@storyshelf/app 0.6.2 → 0.7.0

package/dist/index.d.mts

@@ -2,7 +2,7 @@ import __tsdown_shims_path from 'node:path';
 import __tsdown_shims_url from 'node:url';
 import { ShelfApp, ShelfContext, ShelfLifecycle, ShelfRouter } from "./app-types.mjs";
 import { createAuthSystemHook } from "./notify.mjs";
-import { BrandTheme, NotificationsConfig, ShelfConfig, ShelfOptions, ShelfOptions as ShelfOptions$1, UIConfig } from "@storyshelf/core/config";
+import { BrandTheme, NotificationsConfig, ShelfCompareOptions, ShelfConfig, ShelfNotificationsOptions, ShelfOptions, ShelfOptions as ShelfOptions$1, ShelfTestingOptions, UIConfig } from "@storyshelf/core/config";
 import { Logger, LoggerOptions, PinoTransport, createShelfLogger } from "@storyshelf/core/logger";
 //#region src/index.d.ts
 /**
@@ -12,7 +12,7 @@ import { Logger, LoggerOptions, PinoTransport, createShelfLogger } from "@storys
  * stays synchronous). Await `app.lifecycle.setup()` before serving for
  * fail-fast startup, or let the first request gate on settlement.
  */
-declare function createShelfApp(options: ShelfOptions$1): ShelfApp;
+declare function createShelfApp(rawOptions: ShelfOptions$1): ShelfApp;
 //#endregion
-export { type BrandTheme, type Logger, type LoggerOptions, type NotificationsConfig, type PinoTransport, type ShelfApp, type ShelfConfig, type ShelfContext, type ShelfLifecycle, type ShelfOptions, type ShelfRouter, type UIConfig, createAuthSystemHook, createShelfApp, createShelfLogger };
+export { type BrandTheme, type Logger, type LoggerOptions, type NotificationsConfig, type PinoTransport, type ShelfApp, type ShelfCompareOptions, type ShelfConfig, type ShelfContext, type ShelfLifecycle, type ShelfNotificationsOptions, type ShelfOptions, type ShelfRouter, type ShelfTestingOptions, type UIConfig, createAuthSystemHook, createShelfApp, createShelfLogger };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -2,49 +2,67 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { createAuthSystemHook } from "./notify.mjs";
-import { setupCaptureQueue } from "./capture-setup.mjs";
-import { attachLifecycle, trackBackground } from "./lifecycle.mjs";
-import { checkCredentialsAfterSetup } from "./credentials.mjs";
-import { rateLimit, rateLimitKey } from "./middleware/rate-limit.mjs";
+import { attachLifecycle } from "./lifecycle.mjs";
+import { runBootTasks } from "./boot-tasks.mjs";
+import { setupJobs } from "./jobs-setup.mjs";
+import { createRateLimiter, rateLimitKey } from "./middleware/rate-limit.mjs";
 import { csrf } from "./middleware/csrf.mjs";
 import { requestLogging } from "./middleware/request-log.mjs";
 import { storeScope } from "./middleware/store-scope.mjs";
 import { authGate, resolveRequestUser } from "./middleware/auth-gate.mjs";
+import { requireTesting } from "./middleware/require-testing.mjs";
+import { requireReview } from "./middleware/require-review.mjs";
 import { serverTiming } from "./middleware/server-timing.mjs";
 import { setupGate } from "./middleware/setup-gate.mjs";
 import { registerAdminPages } from "./routers/admin-pages.mjs";
+import { registerPublicOriginRoutes } from "./routers/admin-public-origin.mjs";
 import { registerAdmin } from "./routers/admin.mjs";
 import { registerAssets } from "./routers/assets.mjs";
 import { registerEngineAuth } from "./routers/auth.mjs";
+import { registerBaselines } from "./routers/baselines.mjs";
 import { registerBuilds } from "./routers/builds.mjs";
+import { registerConnections } from "./routers/connections.mjs";
 import { registerHealth } from "./routers/health.mjs";
+import { registerInsightFragments } from "./routers/insights-ui.mjs";
+import { registerInsights } from "./routers/insights.mjs";
 import { registerLabels } from "./routers/labels.mjs";
+import { registerLinks } from "./routers/links.mjs";
 import { registerMedia } from "./routers/media.mjs";
 import { registerMembers } from "./routers/members.mjs";
 import { registerNotificationChannels, registerSystemChannels } from "./routers/notification-channels.mjs";
 import { registerNotificationSubscriptions } from "./routers/notification-subscriptions.mjs";
+import { registerPreviewToken } from "./routers/preview-token.mjs";
 import { registerProfile } from "./routers/profile.mjs";
 import { registerProjects } from "./routers/projects.mjs";
-import { registerStatusConfigs } from "./routers/status-configs.mjs";
+import { registerReviewForms } from "./routers/review-forms.mjs";
+import { registerSignedStorybook } from "./routers/signed-storybook.mjs";
 import { registerStorybook } from "./routers/storybook.mjs";
 import { registerTokens } from "./routers/tokens.mjs";
 import { registerUiPages } from "./routers/ui.mjs";
 import { registerWebhooks } from "./routers/webhooks.mjs";
 import { registerWellKnown } from "./routers/well-known.mjs";
+import { markRouteClasses } from "./routes/openapi-classes.mjs";
 import { resolveRuntime } from "./runtime.mjs";
 import { swaggerUI } from "@hono/swagger-ui";
 import { OpenAPIHono } from "@hono/zod-openapi";
-import { AdapterLifecycleError, validateBootAssembly } from "@storyshelf/core/adapter/setup";
+import { AdapterLifecycleError, adapterSourcesOf, validateBootAssembly } from "@storyshelf/core/adapter/setup";
+import { assertServerless, resolveShelfOptions } from "@storyshelf/core/config";
+import { configureImages } from "@storyshelf/core/diff";
+import { STORYBOOK_TOKEN_PREFIX } from "@storyshelf/core/utils";
 import { createHttpMiddleware, createInstrumentedDatabase, createInstrumentedStorage } from "@storyshelf/observability";
 import { requestId } from "hono/request-id";
 import { createShelfLogger } from "@storyshelf/core/logger";
 //#region src/index.tsx
 /**
+* StoryShelf app: compose database, storage, capture, auth, and notifier
+* adapters into a complete self-hosted visual-testing Hono app.
+*/
+/**
 * Fail fast on third-party adapters that cannot satisfy their slot.
 * Throws before any route or lifecycle hook runs.
 */
 function throwOnInvalidAdapters(options) {
-	const invalid = validateBootAssembly(options);
+	const invalid = validateBootAssembly(adapterSourcesOf(options));
 	if (invalid.length > 0) throw new AdapterLifecycleError("setup", invalid);
 }
 /** Request/capture-path adapters with OTEL wrappers (lifecycle keeps raw ones). */
@@ -55,23 +73,25 @@ function instrumentedOptions(options) {
 		storage: createInstrumentedStorage(options.storage)
 	};
 }
-/** Once adapters are ready, requeue-once or fail builds a restart left `capturing`. */
-function recoverAfterSetup(cell, recoverStuck, logger) {
-	if (!recoverStuck) return;
-	trackBackground(cell, cell.ready.then(async (setup) => {
-		if (setup.ok) await recoverStuck();
-	}).catch((error) => {
-		logger.error({ err: error }, "stuck capture recovery failed");
-	}));
+/** Wire the job queue, its handlers and its consumer, and run the boot tasks that need them. */
+function wireQueues(scoped, runtime, cell) {
+	const jobs = setupJobs(scoped, runtime);
+	cell.consumer = jobs.consumer;
+	runBootTasks(cell, scoped, runtime, jobs.buildState);
+	return jobs;
 }
-/** Boot-time checks that run once adapters are ready: stuck-capture recovery and credential state. */
-function runAfterSetup(cell, scoped, runtime, recoverStuck) {
-	recoverAfterSetup(cell, recoverStuck, runtime.logger);
-	checkCredentialsAfterSetup(cell, scoped.database, runtime.config, runtime.logger);
+/**
+* Serverless check (ADR 0006, decision 3): throws on AWS Lambda, warns on Vercel and Netlify. Only
+* an instance with `testing` needs a process that outlives the request.
+*/
+function warnOnServerless(options, logger) {
+	const warning = assertServerless(options.testing?.runner !== void 0);
+	if (warning) logger.warn(warning);
 }
 /** Attach lifecycle, queue, middleware, routes, and docs to the app. */
 function assembleApp(app, options, scoped) {
 	const runtime = resolveRuntime(options);
+	warnOnServerless(options, runtime.logger);
 	const cell = {
 		ready: Promise.resolve({
 			ok: true,
@@ -81,17 +101,15 @@ function assembleApp(app, options, scoped) {
 	};
 	attachLifecycle(app, options, runtime, cell);
 	if (runtime.config.serverTiming === true) app.use("*", serverTiming(true));
-	const { queue, enqueueCapture, recoverStuck } = setupCaptureQueue(scoped, runtime.config, runtime.gitHosts, runtime.logger);
-	runAfterSetup(cell, scoped, runtime, recoverStuck);
+	const queues = wireQueues(scoped, runtime, cell);
 	wireMiddleware(app, {
 		...runtime,
-		queue,
-		enqueueCapture,
+		...queues,
 		options: scoped,
 		getReady: async () => await cell.ready
 	});
 	registerAllRoutes(app, options, {
-		sources: options,
+		sources: adapterSourcesOf(options),
 		getSettled: () => cell.settled,
 		bootTimeMs: Date.now(),
 		version: packageVersion()
@@ -105,7 +123,12 @@ function assembleApp(app, options, scoped) {
 * stays synchronous). Await `app.lifecycle.setup()` before serving for
 * fail-fast startup, or let the first request gate on settlement.
