@voltro/cms 0.86.0 → 0.87.0

package/dist/snapshotRenderDependencies.js

@@ -0,0 +1,178 @@
+import { admitSnapshotPresentation as e, copySnapshotConsentPurposes as t } from "./snapshotPresentation.js";
+import { copySnapshotContentIdentity as n } from "./snapshotContentIdentity.js";
+import { snapshotProjectedValue as r } from "./snapshotObservation.js";
+import { createHash as i } from "node:crypto";
+import { canonicalJson as a } from "@voltro/runtime";
+//#region src/snapshotRenderDependencies.ts
+var o = () => {
+	throw Error("Snapshot dependencies unavailable");
+}, s = (e) => i("sha256").update(a(e)).digest("hex"), c = (e) => typeof e != "object" || !e || Array.isArray(e) ? o() : e, l = (e, t) => a(e) === a(t), u = (e, t) => e.length > t.length && t.every((t, n) => t === e[n]), d = (i) => {
+	if (i.data.version !== 6 || i.references.version !== 4 || !l(i.data.presentation, e(i.data.consentPurposes, i.data.presentation)) || !l(i.data.consentPurposes, t(i.data.consentPurposes)) || !l(i.data.content, n(i.content)) || !l(Object.keys(i.bindings).sort(), Object.keys(i.data.bindings).sort()) || !l(Object.keys(i.references.nodes).sort(), Object.keys(i.referenceGraph.nodes).sort()) || !l(i.references.edges, i.referenceGraph.edges) || !l(i.references.addresses, i.addressGraph.map((e) => ({
+		source: e.source,
+		fieldPath: e.fieldPath,
+		path: e.target?.output.path ?? null
+	})))) return o();
+	let d = /* @__PURE__ */ new Map(), f = c(i.observations);
+	if (Object.keys(f).sort().join(",") !== "coverage,events,selectiveReuse,version" || f.version !== 5 || f.coverage !== "framework-observations" || f.selectiveReuse !== !1 || !Array.isArray(f.events) || f.events.length > 4096) return o();
+	let p = [], m = s(i.data.context), h = "";
+	for (let e of f.events) {
+		let t = c(e), n = t.kind, f = t.fieldPath, m = a(t), g = n === "component" ? "componentId,contextDigest,fieldPath,handler,kind,renderer,source,valueDigest" : n === "media" ? "contextDigest,fieldPath,kind,output,source,valueDigest" : n === "rich-document" || n === "reference" || n === "link" ? "contextDigest,fieldPath,kind,source,valueDigest" : "";
+		if (g === "" || Object.keys(t).sort().join(",") !== g || m <= h || !Array.isArray(f) || f.some((e) => typeof e == "number" ? !Number.isSafeInteger(e) || e < 0 : typeof e != "string" || e.length === 0 || e.length > 256)) return o();
+		h = m;
+		let _ = t.source;
+		if (_ !== null && (typeof _ != "string" || !Object.hasOwn(i.bindings, _) && !Object.hasOwn(i.referenceGraph.nodes, _))) return o();
+		let v = typeof _ == "string" && Object.hasOwn(i.referenceGraph.nodes, _), y = _ === null ? i.data : v ? i.references.nodes[_] : i.data.bindings[_], b = _ === null ? {
+			dependencies: i.fields,
+			content: i.content
+		} : v ? i.referenceGraph.nodes[_]?.fields : i.bindings[_];
+		if (y == null || b == null) return o();
+		let x = r(y, f);
+		if (t.valueDigest !== s(x) || t.contextDigest !== s(y.context)) return o();
+		if (n === "reference") {
+			let e = i.referenceGraph.edges.find((e) => e.source === _ && l(e.fieldPath, f));
+			if (e === void 0) return o();
+			let n = e.target === null ? null : i.references.nodes[e.target], r = e.target === null ? null : i.referenceGraph.nodes[e.target]?.fields;
+			if (n === void 0 || r === void 0) return o();
+			let c = {
+				source: _,
+				fieldPath: f
+			}, u = s(n);
+			d.set("reference:" + a(c), {
