@storyshelf/app 0.6.2 → 0.7.0

package/dist/routers/settings-git-channel.mjs

@@ -0,0 +1,77 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { flash } from "./flash.mjs";
+import { notificationChannelModel } from "./scoped-models.mjs";
+import { asString, renderSettingsPage } from "./settings.handlers.mjs";
+import { NotificationChannelModel } from "@storyshelf/core/models";
+//#region src/routers/settings-git-channel.ts
+/** Create a git (`state`) channel from the settings form: repository, status prefix and token. */
+const CONFIG_FIELDS = [
+	"owner",
+	"repo",
+	"host",
+	"prefix"
+];
+/** Only the GitHub provider reads these: how it shows a build and the App that posts check runs. */
+const GITHUB_FIELDS = [
+	"mode",
+	"appId",
+	"installationId"
+];
+/** The provider config from the form; blank optional fields are left out. */
+function gitConfig(provider, form) {
+	const config = {};
+	const fields = provider === "github" ? [...CONFIG_FIELDS, ...GITHUB_FIELDS] : CONFIG_FIELDS;
+	for (const field of fields) {
+		const value = asString(form.get(field));
+		if (value) config[field] = value;
+	}
+	return config;
+}
+/** Render the tab again with field errors (HTTP 400). */
+async function formError(c, errors) {
+	return c.html(await renderSettingsPage(c, "notifications", { errors }) ?? "", 400);
+}
+/** Map a failed validation to the form fields it concerns. */
+function fieldErrors(secretField, checked) {
+	if (checked.field === "secret") return { [secretField]: checked.message };
+	if (checked.field === "provider") return { gitProvider: checked.message };
+	const errors = {};
+	for (const issue of checked.issues ?? []) errors[issue.path] ??= issue.message;
+	return Object.keys(errors).length > 0 ? errors : { gitProvider: checked.message };
+}
+/** Validate and store a git channel; the token lands in the encrypted secret column. */
+async function createGitChannel(c, project, provider, form) {
+	const config = gitConfig(provider, form);
+	const checks = config["mode"] === "checks";
+	const token = asString(form.get(checks ? "privateKey" : "token"));
+	const problem = gitChannelProblem(project, provider, config, {
+		token,
+		secretField: checks ? "privateKey" : "token"
+	});
+	if (problem) return await formError(c, problem);
+	await notificationChannelModel().create({
+		projectId: project.id,
+		provider,
+		config,
+		secret: token
+	});
+	flash(c, "Git channel added");
+	return c.html(await renderSettingsPage(c, "notifications") ?? "", 201);
+}
+/** The form errors for a git channel input, or null when it is valid. */
+function gitChannelProblem(project, provider, config, secret) {
+	const { notifiers } = getStore();
+	if (!NotificationChannelModel.isStateKind(notifiers, provider)) return { gitProvider: `Unknown git provider: ${provider}` };
+	const checked = NotificationChannelModel.validateInput(notifiers, provider, config, {
+		projectId: project.id,
+		hasSecret: Boolean(secret.token)
+	});
+	return checked.ok ? null : fieldErrors(secret.secretField, checked);
+}
+//#endregion
+export { createGitChannel };
+
+//# sourceMappingURL=settings-git-channel.mjs.map

package/dist/routers/settings-git-channel.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-git-channel.mjs","names":[],"sources":["../../src/routers/settings-git-channel.ts"],"sourcesContent":["/** Create a git (`state`) channel from the settings form: repository, status prefix and token. */\nimport { NotificationChannelModel } from \"@storyshelf/core/models\";\nimport type { Project } from \"@storyshelf/core/schema\";\nimport type { Context } from \"hono\";\nimport { getStore } from \"../store.ts\";\nimport { flash } from \"./flash.ts\";\nimport { notificationChannelModel } from \"./scoped-models.ts\";\nimport { asString, renderSettingsPage } from \"./settings.handlers.ts\";\n\nconst CONFIG_FIELDS = [\"owner\", \"repo\", \"host\", \"prefix\"] as const;\n/** Only the GitHub provider reads these: how it shows a build and the App that posts check runs. */\nconst GITHUB_FIELDS = [\"mode\", \"appId\", \"installationId\"] as const;\n\n/** The provider config from the form; blank optional fields are left out. */\nfunction gitConfig(provider: string, form: FormData): Record<string, string> {\n  const config: Record<string, string> = {};\n  const fields = provider === \"github\" ? [...CONFIG_FIELDS, ...GITHUB_FIELDS] : CONFIG_FIELDS;\n  for (const field of fields) {\n    const value = asString(form.get(field));\n    if (value) {\n      config[field] = value;\n    }\n  }\n  return config;\n}\n\n/** Render the tab again with field errors (HTTP 400). */\nasync function formError(c: Context, errors: Record<string, string>): Promise<Response> {\n  return c.html((await renderSettingsPage(c, \"notifications\", { errors })) ?? \"\", 400);\n}\n\n/** Map a failed validation to the form fields it concerns. */\nfunction fieldErrors(\n  secretField: \"token\" | \"privateKey\",\n  checked: Extract<ReturnType<typeof NotificationChannelModel.validateInput>, { ok: false }>,\n): Record<string, string> {\n  if (checked.field === \"secret\") {\n    return { [secretField]: checked.message };\n  }\n  if (checked.field === \"provider\") {\n    return { gitProvider: checked.message };\n  }\n  const errors: Record<string, string> = {};\n  for (const issue of checked.issues ?? []) {\n    errors[issue.path] ??= issue.message;\n  }\n  return Object.keys(errors).length > 0 ? errors : { gitProvider: checked.message };\n}\n\n/** Validate and store a git channel; the token lands in the encrypted secret column. */\nexport async function createGitChannel(\n  c: Context,\n  project: Project,\n  provider: string,\n  form: FormData,\n): Promise<Response> {\n  const config = gitConfig(provider, form);\n  // A GitHub App channel keeps its private key where other channels keep a token.\n  const checks = config[\"mode\"] === \"checks\";\n  const token = asString(form.get(checks ? \"privateKey\" : \"token\"));\n  const problem = gitChannelProblem(project, provider, config, {\n    token,\n    secretField: checks ? \"privateKey\" : \"token\",\n  });\n  if (problem) {\n    return await formError(c, problem);\n  }\n  await notificationChannelModel().create({\n    projectId: project.id,\n    provider,\n    config,\n    secret: token,\n  });\n  flash(c, \"Git channel added\");\n  return c.html((await renderSettingsPage(c, \"notifications\")) ?? \"\", 201);\n}\n\n/** The form errors for a git channel input, or null when it is valid. */\nfunction gitChannelProblem(\n  project: Project,\n  provider: string,\n  config: Record<string, string>,\n  secret: { token: string | undefined; secretField: \"token\" | \"privateKey\" },\n): Record<string, string> | null {\n  const { notifiers } = getStore();\n  if (!NotificationChannelModel.isStateKind(notifiers, provider)) {\n    return { gitProvider: `Unknown git provider: ${provider}` };\n  }\n  const checked = NotificationChannelModel.validateInput(notifiers, provider, config, {\n    projectId: project.id,\n    hasSecret: Boolean(secret.token),\n  });\n  return checked.ok ? null : fieldErrors(secret.secretField, checked);\n}\n"],"mappings":";;;;;;;;;;AASA,MAAM,gBAAgB;CAAC;CAAS;CAAQ;CAAQ;AAAQ;;AAExD,MAAM,gBAAgB;CAAC;CAAQ;CAAS;AAAgB;;AAGxD,SAAS,UAAU,UAAkB,MAAwC;CAC3E,MAAM,SAAiC,CAAC;CACxC,MAAM,SAAS,aAAa,WAAW,CAAC,GAAG,eAAe,GAAG,aAAa,IAAI;CAC9E,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,QAAQ,SAAS,KAAK,IAAI,KAAK,CAAC;EACtC,IAAI,OACF,OAAO,SAAS;CAEpB;CACA,OAAO;AACT;;AAGA,eAAe,UAAU,GAAY,QAAmD;CACtF,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,iBAAiB,EAAE,OAAO,CAAC,KAAM,IAAI,GAAG;AACrF;;AAGA,SAAS,YACP,aACA,SACwB;CACxB,IAAI,QAAQ,UAAU,UACpB,OAAO,GAAG,cAAc,QAAQ,QAAQ;CAE1C,IAAI,QAAQ,UAAU,YACpB,OAAO,EAAE,aAAa,QAAQ,QAAQ;CAExC,MAAM,SAAiC,CAAC;CACxC,KAAK,MAAM,SAAS,QAAQ,UAAU,CAAC,GACrC,OAAO,MAAM,UAAU,MAAM;CAE/B,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,IAAI,SAAS,EAAE,aAAa,QAAQ,QAAQ;AAClF;;AAGA,eAAsB,iBACpB,GACA,SACA,UACA,MACmB;CACnB,MAAM,SAAS,UAAU,UAAU,IAAI;CAEvC,MAAM,SAAS,OAAO,YAAY;CAClC,MAAM,QAAQ,SAAS,KAAK,IAAI,SAAS,eAAe,OAAO,CAAC;CAChE,MAAM,UAAU,kBAAkB,SAAS,UAAU,QAAQ;EAC3D;EACA,aAAa,SAAS,eAAe;CACvC,CAAC;CACD,IAAI,SACF,OAAO,MAAM,UAAU,GAAG,OAAO;CAEnC,MAAM,yBAAyB,CAAC,CAAC,OAAO;EACtC,WAAW,QAAQ;EACnB;EACA;EACA,QAAQ;CACV,CAAC;CACD,MAAM,GAAG,mBAAmB;CAC5B,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,eAAe,KAAM,IAAI,GAAG;AACzE;;AAGA,SAAS,kBACP,SACA,UACA,QACA,QAC+B;CAC/B,MAAM,EAAE,cAAc,SAAS;CAC/B,IAAI,CAAC,yBAAyB,YAAY,WAAW,QAAQ,GAC3D,OAAO,EAAE,aAAa,yBAAyB,WAAW;CAE5D,MAAM,UAAU,yBAAyB,cAAc,WAAW,UAAU,QAAQ;EAClF,WAAW,QAAQ;EACnB,WAAW,QAAQ,OAAO,KAAK;CACjC,CAAC;CACD,OAAO,QAAQ,KAAK,OAAO,YAAY,OAAO,aAAa,OAAO;AACpE"}

package/dist/routers/settings-labels.mjs

@@ -9,8 +9,9 @@ import { LabelModel } from "@storyshelf/core/models";
 //#region src/routers/settings-labels.ts
 /** Label-type settings (create custom types, delete removable ones). */
 function registerLabelSettings(app) {
-	app.get("/projects/:slug/settings/labels", async (c) => c.html(await renderSettingsPage(c, "labels")));
+	app.get("/projects/:slug/settings/labels", async (c) => c.html(await renderSettingsPage(c, "labels", { editKey: c.req.query("edit") })));
 	app.post("/projects/:slug/settings/labels", handleCreateLabelType);
+	app.post("/projects/:slug/settings/labels/:key", handleUpdateLabelType);
 	app.post("/projects/:slug/settings/labels/:key/delete", handleDeleteLabelType);
 }
 async function handleCreateLabelType(c) {
@@ -36,6 +37,31 @@ async function persistLabelType(c, projectId, projectSlug, key, labelName, linkT
 		return c.html(await renderSettingsPage(c, "labels", { globalError: message }) ?? "", 400);
 	}
 }
+async function handleUpdateLabelType(c) {
+	const project = await findProject(c.req.param("slug") ?? "");
+	const key = c.req.param("key") ?? "";
+	const form = await c.req.formData();
+	const name = asString(form.get("labelName"));
+	if (!name) return c.html(await renderSettingsPage(c, "labels", {
+		globalError: "Name is required",
+		editKey: key
+	}) ?? "", 400);
+	const template = asString(form.get("linkTemplate"));
+	return await persistLabelUpdate(c, project, key, {
+		name,
+		linkTemplate: template === void 0 || template === "" ? null : template
+	});
+}
+async function persistLabelUpdate(c, project, key, input) {
+	try {
+		if (!await new LabelModel(getStore().db).updateType(project.id, key, input)) throw new Error("Label type not found");
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Failed to update label";
+		return c.html(await renderSettingsPage(c, "labels", { globalError: message }) ?? "", 400);
+	}
+	flash(c, "Label type saved");
+	return hxRedirect(c, `/projects/${project.slug}/settings/labels`);
+}
 async function handleDeleteLabelType(c) {
 	const project = await findProject(c.req.param("slug") ?? "");
 	try {

