@storyshelf/app 0.5.3

package/dist/lifecycle.mjs

@@ -0,0 +1,132 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { startBranchGcTimer } from "./retention-timer.mjs";
+import { AdapterLifecycleError, bindAdapterLoggers, collectSetups, collectTeardowns, runAdapterSetups, runAdapterTeardowns, validateBootAssembly } from "@storyshelf/core/adapter/setup";
+import { sanitizeErrorText } from "@storyshelf/core/utils";
+//#region src/lifecycle.ts
+function trackSettlement(cell, promise) {
+	promise.then((result) => {
+		cell.settled = result;
+	}, () => {
+		cell.settled = {
+			ok: false,
+			failures: []
+		};
+	});
+}
+/** Kick the eager background setup run (resolves; never rejects). */
+function kickSetup(options, ctx, logger, cell) {
+	cell.ready = (async () => {
+		const invalid = validateBootAssembly(options);
+		if (invalid.length > 0) {
+			logger.error({ failures: invalid }, "adapter validation failed");
+			return {
+				ok: false,
+				failures: invalid
+			};
+		}
+		const authFailed = await runAuthSetup(options);
+		if (authFailed) {
+			logger.error({ failures: authFailed.failures }, "auth setup failed");
+			return authFailed;
+		}
+		return await runAdapterSetups(collectSetups(options), ctx, logger);
+	})();
+	trackSettlement(cell, cell.ready);
+}
+/** Login method count, or null when the engine throws during introspection. */
+function loginMethodCount(auth) {
+	try {
+		return auth.loginMethods().length;
+	} catch {
+		return null;
+	}
+}
+/** Log which auth mode the server boots with (open servers stay visible). */
+function logAuthMode(options, logger) {
+	if (!options.auth) {
+		logger.info("auth disabled (local default; every route is open)");
+		return;
+	}
+	const methods = loginMethodCount(options.auth);
+	if (methods === null) {
+		logger.warn("auth loginMethods() threw during boot logging");
+		return;
+	}
+	logger.info({ loginMethods: methods }, "auth enabled");
+}
+/** Kick eager setup and attach the `app.lifecycle` namespace (single run). */
+function attachLifecycle(app, options, runtime, cell) {
+	const setupCtx = {
+		config: runtime.config,
+		logger: runtime.logger
+	};
+	bindAdapterLoggers(options, runtime.logger);
+	logAuthMode(options, runtime.logger);
+	kickSetup(options, setupCtx, runtime.logger, cell);
+	const timer = startBranchGcInterval(options, runtime);
+	Object.assign(app, { lifecycle: createLifecycle(options, setupCtx, runtime.logger, cell, timer) });
+}
+function startBranchGcInterval(options, runtime) {
+	return startBranchGcTimer(options.database, options.storage, runtime.config, runtime.logger);
+}
+/** Run auth boot validation, returning a failure result instead of throwing. */
+async function runAuthSetup(options) {
+	try {
+		await options.auth?.setup?.();
+		return null;
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return {
+			ok: false,
+			failures: [{
+				category: "auth",
+				kind: "auth",
+				name: "auth",
+				error: sanitizeErrorText(message, 500)
+			}]
+		};
+	}
+}
+/** Validation failure settled on the cell — null when the assembly is sound. */
+function invalidSources(options, cell) {
+	const invalid = validateBootAssembly(options);
+	if (invalid.length === 0) return null;
+	const result = {
+		ok: false,
+		failures: invalid
+	};
+	cell.ready = Promise.resolve(result);
+	cell.settled = result;
+	return result;
+}
+/** Build the `app.lifecycle` namespace closing over one settlement cell. */
+function createLifecycle(options, ctx, logger, cell, timer = null) {
+	return {
+		get ready() {
+			return cell.ready;
+		},
+		logger,
+		setup: async () => {
+			const blocked = invalidSources(options, cell);
+			if (blocked) throw new AdapterLifecycleError("setup", blocked.failures);
+			const result = await runAdapterSetups(collectSetups(options), ctx, logger);
+			cell.ready = Promise.resolve(result);
+			cell.settled = result;
+			if (!result.ok) throw new AdapterLifecycleError("setup", result.failures);
+		},
+		teardown: async () => {
+			timer?.stop();
+			const result = await runAdapterTeardowns(collectTeardowns(options), ctx, logger);
+			await options.observability?.shutdown().catch((error) => {
+				logger.error({ err: error }, "observability shutdown failed");
+			});
+			if (!result.ok) throw new AdapterLifecycleError("teardown", result.failures);
+		}
+	};
+}
+//#endregion
+export { attachLifecycle };
+
+//# sourceMappingURL=lifecycle.mjs.map

