@storyshelf/app 0.5.3

package/dist/routers/admin.mjs

@@ -0,0 +1,113 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { notifySystem } from "../notify.mjs";
+import { reencryptWithCurrent } from "../credentials.mjs";
+import { requireSiteAdmin } from "./helpers.mjs";
+import { forbidden, purgeInputSchema, purgeSchema } from "./schemas.mjs";
+import { createRoute, z } from "@hono/zod-openapi";
+import { ProjectModel } from "@storyshelf/core/models";
+import { Retention } from "@storyshelf/core/retention";
+//#region src/routers/admin.ts
+const purgeRoute = createRoute({
+	method: "post",
+	tags: ["Admin"],
+	summary: "Run the retention purge",
+	path: "/api/v1/admin/purge",
+	request: { body: { content: { "application/json": { schema: purgeInputSchema } } } },
+	responses: {
+		200: {
+			content: { "application/json": { schema: purgeSchema } },
+			description: "Retention purge run"
+		},
+		...forbidden
+	}
+});
+const reencryptSchema = z.object({
+	reencrypted: z.number().int(),
+	failed: z.number().int(),
+	unreadable: z.number().int()
+});
+const reencryptRoute = createRoute({
+	method: "post",
+	path: "/api/v1/admin/credentials/reencrypt",
+	tags: ["Admin"],
+	summary: "Re-encrypt stored credentials with the current secret",
+	responses: {
+		200: {
+			content: { "application/json": { schema: reencryptSchema } },
+			description: "Credentials re-encrypted with the current secret"
+		},
+		409: {
+			content: { "application/json": { schema: z.object({ error: z.string() }) } },
+			description: "No previousSecret configured"
+		},
+		...forbidden
+	}
+});
+/** Register the site-admin endpoints: retention purge and credential re-encryption. */
+function registerAdmin(app) {
+	app.openapi(reencryptRoute, async (c) => {
+		requireSiteAdmin(c);
+		const { db, config } = getStore();
+		if (!config.previousSecret) return c.json({ error: "No previousSecret is configured; nothing to re-encrypt" }, 409);
+		const result = await reencryptWithCurrent(db, config);
+		return c.json({
+			reencrypted: result.reencrypted,
+			failed: result.failed,
+			unreadable: result.unreadable.length
+		}, 200);
+	});
+	app.openapi(purgeRoute, async (c) => {
+		requireSiteAdmin(c);
+		const ttlDays = c.req.valid("json").ttlDays ?? getStore().config.purgeTtlDays ?? 30;
+		const removedBuilds = await purgeBuilds(ttlDays);
+		const branch = await purgeBranches();
+		await notifySystem("sys:purge-completed", {
+			removedBuilds,
+			removedBranches: branch.removedBranches,
+			removedBaselines: branch.removedBaselines,
+			ttlDays
+		});
+		return c.json({
+			removedBuilds,
+			removedBranches: branch.removedBranches,
+			removedBaselines: branch.removedBaselines
+		});
+	});
+}
+async function purgeBuilds(ttlDays) {
+	const projects = await new ProjectModel(getStore().db).list();
+	const retention = new Retention(getStore().db, getStore().storage, {
+		builds: getStore().db.tables.builds,
+		buildLabels: getStore().db.tables.buildLabels,
+		baselines: getStore().db.tables.baselines
+	}, getStore().logger);
+	return (await Promise.all(projects.map((project) => retention.purge(project, {
+		ttlDays,
+		keepLatestPerBranch: true
+	})))).reduce((sum, result) => sum + result.removedBuilds, 0);
+}
+async function purgeBranches() {
+	const branchTtl = getStore().config.branchTtlDays ?? 30;
+	if (branchTtl === null) return {
+		removedBranches: 0,
+		removedBaselines: 0
+	};
+	const projects = await new ProjectModel(getStore().db).list();
+	const retention = new Retention(getStore().db, getStore().storage, {
+		builds: getStore().db.tables.builds,
+		buildLabels: getStore().db.tables.buildLabels,
+		baselines: getStore().db.tables.baselines
+	}, getStore().logger);
+	const results = await Promise.all(projects.map((project) => retention.purgeStaleBranches(project, branchTtl)));
+	return {
+		removedBranches: results.reduce((sum, r) => sum + r.removedBranches, 0),
+		removedBaselines: results.reduce((sum, r) => sum + r.removedBaselines, 0)
+	};
+}
+//#endregion
+export { registerAdmin };
+
+//# sourceMappingURL=admin.mjs.map

package/dist/routers/admin.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.mjs","names":["forbiddenResponse"],"sources":["../../src/routers/admin.ts"],"sourcesContent":["/* oxlint-disable typescript/promise-function-async -- admin helpers are async by design */\nimport { createRoute, z } from \"@hono/zod-openapi\";\nimport { ProjectModel } from \"@storyshelf/core/models\";\nimport { Retention } from \"@storyshelf/core/retention\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { reencryptWithCurrent } from \"../credentials.ts\";\nimport { notifySystem } from \"../notify.ts\";\nimport { getStore } from \"../store.ts\";\nimport { requireSiteAdmin } from \"./helpers.ts\";\nimport { forbidden as forbiddenResponse, purgeInputSchema, purgeSchema } from \"./schemas.ts\";\nconst purgeRoute = createRoute({\n  method: \"post\",\n  tags: [\"Admin\"],\n  summary: \"Run the retention purge\",\n  path: \"/api/v1/admin/purge\",\n  request: { body: { content: { \"application/json\": { schema: purgeInputSchema } } } },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: purgeSchema } },\n      description: \"Retention purge run\",\n    },\n    ...forbiddenResponse,\n  },\n});\n\nconst reencryptSchema = z.object({\n  reencrypted: z.number().int(),\n  failed: z.number().int(),\n  unreadable: z.number().int(),\n});\n\nconst reencryptRoute = createRoute({\n  method: \"post\",\n  path: \"/api/v1/admin/credentials/reencrypt\",\n  tags: [\"Admin\"],\n  summary: \"Re-encrypt stored credentials with the current secret\",\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: reencryptSchema } },\n      description: \"Credentials re-encrypted with the current secret\",\n    },\n    409: {\n      content: { \"application/json\": { schema: z.object({ error: z.string() }) } },\n      description: \"No previousSecret configured\",\n    },\n    ...forbiddenResponse,\n  },\n});\n\n/** Register the site-admin endpoints: retention purge and credential re-encryption. */\nexport function registerAdmin(app: ShelfRouter): void {\n  app.openapi(reencryptRoute, async (c) => {\n    requireSiteAdmin(c);\n    const { db, config } = getStore();\n    if (!config.previousSecret) {\n      return c.json({ error: \"No previousSecret is configured; nothing to re-encrypt\" }, 409);\n    }\n    const result = await reencryptWithCurrent(db, config);\n    return c.json(\n      {\n        reencrypted: result.reencrypted,\n        failed: result.failed,\n        unreadable: result.unreadable.length,\n      },\n      200,\n    );\n  });\n\n  app.openapi(purgeRoute, async (c) => {\n    requireSiteAdmin(c);\n    const body = c.req.valid(\"json\");\n    const ttlDays = body.ttlDays ?? getStore().config.purgeTtlDays ?? 