 */
-function createShelfApp(options) {
+function createShelfApp(rawOptions) {
+	const options = resolveShelfOptions(rawOptions);
+	configureImages({
+		engine: options.testing?.images?.engine,
+		threads: options.testing?.compare?.threads
+	});
 	throwOnInvalidAdapters(options);
 	const app = new OpenAPIHono();
 	assembleApp(app, options, instrumentedOptions(options));
@@ -117,8 +140,16 @@ const CSRF_PATHS = [
 	"/auth/invites/*",
 	"/projects/:slug/settings/*",
 	"/profile/*",
+	"/connections/*",
 	"/profile",
-	"/admin/credentials/*"
+	"/admin/credentials/*",
+	"/admin/public-origin",
+	"/admin/public-origin/*",
+	"/projects/:slug/builds/:buildId/insights/generate",
+	"/projects/:slug/builds/:buildId/comments",
+	"/projects/:slug/builds/:buildId/comments/*",
+	"/projects/:slug/builds/:buildId/reviews",
+	"/projects/:slug/insights/health/generate"
 ];
 /** Attach global middleware: ids, logging, init gate, limits, store scope, auth gate. */
 function wireMiddleware(app, wiring) {
@@ -130,64 +161,76 @@ function wireMiddleware(app, wiring) {
 	}));
 	app.use("*", requestLogging(logger));
 	app.use("*", setupGate(getReady));
-	mountGuards(app, config);
-	mountNotificationLimits(app);
+	app.use("*", requireTesting(wiring.options.testing !== void 0));
+	mountGuards(app, config, wiring.options);
 	mountStoreScope(app, wiring);
 	app.use("*", authGate());
+	app.use("*", requireReview());
 }
-/** Mount rate limits and CSRF guards (abuse floors, not strict protection). */
-function mountGuards(app, config) {
-	app.use("/api/v1/*", rateLimit({
-		windowMs: 6e4,
+const MINUTE = 6e4;
+/** Per-path limits; `bucket` gives a route family its own counter (default: shared `api:`). */
+const RATE_LIMITS = [
+	{
+		paths: ["/api/v1/*"],
 		max: 100
-	}));
-	app.use("/api/v1/tokens/*", rateLimit({
-		windowMs: 6e4,
+	},
+	{
+		paths: ["/api/v1/tokens/*"],
 		max: 10
-	}));
-	app.use("/api/v1/webhooks/*", rateLimit({
-		windowMs: 6e4,
+	},
+	{
+		paths: ["/api/v1/webhooks/*"],
 		max: 20
-	}));
-	app.use("/auth/*", rateLimit({
-		windowMs: 6e4,
+	},
+	{
+		paths: ["/auth/*"],
 		max: 100,
-		keyGenerator: rateLimitKey("auth")
-	}));
-	app.use("/api/auth/*", rateLimit({
-		windowMs: 6e4,
+		bucket: "auth"
+	},
+	{
+		paths: ["/api/auth/*"],
 		max: 300,
-		keyGenerator: rateLimitKey("engine")
-	}));
-	for (const path of CSRF_PATHS) app.use(path, csrf(config.secret));
-}
-/** Abuse floors for notification management endpoints (own counters). */
-function mountNotificationLimits(app) {
-	const channel = {
-		windowMs: 6e4,
+		bucket: "engine"
+	},
+	{
+		paths: ["/api/v1/projects/:slug/notification-channels", "/api/v1/projects/:slug/notification-channels/:channelId"],
 		max: 20,
-		keyGenerator: rateLimitKey("notify-channels")
-	};
-	const admin = {
-		windowMs: 6e4,
-		max: 20,
-		keyGenerator: rateLimitKey("notify-admin")
-	};
-	const subscription = {
-		windowMs: 6e4,
+		bucket: "notify-channels"
+	},
+	{
+		paths: ["/api/v1/projects/:slug/notifications", "/api/v1/projects/:slug/notifications/me"],
 		max: 30,
-		keyGenerator: rateLimitKey("notify-subs")
+		bucket: "notify-subs"
+	},
+	{
+		paths: ["/api/v1/admin/notification-channels", "/api/v1/admin/notification-channels/:channelId"],
+		max: 20,
+		bucket: "notify-admin"
+	}
+];
+/** Requests per minute per client IP on the signed Storybook URL route (`testing.storybookUrlRateLimit`). */
+const DEFAULT_STORYBOOK_URL_RATE_LIMIT = 6e3;
+/** Mount rate limits and CSRF guards (abuse floors, not strict protection). */
+function mountGuards(app, config, options) {
+	const rateLimit = createRateLimiter();
+	const signedUrls = {
+		paths: [`${STORYBOOK_TOKEN_PREFIX}*`],
+		max: options.testing?.storybookUrlRateLimit ?? DEFAULT_STORYBOOK_URL_RATE_LIMIT,
+		bucket: "signed-storybook"
 	};
-	app.use("/api/v1/projects/:slug/notification-channels", rateLimit(channel));
-	app.use("/api/v1/projects/:slug/notification-channels/:channelId", rateLimit(channel));
-	app.use("/api/v1/projects/:slug/notifications", rateLimit(subscription));
-	app.use("/api/v1/projects/:slug/notifications/me", rateLimit(subscription));
-	app.use("/api/v1/admin/notification-channels", rateLimit(admin));
-	app.use("/api/v1/admin/notification-channels/:channelId", rateLimit(admin));
+	for (const { paths, max, bucket } of [...RATE_LIMITS, signedUrls]) {
+		const keyGenerator = bucket ? rateLimitKey(bucket) : void 0;
+		for (const path of paths) app.use(path, rateLimit({
+			windowMs: MINUTE,
+			max,
+			keyGenerator
+		}));
+	}
+	for (const path of CSRF_PATHS) app.use(path, csrf(config.secret));
 }
 /** Mount the request-scoped store (db/storage/config/user/adapters). */
 function mountStoreScope(app, wiring) {
-	const { options, config, ui, logger, authEnabled, enqueueCapture, queue, gitHosts, notifiers } = wiring;
+	const { options, config, ui, logger, authEnabled, enqueueCapture, captureQueue, capturesHere, publish, cancelBuildJobs, buildState, design, notifiers, publicOrigin } = wiring;
 	app.use("*", storeScope({
 		db: options.database,
 		storage: options.storage,
@@ -195,10 +238,20 @@ function mountStoreScope(app, wiring) {
 		ui,
 		logger,
 		authEnabled,
+		testing: options.testing !== void 0,
 		enqueueCapture,
-		captureQueue: queue,
-		gitHosts,
+		captureQueue,
+		capturesHere,
+		publish,
+		cancelBuildJobs,
+		buildState,
+		captureConcurrency: options.testing?.concurrency,
+		runner: options.testing?.runner,
+		publicOrigin,
+		design,
 		notifiers,
+		notificationsConfig: options.notifications?.config,
+		ai: options.ai,
 		resolveUser: async (c) => await resolveRequestUser(c, options.auth)
 	}));
 }
@@ -206,7 +259,6 @@ function mountStoreScope(app, wiring) {
 function registerApiRoutes(app, health) {
 	registerProjectRoutes(app);
 	registerNotificationRoutes(app);
-	registerStatusConfigs(app);
 	registerHealth(app, health);
 	registerAdmin(app);
 }
@@ -215,10 +267,13 @@ function registerProjectRoutes(app) {
 	registerProjects(app);
 	registerBuilds(app);
 	registerLabels(app);
+	registerLinks(app);
+	registerBaselines(app);
 	registerMedia(app);
 	registerMembers(app);
 	registerTokens(app);
 	registerWebhooks(app);
+	registerInsights(app);
 }
 /** Register the notification channel and subscription routers. */
 function registerNotificationRoutes(app) {
@@ -232,77 +287,100 @@ function registerAuthFlow(app, options) {
 	registerEngineAuth(app, options.auth);
 	registerWellKnown(app, options.auth);
 	registerProfile(app, options.auth);
+	registerConnections(app);
 }
 /** Register HTML pages, assets, and the optional auth flow. */
 function registerPageRoutes(app, options, health) {
 	registerAuthFlow(app, options);
 	registerAssets(app);
 	registerStorybook(app);
+	registerSignedStorybook(app);
+	registerPreviewToken(app);
 	registerAdminPages(app, health, options.auth);
+	registerPublicOriginRoutes(app);
 	registerUiPages(app);
+	registerReviewForms(app);
+	registerInsightFragments(app);
 }
 /** Register every API router, page set, and optional auth flow. */
 function registerAllRoutes(app, options, health) {
 	registerApiRoutes(app, health);
 	registerPageRoutes(app, options, health);
 }
+/** The OpenAPI document's info and tag catalog. */
+const OPENAPI_CONFIG = {
+	openapi: "3.0.0",
+	info: {
+		title: "StoryShelf API",
+		description: "REST API for the StoryShelf visual testing platform. JSON endpoints live under /api/v1; HTML pages are served at /.",
+		version: "1.0.0"
+	},
+	tags: [
+		{
+			name: "Projects",
+			description: "Create and manage projects (one project is one Storybook)."
+		},
+		{
+			name: "Builds",
+			description: "Upload Storybook builds, inspect capture attempts, retry, and delete."
+		},
+		{
+			name: "Review",
+			description: "Approve or reject snapshots, bulk actions, re-diff, build verdicts, the build changeset and review comments."
+		},
+		{
+			name: "Labels",
+			description: "Typed build labels and their link templates."
+		},
+		{
+			name: "Links",
+			description: "Link packages to the projects that publish them and see where stories use them."
+		},
+		{
+			name: "Baselines",
+			description: "Export and import baselines as a portable zip."
