@storyshelf/app 0.5.3

package/dist/assets/mark.svg

@@ -0,0 +1 @@
+<svg xmlns='http://www.w3.org/2000/svg' width='64' height='64' viewBox='0 0 64 64' role='img' aria-label='StoryShelf'><rect width='64' height='64' rx='14' fill='#1d5fcf'/><path d='M15 11 H49 A4 4 0 0 1 53 15 V15 A2 2 0 0 1 51 17 H13 A2 2 0 0 1 11 15 V15 A4 4 0 0 1 15 11 Z' fill='#ffffff'/><path d='M13 29 H51 A2 2 0 0 1 53 31 V33 A2 2 0 0 1 51 35 H13 A2 2 0 0 1 11 33 V31 A2 2 0 0 1 13 29 Z' fill='#ffffff'/><path d='M13 47 H51 A2 2 0 0 1 53 49 V49 A4 4 0 0 1 49 53 H15 A4 4 0 0 1 11 49 V49 A2 2 0 0 1 13 47 Z' fill='#ffffff'/><path d='M16 19 H16 A2 2 0 0 1 18 21 V27 A2 2 0 0 1 16 29 H16 A2 2 0 0 1 14 27 V21 A2 2 0 0 1 16 19 Z' fill='#ffffff'/><path d='M22 21 H22 A2 2 0 0 1 24 23 V27 A2 2 0 0 1 22 29 H22 A2 2 0 0 1 20 27 V23 A2 2 0 0 1 22 21 Z' fill='#ffffff'/><path d='M28 23 H28 A2 2 0 0 1 30 25 V27 A2 2 0 0 1 28 29 H28 A2 2 0 0 1 26 27 V25 A2 2 0 0 1 28 23 Z' fill='#ffffff'/><path d='M48 37 H48 A2 2 0 0 1 50 39 V45 A2 2 0 0 1 48 47 H48 A2 2 0 0 1 46 45 V39 A2 2 0 0 1 48 37 Z' fill='#ffffff'/><path d='M42 39 H42 A2 2 0 0 1 44 41 V45 A2 2 0 0 1 42 47 H42 A2 2 0 0 1 40 45 V41 A2 2 0 0 1 42 39 Z' fill='#ffffff'/><path d='M36 41 H36 A2 2 0 0 1 38 43 V45 A2 2 0 0 1 36 47 H36 A2 2 0 0 1 34 45 V43 A2 2 0 0 1 36 41 Z' fill='#ffffff'/></svg>

package/dist/capture-setup.mjs

@@ -0,0 +1,139 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { credentialKeys } from "./credential-keys.mjs";
+import { notifySystemWith } from "./notify.mjs";
+import { captureMetrics, currentTraceparent } from "@storyshelf/observability";
+import { InMemoryCaptureQueue, createDispatchJob, recoverStuckCaptures } from "@storyshelf/core/capture";
+import { BuildModel } from "@storyshelf/core/models";
+//#region src/capture-setup.ts
+/** Enqueue a build, continuing the active request trace when present. */
+async function enqueueJob(queue, buildId, reqId) {
+	const traceparent = currentTraceparent();
+	await queue.enqueue({
+		buildId,
+		reqId,
+		...traceparent ? { traceparent } : {}
+	});
+}
+/** Wrap the dispatch job with duration + outcome metrics. */
+async function timedRunJob(runJob, job) {
+	const instruments = captureMetrics();
+	const start = performance.now();
+	try {
+		await runJob(job);
+	} catch (error) {
+		instruments.jobsFailed.add(1);
+		instruments.jobDuration.record(performance.now() - start);
+		throw error;
+	}
+	instruments.jobsCompleted.add(1);
+	instruments.jobDuration.record(performance.now() - start);
+}
+/** Alert admins when an in-process capture leaves its build failed. */
+async function notifyCaptureFailed(options, config, logger, buildId) {
+	const build = await new BuildModel(options.database).get(buildId);
+	if (build?.status !== "failed") return;
+	await notifySystemWith({
+		db: options.database,
+		config,
+		ui: options.ui ?? {},
+		logger,
+		notifiers: options.notifiers ?? []
+	}, "sys:capture-failed", {
+		buildId,
+		projectId: build.projectId,
+		gitBranch: build.gitBranch
+	});
+}
+/** Assemble the capture queue and its enqueue hook. */
+function setupCaptureQueue(options, config, gitHosts, logger) {
+	if (!options.captureQueue && !options.captureRunner) return {
+		queue: null,
+		enqueueCapture: void 0
+	};
+	if (options.captureQueue) {
+		const queue = options.captureQueue;
+		const enqueueCapture = async (buildId, reqId) => {
+			await enqueueJob(queue, buildId, reqId);
+		};
+		if (!options.captureRunner) return {
+			queue: options.captureQueue,
+			enqueueCapture
+		};
+		if (!config.scratchDir) return {
+			queue: options.captureQueue,
+			enqueueCapture
+		};
+		return {
+			queue: options.captureQueue,
+			enqueueCapture
+		};
+	}
+	if (!options.captureRunner) return {
+		queue: null,
+		enqueueCapture: void 0
+	};
+	if (!config.scratchDir) throw new Error("captureRunner is enabled but ShelfConfig.scratchDir is not set");
+	const jobOptions = {
+		db: options.database,
+		tables: {
+			projects: options.database.tables.projects,
+			builds: options.database.tables.builds,
+			buildLabels: options.database.tables.buildLabels,
+			snapshots: options.database.tables.snapshots,
+			baselines: options.database.tables.baselines,
+			captureAttempts: options.database.tables.captureAttempts,
+			captureLogs: options.database.tables.captureLogs
+		},
+		storage: options.storage,
+		runner: options.captureRunner,
+		scratchDir: config.scratchDir,
+		viewports: config.viewports,
+		logger,
+		secret: credentialKeys(config)
+	};
+	const dispatchDeps = {
+		db: options.database,
+		tables: {
+			projects: options.database.tables.projects,
+			builds: options.database.tables.builds,
+			buildLabels: options.database.tables.buildLabels,
+			snapshots: options.database.tables.snapshots,
+			projectStatusConfigs: options.database.tables.projectStatusConfigs,
+			captureAttempts: options.database.tables.captureAttempts,
+			captureLogs: options.database.tables.captureLogs
+		},
+		jobOptions,
+		gitHosts,
+		secret: credentialKeys(config),
+		logger
+	};
+	const runJob = createDispatchJob(dispatchDeps);
+	const captureQueue = options.captureQueue ?? new InMemoryCaptureQueue({
+		concurrency: config.captureConcurrency ?? 2,
+		logger,
+		runJob: async (job) => {
+			await timedRunJob(runJob, job);
+			await notifyCaptureFailed(options, config, logger, job.buildId);
+		}
+	});
+	const enqueueCapture = async (buildId, reqId) => {
+		await enqueueJob(captureQueue, buildId, reqId);
+	};
+	const recoverStuck = async () => await recoverStuckCaptures({
+		deps: dispatchDeps,
+		enqueue: async (buildId) => {
+			await enqueueCapture(buildId);
+		}
+	});
+	return {
+		queue: captureQueue,
+		enqueueCapture,
+		recoverStuck
+	};
+}
+//#endregion
+export { setupCaptureQueue };
+
+//# sourceMappingURL=capture-setup.mjs.map

package/dist/capture-setup.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture-setup.mjs","names":[],"sources":["../src/capture-setup.ts"],"sourcesContent":["import type { CaptureQueue } from \"@storyshelf/core/adapter/capture-queue\";\nimport type { GitHostProvider } from \"@storyshelf/core/adapter/git-host\";\nimport {\n  createDispatchJob,\n  InMemoryCaptureQueue,\n  recoverStuckCaptures,\n} from \"@storyshelf/core/capture\";\nimport type {\n  CaptureDispatchJob,\n  CaptureJobOptions,\n  DispatchDeps,\n  RecoveryResult,\n} from \"@storyshelf/core/capture\";\nimport type { ShelfConfig, ShelfOptions } from \"@storyshelf/core/config\";\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport { BuildModel } from \"@storyshelf/core/models\";\nimport { captureMetrics, currentTraceparent } from \"@storyshelf/observability\";\nimport { credentialKeys } from \"./credential-keys.ts\";\nimport { notifySystemWith } from \"./notify.ts\";\n\n/**\n * Wiring for the capture queue: the queue instance (if any) and a helper\n * to enqueue a build for rendering. When no `captureRunner` is configured\n * both are null/undefined and builds remain `pending` until a runner is added.\n */\nexport interface QueueWiring {\n  queue: CaptureQueue | null;\n  enqueueCapture: ((buildId: string, reqId?: string) => Promise<void>) | undefined;\n  /**\n   * Boot sweep for builds a restart left in `capturing` (requeue once, else fail).\n   * Only set for the in-process queue; remote queues redeliver on their own.\n   */\n  recoverStuck?: () => Promise<RecoveryResult>;\n}\n\n/** Enqueue a build, continuing the active request trace when present. */\nasync function enqueueJob(queue: CaptureQueue, buildId: string, reqId?: string): Promise<void> {\n  const traceparent = currentTraceparent();\n  await queue.enqueue({ buildId, reqId, ...