+				tag: "cms.snapshot.reference",
+				inputDigest: s(c),
+				valueDigest: u
+			}), p.push({
+				...t,
+				target: e.target,
+				targetContent: r?.content ?? null,
+				targetDigest: u
+			});
+			continue;
+		}
+		if (n === "link") {
+			let e = i.addressGraph.find((e) => e.source === _ && l(e.fieldPath, f));
+			if (e === void 0) return o();
+			let n = {
+				source: _,
+				fieldPath: f
+			}, r = s(e.target?.output.path ?? null);
+			d.set("link:" + a(n), {
+				tag: "cms.snapshot.link",
+				inputDigest: s(n),
+				valueDigest: r
+			}), p.push({
+				...t,
+				mappingId: e.mappingId,
+				targetDigest: r,
+				targetRoute: e.target?.output ?? null,
+				targetContent: e.target?.document ?? null
+			});
+			continue;
+		}
+		if (n === "media") {
+			let e = y.media.find((e) => l(e.fieldPath, f) && l(e.output, t.output)), n = i.assets.find((e) => e.source === _ && l(e.selection.fieldPath, f) && l(e.selection.output, t.output));
+			if (e === void 0 || n === void 0) return o();
+			p.push({
+				...t,
+				binaryId: n.binaryId,
+				checksum: n.checksum,
+				assetVersionId: n.assetVersionId
+			});
+			continue;
+		}
+		let S = b.dependencies.find((e) => e.kind === n && l(e.path, f));
+		if (S === void 0) return o();
+		if (S.kind === "rich-document") {
+			let e = b.dependencies.filter((e) => e.kind === "token" && u(e.path, f) && !b.dependencies.some((t) => t.kind === "component" && u(e.path, [...t.path, "props"])));
+			p.push({
+				...t,
+				definitionDigest: S.digest,
+				tokenInputs: e.map((e) => ({
+					...e,
+					valueDigest: s(r(y, e.path))
+				}))
+			});
+			continue;
+		}
+		if (S.kind !== "component") return o();
+		let C = i.frontend.components.find((e) => e.id === S.componentId), w = c(x), T = t.handler;
+		if (C === void 0 || C.digest !== S.digest || C.renderer !== t.renderer || S.componentId !== t.componentId || w.componentId !== S.componentId || w.fingerprint !== S.fingerprint || (S.consent !== null && !i.data.presentation.granted.some((e) => e.id === S.consent) ? T !== "restricted" || C.restricted === null || Object.keys(c(w.props)).length !== 0 : ![
+			"render",
+			"empty",
+			"loading",
+			"error"
+		].includes(String(T)))) return o();
+		let E = T === "render" ? b.dependencies.filter((e) => e.kind === "token" && u(e.path, [...f, "props"])) : [];
+		p.push({
+			...t,
+			definitionDigest: S.digest,
+			implementationDigest: s(C[T]),
+			tokenInputs: E.map((e) => ({
+				...e,
+				valueDigest: s(r(y, e.path))
+			}))
+		});
+	}
+	let g = /* @__PURE__ */ new Set([null, ...Object.keys(i.bindings)]);
+	for (let e = 0; e <= Object.keys(i.referenceGraph.nodes).length; e++) {
+		let e = !1;
+		for (let t of p) t.kind === "reference" && g.has(t.source) && typeof t.target == "string" && !g.has(t.target) && (g.add(t.target), e = !0);
+		if (!e) break;
+	}
+	if (p.some((e) => !g.has(e.source))) return o();
+	let _ = [...d].sort(([e], [t]) => e < t ? -1 : +(e > t)).map(([, e]) => e);
+	return l(i.referenceReads, _) ? {
+		version: 6,
+		coverage: "framework-observations",
+		selectiveReuse: !1,
+		inputs: {
+			snapshotDigest: i.snapshotDigest,
+			inputsId: i.inputsId,
+			executionId: i.executionId,
+			routeId: i.routeId,
+			path: i.data.path,
+			contextDigest: m,
+			presentation: i.data.presentation,
+			consentPurposes: i.data.consentPurposes,
+			content: i.content,
+			contentDigest: s(i.data.values),
+			deliveryDigest: s(i.data),
