@storyshelf/core 0.1.0

package/dist/routers/builds.handlers.mjs

@@ -0,0 +1,87 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { BuildModel } from "../models/build.mjs";
+import { ProjectModel } from "../models/project.mjs";
+import { BUILD_STATUSES } from "../types.mjs";
+import { getStore } from "../store.mjs";
+import { notFound } from "./helpers.mjs";
+import { emitWebhookEvent } from "../adapters/webhook-events.mjs";
+import { BaselineModel } from "../models/baseline.mjs";
+import { SnapshotModel } from "../models/snapshot.mjs";
+import { z } from "@hono/zod-openapi";
+//#region src/routers/builds.handlers.ts
+const VIEW_ROLES = [
+	"viewer",
+	"developer",
+	"approver",
+	"admin"
+];
+const DEVELOPER_ROLES = [
+	"developer",
+	"approver",
+	"admin"
+];
+const APPROVER_ROLES = ["approver", "admin"];
+const buildUploadSchema = z.object({
+	gitSha: z.string(),
+	gitBranch: z.string(),
+	authorEmail: z.string().optional(),
+	authorName: z.string().optional(),
+	message: z.string().optional(),
+	zip: z.instanceof(File).openapi({
+		type: "string",
+		format: "binary"
+	}).optional()
+}).openapi("BuildUpload");
+const buildListQuery = z.object({
+	status: z.enum(BUILD_STATUSES).optional(),
+	branch: z.string().optional()
+});
+async function buildForProject(projectId, buildId) {
+	const build = await new BuildModel(getStore().db).get(buildId);
+	if (!build || build.projectId !== projectId) notFound("Build not found");
+	return build;
+}
+async function snapshotForBuild(build, snapshotId) {
+	const snapshot = await new SnapshotModel(getStore().db).get(snapshotId);
+	if (!snapshot || snapshot.buildId !== build.id) notFound("Snapshot not found");
+	return snapshot;
+}
+async function refreshBuild(buildId) {
+	const db = getStore().db;
+	await new BuildModel(db).updateCounts(buildId);
+	const snapshots = await new SnapshotModel(db).listByBuild(buildId);
+	const unresolved = snapshots.some((s) => s.status === "new" || s.status === "changed");
+	let status;
+	if (unresolved) status = "reviewing";
+	else status = snapshots.some((s) => s.status === "rejected") ? "rejected" : "approved";
+	const build = await new BuildModel(db).get(buildId);
+	if (build) {
+		await new BuildModel(db).setStatus(buildId, status);
+		await emitWebhookEvent(db, build.projectId, `build:${status}`, {
+			buildId,
+			status,
+			snapshotCount: snapshots.length
+		});
+	}
+}
+async function approveSnapshot(snapshotId, userId) {
+	const db = getStore().db;
+	const snapshots = new SnapshotModel(db);
+	const snapshot = await snapshots.get(snapshotId);
+	if (!snapshot) notFound("Snapshot not found");
+	const project = await new ProjectModel(db).get(snapshot.projectId);
+	const build = await new BuildModel(db).get(snapshot.buildId);
+	if (!project || !build) notFound("Project or build not found");
+	await snapshots.review(snapshotId, "approved", userId);
+	await new BaselineModel(db, getStore().storage).upsert(project.id, snapshot.storyId, snapshot.viewportName, build.gitBranch, snapshot.id, snapshot.screenshotPath);
+	await refreshBuild(build.id);
+}
+function asString(value) {
+	return typeof value === "string" ? value : void 0;
+}
+//#endregion
+export { APPROVER_ROLES, DEVELOPER_ROLES, VIEW_ROLES, approveSnapshot, asString, buildForProject, buildListQuery, buildUploadSchema, refreshBuild, snapshotForBuild };
+
+//# sourceMappingURL=builds.handlers.mjs.map

