@voltro/cms 0.86.0 → 0.88.0

package/dist/build.js

@@ -0,0 +1,37 @@
+import { OutputActivationUnavailable as e, createOutputActivationSet as t, makeOutputRegionReceipt as n } from "./outputActivation.js";
+import { copyCmsPublicBuildIdentity as r, decodeCmsPublicBuildIdentity as i, encodeCmsPublicBuildIdentity as a } from "./publicBuild.js";
+import { SnapshotPresentationUnavailable as o, admitSnapshotPresentation as s, copySnapshotConsentPurposes as c, copySnapshotPresentationValue as l, decodeSnapshotPresentation as u, encodeSnapshotPresentation as d, snapshotPresentationFromChoices as f, snapshotPresentations as p } from "./snapshotPresentation.js";
+import { defineFrontendBindings as m } from "./frontendBindings.js";
+import { snapshotApplicationPins as h } from "./snapshotApplication.js";
+import { StaticPathSetConflict as g, StaticPathSetUnavailable as _, copyStaticPathManifest as v, staticPathHash as y, verifyStaticPathPage as b } from "./staticPathSet.js";
+import { activateOutputSet as x, denyOutputTarget as S, initializeOutputRouteHistory as C, probeOutputActivation as w, readActiveOutput as T, readOutputActivationMarker as E } from "./outputActivationStore.js";
+import { readStaticPathSetEvidence as D } from "./staticPathSetStore.js";
+import { createCmsStaticPathSets as O } from "./staticPathSetService.js";
+import { CmsBuildSnapshotUnavailable as k, createCmsBuildSnapshots as A } from "./buildSnapshotService.js";
+import { cmsBuildSnapshotRest as j } from "./buildSnapshotRest.js";
+import { cmsBuildSnapshotTables as M } from "./buildSnapshotTables.js";
+import { createCmsApplicationBuildSnapshots as N } from "./applicationBuildSnapshotService.js";
+import { bindOutputDeployment as P, makeOutputActivationAdmission as F, makeOutputDeploymentAdmission as I, makeOutputServingAdmission as L, readOutputDeployment as R } from "./outputDeployment.js";
+import { CMS_OUTPUT_DEPLOY_SCOPE as z, CmsOutputDeploymentUnavailable as B, createCmsOutputDeployments as V } from "./outputDeploymentService.js";
+import { createCmsBuildApplicationCatalog as H } from "./buildApplicationCatalog.js";
+import { cmsBuildApplicationRest as U } from "./buildApplicationRest.js";
+import { CmsBuildApplicationUploadUnavailable as W, uploadCmsBuildApplication as G } from "./buildApplicationUpload.js";
+import { createSnapshotDocumentAssembly as K } from "./snapshotDocumentAssembly.js";
+import { cmsDocumentAssemblyRest as q } from "./snapshotDocumentAssemblyRest.js";
+import { cmsStaticPathSetRest as J } from "./staticPathSetRest.js";
+import { cmsOutputDeploymentRest as Y } from "./outputDeploymentRest.js";
+import { readOutputActivationTarget as X, retainOutputActivationTarget as Z } from "./outputActivationTarget.js";
+import { cmsOutputActivationTables as Q } from "./outputActivationTables.js";
+import { createCmsPublicBuilds as $ } from "./publicBuildService.js";
