@voltro/cms 0.85.0 → 0.87.0

package/dist/outputDeploymentService.js

@@ -0,0 +1,241 @@
+import { lockSiteState as e } from "./siteState.js";
+import { lockPublicationStream as t } from "./changes.js";
+import { OutputActivationUnavailable as n, copyOutputActivationApp as r, copyOutputActivationScope as i, copyOutputActivationSet as a, makeOutputRegionReceipt as o, verifyOutputActivationProbe as s, verifyOutputRegionReceipts as c } from "./outputActivation.js";
+import { lockRenderReadCredential as l, readRenderReadCredential as u } from "./renderReadAuthority.js";
+import { activateOutputSet as d, lockOutputRouteHistoryCapture as f, probeOutputActivation as p, readOutputActivationMarker as m } from "./outputActivationStore.js";
+import { bindOutputDeployment as h, readOutputDeployment as g } from "./outputDeployment.js";
+import { Effect as _, Schema as v } from "effect";
+import { canonicalJson as y, dataStoreApiKeyStore as b, makeApiKeyService as x } from "@voltro/runtime";
+//#region src/outputDeploymentService.ts
+var S = "cms:deploy", C = class extends v.TaggedError()("CmsOutputDeploymentUnavailable", { reason: v.Literals([
+	"configuration",
+	"credential",
+	"input",
+	"integrity",
+	"state",
+	"changed",
+	"generation",
+	"regions",
+	"denied",
+	"expired",
+	"unadmitted"
+]) }) {}, w = (e) => {
+	throw new C({ reason: e });
+}, T = (e, t) => y(e) === y(t), E = (e) => {
+	if (!Number.isSafeInteger(e.expectedRevision) || e.expectedRevision < 0 || e.expectedRevision >= 2147483647 || !Number.isSafeInteger(e.expectedGeneration) || e.expectedGeneration < 0 || e.expectedGeneration >= 2147483647 || !["forward", "rollback"].includes(e.mode) || !Array.isArray(e.outputs) || e.outputs.length < 1 || e.outputs.length > 64) return w("input");
+	let t = e.outputs.map((e) => typeof e != "object" || !e || typeof e.region != "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(e.region) || typeof e.outputId != "string" || !/^[a-f0-9]{64}$/.test(e.outputId) ? w("input") : {
+		region: e.region,
+		outputId: e.outputId
+	}).sort((e, t) => e.region < t.region ? -1 : +(e.region > t.region));
+	return new Set(t.map((e) => e.region)).size === t.length ? t : w("regions");
+}, D = (e) => !/^[A-Za-z0-9_-]{1,64}$/.test(e.id) || !(e.material instanceof Uint8Array) || e.material.byteLength < 32 ? w("configuration") : {
+	id: e.id,
+	material: new Uint8Array(e.material)
+}, O = (e, r, a) => {
+	let o = i(r), s = (e) => _.tryPromise({
+		try: e,
+		catch: (e) => e instanceof C ? e : new C({ reason: e instanceof n ? e.reason : "state" })
+	}), c = async (e, t, n, r) => {
+		n.throwIfAborted();
+		let i = await l(e, o, t, a());
+		return i === null || !i.scopes.includes("cms:deploy") || r !== void 0 && i.id !== r ? w("credential") : (n.throwIfAborted(), i.id);
+	};
+	return {
+		boundary: s,
+		authorize: c,
+		transaction: async (n, r, i) => {
+			r.throwIfAborted();
+			let s = await e.transactional((e) => u(e, o, n, a()));
+			return s === null || !s.scopes.includes("cms:deploy") ? w("credential") : e.transactional(async (e) => {
+				await f(e, o), await t(e, o);
+				let l = await c(e, n, r, s.id), u = await x(b(e)).verify(n, a());
+				if (u === null || u.id !== l) return w("credential");
+				await c(e, n, r, l);
+				let d = await i(e, l);
+				return await c(e, n, r, l), d;
+			});
+		}
+	};
+}, k = (t) => {