+		},
+		{
+			name: "Members",
+			description: "Project members, roles, and identity-provider group mappings."
+		},
+		{
+			name: "Insights",
+			description: "AI build triage and project health (advisory only; needs AI configured)."
+		},
+		{
+			name: "Tokens",
+			description: "API tokens used by the CLI and CI."
+		},
+		{
+			name: "Webhooks",
+			description: "Signed webhook deliveries for build events."
+		},
+		{
+			name: "Notifications",
+			description: "Email, chat and git notification channels and subscriptions."
+		},
+		{
+			name: "Admin",
+			description: "Site-wide administration."
+		}
+	]
+};
 /** Register the OpenAPI document and interactive docs page. */
 function registerDocs(app) {
-	app.doc("/api/v1/openapi.json", {
-		openapi: "3.0.0",
-		info: {
-			title: "StoryShelf API",
-			description: "REST API for the StoryShelf visual testing platform. JSON endpoints live under /api/v1; HTML pages are served at /.",
-			version: "1.0.0"
-		},
-		tags: [
-			{
-				name: "Projects",
-				description: "Create and manage projects (one project is one Storybook)."
-			},
-			{
-				name: "Builds",
-				description: "Upload Storybook builds, inspect capture attempts, retry, and delete."
-			},
-			{
-				name: "Review",
-				description: "Approve or reject snapshots, bulk actions, re-diff, and review comments."
-			},
-			{
-				name: "Labels",
-				description: "Typed build labels and their link templates."
-			},
-			{
-				name: "Members",
-				description: "Project members, roles, and identity-provider group mappings."
-			},
-			{
-				name: "Tokens",
-				description: "API tokens used by the CLI and CI."
-			},
-			{
-				name: "Webhooks",
-				description: "Signed webhook deliveries for build events."
-			},
-			{
-				name: "Notifications",
-				description: "Email and chat notification channels and subscriptions."
-			},
-			{
-				name: "Git status",
-				description: "Commit-status integrations for GitHub and GitLab."
-			},
-			{
-				name: "Admin",
-				description: "Site-wide administration."
-			}
-		]
-	});
+	app.get("/api/v1/openapi.json", (c) => c.json(markRouteClasses(app.getOpenAPIDocument({
+		...OPENAPI_CONFIG,
+		tags: [...OPENAPI_CONFIG.tags]
+	}))));
 	app.get("/api/v1/docs", swaggerUI({ url: "/api/v1/openapi.json" }));
 }
-/** Package version injected at build via __PKG_VERSION__. */
+/**
+* Package version injected at build via the `__PKG_VERSION__` define. Read as a bare identifier:
+* bundler defines replace identifiers, not `globalThis` property reads. Undefined when running
+* from source (dev server, tests).
+*/
 function packageVersion() {
-	return globalThis.__PKG_VERSION__ ?? "0.0.0";
+	return "0.7.0";
 }
 //#endregion
 export { createAuthSystemHook, createShelfApp, createShelfLogger };

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.tsx"],"sourcesContent":["import { swaggerUI } from \"@hono/swagger-ui\";\nimport { OpenAPIHono } from \"@hono/zod-openapi\";\nimport { AdapterLifecycleError, validateBootAssembly } from \"@storyshelf/core/adapter/setup\";\nimport type { ShelfConfig, ShelfOptions } from \"@storyshelf/core/config\";\n/**\n * StoryShelf app: compose database, storage, capture, auth, and git-host\n * adapters into a complete self-hosted visual-testing Hono app.\n */\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport {\n  createHttpMiddleware,\n  createInstrumentedDatabase,\n  createInstrumentedStorage,\n} from \"@storyshelf/observability\";\nimport { requestId } from \"hono/request-id\";\nimport type { ShelfApp, ShelfContext, ShelfRouter } from \"./app-types.ts\";\nimport { setupCaptureQueue } from \"./capture-setup.ts\";\nimport { checkCredentialsAfterSetup } from \"./credentials.ts\";\nimport { attachLifecycle, trackBackground, type LifecycleCell } from \"./lifecycle.ts\";\nimport {\n  authGate,\n  csrf,\n  rateLimit,\n  rateLimitKey,\n  requestLogging,\n  resolveRequestUser,\n  storeScope,\n} from \"./middleware/index.ts\";\nimport { serverTiming } from \"./middleware/server-timing.ts\";\nimport { setupGate, type MiddlewareWiring } from \"./middleware/setup-gate.ts\";\nimport { registerAdminPages } from \"./routers/admin-pages.ts\";\nimport { registerAdmin } from \"./routers/admin.ts\";\nimport { registerAssets } from \"./routers/assets.ts\";\nimport { registerEngineAuth } from \"./routers/auth.ts\";\nimport { registerBuilds } from \"./routers/builds.ts\";\nimport { registerHealth, type HealthDeps } from \"./routers/health.ts\";\nimport { registerLabels } from \"./routers/labels.ts\";\nimport { registerMedia } from \"./routers/media.ts\";\nimport { registerMembers } from \"./routers/members.ts\";\nimport {\n  registerNotificationChannels,\n  registerSystemChannels,\n} from \"./routers/notification-channels.ts\";\nimport { registerNotificationSubscriptions } from \"./routers/notification-subscriptions.ts\";\nimport { registerProfile } from \"./routers/profile.ts\";\nimport { registerProjects } from \"./routers/projects.ts\";\nimport { registerStatusConfigs } from \"./routers/status-configs.ts\";\nimport { registerStorybook } from \"./routers/storybook.ts\";\nimport { registerTokens } from \"./routers/tokens.ts\";\nimport { registerUiPages } from \"./routers/ui.ts\";\nimport { registerWebhooks } from \"./routers/webhooks.ts\";\nimport { registerWellKnown } from \"./routers/well-known.ts\";\nimport { resolveRuntime } from \"./runtime.ts\";\n\n/**\n * Fail fast on third-party adapters that cannot satisfy their slot.\n * Throws before any route or lifecycle hook runs.\n */\nfunction throwOnInvalidAdapters(options: ShelfOptions): void {\n  const invalid = validateBootAssembly(options);\n  if (invalid.length > 0) {\n    throw new AdapterLifecycleError(\"setup\", invalid);\n  }\n}\n\n/** Request/capture-path adapters with OTEL wrappers (lifecycle keeps raw ones). */\nfunction instrumentedOptions(options: ShelfOptions): ShelfOptions {\n  return {\n    ...options,\n    database: createInstrumentedDatabase(options.database),\n    storage: createInstrumentedStorage(options.storage),\n  };\n}\n\n/** Once adapters are ready, requeue-once or fail builds a restart left `capturing`. */\nfunction recoverAfterSetup(\n  cell: LifecycleCell,\n  recoverStuck: (() => Promise<unknown>) | undefined,\n  logger: Logger,\n): void {\n  if (!recoverStuck) {\n    return;\n  }\n  trackBackground(\n    cell,\n    cell.ready\n      .then(async (setup) => {\n        if (setup.ok) {\n          await recoverStuck();\n        }\n      })\n      .catch((error: unknown) => {\n        logger.error({ err: error }, \"stuck capture recovery failed\");\n      }),\n  );\n}\n\n/** Boot-time checks that run once adapters are ready: stuck-capture recovery and credential state. */\nfunction runAfterSetup(\n  cell: LifecycleCell,\n  scoped: ShelfOptions,\n  runtime: ReturnType<typeof resolveRuntime>,\n  recoverStuck: (() => Promise<unknown>) | undefined,\n): void {\n  recoverAfterSetup(cell, recoverStuck, runtime.logger);\n  checkCredentialsAfterSetup(cell, scoped.database, runtime.config, runtime.logger);\n}\n\n/** Attach lifecycle, queue, middleware, routes, and docs to the app. */\nfunction assembleApp(app: ShelfApp, options: ShelfOptions, scoped: ShelfOptions): void {\n  const runtime = resolveRuntime(options);\n  const cell: LifecycleCell = { ready: Promise.resolve({ ok: true, failures: [] }), settled: null };\n  attachLifecycle(app, options, runtime, cell);\n  if (runtime.config.serverTiming === true) {\n    app.use(\"*\", serverTiming(true));\n  }\n  const { queue, enqueueCapture, recoverStuck } = setupCaptureQueue(\n    scoped,\n    runtime.config,\n    runtime.gitHosts,\n    runtime.logger,\n  );\n  runAfterSetup(cell, scoped, runtime, recoverStuck);\n  wireMiddleware(app, {\n    ...runtime,\n    queue,\n    enqueueCapture,\n    options: scoped,\n    getReady: async () => await cell.ready,\n  });\n  registerAllRoutes(app, options, {\n    sources: options,\n    getSettled: () => cell.settled,\n    bootTimeMs: Date.now(),\n    version: packageVersion(),\n  });\n  registerDocs(app);\n}\n\n/**\n * Create the StoryShelf Hono app with all API routes and HTML pages.