+import { cmsPublicBuildRest as ee } from "./publicBuildRest.js";
+import { createCmsPublicOutputs as te } from "./publicOutputService.js";
+import { cmsPublicOutputHttp as ne } from "./publicOutputHttp.js";
+import { createSnapshotAssetAssembly as re } from "./snapshotAssetAssembly.js";
+import { cmsSnapshotAssetsRest as ie } from "./snapshotAssetAssemblyRest.js";
+import { createSnapshotDocumentTransfer as ae } from "./snapshotDocumentTransfer.js";
+import { cmsSnapshotDocumentTransferRest as oe } from "./snapshotDocumentTransferRest.js";
+import { createSnapshotRoleTransfer as se } from "./snapshotRoleTransfer.js";
+import { cmsSnapshotRoleTransferRest as ce } from "./snapshotRoleTransferRest.js";
+import { createCmsNativeOutputDeployments as le } from "./nativeOutputDeploymentService.js";
+import { cmsOutputTargetRest as ue } from "./outputTargetRest.js";
+export { z as CMS_OUTPUT_DEPLOY_SCOPE, W as CmsBuildApplicationUploadUnavailable, k as CmsBuildSnapshotUnavailable, B as CmsOutputDeploymentUnavailable, e as OutputActivationUnavailable, o as SnapshotPresentationUnavailable, g as StaticPathSetConflict, _ as StaticPathSetUnavailable, x as activateOutputSet, s as admitSnapshotPresentation, P as bindOutputDeployment, U as cmsBuildApplicationRest, j as cmsBuildSnapshotRest, M as cmsBuildSnapshotTables, q as cmsDocumentAssemblyRest, Q as cmsOutputActivationTables, Y as cmsOutputDeploymentRest, ue as cmsOutputTargetRest, ee as cmsPublicBuildRest, ne as cmsPublicOutputHttp, ie as cmsSnapshotAssetsRest, oe as cmsSnapshotDocumentTransferRest, ce as cmsSnapshotRoleTransferRest, J as cmsStaticPathSetRest, r as copyCmsPublicBuildIdentity, c as copySnapshotConsentPurposes, l as copySnapshotPresentationValue, v as copyStaticPathManifest, N as createCmsApplicationBuildSnapshots, H as createCmsBuildApplicationCatalog, A as createCmsBuildSnapshots, le as createCmsNativeOutputDeployments, V as createCmsOutputDeployments, $ as createCmsPublicBuilds, te as createCmsPublicOutputs, O as createCmsStaticPathSets, t as createOutputActivationSet, re as createSnapshotAssetAssembly, K as createSnapshotDocumentAssembly, ae as createSnapshotDocumentTransfer, se as createSnapshotRoleTransfer, i as decodeCmsPublicBuildIdentity, u as decodeSnapshotPresentation, m as defineFrontendBindings, S as denyOutputTarget, a as encodeCmsPublicBuildIdentity, d as encodeSnapshotPresentation, C as initializeOutputRouteHistory, F as makeOutputActivationAdmission, I as makeOutputDeploymentAdmission, n as makeOutputRegionReceipt, L as makeOutputServingAdmission, w as probeOutputActivation, T as readActiveOutput, E as readOutputActivationMarker, X as readOutputActivationTarget, R as readOutputDeployment, D as readStaticPathSetEvidence, Z as retainOutputActivationTarget, h as snapshotApplicationPins, f as snapshotPresentationFromChoices, p as snapshotPresentations, y as staticPathHash, G as uploadCmsBuildApplication, b as verifyStaticPathPage };

