@storyshelf/app 0.6.2 → 0.8.0

package/dist/routers/webhooks.mjs

@@ -1,14 +1,12 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { credentialKeys } from "../credential-keys.mjs";
-import { getStore } from "../store.mjs";
 import { notFound, resolveAuthorizedProject } from "./helpers.mjs";
 import { notFound as notFound$1, unauthorized, webhookCreateSchema, webhookCreatedSchema, webhookPublicSchema } from "./schemas.mjs";
+import { webhookModel } from "./scoped-models.mjs";
 import { createRoute, z } from "@hono/zod-openapi";
 import { WebhookModel } from "@storyshelf/core/models";
-import { randomToken } from "@storyshelf/core/utils";
-//#region src/routers/webhooks.ts
+// src/routers/webhooks.ts
 const ADMIN_ROLES = ["admin"];
 const listWebhooksRoute = createRoute({
 	method: "get",
@@ -60,7 +58,7 @@ const deleteWebhookRoute = createRoute({
 function registerWebhooks(app) {
 	app.openapi(listWebhooksRoute, async (c) => {
 		const project = await resolveAuthorizedProject(c, c.req.valid("param").slug, ...ADMIN_ROLES);
-		const webhooks = await new WebhookModel(getStore().db, void 0, credentialKeys(getStore().config)).list(project.id);
+		const webhooks = await webhookModel().list(project.id);
 		return c.json(webhooks.map((webhook) => ({
 			id: webhook.id,
 			url: webhook.url,
@@ -70,11 +68,7 @@ function registerWebhooks(app) {
 	app.openapi(createWebhookRoute, async (c) => {
 		const project = await resolveAuthorizedProject(c, c.req.valid("param").slug, ...ADMIN_ROLES);
 		const body = c.req.valid("json");
-		const secret = randomToken("whsec_").value;
-		const webhook = await new WebhookModel(getStore().db, void 0, credentialKeys(getStore().config)).create(project.id, {
-			...body,
-			secret
-		});
+		const { webhook, secret } = await webhookModel().issue(project.id, body);
 		return c.json({
 			id: webhook.id,
 			url: webhook.url,
@@ -85,13 +79,12 @@ function registerWebhooks(app) {
 	app.openapi(deleteWebhookRoute, async (c) => {
 		const { slug, webhookId } = c.req.valid("param");
 		const project = await resolveAuthorizedProject(c, slug, ...ADMIN_ROLES);
-		const webhook = await new WebhookModel(getStore().db, void 0, credentialKeys(getStore().config)).get(project.id, webhookId);
+		const webhook = await webhookModel().get(project.id, webhookId);
 		if (!webhook) notFound("Webhook not found");
-		await new WebhookModel(getStore().db, void 0, credentialKeys(getStore().config)).remove(project.id, webhook.id);
+		await webhookModel().remove(project.id, webhook.id);
 		return c.body(null, 204);
 	});
 }
-//#endregion
 export { registerWebhooks };
 
 //# sourceMappingURL=webhooks.mjs.map

package/dist/routers/webhooks.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.mjs","names":["notFoundResponse"],"sources":["../../src/routers/webhooks.ts"],"sourcesContent":["import { createRoute, z } from \"@hono/zod-openapi\";\nimport { WebhookModel } from \"@storyshelf/core/models\";\nimport type { ProjectRole } from \"@storyshelf/core/types\";\nimport { randomToken } from \"@storyshelf/core/utils\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { credentialKeys } from \"../credential-keys.ts\";\nimport { getStore } from \"../store.ts\";\nimport { resolveAuthorizedProject, notFound } from \"./helpers.ts\";\nimport {\n  notFound as notFoundResponse,\n  unauthorized,\n  webhookCreatedSchema,\n  webhookCreateSchema,\n  webhookPublicSchema,\n} from \"./schemas.ts\";\nconst ADMIN_ROLES: readonly ProjectRole[] = [\"admin\"];\n\nconst listWebhooksRoute = createRoute({\n  method: \"get\",\n  tags: [\"Webhooks\"],\n  summary: \"List webhooks\",\n  path: \"/api/v1/projects/{slug}/webhooks\",\n  request: { params: z.object({ slug: z.string() }) },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: webhookPublicSchema.array() } },\n      description: \"List webhooks\",\n    },\n    ...notFoundResponse,\n    ...unauthorized,\n  },\n});\n\nconst createWebhookRoute = createRoute({\n  method: \"post\",\n  tags: [\"Webhooks\"],\n  summary: \"Create a webhook\",\n  path: \"/api/v1/projects/{slug}/webhooks\",\n  request: {\n    params: z.object({ slug: z.string() }),\n    body: { content: { \"application/json\": { schema: webhookCreateSchema } } },\n  },\n  responses: {\n    201: {\n      content: { \"application/json\": { schema: webhookCreatedSchema } },\n      description: \"Created webhook\",\n    },\n    ...notFoundResponse,\n  },\n});\n\nconst deleteWebhookRoute = createRoute({\n  method: \"delete\",\n  tags: [\"Webhooks\"],\n  summary: \"Delete a webhook\",\n  path: \"/api/v1/projects/{slug}/webhooks/{webhookId}\",\n  request: { params: z.object({ slug: z.string(), webhookId: z.string() }) },\n  responses: {\n    204: { description: \"Deleted webhook\" },\n    ...notFoundResponse,\n  },\n});\n\n/** Register the project webhook list, create, and delete endpoints. */\nexport function registerWebhooks(app: ShelfRouter): void {\n  app.openapi(listWebhooksRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...ADMIN_ROLES);\n    const webhooks = await new WebhookModel(\n      getStore().db,\n      undefined,\n      credentialKeys(getStore().config),\n    ).list(project.id);\n    return c.json(\n      webhooks.map((webhook) => ({\n        id: webhook.id,\n        url: webhook.url,\n        events: WebhookModel.eventsOf(webhook),\n      })),\n    );\n  });\n\n  app.openapi(createWebhookRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...ADMIN_ROLES);\n    const body = c.req.valid(\"json\");\n    const secret = randomToken(\"whsec_\").value;\n    const webhook = await new WebhookModel(\n      getStore().db,\n      undefined,\n      credentialKeys(getStore().config),\n    ).create(project.id, { ...body, secret });\n    return c.json({ id: webhook.id, url: webhook.url, events: body.events ?? [], secret }, 201);\n  });\n\n  app.openapi(deleteWebhookRoute, async (c) => {\n    const { slug, webhookId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...ADMIN_ROLES);\n    const webhook = await new WebhookModel(\n      getStore().db,\n      undefined,\n      credentialKeys(getStore().config),\n    ).get(project.id, webhookId);\n    if (!webhook) {\n      notFound(\"Webhook not found\");\n    }\n    await new WebhookModel(getStore().db, undefined, credentialKeys(getStore().config)).remove(\n      project.id,\n      webhook.id,\n    );\n    return c.body(null, 204);\n  });\n}\n"],"mappings":";;;;;;;;;;;AAeA,MAAM,cAAsC,CAAC,OAAO;AAEpD,MAAM,oBAAoB,YAAY;CACpC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE;CAClD,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,MAAM,EAAE,EAAE;GACvE,aAAa;EACf;EACA,GAAGA;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,qBAAqB,YAAY;CACrC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;EACrC,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE,EAAE;CAC3E;CACA,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,qBAAqB,EAAE;GAChE,aAAa;EACf;EACA,GAAGA;CACL;AACF,CAAC;AAED,MAAM,qBAAqB,YAAY;CACrC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,WAAW,EAAE,OAAO;CAAE,CAAC,EAAE;CACzE,WAAW;EACT,KAAK,EAAE,aAAa,kBAAkB;EACtC,GAAGA;CACL;AACF,CAAC;;AAGD,SAAgB,iBAAiB,KAAwB;CACvD,IAAI,QAAQ,mBAAmB,OAAO,MAAM;EAC1C,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,WAAW;EAC3F,MAAM,WAAW,MAAM,IAAI,aACzB,SAAS,CAAC,CAAC,IACX,KAAA,GACA,eAAe,SAAS,CAAC,CAAC,MAAM,CAClC,CAAC,CAAC,KAAK,QAAQ,EAAE;EACjB,OAAO,EAAE,KACP,SAAS,KAAK,aAAa;GACzB,IAAI,QAAQ;GACZ,KAAK,QAAQ;GACb,QAAQ,aAAa,SAAS,OAAO;EACvC,EAAE,CACJ;CACF,CAAC;CAED,IAAI,QAAQ,oBAAoB,OAAO,MAAM;EAC3C,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,WAAW;EAC3F,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,MAAM,SAAS,YAAY,QAAQ,CAAC,CAAC;EACrC,MAAM,UAAU,MAAM,IAAI,aACxB,SAAS,CAAC,CAAC,IACX,KAAA,GACA,eAAe,SAAS,CAAC,CAAC,MAAM,CAClC,CAAC,CAAC,OAAO,QAAQ,IAAI;GAAE,GAAG;GAAM;EAAO,CAAC;EACxC,OAAO,EAAE,KAAK;GAAE,IAAI,QAAQ;GAAI,KAAK,QAAQ;GAAK,QAAQ,KAAK,UAAU,CAAC;GAAG;EAAO,GAAG,GAAG;CAC5F,CAAC;CAED,IAAI,QAAQ,oBAAoB,OAAO,MAAM;EAC3C,MAAM,EAAE,MAAM,cAAc,EAAE,IAAI,MAAM,OAAO;EAC/C,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,WAAW;EACtE,MAAM,UAAU,MAAM,IAAI,aACxB,SAAS,CAAC,CAAC,IACX,KAAA,GACA,eAAe,SAAS,CAAC,CAAC,MAAM,CAClC,CAAC,CAAC,IAAI,QAAQ,IAAI,SAAS;EAC3B,IAAI,CAAC,SACH,SAAS,mBAAmB;EAE9B,MAAM,IAAI,aAAa,SAAS,CAAC,CAAC,IAAI,KAAA,GAAW,eAAe,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAClF,QAAQ,IACR,QAAQ,EACV;EACA,OAAO,EAAE,KAAK,MAAM,GAAG;CACzB,CAAC;AACH"}
+{"version":3,"file":"webhooks.mjs","names":["notFoundResponse"],"sources":["../../src/routers/webhooks.ts"],"sourcesContent":["import { createRoute, z } from \"@hono/zod-openapi\";\nimport { WebhookModel } from \"@storyshelf/core/models\";\nimport type { ProjectRole } from \"@storyshelf/core/types\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { resolveAuthorizedProject, notFound } from \"./helpers.ts\";\nimport {\n  notFound as notFoundResponse,\n  unauthorized,\n  webhookCreatedSchema,\n  webhookCreateSchema,\n  webhookPublicSchema,\n} from \"./schemas.ts\";\nimport { webhookModel } from \"./scoped-models.ts\";\nconst ADMIN_ROLES: readonly ProjectRole[] = [\"admin\"];\n\nconst listWebhooksRoute = createRoute({\n  method: \"get\",\n  tags: [\"Webhooks\"],\n  summary: \"List webhooks\",\n  path: \"/api/v1/projects/{slug}/webhooks\",\n  request: { params: z.object({ slug: z.string() }) },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: webhookPublicSchema.array() } },\n      description: \"List webhooks\",\n    },\n    ...notFoundResponse,\n    ...unauthorized,\n  },\n});\n\nconst createWebhookRoute = createRoute({\n  method: \"post\",\n  tags: [\"Webhooks\"],\n  summary: \"Create a webhook\",\n  path: \"/api/v1/projects/{slug}/webhooks\",\n  request: {\n    params: z.object({ slug: z.string() }),\n    body: { content: { \"application/json\": { schema: webhookCreateSchema } } },\n  },\n  responses: {\n    201: {\n      content: { \"application/json\": { schema: webhookCreatedSchema } },\n      description: \"Created webhook\",\n    },\n    ...notFoundResponse,\n  },\n});\n\nconst deleteWebhookRoute = createRoute({\n  method: \"delete\",\n  tags: [\"Webhooks\"],\n  summary: \"Delete a webhook\",\n  path: \"/api/v1/projects/{slug}/webhooks/{webhookId}\",\n  request: { params: z.object({ slug: z.string(), webhookId: z.string() }) },\n  responses: {\n    204: { description: \"Deleted webhook\" },\n    ...notFoundResponse,\n  },\n});\n\n/** Register the project webhook list, create, and delete endpoints. */\nexport function registerWebhooks(app: ShelfRouter): void {\n  app.openapi(listWebhooksRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...ADMIN_ROLES);\n    const webhooks = await webhookModel().list(project.id);\n    return c.json(\n      webhooks.map((webhook) => ({\n        id: webhook.id,\n        url: webhook.url,\n        events: WebhookModel.eventsOf(webhook),\n      })),\n    );\n  });\n\n  app.openapi(createWebhookRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...ADMIN_ROLES);\n    const body = c.req.valid(\"json\");\n    const { webhook, secret } = await webhookModel().issue(project.id, body);\n    return c.json({ id: webhook.id, url: webhook.url, events: body.events ?? [], secret }, 201);\n  });\n\n  app.openapi(deleteWebhookRoute, async (c) => {\n    const { slug, webhookId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...ADMIN_ROLES);\n    const webhook = await webhookModel().get(project.id, webhookId);\n    if (!webhook) {\n      notFound(\"Webhook not found\");\n    }\n    await webhookModel().remove(project.id, webhook.id);\n    return c.body(null, 204);\n  });\n}\n"],"mappings":";;;;;;;;;AAaA,MAAM,cAAsC,CAAC,OAAO;AAEpD,MAAM,oBAAoB,YAAY;CACpC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE;CAClD,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,MAAM,EAAE,EAAE;GACvE,aAAa;EACf;EACA,GAAGA;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,qBAAqB,YAAY;CACrC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;EACrC,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE,EAAE;CAC3E;CACA,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,qBAAqB,EAAE;GAChE,aAAa;EACf;EACA,GAAGA;CACL;AACF,CAAC;AAED,MAAM,qBAAqB,YAAY;CACrC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,WAAW,EAAE,OAAO;CAAE,CAAC,EAAE;CACzE,WAAW;EACT,KAAK,EAAE,aAAa,kBAAkB;EACtC,GAAGA;CACL;AACF,CAAC;;AAGD,SAAgB,iBAAiB,KAAwB;CACvD,IAAI,QAAQ,mBAAmB,OAAO,MAAM;EAC1C,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,WAAW;EAC3F,MAAM,WAAW,MAAM,aAAa,CAAC,CAAC,KAAK,QAAQ,EAAE;EACrD,OAAO,EAAE,KACP,SAAS,KAAK,aAAa;GACzB,IAAI,QAAQ;GACZ,KAAK,QAAQ;GACb,QAAQ,aAAa,SAAS,OAAO;EACvC,EAAE,CACJ;CACF,CAAC;CAED,IAAI,QAAQ,oBAAoB,OAAO,MAAM;EAC3C,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,WAAW;EAC3F,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,MAAM,EAAE,SAAS,WAAW,MAAM,aAAa,CAAC,CAAC,MAAM,QAAQ,IAAI,IAAI;EACvE,OAAO,EAAE,KAAK;GAAE,IAAI,QAAQ;GAAI,KAAK,QAAQ;GAAK,QAAQ,KAAK,UAAU,CAAC;GAAG;EAAO,GAAG,GAAG;CAC5F,CAAC;CAED,IAAI,QAAQ,oBAAoB,OAAO,MAAM;EAC3C,MAAM,EAAE,MAAM,cAAc,EAAE,IAAI,MAAM,OAAO;EAC/C,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,WAAW;EACtE,MAAM,UAAU,MAAM,aAAa,CAAC,CAAC,IAAI,QAAQ,IAAI,SAAS;EAC9D,IAAI,CAAC,SACH,SAAS,mBAAmB;EAE9B,MAAM,aAAa,CAAC,CAAC,OAAO,QAAQ,IAAI,QAAQ,EAAE;EAClD,OAAO,EAAE,KAAK,MAAM,GAAG;CACzB,CAAC;AACH"}

