@storyshelf/app 0.6.2 → 0.7.0

package/dist/routers/published-access.mjs

@@ -0,0 +1,52 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { currentProjectRole } from "./helpers.mjs";
+import { isPublicBuild } from "@storyshelf/core/models";
+//#region src/routers/published-access.ts
+/**
+* The one policy for reading a build's published files (ADR 0007, decision 5; ADR 0011): a signed
+* token naming the build, or a build anyone may open (public, or an instance without sign-in), or
+* a signed-in viewer of the project. Every route that serves published files asks
+* {@link publishedAccess} and takes its CORS headers from {@link publishedCorsHeaders}.
+*/
+const VIEW_ROLES = /* @__PURE__ */ new Set([
+	"viewer",
+	"developer",
+	"approver",
+	"admin"
+]);
+/**
+* Whether the request may read `build`'s published files, and how. A `grant` (verified claims of a
+* signed URL) decides alone: it opens exactly the build it names and nothing falls through to the
+* other rules, so a token that does not fit answers like a missing one.
+*/
+async function publishedAccess(build, project, grant) {
+	if (grant) return grant.projectId === project.id && grant.buildId === build.id && build.projectId === project.id ? "token" : null;
+	if (isAnonymouslyViewable(build, project)) return "public";
+	const role = await currentProjectRole(project.id);
+	return role && VIEW_ROLES.has(role) ? "session" : null;
+}
+/**
+* Whether anyone who can reach the app may fetch the build's published Storybook with no
+* credentials: the instance has no sign-in, or the build is public (ADR 0011).
+*/
+function isAnonymouslyViewable(build, project) {
+	return !getStore().authEnabled || isPublicBuild(project, build);
+}
+/**
+* CORS headers of a published file. A sandboxed preview frame runs on an opaque origin, so its
+* module scripts are cross-origin requests without cookies: they load only when the file answers
+* `Access-Control-Allow-Origin: *`. That is offered exactly where no credentials are involved, for
+* a public build and for a signed URL (which is itself the credential, never sent as a cookie or
+* header, and never with `Allow-Credentials`). A signed-in viewer's private build answers without
+* it: only same-origin pages may read it.
+*/
+function publishedCorsHeaders(access) {
+	return access === "session" ? {} : { "access-control-allow-origin": "*" };
+}
+//#endregion
+export { isAnonymouslyViewable, publishedAccess, publishedCorsHeaders };
+
+//# sourceMappingURL=published-access.mjs.map

package/dist/routers/published-access.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"published-access.mjs","names":[],"sources":["../../src/routers/published-access.ts"],"sourcesContent":["/**\n * The one policy for reading a build's published files (ADR 0007, decision 5; ADR 0011): a signed\n * token naming the build, or a build anyone may open (public, or an instance without sign-in), or\n * a signed-in viewer of the project. Every route that serves published files asks\n * {@link publishedAccess} and takes its CORS headers from {@link publishedCorsHeaders}.\n */\nimport { isPublicBuild } from \"@storyshelf/core/models\";\nimport type { Build, Project } from \"@storyshelf/core/schema\";\nimport type { StorybookTokenClaims } from \"@storyshelf/core/utils\";\nimport { getStore } from \"../store.ts\";\nimport { currentProjectRole } from \"./helpers.ts\";\n\n/** How a request may read a build: by its token, because the build is open, or by a session. */\nexport type PublishedAccess = \"token\" | \"public\" | \"session\";\n\nconst VIEW_ROLES: ReadonlySet<string> = new Set([\"viewer\", \"developer\", \"approver\", \"admin\"]);\n\n/**\n * Whether the request may read `build`'s published files, and how. A `grant` (verified claims of a\n * signed URL) decides alone: it opens exactly the build it names and nothing falls through to the\n * other rules, so a token that does not fit answers like a missing one.\n */\nexport async function publishedAccess(\n  build: Pick<Build, \"id\" | \"projectId\" | \"public\" | \"gitBranch\">,\n  project: Project,\n  grant?: StorybookTokenClaims,\n): Promise<PublishedAccess | null> {\n  if (grant) {\n    return grant.projectId === project.id &&\n      grant.buildId === build.id &&\n      build.projectId === project.id\n      ? \"token\"\n      : null;\n  }\n  if (isAnonymouslyViewable(build, project)) {\n    return \"public\";\n  }\n  const role = await currentProjectRole(project.id);\n  return role && VIEW_ROLES.has(role) ? \"session\" : null;\n}\n\n/**\n * Whether anyone who can reach the app may fetch the build's published Storybook with no\n * credentials: the instance has no sign-in, or the build is public (ADR 0011).\n */\nexport function isAnonymouslyViewable(\n  build: Pick<Build, \"public\" | \"gitBranch\">,\n  project: Project,\n): boolean {\n  return !getStore().authEnabled || isPublicBuild(project, build);\n}\n\n/**\n * CORS headers of a published file. A sandboxed preview frame runs on an opaque origin, so its\n * module scripts are cross-origin requests without cookies: they load only when the file answers\n * `Access-Control-Allow-Origin: *`. That is offered exactly where no credentials are involved, for\n * a public build and for a signed URL (which is itself the credential, never sent as a cookie or\n * header, and never with `Allow-Credentials`). A signed-in viewer's private build answers without\n * it: only same-origin pages may read it.\n */\nexport function publishedCorsHeaders(access: PublishedAccess): Record<string, string> {\n  return access === \"session\" ? {} : { \"access-control-allow-origin\": \"*\" };\n}\n"],"mappings":";;;;;;;;;;;;;AAeA,MAAM,6BAAkC,IAAI,IAAI;CAAC;CAAU;CAAa;CAAY;AAAO,CAAC;;;;;;AAO5F,eAAsB,gBACpB,OACA,SACA,OACiC;CACjC,IAAI,OACF,OAAO,MAAM,cAAc,QAAQ,MACjC,MAAM,YAAY,MAAM,MACxB,MAAM,cAAc,QAAQ,KAC1B,UACA;CAEN,IAAI,sBAAsB,OAAO,OAAO,GACtC,OAAO;CAET,MAAM,OAAO,MAAM,mBAAmB,QAAQ,EAAE;CAChD,OAAO,QAAQ,WAAW,IAAI,IAAI,IAAI,YAAY;AACpD;;;;;AAMA,SAAgB,sBACd,OACA,SACS;CACT,OAAO,CAAC,SAAS,CAAC,CAAC,eAAe,cAAc,SAAS,KAAK;AAChE;;;;;;;;;AAUA,SAAgB,qBAAqB,QAAiD;CACpF,OAAO,WAAW,YAAY,CAAC,IAAI,EAAE,+BAA+B,IAAI;AAC1E"}