package/dist/lifecycle.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.mjs","names":[],"sources":["../src/lifecycle.ts"],"sourcesContent":["import type { AdapterSetupContext } from \"@storyshelf/core/adapter/metadata\";\nimport {\n  AdapterLifecycleError,\n  bindAdapterLoggers,\n  collectSetups,\n  collectTeardowns,\n  runAdapterSetups,\n  runAdapterTeardowns,\n  validateBootAssembly,\n} from \"@storyshelf/core/adapter/setup\";\nimport type { AdapterSetupResult } from \"@storyshelf/core/adapter/setup\";\nimport type { ShelfOptions } from \"@storyshelf/core/config\";\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport { sanitizeErrorText } from \"@storyshelf/core/utils\";\nimport type { ShelfRouter, ShelfLifecycle } from \"./app-types.ts\";\nimport { startBranchGcTimer } from \"./retention-timer.ts\";\nimport type { ServerRuntime } from \"./runtime.ts\";\n\n/** Mutable setup-settlement cell shared by the gate, health, and `setup()`. */\nexport interface LifecycleCell {\n  ready: Promise<AdapterSetupResult>;\n  settled: AdapterSetupResult | null;\n}\n\nfunction trackSettlement(cell: LifecycleCell, promise: Promise<AdapterSetupResult>): void {\n  promise.then(\n    (result) => {\n      cell.settled = result;\n    },\n    () => {\n      cell.settled = { ok: false, failures: [] };\n    },\n  );\n}\n\n/** Kick the eager background setup run (resolves; never rejects). */\nfunction kickSetup(\n  options: ShelfOptions,\n  ctx: AdapterSetupContext,\n  logger: Logger,\n  cell: LifecycleCell,\n): void {\n  // Auth is not an adapter: its one-shot boot validation runs first, then\n  // the adapter setups. A failing secret check fails readiness, like others.\n  cell.ready = (async (): Promise<AdapterSetupResult> => {\n    const invalid = validateBootAssembly(options);\n    if (invalid.length > 0) {\n      logger.error({ failures: invalid }, \"adapter validation failed\");\n      return { ok: false, failures: invalid };\n    }\n    const authFailed = await runAuthSetup(options);\n    if (authFailed) {\n      logger.error({ failures: authFailed.failures }, \"auth setup failed\");\n      return authFailed;\n    }\n    return await runAdapterSetups(collectSetups(options), ctx, logger);\n  })();\n  trackSettlement(cell, cell.ready);\n}\n\n/** Login method count, or null when the engine throws during introspection. */\nfunction loginMethodCount(auth: NonNullable<ShelfOptions[\"auth\"]>): number | null {\n  try {\n    return auth.loginMethods().length;\n  } catch {\n    return null;\n  }\n}\n\n/** Log which auth mode the server boots with (open servers stay visible). */\nfunction logAuthMode(options: ShelfOptions, logger: Logger): void {\n  if (!options.auth) {\n    logger.info(\"auth disabled (local default; every route is open)\");\n    return;\n  }\n  const methods = loginMethodCount(options.auth);\n  if (methods === null) {\n    logger.warn(\"auth loginMethods() threw during boot logging\");\n    return;\n  }\n  logger.info({ loginMethods: methods }, \"auth enabled\");\n}\n\n/** Kick eager setup and attach the `app.lifecycle` namespace (single run). */\nexport function attachLifecycle(\n  app: ShelfRouter,\n  options: ShelfOptions,\n  runtime: ServerRuntime,\n  cell: LifecycleCell,\n): void {\n  const setupCtx: AdapterSetupContext = { config: runtime.config, logger: runtime.logger };\n  bindAdapterLoggers(options, runtime.logger);\n  logAuthMode(options, runtime.logger);\n  kickSetup(options, setupCtx, runtime.logger, cell);\n  const timer = startBranchGcInterval(options, runtime);\n  Object.assign(app, {\n    lifecycle: createLifecycle(options, setupCtx, runtime.logger, cell, timer),\n  });\n}\n\nfunction startBranchGcInterval(\n  options: ShelfOptions,\n  runtime: ServerRuntime,\n): { stop(): void } | null {\n  return startBranchGcTimer(options.database, options.storage, runtime.config, runtime.logger);\n}\n\n/** Run auth boot validation, returning a failure result instead of throwing. */\nasync function runAuthSetup(options: ShelfOptions): Promise<AdapterSetupResult | null> {\n  try {\n    await options.auth?.setup?.();\n    return null;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    return {\n      ok: false,\n      failures: [\n        { category: \"auth\", kind: \"auth\", name: \"auth\", error: sanitizeErrorText(message, 500) },\n      ],\n    };\n  }\n}\n/** Validation failure settled on the cell — null when the assembly is sound. */\nfunction invalidSources(options: ShelfOptions, cell: LifecycleCell): AdapterSetupResult | null {\n  const invalid = validateBootAssembly(options);\n  if (invalid.length === 0) {\n    return null;\n  }\n  const result: AdapterSetupResult = { ok: false, failures: invalid };\n  cell.ready = Promise.resolve(result);\n  cell.settled = result;\n  return result;\n}\n/** Build the `app.lifecycle` namespace closing over one settlement cell. */\nfunction createLifecycle(\n  options: ShelfOptions,\n  ctx: AdapterSetupContext,\n  logger: Logger,\n  cell: LifecycleCell,\n  timer: { stop(): void } | null = null,\n): ShelfLifecycle {\n  return {\n    get ready() {\n      return cell.ready;\n    },\n    logger,\n    setup: async () => {\n      const blocked = invalidSources(options, cell);\n      if (blocked) {\n        throw new AdapterLifecycleError(\"setup\", blocked.failures);\n      }\n      const result = await runAdapterSetups(collectSetups(options), ctx, logger);\n      cell.ready = Promise.resolve(result);\n      cell.settled = result;\n      if (!result.ok) {\n        throw new AdapterLifecycleError(\"setup\", result.failures);\n      }\n    },\n    teardown: async () => {\n      timer?.stop();\n      const result = await runAdapterTeardowns(collectTeardowns(options), ctx, logger);\n      await options.observability?.shutdown().catch((error: unknown) => {\n        logger.error({ err: error }, \"observability shutdown failed\");\n      });\n      if (!result.ok) {\n        throw new AdapterLifecycleError(\"teardown\", result.failures);\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;AAwBA,SAAS,gBAAgB,MAAqB,SAA4C;CACxF,QAAQ,MACL,WAAW;EACV,KAAK,UAAU;CACjB,SACM;EACJ,KAAK,UAAU;GAAE,IAAI;GAAO,UAAU,CAAC;EAAE;CAC3C,CACF;AACF;;AAGA,SAAS,UACP,SACA,KACA,QACA,MACM;CAGN,KAAK,SAAS,YAAyC;EACrD,MAAM,UAAU,qBAAqB,OAAO;EAC5C,IAAI,QAAQ,SAAS,GAAG;GACtB,OAAO,MAAM,EAAE,UAAU,QAAQ,GAAG,2BAA2B;GAC/D,OAAO;IAAE,IAAI;IAAO,UAAU;GAAQ;EACxC;EACA,MAAM,aAAa,MAAM,aAAa,OAAO;EAC7C,IAAI,YAAY;GACd,OAAO,MAAM,EAAE,UAAU,WAAW,SAAS,GAAG,mBAAmB;GACnE,OAAO;EACT;EACA,OAAO,MAAM,iBAAiB,cAAc,OAAO,GAAG,KAAK,MAAM;CACnE,EAAA,CAAG;CACH,gBAAgB,MAAM,KAAK,KAAK;AAClC;;AAGA,SAAS,iBAAiB,MAAwD;CAChF,IAAI;EACF,OAAO,KAAK,aAAa,CAAC,CAAC;CAC7B,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAS,YAAY,SAAuB,QAAsB;CAChE,IAAI,CAAC,QAAQ,MAAM;EACjB,OAAO,KAAK,oDAAoD;EAChE;CACF;CACA,MAAM,UAAU,iBAAiB,QAAQ,IAAI;CAC7C,IAAI,YAAY,MAAM;EACpB,OAAO,KAAK,+CAA+C;EAC3D;CACF;CACA,OAAO,KAAK,EAAE,cAAc,QAAQ,GAAG,cAAc;AACvD;;AAGA,SAAgB,gBACd,KACA,SACA,SACA,MACM;CACN,MAAM,WAAgC;EAAE,QAAQ,QAAQ;EAAQ,QAAQ,QAAQ;CAAO;CACvF,mBAAmB,SAAS,QAAQ,MAAM;CAC1C,YAAY,SAAS,QAAQ,MAAM;CACnC,UAAU,SAAS,UAAU,QAAQ,QAAQ,IAAI;CACjD,MAAM,QAAQ,sBAAsB,SAAS,OAAO;CACpD,OAAO,OAAO,KAAK,EACjB,WAAW,gBAAgB,SAAS,UAAU,QAAQ,QAAQ,MAAM,KAAK,EAC3E,CAAC;AACH;AAEA,SAAS,sBACP,SACA,SACyB;CACzB,OAAO,mBAAmB,QAAQ,UAAU,QAAQ,SAAS,QAAQ,QAAQ,QAAQ,MAAM;AAC7F;;AAGA,eAAe,aAAa,SAA2D;CACrF,IAAI;EACF,MAAM,QAAQ,MAAM,QAAQ;EAC5B,OAAO;CACT,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACrE,OAAO;GACL,IAAI;GACJ,UAAU,CACR;IAAE,UAAU;IAAQ,MAAM;IAAQ,MAAM;IAAQ,OAAO,kBAAkB,SAAS,GAAG;GAAE,CACzF;EACF;CACF;AACF;;AAEA,SAAS,eAAe,SAAuB,MAAgD;CAC7F,MAAM,UAAU,qBAAqB,OAAO;CAC5C,IAAI,QAAQ,WAAW,GACrB,OAAO;CAET,MAAM,SAA6B;EAAE,IAAI;EAAO,UAAU;CAAQ;CAClE,KAAK,QAAQ,QAAQ,QAAQ,MAAM;CACnC,KAAK,UAAU;CACf,OAAO;AACT;;AAEA,SAAS,gBACP,SACA,KACA,QACA,MACA,QAAiC,MACjB;CAChB,OAAO;EACL,IAAI,QAAQ;GACV,OAAO,KAAK;EACd;EACA;EACA,OAAO,YAAY;GACjB,MAAM,UAAU,eAAe,SAAS,IAAI;GAC5C,IAAI,SACF,MAAM,IAAI,sBAAsB,SAAS,QAAQ,QAAQ;GAE3D,MAAM,SAAS,MAAM,iBAAiB,cAAc,OAAO,GAAG,KAAK,MAAM;GACzE,KAAK,QAAQ,QAAQ,QAAQ,MAAM;GACnC,KAAK,UAAU;GACf,IAAI,CAAC,OAAO,IACV,MAAM,IAAI,sBAAsB,SAAS,OAAO,QAAQ;EAE5D;EACA,UAAU,YAAY;GACpB,OAAO,KAAK;GACZ,MAAM,SAAS,MAAM,oBAAoB,iBAAiB,OAAO,GAAG,KAAK,MAAM;GAC/E,MAAM,QAAQ,eAAe,SAAS,CAAC,CAAC,OAAO,UAAmB;IAChE,OAAO,MAAM,EAAE,KAAK,MAAM,GAAG,+BAA+B;GAC9D,CAAC;GACD,IAAI,CAAC,OAAO,IACV,MAAM,IAAI,sBAAsB,YAAY,OAAO,QAAQ;EAE/D;CACF;AACF"}

