@voltro/cms 0.86.0 → 0.88.0

package/dist/outputActivationStore.js

@@ -0,0 +1,410 @@
+import { copyOutputActivationManifest as e, copyOutputActivationObservation as t, copyOutputActivationScope as n, copyOutputActivationSet as r, makeOutputActivationProbe as i, outputActivationContractDigest as a, outputActivationFail as o, outputActivationHash as s, verifyOutputActivationProbe as c, verifyOutputRegionReceipts as l } from "./outputActivation.js";
+import { copyObservedRoutes as u } from "./routeHistoryStorage.js";
+import { copySnapshotResource as d } from "./buildSnapshot.js";
+import { staticPathUrl as f } from "./staticPathSet.js";
+import { copyStoredOutputActivationOrigin as p } from "./outputActivationOrigin.js";
+import { iterateRouteHistory as m, readRouteHistoryPage as h, replaceRouteHistory as g, routeHistoryTables as _ } from "./routeHistoryStore.js";
+import { and as v, eq as y, generateId as b, gt as x, id as S, integer as C, json as w, table as T, text as E, timestamp as D } from "@voltro/database";
+import { tenant as O } from "@voltro/plugin-multitenancy/mixin";
+import { canonicalJson as k } from "@voltro/runtime";
+// src/outputActivationStore.ts
+var A = "_voltro_cms_output_heads", j = "_voltro_cms_output_activations", M = "_voltro_cms_output_denies", N = T(A, {
+	id: S({ prefix: "couth" }),
+	site: E().maxLength(64),
+	environment: E().maxLength(64),
+	generation: C(),
+	safetyGeneration: C(),
+	activeMarkerId: E().maxLength(64).nullable()
+}).with(O()).unique("cms_output_head_scope", [
+	"tenantId",
+	"site",
+	"environment"
+]), P = T(j, {
+	id: S({ prefix: "couta" }),
+	site: E().maxLength(64),
+	environment: E().maxLength(64),
+	generation: C(),
+	setId: E().maxLength(64),
+	manifest: w(),
+	probe: w(),
+	receipts: w(),
+	activatedAt: D()
+}).with(O()).unique("cms_output_activation_generation", [
+	"tenantId",
+	"site",
+	"environment",
+	"generation"
+]), F = T(M, {
+	id: S({ prefix: "coutd" }),
+	site: E().maxLength(64),
+	environment: E().maxLength(64),
+	keyDigest: E().maxLength(64),
+	target: w(),
+	reason: E().oneOf([
+		"security",
+		"rights",
+		"takedown"
+	])
+}).with(O()).unique("cms_output_safety_deny", [
+	"tenantId",
+	"site",
+	"environment",
+	"keyDigest"
+]), I = Object.freeze([
+	N,
+	P,
+	F,
+	..._
+]), L = (e) => v(y("tenantId", e.tenantId), y("site", e.site), y("environment", e.environment)), R = (e, t) => {
+	let n = b({
+		kind: "typeid",
+		prefix: e
+	}, t);
+	return n === null ? o("state") : n;
+}, z = (e) => typeof e.id != "string" || !Number.isSafeInteger(e.generation) || Number(e.generation) < 0 || !Number.isSafeInteger(e.safetyGeneration) || Number(e.safetyGeneration) < 0 || e.activeMarkerId !== null && typeof e.activeMarkerId != "string" || e.generation === 0 != (e.activeMarkerId === null) ? o("state") : {
+	id: e.id,
+	generation: Number(e.generation),
+	safetyGeneration: Number(e.safetyGeneration),
+	activeMarkerId: e.activeMarkerId
+}, B = async (e, t, n, r = "update") => {
+	n && await e.insertIgnore(A, {
+		id: R("couth", A),
+		...t,
+		generation: 0,
+		safetyGeneration: 0,
+		activeMarkerId: null
+	}, { conflictColumns: [
+		"tenantId",
+		"site",
+		"environment"
+	] });
+	let [i] = await e.query({
+		table: A,
+		predicate: L(t),
+		lock: r,
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: void 0
