@storyshelf/app 0.6.2 → 0.8.0

package/dist/middleware/auth-gate.mjs

@@ -2,7 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { getStore } from "../store.mjs";
-//#region src/middleware/auth-gate.ts
+import { STORYBOOK_TOKEN_PREFIX } from "@storyshelf/core/utils";
+// src/middleware/auth-gate.ts
 /** Resolve the request user from the auth adapter (null when auth is off or a token is used). */
 async function resolveRequestUser(c, auth) {
 	if (!auth) return null;
@@ -13,13 +14,14 @@ async function resolveRequestUser(c, auth) {
 * Gate the server-rendered UI behind auth (ADR 0008): unauthenticated HTML
 * requests redirect to login. API/auth routes answer 401/403 themselves, and
 * published-Storybook routes enforce their own auth (public builds are
-* viewable without a session, ADR 0011).
+* viewable without a session, ADR 0011), and `/_s/<token>` is answered by its signed token
+* alone (ADR 0007).
 */
 function authGate() {
 	return async (c, next) => {
 		const { user, authEnabled: isAuthEnabled } = getStore();
 		const { path } = c.req;
-		if (!isAuthEnabled || user || path.startsWith("/api/") || path.startsWith("/auth/") || path.startsWith("/assets/") || path.startsWith("/.well-known/") || path.startsWith("/projects/") && path.includes("/storybook") || /^\/projects\/[^/]+\/?$/u.test(path)) {
+		if (!isAuthEnabled || user || path.startsWith("/api/") || path.startsWith("/auth/") || path.startsWith("/assets/") || path.startsWith(STORYBOOK_TOKEN_PREFIX) || path.startsWith("/.well-known/") || path.startsWith("/projects/") && path.includes("/storybook") || /^\/projects\/[^/]+\/?$/u.test(path)) {
 			await next();
 			return;
 		}
@@ -30,7 +32,6 @@ function authGate() {
 		return c.redirect("/auth/login", 302);
 	};
 }
-//#endregion
 export { authGate, resolveRequestUser };
 
 //# sourceMappingURL=auth-gate.mjs.map

package/dist/middleware/auth-gate.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-gate.mjs","names":[],"sources":["../../src/middleware/auth-gate.ts"],"sourcesContent":["import type { Auth } from \"@storyshelf/core/auth\";\nimport type { AuthUser } from \"@storyshelf/core/types\";\nimport type { Context, Next } from \"hono\";\nimport { getStore } from \"../store.ts\";\n\n/** Resolve the request user from the auth adapter (null when auth is off or a token is used). */\nexport async function resolveRequestUser(\n  c: Pick<Context, \"req\">,\n  auth?: Auth,\n): Promise<AuthUser | null> {\n  if (!auth) {\n    return null;\n  }\n  if (c.req.header(\"authorization\")) {\n    return null;\n  }\n  return await auth.check(c.req.raw);\n}\n\n/**\n * Gate the server-rendered UI behind auth (ADR 0008): unauthenticated HTML\n * requests redirect to login. API/auth routes answer 401/403 themselves, and\n * published-Storybook routes enforce their own auth (public builds are\n * viewable without a session, ADR 0011).\n */\nexport function authGate() {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const { user, authEnabled: isAuthEnabled } = getStore();\n    const { path } = c.req;\n    if (\n      !isAuthEnabled ||\n      user ||\n      path.startsWith(\"/api/\") ||\n      path.startsWith(\"/auth/\") ||\n      path.startsWith(\"/assets/\") ||\n      path.startsWith(\"/.well-known/\") ||\n      (path.startsWith(\"/projects/\") && path.includes(\"/storybook\")) ||\n      /^\\/projects\\/[^/]+\\/?$/u.test(path)\n    ) {\n      await next();\n      return;\n    }\n    if (c.req.header(\"HX-Request\") === \"true\") {\n      c.header(\"HX-Redirect\", \"/auth/login\");\n      return c.body(null, 204);\n    }\n    return c.redirect(\"/auth/login\", 302);\n  };\n}\n"],"mappings":";;;;;;AAMA,eAAsB,mBACpB,GACA,MAC0B;CAC1B,IAAI,CAAC,MACH,OAAO;CAET,IAAI,EAAE,IAAI,OAAO,eAAe,GAC9B,OAAO;CAET,OAAO,MAAM,KAAK,MAAM,EAAE,IAAI,GAAG;AACnC;;;;;;;AAQA,SAAgB,WAAW;CAEzB,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,EAAE,MAAM,aAAa,kBAAkB,SAAS;EACtD,MAAM,EAAE,SAAS,EAAE;EACnB,IACE,CAAC,iBACD,QACA,KAAK,WAAW,OAAO,KACvB,KAAK,WAAW,QAAQ,KACxB,KAAK,WAAW,UAAU,KAC1B,KAAK,WAAW,eAAe,KAC9B,KAAK,WAAW,YAAY,KAAK,KAAK,SAAS,YAAY,KAC5D,0BAA0B,KAAK,IAAI,GACnC;GACA,MAAM,KAAK;GACX;EACF;EACA,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,QAAQ;GACzC,EAAE,OAAO,eAAe,aAAa;GACrC,OAAO,EAAE,KAAK,MAAM,GAAG;EACzB;EACA,OAAO,EAAE,SAAS,eAAe,GAAG;CACtC;AACF"}
+{"version":3,"file":"auth-gate.mjs","names":[],"sources":["../../src/middleware/auth-gate.ts"],"sourcesContent":["import type { Auth } from \"@storyshelf/core/auth\";\nimport type { AuthUser } from \"@storyshelf/core/types\";\nimport { STORYBOOK_TOKEN_PREFIX } from \"@storyshelf/core/utils\";\nimport type { Context, Next } from \"hono\";\nimport { getStore } from \"../store.ts\";\n\n/** Resolve the request user from the auth adapter (null when auth is off or a token is used). */\nexport async function resolveRequestUser(\n  c: Pick<Context, \"req\">,\n  auth?: Auth,\n): Promise<AuthUser | null> {\n  if (!auth) {\n    return null;\n  }\n  if (c.req.header(\"authorization\")) {\n    return null;\n  }\n  return await auth.check(c.req.raw);\n}\n\n/**\n * Gate the server-rendered UI behind auth (ADR 0008): unauthenticated HTML\n * requests redirect to login. API/auth routes answer 401/403 themselves, and\n * published-Storybook routes enforce their own auth (public builds are\n * viewable without a session, ADR 0011), and `/_s/<token>` is answered by its signed token\n * alone (ADR 0007).\n */\nexport function authGate() {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const { user, authEnabled: isAuthEnabled } = getStore();\n    const { path } = c.req;\n    if (\n      !isAuthEnabled ||\n      user ||\n      path.startsWith(\"/api/\") ||\n      path.startsWith(\"/auth/\") ||\n      path.startsWith(\"/assets/\") ||\n      path.startsWith(STORYBOOK_TOKEN_PREFIX) ||\n      path.startsWith(\"/.well-known/\") ||\n      (path.startsWith(\"/projects/\") && path.includes(\"/storybook\")) ||\n      /^\\/projects\\/[^/]+\\/?$/u.test(path)\n    ) {\n      await next();\n      return;\n    }\n    if (c.req.header(\"HX-Request\") === \"true\") {\n      c.header(\"HX-Redirect\", \"/auth/login\");\n      return c.body(null, 204);\n    }\n    return c.redirect(\"/auth/login\", 302);\n  };\n}\n"],"mappings":";;;;;;;AAOA,eAAsB,mBACpB,GACA,MAC0B;CAC1B,IAAI,CAAC,MACH,OAAO;CAET,IAAI,EAAE,IAAI,OAAO,eAAe,GAC9B,OAAO;CAET,OAAO,MAAM,KAAK,MAAM,EAAE,IAAI,GAAG;AACnC;;;;;;;;AASA,SAAgB,WAAW;CAEzB,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,EAAE,MAAM,aAAa,kBAAkB,SAAS;EACtD,MAAM,EAAE,SAAS,EAAE;EACnB,IACE,CAAC,iBACD,QACA,KAAK,WAAW,OAAO,KACvB,KAAK,WAAW,QAAQ,KACxB,KAAK,WAAW,UAAU,KAC1B,KAAK,WAAW,sBAAsB,KACtC,KAAK,WAAW,eAAe,KAC9B,KAAK,WAAW,YAAY,KAAK,KAAK,SAAS,YAAY,KAC5D,0BAA0B,KAAK,IAAI,GACnC;GACA,MAAM,KAAK;GACX;EACF;EACA,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,QAAQ;GACzC,EAAE,OAAO,eAAe,aAAa;GACrC,OAAO,EAAE,KAAK,MAAM,GAAG;EACzB;EACA,OAAO,EAAE,SAAS,eAAe,GAAG;CACtC;AACF"}