package/dist/routers/well-known.mjs

@@ -2,7 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { getStore } from "../store.mjs";
-//#region src/routers/well-known.ts
+// src/routers/well-known.ts
 /** SSO-capable login methods (oauth buttons + SSO) with IdP reply URLs. */
 function ssoProviders(auth, origin) {
 	return auth.loginMethods().filter((method) => method.kind === "oauth" || method.kind === "sso").map((method) => ({
@@ -11,13 +11,20 @@ function ssoProviders(auth, origin) {
 		redirectUris: method.kind === "sso" ? [`${origin}/api/auth/sso/callback/${method.id}`, `${origin}/api/auth/sso/saml2/sp/acs/${method.id}`] : [`${origin}/api/auth/callback/${method.id}`]
 	}));
 }
-function requestOrigin(c) {
-	return getStore().config.publicBaseUrl ?? new URL(c.req.url).origin;
+/**
+* The origin of this interactive, request-bound document (ADR 0007, decision 6): the confirmed
+* public origin, else the address the request came in on (the one place besides OAuth redirect
+* URIs where authentication may use it).
+*/
+async function requestOrigin(c) {
+	const { publicOrigin, config } = getStore();
+	const own = new URL(c.req.url).origin;
+	return publicOrigin ? await publicOrigin.authOrigin(own) : config.publicBaseUrl ?? own;
 }
 /** Register public relying-party helper documents (no auth required). */
 function registerWellKnown(app, auth) {
-	app.get("/.well-known/openid-configuration", (c) => {
-		const origin = requestOrigin(c);
+	app.get("/.well-known/openid-configuration", async (c) => {
+		const origin = await requestOrigin(c);
 		const providers = ssoProviders(auth, origin);
 		return c.json({
 			issuer: origin,
@@ -37,7 +44,6 @@ function registerWellKnown(app, auth) {
 	});
 	app.get("/.well-known/change-password", (c) => c.redirect("/profile", 302));
 }
-//#endregion
 export { registerWellKnown };
 