package/dist/middleware/auth-gate.mjs

@@ -0,0 +1,36 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+//#region src/middleware/auth-gate.ts
+/** Resolve the request user from the auth adapter (null when auth is off or a token is used). */
+async function resolveRequestUser(c, auth) {
+	if (!auth) return null;
+	if (c.req.header("authorization")) return null;
+	return await auth.check(c.req.raw);
+}
+/**
+* Gate the server-rendered UI behind auth (ADR 0008): unauthenticated HTML
+* requests redirect to login. API/auth routes answer 401/403 themselves, and
+* published-Storybook routes enforce their own auth (public builds are
+* viewable without a session, ADR 0011).
+*/
+function authGate() {
+	return async (c, next) => {
+		const { user, authEnabled: isAuthEnabled } = getStore();
+		const { path } = c.req;
+		if (!isAuthEnabled || user || path.startsWith("/api/") || path.startsWith("/auth/") || path.startsWith("/assets/") || path.startsWith("/.well-known/") || path.startsWith("/projects/") && path.includes("/storybook") || /^\/projects\/[^/]+\/?$/u.test(path)) {
+			await next();
+			return;
+		}
+		if (c.req.header("HX-Request") === "true") {
+			c.header("HX-Redirect", "/auth/login");
+			return c.body(null, 204);
+		}
+		return c.redirect("/auth/login", 302);
+	};
+}
+//#endregion
+export { authGate, resolveRequestUser };
+
+//# sourceMappingURL=auth-gate.mjs.map

package/dist/middleware/auth-gate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-gate.mjs","names":[],"sources":["../../src/middleware/auth-gate.ts"],"sourcesContent":["import type { Auth } from \"@storyshelf/auth\";\nimport type { AuthUser } from \"@storyshelf/core/types\";\nimport type { Context, Next } from \"hono\";\nimport { getStore } from \"../store.ts\";\n\n/** Resolve the request user from the auth adapter (null when auth is off or a token is used). */\nexport async function resolveRequestUser(\n  c: Pick<Context, \"req\">,\n  auth?: Auth,\n): Promise<AuthUser | null> {\n  if (!auth) {\n    return null;\n  }\n  if (c.req.header(\"authorization\")) {\n    return null;\n  }\n  return await auth.check(c.req.raw);\n}\n\n/**\n * Gate the server-rendered UI behind auth (ADR 0008): unauthenticated HTML\n * requests redirect to login. API/auth routes answer 401/403 themselves, and\n * published-Storybook routes enforce their own auth (public builds are\n * viewable without a session, ADR 0011).\n */\nexport function authGate() {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const { user, authEnabled: isAuthEnabled } = getStore();\n    const { path } = c.req;\n    if (\n      !isAuthEnabled ||\n      user ||\n      path.startsWith(\"/api/\") ||\n      path.startsWith(\"/auth/\") ||\n      path.startsWith(\"/assets/\") ||\n      path.startsWith(\"/.well-known/\") ||\n      (path.startsWith(\"/projects/\") && path.includes(\"/storybook\")) ||\n      /^\\/projects\\/[^/]+\\/?$/u.test(path)\n    ) {\n      await next();\n      return;\n    }\n    if (c.req.header(\"HX-Request\") === \"true\") {\n      c.header(\"HX-Redirect\", \"/auth/login\");\n      return c.body(null, 204);\n    }\n    return c.redirect(\"/auth/login\", 302);\n  };\n}\n"],"mappings":";;;;;;AAMA,eAAsB,mBACpB,GACA,MAC0B;CAC1B,IAAI,CAAC,MACH,OAAO;CAET,IAAI,EAAE,IAAI,OAAO,eAAe,GAC9B,OAAO;CAET,OAAO,MAAM,KAAK,MAAM,EAAE,IAAI,GAAG;AACnC;;;;;;;AAQA,SAAgB,WAAW;CAEzB,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,EAAE,MAAM,aAAa,kBAAkB,SAAS;EACtD,MAAM,EAAE,SAAS,EAAE;EACnB,IACE,CAAC,iBACD,QACA,KAAK,WAAW,OAAO,KACvB,KAAK,WAAW,QAAQ,KACxB,KAAK,WAAW,UAAU,KAC1B,KAAK,WAAW,eAAe,KAC9B,KAAK,WAAW,YAAY,KAAK,KAAK,SAAS,YAAY,KAC5D,0BAA0B,KAAK,IAAI,GACnC;GACA,MAAM,KAAK;GACX;EACF;EACA,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,QAAQ;GACzC,EAAE,OAAO,eAAe,aAAa;GACrC,OAAO,EAAE,KAAK,MAAM,GAAG;EACzB;EACA,OAAO,EAAE,SAAS,eAAe,GAAG;CACtC;AACF"}