package/dist/middleware/csrf.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { timingSafeEqualString } from "@storyshelf/core/utils";
 import { SESSION_COOKIE } from "@storyshelf/core/types";
 import { createHash, randomBytes } from "node:crypto";
-//#region src/middleware/csrf.ts
+// src/middleware/csrf.ts
 const DEFAULT_SESSION = "default";
 const FALLBACK_SECRET = randomBytes(32).toString("hex");
 /** Use the app secret when provided so tokens survive restarts and instances. */
@@ -69,7 +69,6 @@ function csrf(secret) {
 function getCsrfToken(secret, sessionId = DEFAULT_SESSION) {
 	return generateToken(resolveSecret(secret), sessionId);
 }
-//#endregion
 export { csrf, getCsrfToken, sessionIdFrom };
 
 //# sourceMappingURL=csrf.mjs.map

package/dist/middleware/rate-limit.mjs

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-//#region src/middleware/rate-limit.ts
+// src/middleware/rate-limit.ts
 /** Direct peer IP from server runtimes exposing the socket (unspoofable TCP source). */
 function peerIp(c) {
 	const env = c.env ?? {};
@@ -25,44 +25,51 @@ function rateLimitKey(prefix) {
 		return `${prefix}:anonymous`;
 	};
 }
-const stores = /* @__PURE__ */ new Map();
 /** Cap tracked buckets (spoofed keys would otherwise grow the map forever). */
 const MAX_BUCKETS = 1e4;
-function cleanup() {
-	const now = Date.now();
-	for (const [key, entry] of stores) if (now > entry.resetAt) stores.delete(key);
-}
-setInterval(cleanup, 6e4).unref();
-/** Hono middleware limiting requests per key within a sliding window. */
-function rateLimit(options) {
-	const { windowMs, max, keyGenerator } = options;
-	return async (c, next) => {
-		const key = keyGenerator ? keyGenerator(c) : rateLimitKey("api")(c);
-		const now = Date.now();
-		let entry = stores.get(key);
-		if (!entry || now > entry.resetAt) {
-			entry = {
-				count: 0,
-				resetAt: now + windowMs
-			};
-			if (stores.size >= MAX_BUCKETS) {
-				const oldest = stores.keys().next();
-				if (!oldest.done) stores.delete(oldest.value);
+const SWEEP_INTERVAL_MS = 6e4;
+/**
+* Create a rate limiter with its own bucket store, so each app instance
+* counts independently. Limiters built from the same `rateLimit` factory that
+* resolve to the same key share one counter (e.g. `/api/v1/*` and
+* `/api/v1/tokens/*` both bill the caller's `api:` bucket).
+*/
+function createRateLimiter() {
+	const stores = /* @__PURE__ */ new Map();
+	let lastSweep = Date.now();
+	const sweep = (now) => {
+		lastSweep = now;
+		for (const [key, entry] of stores) if (now > entry.resetAt) stores.delete(key);
+	};
+	return (options) => {
+		const { windowMs, max, keyGenerator } = options;
+		return async (c, next) => {
+			const key = keyGenerator ? keyGenerator(c) : rateLimitKey("api")(c);
+			const now = Date.now();
+			if (now - lastSweep > SWEEP_INTERVAL_MS) sweep(now);
+			let entry = stores.get(key);
+			if (!entry || now > entry.resetAt) {
+				entry = {
+					count: 0,
+					resetAt: now + windowMs
+				};
+				if (stores.size >= MAX_BUCKETS) {
+					const oldest = stores.keys().next();
+					if (!oldest.done) stores.delete(oldest.value);
+				}
+				stores.set(key, entry);
+			}
+			entry.count += 1;
+			if (entry.count > max) {
+				c.header("Retry-After", String(Math.ceil((entry.resetAt - now) / 1e3)));
+				return c.json({ error: "Too many requests" }, 429);
 			}
-			stores.set(key, entry);
-		}
-		entry.count += 1;
-		if (entry.count > max) {
-			const retryAfter = Math.ceil((entry.resetAt - now) / 1e3);
-			c.header("Retry-After", String(retryAfter));
-			return c.json({ error: "Too many requests" }, 429);
-		}
-		c.header("X-RateLimit-Limit", String(max));
-		c.header("X-RateLimit-Remaining", String(Math.max(0, max - entry.count)));
-		await next();
+			c.header("X-RateLimit-Limit", String(max));
+			c.header("X-RateLimit-Remaining", String(Math.max(0, max - entry.count)));
+			return await next();
+		};
 	};
 }
-//#endregion
-export { rateLimit, rateLimitKey };
+export { createRateLimiter, rateLimitKey };
 