package/dist/routers/published-files.mjs

@@ -0,0 +1,52 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { publishedCorsHeaders } from "./published-access.mjs";
+import { isSafeSegment, mimeFor } from "@storyshelf/core/utils";
+import { readPublishedFile } from "@storyshelf/core/capture";
+//#region src/routers/published-files.ts
+/**
+* Serving a build's published files (ADR 0010, ADR 0007 decision 5): the single place that decodes
+* and checks a request path, reads the file through the build's manifest and sets the headers.
+* The published Storybook routes (`/projects/:slug/storybook/build/:id/*`, `/_/:id/*`) and the
+* signed URL route (`/_s/:token/*`) all end here, each bringing the access {@link publishedAccess}
+* granted.
+*/
+/** Headers of every signed URL answer: a token URL must not be cached, indexed or leaked by `Referer`. */
+const SIGNED_URL_HEADERS = {
+	"cache-control": "private, no-store",
+	"referrer-policy": "no-referrer",
+	"x-robots-tag": "noindex, nofollow",
+	"x-content-type-options": "nosniff"
+};
+/**
+* The file path after `base`, decoded once. `""` is the root; `null` when the path is not under
+* `base` or could leave the build: empty, `.` or `..` segments, backslashes and NUL are refused.
+*/
+function publishedRelativePath(path, base) {
+	if (!path.startsWith(base)) return null;
+	let rest;
+	try {
+		rest = decodeURIComponent(path.slice(base.length));
+	} catch {
+		return null;
+	}
+	return rest === "" || rest.split("/").every((segment) => segment !== "" && segment !== "." && !segment.includes("\0") && isSafeSegment(segment)) ? rest : null;
+}
+/** The file as a response, or `null` when the build has no such file. */
+async function servePublishedFile(c, request) {
+	const { projectId, buildId, rel, access } = request;
+	const file = await readPublishedFile(getStore().storage, projectId, buildId, rel);
+	if (!file) return null;
+	const headers = access === "token" ? SIGNED_URL_HEADERS : { "cache-control": request.cacheControl };
+	return c.body(new Uint8Array(file), 200, {
+		...headers,
+		...publishedCorsHeaders(access),
+		"content-type": mimeFor(rel)
+	});
+}
+//#endregion
+export { SIGNED_URL_HEADERS, publishedRelativePath, servePublishedFile };
+
+//# sourceMappingURL=published-files.mjs.map

package/dist/routers/published-files.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"published-files.mjs","names":[],"sources":["../../src/routers/published-files.ts"],"sourcesContent":["/**\n * Serving a build's published files (ADR 0010, ADR 0007 decision 5): the single place that decodes\n * and checks a request path, reads the file through the build's manifest and sets the headers.\n * The published Storybook routes (`/projects/:slug/storybook/build/:id/*`, `/_/:id/*`) and the\n * signed URL route (`/_s/:token/*`) all end here, each bringing the access {@link publishedAccess}\n * granted.\n */\nimport { readPublishedFile } from \"@storyshelf/core/capture\";\nimport { isSafeSegment, mimeFor } from \"@storyshelf/core/utils\";\nimport type { Context } from \"hono\";\nimport { getStore } from \"../store.ts\";\nimport { publishedCorsHeaders, type PublishedAccess } from \"./published-access.ts\";\n\n/** Headers of every signed URL answer: a token URL must not be cached, indexed or leaked by `Referer`. */\nexport const SIGNED_URL_HEADERS = {\n  \"cache-control\": \"private, no-store\",\n  \"referrer-policy\": \"no-referrer\",\n  \"x-robots-tag\": \"noindex, nofollow\",\n  \"x-content-type-options\": \"nosniff\",\n} as const;\n\n/**\n * The file path after `base`, decoded once. `\"\"` is the root; `null` when the path is not under\n * `base` or could leave the build: empty, `.` or `..` segments, backslashes and NUL are refused.\n */\nexport function publishedRelativePath(path: string, base: string): string | null {\n  if (!path.startsWith(base)) {\n    return null;\n  }\n  let rest: string;\n  try {\n    rest = decodeURIComponent(path.slice(base.length));\n  } catch {\n    return null;\n  }\n  const safe =\n    rest === \"\" ||\n    rest\n      .split(\"/\")\n      .every(\n        (segment) =>\n          segment !== \"\" && segment !== \".\" && !segment.includes(\"\\0\") && isSafeSegment(segment),\n      );\n  return safe ? rest : null;\n}\n\n/** Where a file of a build lives and how the request got to it. */\nexport interface PublishedFileRequest {\n  projectId: string;\n  buildId: string;\n  /** A path accepted by {@link publishedRelativePath}, not the root. */\n  rel: string;\n  access: PublishedAccess;\n  /** `Cache-Control` of a normal answer; a signed URL always answers `private, no-store`. */\n  cacheControl: string;\n}\n\n/** The file as a response, or `null` when the build has no such file. */\nexport async function servePublishedFile(\n  c: Context,\n  request: PublishedFileRequest,\n): Promise<Response | null> {\n  const { projectId, buildId, rel, access } = request;\n  const file = await readPublishedFile(getStore().storage, projectId, buildId, rel);\n  if (!file) {\n    return null;\n  }\n  const headers =\n    access === \"token\" ? SIGNED_URL_HEADERS : { \"cache-control\": request.cacheControl };\n  return c.body(new Uint8Array(file), 200, {\n    ...headers,\n    ...publishedCorsHeaders(access),\n    \"content-type\": mimeFor(rel),\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAcA,MAAa,qBAAqB;CAChC,iBAAiB;CACjB,mBAAmB;CACnB,gBAAgB;CAChB,0BAA0B;AAC5B;;;;;AAMA,SAAgB,sBAAsB,MAAc,MAA6B;CAC/E,IAAI,CAAC,KAAK,WAAW,IAAI,GACvB,OAAO;CAET,IAAI;CACJ,IAAI;EACF,OAAO,mBAAmB,KAAK,MAAM,KAAK,MAAM,CAAC;CACnD,QAAQ;EACN,OAAO;CACT;CASA,OAPE,SAAS,MACT,KACG,MAAM,GAAG,CAAC,CACV,OACE,YACC,YAAY,MAAM,YAAY,OAAO,CAAC,QAAQ,SAAS,IAAI,KAAK,cAAc,OAAO,CACzF,IACU,OAAO;AACvB;;AAcA,eAAsB,mBACpB,GACA,SAC0B;CAC1B,MAAM,EAAE,WAAW,SAAS,KAAK,WAAW;CAC5C,MAAM,OAAO,MAAM,kBAAkB,SAAS,CAAC,CAAC,SAAS,WAAW,SAAS,GAAG;CAChF,IAAI,CAAC,MACH,OAAO;CAET,MAAM,UACJ,WAAW,UAAU,qBAAqB,EAAE,iBAAiB,QAAQ,aAAa;CACpF,OAAO,EAAE,KAAK,IAAI,WAAW,IAAI,GAAG,KAAK;EACvC,GAAG;EACH,GAAG,qBAAqB,MAAM;EAC9B,gBAAgB,QAAQ,GAAG;CAC7B,CAAC;AACH"}

