@storyshelf/app 0.6.2 → 0.7.0

package/dist/middleware/auth-gate.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-gate.mjs","names":[],"sources":["../../src/middleware/auth-gate.ts"],"sourcesContent":["import type { Auth } from \"@storyshelf/core/auth\";\nimport type { AuthUser } from \"@storyshelf/core/types\";\nimport type { Context, Next } from \"hono\";\nimport { getStore } from \"../store.ts\";\n\n/** Resolve the request user from the auth adapter (null when auth is off or a token is used). */\nexport async function resolveRequestUser(\n  c: Pick<Context, \"req\">,\n  auth?: Auth,\n): Promise<AuthUser | null> {\n  if (!auth) {\n    return null;\n  }\n  if (c.req.header(\"authorization\")) {\n    return null;\n  }\n  return await auth.check(c.req.raw);\n}\n\n/**\n * Gate the server-rendered UI behind auth (ADR 0008): unauthenticated HTML\n * requests redirect to login. API/auth routes answer 401/403 themselves, and\n * published-Storybook routes enforce their own auth (public builds are\n * viewable without a session, ADR 0011).\n */\nexport function authGate() {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const { user, authEnabled: isAuthEnabled } = getStore();\n    const { path } = c.req;\n    if (\n      !isAuthEnabled ||\n      user ||\n      path.startsWith(\"/api/\") ||\n      path.startsWith(\"/auth/\") ||\n      path.startsWith(\"/assets/\") ||\n      path.startsWith(\"/.well-known/\") ||\n      (path.startsWith(\"/projects/\") && path.includes(\"/storybook\")) ||\n      /^\\/projects\\/[^/]+\\/?$/u.test(path)\n    ) {\n      await next();\n      return;\n    }\n    if (c.req.header(\"HX-Request\") === \"true\") {\n      c.header(\"HX-Redirect\", \"/auth/login\");\n      return c.body(null, 204);\n    }\n    return c.redirect(\"/auth/login\", 302);\n  };\n}\n"],"mappings":";;;;;;AAMA,eAAsB,mBACpB,GACA,MAC0B;CAC1B,IAAI,CAAC,MACH,OAAO;CAET,IAAI,EAAE,IAAI,OAAO,eAAe,GAC9B,OAAO;CAET,OAAO,MAAM,KAAK,MAAM,EAAE,IAAI,GAAG;AACnC;;;;;;;AAQA,SAAgB,WAAW;CAEzB,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,EAAE,MAAM,aAAa,kBAAkB,SAAS;EACtD,MAAM,EAAE,SAAS,EAAE;EACnB,IACE,CAAC,iBACD,QACA,KAAK,WAAW,OAAO,KACvB,KAAK,WAAW,QAAQ,KACxB,KAAK,WAAW,UAAU,KAC1B,KAAK,WAAW,eAAe,KAC9B,KAAK,WAAW,YAAY,KAAK,KAAK,SAAS,YAAY,KAC5D,0BAA0B,KAAK,IAAI,GACnC;GACA,MAAM,KAAK;GACX;EACF;EACA,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,QAAQ;GACzC,EAAE,OAAO,eAAe,aAAa;GACrC,OAAO,EAAE,KAAK,MAAM,GAAG;EACzB;EACA,OAAO,EAAE,SAAS,eAAe,GAAG;CACtC;AACF"}
+{"version":3,"file":"auth-gate.mjs","names":[],"sources":["../../src/middleware/auth-gate.ts"],"sourcesContent":["import type { Auth } from \"@storyshelf/core/auth\";\nimport type { AuthUser } from \"@storyshelf/core/types\";\nimport { STORYBOOK_TOKEN_PREFIX } from \"@storyshelf/core/utils\";\nimport type { Context, Next } from \"hono\";\nimport { getStore } from \"../store.ts\";\n\n/** Resolve the request user from the auth adapter (null when auth is off or a token is used). */\nexport async function resolveRequestUser(\n  c: Pick<Context, \"req\">,\n  auth?: Auth,\n): Promise<AuthUser | null> {\n  if (!auth) {\n    return null;\n  }\n  if (c.req.header(\"authorization\")) {\n    return null;\n  }\n  return await auth.check(c.req.raw);\n}\n\n/**\n * Gate the server-rendered UI behind auth (ADR 0008): unauthenticated HTML\n * requests redirect to login. API/auth routes answer 401/403 themselves, and\n * published-Storybook routes enforce their own auth (public builds are\n * viewable without a session, ADR 0011), and `/_s/<token>` is answered by its signed token\n * alone (ADR 0007).\n */\nexport function authGate() {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const { user, authEnabled: isAuthEnabled } = getStore();\n    const { path } = c.req;\n    if (\n      !isAuthEnabled ||\n      user ||\n      path.startsWith(\"/api/\") ||\n      path.startsWith(\"/auth/\") ||\n      path.startsWith(\"/assets/\") ||\n      path.startsWith(STORYBOOK_TOKEN_PREFIX) ||\n      path.startsWith(\"/.well-known/\") ||\n      (path.startsWith(\"/projects/\") && path.includes(\"/storybook\")) ||\n      /^\\/projects\\/[^/]+\\/?$/u.test(path)\n    ) {\n      await next();\n      return;\n    }\n    if (c.req.header(\"HX-Request\") === \"true\") {\n      c.header(\"HX-Redirect\", \"/auth/login\");\n      return c.body(null, 204);\n    }\n    return c.redirect(\"/auth/login\", 302);\n  };\n}\n"],"mappings":";;;;;;;AAOA,eAAsB,mBACpB,GACA,MAC0B;CAC1B,IAAI,CAAC,MACH,OAAO;CAET,IAAI,EAAE,IAAI,OAAO,eAAe,GAC9B,OAAO;CAET,OAAO,MAAM,KAAK,MAAM,EAAE,IAAI,GAAG;AACnC;;;;;;;;AASA,SAAgB,WAAW;CAEzB,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,EAAE,MAAM,aAAa,kBAAkB,SAAS;EACtD,MAAM,EAAE,SAAS,EAAE;EACnB,IACE,CAAC,iBACD,QACA,KAAK,WAAW,OAAO,KACvB,KAAK,WAAW,QAAQ,KACxB,KAAK,WAAW,UAAU,KAC1B,KAAK,WAAW,sBAAsB,KACtC,KAAK,WAAW,eAAe,KAC9B,KAAK,WAAW,YAAY,KAAK,KAAK,SAAS,YAAY,KAC5D,0BAA0B,KAAK,IAAI,GACnC;GACA,MAAM,KAAK;GACX;EACF;EACA,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,QAAQ;GACzC,EAAE,OAAO,eAAe,aAAa;GACrC,OAAO,EAAE,KAAK,MAAM,GAAG;EACzB;EACA,OAAO,EAAE,SAAS,eAAe,GAAG;CACtC;AACF"}

