@voltro/cms 0.85.0 → 0.87.0

package/dist/references.js

@@ -0,0 +1,173 @@
+import { richDocumentProblems as e, richDocumentReferences as t } from "./richDocument.js";
+import { asTyped as n } from "./effectForm.js";
+import { and as r, eq as i, gt as a, id as o, integer as s, table as c, text as l } from "@voltro/database";
+import { tenant as u } from "@voltro/plugin-multitenancy/mixin";
+//#region src/references.ts
+var d = "cms_references", f = c(d, {
+	id: o({ prefix: "cref" }),
+	sourceType: l().maxLength(64),
+	sourceDocumentId: l().maxLength(64),
+	sourceVariantId: l().maxLength(64),
+	stage: l().maxLength(16).oneOf([
+		"published",
+		"draft",
+		"revision"
+	]).default("published"),
+	revisionId: l().maxLength(64).nullable(),
+	revisionNumber: s().nullable(),
+	site: l().maxLength(64),
+	environment: l().maxLength(64),
+	locale: l().maxLength(64),
+	path: l(),
+	targetType: l().maxLength(64),
+	targetDocumentId: l().maxLength(64)
+}).with(u()).index("cms_references_by_target", [
+	"tenantId",
+	"stage",
+	"site",
+	"environment",
+	"targetType",
+	"targetDocumentId"
+]).index("cms_references_by_source", [
+	"stage",
+	"sourceType",
+	"sourceVariantId",
+	"site",
+	"environment",
+	"locale"
+]), p = (n, r, i, a) => {
+	if (r != null) switch (n.kind) {
+		case "reference":
+			typeof r == "string" && r !== "" && n.referenceType !== void 0 && a.push({
+				path: i,
+				targetType: n.referenceType,
+				targetDocumentId: r
+			});
+			return;
+		case "array":
+			n.element !== void 0 && Array.isArray(r) && r.forEach((e, t) => p(n.element, e, `${i}[${t}]`, a));
+			return;
+		case "struct":
+			if (n.struct !== void 0 && typeof r == "object") for (let [e, t] of Object.entries(n.struct)) p(t, r[e], `${i}.${e}`, a);
+			return;
+		case "richText": {
+			let o = n.richText ?? {};
+			if (e(i, r, o).length > 0) return;
+			let s = r;
+			a.push(...t(i, s, o));
+			let c = new Map((o.profile?.components ?? []).map((e) => [e.id, e]));
+			s.blocks.forEach((e, t) => {
+				let n = e.type === "component" ? c.get(e.componentId) : void 0;
+				if (n !== void 0 && e.type === "component") for (let [r, o] of Object.entries(n.props)) p(o, e.props[r], `${i}.blocks[${t}].props.${r}`, a);
+			});
+			return;
+		}
+		case "components": {
+			if (!Array.isArray(r)) return;
+			let e = new Map((n.components ?? []).map((e) => [e.id, e]));
+			r.forEach((t, n) => {
+				let r = t, o = e.get(String(r.componentId));
+				if (o !== void 0 && typeof r.props == "object" && r.props !== null) for (let [e, t] of Object.entries(o.props)) p(t, r.props[e], `${i}[${n}].props.${e}`, a);
+			});
+			return;
+		}
+		default: return;
+	}
+}, m = (e, t) => {
+	let n = [];
+	for (let [r, i] of Object.entries(e.fields)) p(i, t[r], r, n);
+	return n;
+}, h = (e, t, n, a) => ({
+	table: d,
+	predicate: r(i("sourceType", e.name), i("stage", a), i("sourceVariantId", t), i("site", n.site), i("environment", n.environment), i("locale", n.locale)),
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), g = async (e, t, n, r, i = "published") => {
+	await e.deleteMany(d, { where: h(t, n, r, i).predicate });
+}, _ = async (e, t, n, r, i = "published") => {