 //# sourceMappingURL=rate-limit.mjs.map

package/dist/middleware/rate-limit.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.mjs","names":[],"sources":["../../src/middleware/rate-limit.ts"],"sourcesContent":["import type { Context, Next } from \"hono\";\n\ninterface RateLimitEntry {\n  count: number;\n  resetAt: number;\n}\n\ninterface RateLimitOptions {\n  windowMs: number;\n  max: number;\n  keyGenerator?: (c: Context) => string;\n}\n\n/** Direct peer IP from server runtimes exposing the socket (unspoofable TCP source). */\nfunction peerIp(c: Pick<Context, \"env\">): string | undefined {\n  const env = (c.env ?? {}) as {\n    incoming?: { socket?: { remoteAddress?: unknown } };\n    server?: { incoming?: { socket?: { remoteAddress?: unknown } } };\n  };\n  const address =\n    env.incoming?.socket?.remoteAddress ?? env.server?.incoming?.socket?.remoteAddress;\n  return typeof address === \"string\" && address ? address : undefined;\n}\n\n/**\n * Rate-limit identity for one bucket prefix: direct peer first, then the\n * first `X-Forwarded-For` entry (client-controlled, so only a fallback),\n * then `X-Real-IP`, then a shared bucket. Deployments behind proxies with\n * many users behind one peer IP share that peer's budget.\n */\nexport function rateLimitKey(prefix: string): (c: Context) => string {\n  return (c) => {\n    const peer = peerIp(c);\n    if (peer) {\n      return `${prefix}:${peer}`;\n    }\n    const forwarded = c.req.header(\"x-forwarded-for\")?.split(\",\")[0]?.trim();\n    if (forwarded) {\n      return `${prefix}:fwd:${forwarded}`;\n    }\n    const real = c.req.header(\"x-real-ip\")?.trim();\n    if (real) {\n      return `${prefix}:fwd:${real}`;\n    }\n    return `${prefix}:anonymous`;\n  };\n}\n\nconst stores = new Map<string, RateLimitEntry>();\n\n/** Cap tracked buckets (spoofed keys would otherwise grow the map forever). */\nconst MAX_BUCKETS = 10_000;\n\nfunction cleanup(): void {\n  const now = Date.now();\n  for (const [key, entry] of stores) {\n    if (now > entry.resetAt) {\n      stores.delete(key);\n    }\n  }\n}\n\nsetInterval(cleanup, 60_000).unref();\n\n/** Hono middleware limiting requests per key within a sliding window. */\nexport function rateLimit(options: RateLimitOptions) {\n  const { windowMs, max, keyGenerator } = options;\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const key = keyGenerator ? keyGenerator(c) : rateLimitKey(\"api\")(c);\n    const now = Date.now();\n    let entry = stores.get(key);\n    if (!entry || now > entry.resetAt) {\n      entry = { count: 0, resetAt: now + windowMs };\n      if (stores.size >= MAX_BUCKETS) {\n        const oldest = stores.keys().next();\n        if (!oldest.done) {\n          stores.delete(oldest.value);\n        }\n      }\n      stores.set(key, entry);\n    }\n    entry.count += 1;\n    if (entry.count > max) {\n      const retryAfter = Math.ceil((entry.resetAt - now) / 1000);\n      c.header(\"Retry-After\", String(retryAfter));\n      return c.json({ error: \"Too many requests\" }, 429);\n    }\n    c.header(\"X-RateLimit-Limit\", String(max));\n    c.header(\"X-RateLimit-Remaining\", String(Math.max(0, max - entry.count)));\n    await next();\n  };\n}\n"],"mappings":";;;;;AAcA,SAAS,OAAO,GAA6C;CAC3D,MAAM,MAAO,EAAE,OAAO,CAAC;CAIvB,MAAM,UACJ,IAAI,UAAU,QAAQ,iBAAiB,IAAI,QAAQ,UAAU,QAAQ;CACvE,OAAO,OAAO,YAAY,YAAY,UAAU,UAAU,KAAA;AAC5D;;;;;;;AAQA,SAAgB,aAAa,QAAwC;CACnE,QAAQ,MAAM;EACZ,MAAM,OAAO,OAAO,CAAC;EACrB,IAAI,MACF,OAAO,GAAG,OAAO,GAAG;EAEtB,MAAM,YAAY,EAAE,IAAI,OAAO,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK;EACvE,IAAI,WACF,OAAO,GAAG,OAAO,OAAO;EAE1B,MAAM,OAAO,EAAE,IAAI,OAAO,WAAW,CAAC,EAAE,KAAK;EAC7C,IAAI,MACF,OAAO,GAAG,OAAO,OAAO;EAE1B,OAAO,GAAG,OAAO;CACnB;AACF;AAEA,MAAM,yBAAS,IAAI,IAA4B;;AAG/C,MAAM,cAAc;AAEpB,SAAS,UAAgB;CACvB,MAAM,MAAM,KAAK,IAAI;CACrB,KAAK,MAAM,CAAC,KAAK,UAAU,QACzB,IAAI,MAAM,MAAM,SACd,OAAO,OAAO,GAAG;AAGvB;AAEA,YAAY,SAAS,GAAM,CAAC,CAAC,MAAM;;AAGnC,SAAgB,UAAU,SAA2B;CACnD,MAAM,EAAE,UAAU,KAAK,iBAAiB;CAExC,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,MAAM,eAAe,aAAa,CAAC,IAAI,aAAa,KAAK,CAAC,CAAC,CAAC;EAClE,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,QAAQ,OAAO,IAAI,GAAG;EAC1B,IAAI,CAAC,SAAS,MAAM,MAAM,SAAS;GACjC,QAAQ;IAAE,OAAO;IAAG,SAAS,MAAM;GAAS;GAC5C,IAAI,OAAO,QAAQ,aAAa;IAC9B,MAAM,SAAS,OAAO,KAAK,CAAC,CAAC,KAAK;IAClC,IAAI,CAAC,OAAO,MACV,OAAO,OAAO,OAAO,KAAK;GAE9B;GACA,OAAO,IAAI,KAAK,KAAK;EACvB;EACA,MAAM,SAAS;EACf,IAAI,MAAM,QAAQ,KAAK;GACrB,MAAM,aAAa,KAAK,MAAM,MAAM,UAAU,OAAO,GAAI;GACzD,EAAE,OAAO,eAAe,OAAO,UAAU,CAAC;GAC1C,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;EACnD;EACA,EAAE,OAAO,qBAAqB,OAAO,GAAG,CAAC;EACzC,EAAE,OAAO,yBAAyB,OAAO,KAAK,IAAI,GAAG,MAAM,MAAM,KAAK,CAAC,CAAC;EACxE,MAAM,KAAK;CACb;AACF"}
+{"version":3,"file":"rate-limit.mjs","names":[],"sources":["../../src/middleware/rate-limit.ts"],"sourcesContent":["import type { Context, MiddlewareHandler } from \"hono\";\n\ninterface RateLimitEntry {\n  count: number;\n  resetAt: number;\n}\n\nexport interface RateLimitOptions {\n  windowMs: number;\n  max: number;\n  keyGenerator?: (c: Context) => string;\n}\n\n/** Direct peer IP from server runtimes exposing the socket (unspoofable TCP source). */\nfunction peerIp(c: Pick<Context, \"env\">): string | undefined {\n  const env = (c.env ?? {}) as {\n    incoming?: { socket?: { remoteAddress?: unknown } };\n    server?: { incoming?: { socket?: { remoteAddress?: unknown } } };\n  };\n  const address =\n    env.incoming?.socket?.remoteAddress ?? env.server?.incoming?.socket?.remoteAddress;\n  return typeof address === \"string\" && address ? address : undefined;\n}\n\n/**\n * Rate-limit identity for one bucket prefix: direct peer first, then the\n * first `X-Forwarded-For` entry (client-controlled, so only a fallback),\n * then `X-Real-IP`, then a shared bucket. Deployments behind proxies with\n * many users behind one peer IP share that peer's budget.\n */\nexport function rateLimitKey(prefix: string): (c: Context) => string {\n  return (c) => {\n    const peer = peerIp(c);\n    if (peer) {\n      return `${prefix}:${peer}`;\n    }\n    const forwarded = c.req.header(\"x-forwarded-for\")?.split(\",\")[0]?.trim();\n    if (forwarded) {\n      return `${prefix}:fwd:${forwarded}`;\n    }\n    const real = c.req.header(\"x-real-ip\")?.trim();\n    if (real) {\n      return `${prefix}:fwd:${real}`;\n    }\n    return `${prefix}:anonymous`;\n  };\n}\n\n/** Cap tracked buckets (spoofed keys would otherwise grow the map forever). */\nconst MAX_BUCKETS = 10_000;\nconst SWEEP_INTERVAL_MS = 60_000;\n\n/**\n * Create a rate limiter with its own bucket store, so each app instance\n * counts independently. Limiters built from the same `rateLimit` factory that\n * resolve to the same key share one counter (e.g. `/api/v1/*` and\n * `/api/v1/tokens/*` both bill the caller's `api:` bucket).\n */\nexport function createRateLimiter(): (options: RateLimitOptions) => MiddlewareHandler {\n  const stores = new Map<string, RateLimitEntry>();\n  let lastSweep = Date.now();\n\n  const sweep = (now: number): void => {\n    lastSweep = now;\n    for (const [key, entry] of stores) {\n      if (now > entry.resetAt) {\n        stores.delete(key);\n      }\n    }\n  };\n\n  return (options) => {\n    const { windowMs, max, keyGenerator } = options;\n    return async (c, next) => {\n      const key = keyGenerator ? keyGenerator(c) : rateLimitKey(\"api\")(c);\n      const now = Date.now();\n      if (now - lastSweep > SWEEP_INTERVAL_MS) {\n        sweep(now);\n      }\n      let entry = stores.get(key);\n      if (!entry || now > entry.resetAt) {\n        entry = { count: 0, resetAt: now + windowMs };\n        if (stores.size >= MAX_BUCKETS) {\n          const oldest = stores.keys().next();\n          if (!oldest.done) {\n            stores.delete(oldest.value);\n          }\n        }\n        stores.set(key, entry);\n      }\n      entry.count += 1;\n      if (entry.count > max) {\n        c.header(\"Retry-After\", String(Math.ceil((entry.resetAt - now) / 1000)));\n        return c.json({ error: \"Too many requests\" }, 429);\n      }\n      c.header(\"X-RateLimit-Limit\", String(max));\n      c.header(\"X-RateLimit-Remaining\", String(Math.max(0, max - entry.count)));\n      return await next();\n    };\n  };\n}\n"],"mappings":";;;;;AAcA,SAAS,OAAO,GAA6C;CAC3D,MAAM,MAAO,EAAE,OAAO,CAAC;CAIvB,MAAM,UACJ,IAAI,UAAU,QAAQ,iBAAiB,IAAI,QAAQ,UAAU,QAAQ;CACvE,OAAO,OAAO,YAAY,YAAY,UAAU,UAAU,KAAA;AAC5D;;;;;;;AAQA,SAAgB,aAAa,QAAwC;CACnE,QAAQ,MAAM;EACZ,MAAM,OAAO,OAAO,CAAC;EACrB,IAAI,MACF,OAAO,GAAG,OAAO,GAAG;EAEtB,MAAM,YAAY,EAAE,IAAI,OAAO,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK;EACvE,IAAI,WACF,OAAO,GAAG,OAAO,OAAO;EAE1B,MAAM,OAAO,EAAE,IAAI,OAAO,WAAW,CAAC,EAAE,KAAK;EAC7C,IAAI,MACF,OAAO,GAAG,OAAO,OAAO;EAE1B,OAAO,GAAG,OAAO;CACnB;AACF;;AAGA,MAAM,cAAc;AACpB,MAAM,oBAAoB;;;;;;;AAQ1B,SAAgB,oBAAsE;CACpF,MAAM,yBAAS,IAAI,IAA4B;CAC/C,IAAI,YAAY,KAAK,IAAI;CAEzB,MAAM,SAAS,QAAsB;EACnC,YAAY;EACZ,KAAK,MAAM,CAAC,KAAK,UAAU,QACzB,IAAI,MAAM,MAAM,SACd,OAAO,OAAO,GAAG;CAGvB;CAEA,QAAQ,YAAY;EAClB,MAAM,EAAE,UAAU,KAAK,iBAAiB;EACxC,OAAO,OAAO,GAAG,SAAS;GACxB,MAAM,MAAM,eAAe,aAAa,CAAC,IAAI,aAAa,KAAK,CAAC,CAAC,CAAC;GAClE,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,MAAM,YAAY,mBACpB,MAAM,GAAG;GAEX,IAAI,QAAQ,OAAO,IAAI,GAAG;GAC1B,IAAI,CAAC,SAAS,MAAM,MAAM,SAAS;IACjC,QAAQ;KAAE,OAAO;KAAG,SAAS,MAAM;IAAS;IAC5C,IAAI,OAAO,QAAQ,aAAa;KAC9B,MAAM,SAAS,OAAO,KAAK,CAAC,CAAC,KAAK;KAClC,IAAI,CAAC,OAAO,MACV,OAAO,OAAO,OAAO,KAAK;IAE9B;IACA,OAAO,IAAI,KAAK,KAAK;GACvB;GACA,MAAM,SAAS;GACf,IAAI,MAAM,QAAQ,KAAK;IACrB,EAAE,OAAO,eAAe,OAAO,KAAK,MAAM,MAAM,UAAU,OAAO,GAAI,CAAC,CAAC;IACvE,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;GACnD;GACA,EAAE,OAAO,qBAAqB,OAAO,GAAG,CAAC;GACzC,EAAE,OAAO,yBAAyB,OAAO,KAAK,IAAI,GAAG,MAAM,MAAM,KAAK,CAAC,CAAC;GACxE,OAAO,MAAM,KAAK;EACpB;CACF;AACF"}