\n *\n * Adapter `init` hooks kick off eagerly in the background (the constructor\n * stays synchronous). Await `app.lifecycle.setup()` before serving for\n * fail-fast startup, or let the first request gate on settlement.\n */\nexport function createShelfApp(options: ShelfOptions): ShelfApp {\n  throwOnInvalidAdapters(options);\n  const app = new OpenAPIHono<{ Variables: ShelfContext }>() as ShelfApp;\n  assembleApp(app, options, instrumentedOptions(options));\n\n  return app;\n}\n\n/** Cookie-authenticated write paths guarded by CSRF tokens. */\nconst CSRF_PATHS = [\n  \"/auth/logout\",\n  \"/auth/invites/*\",\n  \"/projects/:slug/settings/*\",\n  \"/profile/*\",\n  \"/profile\",\n  \"/admin/credentials/*\",\n] as const;\n\n/** Attach global middleware: ids, logging, init gate, limits, store scope, auth gate. */\nfunction wireMiddleware(app: ShelfRouter, wiring: MiddlewareWiring): void {\n  const { config, logger, getReady } = wiring;\n  app.use(\"*\", requestId());\n  // OTEL server spans (W3C extraction, route-template naming). Mounted right\n  // after requestId so `storyshelf.req_id` resolves; `enduser.id` resolves\n  // once storeScope runs downstream. Noop without an SDK.\n  app.use(\n    \"*\",\n    createHttpMiddleware({ serviceName: \"storyshelf\", serviceVersion: packageVersion() }),\n  );\n  // Structured request logging. Uses a Hono-native middleware rather than\n  // Pino-http, which expects a Node server response (`res.on`) incompatible\n  // With Hono's Web `Request`/`Response` model.\n  app.use(\"*\", requestLogging(logger));\n  app.use(\"*\", setupGate(getReady));\n  mountGuards(app, config);\n  mountNotificationLimits(app);\n  mountStoreScope(app, wiring);\n  app.use(\"*\", authGate());\n}\n\n/** Mount rate limits and CSRF guards (abuse floors, not strict protection). */\nfunction mountGuards(app: ShelfRouter, config: ShelfConfig): void {\n  app.use(\"/api/v1/*\", rateLimit({ windowMs: 60_000, max: 100 }));\n  app.use(\"/api/v1/tokens/*\", rateLimit({ windowMs: 60_000, max: 10 }));\n  app.use(\"/api/v1/webhooks/*\", rateLimit({ windowMs: 60_000, max: 20 }));\n  // Auth endpoints ride their own buckets (the shared store keys by IP, so\n  // prefix the key: login floods must not eat the API budget or vice versa).\n  app.use(\"/auth/*\", rateLimit({ windowMs: 60_000, max: 100, keyGenerator: rateLimitKey(\"auth\") }));\n  app.use(\n    \"/api/auth/*\",\n    rateLimit({ windowMs: 60_000, max: 300, keyGenerator: rateLimitKey(\"engine\") }),\n  );\n  for (const path of CSRF_PATHS) {\n    app.use(path, csrf(config.secret));\n  }\n}\n\n/** Abuse floors for notification management endpoints (own counters). */\nfunction mountNotificationLimits(app: ShelfRouter): void {\n  const channel = { windowMs: 60_000, max: 20, keyGenerator: rateLimitKey(\"notify-channels\") };\n  const admin = { windowMs: 60_000, max: 20, keyGenerator: rateLimitKey(\"notify-admin\") };\n  const subscription = { windowMs: 60_000, max: 30, keyGenerator: rateLimitKey(\"notify-subs\") };\n  app.use(\"/api/v1/projects/:slug/notification-channels\", rateLimit(channel));\n  app.use(\"/api/v1/projects/:slug/notification-channels/:channelId\", rateLimit(channel));\n  app.use(\"/api/v1/projects/:slug/notifications\", rateLimit(subscription));\n  app.use(\"/api/v1/projects/:slug/notifications/me\", rateLimit(subscription));\n  app.use(\"/api/v1/admin/notification-channels\", rateLimit(admin));\n  app.use(\"/api/v1/admin/notification-channels/:channelId\", rateLimit(admin));\n}\n\n/** Mount the request-scoped store (db/storage/config/user/adapters). */\nfunction mountStoreScope(app: ShelfRouter, wiring: MiddlewareWiring): void {\n  const { options, config, ui, logger, authEnabled, enqueueCapture, queue, gitHosts, notifiers } =\n    wiring;\n  app.use(\n    \"*\",\n    storeScope({\n      db: options.database,\n      storage: options.storage,\n      config,\n      ui,\n      logger,\n      authEnabled,\n      enqueueCapture,\n      captureQueue: queue,\n      gitHosts,\n      notifiers,\n      resolveUser: async (c) => await resolveRequestUser(c, options.auth),\n    }),\n  );\n}\n\n/** Register every JSON API router. */\nfunction registerApiRoutes(app: ShelfRouter, health: HealthDeps): void {\n  registerProjectRoutes(app);\n  registerNotificationRoutes(app);\n  registerStatusConfigs(app);\n  registerHealth(app, health);\n  registerAdmin(app);\n}\n\n/** Register the per-project resource routers. */\nfunction registerProjectRoutes(app: ShelfRouter): void {\n  registerProjects(app);\n  registerBuilds(app);\n  registerLabels(app);\n  registerMedia(app);\n  registerMembers(app);\n  registerTokens(app);\n  registerWebhooks(app);\n}\n\n/** Register the notification channel and subscription routers. */\nfunction registerNotificationRoutes(app: ShelfRouter): void {\n  registerNotificationChannels(app);\n  registerNotificationSubscriptions(app);\n  registerSystemChannels(app);\n}\n\n/** Register the auth flow: engine mount, relying-party documents, profile. */\nfunction registerAuthFlow(app: ShelfRouter, options: ShelfOptions): void {\n  // Auth-gated pages mount only with auth: authEnabled=false mounts zero\n  // auth routes. Static imports stay — true lazy loading would need an async\n  // createShelfApp, which the sync Hono assembly cannot do.\n  if (!options.auth) {\n    return;\n  }\n  registerEngineAuth(app, options.auth);\n  registerWellKnown(app, options.auth);\n  registerProfile(app, options.auth);\n}\n\n/** Register HTML pages, assets, and the optional auth flow. */\nfunction registerPageRoutes(app: ShelfRouter, options: ShelfOptions, health: HealthDeps): void {\n  registerAuthFlow(app, options);\n  registerAssets(app);\n  registerStorybook(app);\n  registerAdminPages(app, health, options.auth);\n  registerUiPages(app);\n}\n\n/** Register every API router, page set, and optional auth flow. */\nfunction registerAllRoutes(app: ShelfRouter, options: ShelfOptions, health: HealthDeps): void {\n  registerApiRoutes(app, health);\n  registerPageRoutes(app, options, health);\n}\n\n/** Register the OpenAPI document and interactive docs page. */\nfunction registerDocs(app: ShelfRouter): void {\n  app.doc(\"/api/v1/openapi.json\", {\n    openapi: \"3.0.0\",\n    info: {\n      title: \"StoryShelf API\",\n      description:\n        \"REST API for the StoryShelf visual testing platform. JSON endpoints live under /api/v1; HTML pages are served at /.