package/dist/middleware/csrf.mjs

@@ -0,0 +1,75 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { timingSafeEqualString } from "@storyshelf/core/utils";
+import { SESSION_COOKIE } from "@storyshelf/core/types";
+import { createHash, randomBytes } from "node:crypto";
+//#region src/middleware/csrf.ts
+const DEFAULT_SESSION = "default";
+const FALLBACK_SECRET = randomBytes(32).toString("hex");
+/** Use the app secret when provided so tokens survive restarts and instances. */
+function resolveSecret(secret) {
+	return secret ?? FALLBACK_SECRET;
+}
+function generateToken(secret, sessionId) {
+	const payload = `${sessionId}:${Date.now().toString(36)}`;
+	return `${payload}:${createHash("sha256").update(`${secret}:${payload}`).digest("hex").slice(0, 16)}`;
+}
+function verifyToken(secret, token, sessionId) {
+	const parts = token.split(":");
+	if (parts.length !== 3) return false;
+	const [payloadTimestamp, signature] = parts.slice(1);
+	if (!payloadTimestamp || !signature) return false;
+	const expectedSignature = createHash("sha256").update(`${secret}:${sessionId}:${payloadTimestamp}`).digest("hex").slice(0, 16);
+	if (!timingSafeEqualString(signature, expectedSignature)) return false;
+	const timestamp = Number.parseInt(payloadTimestamp, 36);
+	const age = Date.now() - timestamp;
+	return age >= 0 && age < 864e5;
+}
+/**
+* Session id for CSRF binding: the raw session cookie value, or "default"
+* for anonymous requests (login/invite forms have no session yet). A token
+* minted for one session never validates for another.
+*/
+function sessionIdFrom(c) {
+	const header = c.req.header("cookie") ?? "";
+	for (const part of header.split(";")) {
+		const eqIndex = part.indexOf("=");
+		if (eqIndex !== -1 && part.slice(0, eqIndex).trim() === SESSION_COOKIE) {
+			const value = part.slice(eqIndex + 1).trim();
+			if (value) return value;
+		}
+	}
+	return DEFAULT_SESSION;
+}
+/** Read a CSRF token from the request header or form body (never the URL: query tokens leak via logs, history, and Referer). */
+async function tokenFromRequest(c) {
+	const header = c.req.header("x-csrf-token");
+	if (header) return header;
+	if (!(c.req.header("content-type") ?? "").includes("form")) return;
+	const value = (await c.req.parseBody())["csrf_token"];
+	return typeof value === "string" ? value : void 0;
+}
+/** Hono middleware issuing CSRF tokens on safe methods and verifying them on writes. */
+function csrf(secret) {
+	const resolvedSecret = resolveSecret(secret);
+	return async (c, next) => {
+		const { method } = c.req;
+		if (method === "GET" || method === "HEAD" || method === "OPTIONS") {
+			c.header("X-CSRF-Token", generateToken(resolvedSecret, sessionIdFrom(c)));
+			await next();
+			return;
+		}
+		const token = await tokenFromRequest(c);
+		if (!token || !verifyToken(resolvedSecret, token, sessionIdFrom(c))) return c.json({ error: "Invalid CSRF token" }, 403);
+		await next();
+	};
+}
+/** Generate a CSRF token for the given session (bound to the same secret as `csrf`). */
+function getCsrfToken(secret, sessionId = DEFAULT_SESSION) {
+	return generateToken(resolveSecret(secret), sessionId);
+}
+//#endregion
+export { csrf, getCsrfToken, sessionIdFrom };
+
+//# sourceMappingURL=csrf.mjs.map

package/dist/middleware/csrf.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.mjs","names":[],"sources":["../../src/middleware/csrf.ts"],"sourcesContent":["import { SESSION_COOKIE } from \"@storyshelf/core/types\";\nimport { timingSafeEqualString } from \"@storyshelf/core/utils\";\nimport type { Context, Next } from \"hono\";\nimport { createHash, randomBytes } from \"node:crypto\";\n\nconst DEFAULT_SESSION = \"default\";\nconst FALLBACK_SECRET = randomBytes(32).toString(\"hex\");\n\n/** Use the app secret when provided so tokens survive restarts and instances. */\nfunction resolveSecret(secret?: string): string {\n  return secret ?? FALLBACK_SECRET;\n}\n\nfunction generateToken(secret: string, sessionId: string): string {\n  const timestamp = Date.now().toString(36);\n  const payload = `${sessionId}:${timestamp}`;\n  const signature = createHash(\"sha256\").update(`${secret}:${payload}`).digest(\"hex\").slice(0, 16);\n  return `${payload}:${signature}`;\n}\n\nfunction verifyToken(secret: string, token: string, sessionId: string): boolean {\n  const parts = token.split(\":\");\n  if (parts.length !== 3) {\n    return false;\n  }\n  const [payloadTimestamp, signature] = parts.slice(1);\n  if (!payloadTimestamp || !signature) {\n    return false;\n  }\n  const expectedSignature = createHash(\"sha256\")\n    .update(`${secret}:${sessionId}:${payloadTimestamp}`)\n    .digest(\"hex\")\n    .slice(0, 16);\n  if (!timingSafeEqualString(signature, expectedSignature)) {\n    return false;\n  }\n  const timestamp = Number.parseInt(payloadTimestamp, 36);\n  const age = Date.now() - timestamp;\n  // Same-millisecond tokens are fresh (>= 0), not from the future.\n  return age >= 0 && age < 24 * 60 * 60 * 1000;\n}\n\n/**\n * Session id for CSRF binding: the raw session cookie value, or \"default\"\n * for anonymous requests (login/invite forms have no session yet). A token\n * minted for one session never validates for another.\n */\nexport function sessionIdFrom(c: Pick<Context, \"req\">): string {\n  const header = c.req.header(\"cookie\") ?? \"\";\n  for (const part of header.split(\";\")) {\n    const eqIndex = part.indexOf(\"=\");\n    if (eqIndex !== -1 && part.slice(0, eqIndex).trim() === SESSION_COOKIE) {\n      const value = part.slice(eqIndex + 1).trim();\n      if (value) {\n        return value;\n      }\n    }\n  }\n  return DEFAULT_SESSION;\n}\n\n/** Read a CSRF token from the request header or form body (never the URL: query tokens leak via logs, history, and Referer). */\nasync function tokenFromRequest(c: Context): Promise<string | undefined> {\n  const header = c.req.header(\"x-csrf-token\");\n  if (header) {\n    return header;\n  }\n  const contentType = c.req.header(\"content-type\") ?? \"\";\n  if (!contentType.includes(\"form\")) {\n    return undefined;\n  }\n  const body = await c.req.parseBody();\n  const value = body[\"csrf_token\"];\n  return typeof value === \"string\" ? value : undefined;\n}\n\n/** Hono middleware issuing CSRF tokens on safe methods and verifying them on writes. */\nexport function csrf(secret?: string) {\n  const resolvedSecret = resolveSecret(secret);\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const { method } = c.req;\n    if (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") {\n      c.header(\"X-CSRF-Token\", generateToken(resolvedSecret, sessionIdFrom(c)));\n      await next();\n      return;\n    }\n    const token = await tokenFromRequest(c);\n    if (!token || !verifyToken(resolvedSecret, token, sessionIdFrom(c))) {\n      return c.json({ error: \"Invalid CSRF token\" }, 403);\n    }\n    await next();\n  };\n}\n\n/** Generate a CSRF token for the given session (bound to the same secret as `csrf`). */\nexport function getCsrfToken(secret?: string, sessionId: string = DEFAULT_SESSION): string {\n  return generateToken(resolveSecret(secret), sessionId);\n}\n"],"mappings":";;;;;;;AAKA,MAAM,kBAAkB;AACxB,MAAM,kBAAkB,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;;AAGtD,SAAS,cAAc,QAAyB;CAC9C,OAAO,UAAU;AACnB;AAEA,SAAS,cAAc,QAAgB,WAA2B;CAEhE,MAAM,UAAU,GAAG,UAAU,GADX,KAAK,IAAI,CAAC,CAAC,SAAS,EACE;CAExC,OAAO,GAAG,QAAQ,GADA,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAChE;AAC/B;AAEA,SAAS,YAAY,QAAgB,OAAe,WAA4B;CAC9E,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,IAAI,MAAM,WAAW,GACnB,OAAO;CAET,MAAM,CAAC,kBAAkB,aAAa,MAAM,MAAM,CAAC;CACnD,IAAI,CAAC,oBAAoB,CAAC,WACxB,OAAO;CAET,MAAM,oBAAoB,WAAW,QAAQ,CAAC,CAC3C,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,kBAAkB,CAAC,CACpD,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,IAAI,CAAC,sBAAsB,WAAW,iBAAiB,GACrD,OAAO;CAET,MAAM,YAAY,OAAO,SAAS,kBAAkB,EAAE;CACtD,MAAM,MAAM,KAAK,IAAI,IAAI;CAEzB,OAAO,OAAO,KAAK,MAAM;AAC3B;;;;;;AAOA,SAAgB,cAAc,GAAiC;CAC7D,MAAM,SAAS,EAAE,IAAI,OAAO,QAAQ,KAAK;CACzC,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,UAAU,KAAK,QAAQ,GAAG;EAChC,IAAI,YAAY,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,MAAM,gBAAgB;GACtE,MAAM,QAAQ,KAAK,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK;GAC3C,IAAI,OACF,OAAO;EAEX;CACF;CACA,OAAO;AACT;;AAGA,eAAe,iBAAiB,GAAyC;CACvE,MAAM,SAAS,EAAE,IAAI,OAAO,cAAc;CAC1C,IAAI,QACF,OAAO;CAGT,IAAI,EADgB,EAAE,IAAI,OAAO,cAAc,KAAK,GAAA,CACnC,SAAS,MAAM,GAC9B;CAGF,MAAM,SAAQ,MADK,EAAE,IAAI,UAAU,EAAA,CAChB;CACnB,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;AAC7C;;AAGA,SAAgB,KAAK,QAAiB;CACpC,MAAM,iBAAiB,cAAc,MAAM;CAE3C,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,EAAE,WAAW,EAAE;EACrB,IAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAAW;GACjE,EAAE,OAAO,gBAAgB,cAAc,gBAAgB,cAAc,CAAC,CAAC,CAAC;GACxE,MAAM,KAAK;GACX;EACF;EACA,MAAM,QAAQ,MAAM,iBAAiB,CAAC;EACtC,IAAI,CAAC,SAAS,CAAC,YAAY,gBAAgB,OAAO,cAAc,CAAC,CAAC,GAChE,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;EAEpD,MAAM,KAAK;CACb;AACF;;AAGA,SAAgB,aAAa,QAAiB,YAAoB,iBAAyB;CACzF,OAAO,cAAc,cAAc,MAAM,GAAG,SAAS;AACvD"}

