@storyshelf/app 0.6.2 → 0.7.0

package/dist/routers/insights.mjs

@@ -0,0 +1,189 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { failWith } from "../insights/errors.mjs";
+import { notFound } from "./helpers.mjs";
+import { badRequest, errorSchema, healthRequestSchema, insightRequestSchema, insightSchema, notFound as notFound$1, unauthorized } from "./schemas.mjs";
+import { buildForProject } from "./builds.handlers.mjs";
+import { freshen } from "../insights/stale.mjs";
+import { toInsightView } from "../insights/view.mjs";
+import { requestHealth, requestTriage } from "../insights/request.mjs";
+import { isSiteAdmin, projectForRegenerate, projectForView } from "./insights.handlers.mjs";
+import { createRoute, z } from "@hono/zod-openapi";
+import { InsightModel } from "@storyshelf/core/models";
+//#region src/routers/insights.ts
+const BUILD_PARAMS = z.object({
+	slug: z.string(),
+	buildId: z.string()
+});
+const json = (schema) => ({ content: { "application/json": { schema } } });
+const guardResponses = {
+	501: {
+		...json(errorSchema),
+		description: "AI is not configured on this server (ai-disabled)"
+	},
+	409: {
+		...json(errorSchema),
+		description: "AI is disabled for this project"
+	},
+	...notFound$1,
+	...unauthorized
+};
+const latestRoute = createRoute({
+	method: "get",
+	tags: ["Insights"],
+	summary: "Latest build triage",
+	path: "/api/v1/projects/{slug}/builds/{buildId}/insights/latest",
+	request: { params: BUILD_PARAMS },
+	responses: {
+		200: {
+			...json(insightSchema),
+			description: "Latest triage"
+		},
+		...guardResponses
+	}
+});
+const listRoute = createRoute({
+	method: "get",
+	tags: ["Insights"],
+	summary: "Build triage history",
+	path: "/api/v1/projects/{slug}/builds/{buildId}/insights",
+	request: {
+		params: BUILD_PARAMS,
+		query: z.object({ limit: z.coerce.number().int().min(1).max(50).optional() })
+	},
+	responses: {
+		200: {
+			...json(insightSchema.array()),
+			description: "Triage history"
+		},
+		...guardResponses
+	}
+});
+const generateRoute = createRoute({
+	method: "post",
+	tags: ["Insights"],
+	summary: "Generate a build triage",
+	path: "/api/v1/projects/{slug}/builds/{buildId}/insights",
+	request: {
+		params: BUILD_PARAMS,
+		body: { content: { "application/json": { schema: insightRequestSchema } } }
+	},
+	responses: {
+		200: {
+			...json(insightSchema),
+			description: "Cached insight (unbilled)"
+		},
+		202: {
+			...json(insightSchema),
+			description: "Generation started; poll the latest endpoint"
+		},
+		429: {
+			...json(errorSchema),
+			description: "Budget or rate limit reached (see Retry-After)"
+		},
+		...guardResponses
+	}
+});
+const healthGetRoute = createRoute({
+	method: "get",
+	tags: ["Insights"],
+	summary: "Project health digest",
+	path: "/api/v1/projects/{slug}/insights/health",
+	request: {
+		params: z.object({ slug: z.string() }),
+		query: z.object({ window: z.string().optional() })
+	},
+	responses: {
+		200: {
+			...json(insightSchema),
+			description: "Cached digest"
+		},
+		...guardResponses
+	}
+});
+const healthPostRoute = createRoute({
+	method: "post",
+	tags: ["Insights"],
+	summary: "Generate a project health digest",
+	path: "/api/v1/projects/{slug}/insights/health",
+	request: {
+		params: z.object({ slug: z.string() }),
+		body: { content: { "application/json": { schema: healthRequestSchema } } }
+	},
+	responses: {
+		200: {
+			...json(insightSchema),
+			description: "Cached digest (unbilled)"
+		},
+		202: {
+			...json(insightSchema),
+			description: "Generation started"
+		},
+		429: {
+			...json(errorSchema),
+			description: "Budget or rate limit reached (see Retry-After)"
+		},
+		...badRequest,
+		...guardResponses
+	}
+});
+/** Register the build triage endpoints. */
+function registerBuildInsights(app) {
+	app.openapi(latestRoute, async (c) => {
+		const { slug, buildId } = c.req.valid("param");
+		const { deps, project } = await projectForView(c, slug);
+		const build = await buildForProject(project.id, buildId);
+		const [latest] = await new InsightModel(deps.db).listForBuild(build.id, 1);
+		return latest ? c.json(toInsightView(await freshen(deps, latest)), 200) : notFound("never-generated: POST to this build's insights to create one");
+	});
+	app.openapi(listRoute, async (c) => {
+		const { slug, buildId } = c.req.valid("param");
+		const { limit } = c.req.valid("query");
+		const { deps, project } = await projectForView(c, slug);
+		const build = await buildForProject(project.id, buildId);
+		const rows = await new InsightModel(deps.db).listForBuild(build.id, limit ?? 20);
+		return c.json(await Promise.all(rows.map(async (row) => toInsightView(await freshen(deps, row)))), 200);
+	});
+	app.openapi(generateRoute, async (c) => {
+		const { slug, buildId } = c.req.valid("param");
+		const body = c.req.valid("json");
+		const { deps, project } = await projectForRegenerate(c, slug);
+		const build = await buildForProject(project.id, buildId);
+		const outcome = await requestTriage(deps, project, build, {
+			force: body.force ?? false,
+			profile: isSiteAdmin(c) ? body.profile : void 0
+		});
+		const view = toInsightView(outcome.row);
+		return outcome.status === 200 ? c.json(view, 200) : c.json(view, 202, { location: `/api/v1/projects/${slug}/builds/${build.id}/insights/latest` });
+	});
+}
+/** Register the project-health endpoints. */
+function registerHealthInsights(app) {
+	app.openapi(healthGetRoute, async (c) => {
+		const { slug } = c.req.valid("param");
+		const { window } = c.req.valid("query");
+		const { deps, project } = await projectForView(c, slug);
+		const row = await new InsightModel(deps.db).getHealth(project.id, window ?? "30d");
+		return row ? c.json(toInsightView(await freshen(deps, row)), 200) : notFound("never-generated: POST to create a health digest");
+	});
+	app.openapi(healthPostRoute, async (c) => {
+		const { slug } = c.req.valid("param");
+		const body = c.req.valid("json");
+		const { deps, project } = await projectForRegenerate(c, slug);
+		const window = body.window ?? "30d";
+		const outcome = await requestHealth(deps, project, window, { force: body.force ?? false });
+		if (!outcome) failWith(400, "window must look like 30d (1-365 days)");
+		const view = toInsightView(outcome.row);
+		return outcome.status === 200 ? c.json(view, 200) : c.json(view, 202, { location: `/api/v1/projects/${slug}/insights/health?window=${window}` });
+	});
+}
+/** Register the AI insights endpoints (build triage and project health). */
+function registerInsights(app) {
+	registerBuildInsights(app);
+	registerHealthInsights(app);
+}
+//#endregion
+export { registerInsights };
+
+//# sourceMappingURL=insights.mjs.map

