@voltro/cms 0.86.0 → 0.88.0

package/dist/release.js

@@ -1,160 +1,190 @@
-import { asTyped as e } from "./effectForm.js";
-import { ContentNotFound as t, ReferenceUnavailable as n, ReleaseNotEditable as r, ReviewRequired as i } from "./errors.js";
-import { publishRevision as a, unpublish as o } from "./write.js";
-import { and as s, eq as c, generateId as l, id as u, integer as d, json as f, lte as p, table as m, text as h, timestamp as g } from "@voltro/database";
-import { tenant as _ } from "@voltro/plugin-multitenancy/mixin";
-//#region src/release.ts
-var v = "cms_releases", y = "cms_release_items", b = [
+import { PublicRouteRegistryUnavailable as e } from "./publicRouteRegistry.js";
+import { ChangeFeedUnavailable as t, ContentNotFound as n, ReferenceUnavailable as r, ReleaseNotEditable as i, ReviewRequired as a } from "./errors.js";
+import { asTyped as o } from "./effectForm.js";
+import { activatePublicationRelease as s, lockPublicationStream as c } from "./changes.js";
+import { withPublicRouteStateMutation as l } from "./publicRouteMutation.js";
+import { withPublicRoutePublicationBatch as u } from "./publicRoutePublication.js";
+import { publishRevision as d, unpublish as f } from "./write.js";
+import { and as p, eq as m, generateId as h, id as g, integer as _, isNull as v, json as y, lte as b, table as x, text as S, timestamp as C } from "@voltro/database";
+import { tenant as w } from "@voltro/plugin-multitenancy/mixin";
+// src/release.ts
+var T = "cms_releases", E = "cms_release_items", D = [
 	"draft",
 	"scheduled",
 	"published",
 	"failed"
-], x = m(v, {
-	id: u({ prefix: "crel" }),
-	name: h(),
-	site: h().maxLength(64),
-	environment: h().maxLength(64),
-	status: h().oneOf(b),
-	scheduledAt: g().nullable(),
-	publishedAt: g().nullable(),
-	rollbackOf: h().nullable(),
-	claimToken: h().nullable(),
-	failure: h().nullable()
-}).with(_()), S = m(y, {
-	id: u({ prefix: "crit" }),
-	releaseId: h(),
-	contentType: h().maxLength(64),
-	variantId: h().maxLength(64),
-	locale: h().maxLength(64),
-	action: h().oneOf(["publish", "unpublish"]),
-	revisionId: h().nullable(),
-	previousRevisionId: h().nullable(),
-	position: d(),
-	inherited: f().nullable()
-}).with(_()).unique("cms_release_items_uq_variant", [
+], O = x(T, {
+	id: g({ prefix: "crel" }),
+	name: S(),
+	site: S().maxLength(64),
+	environment: S().maxLength(64),
+	status: S().oneOf(D),
+	scheduledAt: C().nullable(),
+	publishedAt: C().nullable(),
+	publicationGeneration: S().maxLength(20).nullable(),
+	publicationCheckpoint: S().maxLength(64).nullable(),
+	rollbackOf: S().nullable(),
+	claimToken: S().nullable(),
+	failure: S().nullable()
+}).with(w()), k = x(E, {
+	id: g({ prefix: "crit" }),
+	releaseId: S(),
+	contentType: S().maxLength(64),
+	variantId: S().maxLength(64),
+	locale: S().maxLength(64),
+	action: S().oneOf(["publish", "unpublish"]),
+	revisionId: S().nullable(),
+	previousRevisionId: S().nullable(),
+	position: _(),
+	inherited: y().nullable()
+}).with(w()).unique("cms_release_items_uq_variant", [
 	"tenantId",
 	"releaseId",
 	"contentType",
 	"variantId"
-]), C = (e, t, n, r) => e.query({
+]), A = (e, t, n, r, i) => e.query({
 	table: t,
 	predicate: n,
+	...i === void 0 ? {} : { lock: i },
 	order: r === void 0 ? [] : [r],
 	take: void 0,
 	skip: void 0,
 	projection: void 0
-}), w = async (e, n) => {
-	let [r] = await C(e, v, c("id", n));
-	if (r === void 0) throw new t({
+}), j = async (e, t, r) => {
+	let [i] = await A(e, T, m("id", t), void 0, r);
