@storyshelf/app 0.7.0 → 0.8.0

package/dist/routers/published-files.mjs

@@ -3,9 +3,11 @@ import "node:url";
 import.meta.url;
 import { getStore } from "../store.mjs";
 import { publishedCorsHeaders } from "./published-access.mjs";
+import { SIGNED_NO_STORE, signedCacheControl } from "./capture-cache.mjs";
+import { acceptsGzip, publishedGzip } from "./published-compression.mjs";
 import { isSafeSegment, mimeFor } from "@storyshelf/core/utils";
-import { readPublishedFile } from "@storyshelf/core/capture";
-//#region src/routers/published-files.ts
+import { readPublishedFileInfo } from "@storyshelf/core/capture";
+// src/routers/published-files.ts
 /**
 * Serving a build's published files (ADR 0010, ADR 0007 decision 5): the single place that decodes
 * and checks a request path, reads the file through the build's manifest and sets the headers.
@@ -13,9 +15,13 @@ import { readPublishedFile } from "@storyshelf/core/capture";
 * signed URL route (`/_s/:token/*`) all end here, each bringing the access {@link publishedAccess}
 * granted.
 */
-/** Headers of every signed URL answer: a token URL must not be cached, indexed or leaked by `Referer`. */
+/**
+* Headers of every signed URL answer: a token URL must not be indexed or leaked by `Referer`, and
+* is `no-store` here. Only a successful answer for a capture grant may replace `cache-control`
+* (`signedCacheControl`); an error always sends these as they are.
+*/
 const SIGNED_URL_HEADERS = {
-	"cache-control": "private, no-store",
+	"cache-control": SIGNED_NO_STORE,
 	"referrer-policy": "no-referrer",
 	"x-robots-tag": "noindex, nofollow",
 	"x-content-type-options": "nosniff"
@@ -37,16 +43,27 @@ function publishedRelativePath(path, base) {
 /** The file as a response, or `null` when the build has no such file. */
 async function servePublishedFile(c, request) {
 	const { projectId, buildId, rel, access } = request;
-	const file = await readPublishedFile(getStore().storage, projectId, buildId, rel);
+	const { storage, config } = getStore();
+	const file = await readPublishedFileInfo(storage, projectId, buildId, rel);
 	if (!file) return null;
-	const headers = access === "token" ? SIGNED_URL_HEADERS : { "cache-control": request.cacheControl };
-	return c.body(new Uint8Array(file), 200, {
+	const headers = access === "token" ? {
+		...SIGNED_URL_HEADERS,
+		"cache-control": signedCacheControl({
+			cacheMaxAgeSeconds: config.captureAssets?.cacheMaxAgeSeconds,
+			grant: request.grant,
+			immutable: file.contentHash !== void 0
+		})
+	} : { "cache-control": request.cacheControl };
+	const mime = mimeFor(rel);
+	const compressed = config.publishedCompression && acceptsGzip(c.req.header("accept-encoding")) ? await publishedGzip(storage, file.contentHash, file.bytes, mime) : void 0;
+	return c.body(new Uint8Array(compressed ?? file.bytes), 200, {
 		...headers,
 		...publishedCorsHeaders(access),
-		"content-type": mimeFor(rel)
+		"content-type": mime,
+		...config.publishedCompression ? { vary: "Accept-Encoding" } : {},
+		...compressed ? { "content-encoding": "gzip" } : {}
 	});
 }
-//#endregion
 export { SIGNED_URL_HEADERS, publishedRelativePath, servePublishedFile };
 