package/dist/middleware/rate-limit.mjs

@@ -0,0 +1,68 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/middleware/rate-limit.ts
+/** Direct peer IP from server runtimes exposing the socket (unspoofable TCP source). */
+function peerIp(c) {
+	const env = c.env ?? {};
+	const address = env.incoming?.socket?.remoteAddress ?? env.server?.incoming?.socket?.remoteAddress;
+	return typeof address === "string" && address ? address : void 0;
+}
+/**
+* Rate-limit identity for one bucket prefix: direct peer first, then the
+* first `X-Forwarded-For` entry (client-controlled, so only a fallback),
+* then `X-Real-IP`, then a shared bucket. Deployments behind proxies with
+* many users behind one peer IP share that peer's budget.
+*/
+function rateLimitKey(prefix) {
+	return (c) => {
+		const peer = peerIp(c);
+		if (peer) return `${prefix}:${peer}`;
+		const forwarded = c.req.header("x-forwarded-for")?.split(",")[0]?.trim();
+		if (forwarded) return `${prefix}:fwd:${forwarded}`;
+		const real = c.req.header("x-real-ip")?.trim();
+		if (real) return `${prefix}:fwd:${real}`;
+		return `${prefix}:anonymous`;
+	};
+}
+const stores = /* @__PURE__ */ new Map();
+/** Cap tracked buckets (spoofed keys would otherwise grow the map forever). */
+const MAX_BUCKETS = 1e4;
+function cleanup() {
+	const now = Date.now();
+	for (const [key, entry] of stores) if (now > entry.resetAt) stores.delete(key);
+}
+setInterval(cleanup, 6e4).unref();
+/** Hono middleware limiting requests per key within a sliding window. */
+function rateLimit(options) {
+	const { windowMs, max, keyGenerator } = options;
+	return async (c, next) => {
+		const key = keyGenerator ? keyGenerator(c) : rateLimitKey("api")(c);
+		const now = Date.now();
+		let entry = stores.get(key);
+		if (!entry || now > entry.resetAt) {
+			entry = {
+				count: 0,
+				resetAt: now + windowMs
+			};
+			if (stores.size >= MAX_BUCKETS) {
+				const oldest = stores.keys().next();
+				if (!oldest.done) stores.delete(oldest.value);
+			}
+			stores.set(key, entry);
+		}
+		entry.count += 1;
+		if (entry.count > max) {
+			const retryAfter = Math.ceil((entry.resetAt - now) / 1e3);
+			c.header("Retry-After", String(retryAfter));
+			return c.json({ error: "Too many requests" }, 429);
+		}
+		c.header("X-RateLimit-Limit", String(max));
+		c.header("X-RateLimit-Remaining", String(Math.max(0, max - entry.count)));
+		await next();
+	};
+}
+//#endregion
+export { rateLimit, rateLimitKey };
+
+//# sourceMappingURL=rate-limit.mjs.map