+	let n = i(t.scope), l = t.store, u = t.now ?? Date.now, f = D(t.key), _ = [f, ...(t.verificationKeys ?? []).map(D)];
+	if (new Set(_.map((e) => e.id)).size !== _.length) return w("configuration");
+	let v = Object.fromEntries(Object.entries(t.regions).map(([e, t]) => {
+		if (!/^[A-Za-z0-9_-]{1,64}$/.test(e) || typeof t.verify != "function") return w("configuration");
+		let n = D(t.key), r = [n, ...(t.verificationKeys ?? []).map(D)];
+		return new Set(r.map((e) => e.id)).size === r.length ? [e, {
+			key: n,
+			keys: r,
+			verify: t.verify.bind(t)
+		}] : w("configuration");
+	})), y = Object.fromEntries(Object.entries(v).map(([e, t]) => [e, t.keys])), b = t.readDeployment.bind(t), x = t.readSet.bind(t), S = t.admit.bind(t), C = t.readRoutes.bind(t), { boundary: k, authorize: A, transaction: j } = O(l, n, u), M = async (e, t) => {
+		if (!/^[a-f0-9]{64}$/.test(t)) return w("input");
+		let r = a(await x(e, t));
+		return r.id !== t || !T(r.manifest.scope, n) || r.manifest.regions.required.some((e) => !Object.hasOwn(v, e)) ? w("changed") : r;
+	}, N = (e) => structuredClone(e), P = async (e, t) => {
+		let n = await M(e, t), i = await b(e, n.manifest.app.deploymentId);
+		return !T(r(i.app), n.manifest.app) || i.renderPolicyDigest !== n.manifest.renderPolicyDigest ? w("changed") : n;
+	}, F = async (e, t, r, i) => {
+		let a = await g(e, n), o = await m(e, n, {
+			keys: _,
+			regionKeys: y
+		});
+		return a?.revision === r.expectedRevision + 1 && o?.generation === r.expectedGeneration + 1 && T(a.app, t.manifest.app) && a.renderPolicyDigest === t.manifest.renderPolicyDigest && T(o.set, t) && o.probe.mode === r.mode && T(o.receipts.map(({ region: e, outputId: t }) => ({
+			region: e,
+			outputId: t
+		})).sort((e, t) => e.region < t.region ? -1 : +(e.region > t.region)), i) ? {
+			deployment: a,
+			activation: o
+		} : null;
+	};
+	return {
+		inspect: (e) => {
+			let t = N(e);
+			return k((e) => j(t.credential, e, async (e) => {
+				let t = await g(e, n), r = await m(e, n, {
+					keys: _,
+					regionKeys: y
+				});
+				return {
+					revision: t?.revision ?? 0,
+					generation: r?.generation ?? 0
+				};
+			}));
+		},
+		deploy: (e) => {
+			let t = N(e);
+			return k(async (e) => {
+				let r = E(t), i = await j(t.credential, e, async (e) => {
+					let n = await M(e, t.targetId);
+					return T(r.map((e) => e.region), n.manifest.regions.required) ? {
+						set: n,
+						prior: await F(e, n, t, r)
+					} : w("regions");
+				});
+				return i.prior === null ? (await Promise.all(r.map((e) => v[e.region].verify(l, i.set, e.outputId))), j(t.credential, e, async (a, s) => {
+					let c = await M(a, t.targetId);
+					if (!T(c, i.set)) return w("changed");
+					let l = await F(a, c, t, r);
+					if (l !== null) return l;
+					await P(a, t.targetId), await A(a, t.credential, e, s);
+					let m = await h(a, n, {
+						expectedRevision: t.expectedRevision,
+						app: c.manifest.app,
+						renderPolicyDigest: c.manifest.renderPolicyDigest
+					}), g = async (...n) => {
+						await A(a, t.credential, e, s);
+						let r = await S(...n);
+						return await A(a, t.credential, e, s), r;
+					}, b = await p(a, c, {
+						expectedGeneration: t.expectedGeneration,
+						mode: t.mode,
+						key: f,
+						now: u(),
+						ttlMs: 3e4,
+						admit: g
+					}), x = r.map((e) => o(b, e.region, v[e.region].key, e.outputId));