package/dist/routers/insights.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"insights.mjs","names":["notFound","throwNotFound"],"sources":["../../src/routers/insights.ts"],"sourcesContent":["import { createRoute, z } from \"@hono/zod-openapi\";\nimport { InsightModel } from \"@storyshelf/core/models\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { failWith } from \"../insights/errors.ts\";\nimport { requestHealth, requestTriage } from \"../insights/request.ts\";\nimport { freshen } from \"../insights/stale.ts\";\nimport { toInsightView } from \"../insights/view.ts\";\nimport { buildForProject } from \"./builds.handlers.ts\";\nimport { notFound as throwNotFound } from \"./helpers.ts\";\nimport { isSiteAdmin, projectForRegenerate, projectForView } from \"./insights.handlers.ts\";\nimport {\n  badRequest,\n  errorSchema,\n  healthRequestSchema,\n  insightRequestSchema,\n  insightSchema,\n  notFound,\n  unauthorized,\n} from \"./schemas.ts\";\n\nconst BUILD_PARAMS = z.object({ slug: z.string(), buildId: z.string() });\nconst json = (schema: z.ZodType): { content: { \"application/json\": { schema: z.ZodType } } } => ({\n  content: { \"application/json\": { schema } },\n});\nconst guardResponses = {\n  501: { ...json(errorSchema), description: \"AI is not configured on this server (ai-disabled)\" },\n  409: { ...json(errorSchema), description: \"AI is disabled for this project\" },\n  ...notFound,\n  ...unauthorized,\n} as const;\n\nconst latestRoute = createRoute({\n  method: \"get\",\n  tags: [\"Insights\"],\n  summary: \"Latest build triage\",\n  path: \"/api/v1/projects/{slug}/builds/{buildId}/insights/latest\",\n  request: { params: BUILD_PARAMS },\n  responses: { 200: { ...json(insightSchema), description: \"Latest triage\" }, ...guardResponses },\n});\n\nconst listRoute = createRoute({\n  method: \"get\",\n  tags: [\"Insights\"],\n  summary: \"Build triage history\",\n  path: \"/api/v1/projects/{slug}/builds/{buildId}/insights\",\n  request: {\n    params: BUILD_PARAMS,\n    query: z.object({ limit: z.coerce.number().int().min(1).max(50).optional() }),\n  },\n  responses: {\n    200: { ...json(insightSchema.array()), description: \"Triage history\" },\n    ...guardResponses,\n  },\n});\n\nconst generateRoute = createRoute({\n  method: \"post\",\n  tags: [\"Insights\"],\n  summary: \"Generate a build triage\",\n  path: \"/api/v1/projects/{slug}/builds/{buildId}/insights\",\n  request: {\n    params: BUILD_PARAMS,\n    body: { content: { \"application/json\": { schema: insightRequestSchema } } },\n  },\n  responses: {\n    200: { ...json(insightSchema), description: \"Cached insight (unbilled)\" },\n    202: { ...json(insightSchema), description: \"Generation started; poll the latest endpoint\" },\n    429: { ...json(errorSchema), description: \"Budget or rate limit reached (see Retry-After)\" },\n    ...guardResponses,\n  },\n});\n\nconst healthGetRoute = createRoute({\n  method: \"get\",\n  tags: [\"Insights\"],\n  summary: \"Project health digest\",\n  path: \"/api/v1/projects/{slug}/insights/health\",\n  request: {\n    params: z.object({ slug: z.string() }),\n    query: z.object({ window: z.string().optional() }),\n  },\n  responses: { 200: { ...json(insightSchema), description: \"Cached digest\" }, ...guardResponses },\n});\n\nconst healthPostRoute = createRoute({\n  method: \"post\",\n  tags: [\"Insights\"],\n  summary: \"Generate a project health digest\",\n  path: \"/api/v1/projects/{slug}/insights/health\",\n  request: {\n    params: z.object({ slug: z.string() }),\n    body: { content: { \"application/json\": { schema: healthRequestSchema } } },\n  },\n  responses: {\n    200: { ...json(insightSchema), description: \"Cached digest (unbilled)\" },\n    202: { ...json(insightSchema), description: \"Generation started\" },\n    429: { ...json(errorSchema), description: \"Budget or rate limit reached (see Retry-After)\" },\n    ...badRequest,\n    ...guardResponses,\n  },\n});\n\n/** Register the build triage endpoints. */\nfunction registerBuildInsights(app: ShelfRouter): void {\n  app.openapi(latestRoute, async (c) => {\n    const { slug, buildId } = c.req.valid(\"param\");\n    const { deps, project } = await projectForView(c, slug);\n    const build = await buildForProject(project.id, buildId);\n    const [latest] = await new InsightModel(deps.db).listForBuild(build.id, 1);\n    return latest\n      ? c.json(toInsightView(await freshen(deps, latest)), 200)\n      : throwNotFound(\"never-generated: POST to this build's insights to create one\");\n  });\n\n  app.openapi(listRoute, async (c) => {\n    const { slug, buildId } = c.req.valid(\"param\");\n    const { limit } = c.req.valid(\"query\");\n    const { deps, project } = await projectForView(c, slug);\n    const build = await buildForProject(project.id, buildId);\n    const rows = await new InsightModel(deps.db).listForBuild(build.id, limit ?? 20);\n    return c.json(\n      await Promise.all(rows.map(async (row) => toInsightView(await freshen(deps, row)))),\n      200,\n    );\n  });\n\n  app.openapi(generateRoute, async (c) => {\n    const { slug, buildId } = c.req.valid(\"param\");\n    const body = c.req.valid(\"json\");\n    const { deps, project } = await projectForRegenerate(c, slug);\n    const build = await buildForProject(project.id, buildId);\n    const outcome = await requestTriage(deps, project, build, {\n      force: body.force ?? false,\n      profile: isSiteAdmin(c) ? body.profile : undefined,\n    });\n    const view = toInsightView(outcome.row);\n    return outcome.status === 200\n      ? c.json(view, 200)\n      : c.json(view, 202, {\n          location: `/api/v1/projects/${slug}/builds/${build.id}/insights/latest`,\n        });\n  });\n}\n\n/** Register the project-health endpoints. */\nfunction registerHealthInsights(app: ShelfRouter): void {\n  app.openapi(healthGetRoute, async (c) => {\n    const { slug } = c.req.valid(\"param\");\n    const { window } = c.req.valid(\"query\");\n    const { deps, project } = await projectForView(c, slug);\n    const row = await new InsightModel(deps.db).getHealth(project.id, window ?? \"30d\");\n    return row\n      ? c.json(toInsightView(await freshen(deps, row)), 200)\n      : throwNotFound(\"never-generated: POST to create a health digest\");\n  });\n\n  app.openapi(healthPostRoute, async (c) => {\n    const { slug } = c.req.valid(\"param\");\n    const body = c.req.valid(\"json\");\n    const { deps, project } = await projectForRegenerate(c, slug);\n    const window = body.window ?? \"30d\";\n    const outcome = await requestHealth(deps, project, window, { force: body.force ?? false });\n    if (!outcome) {\n      failWith(400, \"window must look like 30d (1-365 days)\");\n    }\n    const view = toInsightView(outcome.row);\n    return outcome.status === 200\n      ? c.json(view, 200)\n      : c.json(view, 202, {\n          location: `/api/v1/projects/${slug}/insights/health?window=${window}`,\n        });\n  });\n}\n\n/** Register the AI insights endpoints (build triage and project health). */\nexport function registerInsights(app: ShelfRouter): void {\n  registerBuildInsights(app);\n  registerHealthInsights(app);\n}\n"],"mappings":";;;;;;;;;;;;;;AAoBA,MAAM,eAAe,EAAE,OAAO;CAAE,MAAM,EAAE,OAAO;CAAG,SAAS,EAAE,OAAO;AAAE,CAAC;AACvE,MAAM,QAAQ,YAAmF,EAC/F,SAAS,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAC5C;AACA,MAAM,iBAAiB;CACrB,KAAK;EAAE,GAAG,KAAK,WAAW;EAAG,aAAa;CAAoD;CAC9F,KAAK;EAAE,GAAG,KAAK,WAAW;EAAG,aAAa;CAAkC;CAC5E,GAAGA;CACH,GAAG;AACL;AAEA,MAAM,cAAc,YAAY;CAC9B,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,aAAa;CAChC,WAAW;EAAE,KAAK;GAAE,GAAG,KAAK,aAAa;GAAG,aAAa;EAAgB;EAAG,GAAG;CAAe;AAChG,CAAC;AAED,MAAM,YAAY,YAAY;CAC5B,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ;EACR,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;CAC9E;CACA,WAAW;EACT,KAAK;GAAE,GAAG,KAAK,cAAc,MAAM,CAAC;GAAG,aAAa;EAAiB;EACrE,GAAG;CACL;AACF,CAAC;AAED,MAAM,gBAAgB,YAAY;CAChC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ;EACR,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,qBAAqB,EAAE,EAAE;CAC5E;CACA,WAAW;EACT,KAAK;GAAE,GAAG,KAAK,aAAa;GAAG,aAAa;EAA4B;EACxE,KAAK;GAAE,GAAG,KAAK,aAAa;GAAG,aAAa;EAA+C;EAC3F,KAAK;GAAE,GAAG,KAAK,WAAW;GAAG,aAAa;EAAiD;EAC3F,GAAG;CACL;AACF,CAAC;AAED,MAAM,iBAAiB,YAAY;CACjC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;EACrC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;CACnD;CACA,WAAW;EAAE,KAAK;GAAE,GAAG,KAAK,aAAa;GAAG,aAAa;EAAgB;EAAG,GAAG;CAAe;AAChG,CAAC;AAED,MAAM,kBAAkB,YAAY;CAClC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;EACrC,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE,EAAE;CAC3E;CACA,WAAW;EACT,KAAK;GAAE,GAAG,KAAK,aAAa;GAAG,aAAa;EAA2B;EACvE,KAAK;GAAE,GAAG,KAAK,aAAa;GAAG,aAAa;EAAqB;EACjE,KAAK;GAAE,GAAG,KAAK,WAAW;GAAG,aAAa;EAAiD;EAC3F,GAAG;EACH,GAAG;CACL;AACF,CAAC;;AAGD,SAAS,sBAAsB,KAAwB;CACrD,IAAI,QAAQ,aAAa,OAAO,MAAM;EACpC,MAAM,EAAE,MAAM,YAAY,EAAE,IAAI,MAAM,OAAO;EAC7C,MAAM,EAAE,MAAM,YAAY,MAAM,eAAe,GAAG,IAAI;EACtD,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,IAAI,OAAO;EACvD,MAAM,CAAC,UAAU,MAAM,IAAI,aAAa,KAAK,EAAE,CAAC,CAAC,aAAa,MAAM,IAAI,CAAC;EACzE,OAAO,SACH,EAAE,KAAK,cAAc,MAAM,QAAQ,MAAM,MAAM,CAAC,GAAG,GAAG,IACtDC,SAAc,8DAA8D;CAClF,CAAC;CAED,IAAI,QAAQ,WAAW,OAAO,MAAM;EAClC,MAAM,EAAE,MAAM,YAAY,EAAE,IAAI,MAAM,OAAO;EAC7C,MAAM,EAAE,UAAU,EAAE,IAAI,MAAM,OAAO;EACrC,MAAM,EAAE,MAAM,YAAY,MAAM,eAAe,GAAG,IAAI;EACtD,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,IAAI,OAAO;EACvD,MAAM,OAAO,MAAM,IAAI,aAAa,KAAK,EAAE,CAAC,CAAC,aAAa,MAAM,IAAI,SAAS,EAAE;EAC/E,OAAO,EAAE,KACP,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAO,QAAQ,cAAc,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,CAAC,GAClF,GACF;CACF,CAAC;CAED,IAAI,QAAQ,eAAe,OAAO,MAAM;EACtC,MAAM,EAAE,MAAM,YAAY,EAAE,IAAI,MAAM,OAAO;EAC7C,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,MAAM,EAAE,MAAM,YAAY,MAAM,qBAAqB,GAAG,IAAI;EAC5D,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,IAAI,OAAO;EACvD,MAAM,UAAU,MAAM,cAAc,MAAM,SAAS,OAAO;GACxD,OAAO,KAAK,SAAS;GACrB,SAAS,YAAY,CAAC,IAAI,KAAK,UAAU,KAAA;EAC3C,CAAC;EACD,MAAM,OAAO,cAAc,QAAQ,GAAG;EACtC,OAAO,QAAQ,WAAW,MACtB,EAAE,KAAK,MAAM,GAAG,IAChB,EAAE,KAAK,MAAM,KAAK,EAChB,UAAU,oBAAoB,KAAK,UAAU,MAAM,GAAG,kBACxD,CAAC;CACP,CAAC;AACH;;AAGA,SAAS,uBAAuB,KAAwB;CACtD,IAAI,QAAQ,gBAAgB,OAAO,MAAM;EACvC,MAAM,EAAE,SAAS,EAAE,IAAI,MAAM,OAAO;EACpC,MAAM,EAAE,WAAW,EAAE,IAAI,MAAM,OAAO;EACtC,MAAM,EAAE,MAAM,YAAY,MAAM,eAAe,GAAG,IAAI;EACtD,MAAM,MAAM,MAAM,IAAI,aAAa,KAAK,EAAE,CAAC,CAAC,UAAU,QAAQ,IAAI,UAAU,KAAK;EACjF,OAAO,MACH,EAAE,KAAK,cAAc,MAAM,QAAQ,MAAM,GAAG,CAAC,GAAG,GAAG,IACnDA,SAAc,iDAAiD;CACrE,CAAC;CAED,IAAI,QAAQ,iBAAiB,OAAO,MAAM;EACxC,MAAM,EAAE,SAAS,EAAE,IAAI,MAAM,OAAO;EACpC,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,MAAM,EAAE,MAAM,YAAY,MAAM,qBAAqB,GAAG,IAAI;EAC5D,MAAM,SAAS,KAAK,UAAU;EAC9B,MAAM,UAAU,MAAM,cAAc,MAAM,SAAS,QAAQ,EAAE,OAAO,KAAK,SAAS,MAAM,CAAC;EACzF,IAAI,CAAC,SACH,SAAS,KAAK,wCAAwC;EAExD,MAAM,OAAO,cAAc,QAAQ,GAAG;EACtC,OAAO,QAAQ,WAAW,MACtB,EAAE,KAAK,MAAM,GAAG,IAChB,EAAE,KAAK,MAAM,KAAK,EAChB,UAAU,oBAAoB,KAAK,0BAA0B,SAC/D,CAAC;CACP,CAAC;AACH;;AAGA,SAAgB,iBAAiB,KAAwB;CACvD,sBAAsB,GAAG;CACzB,uBAAuB,GAAG;AAC5B"}