 //# sourceMappingURL=published-files.mjs.map

package/dist/routers/published-files.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"published-files.mjs","names":[],"sources":["../../src/routers/published-files.ts"],"sourcesContent":["/**\n * Serving a build's published files (ADR 0010, ADR 0007 decision 5): the single place that decodes\n * and checks a request path, reads the file through the build's manifest and sets the headers.\n * The published Storybook routes (`/projects/:slug/storybook/build/:id/*`, `/_/:id/*`) and the\n * signed URL route (`/_s/:token/*`) all end here, each bringing the access {@link publishedAccess}\n * granted.\n */\nimport { readPublishedFile } from \"@storyshelf/core/capture\";\nimport { isSafeSegment, mimeFor } from \"@storyshelf/core/utils\";\nimport type { Context } from \"hono\";\nimport { getStore } from \"../store.ts\";\nimport { publishedCorsHeaders, type PublishedAccess } from \"./published-access.ts\";\n\n/** Headers of every signed URL answer: a token URL must not be cached, indexed or leaked by `Referer`. */\nexport const SIGNED_URL_HEADERS = {\n  \"cache-control\": \"private, no-store\",\n  \"referrer-policy\": \"no-referrer\",\n  \"x-robots-tag\": \"noindex, nofollow\",\n  \"x-content-type-options\": \"nosniff\",\n} as const;\n\n/**\n * The file path after `base`, decoded once. `\"\"` is the root; `null` when the path is not under\n * `base` or could leave the build: empty, `.` or `..` segments, backslashes and NUL are refused.\n */\nexport function publishedRelativePath(path: string, base: string): string | null {\n  if (!path.startsWith(base)) {\n    return null;\n  }\n  let rest: string;\n  try {\n    rest = decodeURIComponent(path.slice(base.length));\n  } catch {\n    return null;\n  }\n  const safe =\n    rest === \"\" ||\n    rest\n      .split(\"/\")\n      .every(\n        (segment) =>\n          segment !== \"\" && segment !== \".\" && !segment.includes(\"\\0\") && isSafeSegment(segment),\n      );\n  return safe ? rest : null;\n}\n\n/** Where a file of a build lives and how the request got to it. */\nexport interface PublishedFileRequest {\n  projectId: string;\n  buildId: string;\n  /** A path accepted by {@link publishedRelativePath}, not the root. */\n  rel: string;\n  access: PublishedAccess;\n  /** `Cache-Control` of a normal answer; a signed URL always answers `private, no-store`. */\n  cacheControl: string;\n}\n\n/** The file as a response, or `null` when the build has no such file. */\nexport async function servePublishedFile(\n  c: Context,\n  request: PublishedFileRequest,\n): Promise<Response | null> {\n  const { projectId, buildId, rel, access } = request;\n  const file = await readPublishedFile(getStore().storage, projectId, buildId, rel);\n  if (!file) {\n    return null;\n  }\n  const headers =\n    access === \"token\" ? SIGNED_URL_HEADERS : { \"cache-control\": request.cacheControl };\n  return c.body(new Uint8Array(file), 200, {\n    ...headers,\n    ...publishedCorsHeaders(access),\n    \"content-type\": mimeFor(rel),\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAcA,MAAa,qBAAqB;CAChC,iBAAiB;CACjB,mBAAmB;CACnB,gBAAgB;CAChB,0BAA0B;AAC5B;;;;;AAMA,SAAgB,sBAAsB,MAAc,MAA6B;CAC/E,IAAI,CAAC,KAAK,WAAW,IAAI,GACvB,OAAO;CAET,IAAI;CACJ,IAAI;EACF,OAAO,mBAAmB,KAAK,MAAM,KAAK,MAAM,CAAC;CACnD,QAAQ;EACN,OAAO;CACT;CASA,OAPE,SAAS,MACT,KACG,MAAM,GAAG,CAAC,CACV,OACE,YACC,YAAY,MAAM,YAAY,OAAO,CAAC,QAAQ,SAAS,IAAI,KAAK,cAAc,OAAO,CACzF,IACU,OAAO;AACvB;;AAcA,eAAsB,mBACpB,GACA,SAC0B;CAC1B,MAAM,EAAE,WAAW,SAAS,KAAK,WAAW;CAC5C,MAAM,OAAO,MAAM,kBAAkB,SAAS,CAAC,CAAC,SAAS,WAAW,SAAS,GAAG;CAChF,IAAI,CAAC,MACH,OAAO;CAET,MAAM,UACJ,WAAW,UAAU,qBAAqB,EAAE,iBAAiB,QAAQ,aAAa;CACpF,OAAO,EAAE,KAAK,IAAI,WAAW,IAAI,GAAG,KAAK;EACvC,GAAG;EACH,GAAG,qBAAqB,MAAM;EAC9B,gBAAgB,QAAQ,GAAG;CAC7B,CAAC;AACH"}
+{"version":3,"file":"published-files.mjs","names":[],"sources":["../../src/routers/published-files.ts"],"sourcesContent":["/**\n * Serving a build's published files (ADR 0010, ADR 0007 decision 5): the single place that decodes\n * and checks a request path, reads the file through the build's manifest and sets the headers.\n * The published Storybook routes (`/projects/:slug/storybook/build/:id/*`, `/_/:id/*`) and the\n * signed URL route (`/_s/:token/*`) all end here, each bringing the access {@link publishedAccess}\n * granted.\n */\nimport { readPublishedFileInfo } from \"@storyshelf/core/capture\";\nimport { isSafeSegment, mimeFor, type StorybookTokenClaims } from \"@storyshelf/core/utils\";\nimport type { Context } from \"hono\";\nimport { getStore } from \"../store.ts\";\nimport { signedCacheControl, SIGNED_NO_STORE } from \"./capture-cache.ts\";\nimport { publishedCorsHeaders, type PublishedAccess } from \"./published-access.ts\";\nimport { acceptsGzip, publishedGzip } from \"./published-compression.ts\";\n\n/**\n * Headers of every signed URL answer: a token URL must not be indexed or leaked by `Referer`, and\n * is `no-store` here. Only a successful answer for a capture grant may replace `cache-control`\n * (`signedCacheControl`); an error always sends these as they are.\n */\nexport const SIGNED_URL_HEADERS = {\n  \"cache-control\": SIGNED_NO_STORE,\n  \"referrer-policy\": \"no-referrer\",\n  \"x-robots-tag\": \"noindex, nofollow\",\n  \"x-content-type-options\": \"nosniff\",\n} as const;\n\n/**\n * The file path after `base`, decoded once. `\"\"` is the root; `null` when the path is not under\n * `base` or could leave the build: empty, `.` or `..` segments, backslashes and NUL are refused.\n */\nexport function publishedRelativePath(path: string, base: string): string | null {\n  if (!path.startsWith(base)) {\n    return null;\n  }\n  let rest: string;\n  try {\n    rest = decodeURIComponent(path.slice(base.length));\n  } catch {\n    return null;\n  }\n  const safe =\n    rest === \"\" ||\n    rest\n      .split(\"/\")\n      .every(\n        (segment) =>\n          segment !== \"\" && segment !== \".\" && !segment.includes(\"\\0\") && isSafeSegment(segment),\n      );\n  return safe ? rest : null;\n}\n\n/** Where a file of a build lives and how the request got to it. */\nexport interface PublishedFileRequest {\n  projectId: string;\n  buildId: string;\n  /** A path accepted by {@link publishedRelativePath}, not the root. */\n  rel: string;\n  access: PublishedAccess;\n  /** `Cache-Control` of a normal answer; a signed URL answers `signedCacheControl` instead. */\n  cacheControl: string;\n  /** The verified claims of a signed URL's token; decides whether its answer may be fresh. */\n  grant?: StorybookTokenClaims | undefined;\n}\n\n/** The file as a response, or `null` when the build has no such file. */\nexport async function servePublishedFile(\n  c: Context,\n  request: PublishedFileRequest,\n): Promise<Response | null> {\n  const { projectId, buildId, rel, access } = request;\n  const { storage, config } = getStore();\n  const file = await readPublishedFileInfo(storage, projectId, buildId, rel);\n  if (!file) {\n    return null;\n  }\n  const headers =\n    access === \"token\"\n      ? {\n          ...SIGNED_URL_HEADERS,\n          \"cache-control\": signedCacheControl({\n            cacheMaxAgeSeconds: config.captureAssets?.cacheMaxAgeSeconds,\n            grant: request.grant,\n            immutable: file.contentHash !== undefined,\n          }),\n        }\n      : { \"cache-control\": request.cacheControl };\n  const mime = mimeFor(rel);\n  const compressed =\n    config.publishedCompression && acceptsGzip(c.req.header(\"accept-encoding\"))\n      ? await publishedGzip(storage, file.contentHash, file.bytes, mime)\n      : undefined;\n  return c.body(new Uint8Array(compressed ?? file.bytes), 200, {\n    ...headers,\n    ...publishedCorsHeaders(access),\n    \"content-type\": mime,\n    ...(config.publishedCompression ? { vary: \"Accept-Encoding\" } : {}),\n    ...(compressed ? { \"content-encoding\": \"gzip\" } : {}),\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAoBA,MAAa,qBAAqB;CAChC,iBAAiB;CACjB,mBAAmB;CACnB,gBAAgB;CAChB,0BAA0B;AAC5B;;;;;AAMA,SAAgB,sBAAsB,MAAc,MAA6B;CAC/E,IAAI,CAAC,KAAK,WAAW,IAAI,GACvB,OAAO;CAET,IAAI;CACJ,IAAI;EACF,OAAO,mBAAmB,KAAK,MAAM,KAAK,MAAM,CAAC;CACnD,QAAQ;EACN,OAAO;CACT;CASA,OAPE,SAAS,MACT,KACG,MAAM,GAAG,CAAC,CACV,OACE,YACC,YAAY,MAAM,YAAY,OAAO,CAAC,QAAQ,SAAS,IAAI,KAAK,cAAc,OAAO,CACzF,IACU,OAAO;AACvB;;AAgBA,eAAsB,mBACpB,GACA,SAC0B;CAC1B,MAAM,EAAE,WAAW,SAAS,KAAK,WAAW;CAC5C,MAAM,EAAE,SAAS,WAAW,SAAS;CACrC,MAAM,OAAO,MAAM,sBAAsB,SAAS,WAAW,SAAS,GAAG;CACzE,IAAI,CAAC,MACH,OAAO;CAET,MAAM,UACJ,WAAW,UACP;EACE,GAAG;EACH,iBAAiB,mBAAmB;GAClC,oBAAoB,OAAO,eAAe;GAC1C,OAAO,QAAQ;GACf,WAAW,KAAK,gBAAgB,KAAA;EAClC,CAAC;CACH,IACA,EAAE,iBAAiB,QAAQ,aAAa;CAC9C,MAAM,OAAO,QAAQ,GAAG;CACxB,MAAM,aACJ,OAAO,wBAAwB,YAAY,EAAE,IAAI,OAAO,iBAAiB,CAAC,IACtE,MAAM,cAAc,SAAS,KAAK,aAAa,KAAK,OAAO,IAAI,IAC/D,KAAA;CACN,OAAO,EAAE,KAAK,IAAI,WAAW,cAAc,KAAK,KAAK,GAAG,KAAK;EAC3D,GAAG;EACH,GAAG,qBAAqB,MAAM;EAC9B,gBAAgB;EAChB,GAAI,OAAO,uBAAuB,EAAE,MAAM,kBAAkB,IAAI,CAAC;EACjE,GAAI,aAAa,EAAE,oBAAoB,OAAO,IAAI,CAAC;CACrD,CAAC;AACH"}