\",\n      version: \"1.0.0\",\n    },\n    tags: [\n      {\n        name: \"Projects\",\n        description: \"Create and manage projects (one project is one Storybook).\",\n      },\n      {\n        name: \"Builds\",\n        description: \"Upload Storybook builds, inspect capture attempts, retry, and delete.\",\n      },\n      {\n        name: \"Review\",\n        description: \"Approve or reject snapshots, bulk actions, re-diff, and review comments.\",\n      },\n      { name: \"Labels\", description: \"Typed build labels and their link templates.\" },\n      {\n        name: \"Members\",\n        description: \"Project members, roles, and identity-provider group mappings.\",\n      },\n      { name: \"Tokens\", description: \"API tokens used by the CLI and CI.\" },\n      { name: \"Webhooks\", description: \"Signed webhook deliveries for build events.\" },\n      {\n        name: \"Notifications\",\n        description: \"Email and chat notification channels and subscriptions.\",\n      },\n      { name: \"Git status\", description: \"Commit-status integrations for GitHub and GitLab.\" },\n      { name: \"Admin\", description: \"Site-wide administration.\" },\n    ],\n  });\n  app.get(\"/api/v1/docs\", swaggerUI({ url: \"/api/v1/openapi.json\" }));\n}\n\n/** Package version injected at build via __PKG_VERSION__. */\nfunction packageVersion(): string {\n  return (globalThis as unknown as { __PKG_VERSION__?: string }).__PKG_VERSION__ ?? \"0.0.0\";\n}\n\n/**\n * Public surface: the app and its types only.\n *\n * `createShelfApp` plus the option/config types needed to call it. Adapter\n * interfaces live under `core/adapter/*`; runtime helpers under `core/logger`,\n * `core/capture`, `core/paths`, `core/urls`, `core/diff`; tables and row types\n * under `core/schema`. Importing the barrel must never pull Node-only modules\n * into edge bundles beyond what Hono itself needs.\n */\nexport { createAuthSystemHook } from \"./notify.ts\";\nexport type {\n  ShelfOptions,\n  ShelfConfig,\n  UIConfig,\n  BrandTheme,\n  NotificationsConfig,\n} from \"@storyshelf/core/config\";\nexport {\n  createShelfLogger,\n  type Logger,\n  type LoggerOptions,\n  type PinoTransport,\n} from \"@storyshelf/core/logger\";\nexport type { ShelfApp, ShelfContext, ShelfLifecycle, ShelfRouter } from \"./app-types.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,SAAS,uBAAuB,SAA6B;CAC3D,MAAM,UAAU,qBAAqB,OAAO;CAC5C,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,sBAAsB,SAAS,OAAO;AAEpD;;AAGA,SAAS,oBAAoB,SAAqC;CAChE,OAAO;EACL,GAAG;EACH,UAAU,2BAA2B,QAAQ,QAAQ;EACrD,SAAS,0BAA0B,QAAQ,OAAO;CACpD;AACF;;AAGA,SAAS,kBACP,MACA,cACA,QACM;CACN,IAAI,CAAC,cACH;CAEF,gBACE,MACA,KAAK,MACF,KAAK,OAAO,UAAU;EACrB,IAAI,MAAM,IACR,MAAM,aAAa;CAEvB,CAAC,CAAC,CACD,OAAO,UAAmB;EACzB,OAAO,MAAM,EAAE,KAAK,MAAM,GAAG,+BAA+B;CAC9D,CAAC,CACL;AACF;;AAGA,SAAS,cACP,MACA,QACA,SACA,cACM;CACN,kBAAkB,MAAM,cAAc,QAAQ,MAAM;CACpD,2BAA2B,MAAM,OAAO,UAAU,QAAQ,QAAQ,QAAQ,MAAM;AAClF;;AAGA,SAAS,YAAY,KAAe,SAAuB,QAA4B;CACrF,MAAM,UAAU,eAAe,OAAO;CACtC,MAAM,OAAsB;EAAE,OAAO,QAAQ,QAAQ;GAAE,IAAI;GAAM,UAAU,CAAC;EAAE,CAAC;EAAG,SAAS;CAAK;CAChG,gBAAgB,KAAK,SAAS,SAAS,IAAI;CAC3C,IAAI,QAAQ,OAAO,iBAAiB,MAClC,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC;CAEjC,MAAM,EAAE,OAAO,gBAAgB,iBAAiB,kBAC9C,QACA,QAAQ,QACR,QAAQ,UACR,QAAQ,MACV;CACA,cAAc,MAAM,QAAQ,SAAS,YAAY;CACjD,eAAe,KAAK;EAClB,GAAG;EACH;EACA;EACA,SAAS;EACT,UAAU,YAAY,MAAM,KAAK;CACnC,CAAC;CACD,kBAAkB,KAAK,SAAS;EAC9B,SAAS;EACT,kBAAkB,KAAK;EACvB,YAAY,KAAK,IAAI;EACrB,SAAS,eAAe;CAC1B,CAAC;CACD,aAAa,GAAG;AAClB;;;;;;;;AASA,SAAgB,eAAe,SAAiC;CAC9D,uBAAuB,OAAO;CAC9B,MAAM,MAAM,IAAI,YAAyC;CACzD,YAAY,KAAK,SAAS,oBAAoB,OAAO,CAAC;CAEtD,OAAO;AACT;;AAGA,MAAM,aAAa;CACjB;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,SAAS,eAAe,KAAkB,QAAgC;CACxE,MAAM,EAAE,QAAQ,QAAQ,aAAa;CACrC,IAAI,IAAI,KAAK,UAAU,CAAC;CAIxB,IAAI,IACF,KACA,qBAAqB;EAAE,aAAa;EAAc,gBAAgB,eAAe;CAAE,CAAC,CACtF;CAIA,IAAI,IAAI,KAAK,eAAe,MAAM,CAAC;CACnC,IAAI,IAAI,KAAK,UAAU,QAAQ,CAAC;CAChC,YAAY,KAAK,MAAM;CACvB,wBAAwB,GAAG;CAC3B,gBAAgB,KAAK,MAAM;CAC3B,IAAI,IAAI,KAAK,SAAS,CAAC;AACzB;;AAGA,SAAS,YAAY,KAAkB,QAA2B;CAChE,IAAI,IAAI,aAAa,UAAU;EAAE,UAAU;EAAQ,KAAK;CAAI,CAAC,CAAC;CAC9D,IAAI,IAAI,oBAAoB,UAAU;EAAE,UAAU;EAAQ,KAAK;CAAG,CAAC,CAAC;CACpE,IAAI,IAAI,sBAAsB,UAAU;EAAE,UAAU;EAAQ,KAAK;CAAG,CAAC,CAAC;CAGtE,IAAI,IAAI,WAAW,UAAU;EAAE,UAAU;EAAQ,KAAK;EAAK,cAAc,aAAa,MAAM;CAAE,CAAC,CAAC;CAChG,IAAI,IACF,eACA,UAAU;EAAE,UAAU;EAAQ,KAAK;EAAK,cAAc,aAAa,QAAQ;CAAE,CAAC,CAChF;CACA,KAAK,MAAM,QAAQ,YACjB,IAAI,IAAI,MAAM,KAAK,OAAO,MAAM,CAAC;AAErC;;AAGA,SAAS,wBAAwB,KAAwB;CACvD,MAAM,UAAU;EAAE,UAAU;EAAQ,KAAK;EAAI,cAAc,aAAa,iBAAiB;CAAE;CAC3F,MAAM,QAAQ;EAAE,UAAU;EAAQ,KAAK;EAAI,cAAc,aAAa,cAAc;CAAE;CACtF,MAAM,eAAe;EAAE,UAAU;EAAQ,KAAK;EAAI,cAAc,aAAa,aAAa;CAAE;CAC5F,IAAI,IAAI,gDAAgD,UAAU,OAAO,CAAC;CAC1E,IAAI,IAAI,2DAA2D,UAAU,OAAO,CAAC;CACrF,IAAI,IAAI,wCAAwC,UAAU,YAAY,CAAC;CACvE,IAAI,IAAI,2CAA2C,UAAU,YAAY,CAAC;CAC1E,IAAI,IAAI,uCAAuC,UAAU,KAAK,CAAC;CAC/D,IAAI,IAAI,kDAAkD,UAAU,KAAK,CAAC;AAC5E;;AAGA,SAAS,gBAAgB,KAAkB,QAAgC;CACzE,MAAM,EAAE,SAAS,QAAQ,IAAI,QAAQ,aAAa,gBAAgB,OAAO,UAAU,cACjF;CACF,IAAI,IACF,KACA,WAAW;EACT,IAAI,QAAQ;EACZ,SAAS,QAAQ;EACjB;EACA;EACA;EACA;EACA;EACA,cAAc;EACd;EACA;EACA,aAAa,OAAO,MAAM,MAAM,mBAAmB,GAAG,QAAQ,IAAI;CACpE,CAAC,CACH;AACF;;AAGA,SAAS,kBAAkB,KAAkB,QAA0B;CACrE,sBAAsB,GAAG;CACzB,2BAA2B,GAAG;CAC9B,sBAAsB,GAAG;CACzB,eAAe,KAAK,MAAM;CAC1B,cAAc,GAAG;AACnB;;AAGA,SAAS,sBAAsB,KAAwB;CACrD,iBAAiB,GAAG;CACpB,eAAe,GAAG;CAClB,eAAe,GAAG;CAClB,cAAc,GAAG;CACjB,gBAAgB,GAAG;CACnB,eAAe,GAAG;CAClB,iBAAiB,GAAG;AACtB;;AAGA,SAAS,2BAA2B,KAAwB;CAC1D,6BAA6B,GAAG;CAChC,kCAAkC,GAAG;CACrC,uBAAuB,GAAG;AAC5B;;AAGA,SAAS,iBAAiB,KAAkB,SAA6B;CAIvE,IAAI,CAAC,QAAQ,MACX;CAEF,mBAAmB,KAAK,QAAQ,IAAI;CACpC,kBAAkB,KAAK,QAAQ,IAAI;CACnC,gBAAgB,KAAK,QAAQ,IAAI;AACnC;;AAGA,SAAS,mBAAmB,KAAkB,SAAuB,QAA0B;CAC7F,iBAAiB,KAAK,OAAO;CAC7B,eAAe,GAAG;CAClB,kBAAkB,GAAG;CACrB,mBAAmB,KAAK,QAAQ,QAAQ,IAAI;CAC5C,gBAAgB,GAAG;AACrB;;AAGA,SAAS,kBAAkB,KAAkB,SAAuB,QAA0B;CAC5F,kBAAkB,KAAK,MAAM;CAC7B,mBAAmB,KAAK,SAAS,MAAM;AACzC;;AAGA,SAAS,aAAa,KAAwB;CAC5C,IAAI,IAAI,wBAAwB;EAC9B,SAAS;EACT,MAAM;GACJ,OAAO;GACP,aACE;GACF,SAAS;EACX;EACA,MAAM;GACJ;IACE,MAAM;IACN,aAAa;GACf;GACA;IACE,MAAM;IACN,aAAa;GACf;GACA;IACE,MAAM;IACN,aAAa;GACf;GACA;IAAE,MAAM;IAAU,aAAa;GAA+C;GAC9E;IACE,MAAM;IACN,aAAa;GACf;GACA;IAAE,MAAM;IAAU,aAAa;GAAqC;GACpE;IAAE,MAAM;IAAY,aAAa;GAA8C;GAC/E;IACE,MAAM;IACN,aAAa;GACf;GACA;IAAE,MAAM;IAAc,aAAa;GAAoD;GACvF;IAAE,MAAM;IAAS,aAAa;GAA4B;EAC5D;CACF,CAAC;CACD,IAAI,IAAI,gBAAgB,UAAU,EAAE,KAAK,uBAAuB,CAAC,CAAC;AACpE;;AAGA,SAAS,iBAAyB;CAChC,OAAQ,WAAuD,mBAAmB;AACpF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.tsx"],"sourcesContent":["import { swaggerUI } from \"@hono/swagger-ui\";\nimport { OpenAPIHono } from \"@hono/zod-openapi\";\nimport {\n  AdapterLifecycleError,\n  adapterSourcesOf,\n  validateBootAssembly,\n} from \"@storyshelf/core/adapter/setup\";\nimport { assertServerless, resolveShelfOptions } from \"@storyshelf/core/config\";\nimport type { ShelfConfig, ShelfOptions } from \"@storyshelf/core/config\";\nimport { configureImages } from \"@storyshelf/core/diff\";\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport { STORYBOOK_TOKEN_PREFIX } from \"@storyshelf/core/utils\";\n/**\n * StoryShelf app: compose database, storage, capture, auth, and notifier\n * adapters into a complete self-hosted visual-testing Hono app.