package/dist/routers/settings-labels.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"settings-labels.mjs","names":[],"sources":["../../src/routers/settings-labels.ts"],"sourcesContent":["import { LabelModel } from \"@storyshelf/core/models\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { flash } from \"./flash.ts\";\nimport { hxRedirect } from \"./htmx.ts\";\nimport { asString, findProject, renderSettingsPage } from \"./settings.handlers.ts\";\n/** Label-type settings (create custom types, delete removable ones). */\nexport function registerLabelSettings(app: ShelfRouter): void {\n  app.get(\"/projects/:slug/settings/labels\", async (c) =>\n    c.html(await renderSettingsPage(c, \"labels\")),\n  );\n  app.post(\"/projects/:slug/settings/labels\", handleCreateLabelType);\n  app.post(\"/projects/:slug/settings/labels/:key/delete\", handleDeleteLabelType);\n}\n\nasync function handleCreateLabelType(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const form = await c.req.formData();\n  const key = asString(form.get(\"key\"));\n  const labelName = asString(form.get(\"labelName\")) ?? asString(form.get(\"name\"));\n  const linkTemplate = asString(form.get(\"linkTemplate\"));\n  if (!key || !labelName) {\n    return c.html(\n      (await renderSettingsPage(c, \"labels\", { globalError: \"Key and name are required\" })) ?? \"\",\n      400,\n    );\n  }\n  return await persistLabelType(c, project.id, project.slug, key, labelName, linkTemplate);\n}\n\nasync function persistLabelType(\n  c: Context,\n  projectId: string,\n  projectSlug: string,\n  key: string,\n  labelName: string,\n  linkTemplate: string | undefined,\n): Promise<Response> {\n  try {\n    await new LabelModel(getStore().db).createType(projectId, {\n      key,\n      name: labelName,\n      linkTemplate,\n    });\n    flash(c, \"Label type added\");\n    return hxRedirect(c, `/projects/${projectSlug}/settings/labels`);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : \"Failed to create label\";\n    return c.html((await renderSettingsPage(c, \"labels\", { globalError: message })) ?? \"\", 400);\n  }\n}\n\nasync function handleDeleteLabelType(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  try {\n    await new LabelModel(getStore().db).removeType(project.id, c.req.param(\"key\") ?? \"\");\n  } catch {\n    return c.html(\n      (await renderSettingsPage(c, \"labels\", { globalError: \"Cannot delete built-in label\" })) ??\n        \"\",\n      400,\n    );\n  }\n  flash(c, \"Label type deleted\");\n  return hxRedirect(c, `/projects/${project.slug}/settings/labels`);\n}\n"],"mappings":";;;;;;;;;;AAQA,SAAgB,sBAAsB,KAAwB;CAC5D,IAAI,IAAI,mCAAmC,OAAO,MAChD,EAAE,KAAK,MAAM,mBAAmB,GAAG,QAAQ,CAAC,CAC9C;CACA,IAAI,KAAK,mCAAmC,qBAAqB;CACjE,IAAI,KAAK,+CAA+C,qBAAqB;AAC/E;AAEA,eAAe,sBAAsB,GAA+B;CAClE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;CAClC,MAAM,MAAM,SAAS,KAAK,IAAI,KAAK,CAAC;CACpC,MAAM,YAAY,SAAS,KAAK,IAAI,WAAW,CAAC,KAAK,SAAS,KAAK,IAAI,MAAM,CAAC;CAC9E,MAAM,eAAe,SAAS,KAAK,IAAI,cAAc,CAAC;CACtD,IAAI,CAAC,OAAO,CAAC,WACX,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,UAAU,EAAE,aAAa,4BAA4B,CAAC,KAAM,IACzF,GACF;CAEF,OAAO,MAAM,iBAAiB,GAAG,QAAQ,IAAI,QAAQ,MAAM,KAAK,WAAW,YAAY;AACzF;AAEA,eAAe,iBACb,GACA,WACA,aACA,KACA,WACA,cACmB;CACnB,IAAI;EACF,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,WAAW;GACxD;GACA,MAAM;GACN;EACF,CAAC;EACD,MAAM,GAAG,kBAAkB;EAC3B,OAAO,WAAW,GAAG,aAAa,YAAY,iBAAiB;CACjE,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;EACzD,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,UAAU,EAAE,aAAa,QAAQ,CAAC,KAAM,IAAI,GAAG;CAC5F;AACF;AAEA,eAAe,sBAAsB,GAA+B;CAClE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,IAAI;EACF,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,QAAQ,IAAI,EAAE,IAAI,MAAM,KAAK,KAAK,EAAE;CACrF,QAAQ;EACN,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,UAAU,EAAE,aAAa,+BAA+B,CAAC,KACpF,IACF,GACF;CACF;CACA,MAAM,GAAG,oBAAoB;CAC7B,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,iBAAiB;AAClE"}
+{"version":3,"file":"settings-labels.mjs","names":[],"sources":["../../src/routers/settings-labels.ts"],"sourcesContent":["import { LabelModel } from \"@storyshelf/core/models\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { flash } from \"./flash.ts\";\nimport { hxRedirect } from \"./htmx.ts\";\nimport { asString, findProject, renderSettingsPage } from \"./settings.handlers.ts\";\n/** Label-type settings (create custom types, delete removable ones). */\nexport function registerLabelSettings(app: ShelfRouter): void {\n  app.get(\"/projects/:slug/settings/labels\", async (c) =>\n    c.html(await renderSettingsPage(c, \"labels\", { editKey: c.req.query(\"edit\") })),\n  );\n  app.post(\"/projects/:slug/settings/labels\", handleCreateLabelType);\n  app.post(\"/projects/:slug/settings/labels/:key\", handleUpdateLabelType);\n  app.post(\"/projects/:slug/settings/labels/:key/delete\", handleDeleteLabelType);\n}\n\nasync function handleCreateLabelType(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const form = await c.req.formData();\n  const key = asString(form.get(\"key\"));\n  const labelName = asString(form.get(\"labelName\")) ?? asString(form.get(\"name\"));\n  const linkTemplate = asString(form.get(\"linkTemplate\"));\n  if (!key || !labelName) {\n    return c.html(\n      (await renderSettingsPage(c, \"labels\", { globalError: \"Key and name are required\" })) ?? \"\",\n      400,\n    );\n  }\n  return await persistLabelType(c, project.id, project.slug, key, labelName, linkTemplate);\n}\n\nasync function persistLabelType(\n  c: Context,\n  projectId: string,\n  projectSlug: string,\n  key: string,\n  labelName: string,\n  linkTemplate: string | undefined,\n): Promise<Response> {\n  try {\n    await new LabelModel(getStore().db).createType(projectId, {\n      key,\n      name: labelName,\n      linkTemplate,\n    });\n    flash(c, \"Label type added\");\n    return hxRedirect(c, `/projects/${projectSlug}/settings/labels`);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : \"Failed to create label\";\n    return c.html((await renderSettingsPage(c, \"labels\", { globalError: message })) ?? \"\", 400);\n  }\n}\n\nasync function handleUpdateLabelType(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const key = c.req.param(\"key\") ?? \"\";\n  const form = await c.req.formData();\n  const name = asString(form.get(\"labelName\"));\n  if (!name) {\n    return c.html(\n      (await renderSettingsPage(c, \"labels\", { globalError: \"Name is required\", editKey: key })) ??\n        \"\",\n      400,\n    );\n  }\n  const template = asString(form.get(\"linkTemplate\"));\n  const linkTemplate = template === undefined || template === \"\" ? null : template;\n  return await persistLabelUpdate(c, project, key, { name, linkTemplate });\n}\n\nasync function persistLabelUpdate(\n  c: Context,\n  project: { id: string; slug: string },\n  key: string,\n  input: { name: string; linkTemplate: string | null },\n): Promise<Response> {\n  try {\n    const updated = await new LabelModel(getStore().db).updateType(project.id, key, input);\n    if (!updated) {\n      throw new Error(\"Label type not found\");\n    }\n  } catch (error) {\n    const message = error instanceof Error ? error.message : \"Failed to update label\";\n    return c.html((await renderSettingsPage(c, \"labels\", { globalError: message })) ?? \"\", 400);\n  }\n  flash(c, \"Label type saved\");\n  return hxRedirect(c, `/projects/${project.slug}/settings/labels`);\n}\n\nasync function handleDeleteLabelType(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  try {\n    await new LabelModel(getStore().db).removeType(project.id, c.req.param(\"key\") ?? \"\");\n  } catch {\n    return c.html(\n      (await renderSettingsPage(c, \"labels\", { globalError: \"Cannot delete built-in label\" })) ??\n        \"\",\n      400,\n    );\n  }\n  flash(c, \"Label type deleted\");\n  return hxRedirect(c, `/projects/${project.slug}/settings/labels`);\n}\n"],"mappings":";;;;;;;;;;AAQA,SAAgB,sBAAsB,KAAwB;CAC5D,IAAI,IAAI,mCAAmC,OAAO,MAChD,EAAE,KAAK,MAAM,mBAAmB,GAAG,UAAU,EAAE,SAAS,EAAE,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC,CAChF;CACA,IAAI,KAAK,mCAAmC,qBAAqB;CACjE,IAAI,KAAK,wCAAwC,qBAAqB;CACtE,IAAI,KAAK,+CAA+C,qBAAqB;AAC/E;AAEA,eAAe,sBAAsB,GAA+B;CAClE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;CAClC,MAAM,MAAM,SAAS,KAAK,IAAI,KAAK,CAAC;CACpC,MAAM,YAAY,SAAS,KAAK,IAAI,WAAW,CAAC,KAAK,SAAS,KAAK,IAAI,MAAM,CAAC;CAC9E,MAAM,eAAe,SAAS,KAAK,IAAI,cAAc,CAAC;CACtD,IAAI,CAAC,OAAO,CAAC,WACX,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,UAAU,EAAE,aAAa,4BAA4B,CAAC,KAAM,IACzF,GACF;CAEF,OAAO,MAAM,iBAAiB,GAAG,QAAQ,IAAI,QAAQ,MAAM,KAAK,WAAW,YAAY;AACzF;AAEA,eAAe,iBACb,GACA,WACA,aACA,KACA,WACA,cACmB;CACnB,IAAI;EACF,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,WAAW;GACxD;GACA,MAAM;GACN;EACF,CAAC;EACD,MAAM,GAAG,kBAAkB;EAC3B,OAAO,WAAW,GAAG,aAAa,YAAY,iBAAiB;CACjE,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;EACzD,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,UAAU,EAAE,aAAa,QAAQ,CAAC,KAAM,IAAI,GAAG;CAC5F;AACF;AAEA,eAAe,sBAAsB,GAA+B;CAClE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,MAAM,EAAE,IAAI,MAAM,KAAK,KAAK;CAClC,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;CAClC,MAAM,OAAO,SAAS,KAAK,IAAI,WAAW,CAAC;CAC3C,IAAI,CAAC,MACH,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,UAAU;EAAE,aAAa;EAAoB,SAAS;CAAI,CAAC,KACtF,IACF,GACF;CAEF,MAAM,WAAW,SAAS,KAAK,IAAI,cAAc,CAAC;CAElD,OAAO,MAAM,mBAAmB,GAAG,SAAS,KAAK;EAAE;EAAM,cADpC,aAAa,KAAA,KAAa,aAAa,KAAK,OAAO;CACF,CAAC;AACzE;AAEA,eAAe,mBACb,GACA,SACA,KACA,OACmB;CACnB,IAAI;EAEF,IAAI,CAAC,MADiB,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,QAAQ,IAAI,KAAK,KAAK,GAEnF,MAAM,IAAI,MAAM,sBAAsB;CAE1C,SAAS,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;EACzD,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,UAAU,EAAE,aAAa,QAAQ,CAAC,KAAM,IAAI,GAAG;CAC5F;CACA,MAAM,GAAG,kBAAkB;CAC3B,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,iBAAiB;AAClE;AAEA,eAAe,sBAAsB,GAA+B;CAClE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,IAAI;EACF,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,QAAQ,IAAI,EAAE,IAAI,MAAM,KAAK,KAAK,EAAE;CACrF,QAAQ;EACN,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,UAAU,EAAE,aAAa,+BAA+B,CAAC,KACpF,IACF,GACF;CACF;CACA,MAAM,GAAG,oBAAoB;CAC7B,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,iBAAiB;AAClE"}