+	});
+	return i === void 0 ? null : z(i);
+}, V = async (e, t) => {
+	let r = n(t), i = await B(e, r, !0);
+	if (i === null) return o("state");
+	let [a] = await e.query({
+		table: j,
+		predicate: i.generation === 0 ? L(r) : v(L(r), x("generation", i.generation)),
+		lock: "update",
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: ["id"]
+	});
+	if (a !== void 0) return o("state");
+	if (i.activeMarkerId === null) return {
+		generation: 0,
+		activationId: null,
+		sourceDigest: null
+	};
+	let [s] = await e.query({
+		table: j,
+		predicate: v(L(r), y("id", i.activeMarkerId)),
+		lock: "update",
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: void 0
+	});
+	if (s === void 0 || s.generation !== i.generation) return o("state");
+	let c = p({
+		setId: s.setId,
+		manifest: s.manifest,
+		activationId: i.activeMarkerId,
+		generation: i.generation
+	});
+	return W(c.scope, r) ? {
+		generation: i.generation,
+		activationId: i.activeMarkerId,
+		sourceDigest: c.sourceDigest
+	} : o("state");
+}, H = (e, t, n, r) => {
+	let i = p({
+		setId: r.id,
+		manifest: r.manifest,
+		activationId: t,
+		generation: n
+	});
+	return W(i.scope, e) ? i.sourceDigest : o("state");
+}, U = async (e, t, n) => {
+	let r = await n(e, t);
+	if (typeof r != "object" || !r || Array.isArray(r) || ![Object.prototype, null].includes(Object.getPrototypeOf(r)) || Object.getOwnPropertySymbols(r).length > 0) return o("input");
+	let i = Object.getOwnPropertyDescriptors(r);
+	if (Object.keys(i).sort().join(",") !== "documentArtifacts,routes" || Object.values(i).some((e) => !e.enumerable || !("value" in e))) return o("integrity");
+	let a = d({
+		key: "activation-documents",
+		value: { artifacts: i.documentArtifacts.value }
+	}).value.artifacts;
+	if (k(a) !== k(e.manifest.artifacts.map((e) => ({
+		host: e.host,
+		artifactId: e.documents
+	})))) return o("integrity");
+	let s = u(i.routes.value), c = /* @__PURE__ */ new Map();
+	for (let t of s) {
+		let n = new URL(t.url).hostname;
+		if (!e.manifest.paths.some((e) => e.host === n)) return o("integrity");
+		c.set(n, (c.get(n) ?? 0) + 1);
+	}
+	return e.manifest.paths.some((e) => (c.get(e.host) ?? 0) !== e.count) ? o("integrity") : s;
+}, W = (e, t) => k(e) === k(t), G = async (e, n, r, i) => {
+	let s = t(await i(e, n, r));
+	return r === "forward" && (s.publicationGeneration !== n.manifest.snapshot.publicationGeneration || s.releaseId !== n.manifest.snapshot.releaseId || s.deploymentId !== n.manifest.app.deploymentId || s.renderPolicyDigest !== n.manifest.renderPolicyDigest || s.contractDigest !== a(n.manifest.app)) ? o("changed") : s;
+}, K = async (t, n) => {
+	let [r] = await t.query({
+		table: j,
+		predicate: v(L(n.manifest.scope), y("setId", n.id)),
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: void 0
+	});
+	if (r === void 0 || k(e(r.manifest)) !== k(n.manifest)) return o("state");
+}, q = async (e, t, i) => {
+	let a = n(t), s = await B(e, a, !1);
+	if (s === null || s.generation === 0) return {
+		revision: 0,
+		historyCount: 0
+	};
+	let u = 0, d;
+	for (; u < s.generation;) {
+		let t = await e.query({
+			table: j,
+			predicate: v(L(a), x("generation", u)),
+			lock: "update",
+			order: [{
+				column: "generation",
+				direction: "asc"
+			}],
+			take: 100,