+					return {
+						deployment: m,
+						activation: await d(a, c, {
+							probe: b,
+							keys: _,
+							regionKeys: y,
+							receipts: x,
+							now: u(),
+							admit: g,
+							readRoutes: C
+						})
+					};
+				})) : i.prior;
+			});
+		},
+		confirm: (e) => {
+			let t = N(e);
+			return k(async (e) => {
+				let n = E(t);
+				return j(t.credential, e, async (e) => {
+					let r = await M(e, t.targetId);
+					return T(n.map((e) => e.region), r.manifest.regions.required) ? await F(e, r, t, n) ?? w("changed") : w("regions");
+				});
+			});
+		},
+		bind: (t) => {
+			let i = N(t);
+			return k((t) => j(i.credential, t, async (a, o) => {
+				if (!/^[A-Za-z0-9_-]{1,64}$/.test(i.deploymentId)) return w("input");
+				let s = await b(a, i.deploymentId), c = r(s.app);
+				if (c.deploymentId !== i.deploymentId) return w("changed");
+				await A(a, i.credential, t, o), await e(a, n);
+				let l = await g(a, n, { lock: "update" });
+				if (l !== null && l.revision === i.expectedRevision + 1 && T(l.app, c) && l.renderPolicyDigest === s.renderPolicyDigest) return await A(a, i.credential, t, o), l;
+				let u = await h(a, n, {
+					expectedRevision: i.expectedRevision,
+					app: c,
+					renderPolicyDigest: s.renderPolicyDigest
+				});
+				return await A(a, i.credential, t, o), u;
+			}));
+		},
+		probe: (e) => {
+			let t = N(e);
+			return k((e) => j(t.credential, e, async (n, r) => {
+				let i = await M(n, t.targetId), a = await p(n, i, {
+					expectedGeneration: t.expectedGeneration,
+					mode: t.mode,
+					key: f,
+					now: u(),
+					ttlMs: 3e4,
+					admit: async (...i) => {
+						await A(n, t.credential, e, r);
+						let a = await S(...i);
+						return await A(n, t.credential, e, r), a;
+					}
+				});
+				return await A(n, t.credential, e, r), a;
+			}));
+		},
+		observeRegion: (e) => {
+			let t = N(e);
+			return k(async (e) => {
+				let r = await j(t.credential, e, async (e, r) => {
+					let i = await M(e, t.targetId), a = s(t.probe, _, u()), o = v[t.region];
+					return a.targetId !== i.id || !T(a.scope, n) || !i.manifest.regions.required.includes(t.region) || o === void 0 || !/^[a-f0-9]{64}$/.test(t.outputId) ? w("regions") : {
+						parent: r,
+						set: i,
+						proof: a,
+						port: o
+					};
+				});
+				return await r.port.verify(l, r.set, t.outputId), j(t.credential, e, async (e, n) => n === r.parent ? T(await M(e, t.targetId), r.set) ? (s(r.proof, _, u()), o(r.proof, t.region, r.port.key, t.outputId)) : w("changed") : w("credential"));
+			});
+		},
+		activate: (e) => {
+			let t = N(e);
+			return k((e) => j(t.credential, e, async (r, i) => {
+				let a = await M(r, t.targetId), o = await m(r, n, {
+					keys: _,
+					regionKeys: y
+				});
+				if (o?.probe.id === t.probe.id) {
+					let n = s(t.probe, _, o.activatedAt), l = c(a, n, t.receipts, y), u = (e) => [...e].sort((e, t) => e.region < t.region ? -1 : +(e.region > t.region));
+					return o.set.id !== a.id || !T(o.probe, n) || !T(u(o.receipts), u(l)) ? w("changed") : (await A(r, t.credential, e, i), o);
+				}
+				let l = await d(r, a, {
+					probe: t.probe,
+					keys: _,
+					regionKeys: y,
+					receipts: t.receipts,
+					now: u(),
+					admit: async (...n) => {
+						await A(r, t.credential, e, i);
+						let a = await S(...n);
+						return await A(r, t.credential, e, i), a;