package/dist/routers/review-forms.mjs

@@ -0,0 +1,72 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { resolveAuthorizedProject, resolveReviewer } from "./helpers.mjs";
+import { hxRefresh } from "./htmx.mjs";
+import { flash } from "./flash.mjs";
+import { buildReviewCreateSchema, commentCreateSchema } from "./schemas.mjs";
+import { APPROVER_ROLES, DEVELOPER_ROLES, buildForProject } from "./builds.handlers.mjs";
+import { giveVerdict } from "./build-reviews.handlers.mjs";
+import { createComment, resolveBuildComment } from "./comments.mjs";
+import { HTTPException } from "hono/http-exception";
+//#region src/routers/review-forms.ts
+/** Register the form routes of review (`review` class). */
+function registerReviewForms(app) {
+	const base = "/projects/:slug/builds/:buildId";
+	app.post(`${base}/comments`, async (c) => {
+		const { project, build } = await target(c, DEVELOPER_ROLES);
+		const input = commentCreateSchema.safeParse(await fields(c));
+		if (!input.success) throw new HTTPException(400, { message: "A comment needs some text (up to 4000 characters)" });
+		await createComment(project, build.id, input.data);
+		return done(c, build.id, "Comment added");
+	});
+	app.post(`${base}/comments/:commentId/resolve`, async (c) => {
+		const { build } = await target(c, DEVELOPER_ROLES);
+		await resolveBuildComment(build.id, c.req.param("commentId"));
+		return done(c, build.id, "Comment resolved");
+	});
+	app.post(`${base}/reviews`, async (c) => {
+		const { project, build } = await target(c, APPROVER_ROLES);
+		const input = buildReviewCreateSchema.safeParse(await fields(c));
+		if (!input.success) throw new HTTPException(400, { message: "Choose approve or reject" });
+		await giveVerdict(project, build, await resolveReviewer(c), input.data);
+		return done(c, build.id, "Verdict recorded");
+	});
+}
+async function target(c, roles) {
+	const project = await resolveAuthorizedProject(c, c.req.param("slug") ?? "", ...roles);
+	return {
+		project,
+		build: await buildForProject(project.id, c.req.param("buildId") ?? "")
+	};
+}
+/** The form's text fields, blanks left out (an empty `storyId` means no story). */
+async function fields(c) {
+	const form = await c.req.formData();
+	const values = {};
+	for (const [key, value] of form.entries()) if (typeof value === "string" && key !== "csrf_token" && value.trim() !== "") values[key] = value.trim();
+	return values;
+}
+/** HTMX reloads the page it posted from; a plain form goes back to the page, else the build. */
+function done(c, buildId, message) {
+	flash(c, message);
+	if (c.req.header("HX-Request") === "true") {
+		hxRefresh(c);
+		return c.body(null, 204);
+	}
+	return c.redirect(returnPath(c, buildId), 303);
+}
+/** The path the form was posted from when it is on this host, else the build page. */
+function returnPath(c, buildId) {
+	const fallback = `/projects/${c.req.param("slug") ?? ""}/builds/${buildId}`;
+	try {
+		const referer = new URL(c.req.header("referer") ?? "", c.req.url);
+		return referer.origin === new URL(c.req.url).origin ? `${referer.pathname}${referer.search}` : fallback;
+	} catch {
+		return fallback;
+	}
+}
+//#endregion
+export { registerReviewForms };
+
+//# sourceMappingURL=review-forms.mjs.map

package/dist/routers/review-forms.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-forms.mjs","names":[],"sources":["../../src/routers/review-forms.ts"],"sourcesContent":["/**\n * The review forms of the build, diff and component pages. HTMX and plain forms post\n * `application/x-www-form-urlencoded`, which the JSON endpoints under `/api/v1` refuse (415), so\n * each form has a page route that reads the form and calls the same handlers as the API. All\n * three are `review` routes: they answer 404 for a project with review off.\n */\nimport type { Build, Project } from \"@storyshelf/core/schema\";\nimport type { ProjectRole } from \"@storyshelf/core/types\";\nimport type { Context } from \"hono\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { giveVerdict } from \"./build-reviews.handlers.ts\";\nimport { APPROVER_ROLES, DEVELOPER_ROLES, buildForProject } from \"./builds.handlers.ts\";\nimport { createComment, resolveBuildComment } from \"./comments.ts\";\nimport { flash } from \"./flash.ts\";\nimport { resolveAuthorizedProject, resolveReviewer } from \"./helpers.ts\";\nimport { hxRefresh } from \"./htmx.ts\";\nimport { buildReviewCreateSchema, commentCreateSchema } from \"./schemas.ts\";\n\n/** Register the form routes of review (`review` class). */\nexport function registerReviewForms(app: ShelfRouter): void {\n  const base = \"/projects/:slug/builds/:buildId\";\n  app.post(`${base}/comments`, async (c) => {\n    const { project, build } = await target(c, DEVELOPER_ROLES);\n    const input = commentCreateSchema.safeParse(await fields(c));\n    if (!input.success) {\n      throw new HTTPException(400, {\n        message: \"A comment needs some text (up to 4000 characters)\",\n      });\n    }\n    await createComment(project, build.id, input.data);\n    return done(c, build.id, \"Comment added\");\n  });\n\n  app.post(`${base}/comments/:commentId/resolve`, async (c) => {\n    const { build } = await target(c, DEVELOPER_ROLES);\n    await resolveBuildComment(build.id, c.req.param(\"commentId\"));\n    return done(c, build.id, \"Comment resolved\");\n  });\n\n  app.post(`${base}/reviews`, async (c) => {\n    const { project, build } = await target(c, APPROVER_ROLES);\n    const input = buildReviewCreateSchema.safeParse(await fields(c));\n    if (!input.success) {\n      throw new HTTPException(400, { message: \"Choose approve or reject\" });\n    }\n    await giveVerdict(project, build, await resolveReviewer(c), input.data);\n    return done(c, build.id, \"Verdict recorded\");\n  });\n}\n\nasync function target(\n  c: Context,\n  roles: readonly ProjectRole[],\n): Promise<{ project: Project; build: Build }> {\n  const project = await resolveAuthorizedProject(c, c.req.param(\"slug\") ?? \"\", ...roles);\n  const build = await buildForProject(project.id, c.req.param(\"buildId\") ?? \"\");\n  return { project, build };\n}\n\n/** The form's text fields, blanks left out (an empty `storyId` means no story). */\nasync function fields(c: Context): Promise<Record<string, string>> {\n  const form = await c.req.formData();\n  const values: Record<string, string> = {};\n  for (const [key, value] of form.entries()) {\n    if (typeof value === \"string\" && key !== \"csrf_token\" && value.trim() !== \"\") {\n      values[key] = value.trim();\n    }\n  }\n  return values;\n}\n\n/** HTMX reloads the page it posted from; a plain form goes back to the page, else the build. */\nfunction done(c: Context, buildId: string, message: string): Response {\n  flash(c, message);\n  if (c.req.header(\"HX-Request\") === \"true\") {\n    hxRefresh(c);\n    return c.body(null, 204);\n  }\n  return c.redirect(returnPath(c, buildId), 303);\n}\n\n/** The path the form was posted from when it is on this host, else the build page. */\nfunction returnPath(c: Context, buildId: string): string {\n  const slug = c.req.param(\"slug\") ?? \"\";\n  const fallback = `/projects/${slug}/builds/${buildId}`;\n  try {\n    const referer = new URL(c.req.header(\"referer\") ?? \"\", c.req.url);\n    return referer.origin === new URL(c.req.url).origin\n      ? `${referer.pathname}${referer.search}`\n      : fallback;\n  } catch {\n    return fallback;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAoBA,SAAgB,oBAAoB,KAAwB;CAC1D,MAAM,OAAO;CACb,IAAI,KAAK,GAAG,KAAK,YAAY,OAAO,MAAM;EACxC,MAAM,EAAE,SAAS,UAAU,MAAM,OAAO,GAAG,eAAe;EAC1D,MAAM,QAAQ,oBAAoB,UAAU,MAAM,OAAO,CAAC,CAAC;EAC3D,IAAI,CAAC,MAAM,SACT,MAAM,IAAI,cAAc,KAAK,EAC3B,SAAS,oDACX,CAAC;EAEH,MAAM,cAAc,SAAS,MAAM,IAAI,MAAM,IAAI;EACjD,OAAO,KAAK,GAAG,MAAM,IAAI,eAAe;CAC1C,CAAC;CAED,IAAI,KAAK,GAAG,KAAK,+BAA+B,OAAO,MAAM;EAC3D,MAAM,EAAE,UAAU,MAAM,OAAO,GAAG,eAAe;EACjD,MAAM,oBAAoB,MAAM,IAAI,EAAE,IAAI,MAAM,WAAW,CAAC;EAC5D,OAAO,KAAK,GAAG,MAAM,IAAI,kBAAkB;CAC7C,CAAC;CAED,IAAI,KAAK,GAAG,KAAK,WAAW,OAAO,MAAM;EACvC,MAAM,EAAE,SAAS,UAAU,MAAM,OAAO,GAAG,cAAc;EACzD,MAAM,QAAQ,wBAAwB,UAAU,MAAM,OAAO,CAAC,CAAC;EAC/D,IAAI,CAAC,MAAM,SACT,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,2BAA2B,CAAC;EAEtE,MAAM,YAAY,SAAS,OAAO,MAAM,gBAAgB,CAAC,GAAG,MAAM,IAAI;EACtE,OAAO,KAAK,GAAG,MAAM,IAAI,kBAAkB;CAC7C,CAAC;AACH;AAEA,eAAe,OACb,GACA,OAC6C;CAC7C,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,MAAM,KAAK,IAAI,GAAG,KAAK;CAErF,OAAO;EAAE;EAAS,OAAA,MADE,gBAAgB,QAAQ,IAAI,EAAE,IAAI,MAAM,SAAS,KAAK,EAAE;CACpD;AAC1B;;AAGA,eAAe,OAAO,GAA6C;CACjE,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;CAClC,MAAM,SAAiC,CAAC;CACxC,KAAK,MAAM,CAAC,KAAK,UAAU,KAAK,QAAQ,GACtC,IAAI,OAAO,UAAU,YAAY,QAAQ,gBAAgB,MAAM,KAAK,MAAM,IACxE,OAAO,OAAO,MAAM,KAAK;CAG7B,OAAO;AACT;;AAGA,SAAS,KAAK,GAAY,SAAiB,SAA2B;CACpE,MAAM,GAAG,OAAO;CAChB,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,QAAQ;EACzC,UAAU,CAAC;EACX,OAAO,EAAE,KAAK,MAAM,GAAG;CACzB;CACA,OAAO,EAAE,SAAS,WAAW,GAAG,OAAO,GAAG,GAAG;AAC/C;;AAGA,SAAS,WAAW,GAAY,SAAyB;CAEvD,MAAM,WAAW,aADJ,EAAE,IAAI,MAAM,MAAM,KAAK,GACD,UAAU;CAC7C,IAAI;EACF,MAAM,UAAU,IAAI,IAAI,EAAE,IAAI,OAAO,SAAS,KAAK,IAAI,EAAE,IAAI,GAAG;EAChE,OAAO,QAAQ,WAAW,IAAI,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,SACzC,GAAG,QAAQ,WAAW,QAAQ,WAC9B;CACN,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/routers/review-section.handlers.mjs