package/dist/routers/settings-links.mjs

@@ -0,0 +1,63 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { hxRedirect } from "./htmx.mjs";
+import { flash } from "./flash.mjs";
+import { asString, findProject, renderSettingsPage } from "./settings.handlers.mjs";
+import { PackageUsageModel, ProjectModel } from "@storyshelf/core/models";
+//#region src/routers/settings-links.ts
+/** Package-link settings (link a consumed package to its upstream project, or unlink it). */
+function registerLinkSettings(app) {
+	app.get("/projects/:slug/settings/links", async (c) => c.html(await renderSettingsPage(c, "links")));
+	app.post("/projects/:slug/settings/links", handleAddLink);
+	app.post("/projects/:slug/settings/links/delete", handleRemoveLink);
+}
+async function rejectLink(c, message) {
+	return c.html(await renderSettingsPage(c, "links", { globalError: message }) ?? "", 400);
+}
+/** Replace one package's link, keeping the project's other links. */
+async function saveLink(project, packageName, upstreamId) {
+	const model = new PackageUsageModel(getStore().db);
+	const kept = (await model.listLinks(project.id)).filter((link) => link.packageName !== packageName);
+	await model.replaceLinks(project.id, [...kept.map((link) => ({
+		upstreamId: link.upstreamId,
+		packageName: link.packageName
+	})), {
+		upstreamId,
+		packageName
+	}]);
+}
+/** Read the add-link form fields. */
+async function readLinkForm(c) {
+	const form = await c.req.formData();
+	return {
+		packageName: asString(form.get("package")),
+		upstreamSlug: asString(form.get("upstreamSlug"))
+	};
+}
+async function handleAddLink(c) {
+	const project = await findProject(c.req.param("slug") ?? "");
+	const { packageName, upstreamSlug } = await readLinkForm(c);
+	const upstream = upstreamSlug ? await new ProjectModel(getStore().db).getBySlug(upstreamSlug) : null;
+	if (!packageName || !upstream || upstream.id === project.id) return await rejectLink(c, "Enter a package and choose a different, existing upstream project");
+	await saveLink(project, packageName, upstream.id);
+	flash(c, "Package linked");
+	return hxRedirect(c, `/projects/${project.slug}/settings/links`);
+}
+async function handleRemoveLink(c) {
+	const project = await findProject(c.req.param("slug") ?? "");
+	const packageName = asString((await c.req.formData()).get("package"));
+	const model = new PackageUsageModel(getStore().db);
+	const kept = (await model.listLinks(project.id)).filter((link) => link.packageName !== packageName);
+	await model.replaceLinks(project.id, kept.map((link) => ({
+		upstreamId: link.upstreamId,
+		packageName: link.packageName
+	})));
+	flash(c, "Link removed");
+	return hxRedirect(c, `/projects/${project.slug}/settings/links`);
+}
+//#endregion
+export { registerLinkSettings };
+
+//# sourceMappingURL=settings-links.mjs.map

package/dist/routers/settings-links.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-links.mjs","names":[],"sources":["../../src/routers/settings-links.ts"],"sourcesContent":["import { PackageUsageModel, ProjectModel } from \"@storyshelf/core/models\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { flash } from \"./flash.ts\";\nimport { hxRedirect } from \"./htmx.ts\";\nimport { asString, findProject, renderSettingsPage } from \"./settings.handlers.ts\";\n\n/** Package-link settings (link a consumed package to its upstream project, or unlink it). */\nexport function registerLinkSettings(app: ShelfRouter): void {\n  app.get(\"/projects/:slug/settings/links\", async (c) =>\n    c.html(await renderSettingsPage(c, \"links\")),\n  );\n  app.post(\"/projects/:slug/settings/links\", handleAddLink);\n  app.post(\"/projects/:slug/settings/links/delete\", handleRemoveLink);\n}\n\nasync function rejectLink(c: Context, message: string): Promise<Response> {\n  return c.html((await renderSettingsPage(c, \"links\", { globalError: message })) ?? \"\", 400);\n}\n\n/** Replace one package's link, keeping the project's other links. */\nasync function saveLink(\n  project: { id: string },\n  packageName: string,\n  upstreamId: string,\n): Promise<void> {\n  const model = new PackageUsageModel(getStore().db);\n  const kept = (await model.listLinks(project.id)).filter(\n    (link) => link.packageName !== packageName,\n  );\n  await model.replaceLinks(project.id, [\n    ...kept.map((link) => ({ upstreamId: link.upstreamId, packageName: link.packageName })),\n    { upstreamId, packageName },\n  ]);\n}\n\n/** Read the add-link form fields. */\nasync function readLinkForm(c: Context): Promise<{ packageName?: string; upstreamSlug?: string }> {\n  const form = await c.req.formData();\n  return {\n    packageName: asString(form.get(\"package\")),\n    upstreamSlug: asString(form.get(\"upstreamSlug\")),\n  };\n}\n\nasync function handleAddLink(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const { packageName, upstreamSlug } = await readLinkForm(c);\n  const upstream = upstreamSlug\n    ? await new ProjectModel(getStore().db).getBySlug(upstreamSlug)\n    : null;\n  if (!packageName || !upstream || upstream.id === project.id) {\n    return await rejectLink(c, \"Enter a package and choose a different, existing upstream project\");\n  }\n  await saveLink(project, packageName, upstream.id);\n  flash(c, \"Package linked\");\n  return hxRedirect(c, `/projects/${project.slug}/settings/links`);\n}\n\nasync function handleRemoveLink(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const packageName = asString((await c.req.formData()).get(\"package\"));\n  const model = new PackageUsageModel(getStore().db);\n  const kept = (await model.listLinks(project.id)).filter(\n    (link) => link.packageName !== packageName,\n  );\n  await model.replaceLinks(\n    project.id,\n    kept.map((link) => ({ upstreamId: link.upstreamId, packageName: link.packageName })),\n  );\n  flash(c, \"Link removed\");\n  return hxRedirect(c, `/projects/${project.slug}/settings/links`);\n}\n"],"mappings":";;;;;;;;;;AASA,SAAgB,qBAAqB,KAAwB;CAC3D,IAAI,IAAI,kCAAkC,OAAO,MAC/C,EAAE,KAAK,MAAM,mBAAmB,GAAG,OAAO,CAAC,CAC7C;CACA,IAAI,KAAK,kCAAkC,aAAa;CACxD,IAAI,KAAK,yCAAyC,gBAAgB;AACpE;AAEA,eAAe,WAAW,GAAY,SAAoC;CACxE,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,SAAS,EAAE,aAAa,QAAQ,CAAC,KAAM,IAAI,GAAG;AAC3F;;AAGA,eAAe,SACb,SACA,aACA,YACe;CACf,MAAM,QAAQ,IAAI,kBAAkB,SAAS,CAAC,CAAC,EAAE;CACjD,MAAM,QAAQ,MAAM,MAAM,UAAU,QAAQ,EAAE,EAAA,CAAG,QAC9C,SAAS,KAAK,gBAAgB,WACjC;CACA,MAAM,MAAM,aAAa,QAAQ,IAAI,CACnC,GAAG,KAAK,KAAK,UAAU;EAAE,YAAY,KAAK;EAAY,aAAa,KAAK;CAAY,EAAE,GACtF;EAAE;EAAY;CAAY,CAC5B,CAAC;AACH;;AAGA,eAAe,aAAa,GAAsE;CAChG,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;CAClC,OAAO;EACL,aAAa,SAAS,KAAK,IAAI,SAAS,CAAC;EACzC,cAAc,SAAS,KAAK,IAAI,cAAc,CAAC;CACjD;AACF;AAEA,eAAe,cAAc,GAA+B;CAC1D,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,EAAE,aAAa,iBAAiB,MAAM,aAAa,CAAC;CAC1D,MAAM,WAAW,eACb,MAAM,IAAI,aAAa,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,YAAY,IAC5D;CACJ,IAAI,CAAC,eAAe,CAAC,YAAY,SAAS,OAAO,QAAQ,IACvD,OAAO,MAAM,WAAW,GAAG,mEAAmE;CAEhG,MAAM,SAAS,SAAS,aAAa,SAAS,EAAE;CAChD,MAAM,GAAG,gBAAgB;CACzB,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,gBAAgB;AACjE;AAEA,eAAe,iBAAiB,GAA+B;CAC7D,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,cAAc,UAAU,MAAM,EAAE,IAAI,SAAS,EAAA,CAAG,IAAI,SAAS,CAAC;CACpE,MAAM,QAAQ,IAAI,kBAAkB,SAAS,CAAC,CAAC,EAAE;CACjD,MAAM,QAAQ,MAAM,MAAM,UAAU,QAAQ,EAAE,EAAA,CAAG,QAC9C,SAAS,KAAK,gBAAgB,WACjC;CACA,MAAM,MAAM,aACV,QAAQ,IACR,KAAK,KAAK,UAAU;EAAE,YAAY,KAAK;EAAY,aAAa,KAAK;CAAY,EAAE,CACrF;CACA,MAAM,GAAG,cAAc;CACvB,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,gBAAgB;AACjE"}

package/dist/routers/settings-members.mjs

@@ -6,6 +6,7 @@ import { hxRedirect } from "./htmx.mjs";
 import { flash } from "./flash.mjs";
 import { asString, findProject, renderSettingsPage } from "./settings.handlers.mjs";
 import { MemberModel, ProjectGroupMappingModel } from "@storyshelf/core/models";
+import { isProjectRole } from "@storyshelf/core/types";
 //#region src/routers/settings-members.ts
 /** Project member settings (assign roles, remove members). */
 function registerMemberSettings(app) {
@@ -15,7 +16,7 @@ function registerMemberSettings(app) {
 		const form = await c.req.formData();
 		const userId = asString(form.get("userId"));
 		const role = asString(form.get("role"));
-		if (!userId || !role) return c.html(await renderSettingsPage(c, "members", { globalError: "User and role are required" }) ?? "", 400);
+		if (!userId || !isProjectRole(role)) return c.html(await renderSettingsPage(c, "members", { globalError: "User and role are required" }) ?? "", 400);
 		await new MemberModel(getStore().db).set(project.id, userId, role);
 		flash(c, "Member saved");
 		return hxRedirect(c, `/projects/${project.slug}/settings/members`);
@@ -35,12 +36,8 @@ function registerGroupMappingSettings(app) {
 		const form = await c.req.formData();
 		const groupName = asString(form.get("groupName"));
 		const role = asString(form.get("role"));
-		if (!groupName || !role || ![
-			"viewer",
-			"developer",
-			"approver",
-			"admin"
-		].includes(role)) return c.html(await renderSettingsPage(c, "members", { globalError: "Group and role are required" }) ?? "", 400);
+		const inputError = ProjectGroupMappingModel.inputError(groupName, role);
+		if (inputError || !groupName || !isProjectRole(role)) return c.html(await renderSettingsPage(c, "members", { globalError: inputError ?? "Invalid input" }) ?? "", 400);
 		await new ProjectGroupMappingModel(getStore().db).create(project.id, groupName, role);
 		flash(c, "Group mapping added");
 		return hxRedirect(c, `/projects/${project.slug}/settings/members`);