30;\n    const removedBuilds = await purgeBuilds(ttlDays);\n    const branch = await purgeBranches();\n    await notifySystem(\"sys:purge-completed\", {\n      removedBuilds,\n      removedBranches: branch.removedBranches,\n      removedBaselines: branch.removedBaselines,\n      ttlDays,\n    });\n    return c.json({\n      removedBuilds,\n      removedBranches: branch.removedBranches,\n      removedBaselines: branch.removedBaselines,\n    });\n  });\n}\n\n// oxlint-disable-next-line typescript/promise-function-async\nasync function purgeBuilds(ttlDays: number): Promise<number> {\n  const projects = await new ProjectModel(getStore().db).list();\n  const retention = new Retention(\n    getStore().db,\n    getStore().storage,\n    {\n      builds: getStore().db.tables.builds,\n      buildLabels: getStore().db.tables.buildLabels,\n      baselines: getStore().db.tables.baselines,\n    },\n    getStore().logger,\n  );\n  const results = await Promise.all(\n    projects.map((project) => retention.purge(project, { ttlDays, keepLatestPerBranch: true })),\n  );\n  return results.reduce((sum, result) => sum + result.removedBuilds, 0);\n}\n\n// oxlint-disable-next-line typescript/promise-function-async\nasync function purgeBranches(): Promise<{ removedBranches: number; removedBaselines: number }> {\n  const branchTtl = getStore().config.branchTtlDays ?? 30;\n  if (branchTtl === null) {\n    return { removedBranches: 0, removedBaselines: 0 };\n  }\n  const projects = await new ProjectModel(getStore().db).list();\n  const retention = new Retention(\n    getStore().db,\n    getStore().storage,\n    {\n      builds: getStore().db.tables.builds,\n      buildLabels: getStore().db.tables.buildLabels,\n      baselines: getStore().db.tables.baselines,\n    },\n    getStore().logger,\n  );\n  const results = await Promise.all(\n    projects.map((project) => retention.purgeStaleBranches(project, branchTtl)),\n  );\n  const removedBranches = results.reduce(\n    (sum: number, r: { removedBranches: number }) => sum + r.removedBranches,\n    0,\n  );\n  const removedBaselines = results.reduce(\n    (sum: number, r: { removedBaselines: number }) => sum + r.removedBaselines,\n    0,\n  );\n  return { removedBranches, removedBaselines };\n}\n"],"mappings":";;;;;;;;;;;;AAUA,MAAM,aAAa,YAAY;CAC7B,QAAQ;CACR,MAAM,CAAC,OAAO;CACd,SAAS;CACT,MAAM;CACN,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,iBAAiB,EAAE,EAAE,EAAE;CACnF,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,YAAY,EAAE;GACvD,aAAa;EACf;EACA,GAAGA;CACL;AACF,CAAC;AAED,MAAM,kBAAkB,EAAE,OAAO;CAC/B,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI;CAC5B,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI;CACvB,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI;AAC7B,CAAC;AAED,MAAM,iBAAiB,YAAY;CACjC,QAAQ;CACR,MAAM;CACN,MAAM,CAAC,OAAO;CACd,SAAS;CACT,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,EAAE;GAC3D,aAAa;EACf;EACA,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE;GAC3E,aAAa;EACf;EACA,GAAGA;CACL;AACF,CAAC;;AAGD,SAAgB,cAAc,KAAwB;CACpD,IAAI,QAAQ,gBAAgB,OAAO,MAAM;EACvC,iBAAiB,CAAC;EAClB,MAAM,EAAE,IAAI,WAAW,SAAS;EAChC,IAAI,CAAC,OAAO,gBACV,OAAO,EAAE,KAAK,EAAE,OAAO,yDAAyD,GAAG,GAAG;EAExF,MAAM,SAAS,MAAM,qBAAqB,IAAI,MAAM;EACpD,OAAO,EAAE,KACP;GACE,aAAa,OAAO;GACpB,QAAQ,OAAO;GACf,YAAY,OAAO,WAAW;EAChC,GACA,GACF;CACF,CAAC;CAED,IAAI,QAAQ,YAAY,OAAO,MAAM;EACnC,iBAAiB,CAAC;EAElB,MAAM,UADO,EAAE,IAAI,MAAM,MACN,CAAC,CAAC,WAAW,SAAS,CAAC,CAAC,OAAO,gBAAgB;EAClE,MAAM,gBAAgB,MAAM,YAAY,OAAO;EAC/C,MAAM,SAAS,MAAM,cAAc;EACnC,MAAM,aAAa,uBAAuB;GACxC;GACA,iBAAiB,OAAO;GACxB,kBAAkB,OAAO;GACzB;EACF,CAAC;EACD,OAAO,EAAE,KAAK;GACZ;GACA,iBAAiB,OAAO;GACxB,kBAAkB,OAAO;EAC3B,CAAC;CACH,CAAC;AACH;AAGA,eAAe,YAAY,SAAkC;CAC3D,MAAM,WAAW,MAAM,IAAI,aAAa,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK;CAC5D,MAAM,YAAY,IAAI,UACpB,SAAS,CAAC,CAAC,IACX,SAAS,CAAC,CAAC,SACX;EACE,QAAQ,SAAS,CAAC,CAAC,GAAG,OAAO;EAC7B,aAAa,SAAS,CAAC,CAAC,GAAG,OAAO;EAClC,WAAW,SAAS,CAAC,CAAC,GAAG,OAAO;CAClC,GACA,SAAS,CAAC,CAAC,MACb;CAIA,QAAO,MAHe,QAAQ,IAC5B,SAAS,KAAK,YAAY,UAAU,MAAM,SAAS;EAAE;EAAS,qBAAqB;CAAK,CAAC,CAAC,CAC5F,EAAA,CACe,QAAQ,KAAK,WAAW,MAAM,OAAO,eAAe,CAAC;AACtE;AAGA,eAAe,gBAAgF;CAC7F,MAAM,YAAY,SAAS,CAAC,CAAC,OAAO,iBAAiB;CACrD,IAAI,cAAc,MAChB,OAAO;EAAE,iBAAiB;EAAG,kBAAkB;CAAE;CAEnD,MAAM,WAAW,MAAM,IAAI,aAAa,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK;CAC5D,MAAM,YAAY,IAAI,UACpB,SAAS,CAAC,CAAC,IACX,SAAS,CAAC,CAAC,SACX;EACE,QAAQ,SAAS,CAAC,CAAC,GAAG,OAAO;EAC7B,aAAa,SAAS,CAAC,CAAC,GAAG,OAAO;EAClC,WAAW,SAAS,CAAC,CAAC,GAAG,OAAO;CAClC,GACA,SAAS,CAAC,CAAC,MACb;CACA,MAAM,UAAU,MAAM,QAAQ,IAC5B,SAAS,KAAK,YAAY,UAAU,mBAAmB,SAAS,SAAS,CAAC,CAC5E;CASA,OAAO;EAAE,iBARe,QAAQ,QAC7B,KAAa,MAAmC,MAAM,EAAE,iBACzD,CAMqB;EAAG,kBAJD,QAAQ,QAC9B,KAAa,MAAoC,MAAM,EAAE,kBAC1D,CAEuC;CAAE;AAC7C"}

package/dist/routers/assets.mjs

@@ -0,0 +1,64 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { assetManifest } from "../asset-manifest.mjs";
+//#region src/routers/assets.ts
+const IMMUTABLE = "public, max-age=31536000, immutable";
+/**
+* Serve a content-addressed asset. A matching hash is cacheable forever and
+* answers conditional requests with 304; a stale hash (an old page still
+* open after an upgrade) gets the current content but is never cached under
+* the old URL.