package/dist/routers/builds.handlers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"builds.handlers.mjs","names":[],"sources":["../../src/routers/builds.handlers.ts"],"sourcesContent":["import { z } from \"@hono/zod-openapi\";\n\nimport { BaselineModel } from \"../models/baseline.ts\";\nimport { BuildModel } from \"../models/build.ts\";\nimport { ProjectModel } from \"../models/project.ts\";\nimport { SnapshotModel } from \"../models/snapshot.ts\";\nimport { emitWebhookEvent } from \"../adapters/webhook-events.ts\";\nimport { getStore } from \"../store.ts\";\nimport { type ProjectRole, BUILD_STATUSES } from \"../types.ts\";\nimport { notFound } from \"./helpers.ts\";\n\nexport const VIEW_ROLES: readonly ProjectRole[] = [\"viewer\", \"developer\", \"approver\", \"admin\"];\nexport const DEVELOPER_ROLES: readonly ProjectRole[] = [\"developer\", \"approver\", \"admin\"];\nexport const APPROVER_ROLES: readonly ProjectRole[] = [\"approver\", \"admin\"];\n\nexport const buildUploadSchema = z.object({\n  gitSha: z.string(),\n  gitBranch: z.string(),\n  authorEmail: z.string().optional(),\n  authorName: z.string().optional(),\n  message: z.string().optional(),\n  zip: z.instanceof(File).openapi({ type: \"string\", format: \"binary\" }).optional(),\n}).openapi(\"BuildUpload\");\n\nexport const buildListQuery = z.object({\n  status: z.enum(BUILD_STATUSES).optional(),\n  branch: z.string().optional(),\n});\n\nexport async function buildForProject(projectId: string, buildId: string): Promise<import(\"../models/build.ts\").Build> {\n  const build = await new BuildModel(getStore().db).get(buildId);\n  if (!build || build.projectId !== projectId) {\n    notFound(\"Build not found\");\n  }\n  return build;\n}\n\nexport async function snapshotForBuild(build: { id: string }, snapshotId: string): Promise<import(\"../models/snapshot.ts\").Snapshot> {\n  const snapshot = await new SnapshotModel(getStore().db).get(snapshotId);\n  if (!snapshot || snapshot.buildId !== build.id) {\n    notFound(\"Snapshot not found\");\n  }\n  return snapshot;\n}\n\nexport async function refreshBuild(buildId: string): Promise<void> {\n  const db = getStore().db;\n  await new BuildModel(db).updateCounts(buildId);\n  const snapshots = await new SnapshotModel(db).listByBuild(buildId);\n  const unresolved = snapshots.some((s) => s.status === \"new\" || s.status === \"changed\");\n  let status: \"reviewing\" | \"rejected\" | \"approved\";\n  if (unresolved) {\n    status = \"reviewing\";\n  } else {\n    const rejected = snapshots.some((s) => s.status === \"rejected\");\n    status = rejected ? \"rejected\" : \"approved\";\n  }\n  const build = await new BuildModel(db).get(buildId);\n  if (build) {\n    await new BuildModel(db).setStatus(buildId, status);\n    await emitWebhookEvent(db, build.projectId, `build:${status}`, {\n      buildId,\n      status,\n      snapshotCount: snapshots.length,\n    });\n  }\n}\n\nexport async function approveSnapshot(snapshotId: string, userId: string): Promise<void> {\n  const db = getStore().db;\n  const snapshots = new SnapshotModel(db);\n  const snapshot = await snapshots.get(snapshotId);\n  if (!snapshot) {\n    notFound(\"Snapshot not found\");\n  }\n  const project = await new ProjectModel(db).get(snapshot.projectId);\n  const build = await new BuildModel(db).get(snapshot.buildId);\n  if (!project || !build) {\n    notFound(\"Project or build not found\");\n  }\n  await snapshots.review(snapshotId, \"approved\", userId);\n  const baselines = new BaselineModel(db, getStore().storage);\n  await baselines.upsert(project.id, snapshot.storyId, snapshot.viewportName, build.gitBranch, snapshot.id, snapshot.screenshotPath);\n  await refreshBuild(build.id);\n}\n\nfunction asString(value: FormDataEntryValue | null): string | undefined {\n  