+			skip: void 0,
+			projection: void 0
+		});
+		if (t.length === 0) return o("state");
+		for (let n of t) {
+			if (n.generation !== u + 1 || u >= s.generation || typeof n.id != "string") return o("state");
+			let t = r({
+				id: n.setId,
+				manifest: n.manifest
+			}), f = n.activatedAt instanceof Date ? n.activatedAt.getTime() : new Date(String(n.activatedAt)).getTime(), p = c(n.probe, i.keys, f);
+			if (!W(t.manifest.scope, a) || !W(p.scope, a) || p.targetId !== t.id || p.expectedGeneration !== u) return o("integrity");
+			let m = l(t, p, n.receipts, i.regionKeys), _ = await G(e, t, "rollback", i.admit), v = await U(t, m[0], i.readRoutes);
+			if (k(await G(e, t, "rollback", i.admit)) !== k(_)) return o("changed");
+			if (d ??= await h(e, a), d.revision !== 0 && d.revision !== s.generation) return o("state");
+			u++;
+			let y = H(a, n.id, u, t);
+			if (d.revision === 0 && await g(e, a, {
+				expectedRevision: u - 1,
+				sourceDigest: y,
+				routes: v
+			}), u === s.generation && (n.id !== s.activeMarkerId || d.revision !== 0 && d.sourceDigest !== y)) return o("state");
+		}
+	}
+	let f = await h(e, a);
+	for await (let t of m(e, a, f.revision));
+	return {
+		revision: f.revision,
+		historyCount: f.historyCount
+	};
+}, J = async (e, t, n) => {
+	let a = r(t), s = await B(e, a.manifest.scope, !0);
+	if (s === null || s.generation !== n.expectedGeneration || s.generation >= 2147483647) return o("generation");
+	if (!Number.isSafeInteger(n.now) || n.now < 0 || !Number.isSafeInteger(n.ttlMs) || n.ttlMs < 1 || n.ttlMs > 3e4) return o("input");
+	n.mode === "rollback" && await K(e, a);
+	let c = await G(e, a, n.mode, n.admit);
+	return i({
+		targetId: a.id,
+		scope: a.manifest.scope,
+		expectedGeneration: s.generation,
+		mode: n.mode,
+		observation: c,
+		expiresAt: n.now + n.ttlMs
+	}, n.key);
+}, Y = async (e, t, n) => {
+	let i = r(t), a = c(n.probe, n.keys, n.now);
+	if (a.targetId !== i.id || !W(a.scope, i.manifest.scope)) return o("integrity");
+	let s = await B(e, i.manifest.scope, !1);
+	if (s === null || s.generation !== a.expectedGeneration) return o("generation");
+	a.mode === "rollback" && await K(e, i);
+	let u = await G(e, i, a.mode, n.admit);
+	if (k(u) !== k(a.observation)) return o("changed");
+	let d = l(i, a, n.receipts, n.regionKeys), f = await U(i, d[0], n.readRoutes);
+	if (k(await G(e, i, a.mode, n.admit)) !== k(u)) return o("changed");
+	let m = await h(e, i.manifest.scope);
+	if (m.revision !== s.generation) return o("state");
+	if (s.activeMarkerId !== null) {
+		let [t] = await e.query({
+			table: j,
+			predicate: v(L(i.manifest.scope), y("id", s.activeMarkerId)),
+			lock: "update",
+			order: [],
+			take: 1,
+			skip: void 0,
+			projection: void 0
+		});
+		if (t === void 0 || t.generation !== s.generation) return o("state");
+		let n = p({
+			setId: t.setId,
+			manifest: t.manifest,
+			activationId: s.activeMarkerId,
+			generation: s.generation
+		});
+		if (!W(n.scope, i.manifest.scope) || m.sourceDigest !== n.sourceDigest) return o("state");
+	}
+	let _ = {
+		id: R("couta", j),
+		generation: s.generation + 1,
+		set: i,
+		probe: a,
+		receipts: d,
+		activatedAt: n.now
+	};
+	return await e.updateMany("_voltro_cms_output_heads", {
+		generation: _.generation,
+		activeMarkerId: _.id