package/dist/routers/settings-members.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"settings-members.mjs","names":[],"sources":["../../src/routers/settings-members.ts"],"sourcesContent":["import { MemberModel, ProjectGroupMappingModel } from \"@storyshelf/core/models\";\nimport type { ProjectRole } from \"@storyshelf/core/types\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { flash } from \"./flash.ts\";\nimport { hxRedirect } from \"./htmx.ts\";\nimport { asString, findProject, renderSettingsPage } from \"./settings.handlers.ts\";\n/** Project member settings (assign roles, remove members). */\nexport function registerMemberSettings(app: ShelfRouter): void {\n  app.get(\"/projects/:slug/settings/members\", async (c) =>\n    c.html(await renderSettingsPage(c, \"members\")),\n  );\n\n  app.post(\"/projects/:slug/settings/members\", async (c) => {\n    const project = await findProject(c.req.param(\"slug\") ?? \"\");\n    const form = await c.req.formData();\n    const userId = asString(form.get(\"userId\"));\n    const role = asString(form.get(\"role\"));\n    if (!userId || !role) {\n      return c.html(\n        (await renderSettingsPage(c, \"members\", { globalError: \"User and role are required\" })) ??\n          \"\",\n        400,\n      );\n    }\n    await new MemberModel(getStore().db).set(project.id, userId, role as ProjectRole);\n    flash(c, \"Member saved\");\n    return hxRedirect(c, `/projects/${project.slug}/settings/members`);\n  });\n\n  app.post(\"/projects/:slug/settings/members/:userId/remove\", async (c) => {\n    const project = await findProject(c.req.param(\"slug\") ?? \"\");\n    await new MemberModel(getStore().db).remove(project.id, c.req.param(\"userId\") ?? \"\");\n    flash(c, \"Member removed\");\n    return hxRedirect(c, `/projects/${project.slug}/settings/members`);\n  });\n\n  registerGroupMappingSettings(app);\n}\n\n/** Identity-provider group mapping settings (exact-match group to role). */\nfunction registerGroupMappingSettings(app: ShelfRouter): void {\n  app.post(\"/projects/:slug/settings/members/groups\", async (c) => {\n    const project = await findProject(c.req.param(\"slug\") ?? \"\");\n    const form = await c.req.formData();\n    const groupName = asString(form.get(\"groupName\"));\n    const role = asString(form.get(\"role\")) as ProjectRole | undefined;\n    if (!groupName || !role || ![\"viewer\", \"developer\", \"approver\", \"admin\"].includes(role)) {\n      return c.html(\n        (await renderSettingsPage(c, \"members\", { globalError: \"Group and role are required\" })) ??\n          \"\",\n        400,\n      );\n    }\n    await new ProjectGroupMappingModel(getStore().db).create(project.id, groupName, role);\n    flash(c, \"Group mapping added\");\n    return hxRedirect(c, `/projects/${project.slug}/settings/members`);\n  });\n\n  app.post(\"/projects/:slug/settings/members/groups/:mappingId/remove\", async (c) => {\n    const project = await findProject(c.req.param(\"slug\") ?? \"\");\n    await new ProjectGroupMappingModel(getStore().db).remove(\n      project.id,\n      c.req.param(\"mappingId\") ?? \"\",\n    );\n    flash(c, \"Group mapping removed\");\n    return hxRedirect(c, `/projects/${project.slug}/settings/members`);\n  });\n}\n"],"mappings":";;;;;;;;;;AAQA,SAAgB,uBAAuB,KAAwB;CAC7D,IAAI,IAAI,oCAAoC,OAAO,MACjD,EAAE,KAAK,MAAM,mBAAmB,GAAG,SAAS,CAAC,CAC/C;CAEA,IAAI,KAAK,oCAAoC,OAAO,MAAM;EACxD,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;EAC3D,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;EAClC,MAAM,SAAS,SAAS,KAAK,IAAI,QAAQ,CAAC;EAC1C,MAAM,OAAO,SAAS,KAAK,IAAI,MAAM,CAAC;EACtC,IAAI,CAAC,UAAU,CAAC,MACd,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,WAAW,EAAE,aAAa,6BAA6B,CAAC,KACnF,IACF,GACF;EAEF,MAAM,IAAI,YAAY,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,IAAI,QAAQ,IAAmB;EAChF,MAAM,GAAG,cAAc;EACvB,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,kBAAkB;CACnE,CAAC;CAED,IAAI,KAAK,mDAAmD,OAAO,MAAM;EACvE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;EAC3D,MAAM,IAAI,YAAY,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI,EAAE,IAAI,MAAM,QAAQ,KAAK,EAAE;EACnF,MAAM,GAAG,gBAAgB;EACzB,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,kBAAkB;CACnE,CAAC;CAED,6BAA6B,GAAG;AAClC;;AAGA,SAAS,6BAA6B,KAAwB;CAC5D,IAAI,KAAK,2CAA2C,OAAO,MAAM;EAC/D,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;EAC3D,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;EAClC,MAAM,YAAY,SAAS,KAAK,IAAI,WAAW,CAAC;EAChD,MAAM,OAAO,SAAS,KAAK,IAAI,MAAM,CAAC;EACtC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;GAAC;GAAU;GAAa;GAAY;EAAO,CAAC,CAAC,SAAS,IAAI,GACpF,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,WAAW,EAAE,aAAa,8BAA8B,CAAC,KACpF,IACF,GACF;EAEF,MAAM,IAAI,yBAAyB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI,WAAW,IAAI;EACpF,MAAM,GAAG,qBAAqB;EAC9B,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,kBAAkB;CACnE,CAAC;CAED,IAAI,KAAK,6DAA6D,OAAO,MAAM;EACjF,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;EAC3D,MAAM,IAAI,yBAAyB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAChD,QAAQ,IACR,EAAE,IAAI,MAAM,WAAW,KAAK,EAC9B;EACA,MAAM,GAAG,uBAAuB;EAChC,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,kBAAkB;CACnE,CAAC;AACH"}
+{"version":3,"file":"settings-members.mjs","names":[],"sources":["../../src/routers/settings-members.ts"],"sourcesContent":["import { MemberModel, ProjectGroupMappingModel } from \"@storyshelf/core/models\";\nimport { isProjectRole } from \"@storyshelf/core/types\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { flash } from \"./flash.ts\";\nimport { hxRedirect } from \"./htmx.ts\";\nimport { asString, findProject, renderSettingsPage } from \"./settings.handlers.ts\";\n/** Project member settings (assign roles, remove members). */\nexport function registerMemberSettings(app: ShelfRouter): void {\n  app.get(\"/projects/:slug/settings/members\", async (c) =>\n    c.html(await renderSettingsPage(c, \"members\")),\n  );\n\n  app.post(\"/projects/:slug/settings/members\", async (c) => {\n    const project = await findProject(c.req.param(\"slug\") ?? \"\");\n    const form = await c.req.formData();\n    const userId = asString(form.get(\"userId\"));\n    const role = asString(form.get(\"role\"));\n    if (!userId || !isProjectRole(role)) {\n      return c.html(\n        (await renderSettingsPage(c, \"members\", { globalError: \"User and role are required\" })) ??\n          \"\",\n        400,\n      );\n    }\n    await new MemberModel(getStore().db).set(project.id, userId, role);\n    flash(c, \"Member saved\");\n    return hxRedirect(c, `/projects/${project.slug}/settings/members`);\n  });\n\n  app.post(\"/projects/:slug/settings/members/:userId/remove\", async (c) => {\n    const project = await findProject(c.req.param(\"slug\") ?? \"\");\n    await new MemberModel(getStore().db).remove(project.id, c.req.param(\"userId\") ?? \"\");\n    flash(c, \"Member removed\");\n    return hxRedirect(c, `/projects/${project.slug}/settings/members`);\n  });\n\n  registerGroupMappingSettings(app);\n}\n\n/** Identity-provider group mapping settings (exact-match group to role). */\nfunction registerGroupMappingSettings(app: ShelfRouter): void {\n  app.post(\"/projects/:slug/settings/members/groups\", async (c) => {\n    const project = await findProject(c.req.param(\"slug\") ?? \"\");\n    const form = await c.req.formData();\n    const groupName = asString(form.get(\"groupName\"));\n    const role = asString(form.get(\"role\"));\n    const inputError = ProjectGroupMappingModel.inputError(groupName, role);\n    if (inputError || !groupName || !isProjectRole(role)) {\n      return c.html(\n        (await renderSettingsPage(c, \"members\", { globalError: inputError ?? \"Invalid input\" })) ??\n          \"\",\n        400,\n      );\n    }\n    await new ProjectGroupMappingModel(getStore().db).create(project.id, groupName, role);\n    flash(c, \"Group mapping added\");\n    return hxRedirect(c, `/projects/${project.slug}/settings/members`);\n  });\n\n  app.post(\"/projects/:slug/settings/members/groups/:mappingId/remove\", async (c) => {\n    const project = await findProject(c.req.param(\"slug\") ?? \"\");\n    await new ProjectGroupMappingModel(getStore().db).remove(\n      project.id,\n      c.req.param(\"mappingId\") ?? \"\",\n    );\n    flash(c, \"Group mapping removed\");\n    return hxRedirect(c, `/projects/${project.slug}/settings/members`);\n  });\n}\n"],"mappings":";;;;;;;;;;;AAQA,SAAgB,uBAAuB,KAAwB;CAC7D,IAAI,IAAI,oCAAoC,OAAO,MACjD,EAAE,KAAK,MAAM,mBAAmB,GAAG,SAAS,CAAC,CAC/C;CAEA,IAAI,KAAK,oCAAoC,OAAO,MAAM;EACxD,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;EAC3D,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;EAClC,MAAM,SAAS,SAAS,KAAK,IAAI,QAAQ,CAAC;EAC1C,MAAM,OAAO,SAAS,KAAK,IAAI,MAAM,CAAC;EACtC,IAAI,CAAC,UAAU,CAAC,cAAc,IAAI,GAChC,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,WAAW,EAAE,aAAa,6BAA6B,CAAC,KACnF,IACF,GACF;EAEF,MAAM,IAAI,YAAY,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,IAAI,QAAQ,IAAI;EACjE,MAAM,GAAG,cAAc;EACvB,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,kBAAkB;CACnE,CAAC;CAED,IAAI,KAAK,mDAAmD,OAAO,MAAM;EACvE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;EAC3D,MAAM,IAAI,YAAY,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI,EAAE,IAAI,MAAM,QAAQ,KAAK,EAAE;EACnF,MAAM,GAAG,gBAAgB;EACzB,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,kBAAkB;CACnE,CAAC;CAED,6BAA6B,GAAG;AAClC;;AAGA,SAAS,6BAA6B,KAAwB;CAC5D,IAAI,KAAK,2CAA2C,OAAO,MAAM;EAC/D,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;EAC3D,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;EAClC,MAAM,YAAY,SAAS,KAAK,IAAI,WAAW,CAAC;EAChD,MAAM,OAAO,SAAS,KAAK,IAAI,MAAM,CAAC;EACtC,MAAM,aAAa,yBAAyB,WAAW,WAAW,IAAI;EACtE,IAAI,cAAc,CAAC,aAAa,CAAC,cAAc,IAAI,GACjD,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,WAAW,EAAE,aAAa,cAAc,gBAAgB,CAAC,KACpF,IACF,GACF;EAEF,MAAM,IAAI,yBAAyB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI,WAAW,IAAI;EACpF,MAAM,GAAG,qBAAqB;EAC9B,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,kBAAkB;CACnE,CAAC;CAED,IAAI,KAAK,6DAA6D,OAAO,MAAM;EACjF,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;EAC3D,MAAM,IAAI,yBAAyB,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAChD,QAAQ,IACR,EAAE,IAAI,MAAM,WAAW,KAAK,EAC9B;EACA,MAAM,GAAG,uBAAuB;EAChC,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,kBAAkB;CACnE,CAAC;AACH"}

package/dist/routers/settings-notifications.mjs

@@ -1,13 +1,14 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { credentialKeys } from "../credential-keys.mjs";
 import { getStore } from "../store.mjs";
 import { flash } from "./flash.mjs";
+import { notificationChannelModel } from "./scoped-models.mjs";
 import { asString, findProject, renderSettingsPage } from "./settings.handlers.mjs";
+import { createGitChannel } from "./settings-git-channel.mjs";
 import { NotificationChannelModel, NotificationSubscriptionModel } from "@storyshelf/core/models";
 //#region src/routers/settings-notifications.ts
-/** Notifications settings (channels plus my preferences). */
+/** Notifications settings (message and git channels plus my preferences). */
 function registerNotificationSettings(app) {
 	app.get("/projects/:slug/settings/notifications", async (c) => c.html(await renderSettingsPage(c, "notifications")));
 	app.post("/projects/:slug/settings/notifications", handleCreateChannel);
@@ -28,6 +29,11 @@ function parseChecks(form, name) {
 async function handleCreateChannel(c) {
 	const project = await findProject(c.req.param("slug") ?? "");
 	const form = await c.req.formData();
+	const gitProvider = asString(form.get("gitProvider"));
+	return gitProvider ? await createGitChannel(c, project, gitProvider, form) : await createMessageChannel(c, project, form);
+}
+/** The message-channel form: a provider and a target (email address or webhook URL). */
+async function createMessageChannel(c, project, form) {
 	const provider = asString(form.get("provider"));
 	const target = asString(form.get("target"));
 	if (provider && target) return await createChannelRecord(c, project, provider, target, form);
@@ -44,11 +50,10 @@ async function targetError(c, message) {
 	return c.html(await renderSettingsPage(c, "notifications", { errors: { target: message } }) ?? "", 400);
 }
 async function createChannelRecord(c, project, provider, target, form) {
-	const descriptor = getStore().notifiers.find((candidate) => candidate.metadata.kind === provider);
-	if (!descriptor) return await providerError(c, `Unknown provider: ${provider}`);
-	const parsed = descriptor.metadata.schema.safeParse(channelConfig(provider, target, form));
-	if (!parsed.success) return await targetError(c, parsed.error.message);
-	await persistChannel(project, provider, target, parsed.data, form);
+	const config = channelConfig(provider, target, form);
+	const checked = NotificationChannelModel.validateInput(getStore().notifiers, provider, config);
+	if (!checked.ok) return checked.field === "provider" ? await providerError(c, checked.message) : await targetError(c, checked.message);
+	await persistChannel(project, provider, target, config, form);
 	flash(c, "Notification channel added");
 	return c.html(await renderSettingsPage(c, "notifications") ?? "", 201);
 }
@@ -63,7 +68,7 @@ function channelConfig(provider, target, form) {
 }
 /** Persist a validated channel (webhook URLs land in the secret column). */
 async function persistChannel(project, provider, target, config, form) {
-	await new NotificationChannelModel(getStore().db, void 0, credentialKeys(getStore().config)).create({
+	await notificationChannelModel().create({
 		projectId: project.id,
 		provider,
 		config,
@@ -73,11 +78,11 @@ async function persistChannel(project, provider, target, config, form) {
 }
 async function handleDeleteChannel(c) {
 	const project = await findProject(c.req.param("slug") ?? "");
-	const model = new NotificationChannelModel(getStore().db, void 0, credentialKeys(getStore().config));
+	const model = notificationChannelModel();
 	const channel = await model.get(c.req.param("channelId") ?? "");
 	if (!channel || channel.projectId !== project.id) return c.html(await renderSettingsPage(c, "notifications", { globalError: "Channel not found" }) ?? "", 404);
 	await model.remove(channel.id);
-	flash(c, "Notification channel removed");
+	flash(c, "Channel removed");
 	return c.html(await renderSettingsPage(c, "notifications") ?? "");
 }
 async function handleSaveMine(c) {