package/dist/routers/links.handlers.mjs

@@ -0,0 +1,80 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { catalogOf, getStore } from "../store.mjs";
+import { resolveAuthorizedProject } from "./helpers.mjs";
+import { BuildModel, PackageUsageModel, ProjectModel, SnapshotModel, matchUpstreamStory } from "@storyshelf/core/models";
+//#region src/routers/links.handlers.ts
+const VIEW_ROLES = [
+	"viewer",
+	"developer",
+	"approver",
+	"admin"
+];
+/**
+* Upstream project resolved from its latest approved default build: its stories from the build's
+* snapshots when it has them, from its Storybook catalog otherwise (a hosting-only build).
+*/
+async function resolveUpstream(upstream) {
+	const build = await new BuildModel(getStore().db).latestApprovedDefault(upstream);
+	const stories = (build ? await new SnapshotModel(getStore().db).listByBuild(build.id) : []).flatMap((snapshot) => snapshot.storyImportPath ? [{
+		importPath: snapshot.storyImportPath,
+		storyId: snapshot.storyId
+	}] : []);
+	return {
+		slug: upstream.slug,
+		buildId: build?.id ?? null,
+		stories: stories.length > 0 || !build ? stories : await catalogStories(upstream, build.id)
+	};
+}
+async function catalogStories(upstream, buildId) {
+	return ((await catalogOf().load(upstream.id, buildId).catch(() => null))?.entries ?? []).flatMap((entry) => entry.type === "story" && entry.importPath ? [{
+		importPath: entry.importPath,
+		storyId: entry.id
+	}] : []);
+}
+/** Resolve each linked package once; upstreams the viewer cannot open are omitted. */
+async function resolveLinkedUpstreams(c, project, packages) {
+	const links = (await new PackageUsageModel(getStore().db).listLinks(project.id)).filter((link) => packages.has(link.packageName));
+	const resolved = await Promise.all(links.map(async (link) => {
+		const upstream = await new ProjectModel(getStore().db).get(link.upstreamId);
+		const visible = upstream ? await resolveAuthorizedProject(c, upstream.slug, ...VIEW_ROLES).catch(() => null) : null;
+		return upstream && visible ? [link.packageName, await resolveUpstream(upstream)] : null;
+	}));
+	return new Map(resolved.filter((entry) => entry !== null));
+}
+/**
+* Linked-package usage grouped by story file, resolved with one pass over the
+* build's usage rows and one lookup per linked upstream (never per story).
+* Omits upstreams the viewer cannot open; pass `storyImportPath` to narrow to one story.
+*/
+async function linkedUsageByStory(c, project, buildId, storyImportPath) {
+	const model = new PackageUsageModel(getStore().db);
+	const rows = storyImportPath ? await model.listForStory(buildId, storyImportPath) : await model.listForBuild(buildId);
+	const upstreams = await resolveLinkedUpstreams(c, project, new Set(rows.map((row) => row.packageName)));
+	const byStory = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const upstream = upstreams.get(row.packageName);
+		if (upstream) {
+			const upstreamStoryId = matchUpstreamStory(row.modulePath, upstream.stories);
+			byStory.set(row.storyImportPath, [...byStory.get(row.storyImportPath) ?? [], {
+				package: row.packageName,
+				version: row.version,
+				upstreamSlug: upstream.slug,
+				upstreamBuildId: upstream.buildId,
+				upstreamStoryId,
+				upstreamImportPath: upstream.stories.find((story) => story.storyId === upstreamStoryId)?.importPath ?? null
+			}]);
+		}
+	}
+	return byStory;
+}
+/** Linked-package usage of one story, omitting upstreams the viewer cannot open. */
+async function linkedUsageFor(c, project, buildId, storyImportPath) {
+	if (!storyImportPath) return [];
+	return (await linkedUsageByStory(c, project, buildId, storyImportPath)).get(storyImportPath) ?? [];
+}
+//#endregion
+export { linkedUsageByStory, linkedUsageFor };
+
+//# sourceMappingURL=links.handlers.mjs.map

package/dist/routers/links.handlers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"links.handlers.mjs","names":[],"sources":["../../src/routers/links.handlers.ts"],"sourcesContent":["import {\n  BuildModel,\n  matchUpstreamStory,\n  PackageUsageModel,\n  ProjectModel,\n  SnapshotModel,\n} from \"@storyshelf/core/models\";\nimport type { Project } from \"@storyshelf/core/schema\";\nimport type { ProjectRole } from \"@storyshelf/core/types\";\nimport type { LinkedUsageItem } from \"../pages/build-diff-usage.tsx\";\nimport { catalogOf, getStore } from \"../store.ts\";\nimport { resolveAuthorizedProject } from \"./helpers.ts\";\n\nconst VIEW_ROLES: readonly ProjectRole[] = [\"viewer\", \"developer\", \"approver\", \"admin\"];\n\ntype Caller = Parameters<typeof resolveAuthorizedProject>[0];\n\n/** What a link resolves to: the upstream project's latest published build and its stories. */\ninterface ResolvedUpstream {\n  slug: string;\n  buildId: string | null;\n  stories: { importPath: string; storyId: string }[];\n}\n\n/**\n * Upstream project resolved from its latest approved default build: its stories from the build's\n * snapshots when it has them, from its Storybook catalog otherwise (a hosting-only build).\n */\nasync function resolveUpstream(upstream: Project): Promise<ResolvedUpstream> {\n  const build = await new BuildModel(getStore().db).latestApprovedDefault(upstream);\n  const snapshots = build ? await new SnapshotModel(getStore().db).listByBuild(build.id) : [];\n  const stories = snapshots.flatMap((snapshot) =>\n    snapshot.storyImportPath\n      ? [{ importPath: snapshot.storyImportPath, storyId: snapshot.storyId }]\n      : [],\n  );\n  return {\n    slug: upstream.slug,\n    buildId: build?.id ?? null,\n    stories: stories.length > 0 || !build ? stories : await catalogStories(upstream, build.id),\n  };\n}\n\nasync function catalogStories(\n  upstream: Project,\n  buildId: string,\n): Promise<ResolvedUpstream[\"stories\"]> {\n  const catalog = await catalogOf()\n    .load(upstream.id, buildId)\n    .catch(() => null);\n  return (catalog?.entries ?? []).flatMap((entry) =>\n    entry.type === \"story\" && entry.importPath\n      ? [{ importPath: entry.importPath, storyId: entry.id }]\n      : [],\n  );\n}\n\n/** Resolve each linked package once; upstreams the viewer cannot open are omitted. */\nasync function resolveLinkedUpstreams(\n  c: Caller,\n  project: Project,\n  packages: Set<string>,\n): Promise<Map<string, ResolvedUpstream>> {\n  const links = (await new PackageUsageModel(getStore().db).listLinks(project.id)).filter((link) =>\n    packages.has(link.packageName),\n  );\n  const resolved = await Promise.all(\n    links.map(async (link) => {\n      const upstream = await new ProjectModel(getStore().db).get(link.upstreamId);\n      const visible = upstream\n        ? await resolveAuthorizedProject(c, upstream.slug, ...VIEW_ROLES).catch(() => null)\n        : null;\n      return upstream && visible\n        ? ([link.packageName, await resolveUpstream(upstream)] as const)\n        : null;\n    }),\n  );\n  return new Map(resolved.filter((entry) => entry !== null));\n}\n\n/**\n * Linked-package usage grouped by story file, resolved with one pass over the\n * build's usage rows and one lookup per linked upstream (never per story).\n * Omits upstreams the viewer cannot open; pass `storyImportPath` to narrow to one story.\n */\nexport async function linkedUsageByStory(\n  c: Caller,\n  project: Project,\n  buildId: string,\n  storyImportPath?: string,\n): Promise<Map<string, LinkedUsageItem[]>> {\n  const model = new PackageUsageModel(getStore().db);\n  const rows = storyImportPath\n    ? await model.listForStory(buildId, storyImportPath)\n    : await model.listForBuild(buildId);\n  const upstreams = await resolveLinkedUpstreams(\n    c,\n    project,\n    new Set(rows.map((row) => row.packageName)),\n  );\n  const byStory = new Map<string, LinkedUsageItem[]>();\n  for (const row of rows) {\n    const upstream = upstreams.get(row.packageName);\n    if (upstream) {\n      const upstreamStoryId = matchUpstreamStory(row.modulePath, upstream.stories);\n      byStory.set(row.storyImportPath, [\n        ...(byStory.get(row.storyImportPath) ?? []),\n        {\n          package: row.packageName,\n          version: row.version,\n          upstreamSlug: upstream.slug,\n          upstreamBuildId: upstream.buildId,\n          upstreamStoryId,\n          upstreamImportPath:\n            upstream.stories.find((story) => story.storyId === upstreamStoryId)?.importPath ?? null,\n        },\n      ]);\n    }\n  }\n  return byStory;\n}\n\n/** Linked-package usage of one story, omitting upstreams the viewer cannot open. */\nexport async function linkedUsageFor(\n  c: Caller,\n  project: Project,\n  buildId: string,\n  storyImportPath: string | null,\n): Promise<LinkedUsageItem[]> {\n  if (!storyImportPath) {\n    return [];\n  }\n  return (\n    (await linkedUsageByStory(c, project, buildId, storyImportPath)).get(storyImportPath) ?? []\n  );\n}\n"],"mappings":";;;;;;;AAaA,MAAM,aAAqC;CAAC;CAAU;CAAa;CAAY;AAAO;;;;;AAetF,eAAe,gBAAgB,UAA8C;CAC3E,MAAM,QAAQ,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,sBAAsB,QAAQ;CAEhF,MAAM,WADY,QAAQ,MAAM,IAAI,cAAc,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,MAAM,EAAE,IAAI,CAAC,EAAA,CAChE,SAAS,aACjC,SAAS,kBACL,CAAC;EAAE,YAAY,SAAS;EAAiB,SAAS,SAAS;CAAQ,CAAC,IACpE,CAAC,CACP;CACA,OAAO;EACL,MAAM,SAAS;EACf,SAAS,OAAO,MAAM;EACtB,SAAS,QAAQ,SAAS,KAAK,CAAC,QAAQ,UAAU,MAAM,eAAe,UAAU,MAAM,EAAE;CAC3F;AACF;AAEA,eAAe,eACb,UACA,SACsC;CAItC,SAAQ,MAHc,UAAU,CAAC,CAC9B,KAAK,SAAS,IAAI,OAAO,CAAC,CAC1B,YAAY,IAAI,EAAA,EACF,WAAW,CAAC,EAAA,CAAG,SAAS,UACvC,MAAM,SAAS,WAAW,MAAM,aAC5B,CAAC;EAAE,YAAY,MAAM;EAAY,SAAS,MAAM;CAAG,CAAC,IACpD,CAAC,CACP;AACF;;AAGA,eAAe,uBACb,GACA,SACA,UACwC;CACxC,MAAM,SAAS,MAAM,IAAI,kBAAkB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,QAAQ,EAAE,EAAA,CAAG,QAAQ,SACvF,SAAS,IAAI,KAAK,WAAW,CAC/B;CACA,MAAM,WAAW,MAAM,QAAQ,IAC7B,MAAM,IAAI,OAAO,SAAS;EACxB,MAAM,WAAW,MAAM,IAAI,aAAa,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,UAAU;EAC1E,MAAM,UAAU,WACZ,MAAM,yBAAyB,GAAG,SAAS,MAAM,GAAG,UAAU,CAAC,CAAC,YAAY,IAAI,IAChF;EACJ,OAAO,YAAY,UACd,CAAC,KAAK,aAAa,MAAM,gBAAgB,QAAQ,CAAC,IACnD;CACN,CAAC,CACH;CACA,OAAO,IAAI,IAAI,SAAS,QAAQ,UAAU,UAAU,IAAI,CAAC;AAC3D;;;;;;AAOA,eAAsB,mBACpB,GACA,SACA,SACA,iBACyC;CACzC,MAAM,QAAQ,IAAI,kBAAkB,SAAS,CAAC,CAAC,EAAE;CACjD,MAAM,OAAO,kBACT,MAAM,MAAM,aAAa,SAAS,eAAe,IACjD,MAAM,MAAM,aAAa,OAAO;CACpC,MAAM,YAAY,MAAM,uBACtB,GACA,SACA,IAAI,IAAI,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,CAC5C;CACA,MAAM,0BAAU,IAAI,IAA+B;CACnD,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,WAAW,UAAU,IAAI,IAAI,WAAW;EAC9C,IAAI,UAAU;GACZ,MAAM,kBAAkB,mBAAmB,IAAI,YAAY,SAAS,OAAO;GAC3E,QAAQ,IAAI,IAAI,iBAAiB,CAC/B,GAAI,QAAQ,IAAI,IAAI,eAAe,KAAK,CAAC,GACzC;IACE,SAAS,IAAI;IACb,SAAS,IAAI;IACb,cAAc,SAAS;IACvB,iBAAiB,SAAS;IAC1B;IACA,oBACE,SAAS,QAAQ,MAAM,UAAU,MAAM,YAAY,eAAe,CAAC,EAAE,cAAc;GACvF,CACF,CAAC;EACH;CACF;CACA,OAAO;AACT;;AAGA,eAAsB,eACpB,GACA,SACA,SACA,iBAC4B;CAC5B,IAAI,CAAC,iBACH,OAAO,CAAC;CAEV,QACG,MAAM,mBAAmB,GAAG,SAAS,SAAS,eAAe,EAAA,CAAG,IAAI,eAAe,KAAK,CAAC;AAE9F"}