package/dist/middleware/rate-limit.mjs

@@ -25,44 +25,52 @@ function rateLimitKey(prefix) {
 		return `${prefix}:anonymous`;
 	};
 }
-const stores = /* @__PURE__ */ new Map();
 /** Cap tracked buckets (spoofed keys would otherwise grow the map forever). */
 const MAX_BUCKETS = 1e4;
-function cleanup() {
-	const now = Date.now();
-	for (const [key, entry] of stores) if (now > entry.resetAt) stores.delete(key);
-}
-setInterval(cleanup, 6e4).unref();
-/** Hono middleware limiting requests per key within a sliding window. */
-function rateLimit(options) {
-	const { windowMs, max, keyGenerator } = options;
-	return async (c, next) => {
-		const key = keyGenerator ? keyGenerator(c) : rateLimitKey("api")(c);
-		const now = Date.now();
-		let entry = stores.get(key);
-		if (!entry || now > entry.resetAt) {
-			entry = {
-				count: 0,
-				resetAt: now + windowMs
-			};
-			if (stores.size >= MAX_BUCKETS) {
-				const oldest = stores.keys().next();
-				if (!oldest.done) stores.delete(oldest.value);
+const SWEEP_INTERVAL_MS = 6e4;
+/**
+* Create a rate limiter with its own bucket store, so each app instance
+* counts independently. Limiters built from the same `rateLimit` factory that
+* resolve to the same key share one counter (e.g. `/api/v1/*` and
+* `/api/v1/tokens/*` both bill the caller's `api:` bucket).
+*/
+function createRateLimiter() {
+	const stores = /* @__PURE__ */ new Map();
+	let lastSweep = Date.now();
+	const sweep = (now) => {
+		lastSweep = now;
+		for (const [key, entry] of stores) if (now > entry.resetAt) stores.delete(key);
+	};
+	return (options) => {
+		const { windowMs, max, keyGenerator } = options;
+		return async (c, next) => {
+			const key = keyGenerator ? keyGenerator(c) : rateLimitKey("api")(c);
+			const now = Date.now();
+			if (now - lastSweep > SWEEP_INTERVAL_MS) sweep(now);
+			let entry = stores.get(key);
+			if (!entry || now > entry.resetAt) {
+				entry = {
+					count: 0,
+					resetAt: now + windowMs
+				};
+				if (stores.size >= MAX_BUCKETS) {
+					const oldest = stores.keys().next();
+					if (!oldest.done) stores.delete(oldest.value);
+				}
+				stores.set(key, entry);
+			}
+			entry.count += 1;
+			if (entry.count > max) {
+				c.header("Retry-After", String(Math.ceil((entry.resetAt - now) / 1e3)));
+				return c.json({ error: "Too many requests" }, 429);
 			}
-			stores.set(key, entry);
-		}
-		entry.count += 1;
-		if (entry.count > max) {
-			const retryAfter = Math.ceil((entry.resetAt - now) / 1e3);
-			c.header("Retry-After", String(retryAfter));
-			return c.json({ error: "Too many requests" }, 429);
-		}
-		c.header("X-RateLimit-Limit", String(max));
-		c.header("X-RateLimit-Remaining", String(Math.max(0, max - entry.count)));
-		await next();
+			c.header("X-RateLimit-Limit", String(max));
+			c.header("X-RateLimit-Remaining", String(Math.max(0, max - entry.count)));
+			return await next();
+		};
 	};
 }
 //#endregion
-export { rateLimit, rateLimitKey };
+export { createRateLimiter, rateLimitKey };
 
