@voltro/cms 0.86.0 → 0.87.0

package/dist/snapshotTreeRead.js

@@ -0,0 +1,158 @@
+import { compileSiteDelivery as e, defineSiteDelivery as t } from "./siteDelivery.js";
+import { buildTree as n } from "./tree.js";
+import { pageCapturedPublications as r, readCapturedPublication as i, verifyPublicationState as a } from "./publicationState.js";
+import { readVerifiedSnapshotResource as o } from "./buildSnapshot.js";
+import { verifySnapshotRouteOwnership as s } from "./snapshotRouting.js";
+import { admitVerifiedSnapshotPublicDocument as c } from "./snapshotPublicAccess.js";
+import { projectContentValues as l } from "./contentProjection.js";
+import { copySnapshotTrees as u } from "./snapshotProjection.js";
+import { readSnapshotAppExecution as d } from "./snapshotAppExecution.js";
+import { SnapshotRouteReadUnavailable as f, readSnapshotRouteAdmission as p } from "./snapshotRouteAdmission.js";
+import { readAdmittedCapturedAddress as m } from "./snapshotAddressRead.js";
+import { snapshotPathLocale as h } from "./snapshotPathLocale.js";
+import { createHash as g } from "node:crypto";
+import { canonicalJson as _ } from "@voltro/runtime";
+//#region src/snapshotTreeRead.ts
+var v = (e) => {
+	throw new f({ reason: e });
+}, y = (e) => g("sha256").update(_(e)).digest("hex"), b = (e) => typeof e != "object" || !e || Array.isArray(e) ? v("definition") : e, x = async (e, n, r, i, a) => {
+	let o = { ...i }, c = await p(e, n, r, o, a);
+	if (typeof o.name != "string" || !/^[A-Za-z][A-Za-z0-9_-]{0,63}$/.test(o.name)) return v("definition");
+	let l = t(c.configuration.site), u = h(l, o.path);
+	await d(e, c.place, c.snapshot, void 0, [], {
+		id: u.id,
+		contentLocale: u.contentLocale
+	});
+	let f = c.route;
+	if (f !== void 0 && f.definitionDigest !== c.configuration.definitionDigest) return v("binding");
+	let m = f !== void 0 && s(c.configuration, f).owner === "cms" ? {
+		contentType: String(f.contentType),
+		documentId: String(f.documentId)
+	} : null, g = await S(e, c.place, c.snapshot, u.id, m, c.now);
+	return Object.hasOwn(g, o.name) ? g[o.name] : v("definition");
+}, S = async (t, s, d, f, p, h) => {
+	let g = (await o(t, s, d, "projection", "registry")).value;
+	if (g.trees === void 0) return {};
+	if (!Array.isArray(g.types) || !g.types.every((e) => typeof e == "string")) return v("binding");
+	let x = /* @__PURE__ */ new Map(), S = /* @__PURE__ */ new Map();
+	for (let e of Object.values(b(g.trees))) {
+		let n = b(e).contentType;
+		if (typeof n != "string" || !g.types.includes(n)) return v("definition");
+		if (S.has(n)) continue;
+		let r = (await o(t, s, d, "schema", `type:${n}`)).value, i = b(r.definition);
+		if (r.version !== 1 || i.name !== n || _(r.app) !== _(g.app)) return v("binding");
+		S.set(n, r), x.set(n, i);
+	}
+	let C = u(g.trees, [...x.values()]), w = (await o(t, s, d, "routes", "configuration")).value, T = e(w.site), E = T.definition.locales.find((e) => e.id === f && e.enabled), D = (await o(t, s, d, "site", "configuration")).value;
+	if (E === void 0 || T.definition.id !== s.site || !T.definition.environments.includes(s.environment) || w.tenantId !== s.tenantId || w.environment !== s.environment || _(w.app) !== _(g.app) || D.definitionDigest !== y(T.definition)) return v("binding");
+	let O = await a(t, s, d.manifest.publication, h), k = Object.create(null), A = 0, j = 0, M = 0, N = 0;
+	for (let [e, a] of Object.entries(C)) {
+		let o = x.get(a.contentType).tree, u = [
+			"id",
+			"documentId",
+			"revisionId",
+			"status",
+			"locale",
+			o.parent,
+			o.segment,
+			...o.order === void 0 ? [] : [o.order],
+			...a.includeField === void 0 ? [] : [a.includeField]