(traceparent ? { traceparent } : {}) });\n}\n\n/** Wrap the dispatch job with duration + outcome metrics. */\nasync function timedRunJob(\n  runJob: (job: CaptureDispatchJob) => Promise<void>,\n  job: CaptureDispatchJob,\n): Promise<void> {\n  const instruments = captureMetrics();\n  const start = performance.now();\n  try {\n    await runJob(job);\n  } catch (error) {\n    instruments.jobsFailed.add(1);\n    instruments.jobDuration.record(performance.now() - start);\n    throw error;\n  }\n  instruments.jobsCompleted.add(1);\n  instruments.jobDuration.record(performance.now() - start);\n}\n\n/** Alert admins when an in-process capture leaves its build failed. */\nasync function notifyCaptureFailed(\n  options: ShelfOptions,\n  config: ShelfConfig,\n  logger: Logger,\n  buildId: string,\n): Promise<void> {\n  const build = await new BuildModel(options.database).get(buildId);\n  if (build?.status !== \"failed\") {\n    return;\n  }\n  await notifySystemWith(\n    {\n      db: options.database,\n      config,\n      ui: options.ui ?? {},\n      logger,\n      notifiers: options.notifiers ?? [],\n    },\n    \"sys:capture-failed\",\n    { buildId, projectId: build.projectId, gitBranch: build.gitBranch },\n  );\n}\n\n/** Assemble the capture queue and its enqueue hook. */\nexport function setupCaptureQueue(\n  options: ShelfOptions,\n  config: ShelfConfig,\n  gitHosts: GitHostProvider[],\n  logger: Logger,\n): QueueWiring {\n  if (!options.captureQueue && !options.captureRunner) {\n    return { queue: null, enqueueCapture: undefined };\n  }\n  if (options.captureQueue) {\n    const queue = options.captureQueue;\n    const enqueueCapture = async (buildId: string, reqId?: string): Promise<void> => {\n      await enqueueJob(queue, buildId, reqId);\n    };\n    if (!options.captureRunner) {\n      return { queue: options.captureQueue, enqueueCapture };\n    }\n    // Both queue and runner supplied: runner is ignored server-side for remote queues;\n    // enqueue goes to the supplied queue and capture is handled by an external worker.\n    if (!config.scratchDir) {\n      return { queue: options.captureQueue, enqueueCapture };\n    }\n    // If scratchDir is set with both, still prefer the supplied queue; no in-memory queue needed.\n    return { queue: options.captureQueue, enqueueCapture };\n  }\n  if (!options.captureRunner) {\n    return { queue: null, enqueueCapture: undefined };\n  }\n  if (!config.scratchDir) {\n    throw new Error(\"captureRunner is enabled but ShelfConfig.scratchDir is not set\");\n  }\n  const jobOptions: CaptureJobOptions = {\n    db: options.database,\n    tables: {\n      projects: options.database.tables.projects,\n      builds: options.database.tables.builds,\n      buildLabels: options.database.tables.buildLabels,\n      snapshots: options.database.tables.snapshots,\n      baselines: options.database.tables.baselines,\n      captureAttempts: options.database.tables.captureAttempts,\n      captureLogs: options.database.tables.captureLogs,\n    },\n    storage: options.storage,\n    runner: options.captureRunner,\n    scratchDir: config.scratchDir,\n    viewports: config.viewports,\n    logger,\n    secret: credentialKeys(config),\n  };\n  const dispatchDeps: DispatchDeps = {\n    db: options.database,\n    tables: {\n      projects: options.database.tables.projects,\n      builds: options.database.tables.builds,\n      buildLabels: options.database.tables.buildLabels,\n      snapshots: options.database.tables.snapshots,\n      projectStatusConfigs: options.database.tables.projectStatusConfigs,\n      captureAttempts: options.database.tables.captureAttempts,\n      captureLogs: options.database.tables.captureLogs,\n    },\n    jobOptions,\n    gitHosts,\n    secret: credentialKeys(config),\n    logger,\n  };\n  const runJob = createDispatchJob(dispatchDeps);\n  const captureQueue =\n    options.captureQueue ??\n    new InMemoryCaptureQueue({\n      concurrency: config.captureConcurrency ?? 2,\n      logger,\n      runJob: async (job: CaptureDispatchJob): Promise<void> => {\n        await timedRunJob(runJob, job);\n        // In-process completions only: remote-queue workers own their own\n        // alerting (the server never sees those outcomes).\n        await notifyCaptureFailed(options, config, logger, job.buildId);\n      },\n    });\n  const enqueueCapture = async (buildId: string, reqId?: string): Promise<void> => {\n    await enqueueJob(captureQueue, buildId, reqId);\n  };\n  const recoverStuck = async (): Promise<RecoveryResult> =>\n    await recoverStuckCaptures({\n      deps: dispatchDeps,\n      enqueue: async (buildId) => {\n        await enqueueCapture(buildId);\n      },\n    });\n  return { queue: captureQueue, enqueueCapture, recoverStuck };\n}\n"],"mappings":";;;;;;;;;;AAoCA,eAAe,WAAW,OAAqB,SAAiB,OAA+B;CAC7F,MAAM,cAAc,mBAAmB;CACvC,MAAM,MAAM,QAAQ;EAAE;EAAS;EAAO,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;CAAG,CAAC;AACjF;;AAGA,eAAe,YACb,QACA,KACe;CACf,MAAM,cAAc,eAAe;CACnC,MAAM,QAAQ,YAAY,IAAI;CAC9B,IAAI;EACF,MAAM,OAAO,GAAG;CAClB,SAAS,OAAO;EACd,YAAY,WAAW,IAAI,CAAC;EAC5B,YAAY,YAAY,OAAO,YAAY,IAAI,IAAI,KAAK;EACxD,MAAM;CACR;CACA,YAAY,cAAc,IAAI,CAAC;CAC/B,YAAY,YAAY,OAAO,YAAY,IAAI,IAAI,KAAK;AAC1D;;AAGA,eAAe,oBACb,SACA,QACA,QACA,SACe;CACf,MAAM,QAAQ,MAAM,IAAI,WAAW,QAAQ,QAAQ,CAAC,CAAC,IAAI,OAAO;CAChE,IAAI,OAAO,WAAW,UACpB;CAEF,MAAM,iBACJ;EACE,IAAI,QAAQ;EACZ;EACA,IAAI,QAAQ,MAAM,CAAC;EACnB;EACA,WAAW,QAAQ,aAAa,CAAC;CACnC,GACA,sBACA;EAAE;EAAS,WAAW,MAAM;EAAW,WAAW,MAAM;CAAU,CACpE;AACF;;AAGA,SAAgB,kBACd,SACA,QACA,UACA,QACa;CACb,IAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,eACpC,OAAO;EAAE,OAAO;EAAM,gBAAgB,KAAA;CAAU;CAElD,IAAI,QAAQ,cAAc;EACxB,MAAM,QAAQ,QAAQ;EACtB,MAAM,iBAAiB,OAAO,SAAiB,UAAkC;GAC/E,MAAM,WAAW,OAAO,SAAS,KAAK;EACxC;EACA,IAAI,CAAC,QAAQ,eACX,OAAO;GAAE,OAAO,QAAQ;GAAc;EAAe;EAIvD,IAAI,CAAC,OAAO,YACV,OAAO;GAAE,OAAO,QAAQ;GAAc;EAAe;EAGvD,OAAO;GAAE,OAAO,QAAQ;GAAc;EAAe;CACvD;CACA,IAAI,CAAC,QAAQ,eACX,OAAO;EAAE,OAAO;EAAM,gBAAgB,KAAA;CAAU;CAElD,IAAI,CAAC,OAAO,YACV,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,aAAgC;EACpC,IAAI,QAAQ;EACZ,QAAQ;GACN,UAAU,QAAQ,SAAS,OAAO;GAClC,QAAQ,QAAQ,SAAS,OAAO;GAChC,aAAa,QAAQ,SAAS,OAAO;GACrC,WAAW,QAAQ,SAAS,OAAO;GACnC,WAAW,QAAQ,SAAS,OAAO;GACnC,iBAAiB,QAAQ,SAAS,OAAO;GACzC,aAAa,QAAQ,SAAS,OAAO;EACvC;EACA,SAAS,QAAQ;EACjB,QAAQ,QAAQ;EAChB,YAAY,OAAO;EACnB,WAAW,OAAO;EAClB;EACA,QAAQ,eAAe,MAAM;CAC/B;CACA,MAAM,eAA6B;EACjC,IAAI,QAAQ;EACZ,QAAQ;GACN,UAAU,QAAQ,SAAS,OAAO;GAClC,QAAQ,QAAQ,SAAS,OAAO;GAChC,aAAa,QAAQ,SAAS,OAAO;GACrC,WAAW,QAAQ,SAAS,OAAO;GACnC,sBAAsB,QAAQ,SAAS,OAAO;GAC9C,iBAAiB,QAAQ,SAAS,OAAO;GACzC,aAAa,QAAQ,SAAS,OAAO;EACvC;EACA;EACA;EACA,QAAQ,eAAe,MAAM;EAC7B;CACF;CACA,MAAM,SAAS,kBAAkB,YAAY;CAC7C,MAAM,eACJ,QAAQ,gBACR,IAAI,qBAAqB;EACvB,aAAa,OAAO,sBAAsB;EAC1C;EACA,QAAQ,OAAO,QAA2C;GACxD,MAAM,YAAY,QAAQ,GAAG;GAG7B,MAAM,oBAAoB,SAAS,QAAQ,QAAQ,IAAI,OAAO;EAChE;CACF,CAAC;CACH,MAAM,iBAAiB,OAAO,SAAiB,UAAkC;EAC/E,MAAM,WAAW,cAAc,SAAS,KAAK;CAC/C;CACA,MAAM,eAAe,YACnB,MAAM,qBAAqB;EACzB,MAAM;EACN,SAAS,OAAO,YAAY;GAC1B,MAAM,eAAe,OAAO;EAC9B;CACF,CAAC;CACH,OAAO;EAAE,OAAO;EAAc;EAAgB;CAAa;AAC7D"}

package/dist/credential-keys.mjs

@@ -0,0 +1,20 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/credential-keys.ts
+/**
+* Key material for encrypted credentials: the current secret, plus
+* `previousSecret` as a decrypt-only fallback during a rotation. Not for
+* signing (CSRF, sessions), which only ever uses `config.secret`.