 //# sourceMappingURL=rate-limit.mjs.map

package/dist/middleware/rate-limit.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.mjs","names":[],"sources":["../../src/middleware/rate-limit.ts"],"sourcesContent":["import type { Context, Next } from \"hono\";\n\ninterface RateLimitEntry {\n  count: number;\n  resetAt: number;\n}\n\ninterface RateLimitOptions {\n  windowMs: number;\n  max: number;\n  keyGenerator?: (c: Context) => string;\n}\n\n/** Direct peer IP from server runtimes exposing the socket (unspoofable TCP source). */\nfunction peerIp(c: Pick<Context, \"env\">): string | undefined {\n  const env = (c.env ?? {}) as {\n    incoming?: { socket?: { remoteAddress?: unknown } };\n    server?: { incoming?: { socket?: { remoteAddress?: unknown } } };\n  };\n  const address =\n    env.incoming?.socket?.remoteAddress ?? env.server?.incoming?.socket?.remoteAddress;\n  return typeof address === \"string\" && address ? address : undefined;\n}\n\n/**\n * Rate-limit identity for one bucket prefix: direct peer first, then the\n * first `X-Forwarded-For` entry (client-controlled, so only a fallback),\n * then `X-Real-IP`, then a shared bucket. Deployments behind proxies with\n * many users behind one peer IP share that peer's budget.\n */\nexport function rateLimitKey(prefix: string): (c: Context) => string {\n  return (c) => {\n    const peer = peerIp(c);\n    if (peer) {\n      return `${prefix}:${peer}`;\n    }\n    const forwarded = c.req.header(\"x-forwarded-for\")?.split(\",\")[0]?.trim();\n    if (forwarded) {\n      return `${prefix}:fwd:${forwarded}`;\n    }\n    const real = c.req.header(\"x-real-ip\")?.trim();\n    if (real) {\n      return `${prefix}:fwd:${real}`;\n    }\n    return `${prefix}:anonymous`;\n  };\n}\n\nconst stores = new Map<string, RateLimitEntry>();\n\n/** Cap tracked buckets (spoofed keys would otherwise grow the map forever). */\nconst MAX_BUCKETS = 10_000;\n\nfunction cleanup(): void {\n  const now = Date.now();\n  for (const [key, entry] of stores) {\n    if (now > entry.resetAt) {\n      stores.delete(key);\n    }\n  }\n}\n\nsetInterval(cleanup, 60_000).unref();\n\n/** Hono middleware limiting requests per key within a sliding window. */\nexport function rateLimit(options: RateLimitOptions) {\n  const { windowMs, max, keyGenerator } = options;\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const key = keyGenerator ? keyGenerator(c) : rateLimitKey(\"api\")(c);\n    const now = Date.now();\n    let entry = stores.get(key);\n    if (!entry || now > entry.resetAt) {\n      entry = { count: 0, resetAt: now + windowMs };\n      if (stores.size >= MAX_BUCKETS) {\n        const oldest = stores.keys().next();\n        if (!oldest.done) {\n          stores.delete(oldest.value);\n        }\n      }\n      stores.set(key, entry);\n    }\n    entry.count += 1;\n    if (entry.count > max) {\n      const retryAfter = Math.ceil((entry.resetAt - now) / 1000);\n      c.header(\"Retry-After\", String(retryAfter));\n      return c.json({ error: \"Too many requests\" }, 429);\n    }\n    c.header(\"X-RateLimit-Limit\", String(max));\n    c.header(\"X-RateLimit-Remaining\", String(Math.max(0, max - entry.count)));\n    await next();\n  };\n}\n"],"mappings":";;;;;AAcA,SAAS,OAAO,GAA6C;CAC3D,MAAM,MAAO,EAAE,OAAO,CAAC;CAIvB,MAAM,UACJ,IAAI,UAAU,QAAQ,iBAAiB,IAAI,QAAQ,UAAU,QAAQ;CACvE,OAAO,OAAO,YAAY,YAAY,UAAU,UAAU,KAAA;AAC5D;;;;;;;AAQA,SAAgB,aAAa,QAAwC;CACnE,QAAQ,MAAM;EACZ,MAAM,OAAO,OAAO,CAAC;EACrB,IAAI,MACF,OAAO,GAAG,OAAO,GAAG;EAEtB,MAAM,YAAY,EAAE,IAAI,OAAO,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK;EACvE,IAAI,WACF,OAAO,GAAG,OAAO,OAAO;EAE1B,MAAM,OAAO,EAAE,IAAI,OAAO,WAAW,CAAC,EAAE,KAAK;EAC7C,IAAI,MACF,OAAO,GAAG,OAAO,OAAO;EAE1B,OAAO,GAAG,OAAO;CACnB;AACF;AAEA,MAAM,yBAAS,IAAI,IAA4B;;AAG/C,MAAM,cAAc;AAEpB,SAAS,UAAgB;CACvB,MAAM,MAAM,KAAK,IAAI;CACrB,KAAK,MAAM,CAAC,KAAK,UAAU,QACzB,IAAI,MAAM,MAAM,SACd,OAAO,OAAO,GAAG;AAGvB;AAEA,YAAY,SAAS,GAAM,CAAC,CAAC,MAAM;;AAGnC,SAAgB,UAAU,SAA2B;CACnD,MAAM,EAAE,UAAU,KAAK,iBAAiB;CAExC,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,MAAM,eAAe,aAAa,CAAC,IAAI,aAAa,KAAK,CAAC,CAAC,CAAC;EAClE,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,QAAQ,OAAO,IAAI,GAAG;EAC1B,IAAI,CAAC,SAAS,MAAM,MAAM,SAAS;GACjC,QAAQ;IAAE,OAAO;IAAG,SAAS,MAAM;GAAS;GAC5C,IAAI,OAAO,QAAQ,aAAa;IAC9B,MAAM,SAAS,OAAO,KAAK,CAAC,CAAC,KAAK;IAClC,IAAI,CAAC,OAAO,MACV,OAAO,OAAO,OAAO,KAAK;GAE9B;GACA,OAAO,IAAI,KAAK,KAAK;EACvB;EACA,MAAM,SAAS;EACf,IAAI,MAAM,QAAQ,KAAK;GACrB,MAAM,aAAa,KAAK,MAAM,MAAM,UAAU,OAAO,GAAI;GACzD,EAAE,OAAO,eAAe,OAAO,UAAU,CAAC;GAC1C,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;EACnD;EACA,EAAE,OAAO,qBAAqB,OAAO,GAAG,CAAC;EACzC,EAAE,OAAO,yBAAyB,OAAO,KAAK,IAAI,GAAG,MAAM,MAAM,KAAK,CAAC,CAAC;EACxE,MAAM,KAAK;CACb;AACF"}
+{"version":3,"file":"rate-limit.mjs","names":[],"sources":["../../src/middleware/rate-limit.ts"],"sourcesContent":["import type { Context, MiddlewareHandler } from \"hono\";\n\ninterface RateLimitEntry {\n  count: number;\n  resetAt: number;\n}\n\nexport interface RateLimitOptions {\n  windowMs: number;\n  max: number;\n  keyGenerator?: (c: Context) => string;\n}\n\n/** Direct peer IP from server runtimes exposing the socket (unspoofable TCP source). */\nfunction peerIp(c: Pick<Context, \"env\">): string | undefined {\n  const env = (c.env ?? {}) as {\n    incoming?: { socket?: { remoteAddress?: unknown } };\n    server?: { incoming?: { socket?: { remoteAddress?: unknown } } };\n  };\n  const address =\n    env.incoming?.socket?.remoteAddress ?? env.server?.incoming?.socket?.remoteAddress;\n  return typeof address === \"string\" && address ? address : undefined;\n}\n\n/**\n * Rate-limit identity for one bucket prefix: direct peer first, then the\n * first `X-Forwarded-For` entry (client-controlled, so only a fallback),\n * then `X-Real-IP`, then a shared bucket. Deployments behind proxies with\n * many users behind one peer IP share that peer's budget.\n */\nexport function rateLimitKey(prefix: string): (c: Context) => string {\n  return (c) => {\n    const peer = peerIp(c);\n    if (peer) {\n      return `${prefix}:${peer}`;\n    }\n    const forwarded = c.req.header(\"x-forwarded-for\")?.split(\",\")[0]?.trim();\n    if (forwarded) {\n      return `${prefix}:fwd:${forwarded}`;\n    }\n    const real = c.req.header(\"x-real-ip\")?.trim();\n    if (real) {\n      return `${prefix}:fwd:${real}`;\n    }\n    return `${prefix}:anonymous`;\n  };\n}\n\n/** Cap tracked buckets (spoofed keys would otherwise grow the map forever). */\nconst MAX_BUCKETS = 10_000;\nconst SWEEP_INTERVAL_MS = 60_000;\n\n/**\n * Create a rate limiter with its own bucket store, so each app instance\n * counts independently. Limiters built from the same `rateLimit` factory that\n * resolve to the same key share one counter (e.g. `/api/v1/*` and\n * `/api/v1/tokens/*` both bill the caller's `api:` bucket).\n */\nexport function createRateLimiter(): (options: RateLimitOptions) => MiddlewareHandler {\n  const stores = new Map<string, RateLimitEntry>();\n  let lastSweep = Date.now();\n\n  const sweep = (now: number): void => {\n    lastSweep = now;\n    for (const [key, entry] of stores) {\n      if (now > entry.resetAt) {\n        stores.delete(key);\n      }\n    }\n  };\n\n  return (options) => {\n    const { windowMs, max, keyGenerator } = options;\n    return async (c, next) => {\n      const key = keyGenerator ? keyGenerator(c) : rateLimitKey(\"api\")(c);\n      const now = Date.now();\n      if (now - lastSweep > SWEEP_INTERVAL_MS) {\n        sweep(now);\n      }\n      let entry = stores.get(key);\n      if (!entry || now > entry.resetAt) {\n        entry = { count: 0, resetAt: now + windowMs };\n        if (stores.size >= MAX_BUCKETS) {\n          const oldest = stores.keys().next();\n          if (!oldest.done) {\n            stores.delete(oldest.value);\n          }\n        }\n        stores.set(key, entry);\n      }\n      entry.count += 1;\n      if (entry.count > max) {\n        c.header(\"Retry-After\", String(Math.ceil((entry.resetAt - now) / 1000)));\n        return c.json({ error: \"Too many requests\" }, 429);\n      }\n      c.header(\"X-RateLimit-Limit\", String(max));\n      c.header(\"X-RateLimit-Remaining\", String(Math.max(0, max - entry.count)));\n      return await next();\n    };\n  };\n}\n"],"mappings":";;;;;AAcA,SAAS,OAAO,GAA6C;CAC3D,MAAM,MAAO,EAAE,OAAO,CAAC;CAIvB,MAAM,UACJ,IAAI,UAAU,QAAQ,iBAAiB,IAAI,QAAQ,UAAU,QAAQ;CACvE,OAAO,OAAO,YAAY,YAAY,UAAU,UAAU,KAAA;AAC5D;;;;;;;AAQA,SAAgB,aAAa,QAAwC;CACnE,QAAQ,MAAM;EACZ,MAAM,OAAO,OAAO,CAAC;EACrB,IAAI,MACF,OAAO,GAAG,OAAO,GAAG;EAEtB,MAAM,YAAY,EAAE,IAAI,OAAO,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK;EACvE,IAAI,WACF,OAAO,GAAG,OAAO,OAAO;EAE1B,MAAM,OAAO,EAAE,IAAI,OAAO,WAAW,CAAC,EAAE,KAAK;EAC7C,IAAI,MACF,OAAO,GAAG,OAAO,OAAO;EAE1B,OAAO,GAAG,OAAO;CACnB;AACF;;AAGA,MAAM,cAAc;AACpB,MAAM,oBAAoB;;;;;;;AAQ1B,SAAgB,oBAAsE;CACpF,MAAM,yBAAS,IAAI,IAA4B;CAC/C,IAAI,YAAY,KAAK,IAAI;CAEzB,MAAM,SAAS,QAAsB;EACnC,YAAY;EACZ,KAAK,MAAM,CAAC,KAAK,UAAU,QACzB,IAAI,MAAM,MAAM,SACd,OAAO,OAAO,GAAG;CAGvB;CAEA,QAAQ,YAAY;EAClB,MAAM,EAAE,UAAU,KAAK,iBAAiB;EACxC,OAAO,OAAO,GAAG,SAAS;GACxB,MAAM,MAAM,eAAe,aAAa,CAAC,IAAI,aAAa,KAAK,CAAC,CAAC,CAAC;GAClE,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,MAAM,YAAY,mBACpB,MAAM,GAAG;GAEX,IAAI,QAAQ,OAAO,IAAI,GAAG;GAC1B,IAAI,CAAC,SAAS,MAAM,MAAM,SAAS;IACjC,QAAQ;KAAE,OAAO;KAAG,SAAS,MAAM;IAAS;IAC5C,IAAI,OAAO,QAAQ,aAAa;KAC9B,MAAM,SAAS,OAAO,KAAK,CAAC,CAAC,KAAK;KAClC,IAAI,CAAC,OAAO,MACV,OAAO,OAAO,OAAO,KAAK;IAE9B;IACA,OAAO,IAAI,KAAK,KAAK;GACvB;GACA,MAAM,SAAS;GACf,IAAI,MAAM,QAAQ,KAAK;IACrB,EAAE,OAAO,eAAe,OAAO,KAAK,MAAM,MAAM,UAAU,OAAO,GAAI,CAAC,CAAC;IACvE,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;GACnD;GACA,EAAE,OAAO,qBAAqB,OAAO,GAAG,CAAC;GACzC,EAAE,OAAO,yBAAyB,OAAO,KAAK,IAAI,GAAG,MAAM,MAAM,KAAK,CAAC,CAAC;GACxE,OAAO,MAAM,KAAK;EACpB;CACF;AACF"}

package/dist/middleware/request-log.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { redactSecrets } from "@storyshelf/core/utils";
 //#region src/middleware/request-log.ts
 /** Hono middleware logging request start/end with duration. */
 function requestLogging(logger) {
@@ -10,14 +11,14 @@ function requestLogging(logger) {
 		logger.info({
 			reqId: id,
 			method: c.req.method,
-			url: c.req.path
+			url: redactSecrets(c.req.path)
 		}, "request start");
 		await next();
 		const userId = c.get("userId");
 		logger.info({
 			reqId: id,
 			method: c.req.method,
-			url: c.req.path,
+			url: redactSecrets(c.req.path),
 			status: c.res.status,
 			durationMs: Math.round(performance.now() - started),
 			...userId ? { userId } : {}