return typeof value === \"string\" ? value : undefined;\n}\n\nexport { asString };"],"mappings":";;;;;;;;;;;;;AAWA,MAAa,aAAqC;CAAC;CAAU;CAAa;CAAY;AAAO;AAC7F,MAAa,kBAA0C;CAAC;CAAa;CAAY;AAAO;AACxF,MAAa,iBAAyC,CAAC,YAAY,OAAO;AAE1E,MAAa,oBAAoB,EAAE,OAAO;CACxC,QAAQ,EAAE,OAAO;CACjB,WAAW,EAAE,OAAO;CACpB,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;CACjC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC,QAAQ;EAAE,MAAM;EAAU,QAAQ;CAAS,CAAC,CAAC,CAAC,SAAS;AACjF,CAAC,CAAC,CAAC,QAAQ,aAAa;AAExB,MAAa,iBAAiB,EAAE,OAAO;CACrC,QAAQ,EAAE,KAAK,cAAc,CAAC,CAAC,SAAS;CACxC,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;AAC9B,CAAC;AAED,eAAsB,gBAAgB,WAAmB,SAA8D;CACrH,MAAM,QAAQ,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO;CAC7D,IAAI,CAAC,SAAS,MAAM,cAAc,WAChC,SAAS,iBAAiB;CAE5B,OAAO;AACT;AAEA,eAAsB,iBAAiB,OAAuB,YAAuE;CACnI,MAAM,WAAW,MAAM,IAAI,cAAc,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU;CACtE,IAAI,CAAC,YAAY,SAAS,YAAY,MAAM,IAC1C,SAAS,oBAAoB;CAE/B,OAAO;AACT;AAEA,eAAsB,aAAa,SAAgC;CACjE,MAAM,KAAK,SAAS,CAAC,CAAC;CACtB,MAAM,IAAI,WAAW,EAAE,CAAC,CAAC,aAAa,OAAO;CAC7C,MAAM,YAAY,MAAM,IAAI,cAAc,EAAE,CAAC,CAAC,YAAY,OAAO;CACjE,MAAM,aAAa,UAAU,MAAM,MAAM,EAAE,WAAW,SAAS,EAAE,WAAW,SAAS;CACrF,IAAI;CACJ,IAAI,YACF,SAAS;MAGT,SADiB,UAAU,MAAM,MAAM,EAAE,WAAW,UACpC,IAAI,aAAa;CAEnC,MAAM,QAAQ,MAAM,IAAI,WAAW,EAAE,CAAC,CAAC,IAAI,OAAO;CAClD,IAAI,OAAO;EACT,MAAM,IAAI,WAAW,EAAE,CAAC,CAAC,UAAU,SAAS,MAAM;EAClD,MAAM,iBAAiB,IAAI,MAAM,WAAW,SAAS,UAAU;GAC7D;GACA;GACA,eAAe,UAAU;EAC3B,CAAC;CACH;AACF;AAEA,eAAsB,gBAAgB,YAAoB,QAA+B;CACvF,MAAM,KAAK,SAAS,CAAC,CAAC;CACtB,MAAM,YAAY,IAAI,cAAc,EAAE;CACtC,MAAM,WAAW,MAAM,UAAU,IAAI,UAAU;CAC/C,IAAI,CAAC,UACH,SAAS,oBAAoB;CAE/B,MAAM,UAAU,MAAM,IAAI,aAAa,EAAE,CAAC,CAAC,IAAI,SAAS,SAAS;CACjE,MAAM,QAAQ,MAAM,IAAI,WAAW,EAAE,CAAC,CAAC,IAAI,SAAS,OAAO;CAC3D,IAAI,CAAC,WAAW,CAAC,OACf,SAAS,4BAA4B;CAEvC,MAAM,UAAU,OAAO,YAAY,YAAY,MAAM;CAErD,MAAM,IADgB,cAAc,IAAI,SAAS,CAAC,CAAC,OACrC,CAAC,CAAC,OAAO,QAAQ,IAAI,SAAS,SAAS,SAAS,cAAc,MAAM,WAAW,SAAS,IAAI,SAAS,cAAc;CACjI,MAAM,aAAa,MAAM,EAAE;AAC7B;AAEA,SAAS,SAAS,OAAsD;CACtE,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;AAC7C"}

package/dist/routers/builds.mjs

@@ -0,0 +1,162 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { BuildModel } from "../models/build.mjs";
+import { getStore } from "../store.mjs";
+import { resolveAuthorizedProject } from "./helpers.mjs";
+import { badRequest, buildSchema, forbidden, notFound, unauthorized } from "./schemas.mjs";
+import { emitWebhookEvent } from "../adapters/webhook-events.mjs";
+import { storybookZipPath } from "../utils/paths.mjs";
+import { APPROVER_ROLES, DEVELOPER_ROLES, VIEW_ROLES, asString, buildForProject, buildListQuery, buildUploadSchema } from "./builds.handlers.mjs";
+import { registerSnapshots } from "./snapshots.mjs";
+import { registerComments } from "./comments.mjs";
+import { createRoute, z } from "@hono/zod-openapi";
+import { HTTPException } from "hono/http-exception";
+//#region src/routers/builds.ts
+const listBuildsRoute = createRoute({
+	method: "get",
+	path: "/api/v1/projects/{slug}/builds",
+	request: {
+		params: z.object({ slug: z.string() }),
+		query: buildListQuery
+	},
+	responses: {
+		200: {
+			content: { "application/json": { schema: buildSchema.array() } },
+			description: "List builds for a project"
+		},
+		...notFound,
+		...unauthorized
+	}
+});
+const createBuildRoute = createRoute({
+	method: "post",
+	path: "/api/v1/projects/{slug}/builds",
+	request: {
+		params: z.object({ slug: z.string() }),
+		body: { content: { "multipart/form-data": { schema: buildUploadSchema } } }
+	},
+	responses: {
+		202: {