package/dist/routers/review-forms.mjs

@@ -9,7 +9,7 @@ import { APPROVER_ROLES, DEVELOPER_ROLES, buildForProject } from "./builds.handl
 import { giveVerdict } from "./build-reviews.handlers.mjs";
 import { createComment, resolveBuildComment } from "./comments.mjs";
 import { HTTPException } from "hono/http-exception";
-//#region src/routers/review-forms.ts
+// src/routers/review-forms.ts
 /** Register the form routes of review (`review` class). */
 function registerReviewForms(app) {
 	const base = "/projects/:slug/builds/:buildId";
@@ -66,7 +66,6 @@ function returnPath(c, buildId) {
 		return fallback;
 	}
 }
-//#endregion
 export { registerReviewForms };
 
 //# sourceMappingURL=review-forms.mjs.map

package/dist/routers/review-next.mjs

@@ -5,7 +5,7 @@ import { getStore } from "../store.mjs";
 import { hxRefresh, isHxRequest } from "./htmx.mjs";
 import { isOpenSnapshot } from "./baseline-guard.mjs";
 import { SnapshotModel } from "@storyshelf/core/models";
-//#region src/routers/review-next.ts
+// src/routers/review-next.ts
 /**
 * The next snapshot still waiting for a decision after `currentId`, in list
 * order, wrapping to the start. Null when nothing else is open.
@@ -41,7 +41,6 @@ async function hxAdvance(c, target) {
 	}
 	c.header("HX-Redirect", url);
 }
-//#endregion
 export { hxAdvance, nextOpenSnapshotId };
 
 //# sourceMappingURL=review-next.mjs.map

package/dist/routers/review-section.handlers.mjs

@@ -6,7 +6,7 @@ import { currentProjectRole } from "./helpers.mjs";
 import { reviewStateOf } from "./build-reviews.handlers.mjs";
 import { publishingOf } from "@storyshelf/core/capture";
 import { CommentModel, UserModel, changesetOf } from "@storyshelf/core/models";
-//#region src/routers/review-section.handlers.ts
+// src/routers/review-section.handlers.ts
 /** Data behind the review section of the build page (ADR 0013): verdicts, changeset and comments. */
 /** Whether review is on for the project (a row without the column counts as on). */
 function reviewIsOn(project) {
@@ -79,7 +79,6 @@ async function loadComponentReview(project, build) {
 		canComment: capabilities.canComment
 	};
 }
-//#endregion
 export { loadComponentReview, loadReviewSection, namesOf, reviewCapabilities, reviewIsOn };
 
 //# sourceMappingURL=review-section.handlers.mjs.map

package/dist/routers/review-switch-off.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { getStore } from "../store.mjs";
 import { requestBuildState } from "../git-status.mjs";
 import { acceptPendingWithoutWork } from "@storyshelf/core/models";
-//#region src/routers/review-switch-off.ts
+// src/routers/review-switch-off.ts
 /** The switch-off pass at the app level (ADR 0013, decision 1): accept the queue review leaves behind. */
 /**
 * When a save turned review off (`before` had it on), accept the project's pending builds that no
@@ -23,7 +23,6 @@ async function runSwitchOffPass(before, after) {
 	}, "review turned off: accepted pending builds");
 	return accepted.length;
 }
-//#endregion
 export { runSwitchOffPass };
 