package/dist/routers/settings-notifications.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"settings-notifications.mjs","names":[],"sources":["../../src/routers/settings-notifications.ts"],"sourcesContent":["import { NotificationChannelModel, NotificationSubscriptionModel } from \"@storyshelf/core/models\";\nimport type { Project } from \"@storyshelf/core/schema\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { credentialKeys } from \"../credential-keys.ts\";\nimport { getStore } from \"../store.ts\";\nimport { flash } from \"./flash.ts\";\nimport { asString, findProject, renderSettingsPage } from \"./settings.handlers.ts\";\n\n/** Notifications settings (channels plus my preferences). */\nexport function registerNotificationSettings(app: ShelfRouter): void {\n  app.get(\"/projects/:slug/settings/notifications\", async (c) =>\n    c.html(await renderSettingsPage(c, \"notifications\")),\n  );\n  app.post(\"/projects/:slug/settings/notifications\", handleCreateChannel);\n  app.post(\"/projects/:slug/settings/notifications/:channelId/delete\", handleDeleteChannel);\n  app.post(\"/projects/:slug/settings/notifications/me\", handleSaveMine);\n}\n\n/** Parse the comma-separated events field. */\nfunction parseEvents(form: FormData): string[] | undefined {\n  const raw = asString(form.get(\"events\"));\n  if (!raw) {\n    return undefined;\n  }\n  const events = raw\n    .split(\",\")\n    .map((event) => event.trim())\n    .filter((event) => event.length > 0);\n  return events.length > 0 ? events : undefined;\n}\n\n/** Parse repeated checkbox values (topics). */\nfunction parseChecks(form: FormData, name: string): string[] {\n  return form\n    .getAll(name)\n    .filter((entry): entry is string => typeof entry === \"string\")\n    .map((entry) => entry.trim())\n    .filter((entry) => entry.length > 0);\n}\n\nasync function handleCreateChannel(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const form = await c.req.formData();\n  const provider = asString(form.get(\"provider\"));\n  const target = asString(form.get(\"target\"));\n  if (provider && target) {\n    return await createChannelRecord(c, project, provider, target, form);\n  }\n  const missing = provider ? \"target\" : \"provider\";\n  const message = provider ? \"Enter a target\" : \"Choose a provider\";\n  return c.html(\n    (await renderSettingsPage(c, \"notifications\", { errors: { [missing]: message } })) ?? \"\",\n    400,\n  );\n}\n\n/** Render the tab with a provider-field error. */\nasync function providerError(c: Context, message: string): Promise<Response> {\n  return c.html(\n    (await renderSettingsPage(c, \"notifications\", { errors: { provider: message } })) ?? \"\",\n    400,\n  );\n}\n\n/** Render the tab with a target-field error. */\nasync function targetError(c: Context, message: string): Promise<Response> {\n  return c.html(\n    (await renderSettingsPage(c, \"notifications\", { errors: { target: message } })) ?? \"\",\n    400,\n  );\n}\n\nasync function createChannelRecord(\n  c: Context,\n  project: Project,\n  provider: string,\n  target: string,\n  form: FormData,\n): Promise<Response> {\n  const descriptor = getStore().notifiers.find((candidate) => candidate.metadata.kind === provider);\n  if (!descriptor) {\n    return await providerError(c, `Unknown provider: ${provider}`);\n  }\n  const parsed = descriptor.metadata.schema.safeParse(channelConfig(provider, target, form));\n  if (!parsed.success) {\n    return await targetError(c, parsed.error.message);\n  }\n  await persistChannel(project, provider, target, parsed.data, form);\n  flash(c, \"Notification channel added\");\n  return c.html((await renderSettingsPage(c, \"notifications\")) ?? \"\", 201);\n}\n\n/** Build the provider config from the form (address vs secret per kind). */\nfunction channelConfig(provider: string, target: string, form: FormData): Record<string, unknown> {\n  const style = asString(form.get(\"style\")) ?? \"compact\";\n  if (provider === \"email\") {\n    return { to: target, style };\n  }\n  return { style };\n}\n\n/** Persist a validated channel (webhook URLs land in the secret column). */\nasync function persistChannel(\n  project: Project,\n  provider: string,\n  target: string,\n  config: unknown,\n  form: FormData,\n): Promise<void> {\n  await new NotificationChannelModel(\n    getStore().db,\n    undefined,\n    credentialKeys(getStore().config),\n  ).create({\n    projectId: project.id,\n    provider,\n    config: config as Record<string, unknown>,\n    secret: provider === \"email\" ? undefined : target,\n    events: parseEvents(form),\n  });\n}\n\nasync function handleDeleteChannel(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const model = new NotificationChannelModel(\n    getStore().db,\n    undefined,\n    credentialKeys(getStore().config),\n  );\n  const channel = await model.get(c.req.param(\"channelId\") ?? \"\");\n  if (!channel || channel.projectId !== project.id) {\n    return c.html(\n      (await renderSettingsPage(c, \"notifications\", {\n        globalError: \"Channel not found\",\n      })) ?? \"\",\n      404,\n    );\n  }\n  await model.remove(channel.id);\n  flash(c, \"Notification channel removed\");\n  return c.html((await renderSettingsPage(c, \"notifications\")) ?? \"\");\n}\n\nasync function handleSaveMine(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const user = getStore().user;\n  if (user) {\n    await saveSubscription(project, user.id, await c.req.formData());\n    flash(c, \"Notification preferences saved\");\n    return c.html((await renderSettingsPage(c, \"notifications\")) ?? \"\");\n  }\n  return c.html(\n    (await renderSettingsPage(c, \"notifications\", {\n      globalError: \"Sign in to save notification preferences\",\n    })) ?? \"\",\n    401,\n  );\n}\n\n/** Persist the viewer's own subscription (unchecked means opt out). */\nasync function saveSubscription(project: Project, userId: string, form: FormData): Promise<void> {\n  const model = new NotificationSubscriptionModel(getStore().db);\n  if (form.get(\"enabled\") === \"on\") {\n    await model.upsert(project.id, userId, { events: parseChecks(form, \"events\"), via: [\"email\"] });\n    return;\n  }\n  await model.remove(project.id, userId);\n}\n"],"mappings":";;;;;;;;;;AAUA,SAAgB,6BAA6B,KAAwB;CACnE,IAAI,IAAI,0CAA0C,OAAO,MACvD,EAAE,KAAK,MAAM,mBAAmB,GAAG,eAAe,CAAC,CACrD;CACA,IAAI,KAAK,0CAA0C,mBAAmB;CACtE,IAAI,KAAK,4DAA4D,mBAAmB;CACxF,IAAI,KAAK,6CAA6C,cAAc;AACtE;;AAGA,SAAS,YAAY,MAAsC;CACzD,MAAM,MAAM,SAAS,KAAK,IAAI,QAAQ,CAAC;CACvC,IAAI,CAAC,KACH;CAEF,MAAM,SAAS,IACZ,MAAM,GAAG,CAAC,CACV,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,QAAQ,UAAU,MAAM,SAAS,CAAC;CACrC,OAAO,OAAO,SAAS,IAAI,SAAS,KAAA;AACtC;;AAGA,SAAS,YAAY,MAAgB,MAAwB;CAC3D,OAAO,KACJ,OAAO,IAAI,CAAC,CACZ,QAAQ,UAA2B,OAAO,UAAU,QAAQ,CAAC,CAC7D,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,QAAQ,UAAU,MAAM,SAAS,CAAC;AACvC;AAEA,eAAe,oBAAoB,GAA+B;CAChE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;CAClC,MAAM,WAAW,SAAS,KAAK,IAAI,UAAU,CAAC;CAC9C,MAAM,SAAS,SAAS,KAAK,IAAI,QAAQ,CAAC;CAC1C,IAAI,YAAY,QACd,OAAO,MAAM,oBAAoB,GAAG,SAAS,UAAU,QAAQ,IAAI;CAErE,MAAM,UAAU,WAAW,WAAW;CACtC,MAAM,UAAU,WAAW,mBAAmB;CAC9C,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,iBAAiB,EAAE,QAAQ,GAAG,UAAU,QAAQ,EAAE,CAAC,KAAM,IACtF,GACF;AACF;;AAGA,eAAe,cAAc,GAAY,SAAoC;CAC3E,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,iBAAiB,EAAE,QAAQ,EAAE,UAAU,QAAQ,EAAE,CAAC,KAAM,IACrF,GACF;AACF;;AAGA,eAAe,YAAY,GAAY,SAAoC;CACzE,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,QAAQ,EAAE,CAAC,KAAM,IACnF,GACF;AACF;AAEA,eAAe,oBACb,GACA,SACA,UACA,QACA,MACmB;CACnB,MAAM,aAAa,SAAS,CAAC,CAAC,UAAU,MAAM,cAAc,UAAU,SAAS,SAAS,QAAQ;CAChG,IAAI,CAAC,YACH,OAAO,MAAM,cAAc,GAAG,qBAAqB,UAAU;CAE/D,MAAM,SAAS,WAAW,SAAS,OAAO,UAAU,cAAc,UAAU,QAAQ,IAAI,CAAC;CACzF,IAAI,CAAC,OAAO,SACV,OAAO,MAAM,YAAY,GAAG,OAAO,MAAM,OAAO;CAElD,MAAM,eAAe,SAAS,UAAU,QAAQ,OAAO,MAAM,IAAI;CACjE,MAAM,GAAG,4BAA4B;CACrC,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,eAAe,KAAM,IAAI,GAAG;AACzE;;AAGA,SAAS,cAAc,UAAkB,QAAgB,MAAyC;CAChG,MAAM,QAAQ,SAAS,KAAK,IAAI,OAAO,CAAC,KAAK;CAC7C,IAAI,aAAa,SACf,OAAO;EAAE,IAAI;EAAQ;CAAM;CAE7B,OAAO,EAAE,MAAM;AACjB;;AAGA,eAAe,eACb,SACA,UACA,QACA,QACA,MACe;CACf,MAAM,IAAI,yBACR,SAAS,CAAC,CAAC,IACX,KAAA,GACA,eAAe,SAAS,CAAC,CAAC,MAAM,CAClC,CAAC,CAAC,OAAO;EACP,WAAW,QAAQ;EACnB;EACQ;EACR,QAAQ,aAAa,UAAU,KAAA,IAAY;EAC3C,QAAQ,YAAY,IAAI;CAC1B,CAAC;AACH;AAEA,eAAe,oBAAoB,GAA+B;CAChE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,QAAQ,IAAI,yBAChB,SAAS,CAAC,CAAC,IACX,KAAA,GACA,eAAe,SAAS,CAAC,CAAC,MAAM,CAClC;CACA,MAAM,UAAU,MAAM,MAAM,IAAI,EAAE,IAAI,MAAM,WAAW,KAAK,EAAE;CAC9D,IAAI,CAAC,WAAW,QAAQ,cAAc,QAAQ,IAC5C,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,iBAAiB,EAC5C,aAAa,oBACf,CAAC,KAAM,IACP,GACF;CAEF,MAAM,MAAM,OAAO,QAAQ,EAAE;CAC7B,MAAM,GAAG,8BAA8B;CACvC,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,eAAe,KAAM,EAAE;AACpE;AAEA,eAAe,eAAe,GAA+B;CAC3D,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,OAAO,SAAS,CAAC,CAAC;CACxB,IAAI,MAAM;EACR,MAAM,iBAAiB,SAAS,KAAK,IAAI,MAAM,EAAE,IAAI,SAAS,CAAC;EAC/D,MAAM,GAAG,gCAAgC;EACzC,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,eAAe,KAAM,EAAE;CACpE;CACA,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,iBAAiB,EAC5C,aAAa,2CACf,CAAC,KAAM,IACP,GACF;AACF;;AAGA,eAAe,iBAAiB,SAAkB,QAAgB,MAA+B;CAC/F,MAAM,QAAQ,IAAI,8BAA8B,SAAS,CAAC,CAAC,EAAE;CAC7D,IAAI,KAAK,IAAI,SAAS,MAAM,MAAM;EAChC,MAAM,MAAM,OAAO,QAAQ,IAAI,QAAQ;GAAE,QAAQ,YAAY,MAAM,QAAQ;GAAG,KAAK,CAAC,OAAO;EAAE,CAAC;EAC9F;CACF;CACA,MAAM,MAAM,OAAO,QAAQ,IAAI,MAAM;AACvC"}