 //# sourceMappingURL=well-known.mjs.map

package/dist/routers/well-known.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"well-known.mjs","names":[],"sources":["../../src/routers/well-known.ts"],"sourcesContent":["import type { Auth } from \"@storyshelf/core/auth\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\n\n/** One SSO-capable login method with its IdP reply URLs. */\ninterface SsoProviderLink {\n  id: string;\n  label: string;\n  redirectUris: string[];\n}\n\n/** SSO-capable login methods (oauth buttons + SSO) with IdP reply URLs. */\nfunction ssoProviders(auth: Auth, origin: string): SsoProviderLink[] {\n  return auth\n    .loginMethods()\n    .filter((method) => method.kind === \"oauth\" || method.kind === \"sso\")\n    .map((method) => ({\n      id: method.id,\n      label: method.label,\n      redirectUris:\n        method.kind === \"sso\"\n          ? [\n              `${origin}/api/auth/sso/callback/${method.id}`,\n              `${origin}/api/auth/sso/saml2/sp/acs/${method.id}`,\n            ]\n          : [`${origin}/api/auth/callback/${method.id}`],\n    }));\n}\n\nfunction requestOrigin(c: Context): string {\n  return getStore().config.publicBaseUrl ?? new URL(c.req.url).origin;\n}\n\n/** Register public relying-party helper documents (no auth required). */\nexport function registerWellKnown(app: ShelfRouter, auth: Auth): void {\n  app.get(\"/.well-known/openid-configuration\", (c) => {\n    const origin = requestOrigin(c);\n    const providers = ssoProviders(auth, origin);\n    return c.json(\n      {\n        issuer: origin,\n        note: \"StoryShelf is an OpenID Connect relying party, not an identity provider. This document helps operators register redirect URIs with their provider; it is not provider metadata.\",\n        response_types_supported: [\"code\"],\n        scopes_supported: [\"openid\", \"email\", \"profile\"],\n        redirect_uris: providers.flatMap((provider) => provider.redirectUris),\n        providers: providers.map((method) => ({ id: method.id, label: method.label })),\n      },\n      200,\n      { \"Cache-Control\": \"public, max-age=300\" },\n    );\n  });\n\n  // oxlint-disable-next-line typescript/promise-function-async -- Hono handler may return Response directly\n  app.get(\"/.well-known/change-password\", (c) => c.redirect(\"/profile\", 302));\n}\n"],"mappings":";;;;;;AAaA,SAAS,aAAa,MAAY,QAAmC;CACnE,OAAO,KACJ,aAAa,CAAC,CACd,QAAQ,WAAW,OAAO,SAAS,WAAW,OAAO,SAAS,KAAK,CAAC,CACpE,KAAK,YAAY;EAChB,IAAI,OAAO;EACX,OAAO,OAAO;EACd,cACE,OAAO,SAAS,QACZ,CACE,GAAG,OAAO,yBAAyB,OAAO,MAC1C,GAAG,OAAO,6BAA6B,OAAO,IAChD,IACA,CAAC,GAAG,OAAO,qBAAqB,OAAO,IAAI;CACnD,EAAE;AACN;AAEA,SAAS,cAAc,GAAoB;CACzC,OAAO,SAAS,CAAC,CAAC,OAAO,iBAAiB,IAAI,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC;AAC/D;;AAGA,SAAgB,kBAAkB,KAAkB,MAAkB;CACpE,IAAI,IAAI,sCAAsC,MAAM;EAClD,MAAM,SAAS,cAAc,CAAC;EAC9B,MAAM,YAAY,aAAa,MAAM,MAAM;EAC3C,OAAO,EAAE,KACP;GACE,QAAQ;GACR,MAAM;GACN,0BAA0B,CAAC,MAAM;GACjC,kBAAkB;IAAC;IAAU;IAAS;GAAS;GAC/C,eAAe,UAAU,SAAS,aAAa,SAAS,YAAY;GACpE,WAAW,UAAU,KAAK,YAAY;IAAE,IAAI,OAAO;IAAI,OAAO,OAAO;GAAM,EAAE;EAC/E,GACA,KACA,EAAE,iBAAiB,sBAAsB,CAC3C;CACF,CAAC;CAGD,IAAI,IAAI,iCAAiC,MAAM,EAAE,SAAS,YAAY,GAAG,CAAC;AAC5E"}
+{"version":3,"file":"well-known.mjs","names":[],"sources":["../../src/routers/well-known.ts"],"sourcesContent":["import type { Auth } from \"@storyshelf/core/auth\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\n\n/** One SSO-capable login method with its IdP reply URLs. */\ninterface SsoProviderLink {\n  id: string;\n  label: string;\n  redirectUris: string[];\n}\n\n/** SSO-capable login methods (oauth buttons + SSO) with IdP reply URLs. */\nfunction ssoProviders(auth: Auth, origin: string): SsoProviderLink[] {\n  return auth\n    .loginMethods()\n    .filter((method) => method.kind === \"oauth\" || method.kind === \"sso\")\n    .map((method) => ({\n      id: method.id,\n      label: method.label,\n      redirectUris:\n        method.kind === \"sso\"\n          ? [\n              `${origin}/api/auth/sso/callback/${method.id}`,\n              `${origin}/api/auth/sso/saml2/sp/acs/${method.id}`,\n            ]\n          : [`${origin}/api/auth/callback/${method.id}`],\n    }));\n}\n\n/**\n * The origin of this interactive, request-bound document (ADR 0007, decision 6): the confirmed\n * public origin, else the address the request came in on (the one place besides OAuth redirect\n * URIs where authentication may use it).\n */\nasync function requestOrigin(c: Context): Promise<string> {\n  const { publicOrigin, config } = getStore();\n  const own = new URL(c.req.url).origin;\n  return publicOrigin ? await publicOrigin.authOrigin(own) : (config.publicBaseUrl ?? own);\n}\n\n/** Register public relying-party helper documents (no auth required). */\nexport function registerWellKnown(app: ShelfRouter, auth: Auth): void {\n  app.get(\"/.well-known/openid-configuration\", async (c) => {\n    const origin = await requestOrigin(c);\n    const providers = ssoProviders(auth, origin);\n    return c.json(\n      {\n        issuer: origin,\n        note: \"StoryShelf is an OpenID Connect relying party, not an identity provider. This document helps operators register redirect URIs with their provider; it is not provider metadata.\",\n        response_types_supported: [\"code\"],\n        scopes_supported: [\"openid\", \"email\", \"profile\"],\n        redirect_uris: providers.flatMap((provider) => provider.redirectUris),\n        providers: providers.map((method) => ({ id: method.id, label: method.label })),\n      },\n      200,\n      { \"Cache-Control\": \"public, max-age=300\" },\n    );\n  });\n\n  // oxlint-disable-next-line typescript/promise-function-async -- Hono handler may return Response directly\n  app.get(\"/.well-known/change-password\", (c) => c.redirect(\"/profile\", 302));\n}\n"],"mappings":";;;;;;AAaA,SAAS,aAAa,MAAY,QAAmC;CACnE,OAAO,KACJ,aAAa,CAAC,CACd,QAAQ,WAAW,OAAO,SAAS,WAAW,OAAO,SAAS,KAAK,CAAC,CACpE,KAAK,YAAY;EAChB,IAAI,OAAO;EACX,OAAO,OAAO;EACd,cACE,OAAO,SAAS,QACZ,CACE,GAAG,OAAO,yBAAyB,OAAO,MAC1C,GAAG,OAAO,6BAA6B,OAAO,IAChD,IACA,CAAC,GAAG,OAAO,qBAAqB,OAAO,IAAI;CACnD,EAAE;AACN;;;;;;AAOA,eAAe,cAAc,GAA6B;CACxD,MAAM,EAAE,cAAc,WAAW,SAAS;CAC1C,MAAM,MAAM,IAAI,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC;CAC/B,OAAO,eAAe,MAAM,aAAa,WAAW,GAAG,IAAK,OAAO,iBAAiB;AACtF;;AAGA,SAAgB,kBAAkB,KAAkB,MAAkB;CACpE,IAAI,IAAI,qCAAqC,OAAO,MAAM;EACxD,MAAM,SAAS,MAAM,cAAc,CAAC;EACpC,MAAM,YAAY,aAAa,MAAM,MAAM;EAC3C,OAAO,EAAE,KACP;GACE,QAAQ;GACR,MAAM;GACN,0BAA0B,CAAC,MAAM;GACjC,kBAAkB;IAAC;IAAU;IAAS;GAAS;GAC/C,eAAe,UAAU,SAAS,aAAa,SAAS,YAAY;GACpE,WAAW,UAAU,KAAK,YAAY;IAAE,IAAI,OAAO;IAAI,OAAO,OAAO;GAAM,EAAE;EAC/E,GACA,KACA,EAAE,iBAAiB,sBAAsB,CAC3C;CACF,CAAC;CAGD,IAAI,IAAI,iCAAiC,MAAM,EAAE,SAAS,YAAY,GAAG,CAAC;AAC5E"}

package/dist/routes/api-routes.mjs

@@ -0,0 +1,92 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+// src/routes/api-routes.ts
+/** JSON API routes, keyed by `METHOD /hono-pattern`. */
+const API_ROUTE_CLASSES = {
+	"GET /api/v1/projects": "hosting",
+	"POST /api/v1/projects": "hosting",
+	"GET /api/v1/projects/:slug": "hosting",
+	"PATCH /api/v1/projects/:slug": "hosting",
+	"DELETE /api/v1/projects/:slug": "hosting",
+	"GET /api/v1/projects/:slug/builds": "hosting",
+	"POST /api/v1/projects/:slug/builds": "hosting",
+	"POST /api/v1/projects/:slug/builds/:buildId/usage": "hosting",
+	"PUT /api/v1/projects/:slug/builds/:buildId/zip": "hosting",
+	"POST /api/v1/projects/:slug/builds/:buildId/dedup": "hosting",
+	"POST /api/v1/projects/:slug/builds/:buildId/content": "hosting",
+	"POST /api/v1/projects/:slug/builds/:buildId/manifest": "hosting",
+	"GET /api/v1/projects/:slug/builds/:buildId": "hosting",
+	"DELETE /api/v1/projects/:slug/builds/:buildId": "hosting",
+	"GET /api/v1/projects/:slug/label-types": "hosting",
+	"POST /api/v1/projects/:slug/label-types": "hosting",
+	"DELETE /api/v1/projects/:slug/label-types/:key": "hosting",
+	"PATCH /api/v1/projects/:slug/label-types/:key": "hosting",
+	"GET /api/v1/projects/:slug/links": "hosting",
+	"PUT /api/v1/projects/:slug/links": "hosting",
+	"GET /api/v1/projects/:slug/members": "hosting",
+	"POST /api/v1/projects/:slug/members": "hosting",
+	"PATCH /api/v1/projects/:slug/members/:userId": "hosting",
+	"DELETE /api/v1/projects/:slug/members/:userId": "hosting",
+	"GET /api/v1/projects/:slug/group-mappings": "hosting",
+	"POST /api/v1/projects/:slug/group-mappings": "hosting",
+	"DELETE /api/v1/projects/:slug/group-mappings/:mappingId": "hosting",
+	"GET /api/v1/projects/:slug/tokens": "hosting",
+	"POST /api/v1/projects/:slug/tokens": "hosting",
+	"DELETE /api/v1/projects/:slug/tokens/:tokenId": "hosting",
+	"GET /api/v1/projects/:slug/webhooks": "hosting",
+	"POST /api/v1/projects/:slug/webhooks": "hosting",
+	"DELETE /api/v1/projects/:slug/webhooks/:webhookId": "hosting",
+	"GET /api/v1/projects/:slug/notification-channels": "hosting",
+	"POST /api/v1/projects/:slug/notification-channels": "hosting",
+	"DELETE /api/v1/projects/:slug/notification-channels/:channelId": "hosting",
+	"GET /api/v1/projects/:slug/notifications/me": "hosting",
+	"PUT /api/v1/projects/:slug/notifications/me": "hosting",
+	"DELETE /api/v1/projects/:slug/notifications/me": "hosting",
+	"GET /api/v1/projects/:slug/notifications": "hosting",
+	"GET /api/v1/admin/notification-channels": "hosting",
+	"POST /api/v1/admin/notification-channels": "hosting",
+	"DELETE /api/v1/admin/notification-channels/:channelId": "hosting",
+	"GET /api/v1/health": "hosting",
+	"POST /api/v1/health": "hosting",
+	"POST /api/v1/admin/credentials/reencrypt": "hosting",
+	"POST /api/v1/admin/purge": "hosting",
+	"GET /api/v1/openapi.json": "hosting",
+	"GET /api/v1/docs": "hosting",
+	"POST /api/v1/projects/:slug/builds/:buildId/affected": "testing",
+	"POST /api/v1/projects/:slug/builds/:buildId/retry": "testing",
+	"POST /api/v1/projects/:slug/builds/:buildId/cancel": "testing",
+	"GET /api/v1/projects/:slug/builds/:buildId/snapshots": "testing",
+	"GET /api/v1/projects/:slug/builds/:buildId/preview-token": "testing",
+	"POST /api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/approve": "testing",
+	"POST /api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/reject": "testing",
+	"POST /api/v1/projects/:slug/builds/:buildId/approve-all": "testing",
+	"POST /api/v1/projects/:slug/builds/:buildId/reject-all": "testing",
+	"POST /api/v1/projects/:slug/builds/:buildId/stories/:storyId/modes/:modeKey/approve": "testing",
+	"POST /api/v1/projects/:slug/builds/:buildId/stories/:storyId/modes/:modeKey/reject": "testing",
+	"POST /api/v1/projects/:slug/builds/:buildId/rediff": "testing",
+	"GET /api/v1/projects/:slug/builds/:buildId/attempts": "testing",
+	"GET /api/v1/projects/:slug/builds/:buildId/attempts/:attemptNo": "testing",
+	"GET /api/v1/projects/:slug/builds/:buildId/attempts/:attemptNo/logs": "testing",
+	"GET /api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/usage": "testing",
+	"GET /api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/image": "testing",
+	"GET /api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/diff": "testing",
+	"GET /api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/baseline": "testing",
+	"GET /api/v1/projects/:slug/design/renders/:renderId": "testing",
+	"GET /api/v1/projects/:slug/baselines/export": "testing",
+	"POST /api/v1/projects/:slug/baselines/import": "testing",
+	"GET /api/v1/projects/:slug/builds/:buildId/insights/latest": "testing",
+	"GET /api/v1/projects/:slug/builds/:buildId/insights": "testing",
+	"POST /api/v1/projects/:slug/builds/:buildId/insights": "testing",
+	"GET /api/v1/projects/:slug/insights/health": "testing",
+	"POST /api/v1/projects/:slug/insights/health": "testing",
+	"GET /api/v1/projects/:slug/builds/:buildId/comments": "review",
+	"POST /api/v1/projects/:slug/builds/:buildId/comments": "review",
+	"POST /api/v1/projects/:slug/builds/:buildId/comments/:commentId/resolve": "review",
+	"GET /api/v1/projects/:slug/builds/:buildId/reviews": "review",
+	"POST /api/v1/projects/:slug/builds/:buildId/reviews": "review",
+	"GET /api/v1/projects/:slug/builds/:buildId/changeset": "review"
+};
+export { API_ROUTE_CLASSES };
+
+//# sourceMappingURL=api-routes.mjs.map