package/dist/middleware/request-log.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request-log.mjs","names":[],"sources":["../../src/middleware/request-log.ts"],"sourcesContent":["import type { Logger } from \"@storyshelf/core/logger\";\nimport type { Context, Next } from \"hono\";\n\n/** Hono middleware logging request start/end with duration. */\nexport function requestLogging(logger: Logger) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const started = performance.now();\n    const id = c.get(\"requestId\");\n    logger.info({ reqId: id, method: c.req.method, url: c.req.path }, \"request start\");\n    await next();\n    const userId = c.get(\"userId\") as string | null | undefined;\n    logger.info(\n      {\n        reqId: id,\n        method: c.req.method,\n        url: c.req.path,\n        status: c.res.status,\n        durationMs: Math.round(performance.now() - started),\n        ...(userId ? { userId } : {}),\n      },\n      \"request end\",\n    );\n  };\n}\n"],"mappings":";;;;;AAIA,SAAgB,eAAe,QAAgB;CAE7C,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,UAAU,YAAY,IAAI;EAChC,MAAM,KAAK,EAAE,IAAI,WAAW;EAC5B,OAAO,KAAK;GAAE,OAAO;GAAI,QAAQ,EAAE,IAAI;GAAQ,KAAK,EAAE,IAAI;EAAK,GAAG,eAAe;EACjF,MAAM,KAAK;EACX,MAAM,SAAS,EAAE,IAAI,QAAQ;EAC7B,OAAO,KACL;GACE,OAAO;GACP,QAAQ,EAAE,IAAI;GACd,KAAK,EAAE,IAAI;GACX,QAAQ,EAAE,IAAI;GACd,YAAY,KAAK,MAAM,YAAY,IAAI,IAAI,OAAO;GAClD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC7B,GACA,aACF;CACF;AACF"}
+{"version":3,"file":"request-log.mjs","names":[],"sources":["../../src/middleware/request-log.ts"],"sourcesContent":["import type { Logger } from \"@storyshelf/core/logger\";\nimport { redactSecrets } from \"@storyshelf/core/utils\";\nimport type { Context, Next } from \"hono\";\n\n/** Hono middleware logging request start/end with duration. */\nexport function requestLogging(logger: Logger) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const started = performance.now();\n    const id = c.get(\"requestId\");\n    logger.info(\n      { reqId: id, method: c.req.method, url: redactSecrets(c.req.path) },\n      \"request start\",\n    );\n    await next();\n    const userId = c.get(\"userId\") as string | null | undefined;\n    logger.info(\n      {\n        reqId: id,\n        method: c.req.method,\n        url: redactSecrets(c.req.path),\n        status: c.res.status,\n        durationMs: Math.round(performance.now() - started),\n        ...(userId ? { userId } : {}),\n      },\n      \"request end\",\n    );\n  };\n}\n"],"mappings":";;;;;;AAKA,SAAgB,eAAe,QAAgB;CAE7C,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,UAAU,YAAY,IAAI;EAChC,MAAM,KAAK,EAAE,IAAI,WAAW;EAC5B,OAAO,KACL;GAAE,OAAO;GAAI,QAAQ,EAAE,IAAI;GAAQ,KAAK,cAAc,EAAE,IAAI,IAAI;EAAE,GAClE,eACF;EACA,MAAM,KAAK;EACX,MAAM,SAAS,EAAE,IAAI,QAAQ;EAC7B,OAAO,KACL;GACE,OAAO;GACP,QAAQ,EAAE,IAAI;GACd,KAAK,cAAc,EAAE,IAAI,IAAI;GAC7B,QAAQ,EAAE,IAAI;GACd,YAAY,KAAK,MAAM,YAAY,IAAI,IAAI,OAAO;GAClD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC7B,GACA,aACF;CACF;AACF"}

package/dist/middleware/require-review.mjs

@@ -0,0 +1,51 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { matchedRouteClass } from "./require-testing.mjs";
+import { resolveAuthorizedProject } from "../routers/helpers.mjs";
+//#region src/middleware/require-review.ts
+/** Body of the 404 a `review` route answers for a project with review off. */
+const REVIEW_DISABLED_MESSAGE = "Review is off for this project.";
+/** Roles that may see a project's routes at all; the gate answers only to them. */
+const VIEWER_ROLES = [
+	"viewer",
+	"developer",
+	"approver",
+	"admin"
+];
+/** The project slug of `/api/v1/projects/:slug/...` and `/projects/:slug/...` paths. */
+function projectSlugOf(path) {
+	return /^(?:\/api\/v1)?\/projects\/(?<slug>[^/]+)\//u.exec(path)?.groups?.["slug"];
+}
+/**
+* Gate routes classified `review` (ADR 0013, decision 10): they answer 404 for a project that has
+* review off, as if they did not exist. The switch is read from the database on every request, so
+* turning review off or on takes effect at once. Only a caller who may view the project is told
+* (anyone else gets the route's own refusal), so the gate reveals nothing about a project the
+* caller cannot see. It runs after the store scope and the auth gate, which it needs to resolve
+* the caller; routes of other classes, and unknown projects, pass through.
+*/
+function requireReview() {
+	return async (c, next) => {
+		if (matchedRouteClass(c) !== "review" || !await reviewIsOff(c)) {
+			await next();
+			return;
+		}
+		if (c.req.path.startsWith("/api/")) return c.json({ error: REVIEW_DISABLED_MESSAGE }, 404);
+		return c.text(REVIEW_DISABLED_MESSAGE, 404);
+	};
+}
+/** Whether the request names a project the caller may view and whose review switch is off. */
+async function reviewIsOff(c) {
+	const slug = projectSlugOf(c.req.path);
+	if (slug === void 0) return false;
+	try {
+		return (await resolveAuthorizedProject(c, slug, ...VIEWER_ROLES)).reviewEnabled === false;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { REVIEW_DISABLED_MESSAGE, requireReview };
+
+//# sourceMappingURL=require-review.mjs.map

package/dist/middleware/require-review.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-review.mjs","names":[],"sources":["../../src/middleware/require-review.ts"],"sourcesContent":["import type { Context, Next } from \"hono\";\nimport { resolveAuthorizedProject } from \"../routers/helpers.ts\";\nimport { matchedRouteClass } from \"./require-testing.ts\";\n\n/** Body of the 404 a `review` route answers for a project with review off. */\nexport const REVIEW_DISABLED_MESSAGE = \"Review is off for this project.\";\n\n/** Roles that may see a project's routes at all; the gate answers only to them. */\nconst VIEWER_ROLES = [\"viewer\", \"developer\", \"approver\", \"admin\"] as const;\n\n/** The project slug of `/api/v1/projects/:slug/...` and `/projects/:slug/...` paths. */\nfunction projectSlugOf(path: string): string | undefined {\n  return /^(?:\\/api\\/v1)?\\/projects\\/(?<slug>[^/]+)\\//u.exec(path)?.groups?.[\"slug\"];\n}\n\n/**\n * Gate routes classified `review` (ADR 0013, decision 10): they answer 404 for a project that has\n * review off, as if they did not exist. The switch is read from the database on every request, so\n * turning review off or on takes effect at once. Only a caller who may view the project is told\n * (anyone else gets the route's own refusal), so the gate reveals nothing about a project the\n * caller cannot see. It runs after the store scope and the auth gate, which it needs to resolve\n * the caller; routes of other classes, and unknown projects, pass through.\n */\nexport function requireReview() {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    if (matchedRouteClass(c) !== \"review\" || !(await reviewIsOff(c))) {\n      await next();\n      return;\n    }\n    if (c.req.path.startsWith(\"/api/\")) {\n      return c.json({ error: REVIEW_DISABLED_MESSAGE }, 404);\n    }\n    return c.text(REVIEW_DISABLED_MESSAGE, 404);\n  };\n}\n\n/** Whether the request names a project the caller may view and whose review switch is off. */\nasync function reviewIsOff(c: Context): Promise<boolean> {\n  const slug = projectSlugOf(c.req.path);\n  if (slug === undefined) {\n    return false;\n  }\n  try {\n    const project = await resolveAuthorizedProject(c, slug, ...VIEWER_ROLES);\n    return project.reviewEnabled === false;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;AAKA,MAAa,0BAA0B;;AAGvC,MAAM,eAAe;CAAC;CAAU;CAAa;CAAY;AAAO;;AAGhE,SAAS,cAAc,MAAkC;CACvD,OAAO,+CAA+C,KAAK,IAAI,CAAC,EAAE,SAAS;AAC7E;;;;;;;;;AAUA,SAAgB,gBAAgB;CAE9B,OAAO,OAAO,GAAY,SAAyC;EACjE,IAAI,kBAAkB,CAAC,MAAM,YAAY,CAAE,MAAM,YAAY,CAAC,GAAI;GAChE,MAAM,KAAK;GACX;EACF;EACA,IAAI,EAAE,IAAI,KAAK,WAAW,OAAO,GAC/B,OAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,GAAG,GAAG;EAEvD,OAAO,EAAE,KAAK,yBAAyB,GAAG;CAC5C;AACF;;AAGA,eAAe,YAAY,GAA8B;CACvD,MAAM,OAAO,cAAc,EAAE,IAAI,IAAI;CACrC,IAAI,SAAS,KAAA,GACX,OAAO;CAET,IAAI;EAEF,QAAO,MADe,yBAAyB,GAAG,MAAM,GAAG,YAAY,EAAA,CACxD,kBAAkB;CACnC,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/middleware/require-testing.mjs