package/dist/routers/links.mjs

@@ -0,0 +1,139 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { resolveAuthorizedProject } from "./helpers.mjs";
+import { badRequest, forbidden, notFound, unauthorized } from "./schemas.mjs";
+import { buildForProject, snapshotForBuild } from "./builds.handlers.mjs";
+import { linkedUsageFor } from "./links.handlers.mjs";
+import { createRoute, z } from "@hono/zod-openapi";
+import { PackageUsageModel, ProjectModel } from "@storyshelf/core/models";
+import { HTTPException } from "hono/http-exception";
+//#region src/routers/links.ts
+const VIEW_ROLES = [
+	"viewer",
+	"developer",
+	"approver",
+	"admin"
+];
+const ADMIN_ROLES = ["admin"];
+const linkSchema = z.object({
+	package: z.string().min(1).max(214),
+	upstreamSlug: z.string().min(1)
+});
+const linksBodySchema = z.object({ links: z.array(linkSchema).max(200) });
+const usageItemSchema = z.object({
+	package: z.string(),
+	version: z.string().nullable(),
+	upstreamSlug: z.string(),
+	/** Latest approved default build of the upstream project; null when it has none. */
+	upstreamBuildId: z.string().nullable(),
+	/** Upstream story the package module maps to; null falls back to the library. */
+	upstreamStoryId: z.string().nullable(),
+	/** Story file of the matched upstream story; null when nothing matched. */
+	upstreamImportPath: z.string().nullable().optional()
+});
+const projectParams = z.object({ slug: z.string() });
+const listLinksRoute = createRoute({
+	method: "get",
+	tags: ["Links"],
+	summary: "List the packages this project consumes from other projects",
+	path: "/api/v1/projects/{slug}/links",
+	request: { params: projectParams },
+	responses: {
+		200: {
+			content: { "application/json": { schema: linksBodySchema } },
+			description: "Package links of the project"
+		},
+		...notFound,
+		...unauthorized
+	}
+});
+const putLinksRoute = createRoute({
+	method: "put",
+	tags: ["Links"],
+	summary: "Replace the packages this project consumes from other projects",
+	path: "/api/v1/projects/{slug}/links",
+	request: {
+		params: projectParams,
+		body: { content: { "application/json": { schema: linksBodySchema } } }
+	},
+	responses: {
+		200: {
+			content: { "application/json": { schema: linksBodySchema } },
+			description: "Links replaced"
+		},
+		...badRequest,
+		...forbidden,
+		...notFound
+	}
+});
+const usageRoute = createRoute({
+	method: "get",
+	tags: ["Links"],
+	summary: "Linked packages a snapshot's story uses",
+	path: "/api/v1/projects/{slug}/builds/{buildId}/snapshots/{snapshotId}/usage",
+	request: { params: z.object({
+		slug: z.string(),
+		buildId: z.string(),
+		snapshotId: z.string()
+	}) },
+	responses: {
+		200: {
+			content: { "application/json": { schema: usageItemSchema.array() } },
+			description: "Usage of linked packages; empty when the build reported none"
+		},
+		...notFound,
+		...unauthorized
+	}
+});
+/** Resolve link slugs to projects, rejecting unknown, self, duplicate, or unviewable ones. */
+async function resolveLinkTargets(c, project, links) {
+	if (new Set(links.map((link) => link.package)).size !== links.length) throw new HTTPException(400, { message: "Each package can be linked once" });
+	return await Promise.all(links.map(async (link) => {
+		if (link.upstreamSlug === project.slug) throw new HTTPException(400, { message: "A project cannot link to itself" });
+		return {
+			upstreamId: (await resolveAuthorizedProject(c, link.upstreamSlug, ...VIEW_ROLES).catch(() => {
+				throw new HTTPException(400, { message: `Unknown project: ${link.upstreamSlug}` });
+			})).id,
+			packageName: link.package
+		};
+	}));
+}
+/** Links of a project as API shape, dropping upstreams that no longer exist. */
+async function linkViews(project) {
+	const db = getStore().db;
+	const links = await new PackageUsageModel(db).listLinks(project.id);
+	return (await Promise.all(links.map(async (link) => {
+		const upstream = await new ProjectModel(db).get(link.upstreamId);
+		return upstream ? {
+			package: link.packageName,
+			upstreamSlug: upstream.slug
+		} : null;
+	}))).filter((view) => view !== null);
+}
+/** Register the package-link and snapshot-usage endpoints. */
+function registerLinks(app) {
+	app.openapi(listLinksRoute, async (c) => {
+		const project = await resolveAuthorizedProject(c, c.req.valid("param").slug, ...VIEW_ROLES);
+		return c.json({ links: await linkViews(project) });
+	});
+	app.openapi(putLinksRoute, async (c) => {
+		const project = await resolveAuthorizedProject(c, c.req.valid("param").slug, ...ADMIN_ROLES);
+		const { links } = c.req.valid("json");
+		const targets = await resolveLinkTargets(c, project, links);
+		await new PackageUsageModel(getStore().db).replaceLinks(project.id, targets);
+		return c.json({ links: await linkViews(project) });
+	});
+	app.openapi(usageRoute, async (c) => {
+		const { slug, buildId, snapshotId } = c.req.valid("param");
+		const project = await resolveAuthorizedProject(c, slug, ...VIEW_ROLES);
+		const build = await buildForProject(project.id, buildId);
+		const snapshot = await snapshotForBuild(build, snapshotId);
+		return c.json(await linkedUsageFor(c, project, build.id, snapshot.storyImportPath));
+	});
+}
+//#endregion
+export { registerLinks };
+
+//# sourceMappingURL=links.mjs.map

package/dist/routers/links.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"links.mjs","names":[],"sources":["../../src/routers/links.ts"],"sourcesContent":["import { createRoute, z } from \"@hono/zod-openapi\";\nimport { PackageUsageModel, ProjectModel } from \"@storyshelf/core/models\";\nimport type { Project } from \"@storyshelf/core/schema\";\nimport type { ProjectRole } from \"@storyshelf/core/types\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { buildForProject, snapshotForBuild } from \"./builds.handlers.ts\";\nimport { resolveAuthorizedProject } from \"./helpers.ts\";\nimport { linkedUsageFor } from \"./links.handlers.ts\";\nimport { badRequest, forbidden, notFound, unauthorized } from \"./schemas.ts\";\n\nconst VIEW_ROLES: readonly ProjectRole[] = [\"viewer\", \"developer\", \"approver\", \"admin\"];\nconst ADMIN_ROLES: readonly ProjectRole[] = [\"admin\"];\n\nconst linkSchema = z.object({\n  package: z.string().min(1).max(214),\n  upstreamSlug: z.string().min(1),\n});\nconst linksBodySchema = z.object({ links: z.array(linkSchema).max(200) });\nconst usageItemSchema = z.object({\n  package: z.string(),\n  version: z.string().nullable(),\n  upstreamSlug: z.string(),\n  /** Latest approved default build of the upstream project; null when it has none. */\n  upstreamBuildId: z.string().nullable(),\n  /** Upstream story the package module maps to; null falls back to the library. */\n  upstreamStoryId: z.string().nullable(),\n  /** Story file of the matched upstream story; null when nothing matched. */\n  upstreamImportPath: z.string().nullable().optional(),\n});\n\nconst projectParams = z.object({ slug: z.string() });\n\nconst listLinksRoute = createRoute({\n  method: \"get\",\n  tags: [\"Links\"],\n  summary: \"List the packages this project consumes from other projects\",\n  path: \"/api/v1/projects/{slug}/links\",\n  request: { params: projectParams },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: linksBodySchema } },\n      description: \"Package links of the project\",\n    },\n    ...notFound,\n    ...unauthorized,\n  },\n});\n\nconst putLinksRoute = createRoute({\n  method: \"put\",\n  tags: [\"Links\"],\n  summary: \"Replace the packages this project consumes from other projects\",\n  path: \"/api/v1/projects/{slug}/links\",\n  request: {\n    params: projectParams,\n    body: { content: { \"application/json\": { schema: linksBodySchema } } },\n  },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: linksBodySchema } },\n      description: \"Links replaced\",\n    },\n    ...badRequest,\n    ...forbidden,\n    ...notFound,\n  },\n});\n\nconst usageRoute = createRoute({\n  method: \"get\",\n  tags: [\"Links\"],\n  summary: \"Linked packages a snapshot's story uses\",\n  path: \"/api/v1/projects/{slug}/builds/{buildId}/snapshots/{snapshotId}/usage\",\n  request: {\n    params: z.object({ slug: z.string(), buildId: z.string(), snapshotId: z.string() }),\n  },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: usageItemSchema.array() } },\n      description: \"Usage of linked packages; empty when the build reported none\",\n    },\n    ...notFound,\n    ...unauthorized,\n  },\n});\n\n/** Resolve link slugs to projects, rejecting unknown, self, duplicate, or unviewable ones. */\nasync function resolveLinkTargets(\n  c: Parameters<typeof resolveAuthorizedProject>[0],\n  project: Project,\n  links: z.infer<typeof linkSchema>[],\n): Promise<{ upstreamId: string; packageName: string }[]> {\n  if (new Set(links.map((link) => link.package)).size !== links.length) {\n    throw new HTTPException(400, { message: \"Each package can be linked once\" });\n  }\n  return await Promise.all(\n    links.map(async (link) => {\n      if (link.upstreamSlug === project.slug) {\n        throw new HTTPException(400, { message: \"A project cannot link to itself\" });\n      }\n      const upstream = await resolveAuthorizedProject(c, link.upstreamSlug, ...VIEW_ROLES).catch(\n        () => {\n          throw new HTTPException(400, { message: `Unknown project: ${link.upstreamSlug}` });\n        },\n      );\n      return { upstreamId: upstream.id, packageName: link.package };\n    }),\n  );\n}\n\n/** Links of a project as API shape, dropping upstreams that no longer exist. */\nasync function linkViews(project: Project): Promise<z.infer<typeof linkSchema>[]> {\n  const db = getStore().db;\n  const links = await new PackageUsageModel(db).listLinks(project.id);\n  const views = await Promise.all(\n    links.map(async (link) => {\n      const upstream = await new ProjectModel(db).get(link.upstreamId);\n      return upstream ? { package: link.packageName, upstreamSlug: upstream.slug } : null;\n    }),\n  );\n  return views.filter((view): view is z.infer<typeof linkSchema> => view !== null);\n}\n\n/** Register the package-link and snapshot-usage endpoints. */\nexport function registerLinks(app: ShelfRouter): void {\n  app.openapi(listLinksRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...VIEW_ROLES);\n    return c.json({ links: await linkViews(project) });\n  });\n\n  app.openapi(putLinksRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...ADMIN_ROLES);\n    const { links } = c.req.valid(\"json\");\n    const targets = await resolveLinkTargets(c, project, links);\n    await new PackageUsageModel(getStore().db).replaceLinks(project.id, targets);\n    return c.json({ links: await linkViews(project) });\n  });\n\n  app.openapi(usageRoute, async (c) => {\n    const { slug, buildId, snapshotId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...VIEW_ROLES);\n    const build = await buildForProject(project.id, buildId);\n    const snapshot = await snapshotForBuild(build, snapshotId);\n    return c.json(await linkedUsageFor(c, project, build.id, snapshot.storyImportPath));\n  });\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,aAAqC;CAAC;CAAU;CAAa;CAAY;AAAO;AACtF,MAAM,cAAsC,CAAC,OAAO;AAEpD,MAAM,aAAa,EAAE,OAAO;CAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CAClC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AACD,MAAM,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;AACxE,MAAM,kBAAkB,EAAE,OAAO;CAC/B,SAAS,EAAE,OAAO;CAClB,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,cAAc,EAAE,OAAO;;CAEvB,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;;CAErC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;;CAErC,oBAAoB,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;AACrD,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAEnD,MAAM,iBAAiB,YAAY;CACjC,QAAQ;CACR,MAAM,CAAC,OAAO;CACd,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,cAAc;CACjC,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,EAAE;GAC3D,aAAa;EACf;EACA,GAAG;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,gBAAgB,YAAY;CAChC,QAAQ;CACR,MAAM,CAAC,OAAO;CACd,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ;EACR,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,EAAE,EAAE;CACvE;CACA,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,EAAE;GAC3D,aAAa;EACf;EACA,GAAG;EACH,GAAG;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,aAAa,YAAY;CAC7B,QAAQ;CACR,MAAM,CAAC,OAAO;CACd,SAAS;CACT,MAAM;CACN,SAAS,EACP,QAAQ,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,SAAS,EAAE,OAAO;EAAG,YAAY,EAAE,OAAO;CAAE,CAAC,EACpF;CACA,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,MAAM,EAAE,EAAE;GACnE,aAAa;EACf;EACA,GAAG;EACH,GAAG;CACL;AACF,CAAC;;AAGD,eAAe,mBACb,GACA,SACA,OACwD;CACxD,IAAI,IAAI,IAAI,MAAM,KAAK,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,MAAM,QAC5D,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,kCAAkC,CAAC;CAE7E,OAAO,MAAM,QAAQ,IACnB,MAAM,IAAI,OAAO,SAAS;EACxB,IAAI,KAAK,iBAAiB,QAAQ,MAChC,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,kCAAkC,CAAC;EAO7E,OAAO;GAAE,aAAY,MALE,yBAAyB,GAAG,KAAK,cAAc,GAAG,UAAU,CAAC,CAAC,YAC7E;IACJ,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,oBAAoB,KAAK,eAAe,CAAC;GACnF,CACF,EAAA,CAC8B;GAAI,aAAa,KAAK;EAAQ;CAC9D,CAAC,CACH;AACF;;AAGA,eAAe,UAAU,SAAyD;CAChF,MAAM,KAAK,SAAS,CAAC,CAAC;CACtB,MAAM,QAAQ,MAAM,IAAI,kBAAkB,EAAE,CAAC,CAAC,UAAU,QAAQ,EAAE;CAOlE,QAAO,MANa,QAAQ,IAC1B,MAAM,IAAI,OAAO,SAAS;EACxB,MAAM,WAAW,MAAM,IAAI,aAAa,EAAE,CAAC,CAAC,IAAI,KAAK,UAAU;EAC/D,OAAO,WAAW;GAAE,SAAS,KAAK;GAAa,cAAc,SAAS;EAAK,IAAI;CACjF,CAAC,CACH,EAAA,CACa,QAAQ,SAA6C,SAAS,IAAI;AACjF;;AAGA,SAAgB,cAAc,KAAwB;CACpD,IAAI,QAAQ,gBAAgB,OAAO,MAAM;EACvC,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,UAAU;EAC1F,OAAO,EAAE,KAAK,EAAE,OAAO,MAAM,UAAU,OAAO,EAAE,CAAC;CACnD,CAAC;CAED,IAAI,QAAQ,eAAe,OAAO,MAAM;EACtC,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,WAAW;EAC3F,MAAM,EAAE,UAAU,EAAE,IAAI,MAAM,MAAM;EACpC,MAAM,UAAU,MAAM,mBAAmB,GAAG,SAAS,KAAK;EAC1D,MAAM,IAAI,kBAAkB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,QAAQ,IAAI,OAAO;EAC3E,OAAO,EAAE,KAAK,EAAE,OAAO,MAAM,UAAU,OAAO,EAAE,CAAC;CACnD,CAAC;CAED,IAAI,QAAQ,YAAY,OAAO,MAAM;EACnC,MAAM,EAAE,MAAM,SAAS,eAAe,EAAE,IAAI,MAAM,OAAO;EACzD,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,UAAU;EACrE,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,IAAI,OAAO;EACvD,MAAM,WAAW,MAAM,iBAAiB,OAAO,UAAU;EACzD,OAAO,EAAE,KAAK,MAAM,eAAe,GAAG,SAAS,MAAM,IAAI,SAAS,eAAe,CAAC;CACpF,CAAC;AACH"}