+			addresses: i.addressGraph.map((e) => ({
+				source: e.source,
+				fieldPath: e.fieldPath,
+				mappingId: e.mappingId,
+				target: e.target === null ? null : {
+					address: e.target.output,
+					content: e.target.document,
+					ancestors: e.target.ancestors,
+					definitionDigest: s(e.target.schema),
+					routeDigest: s(e.target.route)
+				}
+			})),
+			references: {
+				deliveryDigest: s(i.references),
+				edges: i.references.edges,
+				nodes: Object.fromEntries(Object.entries(i.referenceGraph.nodes).map(([e, t]) => {
+					let r = i.references.nodes[e];
+					return r === void 0 || !l(r.content, n(t.fields.content)) || !l(r.values, t.output.values) || r.sourceLocale !== t.output.sourceLocale || r.fallback !== t.output.fallback || !l(r.context, i.data.context) || !l(r.presentation, t.output.presentation) || !l(r.presentation, i.data.presentation) || !l(r.consentPurposes, i.data.consentPurposes) ? o() : [e, {
+						content: t.fields.content,
+						contextDigest: s(r.context),
+						contentDigest: s(r.values),
+						deliveryDigest: s(r)
+					}];
+				}))
+			},
+			bindings: Object.fromEntries(Object.entries(i.bindings).map(([e, t]) => {
+				let r = i.data.bindings[e];
+				return !Object.hasOwn(i.data.bindings, e) || t === null != (r === null) || t !== null && r != null && (!l(r.content, n(t.content)) || !l(r.presentation, i.data.presentation) || !l(r.consentPurposes, i.data.consentPurposes)) ? o() : [e, r == null || t === null ? null : {
+					content: t.content,
+					contextDigest: s(r.context),
+					contentDigest: s(r.values)
+				}];
+			}))
+		},
+		events: p
+	} : o();
+};
+//#endregion
+export { d as snapshotRenderDependencies };

package/dist/snapshotRenditions.js

@@ -0,0 +1,88 @@
+import { readPublicationBoundary as e } from "./changes.js";
+import { copySnapshotResource as t } from "./buildSnapshot.js";
+import { readAssetRendition as n, readAssetRenditionSelection as r } from "./assetRenditions.js";
+import { Schema as i } from "effect";
+import { canonicalJson as a } from "@voltro/runtime";
+//#region src/snapshotRenditions.ts
+var o = class extends i.TaggedError()("SnapshotRenditionUnavailable", { reason: i.Literals([
+	"configuration",
+	"publication",
+	"missing",
+	"asset",
+	"recipe"
+]) }) {}, s = (e) => {
+	throw new o({ reason: e });
+}, c = (e) => typeof e == "string" && e.length > 0 && e.length <= 128 && e.trim() === e, l = (e) => typeof e == "string" && /^[a-f0-9]{64}$/.test(e), u = (e, t) => {
+	let { definitionDigest: n, ...r } = e, { definitionDigest: i, ...o } = t;
+	return a(r) === a(o);
+}, d = (e) => {
+	if (!Array.isArray(e) || e.length > 64) return s("configuration");
+	let t = e.map((e) => !e || !c(e.contentType) || e.contentType.length > 64 || !c(e.slot) || e.slot.length > 64 || !e.recipe || !c(e.recipe.format) || !l(e.recipe.digest) || !e.engine || !c(e.engine.name) || !c(e.engine.version) || !l(e.engine.digest) ? s("configuration") : {
+		contentType: e.contentType,
+		slot: e.slot,
+		recipe: {
+			format: e.recipe.format,
+			digest: e.recipe.digest
+		},
+		engine: {
+			name: e.engine.name,
+			version: e.engine.version,
+			digest: e.engine.digest
+		}
+	}).sort((e, t) => {
+		let n = a([e.contentType, e.slot]), r = a([t.contentType, t.slot]);
+		return n < r ? -1 : +(n > r);
+	});
+	return new Set(t.map((e) => a([e.contentType, e.slot]))).size === t.length ? t : s("configuration");