+	let a = n.id;
+	await g(e, t, a, r, i), await v(e, t, n, r, i);
+}, v = async (e, t, n, r, i) => {
+	let a = n.id, o = n.tenantId, s = m(t, n).map((e) => ({
+		sourceType: t.name,
+		sourceDocumentId: n.documentId,
+		sourceVariantId: a,
+		stage: i,
+		revisionId: typeof n.revisionId == "string" ? n.revisionId : null,
+		revisionNumber: typeof n.revision == "number" ? n.revision : null,
+		site: r.site,
+		environment: r.environment,
+		locale: r.locale,
+		path: e.path,
+		targetType: e.targetType,
+		targetDocumentId: e.targetDocumentId,
+		...o == null ? {} : { tenantId: o }
+	}));
+	s.length > 0 && await e.insertMany(d, s, { returning: "none" });
+}, y = (e) => {
+	let t = (e) => e.kind === "reference" || e.kind === "richText" || e.element !== void 0 && t(e.element) || Object.values(e.struct ?? {}).some(t) || (e.components ?? []).some((e) => Object.values(e.props).some(t));
+	return Object.values(e.fields).some(t);
+}, b = async (e, t, n, r) => {
+	let i = n.values;
+	if (typeof i != "object" || !i) return;
+	let a = m(t, i).map((e) => ({
+		sourceType: t.name,
+		sourceDocumentId: n.documentId,
+		sourceVariantId: n.id,
+		stage: "revision",
+		revisionId: n.id,
+		revisionNumber: n.number,
+		...r,
+		...e,
+		...n.tenantId !== void 0 && n.tenantId !== null ? { tenantId: n.tenantId } : {}
+	}));
+	a.length > 0 && await e.insertMany(d, a, { returning: "none" });
+}, x = async (e, t, n) => {
+	async function* o(t, n) {
+		let i;
+		for (;;) {
+			let o = await e.query({
+				table: t,
+				predicate: i === void 0 ? n : r(n, a("id", i)),
+				order: [{
+					column: "id",
+					direction: "asc"
+				}],
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			});
+			for (let e of o) yield e;
+			if (o.length < 500) return;
+			i = String(o.at(-1).id);
+		}
+	}
+	for (let a of t) {
+		for (let t of ["draft", "revision"]) await e.deleteMany(d, { where: r(i("stage", t), i("sourceType", a.name), i("site", n.site), i("environment", n.environment)) });
+		for await (let t of o(`${a.name}_drafts`, r(i("site", n.site), i("environment", n.environment)))) t.status !== "archived" && await v(e, a, t, {
+			...n,
+			locale: String(t.locale)
+		}, "draft");
+		for await (let t of o("cms_revisions", r(i("contentType", a.name), i("site", n.site), i("environment", n.environment)))) await b(e, a, t, {
+			...n,
+			locale: String(t.locale)
+		});
+	}
+}, S = async (e, t, n) => (await e.query({
+	table: d,
+	predicate: r(i("targetType", t.type), i("stage", "published"), i("targetDocumentId", t.documentId), i("site", n.site), i("environment", n.environment)),
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+})).map((e) => ({
+	sourceType: e.sourceType,
+	sourceDocumentId: e.sourceDocumentId,
+	sourceVariantId: e.sourceVariantId,
+	locale: e.locale,
+	path: e.path
+})).sort((e, t) => e.sourceType.localeCompare(t.sourceType) || e.sourceDocumentId.localeCompare(t.sourceDocumentId) || e.locale.localeCompare(t.locale) || e.path.localeCompare(t.path)), C = (...e) => n(() => S(...e)), w = (...e) => n(() => x(...e));
+//#endregion