+			content: { "application/json": { schema: buildSchema } },
+			description: "Build created and capture queued"
+		},
+		...badRequest,
+		...forbidden,
+		...notFound
+	}
+});
+const getBuildRoute = createRoute({
+	method: "get",
+	path: "/api/v1/projects/{slug}/builds/{buildId}",
+	request: { params: z.object({
+		slug: z.string(),
+		buildId: z.string()
+	}) },
+	responses: {
+		200: {
+			content: { "application/json": { schema: buildSchema } },
+			description: "Fetch a build"
+		},
+		...notFound,
+		...unauthorized
+	}
+});
+const retryBuildRoute = createRoute({
+	method: "post",
+	path: "/api/v1/projects/{slug}/builds/{buildId}/retry",
+	request: { params: z.object({
+		slug: z.string(),
+		buildId: z.string()
+	}) },
+	responses: {
+		202: {
+			content: { "application/json": { schema: buildSchema } },
+			description: "Build reset to pending"
+		},
+		...notFound
+	}
+});
+const deleteBuildRoute = createRoute({
+	method: "delete",
+	path: "/api/v1/projects/{slug}/builds/{buildId}",
+	request: { params: z.object({
+		slug: z.string(),
+		buildId: z.string()
+	}) },
+	responses: {
+		204: { description: "Build deleted" },
+		...notFound
+	}
+});
+function registerBuilds(app) {
+	app.openapi(listBuildsRoute, async (c) => {
+		const project = await resolveAuthorizedProject(c, c.req.valid("param").slug, ...VIEW_ROLES);
+		const { status, branch } = c.req.valid("query");
+		const builds = new BuildModel(getStore().db).list(project.id, {
+			status,
+			branch: branch ?? void 0
+		});
+		return c.json(await builds);
+	});
+	app.openapi(createBuildRoute, async (c) => {
+		const project = await resolveAuthorizedProject(c, c.req.valid("param").slug, ...DEVELOPER_ROLES);
+		const form = await c.req.formData();
+		const gitSha = asString(form.get("gitSha")) ?? "";
+		const gitBranch = asString(form.get("gitBranch")) ?? "";
+		if (!gitSha || !gitBranch) throw new HTTPException(400, { message: "gitSha and gitBranch are required" });
+		const authorEmail = asString(form.get("authorEmail"));
+		const authorName = asString(form.get("authorName"));
+		const message = asString(form.get("message"));
+		const build = await new BuildModel(getStore().db).create(project.id, {
+			gitSha,
+			gitBranch,
+			isDefault: gitBranch === project.gitDefaultBranch,
+			authorEmail,
+			authorName,
+			message
+		});
+		await emitWebhookEvent(getStore().db, project.id, "build:created", {
+			buildId: build.id,
+			gitSha,
+			gitBranch,
+			authorEmail,
+			authorName,
+			message
+		});
+		const zip = form.get("zip");
+		if (zip && typeof zip !== "string") {
+			const buffer = Buffer.from(await zip.arrayBuffer());
+			await getStore().storage.write(storybookZipPath(project.id, build.id), buffer);
+		}
+		const reqId = c.get("requestId");
+		await getStore().enqueueCapture?.(build.id, reqId);
+		return c.json(build, 202);
+	});
+	app.openapi(getBuildRoute, async (c) => {
+		const { slug, buildId } = c.req.valid("param");
+		const project = await resolveAuthorizedProject(c, slug, ...VIEW_ROLES);
+		const build = await buildForProject(project.id, buildId);
+		return c.json(build);
+	});
+	app.openapi(retryBuildRoute, async (c) => {
+		const { slug, buildId } = c.req.valid("param");
+		const project = await resolveAuthorizedProject(c, slug, ...DEVELOPER_ROLES);
+		const build = await buildForProject(project.id, buildId);
+		const updated = await new BuildModel(getStore().db).setStatus(build.id, "pending");
+		return c.json(updated, 202);
+	});
+	app.openapi(deleteBuildRoute, async (c) => {
+		const { slug, buildId } = c.req.valid("param");