+		], g = /* @__PURE__ */ new Map();
+		for (let e of [E.contentLocale, ...T.fallback[E.contentLocale]]) {
+			let n;
+			do {
+				let i = await r(t, s, d.manifest.publication.id, a.contentType, e, {
+					limit: 200,
+					now: h,
+					...n === void 0 ? {} : { after: n }
+				});
+				for (let t of i.items) {
+					if (++A > 5e4) return v("bounds");
+					if (typeof t.documentId != "string" || t.status !== "published" || t.locale !== e) return v("publication");
+					if (!g.has(t.documentId)) {
+						let n = Object.fromEntries(u.filter((e) => Object.hasOwn(t, e)).map((e) => [e, t[e]]));
+						if (Object.values(n).some((e) => e !== null && typeof e != "string" && typeof e != "boolean" && !(typeof e == "number" && Number.isFinite(e)))) return v("publication");
+						if (N += Buffer.byteLength(_(n)), N > 16777216) return v("bounds");
+						g.set(t.documentId, {
+							row: n,
+							locale: e,
+							fallback: e !== E.contentLocale
+						});
+					}
+				}
+				n = i.next ?? void 0;
+			} while (n !== void 0);
+		}
+		for (let e of g.values()) {
+			let t = /* @__PURE__ */ new Set(), n = e;
+			for (; n !== void 0;) {
+				let e = String(n.row.documentId);
+				if (t.has(e)) break;
+				if (t.size >= 128) return v("bounds");
+				t.add(e);
+				let r = n.row[o.parent];
+				n = typeof r == "string" ? g.get(r) : void 0;
+			}
+		}
+		let y = n([...g.values()], o), b = new Map(y.nodes.map((e) => [e.documentId, e])), S = /* @__PURE__ */ new Map(), C = async (e) => {
+			if (S.has(e.documentId)) return S.get(e.documentId);
+			if (++M > 4096) return v("bounds");
+			let n = await c(t, s, d, O, a.contentType, f, e.documentId, h);
+			if (n === null) return S.set(e.documentId, null), null;
+			let r = await m(t, s, d, {
+				contentType: a.contentType,
+				documentId: e.documentId,
+				localeId: f,
+				mappingId: a.mappingId
+			}, n, h);
+			if (r === null) return S.set(e.documentId, null), null;
+			if (r.document.variantId !== e.row.id || r.document.revisionId !== e.row.revisionId || r.document.locale !== e.locale) return v("binding");
+			let o = await i(t, s, d.manifest.publication.id, a.contentType, r.document.locale, r.document.variantId, h);
+			if (o === null || o.documentId !== e.documentId || o.revisionId !== r.document.revisionId) return v("publication");
+			let u = l({
+				version: 1,
+				fields: Object.fromEntries(a.fields.map((e) => [e, !0]))
+			}, o);
+			if (Object.values(u).some((e) => e !== null && typeof e != "string" && typeof e != "boolean" && !(typeof e == "number" && Number.isFinite(e)))) return v("publication");
+			let p = {
+				documentId: e.documentId,
+				parent: e.parent,
+				depth: e.depth,
+				path: r.output.path,
+				sourceLocale: e.locale,
+				fallback: e.fallback,
+				values: u
+			};
+			return S.set(e.documentId, p), p;
+		}, w = [], D = /* @__PURE__ */ new Set();
+		for (let e of y.nodes) {
+			if (a.includeField !== void 0 && (e.row[a.includeField] !== !0 || e.parent !== null && !D.has(e.parent))) continue;
+			let t = await C(e);
+			if (t !== null) {
+				if (++j > 4096) return v("bounds");
+				w.push(t), D.add(e.documentId);
+			}
+		}
+		let P = p?.contentType === a.contentType ? b.get(p.documentId) : void 0, F = P === void 0 ? null : await C(P), I = [];
+		if (F !== null) for (let e = P.parent; e !== null;) {
+			let t = b.get(e);
+			if (t === void 0) return v("binding");
+			let n = await C(t);
+			if (n === null) return v("binding");
+			if (++j > 4096) return v("bounds");
+			I.unshift(n), e = t.parent;
+		}
+		k[e] = {
+			version: 1,
+			contentType: a.contentType,
+			localeId: f,
+			requestedLocale: E.contentLocale,
+			currentDocumentId: F?.documentId ?? null,