@@ -0,0 +1,41 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { classOfRoute } from "../routes/classification.mjs";
+import { matchedRoutes } from "hono/route";
+//#region src/middleware/require-testing.ts
+/** Body of the 404 a `testing` route answers on a hosting-only instance. */
+const TESTING_DISABLED_MESSAGE = "Testing is not enabled on this instance.";
+/**
+* Gate routes classified `testing` (ADR 0006, decisions 1 and 8): without `options.testing` they
+* answer 404, as if the feature did not exist. The class comes from the route table through the
+* handler Hono matched, so a new route needs no guard of its own, only a table entry. It is mounted
+* before the CSRF and rate-limit guards so a hidden route answers the same 404 for every request. `hosting`,
+* `both` and `review` routes, and requests that match no classified route, pass through.
+*/
+function requireTesting(enabled) {
+	return async (c, next) => {
+		if (enabled || !isTestingRoute(c)) {
+			await next();
+			return;
+		}
+		if (c.req.path.startsWith("/api/")) return c.json({ error: TESTING_DISABLED_MESSAGE }, 404);
+		return c.text(TESTING_DISABLED_MESSAGE, 404);
+	};
+}
+/** The last matched handler that the table classifies (middleware matches come first). */
+function matchedRouteClass(c) {
+	const routes = matchedRoutes(c);
+	for (let index = routes.length - 1; index >= 0; index -= 1) {
+		const route = routes[index];
+		const routeClass = route && classOfRoute(route.method, route.path);
+		if (routeClass !== void 0) return routeClass;
+	}
+}
+function isTestingRoute(c) {
+	return matchedRouteClass(c) === "testing";
+}
+//#endregion
+export { TESTING_DISABLED_MESSAGE, matchedRouteClass, requireTesting };
+
+//# sourceMappingURL=require-testing.mjs.map

package/dist/middleware/require-testing.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-testing.mjs","names":[],"sources":["../../src/middleware/require-testing.ts"],"sourcesContent":["import type { Context, Next } from \"hono\";\nimport { matchedRoutes } from \"hono/route\";\nimport { classOfRoute, type RouteClass } from \"../routes/classification.ts\";\n\n/** Body of the 404 a `testing` route answers on a hosting-only instance. */\nexport const TESTING_DISABLED_MESSAGE = \"Testing is not enabled on this instance.\";\n\n/**\n * Gate routes classified `testing` (ADR 0006, decisions 1 and 8): without `options.testing` they\n * answer 404, as if the feature did not exist. The class comes from the route table through the\n * handler Hono matched, so a new route needs no guard of its own, only a table entry. It is mounted\n * before the CSRF and rate-limit guards so a hidden route answers the same 404 for every request. `hosting`,\n * `both` and `review` routes, and requests that match no classified route, pass through.\n */\nexport function requireTesting(enabled: boolean) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    if (enabled || !isTestingRoute(c)) {\n      await next();\n      return;\n    }\n    if (c.req.path.startsWith(\"/api/\")) {\n      return c.json({ error: TESTING_DISABLED_MESSAGE }, 404);\n    }\n    return c.text(TESTING_DISABLED_MESSAGE, 404);\n  };\n}\n\n/** The last matched handler that the table classifies (middleware matches come first). */\nexport function matchedRouteClass(c: Context): RouteClass | undefined {\n  const routes = matchedRoutes(c);\n  for (let index = routes.length - 1; index >= 0; index -= 1) {\n    const route = routes[index];\n    const routeClass = route && classOfRoute(route.method, route.path);\n    if (routeClass !== undefined) {\n      return routeClass;\n    }\n  }\n  return undefined;\n}\n\nfunction isTestingRoute(c: Context): boolean {\n  return matchedRouteClass(c) === \"testing\";\n}\n"],"mappings":";;;;;;;AAKA,MAAa,2BAA2B;;;;;;;;AASxC,SAAgB,eAAe,SAAkB;CAE/C,OAAO,OAAO,GAAY,SAAyC;EACjE,IAAI,WAAW,CAAC,eAAe,CAAC,GAAG;GACjC,MAAM,KAAK;GACX;EACF;EACA,IAAI,EAAE,IAAI,KAAK,WAAW,OAAO,GAC/B,OAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,GAAG,GAAG;EAExD,OAAO,EAAE,KAAK,0BAA0B,GAAG;CAC7C;AACF;;AAGA,SAAgB,kBAAkB,GAAoC;CACpE,MAAM,SAAS,cAAc,CAAC;CAC9B,KAAK,IAAI,QAAQ,OAAO,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG;EAC1D,MAAM,QAAQ,OAAO;EACrB,MAAM,aAAa,SAAS,aAAa,MAAM,QAAQ,MAAM,IAAI;EACjE,IAAI,eAAe,KAAA,GACjB,OAAO;CAEX;AAEF;AAEA,SAAS,eAAe,GAAqB;CAC3C,OAAO,kBAAkB,CAAC,MAAM;AAClC"}

package/dist/middleware/setup-gate.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"setup-gate.mjs","names":[],"sources":["../../src/middleware/setup-gate.ts"],"sourcesContent":["import type { AdapterSetupResult } from \"@storyshelf/core/adapter/setup\";\nimport type { ShelfOptions } from \"@storyshelf/core/config\";\nimport { sanitizeErrorText } from \"@storyshelf/core/utils\";\nimport type { Context, Next } from \"hono\";\nimport type { QueueWiring } from \"../capture-setup.ts\";\nimport type { ServerRuntime } from \"../runtime.ts\";\n\nexport interface MiddlewareWiring extends ServerRuntime, QueueWiring {\n  options: ShelfOptions;\n  getReady: () => Promise<AdapterSetupResult>;\n}\n\n/** Failures safe to expose on the setup gate's 503 (redacted, no secrets). */\nfunction publicFailures(\n  result: AdapterSetupResult,\n): { category: string; kind: string; error: string }[] {\n  return result.failures.map((failure) => ({\n    category: failure.category,\n    kind: failure.kind,\n    error: sanitizeErrorText(failure.error, 500),\n  }));\n}\n\n/**\n * Block requests until adapter setup settles; answer 503 with the per-adapter\n * failures when setup failed. Health probes and the admin System page are\n * exempt (they report setup state themselves instead of being masked by\n * the gate — both are site-admin-gated where it matters).\n */\nexport function setupGate(getReady: () => Promise<AdapterSetupResult>) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    if (c.req.path === \"/api/v1/health\" || c.req.path === \"/admin\") {\n      await next();\n      return;\n    }\n    const result = await getReady();\n    if (!result.ok) {\n      return c.json({ error: \"Adapters failed setup\", failures: publicFailures(result) }, 503);\n    }\n    await next();\n  };\n}\n"],"mappings":";;;;;;AAaA,SAAS,eACP,QACqD;CACrD,OAAO,OAAO,SAAS,KAAK,aAAa;EACvC,UAAU,QAAQ;EAClB,MAAM,QAAQ;EACd,OAAO,kBAAkB,QAAQ,OAAO,GAAG;CAC7C,EAAE;AACJ;;;;;;;AAQA,SAAgB,UAAU,UAA6C;CAErE,OAAO,OAAO,GAAY,SAAyC;EACjE,IAAI,EAAE,IAAI,SAAS,oBAAoB,EAAE,IAAI,SAAS,UAAU;GAC9D,MAAM,KAAK;GACX;EACF;EACA,MAAM,SAAS,MAAM,SAAS;EAC9B,IAAI,CAAC,OAAO,IACV,OAAO,EAAE,KAAK;GAAE,OAAO;GAAyB,UAAU,eAAe,MAAM;EAAE,GAAG,GAAG;EAEzF,MAAM,KAAK;CACb;AACF"}
+{"version":3,"file":"setup-gate.mjs","names":[],"sources":["../../src/middleware/setup-gate.ts"],"sourcesContent":["import type { AdapterSetupResult } from \"@storyshelf/core/adapter/setup\";\nimport type { ShelfOptions } from \"@storyshelf/core/config\";\nimport { sanitizeErrorText } from \"@storyshelf/core/utils\";\nimport type { Context, Next } from \"hono\";\nimport type { JobsWiring } from \"../jobs-setup.ts\";\nimport type { ServerRuntime } from \"../runtime.ts\";\n\nexport interface MiddlewareWiring extends ServerRuntime, Omit<JobsWiring, \"consumer\"> {\n  options: ShelfOptions;\n  getReady: () => Promise<AdapterSetupResult>;\n}\n\n/** Failures safe to expose on the setup gate's 503 (redacted, no secrets). */\nfunction publicFailures(\n  result: AdapterSetupResult,\n): { category: string; kind: string; error: string }[] {\n  return result.failures.map((failure) => ({\n    category: failure.category,\n    kind: failure.kind,\n    error: sanitizeErrorText(failure.error, 500),\n  }));\n}\n\n/**\n * Block requests until adapter setup settles; answer 503 with the per-adapter\n * failures when setup failed. Health probes and the admin System page are\n * exempt (they report setup state themselves instead of being masked by\n * the gate — both are site-admin-gated where it matters).\n */\nexport function setupGate(getReady: () => Promise<AdapterSetupResult>) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    if (c.req.path === \"/api/v1/health\" || c.req.path === \"/admin\") {\n      await next();\n      return;\n    }\n    const result = await getReady();\n    if (!result.ok) {\n      return c.json({ error: \"Adapters failed setup\", failures: publicFailures(result) }, 503);\n    }\n    await next();\n  };\n}\n"],"mappings":";;;;;;AAaA,SAAS,eACP,QACqD;CACrD,OAAO,OAAO,SAAS,KAAK,aAAa;EACvC,UAAU,QAAQ;EAClB,MAAM,QAAQ;EACd,OAAO,kBAAkB,QAAQ,OAAO,GAAG;CAC7C,EAAE;AACJ;;;;;;;AAQA,SAAgB,UAAU,UAA6C;CAErE,OAAO,OAAO,GAAY,SAAyC;EACjE,IAAI,EAAE,IAAI,SAAS,oBAAoB,EAAE,IAAI,SAAS,UAAU;GAC9D,MAAM,KAAK;GACX;EACF;EACA,MAAM,SAAS,MAAM,SAAS;EAC9B,IAAI,CAAC,OAAO,IACV,OAAO,EAAE,KAAK;GAAE,OAAO;GAAyB,UAAU,eAAe,MAAM;EAAE,GAAG,GAAG;EAEzF,MAAM,KAAK;CACb;AACF"}