@@ -0,0 +1,85 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { currentProjectRole } from "./helpers.mjs";
+import { reviewStateOf } from "./build-reviews.handlers.mjs";
+import { publishingOf } from "@storyshelf/core/capture";
+import { CommentModel, UserModel, changesetOf } from "@storyshelf/core/models";
+//#region src/routers/review-section.handlers.ts
+/** Data behind the review section of the build page (ADR 0013): verdicts, changeset and comments. */
+/** Whether review is on for the project (a row without the column counts as on). */
+function reviewIsOn(project) {
+	return project.reviewEnabled !== false;
+}
+/** The viewer's review rights: everything with auth off, else by their role on the project. */
+async function reviewCapabilities(project) {
+	if (!getStore().authEnabled) return {
+		canComment: true,
+		canVerdict: true
+	};
+	const role = await currentProjectRole(project.id);
+	return {
+		canComment: role === "developer" || role === "approver" || role === "admin",
+		canVerdict: role === "approver" || role === "admin"
+	};
+}
+/** The review section of a build; null when the project has review off. */
+async function loadReviewSection(project, build, catalog) {
+	if (!reviewIsOn(project)) return null;
+	const { db, testing } = getStore();
+	const [state, changeset, comments, capabilities, publishing] = await Promise.all([
+		reviewStateOf(project, build),
+		changesetOf(db, project, build),
+		new CommentModel(db).listByBuild(build.id),
+		reviewCapabilities(project),
+		publishingOrPending(build)
+	]);
+	const shown = comments.filter((comment) => comment.snapshotId === null);
+	return {
+		project,
+		build,
+		state,
+		changeset,
+		firstStory: firstStoryOf(catalog),
+		comments: shown,
+		names: await namesOf([...state.latest, ...shown].map((item) => item.userId)),
+		testing,
+		publishing,
+		...capabilities
+	};
+}
+/** How publishing stands; a storage probe that fails reads as the storage-independent state. */
+async function publishingOrPending(build) {
+	try {
+		return await publishingOf(getStore().storage, build);
+	} catch {
+		return await publishingOf(void 0, build);
+	}
+}
+/** Display names of the given users; ids that no longer resolve show as the id. */
+async function namesOf(userIds) {
+	const users = new UserModel(getStore().db);
+	const ids = [...new Set(userIds.filter((id) => id !== null))];
+	const found = await Promise.all(ids.map(async (id) => [id, await users.get(id)]));
+	return new Map(found.map(([id, user]) => [id, user?.name ?? user?.email ?? id]));
+}
+/** Story file -> id of its first story. */
+function firstStoryOf(catalog) {
+	const first = /* @__PURE__ */ new Map();
+	for (const entry of catalog?.entries ?? []) if (entry.type === "story" && !first.has(entry.importPath)) first.set(entry.importPath, entry.id);
+	return first;
+}
+/** Story comments of `build` for a component page; null when the project has review off. */
+async function loadComponentReview(project, build) {
+	if (!reviewIsOn(project)) return null;
+	const [comments, capabilities] = await Promise.all([new CommentModel(getStore().db).listByBuild(build.id), reviewCapabilities(project)]);
+	return {
+		comments: comments.filter((comment) => comment.storyId !== null),
+		canComment: capabilities.canComment
+	};
+}
+//#endregion
+export { loadComponentReview, loadReviewSection, namesOf, reviewCapabilities, reviewIsOn };
+
+//# sourceMappingURL=review-section.handlers.mjs.map

