@voltro/cms 0.86.0 → 0.88.0

package/dist/nativeOutputDeploymentService.js

@@ -0,0 +1,204 @@
+import { copyOutputActivationScope as e, createOutputActivationSet as t, outputActivationHash as n } from "./outputActivation.js";
+import { verifyBuildSnapshot as r } from "./buildSnapshot.js";
+import { readSnapshotAppExecution as i } from "./snapshotAppExecution.js";
+import { readStaticPathSetEvidence as a } from "./staticPathSetStore.js";
+import { makeOutputActivationAdmission as o } from "./outputDeployment.js";
+import { CmsOutputDeploymentUnavailable as s, createCmsOutputDeploymentAuthority as c, createCmsOutputDeployments as l } from "./outputDeploymentService.js";
+import { OUTPUT_ACTIVATION_TARGETS as u } from "./outputActivationTargetTable.js";
+import { readOutputActivationTarget as d, retainOutputActivationTarget as f } from "./outputActivationTarget.js";
+import { and as p, eq as m } from "@voltro/database";
+import { canonicalJson as h } from "@voltro/protocol";
+// src/nativeOutputDeploymentService.ts
+var g = (e) => {
+	throw new s({ reason: e });
+}, _ = (e, t) => h(e) === h(t), v = (e) => typeof e?.id != "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(e.id) || !(e.material instanceof Uint8Array) || e.material.byteLength < 32 ? g("configuration") : {
+	id: e.id,
+	material: new Uint8Array(e.material)
+}, y = (s) => {
+	let h = s.store, y = e(s.scope), b = s.now ?? Date.now, x = s.pathKeys.map(v), S = v(s.key), C = Object.keys(s.regions).sort(), w = s.quorum;
+	if (x.length < 1 || x.length > 64 || new Set(x.map((e) => e.id)).size !== x.length || C.length < 1 || C.length > 64 || !Number.isSafeInteger(w) || w < 1 || w > C.length) return g("configuration");
+	let T = Object.fromEntries(C.map((e) => {
+		let t = s.regions[e];
+		return !/^[A-Za-z0-9_-]{1,64}$/.test(e) || [
+			"stage",
+			"verify",
+			"readArtifacts",
+			"readRoutes"
+		].some((e) => typeof t[e] != "function") ? g("configuration") : [e, {
+			key: v(t.key),
+			verificationKeys: (t.verificationKeys ?? []).map(v),
+			stage: t.stage.bind(t),
+			verify: t.verify.bind(t),
+			readArtifacts: t.readArtifacts.bind(t),
+			readRoutes: t.readRoutes.bind(t)
+		}];
+	})), { boundary: E, transaction: D } = c(h, y, b), O = async (e, t, a) => {
+		if (typeof a != "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(a)) return g("input");
+		let o = await r(e, y, t, b()), s = await i(e, y, o), c = s.definitions.value, l = (e) => o.manifest.parts.find((t) => t.part === e) ?? g("integrity"), u = n({
+			domain: "voltro.cms.output.schema/v1",
+			pin: l("schema")
+		}), d = n({
+			domain: "voltro.cms.output.bindings/v1",
+			components: l("components"),
+			projection: l("projection"),
+			frontend: c.frontend
+		}), f = n({
+			domain: "voltro.cms.output.cache-key/v1",
+			schemaDigest: u,
+			bindingsDigest: d,
+			site: c.site,
+			routing: c.routing,
+			consentPurposes: c.consentPurposes
+		});
+		return {
+			snapshot: {
+				id: o.id,
+				digest: o.digest,
+				releaseId: o.manifest.publication.releaseId ?? g("state"),
+				publicationGeneration: o.manifest.publication.generation
+			},
+			app: {
+				deploymentId: a,
+				inputsId: s.inputsId,
+				executionId: s.executionId,
+				contractVersion: 1,
+				schemaDigest: u,
+				bindingsDigest: d,
+				cacheKeyDigest: f
+			},
+			renderPolicyDigest: l("policies").digest
+		};
+	}, k = async (e, t) => await d(e, y, t) ?? g("state"), A = async (e, t) => {