package/dist/buildApplicationAdmission.js

@@ -0,0 +1,15 @@
+import { copyBuildSnapshotApplicationPin as e } from "./buildSnapshotApplicationPin.js";
+// src/buildApplicationAdmission.ts
+var t = "/v1/cms/build-applications/admit", n = "x-voltro-cms-application", r = (t) => {
+	let n = () => {
+		throw TypeError("Invalid application admission comparison");
+	};
+	if (typeof t != "object" || !t || Array.isArray(t) || Object.keys(t).sort().join(",") !== "application,archiveId,deploymentId") return n();
+	let r = t, i = r.deploymentId, a = r.archiveId;
+	return typeof i != "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(i) || typeof a != "string" || !/^[a-f0-9]{64}$/.test(a) ? n() : {
+		deploymentId: i,
+		archiveId: a,
+		application: e(r.application)
+	};
+};
+export { t as CMS_BUILD_APPLICATION_ADMIT_PATH, n as CMS_BUILD_APPLICATION_HEADER, r as copyCmsBuildApplicationAdmission };

package/dist/buildApplicationCatalog.js

@@ -0,0 +1,135 @@
+import { copyOutputActivationScope as e } from "./outputActivation.js";
+import { BUILD_APPLICATION_CATALOG as t } from "./buildApplicationCatalogTable.js";
+import { copyBuildSnapshotApplicationIdentity as n, copyBuildSnapshotApplicationPin as r } from "./buildSnapshotApplicationPin.js";
+import { CmsOutputDeploymentUnavailable as i, createCmsOutputDeploymentAuthority as a } from "./outputDeploymentService.js";
+import { copyCmsBuildApplicationAdmission as o } from "./buildApplicationAdmission.js";
+import { and as s, eq as c } from "@voltro/database";
+import { createHash as l } from "node:crypto";
+import { canonicalJson as u } from "@voltro/protocol";
+// src/buildApplicationCatalog.ts
+var d = (e) => {
+	throw new i({ reason: e });
+}, f = (e) => l("sha256").update(u(e)).digest("hex"), p = (e) => f({
+	inputsId: e.inputsId,
+	executionId: e.executionId
+}), m = (e, t) => u(e) === u(t), h = (e) => {
+	try {
+		return o({
+			deploymentId: e.deploymentId,
+			archiveId: e.archiveId,
+			application: e.application
+		});
+	} catch {
+		return d("input");
+	}
+}, g = (e) => r({
+	code: e.code,
+	inputsId: e.inputsId,
+	executionId: e.executionId
+}), _ = (i) => {
+	let o = i.store, l = e(i.scope), u = i.now ?? Date.now, f = i.receive.bind(i), _ = i.open.bind(i), v = i.verify.bind(i), { boundary: y, transaction: b } = a(o, l, u), x = (e, t) => s(c("tenantId", l.tenantId), c("site", l.site), c("environment", l.environment), c(e, t)), S = (e) => {
+		let t = h({
+			deploymentId: e.deploymentId,
+			archiveId: e.archiveId,
+			application: e.application
+		});
+		return e.applicationId === p(t.application) ? t : d("integrity");
+	}, C = async (e, n) => {
+		let r = await e.query({
+			table: t,
+			predicate: x("deploymentId", n),
+			order: [],
+			take: 2,
+			skip: void 0,
+			projection: void 0
+		});
+		return r.length > 1 ? d("state") : r.length === 0 ? null : S(r[0]);
+	}, w = async (e, n) => {
+		let r = await e.query({
+			table: t,
+			predicate: x("applicationId", p(n)),
+			order: [],
+			take: 2,
+			skip: void 0,