+	}, { where: v(L(i.manifest.scope), y("id", s.id), y("generation", s.generation)) }) === 1 ? (await e.insert(j, {
+		id: _.id,
+		...i.manifest.scope,
+		generation: _.generation,
+		setId: i.id,
+		manifest: i.manifest,
+		probe: a,
+		receipts: d,
+		activatedAt: new Date(n.now)
+	}), await g(e, i.manifest.scope, {
+		expectedRevision: m.revision,
+		sourceDigest: H(i.manifest.scope, _.id, _.generation, i),
+		routes: f
+	}), _) : o("generation");
+}, X = (e) => {
+	if (!e || typeof e != "object") return o("input");
+	if (e.kind === "asset" && Object.keys(e).sort().join(",") === "digest,kind" && /^[a-f0-9]{64}$/.test(e.digest)) return { ...e };
+	if (e.kind === "url" && Object.keys(e).sort().join(",") === "kind,url") try {
+		let t = new URL(e.url);
+		if (t.protocol === "https:" && f(t.hostname, t.pathname) === e.url) return { ...e };
+	} catch {
+		return o("input");
+	}
+	return o("input");
+}, Z = async (e, t, r = {}) => {
+	let i = n(t), { expectedGeneration: a, after: c, take: l = 500 } = r;
+	if (!Number.isSafeInteger(l) || l < 1 || l > 1e3 || a !== void 0 && (!Number.isSafeInteger(a) || a < 0 || a > 2147483647) || c !== void 0 && (a === void 0 || typeof c != "string" || !/^[a-f0-9]{64}$/.test(c))) return o("input");
+	let u = (await B(e, i, !1))?.safetyGeneration ?? 0;
+	if (u > 2147483647) return o("state");
+	if (a !== void 0 && a !== u) return o("generation");
+	let d = await e.query({
+		table: M,
+		predicate: v(L(i), ...c === void 0 ? [] : [x("keyDigest", c)]),
+		lock: "update",
+		order: [{
+			column: "keyDigest",
+			direction: "asc"
+		}],
+		take: l + 1,
+		skip: void 0,
+		projection: [
+			"keyDigest",
+			"target",
+			"reason"
+		]
+	});
+	if (d.length > l + 1 || d.length > u || c === void 0 && d.length <= l && d.length !== u) return o("state");
+	let f = c ?? "", p = d.map((e) => {
+		let t = X(e.target), n = e.keyDigest, r = e.reason;
+		return typeof n != "string" || !/^[a-f0-9]{64}$/.test(n) || n <= f || s(t) !== n ? o("integrity") : r !== "security" && r !== "rights" && r !== "takedown" ? o("state") : (f = n, {
+			keyDigest: n,
+			target: t,
+			reason: r
+		});
+	});
+	return {
+		generation: u,
+		entries: p.slice(0, l),
+		next: p.length > l ? p[l - 1].keyDigest : null
+	};
+}, Q = async (e, t, r, i) => {
+	let a = n(t), c = X(r);
+	if (![
+		"security",
+		"rights",
+		"takedown"
+	].includes(i)) return o("input");
+	let l = await B(e, a, !0);
+	if (l === null || l.safetyGeneration >= 2147483647) return o("state");
+	let u = s(c), [d] = await e.query({
+		table: M,
+		predicate: v(L(a), y("keyDigest", u)),
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: void 0
+	});
+	if (d !== void 0) return k(d.target) === k(c) ? l.safetyGeneration : o("integrity");
+	await e.insert(M, {
+		id: R("coutd", M),
+		...a,
+		keyDigest: u,
+		target: c,
+		reason: i
+	});
+	let f = l.safetyGeneration + 1;
+	return await e.update(A, l.id, { safetyGeneration: f }), f;
+}, $ = async (e, t, n, i) => {
+	if (n.activeMarkerId === null) return o("state");
+	let [a] = await e.query({
+		table: j,
+		predicate: v(L(t), y("id", n.activeMarkerId)),
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: void 0
+	});
+	if (a === void 0 || a.generation !== n.generation) return o("state");