+					},
+					readRoutes: C
+				});
+				return await A(r, t.credential, e, i), l;
+			}));
+		}
+	};
+};
+//#endregion
+export { S as CMS_OUTPUT_DEPLOY_SCOPE, C as CmsOutputDeploymentUnavailable, O as createCmsOutputDeploymentAuthority, k as createCmsOutputDeployments };

package/dist/outputRouteGraph.js

@@ -0,0 +1,177 @@
+import { OutputActivationUnavailable as e } from "./outputActivation.js";
+import { copyObservedRoutes as t } from "./routeHistoryStorage.js";
+import { copySnapshotResource as n } from "./buildSnapshot.js";
+import { nativeSnapshotRouteId as r, snapshotRouteDispatch as i } from "./snapshotRouting.js";
+import { copyRouteDispositionDefinition as a } from "./routeDispositions.js";
+import { iterateApprovedRouteDispositions as o } from "./routeDispositionStore.js";
+import { readPublicRouteHistoryView as s } from "./publicRouteHistoryView.js";
+import { verifyStaticPathPage as ee, verifyStaticPathSet as te } from "./staticPathSet.js";
+import { iterateRouteHistory as c, readRouteHistoryPage as ne } from "./routeHistoryStore.js";
+import { readOutputSafetyPage as l } from "./outputActivationStore.js";
+import { admitCapturedAssetUseRights as u } from "./assetUseRights.js";
+import { isPrivateNativeRouteReservation as d } from "./privateNativeRouteReservation.js";
+import { planExactRouteDispositions as f } from "./routeDispositionGraph.js";
+import { canonicalJson as p } from "@voltro/runtime";
+//#region src/outputRouteGraph.ts
+var m = (t) => {
+	throw new e({ reason: t });
+}, h = (e, t) => {
+	if (typeof e != "object" || !e || Array.isArray(e) || ![Object.prototype, null].includes(Object.getPrototypeOf(e)) || Object.getOwnPropertySymbols(e).length > 0) return m("input");
+	let n = Object.getOwnPropertyDescriptors(e);
+	return Object.keys(n).sort().join(",") !== t || Object.values(n).some((e) => !e.enumerable || !("value" in e)) ? m("input") : e;
+}, g = (e, t = 1e5) => {
+	if (!Array.isArray(e) || e.length > t || Object.getOwnPropertySymbols(e).length > 0 || Object.keys(e).length !== e.length) return m("input");
+	for (let t = 0; t < e.length; t++) {
+		let n = Object.getOwnPropertyDescriptor(e, String(t));
+		if (n === void 0 || !n.enumerable || !("value" in n)) return m("input");
+	}
+	return e;
+}, _ = (e) => typeof e == "string" && /^[a-f0-9]{64}$/.test(e), v = () => {
+	let e = 2;
+	return (t) => {
+		if (e += Buffer.byteLength(p(t)) + 1, e > 67108864) return m("input");
+	};
+}, y = async (e, y, b, x) => {
+	let S = h(b, "artifacts,documents,pathSets,producers,redirects,safety"), C = y.manifest.scope, w = x.now ?? Date.now, T = y.manifest.artifacts.map((e) => ({
+		host: e.host,
+		documents: e.documents,
+		redirects: e.redirects,
+		deny: e.deny
+	})), E = g(S.artifacts, 256).map((e) => h(n({
+		key: "host-artifacts",
+		value: { artifacts: e }
+	}).value.artifacts, "deny,documents,host,redirects"));
+	if (p(E) !== p(T)) return m("integrity");
+	let D = g(S.producers, 256).map((e) => h(n({
+		key: "producer",
+		value: { producer: e }
+	}).value.producer, "buildId,consumerId,host"));
+	if (D.length !== y.manifest.paths.length || D.some((e, t) => e.host !== y.manifest.paths[t].host || typeof e.consumerId != "string" || typeof e.buildId != "string")) return m("integrity");
+	let O = new Map(D.map((e) => [e.host, e])), k = new Set(y.manifest.paths.map((e) => e.host)), A = await ne(e, C, {