+		let n = await O(e, t.set.manifest.snapshot, t.set.manifest.app.deploymentId);
+		return !_(n.app, t.set.manifest.app) || !_(n.snapshot, t.set.manifest.snapshot) || n.renderPolicyDigest !== t.set.manifest.renderPolicyDigest ? g("changed") : n;
+	}, j = o({
+		pathKeys: x,
+		use: s.use.bind(s),
+		now: b,
+		verifyArtifacts: async (e, t) => {
+			let n = await k(e, t.id);
+			if (!_(n.set, t)) return g("changed");
+			let r;
+			for (let e of n.outputs) {
+				let n = T[e.region] ?? g("regions");
+				await n.verify(t, e.outputId);
+				let i = await n.readArtifacts(t, e.outputId);
+				if (r !== void 0 && !_(r, i)) return g("integrity");
+				r = i;
+			}
+			if (r === void 0) return g("regions");
+			let i = [];
+			for (let r of n.pathSets) {
+				let n = t.manifest.paths.find((e) => e.host === r.host) ?? g("integrity");
+				i.push(await a(e, y, {
+					id: r.jobId,
+					digest: n.setId
+				}, x));
+			}
+			return {
+				...r,
+				pathSets: i
+			};
+		}
+	});
+	return {
+		...l({
+			store: h,
+			scope: y,
+			key: S,
+			...s.verificationKeys === void 0 ? {} : { verificationKeys: s.verificationKeys },
+			now: b,
+			readSet: async (e, t) => (await k(e, t)).set,
+			readDeployment: async (e, t) => {
+				let n = await e.query({
+					table: u,
+					predicate: p(m("tenantId", y.tenantId), m("site", y.site), m("environment", y.environment), m("deploymentId", t)),
+					order: [],
+					take: 2,
+					skip: void 0,
+					projection: ["targetId"]
+				});
+				if (n.length !== 1 || typeof n[0].targetId != "string") return g("state");
+				let r = await A(e, await k(e, n[0].targetId));
+				return {
+					app: r.app,
+					renderPolicyDigest: r.renderPolicyDigest
+				};
+			},
+			admit: j,
+			readRoutes: (e, t) => (T[t.region] ?? g("regions")).readRoutes(e, t.outputId),
+			regions: Object.fromEntries(C.map((e) => {
+				let t = T[e];
+				return [e, {
+					key: t.key,
+					verificationKeys: t.verificationKeys,
+					verify: async (n, r, i) => {
+						if ((await k(n, r.id)).outputs.find((t) => t.region === e)?.outputId !== i) return g("regions");
+						await t.verify(r, i);
+					}
+				}];
+			}))
+		}),
+		prepare: (e) => {
+			let r = structuredClone(e);
+			return E(async (e) => {
+				let i = await D(r.credential, e, async (e) => {
+					let i = await O(e, r.snapshot, r.deploymentId);
+					if (!Array.isArray(r.pathSets) || r.pathSets.length < 1 || r.pathSets.length > 256) return g("input");
+					let o = [...r.pathSets].sort((e, t) => e.host < t.host ? -1 : +(e.host > t.host)), s = [];
+					for (let t of o) {
+						let n = await a(e, y, {
+							id: t.jobId,
+							digest: t.digest
+						}, x);
+						s.push({
+							host: t.host,
+							setId: n.set.id,
+							count: n.set.manifest.count
+						});
+					}
+					let c = {
+						version: 2,
+						scope: y,
+						...i,
+						paths: s,
+						artifacts: r.artifacts,
+						regions: {
+							required: C,
+							quorum: w
+						}
+					};
+					return {
+						set: t({
+							...c,
+							cacheNamespace: n({
+								domain: "voltro.cms.output.namespace/v1",
+								manifest: c
+							})
+						}),
+						pathSets: o.map(({ host: e, jobId: t }) => ({
+							host: e,
+							jobId: t
+						}))
+					};
+				}), o = [];
+				for (let t of C) {
+					e.throwIfAborted();
+					let n = await T[t].stage(i.set);
+					e.throwIfAborted(), await T[t].verify(i.set, n.outputId), o.push({
+						region: t,
+						outputId: n.outputId
+					});
+				}
+				return D(r.credential, e, async (e) => {
