@voltro/cms 0.85.0 → 0.87.0

package/dist/presenceAnchors.js

@@ -0,0 +1,68 @@
+//#region src/presenceAnchors.ts
+var e = /^[A-Za-z0-9_.:/-]{1,120}$/, t = (t) => typeof t == "string" && e.test(t), n = (e) => Number.isInteger(e) && e >= 0 && e <= 1e6, r = (e) => typeof e == "number" && Number.isFinite(e) && e >= 0 && e <= 1, i = (e) => {
+	if (typeof e != "object" || !e) return null;
+	let i = e;
+	switch (i.kind) {
+		case "view": return t(i.view) ? {
+			kind: "view",
+			view: i.view
+		} : null;
+		case "field": return t(i.field) ? {
+			kind: "field",
+			field: i.field
+		} : null;
+		case "component": return t(i.field) && t(i.instanceId) && t(i.componentId) ? {
+			kind: "component",
+			field: i.field,
+			instanceId: i.instanceId,
+			componentId: i.componentId
+		} : null;
+		case "slot": return t(i.field) && t(i.instanceId) && t(i.componentId) && t(i.prop) ? {
+			kind: "slot",
+			field: i.field,
+			instanceId: i.instanceId,
+			componentId: i.componentId,
+			prop: i.prop
+		} : null;
+		case "selection": return t(i.field) && n(i.start) && n(i.end) && i.end >= i.start ? {
+			kind: "selection",
+			field: i.field,
+			start: i.start,
+			end: i.end
+		} : null;
+		case "assetRegion": return r(i.x) && r(i.y) && r(i.width) && r(i.height) && i.x + i.width <= 1 && i.y + i.height <= 1 ? {
+			kind: "assetRegion",
+			x: i.x,
+			y: i.y,
+			width: i.width,
+			height: i.height
+		} : null;
+		default: return null;
+	}
+}, a = (e) => {
+	let t = e;
+	if (typeof t != "object" || !t || typeof t.closest != "function") return null;
+	let n = t.closest("[data-cms-field]"), r = t.closest("[data-cms-instance]");
+	if (r != null) {
+		let e = r.parentElement?.closest?.("[data-cms-field]") ?? null, t = e?.getAttribute("data-cms-field") ?? null, a = r.getAttribute("data-cms-instance"), o = r.getAttribute("data-cms-component"), s = n != null && n !== e ? n.getAttribute("data-cms-field") : null;
+		if (t !== null && a !== null && o !== null) return i(s === null ? {
+			kind: "component",
+			field: t,
+			instanceId: a,
+			componentId: o
+		} : {
+			kind: "slot",
+			field: t,
+			instanceId: a,
+			componentId: o,
+			prop: s
+		});
+	}
+	let a = n?.getAttribute("data-cms-field") ?? null;
+	return a === null ? null : i({
+		kind: "field",
+		field: a
+	});
+};
+//#endregion
+export { i as parsePresenceAnchor, a as presenceAnchorOf };

package/dist/preview.js

@@ -0,0 +1,31 @@
+import { createHmac as e, timingSafeEqual as t } from "node:crypto";
+//#region src/preview.ts
+var n = 3600, r = (e) => (Buffer.isBuffer(e) ? e : Buffer.from(e, "utf8")).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), i = (e) => Buffer.from(e.replace(/-/g, "+").replace(/_/g, "/"), "base64"), a = (e) => e ?? process.env.VOLTRO_SESSION_SECRET ?? null, o = (t, i, o = {}) => {
+	let s = a(o.secret);
+	if (s === null) throw Error("cms previewToken requires a signing secret — set VOLTRO_SESSION_SECRET or pass { secret }. Refusing to sign with a hardcoded default (it would ship in the bundle and be forgeable).");
+	let c = {
+		t,
+		i,
+		exp: Math.floor(Date.now() / 1e3) + (o.ttlSeconds ?? n)
+	}, l = r(JSON.stringify(c));
+	return `${l}.${r(e("sha256", s).update(l).digest())}`;
+}, s = (n, r = {}) => {
+	if (!n) return null;
+	let o = a(r.secret);
+	if (o === null) return null;
+	let s = n.indexOf(".");
+	if (s <= 0 || s === n.length - 1) return null;
+	let c = n.slice(0, s), l = n.slice(s + 1), u = e("sha256", o).update(c).digest(), d = i(l);
+	if (d.length !== u.length || !t(d, u)) return null;
+	try {
+		let e = JSON.parse(i(c).toString("utf8"));
+		return typeof e.t != "string" || typeof e.i != "string" || typeof e.exp != "number" || e.exp < Math.floor(Date.now() / 1e3) ? null : {
+			type: e.t,
+			id: e.i
+		};
+	} catch {
+		return null;
+	}
+};
+//#endregion
+export { o as previewToken, s as verifyPreviewToken };