+	if (i === void 0) throw new n({
 		contentType: "release",
-		id: n,
+		id: t,
 		stage: "draft"
 	});
-	return r;
-}, T = (e, t) => ({
+	return i;
+}, M = async (e, n) => {
+	let r = await j(e, n);
+	if (typeof r.tenantId != "string" || r.tenantId === "") throw new t({ reason: "scope" });
+	return await c(e, {
+		tenantId: r.tenantId,
+		site: String(r.site),
+		environment: String(r.environment)
+	}), j(e, n, "update");
+}, N = (e, t) => ({
 	site: String(e.site),
 	environment: String(e.environment),
 	locale: t
-}), E = (e, t) => e.insert(v, {
+}), P = (e, t) => e.insert(T, {
 	...t,
 	status: "draft"
-}), D = async (e, n, i) => {
-	let a = await w(e, n);
-	if (a.status !== "draft") throw new r({
-		id: n,
+}), F = async (e, t, r) => {
+	let a = await j(e, t, "update");
+	if (a.status !== "draft") throw new i({
+		id: t,
 		status: String(a.status)
 	});
-	let o = T(a, i.locale), [l] = await C(e, `${i.type.name}_drafts`, s(c("id", i.id), c("site", o.site), c("environment", o.environment), c("locale", o.locale)));
-	if (l === void 0) throw new t({
-		contentType: i.type.name,
-		id: i.id,
+	let o = N(a, r.locale), [s] = await A(e, `${r.type.name}_drafts`, p(m("id", r.id), m("site", o.site), m("environment", o.environment), m("locale", o.locale)), void 0, "update");
+	if (s === void 0) throw new n({
+		contentType: r.type.name,
+		id: r.id,
 		stage: "draft"
 	});
-	let u = i.action ?? "publish", d = await C(e, y, s(c("releaseId", n), c("contentType", i.type.name), c("variantId", i.id))), f = {
-		action: u,
-		locale: i.locale,
-		revisionId: u === "publish" ? i.revisionId ?? String(l.revisionId) : null
-	}, [p] = d;
-	if (p !== void 0) return await e.update("cms_release_items", String(p.id), f) ?? p;
-	let m = (await C(e, y, c("releaseId", n))).length;
-	return e.insert(y, {
-		releaseId: n,
-		contentType: i.type.name,
-		variantId: i.id,
-		position: m,
-		...f
+	let c = r.action ?? "publish", l = await A(e, E, p(m("releaseId", t), m("contentType", r.type.name), m("variantId", r.id)), void 0, "update"), u = {
+		action: c,
+		locale: r.locale,
+		revisionId: c === "publish" ? r.revisionId ?? String(s.revisionId) : null
+	}, [d] = l;
+	if (d !== void 0) return await e.update("cms_release_items", String(d.id), u) ?? d;
+	let f = (await A(e, E, m("releaseId", t), void 0, "update")).length;
+	return e.insert(E, {
+		releaseId: t,
+		contentType: r.type.name,
+		variantId: r.id,
+		position: f,
+		...u
 	});
-}, O = async (e, t) => {
-	let [n] = await C(e, v, c("id", t));
+}, I = async (e, t) => {
+	let [n] = await A(e, T, m("id", t));
 	return n === void 0 ? null : String(n.status);
-}, k = (e, t) => C(e, y, c("releaseId", t), {
+}, L = (e, t) => A(e, E, m("releaseId", t), {
 	column: "position",
 	direction: "asc"
-}), A = (e, t) => C(e, v, s(c("site", t.site), c("environment", t.environment)), {
+}), R = (e, t) => A(e, T, p(m("site", t.site), m("environment", t.environment)), {
 	column: "createdAt",
 	direction: "desc"
-}), j = async (e, t, n, r) => {
-	let [i] = await C(e, `${t}_published`, s(c("id", n), c("site", r.site), c("environment", r.environment), c("locale", r.locale)));
+}), z = async (e, t, n, r) => {
+	let [i] = await A(e, `${t}_published`, p(m("id", n), m("site", r.site), m("environment", r.environment), m("locale", r.locale)), void 0, "update");
 	return i === void 0 ? null : String(i.revisionId);
-}, M = async (e, n, i, s = /* @__PURE__ */ new Date(), c = {}) => {
-	let l = await w(e, i);