+*/
+function credentialKeys(config) {
+	if (config.secret && config.previousSecret) return {
+		current: config.secret,
+		previous: config.previousSecret
+	};
+	return config.secret;
+}
+//#endregion
+export { credentialKeys };
+
+//# sourceMappingURL=credential-keys.mjs.map

package/dist/credential-keys.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-keys.mjs","names":[],"sources":["../src/credential-keys.ts"],"sourcesContent":["import type { ShelfConfig } from \"@storyshelf/core/config\";\nimport type { SecretInput } from \"@storyshelf/core/utils\";\n\n/**\n * Key material for encrypted credentials: the current secret, plus\n * `previousSecret` as a decrypt-only fallback during a rotation. Not for\n * signing (CSRF, sessions), which only ever uses `config.secret`.\n */\nexport function credentialKeys(config: ShelfConfig): SecretInput {\n  if (config.secret && config.previousSecret) {\n    return { current: config.secret, previous: config.previousSecret };\n  }\n  return config.secret;\n}\n"],"mappings":";;;;;;;;;AAQA,SAAgB,eAAe,QAAkC;CAC/D,IAAI,OAAO,UAAU,OAAO,gBAC1B,OAAO;EAAE,SAAS,OAAO;EAAQ,UAAU,OAAO;CAAe;CAEnE,OAAO,OAAO;AAChB"}

package/dist/credentials.mjs

@@ -0,0 +1,56 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { probeCredentials, reencryptCredentials } from "@storyshelf/core/models";
+//#region src/credentials.ts
+/** Current/previous key pair for a probe, or null when no secret is configured. */
+function secretKeysOf(config) {
+	if (!config.secret) return null;
+	return config.previousSecret ? {
+		current: config.secret,
+		previous: config.previousSecret
+	} : { current: config.secret };
+}
+/** Probe stored credentials; null when no secret is configured. */
+async function loadCredentialProbe(db, config) {
+	const keys = secretKeysOf(config);
+	return keys ? await probeCredentials(db, keys) : null;
+}
+/** Re-encrypt rows under `previousSecret`; throws when no rotation is configured. */
+async function reencryptWithCurrent(db, config) {
+	const keys = secretKeysOf(config);
+	if (!keys?.previous) throw new Error("No previousSecret is configured; nothing to re-encrypt");
+	return await reencryptCredentials(db, keys);
+}
+/** Log what the probe found; returns whether rows still need re-encryption. */
+function logProbe(probe, config, logger) {
+	if (config.migrateCredentialsOnBoot && !config.previousSecret) logger.warn("migrateCredentialsOnBoot has no effect without previousSecret");
+	if (probe.unreadable.length > 0) logger.error({
+		count: probe.unreadable.length,
+		rows: probe.unreadable.slice(0, 20)
+	}, "stored credentials cannot be decrypted; check SECRET and SECRET_PREVIOUS");
+	if (probe.previous > 0 && !config.migrateCredentialsOnBoot) logger.warn({ count: probe.previous }, "credentials still encrypted with previousSecret; re-encrypt from the System page");
+	return probe.previous > 0;
+}
+/** Log the credential state at boot and, if opted in, migrate to the current key. */
+async function checkCredentialsAtBoot(db, config, logger) {
+	const probe = await loadCredentialProbe(db, config);
+	if (!probe || !logProbe(probe, config, logger) || !config.migrateCredentialsOnBoot) return;
+	const result = await reencryptWithCurrent(db, config);
+	logger.info({
+		reencrypted: result.reencrypted,
+		failed: result.failed
+	}, "re-encrypted credentials with the current secret");
+}
+/** Run {@link checkCredentialsAtBoot} once adapters are ready; never blocks or throws. */
+function checkCredentialsAfterSetup(cell, db, config, logger) {
+	cell.ready.then(async (setup) => {
+		if (setup.ok) await checkCredentialsAtBoot(db, config, logger);
+	}).catch((error) => {
+		logger.error({ err: error }, "credential check failed");
+	});
+}
+//#endregion
+export { checkCredentialsAfterSetup, checkCredentialsAtBoot, loadCredentialProbe, reencryptWithCurrent, secretKeysOf };
+
+//# sourceMappingURL=credentials.mjs.map

package/dist/credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.mjs","names":[],"sources":["../src/credentials.ts"],"sourcesContent":["/**\n * Runtime side of secret rotation: boot check/migration, the health probe, and\n * the re-encrypt action shared by the System page and the admin API.\n */\nimport type { DatabaseAdapter } from \"@storyshelf/core/adapter/database\";\nimport type { ShelfConfig } from \"@storyshelf/core/config\";\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport {\n  probeCredentials,\n  reencryptCredentials,\n  type CredentialProbe,\n  type ReencryptResult,\n} from \"@storyshelf/core/models\";\nimport type { SecretKeys } from \"@storyshelf/core/utils\";\nimport type { LifecycleCell } from \"./lifecycle.ts\";\n\n/** Current/previous key pair for a probe, or null when no secret is configured. */\nexport function secretKeysOf(config: ShelfConfig): SecretKeys | null {\n  if (!config.secret) {\n    return null;\n  }\n  return config.previousSecret\n    ? { current: config.secret, previous: config.previousSecret }\n    : { current: config.secret };\n}\n\n/** Probe stored credentials; null when no secret is configured. */\nexport async function loadCredentialProbe(\n  db: DatabaseAdapter,\n  config: ShelfConfig,\n): Promise<CredentialProbe | null> {\n  const keys = secretKeysOf(config);\n  return keys ? await probeCredentials(db, keys) : null;\n}\n\n/** Re-encrypt rows under `previousSecret`; throws when no rotation is configured. */\nexport async function reencryptWithCurrent(\n  db: DatabaseAdapter,\n  config: ShelfConfig,\n): Promise<ReencryptResult> {\n  const keys = secretKeysOf(config);\n  if (!keys?.previous) {\n    throw new Error(\"No previousSecret is configured; nothing to re-encrypt\");\n  }\n  return await reencryptCredentials(db, keys);\n}\n\n/** Log what the probe found; returns whether rows still need re-encryption. */\nfunction logProbe(probe: CredentialProbe, config: ShelfConfig, logger: Logger): boolean {\n  if (config.migrateCredentialsOnBoot && !config.previousSecret) {\n    logger.warn(\"migrateCredentialsOnBoot has no effect without previousSecret\");\n  }\n  if (probe.unreadable.length > 0) {\n    logger.error(\n      { count: probe.unreadable.length, rows: probe.unreadable.slice(0, 20) },\n      \"stored credentials cannot be decrypted; check SECRET and SECRET_PREVIOUS\",\n    );\n  }\n  if (probe.previous > 0 && !config.migrateCredentialsOnBoot) {\n    logger.warn(\n      { count: probe.previous },\n      \"credentials still encrypted with previousSecret; re-encrypt from the System page\",\n    );\n  }\n  return probe.previous > 0;\n}\n\n/** Log the credential state at boot and, if opted in, migrate to the current key. */\nexport async function checkCredentialsAtBoot(\n  db: DatabaseAdapter,\n  config: ShelfConfig,\n  logger: Logger,\n): Promise<void> {\n  const probe = await loadCredentialProbe(db, config);\n  if (!probe || !logProbe(probe, config, logger) || !config.migrateCredentialsOnBoot) {\n    return;\n  }\n  const result = await reencryptWithCurrent(db, config);\n  logger.info(\n    { reencrypted: result.reencrypted, failed: result.failed },\n    \"re-encrypted credentials with the current secret\",\n  );\n}\n\n/** Run {@link checkCredentialsAtBoot} once adapters are ready; never blocks or throws. */\nexport function checkCredentialsAfterSetup(\n  cell: LifecycleCell,\n  db: DatabaseAdapter,\n  config: ShelfConfig,\n  logger: Logger,\n): void {\n  cell.ready\n    .then(async (setup) => {\n      if (setup.ok) {\n        await checkCredentialsAtBoot(db, config, logger);\n      }\n    })\n    .catch((error: unknown) => {\n      logger.error({ err: error }, \"credential check failed\");\n    });\n}\n"],"mappings":";;;;;;AAiBA,SAAgB,aAAa,QAAwC;CACnE,IAAI,CAAC,OAAO,QACV,OAAO;CAET,OAAO,OAAO,iBACV;EAAE,SAAS,OAAO;EAAQ,UAAU,OAAO;CAAe,IAC1D,EAAE,SAAS,OAAO,OAAO;AAC/B;;AAGA,eAAsB,oBACpB,IACA,QACiC;CACjC,MAAM,OAAO,aAAa,MAAM;CAChC,OAAO,OAAO,MAAM,iBAAiB,IAAI,IAAI,IAAI;AACnD;;AAGA,eAAsB,qBACpB,IACA,QAC0B;CAC1B,MAAM,OAAO,aAAa,MAAM;CAChC,IAAI,CAAC,MAAM,UACT,MAAM,IAAI,MAAM,wDAAwD;CAE1E,OAAO,MAAM,qBAAqB,IAAI,IAAI;AAC5C;;AAGA,SAAS,SAAS,OAAwB,QAAqB,QAAyB;CACtF,IAAI,OAAO,4BAA4B,CAAC,OAAO,gBAC7C,OAAO,KAAK,+DAA+D;CAE7E,IAAI,MAAM,WAAW,SAAS,GAC5B,OAAO,MACL;EAAE,OAAO,MAAM,WAAW;EAAQ,MAAM,MAAM,WAAW,MAAM,GAAG,EAAE;CAAE,GACtE,0EACF;CAEF,IAAI,MAAM,WAAW,KAAK,CAAC,OAAO,0BAChC,OAAO,KACL,EAAE,OAAO,MAAM,SAAS,GACxB,kFACF;CAEF,OAAO,MAAM,WAAW;AAC1B;;AAGA,eAAsB,uBACpB,IACA,QACA,QACe;CACf,MAAM,QAAQ,MAAM,oBAAoB,IAAI,MAAM;CAClD,IAAI,CAAC,SAAS,CAAC,SAAS,OAAO,QAAQ,MAAM,KAAK,CAAC,OAAO,0BACxD;CAEF,MAAM,SAAS,MAAM,qBAAqB,IAAI,MAAM;CACpD,OAAO,KACL;EAAE,aAAa,OAAO;EAAa,QAAQ,OAAO;CAAO,GACzD,kDACF;AACF;;AAGA,SAAgB,2BACd,MACA,IACA,QACA,QACM;CACN,KAAK,MACF,KAAK,OAAO,UAAU;EACrB,IAAI,MAAM,IACR,MAAM,uBAAuB,IAAI,QAAQ,MAAM;CAEnD,CAAC,CAAC,CACD,OAAO,UAAmB;EACzB,OAAO,MAAM,EAAE,KAAK,MAAM,GAAG,yBAAyB;CACxD,CAAC;AACL"}

package/dist/index.d.mts

@@ -0,0 +1,18 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { ShelfApp, ShelfContext, ShelfLifecycle, ShelfRouter } from "./app-types.mjs";
+import { createAuthSystemHook } from "./notify.mjs";
+import { BrandTheme, NotificationsConfig, ShelfConfig, ShelfOptions, ShelfOptions as ShelfOptions$1, UIConfig } from "@storyshelf/core/config";
+import { Logger, LoggerOptions, PinoTransport, createShelfLogger } from "@storyshelf/core/logger";
+//#region src/index.d.ts
+/**
+ * Create the StoryShelf Hono app with all API routes and HTML pages.
+ *
+ * Adapter `init` hooks kick off eagerly in the background (the constructor
+ * stays synchronous). Await `app.lifecycle.setup()` before serving for
+ * fail-fast startup, or let the first request gate on settlement.
+ */
+declare function createShelfApp(options: ShelfOptions$1): ShelfApp;
+//#endregion
+export { type BrandTheme, type Logger, type LoggerOptions, type NotificationsConfig, type PinoTransport, type ShelfApp, type ShelfConfig, type ShelfContext, type ShelfLifecycle, type ShelfOptions, type ShelfRouter, type UIConfig, createAuthSystemHook, createShelfApp, createShelfLogger };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -0,0 +1,310 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createAuthSystemHook } from "./notify.mjs";
+import { setupCaptureQueue } from "./capture-setup.mjs";
+import { checkCredentialsAfterSetup } from "./credentials.mjs";
+import { attachLifecycle } from "./lifecycle.mjs";
+import { rateLimit, rateLimitKey } from "./middleware/rate-limit.mjs";
+import { csrf } from "./middleware/csrf.mjs";
+import { requestLogging } from "./middleware/request-log.mjs";
+import { storeScope } from "./middleware/store-scope.mjs";
+import { authGate, resolveRequestUser } from "./middleware/auth-gate.mjs";
+import { serverTiming } from "./middleware/server-timing.mjs";
+import { setupGate } from "./middleware/setup-gate.mjs";
+import { registerAdminPages } from "./routers/admin-pages.mjs";
+import { registerAdmin } from "./routers/admin.mjs";
+import { registerAssets } from "./routers/assets.mjs";
+import { registerEngineAuth } from "./routers/auth.mjs";
+import { registerBuilds } from "./routers/builds.mjs";
+import { registerHealth } from "./routers/health.mjs";
+import { registerLabels } from "./routers/labels.mjs";
+import { registerMedia } from "./routers/media.mjs";
+import { registerMembers } from "./routers/members.mjs";
+import { registerNotificationChannels, registerSystemChannels } from "./routers/notification-channels.mjs";
+import { registerNotificationSubscriptions } from "./routers/notification-subscriptions.mjs";
+import { registerProfile } from "./routers/profile.mjs";
+import { registerProjects } from "./routers/projects.mjs";
+import { registerStatusConfigs } from "./routers/status-configs.mjs";
+import { registerStorybook } from "./routers/storybook.mjs";
+import { registerTokens } from "./routers/tokens.mjs";
+import { registerUiPages } from "./routers/ui.mjs";
+import { registerWebhooks } from "./routers/webhooks.mjs";
+import { registerWellKnown } from "./routers/well-known.mjs";
+import { resolveRuntime } from "./runtime.mjs";
+import { swaggerUI } from "@hono/swagger-ui";
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { AdapterLifecycleError, validateBootAssembly } from "@storyshelf/core/adapter/setup";
+import { createHttpMiddleware, createInstrumentedDatabase, createInstrumentedStorage } from "@storyshelf/observability";
+import { requestId } from "hono/request-id";
+import { createShelfLogger } from "@storyshelf/core/logger";
+//#region src/index.tsx
+/**
+* Fail fast on third-party adapters that cannot satisfy their slot.
+* Throws before any route or lifecycle hook runs.