+}, f = (i, o, c, l) => {
+	let f = {
+		tenantId: o.tenantId,
+		site: o.site,
+		environment: o.environment
+	};
+	if (c.format !== "voltro.cms.media-uses/v1") return s("configuration");
+	let p = d(l);
+	return {
+		format: "voltro.cms.media-renditions/v1",
+		entries: async function* (o) {
+			let l = await e(i, f);
+			if (l.generation !== o.generation || l.releaseId !== o.releaseId || l.checkpoint !== o.checkpoint) return s("publication");
+			for await (let e of c.entries(o)) {
+				if (e.key === "configuration") {
+					let n = e.value.types;
+					if (!Array.isArray(n) || p.some((e) => !n.includes(e.contentType))) return s("configuration");
+					yield t({
+						...e,
+						value: {
+							...e.value,
+							renditionRequirements: p
+						}
+					});
+					continue;
+				}
+				let o = e.value.assetRevision, c = [];
+				if (o !== void 0) for (let e of p.filter((e) => e.contentType === o.contentType)) {
+					let t = await r(i, f, o.versionId, e.slot);
+					if (t === null || t.renditionId === null) return s("missing");
+					let l = await n(i, f, t.renditionId);
+					if (!u(o, l.asset)) return s("asset");
+					let d = l.output.renditionProof;
+					if (a(d.recipe) !== a(e.recipe) || a(d.engine) !== a(e.engine)) return s("recipe");
+					c.push({
+						selection: t,
+						rendition: l
+					});
+				}
+				yield t({
+					...e,
+					value: {
+						...e.value,
+						renditions: c
+					}
+				});
+			}
+		}
+	};
+};
+//#endregion
+export { o as SnapshotRenditionUnavailable, d as copySnapshotRenditionRequirements, f as snapshotRenditionsSource };

package/dist/snapshotRichDocument.js

@@ -0,0 +1,62 @@
+import { richDocumentProblems as e } from "./richDocument.js";
+import { createFrontendMediaReader as t } from "./frontendMedia.js";
+import { snapshotObserver as n, snapshotProjectedValue as r } from "./snapshotObservation.js";
+import { renderSnapshotComponent as i } from "./snapshotComponent.js";
+//#region src/snapshotRichDocument.ts
+var a = () => {
+	throw Error("Snapshot rich document unavailable");
+}, o = (o, s, c) => {
+	let l = r(o, s), u = n(o), d = [...s];
+	if (typeof l != "object" || !l || Array.isArray(l)) return a();
+	let f = l;
+	if (f.type !== "doc" || !Array.isArray(f.blocks)) return a();
+	let p = f.blocks.map((e) => {
+		if (typeof e != "object" || !e || Array.isArray(e)) return a();
+		let t = e;
+		if (t.type !== "component" || t.consentRequired === void 0) return t;
+		if (c.bindings[String(t.componentId)]?.schema.consent !== t.consentRequired || t.props === null || typeof t.props != "object" || Object.keys(t.props).length !== 0) return a();
+		let { consentRequired: n, ...r } = t;
+		return r;
+	}), m = {
+		...f,
+		blocks: p
+	};
+	if (e("", m, {
+		images: "*",
+		links: "*"
+	}).some((e) => e.rule === "type" || e.rule === "unknown")) return a();
+	u({
+		kind: "rich-document",
+		fieldPath: d
+	});
+	let h = t(o.media, d, (e) => u({
+		kind: "media",
+		...e
+	})), g = (e, t = { kind: "original" }) => h([
+		"blocks",
+		e,
+		"asset"
+	], t) ?? a();
+	return {
+		document: m,
+		hrefOf: (e, { fieldPath: t }) => c.hrefOf?.([...d, ...t]) ?? void 0,
+		contactHrefOf: (e, { fieldPath: t }) => c.contactHrefOf?.([...d, ...t]) ?? void 0,
+		renderImage: (e, { index: t }) => c.renderImage(e, g(t, c.imageOutput), {
+			index: t,
+			fieldPath: [
+				...d,
+				"blocks",
+				t,
+				"asset"
+			]
+		}),