package/dist/privateCmsTransport.js

@@ -0,0 +1,76 @@
+import { Effect as e } from "effect";
+import { defineAction as t } from "@voltro/protocol";
+import { RestRouteError as n, projectedFailure as r, publicApiRoute as i, restError as a, restRoutesToHttpRoutes as o } from "@voltro/protocol/rest";
+//#region src/privateCmsTransport.ts
+var s = {
+	"cache-control": "private, no-store",
+	pragma: "no-cache",
+	vary: "Authorization"
+}, c = (e) => {
+	let t = e.headers.authorization;
+	return typeof t != "string" || t.length > 520 ? null : /^Bearer ([^\s]+)$/i.exec(t)?.[1] ?? null;
+}, l = (e, t) => c(e) ?? (() => {
+	throw a(401, {
+		error: t,
+		_tag: t,
+		reason: "credential"
+	}, {
+		...s,
+		"www-authenticate": "Bearer"
+	});
+})(), u = (e) => c(e) === null ? {
+	status: 401,
+	message: "CMS credential required"
+} : void 0, d = async (t, i, o) => {
+	let c = await e.runPromise(e.result(t));
+	if (c._tag === "Success") return c.success;
+	let l = c.failure;
+	if (typeof l == "object" && l && "_tag" in l && l._tag === i && "reason" in l && l.reason === "credential") {
+		let e = r(l, o, { errorStatus: { [i]: 401 } });
+		throw e instanceof n ? a(e.status, e.body, {
+			...s,
+			"www-authenticate": "Bearer"
+		}) : e;
+	}
+	throw l;
+}, f = (e, n, r, a, o, s, c) => {
+	let l = `${e.namespace}.${n}`, f = t({
+		name: l,
+		input: o,
+		output: s,
+		error: e.error,
+		openAccess: "Dedicated credential exchange: the header guard and server-bound CMS service verify authority; no ambient Subject grants access.",
+		publicApi: {
+			method: "POST",
+			path: `${e.path}/${n}`,
+			security: "required",
+			idempotent: !1,
+			operationId: `${e.operationPrefix}${n[0].toUpperCase()}${n.slice(1)}`,
+			tags: [...e.tags],
+			errorStatus: e.errorStatus,
+			...Object.hasOwn(e.errorStatus, e.credentialError) ? { additionalErrorStatuses: { [e.credentialError]: [401] } } : {},
+			summary: r,
+			description: a
+		}
+	}), p = i(f, (t, n) => d(c(t, n), e.credentialError, f));
+	return {
+		...p,
+		guards: [...p.guards ?? [], u],
+		maxBodyBytes: 16384
+	};
+}, p = (e) => o(e).map((e) => ({
+	...e,
+	handle: async (...t) => {
+		let n = await e.handle(...t);
+		return {
+			...n,
+			headers: {
+				...n.headers,
+				...s,
+				...n.status === 401 ? { "www-authenticate": "Bearer" } : {}
+			}
+		};
+	}
+}));
+//#endregion
+export { l as cmsCredential, s as privateCmsHeaders, p as privateCmsHttpRoutes, f as privateCmsOperation };