package/dist/middleware/rate-limit.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.mjs","names":[],"sources":["../../src/middleware/rate-limit.ts"],"sourcesContent":["import type { Context, Next } from \"hono\";\n\ninterface RateLimitEntry {\n  count: number;\n  resetAt: number;\n}\n\ninterface RateLimitOptions {\n  windowMs: number;\n  max: number;\n  keyGenerator?: (c: Context) => string;\n}\n\n/** Direct peer IP from server runtimes exposing the socket (unspoofable TCP source). */\nfunction peerIp(c: Pick<Context, \"env\">): string | undefined {\n  const env = (c.env ?? {}) as {\n    incoming?: { socket?: { remoteAddress?: unknown } };\n    server?: { incoming?: { socket?: { remoteAddress?: unknown } } };\n  };\n  const address =\n    env.incoming?.socket?.remoteAddress ?? env.server?.incoming?.socket?.remoteAddress;\n  return typeof address === \"string\" && address ? address : undefined;\n}\n\n/**\n * Rate-limit identity for one bucket prefix: direct peer first, then the\n * first `X-Forwarded-For` entry (client-controlled, so only a fallback),\n * then `X-Real-IP`, then a shared bucket. Deployments behind proxies with\n * many users behind one peer IP share that peer's budget.\n */\nexport function rateLimitKey(prefix: string): (c: Context) => string {\n  return (c) => {\n    const peer = peerIp(c);\n    if (peer) {\n      return `${prefix}:${peer}`;\n    }\n    const forwarded = c.req.header(\"x-forwarded-for\")?.split(\",\")[0]?.trim();\n    if (forwarded) {\n      return `${prefix}:fwd:${forwarded}`;\n    }\n    const real = c.req.header(\"x-real-ip\")?.trim();\n    if (real) {\n      return `${prefix}:fwd:${real}`;\n    }\n    return `${prefix}:anonymous`;\n  };\n}\n\nconst stores = new Map<string, RateLimitEntry>();\n\n/** Cap tracked buckets (spoofed keys would otherwise grow the map forever). */\nconst MAX_BUCKETS = 10_000;\n\nfunction cleanup(): void {\n  const now = Date.now();\n  for (const [key, entry] of stores) {\n    if (now > entry.resetAt) {\n      stores.delete(key);\n    }\n  }\n}\n\nsetInterval(cleanup, 60_000).unref();\n\n/** Hono middleware limiting requests per key within a sliding window. */\nexport function rateLimit(options: RateLimitOptions) {\n  const { windowMs, max, keyGenerator } = options;\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const key = keyGenerator ? keyGenerator(c) : rateLimitKey(\"api\")(c);\n    const now = Date.now();\n    let entry = stores.get(key);\n    if (!entry || now > entry.resetAt) {\n      entry = { count: 0, resetAt: now + windowMs };\n      if (stores.size >= MAX_BUCKETS) {\n        const oldest = stores.keys().next();\n        if (!oldest.done) {\n          stores.delete(oldest.value);\n        }\n      }\n      stores.set(key, entry);\n    }\n    entry.count += 1;\n    if (entry.count > max) {\n      const retryAfter = Math.ceil((entry.resetAt - now) / 1000);\n      c.header(\"Retry-After\", String(retryAfter));\n      return c.json({ error: \"Too many requests\" }, 429);\n    }\n    c.header(\"X-RateLimit-Limit\", String(max));\n    c.header(\"X-RateLimit-Remaining\", String(Math.max(0, max - entry.count)));\n    await next();\n  };\n}\n"],"mappings":";;;;;AAcA,SAAS,OAAO,GAA6C;CAC3D,MAAM,MAAO,EAAE,OAAO,CAAC;CAIvB,MAAM,UACJ,IAAI,UAAU,QAAQ,iBAAiB,IAAI,QAAQ,UAAU,QAAQ;CACvE,OAAO,OAAO,YAAY,YAAY,UAAU,UAAU,KAAA;AAC5D;;;;;;;AAQA,SAAgB,aAAa,QAAwC;CACnE,QAAQ,MAAM;EACZ,MAAM,OAAO,OAAO,CAAC;EACrB,IAAI,MACF,OAAO,GAAG,OAAO,GAAG;EAEtB,MAAM,YAAY,EAAE,IAAI,OAAO,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK;EACvE,IAAI,WACF,OAAO,GAAG,OAAO,OAAO;EAE1B,MAAM,OAAO,EAAE,IAAI,OAAO,WAAW,CAAC,EAAE,KAAK;EAC7C,IAAI,MACF,OAAO,GAAG,OAAO,OAAO;EAE1B,OAAO,GAAG,OAAO;CACnB;AACF;AAEA,MAAM,yBAAS,IAAI,IAA4B;;AAG/C,MAAM,cAAc;AAEpB,SAAS,UAAgB;CACvB,MAAM,MAAM,KAAK,IAAI;CACrB,KAAK,MAAM,CAAC,KAAK,UAAU,QACzB,IAAI,MAAM,MAAM,SACd,OAAO,OAAO,GAAG;AAGvB;AAEA,YAAY,SAAS,GAAM,CAAC,CAAC,MAAM;;AAGnC,SAAgB,UAAU,SAA2B;CACnD,MAAM,EAAE,UAAU,KAAK,iBAAiB;CAExC,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,MAAM,eAAe,aAAa,CAAC,IAAI,aAAa,KAAK,CAAC,CAAC,CAAC;EAClE,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,QAAQ,OAAO,IAAI,GAAG;EAC1B,IAAI,CAAC,SAAS,MAAM,MAAM,SAAS;GACjC,QAAQ;IAAE,OAAO;IAAG,SAAS,MAAM;GAAS;GAC5C,IAAI,OAAO,QAAQ,aAAa;IAC9B,MAAM,SAAS,OAAO,KAAK,CAAC,CAAC,KAAK;IAClC,IAAI,CAAC,OAAO,MACV,OAAO,OAAO,OAAO,KAAK;GAE9B;GACA,OAAO,IAAI,KAAK,KAAK;EACvB;EACA,MAAM,SAAS;EACf,IAAI,MAAM,QAAQ,KAAK;GACrB,MAAM,aAAa,KAAK,MAAM,MAAM,UAAU,OAAO,GAAI;GACzD,EAAE,OAAO,eAAe,OAAO,UAAU,CAAC;GAC1C,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;EACnD;EACA,EAAE,OAAO,qBAAqB,OAAO,GAAG,CAAC;EACzC,EAAE,OAAO,yBAAyB,OAAO,KAAK,IAAI,GAAG,MAAM,MAAM,KAAK,CAAC,CAAC;EACxE,MAAM,KAAK;CACb;AACF"}

package/dist/middleware/request-log.mjs

@@ -0,0 +1,30 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/middleware/request-log.ts
+/** Hono middleware logging request start/end with duration. */
+function requestLogging(logger) {
+	return async (c, next) => {
+		const started = performance.now();
+		const id = c.get("requestId");
+		logger.info({
+			reqId: id,
+			method: c.req.method,
+			url: c.req.path
+		}, "request start");
+		await next();
+		const userId = c.get("userId");
+		logger.info({
+			reqId: id,
+			method: c.req.method,
+			url: c.req.path,
+			status: c.res.status,
+			durationMs: Math.round(performance.now() - started),
+			...userId ? { userId } : {}
+		}, "request end");
+	};
+}
+//#endregion
+export { requestLogging };
+
+//# sourceMappingURL=request-log.mjs.map