+{"version":3,"file":"settings-notifications.mjs","names":[],"sources":["../../src/routers/settings-notifications.ts"],"sourcesContent":["import { NotificationChannelModel, NotificationSubscriptionModel } from \"@storyshelf/core/models\";\nimport type { Project } from \"@storyshelf/core/schema\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { flash } from \"./flash.ts\";\nimport { notificationChannelModel } from \"./scoped-models.ts\";\nimport { createGitChannel } from \"./settings-git-channel.ts\";\nimport { asString, findProject, renderSettingsPage } from \"./settings.handlers.ts\";\n\n/** Notifications settings (message and git channels plus my preferences). */\nexport function registerNotificationSettings(app: ShelfRouter): void {\n  app.get(\"/projects/:slug/settings/notifications\", async (c) =>\n    c.html(await renderSettingsPage(c, \"notifications\")),\n  );\n  app.post(\"/projects/:slug/settings/notifications\", handleCreateChannel);\n  app.post(\"/projects/:slug/settings/notifications/:channelId/delete\", handleDeleteChannel);\n  app.post(\"/projects/:slug/settings/notifications/me\", handleSaveMine);\n}\n\n/** Parse the comma-separated events field. */\nfunction parseEvents(form: FormData): string[] | undefined {\n  const raw = asString(form.get(\"events\"));\n  if (!raw) {\n    return undefined;\n  }\n  const events = raw\n    .split(\",\")\n    .map((event) => event.trim())\n    .filter((event) => event.length > 0);\n  return events.length > 0 ? events : undefined;\n}\n\n/** Parse repeated checkbox values (topics). */\nfunction parseChecks(form: FormData, name: string): string[] {\n  return form\n    .getAll(name)\n    .filter((entry): entry is string => typeof entry === \"string\")\n    .map((entry) => entry.trim())\n    .filter((entry) => entry.length > 0);\n}\n\nasync function handleCreateChannel(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const form = await c.req.formData();\n  const gitProvider = asString(form.get(\"gitProvider\"));\n  return gitProvider\n    ? await createGitChannel(c, project, gitProvider, form)\n    : await createMessageChannel(c, project, form);\n}\n\n/** The message-channel form: a provider and a target (email address or webhook URL). */\nasync function createMessageChannel(\n  c: Context,\n  project: Project,\n  form: FormData,\n): Promise<Response> {\n  const provider = asString(form.get(\"provider\"));\n  const target = asString(form.get(\"target\"));\n  if (provider && target) {\n    return await createChannelRecord(c, project, provider, target, form);\n  }\n  const missing = provider ? \"target\" : \"provider\";\n  const message = provider ? \"Enter a target\" : \"Choose a provider\";\n  return c.html(\n    (await renderSettingsPage(c, \"notifications\", { errors: { [missing]: message } })) ?? \"\",\n    400,\n  );\n}\n\n/** Render the tab with a provider-field error. */\nasync function providerError(c: Context, message: string): Promise<Response> {\n  return c.html(\n    (await renderSettingsPage(c, \"notifications\", { errors: { provider: message } })) ?? \"\",\n    400,\n  );\n}\n\n/** Render the tab with a target-field error. */\nasync function targetError(c: Context, message: string): Promise<Response> {\n  return c.html(\n    (await renderSettingsPage(c, \"notifications\", { errors: { target: message } })) ?? \"\",\n    400,\n  );\n}\n\nasync function createChannelRecord(\n  c: Context,\n  project: Project,\n  provider: string,\n  target: string,\n  form: FormData,\n): Promise<Response> {\n  const config = channelConfig(provider, target, form);\n  const checked = NotificationChannelModel.validateInput(getStore().notifiers, provider, config);\n  if (!checked.ok) {\n    return checked.field === \"provider\"\n      ? await providerError(c, checked.message)\n      : await targetError(c, checked.message);\n  }\n  await persistChannel(project, provider, target, config, form);\n  flash(c, \"Notification channel added\");\n  return c.html((await renderSettingsPage(c, \"notifications\")) ?? \"\", 201);\n}\n\n/** Build the provider config from the form (address vs secret per kind). */\nfunction channelConfig(provider: string, target: string, form: FormData): Record<string, unknown> {\n  const style = asString(form.get(\"style\")) ?? \"compact\";\n  if (provider === \"email\") {\n    return { to: target, style };\n  }\n  return { style };\n}\n\n/** Persist a validated channel (webhook URLs land in the secret column). */\nasync function persistChannel(\n  project: Project,\n  provider: string,\n  target: string,\n  config: unknown,\n  form: FormData,\n): Promise<void> {\n  await notificationChannelModel().create({\n    projectId: project.id,\n    provider,\n    config: config as Record<string, unknown>,\n    secret: provider === \"email\" ? undefined : target,\n    events: parseEvents(form),\n  });\n}\n\nasync function handleDeleteChannel(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const model = notificationChannelModel();\n  const channel = await model.get(c.req.param(\"channelId\") ?? \"\");\n  if (!channel || channel.projectId !== project.id) {\n    return c.html(\n      (await renderSettingsPage(c, \"notifications\", {\n        globalError: \"Channel not found\",\n      })) ?? \"\",\n      404,\n    );\n  }\n  await model.remove(channel.id);\n  flash(c, \"Channel removed\");\n  return c.html((await renderSettingsPage(c, \"notifications\")) ?? \"\");\n}\n\nasync function handleSaveMine(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const user = getStore().user;\n  if (user) {\n    await saveSubscription(project, user.id, await c.req.formData());\n    flash(c, \"Notification preferences saved\");\n    return c.html((await renderSettingsPage(c, \"notifications\")) ?? \"\");\n  }\n  return c.html(\n    (await renderSettingsPage(c, \"notifications\", {\n      globalError: \"Sign in to save notification preferences\",\n    })) ?? \"\",\n    401,\n  );\n}\n\n/** Persist the viewer's own subscription (unchecked means opt out). */\nasync function saveSubscription(project: Project, userId: string, form: FormData): Promise<void> {\n  const model = new NotificationSubscriptionModel(getStore().db);\n  if (form.get(\"enabled\") === \"on\") {\n    await model.upsert(project.id, userId, { events: parseChecks(form, \"events\"), via: [\"email\"] });\n    return;\n  }\n  await model.remove(project.id, userId);\n}\n"],"mappings":";;;;;;;;;;;AAWA,SAAgB,6BAA6B,KAAwB;CACnE,IAAI,IAAI,0CAA0C,OAAO,MACvD,EAAE,KAAK,MAAM,mBAAmB,GAAG,eAAe,CAAC,CACrD;CACA,IAAI,KAAK,0CAA0C,mBAAmB;CACtE,IAAI,KAAK,4DAA4D,mBAAmB;CACxF,IAAI,KAAK,6CAA6C,cAAc;AACtE;;AAGA,SAAS,YAAY,MAAsC;CACzD,MAAM,MAAM,SAAS,KAAK,IAAI,QAAQ,CAAC;CACvC,IAAI,CAAC,KACH;CAEF,MAAM,SAAS,IACZ,MAAM,GAAG,CAAC,CACV,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,QAAQ,UAAU,MAAM,SAAS,CAAC;CACrC,OAAO,OAAO,SAAS,IAAI,SAAS,KAAA;AACtC;;AAGA,SAAS,YAAY,MAAgB,MAAwB;CAC3D,OAAO,KACJ,OAAO,IAAI,CAAC,CACZ,QAAQ,UAA2B,OAAO,UAAU,QAAQ,CAAC,CAC7D,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,QAAQ,UAAU,MAAM,SAAS,CAAC;AACvC;AAEA,eAAe,oBAAoB,GAA+B;CAChE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;CAClC,MAAM,cAAc,SAAS,KAAK,IAAI,aAAa,CAAC;CACpD,OAAO,cACH,MAAM,iBAAiB,GAAG,SAAS,aAAa,IAAI,IACpD,MAAM,qBAAqB,GAAG,SAAS,IAAI;AACjD;;AAGA,eAAe,qBACb,GACA,SACA,MACmB;CACnB,MAAM,WAAW,SAAS,KAAK,IAAI,UAAU,CAAC;CAC9C,MAAM,SAAS,SAAS,KAAK,IAAI,QAAQ,CAAC;CAC1C,IAAI,YAAY,QACd,OAAO,MAAM,oBAAoB,GAAG,SAAS,UAAU,QAAQ,IAAI;CAErE,MAAM,UAAU,WAAW,WAAW;CACtC,MAAM,UAAU,WAAW,mBAAmB;CAC9C,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,iBAAiB,EAAE,QAAQ,GAAG,UAAU,QAAQ,EAAE,CAAC,KAAM,IACtF,GACF;AACF;;AAGA,eAAe,cAAc,GAAY,SAAoC;CAC3E,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,iBAAiB,EAAE,QAAQ,EAAE,UAAU,QAAQ,EAAE,CAAC,KAAM,IACrF,GACF;AACF;;AAGA,eAAe,YAAY,GAAY,SAAoC;CACzE,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,QAAQ,EAAE,CAAC,KAAM,IACnF,GACF;AACF;AAEA,eAAe,oBACb,GACA,SACA,UACA,QACA,MACmB;CACnB,MAAM,SAAS,cAAc,UAAU,QAAQ,IAAI;CACnD,MAAM,UAAU,yBAAyB,cAAc,SAAS,CAAC,CAAC,WAAW,UAAU,MAAM;CAC7F,IAAI,CAAC,QAAQ,IACX,OAAO,QAAQ,UAAU,aACrB,MAAM,cAAc,GAAG,QAAQ,OAAO,IACtC,MAAM,YAAY,GAAG,QAAQ,OAAO;CAE1C,MAAM,eAAe,SAAS,UAAU,QAAQ,QAAQ,IAAI;CAC5D,MAAM,GAAG,4BAA4B;CACrC,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,eAAe,KAAM,IAAI,GAAG;AACzE;;AAGA,SAAS,cAAc,UAAkB,QAAgB,MAAyC;CAChG,MAAM,QAAQ,SAAS,KAAK,IAAI,OAAO,CAAC,KAAK;CAC7C,IAAI,aAAa,SACf,OAAO;EAAE,IAAI;EAAQ;CAAM;CAE7B,OAAO,EAAE,MAAM;AACjB;;AAGA,eAAe,eACb,SACA,UACA,QACA,QACA,MACe;CACf,MAAM,yBAAyB,CAAC,CAAC,OAAO;EACtC,WAAW,QAAQ;EACnB;EACQ;EACR,QAAQ,aAAa,UAAU,KAAA,IAAY;EAC3C,QAAQ,YAAY,IAAI;CAC1B,CAAC;AACH;AAEA,eAAe,oBAAoB,GAA+B;CAChE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,QAAQ,yBAAyB;CACvC,MAAM,UAAU,MAAM,MAAM,IAAI,EAAE,IAAI,MAAM,WAAW,KAAK,EAAE;CAC9D,IAAI,CAAC,WAAW,QAAQ,cAAc,QAAQ,IAC5C,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,iBAAiB,EAC5C,aAAa,oBACf,CAAC,KAAM,IACP,GACF;CAEF,MAAM,MAAM,OAAO,QAAQ,EAAE;CAC7B,MAAM,GAAG,iBAAiB;CAC1B,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,eAAe,KAAM,EAAE;AACpE;AAEA,eAAe,eAAe,GAA+B;CAC3D,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,OAAO,SAAS,CAAC,CAAC;CACxB,IAAI,MAAM;EACR,MAAM,iBAAiB,SAAS,KAAK,IAAI,MAAM,EAAE,IAAI,SAAS,CAAC;EAC/D,MAAM,GAAG,gCAAgC;EACzC,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,eAAe,KAAM,EAAE;CACpE;CACA,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,iBAAiB,EAC5C,aAAa,2CACf,CAAC,KAAM,IACP,GACF;AACF;;AAGA,eAAe,iBAAiB,SAAkB,QAAgB,MAA+B;CAC/F,MAAM,QAAQ,IAAI,8BAA8B,SAAS,CAAC,CAAC,EAAE;CAC7D,IAAI,KAAK,IAAI,SAAS,MAAM,MAAM;EAChC,MAAM,MAAM,OAAO,QAAQ,IAAI,QAAQ;GAAE,QAAQ,YAAY,MAAM,QAAQ;GAAG,KAAK,CAAC,OAAO;EAAE,CAAC;EAC9F;CACF;CACA,MAAM,MAAM,OAAO,QAAQ,IAAI,MAAM;AACvC"}