package/dist/routers/media.mjs

@@ -1,9 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { credentialKeys } from "../credential-keys.mjs";
 import { getStore } from "../store.mjs";
 import { notFound, resolveAuthorizedProject } from "./helpers.mjs";
-import { BaselineModel, BuildModel, SnapshotModel } from "@storyshelf/core/models";
+import { BaselineModel, BuildModel, DesignCredentialModel, DesignNodeModel, SnapshotModel } from "@storyshelf/core/models";
 //#region src/routers/media.ts
 const VIEW_ROLES = [
 	"viewer",
@@ -12,12 +13,14 @@ const VIEW_ROLES = [
 	"admin"
 ];
 const PNG = "image/png";
-function imageResponse(buffer) {
+function imageResponse(buffer, cacheControl = "private, max-age=3600") {
 	return new Response(new Uint8Array(buffer), { headers: {
 		"content-type": PNG,
-		"cache-control": "private, max-age=3600"
+		"cache-control": cacheControl
 	} });
 }
+/** Design renders are addressed by file version (`?v=`): immutable once the version matches the row. */
+const RENDER_IMMUTABLE = "private, max-age=31536000, immutable";
 /** Register the PNG image, diff, and baseline media endpoints for snapshots. */
 function registerMedia(app) {
 	app.get("/api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/image", async (c) => {
@@ -31,13 +34,24 @@ function registerMedia(app) {
 		if (!snapshot.diffPath) notFound("No diff for this snapshot");
 		return imageResponse(await getStore().storage.read(snapshot.diffPath));
 	});
+	app.get("/api/v1/projects/:slug/design/renders/:renderId", async (c) => {
+		const project = await resolveAuthorizedProject(c, c.req.param("slug"), ...VIEW_ROLES);
+		const { db, config, storage, design } = getStore();
+		const credentials = new DesignCredentialModel(db, credentialKeys(config));
+		const nodes = new DesignNodeModel(db, credentials, design, { storage });
+		const found = await nodes.get(project.id, c.req.param("renderId"));
+		const node = found && (found.viewerId === "" || found.viewerId === getStore().user?.id) ? found : null;
+		const png = node ? await nodes.readRender(node) : null;
+		if (!png) notFound("No design render");
+		return imageResponse(png, node?.renderVersion && c.req.query("v") === node.renderVersion ? RENDER_IMMUTABLE : void 0);
+	});
 	app.get("/api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/baseline", async (c) => {
 		const project = await resolveAuthorizedProject(c, c.req.param("slug"), ...VIEW_ROLES);
 		const snapshot = await findSnapshot(c.req.param("buildId"), c.req.param("snapshotId"), project.id);
 		const build = await new BuildModel(getStore().db).get(snapshot.buildId);
 		if (!build) notFound("Build not found");
 		const baselines = new BaselineModel(getStore().db, void 0, getStore().storage);
-		const baseline = await baselines.resolve(project.id, snapshot.storyId, snapshot.viewportName, build.gitBranch, project.gitDefaultBranch);
+		const baseline = await baselines.resolve(project.id, snapshot.storyId, snapshot.viewportName, build.gitBranch, project.gitDefaultBranch, snapshot.browser);
 		if (!baseline) notFound("No baseline for this snapshot");
 		return imageResponse(await baselines.read(baseline));
 	});