+export { d as CMS_REFERENCES_TABLE, g as clearReferences, f as cmsReferencesTable, y as hasReferenceFields, x as rebuildReferenceIndex, w as rebuildReferenceIndexEffect, m as referencesOf, S as usedBy, C as usedByEffect, _ as writeReferences, b as writeRevisionReferences };

package/dist/release.js

@@ -0,0 +1,241 @@
+import { PublicRouteRegistryUnavailable as e } from "./publicRouteRegistry.js";
+import { ChangeFeedUnavailable as t, ContentNotFound as n, ReferenceUnavailable as r, ReleaseNotEditable as i, ReviewRequired as a } from "./errors.js";
+import { asTyped as o } from "./effectForm.js";
+import { activatePublicationRelease as s, lockPublicationStream as c } from "./changes.js";
+import { withPublicRouteStateMutation as l } from "./publicRouteMutation.js";
+import { withPublicRoutePublicationBatch as u } from "./publicRoutePublication.js";
+import { publishRevision as d, unpublish as f } from "./write.js";
+import { and as p, eq as m, generateId as h, id as g, integer as _, isNull as v, json as y, lte as b, table as x, text as S, timestamp as C } from "@voltro/database";
+import { tenant as w } from "@voltro/plugin-multitenancy/mixin";
+//#region src/release.ts
+var T = "cms_releases", E = "cms_release_items", D = [
+	"draft",
+	"scheduled",
+	"published",
+	"failed"
+], O = x(T, {
+	id: g({ prefix: "crel" }),
+	name: S(),
+	site: S().maxLength(64),
+	environment: S().maxLength(64),
+	status: S().oneOf(D),
+	scheduledAt: C().nullable(),
+	publishedAt: C().nullable(),
+	publicationGeneration: S().maxLength(20).nullable(),
+	publicationCheckpoint: S().maxLength(64).nullable(),
+	rollbackOf: S().nullable(),
+	claimToken: S().nullable(),
+	failure: S().nullable()
+}).with(w()), k = x(E, {
+	id: g({ prefix: "crit" }),
+	releaseId: S(),
+	contentType: S().maxLength(64),
+	variantId: S().maxLength(64),
+	locale: S().maxLength(64),
+	action: S().oneOf(["publish", "unpublish"]),
+	revisionId: S().nullable(),
+	previousRevisionId: S().nullable(),
+	position: _(),
+	inherited: y().nullable()
+}).with(w()).unique("cms_release_items_uq_variant", [
+	"tenantId",
+	"releaseId",
+	"contentType",
+	"variantId"
+]), A = (e, t, n, r, i) => e.query({
+	table: t,
+	predicate: n,
+	...i === void 0 ? {} : { lock: i },
+	order: r === void 0 ? [] : [r],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), j = async (e, t, r) => {
+	let [i] = await A(e, T, m("id", t), void 0, r);
+	if (i === void 0) throw new n({
+		contentType: "release",
+		id: t,
+		stage: "draft"
+	});
+	return i;
+}, M = async (e, n) => {
+	let r = await j(e, n);
+	if (typeof r.tenantId != "string" || r.tenantId === "") throw new t({ reason: "scope" });
+	return await c(e, {
+		tenantId: r.tenantId,
+		site: String(r.site),
+		environment: String(r.environment)
+	}), j(e, n, "update");
+}, N = (e, t) => ({
+	site: String(e.site),
+	environment: String(e.environment),
+	locale: t
+}), P = (e, t) => e.insert(T, {
+	...t,
+	status: "draft"
+}), F = async (e, t, r) => {
+	let a = await j(e, t, "update");
+	if (a.status !== "draft") throw new i({
+		id: t,
+		status: String(a.status)
+	});
+	let o = N(a, r.locale), [s] = await A(e, `${r.type.name}_drafts`, p(m("id", r.id), m("site", o.site), m("environment", o.environment), m("locale", o.locale)), void 0, "update");