+*/
+function throwOnInvalidAdapters(options) {
+	const invalid = validateBootAssembly(options);
+	if (invalid.length > 0) throw new AdapterLifecycleError("setup", invalid);
+}
+/** Request/capture-path adapters with OTEL wrappers (lifecycle keeps raw ones). */
+function instrumentedOptions(options) {
+	return {
+		...options,
+		database: createInstrumentedDatabase(options.database),
+		storage: createInstrumentedStorage(options.storage)
+	};
+}
+/** Once adapters are ready, requeue-once or fail builds a restart left `capturing`. */
+function recoverAfterSetup(cell, recoverStuck, logger) {
+	if (!recoverStuck) return;
+	cell.ready.then(async (setup) => {
+		if (setup.ok) await recoverStuck();
+	}).catch((error) => {
+		logger.error({ err: error }, "stuck capture recovery failed");
+	});
+}
+/** Boot-time checks that run once adapters are ready: stuck-capture recovery and credential state. */
+function runAfterSetup(cell, scoped, runtime, recoverStuck) {
+	recoverAfterSetup(cell, recoverStuck, runtime.logger);
+	checkCredentialsAfterSetup(cell, scoped.database, runtime.config, runtime.logger);
+}
+/** Attach lifecycle, queue, middleware, routes, and docs to the app. */
+function assembleApp(app, options, scoped) {
+	const runtime = resolveRuntime(options);
+	const cell = {
+		ready: Promise.resolve({
+			ok: true,
+			failures: []
+		}),
+		settled: null
+	};
+	attachLifecycle(app, options, runtime, cell);
+	if (runtime.config.serverTiming === true) app.use("*", serverTiming(true));
+	const { queue, enqueueCapture, recoverStuck } = setupCaptureQueue(scoped, runtime.config, runtime.gitHosts, runtime.logger);
+	runAfterSetup(cell, scoped, runtime, recoverStuck);
+	wireMiddleware(app, {
+		...runtime,
+		queue,
+		enqueueCapture,
+		options: scoped,
+		getReady: async () => await cell.ready
+	});
+	registerAllRoutes(app, options, {
+		sources: options,
+		getSettled: () => cell.settled,
+		bootTimeMs: Date.now(),
+		version: packageVersion()
+	});
+	registerDocs(app);
+}
+/**
+* Create the StoryShelf Hono app with all API routes and HTML pages.
+*
+* Adapter `init` hooks kick off eagerly in the background (the constructor
+* stays synchronous). Await `app.lifecycle.setup()` before serving for
+* fail-fast startup, or let the first request gate on settlement.
+*/
+function createShelfApp(options) {
+	throwOnInvalidAdapters(options);
+	const app = new OpenAPIHono();
+	assembleApp(app, options, instrumentedOptions(options));
+	return app;
+}
+/** Cookie-authenticated write paths guarded by CSRF tokens. */
+const CSRF_PATHS = [
+	"/auth/logout",
+	"/auth/invites/*",
+	"/projects/:slug/settings/*",
+	"/profile/*",
+	"/profile",
+	"/admin/credentials/*"
+];
+/** Attach global middleware: ids, logging, init gate, limits, store scope, auth gate. */
+function wireMiddleware(app, wiring) {
+	const { config, logger, getReady } = wiring;
+	app.use("*", requestId());
+	app.use("*", createHttpMiddleware({
+		serviceName: "storyshelf",
+		serviceVersion: packageVersion()
+	}));
+	app.use("*", requestLogging(logger));
+	app.use("*", setupGate(getReady));
+	mountGuards(app, config);
+	mountNotificationLimits(app);
+	mountStoreScope(app, wiring);
+	app.use("*", authGate());
+}
+/** Mount rate limits and CSRF guards (abuse floors, not strict protection). */
+function mountGuards(app, config) {
+	app.use("/api/v1/*", rateLimit({
+		windowMs: 6e4,
+		max: 100
+	}));
+	app.use("/api/v1/tokens/*", rateLimit({
+		windowMs: 6e4,
+		max: 10
+	}));
+	app.use("/api/v1/webhooks/*", rateLimit({
+		windowMs: 6e4,
+		max: 20
+	}));
+	app.use("/auth/*", rateLimit({
+		windowMs: 6e4,
+		max: 100,
+		keyGenerator: rateLimitKey("auth")
+	}));
+	app.use("/api/auth/*", rateLimit({
+		windowMs: 6e4,
+		max: 300,
+		keyGenerator: rateLimitKey("engine")
+	}));
+	for (const path of CSRF_PATHS) app.use(path, csrf(config.secret));
+}
+/** Abuse floors for notification management endpoints (own counters). */
+function mountNotificationLimits(app) {
+	const channel = {
+		windowMs: 6e4,
+		max: 20,
+		keyGenerator: rateLimitKey("notify-channels")
+	};
+	const admin = {
+		windowMs: 6e4,
+		max: 20,
+		keyGenerator: rateLimitKey("notify-admin")
+	};
+	const subscription = {
+		windowMs: 6e4,
+		max: 30,
+		keyGenerator: rateLimitKey("notify-subs")
+	};
+	app.use("/api/v1/projects/:slug/notification-channels", rateLimit(channel));
+	app.use("/api/v1/projects/:slug/notification-channels/:channelId", rateLimit(channel));
+	app.use("/api/v1/projects/:slug/notifications", rateLimit(subscription));
+	app.use("/api/v1/projects/:slug/notifications/me", rateLimit(subscription));
+	app.use("/api/v1/admin/notification-channels", rateLimit(admin));
+	app.use("/api/v1/admin/notification-channels/:channelId", rateLimit(admin));
+}
+/** Mount the request-scoped store (db/storage/config/user/adapters). */
+function mountStoreScope(app, wiring) {
+	const { options, config, ui, logger, authEnabled, enqueueCapture, queue, gitHosts, notifiers } = wiring;
+	app.use("*", storeScope({
+		db: options.database,
+		storage: options.storage,
+		config,
+		ui,
+		logger,
+		authEnabled,
+		enqueueCapture,
+		captureQueue: queue,
+		gitHosts,
+		notifiers,
+		resolveUser: async (c) => await resolveRequestUser(c, options.auth)
+	}));
+}
+/** Register every JSON API router. */
+function registerApiRoutes(app, health) {
+	registerProjectRoutes(app);
+	registerNotificationRoutes(app);
+	registerStatusConfigs(app);
+	registerHealth(app, health);
+	registerAdmin(app);
+}
+/** Register the per-project resource routers. */
+function registerProjectRoutes(app) {
+	registerProjects(app);
+	registerBuilds(app);
+	registerLabels(app);
+	registerMedia(app);
+	registerMembers(app);
+	registerTokens(app);
+	registerWebhooks(app);
+}
+/** Register the notification channel and subscription routers. */
+function registerNotificationRoutes(app) {
+	registerNotificationChannels(app);
+	registerNotificationSubscriptions(app);
+	registerSystemChannels(app);
+}
+/** Register the auth flow: engine mount, relying-party documents, profile. */
+function registerAuthFlow(app, options) {
+	if (!options.auth) return;
+	registerEngineAuth(app, options.auth);
+	registerWellKnown(app, options.auth);
+	registerProfile(app, options.auth);
+}
+/** Register HTML pages, assets, and the optional auth flow. */
+function registerPageRoutes(app, options, health) {
+	registerAuthFlow(app, options);
+	registerAssets(app);
+	registerStorybook(app);
+	registerAdminPages(app, health, options.auth);
+	registerUiPages(app);
+}
+/** Register every API router, page set, and optional auth flow. */
+function registerAllRoutes(app, options, health) {
+	registerApiRoutes(app, health);
+	registerPageRoutes(app, options, health);
+}
+/** Register the OpenAPI document and interactive docs page. */
+function registerDocs(app) {
+	app.doc("/api/v1/openapi.json", {
+		openapi: "3.0.0",
+		info: {
+			title: "StoryShelf API",
+			description: "REST API for the StoryShelf visual testing platform. JSON endpoints live under /api/v1; HTML pages are served at /.",
+			version: "1.0.0"
+		},
+		tags: [
+			{
+				name: "Projects",
+				description: "Create and manage projects (one project is one Storybook)."
+			},
+			{
+				name: "Builds",
+				description: "Upload Storybook builds, inspect capture attempts, retry, and delete."
+			},
+			{
+				name: "Review",
+				description: "Approve or reject snapshots, bulk actions, re-diff, and review comments."
+			},
+			{
+				name: "Labels",
+				description: "Typed build labels and their link templates."
+			},
+			{
+				name: "Members",
+				description: "Project members, roles, and identity-provider group mappings."
+			},
+			{
+				name: "Tokens",
+				description: "API tokens used by the CLI and CI."