-	if (l.status !== "draft" && l.status !== "scheduled") throw new r({
-		id: i,
-		status: String(l.status)
+}, B = async (e, t, r, a = /* @__PURE__ */ new Date(), o = {}) => {
+	let c = await M(e, r);
+	if (c.status !== "draft" && c.status !== "scheduled") throw new i({
+		id: r,
+		status: String(c.status)
 	});
-	let u = new Map(n.map((e) => [e.name, e]));
-	for (let n of await k(e, i)) {
-		let r = u.get(String(n.contentType));
-		if (r === void 0) throw new t({
-			contentType: String(n.contentType),
-			id: String(n.variantId),
-			stage: "draft"
-		});
-		let s = T(l, String(n.locale)), c = String(n.variantId), d = await j(e, r.name, c, s);
-		n.action === "publish" ? await a(e, r, c, s, String(n.revisionId), { releaseId: i }) : d !== null && await o(e, r, c, s, { releaseId: i }), await e.update(y, String(n.id), { previousRevisionId: d });
-	}
-	let d = await e.update("cms_releases", i, {
-		status: "published",
-		publishedAt: s
-	}) ?? l;
-	for (let t of c.afterPublish ?? []) await t(e, d, s);
-	return d;
-}, N = async (e, t, n) => {
-	let i = await w(e, t);
-	if (i.status !== "draft") throw new r({
+	return u(e, {
+		tenantId: String(c.tenantId),
+		site: String(c.site),
+		environment: String(c.environment)
+	}, async () => {
+		let i = new Map(t.map((e) => [e.name, e]));
+		for (let t of await A(e, E, m("releaseId", r), {
+			column: "position",
+			direction: "asc"
+		}, "update")) {
+			let a = i.get(String(t.contentType));
+			if (a === void 0) throw new n({
+				contentType: String(t.contentType),
+				id: String(t.variantId),
+				stage: "draft"
+			});
+			let o = N(c, String(t.locale)), s = String(t.variantId), l = await z(e, a.name, s, o);
+			t.action === "publish" ? await d(e, a, s, o, String(t.revisionId), { releaseId: r }) : l !== null && await f(e, a, s, o, { releaseId: r }), await e.update(E, String(t.id), { previousRevisionId: l });
+		}
+		let l = await s(e, {
+			tenantId: String(c.tenantId),
+			site: String(c.site),
+			environment: String(c.environment)
+		}, r), u = await e.update("cms_releases", r, {
+			status: "published",
+			publishedAt: a,
+			publicationGeneration: l.generation,
+			publicationCheckpoint: l.checkpoint
+		}) ?? c;
+		for (let t of o.afterPublish ?? []) await t(e, u, a);
+		return u;
+	});
+}, V = async (e, t, n) => {
+	let r = await j(e, t, "update");
+	if (r.status !== "draft") throw new i({
 		id: t,
-		status: String(i.status)
+		status: String(r.status)
 	});
 	return await e.update("cms_releases", t, {
 		status: "scheduled",
 		scheduledAt: n
-	}) ?? i;
-}, P = async (e, t, n = /* @__PURE__ */ new Date(), r = {}) => {
-	let i = await C(e, v, s(c("status", "scheduled"), p("scheduledAt", n))), a = [];
+	}) ?? r;
+}, H = async (e, t, n = /* @__PURE__ */ new Date(), r = {}) => {
+	let i = await A(e, T, p(m("status", "scheduled"), b("scheduledAt", n))), a = [];
 	for (let o of i) {
-		let i = String(o.id), u = l({
+		let i = String(o.id), s = h({
 			kind: "typeid",
 			prefix: "claim"
 		}, "cms_releases") ?? `claim_${Date.now()}`;
 		try {
-			await e.transactional(async (e) => await e.updateMany("cms_releases", { claimToken: u }, { where: s(c("id", i), c("status", "scheduled")) }) === 1 && (await M(e, t, i, n, r), !0)) && a.push(i);
+			await e.transactional(async (e) => (await M(e, i), await e.updateMany("cms_releases", { claimToken: s }, { where: p(m("id", i), m("status", "scheduled")) }) === 1 && (await B(e, t, i, n, r), !0))) && a.push(i);
 		} catch (t) {
-			await e.update(v, i, {