package/dist/privateNativeRouteReservation.js

@@ -0,0 +1,10 @@
+import { snapshotRouteDispatch as e } from "./snapshotRouting.js";
+//#region src/privateNativeRouteReservation.ts
+var t = (t, n, r) => {
+	let i = e(t, n, r);
+	if (i?.owner !== "code") return !1;
+	let a = t.definition?.claims[i.code.file];
+	return a?.kind !== "code" || a.public !== !0;
+};
+//#endregion
+export { t as isPrivateNativeRouteReservation };

package/dist/promotion.js

@@ -0,0 +1,116 @@
+import { PublicRouteRegistryUnavailable as e } from "./publicRouteRegistry.js";
+import { ChangeFeedUnavailable as t, ContentIdConflict as n, ContentNotFound as r, ContentValidationFailed as i, ReferenceUnavailable as a, ReleaseNotEditable as o, ReviewRequired as s, RevisionMismatch as c } from "./errors.js";
+import { asTyped as l } from "./effectForm.js";
+import { pickDeclared as u } from "./contentValues.js";
+import { withPublicRouteStateMutation as d } from "./publicRouteMutation.js";
+import { saveDraft as f } from "./write.js";
+import { addToRelease as p, createRelease as m, publishRelease as h } from "./release.js";
+import { lockEnvironmentPairForPublication as g } from "./environments.js";
+import { and as _, eq as v, neq as y } from "@voltro/database";
+//#region src/promotion.ts
+var b = (e, t, n, r, i = []) => e.query({
+	table: t,
+	predicate: _(v("site", n), v("environment", r), y("status", "archived"), ...i),
+	order: [{
+		column: "id",
+		direction: "asc"
+	}],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), x = (e) => JSON.stringify(e, (e, t) => typeof t == "object" && t && !Array.isArray(t) && !(t instanceof Date) ? Object.fromEntries(Object.entries(t).sort(([e], [t]) => e < t ? -1 : 1)) : t), S = (e) => {
+	for (let t of [
+		"title",
+		"name",
+		"slug"
+	]) if (typeof e[t] == "string" && e[t] !== "") return e[t];
+	return String(e.documentId);
+}, C = (e) => `${String(e.documentId)}\u0000${String(e.locale)}`, w = async (e, t, n) => {
+	let r = [];
+	for (let i of t) {
+		let t = await b(e, `${i.name}_published`, n.site, n.from);
+		if (t.length === 0) continue;
+		let a = new Map((await b(e, `${i.name}_published`, n.site, n.to)).map((e) => [C(e), e])), o = new Map((await b(e, `${i.name}_drafts`, n.site, n.to)).map((e) => [C(e), e]));
+		for (let e of t) {
+			let t = a.get(C(e)), n = o.get(C(e)), s = {
+				contentType: i.name,
+				documentId: String(e.documentId),
+				locale: String(e.locale),
+				title: S(e)
+			};
+			n !== void 0 && n.status === "draft" ? r.push({
+				...s,
+				change: "blocked"
+			}) : t === void 0 ? r.push({
+				...s,
+				change: "new"
+			}) : x(u(i, e)) !== x(u(i, t)) && r.push({
+				...s,
+				change: "changed"
+			});
+		}
+	}
+	return r;
+}, T = async (e, n, r, i, a) => {
+	if (i.length === 0) return {
+		ok: !1,
+		reason: "nothingSelected",
+		items: []
+	};
+	let o = await g(e, n, r), s = await w(e, n, r), c = new Map(s.map((e) => [`${e.contentType}\u0000${e.documentId}\u0000${e.locale}`, e])), l = i.filter((e) => !c.has(`${e.contentType}\u0000${e.documentId}\u0000${e.locale}`));
+	if (l.length > 0) return {
+		ok: !1,
+		reason: "notInPlan",
+		items: l
+	};
+	let _ = i.filter((e) => c.get(`${e.contentType}\u0000${e.documentId}\u0000${e.locale}`).change === "blocked");
+	if (_.length > 0) return {
+		ok: !1,
+		reason: "blocked",
+		items: _
+	};
+	let y = new Map(n.map((e) => [e.name, e]));
+	return d(e, async () => {
+		let s = await m(e, {
+			name: a.name,
+			site: r.site,
+			environment: r.to
+		}), c = String(s.id);
+		for (let n of i) {
+			let i = y.get(n.contentType), [a] = await b(e, `${i.name}_published`, r.site, r.from, [v("documentId", n.documentId), v("locale", n.locale)]), s = {
+				site: r.site,
+				environment: r.to,
+				locale: n.locale
+			}, [l] = await b(e, `${i.name}_drafts`, r.site, r.to, [v("documentId", n.documentId), v("locale", n.locale)]);
+			if (o === null || a === void 0 || a.tenantId !== o.tenantId) throw new t({ reason: "scope" });
+			let d = u(i, a), m = await f(e, i, l === void 0 ? {
+				...d,
+				documentId: n.documentId
+			} : {
+				...d,
+				id: l.id
+			}, s);
+			await p(e, c, {
+				type: i,
+				id: String(m.id),
+				locale: n.locale,
+				revisionId: String(m.revisionId)
+			});
+		}
+		return await h(e, n, c), {
+			ok: !0,
+			releaseId: c,
+			promoted: i.length
+		};
+	});
+}, E = [
+	i,
+	n,
+	r,
+	c,
+	o,
+	s,
+	a
+], D = (...e) => l(() => w(...e), ...E), O = (...n) => l(() => T(...n), ...E, t, e);
+//#endregion
+export { w as planPromotion, D as planPromotionEffect, T as promote, O as promoteEffect };