package/dist/middleware/store-scope.mjs

@@ -17,11 +17,21 @@ function storeScope(deps) {
 			logger: deps.logger,
 			user,
 			authEnabled: deps.authEnabled,
+			testing: deps.testing,
 			sessionId: sessionIdFrom(c),
 			enqueueCapture: deps.enqueueCapture,
 			captureQueue: deps.captureQueue,
-			gitHosts: deps.gitHosts,
-			notifiers: deps.notifiers
+			capturesHere: deps.capturesHere,
+			publish: deps.publish,
+			cancelBuildJobs: deps.cancelBuildJobs,
+			buildState: deps.buildState,
+			captureConcurrency: deps.captureConcurrency,
+			runner: deps.runner,
+			publicOrigin: deps.publicOrigin,
+			design: deps.design,
+			notifiers: deps.notifiers,
+			notificationsConfig: deps.notificationsConfig,
+			ai: deps.ai
 		}, async () => {
 			await next();
 		});

package/dist/middleware/store-scope.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"store-scope.mjs","names":[],"sources":["../../src/middleware/store-scope.ts"],"sourcesContent":["import type { CaptureQueue } from \"@storyshelf/core/adapter/capture-queue\";\nimport type { DatabaseAdapter } from \"@storyshelf/core/adapter/database\";\nimport type { GitHostProvider } from \"@storyshelf/core/adapter/git-host\";\nimport type { NotifierProvider } from \"@storyshelf/core/adapter/notifier\";\nimport type { StorageAdapter } from \"@storyshelf/core/adapter/storage\";\nimport type { ShelfConfig, UIConfig } from \"@storyshelf/core/config\";\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport type { AuthUser } from \"@storyshelf/core/types\";\nimport type { Context, Next } from \"hono\";\nimport { runWithStore } from \"../store.ts\";\nimport { sessionIdFrom } from \"./csrf.ts\";\n\n/** Dependencies scoped into the request store for router handlers. */\nexport interface StoreScopeDeps {\n  db: DatabaseAdapter;\n  storage: StorageAdapter;\n  config: ShelfConfig;\n  ui: UIConfig;\n  logger: Logger;\n  authEnabled: boolean;\n  enqueueCapture?: (buildId: string, reqId?: string) => Promise<void>;\n  captureQueue: CaptureQueue | null;\n  gitHosts: GitHostProvider[];\n  notifiers: NotifierProvider[];\n  resolveUser: (c: Context) => Promise<AuthUser | null>;\n}\n\n/** Hono middleware running downstream handlers inside the request store. */\nexport function storeScope(deps: StoreScopeDeps) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const user = await deps.resolveUser(c);\n    c.set(\"userId\", user?.id ?? null);\n    await runWithStore(\n      {\n        db: deps.db,\n        storage: deps.storage,\n        config: deps.config,\n        ui: deps.ui,\n        logger: deps.logger,\n        user,\n        authEnabled: deps.authEnabled,\n        sessionId: sessionIdFrom(c),\n        enqueueCapture: deps.enqueueCapture,\n        captureQueue: deps.captureQueue,\n        gitHosts: deps.gitHosts,\n        notifiers: deps.notifiers,\n      },\n      async () => {\n        await next();\n      },\n    );\n  };\n}\n"],"mappings":";;;;;;;AA4BA,SAAgB,WAAW,MAAsB;CAE/C,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,OAAO,MAAM,KAAK,YAAY,CAAC;EACrC,EAAE,IAAI,UAAU,MAAM,MAAM,IAAI;EAChC,MAAM,aACJ;GACE,IAAI,KAAK;GACT,SAAS,KAAK;GACd,QAAQ,KAAK;GACb,IAAI,KAAK;GACT,QAAQ,KAAK;GACb;GACA,aAAa,KAAK;GAClB,WAAW,cAAc,CAAC;GAC1B,gBAAgB,KAAK;GACrB,cAAc,KAAK;GACnB,UAAU,KAAK;GACf,WAAW,KAAK;EAClB,GACA,YAAY;GACV,MAAM,KAAK;EACb,CACF;CACF;AACF"}
+{"version":3,"file":"store-scope.mjs","names":[],"sources":["../../src/middleware/store-scope.ts"],"sourcesContent":["import type { CaptureQueue } from \"@storyshelf/core/adapter/capture-queue\";\nimport type { CaptureRunner } from \"@storyshelf/core/adapter/capture-runner\";\nimport type { DatabaseAdapter } from \"@storyshelf/core/adapter/database\";\nimport type { DesignProvider } from \"@storyshelf/core/adapter/design\";\nimport type { NotifierProvider } from \"@storyshelf/core/adapter/notifier\";\nimport type { StorageAdapter } from \"@storyshelf/core/adapter/storage\";\nimport type { Ai } from \"@storyshelf/core/ai\";\nimport type { BuildStatePublisher } from \"@storyshelf/core/capture\";\nimport type { NotificationsConfig, ShelfConfig, UIConfig } from \"@storyshelf/core/config\";\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport type { PublicOriginResolver } from \"@storyshelf/core/models\";\nimport type { AuthUser } from \"@storyshelf/core/types\";\nimport type { Context, Next } from \"hono\";\nimport type { PublishService } from \"../publish-setup.ts\";\nimport { runWithStore } from \"../store.ts\";\nimport { sessionIdFrom } from \"./csrf.ts\";\n\n/** Dependencies scoped into the request store for router handlers. */\nexport interface StoreScopeDeps {\n  db: DatabaseAdapter;\n  storage: StorageAdapter;\n  config: ShelfConfig;\n  ui: UIConfig;\n  logger: Logger;\n  authEnabled: boolean;\n  testing: boolean;\n  enqueueCapture?: (buildId: string, reqId?: string) => Promise<void>;\n  captureQueue: CaptureQueue | null;\n  /** This instance runs the capture jobs itself (the retry and compute-jobs UI applies). */\n  capturesHere?: boolean;\n  publish?: PublishService;\n  cancelBuildJobs?: (buildId: string) => Promise<boolean>;\n  buildState?: BuildStatePublisher;\n  captureConcurrency?: number;\n  runner?: Pick<CaptureRunner, \"metadata\"> | undefined;\n  publicOrigin?: PublicOriginResolver | undefined;\n  design: DesignProvider[];\n  notifiers: NotifierProvider[];\n  notificationsConfig?: NotificationsConfig;\n  ai?: Ai;\n  resolveUser: (c: Context) => Promise<AuthUser | null>;\n}\n\n/** Hono middleware running downstream handlers inside the request store. */\nexport function storeScope(deps: StoreScopeDeps) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const user = await deps.resolveUser(c);\n    c.set(\"userId\", user?.id ?? null);\n    await runWithStore(\n      {\n        db: deps.db,\n        storage: deps.storage,\n        config: deps.config,\n        ui: deps.ui,\n        logger: deps.logger,\n        user,\n        authEnabled: deps.authEnabled,\n        testing: deps.testing,\n        sessionId: sessionIdFrom(c),\n        enqueueCapture: deps.enqueueCapture,\n        captureQueue: deps.captureQueue,\n        capturesHere: deps.capturesHere,\n        publish: deps.publish,\n        cancelBuildJobs: deps.cancelBuildJobs,\n        buildState: deps.buildState,\n        captureConcurrency: deps.captureConcurrency,\n        runner: deps.runner,\n        publicOrigin: deps.publicOrigin,\n        design: deps.design,\n        notifiers: deps.notifiers,\n        notificationsConfig: deps.notificationsConfig,\n        ai: deps.ai,\n      },\n      async () => {\n        await next();\n      },\n    );\n  };\n}\n"],"mappings":";;;;;;;AA4CA,SAAgB,WAAW,MAAsB;CAE/C,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,OAAO,MAAM,KAAK,YAAY,CAAC;EACrC,EAAE,IAAI,UAAU,MAAM,MAAM,IAAI;EAChC,MAAM,aACJ;GACE,IAAI,KAAK;GACT,SAAS,KAAK;GACd,QAAQ,KAAK;GACb,IAAI,KAAK;GACT,QAAQ,KAAK;GACb;GACA,aAAa,KAAK;GAClB,SAAS,KAAK;GACd,WAAW,cAAc,CAAC;GAC1B,gBAAgB,KAAK;GACrB,cAAc,KAAK;GACnB,cAAc,KAAK;GACnB,SAAS,KAAK;GACd,iBAAiB,KAAK;GACtB,YAAY,KAAK;GACjB,oBAAoB,KAAK;GACzB,QAAQ,KAAK;GACb,cAAc,KAAK;GACnB,QAAQ,KAAK;GACb,WAAW,KAAK;GAChB,qBAAqB,KAAK;GAC1B,IAAI,KAAK;EACX,GACA,YAAY;GACV,MAAM,KAAK;EACb,CACF;CACF;AACF"}