package/dist/routers/media.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"media.mjs","names":[],"sources":["../../src/routers/media.ts"],"sourcesContent":["import { BaselineModel } from \"@storyshelf/core/models\";\nimport { BuildModel } from \"@storyshelf/core/models\";\nimport { SnapshotModel } from \"@storyshelf/core/models\";\nimport type { Snapshot } from \"@storyshelf/core/schema\";\nimport type { ProjectRole } from \"@storyshelf/core/types\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { notFound, resolveAuthorizedProject } from \"./helpers.ts\";\nconst VIEW_ROLES: readonly ProjectRole[] = [\"viewer\", \"developer\", \"approver\", \"admin\"];\n\nconst PNG = \"image/png\";\n\nfunction imageResponse(buffer: Buffer): Response {\n  return new Response(new Uint8Array(buffer), {\n    headers: { \"content-type\": PNG, \"cache-control\": \"private, max-age=3600\" },\n  });\n}\n\n/** Register the PNG image, diff, and baseline media endpoints for snapshots. */\nexport function registerMedia(app: ShelfRouter): void {\n  app.get(\"/api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/image\", async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.param(\"slug\"), ...VIEW_ROLES);\n    const snapshot = await findSnapshot(\n      c.req.param(\"buildId\"),\n      c.req.param(\"snapshotId\"),\n      project.id,\n    );\n    return imageResponse(await getStore().storage.read(snapshot.screenshotPath));\n  });\n\n  app.get(\"/api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/diff\", async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.param(\"slug\"), ...VIEW_ROLES);\n    const snapshot = await findSnapshot(\n      c.req.param(\"buildId\"),\n      c.req.param(\"snapshotId\"),\n      project.id,\n    );\n    if (!snapshot.diffPath) {\n      notFound(\"No diff for this snapshot\");\n    }\n    return imageResponse(await getStore().storage.read(snapshot.diffPath));\n  });\n\n  app.get(\"/api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/baseline\", async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.param(\"slug\"), ...VIEW_ROLES);\n    const snapshot = await findSnapshot(\n      c.req.param(\"buildId\"),\n      c.req.param(\"snapshotId\"),\n      project.id,\n    );\n    const build = await new BuildModel(getStore().db).get(snapshot.buildId);\n    if (!build) {\n      notFound(\"Build not found\");\n    }\n    const baselines = new BaselineModel(getStore().db, undefined, getStore().storage);\n    const baseline = await baselines.resolve(\n      project.id,\n      snapshot.storyId,\n      snapshot.viewportName,\n      build.gitBranch,\n      project.gitDefaultBranch,\n    );\n    if (!baseline) {\n      notFound(\"No baseline for this snapshot\");\n    }\n    return imageResponse(await baselines.read(baseline));\n  });\n}\n\nasync function findSnapshot(\n  buildId: string,\n  snapshotId: string,\n  projectId: string,\n): Promise<Snapshot> {\n  const snapshot = await new SnapshotModel(getStore().db).get(snapshotId);\n  if (!snapshot || snapshot.buildId !== buildId || snapshot.projectId !== projectId) {\n    notFound(\"Snapshot not found\");\n  }\n  return snapshot;\n}\n"],"mappings":";;;;;;;AAQA,MAAM,aAAqC;CAAC;CAAU;CAAa;CAAY;AAAO;AAEtF,MAAM,MAAM;AAEZ,SAAS,cAAc,QAA0B;CAC/C,OAAO,IAAI,SAAS,IAAI,WAAW,MAAM,GAAG,EAC1C,SAAS;EAAE,gBAAgB;EAAK,iBAAiB;CAAwB,EAC3E,CAAC;AACH;;AAGA,SAAgB,cAAc,KAAwB;CACpD,IAAI,IAAI,sEAAsE,OAAO,MAAM;EACzF,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,MAAM,GAAG,GAAG,UAAU;EACpF,MAAM,WAAW,MAAM,aACrB,EAAE,IAAI,MAAM,SAAS,GACrB,EAAE,IAAI,MAAM,YAAY,GACxB,QAAQ,EACV;EACA,OAAO,cAAc,MAAM,SAAS,CAAC,CAAC,QAAQ,KAAK,SAAS,cAAc,CAAC;CAC7E,CAAC;CAED,IAAI,IAAI,qEAAqE,OAAO,MAAM;EACxF,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,MAAM,GAAG,GAAG,UAAU;EACpF,MAAM,WAAW,MAAM,aACrB,EAAE,IAAI,MAAM,SAAS,GACrB,EAAE,IAAI,MAAM,YAAY,GACxB,QAAQ,EACV;EACA,IAAI,CAAC,SAAS,UACZ,SAAS,2BAA2B;EAEtC,OAAO,cAAc,MAAM,SAAS,CAAC,CAAC,QAAQ,KAAK,SAAS,QAAQ,CAAC;CACvE,CAAC;CAED,IAAI,IAAI,yEAAyE,OAAO,MAAM;EAC5F,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,MAAM,GAAG,GAAG,UAAU;EACpF,MAAM,WAAW,MAAM,aACrB,EAAE,IAAI,MAAM,SAAS,GACrB,EAAE,IAAI,MAAM,YAAY,GACxB,QAAQ,EACV;EACA,MAAM,QAAQ,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,OAAO;EACtE,IAAI,CAAC,OACH,SAAS,iBAAiB;EAE5B,MAAM,YAAY,IAAI,cAAc,SAAS,CAAC,CAAC,IAAI,KAAA,GAAW,SAAS,CAAC,CAAC,OAAO;EAChF,MAAM,WAAW,MAAM,UAAU,QAC/B,QAAQ,IACR,SAAS,SACT,SAAS,cACT,MAAM,WACN,QAAQ,gBACV;EACA,IAAI,CAAC,UACH,SAAS,+BAA+B;EAE1C,OAAO,cAAc,MAAM,UAAU,KAAK,QAAQ,CAAC;CACrD,CAAC;AACH;AAEA,eAAe,aACb,SACA,YACA,WACmB;CACnB,MAAM,WAAW,MAAM,IAAI,cAAc,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU;CACtE,IAAI,CAAC,YAAY,SAAS,YAAY,WAAW,SAAS,cAAc,WACtE,SAAS,oBAAoB;CAE/B,OAAO;AACT"}
+{"version":3,"file":"media.mjs","names":[],"sources":["../../src/routers/media.ts"],"sourcesContent":["import { BaselineModel, DesignCredentialModel, DesignNodeModel } from \"@storyshelf/core/models\";\nimport { BuildModel } from \"@storyshelf/core/models\";\nimport { SnapshotModel } from \"@storyshelf/core/models\";\nimport type { Snapshot } from \"@storyshelf/core/schema\";\nimport type { ProjectRole } from \"@storyshelf/core/types\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { credentialKeys } from \"../credential-keys.ts\";\nimport { getStore } from \"../store.ts\";\nimport { notFound, resolveAuthorizedProject } from \"./helpers.ts\";\nconst VIEW_ROLES: readonly ProjectRole[] = [\"viewer\", \"developer\", \"approver\", \"admin\"];\n\nconst PNG = \"image/png\";\n\nfunction imageResponse(buffer: Buffer, cacheControl = \"private, max-age=3600\"): Response {\n  return new Response(new Uint8Array(buffer), {\n    headers: { \"content-type\": PNG, \"cache-control\": cacheControl },\n  });\n}\n\n/** Design renders are addressed by file version (`?v=`): immutable once the version matches the row. */\nconst RENDER_IMMUTABLE = \"private, max-age=31536000, immutable\";\n\n/** Register the PNG image, diff, and baseline media endpoints for snapshots. */\nexport function registerMedia(app: ShelfRouter): void {\n  app.get(\"/api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/image\", async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.param(\"slug\"), ...VIEW_ROLES);\n    const snapshot = await findSnapshot(\n      c.req.param(\"buildId\"),\n      c.req.param(\"snapshotId\"),\n      project.id,\n    );\n    return imageResponse(await getStore().storage.read(snapshot.screenshotPath));\n  });\n\n  app.get(\"/api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/diff\", async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.param(\"slug\"), ...VIEW_ROLES);\n    const snapshot = await findSnapshot(\n      c.req.param(\"buildId\"),\n      c.req.param(\"snapshotId\"),\n      project.id,\n    );\n    if (!snapshot.diffPath) {\n      notFound(\"No diff for this snapshot\");\n    }\n    return imageResponse(await getStore().storage.read(snapshot.diffPath));\n  });\n\n  // `:renderId` is the internal design_nodes row id (a ULID), not a provider node id.\n  app.get(\"/api/v1/projects/:slug/design/renders/:renderId\", async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.param(\"slug\"), ...VIEW_ROLES);\n    const { db, config, storage, design } = getStore();\n    const credentials = new DesignCredentialModel(db, credentialKeys(config));\n    const nodes = new DesignNodeModel(db, credentials, design, { storage });\n    const found = await nodes.get(project.id, c.req.param(\"renderId\"));\n    // A render fetched with a member's own connection is theirs alone (it may show files others cannot open).\n    const node =\n      found && (found.viewerId === \"\" || found.viewerId === getStore().user?.id) ? found : null;\n    const png = node ? await nodes.readRender(node) : null;\n    if (!png) {\n      notFound(\"No design render\");\n    }\n    const versioned = node?.renderVersion && c.req.query(\"v\") === node.renderVersion;\n    return imageResponse(png, versioned ? RENDER_IMMUTABLE : undefined);\n  });\n\n  app.get(\"/api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/baseline\", async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.param(\"slug\"), ...VIEW_ROLES);\n    const snapshot = await findSnapshot(\n      c.req.param(\"buildId\"),\n      c.req.param(\"snapshotId\"),\n      project.id,\n    );\n    const build = await new BuildModel(getStore().db).get(snapshot.buildId);\n    if (!build) {\n      notFound(\"Build not found\");\n    }\n    const baselines = new BaselineModel(getStore().db, undefined, getStore().storage);\n    const baseline = await baselines.resolve(\n      project.id,\n      snapshot.storyId,\n      snapshot.viewportName,\n      build.gitBranch,\n      project.gitDefaultBranch,\n      snapshot.browser,\n    );\n    if (!baseline) {\n      notFound(\"No baseline for this snapshot\");\n    }\n    return imageResponse(await baselines.read(baseline));\n  });\n}\n\nasync function findSnapshot(\n  buildId: string,\n  snapshotId: string,\n  projectId: string,\n): Promise<Snapshot> {\n  const snapshot = await new SnapshotModel(getStore().db).get(snapshotId);\n  if (!snapshot || snapshot.buildId !== buildId || snapshot.projectId !== projectId) {\n    notFound(\"Snapshot not found\");\n  }\n  return snapshot;\n}\n"],"mappings":";;;;;;;;AASA,MAAM,aAAqC;CAAC;CAAU;CAAa;CAAY;AAAO;AAEtF,MAAM,MAAM;AAEZ,SAAS,cAAc,QAAgB,eAAe,yBAAmC;CACvF,OAAO,IAAI,SAAS,IAAI,WAAW,MAAM,GAAG,EAC1C,SAAS;EAAE,gBAAgB;EAAK,iBAAiB;CAAa,EAChE,CAAC;AACH;;AAGA,MAAM,mBAAmB;;AAGzB,SAAgB,cAAc,KAAwB;CACpD,IAAI,IAAI,sEAAsE,OAAO,MAAM;EACzF,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,MAAM,GAAG,GAAG,UAAU;EACpF,MAAM,WAAW,MAAM,aACrB,EAAE,IAAI,MAAM,SAAS,GACrB,EAAE,IAAI,MAAM,YAAY,GACxB,QAAQ,EACV;EACA,OAAO,cAAc,MAAM,SAAS,CAAC,CAAC,QAAQ,KAAK,SAAS,cAAc,CAAC;CAC7E,CAAC;CAED,IAAI,IAAI,qEAAqE,OAAO,MAAM;EACxF,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,MAAM,GAAG,GAAG,UAAU;EACpF,MAAM,WAAW,MAAM,aACrB,EAAE,IAAI,MAAM,SAAS,GACrB,EAAE,IAAI,MAAM,YAAY,GACxB,QAAQ,EACV;EACA,IAAI,CAAC,SAAS,UACZ,SAAS,2BAA2B;EAEtC,OAAO,cAAc,MAAM,SAAS,CAAC,CAAC,QAAQ,KAAK,SAAS,QAAQ,CAAC;CACvE,CAAC;CAGD,IAAI,IAAI,mDAAmD,OAAO,MAAM;EACtE,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,MAAM,GAAG,GAAG,UAAU;EACpF,MAAM,EAAE,IAAI,QAAQ,SAAS,WAAW,SAAS;EACjD,MAAM,cAAc,IAAI,sBAAsB,IAAI,eAAe,MAAM,CAAC;EACxE,MAAM,QAAQ,IAAI,gBAAgB,IAAI,aAAa,QAAQ,EAAE,QAAQ,CAAC;EACtE,MAAM,QAAQ,MAAM,MAAM,IAAI,QAAQ,IAAI,EAAE,IAAI,MAAM,UAAU,CAAC;EAEjE,MAAM,OACJ,UAAU,MAAM,aAAa,MAAM,MAAM,aAAa,SAAS,CAAC,CAAC,MAAM,MAAM,QAAQ;EACvF,MAAM,MAAM,OAAO,MAAM,MAAM,WAAW,IAAI,IAAI;EAClD,IAAI,CAAC,KACH,SAAS,kBAAkB;EAG7B,OAAO,cAAc,KADH,MAAM,iBAAiB,EAAE,IAAI,MAAM,GAAG,MAAM,KAAK,gBAC7B,mBAAmB,KAAA,CAAS;CACpE,CAAC;CAED,IAAI,IAAI,yEAAyE,OAAO,MAAM;EAC5F,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,MAAM,GAAG,GAAG,UAAU;EACpF,MAAM,WAAW,MAAM,aACrB,EAAE,IAAI,MAAM,SAAS,GACrB,EAAE,IAAI,MAAM,YAAY,GACxB,QAAQ,EACV;EACA,MAAM,QAAQ,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,OAAO;EACtE,IAAI,CAAC,OACH,SAAS,iBAAiB;EAE5B,MAAM,YAAY,IAAI,cAAc,SAAS,CAAC,CAAC,IAAI,KAAA,GAAW,SAAS,CAAC,CAAC,OAAO;EAChF,MAAM,WAAW,MAAM,UAAU,QAC/B,QAAQ,IACR,SAAS,SACT,SAAS,cACT,MAAM,WACN,QAAQ,kBACR,SAAS,OACX;EACA,IAAI,CAAC,UACH,SAAS,+BAA+B;EAE1C,OAAO,cAAc,MAAM,UAAU,KAAK,QAAQ,CAAC;CACrD,CAAC;AACH;AAEA,eAAe,aACb,SACA,YACA,WACmB;CACnB,MAAM,WAAW,MAAM,IAAI,cAAc,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU;CACtE,IAAI,CAAC,YAAY,SAAS,YAAY,WAAW,SAAS,cAAc,WACtE,SAAS,oBAAoB;CAE/B,OAAO;AACT"}