+	let s = a.activatedAt instanceof Date ? a.activatedAt.getTime() : typeof a.activatedAt == "string" ? Date.parse(a.activatedAt) : NaN;
+	if (!Number.isSafeInteger(s)) return o("state");
+	let u = r({
+		id: a.setId,
+		manifest: a.manifest
+	});
+	if (!W(t, u.manifest.scope)) return o("integrity");
+	let d = c(a.probe, i.keys, s);
+	if (d.targetId !== u.id || d.expectedGeneration + 1 !== n.generation || !W(d.scope, t)) return o("integrity");
+	let f = l(u, d, a.receipts, i.regionKeys);
+	return {
+		id: n.activeMarkerId,
+		generation: n.generation,
+		set: u,
+		probe: d,
+		receipts: f,
+		activatedAt: s
+	};
+}, ee = async (e, t, r) => {
+	let i = n(t), a = await B(e, i, !1, r.lock ?? "update");
+	return a === null || a.activeMarkerId === null ? null : $(e, i, a, r);
+}, te = async (e, t, r, i) => {
+	let a = n(t), c = X(r), l = await B(e, a, !1, i.lock ?? "update");
+	if (l === null || l.activeMarkerId === null) return null;
+	let [u] = await e.query({
+		table: M,
+		predicate: v(L(a), y("keyDigest", s(c))),
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: void 0
+	});
+	if (u !== void 0) return o("denied");
+	let d = await $(e, a, l, i), f = d.receipts.find((e) => e.region === i.region);
+	return f === void 0 ? o("regions") : (await i.admit(e, d.set, c, f), {
+		marker: d,
+		safetyGeneration: l.safetyGeneration
+	});
+};
+export { j as OUTPUT_ACTIVATIONS, A as OUTPUT_ACTIVATION_HEADS, M as OUTPUT_SAFETY_DENIES, Y as activateOutputSet, Q as denyOutputTarget, q as initializeOutputRouteHistory, V as lockOutputRouteHistoryCapture, N as outputActivationHeadsTable, I as outputActivationTables, P as outputActivationsTable, F as outputSafetyDeniesTable, J as probeOutputActivation, te as readActiveOutput, ee as readOutputActivationMarker, Z as readOutputSafetyPage };

package/dist/outputActivationTables.js

@@ -0,0 +1,10 @@
+import { outputActivationTables as e } from "./outputActivationStore.js";
+import { outputDeploymentTables as t } from "./outputDeployment.js";
+import { outputActivationTargetsTable as n } from "./outputActivationTargetTable.js";
+// src/outputActivationTables.ts
+var r = Object.freeze([
+	...e,
+	...t,
+	n
+]);
+export { r as cmsOutputActivationTables };

package/dist/outputActivationTarget.js

@@ -0,0 +1,80 @@
+import { copyOutputActivationScope as e, copyOutputActivationSet as t, outputActivationFail as n } from "./outputActivation.js";
+import { copySnapshotResource as r } from "./buildSnapshot.js";
+import { readStaticPathSetEvidence as i } from "./staticPathSetStore.js";
+import { OUTPUT_ACTIVATION_TARGETS as a } from "./outputActivationTargetTable.js";
+import { and as o, eq as s } from "@voltro/database";
+import { canonicalJson as c } from "@voltro/protocol";
+// src/outputActivationTarget.ts
+var l = (e, t) => typeof e != "object" || !e || Array.isArray(e) || Object.keys(e).sort().join(",") !== t ? n("input") : e, u = (e) => {
+	let i = l(r({
+		key: "output-target",
+		value: e
+	}).value, "outputs,pathSets,set"), a = t(i.set);
+	if (!Array.isArray(i.pathSets) || i.pathSets.length !== a.manifest.paths.length || !Array.isArray(i.outputs) || i.outputs.length !== a.manifest.regions.required.length) return n("input");
+	let o = i.pathSets.map((e) => {
+		let t = l(e, "host,jobId");