\n */\nimport {\n  createHttpMiddleware,\n  createInstrumentedDatabase,\n  createInstrumentedStorage,\n} from \"@storyshelf/observability\";\nimport { requestId } from \"hono/request-id\";\nimport type { ShelfApp, ShelfContext, ShelfRouter } from \"./app-types.ts\";\nimport { runBootTasks } from \"./boot-tasks.ts\";\nimport { setupJobs, type JobsWiring } from \"./jobs-setup.ts\";\nimport { attachLifecycle, type LifecycleCell } from \"./lifecycle.ts\";\nimport {\n  authGate,\n  csrf,\n  createRateLimiter,\n  requireReview,\n  requireTesting,\n  rateLimitKey,\n  requestLogging,\n  resolveRequestUser,\n  storeScope,\n} from \"./middleware/index.ts\";\nimport { serverTiming } from \"./middleware/server-timing.ts\";\nimport { setupGate, type MiddlewareWiring } from \"./middleware/setup-gate.ts\";\nimport { registerAdminPages } from \"./routers/admin-pages.ts\";\nimport { registerPublicOriginRoutes } from \"./routers/admin-public-origin.ts\";\nimport { registerAdmin } from \"./routers/admin.ts\";\nimport { registerAssets } from \"./routers/assets.ts\";\nimport { registerEngineAuth } from \"./routers/auth.ts\";\nimport { registerBaselines } from \"./routers/baselines.ts\";\nimport { registerBuilds } from \"./routers/builds.ts\";\nimport { registerConnections } from \"./routers/connections.ts\";\nimport { registerHealth, type HealthDeps } from \"./routers/health.ts\";\nimport { registerInsightFragments } from \"./routers/insights-ui.tsx\";\nimport { registerInsights } from \"./routers/insights.ts\";\nimport { registerLabels } from \"./routers/labels.ts\";\nimport { registerLinks } from \"./routers/links.ts\";\nimport { registerMedia } from \"./routers/media.ts\";\nimport { registerMembers } from \"./routers/members.ts\";\nimport {\n  registerNotificationChannels,\n  registerSystemChannels,\n} from \"./routers/notification-channels.ts\";\nimport { registerNotificationSubscriptions } from \"./routers/notification-subscriptions.ts\";\nimport { registerPreviewToken } from \"./routers/preview-token.ts\";\nimport { registerProfile } from \"./routers/profile.ts\";\nimport { registerProjects } from \"./routers/projects.ts\";\nimport { registerReviewForms } from \"./routers/review-forms.ts\";\nimport { registerSignedStorybook } from \"./routers/signed-storybook.ts\";\nimport { registerStorybook } from \"./routers/storybook.ts\";\nimport { registerTokens } from \"./routers/tokens.ts\";\nimport { registerUiPages } from \"./routers/ui.ts\";\nimport { registerWebhooks } from \"./routers/webhooks.ts\";\nimport { registerWellKnown } from \"./routers/well-known.ts\";\nimport { markRouteClasses } from \"./routes/openapi-classes.ts\";\nimport { resolveRuntime, type ServerRuntime } from \"./runtime.ts\";\n\n/**\n * Fail fast on third-party adapters that cannot satisfy their slot.\n * Throws before any route or lifecycle hook runs.\n */\nfunction throwOnInvalidAdapters(options: ShelfOptions): void {\n  const invalid = validateBootAssembly(adapterSourcesOf(options));\n  if (invalid.length > 0) {\n    throw new AdapterLifecycleError(\"setup\", invalid);\n  }\n}\n\n/** Request/capture-path adapters with OTEL wrappers (lifecycle keeps raw ones). */\nfunction instrumentedOptions(options: ShelfOptions): ShelfOptions {\n  return {\n    ...options,\n    database: createInstrumentedDatabase(options.database),\n    storage: createInstrumentedStorage(options.storage),\n  };\n}\n\n/** Wire the job queue, its handlers and its consumer, and run the boot tasks that need them. */\nfunction wireQueues(scoped: ShelfOptions, runtime: ServerRuntime, cell: LifecycleCell): JobsWiring {\n  const jobs = setupJobs(scoped, runtime);\n  cell.consumer = jobs.consumer;\n  runBootTasks(cell, scoped, runtime, jobs.buildState);\n  return jobs;\n}\n\n/**\n * Serverless check (ADR 0006, decision 3): throws on AWS Lambda, warns on Vercel and Netlify. Only\n * an instance with `testing` needs a process that outlives the request.\n */\nfunction warnOnServerless(options: ShelfOptions, logger: Logger): void {\n  const warning = assertServerless(options.testing?.runner !== undefined);\n  if (warning) {\n    logger.warn(warning);\n  }\n}\n\n/** Attach lifecycle, queue, middleware, routes, and docs to the app. */\nfunction assembleApp(app: ShelfApp, options: ShelfOptions, scoped: ShelfOptions): void {\n  const runtime = resolveRuntime(options);\n  warnOnServerless(options, runtime.logger);\n  const cell: LifecycleCell = { ready: Promise.resolve({ ok: true, failures: [] }), settled: null };\n  attachLifecycle(app, options, runtime, cell);\n  if (runtime.config.serverTiming === true) {\n    app.use(\"*\", serverTiming(true));\n  }\n  const queues = wireQueues(scoped, runtime, cell);\n  wireMiddleware(app, {\n    ...runtime,\n    ...queues,\n    options: scoped,\n    getReady: async () => await cell.ready,\n  });\n  registerAllRoutes(app, options, {\n    sources: adapterSourcesOf(options),\n    getSettled: () => cell.settled,\n    bootTimeMs: Date.now(),\n    version: packageVersion(),\n  });\n  registerDocs(app);\n}\n\n/**\n * Create the StoryShelf Hono app with all API routes and HTML pages.\n *\n * Adapter `init` hooks kick off eagerly in the background (the constructor\n * stays synchronous). Await `app.lifecycle.setup()` before serving for\n * fail-fast startup, or let the first request gate on settlement.\n */\nexport function createShelfApp(rawOptions: ShelfOptions): ShelfApp {\n  const options = resolveShelfOptions(rawOptions);\n  configureImages({\n    engine: options.testing?.images?.engine,\n    threads: options.testing?.compare?.threads,\n  });\n  throwOnInvalidAdapters(options);\n  const app = new OpenAPIHono<{ Variables: ShelfContext }>() as ShelfApp;\n  assembleApp(app, options, instrumentedOptions(options));\n\n  return app;\n}\n\n/** Cookie-authenticated write paths guarded by CSRF tokens. */\nconst CSRF_PATHS = [\n  \"/auth/logout\",\n  \"/auth/invites/*\",\n  \"/projects/:slug/settings/*\",\n  \"/profile/*\",\n  \"/connections/*\",\n  \"/profile\",\n  \"/admin/credentials/*\",\n  \"/admin/public-origin\",\n  \"/admin/public-origin/*\",\n  \"/projects/:slug/builds/:buildId/insights/generate\",\n  \"/projects/:slug/builds/:buildId/comments\",\n  \"/projects/:slug/builds/:buildId/comments/*\",\n  \"/projects/:slug/builds/:buildId/reviews\",\n  \"/projects/:slug/insights/health/generate\",\n] as const;\n\n/** Attach global middleware: ids, logging, init gate, limits, store scope, auth gate. */\nfunction wireMiddleware(app: ShelfRouter, wiring: MiddlewareWiring): void {\n  const { config, logger, getReady } = wiring;\n  app.use(\"*\", requestId());\n  // OTEL server spans (W3C extraction, route-template naming). Mounted right\n  // after requestId so `storyshelf.req_id` resolves; `enduser.id` resolves\n  // once storeScope runs downstream. Noop without an SDK.\n  app.use(\n    \"*\",\n    createHttpMiddleware({ serviceName: \"storyshelf\", serviceVersion: packageVersion() }),\n  );\n  // Structured request logging. Uses a Hono-native middleware rather than\n  // Pino-http, which expects a Node server response (`res.on`) incompatible\n  // With Hono's Web `Request`/`Response` model.