package/dist/publicBuild.js

@@ -0,0 +1,90 @@
+import { encodeCanonicalPathSegment as e } from "./pathSegmentEncoding.js";
+//#region src/publicBuild.ts
+var t = class extends Error {
+	reason;
+	_tag = "CmsPublicBuildUnavailable";
+	constructor(e) {
+		super("Public build unavailable: " + e), this.reason = e;
+	}
+}, n = (e) => {
+	throw new t(e);
+}, r = (e) => typeof e == "string" && /^[a-f0-9]{64}$/.test(e), i = (e) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) return n("identity");
+	let t = e;
+	return Object.keys(t).sort().join(",") !== "executionId,inputsId,snapshotDigest,version" || t.version !== 1 || !r(t.snapshotDigest) || !r(t.inputsId) || !r(t.executionId) ? n("identity") : {
+		version: 1,
+		snapshotDigest: t.snapshotDigest,
+		inputsId: t.inputsId,
+		executionId: t.executionId
+	};
+}, a = (e) => {
+	let t = i(e);
+	return [
+		"1",
+		t.snapshotDigest,
+		t.inputsId,
+		t.executionId
+	].join(".");
+}, o = (e) => {
+	if (typeof e != "string" || !/^1\.[a-f0-9]{64}\.[a-f0-9]{64}\.[a-f0-9]{64}$/.test(e)) return n("identity");
+	let [, t, r, a] = e.split(".");
+	return i({
+		version: 1,
+		snapshotDigest: t,
+		inputsId: r,
+		executionId: a
+	});
+}, s = (e = globalThis.document) => {
+	if (e === void 0) return null;
+	let t = e.querySelectorAll("meta[name=\"voltro:cms-build\"]");
+	return t.length === 0 ? null : t.length === 1 ? o(t[0].getAttribute("content") ?? "") : n("identity");
+}, c = (e) => `<meta name="voltro:cms-build" content="${a(e)}" />`, l = (t) => {
+	if (typeof t != "string" || t.length > 4096 || !t.startsWith("/") || t.startsWith("//") || /[\\?#\x00-\x20\x7f]/.test(t) || t.slice(1).includes("//")) return n("request");
+	try {
+		if (new URL(t, "https://captured.invalid").pathname !== t) return n("request");
+		let r = t.split("/").map((t) => {
+			let r = decodeURIComponent(t).normalize("NFC");
+			return /[\\/\x00-\x1f\x7f]/.test(r) || r === "." || r === ".." ? n("request") : e(r);
+		}).join("/").replace(/\/$/, "") || "/";
+		return r.length > 4096 ? n("request") : r;
+	} catch {
+		return n("request");
+	}
+}, u = async (e, t, r = {}) => {
+	let o = i(e), s = l(t), c = new URLSearchParams({
+		build: a(o),
+		path: s
+	}), u;
+	try {
+		u = await (r.fetch ?? globalThis.fetch)("/v1/cms/public-build/page?" + c, {
+			method: "GET",
+			credentials: "same-origin",
+			cache: "no-store",
+			redirect: "error",
+			...r.signal === void 0 ? {} : { signal: r.signal }
+		});
+	} catch (e) {
+		if (r.signal?.aborted) throw e;
+		return n("transport");
+	}
+	if (u.status === 409) return n("changed");
+	if (u.status === 404) return n("not-found");
+	if (u.status === 403 || u.status === 410) return n("denied");
+	if (!u.ok || u.headers.get("content-type")?.split(";", 1)[0] !== "application/json") return n("transport");
+	let d;
+	try {
+		d = await u.json();
+	} catch {
+		return n("transport");
+	}
+	if (typeof d != "object" || !d || Array.isArray(d)) return n("request");
+	let f = d;
+	return Object.keys(f).sort().join(",") !== "build,page,path,version" || f.version !== 1 || f.path !== s || a(i(f.build)) !== a(o) ? n("changed") : {
+		version: 1,
+		build: o,
+		path: s,
+		page: f.page
+	};
+};
+//#endregion
+export { t as CmsPublicBuildUnavailable, l as canonicalCmsPublicPath, c as cmsPublicBuildMeta, i as copyCmsPublicBuildIdentity, o as decodeCmsPublicBuildIdentity, a as encodeCmsPublicBuildIdentity, u as loadCmsPublicBuildPage, s as readCmsPublicBuildIdentity };