+	if (s === void 0) throw new n({
+		contentType: r.type.name,
+		id: r.id,
+		stage: "draft"
+	});
+	let c = r.action ?? "publish", l = await A(e, E, p(m("releaseId", t), m("contentType", r.type.name), m("variantId", r.id)), void 0, "update"), u = {
+		action: c,
+		locale: r.locale,
+		revisionId: c === "publish" ? r.revisionId ?? String(s.revisionId) : null
+	}, [d] = l;
+	if (d !== void 0) return await e.update("cms_release_items", String(d.id), u) ?? d;
+	let f = (await A(e, E, m("releaseId", t), void 0, "update")).length;
+	return e.insert(E, {
+		releaseId: t,
+		contentType: r.type.name,
+		variantId: r.id,
+		position: f,
+		...u
+	});
+}, I = async (e, t) => {
+	let [n] = await A(e, T, m("id", t));
+	return n === void 0 ? null : String(n.status);
+}, L = (e, t) => A(e, E, m("releaseId", t), {
+	column: "position",
+	direction: "asc"
+}), R = (e, t) => A(e, T, p(m("site", t.site), m("environment", t.environment)), {
+	column: "createdAt",
+	direction: "desc"
+}), z = async (e, t, n, r) => {
+	let [i] = await A(e, `${t}_published`, p(m("id", n), m("site", r.site), m("environment", r.environment), m("locale", r.locale)), void 0, "update");
+	return i === void 0 ? null : String(i.revisionId);
+}, B = async (e, t, r, a = /* @__PURE__ */ new Date(), o = {}) => {
+	let c = await M(e, r);
+	if (c.status !== "draft" && c.status !== "scheduled") throw new i({
+		id: r,
+		status: String(c.status)
+	});
+	return u(e, {
+		tenantId: String(c.tenantId),
+		site: String(c.site),
+		environment: String(c.environment)
+	}, async () => {
+		let i = new Map(t.map((e) => [e.name, e]));
+		for (let t of await A(e, E, m("releaseId", r), {
+			column: "position",
+			direction: "asc"
+		}, "update")) {
+			let a = i.get(String(t.contentType));
+			if (a === void 0) throw new n({
+				contentType: String(t.contentType),
+				id: String(t.variantId),
+				stage: "draft"
+			});
+			let o = N(c, String(t.locale)), s = String(t.variantId), l = await z(e, a.name, s, o);
+			t.action === "publish" ? await d(e, a, s, o, String(t.revisionId), { releaseId: r }) : l !== null && await f(e, a, s, o, { releaseId: r }), await e.update(E, String(t.id), { previousRevisionId: l });
+		}
+		let l = await s(e, {
+			tenantId: String(c.tenantId),
+			site: String(c.site),
+			environment: String(c.environment)
+		}, r), u = await e.update("cms_releases", r, {
+			status: "published",
+			publishedAt: a,
+			publicationGeneration: l.generation,
+			publicationCheckpoint: l.checkpoint
+		}) ?? c;
+		for (let t of o.afterPublish ?? []) await t(e, u, a);
+		return u;
+	});
+}, V = async (e, t, n) => {
+	let r = await j(e, t, "update");
+	if (r.status !== "draft") throw new i({
+		id: t,
+		status: String(r.status)
+	});
+	return await e.update("cms_releases", t, {
+		status: "scheduled",
+		scheduledAt: n
+	}) ?? r;
+}, H = async (e, t, n = /* @__PURE__ */ new Date(), r = {}) => {
+	let i = await A(e, T, p(m("status", "scheduled"), b("scheduledAt", n))), a = [];
+	for (let o of i) {
+		let i = String(o.id), s = h({
+			kind: "typeid",
+			prefix: "claim"
+		}, "cms_releases") ?? `claim_${Date.now()}`;
+		try {