package/dist/middleware/request-log.mjs

@@ -1,7 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-//#region src/middleware/request-log.ts
+import { redactSecrets } from "@storyshelf/core/utils";
+// src/middleware/request-log.ts
 /** Hono middleware logging request start/end with duration. */
 function requestLogging(logger) {
 	return async (c, next) => {
@@ -10,21 +11,20 @@ function requestLogging(logger) {
 		logger.info({
 			reqId: id,
 			method: c.req.method,
-			url: c.req.path
+			url: redactSecrets(c.req.path)
 		}, "request start");
 		await next();
 		const userId = c.get("userId");
 		logger.info({
 			reqId: id,
 			method: c.req.method,
-			url: c.req.path,
+			url: redactSecrets(c.req.path),
 			status: c.res.status,
 			durationMs: Math.round(performance.now() - started),
 			...userId ? { userId } : {}
 		}, "request end");
 	};
 }
-//#endregion
 export { requestLogging };
 
 //# sourceMappingURL=request-log.mjs.map

package/dist/middleware/request-log.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request-log.mjs","names":[],"sources":["../../src/middleware/request-log.ts"],"sourcesContent":["import type { Logger } from \"@storyshelf/core/logger\";\nimport type { Context, Next } from \"hono\";\n\n/** Hono middleware logging request start/end with duration. */\nexport function requestLogging(logger: Logger) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const started = performance.now();\n    const id = c.get(\"requestId\");\n    logger.info({ reqId: id, method: c.req.method, url: c.req.path }, \"request start\");\n    await next();\n    const userId = c.get(\"userId\") as string | null | undefined;\n    logger.info(\n      {\n        reqId: id,\n        method: c.req.method,\n        url: c.req.path,\n        status: c.res.status,\n        durationMs: Math.round(performance.now() - started),\n        ...(userId ? { userId } : {}),\n      },\n      \"request end\",\n    );\n  };\n}\n"],"mappings":";;;;;AAIA,SAAgB,eAAe,QAAgB;CAE7C,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,UAAU,YAAY,IAAI;EAChC,MAAM,KAAK,EAAE,IAAI,WAAW;EAC5B,OAAO,KAAK;GAAE,OAAO;GAAI,QAAQ,EAAE,IAAI;GAAQ,KAAK,EAAE,IAAI;EAAK,GAAG,eAAe;EACjF,MAAM,KAAK;EACX,MAAM,SAAS,EAAE,IAAI,QAAQ;EAC7B,OAAO,KACL;GACE,OAAO;GACP,QAAQ,EAAE,IAAI;GACd,KAAK,EAAE,IAAI;GACX,QAAQ,EAAE,IAAI;GACd,YAAY,KAAK,MAAM,YAAY,IAAI,IAAI,OAAO;GAClD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC7B,GACA,aACF;CACF;AACF"}
+{"version":3,"file":"request-log.mjs","names":[],"sources":["../../src/middleware/request-log.ts"],"sourcesContent":["import type { Logger } from \"@storyshelf/core/logger\";\nimport { redactSecrets } from \"@storyshelf/core/utils\";\nimport type { Context, Next } from \"hono\";\n\n/** Hono middleware logging request start/end with duration. */\nexport function requestLogging(logger: Logger) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const started = performance.now();\n    const id = c.get(\"requestId\");\n    logger.info(\n      { reqId: id, method: c.req.method, url: redactSecrets(c.req.path) },\n      \"request start\",\n    );\n    await next();\n    const userId = c.get(\"userId\") as string | null | undefined;\n    logger.info(\n      {\n        reqId: id,\n        method: c.req.method,\n        url: redactSecrets(c.req.path),\n        status: c.res.status,\n        durationMs: Math.round(performance.now() - started),\n        ...(userId ? { userId } : {}),\n      },\n      \"request end\",\n    );\n  };\n}\n"],"mappings":";;;;;;AAKA,SAAgB,eAAe,QAAgB;CAE7C,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,UAAU,YAAY,IAAI;EAChC,MAAM,KAAK,EAAE,IAAI,WAAW;EAC5B,OAAO,KACL;GAAE,OAAO;GAAI,QAAQ,EAAE,IAAI;GAAQ,KAAK,cAAc,EAAE,IAAI,IAAI;EAAE,GAClE,eACF;EACA,MAAM,KAAK;EACX,MAAM,SAAS,EAAE,IAAI,QAAQ;EAC7B,OAAO,KACL;GACE,OAAO;GACP,QAAQ,EAAE,IAAI;GACd,KAAK,cAAc,EAAE,IAAI,IAAI;GAC7B,QAAQ,EAAE,IAAI;GACd,YAAY,KAAK,MAAM,YAAY,IAAI,IAAI,OAAO;GAClD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC7B,GACA,aACF;CACF;AACF"}