 //# sourceMappingURL=review-switch-off.mjs.map

package/dist/routers/schemas.mjs

@@ -6,7 +6,7 @@ import { storybookUrlTtlOverrideError } from "@storyshelf/core/utils";
 import { WebhookModel } from "@storyshelf/core/models";
 import { BUILD_STATUSES, PROJECT_ROLES, REVIEW_VERDICTS, SNAPSHOT_STATUSES } from "@storyshelf/core/types";
 import { BROWSER_NAMES, TARGET_NAME_PATTERN } from "@storyshelf/core/adapter/capture-runner";
-//#region src/routers/schemas.ts
+// src/routers/schemas.ts
 /** A capture target: an engine (`chromium`) or a remote one, `<engine>@<name>` (ADR 0007). */
 const captureTargetSchema = z.string().regex(new RegExp(`^(?:${BROWSER_NAMES.join("|")})(?:@${TARGET_NAME_PATTERN.source.slice(1, -1)})?$`, "u"), "Expected an engine (chromium, firefox, webkit, chrome) or <engine>@<name>");
 const reviewApprovalsSchema = z.number().int().min(1).max(20);
@@ -449,7 +449,6 @@ const healthRequestSchema = z.object({
 	window: z.string().optional(),
 	force: z.boolean().optional()
 }).openapi("HealthInsightRequest");
-//#endregion
 export { approveAllResultSchema, attemptLogSchema, attemptSchema, badRequest, baselineChangedSchema, buildReviewCreateSchema, buildReviewSchema, buildReviewStateSchema, buildSchema, commentCreateSchema, commentSchema, errorSchema, forbidden, groupDecisionResultSchema, groupMappingCreateSchema, groupMappingSchema, healthRequestSchema, insightRequestSchema, insightSchema, labelTypeCreateSchema, labelTypeSchema, labelTypeUpdateSchema, memberRoleSchema, memberSchema, memberSetSchema, notFound, notificationChannelCreateSchema, notificationChannelSchema, notificationSubscriptionPutSchema, notificationSubscriptionSchema, okSchema, projectCreateSchema, projectSchema, projectUpdateSchema, purgeInputSchema, purgeSchema, rediffResultSchema, snapshotSchema, tokenCreateSchema, tokenCreatedSchema, tokenPublicSchema, unauthorized, webhookCreateSchema, webhookCreatedSchema, webhookPublicSchema };
 
 //# sourceMappingURL=schemas.mjs.map

package/dist/routers/scoped-models.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { credentialKeys } from "../credential-keys.mjs";
 import { getStore } from "../store.mjs";
 import { NotificationChannelModel, WebhookModel } from "@storyshelf/core/models";
-//#region src/routers/scoped-models.ts
+// src/routers/scoped-models.ts
 /** Models that encrypt secrets at rest, bound to the current request's db and server secret. */
 /** Webhook model for the current request. */
 function webhookModel() {
@@ -16,7 +16,6 @@ function notificationChannelModel() {
 	const { db, config } = getStore();
 	return new NotificationChannelModel(db, void 0, credentialKeys(config));
 }
-//#endregion
 export { notificationChannelModel, webhookModel };
 
 //# sourceMappingURL=scoped-models.mjs.map

package/dist/routers/settings-ai.mjs

@@ -7,7 +7,7 @@ import { hxRedirect } from "./htmx.mjs";
 import { flash } from "./flash.mjs";
 import { asString, findProject, renderSettingsPage } from "./settings.handlers.mjs";
 import { ProjectModel } from "@storyshelf/core/models";
-//#region src/routers/settings-ai.ts
+// src/routers/settings-ai.ts
 /** Register the project AI settings tab (site admins set the profile gate). */
 function registerAiSettings(app) {
 	app.get("/projects/:slug/settings/ai", async (c) => c.html(await renderSettingsPage(c, "ai")));
@@ -29,7 +29,6 @@ async function handleAiUpdate(c) {
 	flash(c, requested === "" ? "AI turned off for this project" : "AI profile saved");
 	return hxRedirect(c, `/projects/${project.slug}/settings/ai`);
 }
-//#endregion
 export { registerAiSettings };
 
 //# sourceMappingURL=settings-ai.mjs.map

package/dist/routers/settings-capture.mjs

@@ -12,7 +12,7 @@ import { resolveBrowsers } from "@storyshelf/core/capture";
 import { ProjectModel } from "@storyshelf/core/models";
 import { HTTPException } from "hono/http-exception";
 import { isCaptureTarget } from "@storyshelf/core/adapter/capture-runner";
-//#region src/routers/settings-capture.ts
+// src/routers/settings-capture.ts
 /** Capture settings: browsers (primary + extras), the mode allowlist and the signed URL lifetime. */
 function registerCaptureSettings(app) {
 	app.get("/projects/:slug/settings/capture", async (c) => c.html(await renderSettingsPage(c, "capture")));
@@ -71,7 +71,6 @@ async function handleCaptureUpdate(c) {
 	flash(c, "Capture settings saved");
 	return hxRedirect(c, `/projects/${project.slug}/settings/capture`);
 }
-//#endregion
 export { registerCaptureSettings };
 
 //# sourceMappingURL=settings-capture.mjs.map

package/dist/routers/settings-design.mjs

@@ -9,7 +9,7 @@ import { flash } from "./flash.mjs";
 import { asString, renderSettingsPage } from "./settings.handlers.mjs";
 import { DesignCredentialModel, DesignModel } from "@storyshelf/core/models";
 import { InvalidDesignUrlError } from "@storyshelf/core/adapter/design";
-//#region src/routers/settings-design.ts
+// src/routers/settings-design.ts
 /** Design settings (project design files, component mapping, provider credentials). */
 function registerDesignSettings(app) {
 	const base = "/projects/:slug/settings/design";
@@ -97,7 +97,6 @@ async function handleRemoveToken(c) {
 	await credentialModel().remove(project.id, provider.metadata.kind);
 	return done(c, project.slug, `${provider.metadata.name} token removed`);
 }
-//#endregion
 export { registerDesignSettings };
 
 //# sourceMappingURL=settings-design.mjs.map

package/dist/routers/settings-general.mjs

@@ -10,7 +10,7 @@ import { runSwitchOffPass } from "./review-switch-off.mjs";
 import { asString, findProject, renderSettingsPage } from "./settings.handlers.mjs";
 import { resolveBrowsers } from "@storyshelf/core/capture";
 import { ProjectModel } from "@storyshelf/core/models";
-//#region src/routers/settings-general.ts
+// src/routers/settings-general.ts
 /** General project settings (name, repo, thresholds) and danger-zone delete. */
 function registerGeneralSettings(app) {
 	app.get("/projects/:slug/settings", async (c) => c.html(await renderSettingsPage(c, "general")));
@@ -143,7 +143,6 @@ function approvalsOf(form, project) {
 function reviewSavedMessage(accepted) {
 	return accepted > 0 ? `Review settings saved; accepted ${accepted} pending build${accepted === 1 ? "" : "s"}` : "Review settings saved";
 }
-//#endregion
 export { registerGeneralSettings };
 