+			await e.updateMany(T, {
 				status: "failed",
-				failure: F(t)
-			});
+				failure: U(t)
+			}, { where: p(m("id", i), m("status", "scheduled"), o.claimToken === null || o.claimToken === void 0 ? v("claimToken") : m("claimToken", o.claimToken)) });
 		}
 	}
 	return a;
-}, F = (e) => {
-	if (e instanceof n) return `ReferenceUnavailable: ${e.contentType} ${e.id} uses ${e.targets.map((e) => `${e.contentType} ${e.documentId} (${e.reason})`).join(", ")}`;
-	if (e instanceof i) return `ReviewRequired: ${e.contentType} ${e.id} revision ${e.revisionId} is not approved`;
-	if (e instanceof t) return `ContentNotFound: ${e.contentType} ${e.id} (${e.stage})`;
-	let r = e?._tag;
-	return typeof r == "string" ? r : e instanceof Error ? e.message : String(e);
-}, I = async (e, t) => {
-	let n = await w(e, t);
-	if (n.status !== "failed") throw new r({
+}, U = (e) => {
+	if (e instanceof r) return `ReferenceUnavailable: ${e.contentType} ${e.id} uses ${e.targets.map((e) => `${e.contentType} ${e.documentId} (${e.reason})`).join(", ")}`;
+	if (e instanceof a) return `ReviewRequired: ${e.contentType} ${e.id} revision ${e.revisionId} is not approved`;
+	if (e instanceof n) return `ContentNotFound: ${e.contentType} ${e.id} (${e.stage})`;
+	let t = e?._tag;
+	return typeof t == "string" ? t : e instanceof Error ? e.message : String(e);
+}, W = async (e, t) => {
+	let n = await j(e, t, "update");
+	if (n.status !== "failed") throw new i({
 		id: t,
 		status: String(n.status)
 	});
@@ -164,42 +194,47 @@ var v = "cms_releases", y = "cms_release_items", b = [
 		claimToken: null,
 		scheduledAt: null
 	}) ?? n;
-}, L = async (e, t, n, i = /* @__PURE__ */ new Date(), a = {}) => {
-	let o = await w(e, n);
-	if (o.status !== "published") throw new r({
+}, G = async (e, t, n, r = /* @__PURE__ */ new Date(), a = {}) => {
+	let o = await M(e, n);
+	if (o.status !== "published") throw new i({
 		id: n,
 		status: String(o.status)
 	});
-	let s = await e.insert(v, {
-		name: `Rollback of ${String(o.name)}`,
-		site: o.site,
-		environment: o.environment,
-		status: "draft",
-		rollbackOf: n,
-		...o.tenantId !== void 0 && o.tenantId !== null ? { tenantId: o.tenantId } : {}
-	}), c = String(s.id), l = 0;
-	for (let t of await k(e, n)) {
-		let n = t.previousRevisionId;
-		await e.insert(y, {
-			releaseId: c,
-			contentType: t.contentType,
-			variantId: t.variantId,
-			locale: t.locale,
-			action: n == null ? "unpublish" : "publish",
-			revisionId: n ?? null,
-			position: l++,
-			...t.tenantId !== void 0 && t.tenantId !== null ? { tenantId: t.tenantId } : {}
-		});
-	}
-	return M(e, t, c, i, a);
-}, R = [
-	t,
-	r,
+	return l(e, async () => {
+		let i = await e.insert(T, {
+			name: `Rollback of ${String(o.name)}`,
+			site: o.site,
+			environment: o.environment,
+			status: "draft",
+			rollbackOf: n,
+			...o.tenantId !== void 0 && o.tenantId !== null ? { tenantId: o.tenantId } : {}
+		}), s = String(i.id), c = 0;
+		for (let t of await L(e, n)) {
+			let n = t.previousRevisionId;
+			await e.insert(E, {
+				releaseId: s,
+				contentType: t.contentType,
+				variantId: t.variantId,
+				locale: t.locale,
+				action: n == null ? "unpublish" : "publish",
+				revisionId: n ?? null,
+				position: c++,
+				...t.tenantId !== void 0 && t.tenantId !== null ? { tenantId: t.tenantId } : {}
+			});
+		}
+		return B(e, t, s, r, a);
+	});
+}, K = [
+	n,
 	i,
-	n
-], z = (...t) => e(() => E(...t)), B = (...n) => e(() => D(...n), t, r), V = async (e, t, n, r) => {