+		return typeof t.host != "string" || typeof t.jobId != "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(t.jobId) ? n("input") : {
+			host: t.host,
+			jobId: t.jobId
+		};
+	}).sort((e, t) => e.host < t.host ? -1 : +(e.host > t.host)), s = i.outputs.map((e) => {
+		let t = l(e, "outputId,region");
+		return typeof t.region != "string" || typeof t.outputId != "string" || !/^[a-f0-9]{64}$/.test(t.outputId) ? n("input") : {
+			region: t.region,
+			outputId: t.outputId
+		};
+	}).sort((e, t) => e.region < t.region ? -1 : +(e.region > t.region));
+	return o.some((e, t) => e.host !== a.manifest.paths[t].host) || s.some((e, t) => e.region !== a.manifest.regions.required[t]) ? n("changed") : {
+		set: a,
+		pathSets: o,
+		outputs: s
+	};
+}, d = (e, t) => o(s("tenantId", e.tenantId), s("site", e.site), s("environment", e.environment), s("targetId", t)), f = async (t, r, i) => {
+	let o = e(r);
+	if (typeof i != "string" || !/^[a-f0-9]{64}$/.test(i)) return n("input");
+	let s = await t.query({
+		table: a,
+		predicate: d(o, i),
+		order: [],
+		take: 2,
+		skip: void 0,
+		projection: void 0
+	});
+	if (s.length === 0) return null;
+	if (s.length !== 1) return n("state");
+	let l = s[0], f = u({
+		set: {
+			id: i,
+			manifest: l.manifest
+		},
+		pathSets: l.pathSets,
+		outputs: l.outputs
+	});
+	return l.deploymentId !== f.set.manifest.app.deploymentId || c(f.set.manifest.scope) !== c(o) ? n("changed") : f;
+}, p = async (t, r, o, s) => {
+	let l = e(r), d = u(o), p = d.set;
+	if (c(p.manifest.scope) !== c(l)) return n("changed");
+	for (let e of d.pathSets) {
+		let r = p.manifest.paths.find((t) => t.host === e.host), a = await i(t, l, {
+			id: e.jobId,
+			digest: r.setId
+		}, s), o = a.set.manifest.context;
+		if (o.host !== e.host || o.snapshotId !== p.manifest.snapshot.id || o.snapshotDigest !== p.manifest.snapshot.digest || o.releaseId !== p.manifest.snapshot.releaseId || o.inputsId !== p.manifest.app.inputsId || o.executionId !== p.manifest.app.executionId || o.policyDigest !== p.manifest.renderPolicyDigest || a.set.manifest.count !== r.count) return n("changed");
+	}
+	await t.insertIgnore(a, {
+		...l,
+		targetId: p.id,
+		deploymentId: p.manifest.app.deploymentId,
+		manifest: p.manifest,
+		pathSets: d.pathSets,
+		outputs: d.outputs
+	}, { conflictColumns: [
+		"tenantId",
+		"site",
+		"environment",
+		"targetId"
+	] });
+	let m = await f(t, l, p.id);
+	return c(m) === c(d) ? m : n("changed");
+};
+export { f as readOutputActivationTarget, p as retainOutputActivationTarget };

package/dist/outputActivationTargetTable.js

@@ -0,0 +1,24 @@
+import { id as e, json as t, table as n, text as r } from "@voltro/database";
+import { tenant as i } from "@voltro/plugin-multitenancy/mixin";
+// src/outputActivationTargetTable.ts
+var a = "_voltro_cms_output_targets", o = n("_voltro_cms_output_targets", {
+	id: e({ prefix: "coutt" }),
+	site: r().maxLength(64),
+	environment: r().maxLength(64),
+	targetId: r().maxLength(64),
+	deploymentId: r().maxLength(64),
+	manifest: t(),
+	pathSets: t(),
+	outputs: t()
+}).with(i()).unique("cms_output_target_scope", [
+	"tenantId",
+	"site",
+	"environment",
+	"targetId"
+]).unique("cms_output_target_deployment", [
+	"tenantId",
+	"site",
+	"environment",
+	"deploymentId"
+]);
+export { a as OUTPUT_ACTIVATION_TARGETS, o as outputActivationTargetsTable };