+			await e.transactional(async (e) => (await M(e, i), await e.updateMany("cms_releases", { claimToken: s }, { where: p(m("id", i), m("status", "scheduled")) }) === 1 && (await B(e, t, i, n, r), !0))) && a.push(i);
+		} catch (t) {
+			await e.updateMany(T, {
+				status: "failed",
+				failure: U(t)
+			}, { where: p(m("id", i), m("status", "scheduled"), o.claimToken === null || o.claimToken === void 0 ? v("claimToken") : m("claimToken", o.claimToken)) });
+		}
+	}
+	return a;
+}, U = (e) => {
+	if (e instanceof r) return `ReferenceUnavailable: ${e.contentType} ${e.id} uses ${e.targets.map((e) => `${e.contentType} ${e.documentId} (${e.reason})`).join(", ")}`;
+	if (e instanceof a) return `ReviewRequired: ${e.contentType} ${e.id} revision ${e.revisionId} is not approved`;
+	if (e instanceof n) return `ContentNotFound: ${e.contentType} ${e.id} (${e.stage})`;
+	let t = e?._tag;
+	return typeof t == "string" ? t : e instanceof Error ? e.message : String(e);
+}, W = async (e, t) => {
+	let n = await j(e, t, "update");
+	if (n.status !== "failed") throw new i({
+		id: t,
+		status: String(n.status)
+	});
+	return await e.update("cms_releases", t, {
+		status: "draft",
+		failure: null,
+		claimToken: null,
+		scheduledAt: null
+	}) ?? n;
+}, G = async (e, t, n, r = /* @__PURE__ */ new Date(), a = {}) => {
+	let o = await M(e, n);
+	if (o.status !== "published") throw new i({
+		id: n,
+		status: String(o.status)
+	});
+	return l(e, async () => {
+		let i = await e.insert(T, {
+			name: `Rollback of ${String(o.name)}`,
+			site: o.site,
+			environment: o.environment,
+			status: "draft",
+			rollbackOf: n,
+			...o.tenantId !== void 0 && o.tenantId !== null ? { tenantId: o.tenantId } : {}
+		}), s = String(i.id), c = 0;
+		for (let t of await L(e, n)) {
+			let n = t.previousRevisionId;
+			await e.insert(E, {
+				releaseId: s,
+				contentType: t.contentType,
+				variantId: t.variantId,
+				locale: t.locale,
+				action: n == null ? "unpublish" : "publish",
+				revisionId: n ?? null,
+				position: c++,
+				...t.tenantId !== void 0 && t.tenantId !== null ? { tenantId: t.tenantId } : {}
+			});
+		}
+		return B(e, t, s, r, a);
+	});
+}, K = [
+	n,
+	i,
+	a,
+	r
+], q = [
+	...K,
+	t,
+	e
+], J = (...e) => o(() => P(...e)), Y = (...e) => o(() => F(...e), n, i), X = async (e, t, n, r) => {
+	let [i] = await A(e, E, p(m("releaseId", t), m("variantId", n)));
+	return i !== void 0 && (await e.update(E, String(i.id), { inherited: r }), !0);
+}, Z = (...e) => o(() => X(...e)), Q = (...e) => o(() => L(...e)), $ = (...e) => o(() => I(...e)), ee = (...e) => o(() => R(...e)), te = (...e) => o(() => B(...e), ...q), ne = (...e) => o(() => V(...e), ...K), re = (...e) => o(() => H(...e)), ie = (...e) => o(() => G(...e), ...q), ae = (...e) => o(() => W(...e), ...K);
+//#endregion
+export { T as CMS_RELEASES_TABLE, E as CMS_RELEASE_ITEMS_TABLE, D as RELEASE_STATUSES, F as addToRelease, Y as addToReleaseEffect, k as cmsReleaseItemsTable, O as cmsReleasesTable, P as createRelease, J as createReleaseEffect, U as describeFailure, L as listReleaseItems, Q as listReleaseItemsEffect, R as listReleases, ee as listReleasesEffect, X as pinReleaseInheritance, Z as pinReleaseInheritanceEffect, H as publishDueReleases, re as publishDueReleasesEffect, B as publishRelease, te as publishReleaseEffect, I as releaseStatusOf, $ as releaseStatusOfEffect, W as retryRelease, ae as retryReleaseEffect, G as rollbackRelease, ie as rollbackReleaseEffect, V as scheduleRelease, ne as scheduleReleaseEffect };