package/dist/routers/review-section.handlers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-section.handlers.mjs","names":[],"sources":["../../src/routers/review-section.handlers.ts"],"sourcesContent":["/** Data behind the review section of the build page (ADR 0013): verdicts, changeset and comments. */\nimport { publishingOf, type Catalog } from \"@storyshelf/core/capture\";\nimport { changesetOf, CommentModel, UserModel, type BuildChangeset } from \"@storyshelf/core/models\";\nimport type { Build, Comment, Project } from \"@storyshelf/core/schema\";\nimport { getStore } from \"../store.ts\";\nimport { reviewStateOf, type ReviewState } from \"./build-reviews.handlers.ts\";\nimport { currentProjectRole } from \"./helpers.ts\";\n\n/** What the viewer may do in review. */\nexport interface ReviewCapabilities {\n  /** Write build, story and snapshot comments (developer and above). */\n  canComment: boolean;\n  /** Give a verdict (approver and admin). */\n  canVerdict: boolean;\n}\n\n/** Everything the review cards render. */\nexport interface ReviewSectionData extends ReviewCapabilities {\n  project: Project;\n  build: Build;\n  /** The verdicts and what they make of the build. */\n  state: ReviewState;\n  changeset: BuildChangeset;\n  /** First story of each story file in the build, to link a component to its published story. */\n  firstStory: ReadonlyMap<string, string>;\n  /** Build and story comments (snapshot comments belong to the diff view). */\n  comments: Comment[];\n  /** Display names of the users behind verdicts and comments, by user id. */\n  names: ReadonlyMap<string, string>;\n  /** Whether the snapshot rollup decides the build, so the verdict is a sign-off only. */\n  testing: boolean;\n  /** Whether the build's Storybook is published; a verdict waits for `success` (ADR 0013). */\n  publishing: Awaited<ReturnType<typeof publishingOf>>;\n}\n\n/** Whether review is on for the project (a row without the column counts as on). */\nexport function reviewIsOn(project: Pick<Project, \"reviewEnabled\">): boolean {\n  return project.reviewEnabled !== false;\n}\n\n/** The viewer's review rights: everything with auth off, else by their role on the project. */\nexport async function reviewCapabilities(project: Project): Promise<ReviewCapabilities> {\n  if (!getStore().authEnabled) {\n    return { canComment: true, canVerdict: true };\n  }\n  const role = await currentProjectRole(project.id);\n  return {\n    canComment: role === \"developer\" || role === \"approver\" || role === \"admin\",\n    canVerdict: role === \"approver\" || role === \"admin\",\n  };\n}\n\n/** The review section of a build; null when the project has review off. */\nexport async function loadReviewSection(\n  project: Project,\n  build: Build,\n  catalog: Catalog | null,\n): Promise<ReviewSectionData | null> {\n  if (!reviewIsOn(project)) {\n    return null;\n  }\n  const { db, testing } = getStore();\n  const [state, changeset, comments, capabilities, publishing] = await Promise.all([\n    reviewStateOf(project, build),\n    changesetOf(db, project, build),\n    new CommentModel(db).listByBuild(build.id),\n    reviewCapabilities(project),\n    publishingOrPending(build),\n  ]);\n  const shown = comments.filter((comment) => comment.snapshotId === null);\n  return {\n    project,\n    build,\n    state,\n    changeset,\n    firstStory: firstStoryOf(catalog),\n    comments: shown,\n    names: await namesOf([...state.latest, ...shown].map((item) => item.userId)),\n    testing,\n    publishing,\n    ...capabilities,\n  };\n}\n\n/** How publishing stands; a storage probe that fails reads as the storage-independent state. */\nasync function publishingOrPending(build: Build): Promise<ReviewSectionData[\"publishing\"]> {\n  try {\n    return await publishingOf(getStore().storage, build);\n  } catch {\n    return await publishingOf(undefined, build);\n  }\n}\n\n/** Display names of the given users; ids that no longer resolve show as the id. */\nexport async function namesOf(userIds: readonly (string | null)[]): Promise<Map<string, string>> {\n  const users = new UserModel(getStore().db);\n  const ids = [...new Set(userIds.filter((id): id is string => id !== null))];\n  const found = await Promise.all(ids.map(async (id) => [id, await users.get(id)] as const));\n  return new Map(found.map(([id, user]) => [id, user?.name ?? user?.email ?? id]));\n}\n\n/** Story file -> id of its first story. */\nfunction firstStoryOf(catalog: Catalog | null): Map<string, string> {\n  const first = new Map<string, string>();\n  for (const entry of catalog?.entries ?? []) {\n    if (entry.type === \"story\" && !first.has(entry.importPath)) {\n      first.set(entry.importPath, entry.id);\n    }\n  }\n  return first;\n}\n\n/** What a component page needs of review: the story comments of the build it shows. */\nexport interface ComponentReview {\n  comments: Comment[];\n  canComment: boolean;\n}\n\n/** Story comments of `build` for a component page; null when the project has review off. */\nexport async function loadComponentReview(\n  project: Project,\n  build: Build,\n): Promise<ComponentReview | null> {\n  if (!reviewIsOn(project)) {\n    return null;\n  }\n  const [comments, capabilities] = await Promise.all([\n    new CommentModel(getStore().db).listByBuild(build.id),\n    reviewCapabilities(project),\n  ]);\n  return {\n    comments: comments.filter((comment) => comment.storyId !== null),\n    canComment: capabilities.canComment,\n  };\n}\n"],"mappings":";;;;;;;;;;;AAoCA,SAAgB,WAAW,SAAkD;CAC3E,OAAO,QAAQ,kBAAkB;AACnC;;AAGA,eAAsB,mBAAmB,SAA+C;CACtF,IAAI,CAAC,SAAS,CAAC,CAAC,aACd,OAAO;EAAE,YAAY;EAAM,YAAY;CAAK;CAE9C,MAAM,OAAO,MAAM,mBAAmB,QAAQ,EAAE;CAChD,OAAO;EACL,YAAY,SAAS,eAAe,SAAS,cAAc,SAAS;EACpE,YAAY,SAAS,cAAc,SAAS;CAC9C;AACF;;AAGA,eAAsB,kBACpB,SACA,OACA,SACmC;CACnC,IAAI,CAAC,WAAW,OAAO,GACrB,OAAO;CAET,MAAM,EAAE,IAAI,YAAY,SAAS;CACjC,MAAM,CAAC,OAAO,WAAW,UAAU,cAAc,cAAc,MAAM,QAAQ,IAAI;EAC/E,cAAc,SAAS,KAAK;EAC5B,YAAY,IAAI,SAAS,KAAK;EAC9B,IAAI,aAAa,EAAE,CAAC,CAAC,YAAY,MAAM,EAAE;EACzC,mBAAmB,OAAO;EAC1B,oBAAoB,KAAK;CAC3B,CAAC;CACD,MAAM,QAAQ,SAAS,QAAQ,YAAY,QAAQ,eAAe,IAAI;CACtE,OAAO;EACL;EACA;EACA;EACA;EACA,YAAY,aAAa,OAAO;EAChC,UAAU;EACV,OAAO,MAAM,QAAQ,CAAC,GAAG,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,SAAS,KAAK,MAAM,CAAC;EAC3E;EACA;EACA,GAAG;CACL;AACF;;AAGA,eAAe,oBAAoB,OAAwD;CACzF,IAAI;EACF,OAAO,MAAM,aAAa,SAAS,CAAC,CAAC,SAAS,KAAK;CACrD,QAAQ;EACN,OAAO,MAAM,aAAa,KAAA,GAAW,KAAK;CAC5C;AACF;;AAGA,eAAsB,QAAQ,SAAmE;CAC/F,MAAM,QAAQ,IAAI,UAAU,SAAS,CAAC,CAAC,EAAE;CACzC,MAAM,MAAM,CAAC,GAAG,IAAI,IAAI,QAAQ,QAAQ,OAAqB,OAAO,IAAI,CAAC,CAAC;CAC1E,MAAM,QAAQ,MAAM,QAAQ,IAAI,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,MAAM,MAAM,IAAI,EAAE,CAAC,CAAU,CAAC;CACzF,OAAO,IAAI,IAAI,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM,QAAQ,MAAM,SAAS,EAAE,CAAC,CAAC;AACjF;;AAGA,SAAS,aAAa,SAA8C;CAClE,MAAM,wBAAQ,IAAI,IAAoB;CACtC,KAAK,MAAM,SAAS,SAAS,WAAW,CAAC,GACvC,IAAI,MAAM,SAAS,WAAW,CAAC,MAAM,IAAI,MAAM,UAAU,GACvD,MAAM,IAAI,MAAM,YAAY,MAAM,EAAE;CAGxC,OAAO;AACT;;AASA,eAAsB,oBACpB,SACA,OACiC;CACjC,IAAI,CAAC,WAAW,OAAO,GACrB,OAAO;CAET,MAAM,CAAC,UAAU,gBAAgB,MAAM,QAAQ,IAAI,CACjD,IAAI,aAAa,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,MAAM,EAAE,GACpD,mBAAmB,OAAO,CAC5B,CAAC;CACD,OAAO;EACL,UAAU,SAAS,QAAQ,YAAY,QAAQ,YAAY,IAAI;EAC/D,YAAY,aAAa;CAC3B;AACF"}