+		expectedRevision: x.observed.generation,
+		take: 1
+	});
+	if (A.sourceDigest !== x.observed.sourceDigest) return m("changed");
+	let j = [], re = v();
+	for await (let t of c(e, C, A.revision)) {
+		if (re(t), j.length >= 1e5) return m("input");
+		j.push({
+			url: t.url,
+			routeId: t.routeId
+		});
+	}
+	let M = await s(e, C), N = M.namespace.binding;
+	if (y.manifest.paths.some((e) => !M.namespace.domains.some((t) => t.host === e.host))) return m("changed");
+	let P = [], F = [], I = v();
+	for await (let e of M.entries()) {
+		if (I(e), P.length >= 1e5) return m("input");
+		let t = {
+			url: e.url,
+			routeId: e.routeId
+		};
+		P.push(t), e.active && F.push(t);
+	}
+	let L = new Map(F.map((e) => [e.url, e.routeId])), R = [], z = /* @__PURE__ */ new Map(), B = /* @__PURE__ */ new Set(), V = v();
+	for (let e of g(S.pathSets, 256)) {
+		let t = h(e, "pages,set"), n = te(t.set, x.keys), a = n.manifest.context, o = y.manifest.paths.find((e) => e.host === a.host), s = O.get(a.host);
+		if (o === void 0 || s === void 0 || B.has(n.id) || n.id !== o.setId || n.manifest.count !== o.count || a.tenantId !== C.tenantId || a.site !== C.site || a.environment !== C.environment || a.snapshotId !== y.manifest.snapshot.id || a.snapshotDigest !== y.manifest.snapshot.digest || a.releaseId !== y.manifest.snapshot.releaseId || a.inputsId !== y.manifest.app.inputsId || a.executionId !== y.manifest.app.executionId || a.policyDigest !== y.manifest.renderPolicyDigest || a.consumerId !== s.consumerId || a.buildId !== s.buildId || a.host !== o.host || p(a.localeIds) !== p(N.definition.site.locales.filter((e) => e.enabled).map((e) => e.id).sort()) || !a.owners.includes("cms") || !a.owners.includes("code")) return m("integrity");
+		B.add(n.id);
+		let c = g(t.pages, 500);
+		if (c.length !== n.manifest.pages.length) return m("integrity");
+		for (let e = 0; e < c.length; e++) for (let t of ee(n, e, c[e])) {
+			if (V(t), R.length >= 1e5) return m("input");
+			if (t.host !== a.host) return m("integrity");
+			let e = "https://" + t.host + t.path, n = L.get(e), o = i(N.definition.routing, t.path, n !== void 0);
+			if (z.has(e) || !N.definition.site.locales.some((e) => e.enabled && e.id === t.localeId) || o === null || o.owner !== t.owner || n !== void 0 && n !== t.routeId) return m("changed");
+			if (t.owner === "cms") {
+				if (n !== t.routeId) return m("changed");
+			} else {
+				let e = o.code === null ? void 0 : N.definition.routing.definition?.claims[o.code.file];
+				if (e?.kind !== "code" || e.public !== !0 || o.code?.file !== t.file || typeof t.file != "string" || r(C, t.localeId, t.file, t.path) !== t.routeId) return m("changed");
+			}
+			R.push(t), z.set(e, t.routeId);
+		}
+	}
+	let H = /* @__PURE__ */ new Map();
+	for (let e of R) H.set(e.host, (H.get(e.host) ?? 0) + 1);
+	if (B.size !== y.manifest.paths.length || y.manifest.paths.some((e) => (H.get(e.host) ?? 0) !== e.count)) return m("integrity");
+	let U = v(), W = g(S.documents).map((e) => {
+		let r = h(n({
+			key: "document",
+			value: { document: e }
+		}).value.document, "media,routeId,url");
+		U(r);
+		let [i] = t([{
+			url: r.url,
+			routeId: r.routeId
+		}]);
+		if (i === void 0 || z.get(i.url) !== i.routeId) return m("integrity");
+		let a = g(r.media).map((e) => {
+			let t = h(e, "digest,rights");
+			return _(t.digest) ? {