package/dist/routes/api-routes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-routes.mjs","names":[],"sources":["../../src/routes/api-routes.ts"],"sourcesContent":["/** Classes of the JSON API routes under `/api/v1`. */\nimport type { RouteClass } from \"./classification.ts\";\n\n/** JSON API routes, keyed by `METHOD /hono-pattern`. */\nexport const API_ROUTE_CLASSES: Readonly<Record<string, RouteClass>> = {\n  // hosting\n  \"GET /api/v1/projects\": \"hosting\",\n  \"POST /api/v1/projects\": \"hosting\",\n  \"GET /api/v1/projects/:slug\": \"hosting\",\n  \"PATCH /api/v1/projects/:slug\": \"hosting\",\n  \"DELETE /api/v1/projects/:slug\": \"hosting\",\n  \"GET /api/v1/projects/:slug/builds\": \"hosting\",\n  \"POST /api/v1/projects/:slug/builds\": \"hosting\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/usage\": \"hosting\",\n  \"PUT /api/v1/projects/:slug/builds/:buildId/zip\": \"hosting\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/dedup\": \"hosting\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/content\": \"hosting\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/manifest\": \"hosting\",\n  \"GET /api/v1/projects/:slug/builds/:buildId\": \"hosting\",\n  \"DELETE /api/v1/projects/:slug/builds/:buildId\": \"hosting\",\n  \"GET /api/v1/projects/:slug/label-types\": \"hosting\",\n  \"POST /api/v1/projects/:slug/label-types\": \"hosting\",\n  \"DELETE /api/v1/projects/:slug/label-types/:key\": \"hosting\",\n  \"PATCH /api/v1/projects/:slug/label-types/:key\": \"hosting\",\n  \"GET /api/v1/projects/:slug/links\": \"hosting\",\n  \"PUT /api/v1/projects/:slug/links\": \"hosting\",\n  \"GET /api/v1/projects/:slug/members\": \"hosting\",\n  \"POST /api/v1/projects/:slug/members\": \"hosting\",\n  \"PATCH /api/v1/projects/:slug/members/:userId\": \"hosting\",\n  \"DELETE /api/v1/projects/:slug/members/:userId\": \"hosting\",\n  \"GET /api/v1/projects/:slug/group-mappings\": \"hosting\",\n  \"POST /api/v1/projects/:slug/group-mappings\": \"hosting\",\n  \"DELETE /api/v1/projects/:slug/group-mappings/:mappingId\": \"hosting\",\n  \"GET /api/v1/projects/:slug/tokens\": \"hosting\",\n  \"POST /api/v1/projects/:slug/tokens\": \"hosting\",\n  \"DELETE /api/v1/projects/:slug/tokens/:tokenId\": \"hosting\",\n  \"GET /api/v1/projects/:slug/webhooks\": \"hosting\",\n  \"POST /api/v1/projects/:slug/webhooks\": \"hosting\",\n  \"DELETE /api/v1/projects/:slug/webhooks/:webhookId\": \"hosting\",\n  \"GET /api/v1/projects/:slug/notification-channels\": \"hosting\",\n  \"POST /api/v1/projects/:slug/notification-channels\": \"hosting\",\n  \"DELETE /api/v1/projects/:slug/notification-channels/:channelId\": \"hosting\",\n  \"GET /api/v1/projects/:slug/notifications/me\": \"hosting\",\n  \"PUT /api/v1/projects/:slug/notifications/me\": \"hosting\",\n  \"DELETE /api/v1/projects/:slug/notifications/me\": \"hosting\",\n  \"GET /api/v1/projects/:slug/notifications\": \"hosting\",\n  \"GET /api/v1/admin/notification-channels\": \"hosting\",\n  \"POST /api/v1/admin/notification-channels\": \"hosting\",\n  \"DELETE /api/v1/admin/notification-channels/:channelId\": \"hosting\",\n  \"GET /api/v1/health\": \"hosting\",\n  \"POST /api/v1/health\": \"hosting\",\n  \"POST /api/v1/admin/credentials/reencrypt\": \"hosting\",\n  \"POST /api/v1/admin/purge\": \"hosting\",\n  \"GET /api/v1/openapi.json\": \"hosting\",\n  \"GET /api/v1/docs\": \"hosting\",\n  // testing\n  \"POST /api/v1/projects/:slug/builds/:buildId/affected\": \"testing\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/retry\": \"testing\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/cancel\": \"testing\",\n  \"GET /api/v1/projects/:slug/builds/:buildId/snapshots\": \"testing\",\n  \"GET /api/v1/projects/:slug/builds/:buildId/preview-token\": \"testing\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/approve\": \"testing\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/reject\": \"testing\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/approve-all\": \"testing\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/reject-all\": \"testing\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/stories/:storyId/modes/:modeKey/approve\": \"testing\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/stories/:storyId/modes/:modeKey/reject\": \"testing\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/rediff\": \"testing\",\n  \"GET /api/v1/projects/:slug/builds/:buildId/attempts\": \"testing\",\n  \"GET /api/v1/projects/:slug/builds/:buildId/attempts/:attemptNo\": \"testing\",\n  \"GET /api/v1/projects/:slug/builds/:buildId/attempts/:attemptNo/logs\": \"testing\",\n  \"GET /api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/usage\": \"testing\",\n  \"GET /api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/image\": \"testing\",\n  \"GET /api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/diff\": \"testing\",\n  \"GET /api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/baseline\": \"testing\",\n  \"GET /api/v1/projects/:slug/design/renders/:renderId\": \"testing\",\n  \"GET /api/v1/projects/:slug/baselines/export\": \"testing\",\n  \"POST /api/v1/projects/:slug/baselines/import\": \"testing\",\n  \"GET /api/v1/projects/:slug/builds/:buildId/insights/latest\": \"testing\",\n  \"GET /api/v1/projects/:slug/builds/:buildId/insights\": \"testing\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/insights\": \"testing\",\n  \"GET /api/v1/projects/:slug/insights/health\": \"testing\",\n  \"POST /api/v1/projects/:slug/insights/health\": \"testing\",\n  // review\n  \"GET /api/v1/projects/:slug/builds/:buildId/comments\": \"review\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/comments\": \"review\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/comments/:commentId/resolve\": \"review\",\n  \"GET /api/v1/projects/:slug/builds/:buildId/reviews\": \"review\",\n  \"POST /api/v1/projects/:slug/builds/:buildId/reviews\": \"review\",\n  \"GET /api/v1/projects/:slug/builds/:buildId/changeset\": \"review\",\n};\n"],"mappings":";;;;;AAIA,MAAa,oBAA0D;CAErE,wBAAwB;CACxB,yBAAyB;CACzB,8BAA8B;CAC9B,gCAAgC;CAChC,iCAAiC;CACjC,qCAAqC;CACrC,sCAAsC;CACtC,qDAAqD;CACrD,kDAAkD;CAClD,qDAAqD;CACrD,uDAAuD;CACvD,wDAAwD;CACxD,8CAA8C;CAC9C,iDAAiD;CACjD,0CAA0C;CAC1C,2CAA2C;CAC3C,kDAAkD;CAClD,iDAAiD;CACjD,oCAAoC;CACpC,oCAAoC;CACpC,sCAAsC;CACtC,uCAAuC;CACvC,gDAAgD;CAChD,iDAAiD;CACjD,6CAA6C;CAC7C,8CAA8C;CAC9C,2DAA2D;CAC3D,qCAAqC;CACrC,sCAAsC;CACtC,iDAAiD;CACjD,uCAAuC;CACvC,wCAAwC;CACxC,qDAAqD;CACrD,oDAAoD;CACpD,qDAAqD;CACrD,kEAAkE;CAClE,+CAA+C;CAC/C,+CAA+C;CAC/C,kDAAkD;CAClD,4CAA4C;CAC5C,2CAA2C;CAC3C,4CAA4C;CAC5C,yDAAyD;CACzD,sBAAsB;CACtB,uBAAuB;CACvB,4CAA4C;CAC5C,4BAA4B;CAC5B,4BAA4B;CAC5B,oBAAoB;CAEpB,wDAAwD;CACxD,qDAAqD;CACrD,sDAAsD;CACtD,wDAAwD;CACxD,4DAA4D;CAC5D,6EAA6E;CAC7E,4EAA4E;CAC5E,2DAA2D;CAC3D,0DAA0D;CAC1D,uFAAuF;CACvF,sFAAsF;CACtF,sDAAsD;CACtD,uDAAuD;CACvD,kEAAkE;CAClE,uEAAuE;CACvE,0EAA0E;CAC1E,0EAA0E;CAC1E,yEAAyE;CACzE,6EAA6E;CAC7E,uDAAuD;CACvD,+CAA+C;CAC/C,gDAAgD;CAChD,8DAA8D;CAC9D,uDAAuD;CACvD,wDAAwD;CACxD,8CAA8C;CAC9C,+CAA+C;CAE/C,uDAAuD;CACvD,wDAAwD;CACxD,2EAA2E;CAC3E,sDAAsD;CACtD,uDAAuD;CACvD,wDAAwD;AAC1D"}