package/dist/renderReadAuthority.js

@@ -0,0 +1,43 @@
+import { dataStoreApiKeyStore as e, lockApiKeyById as t, sha256Hex as n } from "@voltro/runtime";
+//#region src/renderReadAuthority.ts
+var r = (e) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) return null;
+	let t = e;
+	return Object.keys(t).length !== 3 || Object.keys(t).some((e) => ![
+		"kind",
+		"id",
+		"scope"
+	].includes(e)) || t.kind !== "apiKey" || typeof t.id != "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(t.id) || typeof t.scope != "string" || !/^[A-Za-z][A-Za-z0-9:_.-]{0,127}$/.test(t.scope) ? null : {
+		kind: "apiKey",
+		id: t.id,
+		scope: t.scope
+	};
+}, i = (e, t, n, r) => e === null || e.id !== n || e.tenantId !== t.tenantId || e.revokedAt !== null || e.onBehalfOf !== null && e.onBehalfOf !== void 0 || !Array.isArray(e.scopes) || !e.scopes.every((e) => typeof e == "string") || e.metadata === null || typeof e.metadata != "object" || Array.isArray(e.metadata) || e.metadata.site !== t.site || e.metadata.environment !== t.environment || e.expiresAt !== null && (!Number.isSafeInteger(e.expiresAt) || e.expiresAt <= r) ? null : {
+	expiresAt: e.expiresAt,
+	scopes: [...e.scopes]
+}, a = async (t, n, r, a) => i(await e(t).findById(r), n, r, a), o = async (e, t, n, r) => {
+	let i = await a(e, t, n.id, r);
+	return i !== null && i.scopes.includes(n.scope) ? { expiresAt: i.expiresAt } : null;
+}, s = async (t, r, i, o) => {
+	if (typeof i != "string" || i.length === 0 || i.length > 512 || !Number.isSafeInteger(o) || !Number.isFinite(new Date(o).getTime())) return null;
+	let s = await e(t).findByHash(n(i));
+	if (s === null) return null;
+	let c = await a(t, r, s.id, o);
+	return c === null ? null : {
+		id: s.id,
+		...c
+	};
+}, c = async (r, a, o, s) => {
+	if (typeof o != "string" || o.length === 0 || o.length > 512 || !Number.isSafeInteger(s) || !Number.isFinite(new Date(s).getTime())) return null;
+	let c = n(o), l = await e(r).findByHash(c);
+	if (l === null) return null;
+	let u = await t(r, l.id, a.tenantId);
+	if (u === null || u.hashedKey !== c) return null;
+	let d = i(u, a, l.id, s);
+	return d === null ? null : {
+		id: u.id,
+		...d
+	};
+};
+//#endregion
+export { r as copyRenderReadAuthority, c as lockRenderReadCredential, o as readRenderReadAuthority, s as readRenderReadCredential, a as readRenderReadOrganization };

package/dist/renderReadGrant.js

@@ -0,0 +1,137 @@
+import { copyRenderReadAuthority as e, readRenderReadAuthority as t } from "./renderReadAuthority.js";
+import { Schema as n } from "effect";
+import { and as r, eq as i, id as a, json as o, table as s, text as c, timestamp as l } from "@voltro/database";
+import { tenant as u } from "@voltro/plugin-multitenancy/mixin";
+import { createHmac as d, timingSafeEqual as f } from "node:crypto";