+			},
+			{
+				name: "Webhooks",
+				description: "Signed webhook deliveries for build events."
+			},
+			{
+				name: "Notifications",
+				description: "Email and chat notification channels and subscriptions."
+			},
+			{
+				name: "Git status",
+				description: "Commit-status integrations for GitHub and GitLab."
+			},
+			{
+				name: "Admin",
+				description: "Site-wide administration."
+			}
+		]
+	});
+	app.get("/api/v1/docs", swaggerUI({ url: "/api/v1/openapi.json" }));
+}
+/** Package version injected at build via __PKG_VERSION__. */
+function packageVersion() {
+	return globalThis.__PKG_VERSION__ ?? "0.0.0";
+}
+//#endregion
+export { createAuthSystemHook, createShelfApp, createShelfLogger };
+
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.tsx"],"sourcesContent":["import { swaggerUI } from \"@hono/swagger-ui\";\nimport { OpenAPIHono } from \"@hono/zod-openapi\";\nimport { AdapterLifecycleError, validateBootAssembly } from \"@storyshelf/core/adapter/setup\";\nimport type { ShelfConfig, ShelfOptions } from \"@storyshelf/core/config\";\n/**\n * StoryShelf app: compose database, storage, capture, auth, and git-host\n * adapters into a complete self-hosted visual-testing Hono app.\n */\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport {\n  createHttpMiddleware,\n  createInstrumentedDatabase,\n  createInstrumentedStorage,\n} from \"@storyshelf/observability\";\nimport { requestId } from \"hono/request-id\";\nimport type { ShelfApp, ShelfContext, ShelfRouter } from \"./app-types.ts\";\nimport { setupCaptureQueue } from \"./capture-setup.ts\";\nimport { checkCredentialsAfterSetup } from \"./credentials.ts\";\nimport { attachLifecycle, type LifecycleCell } from \"./lifecycle.ts\";\nimport {\n  authGate,\n  csrf,\n  rateLimit,\n  rateLimitKey,\n  requestLogging,\n  resolveRequestUser,\n  storeScope,\n} from \"./middleware/index.ts\";\nimport { serverTiming } from \"./middleware/server-timing.ts\";\nimport { setupGate, type MiddlewareWiring } from \"./middleware/setup-gate.ts\";\nimport { registerAdminPages } from \"./routers/admin-pages.ts\";\nimport { registerAdmin } from \"./routers/admin.ts\";\nimport { registerAssets } from \"./routers/assets.ts\";\nimport { registerEngineAuth } from \"./routers/auth.ts\";\nimport { registerBuilds } from \"./routers/builds.ts\";\nimport { registerHealth, type HealthDeps } from \"./routers/health.ts\";\nimport { registerLabels } from \"./routers/labels.ts\";\nimport { registerMedia } from \"./routers/media.ts\";\nimport { registerMembers } from \"./routers/members.ts\";\nimport {\n  registerNotificationChannels,\n  registerSystemChannels,\n} from \"./routers/notification-channels.ts\";\nimport { registerNotificationSubscriptions } from \"./routers/notification-subscriptions.ts\";\nimport { registerProfile } from \"./routers/profile.ts\";\nimport { registerProjects } from \"./routers/projects.ts\";\nimport { registerStatusConfigs } from \"./routers/status-configs.ts\";\nimport { registerStorybook } from \"./routers/storybook.ts\";\nimport { registerTokens } from \"./routers/tokens.ts\";\nimport { registerUiPages } from \"./routers/ui.ts\";\nimport { registerWebhooks } from \"./routers/webhooks.ts\";\nimport { registerWellKnown } from \"./routers/well-known.ts\";\nimport { resolveRuntime } from \"./runtime.ts\";\n\n/**\n * Fail fast on third-party adapters that cannot satisfy their slot.\n * Throws before any route or lifecycle hook runs.\n */\nfunction throwOnInvalidAdapters(options: ShelfOptions): void {\n  const invalid = validateBootAssembly(options);\n  if (invalid.length > 0) {\n    throw new AdapterLifecycleError(\"setup\", invalid);\n  }\n}\n\n/** Request/capture-path adapters with OTEL wrappers (lifecycle keeps raw ones). */\nfunction instrumentedOptions(options: ShelfOptions): ShelfOptions {\n  return {\n    ...options,\n    database: createInstrumentedDatabase(options.database),\n    storage: createInstrumentedStorage(options.storage),\n  };\n}\n\n/** Once adapters are ready, requeue-once or fail builds a restart left `capturing`. */\nfunction recoverAfterSetup(\n  cell: LifecycleCell,\n  recoverStuck: (() => Promise<unknown>) | undefined,\n  logger: Logger,\n): void {\n  if (!recoverStuck) {\n    return;\n  }\n  cell.ready\n    .then(async (setup) => {\n      if (setup.ok) {\n        await recoverStuck();\n      }\n    })\n    .catch((error: unknown) => {\n      logger.error({ err: error }, \"stuck capture recovery failed\");\n    });\n}\n\n/** Boot-time checks that run once adapters are ready: stuck-capture recovery and credential state. */\nfunction runAfterSetup(\n  cell: LifecycleCell,\n  scoped: ShelfOptions,\n  runtime: ReturnType<typeof resolveRuntime>,\n  recoverStuck: (() => Promise<unknown>) | undefined,\n): void {\n  recoverAfterSetup(cell, recoverStuck, runtime.logger);\n  checkCredentialsAfterSetup(cell, scoped.database, runtime.config, runtime.logger);\n}\n\n/** Attach lifecycle, queue, middleware, routes, and docs to the app. */\nfunction assembleApp(app: ShelfApp, options: ShelfOptions, scoped: ShelfOptions): void {\n  const runtime = resolveRuntime(options);\n  const cell: LifecycleCell = { ready: Promise.resolve({ ok: true, failures: [] }), settled: null };\n  attachLifecycle(app, options, runtime, cell);\n  if (runtime.config.serverTiming === true) {\n    app.use(\"*\", serverTiming(true));\n  }\n  const { queue, enqueueCapture, recoverStuck } = setupCaptureQueue(\n    scoped,\n    runtime.config,\n    runtime.gitHosts,\n    runtime.logger,\n  );\n  runAfterSetup(cell, scoped, runtime, recoverStuck);\n  wireMiddleware(app, {\n    ...runtime,\n    queue,\n    enqueueCapture,\n    options: scoped,\n    getReady: async () => await cell.ready,\n  });\n  registerAllRoutes(app, options, {\n    sources: options,\n    getSettled: () => cell.settled,\n    bootTimeMs: Date.now(),\n    version: packageVersion(),\n  });\n  registerDocs(app);\n}\n\n/**\n * Create the StoryShelf Hono app with all API routes and HTML pages.\n *\n * Adapter `init` hooks kick off eagerly in the background (the constructor\n * stays synchronous). Await `app.lifecycle.setup()` before serving for\n * fail-fast startup, or let the first request gate on settlement.