 //# sourceMappingURL=settings-general.mjs.map

package/dist/routers/settings-git-channel.mjs

@@ -6,7 +6,7 @@ import { flash } from "./flash.mjs";
 import { notificationChannelModel } from "./scoped-models.mjs";
 import { asString, renderSettingsPage } from "./settings.handlers.mjs";
 import { NotificationChannelModel } from "@storyshelf/core/models";
-//#region src/routers/settings-git-channel.ts
+// src/routers/settings-git-channel.ts
 /** Create a git (`state`) channel from the settings form: repository, status prefix and token. */
 const CONFIG_FIELDS = [
 	"owner",
@@ -71,7 +71,6 @@ function gitChannelProblem(project, provider, config, secret) {
 	});
 	return checked.ok ? null : fieldErrors(secret.secretField, checked);
 }
-//#endregion
 export { createGitChannel };
 
 //# sourceMappingURL=settings-git-channel.mjs.map

package/dist/routers/settings-labels.mjs

@@ -6,7 +6,7 @@ import { hxRedirect } from "./htmx.mjs";
 import { flash } from "./flash.mjs";
 import { asString, findProject, renderSettingsPage } from "./settings.handlers.mjs";
 import { LabelModel } from "@storyshelf/core/models";
-//#region src/routers/settings-labels.ts
+// src/routers/settings-labels.ts
 /** Label-type settings (create custom types, delete removable ones). */
 function registerLabelSettings(app) {
 	app.get("/projects/:slug/settings/labels", async (c) => c.html(await renderSettingsPage(c, "labels", { editKey: c.req.query("edit") })));
@@ -72,7 +72,6 @@ async function handleDeleteLabelType(c) {
 	flash(c, "Label type deleted");
 	return hxRedirect(c, `/projects/${project.slug}/settings/labels`);
 }
-//#endregion
 export { registerLabelSettings };
 
 //# sourceMappingURL=settings-labels.mjs.map

package/dist/routers/settings-links.mjs

@@ -6,7 +6,7 @@ import { hxRedirect } from "./htmx.mjs";
 import { flash } from "./flash.mjs";
 import { asString, findProject, renderSettingsPage } from "./settings.handlers.mjs";
 import { PackageUsageModel, ProjectModel } from "@storyshelf/core/models";
-//#region src/routers/settings-links.ts
+// src/routers/settings-links.ts
 /** Package-link settings (link a consumed package to its upstream project, or unlink it). */
 function registerLinkSettings(app) {
 	app.get("/projects/:slug/settings/links", async (c) => c.html(await renderSettingsPage(c, "links")));
@@ -57,7 +57,6 @@ async function handleRemoveLink(c) {
 	flash(c, "Link removed");
 	return hxRedirect(c, `/projects/${project.slug}/settings/links`);
 }
-//#endregion
 export { registerLinkSettings };
 
 //# sourceMappingURL=settings-links.mjs.map

package/dist/routers/settings-members.mjs

@@ -7,7 +7,7 @@ import { flash } from "./flash.mjs";
 import { asString, findProject, renderSettingsPage } from "./settings.handlers.mjs";
 import { MemberModel, ProjectGroupMappingModel } from "@storyshelf/core/models";
 import { isProjectRole } from "@storyshelf/core/types";
-//#region src/routers/settings-members.ts
+// src/routers/settings-members.ts
 /** Project member settings (assign roles, remove members). */
 function registerMemberSettings(app) {
 	app.get("/projects/:slug/settings/members", async (c) => c.html(await renderSettingsPage(c, "members")));
@@ -49,7 +49,6 @@ function registerGroupMappingSettings(app) {
 		return hxRedirect(c, `/projects/${project.slug}/settings/members`);
 	});
 }
-//#endregion
 export { registerMemberSettings };
 
 //# sourceMappingURL=settings-members.mjs.map

package/dist/routers/settings-notifications.mjs

@@ -7,7 +7,7 @@ import { notificationChannelModel } from "./scoped-models.mjs";
 import { asString, findProject, renderSettingsPage } from "./settings.handlers.mjs";
 import { createGitChannel } from "./settings-git-channel.mjs";
 import { NotificationChannelModel, NotificationSubscriptionModel } from "@storyshelf/core/models";
-//#region src/routers/settings-notifications.ts
+// src/routers/settings-notifications.ts
 /** Notifications settings (message and git channels plus my preferences). */
 function registerNotificationSettings(app) {
 	app.get("/projects/:slug/settings/notifications", async (c) => c.html(await renderSettingsPage(c, "notifications")));
@@ -107,7 +107,6 @@ async function saveSubscription(project, userId, form) {
 	}
 	await model.remove(project.id, userId);
 }
-//#endregion
 export { registerNotificationSettings };
 
 //# sourceMappingURL=settings-notifications.mjs.map

package/dist/routers/settings-tokens.mjs

@@ -6,7 +6,7 @@ import { hxRedirect } from "./htmx.mjs";
 import { flash } from "./flash.mjs";
 import { asString, findProject, renderSettingsPage } from "./settings.handlers.mjs";
 import { TokenModel } from "@storyshelf/core/models";
-//#region src/routers/settings-tokens.ts
+// src/routers/settings-tokens.ts
 /** CI token settings (create with one-time display, delete). */
 function registerTokenSettings(app) {
 	app.get("/projects/:slug/settings/tokens", async (c) => c.html(await renderSettingsPage(c, "tokens")));
@@ -31,7 +31,6 @@ async function handleDeleteToken(c) {
 	flash(c, "Token deleted");
 	return hxRedirect(c, `/projects/${project.slug}/settings/tokens`);
 }
-//#endregion
 export { registerTokenSettings };
 
 //# sourceMappingURL=settings-tokens.mjs.map

package/dist/routers/settings-webhooks.mjs

@@ -7,7 +7,7 @@ import { flash } from "./flash.mjs";
 import { webhookModel } from "./scoped-models.mjs";
 import { asString, findProject, renderSettingsPage } from "./settings.handlers.mjs";
 import { WebhookModel } from "@storyshelf/core/models";
-//#region src/routers/settings-webhooks.ts
+// src/routers/settings-webhooks.ts
 /** Webhook settings (create with one-time secret display, delete). */
 function registerWebhookSettings(app) {
 	app.get("/projects/:slug/settings/webhooks", async (c) => c.html(await renderSettingsPage(c, "webhooks")));
@@ -44,7 +44,6 @@ async function handleDeleteWebhook(c) {
 	flash(c, "Webhook deleted");
 	return hxRedirect(c, `/projects/${project.slug}/settings/webhooks`);
 }
-//#endregion
 export { registerWebhookSettings };
 