+				digest: t.digest,
+				rights: t.rights
+			} : m("integrity");
+		});
+		return {
+			...i,
+			media: a
+		};
+	});
+	if (new Set(W.map((e) => e.url)).size !== z.size) return m("integrity");
+	let G = h(S.safety, "entries,generation"), K = [], q = v(), J, Y;
+	for (;;) {
+		let t = await l(e, C, {
+			...J === void 0 ? {} : { after: J },
+			...Y === void 0 ? {} : { expectedGeneration: Y }
+		});
+		Y ??= t.generation;
+		for (let e of t.entries) {
+			if (q(e), K.length >= 1e5) return m("input");
+			K.push(e);
+		}
+		if (t.next === null) break;
+		J = t.next;
+	}
+	let ie = g(G.entries).map((e) => n({
+		key: "safety-entry",
+		value: { entry: e }
+	}).value.entry);
+	if (Y !== G.generation || p(K) !== p(ie)) return m("changed");
+	let X = new Set(K.flatMap((e) => e.target.kind === "url" ? [e.target.url] : [])), ae = new Set(K.flatMap((e) => e.target.kind === "asset" ? [e.target.digest] : []));
+	for (let t of W) {
+		if (X.has(t.url)) return m("denied");
+		let n = new URL(t.url);
+		for (let r of t.media) {
+			if (ae.has(r.digest)) return m("denied");
+			await u(e, C, r.rights, w(), x.use({
+				host: n.hostname,
+				path: n.pathname
+			}));
+		}
+	}
+	let Z = [], oe = v();
+	for await (let t of o(e, C)) {
+		if (oe(t.definition), Z.length >= 1e5) return m("input");
+		Z.push(t.definition);
+	}
+	let Q = (e) => k.has(new URL(e.url).hostname), se = [...new Map([...j.filter(Q), ...P.filter(Q)].map((e) => [e.url, e])).values()].filter((e) => d(N.definition.routing, new URL(e.url).pathname, L.has(e.url))), $ = f({
+		observed: j.filter(Q),
+		sourceObserved: P.filter(Q),
+		currentOwned: F.filter(Q),
+		reserved: se,
+		current: R.map((e) => ({
+			url: "https://" + e.host + e.path,
+			routeId: e.routeId
+		})),
+		decisions: Z.filter((e) => k.has(new URL(e.source.url).hostname)),
+		now: w()
+	}), ce = v(), le = g(S.redirects).map((e) => {
+		let t = a(e);
+		return ce(t), t;
+	});
+	if (p(le) !== p($)) return m("changed");
+	for (let e of $) if (X.has(e.source.url) || e.action.kind === "redirect" && X.has(e.action.target.url)) return m("denied");
+};
+//#endregion
+export { y as admitOutputRouteGraph };

package/dist/outputSafetyArtifact.js

@@ -0,0 +1,147 @@
+import { normalizeHost as e } from "./domainHost.js";
+import { copyOutputActivationScope as t } from "./outputActivation.js";
+import { copySnapshotResource as n } from "./buildSnapshot.js";
+import { readOutputSafetyPage as r } from "./outputActivationStore.js";
+import { Schema as i } from "effect";
+import { createHash as a } from "node:crypto";
+import { canonicalJson as o } from "@voltro/runtime";
+//#region src/outputSafetyArtifact.ts
+var s = class extends i.TaggedError()("OutputSafetyArtifactUnavailable", { reason: i.Literals([
+	"binding",
+	"changed",
+	"budget"
+]) }) {}, c = (e) => {
+	throw new s({ reason: e });
+}, l = (e) => a("sha256").update(o(e)).digest("hex"), u = (e) => typeof e == "string" && /^[a-f0-9]{64}$/.test(e), d = (e) => typeof e == "string" && /^[A-Za-z0-9_-]{1,64}$/.test(e), f = (e, t) => !e || typeof e != "object" || Array.isArray(e) || Object.keys(e).sort().join(",") !== t ? c("binding") : e, p = (t) => {
+	let r = f(n({
+		key: "safety-binding",
+		value: { binding: t }
+	}).value.binding, "app,buildId,consumerId,documents,host,snapshot"), i = f(r.snapshot, "digest,id"), a = f(r.app, "executionId,inputsId"), o = f(r.documents, "artifactId,pathSetIds");