package/dist/routes/classification.mjs

@@ -0,0 +1,37 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { API_ROUTE_CLASSES } from "./api-routes.mjs";
+import { PAGE_ROUTE_CLASSES } from "./page-routes.mjs";
+// src/routes/classification.ts
+/**
+* Route classification (ADR 0006, decision 8): every route the app registers declares whether it
+* belongs to hosting, testing, review, or both. `classification.test.ts` fails on any registered
+* route missing here and on any entry that no longer matches a route, so a new route must be
+* classified in `api-routes.ts` or `page-routes.ts` in the same change.
+*
+* Today the table only describes the routes; nothing is gated by it yet (gating comes with the
+* `testing` option work, which will apply it as middleware).
+*/
+/** The full table, keyed by `"METHOD /hono-pattern"` exactly as `app.routes` reports it. */
+const ROUTE_CLASSES = {
+	...API_ROUTE_CLASSES,
+	...PAGE_ROUTE_CLASSES
+};
+/**
+* Route families whose individual patterns are not worth listing (content-hashed static assets).
+* A rule applies to any method whose path starts with `prefix`.
+*/
+const ROUTE_PREFIX_CLASSES = [{
+	prefix: "/assets/",
+	routeClass: "hosting"
+}];
+/** The class of a registered route, or `undefined` when it is unclassified. */
+function classOfRoute(method, path) {
+	const exact = ROUTE_CLASSES[`${method} ${path}`];
+	if (exact !== void 0) return exact;
+	return ROUTE_PREFIX_CLASSES.find((rule) => path.startsWith(rule.prefix))?.routeClass;
+}
+export { ROUTE_CLASSES, ROUTE_PREFIX_CLASSES, classOfRoute };
+
+//# sourceMappingURL=classification.mjs.map

package/dist/routes/classification.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification.mjs","names":[],"sources":["../../src/routes/classification.ts"],"sourcesContent":["/**\n * Route classification (ADR 0006, decision 8): every route the app registers declares whether it\n * belongs to hosting, testing, review, or both. `classification.test.ts` fails on any registered\n * route missing here and on any entry that no longer matches a route, so a new route must be\n * classified in `api-routes.ts` or `page-routes.ts` in the same change.\n *\n * Today the table only describes the routes; nothing is gated by it yet (gating comes with the\n * `testing` option work, which will apply it as middleware).\n */\nimport { API_ROUTE_CLASSES } from \"./api-routes.ts\";\nimport { PAGE_ROUTE_CLASSES } from \"./page-routes.ts\";\n\n/**\n * - `hosting`: available with and without `testing`.\n * - `testing`: 404 without `testing`.\n * - `review`: 404 when the project's review switch is off.\n * - `both`: present in both modes, with sections gated by `testing`.\n */\nexport type RouteClass = \"hosting\" | \"testing\" | \"review\" | \"both\";\n\nexport const ROUTE_CLASS_VALUES: readonly RouteClass[] = [\"hosting\", \"testing\", \"review\", \"both\"];\n\n/** The full table, keyed by `\"METHOD /hono-pattern\"` exactly as `app.routes` reports it. */\nexport const ROUTE_CLASSES: Readonly<Record<string, RouteClass>> = {\n  ...API_ROUTE_CLASSES,\n  ...PAGE_ROUTE_CLASSES,\n};\n\n/**\n * Route families whose individual patterns are not worth listing (content-hashed static assets).\n * A rule applies to any method whose path starts with `prefix`.\n */\nexport const ROUTE_PREFIX_CLASSES: readonly { prefix: string; routeClass: RouteClass }[] = [\n  { prefix: \"/assets/\", routeClass: \"hosting\" },\n];\n\n/** The class of a registered route, or `undefined` when it is unclassified. */\nexport function classOfRoute(method: string, path: string): RouteClass | undefined {\n  const exact = ROUTE_CLASSES[`${method} ${path}`];\n  if (exact !== undefined) {\n    return exact;\n  }\n  return ROUTE_PREFIX_CLASSES.find((rule) => path.startsWith(rule.prefix))?.routeClass;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAuBA,MAAa,gBAAsD;CACjE,GAAG;CACH,GAAG;AACL;;;;;AAMA,MAAa,uBAA8E,CACzF;CAAE,QAAQ;CAAY,YAAY;AAAU,CAC9C;;AAGA,SAAgB,aAAa,QAAgB,MAAsC;CACjF,MAAM,QAAQ,cAAc,GAAG,OAAO,GAAG;CACzC,IAAI,UAAU,KAAA,GACZ,OAAO;CAET,OAAO,qBAAqB,MAAM,SAAS,KAAK,WAAW,KAAK,MAAM,CAAC,CAAC,EAAE;AAC5E"}

package/dist/routes/openapi-classes.mjs

@@ -0,0 +1,21 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { classOfRoute } from "./classification.mjs";
+// src/routes/openapi-classes.ts
+/** Tags every operation of an OpenAPI document with the class of its route (`x-storyshelf-class`). */
+/** OpenAPI path templates (`{slug}`) as Hono patterns (`:slug`), the form the route table uses. */
+function honoPattern(path) {
+	return path.replaceAll(/\{(?<name>[^}]+)\}/gu, ":$<name>");
+}
+/** `document` with `x-storyshelf-class` on each operation whose route the table classifies. */
+function markRouteClasses(document) {
+	for (const [path, operations] of Object.entries(document.paths ?? {})) for (const [method, operation] of Object.entries(operations)) {
+		const routeClass = classOfRoute(method.toUpperCase(), honoPattern(path));
+		if (routeClass !== void 0 && typeof operation === "object" && operation !== null) operation["x-storyshelf-class"] = routeClass;
+	}
+	return document;
+}
+export { markRouteClasses };
+
+//# sourceMappingURL=openapi-classes.mjs.map

package/dist/routes/openapi-classes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-classes.mjs","names":[],"sources":["../../src/routes/openapi-classes.ts"],"sourcesContent":["/** Tags every operation of an OpenAPI document with the class of its route (`x-storyshelf-class`). */\nimport { classOfRoute } from \"./classification.ts\";\n\ninterface OpenApiLike {\n  paths?: object | undefined;\n}\n\n/** OpenAPI path templates (`{slug}`) as Hono patterns (`:slug`), the form the route table uses. */\nfunction honoPattern(path: string): string {\n  return path.replaceAll(/\\{(?<name>[^}]+)\\}/gu, \":$<name>\");\n}\n\n/** `document` with `x-storyshelf-class` on each operation whose route the table classifies. */\nexport function markRouteClasses<T extends OpenApiLike>(document: T): T {\n  for (const [path, operations] of Object.entries(document.paths ?? {}) as [string, object][]) {\n    for (const [method, operation] of Object.entries(operations)) {\n      const routeClass = classOfRoute(method.toUpperCase(), honoPattern(path));\n      if (routeClass !== undefined && typeof operation === \"object\" && operation !== null) {\n        (operation as Record<string, unknown>)[\"x-storyshelf-class\"] = routeClass;\n      }\n    }\n  }\n  return document;\n}\n"],"mappings":";;;;;;;AAQA,SAAS,YAAY,MAAsB;CACzC,OAAO,KAAK,WAAW,wBAAwB,UAAU;AAC3D;;AAGA,SAAgB,iBAAwC,UAAgB;CACtE,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,SAAS,SAAS,CAAC,CAAC,GAClE,KAAK,MAAM,CAAC,QAAQ,cAAc,OAAO,QAAQ,UAAU,GAAG;EAC5D,MAAM,aAAa,aAAa,OAAO,YAAY,GAAG,YAAY,IAAI,CAAC;EACvE,IAAI,eAAe,KAAA,KAAa,OAAO,cAAc,YAAY,cAAc,MAC7E,UAAuC,wBAAwB;CAEnE;CAEF,OAAO;AACT"}