package/dist/routers/settings-tokens.mjs

@@ -6,7 +6,6 @@ import { hxRedirect } from "./htmx.mjs";
 import { flash } from "./flash.mjs";
 import { asString, findProject, renderSettingsPage } from "./settings.handlers.mjs";
 import { TokenModel } from "@storyshelf/core/models";
-import { randomToken } from "@storyshelf/core/utils";
 //#region src/routers/settings-tokens.ts
 /** CI token settings (create with one-time display, delete). */
 function registerTokenSettings(app) {
@@ -19,14 +18,12 @@ async function handleCreateToken(c) {
 	const form = await c.req.formData();
 	const tokenName = asString(form.get("tokenName")) ?? asString(form.get("name"));
 	if (!tokenName) return c.html(await renderSettingsPage(c, "tokens", { globalError: "Name is required" }) ?? "", 400);
-	const token = randomToken("shelf_");
-	await new TokenModel(getStore().db).create(project.id, {
+	const { value } = await new TokenModel(getStore().db).issue(project.id, {
 		name: tokenName,
-		hash: token.hash,
 		userId: getStore().user?.id ?? null
 	});
 	flash(c, "Token created — copy it now, it is shown once");
-	return c.html(await renderSettingsPage(c, "tokens", { secret: token.value }) ?? "");
+	return c.html(await renderSettingsPage(c, "tokens", { secret: value }) ?? "");
 }
 async function handleDeleteToken(c) {
 	const project = await findProject(c.req.param("slug") ?? "");

package/dist/routers/settings-tokens.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"settings-tokens.mjs","names":[],"sources":["../../src/routers/settings-tokens.ts"],"sourcesContent":["import { TokenModel } from \"@storyshelf/core/models\";\nimport { randomToken } from \"@storyshelf/core/utils\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { flash } from \"./flash.ts\";\nimport { hxRedirect } from \"./htmx.ts\";\nimport { asString, findProject, renderSettingsPage } from \"./settings.handlers.ts\";\n/** CI token settings (create with one-time display, delete). */\nexport function registerTokenSettings(app: ShelfRouter): void {\n  app.get(\"/projects/:slug/settings/tokens\", async (c) =>\n    c.html(await renderSettingsPage(c, \"tokens\")),\n  );\n  app.post(\"/projects/:slug/settings/tokens\", handleCreateToken);\n  app.post(\"/projects/:slug/settings/tokens/:tokenId/delete\", handleDeleteToken);\n}\n\nasync function handleCreateToken(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const form = await c.req.formData();\n  const tokenName = asString(form.get(\"tokenName\")) ?? asString(form.get(\"name\"));\n  if (!tokenName) {\n    return c.html(\n      (await renderSettingsPage(c, \"tokens\", { globalError: \"Name is required\" })) ?? \"\",\n      400,\n    );\n  }\n  const token = randomToken(\"shelf_\");\n  await new TokenModel(getStore().db).create(project.id, {\n    name: tokenName,\n    hash: token.hash,\n    userId: getStore().user?.id ?? null,\n  });\n  flash(c, \"Token created — copy it now, it is shown once\");\n  return c.html((await renderSettingsPage(c, \"tokens\", { secret: token.value })) ?? \"\");\n}\n\nasync function handleDeleteToken(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  await new TokenModel(getStore().db).remove(c.req.param(\"tokenId\") ?? \"\");\n  flash(c, \"Token deleted\");\n  return hxRedirect(c, `/projects/${project.slug}/settings/tokens`);\n}\n"],"mappings":";;;;;;;;;;;AASA,SAAgB,sBAAsB,KAAwB;CAC5D,IAAI,IAAI,mCAAmC,OAAO,MAChD,EAAE,KAAK,MAAM,mBAAmB,GAAG,QAAQ,CAAC,CAC9C;CACA,IAAI,KAAK,mCAAmC,iBAAiB;CAC7D,IAAI,KAAK,mDAAmD,iBAAiB;AAC/E;AAEA,eAAe,kBAAkB,GAA+B;CAC9D,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;CAClC,MAAM,YAAY,SAAS,KAAK,IAAI,WAAW,CAAC,KAAK,SAAS,KAAK,IAAI,MAAM,CAAC;CAC9E,IAAI,CAAC,WACH,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,UAAU,EAAE,aAAa,mBAAmB,CAAC,KAAM,IAChF,GACF;CAEF,MAAM,QAAQ,YAAY,QAAQ;CAClC,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI;EACrD,MAAM;EACN,MAAM,MAAM;EACZ,QAAQ,SAAS,CAAC,CAAC,MAAM,MAAM;CACjC,CAAC;CACD,MAAM,GAAG,+CAA+C;CACxD,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,UAAU,EAAE,QAAQ,MAAM,MAAM,CAAC,KAAM,EAAE;AACtF;AAEA,eAAe,kBAAkB,GAA+B;CAC9D,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,MAAM,SAAS,KAAK,EAAE;CACvE,MAAM,GAAG,eAAe;CACxB,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,iBAAiB;AAClE"}
+{"version":3,"file":"settings-tokens.mjs","names":[],"sources":["../../src/routers/settings-tokens.ts"],"sourcesContent":["import { TokenModel } from \"@storyshelf/core/models\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { flash } from \"./flash.ts\";\nimport { hxRedirect } from \"./htmx.ts\";\nimport { asString, findProject, renderSettingsPage } from \"./settings.handlers.ts\";\n/** CI token settings (create with one-time display, delete). */\nexport function registerTokenSettings(app: ShelfRouter): void {\n  app.get(\"/projects/:slug/settings/tokens\", async (c) =>\n    c.html(await renderSettingsPage(c, \"tokens\")),\n  );\n  app.post(\"/projects/:slug/settings/tokens\", handleCreateToken);\n  app.post(\"/projects/:slug/settings/tokens/:tokenId/delete\", handleDeleteToken);\n}\n\nasync function handleCreateToken(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const form = await c.req.formData();\n  const tokenName = asString(form.get(\"tokenName\")) ?? asString(form.get(\"name\"));\n  if (!tokenName) {\n    return c.html(\n      (await renderSettingsPage(c, \"tokens\", { globalError: \"Name is required\" })) ?? \"\",\n      400,\n    );\n  }\n  const { value } = await new TokenModel(getStore().db).issue(project.id, {\n    name: tokenName,\n    userId: getStore().user?.id ?? null,\n  });\n  flash(c, \"Token created — copy it now, it is shown once\");\n  return c.html((await renderSettingsPage(c, \"tokens\", { secret: value })) ?? \"\");\n}\n\nasync function handleDeleteToken(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  await new TokenModel(getStore().db).remove(c.req.param(\"tokenId\") ?? \"\");\n  flash(c, \"Token deleted\");\n  return hxRedirect(c, `/projects/${project.slug}/settings/tokens`);\n}\n"],"mappings":";;;;;;;;;;AAQA,SAAgB,sBAAsB,KAAwB;CAC5D,IAAI,IAAI,mCAAmC,OAAO,MAChD,EAAE,KAAK,MAAM,mBAAmB,GAAG,QAAQ,CAAC,CAC9C;CACA,IAAI,KAAK,mCAAmC,iBAAiB;CAC7D,IAAI,KAAK,mDAAmD,iBAAiB;AAC/E;AAEA,eAAe,kBAAkB,GAA+B;CAC9D,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;CAClC,MAAM,YAAY,SAAS,KAAK,IAAI,WAAW,CAAC,KAAK,SAAS,KAAK,IAAI,MAAM,CAAC;CAC9E,IAAI,CAAC,WACH,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,UAAU,EAAE,aAAa,mBAAmB,CAAC,KAAM,IAChF,GACF;CAEF,MAAM,EAAE,UAAU,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,QAAQ,IAAI;EACtE,MAAM;EACN,QAAQ,SAAS,CAAC,CAAC,MAAM,MAAM;CACjC,CAAC;CACD,MAAM,GAAG,+CAA+C;CACxD,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,UAAU,EAAE,QAAQ,MAAM,CAAC,KAAM,EAAE;AAChF;AAEA,eAAe,kBAAkB,GAA+B;CAC9D,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,MAAM,SAAS,KAAK,EAAE;CACvE,MAAM,GAAG,eAAe;CACxB,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,iBAAiB;AAClE"}

package/dist/routers/settings-webhooks.mjs

@@ -1,14 +1,12 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { credentialKeys } from "../credential-keys.mjs";
-import { getStore } from "../store.mjs";
+import { notFound } from "./helpers.mjs";
 import { hxRedirect } from "./htmx.mjs";
 import { flash } from "./flash.mjs";
-import { notFound } from "./helpers.mjs";
+import { webhookModel } from "./scoped-models.mjs";
 import { asString, findProject, renderSettingsPage } from "./settings.handlers.mjs";
 import { WebhookModel } from "@storyshelf/core/models";
-import { randomToken } from "@storyshelf/core/utils";
 //#region src/routers/settings-webhooks.ts
 /** Webhook settings (create with one-time secret display, delete). */
 function registerWebhookSettings(app) {
@@ -16,18 +14,6 @@ function registerWebhookSettings(app) {
 	app.post("/projects/:slug/settings/webhooks", handleCreateWebhook);
 	app.post("/projects/:slug/settings/webhooks/:webhookId/delete", handleDeleteWebhook);
 }
-/** Validate a webhook URL, returning the error message or null when valid. */
-function webhookUrlError(url) {
-	if (!url) return "A valid URL is required";
-	let protocol;
-	try {
-		protocol = new URL(url).protocol;
-	} catch {
-		return "Enter a valid URL";
-	}
-	if (protocol !== "https:" && protocol !== "http:") return "URL must use http or https";
-	return null;
-}
 /** Parse the comma-separated events field. */
 function parseWebhookEvents(form) {
 	const eventsRaw = asString(form.get("events"));
@@ -38,26 +24,23 @@ async function handleCreateWebhook(c) {
 	const project = await findProject(c.req.param("slug") ?? "");
 	const form = await c.req.formData();
 	const url = asString(form.get("url"));
-	const urlError = webhookUrlError(url);
+	const urlError = WebhookModel.urlError(url);
 	if (urlError || !url) return c.html(await renderSettingsPage(c, "webhooks", { errors: { url: urlError ?? "Invalid URL" } }) ?? "", 400);
 	return await createWebhookRecord(c, project, url, parseWebhookEvents(form));
 }
 async function createWebhookRecord(c, project, url, events) {
-	const webhookModel = new WebhookModel(getStore().db, void 0, credentialKeys(getStore().config));
-	const secret = randomToken("whsec_").value;
-	await webhookModel.create(project.id, {
+	const { secret } = await webhookModel().issue(project.id, {
 		url,
-		events,
-		secret
+		events
 	});
 	flash(c, "Webhook created — copy the signing secret now");
 	return c.html(await renderSettingsPage(c, "webhooks", { secret }) ?? "", 201);
 }
 async function handleDeleteWebhook(c) {
 	const project = await findProject(c.req.param("slug") ?? "");
-	const webhook = await new WebhookModel(getStore().db, void 0, credentialKeys(getStore().config)).get(project.id, c.req.param("webhookId") ?? "");
+	const webhook = await webhookModel().get(project.id, c.req.param("webhookId") ?? "");
 	if (!webhook) notFound("Webhook not found");
-	await new WebhookModel(getStore().db, void 0, credentialKeys(getStore().config)).remove(project.id, webhook.id);
+	await webhookModel().remove(project.id, webhook.id);
 	flash(c, "Webhook deleted");
 	return hxRedirect(c, `/projects/${project.slug}/settings/webhooks`);
 }