+	return !d(i.id) || !u(i.digest) || !u(a.inputsId) || !u(a.executionId) || !u(o.artifactId) || !Array.isArray(o.pathSetIds) || o.pathSetIds.length < 1 || o.pathSetIds.length > 64 || !o.pathSetIds.every(u) || new Set(o.pathSetIds).size !== o.pathSetIds.length || !d(r.consumerId) || !d(r.buildId) || typeof r.host != "string" || r.host.length > 253 || e(r.host) !== r.host ? c("binding") : {
+		snapshot: {
+			id: i.id,
+			digest: i.digest
+		},
+		app: {
+			inputsId: a.inputsId,
+			executionId: a.executionId
+		},
+		documents: {
+			artifactId: o.artifactId,
+			pathSetIds: [...o.pathSetIds].sort()
+		},
+		consumerId: r.consumerId,
+		buildId: r.buildId,
+		host: r.host
+	};
+}, m = (e) => {
+	let t = f(n({
+		key: "safety-selection",
+		value: { selection: e }
+	}).value.selection, "artifactId");
+	return u(t.artifactId) ? { artifactId: t.artifactId } : c("binding");
+}, h = (e) => !Number.isSafeInteger(e) || e < 1 ? c("budget") : Math.min(e, 67108864), g = async (e, n, i) => {
+	let a = t(n), s = h(i.maxBytes), l = i.expectedGeneration, u, d = 0, f = [];
+	for (;;) {
+		let t = await e.transactional((e) => r(e, a, {
+			...l === void 0 ? {} : { expectedGeneration: l },
+			...u === void 0 ? {} : { after: u }
+		}));
+		if (l ??= t.generation, l > 1e5) return c("budget");
+		for (let e of t.entries) {
+			if (d += Buffer.byteLength(o(e), "utf8") + 1, d > s) return c("budget");
+			f.push(e);
+		}
+		if (t.next === null) break;
+		u = t.next;
+	}
+	return f.length === l ? {
+		generation: l,
+		entries: f
+	} : c("changed");
+}, _ = (e, t) => Buffer.from(o({
+	version: 1,
+	generation: e.generation,
+	index: t,
+	entries: e.entries.slice(t * 500, (t + 1) * 500)
+}) + "\n", "utf8"), v = (e, t) => {
+	let n = [], r = 0;
+	for (let i = 0; i < Math.max(1, Math.ceil(e.entries.length / 500)); i++) {
+		let o = _(e, i);
+		if (r += o.length, r > t) return c("budget");
+		n.push({
+			path: "safety/" + String(i).padStart(5, "0") + ".json",
+			size: o.length,
+			digest: a("sha256").update(o).digest("hex"),
+			contentType: "application/json"
+		});
+	}
+	return n;
+}, y = (e, t, n) => ({
+	version: 1,
+	profile: "voltro.cms.snapshot-safety-output/v1",
+	kind: "deny",
+	...e,
+	...t,
+	generation: n.generation,
+	entryCount: n.entries.length,
+	chunkCount: Math.max(1, Math.ceil(n.entries.length / 500)),
+	safetyDigest: l(n.entries)
+}), b = async (e, n, r) => {
+	let i = t(n), a = h(r.maxBytes), s = r.admit, d = r.provider, f = p(await e.transactional((e) => s(e))), m = await g(e, i, { maxBytes: a }), b = l(m.entries), x = v(m, a), S;
+	try {
+		S = await d.begin();
+		for (let e = 0; e < x.length; e++) {
+			let t = _(m, e);
+			await S.write(x[e], (async function* () {
+				yield t;
+			})());
+		}
+		let t = p(await e.transactional((e) => s(e)));
+		if (o(t) !== o(f) || l((await g(e, i, {
+			maxBytes: a,
+			expectedGeneration: m.generation
+		})).entries) !== b) return c("changed");
+		let n = await S.seal(y(i, f, m));
+		return u(n.id) ? {
+			artifactId: n.id,
+			generation: m.generation,
+			entryCount: m.entries.length
+		} : c("binding");
+	} catch (e) {
+		throw S !== void 0 && await Promise.allSettled([S.abort()]), e;
+	}
+}, x = async (e, r, i, a) => {
+	if (!u(i)) return c("binding");
+	let s = t(r), d = h(a.maxBytes), m = a.provider.read?.bind(a.provider);