+			nodes: w,
+			ancestors: I
+		};
+	}
+	return Buffer.byteLength(_(k)) > 4194304 ? v("bounds") : k;
+};
+//#endregion
+export { S as readAdmittedSnapshotTrees, x as readSnapshotTree };

package/dist/staticPathSet.js

@@ -0,0 +1,177 @@
+import { normalizeHost as e } from "./domainHost.js";
+import { canonicalCmsPublicPath as t } from "./publicBuild.js";
+import { Schema as n } from "effect";
+import { createHash as r, createHmac as i, timingSafeEqual as a } from "node:crypto";
+import { canonicalJson as o } from "@voltro/runtime";
+//#region src/staticPathSet.ts
+var s = class extends n.TaggedError()("StaticPathSetUnavailable", { reason: n.Literals([
+	"input",
+	"bounds",
+	"integrity",
+	"key",
+	"cursor",
+	"state",
+	"changed"
+]) }) {}, c = class extends n.TaggedError()("StaticPathSetConflict", {
+	url: n.String,
+	owners: n.Array(n.String),
+	repair: n.String
+}) {}, l = (e) => r("sha256").update(o(e)).digest("hex"), u = (e) => {
+	throw new s({ reason: e });
+}, d = (e) => typeof e == "string" && /^[a-f0-9]{64}$/.test(e), f = (e) => typeof e == "string" && /^[A-Za-z0-9_-]{1,64}$/.test(e), p = (e) => typeof e != "object" || !e || Array.isArray(e) ? u("input") : e, m = (e, t) => {
+	if (Object.keys(e).sort().join(",") !== [...t].sort().join(",")) return u("input");
+}, h = (e) => typeof e == "string" && e.length > 0 && e.length <= 1024 && !/[\\\x00-\x1f\x7f:]/.test(e) && e.split("/").every((e) => e !== "" && e !== "." && e !== ".." && e.toLowerCase() !== ".git"), g = (n, r) => {
+	if (e(n) !== n) return u("input");
+	try {
+		return `https://${n}${t(r)}`;
+	} catch {
+		return u("input");
+	}
+}, _ = (e) => {
+	let t = p(e);
+	if (m(t, [
+		"host",
+		"path",
+		"localeId",
+		"routeId",
+		"owner",
+		"file",
+		"sourceDigest",
+		"parameters"
+	]), typeof t.host != "string" || typeof t.path != "string" || !f(t.localeId) || typeof t.routeId != "string" || !/^(route_|native_)[a-f0-9]{64}$/.test(t.routeId) || typeof t.owner != "string" || !["cms", "code"].includes(t.owner) || !(t.file === null && t.sourceDigest === null || h(t.file) && d(t.sourceDigest)) || t.owner === "code" && t.file === null) return u("input");
+	g(t.host, t.path);
+	let n = p(t.parameters);
+	return Object.keys(n).length > 64 || Object.entries(n).some(([e, t]) => !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(e) || typeof t != "string" || t.length > 4096) ? u("input") : {
+		host: t.host,
+		path: t.path,
+		localeId: t.localeId,
+		routeId: t.routeId,
+		owner: t.owner,
+		file: t.file,
+		sourceDigest: t.sourceDigest,
+		parameters: Object.fromEntries(Object.keys(n).sort().map((e) => [e, n[e]]))
+	};
+}, v = (e) => {
+	if (!Array.isArray(e) || e.length === 0 || e.length > 2 || e.some((e) => typeof e != "string" || !["cms", "code"].includes(e))) return u("input");
+	let t = [...e].sort();
+	return new Set(t).size === t.length ? t : u("input");
+}, y = (t) => {
+	let n = p(t), r = [
+		"tenantId",
+		"site",
+		"environment",
+		"snapshotId",
+		"consumerId",
+		"buildId"
+	], i = [
+		"snapshotDigest",
+		"inputsId",
+		"executionId",
+		"routesDigest",
+		"domainsDigest",
+		"localesDigest",
+		"policyDigest",
+		"projectionDigest"
+	];
+	if (m(n, [
+		...r,
+		...i,
+		"releaseId",
+		"host",
+		"localeIds",
+		"owners"
+	]), !r.every((e) => f(n[e])) || !i.every((e) => d(n[e])) || !(n.releaseId === null || f(n.releaseId)) || typeof n.host != "string" || e(n.host) !== n.host || !Array.isArray(n.localeIds) || n.localeIds.length === 0 || n.localeIds.length > 64 || n.localeIds.some((e, t, n) => !f(e) || t > 0 && n[t - 1] >= e)) return u("input");
+	let a = v(n.owners);
+	return o(a) === o(n.owners) ? {
+		...n,