package/dist/publicBuildRest.js

@@ -0,0 +1,98 @@
+import { CmsPublicBuildUnavailable as e, decodeCmsPublicBuildIdentity as t } from "./publicBuild.js";
+import { Effect as n, Schema as r } from "effect";
+import { defineQuery as i } from "@voltro/protocol";
+import { RestRouteError as a, projectedFailure as o, publicApiRoute as s, restError as c, restRoutesToHttpRoutes as l } from "@voltro/protocol/rest";
+//#region src/publicBuildRest.ts
+var u = {
+	"cache-control": "private, no-store",
+	pragma: "no-cache",
+	vary: "Cookie"
+}, d = r.Struct({
+	version: r.Literal(1),
+	snapshotDigest: r.String,
+	inputsId: r.String,
+	executionId: r.String
+}), f = r.Struct({
+	build: r.String,
+	path: r.String
+}), p = {
+	identity: 400,
+	request: 400,
+	changed: 409,
+	"not-found": 404,
+	denied: 410,
+	transport: 503
+}, m = i({
+	name: "cms.publicBuildPage",
+	input: f,
+	output: r.Struct({
+		version: r.Literal(1),
+		build: d,
+		path: r.String,
+		page: r.Unknown
+	}),
+	error: r.Struct({
+		_tag: r.Literal("CmsPublicBuildUnavailable"),
+		reason: r.Literals([
+			"identity",
+			"request",
+			"changed",
+			"not-found",
+			"denied",
+			"transport"
+		])
+	}),
+	openAccess: "Anonymous presentation from the current independently admitted public output marker. Private read credentials never grant this endpoint.",
+	publicApi: {
+		method: "GET",
+		path: "/v1/cms/public-build/page",
+		security: !1,
+		idempotent: !1,
+		operationId: "cmsPublicBuildPage",
+		tags: ["CMS public builds"],
+		errorStatus: { CmsPublicBuildUnavailable: 409 },
+		additionalErrorStatuses: { CmsPublicBuildUnavailable: [...new Set(Object.values(p))].filter((e) => e !== 409) },
+		summary: "Read a current captured public page presentation",
+		description: "Exact public build selector, admitted request host and canonical path. Active generation, region, output membership, current rights and monotone denies are checked. No live fallback; private no-store including errors."
+	}
+}), h = (t) => {
+	let n = o(new e(t), m, { errorStatus: { CmsPublicBuildUnavailable: p[t] } });
+	throw n instanceof a ? c(n.status, n.body, u) : n;
+}, g = (e, r) => {
+	let i = [s(m, async (i, a) => {
+		let o = i;
+		[...new URLSearchParams(a.query).keys()].sort().join(",") !== "build,path" && h("request");
+		let s = (() => {
+			try {
+				return t(o.build);
+			} catch {
+				return h("identity");
+			}
+		})(), c = r.choices?.(a.headers), l = await n.runPromise(n.result(e.page({
+			build: s,
+			path: o.path,
+			host: r.host(a.headers),
+			...c === void 0 ? {} : { choices: c }
+		})));
+		if (l._tag === "Success") return l.success;
+		h(l.failure.reason);
+	})];
+	return {
+		routes: i,
+		httpRoutes: l(i).map((e) => ({
+			...e,
+			handle: async (...t) => {
+				let n = await e.handle(...t);
+				return {
+					...n,
+					headers: {
+						...n.headers,
+						...u
+					}
+				};
+			}
+		}))
+	};
+};
+//#endregion
+export { g as cmsPublicBuildRest };