+import { canonicalJson as p, generateApiKeyToken as m } from "@voltro/runtime";
+//#region src/renderReadGrant.ts
+var h = class extends n.TaggedError()("RenderReadGrantRejected", { reason: n.Literals([
+	"binding",
+	"key",
+	"expiry",
+	"token",
+	"revoked",
+	"expired",
+	"authority"
+]) }) {}, g = "_voltro_cms_render_read_grants", _ = s(g, {
+	id: a({ prefix: "crrg" }),
+	site: c().maxLength(64),
+	environment: c().maxLength(64),
+	binding: o(),
+	keyId: c().maxLength(64),
+	verifier: c().maxLength(64),
+	issuedAt: l(),
+	expiresAt: l(),
+	revokedAt: l().nullable()
+}).with(u()), v = "crread1", y = [
+	"tenantId",
+	"site",
+	"environment",
+	"consumerId",
+	"snapshotId",
+	"snapshotDigest",
+	"releaseId",
+	"buildId",
+	"policyDigest",
+	"projectionDigest"
+], b = [
+	"tenantId",
+	"site",
+	"environment",
+	"consumerId",
+	"snapshotId",
+	"buildId"
+], x = [
+	"snapshotDigest",
+	"policyDigest",
+	"projectionDigest"
+], S = (e) => {
+	throw new h({ reason: e });
+}, C = (e) => typeof e == "string" && e.length > 0 && e.length <= 64 && /^[a-zA-Z0-9_-]+$/.test(e), w = (e) => typeof e == "string" && /^[0-9a-f]{64}$/.test(e), T = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : NaN, E = (e) => Number.isSafeInteger(e) && Number.isFinite(new Date(e).getTime()), D = (e) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) return S("binding");
+	let t = e;
+	return Object.keys(t).length !== y.length || Object.keys(t).some((e) => !y.includes(e)) || !b.every((e) => C(t[e])) || !x.every((e) => w(t[e])) || !(t.releaseId === null || C(t.releaseId)) ? S("binding") : Object.fromEntries(y.map((e) => [e, t[e]]));
+}, O = (e) => !C(e.id) || !(e.material instanceof Uint8Array) || e.material.length < 32 ? S("key") : e, k = (e) => [
+	e.tenantId,
+	e.site,
+	e.environment
+].every(C) ? r(i("tenantId", e.tenantId), i("site", e.site), i("environment", e.environment)) : S("binding"), A = (e, t, n) => d("sha256", e.material).update(p({
+	purpose: "voltro.cms.render-read/v1",
+	nonce: t,
+	id: n.id,
+	keyId: n.keyId,
+	binding: n.binding,
+	issuedAt: T(n.issuedAt),
+	expiresAt: T(n.expiresAt)
+})).digest("hex"), j = async (n, r, i) => {
+	let a = D(r), o = O({
+		id: i.key.id,
+		material: new Uint8Array(i.key.material)
+	}), s = i.now ?? Date.now(), c = i.expiresAt, l = i.maxExpiresAt;
+	if (![
+		s,
+		c,
+		l
+	].every(E) || c <= s || c > l) return S("expiry");
+	let u = i.authority === void 0 ? void 0 : e(i.authority);
+	if (u === null) return S("authority");
+	if (u !== void 0) {
+		let e = await t(n, a, u, s);
+		if (e === null || e.expiresAt !== null && c > e.expiresAt) return S("authority");
+	}
+	let d = m(""), f = await n.insert(g, {
+		tenantId: a.tenantId,
+		site: a.site,
+		environment: a.environment,
+		binding: u === void 0 ? a : {
+			...a,
+			authority: u
+		},
+		keyId: o.id,
+		verifier: "",
+		issuedAt: new Date(s),
+		expiresAt: new Date(c),
+		revokedAt: null
+	});
+	return C(f.id) ? (await n.update(g, f.id, { verifier: A(o, d, f) }), {
+		id: f.id,
+		token: `${v}.${f.id}.${d}`,
+		expiresAt: c
+	}) : S("token");
+}, M = async (n, a, o, s, c) => {
+	let l = D(o), u = s.now ?? Date.now();