package/dist/notifications-pause.mjs

@@ -0,0 +1,33 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "./store.mjs";
+//#region src/notifications-pause.ts
+/** What the System page and the notification settings tell the viewer. */
+const NOTIFICATIONS_PAUSED_TEXT = "Notifications are paused until a public URL is set; set PUBLIC_BASE_URL or confirm the detected origin.";
+/** The origin notifications link to, or `undefined` while none is resolved. */
+async function notificationOrigin(deps) {
+	const trimmed = (deps.publicOrigin ? await deps.publicOrigin.url() : deps.config.publicBaseUrl)?.trim().replace(/\/+$/u, "");
+	return trimmed === void 0 || trimmed === "" ? void 0 : trimmed;
+}
+/** Whether the current instance sends no notifications for want of a public origin. */
+async function notificationsPaused(store = getStore()) {
+	return await notificationOrigin(store) === void 0;
+}
+/** Loggers that already said so; cleared when an origin resolves, so a later pause logs again. */
+const warned = /* @__PURE__ */ new WeakSet();
+/** Log (once per pause, per logger) that a notification was skipped. */
+function warnPaused(logger, event) {
+	if (!warned.has(logger)) {
+		warned.add(logger);
+		logger.warn({ event }, `${NOTIFICATIONS_PAUSED_TEXT} Skipping notifications.`);
+	}
+}
+/** Forget a logged pause: an origin resolved. */
+function clearPaused(logger) {
+	warned.delete(logger);
+}
+//#endregion
+export { NOTIFICATIONS_PAUSED_TEXT, clearPaused, notificationOrigin, notificationsPaused, warnPaused };
+
+//# sourceMappingURL=notifications-pause.mjs.map

package/dist/notifications-pause.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications-pause.mjs","names":[],"sources":["../src/notifications-pause.ts"],"sourcesContent":["import type { ShelfConfig } from \"@storyshelf/core/config\";\n/**\n * Notifications need a public origin (ADR 0014, decision 11): every message carries a link and\n * every git status targets one, so while the resolver (ADR 0007, decision 6) finds no confirmed\n * origin (a detected one counts only once an admin confirmed it) nothing is sent. Pausing is not a failure: no channel is marked as errored, and the System page\n * and the notification settings say what to set.\n */\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport type { PublicOriginResolver } from \"@storyshelf/core/models\";\nimport { getStore, type Store } from \"./store.ts\";\n\n/** What the System page and the notification settings tell the viewer. */\nexport const NOTIFICATIONS_PAUSED_TEXT =\n  \"Notifications are paused until a public URL is set; set PUBLIC_BASE_URL or confirm the detected origin.\";\n\n/** What a pause check reads. */\ninterface OriginDeps {\n  config: Pick<ShelfConfig, \"publicBaseUrl\">;\n  /** The resolver; absent (hand-built stores) means `config.publicBaseUrl` only. */\n  publicOrigin?: Pick<PublicOriginResolver, \"url\"> | undefined;\n}\n\n/** The origin notifications link to, or `undefined` while none is resolved. */\nexport async function notificationOrigin(deps: OriginDeps): Promise<string | undefined> {\n  const origin = deps.publicOrigin ? await deps.publicOrigin.url() : deps.config.publicBaseUrl;\n  const trimmed = origin?.trim().replace(/\\/+$/u, \"\");\n  return trimmed === undefined || trimmed === \"\" ? undefined : trimmed;\n}\n\n/** Whether the current instance sends no notifications for want of a public origin. */\nexport async function notificationsPaused(store: Store = getStore()): Promise<boolean> {\n  return (await notificationOrigin(store)) === undefined;\n}\n\n/** Loggers that already said so; cleared when an origin resolves, so a later pause logs again. */\nconst warned = new WeakSet<object>();\n\n/** Log (once per pause, per logger) that a notification was skipped. */\nexport function warnPaused(logger: Logger, event: string): void {\n  if (!warned.has(logger)) {\n    warned.add(logger);\n    logger.warn({ event }, `${NOTIFICATIONS_PAUSED_TEXT} Skipping notifications.`);\n  }\n}\n\n/** Forget a logged pause: an origin resolved. */\nexport function clearPaused(logger: Logger): void {\n  warned.delete(logger);\n}\n"],"mappings":";;;;;;AAYA,MAAa,4BACX;;AAUF,eAAsB,mBAAmB,MAA+C;CAEtF,MAAM,WADS,KAAK,eAAe,MAAM,KAAK,aAAa,IAAI,IAAI,KAAK,OAAO,cAAA,EACvD,KAAK,CAAC,CAAC,QAAQ,SAAS,EAAE;CAClD,OAAO,YAAY,KAAA,KAAa,YAAY,KAAK,KAAA,IAAY;AAC/D;;AAGA,eAAsB,oBAAoB,QAAe,SAAS,GAAqB;CACrF,OAAQ,MAAM,mBAAmB,KAAK,MAAO,KAAA;AAC/C;;AAGA,MAAM,yBAAS,IAAI,QAAgB;;AAGnC,SAAgB,WAAW,QAAgB,OAAqB;CAC9D,IAAI,CAAC,OAAO,IAAI,MAAM,GAAG;EACvB,OAAO,IAAI,MAAM;EACjB,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,0BAA0B,yBAAyB;CAC/E;AACF;;AAGA,SAAgB,YAAY,QAAsB;CAChD,OAAO,OAAO,MAAM;AACtB"}

package/dist/notify.d.mts

@@ -1,7 +1,8 @@
 import __tsdown_shims_path from 'node:path';
 import __tsdown_shims_url from 'node:url';
-import { NotifierProvider } from "@storyshelf/core/adapter/notifier";
 import { ShelfConfig, UIConfig } from "@storyshelf/core/config";
+import "@storyshelf/core/models";
+import { NotifierProvider } from "@storyshelf/core/adapter/notifier";
 import { Logger } from "@storyshelf/core/logger";
 import { DatabaseAdapter } from "@storyshelf/core/adapter/database";
 import "@storyshelf/core/schema";