package/dist/publicBuildService.js

@@ -0,0 +1,63 @@
+import { normalizeHost as e } from "./domainHost.js";
+import { OutputActivationUnavailable as t } from "./outputActivation.js";
+import { CmsPublicBuildUnavailable as n, canonicalCmsPublicPath as r, copyCmsPublicBuildIdentity as i, encodeCmsPublicBuildIdentity as a } from "./publicBuild.js";
+import { readActiveOutput as o } from "./outputActivationStore.js";
+import { copyPublicConsentChoices as s, selectPublicPresentation as c } from "./publicPresentation.js";
+import { Effect as l } from "effect";
+//#region src/publicBuildService.ts
+var u = (u) => {
+	let d = { ...u.scope }, f = u.keys.map((e) => ({
+		id: e.id,
+		material: new Uint8Array(e.material)
+	})), p = Object.fromEntries(Object.entries(u.regionKeys).map(([e, t]) => [e, t.map((e) => ({
+		id: e.id,
+		material: new Uint8Array(e.material)
+	}))])), m = u.region, h = u.admit, g = u.readPage, _ = u.store;
+	return { page: (v) => l.tryPromise({
+		try: async () => {
+			let t = i(v.build), l = e(v.host), y = r(v.path), b = s(v.choices);
+			if (l !== v.host) throw new n("request");
+			return _.transactional(async (e) => {
+				let r;
+				if (await o(e, d, {
+					kind: "url",
+					url: "https://" + l + y
+				}, {
+					keys: f,
+					regionKeys: p,
+					region: m,
+					lock: "share",
+					admit: async (e, i, o, s) => {
+						let d = {
+							version: 1,
+							snapshotDigest: i.manifest.snapshot.digest,
+							inputsId: i.manifest.app.inputsId,
+							executionId: i.manifest.app.executionId
+						};
+						if (a(d) !== a(t)) throw new n("changed");
+						if (!i.manifest.paths.some((e) => e.host === l)) throw new n("not-found");
+						await h(e, i, o, s);
+						let f = c(await u.readPresentations(e, i, s), b), p = await g(e, i, s, {
+							host: l,
+							path: y,
+							presentation: f
+						});
+						if (!p.found) throw new n("not-found");
+						let m = JSON.stringify(p.page);
+						if (m === void 0 || Buffer.byteLength(m) > 4194304) throw new n("transport");
+						await h(e, i, o, s), r = {
+							version: 1,
+							build: t,
+							path: y,
+							page: JSON.parse(m)
+						};
+					}
+				}) === null || r === void 0) throw new n("not-found");
+				return r;
+			});
+		},
+		catch: (e) => e instanceof n ? e : e instanceof t ? new n(e.reason === "denied" ? "denied" : "changed") : new n("transport")
+	}) };
+};
+//#endregion
+export { u as createCmsPublicBuilds };