\n */\nexport function createShelfApp(options: ShelfOptions): ShelfApp {\n  throwOnInvalidAdapters(options);\n  const app = new OpenAPIHono<{ Variables: ShelfContext }>() as ShelfApp;\n  assembleApp(app, options, instrumentedOptions(options));\n\n  return app;\n}\n\n/** Cookie-authenticated write paths guarded by CSRF tokens. */\nconst CSRF_PATHS = [\n  \"/auth/logout\",\n  \"/auth/invites/*\",\n  \"/projects/:slug/settings/*\",\n  \"/profile/*\",\n  \"/profile\",\n  \"/admin/credentials/*\",\n] as const;\n\n/** Attach global middleware: ids, logging, init gate, limits, store scope, auth gate. */\nfunction wireMiddleware(app: ShelfRouter, wiring: MiddlewareWiring): void {\n  const { config, logger, getReady } = wiring;\n  app.use(\"*\", requestId());\n  // OTEL server spans (W3C extraction, route-template naming). Mounted right\n  // after requestId so `storyshelf.req_id` resolves; `enduser.id` resolves\n  // once storeScope runs downstream. Noop without an SDK.\n  app.use(\n    \"*\",\n    createHttpMiddleware({ serviceName: \"storyshelf\", serviceVersion: packageVersion() }),\n  );\n  // Structured request logging. Uses a Hono-native middleware rather than\n  // Pino-http, which expects a Node server response (`res.on`) incompatible\n  // With Hono's Web `Request`/`Response` model.\n  app.use(\"*\", requestLogging(logger));\n  app.use(\"*\", setupGate(getReady));\n  mountGuards(app, config);\n  mountNotificationLimits(app);\n  mountStoreScope(app, wiring);\n  app.use(\"*\", authGate());\n}\n\n/** Mount rate limits and CSRF guards (abuse floors, not strict protection). */\nfunction mountGuards(app: ShelfRouter, config: ShelfConfig): void {\n  app.use(\"/api/v1/*\", rateLimit({ windowMs: 60_000, max: 100 }));\n  app.use(\"/api/v1/tokens/*\", rateLimit({ windowMs: 60_000, max: 10 }));\n  app.use(\"/api/v1/webhooks/*\", rateLimit({ windowMs: 60_000, max: 20 }));\n  // Auth endpoints ride their own buckets (the shared store keys by IP, so\n  // prefix the key: login floods must not eat the API budget or vice versa).\n  app.use(\"/auth/*\", rateLimit({ windowMs: 60_000, max: 100, keyGenerator: rateLimitKey(\"auth\") }));\n  app.use(\n    \"/api/auth/*\",\n    rateLimit({ windowMs: 60_000, max: 300, keyGenerator: rateLimitKey(\"engine\") }),\n  );\n  for (const path of CSRF_PATHS) {\n    app.use(path, csrf(config.secret));\n  }\n}\n\n/** Abuse floors for notification management endpoints (own counters). */\nfunction mountNotificationLimits(app: ShelfRouter): void {\n  const channel = { windowMs: 60_000, max: 20, keyGenerator: rateLimitKey(\"notify-channels\") };\n  const admin = { windowMs: 60_000, max: 20, keyGenerator: rateLimitKey(\"notify-admin\") };\n  const subscription = { windowMs: 60_000, max: 30, keyGenerator: rateLimitKey(\"notify-subs\") };\n  app.use(\"/api/v1/projects/:slug/notification-channels\", rateLimit(channel));\n  app.use(\"/api/v1/projects/:slug/notification-channels/:channelId\", rateLimit(channel));\n  app.use(\"/api/v1/projects/:slug/notifications\", rateLimit(subscription));\n  app.use(\"/api/v1/projects/:slug/notifications/me\", rateLimit(subscription));\n  app.use(\"/api/v1/admin/notification-channels\", rateLimit(admin));\n  app.use(\"/api/v1/admin/notification-channels/:channelId\", rateLimit(admin));\n}\n\n/** Mount the request-scoped store (db/storage/config/user/adapters). */\nfunction mountStoreScope(app: ShelfRouter, wiring: MiddlewareWiring): void {\n  const { options, config, ui, logger, authEnabled, enqueueCapture, queue, gitHosts, notifiers } =\n    wiring;\n  app.use(\n    \"*\",\n    storeScope({\n      db: options.database,\n      storage: options.storage,\n      config,\n      ui,\n      logger,\n      authEnabled,\n      enqueueCapture,\n      captureQueue: queue,\n      gitHosts,\n      notifiers,\n      resolveUser: async (c) => await resolveRequestUser(c, options.auth),\n    }),\n  );\n}\n\n/** Register every JSON API router. */\nfunction registerApiRoutes(app: ShelfRouter, health: HealthDeps): void {\n  registerProjectRoutes(app);\n  registerNotificationRoutes(app);\n  registerStatusConfigs(app);\n  registerHealth(app, health);\n  registerAdmin(app);\n}\n\n/** Register the per-project resource routers. */\nfunction registerProjectRoutes(app: ShelfRouter): void {\n  registerProjects(app);\n  registerBuilds(app);\n  registerLabels(app);\n  registerMedia(app);\n  registerMembers(app);\n  registerTokens(app);\n  registerWebhooks(app);\n}\n\n/** Register the notification channel and subscription routers. */\nfunction registerNotificationRoutes(app: ShelfRouter): void {\n  registerNotificationChannels(app);\n  registerNotificationSubscriptions(app);\n  registerSystemChannels(app);\n}\n\n/** Register the auth flow: engine mount, relying-party documents, profile. */\nfunction registerAuthFlow(app: ShelfRouter, options: ShelfOptions): void {\n  // Auth-gated pages mount only with auth: authEnabled=false mounts zero\n  // auth routes. Static imports stay — true lazy loading would need an async\n  // createShelfApp, which the sync Hono assembly cannot do.\n  if (!options.auth) {\n    return;\n  }\n  registerEngineAuth(app, options.auth);\n  registerWellKnown(app, options.auth);\n  registerProfile(app, options.auth);\n}\n\n/** Register HTML pages, assets, and the optional auth flow. */\nfunction registerPageRoutes(app: ShelfRouter, options: ShelfOptions, health: HealthDeps): void {\n  registerAuthFlow(app, options);\n  registerAssets(app);\n  registerStorybook(app);\n  registerAdminPages(app, health, options.auth);\n  registerUiPages(app);\n}\n\n/** Register every API router, page set, and optional auth flow. */\nfunction registerAllRoutes(app: ShelfRouter, options: ShelfOptions, health: HealthDeps): void {\n  registerApiRoutes(app, health);\n  registerPageRoutes(app, options, health);\n}\n\n/** Register the OpenAPI document and interactive docs page. */\nfunction registerDocs(app: ShelfRouter): void {\n  app.doc(\"/api/v1/openapi.json\", {\n    openapi: \"3.0.0\",\n    info: {\n      title: \"StoryShelf API\",\n      description:\n        \"REST API for the StoryShelf visual testing platform. JSON endpoints live under /api/v1; HTML pages are served at /.\",\n      version: \"1.0.0\",\n    },\n    tags: [\n      {\n        name: \"Projects\",\n        description: \"Create and manage projects (one project is one Storybook).