\n  app.use(\"*\", requestLogging(logger));\n  app.use(\"*\", setupGate(getReady));\n  // Routes classified `testing` answer 404 without `options.testing` (ADR 0006, decision 8).\n  app.use(\"*\", requireTesting(wiring.options.testing !== undefined));\n  mountGuards(app, config, wiring.options);\n  mountStoreScope(app, wiring);\n  app.use(\"*\", authGate());\n  // Routes classified `review` answer 404 for a project with review off (ADR 0013, decision 10).\n  app.use(\"*\", requireReview());\n}\n\nconst MINUTE = 60_000;\n\n/** Per-path limits; `bucket` gives a route family its own counter (default: shared `api:`). */\nconst RATE_LIMITS: readonly { paths: string[]; max: number; bucket?: string }[] = [\n  { paths: [\"/api/v1/*\"], max: 100 },\n  { paths: [\"/api/v1/tokens/*\"], max: 10 },\n  { paths: [\"/api/v1/webhooks/*\"], max: 20 },\n  // Auth endpoints ride their own buckets (the store keys by IP, so a prefix\n  // keeps login floods from eating the API budget or vice versa).\n  { paths: [\"/auth/*\"], max: 100, bucket: \"auth\" },\n  { paths: [\"/api/auth/*\"], max: 300, bucket: \"engine\" },\n  {\n    paths: [\n      \"/api/v1/projects/:slug/notification-channels\",\n      \"/api/v1/projects/:slug/notification-channels/:channelId\",\n    ],\n    max: 20,\n    bucket: \"notify-channels\",\n  },\n  {\n    paths: [\"/api/v1/projects/:slug/notifications\", \"/api/v1/projects/:slug/notifications/me\"],\n    max: 30,\n    bucket: \"notify-subs\",\n  },\n  {\n    paths: [\n      \"/api/v1/admin/notification-channels\",\n      \"/api/v1/admin/notification-channels/:channelId\",\n    ],\n    max: 20,\n    bucket: \"notify-admin\",\n  },\n];\n\n/** Requests per minute per client IP on the signed Storybook URL route (`testing.storybookUrlRateLimit`). */\nconst DEFAULT_STORYBOOK_URL_RATE_LIMIT = 6000;\n\n/** Mount rate limits and CSRF guards (abuse floors, not strict protection). */\nfunction mountGuards(app: ShelfRouter, config: ShelfConfig, options: ShelfOptions): void {\n  const rateLimit = createRateLimiter();\n  // A render fetches thousands of assets from one farm IP, so this floor is generous; it counts\n  // before the token is looked at and answers 429 alike for any token.\n  const signedUrls = {\n    paths: [`${STORYBOOK_TOKEN_PREFIX}*`],\n    max: options.testing?.storybookUrlRateLimit ?? DEFAULT_STORYBOOK_URL_RATE_LIMIT,\n    bucket: \"signed-storybook\",\n  };\n  for (const { paths, max, bucket } of [...RATE_LIMITS, signedUrls]) {\n    const keyGenerator = bucket ? rateLimitKey(bucket) : undefined;\n    for (const path of paths) {\n      app.use(path, rateLimit({ windowMs: MINUTE, max, keyGenerator }));\n    }\n  }\n  for (const path of CSRF_PATHS) {\n    app.use(path, csrf(config.secret));\n  }\n}\n\n/** Mount the request-scoped store (db/storage/config/user/adapters). */\nfunction mountStoreScope(app: ShelfRouter, wiring: MiddlewareWiring): void {\n  const {\n    options,\n    config,\n    ui,\n    logger,\n    authEnabled,\n    enqueueCapture,\n    captureQueue,\n    capturesHere,\n    publish,\n    cancelBuildJobs,\n    buildState,\n    design,\n    notifiers,\n    publicOrigin,\n  } = wiring;\n  app.use(\n    \"*\",\n    storeScope({\n      db: options.database,\n      storage: options.storage,\n      config,\n      ui,\n      logger,\n      authEnabled,\n      testing: options.testing !== undefined,\n      enqueueCapture,\n      captureQueue,\n      capturesHere,\n      publish,\n      cancelBuildJobs,\n      buildState,\n      captureConcurrency: options.testing?.concurrency,\n      runner: options.testing?.runner,\n      publicOrigin,\n      design,\n      notifiers,\n      notificationsConfig: options.notifications?.config,\n      ai: options.ai,\n      resolveUser: async (c) => await resolveRequestUser(c, options.auth),\n    }),\n  );\n}\n\n/** Register every JSON API router. */\nfunction registerApiRoutes(app: ShelfRouter, health: HealthDeps): void {\n  registerProjectRoutes(app);\n  registerNotificationRoutes(app);\n  registerHealth(app, health);\n  registerAdmin(app);\n}\n\n/** Register the per-project resource routers. */\nfunction registerProjectRoutes(app: ShelfRouter): void {\n  registerProjects(app);\n  registerBuilds(app);\n  registerLabels(app);\n  registerLinks(app);\n  registerBaselines(app);\n  registerMedia(app);\n  registerMembers(app);\n  registerTokens(app);\n  registerWebhooks(app);\n  registerInsights(app);\n}\n\n/** Register the notification channel and subscription routers. */\nfunction registerNotificationRoutes(app: ShelfRouter): void {\n  registerNotificationChannels(app);\n  registerNotificationSubscriptions(app);\n  registerSystemChannels(app);\n}\n\n/** Register the auth flow: engine mount, relying-party documents, profile. */\nfunction registerAuthFlow(app: ShelfRouter, options: ShelfOptions): void {\n  // Auth-gated pages mount only with auth: authEnabled=false mounts zero\n  // auth routes. Static imports stay — true lazy loading would need an async\n  // createShelfApp, which the sync Hono assembly cannot do.\n  if (!options.auth) {\n    return;\n  }\n  registerEngineAuth(app, options.auth);\n  registerWellKnown(app, options.auth);\n  registerProfile(app, options.auth);\n  registerConnections(app);\n}\n\n/** Register HTML pages, assets, and the optional auth flow. */\nfunction registerPageRoutes(app: ShelfRouter, options: ShelfOptions, health: HealthDeps): void {\n  registerAuthFlow(app, options);\n  registerAssets(app);\n  registerStorybook(app);\n  registerSignedStorybook(app);\n  registerPreviewToken(app);\n  registerAdminPages(app, health, options.auth);\n  registerPublicOriginRoutes(app);\n  registerUiPages(app);\n  registerReviewForms(app);\n  registerInsightFragments(app);\n}\n\n/** Register every API router, page set, and optional auth flow. */\nfunction registerAllRoutes(app: ShelfRouter, options: ShelfOptions, health: HealthDeps): void {\n  registerApiRoutes(app, health);\n  registerPageRoutes(app, options, health);\n}\n\n/** The OpenAPI document's info and tag catalog. */\nconst OPENAPI_CONFIG = {\n  openapi: \"3.0.0\",\n  info: {\n    title: \"StoryShelf API\",\n    description:\n      \"REST API for the StoryShelf visual testing platform. JSON endpoints live under /api/v1; HTML pages are served at /.\",\n    version: \"1.0.0\",\n  },\n  tags: [\n    {\n      name: \"Projects\",\n      description: \"Create and manage projects (one project is one Storybook).\",\n    },\n    {\n      name: \"Builds\",\n      description: \"Upload Storybook builds, inspect capture attempts, retry, and delete.\",\n    },\n    {\n      name: \"Review\",\n      description:\n        \"Approve or reject snapshots, bulk actions, re-diff, build verdicts, the build changeset and review comments.\",\n    },\n    { name: \"Labels\", description: \"Typed build labels and their link templates.\" },\n    {\n      name: \"Links\",\n      description:\n        \"Link packages to the projects that publish them and see where stories use them.\",\n    },\n    { name: \"Baselines\", description: \"Export and import baselines as a portable zip.