package/dist/routers/members.mjs

@@ -161,7 +161,8 @@ function registerGroupMappingRoutes(app) {
 	app.openapi(createGroupMappingRoute, async (c) => {
 		const project = await resolveAuthorizedProject(c, c.req.valid("param").slug, ...ADMIN_ROLES);
 		const body = c.req.valid("json");
-		if (body.groupName.includes("*")) throw new HTTPException(400, { message: "Group names match exactly; wildcards are not expanded. A broad pattern can silently grant org-wide access." });
+		const inputError = ProjectGroupMappingModel.inputError(body.groupName, body.role);
+		if (inputError) throw new HTTPException(400, { message: inputError });
 		return c.json(await new ProjectGroupMappingModel(getStore().db).create(project.id, body.groupName, body.role), 201);
 	});
 	app.openapi(deleteGroupMappingRoute, async (c) => {

package/dist/routers/members.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"members.mjs","names":[],"sources":["../../src/routers/members.ts"],"sourcesContent":["import { createRoute, z } from \"@hono/zod-openapi\";\nimport { MemberModel, ProjectGroupMappingModel } from \"@storyshelf/core/models\";\nimport type { ProjectRole } from \"@storyshelf/core/types\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { resolveAuthorizedProject } from \"./helpers.ts\";\nimport {\n  groupMappingCreateSchema,\n  groupMappingSchema,\n  memberRoleSchema,\n  memberSchema,\n  memberSetSchema,\n  notFound,\n  unauthorized,\n} from \"./schemas.ts\";\nconst VIEW_ROLES: readonly ProjectRole[] = [\"viewer\", \"developer\", \"approver\", \"admin\"];\nconst ADMIN_ROLES: readonly ProjectRole[] = [\"admin\"];\n\nconst listMembersRoute = createRoute({\n  method: \"get\",\n  tags: [\"Members\"],\n  summary: \"List members\",\n  path: \"/api/v1/projects/{slug}/members\",\n  request: { params: z.object({ slug: z.string() }) },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: memberSchema.array() } },\n      description: \"List project members\",\n    },\n    ...notFound,\n    ...unauthorized,\n  },\n});\n\nconst setMemberRoute = createRoute({\n  method: \"post\",\n  tags: [\"Members\"],\n  summary: \"Add or update a member\",\n  path: \"/api/v1/projects/{slug}/members\",\n  request: {\n    params: z.object({ slug: z.string() }),\n    body: { content: { \"application/json\": { schema: memberSetSchema } } },\n  },\n  responses: {\n    201: {\n      content: { \"application/json\": { schema: memberSchema } },\n      description: \"Added or updated member\",\n    },\n    ...notFound,\n  },\n});\n\nconst updateMemberRoute = createRoute({\n  method: \"patch\",\n  tags: [\"Members\"],\n  summary: \"Change a member's role\",\n  path: \"/api/v1/projects/{slug}/members/{userId}\",\n  request: {\n    params: z.object({ slug: z.string(), userId: z.string() }),\n    body: { content: { \"application/json\": { schema: memberRoleSchema } } },\n  },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: memberSchema } },\n      description: \"Updated member role\",\n    },\n    ...notFound,\n  },\n});\n\nconst deleteMemberRoute = createRoute({\n  method: \"delete\",\n  tags: [\"Members\"],\n  summary: \"Remove a member\",\n  path: \"/api/v1/projects/{slug}/members/{userId}\",\n  request: { params: z.object({ slug: z.string(), userId: z.string() }) },\n  responses: {\n    204: { description: \"Removed member\" },\n    ...notFound,\n  },\n});\n\nconst listGroupMappingsRoute = createRoute({\n  method: \"get\",\n  tags: [\"Members\"],\n  summary: \"List group mappings\",\n  path: \"/api/v1/projects/{slug}/group-mappings\",\n  request: { params: z.object({ slug: z.string() }) },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: groupMappingSchema.array() } },\n      description: \"List identity-provider group mappings\",\n    },\n    ...notFound,\n    ...unauthorized,\n  },\n});\n\nconst createGroupMappingRoute = createRoute({\n  method: \"post\",\n  tags: [\"Members\"],\n  summary: \"Create a group mapping\",\n  path: \"/api/v1/projects/{slug}/group-mappings\",\n  request: {\n    params: z.object({ slug: z.string() }),\n    body: { content: { \"application/json\": { schema: groupMappingCreateSchema } } },\n  },\n  responses: {\n    201: {\n      content: { \"application/json\": { schema: groupMappingSchema } },\n      description: \"Created group mapping (exact group-name match)\",\n    },\n    ...notFound,\n  },\n});\n\nconst deleteGroupMappingRoute = createRoute({\n  method: \"delete\",\n  tags: [\"Members\"],\n  summary: \"Remove a group mapping\",\n  path: \"/api/v1/projects/{slug}/group-mappings/{mappingId}\",\n  request: { params: z.object({ slug: z.string(), mappingId: z.string() }) },\n  responses: {\n    204: { description: \"Removed group mapping\" },\n    ...notFound,\n  },\n});\n\n/** Register the project member list, upsert, and removal endpoints. */\nexport function registerMembers(app: ShelfRouter): void {\n  app.openapi(listMembersRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...VIEW_ROLES);\n    return c.json(await new MemberModel(getStore().db).list(project.id));\n  });\n\n  app.openapi(setMemberRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...ADMIN_ROLES);\n    const body = c.req.valid(\"json\");\n    return c.json(\n      await new MemberModel(getStore().db).set(project.id, body.userId, body.role),\n      201,\n    );\n  });\n\n  app.openapi(updateMemberRoute, async (c) => {\n    const { slug, userId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...ADMIN_ROLES);\n    const body = c.req.valid(\"json\");\n    return c.json(await new MemberModel(getStore().db).set(project.id, userId, body.role));\n  });\n\n  app.openapi(deleteMemberRoute, async (c) => {\n    const { slug, userId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...ADMIN_ROLES);\n    await new MemberModel(getStore().db).remove(project.id, userId);\n    return c.body(null, 204);\n  });\n\n  registerGroupMappingRoutes(app);\n}\n\n/** Register identity-provider group mapping endpoints. */\nfunction registerGroupMappingRoutes(app: ShelfRouter): void {\n  app.openapi(listGroupMappingsRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...VIEW_ROLES);\n    return c.json(await new ProjectGroupMappingModel(getStore().db).list(project.id));\n  });\n\n  app.openapi(createGroupMappingRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...ADMIN_ROLES);\n    const body = c.req.valid(\"json\");\n    if (body.groupName.includes(\"*\")) {\n      throw new HTTPException(400, {\n        message:\n          \"Group names match exactly; wildcards are not expanded. A broad pattern can silently grant org-wide access.\",\n      });\n    }\n    return c.json(\n      await new ProjectGroupMappingModel(getStore().db).create(\n        project.id,\n        body.groupName,\n        body.role,\n      ),\n      201,\n    );\n  });\n\n  app.openapi(deleteGroupMappingRoute, async (c) => {\n    const { slug, mappingId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...ADMIN_ROLES);\n    await new ProjectGroupMappingModel(getStore().db).remove(project.id, mappingId);\n    return c.body(null, 204);\n  });\n}\n"],"mappings":";;;;;;;;;;AAgBA,MAAM,aAAqC;CAAC;CAAU;CAAa;CAAY;AAAO;AACtF,MAAM,cAAsC,CAAC,OAAO;AAEpD,MAAM,mBAAmB,YAAY;CACnC,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE;CAClD,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,aAAa,MAAM,EAAE,EAAE;GAChE,aAAa;EACf;EACA,GAAG;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,iBAAiB,YAAY;CACjC,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;EACrC,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,EAAE,EAAE;CACvE;CACA,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,aAAa,EAAE;GACxD,aAAa;EACf;EACA,GAAG;CACL;AACF,CAAC;AAED,MAAM,oBAAoB,YAAY;CACpC,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO;GAAE,MAAM,EAAE,OAAO;GAAG,QAAQ,EAAE,OAAO;EAAE,CAAC;EACzD,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,iBAAiB,EAAE,EAAE;CACxE;CACA,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,aAAa,EAAE;GACxD,aAAa;EACf;EACA,GAAG;CACL;AACF,CAAC;AAED,MAAM,oBAAoB,YAAY;CACpC,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,QAAQ,EAAE,OAAO;CAAE,CAAC,EAAE;CACtE,WAAW;EACT,KAAK,EAAE,aAAa,iBAAiB;EACrC,GAAG;CACL;AACF,CAAC;AAED,MAAM,yBAAyB,YAAY;CACzC,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE;CAClD,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,mBAAmB,MAAM,EAAE,EAAE;GACtE,aAAa;EACf;EACA,GAAG;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,0BAA0B,YAAY;CAC1C,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;EACrC,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,yBAAyB,EAAE,EAAE;CAChF;CACA,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,mBAAmB,EAAE;GAC9D,aAAa;EACf;EACA,GAAG;CACL;AACF,CAAC;AAED,MAAM,0BAA0B,YAAY;CAC1C,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,WAAW,EAAE,OAAO;CAAE,CAAC,EAAE;CACzE,WAAW;EACT,KAAK,EAAE,aAAa,wBAAwB;EAC5C,GAAG;CACL;AACF,CAAC;;AAGD,SAAgB,gBAAgB,KAAwB;CACtD,IAAI,QAAQ,kBAAkB,OAAO,MAAM;EACzC,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,UAAU;EAC1F,OAAO,EAAE,KAAK,MAAM,IAAI,YAAY,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;CACrE,CAAC;CAED,IAAI,QAAQ,gBAAgB,OAAO,MAAM;EACvC,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,WAAW;EAC3F,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,OAAO,EAAE,KACP,MAAM,IAAI,YAAY,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,IAAI,KAAK,QAAQ,KAAK,IAAI,GAC3E,GACF;CACF,CAAC;CAED,IAAI,QAAQ,mBAAmB,OAAO,MAAM;EAC1C,MAAM,EAAE,MAAM,WAAW,EAAE,IAAI,MAAM,OAAO;EAC5C,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,WAAW;EACtE,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,OAAO,EAAE,KAAK,MAAM,IAAI,YAAY,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC;CACvF,CAAC;CAED,IAAI,QAAQ,mBAAmB,OAAO,MAAM;EAC1C,MAAM,EAAE,MAAM,WAAW,EAAE,IAAI,MAAM,OAAO;EAC5C,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,WAAW;EACtE,MAAM,IAAI,YAAY,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI,MAAM;EAC9D,OAAO,EAAE,KAAK,MAAM,GAAG;CACzB,CAAC;CAED,2BAA2B,GAAG;AAChC;;AAGA,SAAS,2BAA2B,KAAwB;CAC1D,IAAI,QAAQ,wBAAwB,OAAO,MAAM;EAC/C,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,UAAU;EAC1F,OAAO,EAAE,KAAK,MAAM,IAAI,yBAAyB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;CAClF,CAAC;CAED,IAAI,QAAQ,yBAAyB,OAAO,MAAM;EAChD,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,WAAW;EAC3F,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,IAAI,KAAK,UAAU,SAAS,GAAG,GAC7B,MAAM,IAAI,cAAc,KAAK,EAC3B,SACE,6GACJ,CAAC;EAEH,OAAO,EAAE,KACP,MAAM,IAAI,yBAAyB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAChD,QAAQ,IACR,KAAK,WACL,KAAK,IACP,GACA,GACF;CACF,CAAC;CAED,IAAI,QAAQ,yBAAyB,OAAO,MAAM;EAChD,MAAM,EAAE,MAAM,cAAc,EAAE,IAAI,MAAM,OAAO;EAC/C,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,WAAW;EACtE,MAAM,IAAI,yBAAyB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI,SAAS;EAC9E,OAAO,EAAE,KAAK,MAAM,GAAG;CACzB,CAAC;AACH"}