+*/
+function serveHashed(c, asset, requestedHash) {
+	const etag = `"${asset.hash}"`;
+	if (requestedHash !== asset.hash) return c.body(asset.source, 200, {
+		"content-type": asset.contentType,
+		"cache-control": "no-store"
+	});
+	if (c.req.header("if-none-match") === etag) return c.body(null, 304, {
+		etag,
+		"cache-control": IMMUTABLE
+	});
+	return c.body(asset.source, 200, {
+		"content-type": asset.contentType,
+		"cache-control": IMMUTABLE,
+		etag
+	});
+}
+/** Register the static-asset routes (HTMX bundle and icon sprite). */
+function registerAssets(app) {
+	const { htmx, icons, mark } = assetManifest;
+	app.get(String.raw`/assets/:file{htmx-[a-f0-9]+\.js}`, (c) => {
+		const hash = (c.req.param("file") ?? "").replaceAll(/^htmx-|\.js$/gu, "");
+		return serveHashed(c, {
+			...htmx,
+			contentType: "application/javascript"
+		}, hash);
+	});
+	app.get(String.raw`/assets/:file{icons-[a-f0-9]+\.svg}`, (c) => {
+		const hash = (c.req.param("file") ?? "").replaceAll(/^icons-|\.svg$/gu, "");
+		return serveHashed(c, {
+			...icons,
+			contentType: "image/svg+xml"
+		}, hash);
+	});
+	app.get(String.raw`/assets/:file{mark-[a-f0-9]+\.svg}`, (c) => {
+		const hash = (c.req.param("file") ?? "").replaceAll(/^mark-|\.svg$/gu, "");
+		return serveHashed(c, {
+			...mark,
+			contentType: "image/svg+xml"
+		}, hash);
+	});
+	app.get("/assets/htmx.js", (c) => {
+		return c.body(htmx.source, 200, {
+			"content-type": "application/javascript",
+			"cache-control": "no-cache",
+			etag: `"${htmx.hash}"`
+		});
+	});
+}
+//#endregion
+export { registerAssets };
+
+//# sourceMappingURL=assets.mjs.map

package/dist/routers/assets.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.mjs","names":[],"sources":["../../src/routers/assets.ts"],"sourcesContent":["import type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { assetManifest } from \"../asset-manifest.ts\";\n\nconst IMMUTABLE = \"public, max-age=31536000, immutable\";\n\ninterface Asset {\n  source: string;\n  hash: string;\n  contentType: string;\n}\n\n/**\n * Serve a content-addressed asset. A matching hash is cacheable forever and\n * answers conditional requests with 304; a stale hash (an old page still\n * open after an upgrade) gets the current content but is never cached under\n * the old URL.\n */\nfunction serveHashed(c: Context, asset: Asset, requestedHash: string): Response {\n  const etag = `\"${asset.hash}\"`;\n  if (requestedHash !== asset.hash) {\n    return c.body(asset.source, 200, {\n      \"content-type\": asset.contentType,\n      \"cache-control\": \"no-store\",\n    });\n  }\n  if (c.req.header(\"if-none-match\") === etag) {\n    return c.body(null, 304, { etag, \"cache-control\": IMMUTABLE });\n  }\n  return c.body(asset.source, 200, {\n    \"content-type\": asset.contentType,\n    \"cache-control\": IMMUTABLE,\n    etag,\n  });\n}\n\n/** Register the static-asset routes (HTMX bundle and icon sprite). */\nexport function registerAssets(app: ShelfRouter): void {\n  const { htmx, icons, mark } = assetManifest;\n  app.get(String.raw`/assets/:file{htmx-[a-f0-9]+\\.js}`, (c) => {\n    const hash = (c.req.param(\"file\") ?? \"\").replaceAll(/^htmx-|\\.js$/gu, \"\");\n    return serveHashed(c, { ...htmx, contentType: \"application/javascript\" }, hash);\n  });\n  app.get(String.raw`/assets/:file{icons-[a-f0-9]+\\.svg}`, (c) => {\n    const hash = (c.req.param(\"file\") ?? \"\").replaceAll(/^icons-|\\.svg$/gu, \"\");\n    return serveHashed(c, { ...icons, contentType: \"image/svg+xml\" }, hash);\n  });\n  app.get(String.raw`/assets/:file{mark-[a-f0-9]+\\.svg}`, (c) => {\n    const hash = (c.req.param(\"file\") ?? \"\").replaceAll(/^mark-|\\.svg$/gu, \"\");\n    return serveHashed(c, { ...mark, contentType: \"image/svg+xml\" }, hash);\n  });\n  // Legacy unversioned URL: kept for old pages and external embeds, but\n  // revalidated (never immutable) because its content can change.\n  app.get(\"/assets/htmx.js\", (c) => {\n    return c.body(htmx.source, 200, {\n      \"content-type\": \"application/javascript\",\n      \"cache-control\": \"no-cache\",\n      etag: `\"${htmx.hash}\"`,\n    });\n  });\n}\n"],"mappings":";;;;;AAIA,MAAM,YAAY;;;;;;;AAclB,SAAS,YAAY,GAAY,OAAc,eAAiC;CAC9E,MAAM,OAAO,IAAI,MAAM,KAAK;CAC5B,IAAI,kBAAkB,MAAM,MAC1B,OAAO,EAAE,KAAK,MAAM,QAAQ,KAAK;EAC/B,gBAAgB,MAAM;EACtB,iBAAiB;CACnB,CAAC;CAEH,IAAI,EAAE,IAAI,OAAO,eAAe,MAAM,MACpC,OAAO,EAAE,KAAK,MAAM,KAAK;EAAE;EAAM,iBAAiB;CAAU,CAAC;CAE/D,OAAO,EAAE,KAAK,MAAM,QAAQ,KAAK;EAC/B,gBAAgB,MAAM;EACtB,iBAAiB;EACjB;CACF,CAAC;AACH;;AAGA,SAAgB,eAAe,KAAwB;CACrD,MAAM,EAAE,MAAM,OAAO,SAAS;CAC9B,IAAI,IAAI,OAAO,GAAG,sCAAsC,MAAM;EAC5D,MAAM,QAAQ,EAAE,IAAI,MAAM,MAAM,KAAK,GAAA,CAAI,WAAW,kBAAkB,EAAE;EACxE,OAAO,YAAY,GAAG;GAAE,GAAG;GAAM,aAAa;EAAyB,GAAG,IAAI;CAChF,CAAC;CACD,IAAI,IAAI,OAAO,GAAG,wCAAwC,MAAM;EAC9D,MAAM,QAAQ,EAAE,IAAI,MAAM,MAAM,KAAK,GAAA,CAAI,WAAW,oBAAoB,EAAE;EAC1E,OAAO,YAAY,GAAG;GAAE,GAAG;GAAO,aAAa;EAAgB,GAAG,IAAI;CACxE,CAAC;CACD,IAAI,IAAI,OAAO,GAAG,uCAAuC,MAAM;EAC7D,MAAM,QAAQ,EAAE,IAAI,MAAM,MAAM,KAAK,GAAA,CAAI,WAAW,mBAAmB,EAAE;EACzE,OAAO,YAAY,GAAG;GAAE,GAAG;GAAM,aAAa;EAAgB,GAAG,IAAI;CACvE,CAAC;CAGD,IAAI,IAAI,oBAAoB,MAAM;EAChC,OAAO,EAAE,KAAK,KAAK,QAAQ,KAAK;GAC9B,gBAAgB;GAChB,iBAAiB;GACjB,MAAM,IAAI,KAAK,KAAK;EACtB,CAAC;CACH,CAAC;AACH"}