package/dist/routers/settings-webhooks.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"settings-webhooks.mjs","names":[],"sources":["../../src/routers/settings-webhooks.ts"],"sourcesContent":["import { WebhookModel } from \"@storyshelf/core/models\";\nimport type { Project } from \"@storyshelf/core/schema\";\nimport { randomToken } from \"@storyshelf/core/utils\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { credentialKeys } from \"../credential-keys.ts\";\nimport { getStore } from \"../store.ts\";\nimport { flash } from \"./flash.ts\";\nimport { notFound } from \"./helpers.ts\";\nimport { hxRedirect } from \"./htmx.ts\";\nimport { asString, findProject, renderSettingsPage } from \"./settings.handlers.ts\";\n/** Webhook settings (create with one-time secret display, delete). */\nexport function registerWebhookSettings(app: ShelfRouter): void {\n  app.get(\"/projects/:slug/settings/webhooks\", async (c) =>\n    c.html(await renderSettingsPage(c, \"webhooks\")),\n  );\n  app.post(\"/projects/:slug/settings/webhooks\", handleCreateWebhook);\n  app.post(\"/projects/:slug/settings/webhooks/:webhookId/delete\", handleDeleteWebhook);\n}\n\n/** Validate a webhook URL, returning the error message or null when valid. */\nfunction webhookUrlError(url: string | undefined): string | null {\n  if (!url) {\n    return \"A valid URL is required\";\n  }\n  let protocol: string;\n  try {\n    protocol = new URL(url).protocol;\n  } catch {\n    return \"Enter a valid URL\";\n  }\n  if (protocol !== \"https:\" && protocol !== \"http:\") {\n    return \"URL must use http or https\";\n  }\n  return null;\n}\n\n/** Parse the comma-separated events field. */\nfunction parseWebhookEvents(form: FormData): string[] | undefined {\n  const eventsRaw = asString(form.get(\"events\"));\n  if (!eventsRaw) {\n    return undefined;\n  }\n  return eventsRaw\n    .split(\",\")\n    .map((event) => event.trim())\n    .filter((event) => event.length > 0);\n}\n\nasync function handleCreateWebhook(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const form = await c.req.formData();\n  const url = asString(form.get(\"url\"));\n  const urlError = webhookUrlError(url);\n  if (urlError || !url) {\n    return c.html(\n      (await renderSettingsPage(c, \"webhooks\", { errors: { url: urlError ?? \"Invalid URL\" } })) ??\n        \"\",\n      400,\n    );\n  }\n  return await createWebhookRecord(c, project, url, parseWebhookEvents(form));\n}\n\nasync function createWebhookRecord(\n  c: Context,\n  project: Project,\n  url: string,\n  events: string[] | undefined,\n): Promise<Response> {\n  const webhookModel = new WebhookModel(\n    getStore().db,\n    undefined,\n    credentialKeys(getStore().config),\n  );\n  const secret = randomToken(\"whsec_\").value;\n  await webhookModel.create(project.id, { url, events, secret });\n  flash(c, \"Webhook created — copy the signing secret now\");\n  return c.html((await renderSettingsPage(c, \"webhooks\", { secret })) ?? \"\", 201);\n}\n\nasync function handleDeleteWebhook(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const webhook = await new WebhookModel(\n    getStore().db,\n    undefined,\n    credentialKeys(getStore().config),\n  ).get(project.id, c.req.param(\"webhookId\") ?? \"\");\n  if (!webhook) {\n    notFound(\"Webhook not found\");\n  }\n  await new WebhookModel(getStore().db, undefined, credentialKeys(getStore().config)).remove(\n    project.id,\n    webhook.id,\n  );\n  flash(c, \"Webhook deleted\");\n  return hxRedirect(c, `/projects/${project.slug}/settings/webhooks`);\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAgB,wBAAwB,KAAwB;CAC9D,IAAI,IAAI,qCAAqC,OAAO,MAClD,EAAE,KAAK,MAAM,mBAAmB,GAAG,UAAU,CAAC,CAChD;CACA,IAAI,KAAK,qCAAqC,mBAAmB;CACjE,IAAI,KAAK,uDAAuD,mBAAmB;AACrF;;AAGA,SAAS,gBAAgB,KAAwC;CAC/D,IAAI,CAAC,KACH,OAAO;CAET,IAAI;CACJ,IAAI;EACF,WAAW,IAAI,IAAI,GAAG,CAAC,CAAC;CAC1B,QAAQ;EACN,OAAO;CACT;CACA,IAAI,aAAa,YAAY,aAAa,SACxC,OAAO;CAET,OAAO;AACT;;AAGA,SAAS,mBAAmB,MAAsC;CAChE,MAAM,YAAY,SAAS,KAAK,IAAI,QAAQ,CAAC;CAC7C,IAAI,CAAC,WACH;CAEF,OAAO,UACJ,MAAM,GAAG,CAAC,CACV,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,QAAQ,UAAU,MAAM,SAAS,CAAC;AACvC;AAEA,eAAe,oBAAoB,GAA+B;CAChE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;CAClC,MAAM,MAAM,SAAS,KAAK,IAAI,KAAK,CAAC;CACpC,MAAM,WAAW,gBAAgB,GAAG;CACpC,IAAI,YAAY,CAAC,KACf,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,YAAY,EAAE,QAAQ,EAAE,KAAK,YAAY,cAAc,EAAE,CAAC,KACrF,IACF,GACF;CAEF,OAAO,MAAM,oBAAoB,GAAG,SAAS,KAAK,mBAAmB,IAAI,CAAC;AAC5E;AAEA,eAAe,oBACb,GACA,SACA,KACA,QACmB;CACnB,MAAM,eAAe,IAAI,aACvB,SAAS,CAAC,CAAC,IACX,KAAA,GACA,eAAe,SAAS,CAAC,CAAC,MAAM,CAClC;CACA,MAAM,SAAS,YAAY,QAAQ,CAAC,CAAC;CACrC,MAAM,aAAa,OAAO,QAAQ,IAAI;EAAE;EAAK;EAAQ;CAAO,CAAC;CAC7D,MAAM,GAAG,+CAA+C;CACxD,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,YAAY,EAAE,OAAO,CAAC,KAAM,IAAI,GAAG;AAChF;AAEA,eAAe,oBAAoB,GAA+B;CAChE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,UAAU,MAAM,IAAI,aACxB,SAAS,CAAC,CAAC,IACX,KAAA,GACA,eAAe,SAAS,CAAC,CAAC,MAAM,CAClC,CAAC,CAAC,IAAI,QAAQ,IAAI,EAAE,IAAI,MAAM,WAAW,KAAK,EAAE;CAChD,IAAI,CAAC,SACH,SAAS,mBAAmB;CAE9B,MAAM,IAAI,aAAa,SAAS,CAAC,CAAC,IAAI,KAAA,GAAW,eAAe,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAClF,QAAQ,IACR,QAAQ,EACV;CACA,MAAM,GAAG,iBAAiB;CAC1B,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,mBAAmB;AACpE"}
+{"version":3,"file":"settings-webhooks.mjs","names":[],"sources":["../../src/routers/settings-webhooks.ts"],"sourcesContent":["import { WebhookModel } from \"@storyshelf/core/models\";\nimport type { Project } from \"@storyshelf/core/schema\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { flash } from \"./flash.ts\";\nimport { notFound } from \"./helpers.ts\";\nimport { hxRedirect } from \"./htmx.ts\";\nimport { webhookModel } from \"./scoped-models.ts\";\nimport { asString, findProject, renderSettingsPage } from \"./settings.handlers.ts\";\n/** Webhook settings (create with one-time secret display, delete). */\nexport function registerWebhookSettings(app: ShelfRouter): void {\n  app.get(\"/projects/:slug/settings/webhooks\", async (c) =>\n    c.html(await renderSettingsPage(c, \"webhooks\")),\n  );\n  app.post(\"/projects/:slug/settings/webhooks\", handleCreateWebhook);\n  app.post(\"/projects/:slug/settings/webhooks/:webhookId/delete\", handleDeleteWebhook);\n}\n\n/** Parse the comma-separated events field. */\nfunction parseWebhookEvents(form: FormData): string[] | undefined {\n  const eventsRaw = asString(form.get(\"events\"));\n  if (!eventsRaw) {\n    return undefined;\n  }\n  return eventsRaw\n    .split(\",\")\n    .map((event) => event.trim())\n    .filter((event) => event.length > 0);\n}\n\nasync function handleCreateWebhook(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const form = await c.req.formData();\n  const url = asString(form.get(\"url\"));\n  const urlError = WebhookModel.urlError(url);\n  if (urlError || !url) {\n    return c.html(\n      (await renderSettingsPage(c, \"webhooks\", { errors: { url: urlError ?? \"Invalid URL\" } })) ??\n        \"\",\n      400,\n    );\n  }\n  return await createWebhookRecord(c, project, url, parseWebhookEvents(form));\n}\n\nasync function createWebhookRecord(\n  c: Context,\n  project: Project,\n  url: string,\n  events: string[] | undefined,\n): Promise<Response> {\n  const { secret } = await webhookModel().issue(project.id, { url, events });\n  flash(c, \"Webhook created — copy the signing secret now\");\n  return c.html((await renderSettingsPage(c, \"webhooks\", { secret })) ?? \"\", 201);\n}\n\nasync function handleDeleteWebhook(c: Context): Promise<Response> {\n  const project = await findProject(c.req.param(\"slug\") ?? \"\");\n  const webhook = await webhookModel().get(project.id, c.req.param(\"webhookId\") ?? \"\");\n  if (!webhook) {\n    notFound(\"Webhook not found\");\n  }\n  await webhookModel().remove(project.id, webhook.id);\n  flash(c, \"Webhook deleted\");\n  return hxRedirect(c, `/projects/${project.slug}/settings/webhooks`);\n}\n"],"mappings":";;;;;;;;;;;AAUA,SAAgB,wBAAwB,KAAwB;CAC9D,IAAI,IAAI,qCAAqC,OAAO,MAClD,EAAE,KAAK,MAAM,mBAAmB,GAAG,UAAU,CAAC,CAChD;CACA,IAAI,KAAK,qCAAqC,mBAAmB;CACjE,IAAI,KAAK,uDAAuD,mBAAmB;AACrF;;AAGA,SAAS,mBAAmB,MAAsC;CAChE,MAAM,YAAY,SAAS,KAAK,IAAI,QAAQ,CAAC;CAC7C,IAAI,CAAC,WACH;CAEF,OAAO,UACJ,MAAM,GAAG,CAAC,CACV,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,QAAQ,UAAU,MAAM,SAAS,CAAC;AACvC;AAEA,eAAe,oBAAoB,GAA+B;CAChE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;CAClC,MAAM,MAAM,SAAS,KAAK,IAAI,KAAK,CAAC;CACpC,MAAM,WAAW,aAAa,SAAS,GAAG;CAC1C,IAAI,YAAY,CAAC,KACf,OAAO,EAAE,KACN,MAAM,mBAAmB,GAAG,YAAY,EAAE,QAAQ,EAAE,KAAK,YAAY,cAAc,EAAE,CAAC,KACrF,IACF,GACF;CAEF,OAAO,MAAM,oBAAoB,GAAG,SAAS,KAAK,mBAAmB,IAAI,CAAC;AAC5E;AAEA,eAAe,oBACb,GACA,SACA,KACA,QACmB;CACnB,MAAM,EAAE,WAAW,MAAM,aAAa,CAAC,CAAC,MAAM,QAAQ,IAAI;EAAE;EAAK;CAAO,CAAC;CACzE,MAAM,GAAG,+CAA+C;CACxD,OAAO,EAAE,KAAM,MAAM,mBAAmB,GAAG,YAAY,EAAE,OAAO,CAAC,KAAM,IAAI,GAAG;AAChF;AAEA,eAAe,oBAAoB,GAA+B;CAChE,MAAM,UAAU,MAAM,YAAY,EAAE,IAAI,MAAM,MAAM,KAAK,EAAE;CAC3D,MAAM,UAAU,MAAM,aAAa,CAAC,CAAC,IAAI,QAAQ,IAAI,EAAE,IAAI,MAAM,WAAW,KAAK,EAAE;CACnF,IAAI,CAAC,SACH,SAAS,mBAAmB;CAE9B,MAAM,aAAa,CAAC,CAAC,OAAO,QAAQ,IAAI,QAAQ,EAAE;CAClD,MAAM,GAAG,iBAAiB;CAC1B,OAAO,WAAW,GAAG,aAAa,QAAQ,KAAK,mBAAmB;AACpE"}