package/dist/routes/page-routes.mjs

@@ -0,0 +1,103 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+// src/routes/page-routes.ts
+/** HTML and auth routes, keyed by `METHOD /hono-pattern`. */
+const PAGE_ROUTE_CLASSES = {
+	"GET /": "hosting",
+	"GET /projects": "hosting",
+	"GET /projects/new": "hosting",
+	"POST /projects/new": "hosting",
+	"GET /projects/:slug/labels": "hosting",
+	"GET /projects/:slug/labels/:key/*": "hosting",
+	"GET /projects/:slug/settings": "hosting",
+	"POST /projects/:slug/settings": "hosting",
+	"POST /projects/:slug/settings/review": "hosting",
+	"POST /projects/:slug/delete": "hosting",
+	"GET /projects/:slug/settings/labels": "hosting",
+	"POST /projects/:slug/settings/labels": "hosting",
+	"POST /projects/:slug/settings/labels/:key": "hosting",
+	"POST /projects/:slug/settings/labels/:key/delete": "hosting",
+	"GET /projects/:slug/settings/links": "hosting",
+	"POST /projects/:slug/settings/links": "hosting",
+	"POST /projects/:slug/settings/links/delete": "hosting",
+	"GET /projects/:slug/settings/design": "hosting",
+	"POST /projects/:slug/settings/design/files": "hosting",
+	"POST /projects/:slug/settings/design/files/:id/delete": "hosting",
+	"POST /projects/:slug/settings/design/components": "hosting",
+	"POST /projects/:slug/settings/design/components/:id/delete": "hosting",
+	"POST /projects/:slug/settings/design/:provider/token": "hosting",
+	"POST /projects/:slug/settings/design/:provider/token/delete": "hosting",
+	"GET /projects/:slug/settings/tokens": "hosting",
+	"POST /projects/:slug/settings/tokens": "hosting",
+	"POST /projects/:slug/settings/tokens/:tokenId/delete": "hosting",
+	"GET /projects/:slug/settings/webhooks": "hosting",
+	"POST /projects/:slug/settings/webhooks": "hosting",
+	"POST /projects/:slug/settings/webhooks/:webhookId/delete": "hosting",
+	"GET /projects/:slug/settings/notifications": "hosting",
+	"POST /projects/:slug/settings/notifications": "hosting",
+	"POST /projects/:slug/settings/notifications/:channelId/delete": "hosting",
+	"POST /projects/:slug/settings/notifications/me": "hosting",
+	"GET /projects/:slug/settings/members": "hosting",
+	"POST /projects/:slug/settings/members": "hosting",
+	"POST /projects/:slug/settings/members/:userId/remove": "hosting",
+	"POST /projects/:slug/settings/members/groups": "hosting",
+	"POST /projects/:slug/settings/members/groups/:mappingId/remove": "hosting",
+	"GET /admin": "hosting",
+	"POST /admin/credentials/reencrypt": "hosting",
+	"POST /admin/public-origin": "hosting",
+	"POST /admin/public-origin/report": "hosting",
+	"POST /admin/public-origin/clear": "hosting",
+	"GET /_": "hosting",
+	"GET /_/": "hosting",
+	"GET /_/:id": "hosting",
+	"GET /_/:id/*": "hosting",
+	"GET /projects/:slug/storybook": "hosting",
+	"GET /projects/:slug/storybook/:key/*": "hosting",
+	"GET /projects/:slug/storybook/build/:buildId/*": "hosting",
+	"GET /_s/:token/*": "testing",
+	"GET /auth/login": "hosting",
+	"GET /auth/engine/login": "hosting",
+	"POST /auth/engine/login": "hosting",
+	"GET /auth/engine/:providerId": "hosting",
+	"GET /auth/invites/:inviteId": "hosting",
+	"POST /auth/invites/:inviteId": "hosting",
+	"POST /auth/logout": "hosting",
+	"GET /.well-known/openid-configuration": "hosting",
+	"GET /.well-known/change-password": "hosting",
+	"GET /profile": "hosting",
+	"POST /profile": "hosting",
+	"POST /profile/password": "hosting",
+	"POST /profile/sessions/revoke": "hosting",
+	"POST /profile/sessions/revoke-others": "hosting",
+	"POST /profile/passkeys/:passkeyId/delete": "hosting",
+	"POST /profile/notifications": "hosting",
+	"GET /connections/:service/start": "hosting",
+	"GET /connections/:service/callback": "hosting",
+	"POST /connections/:service/disconnect": "hosting",
+	"ALL /api/auth/*": "hosting",
+	"GET /projects/:slug/jobs": "testing",
+	"GET /projects/:slug/builds/:buildId/diff": "testing",
+	"GET /projects/:slug/settings/tests": "testing",
+	"POST /projects/:slug/settings/tests": "testing",
+	"GET /projects/:slug/settings/capture": "testing",
+	"POST /projects/:slug/settings/capture": "testing",
+	"GET /projects/:slug/settings/ai": "testing",
+	"POST /projects/:slug/settings/ai": "testing",
+	"GET /admin/ai": "testing",
+	"GET /projects/:slug/insights/health/panel": "testing",
+	"POST /projects/:slug/insights/health/generate": "testing",
+	"GET /projects/:slug/builds/:buildId/insights/panel": "testing",
+	"POST /projects/:slug/builds/:buildId/insights/generate": "testing",
+	"POST /projects/:slug/builds/:buildId/comments": "review",
+	"POST /projects/:slug/builds/:buildId/comments/:commentId/resolve": "review",
+	"POST /projects/:slug/builds/:buildId/reviews": "review",
+	"GET /projects/:slug": "both",
+	"GET /projects/:slug/builds": "both",
+	"GET /projects/:slug/builds/:buildId": "both",
+	"GET /projects/:slug/library": "both",
+	"GET /projects/:slug/components/*": "both"
+};
+export { PAGE_ROUTE_CLASSES };
+
+//# sourceMappingURL=page-routes.mjs.map

package/dist/routes/page-routes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"page-routes.mjs","names":[],"sources":["../../src/routes/page-routes.ts"],"sourcesContent":["/** Classes of the HTML pages, Storybook serving, auth flow and engine routes. */\nimport type { RouteClass } from \"./classification.ts\";\n\n/** HTML and auth routes, keyed by `METHOD /hono-pattern`. */\nexport const PAGE_ROUTE_CLASSES: Readonly<Record<string, RouteClass>> = {\n  // hosting\n  \"GET /\": \"hosting\",\n  \"GET /projects\": \"hosting\",\n  \"GET /projects/new\": \"hosting\",\n  \"POST /projects/new\": \"hosting\",\n  \"GET /projects/:slug/labels\": \"hosting\",\n  \"GET /projects/:slug/labels/:key/*\": \"hosting\",\n  \"GET /projects/:slug/settings\": \"hosting\",\n  \"POST /projects/:slug/settings\": \"hosting\",\n  \"POST /projects/:slug/settings/review\": \"hosting\",\n  \"POST /projects/:slug/delete\": \"hosting\",\n  \"GET /projects/:slug/settings/labels\": \"hosting\",\n  \"POST /projects/:slug/settings/labels\": \"hosting\",\n  \"POST /projects/:slug/settings/labels/:key\": \"hosting\",\n  \"POST /projects/:slug/settings/labels/:key/delete\": \"hosting\",\n  \"GET /projects/:slug/settings/links\": \"hosting\",\n  \"POST /projects/:slug/settings/links\": \"hosting\",\n  \"POST /projects/:slug/settings/links/delete\": \"hosting\",\n  \"GET /projects/:slug/settings/design\": \"hosting\",\n  \"POST /projects/:slug/settings/design/files\": \"hosting\",\n  \"POST /projects/:slug/settings/design/files/:id/delete\": \"hosting\",\n  \"POST /projects/:slug/settings/design/components\": \"hosting\",\n  \"POST /projects/:slug/settings/design/components/:id/delete\": \"hosting\",\n  \"POST /projects/:slug/settings/design/:provider/token\": \"hosting\",\n  \"POST /projects/:slug/settings/design/:provider/token/delete\": \"hosting\",\n  \"GET /projects/:slug/settings/tokens\": \"hosting\",\n  \"POST /projects/:slug/settings/tokens\": \"hosting\",\n  \"POST /projects/:slug/settings/tokens/:tokenId/delete\": \"hosting\",\n  \"GET /projects/:slug/settings/webhooks\": \"hosting\",\n  \"POST /projects/:slug/settings/webhooks\": \"hosting\",\n  \"POST /projects/:slug/settings/webhooks/:webhookId/delete\": \"hosting\",\n  \"GET /projects/:slug/settings/notifications\": \"hosting\",\n  \"POST /projects/:slug/settings/notifications\": \"hosting\",\n  \"POST /projects/:slug/settings/notifications/:channelId/delete\": \"hosting\",\n  \"POST /projects/:slug/settings/notifications/me\": \"hosting\",\n  \"GET /projects/:slug/settings/members\": \"hosting\",\n  \"POST /projects/:slug/settings/members\": \"hosting\",\n  \"POST /projects/:slug/settings/members/:userId/remove\": \"hosting\",\n  \"POST /projects/:slug/settings/members/groups\": \"hosting\",\n  \"POST /projects/:slug/settings/members/groups/:mappingId/remove\": \"hosting\",\n  \"GET /admin\": \"hosting\",\n  \"POST /admin/credentials/reencrypt\": \"hosting\",\n  \"POST /admin/public-origin\": \"hosting\",\n  \"POST /admin/public-origin/report\": \"hosting\",\n  \"POST /admin/public-origin/clear\": \"hosting\",\n  \"GET /_\": \"hosting\",\n  \"GET /_/\": \"hosting\",\n  \"GET /_/:id\": \"hosting\",\n  \"GET /_/:id/*\": \"hosting\",\n  \"GET /projects/:slug/storybook\": \"hosting\",\n  \"GET /projects/:slug/storybook/:key/*\": \"hosting\",\n  \"GET /projects/:slug/storybook/build/:buildId/*\": \"hosting\",\n  \"GET /_s/:token/*\": \"testing\",\n  \"GET /auth/login\": \"hosting\",\n  \"GET /auth/engine/login\": \"hosting\",\n  \"POST /auth/engine/login\": \"hosting\",\n  \"GET /auth/engine/:providerId\": \"hosting\",\n  \"GET /auth/invites/:inviteId\": \"hosting\",\n  \"POST /auth/invites/:inviteId\": \"hosting\",\n  \"POST /auth/logout\": \"hosting\",\n  \"GET /.well-known/openid-configuration\": \"hosting\",\n  \"GET /.well-known/change-password\": \"hosting\",\n  \"GET /profile\": \"hosting\",\n  \"POST /profile\": \"hosting\",\n  \"POST /profile/password\": \"hosting\",\n  \"POST /profile/sessions/revoke\": \"hosting\",\n  \"POST /profile/sessions/revoke-others\": \"hosting\",\n  \"POST /profile/passkeys/:passkeyId/delete\": \"hosting\",\n  \"POST /profile/notifications\": \"hosting\",\n  \"GET /connections/:service/start\": \"hosting\",\n  \"GET /connections/:service/callback\": \"hosting\",\n  \"POST /connections/:service/disconnect\": \"hosting\",\n  \"ALL /api/auth/*\": \"hosting\",\n  // testing\n  \"GET /projects/:slug/jobs\": \"testing\",\n  \"GET /projects/:slug/builds/:buildId/diff\": \"testing\",\n  \"GET /projects/:slug/settings/tests\": \"testing\",\n  \"POST /projects/:slug/settings/tests\": \"testing\",\n  \"GET /projects/:slug/settings/capture\": \"testing\",\n  \"POST /projects/:slug/settings/capture\": \"testing\",\n  \"GET /projects/:slug/settings/ai\": \"testing\",\n  \"POST /projects/:slug/settings/ai\": \"testing\",\n  \"GET /admin/ai\": \"testing\",\n  \"GET /projects/:slug/insights/health/panel\": \"testing\",\n  \"POST /projects/:slug/insights/health/generate\": \"testing\",\n  \"GET /projects/:slug/builds/:buildId/insights/panel\": \"testing\",\n  \"POST /projects/:slug/builds/:buildId/insights/generate\": \"testing\",\n  // review\n  \"POST /projects/:slug/builds/:buildId/comments\": \"review\",\n  \"POST /projects/:slug/builds/:buildId/comments/:commentId/resolve\": \"review\",\n  \"POST /projects/:slug/builds/:buildId/reviews\": \"review\",\n  // both\n  \"GET /projects/:slug\": \"both\",\n  \"GET /projects/:slug/builds\": \"both\",\n  \"GET /projects/:slug/builds/:buildId\": \"both\",\n  \"GET /projects/:slug/library\": \"both\",\n  \"GET /projects/:slug/components/*\": \"both\",\n};\n"],"mappings":";;;;;AAIA,MAAa,qBAA2D;CAEtE,SAAS;CACT,iBAAiB;CACjB,qBAAqB;CACrB,sBAAsB;CACtB,8BAA8B;CAC9B,qCAAqC;CACrC,gCAAgC;CAChC,iCAAiC;CACjC,wCAAwC;CACxC,+BAA+B;CAC/B,uCAAuC;CACvC,wCAAwC;CACxC,6CAA6C;CAC7C,oDAAoD;CACpD,sCAAsC;CACtC,uCAAuC;CACvC,8CAA8C;CAC9C,uCAAuC;CACvC,8CAA8C;CAC9C,yDAAyD;CACzD,mDAAmD;CACnD,8DAA8D;CAC9D,wDAAwD;CACxD,+DAA+D;CAC/D,uCAAuC;CACvC,wCAAwC;CACxC,wDAAwD;CACxD,yCAAyC;CACzC,0CAA0C;CAC1C,4DAA4D;CAC5D,8CAA8C;CAC9C,+CAA+C;CAC/C,iEAAiE;CACjE,kDAAkD;CAClD,wCAAwC;CACxC,yCAAyC;CACzC,wDAAwD;CACxD,gDAAgD;CAChD,kEAAkE;CAClE,cAAc;CACd,qCAAqC;CACrC,6BAA6B;CAC7B,oCAAoC;CACpC,mCAAmC;CACnC,UAAU;CACV,WAAW;CACX,cAAc;CACd,gBAAgB;CAChB,iCAAiC;CACjC,wCAAwC;CACxC,kDAAkD;CAClD,oBAAoB;CACpB,mBAAmB;CACnB,0BAA0B;CAC1B,2BAA2B;CAC3B,gCAAgC;CAChC,+BAA+B;CAC/B,gCAAgC;CAChC,qBAAqB;CACrB,yCAAyC;CACzC,oCAAoC;CACpC,gBAAgB;CAChB,iBAAiB;CACjB,0BAA0B;CAC1B,iCAAiC;CACjC,wCAAwC;CACxC,4CAA4C;CAC5C,+BAA+B;CAC/B,mCAAmC;CACnC,sCAAsC;CACtC,yCAAyC;CACzC,mBAAmB;CAEnB,4BAA4B;CAC5B,4CAA4C;CAC5C,sCAAsC;CACtC,uCAAuC;CACvC,wCAAwC;CACxC,yCAAyC;CACzC,mCAAmC;CACnC,oCAAoC;CACpC,iBAAiB;CACjB,6CAA6C;CAC7C,iDAAiD;CACjD,sDAAsD;CACtD,0DAA0D;CAE1D,iDAAiD;CACjD,oEAAoE;CACpE,gDAAgD;CAEhD,uBAAuB;CACvB,8BAA8B;CAC9B,uCAAuC;CACvC,+BAA+B;CAC/B,oCAAoC;AACtC"}