 //# sourceMappingURL=settings-webhooks.mjs.map

package/dist/routers/settings.handlers.mjs

@@ -9,7 +9,7 @@ import { runnerTargets } from "../targets.mjs";
 import { isSiteAdmin } from "./insights.handlers.mjs";
 import { renderProjectSettingsPage } from "../pages/project-settings.mjs";
 import { DesignCredentialModel, DesignModel, LabelModel, MemberModel, NotificationChannelModel, NotificationSubscriptionModel, PackageUsageModel, ProjectGroupMappingModel, ProjectModel, TokenModel, WebhookModel, credentialDaysLeft } from "@storyshelf/core/models";
-//#region src/routers/settings.handlers.ts
+// src/routers/settings.handlers.ts
 /** Tokens without hashes for the settings UI. */
 async function loadTokenSummaries(db, projectId) {
 	return (await new TokenModel(db).list(projectId)).map(({ hash: _hash, ...rest }) => rest);
@@ -224,7 +224,6 @@ async function findProject(slug) {
 function asString(value) {
 	return typeof value === "string" ? value.trim() : void 0;
 }
-//#endregion
 export { asString, findProject, renderSettingsPage };
 
 //# sourceMappingURL=settings.handlers.mjs.map

package/dist/routers/settings.mjs

@@ -11,7 +11,7 @@ import { registerMemberSettings } from "./settings-members.mjs";
 import { registerNotificationSettings } from "./settings-notifications.mjs";
 import { registerTokenSettings } from "./settings-tokens.mjs";
 import { registerWebhookSettings } from "./settings-webhooks.mjs";
-//#region src/routers/settings.ts
+// src/routers/settings.ts
 /** Register the server-rendered project settings pages and their form handlers. */
 function registerSettingsPages(app) {
 	registerProjectSettings(app);
@@ -31,7 +31,6 @@ function registerCatalogSettings(app) {
 	registerLinkSettings(app);
 	registerDesignSettings(app);
 }
-//#endregion
 export { registerSettingsPages };
 
 //# sourceMappingURL=settings.mjs.map

package/dist/routers/signed-storybook.mjs

@@ -7,13 +7,15 @@ import { publishedAccess } from "./published-access.mjs";
 import { SIGNED_URL_HEADERS, publishedRelativePath, servePublishedFile } from "./published-files.mjs";
 import { STORYBOOK_TOKEN_PREFIX, storybookTokenPath, verifyStorybookToken } from "@storyshelf/core/utils";
 import { BuildModel, ProjectModel } from "@storyshelf/core/models";
-//#region src/routers/signed-storybook.ts
+// src/routers/signed-storybook.ts
 /**
 * Signed Storybook URLs (ADR 0007, decision 5): `GET /_s/<token>/<file>` serves one build's static
 * Storybook files to a remote browser, with no session. The HMAC token is the only credential; it
 * names one project and one build and expires. The file itself is served by the same handler and
 * access policy as the other published routes (`published-files.ts`, `published-access.ts`).
 * Nothing else lives under `/_s/`: no wrapper page, no API, no other build, no listing.
+* Answers are `private, no-store`, except a success for a capture-purpose grant when the server
+* opted in (`captureAssets.cacheMaxAgeSeconds`, see `capture-cache.ts`).
 */
 /** Register the signed-URL file route. */
 function registerSignedStorybook(app) {
@@ -39,7 +41,8 @@ async function serveGranted(c, token, rel) {
 		buildId,
 		rel,
 		access,
-		cacheControl: ""
+		cacheControl: "",
+		grant: verified.claims
 	});
 }
 /** The one answer for every refusal, so a caller cannot tell a bad signature from an expired token. */
@@ -47,7 +50,6 @@ function refuse(c, reason) {
 	getStore().logger.debug({ reason }, "signed storybook request refused");
 	return c.text("Not found", 404, SIGNED_URL_HEADERS);
 }
-//#endregion
 export { registerSignedStorybook };
 