+					let t = {
+						...i,
+						outputs: o
+					};
+					return await A(e, t), f(e, y, t, x);
+				});
+			});
+		}
+	};
+};
+export { y as createCmsNativeOutputDeployments };

package/dist/outputActivation.js

@@ -0,0 +1,233 @@
+import { normalizeHost as e } from "./domainHost.js";
+import { Schema as t } from "effect";
+import { createHash as n, createHmac as r, timingSafeEqual as i } from "node:crypto";
+import { canonicalJson as a } from "@voltro/runtime";
+// src/outputActivation.ts
+var o = class extends t.TaggedError()("OutputActivationUnavailable", { reason: t.Literals([
+	"input",
+	"integrity",
+	"state",
+	"changed",
+	"generation",
+	"regions",
+	"denied",
+	"expired"
+]) }) {}, s = (e) => n("sha256").update(a(e)).digest("hex"), c = (e) => {
+	throw new o({ reason: e });
+}, l = c, u = (e) => typeof e == "string" && /^[a-f0-9]{64}$/.test(e), d = (e) => typeof e == "string" && /^[A-Za-z0-9_-]{1,64}$/.test(e), f = (e, t) => {
+	if (!e || typeof e != "object" || Array.isArray(e) || ![Object.prototype, null].includes(Object.getPrototypeOf(e)) || Object.getOwnPropertySymbols(e).length > 0) return l("input");
+	let n = Object.getOwnPropertyDescriptors(e);
+	return Object.keys(n).sort().join(",") !== [...t].sort().join(",") || Object.values(n).some((e) => !e.enumerable || !("value" in e)) ? l("input") : e;
+}, p = (e, t) => !Array.isArray(e) || e.length < 1 || e.length > t || Object.getOwnPropertySymbols(e).length > 0 || Object.keys(e).length !== e.length ? l("input") : Array.from({ length: e.length }, (t, n) => {
+	let r = Object.getOwnPropertyDescriptor(e, String(n));
+	return r === void 0 || !r.enumerable || !("value" in r) ? l("input") : r.value;
+}), m = (e) => {
+	let t = f(e, [
+		"tenantId",
+		"site",
+		"environment"
+	]);
+	return Object.values(t).every(d) ? {
+		tenantId: String(t.tenantId),
+		site: String(t.site),
+		environment: String(t.environment)
+	} : l("input");
+}, h = (e) => s({
+	contractVersion: e.contractVersion,
+	bindingsDigest: e.bindingsDigest,
+	schemaDigest: e.schemaDigest,
+	cacheKeyDigest: e.cacheKeyDigest
+}), g = (e) => {
+	let t = f(e, [
+		"publicationGeneration",
+		"releaseId",
+		"deploymentId",
+		"renderPolicyDigest",
+		"contractDigest"
+	]);
+	return typeof t.publicationGeneration != "string" || !/^\d{20}$/.test(t.publicationGeneration) || !(t.releaseId === null || d(t.releaseId)) || !d(t.deploymentId) || !u(t.renderPolicyDigest) || !u(t.contractDigest) ? l("input") : { ...t };
+}, _ = (e) => {
+	let t = f(e, [
+		"deploymentId",
+		"inputsId",
+		"executionId",
+		"contractVersion",
+		"bindingsDigest",
+		"schemaDigest",
+		"cacheKeyDigest"
+	]);
+	return !d(t.deploymentId) || ![
+		"inputsId",
+		"executionId",
+		"bindingsDigest",
+		"schemaDigest",
+		"cacheKeyDigest"
+	].every((e) => u(t[e])) || !Number.isSafeInteger(t.contractVersion) || Number(t.contractVersion) < 1 ? l("input") : { ...t };
+}, v = (t) => {
+	let n = f(t, [
+		"version",
+		"scope",
+		"snapshot",
+		"app",
+		"renderPolicyDigest",
+		"paths",
+		"artifacts",
+		"cacheNamespace",
+		"regions"
+	]);
+	if (n.version !== 2 || !u(n.renderPolicyDigest) || !u(n.cacheNamespace)) return l("input");
+	let r = m(n.scope), i = f(n.snapshot, [
+		"id",
+		"digest",
+		"releaseId",
+		"publicationGeneration"
+	]);
+	if (!d(i.id) || !u(i.digest) || !d(i.releaseId) || typeof i.publicationGeneration != "string" || !/^\d{20}$/.test(i.publicationGeneration)) return l("input");