\" },\n    {\n      name: \"Members\",\n      description: \"Project members, roles, and identity-provider group mappings.\",\n    },\n    {\n      name: \"Insights\",\n      description: \"AI build triage and project health (advisory only; needs AI configured).\",\n    },\n    { name: \"Tokens\", description: \"API tokens used by the CLI and CI.\" },\n    { name: \"Webhooks\", description: \"Signed webhook deliveries for build events.\" },\n    {\n      name: \"Notifications\",\n      description: \"Email, chat and git notification channels and subscriptions.\",\n    },\n    { name: \"Admin\", description: \"Site-wide administration.\" },\n  ],\n} as const;\n\n/** Register the OpenAPI document and interactive docs page. */\nfunction registerDocs(app: ShelfRouter): void {\n  // Every operation carries the class of its route (`x-storyshelf-class`), so a client can tell\n  // what an instance hides: `testing` routes 404 without `testing`, `review` ones with review off.\n  app.get(\"/api/v1/openapi.json\", (c) =>\n    c.json(\n      markRouteClasses(\n        app.getOpenAPIDocument({ ...OPENAPI_CONFIG, tags: [...OPENAPI_CONFIG.tags] }),\n      ),\n    ),\n  );\n  app.get(\"/api/v1/docs\", swaggerUI({ url: \"/api/v1/openapi.json\" }));\n}\n\ndeclare const __PKG_VERSION__: string | undefined;\n\n/**\n * Package version injected at build via the `__PKG_VERSION__` define. Read as a bare identifier:\n * bundler defines replace identifiers, not `globalThis` property reads. Undefined when running\n * from source (dev server, tests).\n */\nfunction packageVersion(): string {\n  return typeof __PKG_VERSION__ === \"string\" ? __PKG_VERSION__ : \"0.0.0\";\n}\n\n/**\n * Public surface: the app and its types only.\n *\n * `createShelfApp` plus the option/config types needed to call it. Adapter\n * interfaces live under `core/adapter/*`; runtime helpers under `core/logger`,\n * `core/capture`, `core/paths`, `core/urls`, `core/diff`; tables and row types\n * under `core/schema`. Importing the barrel must never pull Node-only modules\n * into edge bundles beyond what Hono itself needs.\n */\nexport { createAuthSystemHook } from \"./notify.ts\";\nexport type {\n  ShelfOptions,\n  ShelfTestingOptions,\n  ShelfCompareOptions,\n  ShelfNotificationsOptions,\n  ShelfConfig,\n  UIConfig,\n  BrandTheme,\n  NotificationsConfig,\n} from \"@storyshelf/core/config\";\nexport {\n  createShelfLogger,\n  type Logger,\n  type LoggerOptions,\n  type PinoTransport,\n} from \"@storyshelf/core/logger\";\nexport type { ShelfApp, ShelfContext, ShelfLifecycle, ShelfRouter } from \"./app-types.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,SAAS,uBAAuB,SAA6B;CAC3D,MAAM,UAAU,qBAAqB,iBAAiB,OAAO,CAAC;CAC9D,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,sBAAsB,SAAS,OAAO;AAEpD;;AAGA,SAAS,oBAAoB,SAAqC;CAChE,OAAO;EACL,GAAG;EACH,UAAU,2BAA2B,QAAQ,QAAQ;EACrD,SAAS,0BAA0B,QAAQ,OAAO;CACpD;AACF;;AAGA,SAAS,WAAW,QAAsB,SAAwB,MAAiC;CACjG,MAAM,OAAO,UAAU,QAAQ,OAAO;CACtC,KAAK,WAAW,KAAK;CACrB,aAAa,MAAM,QAAQ,SAAS,KAAK,UAAU;CACnD,OAAO;AACT;;;;;AAMA,SAAS,iBAAiB,SAAuB,QAAsB;CACrE,MAAM,UAAU,iBAAiB,QAAQ,SAAS,WAAW,KAAA,CAAS;CACtE,IAAI,SACF,OAAO,KAAK,OAAO;AAEvB;;AAGA,SAAS,YAAY,KAAe,SAAuB,QAA4B;CACrF,MAAM,UAAU,eAAe,OAAO;CACtC,iBAAiB,SAAS,QAAQ,MAAM;CACxC,MAAM,OAAsB;EAAE,OAAO,QAAQ,QAAQ;GAAE,IAAI;GAAM,UAAU,CAAC;EAAE,CAAC;EAAG,SAAS;CAAK;CAChG,gBAAgB,KAAK,SAAS,SAAS,IAAI;CAC3C,IAAI,QAAQ,OAAO,iBAAiB,MAClC,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC;CAEjC,MAAM,SAAS,WAAW,QAAQ,SAAS,IAAI;CAC/C,eAAe,KAAK;EAClB,GAAG;EACH,GAAG;EACH,SAAS;EACT,UAAU,YAAY,MAAM,KAAK;CACnC,CAAC;CACD,kBAAkB,KAAK,SAAS;EAC9B,SAAS,iBAAiB,OAAO;EACjC,kBAAkB,KAAK;EACvB,YAAY,KAAK,IAAI;EACrB,SAAS,eAAe;CAC1B,CAAC;CACD,aAAa,GAAG;AAClB;;;;;;;;AASA,SAAgB,eAAe,YAAoC;CACjE,MAAM,UAAU,oBAAoB,UAAU;CAC9C,gBAAgB;EACd,QAAQ,QAAQ,SAAS,QAAQ;EACjC,SAAS,QAAQ,SAAS,SAAS;CACrC,CAAC;CACD,uBAAuB,OAAO;CAC9B,MAAM,MAAM,IAAI,YAAyC;CACzD,YAAY,KAAK,SAAS,oBAAoB,OAAO,CAAC;CAEtD,OAAO;AACT;;AAGA,MAAM,aAAa;CACjB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,SAAS,eAAe,KAAkB,QAAgC;CACxE,MAAM,EAAE,QAAQ,QAAQ,aAAa;CACrC,IAAI,IAAI,KAAK,UAAU,CAAC;CAIxB,IAAI,IACF,KACA,qBAAqB;EAAE,aAAa;EAAc,gBAAgB,eAAe;CAAE,CAAC,CACtF;CAIA,IAAI,IAAI,KAAK,eAAe,MAAM,CAAC;CACnC,IAAI,IAAI,KAAK,UAAU,QAAQ,CAAC;CAEhC,IAAI,IAAI,KAAK,eAAe,OAAO,QAAQ,YAAY,KAAA,CAAS,CAAC;CACjE,YAAY,KAAK,QAAQ,OAAO,OAAO;CACvC,gBAAgB,KAAK,MAAM;CAC3B,IAAI,IAAI,KAAK,SAAS,CAAC;CAEvB,IAAI,IAAI,KAAK,cAAc,CAAC;AAC9B;AAEA,MAAM,SAAS;;AAGf,MAAM,cAA4E;CAChF;EAAE,OAAO,CAAC,WAAW;EAAG,KAAK;CAAI;CACjC;EAAE,OAAO,CAAC,kBAAkB;EAAG,KAAK;CAAG;CACvC;EAAE,OAAO,CAAC,oBAAoB;EAAG,KAAK;CAAG;CAGzC;EAAE,OAAO,CAAC,SAAS;EAAG,KAAK;EAAK,QAAQ;CAAO;CAC/C;EAAE,OAAO,CAAC,aAAa;EAAG,KAAK;EAAK,QAAQ;CAAS;CACrD;EACE,OAAO,CACL,gDACA,yDACF;EACA,KAAK;EACL,QAAQ;CACV;CACA;EACE,OAAO,CAAC,wCAAwC,yCAAyC;EACzF,KAAK;EACL,QAAQ;CACV;CACA;EACE,OAAO,CACL,uCACA,gDACF;EACA,KAAK;EACL,QAAQ;CACV;AACF;;AAGA,MAAM,mCAAmC;;AAGzC,SAAS,YAAY,KAAkB,QAAqB,SAA6B;CACvF,MAAM,YAAY,kBAAkB;CAGpC,MAAM,aAAa;EACjB,OAAO,CAAC,GAAG,uBAAuB,EAAE;EACpC,KAAK,QAAQ,SAAS,yBAAyB;EAC/C,QAAQ;CACV;CACA,KAAK,MAAM,EAAE,OAAO,KAAK,YAAY,CAAC,GAAG,aAAa,UAAU,GAAG;EACjE,MAAM,eAAe,SAAS,aAAa,MAAM,IAAI,KAAA;EACrD,KAAK,MAAM,QAAQ,OACjB,IAAI,IAAI,MAAM,UAAU;GAAE,UAAU;GAAQ;GAAK;EAAa,CAAC,CAAC;CAEpE;CACA,KAAK,MAAM,QAAQ,YACjB,IAAI,IAAI,MAAM,KAAK,OAAO,MAAM,CAAC;AAErC;;AAGA,SAAS,gBAAgB,KAAkB,QAAgC;CACzE,MAAM,EACJ,SACA,QACA,IACA,QACA,aACA,gBACA,cACA,cACA,SACA,iBACA,YACA,QACA,WACA,iBACE;CACJ,IAAI,IACF,KACA,WAAW;EACT,IAAI,QAAQ;EACZ,SAAS,QAAQ;EACjB;EACA;EACA;EACA;EACA,SAAS,QAAQ,YAAY,KAAA;EAC7B;EACA;EACA;EACA;EACA;EACA;EACA,oBAAoB,QAAQ,SAAS;EACrC,QAAQ,QAAQ,SAAS;EACzB;EACA;EACA;EACA,qBAAqB,QAAQ,eAAe;EAC5C,IAAI,QAAQ;EACZ,aAAa,OAAO,MAAM,MAAM,mBAAmB,GAAG,QAAQ,IAAI;CACpE,CAAC,CACH;AACF;;AAGA,SAAS,kBAAkB,KAAkB,QAA0B;CACrE,sBAAsB,GAAG;CACzB,2BAA2B,GAAG;CAC9B,eAAe,KAAK,MAAM;CAC1B,cAAc,GAAG;AACnB;;AAGA,SAAS,sBAAsB,KAAwB;CACrD,iBAAiB,GAAG;CACpB,eAAe,GAAG;CAClB,eAAe,GAAG;CAClB,cAAc,GAAG;CACjB,kBAAkB,GAAG;CACrB,cAAc,GAAG;CACjB,gBAAgB,GAAG;CACnB,eAAe,GAAG;CAClB,iBAAiB,GAAG;CACpB,iBAAiB,GAAG;AACtB;;AAGA,SAAS,2BAA2B,KAAwB;CAC1D,6BAA6B,GAAG;CAChC,kCAAkC,GAAG;CACrC,uBAAuB,GAAG;AAC5B;;AAGA,SAAS,iBAAiB,KAAkB,SAA6B;CAIvE,IAAI,CAAC,QAAQ,MACX;CAEF,mBAAmB,KAAK,QAAQ,IAAI;CACpC,kBAAkB,KAAK,QAAQ,IAAI;CACnC,gBAAgB,KAAK,QAAQ,IAAI;CACjC,oBAAoB,GAAG;AACzB;;AAGA,SAAS,mBAAmB,KAAkB,SAAuB,QAA0B;CAC7F,iBAAiB,KAAK,OAAO;CAC7B,eAAe,GAAG;CAClB,kBAAkB,GAAG;CACrB,wBAAwB,GAAG;CAC3B,qBAAqB,GAAG;CACxB,mBAAmB,KAAK,QAAQ,QAAQ,IAAI;CAC5C,2BAA2B,GAAG;CAC9B,gBAAgB,GAAG;CACnB,oBAAoB,GAAG;CACvB,yBAAyB,GAAG;AAC9B;;AAGA,SAAS,kBAAkB,KAAkB,SAAuB,QAA0B;CAC5F,kBAAkB,KAAK,MAAM;CAC7B,mBAAmB,KAAK,SAAS,MAAM;AACzC;;AAGA,MAAM,iBAAiB;CACrB,SAAS;CACT,MAAM;EACJ,OAAO;EACP,aACE;EACF,SAAS;CACX;CACA,MAAM;EACJ;GACE,MAAM;GACN,aAAa;EACf;EACA;GACE,MAAM;GACN,aAAa;EACf;EACA;GACE,MAAM;GACN,aACE;EACJ;EACA;GAAE,MAAM;GAAU,aAAa;EAA+C;EAC9E;GACE,MAAM;GACN,aACE;EACJ;EACA;GAAE,MAAM;GAAa,aAAa;EAAiD;EACnF;GACE,MAAM;GACN,aAAa;EACf;EACA;GACE,MAAM;GACN,aAAa;EACf;EACA;GAAE,MAAM;GAAU,aAAa;EAAqC;EACpE;GAAE,MAAM;GAAY,aAAa;EAA8C;EAC/E;GACE,MAAM;GACN,aAAa;EACf;EACA;GAAE,MAAM;GAAS,aAAa;EAA4B;CAC5D;AACF;;AAGA,SAAS,aAAa,KAAwB;CAG5C,IAAI,IAAI,yBAAyB,MAC/B,EAAE,KACA,iBACE,IAAI,mBAAmB;EAAE,GAAG;EAAgB,MAAM,CAAC,GAAG,eAAe,IAAI;CAAE,CAAC,CAC9E,CACF,CACF;CACA,IAAI,IAAI,gBAAgB,UAAU,EAAE,KAAK,uBAAuB,CAAC,CAAC;AACpE;;;;;;AASA,SAAS,iBAAyB;CAChC,OAAA;AACF"}