+	if (m === void 0) return c("binding");
+	let _ = p(await e.transactional((e) => a.admit(e))), b = await g(e, s, { maxBytes: d }), x = {
+		version: 1,
+		subject: y(s, _, b),
+		files: v(b, d)
+	};
+	if (l(x) !== i) return c("binding");
+	let S = f(n({
+		key: "safety-artifact",
+		value: { artifact: await m(i) }
+	}).value.artifact, "id,manifest");
+	if (S.id !== i || o(S.manifest) !== o(x)) return c("binding");
+	let C = p(await e.transactional((e) => a.admit(e)));
+	return o(C) !== o(_) || l((await g(e, s, {
+		maxBytes: d,
+		expectedGeneration: b.generation
+	})).entries) !== l(b.entries) ? c("changed") : {
+		verification: {
+			...b,
+			artifactId: i,
+			safetyDigest: l(b.entries),
+			binding: _
+		},
+		artifact: {
+			id: i,
+			manifest: x
+		}
+	};
+}, S = async (...e) => (await x(...e)).verification;
+//#endregion
+export { s as OutputSafetyArtifactUnavailable, b as captureOutputSafetyArtifact, m as copyOutputSafetySelection, x as readCurrentOutputSafetyArtifact, g as readOutputSafetySnapshot, S as readVerifiedOutputSafetyArtifact };

package/dist/outputTargetRest.js

@@ -0,0 +1,62 @@
+import { cmsCredential as e, privateCmsHttpRoutes as t, privateCmsOperation as n } from "./privateCmsTransport.js";
+import { CmsOutputDeploymentUnavailable as r } from "./outputDeploymentService.js";
+import { outputDeploymentManifestSchema as i } from "./outputDeploymentRest.js";
+import { Schema as a } from "effect";
+import { strictInput as o } from "@voltro/protocol";
+//#region src/outputTargetRest.ts
+var s = a.String.check(a.isPattern(/^[A-Za-z0-9_-]{1,64}$/)), c = a.String.check(a.isPattern(/^[a-f0-9]{64}$/)), l = a.String.check(a.isMaxLength(253)), u = a.Struct({
+	deploymentId: s,
+	snapshot: a.Struct({
+		id: s,
+		digest: c
+	}),
+	pathSets: a.Array(a.Struct({
+		host: l,
+		jobId: s,
+		digest: c
+	})).check(a.isMaxLength(256)),
+	artifacts: a.Array(a.Struct({
+		host: l,
+		documents: c,
+		assets: c,
+		redirects: c,
+		sitemap: c,
+		robots: c,
+		deny: c
+	})).check(a.isMaxLength(256))
+}), d = a.Struct({
+	set: a.Struct({
+		id: c,
+		manifest: i
+	}),
+	pathSets: a.Array(a.Struct({
+		host: l,
+		jobId: s
+	})),
+	outputs: a.Array(a.Struct({
+		region: s,
+		outputId: c
+	}))
+}), f = (i) => {
+	let a = [{
+		...n({
+			namespace: "cms.outputTarget",
+			path: "/v1/cms/output-targets",
+			operationPrefix: "cmsOutputTarget",
+			tags: ["CMS output deployment"],
+			error: r,
+			credentialError: "CmsOutputDeploymentUnavailable",
+			errorStatus: { CmsOutputDeploymentUnavailable: 409 }
+		}, "prepare", "Prepare one original complete output target", "Scoped cms:deploy credential. The server derives app, schema, binding and cache contracts from the actual retained snapshot and verifies original signed path jobs. Fixed server ports stage and rehash all six roles in every required region. Metadata alone grants no activation or serving authority.", o(u, "cms.outputTarget.prepare", !0), d, (t, n) => i.prepare({
+			...t,
+			credential: e(n, "CmsOutputDeploymentUnavailable")
+		})),
+		maxBodyBytes: 524288
+	}];
+	return {
+		routes: a,
+		httpRoutes: t(a)
+	};
+};
+//#endregion
+export { f as cmsOutputTargetRest };

package/dist/pathSegmentEncoding.js

@@ -0,0 +1,4 @@
+//#region src/pathSegmentEncoding.ts
+var e = (e) => encodeURIComponent(e);
+//#endregion
+export { e as encodeCanonicalPathSegment };