package/dist/routers/attempts.mjs

@@ -0,0 +1,96 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { notFound, resolveAuthorizedProject } from "./helpers.mjs";
+import { attemptLogSchema, attemptSchema, notFound as notFound$1, unauthorized } from "./schemas.mjs";
+import { VIEW_ROLES, buildForProject } from "./builds.handlers.mjs";
+import { createRoute, z } from "@hono/zod-openapi";
+import { CaptureAttemptModel, CaptureLogModel } from "@storyshelf/core/models";
+//#region src/routers/attempts.ts
+/** Register the capture-attempt history and per-attempt log endpoints. */
+function registerAttempts(app) {
+	app.openapi(listAttemptsRoute, async (c) => {
+		const build = await scopedBuild(c, c.req.valid("param"));
+		const attempts = await new CaptureAttemptModel(getStore().db).listByBuild(build.id);
+		return c.json(attempts);
+	});
+	app.openapi(getAttemptRoute, async (c) => {
+		const build = await scopedBuild(c, c.req.valid("param"));
+		return c.json(await attemptForBuild(build, c.req.valid("param").attemptNo));
+	});
+	app.openapi(listAttemptLogsRoute, async (c) => {
+		const attempt = await attemptForBuild(await scopedBuild(c, c.req.valid("param")), c.req.valid("param").attemptNo);
+		const logs = await new CaptureLogModel(getStore().db).listByAttempt(attempt.id);
+		return c.json(logs);
+	});
+}
+const buildParams = z.object({
+	slug: z.string(),
+	buildId: z.string()
+});
+const attemptParams = z.object({
+	slug: z.string(),
+	buildId: z.string(),
+	attemptNo: z.coerce.number().int().min(1)
+});
+const listAttemptsRoute = createRoute({
+	method: "get",
+	tags: ["Builds"],
+	summary: "List capture attempts",
+	path: "/api/v1/projects/{slug}/builds/{buildId}/attempts",
+	request: { params: buildParams },
+	responses: {
+		200: {
+			content: { "application/json": { schema: attemptSchema.array() } },
+			description: "List capture attempts for a build (oldest first)"
+		},
+		...notFound$1,
+		...unauthorized
+	}
+});
+const getAttemptRoute = createRoute({
+	method: "get",
+	tags: ["Builds"],
+	summary: "Get a capture attempt",
+	path: "/api/v1/projects/{slug}/builds/{buildId}/attempts/{attemptNo}",
+	request: { params: attemptParams },
+	responses: {
+		200: {
+			content: { "application/json": { schema: attemptSchema } },
+			description: "Fetch a single capture attempt"
+		},
+		...notFound$1,
+		...unauthorized
+	}
+});
+const listAttemptLogsRoute = createRoute({
+	method: "get",
+	tags: ["Builds"],
+	summary: "Get capture attempt logs",
+	path: "/api/v1/projects/{slug}/builds/{buildId}/attempts/{attemptNo}/logs",
+	request: { params: attemptParams },
+	responses: {
+		200: {
+			content: { "application/json": { schema: attemptLogSchema.array() } },
+			description: "List every log line of a capture attempt (in order)"
+		},
+		...notFound$1,
+		...unauthorized
+	}
+});
+/** Resolve the project (viewer+) and the build scoped to it. */
+async function scopedBuild(c, params) {
+	const project = await resolveAuthorizedProject(c, params.slug, ...VIEW_ROLES);
+	return await buildForProject(project.id, params.buildId);
+}
+/** Fetch an attempt scoped to its build, throwing 404 when it does not belong. */
+async function attemptForBuild(build, attemptNo) {
+	const attempt = await new CaptureAttemptModel(getStore().db).getByNo(build.id, attemptNo);
+	if (!attempt) notFound("Attempt not found");
+	return attempt;
+}
+//#endregion
+export { registerAttempts };
+
+//# sourceMappingURL=attempts.mjs.map

package/dist/routers/attempts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"attempts.mjs","names":["notFoundResponse"],"sources":["../../src/routers/attempts.ts"],"sourcesContent":["import { createRoute, z } from \"@hono/zod-openapi\";\nimport { CaptureAttemptModel } from \"@storyshelf/core/models\";\nimport { CaptureLogModel } from \"@storyshelf/core/models\";\nimport type { Build, CaptureAttempt } from \"@storyshelf/core/schema\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { VIEW_ROLES, buildForProject } from \"./builds.handlers.ts\";\nimport { notFound, resolveAuthorizedProject } from \"./helpers.ts\";\nimport { notFound as notFoundResponse, unauthorized } from \"./schemas.ts\";\nimport { attemptLogSchema, attemptSchema } from \"./schemas.ts\";\n\n/** Register the capture-attempt history and per-attempt log endpoints. */\nexport function registerAttempts(app: ShelfRouter): void {\n  app.openapi(listAttemptsRoute, async (c) => {\n    const build = await scopedBuild(c, c.req.valid(\"param\"));\n    const attempts = await new CaptureAttemptModel(getStore().db).listByBuild(build.id);\n    return c.json(attempts);\n  });\n\n  app.openapi(getAttemptRoute, async (c) => {\n    const build = await scopedBuild(c, c.req.valid(\"param\"));\n    return c.json(await attemptForBuild(build, c.req.valid(\"param\").attemptNo));\n  });\n\n  app.openapi(listAttemptLogsRoute, async (c) => {\n    const build = await scopedBuild(c, c.req.valid(\"param\"));\n    const attempt = await attemptForBuild(build, c.req.valid(\"param\").attemptNo);\n    const logs = await new CaptureLogModel(getStore().db).listByAttempt(attempt.id);\n    return c.json(logs);\n  });\n}\n\nconst buildParams = z.object({ slug: z.string(), buildId: z.string() });\n\nconst attemptParams = z.object({\n  slug: z.string(),\n  buildId: z.string(),\n  attemptNo: z.coerce.number().int().min(1),\n});\n\nconst listAttemptsRoute = createRoute({\n  method: \"get\",\n  tags: [\"Builds\"],\n  summary: \"List capture attempts\",\n  path: \"/api/v1/projects/{slug}/builds/{buildId}/attempts\",\n  request: { params: buildParams },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: attemptSchema.array() } },\n      description: \"List capture attempts for a build (oldest first)\",\n    },\n    ...notFoundResponse,\n    ...unauthorized,\n  },\n});\n\nconst getAttemptRoute = createRoute({\n  method: \"get\",\n  tags: [\"Builds\"],\n  summary: \"Get a capture attempt\",\n  path: \"/api/v1/projects/{slug}/builds/{buildId}/attempts/{attemptNo}\",\n  request: { params: attemptParams },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: attemptSchema } },\n      description: \"Fetch a single capture attempt\",\n    },\n    ...notFoundResponse,\n    ...unauthorized,\n  },\n});\n\nconst listAttemptLogsRoute = createRoute({\n  method: \"get\",\n  tags: [\"Builds\"],\n  summary: \"Get capture attempt logs\",\n  path: \"/api/v1/projects/{slug}/builds/{buildId}/attempts/{attemptNo}/logs\",\n  request: { params: attemptParams },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: attemptLogSchema.array() } },\n      description: \"List every log line of a capture attempt (in order)\",\n    },\n    ...notFoundResponse,\n    ...unauthorized,\n  },\n});\n\n/** Resolve the project (viewer+) and the build scoped to it. */\nasync function scopedBuild(c: Context, params: { slug: string; buildId: string }): Promise<Build> {\n  const project = await resolveAuthorizedProject(c, params.slug, ...VIEW_ROLES);\n  return await buildForProject(project.id, params.buildId);\n}\n\n/** Fetch an attempt scoped to its build, throwing 404 when it does not belong. */\nasync function attemptForBuild(build: Build, attemptNo: number): Promise<CaptureAttempt> {\n  const attempt = await new CaptureAttemptModel(getStore().db).getByNo(build.id, attemptNo);\n  if (!attempt) {\n    notFound(\"Attempt not found\");\n  }\n  return attempt;\n}\n"],"mappings":";;;;;;;;;;;AAaA,SAAgB,iBAAiB,KAAwB;CACvD,IAAI,QAAQ,mBAAmB,OAAO,MAAM;EAC1C,MAAM,QAAQ,MAAM,YAAY,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC;EACvD,MAAM,WAAW,MAAM,IAAI,oBAAoB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,MAAM,EAAE;EAClF,OAAO,EAAE,KAAK,QAAQ;CACxB,CAAC;CAED,IAAI,QAAQ,iBAAiB,OAAO,MAAM;EACxC,MAAM,QAAQ,MAAM,YAAY,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC;EACvD,OAAO,EAAE,KAAK,MAAM,gBAAgB,OAAO,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,SAAS,CAAC;CAC5E,CAAC;CAED,IAAI,QAAQ,sBAAsB,OAAO,MAAM;EAE7C,MAAM,UAAU,MAAM,gBAAgB,MADlB,YAAY,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,GACV,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,SAAS;EAC3E,MAAM,OAAO,MAAM,IAAI,gBAAgB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,QAAQ,EAAE;EAC9E,OAAO,EAAE,KAAK,IAAI;CACpB,CAAC;AACH;AAEA,MAAM,cAAc,EAAE,OAAO;CAAE,MAAM,EAAE,OAAO;CAAG,SAAS,EAAE,OAAO;AAAE,CAAC;AAEtE,MAAM,gBAAgB,EAAE,OAAO;CAC7B,MAAM,EAAE,OAAO;CACf,SAAS,EAAE,OAAO;CAClB,WAAW,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,MAAM,oBAAoB,YAAY;CACpC,QAAQ;CACR,MAAM,CAAC,QAAQ;CACf,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,YAAY;CAC/B,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,cAAc,MAAM,EAAE,EAAE;GACjE,aAAa;EACf;EACA,GAAGA;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,kBAAkB,YAAY;CAClC,QAAQ;CACR,MAAM,CAAC,QAAQ;CACf,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,cAAc;CACjC,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,cAAc,EAAE;GACzD,aAAa;EACf;EACA,GAAGA;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,uBAAuB,YAAY;CACvC,QAAQ;CACR,MAAM,CAAC,QAAQ;CACf,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,cAAc;CACjC,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,iBAAiB,MAAM,EAAE,EAAE;GACpE,aAAa;EACf;EACA,GAAGA;EACH,GAAG;CACL;AACF,CAAC;;AAGD,eAAe,YAAY,GAAY,QAA2D;CAChG,MAAM,UAAU,MAAM,yBAAyB,GAAG,OAAO,MAAM,GAAG,UAAU;CAC5E,OAAO,MAAM,gBAAgB,QAAQ,IAAI,OAAO,OAAO;AACzD;;AAGA,eAAe,gBAAgB,OAAc,WAA4C;CACvF,MAAM,UAAU,MAAM,IAAI,oBAAoB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,MAAM,IAAI,SAAS;CACxF,IAAI,CAAC,SACH,SAAS,mBAAmB;CAE9B,OAAO;AACT"}

package/dist/routers/auth-sync.mjs

@@ -0,0 +1,64 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { MemberModel, ProjectGroupMappingModel, ProjectModel, UserModel } from "@storyshelf/core/models";
+//#region src/routers/auth-sync.ts
+const ROLE_RANK = {
+	viewer: 0,
+	developer: 1,
+	approver: 2,
+	admin: 3
+};
+/**
+* Persist the authenticated identity and reconcile OIDC group memberships.