package/dist/middleware/require-review.mjs

@@ -0,0 +1,50 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { matchedRouteClass } from "./require-testing.mjs";
+import { resolveAuthorizedProject } from "../routers/helpers.mjs";
+// src/middleware/require-review.ts
+/** Body of the 404 a `review` route answers for a project with review off. */
+const REVIEW_DISABLED_MESSAGE = "Review is off for this project.";
+/** Roles that may see a project's routes at all; the gate answers only to them. */
+const VIEWER_ROLES = [
+	"viewer",
+	"developer",
+	"approver",
+	"admin"
+];
+/** The project slug of `/api/v1/projects/:slug/...` and `/projects/:slug/...` paths. */
+function projectSlugOf(path) {
+	return /^(?:\/api\/v1)?\/projects\/(?<slug>[^/]+)\//u.exec(path)?.groups?.["slug"];
+}
+/**
+* Gate routes classified `review` (ADR 0013, decision 10): they answer 404 for a project that has
+* review off, as if they did not exist. The switch is read from the database on every request, so
+* turning review off or on takes effect at once. Only a caller who may view the project is told
+* (anyone else gets the route's own refusal), so the gate reveals nothing about a project the
+* caller cannot see. It runs after the store scope and the auth gate, which it needs to resolve
+* the caller; routes of other classes, and unknown projects, pass through.
+*/
+function requireReview() {
+	return async (c, next) => {
+		if (matchedRouteClass(c) !== "review" || !await reviewIsOff(c)) {
+			await next();
+			return;
+		}
+		if (c.req.path.startsWith("/api/")) return c.json({ error: REVIEW_DISABLED_MESSAGE }, 404);
+		return c.text(REVIEW_DISABLED_MESSAGE, 404);
+	};
+}
+/** Whether the request names a project the caller may view and whose review switch is off. */
+async function reviewIsOff(c) {
+	const slug = projectSlugOf(c.req.path);
+	if (slug === void 0) return false;
+	try {
+		return (await resolveAuthorizedProject(c, slug, ...VIEWER_ROLES)).reviewEnabled === false;
+	} catch {
+		return false;
+	}
+}
+export { REVIEW_DISABLED_MESSAGE, requireReview };
+
+//# sourceMappingURL=require-review.mjs.map

package/dist/middleware/require-review.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-review.mjs","names":[],"sources":["../../src/middleware/require-review.ts"],"sourcesContent":["import type { Context, Next } from \"hono\";\nimport { resolveAuthorizedProject } from \"../routers/helpers.ts\";\nimport { matchedRouteClass } from \"./require-testing.ts\";\n\n/** Body of the 404 a `review` route answers for a project with review off. */\nexport const REVIEW_DISABLED_MESSAGE = \"Review is off for this project.\";\n\n/** Roles that may see a project's routes at all; the gate answers only to them. */\nconst VIEWER_ROLES = [\"viewer\", \"developer\", \"approver\", \"admin\"] as const;\n\n/** The project slug of `/api/v1/projects/:slug/...` and `/projects/:slug/...` paths. */\nfunction projectSlugOf(path: string): string | undefined {\n  return /^(?:\\/api\\/v1)?\\/projects\\/(?<slug>[^/]+)\\//u.exec(path)?.groups?.[\"slug\"];\n}\n\n/**\n * Gate routes classified `review` (ADR 0013, decision 10): they answer 404 for a project that has\n * review off, as if they did not exist. The switch is read from the database on every request, so\n * turning review off or on takes effect at once. Only a caller who may view the project is told\n * (anyone else gets the route's own refusal), so the gate reveals nothing about a project the\n * caller cannot see. It runs after the store scope and the auth gate, which it needs to resolve\n * the caller; routes of other classes, and unknown projects, pass through.\n */\nexport function requireReview() {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    if (matchedRouteClass(c) !== \"review\" || !(await reviewIsOff(c))) {\n      await next();\n      return;\n    }\n    if (c.req.path.startsWith(\"/api/\")) {\n      return c.json({ error: REVIEW_DISABLED_MESSAGE }, 404);\n    }\n    return c.text(REVIEW_DISABLED_MESSAGE, 404);\n  };\n}\n\n/** Whether the request names a project the caller may view and whose review switch is off. */\nasync function reviewIsOff(c: Context): Promise<boolean> {\n  const slug = projectSlugOf(c.req.path);\n  if (slug === undefined) {\n    return false;\n  }\n  try {\n    const project = await resolveAuthorizedProject(c, slug, ...VIEWER_ROLES);\n    return project.reviewEnabled === false;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;AAKA,MAAa,0BAA0B;;AAGvC,MAAM,eAAe;CAAC;CAAU;CAAa;CAAY;AAAO;;AAGhE,SAAS,cAAc,MAAkC;CACvD,OAAO,+CAA+C,KAAK,IAAI,CAAC,EAAE,SAAS;AAC7E;;;;;;;;;AAUA,SAAgB,gBAAgB;CAE9B,OAAO,OAAO,GAAY,SAAyC;EACjE,IAAI,kBAAkB,CAAC,MAAM,YAAY,CAAE,MAAM,YAAY,CAAC,GAAI;GAChE,MAAM,KAAK;GACX;EACF;EACA,IAAI,EAAE,IAAI,KAAK,WAAW,OAAO,GAC/B,OAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,GAAG,GAAG;EAEvD,OAAO,EAAE,KAAK,yBAAyB,GAAG;CAC5C;AACF;;AAGA,eAAe,YAAY,GAA8B;CACvD,MAAM,OAAO,cAAc,EAAE,IAAI,IAAI;CACrC,IAAI,SAAS,KAAA,GACX,OAAO;CAET,IAAI;EAEF,QAAO,MADe,yBAAyB,GAAG,MAAM,GAAG,YAAY,EAAA,CACxD,kBAAkB;CACnC,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/middleware/require-testing.mjs

@@ -0,0 +1,40 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { classOfRoute } from "../routes/classification.mjs";
+import { matchedRoutes } from "hono/route";
+// src/middleware/require-testing.ts
+/** Body of the 404 a `testing` route answers on a hosting-only instance. */
+const TESTING_DISABLED_MESSAGE = "Testing is not enabled on this instance.";
+/**
+* Gate routes classified `testing` (ADR 0006, decisions 1 and 8): without `options.testing` they
+* answer 404, as if the feature did not exist. The class comes from the route table through the
+* handler Hono matched, so a new route needs no guard of its own, only a table entry. It is mounted
+* before the CSRF and rate-limit guards so a hidden route answers the same 404 for every request. `hosting`,
+* `both` and `review` routes, and requests that match no classified route, pass through.
+*/
+function requireTesting(enabled) {
+	return async (c, next) => {
+		if (enabled || !isTestingRoute(c)) {
+			await next();
+			return;
+		}
+		if (c.req.path.startsWith("/api/")) return c.json({ error: TESTING_DISABLED_MESSAGE }, 404);
+		return c.text(TESTING_DISABLED_MESSAGE, 404);
+	};
+}
+/** The last matched handler that the table classifies (middleware matches come first). */
+function matchedRouteClass(c) {
+	const routes = matchedRoutes(c);
+	for (let index = routes.length - 1; index >= 0; index -= 1) {
+		const route = routes[index];
+		const routeClass = route && classOfRoute(route.method, route.path);
+		if (routeClass !== void 0) return routeClass;
+	}
+}
+function isTestingRoute(c) {
+	return matchedRouteClass(c) === "testing";
+}
+export { TESTING_DISABLED_MESSAGE, matchedRouteClass, requireTesting };
+
+//# sourceMappingURL=require-testing.mjs.map