package/dist/runtime.mjs

@@ -2,11 +2,11 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { validateConfig, validateUiConfig } from "@storyshelf/core/config";
+import { createPublicOriginResolver } from "@storyshelf/core/models";
 import { createShelfLogger } from "@storyshelf/core/logger";
-//#region src/runtime.ts
+// src/runtime.ts
 function addOptionalSnapshots(snap, options) {
-	if (options.captureRunner) snap["captureRunner"] = options.captureRunner.metadata;
-	if (options.captureQueue) snap["captureQueue"] = options.captureQueue.metadata;
+	if (options.testing?.runner) snap["captureRunner"] = options.testing.runner.metadata;
 }
 /**
 * Build a snapshot of adapter metadata for the `/api/v1/health` and docs.
@@ -14,7 +14,7 @@ function addOptionalSnapshots(snap, options) {
 * the running configuration at a glance.
 *
 * @param options - Router options containing the wired adapters
-* @returns Metadata map keyed by adapter category (e.g. `database`, `git:github`)
+* @returns Metadata map keyed by adapter category (e.g. `database`, `notify:github`)
 */
 function buildAdapterSnapshot(options) {
 	const snap = {
@@ -22,8 +22,8 @@ function buildAdapterSnapshot(options) {
 		storage: options.storage.metadata
 	};
 	addOptionalSnapshots(snap, options);
-	for (const p of options.gitHosts ?? []) snap[`git:${p.metadata.kind}`] = p.metadata;
-	for (const n of options.notifiers ?? []) snap[`notify:${n.metadata.kind}`] = n.metadata;
+	for (const p of options.design ?? []) snap[`design:${p.metadata.kind}`] = p.metadata;
+	for (const n of options.notifications?.notifiers ?? []) snap[`notify:${n.metadata.kind}`] = n.metadata;
 	return snap;
 }
 /** Validate config/ui and derive runtime singletons from options. */
@@ -32,21 +32,25 @@ function resolveRuntime(options) {
 	const ui = options.ui ? validateUiConfig(options.ui) : {};
 	const logger = options.logger ?? createShelfLogger();
 	const authEnabled = options.auth !== void 0;
-	const gitHosts = options.gitHosts ?? [];
-	const notifiers = options.notifiers ?? [];
+	const design = options.design ?? [];
+	const notifiers = options.notifications?.notifiers ?? [];
+	const config = rawConfig.adapters ? rawConfig : {
+		...rawConfig,
+		adapters: buildAdapterSnapshot(options)
+	};
 	return {
-		config: rawConfig.adapters ? rawConfig : {
-			...rawConfig,
-			adapters: buildAdapterSnapshot(options)
-		},
+		config,
 		ui,
 		logger,
 		authEnabled,
-		gitHosts,
-		notifiers
+		design,
+		notifiers,
+		publicOrigin: createPublicOriginResolver({
+			db: options.database,
+			config
+		})
 	};
 }
-//#endregion
 export { buildAdapterSnapshot, resolveRuntime };
 