-	let [i] = await C(e, y, s(c("releaseId", t), c("variantId", n)));
-	return i !== void 0 && (await e.update(y, String(i.id), { inherited: r }), !0);
-}, H = (...t) => e(() => V(...t)), U = (...t) => e(() => k(...t)), W = (...t) => e(() => O(...t)), G = (...t) => e(() => A(...t)), K = (...t) => e(() => M(...t), ...R), q = (...t) => e(() => N(...t), ...R), J = (...t) => e(() => P(...t)), Y = (...t) => e(() => L(...t), ...R), X = (...t) => e(() => I(...t), ...R);
-//#endregion
-export { v as CMS_RELEASES_TABLE, y as CMS_RELEASE_ITEMS_TABLE, b as RELEASE_STATUSES, D as addToRelease, B as addToReleaseEffect, S as cmsReleaseItemsTable, x as cmsReleasesTable, E as createRelease, z as createReleaseEffect, F as describeFailure, k as listReleaseItems, U as listReleaseItemsEffect, A as listReleases, G as listReleasesEffect, V as pinReleaseInheritance, H as pinReleaseInheritanceEffect, P as publishDueReleases, J as publishDueReleasesEffect, M as publishRelease, K as publishReleaseEffect, O as releaseStatusOf, W as releaseStatusOfEffect, I as retryRelease, X as retryReleaseEffect, L as rollbackRelease, Y as rollbackReleaseEffect, N as scheduleRelease, q as scheduleReleaseEffect };
+	a,
+	r
+], q = [
+	...K,
+	t,
+	e
+], J = (...e) => o(() => P(...e)), Y = (...e) => o(() => F(...e), n, i), X = async (e, t, n, r) => {
+	let [i] = await A(e, E, p(m("releaseId", t), m("variantId", n)));
+	return i !== void 0 && (await e.update(E, String(i.id), { inherited: r }), !0);
+}, Z = (...e) => o(() => X(...e)), Q = (...e) => o(() => L(...e)), $ = (...e) => o(() => I(...e)), ee = (...e) => o(() => R(...e)), te = (...e) => o(() => B(...e), ...q), ne = (...e) => o(() => V(...e), ...K), re = (...e) => o(() => H(...e)), ie = (...e) => o(() => G(...e), ...q), ae = (...e) => o(() => W(...e), ...K);
+export { T as CMS_RELEASES_TABLE, E as CMS_RELEASE_ITEMS_TABLE, D as RELEASE_STATUSES, F as addToRelease, Y as addToReleaseEffect, k as cmsReleaseItemsTable, O as cmsReleasesTable, P as createRelease, J as createReleaseEffect, U as describeFailure, L as listReleaseItems, Q as listReleaseItemsEffect, R as listReleases, ee as listReleasesEffect, X as pinReleaseInheritance, Z as pinReleaseInheritanceEffect, H as publishDueReleases, re as publishDueReleasesEffect, B as publishRelease, te as publishReleaseEffect, I as releaseStatusOf, $ as releaseStatusOfEffect, W as retryRelease, ae as retryReleaseEffect, G as rollbackRelease, ie as rollbackReleaseEffect, V as scheduleRelease, ne as scheduleReleaseEffect };

package/dist/renderReadAuthority.js

@@ -0,0 +1,42 @@
+import { dataStoreApiKeyStore as e, lockApiKeyById as t, sha256Hex as n } from "@voltro/runtime";
+// src/renderReadAuthority.ts
+var r = (e) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) return null;
+	let t = e;
+	return Object.keys(t).length !== 3 || Object.keys(t).some((e) => ![
+		"kind",
+		"id",
+		"scope"
+	].includes(e)) || t.kind !== "apiKey" || typeof t.id != "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(t.id) || typeof t.scope != "string" || !/^[A-Za-z][A-Za-z0-9:_.-]{0,127}$/.test(t.scope) ? null : {
+		kind: "apiKey",
+		id: t.id,
+		scope: t.scope
+	};
+}, i = (e, t, n, r) => e === null || e.id !== n || e.tenantId !== t.tenantId || e.revokedAt !== null || e.onBehalfOf !== null && e.onBehalfOf !== void 0 || !Array.isArray(e.scopes) || !e.scopes.every((e) => typeof e == "string") || e.metadata === null || typeof e.metadata != "object" || Array.isArray(e.metadata) || e.metadata.site !== t.site || e.metadata.environment !== t.environment || e.expiresAt !== null && (!Number.isSafeInteger(e.expiresAt) || e.expiresAt <= r) ? null : {