+*
+* Always upserts the user row. Group mappings apply per project: the highest
+* matched role wins (recorded as `oidc:<group>`); memberships from groups the
+* user no longer matches are removed — manual grants are never touched.
+*/
+async function syncLoginMemberships(db, _tables, user) {
+	await new UserModel(db).upsert({
+		id: user.id,
+		email: user.email,
+		name: user.name,
+		avatarUrl: user.avatarUrl ?? null,
+		role: user.role
+	});
+	const groups = user.groups ?? [];
+	const projects = await new ProjectModel(db).list();
+	const members = new MemberModel(db);
+	const mappings = new ProjectGroupMappingModel(db);
+	await Promise.all(projects.map((project) => syncProjectMembership(members, mappings, project.id, user.id, groups)));
+}
+/** Highest-ranked matched mapping, or null when nothing matches. */
+function topMatch(rows, groups) {
+	let top = null;
+	for (const row of rows) {
+		if (!groups.includes(row.groupName)) continue;
+		if (!top || ROLE_RANK[row.role] > ROLE_RANK[top.role]) top = {
+			groupName: row.groupName,
+			role: row.role
+		};
+	}
+	return top;
+}
+/** Remove a synced grant the user no longer matches; manual grants survive. */
+async function revokeIfStale(members, projectId, userId) {
+	const existing = await members.get(projectId, userId);
+	if (existing && existing.source !== "manual") await members.remove(projectId, userId);
+}
+async function syncProjectMembership(members, mappings, projectId, userId, groups) {
+	const rows = await mappings.list(projectId);
+	if (rows.length === 0) return;
+	const top = topMatch(rows, groups);
+	if (!top) {
+		await revokeIfStale(members, projectId, userId);
+		return;
+	}
+	const existing = await members.get(projectId, userId);
+	if (!existing || existing.role !== top.role || existing.source !== `oidc:${top.groupName}`) await members.set(projectId, userId, top.role, `oidc:${top.groupName}`);
+}
+//#endregion
+export { syncLoginMemberships };
+
+//# sourceMappingURL=auth-sync.mjs.map

package/dist/routers/auth-sync.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-sync.mjs","names":[],"sources":["../../src/routers/auth-sync.ts"],"sourcesContent":["import type { DatabaseAdapter } from \"@storyshelf/core/adapter/database\";\nimport {\n  MemberModel,\n  ProjectGroupMappingModel,\n  ProjectModel,\n  UserModel,\n} from \"@storyshelf/core/models\";\nimport type { AuthUser } from \"@storyshelf/core/types\";\nimport type { ProjectRole } from \"@storyshelf/core/types\";\nimport type { Table } from \"drizzle-orm\";\n\n/** Tables required to sync a login. */\nexport interface LoginSyncTables {\n  users: Table;\n  projects: Table;\n  projectMembers: Table;\n  projectGroupMappings: Table;\n}\n\nconst ROLE_RANK: Record<ProjectRole, number> = {\n  viewer: 0,\n  developer: 1,\n  approver: 2,\n  admin: 3,\n};\n\n/**\n * Persist the authenticated identity and reconcile OIDC group memberships.\n *\n * Always upserts the user row. Group mappings apply per project: the highest\n * matched role wins (recorded as `oidc:<group>`); memberships from groups the\n * user no longer matches are removed — manual grants are never touched.\n */\nexport async function syncLoginMemberships(\n  db: DatabaseAdapter,\n  _tables: LoginSyncTables,\n  user: AuthUser,\n): Promise<void> {\n  await new UserModel(db).upsert({\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    avatarUrl: user.avatarUrl ?? null,\n    role: user.role,\n  });\n  const groups = user.groups ?? [];\n  const projects = await new ProjectModel(db).list();\n  const members = new MemberModel(db);\n  const mappings = new ProjectGroupMappingModel(db);\n  await Promise.all(\n    projects.map(\n      // oxlint-disable-next-line typescript/promise-function-async -- returns the inner promise directly\n      (project) => syncProjectMembership(members, mappings, project.id, user.id, groups),\n    ),\n  );\n}\n\n/** Highest-ranked matched mapping, or null when nothing matches. */\nfunction topMatch(\n  rows: { groupName: string; role: ProjectRole }[],\n  groups: string[],\n): { groupName: string; role: ProjectRole } | null {\n  let top: { groupName: string; role: ProjectRole } | null = null;\n  for (const row of rows) {\n    if (!groups.includes(row.groupName)) {\n      continue;\n    }\n    if (!top || ROLE_RANK[row.role] > ROLE_RANK[top.role]) {\n      top = { groupName: row.groupName, role: row.role };\n    }\n  }\n  return top;\n}\n\n/** Remove a synced grant the user no longer matches; manual grants survive. */\nasync function revokeIfStale(\n  members: MemberModel,\n  projectId: string,\n  userId: string,\n): Promise<void> {\n  const existing = await members.get(projectId, userId);\n  if (existing && existing.source !== \"manual\") {\n    await members.remove(projectId, userId);\n  }\n}\n\nasync function syncProjectMembership(\n  members: MemberModel,\n  mappings: ProjectGroupMappingModel,\n  projectId: string,\n  userId: string,\n  groups: string[],\n): Promise<void> {\n  const rows = await mappings.list(projectId);\n  if (rows.length === 0) {\n    return;\n  }\n  const top = topMatch(rows, groups);\n  if (!top) {\n    await revokeIfStale(members, projectId, userId);\n    return;\n  }\n  const existing = await members.get(projectId, userId);\n  if (!existing || existing.role !