package/dist/middleware/request-log.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-log.mjs","names":[],"sources":["../../src/middleware/request-log.ts"],"sourcesContent":["import type { Logger } from \"@storyshelf/core/logger\";\nimport type { Context, Next } from \"hono\";\n\n/** Hono middleware logging request start/end with duration. */\nexport function requestLogging(logger: Logger) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const started = performance.now();\n    const id = c.get(\"requestId\");\n    logger.info({ reqId: id, method: c.req.method, url: c.req.path }, \"request start\");\n    await next();\n    const userId = c.get(\"userId\") as string | null | undefined;\n    logger.info(\n      {\n        reqId: id,\n        method: c.req.method,\n        url: c.req.path,\n        status: c.res.status,\n        durationMs: Math.round(performance.now() - started),\n        ...(userId ? { userId } : {}),\n      },\n      \"request end\",\n    );\n  };\n}\n"],"mappings":";;;;;AAIA,SAAgB,eAAe,QAAgB;CAE7C,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,UAAU,YAAY,IAAI;EAChC,MAAM,KAAK,EAAE,IAAI,WAAW;EAC5B,OAAO,KAAK;GAAE,OAAO;GAAI,QAAQ,EAAE,IAAI;GAAQ,KAAK,EAAE,IAAI;EAAK,GAAG,eAAe;EACjF,MAAM,KAAK;EACX,MAAM,SAAS,EAAE,IAAI,QAAQ;EAC7B,OAAO,KACL;GACE,OAAO;GACP,QAAQ,EAAE,IAAI;GACd,KAAK,EAAE,IAAI;GACX,QAAQ,EAAE,IAAI;GACd,YAAY,KAAK,MAAM,YAAY,IAAI,IAAI,OAAO;GAClD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC7B,GACA,aACF;CACF;AACF"}

package/dist/middleware/server-timing.mjs

@@ -0,0 +1,39 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { runWithTimings } from "@storyshelf/core/utils";
+import { setMetric, timing } from "hono/timing";
+//#region src/middleware/server-timing.ts
+/**
+* Opt-in `Server-Timing` response headers over Hono's timing middleware.
+*
+* Enabled only when `ShelfConfig.serverTiming` is true (default off — some
+* deployments prefer no timing headers). The `total` metric matches the
+* `http.server` span; `db`/`storage` are roll-ups of the instrumented
+* adapter calls in this request (same family names as the `db.*` spans;
+* per-operation detail stays in traces). Background capture work never
+* appears here — it has no response; see attempt logs instead.
+*/
+/** Create the Server-Timing middleware (pass-through unless enabled). */
+function serverTiming(enabled) {
+	const inner = timing({
+		total: true,
+		enabled: false
+	});
+	return async (c, next) => {
+		if (!enabled) {
+			await next();
+			return;
+		}
+		const { timings } = await runWithTimings(async () => {
+			await inner(c, next);
+		});
+		for (const [name, ms] of Object.entries(timings).toSorted((a, b) => a[0].localeCompare(b[0]))) setMetric(c, name, ms);
+		const headers = c.get("metric")?.headers ?? [];
+		if (headers.length > 0) c.res.headers.append("Server-Timing", headers.join(","));
+	};
+}
+//#endregion
+export { serverTiming };
+
+//# sourceMappingURL=server-timing.mjs.map

package/dist/middleware/server-timing.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-timing.mjs","names":[],"sources":["../../src/middleware/server-timing.ts"],"sourcesContent":["/**\n * Opt-in `Server-Timing` response headers over Hono's timing middleware.\n *\n * Enabled only when `ShelfConfig.serverTiming` is true (default off — some\n * deployments prefer no timing headers). The `total` metric matches the\n * `http.server` span; `db`/`storage` are roll-ups of the instrumented\n * adapter calls in this request (same family names as the `db.*` spans;\n * per-operation detail stays in traces). Background capture work never\n * appears here — it has no response; see attempt logs instead.\n */\nimport { runWithTimings } from \"@storyshelf/core/utils\";\nimport type { Context, Next } from \"hono\";\nimport { setMetric, timing } from \"hono/timing\";\n\n/** Create the Server-Timing middleware (pass-through unless enabled). */\nexport function serverTiming(enabled: boolean) {\n  const inner = timing({ total: true, enabled: false });\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    if (!enabled) {\n      await next();\n      return;\n    }\n    const { timings } = await runWithTimings(async () => {\n      await inner(c as never, next);\n    });\n    for (const [name, ms] of Object.entries(timings).toSorted((a, b) => a[0].localeCompare(b[0]))) {\n      setMetric(c, name, ms);\n    }\n    const headers = (c.get(\"metric\") as { headers: string[] } | undefined)?.headers ?? [];\n    if (headers.length > 0) {\n      c.res.headers.append(\"Server-Timing\", headers.join(\",\"));\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAeA,SAAgB,aAAa,SAAkB;CAC7C,MAAM,QAAQ,OAAO;EAAE,OAAO;EAAM,SAAS;CAAM,CAAC;CAEpD,OAAO,OAAO,GAAY,SAAyC;EACjE,IAAI,CAAC,SAAS;GACZ,MAAM,KAAK;GACX;EACF;EACA,MAAM,EAAE,YAAY,MAAM,eAAe,YAAY;GACnD,MAAM,MAAM,GAAY,IAAI;EAC9B,CAAC;EACD,KAAK,MAAM,CAAC,MAAM,OAAO,OAAO,QAAQ,OAAO,CAAC,CAAC,UAAU,GAAG,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,GAC1F,UAAU,GAAG,MAAM,EAAE;EAEvB,MAAM,UAAW,EAAE,IAAI,QAAQ,CAAC,EAAwC,WAAW,CAAC;EACpF,IAAI,QAAQ,SAAS,GACnB,EAAE,IAAI,QAAQ,OAAO,iBAAiB,QAAQ,KAAK,GAAG,CAAC;CAE3D;AACF"}

package/dist/middleware/setup-gate.mjs

@@ -0,0 +1,37 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { sanitizeErrorText } from "@storyshelf/core/utils";
+//#region src/middleware/setup-gate.ts
+/** Failures safe to expose on the setup gate's 503 (redacted, no secrets). */
+function publicFailures(result) {
+	return result.failures.map((failure) => ({
+		category: failure.category,
+		kind: failure.kind,
+		error: sanitizeErrorText(failure.error, 500)
+	}));
+}
+/**
+* Block requests until adapter setup settles; answer 503 with the per-adapter
+* failures when setup failed. Health probes and the admin System page are
+* exempt (they report setup state themselves instead of being masked by
+* the gate — both are site-admin-gated where it matters).
+*/
+function setupGate(getReady) {
+	return async (c, next) => {
+		if (c.req.path === "/api/v1/health" || c.req.path === "/admin") {
+			await next();
+			return;
+		}
+		const result = await getReady();
+		if (!result.ok) return c.json({
+			error: "Adapters failed setup",
+			failures: publicFailures(result)
+		}, 503);
+		await next();
+	};
+}
+//#endregion
+export { setupGate };
+
+//# sourceMappingURL=setup-gate.mjs.map