package/dist/middleware/require-testing.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-testing.mjs","names":[],"sources":["../../src/middleware/require-testing.ts"],"sourcesContent":["import type { Context, Next } from \"hono\";\nimport { matchedRoutes } from \"hono/route\";\nimport { classOfRoute, type RouteClass } from \"../routes/classification.ts\";\n\n/** Body of the 404 a `testing` route answers on a hosting-only instance. */\nexport const TESTING_DISABLED_MESSAGE = \"Testing is not enabled on this instance.\";\n\n/**\n * Gate routes classified `testing` (ADR 0006, decisions 1 and 8): without `options.testing` they\n * answer 404, as if the feature did not exist. The class comes from the route table through the\n * handler Hono matched, so a new route needs no guard of its own, only a table entry. It is mounted\n * before the CSRF and rate-limit guards so a hidden route answers the same 404 for every request. `hosting`,\n * `both` and `review` routes, and requests that match no classified route, pass through.\n */\nexport function requireTesting(enabled: boolean) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    if (enabled || !isTestingRoute(c)) {\n      await next();\n      return;\n    }\n    if (c.req.path.startsWith(\"/api/\")) {\n      return c.json({ error: TESTING_DISABLED_MESSAGE }, 404);\n    }\n    return c.text(TESTING_DISABLED_MESSAGE, 404);\n  };\n}\n\n/** The last matched handler that the table classifies (middleware matches come first). */\nexport function matchedRouteClass(c: Context): RouteClass | undefined {\n  const routes = matchedRoutes(c);\n  for (let index = routes.length - 1; index >= 0; index -= 1) {\n    const route = routes[index];\n    const routeClass = route && classOfRoute(route.method, route.path);\n    if (routeClass !== undefined) {\n      return routeClass;\n    }\n  }\n  return undefined;\n}\n\nfunction isTestingRoute(c: Context): boolean {\n  return matchedRouteClass(c) === \"testing\";\n}\n"],"mappings":";;;;;;;AAKA,MAAa,2BAA2B;;;;;;;;AASxC,SAAgB,eAAe,SAAkB;CAE/C,OAAO,OAAO,GAAY,SAAyC;EACjE,IAAI,WAAW,CAAC,eAAe,CAAC,GAAG;GACjC,MAAM,KAAK;GACX;EACF;EACA,IAAI,EAAE,IAAI,KAAK,WAAW,OAAO,GAC/B,OAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,GAAG,GAAG;EAExD,OAAO,EAAE,KAAK,0BAA0B,GAAG;CAC7C;AACF;;AAGA,SAAgB,kBAAkB,GAAoC;CACpE,MAAM,SAAS,cAAc,CAAC;CAC9B,KAAK,IAAI,QAAQ,OAAO,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG;EAC1D,MAAM,QAAQ,OAAO;EACrB,MAAM,aAAa,SAAS,aAAa,MAAM,QAAQ,MAAM,IAAI;EACjE,IAAI,eAAe,KAAA,GACjB,OAAO;CAEX;AAEF;AAEA,SAAS,eAAe,GAAqB;CAC3C,OAAO,kBAAkB,CAAC,MAAM;AAClC"}

package/dist/middleware/server-timing.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { runWithTimings } from "@storyshelf/core/utils";
 import { setMetric, timing } from "hono/timing";
-//#region src/middleware/server-timing.ts
+// src/middleware/server-timing.ts
 /**
 * Opt-in `Server-Timing` response headers over Hono's timing middleware.
 *
@@ -33,7 +33,6 @@ function serverTiming(enabled) {
 		if (headers.length > 0) c.res.headers.append("Server-Timing", headers.join(","));
 	};
 }
-//#endregion
 export { serverTiming };
 
 //# sourceMappingURL=server-timing.mjs.map

package/dist/middleware/setup-gate.mjs

@@ -2,7 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { sanitizeErrorText } from "@storyshelf/core/utils";
-//#region src/middleware/setup-gate.ts
+// src/middleware/setup-gate.ts
 /** Failures safe to expose on the setup gate's 503 (redacted, no secrets). */
 function publicFailures(result) {
 	return result.failures.map((failure) => ({
@@ -31,7 +31,6 @@ function setupGate(getReady) {
 		await next();
 	};
 }
-//#endregion
 export { setupGate };
 
 //# sourceMappingURL=setup-gate.mjs.map

package/dist/middleware/setup-gate.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"setup-gate.mjs","names":[],"sources":["../../src/middleware/setup-gate.ts"],"sourcesContent":["import type { AdapterSetupResult } from \"@storyshelf/core/adapter/setup\";\nimport type { ShelfOptions } from \"@storyshelf/core/config\";\nimport { sanitizeErrorText } from \"@storyshelf/core/utils\";\nimport type { Context, Next } from \"hono\";\nimport type { QueueWiring } from \"../capture-setup.ts\";\nimport type { ServerRuntime } from \"../runtime.ts\";\n\nexport interface MiddlewareWiring extends ServerRuntime, QueueWiring {\n  options: ShelfOptions;\n  getReady: () => Promise<AdapterSetupResult>;\n}\n\n/** Failures safe to expose on the setup gate's 503 (redacted, no secrets). */\nfunction publicFailures(\n  result: AdapterSetupResult,\n): { category: string; kind: string; error: string }[] {\n  return result.failures.map((failure) => ({\n    category: failure.category,\n    kind: failure.kind,\n    error: sanitizeErrorText(failure.error, 500),\n  }));\n}\n\n/**\n * Block requests until adapter setup settles; answer 503 with the per-adapter\n * failures when setup failed. Health probes and the admin System page are\n * exempt (they report setup state themselves instead of being masked by\n * the gate — both are site-admin-gated where it matters).\n */\nexport function setupGate(getReady: () => Promise<AdapterSetupResult>) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    if (c.req.path === \"/api/v1/health\" || c.req.path === \"/admin\") {\n      await next();\n      return;\n    }\n    const result = await getReady();\n    if (!result.ok) {\n      return c.json({ error: \"Adapters failed setup\", failures: publicFailures(result) }, 503);\n    }\n    await next();\n  };\n}\n"],"mappings":";;;;;;AAaA,SAAS,eACP,QACqD;CACrD,OAAO,OAAO,SAAS,KAAK,aAAa;EACvC,UAAU,QAAQ;EAClB,MAAM,QAAQ;EACd,OAAO,kBAAkB,QAAQ,OAAO,GAAG;CAC7C,EAAE;AACJ;;;;;;;AAQA,SAAgB,UAAU,UAA6C;CAErE,OAAO,OAAO,GAAY,SAAyC;EACjE,IAAI,EAAE,IAAI,SAAS,oBAAoB,EAAE,IAAI,SAAS,UAAU;GAC9D,MAAM,KAAK;GACX;EACF;EACA,MAAM,SAAS,MAAM,SAAS;EAC9B,IAAI,CAAC,OAAO,IACV,OAAO,EAAE,KAAK;GAAE,OAAO;GAAyB,UAAU,eAAe,MAAM;EAAE,GAAG,GAAG;EAEzF,MAAM,KAAK;CACb;AACF"}
+{"version":3,"file":"setup-gate.mjs","names":[],"sources":["../../src/middleware/setup-gate.ts"],"sourcesContent":["import type { AdapterSetupResult } from \"@storyshelf/core/adapter/setup\";\nimport type { ShelfOptions } from \"@storyshelf/core/config\";\nimport { sanitizeErrorText } from \"@storyshelf/core/utils\";\nimport type { Context, Next } from \"hono\";\nimport type { JobsWiring } from \"../jobs-setup.ts\";\nimport type { ServerRuntime } from \"../runtime.ts\";\n\nexport interface MiddlewareWiring extends ServerRuntime, Omit<JobsWiring, \"consumer\"> {\n  options: ShelfOptions;\n  getReady: () => Promise<AdapterSetupResult>;\n}\n\n/** Failures safe to expose on the setup gate's 503 (redacted, no secrets). */\nfunction publicFailures(\n  result: AdapterSetupResult,\n): { category: string; kind: string; error: string }[] {\n  return result.failures.map((failure) => ({\n    category: failure.category,\n    kind: failure.kind,\n    error: sanitizeErrorText(failure.error, 500),\n  }));\n}\n\n/**\n * Block requests until adapter setup settles; answer 503 with the per-adapter\n * failures when setup failed. Health probes and the admin System page are\n * exempt (they report setup state themselves instead of being masked by\n * the gate — both are site-admin-gated where it matters).\n */\nexport function setupGate(getReady: () => Promise<AdapterSetupResult>) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    if (c.req.path === \"/api/v1/health\" || c.req.path === \"/admin\") {\n      await next();\n      return;\n    }\n    const result = await getReady();\n    if (!result.ok) {\n      return c.json({ error: \"Adapters failed setup\", failures: publicFailures(result) }, 503);\n    }\n    await next();\n  };\n}\n"],"mappings":";;;;;;AAaA,SAAS,eACP,QACqD;CACrD,OAAO,OAAO,SAAS,KAAK,aAAa;EACvC,UAAU,QAAQ;EAClB,MAAM,QAAQ;EACd,OAAO,kBAAkB,QAAQ,OAAO,GAAG;CAC7C,EAAE;AACJ;;;;;;;AAQA,SAAgB,UAAU,UAA6C;CAErE,OAAO,OAAO,GAAY,SAAyC;EACjE,IAAI,EAAE,IAAI,SAAS,oBAAoB,EAAE,IAAI,SAAS,UAAU;GAC9D,MAAM,KAAK;GACX;EACF;EACA,MAAM,SAAS,MAAM,SAAS;EAC9B,IAAI,CAAC,OAAO,IACV,OAAO,EAAE,KAAK;GAAE,OAAO;GAAyB,UAAU,eAAe,MAAM;EAAE,GAAG,GAAG;EAEzF,MAAM,KAAK;CACb;AACF"}