+		localeIds: [...n.localeIds],
+		owners: a
+	} : u("input");
+}, b = (e) => !f(e.id) || !(e.material instanceof Uint8Array) || e.material.byteLength < 32 ? u("key") : {
+	id: e.id,
+	material: new Uint8Array(e.material)
+}, x = (e, t) => i("sha256", t.material).update(o({
+	purpose: "voltro.cms.static-path-set/v1",
+	id: e,
+	keyId: t.id
+})).digest("hex"), S = (e) => {
+	let t = p(e);
+	if (m(t, [
+		"version",
+		"context",
+		"sort",
+		"pageSize",
+		"count",
+		"sources",
+		"pages"
+	]), t.version !== 1 || t.sort !== "host-nfc-path/v1" || t.pageSize !== 200 || typeof t.count != "number" || !Number.isSafeInteger(t.count) || t.count < 0 || t.count > 1e5 || !Array.isArray(t.pages) || t.pages.length !== Math.ceil(t.count / 200)) return u("bounds");
+	let n = p(t.sources);
+	if (m(n, ["count", "digest"]), typeof n.count != "number" || !Number.isSafeInteger(n.count) || n.count < 1 || n.count > 1e5 || !d(n.digest)) return u("integrity");
+	let r = 0, i = "", a = t.pages.map((e, n) => {
+		let a = p(e);
+		return m(a, [
+			"count",
+			"digest",
+			"first",
+			"last"
+		]), typeof a.count != "number" || a.count !== Math.min(200, Number(t.count) - n * 200) || !d(a.digest) || typeof a.first != "string" || typeof a.last != "string" || a.first > a.last || a.first <= i || a.last.length > 8192 ? u("integrity") : (r += a.count, i = a.last, {
+			count: a.count,
+			digest: a.digest,
+			first: a.first,
+			last: a.last
+		});
+	});
+	return r === t.count ? {
+		version: 1,
+		context: y(t.context),
+		sort: "host-nfc-path/v1",
+		pageSize: 200,
+		count: r,
+		sources: {
+			count: n.count,
+			digest: n.digest
+		},
+		pages: a
+	} : u("integrity");
+}, C = (e, t) => {
+	let n = b(t), r = S(e), i = l(r);
+	return {
+		id: i,
+		manifest: r,
+		keyId: n.id,
+		signature: x(i, n)
+	};
+}, w = (e, t) => {
+	let n = p(e);
+	m(n, [
+		"id",
+		"manifest",
+		"keyId",
+		"signature"
+	]);
+	let r = t.map(b);
+	if (r.length === 0 || new Set(r.map((e) => e.id)).size !== r.length) return u("key");
+	let i = r.find((e) => e.id === n.keyId);
+	if (i === void 0 || !d(n.id) || !d(n.signature)) return u("integrity");
+	let o = S(n.manifest);
+	return l(o) !== n.id || !a(Buffer.from(x(n.id, i), "hex"), Buffer.from(n.signature, "hex")) ? u("integrity") : {
+		id: n.id,
+		manifest: o,
+		keyId: i.id,
+		signature: n.signature
+	};
+}, T = (e, t, n) => {
+	if (e.manifest.count === 0 && e.manifest.pages.length === 0 && t === 0 && Array.isArray(n) && n.length === 0) return [];
+	if (!Number.isSafeInteger(t) || t < 0 || t >= e.manifest.pages.length || !Array.isArray(n)) return u("bounds");
+	let r = e.manifest.pages[t];
+	if (n.length !== r.count || l(n) !== r.digest) return u("integrity");
+	let i = n.map(_), a = "";
+	for (let t of i) {
+		let n = g(t.host, t.path);
+		if (t.host !== e.manifest.context.host || !e.manifest.context.localeIds.includes(t.localeId) || !e.manifest.context.owners.includes(t.owner) || n <= a) return u("integrity");
+		a = n;
+	}
+	return g(i[0].host, i[0].path) !== r.first || a !== r.last ? u("integrity") : i;
+};
+//#endregion
+export { c as StaticPathSetConflict, s as StaticPathSetUnavailable, y as copyStaticPathContext, _ as copyStaticPathEntry, S as copyStaticPathManifest, v as copyStaticPathOwners, C as signStaticPathSet, l as staticPathHash, g as staticPathUrl, T as verifyStaticPathPage, w as verifyStaticPathSet };

package/dist/staticPathSetRest.js

@@ -0,0 +1,129 @@
+import { cmsCredential as e, privateCmsHttpRoutes as t, privateCmsOperation as n } from "./privateCmsTransport.js";
+import { StaticPathSetConflict as r, StaticPathSetUnavailable as i } from "./staticPathSet.js";
+import { Schema as a } from "effect";