+	expiresAt: e.expiresAt,
+	scopes: [...e.scopes]
+}, a = async (t, n, r, a) => i(await e(t).findById(r), n, r, a), o = async (e, t, n, r) => {
+	let i = await a(e, t, n.id, r);
+	return i !== null && i.scopes.includes(n.scope) ? { expiresAt: i.expiresAt } : null;
+}, s = async (t, r, i, o) => {
+	if (typeof i != "string" || i.length === 0 || i.length > 512 || !Number.isSafeInteger(o) || !Number.isFinite(new Date(o).getTime())) return null;
+	let s = await e(t).findByHash(n(i));
+	if (s === null) return null;
+	let c = await a(t, r, s.id, o);
+	return c === null ? null : {
+		id: s.id,
+		...c
+	};
+}, c = async (r, a, o, s) => {
+	if (typeof o != "string" || o.length === 0 || o.length > 512 || !Number.isSafeInteger(s) || !Number.isFinite(new Date(s).getTime())) return null;
+	let c = n(o), l = await e(r).findByHash(c);
+	if (l === null) return null;
+	let u = await t(r, l.id, a.tenantId);
+	if (u === null || u.hashedKey !== c) return null;
+	let d = i(u, a, l.id, s);
+	return d === null ? null : {
+		id: u.id,
+		...d
+	};
+};
+export { r as copyRenderReadAuthority, c as lockRenderReadCredential, o as readRenderReadAuthority, s as readRenderReadCredential, a as readRenderReadOrganization };

package/dist/renderReadGrant.js

@@ -0,0 +1,136 @@
+import { copyRenderReadAuthority as e, readRenderReadAuthority as t } from "./renderReadAuthority.js";
+import { Schema as n } from "effect";
+import { and as r, eq as i, id as a, json as o, table as s, text as c, timestamp as l } from "@voltro/database";
+import { tenant as u } from "@voltro/plugin-multitenancy/mixin";
+import { createHmac as d, timingSafeEqual as f } from "node:crypto";
+import { canonicalJson as p, generateApiKeyToken as m } from "@voltro/runtime";
+// src/renderReadGrant.ts
+var h = class extends n.TaggedError()("RenderReadGrantRejected", { reason: n.Literals([
+	"binding",
+	"key",
+	"expiry",
+	"token",
+	"revoked",
+	"expired",
+	"authority"
+]) }) {}, g = "_voltro_cms_render_read_grants", _ = s(g, {
+	id: a({ prefix: "crrg" }),
+	site: c().maxLength(64),
+	environment: c().maxLength(64),
+	binding: o(),
+	keyId: c().maxLength(64),
+	verifier: c().maxLength(64),
+	issuedAt: l(),
+	expiresAt: l(),
+	revokedAt: l().nullable()
+}).with(u()), v = "crread1", y = [
+	"tenantId",
+	"site",
+	"environment",
+	"consumerId",
+	"snapshotId",
+	"snapshotDigest",
+	"releaseId",
+	"buildId",
+	"policyDigest",
+	"projectionDigest"
+], b = [
+	"tenantId",
+	"site",
+	"environment",
+	"consumerId",
+	"snapshotId",
+	"buildId"
+], x = [
+	"snapshotDigest",
+	"policyDigest",
+	"projectionDigest"
+], S = (e) => {
+	throw new h({ reason: e });
+}, C = (e) => typeof e == "string" && e.length > 0 && e.length <= 64 && /^[a-zA-Z0-9_-]+$/.test(e), w = (e) => typeof e == "string" && /^[0-9a-f]{64}$/.test(e), T = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : NaN, E = (e) => Number.isSafeInteger(e) && Number.isFinite(new Date(e).getTime()), D = (e) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) return S("binding");
+	let t = e;
+	return Object.keys(t).length !== y.length || Object.keys(t).some((e) => !y.includes(e)) || !b.every((e) => C(t[e])) || !x.every((e) => w(t[e])) || !(t.releaseId === null || C(t.releaseId)) ? S("binding") : Object.fromEntries(y.map((e) => [e, t[e]]));