package/dist/middleware/store-scope.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { runWithStore } from "../store.mjs";
 import { sessionIdFrom } from "./csrf.mjs";
-//#region src/middleware/store-scope.ts
+// src/middleware/store-scope.ts
 /** Hono middleware running downstream handlers inside the request store. */
 function storeScope(deps) {
 	return async (c, next) => {
@@ -17,17 +17,26 @@ function storeScope(deps) {
 			logger: deps.logger,
 			user,
 			authEnabled: deps.authEnabled,
+			testing: deps.testing,
 			sessionId: sessionIdFrom(c),
 			enqueueCapture: deps.enqueueCapture,
 			captureQueue: deps.captureQueue,
-			gitHosts: deps.gitHosts,
-			notifiers: deps.notifiers
+			capturesHere: deps.capturesHere,
+			publish: deps.publish,
+			cancelBuildJobs: deps.cancelBuildJobs,
+			buildState: deps.buildState,
+			captureConcurrency: deps.captureConcurrency,
+			runner: deps.runner,
+			publicOrigin: deps.publicOrigin,
+			design: deps.design,
+			notifiers: deps.notifiers,
+			notificationsConfig: deps.notificationsConfig,
+			ai: deps.ai
 		}, async () => {
 			await next();
 		});
 	};
 }
-//#endregion
 export { storeScope };
 
 //# sourceMappingURL=store-scope.mjs.map

package/dist/middleware/store-scope.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"store-scope.mjs","names":[],"sources":["../../src/middleware/store-scope.ts"],"sourcesContent":["import type { CaptureQueue } from \"@storyshelf/core/adapter/capture-queue\";\nimport type { DatabaseAdapter } from \"@storyshelf/core/adapter/database\";\nimport type { GitHostProvider } from \"@storyshelf/core/adapter/git-host\";\nimport type { NotifierProvider } from \"@storyshelf/core/adapter/notifier\";\nimport type { StorageAdapter } from \"@storyshelf/core/adapter/storage\";\nimport type { ShelfConfig, UIConfig } from \"@storyshelf/core/config\";\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport type { AuthUser } from \"@storyshelf/core/types\";\nimport type { Context, Next } from \"hono\";\nimport { runWithStore } from \"../store.ts\";\nimport { sessionIdFrom } from \"./csrf.ts\";\n\n/** Dependencies scoped into the request store for router handlers. */\nexport interface StoreScopeDeps {\n  db: DatabaseAdapter;\n  storage: StorageAdapter;\n  config: ShelfConfig;\n  ui: UIConfig;\n  logger: Logger;\n  authEnabled: boolean;\n  enqueueCapture?: (buildId: string, reqId?: string) => Promise<void>;\n  captureQueue: CaptureQueue | null;\n  gitHosts: GitHostProvider[];\n  notifiers: NotifierProvider[];\n  resolveUser: (c: Context) => Promise<AuthUser | null>;\n}\n\n/** Hono middleware running downstream handlers inside the request store. */\nexport function storeScope(deps: StoreScopeDeps) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const user = await deps.resolveUser(c);\n    c.set(\"userId\", user?.id ?? null);\n    await runWithStore(\n      {\n        db: deps.db,\n        storage: deps.storage,\n        config: deps.config,\n        ui: deps.ui,\n        logger: deps.logger,\n        user,\n        authEnabled: deps.authEnabled,\n        sessionId: sessionIdFrom(c),\n        enqueueCapture: deps.enqueueCapture,\n        captureQueue: deps.captureQueue,\n        gitHosts: deps.gitHosts,\n        notifiers: deps.notifiers,\n      },\n      async () => {\n        await next();\n      },\n    );\n  };\n}\n"],"mappings":";;;;;;;AA4BA,SAAgB,WAAW,MAAsB;CAE/C,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,OAAO,MAAM,KAAK,YAAY,CAAC;EACrC,EAAE,IAAI,UAAU,MAAM,MAAM,IAAI;EAChC,MAAM,aACJ;GACE,IAAI,KAAK;GACT,SAAS,KAAK;GACd,QAAQ,KAAK;GACb,IAAI,KAAK;GACT,QAAQ,KAAK;GACb;GACA,aAAa,KAAK;GAClB,WAAW,cAAc,CAAC;GAC1B,gBAAgB,KAAK;GACrB,cAAc,KAAK;GACnB,UAAU,KAAK;GACf,WAAW,KAAK;EAClB,GACA,YAAY;GACV,MAAM,KAAK;EACb,CACF;CACF;AACF"}
+{"version":3,"file":"store-scope.mjs","names":[],"sources":["../../src/middleware/store-scope.ts"],"sourcesContent":["import type { CaptureQueue } from \"@storyshelf/core/adapter/capture-queue\";\nimport type { CaptureRunner } from \"@storyshelf/core/adapter/capture-runner\";\nimport type { DatabaseAdapter } from \"@storyshelf/core/adapter/database\";\nimport type { DesignProvider } from \"@storyshelf/core/adapter/design\";\nimport type { NotifierProvider } from \"@storyshelf/core/adapter/notifier\";\nimport type { StorageAdapter } from \"@storyshelf/core/adapter/storage\";\nimport type { Ai } from \"@storyshelf/core/ai\";\nimport type { BuildStatePublisher } from \"@storyshelf/core/capture\";\nimport type { NotificationsConfig, ShelfConfig, UIConfig } from \"@storyshelf/core/config\";\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport type { PublicOriginResolver } from \"@storyshelf/core/models\";\nimport type { AuthUser } from \"@storyshelf/core/types\";\nimport type { Context, Next } from \"hono\";\nimport type { PublishService } from \"../publish-setup.ts\";\nimport { runWithStore } from \"../store.ts\";\nimport { sessionIdFrom } from \"./csrf.ts\";\n\n/** Dependencies scoped into the request store for router handlers. */\nexport interface StoreScopeDeps {\n  db: DatabaseAdapter;\n  storage: StorageAdapter;\n  config: ShelfConfig;\n  ui: UIConfig;\n  logger: Logger;\n  authEnabled: boolean;\n  testing: boolean;\n  enqueueCapture?: (buildId: string, reqId?: string) => Promise<void>;\n  captureQueue: CaptureQueue | null;\n  /** This instance runs the capture jobs itself (the retry and compute-jobs UI applies). */\n  capturesHere?: boolean;\n  publish?: PublishService;\n  cancelBuildJobs?: (buildId: string) => Promise<boolean>;\n  buildState?: BuildStatePublisher;\n  captureConcurrency?: number;\n  runner?: Pick<CaptureRunner, \"metadata\"> | undefined;\n  publicOrigin?: PublicOriginResolver | undefined;\n  design: DesignProvider[];\n  notifiers: NotifierProvider[];\n  notificationsConfig?: NotificationsConfig;\n  ai?: Ai;\n  resolveUser: (c: Context) => Promise<AuthUser | null>;\n}\n\n/** Hono middleware running downstream handlers inside the request store. */\nexport function storeScope(deps: StoreScopeDeps) {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const user = await deps.resolveUser(c);\n    c.set(\"userId\", user?.id ?? null);\n    await runWithStore(\n      {\n        db: deps.db,\n        storage: deps.storage,\n        config: deps.config,\n        ui: deps.ui,\n        logger: deps.logger,\n        user,\n        authEnabled: deps.authEnabled,\n        testing: deps.testing,\n        sessionId: sessionIdFrom(c),\n        enqueueCapture: deps.enqueueCapture,\n        captureQueue: deps.captureQueue,\n        capturesHere: deps.capturesHere,\n        publish: deps.publish,\n        cancelBuildJobs: deps.cancelBuildJobs,\n        buildState: deps.buildState,\n        captureConcurrency: deps.captureConcurrency,\n        runner: deps.runner,\n        publicOrigin: deps.publicOrigin,\n        design: deps.design,\n        notifiers: deps.notifiers,\n        notificationsConfig: deps.notificationsConfig,\n        ai: deps.ai,\n      },\n      async () => {\n        await next();\n      },\n    );\n  };\n}\n"],"mappings":";;;;;;;AA4CA,SAAgB,WAAW,MAAsB;CAE/C,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,OAAO,MAAM,KAAK,YAAY,CAAC;EACrC,EAAE,IAAI,UAAU,MAAM,MAAM,IAAI;EAChC,MAAM,aACJ;GACE,IAAI,KAAK;GACT,SAAS,KAAK;GACd,QAAQ,KAAK;GACb,IAAI,KAAK;GACT,QAAQ,KAAK;GACb;GACA,aAAa,KAAK;GAClB,SAAS,KAAK;GACd,WAAW,cAAc,CAAC;GAC1B,gBAAgB,KAAK;GACrB,cAAc,KAAK;GACnB,cAAc,KAAK;GACnB,SAAS,KAAK;GACd,iBAAiB,KAAK;GACtB,YAAY,KAAK;GACjB,oBAAoB,KAAK;GACzB,QAAQ,KAAK;GACb,cAAc,KAAK;GACnB,QAAQ,KAAK;GACb,WAAW,KAAK;GAChB,qBAAqB,KAAK;GAC1B,IAAI,KAAK;EACX,GACA,YAAY;GACV,MAAM,KAAK;EACb,CACF;CACF;AACF"}