package/dist/routers/review-switch-off.mjs

@@ -0,0 +1,29 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { requestBuildState } from "../git-status.mjs";
+import { acceptPendingWithoutWork } from "@storyshelf/core/models";
+//#region src/routers/review-switch-off.ts
+/** The switch-off pass at the app level (ADR 0013, decision 1): accept the queue review leaves behind. */
+/**
+* When a save turned review off (`before` had it on), accept the project's pending builds that no
+* capture worked on, in one pass. It raises no approval event (nobody approved anything), but each
+* build's git channels are asked to show its new state. Returns the number of builds accepted.
+*/
+async function runSwitchOffPass(before, after) {
+	if (before.reviewEnabled === false || after.reviewEnabled !== false) return 0;
+	const accepted = await acceptPendingWithoutWork(getStore().db, after.id);
+	await Promise.all(accepted.map(async (build) => {
+		await requestBuildState(build.id);
+	}));
+	getStore().logger.info({
+		projectId: after.id,
+		accepted: accepted.length
+	}, "review turned off: accepted pending builds");
+	return accepted.length;
+}
+//#endregion
+export { runSwitchOffPass };
+
+//# sourceMappingURL=review-switch-off.mjs.map

package/dist/routers/review-switch-off.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-switch-off.mjs","names":[],"sources":["../../src/routers/review-switch-off.ts"],"sourcesContent":["/** The switch-off pass at the app level (ADR 0013, decision 1): accept the queue review leaves behind. */\nimport { acceptPendingWithoutWork } from \"@storyshelf/core/models\";\nimport type { Project } from \"@storyshelf/core/schema\";\nimport { requestBuildState } from \"../git-status.ts\";\nimport { getStore } from \"../store.ts\";\n\n/**\n * When a save turned review off (`before` had it on), accept the project's pending builds that no\n * capture worked on, in one pass. It raises no approval event (nobody approved anything), but each\n * build's git channels are asked to show its new state. Returns the number of builds accepted.\n */\nexport async function runSwitchOffPass(before: Project, after: Project): Promise<number> {\n  if (before.reviewEnabled === false || after.reviewEnabled !== false) {\n    return 0;\n  }\n  const accepted = await acceptPendingWithoutWork(getStore().db, after.id);\n  await Promise.all(\n    accepted.map(async (build) => {\n      await requestBuildState(build.id);\n    }),\n  );\n  getStore().logger.info(\n    { projectId: after.id, accepted: accepted.length },\n    \"review turned off: accepted pending builds\",\n  );\n  return accepted.length;\n}\n"],"mappings":";;;;;;;;;;;;;AAWA,eAAsB,iBAAiB,QAAiB,OAAiC;CACvF,IAAI,OAAO,kBAAkB,SAAS,MAAM,kBAAkB,OAC5D,OAAO;CAET,MAAM,WAAW,MAAM,yBAAyB,SAAS,CAAC,CAAC,IAAI,MAAM,EAAE;CACvE,MAAM,QAAQ,IACZ,SAAS,IAAI,OAAO,UAAU;EAC5B,MAAM,kBAAkB,MAAM,EAAE;CAClC,CAAC,CACH;CACA,SAAS,CAAC,CAAC,OAAO,KAChB;EAAE,WAAW,MAAM;EAAI,UAAU,SAAS;CAAO,GACjD,4CACF;CACA,OAAO,SAAS;AAClB"}