+}, O = (e) => !C(e.id) || !(e.material instanceof Uint8Array) || e.material.length < 32 ? S("key") : e, k = (e) => [
+	e.tenantId,
+	e.site,
+	e.environment
+].every(C) ? r(i("tenantId", e.tenantId), i("site", e.site), i("environment", e.environment)) : S("binding"), A = (e, t, n) => d("sha256", e.material).update(p({
+	purpose: "voltro.cms.render-read/v1",
+	nonce: t,
+	id: n.id,
+	keyId: n.keyId,
+	binding: n.binding,
+	issuedAt: T(n.issuedAt),
+	expiresAt: T(n.expiresAt)
+})).digest("hex"), j = async (n, r, i) => {
+	let a = D(r), o = O({
+		id: i.key.id,
+		material: new Uint8Array(i.key.material)
+	}), s = i.now ?? Date.now(), c = i.expiresAt, l = i.maxExpiresAt;
+	if (![
+		s,
+		c,
+		l
+	].every(E) || c <= s || c > l) return S("expiry");
+	let u = i.authority === void 0 ? void 0 : e(i.authority);
+	if (u === null) return S("authority");
+	if (u !== void 0) {
+		let e = await t(n, a, u, s);
+		if (e === null || e.expiresAt !== null && c > e.expiresAt) return S("authority");
+	}
+	let d = m(""), f = await n.insert(g, {
+		tenantId: a.tenantId,
+		site: a.site,
+		environment: a.environment,
+		binding: u === void 0 ? a : {
+			...a,
+			authority: u
+		},
+		keyId: o.id,
+		verifier: "",
+		issuedAt: new Date(s),
+		expiresAt: new Date(c),
+		revokedAt: null
+	});
+	return C(f.id) ? (await n.update(g, f.id, { verifier: A(o, d, f) }), {
+		id: f.id,
+		token: `${v}.${f.id}.${d}`,
+		expiresAt: c
+	}) : S("token");
+}, M = async (n, a, o, s, c) => {
+	let l = D(o), u = s.now ?? Date.now();
+	if (!E(u)) return S("expiry");
+	if (s.keys.length === 0 || new Set(s.keys.map((e) => e.id)).size !== s.keys.length) return S("key");
+	for (let e of s.keys) O(e);
+	if (typeof a != "string" || a.length > 128) return S("token");
+	let d = a.split(".");
+	if (d.length !== 3 || d[0] !== v || !C(d[1]) || !/^[A-Za-z0-9_-]{40}$/.test(d[2])) return S("token");
+	let [m] = await n.query({
+		table: g,
+		predicate: r(k(l), i("id", d[1])),
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: void 0
+	});
+	if (m === void 0 || !w(m.verifier)) return S("token");
+	let h = s.keys.find((e) => e.id === m.keyId);
+	if (h === void 0) return S("token");
+	let _ = Buffer.from(A(h, d[2], m), "hex"), y = Buffer.from(m.verifier, "hex");
+	if (!f(_, y) || m.binding === null || typeof m.binding != "object" || Array.isArray(m.binding)) return S("token");
+	let b = m.binding, { authority: x, ...j } = b;
+	if (p(j) !== p(l)) return S("token");
+	if (m.revokedAt !== null) return S("revoked");
+	let M = T(m.issuedAt), N = T(m.expiresAt);
+	if (!E(M) || !E(N) || M > u || N <= M) return S("token");
+	if (c === void 0 && N <= u) return S("expired");
+	if (Object.hasOwn(b, "authority")) {
+		let r = e(x);
+		if (r === null || await t(n, l, r, u) === null || c !== void 0 && p(r) !== p(c)) return S("authority");
+	} else if (c !== void 0) return S("authority");
+}, N = (e, t, n, r) => M(e, t, n, r), P = (t, n, r, i, a) => {
+	let o = e(i);
+	return o === null ? S("authority") : M(t, n, r, a, o);
+};
+export { g as RENDER_READ_GRANTS_TABLE, h as RenderReadGrantRejected, j as issueRenderReadGrant, _ as renderReadGrantsTable, N as verifyRenderReadGrant, P as verifyRenderReadRenewal };

package/dist/rest.js

@@ -1,4 +1,4 @@
-//#region src/rest.ts
+// src/rest.ts
 var e = (e) => {
 	let t = e.authorization;
 	return t && t.toLowerCase().startsWith("bearer ") ? t.slice(7).trim() : e["x-api-key"];
@@ -48,5 +48,4 @@ var e = (e) => {
 		body: await n.cms.contentType(o).limit(u).all()
 	};
 };
-//#endregion
 export { t as handleCmsRest };