== top.role || existing.source !== `oidc:${top.groupName}`) {\n    await members.set(projectId, userId, top.role, `oidc:${top.groupName}`);\n  }\n}\n"],"mappings":";;;;;AAmBA,MAAM,YAAyC;CAC7C,QAAQ;CACR,WAAW;CACX,UAAU;CACV,OAAO;AACT;;;;;;;;AASA,eAAsB,qBACpB,IACA,SACA,MACe;CACf,MAAM,IAAI,UAAU,EAAE,CAAC,CAAC,OAAO;EAC7B,IAAI,KAAK;EACT,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,WAAW,KAAK,aAAa;EAC7B,MAAM,KAAK;CACb,CAAC;CACD,MAAM,SAAS,KAAK,UAAU,CAAC;CAC/B,MAAM,WAAW,MAAM,IAAI,aAAa,EAAE,CAAC,CAAC,KAAK;CACjD,MAAM,UAAU,IAAI,YAAY,EAAE;CAClC,MAAM,WAAW,IAAI,yBAAyB,EAAE;CAChD,MAAM,QAAQ,IACZ,SAAS,KAEN,YAAY,sBAAsB,SAAS,UAAU,QAAQ,IAAI,KAAK,IAAI,MAAM,CACnF,CACF;AACF;;AAGA,SAAS,SACP,MACA,QACiD;CACjD,IAAI,MAAuD;CAC3D,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,CAAC,OAAO,SAAS,IAAI,SAAS,GAChC;EAEF,IAAI,CAAC,OAAO,UAAU,IAAI,QAAQ,UAAU,IAAI,OAC9C,MAAM;GAAE,WAAW,IAAI;GAAW,MAAM,IAAI;EAAK;CAErD;CACA,OAAO;AACT;;AAGA,eAAe,cACb,SACA,WACA,QACe;CACf,MAAM,WAAW,MAAM,QAAQ,IAAI,WAAW,MAAM;CACpD,IAAI,YAAY,SAAS,WAAW,UAClC,MAAM,QAAQ,OAAO,WAAW,MAAM;AAE1C;AAEA,eAAe,sBACb,SACA,UACA,WACA,QACA,QACe;CACf,MAAM,OAAO,MAAM,SAAS,KAAK,SAAS;CAC1C,IAAI,KAAK,WAAW,GAClB;CAEF,MAAM,MAAM,SAAS,MAAM,MAAM;CACjC,IAAI,CAAC,KAAK;EACR,MAAM,cAAc,SAAS,WAAW,MAAM;EAC9C;CACF;CACA,MAAM,WAAW,MAAM,QAAQ,IAAI,WAAW,MAAM;CACpD,IAAI,CAAC,YAAY,SAAS,SAAS,IAAI,QAAQ,SAAS,WAAW,QAAQ,IAAI,aAC7E,MAAM,QAAQ,IAAI,WAAW,QAAQ,IAAI,MAAM,QAAQ,IAAI,WAAW;AAE1E"}

package/dist/routers/auth.mjs

@@ -0,0 +1,236 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { notifySystem } from "../notify.mjs";
+import { hxRedirect } from "./htmx.mjs";
+import { renderInviteInvalidPage, renderInvitePage } from "../pages/invite.mjs";
+import { renderLoginPage } from "../pages/login.mjs";
+import { syncLoginMemberships } from "./auth-sync.mjs";
+import { UserModel } from "@storyshelf/core/models";
+import { SESSION_COOKIE } from "@storyshelf/core/types";
+import { HTTPException } from "hono/http-exception";
+import { MIN_PASSWORD_LENGTH } from "@storyshelf/auth";
+//#region src/routers/auth.ts
+/** Provider ids are URL path segments: strict charset, bounded length. */
+function validProviderId(value) {
+	return /^[a-zA-Z0-9_-]{1,64}$/u.test(value);
+}
+const ENGINE_PASSWORD_ACTION = "/auth/engine/login";
+/** Forward a request to the mounted engine, preserving origin and cookies. */
+async function forwardToEngine(c, engine, path, body) {
+	return await forwardEngineRequest(c, engine, path, "POST", body);
+}
+async function forwardEngineRequest(c, engine, path, method, body) {
+	const headers = new Headers();
+	for (const name of [
+		"cookie",
+		"origin",
+		"referer",
+		"user-agent"
+	]) {
+		const value = c.req.header(name);
+		if (value) headers.set(name, value);
+	}
+	if (method === "POST") headers.set("content-type", "application/json");
+	return await engine.handler(new Request(new URL(path, c.req.url), {
+		method,
+		headers,
+		...method === "POST" ? { body: JSON.stringify(body ?? {}) } : {}
+	}));
+}
+function copySetCookies(c, res) {
+	const cookies = typeof res.headers.getSetCookie === "function" ? res.headers.getSetCookie() : splitSetCookie(res.headers.get("set-cookie"));
+	for (const cookie of cookies) c.header("set-cookie", cookie, { append: true });
+}
+/** Split a joined Set-Cookie header (runtimes without getSetCookie). */
+function splitSetCookie(header) {
+	if (!header) return [];
+	return header.split(/,\s*(?=[^;\s=]+=)/u).map((part) => part.trim()).filter((part) => part !== "");
+}
+function loginLinks(methods) {
+	return methods.map((method) => ({
+		...method,
+		url: method.kind === "oauth" || method.kind === "sso" ? `/auth/engine/${method.id}` : ENGINE_PASSWORD_ACTION
+	}));
+}
+async function renderEngineLogin(c, engine, error, email, status) {
+	return c.html(await renderLoginPage({
+		error,
+		email,
+		engineMethods: loginLinks(engine.loginMethods())
+	}), status ?? 200);
+}
+/** Membership sync for first-seen engine users only (never demote existing roles). */
+async function syncEngineUser(user) {
+	if (await new UserModel(getStore().db).get(user.id)) return;
+	await syncLoginMemberships(getStore().db, {
+		users: getStore().db.tables.users,
+		projects: getStore().db.tables.projects,
+		projectMembers: getStore().db.tables.projectMembers,
+		projectGroupMappings: getStore().db.tables.projectGroupMappings
+	}, {
+		...user,
+		role: "member"
+	});
+}
+async function readCredentials(c) {
+	const form = await c.req.formData();
+	const rawEmail = form.get("email");
+	const rawPassword = form.get("password");
+	return {
+		email: typeof rawEmail === "string" ? rawEmail : "",
+		password: typeof rawPassword === "string" ? rawPassword : ""
+	};
+}
+async function finishCredentialLogin(c, engine, email, password) {
+	const res = await forwardToEngine(c, engine, "/api/auth/sign-in/email", {
+		email,
+		password
+	});
+	if (res.status !== 200) {
+		if (res.status === 429) return renderEngineLogin(c, engine, "Invalid credentials", email, 429);
+		if (res.status >= 500) return renderEngineLogin(c, engine, "Invalid credentials", email, 502);
+		await notifySystem("sys:auth-failed", { email });
+		return renderEngineLogin(c, engine, "Invalid credentials", email, 401);
+	}
+	copySetCookies(c, res);
+	await syncEngineUser((await res.json()).user);