+	if (!E(u)) return S("expiry");
+	if (s.keys.length === 0 || new Set(s.keys.map((e) => e.id)).size !== s.keys.length) return S("key");
+	for (let e of s.keys) O(e);
+	if (typeof a != "string" || a.length > 128) return S("token");
+	let d = a.split(".");
+	if (d.length !== 3 || d[0] !== v || !C(d[1]) || !/^[A-Za-z0-9_-]{40}$/.test(d[2])) return S("token");
+	let [m] = await n.query({
+		table: g,
+		predicate: r(k(l), i("id", d[1])),
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: void 0
+	});
+	if (m === void 0 || !w(m.verifier)) return S("token");
+	let h = s.keys.find((e) => e.id === m.keyId);
+	if (h === void 0) return S("token");
+	let _ = Buffer.from(A(h, d[2], m), "hex"), y = Buffer.from(m.verifier, "hex");
+	if (!f(_, y) || m.binding === null || typeof m.binding != "object" || Array.isArray(m.binding)) return S("token");
+	let b = m.binding, { authority: x, ...j } = b;
+	if (p(j) !== p(l)) return S("token");
+	if (m.revokedAt !== null) return S("revoked");
+	let M = T(m.issuedAt), N = T(m.expiresAt);
+	if (!E(M) || !E(N) || M > u || N <= M) return S("token");
+	if (c === void 0 && N <= u) return S("expired");
+	if (Object.hasOwn(b, "authority")) {
+		let r = e(x);
+		if (r === null || await t(n, l, r, u) === null || c !== void 0 && p(r) !== p(c)) return S("authority");
+	} else if (c !== void 0) return S("authority");
+}, N = (e, t, n, r) => M(e, t, n, r), P = (t, n, r, i, a) => {
+	let o = e(i);
+	return o === null ? S("authority") : M(t, n, r, a, o);
+};
+//#endregion
+export { g as RENDER_READ_GRANTS_TABLE, h as RenderReadGrantRejected, j as issueRenderReadGrant, _ as renderReadGrantsTable, N as verifyRenderReadGrant, P as verifyRenderReadRenewal };

package/dist/rest.js

@@ -0,0 +1,52 @@
+//#region src/rest.ts
+var e = (e) => {
+	let t = e.authorization;
+	return t && t.toLowerCase().startsWith("bearer ") ? t.slice(7).trim() : e["x-api-key"];
+}, t = async (t, n) => {
+	if (t.method.toUpperCase() !== "GET") return {
+		status: 405,
+		body: { error: "method_not_allowed" }
+	};
+	if (!t.path.startsWith("/v1/cms/")) return {
+		status: 404,
+		body: { error: "not_found" }
+	};
+	let r = e(t.headers), i = r ? n.apiKeys.find((e) => e.key === r) : void 0;
+	if (!i) return {
+		status: 401,
+		body: { error: "unauthorized" }
+	};
+	let a = t.path.slice(8).split("/").filter((e) => e.length > 0), o = a[0];
+	if (!o || !n.types.some((e) => e.name === o)) return {
+		status: 404,
+		body: { error: "unknown_content_type" }
+	};
+	if (!(i.types === void 0 || i.types.includes("*") || i.types.includes(o))) return {
+		status: 403,
+		body: {
+			error: "forbidden",
+			type: o
+		}
+	};
+	if (a.length >= 2) {
+		let e = a.slice(1).join("/"), t = await n.cms.contentType(o).where("slug", "=", e).one();
+		return t ? {
+			status: 200,
+			body: t
+		} : {
+			status: 404,
+			body: {
+				error: "not_found",
+				type: o,
+				slug: e
+			}
+		};
+	}
+	let s = n.defaultLimit ?? 20, c = n.maxLimit ?? 100, l = Number(t.query?.limit), u = Number.isFinite(l) && l > 0 ? Math.min(l, c) : s;
+	return {
+		status: 200,
+		body: await n.cms.contentType(o).limit(u).all()
+	};
+};
+//#endregion
+export { t as handleCmsRest };