+	let a = _(n.app), o = "", s = p(n.paths, 256).map((t) => {
+		let n = f(t, [
+			"host",
+			"setId",
+			"count"
+		]);
+		return typeof n.host != "string" || n.host <= o || n.host.length > 253 || e(n.host) !== n.host || !u(n.setId) || !Number.isSafeInteger(n.count) || Number(n.count) < 0 || Number(n.count) > 1e5 ? l("input") : (o = n.host, {
+			host: n.host,
+			setId: n.setId,
+			count: Number(n.count)
+		});
+	}), c = p(n.artifacts, 256).map((e, t) => {
+		let n = f(e, [
+			"host",
+			"documents",
+			"assets",
+			"redirects",
+			"sitemap",
+			"robots",
+			"deny"
+		]);
+		return n.host !== s[t]?.host || ![
+			"documents",
+			"assets",
+			"redirects",
+			"sitemap",
+			"robots",
+			"deny"
+		].every((e) => u(n[e])) ? l("input") : { ...n };
+	});
+	if (c.length !== s.length) return l("input");
+	let h = f(n.regions, ["required", "quorum"]), g = p(h.required, 64);
+	return g.some((e, t, n) => !d(e) || t > 0 && String(n[t - 1]) >= String(e)) || !Number.isSafeInteger(h.quorum) || Number(h.quorum) < 1 || Number(h.quorum) > g.length ? l("input") : {
+		version: 2,
+		scope: r,
+		snapshot: { ...i },
+		app: a,
+		renderPolicyDigest: n.renderPolicyDigest,
+		paths: s,
+		artifacts: c,
+		cacheNamespace: n.cacheNamespace,
+		regions: {
+			required: g,
+			quorum: Number(h.quorum)
+		}
+	};
+}, y = (e) => {
+	let t = v(e);
+	return {
+		id: s(t),
+		manifest: t
+	};
+}, b = (e) => {
+	let t = f(e, ["id", "manifest"]), n = y(t.manifest);
+	return t.id === n.id ? n : l("integrity");
+}, x = (e, t, n) => !d(n.id) || !(n.material instanceof Uint8Array) || n.material.byteLength < 32 ? l("input") : r("sha256", n.material).update(a({
+	purpose: e,
+	body: t,
+	keyId: n.id
+})).digest("hex"), S = (e, t, n, r, a) => {
+	if (a.length === 0 || new Set(a.map((e) => e.id)).size !== a.length) return l("input");
+	let o = a.find((e) => e.id === r);
+	if (o === void 0 || !u(n) || !i(Buffer.from(x(e, t, o), "hex"), Buffer.from(n, "hex"))) return l("integrity");
+}, C = (e, t) => {
+	let n = {
+		version: 1,
+		targetId: e.targetId,
+		expectedGeneration: e.expectedGeneration,
+		mode: e.mode,
+		expiresAt: e.expiresAt,
+		scope: m(e.scope),
+		observation: g(e.observation)
+	};
+	return !u(n.targetId) || !Number.isSafeInteger(n.expectedGeneration) || n.expectedGeneration < 0 || n.expectedGeneration >= 2 ** 53 - 1 || !["forward", "rollback"].includes(n.mode) || !Number.isSafeInteger(n.expiresAt) || n.expiresAt <= 0 || n.expiresAt > 864e13 ? l("input") : {
+		...n,
+		id: s(n),
+		keyId: t.id,
+		signature: x("voltro.cms.output-activation-probe/v1", n, t)
+	};
+}, w = (e, t, n) => {
+	let r = f(e, [
+		"version",
+		"id",
+		"targetId",
+		"scope",
+		"expectedGeneration",
+		"mode",
+		"observation",
+		"expiresAt",
+		"keyId",
+		"signature"
+	]);
+	if (r.version !== 1 || !u(r.id) || !u(r.targetId) || !d(r.keyId) || !Number.isSafeInteger(r.expectedGeneration) || Number(r.expectedGeneration) < 0 || Number(r.expectedGeneration) >= 2 ** 53 - 1 || !["forward", "rollback"].includes(String(r.mode)) || !Number.isSafeInteger(r.expiresAt) || !Number.isSafeInteger(n)) return l("input");
+	let i = {
+		version: 1,
+		targetId: r.targetId,
+		scope: m(r.scope),
+		expectedGeneration: Number(r.expectedGeneration),
+		mode: r.mode,
+		observation: g(r.observation),
+		expiresAt: Number(r.expiresAt)
+	};
+	return s(i) === r.id ? (S("voltro.cms.output-activation-probe/v1", i, r.signature, r.keyId, t), i.expiresAt <= n ? l("expired") : {
+		...i,