package/dist/notifications-pause.mjs

@@ -0,0 +1,32 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "./store.mjs";
+// src/notifications-pause.ts
+/** What the System page and the notification settings tell the viewer. */
+const NOTIFICATIONS_PAUSED_TEXT = "Notifications are paused until a public URL is set; set PUBLIC_BASE_URL or confirm the detected origin.";
+/** The origin notifications link to, or `undefined` while none is resolved. */
+async function notificationOrigin(deps) {
+	const trimmed = (deps.publicOrigin ? await deps.publicOrigin.url() : deps.config.publicBaseUrl)?.trim().replace(/\/+$/u, "");
+	return trimmed === void 0 || trimmed === "" ? void 0 : trimmed;
+}
+/** Whether the current instance sends no notifications for want of a public origin. */
+async function notificationsPaused(store = getStore()) {
+	return await notificationOrigin(store) === void 0;
+}
+/** Loggers that already said so; cleared when an origin resolves, so a later pause logs again. */
+const warned = /* @__PURE__ */ new WeakSet();
+/** Log (once per pause, per logger) that a notification was skipped. */
+function warnPaused(logger, event) {
+	if (!warned.has(logger)) {
+		warned.add(logger);
+		logger.warn({ event }, `${NOTIFICATIONS_PAUSED_TEXT} Skipping notifications.`);
+	}
+}
+/** Forget a logged pause: an origin resolved. */
+function clearPaused(logger) {
+	warned.delete(logger);
+}
+export { NOTIFICATIONS_PAUSED_TEXT, clearPaused, notificationOrigin, notificationsPaused, warnPaused };
+
+//# sourceMappingURL=notifications-pause.mjs.map

package/dist/notifications-pause.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications-pause.mjs","names":[],"sources":["../src/notifications-pause.ts"],"sourcesContent":["import type { ShelfConfig } from \"@storyshelf/core/config\";\n/**\n * Notifications need a public origin (ADR 0014, decision 11): every message carries a link and\n * every git status targets one, so while the resolver (ADR 0007, decision 6) finds no confirmed\n * origin (a detected one counts only once an admin confirmed it) nothing is sent. Pausing is not a failure: no channel is marked as errored, and the System page\n * and the notification settings say what to set.\n */\nimport type { Logger } from \"@storyshelf/core/logger\";\nimport type { PublicOriginResolver } from \"@storyshelf/core/models\";\nimport { getStore, type Store } from \"./store.ts\";\n\n/** What the System page and the notification settings tell the viewer. */\nexport const NOTIFICATIONS_PAUSED_TEXT =\n  \"Notifications are paused until a public URL is set; set PUBLIC_BASE_URL or confirm the detected origin.\";\n\n/** What a pause check reads. */\ninterface OriginDeps {\n  config: Pick<ShelfConfig, \"publicBaseUrl\">;\n  /** The resolver; absent (hand-built stores) means `config.publicBaseUrl` only. */\n  publicOrigin?: Pick<PublicOriginResolver, \"url\"> | undefined;\n}\n\n/** The origin notifications link to, or `undefined` while none is resolved. */\nexport async function notificationOrigin(deps: OriginDeps): Promise<string | undefined> {\n  const origin = deps.publicOrigin ? await deps.publicOrigin.url() : deps.config.publicBaseUrl;\n  const trimmed = origin?.trim().replace(/\\/+$/u, \"\");\n  return trimmed === undefined || trimmed === \"\" ? undefined : trimmed;\n}\n\n/** Whether the current instance sends no notifications for want of a public origin. */\nexport async function notificationsPaused(store: Store = getStore()): Promise<boolean> {\n  return (await notificationOrigin(store)) === undefined;\n}\n\n/** Loggers that already said so; cleared when an origin resolves, so a later pause logs again. */\nconst warned = new WeakSet<object>();\n\n/** Log (once per pause, per logger) that a notification was skipped. */\nexport function warnPaused(logger: Logger, event: string): void {\n  if (!warned.has(logger)) {\n    warned.add(logger);\n    logger.warn({ event }, `${NOTIFICATIONS_PAUSED_TEXT} Skipping notifications.`);\n  }\n}\n\n/** Forget a logged pause: an origin resolved. */\nexport function clearPaused(logger: Logger): void {\n  warned.delete(logger);\n}\n"],"mappings":";;;;;;AAYA,MAAa,4BACX;;AAUF,eAAsB,mBAAmB,MAA+C;CAEtF,MAAM,WADS,KAAK,eAAe,MAAM,KAAK,aAAa,IAAI,IAAI,KAAK,OAAO,cAAA,EACvD,KAAK,CAAC,CAAC,QAAQ,SAAS,EAAE;CAClD,OAAO,YAAY,KAAA,KAAa,YAAY,KAAK,KAAA,IAAY;AAC/D;;AAGA,eAAsB,oBAAoB,QAAe,SAAS,GAAqB;CACrF,OAAQ,MAAM,mBAAmB,KAAK,MAAO,KAAA;AAC/C;;AAGA,MAAM,yBAAS,IAAI,QAAgB;;AAGnC,SAAgB,WAAW,QAAgB,OAAqB;CAC9D,IAAI,CAAC,OAAO,IAAI,MAAM,GAAG;EACvB,OAAO,IAAI,MAAM;EACjB,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,0BAA0B,yBAAyB;CAC/E;AACF;;AAGA,SAAgB,YAAY,QAAsB;CAChD,OAAO,OAAO,MAAM;AACtB"}

package/dist/notify.d.mts

@@ -1,17 +1,16 @@
 import __tsdown_shims_path from 'node:path';
 import __tsdown_shims_url from 'node:url';
-import { NotifierProvider } from "@storyshelf/core/adapter/notifier";
 import { ShelfConfig, UIConfig } from "@storyshelf/core/config";
-import { Logger } from "@storyshelf/core/logger";
+import "@storyshelf/core/models";
+import { NotifierProvider } from "@storyshelf/core/adapter/notifier";
 import { DatabaseAdapter } from "@storyshelf/core/adapter/database";
+import { Logger } from "@storyshelf/core/logger";
 import "@storyshelf/core/schema";
-//#region src/notify.d.ts
 /**
  * Host hook for the auth engine (`onAuthSystemEvent`): fans `sys:*` auth
  * events out to admin channels. Safe to call anywhere — outside a request
  * scope (e.g. boot) it resolves to a no-op instead of throwing.
  */
 declare function createAuthSystemHook(): (event: "sys:user-created" | "sys:invite-issued", data: Record<string, unknown>) => Promise<void>;
-//#endregion
 export { createAuthSystemHook };
 //# sourceMappingURL=notify.d.mts.map