+//#region src/staticPathSetRest.ts
+var o = a.Struct({
+	id: a.String,
+	digest: a.String
+}), s = a.Struct({
+	snapshot: o,
+	consumerId: a.String,
+	buildId: a.String,
+	host: a.String,
+	localeIds: a.optional(a.Array(a.String)),
+	owners: a.optional(a.Array(a.Literals(["cms", "code"])))
+}), c = a.Struct({
+	tenantId: a.String,
+	site: a.String,
+	environment: a.String,
+	snapshotId: a.String,
+	snapshotDigest: a.String,
+	releaseId: a.NullOr(a.String),
+	consumerId: a.String,
+	buildId: a.String,
+	inputsId: a.String,
+	executionId: a.String,
+	routesDigest: a.String,
+	domainsDigest: a.String,
+	localesDigest: a.String,
+	policyDigest: a.String,
+	projectionDigest: a.String,
+	host: a.String,
+	localeIds: a.Array(a.String),
+	owners: a.Array(a.Literals(["cms", "code"]))
+}), l = a.Struct({
+	id: a.String,
+	keyId: a.String,
+	signature: a.String,
+	manifest: a.Struct({
+		version: a.Literal(1),
+		context: c,
+		sort: a.Literal("host-nfc-path/v1"),
+		pageSize: a.Literal(200),
+		count: a.Number,
+		sources: a.Struct({
+			count: a.Number,
+			digest: a.String
+		}),
+		pages: a.Array(a.Struct({
+			count: a.Number,
+			digest: a.String,
+			first: a.String,
+			last: a.String
+		}))
+	})
+}), u = a.Struct({
+	id: a.String,
+	revision: a.Number,
+	phase: a.Literals([
+		"cms",
+		"code",
+		"seal",
+		"ready"
+	]),
+	enumerated: a.Number,
+	set: a.NullOr(l)
+}), d = a.Struct({
+	host: a.String,
+	path: a.String,
+	localeId: a.String,
+	routeId: a.String,
+	owner: a.Literals(["cms", "code"]),
+	file: a.NullOr(a.String),
+	sourceDigest: a.NullOr(a.String),
+	parameters: a.Record(a.String, a.String)
+}), f = {
+	namespace: "cms.staticPathSet",
+	path: "/v1/cms/static-path-sets",
+	operationPrefix: "cmsStaticPathSet",
+	tags: ["CMS static path sets"],
+	credentialError: "CmsBuildSnapshotUnavailable",
+	error: a.Union([i, r]),
+	errorStatus: {
+		StaticPathSetUnavailable: 409,
+		StaticPathSetConflict: 409
+	}
+}, p = (t, n) => ({
+	snapshot: t.snapshot,
+	token: e(n, "CmsBuildSnapshotUnavailable"),
+	consumerId: t.consumerId,
+	buildId: t.buildId,
+	host: t.host,
+	...t.localeIds === void 0 ? {} : { localeIds: t.localeIds },
+	...t.owners === void 0 ? {} : { owners: t.owners }
+}), m = (e) => {
+	let r = [
+		n(f, "begin", "Begin or resume a captured static path set", "Render-read bearer. Scope, snapshot, build, admitted host and exact locale selection identify the durable job. An id alone grants nothing.", s, u, (t, n) => e.begin(p(t, n))),
+		n(f, "advance", "Advance one bounded durable path enumeration step", "Render-read bearer for the same build. Captured CMS resources and retained native code are merged with captured ownership rules. Renew bounded grants through snapshot open when needed. URL conflicts include both admitted owners and a repair action.", a.Struct({
+			...s.fields,
+			id: a.String,
+			revision: a.Number
+		}), u, (t, n) => e.advance({
+			...p(t, n),
+			id: t.id,
+			revision: t.revision
+		})),
+		n(f, "page", "Read one authenticated immutable static path page", "Render-read bearer. The digest pins the complete signed set and its exact filter, count and ordered page digests. Index is interpreted only within this root. Repeating the same page is idempotent; there is no live fallback.", a.Struct({
+			...s.fields,
+			id: a.String,
+			digest: a.String,
+			index: a.Number
+		}), a.Struct({
+			set: l,
+			index: a.Number,
+			entries: a.Array(d),
+			next: a.NullOr(a.Number)
+		}), (t, n) => e.page({
+			...p(t, n),
+			id: t.id,
+			digest: t.digest,
+			index: t.index
+		}))
+	];
+	return {
+		routes: r,
+		httpRoutes: t(r)
+	};
+};
+//#endregion
+export { m as cmsStaticPathSetRest };