package/dist/routers/schemas.mjs

@@ -2,9 +2,22 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { z } from "@hono/zod-openapi";
-import { BUILD_STATUSES, PROJECT_ROLES, SNAPSHOT_STATUSES } from "@storyshelf/core/types";
-import { BROWSER_NAMES } from "@storyshelf/core/adapter/capture-runner";
+import { storybookUrlTtlOverrideError } from "@storyshelf/core/utils";
+import { WebhookModel } from "@storyshelf/core/models";
+import { BUILD_STATUSES, PROJECT_ROLES, REVIEW_VERDICTS, SNAPSHOT_STATUSES } from "@storyshelf/core/types";
+import { BROWSER_NAMES, TARGET_NAME_PATTERN } from "@storyshelf/core/adapter/capture-runner";
 //#region src/routers/schemas.ts
+/** A capture target: an engine (`chromium`) or a remote one, `<engine>@<name>` (ADR 0007). */
+const captureTargetSchema = z.string().regex(new RegExp(`^(?:${BROWSER_NAMES.join("|")})(?:@${TARGET_NAME_PATTERN.source.slice(1, -1)})?$`, "u"), "Expected an engine (chromium, firefox, webkit, chrome) or <engine>@<name>");
+const reviewApprovalsSchema = z.number().int().min(1).max(20);
+/** Seconds a signed Storybook URL stays valid (ADR 0007, decision 5). */
+const storybookUrlTtlSchema = z.number().int().superRefine((seconds, ctx) => {
+	const message = storybookUrlTtlOverrideError(seconds);
+	if (message !== void 0) ctx.addIssue({
+		code: "custom",
+		message
+	});
+});
 const storybookMetaSchema = z.record(z.string(), z.unknown()).nullable().optional();
 /** OpenAPI schema for a project record. */
 const projectSchema = z.object({
@@ -19,7 +32,23 @@ const projectSchema = z.object({
 	storybookMeta: z.string().nullable().optional(),
 	executePlay: z.boolean(),
 	playTimeoutMs: z.number(),
+	/** Axe accessibility checks run during capture (default on; results never block a build). */
+	runA11y: z.boolean().optional(),
+	/** Storybook 10 `.test()` entries run as interaction tests during capture (default off). */
+	runTests: z.boolean().optional(),
 	browser: z.string().optional(),
+	/** JSON array of capture targets, primary first, primary first; null = just `browser`. */
+	browsers: z.string().nullable().optional(),
+	/** JSON array of mode names to capture; null = every declared mode. */
+	modesAllowlist: z.string().nullable().optional(),
+	/** AI profile gate: null/absent = AI off for this project. */
+	aiProfile: z.string().nullable().optional(),
+	/** Review is on for this project (ADR 0013, decision 1). */
+	reviewEnabled: z.boolean().optional(),
+	/** Approvals a build needs when `testing` is off. */
+	reviewApprovals: z.number().optional(),
+	/** Seconds the signed Storybook URLs of a render stay valid; null derives it from the stories. */
+	storybookUrlTtlSeconds: z.number().nullable().optional(),
 	createdAt: z.string(),
 	updatedAt: z.string()
 }).openapi("Project");
@@ -30,7 +59,13 @@ const projectCreateSchema = z.object({
 	gitDefaultBranch: z.string().optional(),
 	storybookMeta: storybookMetaSchema,
 	executePlay: z.boolean().optional(),
-	playTimeoutMs: z.number().int().min(1e3).max(3e4).optional()
+	playTimeoutMs: z.number().int().min(1e3).max(3e4).optional(),
+	/** Axe accessibility checks during capture; on when omitted. */
+	runA11y: z.boolean().optional(),
+	/** Run Storybook 10 `.test()` entries as interaction tests during capture; off when omitted. */
+	runTests: z.boolean().optional(),
+	reviewEnabled: z.boolean().optional(),
+	reviewApprovals: reviewApprovalsSchema.optional()
 }).openapi("ProjectCreateInput");
 /** OpenAPI schema for patching a project. */
 const projectUpdateSchema = z.object({
@@ -43,7 +78,24 @@ const projectUpdateSchema = z.object({
 	storybookMeta: storybookMetaSchema,
 	executePlay: z.boolean().optional(),
 	playTimeoutMs: z.number().int().min(1e3).max(3e4).optional(),
-	browser: z.enum(BROWSER_NAMES).optional()
+	/** Turn axe accessibility checks during capture on or off (admins). */
+	runA11y: z.boolean().optional(),
+	/** Turn the Storybook 10 `.test()` runs on or off (admins). */
+	runTests: z.boolean().optional(),
+	/** Single capture target; clears `browsers`. */
+	browser: captureTargetSchema.optional(),
+	/** Capture targets, primary first (max 3); null returns to single `browser`. */
+	browsers: z.array(captureTargetSchema).min(1).max(3).nullable().optional(),
+	/** Mode names to capture; null runs every declared mode. */
+	modesAllowlist: z.array(z.string().min(1)).max(50).nullable().optional(),
+	/** Site admins only: a configured AI profile name, or null to turn AI off. */
+	aiProfile: z.string().min(1).nullable().optional(),
+	/** Turn review (comments and build-level verdicts) on or off for the project. */
+	reviewEnabled: z.boolean().optional(),
+	/** Approvals a build needs before it is accepted when `testing` is off. */
+	reviewApprovals: reviewApprovalsSchema.optional(),
+	/** Seconds (at least one minimum slice plus grace, 1050, to 86400) the signed Storybook URLs of a render stay valid; null derives it from the stories. */
+	storybookUrlTtlSeconds: storybookUrlTtlSchema.nullable().optional()
 }).openapi("ProjectUpdateInput");
 /** OpenAPI schema for a build record. */
 const buildSchema = z.object({
@@ -61,10 +113,13 @@ const buildSchema = z.object({
 	changedCount: z.number(),
 	approvedCount: z.number(),
 	rejectedCount: z.number(),
+	inheritedCount: z.number(),
 	affectedOnly: z.boolean(),
 	baselineSha: z.string().nullable(),
 	changedFiles: z.string().nullable(),
 	affectedImportPaths: z.string().nullable(),
+	/** JSON array of the build's Storybook `.test()` results (id, title, name, status, error); null when none ran. */
+	testResults: z.string().nullable().optional(),
 	createdAt: z.string(),
 	updatedAt: z.string()
 }).openapi("Build");
@@ -78,6 +133,8 @@ const snapshotSchema = z.object({
 	storyTitle: z.string(),
 	storyImportPath: z.string().nullable(),
 	viewportName: z.string(),
+	/** Globals JSON the capture's mode applied; null for plain viewports. */
+	mode: z.string().nullable().optional(),
 	viewportWidth: z.number(),
 	viewportHeight: z.number(),
 	screenshotPath: z.string(),
@@ -89,6 +146,8 @@ const snapshotSchema = z.object({
 	reviewedBy: z.string().nullable(),
 	reviewedAt: z.string().nullable(),
 	inherited: z.boolean(),
+	/** JSON array of the axe violations found on this capture (non-blocking); null when none. */
+	a11yViolations: z.string().nullable().optional(),
 	createdAt: z.string(),
 	updatedAt: z.string()
 }).openapi("Snapshot");
@@ -133,6 +192,8 @@ const commentSchema = z.object({
 	projectId: z.string(),
 	buildId: z.string(),
 	snapshotId: z.string().nullable(),
+	/** Storybook story id of a story-anchored comment. */
+	storyId: z.string().nullable().optional(),
 	userId: z.string().nullable(),
 	body: z.string(),
 	parentId: z.string().nullable(),
@@ -143,9 +204,39 @@ const commentSchema = z.object({