+{"version":3,"file":"members.mjs","names":[],"sources":["../../src/routers/members.ts"],"sourcesContent":["import { createRoute, z } from \"@hono/zod-openapi\";\nimport { MemberModel, ProjectGroupMappingModel } from \"@storyshelf/core/models\";\nimport type { ProjectRole } from \"@storyshelf/core/types\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { resolveAuthorizedProject } from \"./helpers.ts\";\nimport {\n  groupMappingCreateSchema,\n  groupMappingSchema,\n  memberRoleSchema,\n  memberSchema,\n  memberSetSchema,\n  notFound,\n  unauthorized,\n} from \"./schemas.ts\";\nconst VIEW_ROLES: readonly ProjectRole[] = [\"viewer\", \"developer\", \"approver\", \"admin\"];\nconst ADMIN_ROLES: readonly ProjectRole[] = [\"admin\"];\n\nconst listMembersRoute = createRoute({\n  method: \"get\",\n  tags: [\"Members\"],\n  summary: \"List members\",\n  path: \"/api/v1/projects/{slug}/members\",\n  request: { params: z.object({ slug: z.string() }) },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: memberSchema.array() } },\n      description: \"List project members\",\n    },\n    ...notFound,\n    ...unauthorized,\n  },\n});\n\nconst setMemberRoute = createRoute({\n  method: \"post\",\n  tags: [\"Members\"],\n  summary: \"Add or update a member\",\n  path: \"/api/v1/projects/{slug}/members\",\n  request: {\n    params: z.object({ slug: z.string() }),\n    body: { content: { \"application/json\": { schema: memberSetSchema } } },\n  },\n  responses: {\n    201: {\n      content: { \"application/json\": { schema: memberSchema } },\n      description: \"Added or updated member\",\n    },\n    ...notFound,\n  },\n});\n\nconst updateMemberRoute = createRoute({\n  method: \"patch\",\n  tags: [\"Members\"],\n  summary: \"Change a member's role\",\n  path: \"/api/v1/projects/{slug}/members/{userId}\",\n  request: {\n    params: z.object({ slug: z.string(), userId: z.string() }),\n    body: { content: { \"application/json\": { schema: memberRoleSchema } } },\n  },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: memberSchema } },\n      description: \"Updated member role\",\n    },\n    ...notFound,\n  },\n});\n\nconst deleteMemberRoute = createRoute({\n  method: \"delete\",\n  tags: [\"Members\"],\n  summary: \"Remove a member\",\n  path: \"/api/v1/projects/{slug}/members/{userId}\",\n  request: { params: z.object({ slug: z.string(), userId: z.string() }) },\n  responses: {\n    204: { description: \"Removed member\" },\n    ...notFound,\n  },\n});\n\nconst listGroupMappingsRoute = createRoute({\n  method: \"get\",\n  tags: [\"Members\"],\n  summary: \"List group mappings\",\n  path: \"/api/v1/projects/{slug}/group-mappings\",\n  request: { params: z.object({ slug: z.string() }) },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: groupMappingSchema.array() } },\n      description: \"List identity-provider group mappings\",\n    },\n    ...notFound,\n    ...unauthorized,\n  },\n});\n\nconst createGroupMappingRoute = createRoute({\n  method: \"post\",\n  tags: [\"Members\"],\n  summary: \"Create a group mapping\",\n  path: \"/api/v1/projects/{slug}/group-mappings\",\n  request: {\n    params: z.object({ slug: z.string() }),\n    body: { content: { \"application/json\": { schema: groupMappingCreateSchema } } },\n  },\n  responses: {\n    201: {\n      content: { \"application/json\": { schema: groupMappingSchema } },\n      description: \"Created group mapping (exact group-name match)\",\n    },\n    ...notFound,\n  },\n});\n\nconst deleteGroupMappingRoute = createRoute({\n  method: \"delete\",\n  tags: [\"Members\"],\n  summary: \"Remove a group mapping\",\n  path: \"/api/v1/projects/{slug}/group-mappings/{mappingId}\",\n  request: { params: z.object({ slug: z.string(), mappingId: z.string() }) },\n  responses: {\n    204: { description: \"Removed group mapping\" },\n    ...notFound,\n  },\n});\n\n/** Register the project member list, upsert, and removal endpoints. */\nexport function registerMembers(app: ShelfRouter): void {\n  app.openapi(listMembersRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...VIEW_ROLES);\n    return c.json(await new MemberModel(getStore().db).list(project.id));\n  });\n\n  app.openapi(setMemberRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...ADMIN_ROLES);\n    const body = c.req.valid(\"json\");\n    return c.json(\n      await new MemberModel(getStore().db).set(project.id, body.userId, body.role),\n      201,\n    );\n  });\n\n  app.openapi(updateMemberRoute, async (c) => {\n    const { slug, userId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...ADMIN_ROLES);\n    const body = c.req.valid(\"json\");\n    return c.json(await new MemberModel(getStore().db).set(project.id, userId, body.role));\n  });\n\n  app.openapi(deleteMemberRoute, async (c) => {\n    const { slug, userId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...ADMIN_ROLES);\n    await new MemberModel(getStore().db).remove(project.id, userId);\n    return c.body(null, 204);\n  });\n\n  registerGroupMappingRoutes(app);\n}\n\n/** Register identity-provider group mapping endpoints. */\nfunction registerGroupMappingRoutes(app: ShelfRouter): void {\n  app.openapi(listGroupMappingsRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...VIEW_ROLES);\n    return c.json(await new ProjectGroupMappingModel(getStore().db).list(project.id));\n  });\n\n  app.openapi(createGroupMappingRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...ADMIN_ROLES);\n    const body = c.req.valid(\"json\");\n    const inputError = ProjectGroupMappingModel.inputError(body.groupName, body.role);\n    if (inputError) {\n      throw new HTTPException(400, { message: inputError });\n    }\n    return c.json(\n      await new ProjectGroupMappingModel(getStore().db).create(\n        project.id,\n        body.groupName,\n        body.role,\n      ),\n      201,\n    );\n  });\n\n  app.openapi(deleteGroupMappingRoute, async (c) => {\n    const { slug, mappingId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...ADMIN_ROLES);\n    await new ProjectGroupMappingModel(getStore().db).remove(project.id, mappingId);\n    return c.body(null, 204);\n  });\n}\n"],"mappings":";;;;;;;;;;AAgBA,MAAM,aAAqC;CAAC;CAAU;CAAa;CAAY;AAAO;AACtF,MAAM,cAAsC,CAAC,OAAO;AAEpD,MAAM,mBAAmB,YAAY;CACnC,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE;CAClD,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,aAAa,MAAM,EAAE,EAAE;GAChE,aAAa;EACf;EACA,GAAG;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,iBAAiB,YAAY;CACjC,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;EACrC,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,EAAE,EAAE;CACvE;CACA,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,aAAa,EAAE;GACxD,aAAa;EACf;EACA,GAAG;CACL;AACF,CAAC;AAED,MAAM,oBAAoB,YAAY;CACpC,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO;GAAE,MAAM,EAAE,OAAO;GAAG,QAAQ,EAAE,OAAO;EAAE,CAAC;EACzD,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,iBAAiB,EAAE,EAAE;CACxE;CACA,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,aAAa,EAAE;GACxD,aAAa;EACf;EACA,GAAG;CACL;AACF,CAAC;AAED,MAAM,oBAAoB,YAAY;CACpC,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,QAAQ,EAAE,OAAO;CAAE,CAAC,EAAE;CACtE,WAAW;EACT,KAAK,EAAE,aAAa,iBAAiB;EACrC,GAAG;CACL;AACF,CAAC;AAED,MAAM,yBAAyB,YAAY;CACzC,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE;CAClD,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,mBAAmB,MAAM,EAAE,EAAE;GACtE,aAAa;EACf;EACA,GAAG;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,0BAA0B,YAAY;CAC1C,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;EACrC,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,yBAAyB,EAAE,EAAE;CAChF;CACA,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,mBAAmB,EAAE;GAC9D,aAAa;EACf;EACA,GAAG;CACL;AACF,CAAC;AAED,MAAM,0BAA0B,YAAY;CAC1C,QAAQ;CACR,MAAM,CAAC,SAAS;CAChB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,WAAW,EAAE,OAAO;CAAE,CAAC,EAAE;CACzE,WAAW;EACT,KAAK,EAAE,aAAa,wBAAwB;EAC5C,GAAG;CACL;AACF,CAAC;;AAGD,SAAgB,gBAAgB,KAAwB;CACtD,IAAI,QAAQ,kBAAkB,OAAO,MAAM;EACzC,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,UAAU;EAC1F,OAAO,EAAE,KAAK,MAAM,IAAI,YAAY,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;CACrE,CAAC;CAED,IAAI,QAAQ,gBAAgB,OAAO,MAAM;EACvC,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,WAAW;EAC3F,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,OAAO,EAAE,KACP,MAAM,IAAI,YAAY,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,IAAI,KAAK,QAAQ,KAAK,IAAI,GAC3E,GACF;CACF,CAAC;CAED,IAAI,QAAQ,mBAAmB,OAAO,MAAM;EAC1C,MAAM,EAAE,MAAM,WAAW,EAAE,IAAI,MAAM,OAAO;EAC5C,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,WAAW;EACtE,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,OAAO,EAAE,KAAK,MAAM,IAAI,YAAY,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC;CACvF,CAAC;CAED,IAAI,QAAQ,mBAAmB,OAAO,MAAM;EAC1C,MAAM,EAAE,MAAM,WAAW,EAAE,IAAI,MAAM,OAAO;EAC5C,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,WAAW;EACtE,MAAM,IAAI,YAAY,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI,MAAM;EAC9D,OAAO,EAAE,KAAK,MAAM,GAAG;CACzB,CAAC;CAED,2BAA2B,GAAG;AAChC;;AAGA,SAAS,2BAA2B,KAAwB;CAC1D,IAAI,QAAQ,wBAAwB,OAAO,MAAM;EAC/C,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,UAAU;EAC1F,OAAO,EAAE,KAAK,MAAM,IAAI,yBAAyB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;CAClF,CAAC;CAED,IAAI,QAAQ,yBAAyB,OAAO,MAAM;EAChD,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,WAAW;EAC3F,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,MAAM,aAAa,yBAAyB,WAAW,KAAK,WAAW,KAAK,IAAI;EAChF,IAAI,YACF,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,WAAW,CAAC;EAEtD,OAAO,EAAE,KACP,MAAM,IAAI,yBAAyB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAChD,QAAQ,IACR,KAAK,WACL,KAAK,IACP,GACA,GACF;CACF,CAAC;CAED,IAAI,QAAQ,yBAAyB,OAAO,MAAM;EAChD,MAAM,EAAE,MAAM,cAAc,EAAE,IAAI,MAAM,OAAO;EAC/C,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,WAAW;EACtE,MAAM,IAAI,yBAAyB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI,SAAS;EAC9E,OAAO,EAAE,KAAK,MAAM,GAAG;CACzB,CAAC;AACH"}