package/dist/publicOutputHttp.js

@@ -0,0 +1,129 @@
+import { canonicalCmsPublicPath as e } from "./publicBuild.js";
+import { Effect as t } from "effect";
+import { storageByteSecurityHeaders as n } from "@voltro/plugin-storage/byte-security";
+//#region src/publicOutputHttp.ts
+var r = (r, i) => {
+	if (i.redirects && r.redirect === void 0) throw Error("Missing public redirect service");
+	let a = [
+		...i.documents.map((e) => ({
+			...e,
+			kind: "document"
+		})),
+		{
+			path: "/__voltro/media",
+			match: "prefix",
+			kind: "asset"
+		},
+		{
+			path: "/__voltro/web",
+			match: "prefix",
+			kind: "asset"
+		},
+		...i.controls ? [
+			{
+				path: "/sitemap.xml",
+				match: "exact",
+				kind: "control"
+			},
+			{
+				path: "/robots.txt",
+				match: "exact",
+				kind: "control"
+			},
+			{
+				path: "/sitemaps",
+				match: "prefix",
+				kind: "control"
+			}
+		] : []
+	];
+	if (a.some((t) => e(t.path) !== t.path) || new Set(a.map((e) => e.path)).size !== a.length) throw Error("Invalid public output mounts");
+	return a.map((e) => ({
+		path: e.path,
+		match: e.match,
+		method: "GET",
+		answersOtherMethods: !0,
+		handle: async (a) => {
+			let o = {
+				"cache-control": "private, no-store",
+				pragma: "no-cache",
+				...e.kind === "control" ? {} : { vary: "Cookie" },
+				"x-content-type-options": "nosniff"
+			};
+			if (a.method !== "GET" && a.method !== "HEAD" && !(i.redirects && e.kind === "document")) return {
+				status: 405,
+				headers: {
+					...o,
+					allow: "GET, HEAD"
+				}
+			};
+			let s, c;
+			try {
+				s = i.host(a.headers), c = e.kind === "control" ? void 0 : i.choices?.(a.headers);
+			} catch {
+				return {
+					status: 400,
+					headers: o
+				};
+			}
+			if (i.redirects && e.kind === "document" && r.redirect !== void 0) {
+				let e = await t.runPromise(t.result(r.redirect({
+					host: s,
+					path: a.path,
+					...c === void 0 ? {} : { choices: c }
+				})));
+				if (e._tag === "Success") {
+					let t = e.success;
+					return {
+						status: t.status,
+						headers: {
+							...o,
+							...t.location === null ? {} : { location: t.location },
+							"content-length": "0"
+						}
+					};
+				}
+				let n = e.failure.reason;
+				if (n !== "not-found") return {
+					status: n === "request" || n === "identity" ? 400 : n === "denied" ? 410 : n === "changed" ? 409 : 503,
+					headers: o
+				};
+			}
+			if (a.method !== "GET" && a.method !== "HEAD") return {
+				status: 405,
+				headers: {
+					...o,
+					allow: "GET, HEAD"
+				}
+			};
+			let l = e.kind === "control" ? r.control({
+				host: s,
+				path: a.path
+			}) : r[e.kind]({
+				host: s,
+				path: a.path,
+				...c === void 0 ? {} : { choices: c }
+			}), u = await t.runPromise(t.result(l));
+			if (u._tag === "Failure") {
+				let e = u.failure.reason;
+				return {
+					status: e === "request" || e === "identity" ? 400 : e === "not-found" ? 404 : e === "denied" ? 410 : e === "changed" ? 409 : 503,
+					headers: o
+				};
+			}
+			let d = u.success;
+			return {
+				status: 200,
+				headers: {
+					...o,
+					...e.path === "/__voltro/media" ? n(d.contentType) : {},
+					"content-length": String(d.bytes.byteLength)
+				},
+				contentType: d.contentType,
+				...a.method === "HEAD" ? {} : { body: d.bytes }
+			};
+		}
+	}));
+};
+//#endregion
+export { r as cmsPublicOutputHttp };