\",\n      },\n      {\n        name: \"Builds\",\n        description: \"Upload Storybook builds, inspect capture attempts, retry, and delete.\",\n      },\n      {\n        name: \"Review\",\n        description: \"Approve or reject snapshots, bulk actions, re-diff, and review comments.\",\n      },\n      { name: \"Labels\", description: \"Typed build labels and their link templates.\" },\n      {\n        name: \"Members\",\n        description: \"Project members, roles, and identity-provider group mappings.\",\n      },\n      { name: \"Tokens\", description: \"API tokens used by the CLI and CI.\" },\n      { name: \"Webhooks\", description: \"Signed webhook deliveries for build events.\" },\n      {\n        name: \"Notifications\",\n        description: \"Email and chat notification channels and subscriptions.\",\n      },\n      { name: \"Git status\", description: \"Commit-status integrations for GitHub and GitLab.\" },\n      { name: \"Admin\", description: \"Site-wide administration.\" },\n    ],\n  });\n  app.get(\"/api/v1/docs\", swaggerUI({ url: \"/api/v1/openapi.json\" }));\n}\n\n/** Package version injected at build via __PKG_VERSION__. */\nfunction packageVersion(): string {\n  return (globalThis as unknown as { __PKG_VERSION__?: string }).__PKG_VERSION__ ?? \"0.0.0\";\n}\n\n/**\n * Public surface: the app and its types only.\n *\n * `createShelfApp` plus the option/config types needed to call it. Adapter\n * interfaces live under `core/adapter/*`; runtime helpers under `core/logger`,\n * `core/capture`, `core/paths`, `core/urls`, `core/diff`; tables and row types\n * under `core/schema`. Importing the barrel must never pull Node-only modules\n * into edge bundles beyond what Hono itself needs.\n */\nexport { createAuthSystemHook } from \"./notify.ts\";\nexport type {\n  ShelfOptions,\n  ShelfConfig,\n  UIConfig,\n  BrandTheme,\n  NotificationsConfig,\n} from \"@storyshelf/core/config\";\nexport {\n  createShelfLogger,\n  type Logger,\n  type LoggerOptions,\n  type PinoTransport,\n} from \"@storyshelf/core/logger\";\nexport type { ShelfApp, ShelfContext, ShelfLifecycle, ShelfRouter } from \"./app-types.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,SAAS,uBAAuB,SAA6B;CAC3D,MAAM,UAAU,qBAAqB,OAAO;CAC5C,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,sBAAsB,SAAS,OAAO;AAEpD;;AAGA,SAAS,oBAAoB,SAAqC;CAChE,OAAO;EACL,GAAG;EACH,UAAU,2BAA2B,QAAQ,QAAQ;EACrD,SAAS,0BAA0B,QAAQ,OAAO;CACpD;AACF;;AAGA,SAAS,kBACP,MACA,cACA,QACM;CACN,IAAI,CAAC,cACH;CAEF,KAAK,MACF,KAAK,OAAO,UAAU;EACrB,IAAI,MAAM,IACR,MAAM,aAAa;CAEvB,CAAC,CAAC,CACD,OAAO,UAAmB;EACzB,OAAO,MAAM,EAAE,KAAK,MAAM,GAAG,+BAA+B;CAC9D,CAAC;AACL;;AAGA,SAAS,cACP,MACA,QACA,SACA,cACM;CACN,kBAAkB,MAAM,cAAc,QAAQ,MAAM;CACpD,2BAA2B,MAAM,OAAO,UAAU,QAAQ,QAAQ,QAAQ,MAAM;AAClF;;AAGA,SAAS,YAAY,KAAe,SAAuB,QAA4B;CACrF,MAAM,UAAU,eAAe,OAAO;CACtC,MAAM,OAAsB;EAAE,OAAO,QAAQ,QAAQ;GAAE,IAAI;GAAM,UAAU,CAAC;EAAE,CAAC;EAAG,SAAS;CAAK;CAChG,gBAAgB,KAAK,SAAS,SAAS,IAAI;CAC3C,IAAI,QAAQ,OAAO,iBAAiB,MAClC,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC;CAEjC,MAAM,EAAE,OAAO,gBAAgB,iBAAiB,kBAC9C,QACA,QAAQ,QACR,QAAQ,UACR,QAAQ,MACV;CACA,cAAc,MAAM,QAAQ,SAAS,YAAY;CACjD,eAAe,KAAK;EAClB,GAAG;EACH;EACA;EACA,SAAS;EACT,UAAU,YAAY,MAAM,KAAK;CACnC,CAAC;CACD,kBAAkB,KAAK,SAAS;EAC9B,SAAS;EACT,kBAAkB,KAAK;EACvB,YAAY,KAAK,IAAI;EACrB,SAAS,eAAe;CAC1B,CAAC;CACD,aAAa,GAAG;AAClB;;;;;;;;AASA,SAAgB,eAAe,SAAiC;CAC9D,uBAAuB,OAAO;CAC9B,MAAM,MAAM,IAAI,YAAyC;CACzD,YAAY,KAAK,SAAS,oBAAoB,OAAO,CAAC;CAEtD,OAAO;AACT;;AAGA,MAAM,aAAa;CACjB;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,SAAS,eAAe,KAAkB,QAAgC;CACxE,MAAM,EAAE,QAAQ,QAAQ,aAAa;CACrC,IAAI,IAAI,KAAK,UAAU,CAAC;CAIxB,IAAI,IACF,KACA,qBAAqB;EAAE,aAAa;EAAc,gBAAgB,eAAe;CAAE,CAAC,CACtF;CAIA,IAAI,IAAI,KAAK,eAAe,MAAM,CAAC;CACnC,IAAI,IAAI,KAAK,UAAU,QAAQ,CAAC;CAChC,YAAY,KAAK,MAAM;CACvB,wBAAwB,GAAG;CAC3B,gBAAgB,KAAK,MAAM;CAC3B,IAAI,IAAI,KAAK,SAAS,CAAC;AACzB;;AAGA,SAAS,YAAY,KAAkB,QAA2B;CAChE,IAAI,IAAI,aAAa,UAAU;EAAE,UAAU;EAAQ,KAAK;CAAI,CAAC,CAAC;CAC9D,IAAI,IAAI,oBAAoB,UAAU;EAAE,UAAU;EAAQ,KAAK;CAAG,CAAC,CAAC;CACpE,IAAI,IAAI,sBAAsB,UAAU;EAAE,UAAU;EAAQ,KAAK;CAAG,CAAC,CAAC;CAGtE,IAAI,IAAI,WAAW,UAAU;EAAE,UAAU;EAAQ,KAAK;EAAK,cAAc,aAAa,MAAM;CAAE,CAAC,CAAC;CAChG,IAAI,IACF,eACA,UAAU;EAAE,UAAU;EAAQ,KAAK;EAAK,cAAc,aAAa,QAAQ;CAAE,CAAC,CAChF;CACA,KAAK,MAAM,QAAQ,YACjB,IAAI,IAAI,MAAM,KAAK,OAAO,MAAM,CAAC;AAErC;;AAGA,SAAS,wBAAwB,KAAwB;CACvD,MAAM,UAAU;EAAE,UAAU;EAAQ,KAAK;EAAI,cAAc,aAAa,iBAAiB;CAAE;CAC3F,MAAM,QAAQ;EAAE,UAAU;EAAQ,KAAK;EAAI,cAAc,aAAa,cAAc;CAAE;CACtF,MAAM,eAAe;EAAE,UAAU;EAAQ,KAAK;EAAI,cAAc,aAAa,aAAa;CAAE;CAC5F,IAAI,IAAI,gDAAgD,UAAU,OAAO,CAAC;CAC1E,IAAI,IAAI,2DAA2D,UAAU,OAAO,CAAC;CACrF,IAAI,IAAI,wCAAwC,UAAU,YAAY,CAAC;CACvE,IAAI,IAAI,2CAA2C,UAAU,YAAY,CAAC;CAC1E,IAAI,IAAI,uCAAuC,UAAU,KAAK,CAAC;CAC/D,IAAI,IAAI,kDAAkD,UAAU,KAAK,CAAC;AAC5E;;AAGA,SAAS,gBAAgB,KAAkB,QAAgC;CACzE,MAAM,EAAE,SAAS,QAAQ,IAAI,QAAQ,aAAa,gBAAgB,OAAO,UAAU,cACjF;CACF,IAAI,IACF,KACA,WAAW;EACT,IAAI,QAAQ;EACZ,SAAS,QAAQ;EACjB;EACA;EACA;EACA;EACA;EACA,cAAc;EACd;EACA;EACA,aAAa,OAAO,MAAM,MAAM,mBAAmB,GAAG,QAAQ,IAAI;CACpE,CAAC,CACH;AACF;;AAGA,SAAS,kBAAkB,KAAkB,QAA0B;CACrE,sBAAsB,GAAG;CACzB,2BAA2B,GAAG;CAC9B,sBAAsB,GAAG;CACzB,eAAe,KAAK,MAAM;CAC1B,cAAc,GAAG;AACnB;;AAGA,SAAS,sBAAsB,KAAwB;CACrD,iBAAiB,GAAG;CACpB,eAAe,GAAG;CAClB,eAAe,GAAG;CAClB,cAAc,GAAG;CACjB,gBAAgB,GAAG;CACnB,eAAe,GAAG;CAClB,iBAAiB,GAAG;AACtB;;AAGA,SAAS,2BAA2B,KAAwB;CAC1D,6BAA6B,GAAG;CAChC,kCAAkC,GAAG;CACrC,uBAAuB,GAAG;AAC5B;;AAGA,SAAS,iBAAiB,KAAkB,SAA6B;CAIvE,IAAI,CAAC,QAAQ,MACX;CAEF,mBAAmB,KAAK,QAAQ,IAAI;CACpC,kBAAkB,KAAK,QAAQ,IAAI;CACnC,gBAAgB,KAAK,QAAQ,IAAI;AACnC;;AAGA,SAAS,mBAAmB,KAAkB,SAAuB,QAA0B;CAC7F,iBAAiB,KAAK,OAAO;CAC7B,eAAe,GAAG;CAClB,kBAAkB,GAAG;CACrB,mBAAmB,KAAK,QAAQ,QAAQ,IAAI;CAC5C,gBAAgB,GAAG;AACrB;;AAGA,SAAS,kBAAkB,KAAkB,SAAuB,QAA0B;CAC5F,kBAAkB,KAAK,MAAM;CAC7B,mBAAmB,KAAK,SAAS,MAAM;AACzC;;AAGA,SAAS,aAAa,KAAwB;CAC5C,IAAI,IAAI,wBAAwB;EAC9B,SAAS;EACT,MAAM;GACJ,OAAO;GACP,aACE;GACF,SAAS;EACX;EACA,MAAM;GACJ;IACE,MAAM;IACN,aAAa;GACf;GACA;IACE,MAAM;IACN,aAAa;GACf;GACA;IACE,MAAM;IACN,aAAa;GACf;GACA;IAAE,MAAM;IAAU,aAAa;GAA+C;GAC9E;IACE,MAAM;IACN,aAAa;GACf;GACA;IAAE,MAAM;IAAU,aAAa;GAAqC;GACpE;IAAE,MAAM;IAAY,aAAa;GAA8C;GAC/E;IACE,MAAM;IACN,aAAa;GACf;GACA;IAAE,MAAM;IAAc,aAAa;GAAoD;GACvF;IAAE,MAAM;IAAS,aAAa;GAA4B;EAC5D;CACF,CAAC;CACD,IAAI,IAAI,gBAAgB,UAAU,EAAE,KAAK,uBAAuB,CAAC,CAAC;AACpE;;AAGA,SAAS,iBAAyB;CAChC,OAAQ,WAAuD,mBAAmB;AACpF"}