+		fileHrefOf: (e, { index: t }) => g(t).url,
+		renderComponent: (e, { index: t }) => i(o, c.bindings, [
+			...d,
+			"blocks",
+			t
+		])
+	};
+};
+//#endregion
+export { o as snapshotRichDocumentProps };

package/dist/snapshotRoleTransfer.js

@@ -0,0 +1,106 @@
+import { SnapshotSeoReadUnavailable as e } from "./snapshotSeoRead.js";
+import { copySnapshotSeoDocumentsSelection as t } from "./snapshotSeoPathSets.js";
+import { readSnapshotSeoDocuments as n, snapshotOutputSafetyBinding as r } from "./snapshotSeoDocuments.js";
+import { readCurrentOutputSafetyArtifact as i } from "./outputSafetyArtifact.js";
+import { readSnapshotSeoOutputArtifact as a } from "./snapshotSeoOutput.js";
+import { readSnapshotRedirectOutputArtifact as o } from "./snapshotRedirectOutput.js";
+import { createSnapshotOutputBatch as s, createSnapshotOutputTransfer as c } from "./snapshotOutputTransfer.js";
+import { canonicalJson as l } from "@voltro/protocol";
+//#region src/snapshotRoleTransfer.ts
+var u = () => {
+	throw new e({ reason: "binding" });
+}, d = (e) => {
+	let { store: d, provider: f, declaration: p, maxBytes: m } = e, h = { ...e.scope }, g = { ...e.use }, _ = e.keys.map((e) => ({
+		id: e.id,
+		material: new Uint8Array(e.material)
+	})), v = e.now ?? Date.now;
+	if (!Number.isSafeInteger(m) || m < 1) return u();
+	let y = f.readAssets?.bind(f), b = async (e, s) => {
+		let c = structuredClone(e), { role: b, id: x } = c;
+		if (![
+			"assets",
+			"deny",
+			"redirects",
+			"sitemap",
+			"robots"
+		].includes(b) || !/^[a-f0-9]{64}$/.test(x) || !Array.isArray(c.targets) || b !== "redirects" && c.targets.length !== 0 || (["assets", "deny"].includes(b) ? c.safety !== null : c.safety === null)) return u();
+		let S = {
+			snapshot: { ...c.snapshot },
+			token: c.token,
+			consumerId: c.consumerId,
+			buildId: c.buildId,
+			host: c.host
+		}, C = t(c.documents), w = (e) => n(e, h, S, C, {
+			provider: f,
+			use: g,
+			keys: _,
+			now: v
+		}), T = async () => {
+			if (b === "assets") {
+				if (y === void 0) return u();
+				let e = await d.transactional(w), t = e.paths.admission.app, n = e.inventory;
+				if (t.web === void 0) return u();
+				let r = await y({
+					id: x,
+					snapshotDigest: S.snapshot.digest,
+					inputsId: t.inputsId,
+					executionId: t.executionId,
+					web: { ...t.web },
+					consentPurposes: n.consentPurposes,
+					presentations: n.presentations,
+					documents: n.records.map((e) => ({
+						url: e.url,
+						path: e.path,
+						routeId: e.routeId,
+						artifactId: e.artifactId,
+						presentation: e.presentation
+					}))
+				}), i = await d.transactional(w);
+				return l(e.inventory) !== l(i.inventory) || l(e.paths.selection) !== l(i.paths.selection) || l(e.paths.admission.context) !== l(i.paths.admission.context) ? u() : r;
+			}
+			if (b === "deny") return (await i(d, h, x, {
+				provider: f,
+				maxBytes: m,
+				admit: async (e) => r(await w(e))
+			})).artifact;
+			if (c.safety === null) return u();
+			let e = {
+				...S,
+				documents: C,
+				safety: { ...c.safety }
+			};
+			return b === "redirects" ? p === void 0 ? u() : o(d, h, S.snapshot, {
+				...e,
+				id: x,
+				targets: c.targets
+			}, {
+				declaration: p,
+				provider: f,
+				use: g,
+				keys: _,
+				maxBytes: m,
+				now: v
+			}) : a(d, h, S.snapshot, {
+				...e,
+				id: x,
+				kind: b
+			}, {
+				provider: f,