 //# sourceMappingURL=signed-storybook.mjs.map

package/dist/routers/signed-storybook.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"signed-storybook.mjs","names":[],"sources":["../../src/routers/signed-storybook.ts"],"sourcesContent":["/**\n * Signed Storybook URLs (ADR 0007, decision 5): `GET /_s/<token>/<file>` serves one build's static\n * Storybook files to a remote browser, with no session. The HMAC token is the only credential; it\n * names one project and one build and expires. The file itself is served by the same handler and\n * access policy as the other published routes (`published-files.ts`, `published-access.ts`).\n * Nothing else lives under `/_s/`: no wrapper page, no API, no other build, no listing.\n */\nimport { BuildModel, ProjectModel } from \"@storyshelf/core/models\";\nimport {\n  STORYBOOK_TOKEN_PREFIX,\n  storybookTokenPath,\n  verifyStorybookToken,\n} from \"@storyshelf/core/utils\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { credentialKeys } from \"../credential-keys.ts\";\nimport { getStore } from \"../store.ts\";\nimport { publishedAccess } from \"./published-access.ts\";\nimport {\n  publishedRelativePath,\n  servePublishedFile,\n  SIGNED_URL_HEADERS,\n} from \"./published-files.ts\";\n\n/** Register the signed-URL file route. */\nexport function registerSignedStorybook(app: ShelfRouter): void {\n  app.get(`${STORYBOOK_TOKEN_PREFIX}:token/*`, async (c) => await serveSigned(c));\n}\n\nasync function serveSigned(c: Context): Promise<Response> {\n  const token = c.req.param(\"token\") ?? \"\";\n  const rel = publishedRelativePath(c.req.path, storybookTokenPath(token));\n  if (!rel) {\n    return refuse(c, \"bad path\");\n  }\n  return (await serveGranted(c, token, rel)) ?? refuse(c, \"no such file\");\n}\n\n/** The file the token grants as a response, or null (for the debug log only: why not). */\nasync function serveGranted(c: Context, token: string, rel: string): Promise<Response | null> {\n  const { config, db } = getStore();\n  const verified = verifyStorybookToken(token, credentialKeys(config));\n  if (!verified.ok) {\n    return refuse(c, verified.reason);\n  }\n  const { projectId, buildId } = verified.claims;\n  const [project, build] = await Promise.all([\n    new ProjectModel(db).get(projectId),\n    new BuildModel(db).get(buildId),\n  ]);\n  const access = project && build ? await publishedAccess(build, project, verified.claims) : null;\n  if (access !== \"token\") {\n    return refuse(c, \"unknown build\");\n  }\n  return await servePublishedFile(c, { projectId, buildId, rel, access, cacheControl: \"\" });\n}\n\n/** The one answer for every refusal, so a caller cannot tell a bad signature from an expired token. */\nfunction refuse(c: Context, reason: string): Response {\n  getStore().logger.debug({ reason }, \"signed storybook request refused\");\n  return c.text(\"Not found\", 404, SIGNED_URL_HEADERS);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAyBA,SAAgB,wBAAwB,KAAwB;CAC9D,IAAI,IAAI,GAAG,uBAAuB,WAAW,OAAO,MAAM,MAAM,YAAY,CAAC,CAAC;AAChF;AAEA,eAAe,YAAY,GAA+B;CACxD,MAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK;CACtC,MAAM,MAAM,sBAAsB,EAAE,IAAI,MAAM,mBAAmB,KAAK,CAAC;CACvE,IAAI,CAAC,KACH,OAAO,OAAO,GAAG,UAAU;CAE7B,OAAQ,MAAM,aAAa,GAAG,OAAO,GAAG,KAAM,OAAO,GAAG,cAAc;AACxE;;AAGA,eAAe,aAAa,GAAY,OAAe,KAAuC;CAC5F,MAAM,EAAE,QAAQ,OAAO,SAAS;CAChC,MAAM,WAAW,qBAAqB,OAAO,eAAe,MAAM,CAAC;CACnE,IAAI,CAAC,SAAS,IACZ,OAAO,OAAO,GAAG,SAAS,MAAM;CAElC,MAAM,EAAE,WAAW,YAAY,SAAS;CACxC,MAAM,CAAC,SAAS,SAAS,MAAM,QAAQ,IAAI,CACzC,IAAI,aAAa,EAAE,CAAC,CAAC,IAAI,SAAS,GAClC,IAAI,WAAW,EAAE,CAAC,CAAC,IAAI,OAAO,CAChC,CAAC;CACD,MAAM,SAAS,WAAW,QAAQ,MAAM,gBAAgB,OAAO,SAAS,SAAS,MAAM,IAAI;CAC3F,IAAI,WAAW,SACb,OAAO,OAAO,GAAG,eAAe;CAElC,OAAO,MAAM,mBAAmB,GAAG;EAAE;EAAW;EAAS;EAAK;EAAQ,cAAc;CAAG,CAAC;AAC1F;;AAGA,SAAS,OAAO,GAAY,QAA0B;CACpD,SAAS,CAAC,CAAC,OAAO,MAAM,EAAE,OAAO,GAAG,kCAAkC;CACtE,OAAO,EAAE,KAAK,aAAa,KAAK,kBAAkB;AACpD"}
+{"version":3,"file":"signed-storybook.mjs","names":[],"sources":["../../src/routers/signed-storybook.ts"],"sourcesContent":["/**\n * Signed Storybook URLs (ADR 0007, decision 5): `GET /_s/<token>/<file>` serves one build's static\n * Storybook files to a remote browser, with no session. The HMAC token is the only credential; it\n * names one project and one build and expires. The file itself is served by the same handler and\n * access policy as the other published routes (`published-files.ts`, `published-access.ts`).\n * Nothing else lives under `/_s/`: no wrapper page, no API, no other build, no listing.\n * Answers are `private, no-store`, except a success for a capture-purpose grant when the server\n * opted in (`captureAssets.cacheMaxAgeSeconds`, see `capture-cache.ts`).\n */\nimport { BuildModel, ProjectModel } from \"@storyshelf/core/models\";\nimport {\n  STORYBOOK_TOKEN_PREFIX,\n  storybookTokenPath,\n  verifyStorybookToken,\n} from \"@storyshelf/core/utils\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { credentialKeys } from \"../credential-keys.ts\";\nimport { getStore } from \"../store.ts\";\nimport { publishedAccess } from \"./published-access.ts\";\nimport {\n  publishedRelativePath,\n  servePublishedFile,\n  SIGNED_URL_HEADERS,\n} from \"./published-files.ts\";\n\n/** Register the signed-URL file route. */\nexport function registerSignedStorybook(app: ShelfRouter): void {\n  app.get(`${STORYBOOK_TOKEN_PREFIX}:token/*`, async (c) => await serveSigned(c));\n}\n\nasync function serveSigned(c: Context): Promise<Response> {\n  const token = c.req.param(\"token\") ?? \"\";\n  const rel = publishedRelativePath(c.req.path, storybookTokenPath(token));\n  if (!rel) {\n    return refuse(c, \"bad path\");\n  }\n  return (await serveGranted(c, token, rel)) ?? refuse(c, \"no such file\");\n}\n\n/** The file the token grants as a response, or null (for the debug log only: why not). */\nasync function serveGranted(c: Context, token: string, rel: string): Promise<Response | null> {\n  const { config, db } = getStore();\n  const verified = verifyStorybookToken(token, credentialKeys(config));\n  if (!verified.ok) {\n    return refuse(c, verified.reason);\n  }\n  const { projectId, buildId } = verified.claims;\n  const [project, build] = await Promise.all([\n    new ProjectModel(db).get(projectId),\n    new BuildModel(db).get(buildId),\n  ]);\n  const access = project && build ? await publishedAccess(build, project, verified.claims) : null;\n  if (access !== \"token\") {\n    return refuse(c, \"unknown build\");\n  }\n  return await servePublishedFile(c, {\n    projectId,\n    buildId,\n    rel,\n    access,\n    cacheControl: \"\",\n    grant: verified.claims,\n  });\n}\n\n/** The one answer for every refusal, so a caller cannot tell a bad signature from an expired token. */\nfunction refuse(c: Context, reason: string): Response {\n  getStore().logger.debug({ reason }, \"signed storybook request refused\");\n  return c.text(\"Not found\", 404, SIGNED_URL_HEADERS);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,wBAAwB,KAAwB;CAC9D,IAAI,IAAI,GAAG,uBAAuB,WAAW,OAAO,MAAM,MAAM,YAAY,CAAC,CAAC;AAChF;AAEA,eAAe,YAAY,GAA+B;CACxD,MAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK;CACtC,MAAM,MAAM,sBAAsB,EAAE,IAAI,MAAM,mBAAmB,KAAK,CAAC;CACvE,IAAI,CAAC,KACH,OAAO,OAAO,GAAG,UAAU;CAE7B,OAAQ,MAAM,aAAa,GAAG,OAAO,GAAG,KAAM,OAAO,GAAG,cAAc;AACxE;;AAGA,eAAe,aAAa,GAAY,OAAe,KAAuC;CAC5F,MAAM,EAAE,QAAQ,OAAO,SAAS;CAChC,MAAM,WAAW,qBAAqB,OAAO,eAAe,MAAM,CAAC;CACnE,IAAI,CAAC,SAAS,IACZ,OAAO,OAAO,GAAG,SAAS,MAAM;CAElC,MAAM,EAAE,WAAW,YAAY,SAAS;CACxC,MAAM,CAAC,SAAS,SAAS,MAAM,QAAQ,IAAI,CACzC,IAAI,aAAa,EAAE,CAAC,CAAC,IAAI,SAAS,GAClC,IAAI,WAAW,EAAE,CAAC,CAAC,IAAI,OAAO,CAChC,CAAC;CACD,MAAM,SAAS,WAAW,QAAQ,MAAM,gBAAgB,OAAO,SAAS,SAAS,MAAM,IAAI;CAC3F,IAAI,WAAW,SACb,OAAO,OAAO,GAAG,eAAe;CAElC,OAAO,MAAM,mBAAmB,GAAG;EACjC;EACA;EACA;EACA;EACA,cAAc;EACd,OAAO,SAAS;CAClB,CAAC;AACH;;AAGA,SAAS,OAAO,GAAY,QAA0B;CACpD,SAAS,CAAC,CAAC,OAAO,MAAM,EAAE,OAAO,GAAG,kCAAkC;CACtE,OAAO,EAAE,KAAK,aAAa,KAAK,kBAAkB;AACpD"}