 /** OpenAPI schema for creating a build comment. */
 const commentCreateSchema = z.object({
 	body: z.string().min(1),
+	/** Anchor to a snapshot; not together with `storyId`. */
 	snapshotId: z.string().optional(),
+	/** Anchor to a story of the build; not together with `snapshotId`. */
+	storyId: z.string().min(1).optional(),
 	parentId: z.string().optional()
 }).openapi("CommentCreateInput");
+/** OpenAPI schema for a build-level review verdict. */
+const buildReviewSchema = z.object({
+	id: z.string(),
+	buildId: z.string(),
+	userId: z.string().nullable(),
+	verdict: z.enum(REVIEW_VERDICTS),
+	body: z.string().nullable(),
+	createdAt: z.string()
+}).openapi("BuildReview");
+/** OpenAPI schema for giving a build a verdict. */
+const buildReviewCreateSchema = z.object({
+	verdict: z.enum(REVIEW_VERDICTS),
+	body: z.string().max(4e3).optional()
+}).openapi("BuildReviewInput");
+/** OpenAPI schema for a build's review state: the verdicts and what they make of the build. */
+const buildReviewStateSchema = z.object({
+	/** Build status now. */
+	status: z.enum(BUILD_STATUSES),
+	/** Approvals the project requires. */
+	approvalsRequired: z.number(),
+	/** Approvals among the reviewers' latest verdicts. */
+	approvals: z.number(),
+	/** Every reviewer's latest verdict. */
+	latest: buildReviewSchema.array(),
+	/** Every verdict given, oldest first. */
+	history: buildReviewSchema.array()
+}).openapi("BuildReviewState");
 /** OpenAPI schema for a project label type. */
 const labelTypeSchema = z.object({
 	id: z.string(),
@@ -218,9 +309,10 @@ const webhookPublicSchema = z.object({
 	url: z.string(),
 	events: z.array(z.string())
 }).openapi("Webhook");
+const webhookUrlBase = z.string().url();
 /** OpenAPI schema for creating a webhook. */
 const webhookCreateSchema = z.object({
-	url: z.string().url(),
+	url: webhookUrlBase.refine((url) => WebhookModel.urlError(url) === null, { message: "URL must use http or https" }),
 	events: z.array(z.string().min(1)).optional()
 }).openapi("WebhookCreateInput");
 /** OpenAPI schema for a newly created webhook including its signing secret. */
@@ -230,22 +322,6 @@ const webhookCreatedSchema = z.object({
 	events: z.array(z.string()),
 	secret: z.string()
 }).openapi("WebhookCreated");
-/** OpenAPI schema for a git status-check configuration. */
-const statusConfigSchema = z.object({
-	id: z.string(),
-	projectId: z.string(),
-	provider: z.string(),
-	config: z.record(z.string(), z.unknown()),
-	hasToken: z.boolean(),
-	createdAt: z.string(),
-	updatedAt: z.string()
-}).openapi("StatusConfig");
-/** OpenAPI schema for creating a git status-check configuration. */
-const statusConfigCreateSchema = z.object({
-	provider: z.string().min(1),
-	config: z.record(z.string(), z.unknown()),
-	token: z.string().min(1)
-}).openapi("StatusConfigCreateInput");
 /** OpenAPI schema for a public notification channel (secret omitted). */
 const notificationChannelSchema = z.object({
 	id: z.string(),
@@ -255,6 +331,8 @@ const notificationChannelSchema = z.object({
 	hasSecret: z.boolean(),
 	events: z.array(z.string()),
 	enabled: z.boolean(),
+	lastError: z.string().nullable(),
+	lastErrorAt: z.string().nullable(),
 	createdAt: z.string(),
 	updatedAt: z.string()
 }).openapi("NotificationChannel");
@@ -287,6 +365,11 @@ const approveAllResultSchema = z.object({
 	ok: z.boolean(),
 	skipped: z.array(z.string())
 }).openapi("ApproveAllResult");
+/** Group decision result: the snapshots one story/mode decision covered. */
+const groupDecisionResultSchema = z.object({
+	ok: z.boolean(),
+	snapshotIds: z.array(z.string())
+}).openapi("GroupDecisionResult");
 /** Result of re-diffing a build against the baselines that apply now. */
 const rediffResultSchema = z.object({
 	ok: z.boolean(),
@@ -331,7 +414,42 @@ const notFound = { 404: {
 	content: { "application/json": { schema: errorSchema } },
 	description: "Not found"
 } };
+/** OpenAPI schema for an insight (build triage or project health). */
+const insightSchema = z.object({
+	id: z.string(),
+	kind: z.enum(["triage", "health"]),
+	buildId: z.string().nullable(),
+	window: z.string().nullable(),
+	status: z.enum([
+		"pending",
+		"running",
+		"done",
+		"failed"
+	]),
+	profile: z.string(),
+	model: z.string(),
+	promptVersion: z.string(),
+	verdict: z.string().nullable(),
+	summary: z.string().nullable(),
+	output: z.unknown().nullable(),
+	meta: z.unknown().nullable(),
+	errorCode: z.string().nullable(),
+	createdAt: z.string(),
+	startedAt: z.string().nullable(),
+	finishedAt: z.string().nullable()
+}).openapi("Insight");
+/** Request body to (re)generate a build triage. */
+const insightRequestSchema = z.object({
+	task: z.literal("triage").optional(),
+	force: z.boolean().optional(),
+	profile: z.string().min(1).optional()
+}).openapi("InsightRequest");
+/** Request body to (re)generate a project-health digest. */
+const healthRequestSchema = z.object({
+	window: z.string().optional(),
+	force: z.boolean().optional()
+}).openapi("HealthInsightRequest");
 //#endregion
-export { approveAllResultSchema, attemptLogSchema, attemptSchema, badRequest, baselineChangedSchema, buildSchema, commentCreateSchema, commentSchema, errorSchema, forbidden, groupMappingCreateSchema, groupMappingSchema, labelTypeCreateSchema, labelTypeSchema, labelTypeUpdateSchema, memberRoleSchema, memberSchema, memberSetSchema, notFound, notificationChannelCreateSchema, notificationChannelSchema, notificationSubscriptionPutSchema, notificationSubscriptionSchema, okSchema, projectCreateSchema, projectSchema, projectUpdateSchema, purgeInputSchema, purgeSchema, rediffResultSchema, snapshotSchema, statusConfigCreateSchema, statusConfigSchema, tokenCreateSchema, tokenCreatedSchema, tokenPublicSchema, unauthorized, webhookCreateSchema, webhookCreatedSchema, webhookPublicSchema };
+export { approveAllResultSchema, attemptLogSchema, attemptSchema, badRequest, baselineChangedSchema, buildReviewCreateSchema, buildReviewSchema, buildReviewStateSchema, buildSchema, commentCreateSchema, commentSchema, errorSchema, forbidden, groupDecisionResultSchema, groupMappingCreateSchema, groupMappingSchema, healthRequestSchema, insightRequestSchema, insightSchema, labelTypeCreateSchema, labelTypeSchema, labelTypeUpdateSchema, memberRoleSchema, memberSchema, memberSetSchema, notFound, notificationChannelCreateSchema, notificationChannelSchema, notificationSubscriptionPutSchema, notificationSubscriptionSchema, okSchema, projectCreateSchema, projectSchema, projectUpdateSchema, purgeInputSchema, purgeSchema, rediffResultSchema, snapshotSchema, tokenCreateSchema, tokenCreatedSchema, tokenPublicSchema, unauthorized, webhookCreateSchema, webhookCreatedSchema, webhookPublicSchema };
 
 //# sourceMappingURL=schemas.mjs.map