+				use: g,
+				keys: _,
+				maxBytes: m,
+				now: v
+			});
+		}, E = await T(), D = 0;
+		for (let e of E.manifest.files) if (!Number.isSafeInteger(e.size) || e.size < 0 || (D += e.size, !Number.isSafeInteger(D) || D > m)) return u();
+		if (E.id !== x) return u();
+		let O = await s(E), k = await T();
+		return l(k) === l(E) ? O : u();
+	};
+	return {
+		...c(f, b),
+		readBatch: s(f, b)
+	};
+};
+//#endregion
+export { d as createSnapshotRoleTransfer };

package/dist/snapshotRoleTransferRest.js

@@ -0,0 +1,99 @@
+import { cmsCredential as e, privateCmsHttpRoutes as t, privateCmsOperation as n } from "./privateCmsTransport.js";
+import { CmsBuildSnapshotUnavailable as r } from "./buildSnapshotService.js";
+import { Effect as i, Schema as a } from "effect";
+import { strictInput as o } from "@voltro/protocol";
+//#region src/snapshotRoleTransferRest.ts
+var s = (s) => {
+	let c = {
+		namespace: "cms.roleTransfer",
+		path: "/v1/cms/role-transfer",
+		operationPrefix: "cmsRoleTransfer",
+		tags: ["CMS private output role transfer"],
+		error: r,
+		errorStatus: { CmsBuildSnapshotUnavailable: 409 },
+		credentialError: "CmsBuildSnapshotUnavailable"
+	}, l = a.Struct({
+		path: a.String,
+		digest: a.String,
+		size: a.Int,
+		contentType: a.String
+	}), u = a.Struct({
+		offset: a.Int,
+		size: a.Int,
+		digest: a.String
+	}), d = a.Struct({
+		artifactId: a.String,
+		pathSets: a.Array(a.Struct({
+			id: a.String,
+			digest: a.String
+		}))
+	}), f = a.Struct({
+		snapshot: a.Struct({
+			id: a.String,
+			digest: a.String
+		}),
+		consumerId: a.String,
+		buildId: a.String,
+		host: a.String,
+		id: a.String,
+		documents: d,
+		role: a.Literals([
+			"assets",
+			"deny",
+			"redirects",
+			"sitemap",
+			"robots"
+		]),
+		safety: a.NullOr(a.Struct({ artifactId: a.String })),
+		targets: a.Array(a.Struct({
+			host: a.String,
+			documents: d
+		}))
+	}), p = "Render-read bearer; complete signed paths, original document receipts, current media rights and grant are admitted before and after every provider read. The exact role is independently reconstructed from original retained assets or current safety, route history and SEO controls. Metadata and bytes are private; they grant no activation or serving authority. No hidden renewal or retry.", m = (e) => i.tryPromise({
+		try: e,
+		catch: () => new r({ reason: "render" })
+	}), h = [
+		n(c, "manifest", "Read a private admitted output role manifest", p, o(f, c.namespace + ".manifest", !0), a.Struct({
+			id: a.String,
+			manifest: a.Struct({
+				version: a.Literal(1),
+				subject: a.Record(a.String, a.Unknown),
+				files: a.Array(l)
+			})
+		}), (t, n) => m(() => s.read({
+			...t,
+			token: e(n, c.credentialError)
+		}))),
+		n(c, "file", "Plan bounded private output role chunks", p, o(a.Struct({
+			...f.fields,
+			path: a.String
+		}), c.namespace + ".file", !0), a.Struct({
+			file: l,
+			chunks: a.Array(u)
+		}), (t, n) => m(() => s.planFile({
+			...t,
+			token: e(n, c.credentialError)
+		}))),
+		n(c, "chunk", "Read a verified private output role chunk", p, o(a.Struct({
+			...f.fields,
+			file: l,
+			chunk: u
+		}), c.namespace + ".chunk", !0), a.Struct({ base64: a.String }), (t, n) => m(async () => ({ base64: Buffer.from(await s.readChunk({
+			...t,
+			token: e(n, c.credentialError)
+		})).toString("base64") }))),
+		n(c, "batch", "Read one bounded batch of complete private output files", p, o(a.Struct({