+			projection: void 0
+		});
+		if (r.length === 0) return null;
+		let i = S(r[0]);
+		return i.application.inputsId !== n.inputsId || i.application.executionId !== n.executionId || r.some((e) => {
+			let t = S(e);
+			return t.archiveId !== i.archiveId || !m(t.application, i.application);
+		}) ? d("integrity") : i;
+	};
+	return {
+		inspect: (e) => y(async (t) => {
+			let { credential: n, deploymentId: i } = e;
+			if (typeof i != "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(i)) return d("input");
+			let a = await b(n, t, async (e, t) => {
+				let n = await C(e, i);
+				return n === null ? d("unadmitted") : {
+					admission: n,
+					parent: t
+				};
+			}), o = () => b(n, t, async (e, t) => {
+				if (t !== a.parent) return d("credential");
+			});
+			return await o(), await v({
+				archiveId: a.admission.archiveId,
+				application: r(a.admission.application)
+			}, o, t), await o(), b(n, t, async (e, t) => {
+				if (t !== a.parent) return d("credential");
+				let n = await C(e, i);
+				return n === null || !m(n, a.admission) ? d("changed") : n;
+			});
+		}),
+		admit: (e, n) => y(async (r) => {
+			let i = h(e), a = e.credential, o = await b(a, r, async (e, t) => {
+				let n = await C(e, i.deploymentId);
+				if (n !== null && !m(n, i)) return d("changed");
+				let r = await w(e, i.application);
+				return r !== null && (r.archiveId !== i.archiveId || !m(r.application, i.application)) ? d("changed") : t;
+			}), s = () => b(a, r, async (e, t) => {
+				if (t !== o) return d("credential");
+			});
+			return await s(), m(g(await f(h(i), n, s, r)), i.application) ? (await s(), b(a, r, async (e, n) => {
+				if (n !== o) return d("credential");
+				let r = await C(e, i.deploymentId);
+				if (r !== null && !m(r, i)) return d("changed");
+				let a = await w(e, i.application);
+				if (a !== null && (a.archiveId !== i.archiveId || !m(a.application, i.application))) return d("changed");
+				await e.insertIgnore(t, {
+					...l,
+					...i,
+					applicationId: p(i.application)
+				}, { conflictColumns: [
+					"tenantId",
+					"site",
+					"environment",
+					"deploymentId"
+				] });
+				let s = await C(e, i.deploymentId);
+				return m(s, i) ? s : d("changed");
+			})) : d("integrity");
+		}),
+		resolveApplication: async (e) => {
+			let t = r(e), n = await o.transactional((e) => w(e, t));
+			if (n === null) return d("state");
+			if (!m(n.application, t)) return d("changed");
+			let i = await _({
+				archiveId: n.archiveId,
+				application: r(t)
+			});
+			if (!m(g(i), t)) return d("integrity");
+			let a = await o.transactional((e) => w(e, t));
+			return a === null || a.archiveId !== n.archiveId || !m(a.application, n.application) ? d("changed") : i;
+		},
+		readApplication: async (e) => {
+			let t = n(e), i = await o.transactional((e) => w(e, t));
+			return i === null ? d("state") : {
+				archiveId: i.archiveId,
+				application: r(i.application)
+			};
+		}
+	};
+};
+export { _ as createCmsBuildApplicationCatalog };