+		id: r.id,
+		keyId: r.keyId,
+		signature: String(r.signature)
+	}) : l("integrity");
+}, T = (e, t, n, r) => {
+	if (!d(t) || !u(r)) return l("input");
+	let i = {
+		version: 1,
+		probeId: e.id,
+		targetId: e.targetId,
+		generation: e.expectedGeneration + 1,
+		region: t,
+		outputId: r
+	};
+	return {
+		...i,
+		keyId: n.id,
+		signature: x("voltro.cms.output-region-receipt/v1", i, n)
+	};
+}, E = (e, t, n, r) => {
+	if (!Array.isArray(n) || n.length > e.manifest.regions.required.length) return l("regions");
+	let i = /* @__PURE__ */ new Set(), a = n.map((n) => {
+		let a = f(n, [
+			"version",
+			"probeId",
+			"targetId",
+			"generation",
+			"region",
+			"outputId",
+			"keyId",
+			"signature"
+		]);
+		return a.version !== 1 || a.probeId !== t.id || a.targetId !== e.id || a.generation !== t.expectedGeneration + 1 || typeof a.region != "string" || !e.manifest.regions.required.includes(a.region) || i.has(a.region) || !u(a.outputId) ? l("regions") : (i.add(a.region), S("voltro.cms.output-region-receipt/v1", {
+			version: 1,
+			probeId: a.probeId,
+			targetId: a.targetId,
+			generation: a.generation,
+			region: a.region,
+			outputId: a.outputId
+		}, a.signature, a.keyId, r[a.region] ?? []), { ...a });
+	});
+	return i.size < e.manifest.regions.quorum ? l("regions") : a.sort((e, t) => e.region < t.region ? -1 : +(e.region > t.region));
+};
+export { o as OutputActivationUnavailable, _ as copyOutputActivationApp, v as copyOutputActivationManifest, g as copyOutputActivationObservation, m as copyOutputActivationScope, b as copyOutputActivationSet, y as createOutputActivationSet, C as makeOutputActivationProbe, T as makeOutputRegionReceipt, h as outputActivationContractDigest, c as outputActivationFail, s as outputActivationHash, w as verifyOutputActivationProbe, E as verifyOutputRegionReceipts };

package/dist/outputActivationOrigin.js

@@ -0,0 +1,50 @@
+import { copyOutputActivationManifest as e, outputActivationFail as t, outputActivationHash as n } from "./outputActivation.js";
+import { copySnapshotResource as r } from "./buildSnapshot.js";
+// src/outputActivationOrigin.ts
+var i = (e) => !e || typeof e != "object" || Array.isArray(e) ? t("input") : e, a = (a) => {
+	if (!/^[A-Za-z0-9_-]{1,64}$/.test(a.activationId) || !Number.isSafeInteger(a.generation) || a.generation < 1) return t("input");
+	let o = i(r({
+		key: "stored-output-origin",
+		value: { manifest: a.manifest }
+	}).value.manifest);
+	if (typeof a.setId != "string" || !/^[a-f0-9]{64}$/.test(a.setId) || n(o) !== a.setId) return t("integrity");
+	if (o.version === 1) {
+		let r = i(o.artifacts), s = o.paths;
+		if (Object.keys(r).sort().join(",") !== "assets,deny,documents,redirects,robots,sitemap" || !Array.isArray(s)) return t("input");
+		let c = e({
+			...o,
+			version: 2,
+			artifacts: s.map((e) => ({
+				...r,
+				host: i(e).host
+			}))
+		});
+		return {
+			scope: c.scope,
+			sourceDigest: n({
+				version: 1,
+				scope: c.scope,
+				activationId: a.activationId,
+				generation: a.generation,
+				setId: a.setId,
+				documentArtifactId: r.documents
+			})
+		};
+	}
+	let s = e(o);
+	return {
+		scope: s.scope,
+		sourceDigest: n({
+			version: 2,
+			scope: s.scope,
+			activationId: a.activationId,
+			generation: a.generation,
+			setId: a.setId,
+			documentArtifacts: s.artifacts.map((e) => ({
+				host: e.host,
+				artifactId: e.documents
+			}))
+		})
+	};
+};
+export { a as copyStoredOutputActivationOrigin };