+	return hxRedirect(c, "/");
+}
+async function handleEngineLogin(c, engine) {
+	const { email, password } = await readCredentials(c);
+	return finishCredentialLogin(c, engine, email, password);
+}
+function resolveEngineMethod(c, engine) {
+	const id = c.req.param("providerId") ?? "";
+	if (!validProviderId(id)) throw new HTTPException(400, { message: "Unknown provider" });
+	return engine.loginMethods().find((entry) => entry.id === id && entry.kind !== "password") ?? null;
+}
+async function finishOAuthStart(c, engine, id) {
+	const res = await forwardToEngine(c, engine, "/api/auth/sign-in/social", {
+		provider: id,
+		callbackURL: "/",
+		disableRedirect: true
+	});
+	if (res.status !== 200) throw new HTTPException(502, { message: "Sign in failed" });
+	const body = await res.json();
+	if (!body.url) throw new HTTPException(502, { message: "Sign in failed" });
+	copySetCookies(c, res);
+	return c.redirect(body.url);
+}
+async function finishSSOStart(c, engine, id) {
+	const res = await forwardToEngine(c, engine, "/api/auth/sign-in/sso", {
+		providerId: id,
+		callbackURL: "/"
+	});
+	if (res.status !== 200) throw new HTTPException(502, { message: "Sign in failed" });
+	const body = await res.json();
+	if (!body.url) throw new HTTPException(502, { message: "Sign in failed" });
+	copySetCookies(c, res);
+	return c.redirect(body.url);
+}
+async function handleEngineStart(c, engine) {
+	const method = resolveEngineMethod(c, engine);
+	if (!method || method.kind === "passkey") return c.notFound();
+	if (method.kind === "sso") return await finishSSOStart(c, engine, method.id);
+	return await finishOAuthStart(c, engine, method.id);
+}
+async function handleInvitePage(c, engine) {
+	const inviteId = c.req.param("inviteId") ?? "";
+	const token = c.req.query("token") ?? "";
+	c.header("Cache-Control", "no-store");
+	if (!inviteId || !token) return c.html(renderInviteInvalidPage("Missing invite link parameters"), 400);
+	try {
+		const { email, name } = await engine.verifyInvite({
+			inviteId,
+			token
+		});
+		return c.html(await renderInvitePage({
+			inviteId,
+			token,
+			email,
+			name
+		}));
+	} catch {
+		return c.html(renderInviteInvalidPage("Invalid or expired invite"), 400);
+	}
+}
+async function readInviteForm(c) {
+	const form = await c.req.formData();
+	return {
+		inviteId: c.req.param("inviteId") ?? "",
+		token: formText(form.get("token")),
+		password: formText(form.get("password")),
+		confirm: formText(form.get("confirm"))
+	};
+}
+function formText(value) {
+	return typeof value === "string" ? value : "";
+}
+async function finishInviteAccept(c, engine, inviteId, token, password) {
+	const user = await engine.acceptInvite({
+		inviteId,
+		token,
+		password
+	});
+	const res = await forwardToEngine(c, engine, "/api/auth/sign-in/email", {
+		email: user.email,
+		password
+	});
+	if (res.status !== 200) throw new Error("Sign in failed");
+	copySetCookies(c, res);
+	await syncEngineUser({
+		id: user.id,
+		email: user.email,
+		name: user.name
+	});
+	return c.redirect("/profile");
+}
+async function inviteAcceptError(c, inviteId, token, error) {
+	const message = error instanceof Error ? error.message : "Invalid or expired invite";
+	if (message.includes(`at least ${MIN_PASSWORD_LENGTH}`)) return c.html(await renderInvitePage({
+		inviteId,
+		token,
+		error: message
+	}), 400);
+	return c.html(renderInviteInvalidPage(message), 400);
+}
+async function handleInviteAccept(c, engine) {
+	const { inviteId, token, password, confirm } = await readInviteForm(c);
+	if (!inviteId || !token) return c.html(renderInviteInvalidPage("Missing invite link parameters"), 400);
+	if (password !== confirm) return c.html(await renderInvitePage({
+		inviteId,
+		token,
+		error: "Passwords do not match"
+	}), 400);
+	try {
+		return await finishInviteAccept(c, engine, inviteId, token, password);
+	} catch (error) {
+		return await inviteAcceptError(c, inviteId, token, error);
+	}
+}
+/** Register the engine mount and descriptor-driven login routes. */
+function registerEngineAuth(app, engine) {
+	app.all("/api/auth/*", async (c) => await engine.handler(c.req.raw));
+	app.get("/auth/login", async (c) => {
+		const methods = engine.loginMethods();
+		const sole = methods.length === 1 ? methods.at(0) : void 0;
+		if (sole?.kind === "oauth" || sole?.kind === "sso") return c.redirect(`/auth/engine/${sole.id}`);
+		return await renderEngineLogin(c, engine);
+	});
+	app.post("/auth/engine/login", async (c) => await handleEngineLogin(c, engine));
+	app.get("/auth/engine/:providerId", async (c) => await handleEngineStart(c, engine));
+	app.get("/auth/invites/:inviteId", async (c) => await handleInvitePage(c, engine));
+	app.post("/auth/invites/:inviteId", async (c) => await handleInviteAccept(c, engine));
+	app.post("/auth/logout", async (c) => {
+		copySetCookies(c, await forwardToEngine(c, engine, "/api/auth/sign-out", {}));
+		const secure = new URL(c.req.url).protocol === "https:" || c.req.header("x-forwarded-proto") === "https";
+		c.header("set-cookie", `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure ? "; Secure" : ""}`, { append: true });
+		return hxRedirect(c, "/auth/login");
+	});
+}
+//#endregion
+export { forwardToEngine, registerEngineAuth };
+
+//# sourceMappingURL=auth.mjs.map