package/dist/buildApplicationCatalogTable.js

@@ -0,0 +1,23 @@
+import { id as e, json as t, table as n, text as r } from "@voltro/database";
+import { tenant as i } from "@voltro/plugin-multitenancy/mixin";
+// src/buildApplicationCatalogTable.ts
+var a = "_voltro_cms_build_applications", o = n("_voltro_cms_build_applications", {
+	id: e({ prefix: "capp" }),
+	site: r().maxLength(64),
+	environment: r().maxLength(64),
+	deploymentId: r().maxLength(64),
+	applicationId: r().maxLength(64),
+	archiveId: r().maxLength(64),
+	application: t()
+}).with(i()).unique("cms_app_deployment", [
+	"tenantId",
+	"site",
+	"environment",
+	"deploymentId"
+]).index("cms_app_identity", [
+	"tenantId",
+	"site",
+	"environment",
+	"applicationId"
+]);
+export { a as BUILD_APPLICATION_CATALOG, o as buildApplicationCatalogTable };

package/dist/buildApplicationRest.js

@@ -0,0 +1,98 @@
+import { cmsCredential as e, privateCmsHeaders as t, privateCmsHttpRoutes as n, privateCmsOperation as r } from "./privateCmsTransport.js";
+import { CmsOutputDeploymentUnavailable as i } from "./outputDeploymentService.js";
+import { CMS_BUILD_APPLICATION_ADMIT_PATH as a, CMS_BUILD_APPLICATION_HEADER as o, copyCmsBuildApplicationAdmission as s } from "./buildApplicationAdmission.js";
+import { Effect as c, Schema as l } from "effect";
+import { strictInput as u } from "@voltro/protocol";
+import { RestRouteError as d } from "@voltro/protocol/rest";
+// src/buildApplicationRest.ts
+var f = l.String.check(l.isPattern(/^[A-Za-z0-9_-]{1,64}$/)), p = l.String.check(l.isPattern(/^[a-f0-9]{64}$/)), m = u(l.Struct({
+	deploymentId: f,
+	archiveId: p,
+	application: l.Struct({
+		inputsId: p,
+		executionId: p,
+		code: l.Struct({
+			commit: l.String,
+			artifactDigest: p,
+			configDigest: p
+		})
+	})
+}), "cms.buildApplication.admit", !0), h = (p, h) => {
+	let g = h.maxBodyBytes;
+	if (!Number.isSafeInteger(g) || g < 1) throw TypeError("A positive safe application upload byte limit is required");
+	let _ = (e, n, r = {}) => ({
+		status: e,
+		contentType: "application/json",
+		headers: {
+			...t,
+			...r
+		},
+		body: JSON.stringify(n)
+	}), v = (e, t) => _(e, {
+		error: "CmsOutputDeploymentUnavailable",
+		_tag: "CmsOutputDeploymentUnavailable",
+		reason: t
+	}, e === 401 ? { "www-authenticate": "Bearer" } : {}), y = async (t) => {
+		if (t.method !== "POST") return _(405, { error: "MethodNotAllowed" }, { allow: "POST" });
+		try {
+			let n = e(t, "CmsOutputDeploymentUnavailable");
+			if (t.headers["content-type"]?.toLowerCase() !== "application/octet-stream") return v(415, "input");
+			let r = t.headers[o];
+			if (r === void 0 || Buffer.byteLength(r, "utf8") > 2048) return v(409, "input");
+			let i;
+			try {
+				i = l.decodeUnknownSync(m)(JSON.parse(r)), s(i);
+			} catch {
+				return v(409, "input");
+			}
+			let a = await c.runPromise(c.result(p.admit({
+				...i,
+				credential: n
+			}, t.body)), { signal: t.signal });
+			return a._tag === "Success" ? _(201, a.success) : v(a.failure.reason === "credential" ? 401 : 409, a.failure.reason);
+		} catch (e) {
+			return e instanceof d && e.status === 401 ? v(401, "credential") : v(409, "state");
+		}
+	}, b = {
+		workload: "rest",
+		credentials: "bearer",
+		method: "POST",
+		path: a,
+		match: "exact",
+		answersOtherMethods: !0,
+		maxBodyBytes: g,
+		handleStream: y,
+		handle: async (e) => {
+			if (e.rawBody.byteLength > g) return v(413, "input");
+			let t = new AbortController();
+			try {
+				let { rawBody: n, ...r } = e;
+				return await y({
+					...r,
+					signal: t.signal,
+					body: (async function* () {
+						yield n;
+					})()
+				});
+			} finally {
+				t.abort();
+			}
+		}
+	}, x = [r({
+		namespace: "cms.buildApplication",
+		path: "/v1/cms/build-applications",
+		operationPrefix: "cmsBuildApplication",
+		tags: ["CMS build applications"],
+		error: i,
+		credentialError: "CmsOutputDeploymentUnavailable",
+		errorStatus: { CmsOutputDeploymentUnavailable: 409 }
+	}, "inspect", "Inspect original private application custody", "Scoped cms:deploy bearer. Revalidates the original immutable deployment association and native private archive custody without loading or executing application code, renewing admission or publishing output. Binary admission uses its separate bounded upload channel.", u(l.Struct({ deploymentId: f }), "cms.buildApplication.inspect", !0), m, (t, n) => p.inspect({
+		...t,
+		credential: e(n, "CmsOutputDeploymentUnavailable")
+	}))];
+	return {
+		routes: x,
+		httpRoutes: [...n(x), b]
+	};
+};
+export { h as cmsBuildApplicationRest };