package/dist/middleware/setup-gate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-gate.mjs","names":[],"sources":["../../src/middleware/setup-gate.ts"],"sourcesContent":["import type { AdapterSetupResult } from \"@storyshelf/core/adapter/setup\";\nimport type { ShelfOptions } from \"@storyshelf/core/config\";\nimport { sanitizeErrorText } from \"@storyshelf/core/utils\";\nimport type { Context, Next } from \"hono\";\nimport type { QueueWiring } from \"../capture-setup.ts\";\nimport type { ServerRuntime } from \"../runtime.ts\";\n\nexport interface MiddlewareWiring extends ServerRuntime, QueueWiring {\n  options: ShelfOptions;\n  getReady: () => Promise<AdapterSetupResult>;\n}\n\n/** Failures safe to expose on the setup gate's 503 (redacted, no secrets). */\nfunction publicFailures(\n  result: AdapterSetupResult,\n): { category: string; kind: string; error: string }[] {\n  return result.failures.map((failure) => ({\n    category: failure.category,\n    kind: failure.kind,\n    error: sanitizeErrorText(failure.error, 500),\n  }));\n}\n\n/**\n * Block requests until adapter setup settles; answer 503 with the per-adapter\n * failures when setup failed. Health probes and the admin System page are\n * exempt (they report setup state themselves instead of being masked by\n * the gate — both are site-admin-gated where it matters).\n */\nexport function setupGate(getReady: () => Promise<AdapterSetupResult>) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    if (c.req.path === \"/api/v1/health\" || c.req.path === \"/admin\") {\n      await next();\n      return;\n    }\n    const result = await getReady();\n    if (!result.ok) {\n      return c.json({ error: \"Adapters failed setup\", failures: publicFailures(result) }, 503);\n    }\n    await next();\n  };\n}\n"],"mappings":";;;;;;AAaA,SAAS,eACP,QACqD;CACrD,OAAO,OAAO,SAAS,KAAK,aAAa;EACvC,UAAU,QAAQ;EAClB,MAAM,QAAQ;EACd,OAAO,kBAAkB,QAAQ,OAAO,GAAG;CAC7C,EAAE;AACJ;;;;;;;AAQA,SAAgB,UAAU,UAA6C;CAErE,OAAO,OAAO,GAAY,SAAyC;EACjE,IAAI,EAAE,IAAI,SAAS,oBAAoB,EAAE,IAAI,SAAS,UAAU;GAC9D,MAAM,KAAK;GACX;EACF;EACA,MAAM,SAAS,MAAM,SAAS;EAC9B,IAAI,CAAC,OAAO,IACV,OAAO,EAAE,KAAK;GAAE,OAAO;GAAyB,UAAU,eAAe,MAAM;EAAE,GAAG,GAAG;EAEzF,MAAM,KAAK;CACb;AACF"}

package/dist/middleware/store-scope.mjs

@@ -0,0 +1,33 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { runWithStore } from "../store.mjs";
+import { sessionIdFrom } from "./csrf.mjs";
+//#region src/middleware/store-scope.ts
+/** Hono middleware running downstream handlers inside the request store. */
+function storeScope(deps) {
+	return async (c, next) => {
+		const user = await deps.resolveUser(c);
+		c.set("userId", user?.id ?? null);
+		await runWithStore({
+			db: deps.db,
+			storage: deps.storage,
+			config: deps.config,
+			ui: deps.ui,
+			logger: deps.logger,
+			user,
+			authEnabled: deps.authEnabled,
+			sessionId: sessionIdFrom(c),
+			enqueueCapture: deps.enqueueCapture,
+			captureQueue: deps.captureQueue,
+			gitHosts: deps.gitHosts,
+			notifiers: deps.notifiers
+		}, async () => {
+			await next();
+		});
+	};
+}
+//#endregion
+export { storeScope };
+
+//# sourceMappingURL=store-scope.mjs.map

package/dist/middleware/store-scope.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-scope.mjs","names":[],"sources":["../../src/middleware/store-scope.ts"],"sourcesContent":["import type { CaptureQueue } from \"@storyshelf/core/adapter/capture-queue\";\nimport type { DatabaseAdapter } from \"@storyshelf/core/adapter/database\";\nimport type { GitHostProvider } from \"@storyshelf/core/adapter/git-host\";\nimport type { NotifierProvider } from \"@storyshelf/core/adapter/notifier\";\nimport type { StorageAdapter } from \"@storyshelf/core/adapter/storage\";\nimport type { ShelfConfig, UIConfig } from \"@storyshelf/core/config\";\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport type { AuthUser } from \"@storyshelf/core/types\";\nimport type { Context, Next } from \"hono\";\nimport { runWithStore } from \"../store.ts\";\nimport { sessionIdFrom } from \"./csrf.ts\";\n\n/** Dependencies scoped into the request store for router handlers. */\nexport interface StoreScopeDeps {\n  db: DatabaseAdapter;\n  storage: StorageAdapter;\n  config: ShelfConfig;\n  ui: UIConfig;\n  logger: Logger;\n  authEnabled: boolean;\n  enqueueCapture?: (buildId: string, reqId?: string) => Promise<void>;\n  captureQueue: CaptureQueue | null;\n  gitHosts: GitHostProvider[];\n  notifiers: NotifierProvider[];\n  resolveUser: (c: Context) => Promise<AuthUser | null>;\n}\n\n/** Hono middleware running downstream handlers inside the request store. */\nexport function storeScope(deps: StoreScopeDeps) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const user = await deps.resolveUser(c);\n    c.set(\"userId\", user?.id ?? null);\n    await runWithStore(\n      {\n        db: deps.db,\n        storage: deps.storage,\n        config: deps.config,\n        ui: deps.ui,\n        logger: deps.logger,\n        user,\n        authEnabled: deps.authEnabled,\n        sessionId: sessionIdFrom(c),\n        enqueueCapture: deps.enqueueCapture,\n        captureQueue: deps.captureQueue,\n        gitHosts: deps.gitHosts,\n        notifiers: deps.notifiers,\n      },\n      async () => {\n        await next();\n      },\n    );\n  };\n}\n"],"mappings":";;;;;;;AA4BA,SAAgB,WAAW,MAAsB;CAE/C,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,OAAO,MAAM,KAAK,YAAY,CAAC;EACrC,EAAE,IAAI,UAAU,MAAM,MAAM,IAAI;EAChC,MAAM,aACJ;GACE,IAAI,KAAK;GACT,SAAS,KAAK;GACd,QAAQ,KAAK;GACb,IAAI,KAAK;GACT,QAAQ,KAAK;GACb;GACA,aAAa,KAAK;GAClB,WAAW,cAAc,CAAC;GAC1B,gBAAgB,KAAK;GACrB,cAAc,KAAK;GACnB,UAAU,KAAK;GACf,WAAW,KAAK;EAClB,GACA,YAAY;GACV,MAAM,KAAK;EACb,CACF;CACF;AACF"}

package/dist/notify.d.mts

@@ -0,0 +1,17 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { NotifierProvider } from "@storyshelf/core/adapter/notifier";
+import { ShelfConfig, UIConfig } from "@storyshelf/core/config";
+import { Logger } from "@storyshelf/core/logger";
+import { DatabaseAdapter } from "@storyshelf/core/adapter/database";
+import "@storyshelf/core/schema";
+//#region src/notify.d.ts
+/**
+ * Host hook for the auth engine (`onAuthSystemEvent`): fans `sys:*` auth
+ * events out to admin channels. Safe to call anywhere — outside a request
+ * scope (e.g. boot) it resolves to a no-op instead of throwing.
+ */
+declare function createAuthSystemHook(): (event: "sys:user-created" | "sys:invite-issued", data: Record<string, unknown>) => Promise<void>;
+//#endregion
+export { createAuthSystemHook };
+//# sourceMappingURL=notify.d.mts.map