package/dist/routers/snapshot-groups.mjs

@@ -6,7 +6,7 @@ import { notFound } from "./helpers.mjs";
 import { baselineChanged, findDriftedSnapshots, isOpenSnapshot } from "./baseline-guard.mjs";
 import { approveSnapshot, refreshBuild } from "./builds.handlers.mjs";
 import { SnapshotModel } from "@storyshelf/core/models";
-//#region src/routers/snapshot-groups.ts
+// src/routers/snapshot-groups.ts
 /** Shared (story, mode) review: one decision covers every browser's snapshot. */
 /** Identity of a review group: the same story and mode across engines. */
 function groupKey(snapshot) {
@@ -57,7 +57,6 @@ function splitByDrift(open, drifted) {
 		skipped: open.filter((s) => blocked.has(groupKey(s)))
 	};
 }
-//#endregion
 export { approveGroup, groupKey, rejectGroup, splitByDrift };
 
 //# sourceMappingURL=snapshot-groups.mjs.map

package/dist/routers/snapshots.mjs

@@ -14,7 +14,7 @@ import { createRoute, z } from "@hono/zod-openapi";
 import { REDIFFABLE_BUILD_STATUSES, rediffBuild } from "@storyshelf/core/capture";
 import { SnapshotModel } from "@storyshelf/core/models";
 import { HTTPException } from "hono/http-exception";
-//#region src/routers/snapshots.ts
+// src/routers/snapshots.ts
 const listSnapshotsRoute = createRoute({
 	method: "get",
 	tags: ["Review"],
@@ -332,7 +332,6 @@ function registerSnapshots(app) {
 		return c.json({ ok: true });
 	});
 }
-//#endregion
 export { registerSnapshots };
 
 //# sourceMappingURL=snapshots.mjs.map

package/dist/routers/storybook.mjs

@@ -1,4 +1,4 @@
-import "node:path";
+import { posix } from "node:path";
 import "node:url";
 import.meta.url;
 import { getStore } from "../store.mjs";
@@ -8,8 +8,7 @@ import { publishedRelativePath, servePublishedFile } from "./published-files.mjs
 import { renderStorybookPage, renderStorybookPreparingPage } from "../pages/storybook.mjs";
 import { storybookDir } from "@storyshelf/core/utils";
 import { BuildModel, LabelModel, ProjectModel } from "@storyshelf/core/models";
-import { posix } from "node:path";
-//#region src/routers/storybook.ts
+// src/routers/storybook.ts
 /** Check whether a build's extracted statics are available for serving. */
 async function staticsReady(projectId, buildId) {
 	if (await getStore().storage.exists(posix.join(storybookDir(projectId, buildId), "manifest.json"))) return true;
@@ -28,19 +27,6 @@ function registerStorybook(app) {
 		if (!await publishedAccess(build, project)) return c.redirect("/auth/login", 302);
 		return c.redirect(`/projects/${slug}/storybook/build/${build.id}/`, 302);
 	});
-	app.get("/projects/:slug/storybook/:key/:value", async (c) => {
-		const slug = c.req.param("slug");
-		const key = c.req.param("key");
-		if (key === "build") return c.notFound();
-		const value = c.req.param("value");
-		const project = await new ProjectModel(getStore().db).getBySlug(slug);
-		if (!project) notFound("Project not found");
-		const buildId = await new LabelModel(getStore().db).latestBuildId(project.id, key, value);
-		if (!buildId) notFound("No build carries that label");
-		const build = await new BuildModel(getStore().db).get(buildId);
-		if (!build || !await publishedAccess(build, project)) return c.redirect("/auth/login", 302);
-		return c.redirect(`/projects/${slug}/storybook/build/${buildId}/`, 302);
-	});
 	app.get("/_/:id", async (c) => {
 		const id = c.req.param("id");
 		if (id.length === 26 && /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(id)) {
@@ -108,13 +94,31 @@ function registerStorybook(app) {
 			cacheControl: "public, max-age=31536000, immutable"
 		}) ?? c.notFound();
 	});
+	app.get("/projects/:slug/storybook/:key/*", async (c) => {
+		const slug = c.req.param("slug");
+		const key = c.req.param("key");
+		if (key === "build") return c.notFound();
+		let value;
+		try {
+			value = decodeURIComponent(c.req.path.split("/").slice(5).join("/"));
+		} catch {
+			return c.notFound();
+		}
+		if (!value) return c.notFound();
+		const project = await new ProjectModel(getStore().db).getBySlug(slug);
+		if (!project) notFound("Project not found");
+		const buildId = await new LabelModel(getStore().db).latestBuildId(project.id, key, value);
+		if (!buildId) notFound("No build carries that label");
+		const build = await new BuildModel(getStore().db).get(buildId);
+		if (!build || !await publishedAccess(build, project)) return c.redirect("/auth/login", 302);
+		return c.redirect(`/projects/${slug}/storybook/build/${buildId}/`, 302);
+	});
 }
 /** Cache policy of the short link: a ULID names one build forever; a slug follows the latest. */
 function shortLinkCache(isUlid26, isRoot) {
 	if (isUlid26) return "public, max-age=31536000, immutable";
 	return isRoot ? "public, max-age=60" : "public, max-age=3600";
 }
-//#endregion
 export { registerStorybook };
 
 //# sourceMappingURL=storybook.mjs.map