package/dist/buildApplicationUpload.js

@@ -0,0 +1,110 @@
+import { CMS_BUILD_APPLICATION_ADMIT_PATH as e, CMS_BUILD_APPLICATION_HEADER as t, copyCmsBuildApplicationAdmission as n } from "./buildApplicationAdmission.js";
+import { Schema as r } from "effect";
+import { canonicalJson as i } from "@voltro/protocol";
+// src/buildApplicationUpload.ts
+var a = class extends r.TaggedError()("CmsBuildApplicationUploadUnavailable", { reason: r.Literals([
+	"input",
+	"authority",
+	"transfer",
+	"response",
+	"aborted"
+]) }) {}, o = async (r) => {
+	let o = (e) => {
+		throw new a({ reason: e });
+	}, { credential: s } = r, c = r.bytes.bind(r), l = r.authorize.bind(r), u = r.fetch ?? globalThis.fetch, d = new AbortController(), f = AbortSignal.any([r.signal, d.signal]), p, m;
+	try {
+		if (p = new URL(r.backendOrigin), p.origin !== r.backendOrigin || p.username !== "" || p.password !== "" || !(p.protocol === "https:" || p.protocol === "http:" && [
+			"127.0.0.1",
+			"[::1]",
+			"localhost"
+		].includes(p.hostname)) || typeof s != "string" || !/^[^\s]{1,512}$/.test(s)) return o("input");
+		m = n(r.admission);
+	} catch {
+		return o("input");
+	}
+	let h = async () => {
+		if (f.aborted) return o("aborted");
+		try {
+			await l();
+		} catch {
+			return o("authority");
+		}
+		if (f.aborted) return o("aborted");
+	};
+	await h();
+	let g;
+	try {
+		g = c(f)[Symbol.asyncIterator]();
+	} catch {
+		return o("input");
+	}
+	let _ = !1, v = !1, y, b = async () => {
+		_ || (_ = !0, await g.return?.());
+	}, x = new ReadableStream({
+		async pull(e) {
+			try {
+				await h();
+				let t = await g.next();
+				if (await h(), t.done) v = !0, e.close();
+				else if (t.value instanceof Uint8Array) e.enqueue(t.value);
+				else throw TypeError("Nonbinary native application input");
+			} catch (t) {
+				t instanceof a && (y = t), e.error(t);
+			}
+		},
+		cancel: async () => {
+			d.abort(), await b();
+		}
+	}, { highWaterMark: 0 });
+	try {
+		let a = {
+			method: "POST",
+			headers: {
+				authorization: "Bearer " + s,
+				"content-type": "application/octet-stream",
+				[t]: JSON.stringify(m)
+			},
+			body: x,
+			signal: f,
+			duplex: "half",
+			redirect: "error",
+			cache: "no-store"
+		}, c;
+		try {
+			c = await u(new URL(e, p), a);
+		} catch {
+			return o(r.signal.aborted ? "aborted" : y?.reason ?? "transfer");
+		}
+		if (c.status !== 201 || c.body === null) return await c.body?.cancel(), o("response");
+		let l = c.body.getReader(), d = [], g = 0;
+		try {
+			for (;;) {
+				let e = await l.read();
+				if (e.done) break;
+				if (g += e.value.byteLength, g > 2048) return await l.cancel(), o("response");
+				d.push(e.value);
+			}
+		} finally {
+			l.releaseLock();
+		}
+		let _;
+		try {
+			if (_ = n(JSON.parse(Buffer.concat(d).toString("utf8"))), i(_) !== i(m)) return o("response");
+		} catch {
+			return o("response");
+		}
+		if (!v) return o("response");
+		try {
+			await b();
+		} catch {
+			return o("transfer");
+		}
+		return await h(), _;
+	} finally {
+		d.abort();
+		try {
+			await b();
+		} catch {}
+	}
+};
+export { a as CmsBuildApplicationUploadUnavailable, o as uploadCmsBuildApplication };