+			...f.fields,
+			files: a.Array(l).check(a.isMinLength(1), a.isMaxLength(200))
+		}), c.namespace + ".batch", !0), a.Struct({ base64: a.String }), (t, n) => m(async () => ({ base64: Buffer.from(await s.readBatch({
+			...t,
+			token: e(n, c.credentialError)
+		})).toString("base64") })))
+	];
+	return {
+		routes: h,
+		httpRoutes: t(h)
+	};
+};
+//#endregion
+export { s as cmsSnapshotRoleTransferRest };

package/dist/snapshotRouteAdmission.js

@@ -0,0 +1,71 @@
+import { normalizeHost as e } from "./domainHost.js";
+import { findVerifiedSnapshotResource as t, readVerifiedSnapshotResource as n } from "./buildSnapshot.js";
+import { contentRouteId as r } from "./contentRouteIdentity.js";
+import { admitSnapshotPresentation as i, copySnapshotPresentationValue as a } from "./snapshotPresentation.js";
+import { readCapturedSnapshotConsentPurposes as o } from "./snapshotPresentationPolicy.js";
+import { resolveSnapshotReadBinding as s } from "./snapshotReadAdmission.js";
+import { verifyRenderReadGrant as c } from "./renderReadGrant.js";
+import { Schema as l } from "effect";
+import { createHash as u } from "node:crypto";
+import { canonicalJson as d } from "@voltro/runtime";
+//#region src/snapshotRouteAdmission.ts
+var f = class extends l.TaggedError()("SnapshotRouteReadUnavailable", { reason: l.Literals([
+	"binding",
+	"host",
+	"path",
+	"route",
+	"definition",
+	"publication",
+	"bounds",
+	"projection",
+	"owner"
+]) }) {}, p = (e) => {
+	throw new f({ reason: e });
+}, m = (e) => u("sha256").update(d(e)).digest("hex"), h = (e) => typeof e == "string" && e.length > 0, g = (e, t, n) => {
+	let { contentType: i, documentId: a, localeId: o, mappingId: s } = n;
+	if (![
+		i,
+		a,
+		o,
+		s
+	].every(h) || n.version !== 1 || n.state !== "resolved" || n.path !== t || n.tenantId !== e.tenantId || n.site !== e.site || n.environment !== e.environment || n.routeId !== r(e, String(o), String(i), String(a), String(s))) return p("route");
+}, _ = async (r, l, u, d, f) => {
+	let h = f.now ?? Date.now(), _ = {
+		tenantId: l.tenantId,
+		site: l.site,
+		environment: l.environment
+	}, v = {
+		...d,
+		presentation: a(d.presentation)
+	}, y = f.keys.map((e) => ({
+		id: e.id,
+		material: new Uint8Array(e.material)
+	})), b = {
+		id: u.id,
+		digest: u.digest
+	}, { snapshot: x, binding: S } = await s(r, _, b, v, h);
+	await c(r, v.token, S, {
+		keys: y,
+		now: h
+	});
+	let C = typeof v.host == "string" ? e(v.host) : null;
+	if (C === null) return p("host");
+	let w = (await t(r, _, x, "domains", C))?.value;
+	if (w === void 0 || w.version !== 1 || w.host !== C || w.tenantId !== _.tenantId || w.site !== _.site) return p("host");
+	if (typeof v.path != "string" || !v.path.startsWith("/") || v.path.startsWith("//") || v.path.length > 4096 || /[\x00-\x20\x7f\\?#]/.test(v.path) || new URL(v.path, `https://${C}`).pathname !== v.path) return p("path");
+	let T = (await t(r, _, x, "routes", `path:${m(v.path)}`))?.value;
+	T !== void 0 && g(_, v.path, T);
+	let E = (await n(r, _, x, "routes", "configuration")).value, D = await o(r, _, x, E.app);
+	return {
+		snapshot: x,
+		binding: S,
+		place: _,
+		input: v,
+		route: T,
+		configuration: E,
+		presentation: i(D, v.presentation),
+		now: h
+	};
+};
+//#endregion
+export { f as SnapshotRouteReadUnavailable, _ as readSnapshotRouteAdmission, g as verifySnapshotContentRoute };