package/dist/notify.mjs

@@ -3,48 +3,56 @@ import "node:url";
 import.meta.url;
 import { credentialKeys } from "./credential-keys.mjs";
 import { getStore } from "./store.mjs";
-import { NotificationChannelModel, NotificationSubscriptionModel, UserModel } from "@storyshelf/core/models";
+import { clearPaused, notificationOrigin, warnPaused } from "./notifications-pause.mjs";
+import { MemberModel, NotificationChannelModel, NotificationSubscriptionModel, UserModel } from "@storyshelf/core/models";
 import { emitNotifications, emitSystemNotification } from "@storyshelf/core/adapter/notifier";
 //#region src/notify.ts
-/** Review URL from an explicit base URL (background use). */
-function reviewUrlForWith(publicBaseUrl, slug, suffix) {
-	const base = publicBaseUrl?.replace(/\/+$/u, "");
-	if (!base) return;
-	return `${base}/projects/${slug}${suffix}`;
-}
-/** Brand inputs from UI config plus server notification defaults. */
-function brandFor(ui, config, reviewUrl) {
+/** Absolute review URL for a project page under the resolved public origin. */
+function reviewUrlFor(origin, slug, suffix) {
+	return `${origin}/projects/${slug}${suffix}`;
+}
+/**
+* The origin notifications link to; `undefined` (after one log line per pause) while none is
+* resolved, which pauses every notification (ADR 0014, decision 11).
+*/
+async function originOrPause(deps, event) {
+	const origin = await notificationOrigin(deps);
+	if (origin === void 0) warnPaused(deps.logger, event);
+	else clearPaused(deps.logger);
+	return origin;
+}
+/** Brand inputs from UI config plus the notification sender settings. */
+function brandFor(ui, settings, reviewUrl) {
 	return {
 		name: ui.name,
 		logo: ui.logo,
 		reviewUrl,
-		fromEmail: config.notifications?.fromEmail,
-		fromName: config.notifications?.fromName ?? ui.name,
-		footerText: config.notifications?.footerText
-	};
-}
-/** Convert a stored row to a send-ready view (null when undecryptable). */
-function toView(row, model) {
-	let secret;
-	try {
-		secret = row.secretEncrypted ? model.decryptSecret(row) : void 0;
-	} catch {
-		return null;
-	}
-	return {
-		id: row.id,
-		projectId: row.projectId,
-		provider: row.provider,
-		config: NotificationChannelModel.configOf(row),
-		secret,
-		events: NotificationChannelModel.eventsOf(row),
-		enabled: row.enabled
+		fromEmail: settings?.fromEmail,
+		fromName: settings?.fromName ?? ui.name,
+		footerText: settings?.footerText
 	};
 }
 /** Load stored channels as send-ready views (skips undecryptable secrets). */
 async function loadChannels(deps, projectId) {
-	const model = new NotificationChannelModel(deps.db, void 0, credentialKeys(deps.config));
-	return (projectId === null ? await model.listSystem() : await model.list(projectId)).filter((row) => row.enabled).flatMap((row) => toView(row, model) ?? []);
+	const model = channelModel(deps);
+	return (projectId === null ? await model.listSystem() : await model.list(projectId)).filter((row) => row.enabled).flatMap((row) => model.toView(row) ?? []);
+}
+/** The channel model bound to the server secret. */
+function channelModel(deps) {
+	return new NotificationChannelModel(deps.db, void 0, credentialKeys(deps.config));
+}
+/** Record each delivery outcome on its channel row (the last error shown in settings). */
+function recordOutcomes(deps) {
+	const model = channelModel(deps);
+	return async (outcome) => {
+		if (outcome.channelId.startsWith("sub:") || outcome.channelId.startsWith("default:")) return;
+		await model.recordOutcome(outcome.channelId, outcome.error).catch((error) => {
+			deps.logger.warn({
+				err: error,
+				channelId: outcome.channelId
+			}, "failed to record outcome");
+		});
+	};
 }
 /** Subscriptions matching an event (enabled + allowlist). */
 function matchingSubs(rows, event) {
@@ -68,10 +76,37 @@ async function targetsForSub(db, sub, wired) {
 		enabled: true
 	}));
 }
+/** Topics that reach a project's approvers and admins unless they opted out (ADR 0013, decision 4). */
+const DEFAULT_ON_EVENTS = /* @__PURE__ */ new Set(["review:requested"]);
+/** Roles that review builds: the default recipients of {@link DEFAULT_ON_EVENTS}. */
+const REVIEWER_ROLES = /* @__PURE__ */ new Set(["approver", "admin"]);
+/**
+* Reviewers with no subscription row for the project: a default-on topic reaches them by email.
+* Anyone with a row decides for themselves (`enabled` off or a topic list without the event opts
+* out), so a row never adds a second message here.
+*/
+async function defaultTargets(db, projectId, rows, wired) {
+	if (!wired.has("email")) return [];
+	const subscribed = new Set(rows.map((row) => row.userId));
+	const members = (await new MemberModel(db).list(projectId)).filter((member) => REVIEWER_ROLES.has(member.role) && !subscribed.has(member.userId));
+	return (await Promise.all(members.map(async (member) => {
+		const user = await new UserModel(db).get(member.userId);
+		return !user || user.disabled ? [] : [{
+			id: `default:${projectId}:${member.userId}`,
+			projectId,
+			provider: "email",
+			config: { to: user.email },
+			events: [],
+			enabled: true
+		}];
+	}))).flat();
+}
 /** Per-subscriber targets for an event (only kinds that are wired). */
 async function subscriberTargets(db, projectId, event, wired) {
 	const rows = await new NotificationSubscriptionModel(db).list(projectId);
-	return (await Promise.all(matchingSubs(rows, event).map(async (sub) => await targetsForSub(db, sub, wired)))).flat();
+	const nested = await Promise.all(matchingSubs(rows, event).map(async (sub) => await targetsForSub(db, sub, wired)));
+	const defaults = DEFAULT_ON_EVENTS.has(event) ? await defaultTargets(db, projectId, rows, wired) : [];
+	return [...nested.flat(), ...defaults];
 }
 /**
 * Fan out a project event to stored channels plus opted-in subscribers.
@@ -79,7 +114,9 @@ async function subscriberTargets(db, projectId, event, wired) {
 */
 async function notifyProjectWith(deps, project, event, data, reviewSuffix) {
 	if (deps.notifiers.length === 0) return;
-	const reviewUrl = reviewSuffix ? reviewUrlForWith(deps.config.publicBaseUrl, project.slug, reviewSuffix) : void 0;
+	const origin = await originOrPause(deps, event);
+	if (origin === void 0) return;
+	const reviewUrl = reviewSuffix ? reviewUrlFor(origin, project.slug, reviewSuffix) : void 0;
 	const wired = new Set(deps.notifiers.map((candidate) => candidate.metadata.kind));
 	const channels = await loadChannels(deps, project.id);
 	const targets = await subscriberTargets(deps.db, project.id, event, wired);
@@ -92,8 +129,9 @@ async function notifyProjectWith(deps, project, event, data, reviewSuffix) {
 	}, {
 		notifiers: deps.notifiers,
 		channels: [...channels, ...targets],
-		brand: brandFor(deps.ui, deps.config, reviewUrl),
-		logger: deps.logger
+		brand: brandFor(deps.ui, deps.notificationsConfig, reviewUrl),
+		logger: deps.logger,
+		onOutcome: recordOutcomes(deps)
 	});
 }
 /**
@@ -105,7 +143,7 @@ async function notifyProject(project, event, data, reviewSuffix) {
 }
 /** Fan out a site-wide admin alert to project-less channels. */
 async function notifySystemWith(deps, event, data) {
-	if (deps.notifiers.length === 0) return;
+	if (deps.notifiers.length === 0 || await originOrPause(deps, event) === void 0) return;
 	await emitSystemNotification({
 		event,
 		data,
@@ -113,8 +151,9 @@ async function notifySystemWith(deps, event, data) {
 	}, {
 		notifiers: deps.notifiers,
 		channels: await loadChannels(deps, null),
-		brand: brandFor(deps.ui, deps.config),
-		logger: deps.logger
+		brand: brandFor(deps.ui, deps.notificationsConfig),
+		logger: deps.logger,
+		onOutcome: recordOutcomes(deps)
 	});
 }
 /** Fan out a site-wide admin alert to project-less channels. */