 //# sourceMappingURL=runtime.mjs.map

package/dist/runtime.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.mjs","names":[],"sources":["../src/runtime.ts"],"sourcesContent":["import type { GitHostProvider } from \"@storyshelf/core/adapter/git-host\";\nimport type { AdapterMetadata, GitAdapterMetadata } from \"@storyshelf/core/adapter/metadata\";\nimport type { NotifierProvider } from \"@storyshelf/core/adapter/notifier\";\nimport type { ShelfConfig, ShelfOptions, UIConfig } from \"@storyshelf/core/config\";\nimport { validateConfig, validateUiConfig } from \"@storyshelf/core/config\";\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport { createShelfLogger } from \"@storyshelf/core/logger\";\n\n/**\n * Resolved server runtime derived from {@link ShelfOptions}.\n * Holds the validated config, UI branding, structured logger, and\n * computed helpers like whether auth is enabled and which git hosts are wired.\n */\nexport interface ServerRuntime {\n  config: ShelfConfig;\n  ui: UIConfig;\n  logger: Logger;\n  authEnabled: boolean;\n  gitHosts: GitHostProvider[];\n  notifiers: NotifierProvider[];\n}\n\nfunction addOptionalSnapshots(\n  snap: Record<string, AdapterMetadata | GitAdapterMetadata>,\n  options: ShelfOptions,\n): void {\n  if (options.captureRunner) {\n    snap[\"captureRunner\"] = options.captureRunner.metadata;\n  }\n  if (options.captureQueue) {\n    snap[\"captureQueue\"] = options.captureQueue.metadata;\n  }\n}\n\n/**\n * Build a snapshot of adapter metadata for the `/api/v1/health` and docs.\n * Collects the name/version of every wired adapter so operators can verify\n * the running configuration at a glance.\n *\n * @param options - Router options containing the wired adapters\n * @returns Metadata map keyed by adapter category (e.g. `database`, `git:github`)\n */\nexport function buildAdapterSnapshot(\n  options: ShelfOptions,\n): Record<string, AdapterMetadata | GitAdapterMetadata> {\n  const snap: Record<string, AdapterMetadata | GitAdapterMetadata> = {\n    database: options.database.metadata,\n    storage: options.storage.metadata,\n  };\n  addOptionalSnapshots(snap, options);\n  for (const p of options.gitHosts ?? []) {\n    snap[`git:${p.metadata.kind}`] = p.metadata;\n  }\n  for (const n of options.notifiers ?? []) {\n    snap[`notify:${n.metadata.kind}`] = n.metadata;\n  }\n  return snap;\n}\n\n/** Validate config/ui and derive runtime singletons from options. */\nexport function resolveRuntime(options: ShelfOptions): ServerRuntime {\n  // eslint-disable-next-line typescript/no-unnecessary-type-assertion -- ShelfConfig lacks index signature\n  const rawConfig = options.config\n    ? validateConfig(options.config as unknown as Record<string, unknown>)\n    : {};\n  // eslint-disable-next-line typescript/no-unnecessary-type-assertion -- UIConfig lacks index signature\n  const ui = options.ui ? validateUiConfig(options.ui as unknown as Record<string, unknown>) : {};\n  const logger = options.logger ?? createShelfLogger();\n  const authEnabled = options.auth !== undefined;\n  const gitHosts = options.gitHosts ?? [];\n  const notifiers = options.notifiers ?? [];\n  // Adapter introspection — auto-populate config.adapters if not supplied\n  const config: ShelfConfig = rawConfig.adapters\n    ? rawConfig\n    : {\n        ...rawConfig,\n        adapters: buildAdapterSnapshot(options),\n      };\n  return { config, ui, logger, authEnabled, gitHosts, notifiers };\n}\n"],"mappings":";;;;;;AAsBA,SAAS,qBACP,MACA,SACM;CACN,IAAI,QAAQ,eACV,KAAK,mBAAmB,QAAQ,cAAc;CAEhD,IAAI,QAAQ,cACV,KAAK,kBAAkB,QAAQ,aAAa;AAEhD;;;;;;;;;AAUA,SAAgB,qBACd,SACsD;CACtD,MAAM,OAA6D;EACjE,UAAU,QAAQ,SAAS;EAC3B,SAAS,QAAQ,QAAQ;CAC3B;CACA,qBAAqB,MAAM,OAAO;CAClC,KAAK,MAAM,KAAK,QAAQ,YAAY,CAAC,GACnC,KAAK,OAAO,EAAE,SAAS,UAAU,EAAE;CAErC,KAAK,MAAM,KAAK,QAAQ,aAAa,CAAC,GACpC,KAAK,UAAU,EAAE,SAAS,UAAU,EAAE;CAExC,OAAO;AACT;;AAGA,SAAgB,eAAe,SAAsC;CAEnE,MAAM,YAAY,QAAQ,SACtB,eAAe,QAAQ,MAA4C,IACnE,CAAC;CAEL,MAAM,KAAK,QAAQ,KAAK,iBAAiB,QAAQ,EAAwC,IAAI,CAAC;CAC9F,MAAM,SAAS,QAAQ,UAAU,kBAAkB;CACnD,MAAM,cAAc,QAAQ,SAAS,KAAA;CACrC,MAAM,WAAW,QAAQ,YAAY,CAAC;CACtC,MAAM,YAAY,QAAQ,aAAa,CAAC;CAQxC,OAAO;EAAE,QANmB,UAAU,WAClC,YACA;GACE,GAAG;GACH,UAAU,qBAAqB,OAAO;EACxC;EACa;EAAI;EAAQ;EAAa;EAAU;CAAU;AAChE"}
+{"version":3,"file":"runtime.mjs","names":[],"sources":["../src/runtime.ts"],"sourcesContent":["import type { DesignProvider } from \"@storyshelf/core/adapter/design\";\nimport type { AdapterMetadata } from \"@storyshelf/core/adapter/metadata\";\nimport type { NotifierProvider } from \"@storyshelf/core/adapter/notifier\";\nimport type { ShelfConfig, ShelfOptions, UIConfig } from \"@storyshelf/core/config\";\nimport { validateConfig, validateUiConfig } from \"@storyshelf/core/config\";\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport { createShelfLogger } from \"@storyshelf/core/logger\";\nimport { createPublicOriginResolver, type PublicOriginResolver } from \"@storyshelf/core/models\";\n\n/**\n * Resolved server runtime derived from {@link ShelfOptions}.\n * Holds the validated config, UI branding, structured logger, and\n * computed helpers like whether auth is enabled and which notifiers are wired.\n */\nexport interface ServerRuntime {\n  config: ShelfConfig;\n  ui: UIConfig;\n  logger: Logger;\n  authEnabled: boolean;\n  design: DesignProvider[];\n  notifiers: NotifierProvider[];\n  /** The public origin for links built in the background (ADR 0007, decision 6). */\n  publicOrigin: PublicOriginResolver;\n}\n\nfunction addOptionalSnapshots(snap: Record<string, AdapterMetadata>, options: ShelfOptions): void {\n  if (options.testing?.runner) {\n    snap[\"captureRunner\"] = options.testing.runner.metadata;\n  }\n}\n\n/**\n * Build a snapshot of adapter metadata for the `/api/v1/health` and docs.\n * Collects the name/version of every wired adapter so operators can verify\n * the running configuration at a glance.\n *\n * @param options - Router options containing the wired adapters\n * @returns Metadata map keyed by adapter category (e.g. `database`, `notify:github`)\n */\nexport function buildAdapterSnapshot(options: ShelfOptions): Record<string, AdapterMetadata> {\n  const snap: Record<string, AdapterMetadata> = {\n    database: options.database.metadata,\n    storage: options.storage.metadata,\n  };\n  addOptionalSnapshots(snap, options);\n  for (const p of options.design ?? []) {\n    snap[`design:${p.metadata.kind}`] = p.metadata;\n  }\n  for (const n of options.notifications?.notifiers ?? []) {\n    snap[`notify:${n.metadata.kind}`] = n.metadata;\n  }\n  return snap;\n}\n\n/** Validate config/ui and derive runtime singletons from options. */\nexport function resolveRuntime(options: ShelfOptions): ServerRuntime {\n  // eslint-disable-next-line typescript/no-unnecessary-type-assertion -- ShelfConfig lacks index signature\n  const rawConfig = options.config\n    ? validateConfig(options.config as unknown as Record<string, unknown>)\n    : {};\n  // eslint-disable-next-line typescript/no-unnecessary-type-assertion -- UIConfig lacks index signature\n  const ui = options.ui ? validateUiConfig(options.ui as unknown as Record<string, unknown>) : {};\n  const logger = options.logger ?? createShelfLogger();\n  const authEnabled = options.auth !== undefined;\n  const design = options.design ?? [];\n  const notifiers = options.notifications?.notifiers ?? [];\n  // Adapter introspection — auto-populate config.adapters if not supplied\n  const config: ShelfConfig = rawConfig.adapters\n    ? rawConfig\n    : {\n        ...rawConfig,\n        adapters: buildAdapterSnapshot(options),\n      };\n  const publicOrigin = createPublicOriginResolver({ db: options.database, config });\n  return { config, ui, logger, authEnabled, design, notifiers, publicOrigin };\n}\n"],"mappings":";;;;;;;AAyBA,SAAS,qBAAqB,MAAuC,SAA6B;CAChG,IAAI,QAAQ,SAAS,QACnB,KAAK,mBAAmB,QAAQ,QAAQ,OAAO;AAEnD;;;;;;;;;AAUA,SAAgB,qBAAqB,SAAwD;CAC3F,MAAM,OAAwC;EAC5C,UAAU,QAAQ,SAAS;EAC3B,SAAS,QAAQ,QAAQ;CAC3B;CACA,qBAAqB,MAAM,OAAO;CAClC,KAAK,MAAM,KAAK,QAAQ,UAAU,CAAC,GACjC,KAAK,UAAU,EAAE,SAAS,UAAU,EAAE;CAExC,KAAK,MAAM,KAAK,QAAQ,eAAe,aAAa,CAAC,GACnD,KAAK,UAAU,EAAE,SAAS,UAAU,EAAE;CAExC,OAAO;AACT;;AAGA,SAAgB,eAAe,SAAsC;CAEnE,MAAM,YAAY,QAAQ,SACtB,eAAe,QAAQ,MAA4C,IACnE,CAAC;CAEL,MAAM,KAAK,QAAQ,KAAK,iBAAiB,QAAQ,EAAwC,IAAI,CAAC;CAC9F,MAAM,SAAS,QAAQ,UAAU,kBAAkB;CACnD,MAAM,cAAc,QAAQ,SAAS,KAAA;CACrC,MAAM,SAAS,QAAQ,UAAU,CAAC;CAClC,MAAM,YAAY,QAAQ,eAAe,aAAa,CAAC;CAEvD,MAAM,SAAsB,UAAU,WAClC,YACA;EACE,GAAG;EACH,UAAU,qBAAqB,OAAO;CACxC;CAEJ,OAAO;EAAE;EAAQ;EAAI;EAAQ;EAAa;EAAQ;EAAW,cADxC,2BAA2B;GAAE,IAAI,QAAQ;GAAU;EAAO,CACP;CAAE;AAC5E"}

package/dist/serverless.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export { isServerlessHost } from "@storyshelf/core/config";

package/dist/store.mjs

@@ -1,8 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { createCatalogLoader } from "@storyshelf/core/capture";
 import { AsyncLocalStorage } from "node:async_hooks";
-//#region src/store.ts
+// src/store.ts
 const storage = new AsyncLocalStorage();
 /** Run a function with the given request store in scope. */
 function runWithStore(store, fn) {
@@ -14,7 +15,23 @@ function getStore() {
 	if (!store) throw new Error("Store not available. Use runWithStore().");
 	return store;
 }
-//#endregion
-export { getStore, runWithStore };
+/**
+* Whether this instance has `testing` (`options.testing` is set): it captures and compares builds,
+* so pages layer snapshot data (screenshots, statuses, design links) onto what the catalog gives
+* them. Without it the same pages render from the published Storybook alone, and the routes
+* classified `testing` answer 404 (`requireTesting`).
+*/
+function testingEnabled(store = getStore()) {
+	return store.testing;
+}
+/** The catalog loader pages read; hand-built stores without one get an uncached loader. */
+function catalogOf(store = getStore()) {
+	return store.publish?.catalog ?? createCatalogLoader({
+		db: store.db,
+		storage: store.storage,
+		logger: store.logger
+	});
+}
+export { catalogOf, getStore, runWithStore, testingEnabled };
 
 //# sourceMappingURL=store.mjs.map