+		const project = await resolveAuthorizedProject(c, slug, ...APPROVER_ROLES);
+		const build = await buildForProject(project.id, buildId);
+		await new BuildModel(getStore().db).remove(build.id);
+		return c.body(null, 204);
+	});
+	registerSnapshots(app);
+	registerComments(app);
+}
+//#endregion
+export { registerBuilds };
+
+//# sourceMappingURL=builds.mjs.map

package/dist/routers/builds.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"builds.mjs","names":["notFoundResponse","forbiddenResponse"],"sources":["../../src/routers/builds.ts"],"sourcesContent":["import { createRoute, z } from \"@hono/zod-openapi\";\nimport type { ShelfApp } from \"../index.tsx\";\nimport { HTTPException } from \"hono/http-exception\";\n\nimport { BuildModel } from \"../models/build.ts\";\nimport { emitWebhookEvent } from \"../adapters/webhook-events.ts\";\nimport { getStore } from \"../store.ts\";\nimport { storybookZipPath } from \"../utils/paths.ts\";\nimport { resolveAuthorizedProject } from \"./helpers.ts\";\nimport { badRequest, buildSchema, forbidden as forbiddenResponse, notFound as notFoundResponse, unauthorized } from \"./schemas.ts\";\nimport { VIEW_ROLES, DEVELOPER_ROLES, APPROVER_ROLES, buildUploadSchema, buildListQuery, buildForProject, asString } from \"./builds.handlers.ts\";\nimport { registerSnapshots } from \"./snapshots.ts\";\nimport { registerComments } from \"./comments.ts\";\n\nconst listBuildsRoute = createRoute({\n  method: \"get\",\n  path: \"/api/v1/projects/{slug}/builds\",\n  request: { params: z.object({ slug: z.string() }), query: buildListQuery },\n  responses: {\n    200: { content: { \"application/json\": { schema: buildSchema.array() } }, description: \"List builds for a project\" },\n    ...notFoundResponse,\n    ...unauthorized,\n  },\n});\n\nconst createBuildRoute = createRoute({\n  method: \"post\",\n  path: \"/api/v1/projects/{slug}/builds\",\n  request: {\n    params: z.object({ slug: z.string() }),\n    body: { content: { \"multipart/form-data\": { schema: buildUploadSchema } } },\n  },\n  responses: {\n    202: { content: { \"application/json\": { schema: buildSchema } }, description: \"Build created and capture queued\" },\n    ...badRequest,\n    ...forbiddenResponse,\n    ...notFoundResponse,\n  },\n});\n\nconst getBuildRoute = createRoute({\n  method: \"get\",\n  path: \"/api/v1/projects/{slug}/builds/{buildId}\",\n  request: { params: z.object({ slug: z.string(), buildId: z.string() }) },\n  responses: {\n    200: { content: { \"application/json\": { schema: buildSchema } }, description: \"Fetch a build\" },\n    ...notFoundResponse,\n    ...unauthorized,\n  },\n});\n\nconst retryBuildRoute = createRoute({\n  method: \"post\",\n  path: \"/api/v1/projects/{slug}/builds/{buildId}/retry\",\n  request: { params: z.object({ slug: z.string(), buildId: z.string() }) },\n  responses: {\n    202: { content: { \"application/json\": { schema: buildSchema } }, description: \"Build reset to pending\" },\n    ...notFoundResponse,\n  },\n});\n\nconst deleteBuildRoute = createRoute({\n  method: \"delete\",\n  path: \"/api/v1/projects/{slug}/builds/{buildId}\",\n  request: { params: z.object({ slug: z.string(), buildId: z.string() }) },\n  responses: {\n    204: { description: \"Build deleted\" },\n    ...notFoundResponse,\n  },\n});\n\nexport function registerBuilds(app: ShelfApp): void {\n  app.openapi(listBuildsRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...VIEW_ROLES);\n    const { status, branch } = c.req.valid(\"query\");\n    const builds = new BuildModel(getStore().db).list(project.id, { status, branch: branch ?? undefined });\n    return c.json(await builds);\n  });\n\n  app.openapi(createBuildRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...DEVELOPER_ROLES);\n    const form = await c.req.formData();\n\n    const gitSha = asString(form.get(\"gitSha\")) ?? \"\";\n    const gitBranch = asString(form.get(\"gitBranch\")) ?? \"\";\n    if (!gitSha || !gitBranch) {\n      throw new HTTPException(400, { message: \"gitSha and gitBranch are required\" });\n    }\n    const authorEmail = asString(form.get(\"authorEmail\"));\n    const authorName = asString(form.get(\"authorName\"));\n    const message = asString(form.get(\"message\"));\n\n    const build = await new BuildModel(getStore().db).create(project.id, {\n      gitSha,\n      gitBranch,\n      isDefault: gitBranch === project.gitDefaultBranch,\n      authorEmail,\n      authorName,\n      message,\n    });\n\n    await emitWebhookEvent(getStore().db, project.id, \"build:created\", {\n      buildId: build.id,\n      gitSha,\n      gitBranch,\n      authorEmail,\n      authorName,\n      message,\n    });\n\n    const zip = form.get(\"zip\");\n    if (zip && typeof zip !== \"string\") {\n      const buffer = Buffer.from(await zip.arrayBuffer());\n      await getStore().storage.write(storybookZipPath(project.id, build.id), buffer);\n    }\n\n    const reqId = c.get(\"requestId\");\n    await getStore().enqueueCapture?.(build.id, reqId);\n    return c.json(build, 202);\n  });\n\n  app.openapi(getBuildRoute, async (c) => {\n    const { slug, buildId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...VIEW_ROLES);\n    const build = await buildForProject(project.id, buildId);\n    return c.json(build);\n  });\n\n  app.openapi(retryBuildRoute, async (c) => {\n    const { slug, buildId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...DEVELOPER_ROLES);\n    const build = await buildForProject(project.id, buildId);\n    const updated = await new BuildModel(getStore().db).setStatus(build.id, \"pending\");\n    return c.json(updated, 202);\n  });\n\n  app.openapi(deleteBuildRoute, async (c) => {\n    const { slug, buildId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...APPROVER_ROLES);\n    const build = await buildForProject(project.id, buildId);\n    await new BuildModel(getStore().db).remove(build.id);\n    return c.body(null, 204);\n  });\n\n  registerSnapshots(app);\n  registerComments(app);\n}"],"mappings":";;;;;;;;;;;;;;;AAcA,MAAM,kBAAkB,YAAY;CAClC,QAAQ;CACR,MAAM;CACN,SAAS;EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;EAAG,OAAO;CAAe;CACzE,WAAW;EACT,KAAK;GAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,YAAY,MAAM,EAAE,EAAE;GAAG,aAAa;EAA4B;EAClH,GAAGA;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,mBAAmB,YAAY;CACnC,QAAQ;CACR,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;EACrC,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,QAAQ,kBAAkB,EAAE,EAAE;CAC5E;CACA,WAAW;EACT,KAAK;GAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,YAAY,EAAE;GAAG,aAAa;EAAmC;EACjH,GAAG;EACH,GAAGC;EACH,GAAGD;CACL;AACF,CAAC;AAED,MAAM,gBAAgB,YAAY;CAChC,QAAQ;CACR,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,SAAS,EAAE,OAAO;CAAE,CAAC,EAAE;CACvE,WAAW;EACT,KAAK;GAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,YAAY,EAAE;GAAG,aAAa;EAAgB;EAC9F,GAAGA;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,kBAAkB,YAAY;CAClC,QAAQ;CACR,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,SAAS,EAAE,OAAO;CAAE,CAAC,EAAE;CACvE,WAAW;EACT,KAAK;GAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,YAAY,EAAE;GAAG,aAAa;EAAyB;EACvG,GAAGA;CACL;AACF,CAAC;AAED,MAAM,mBAAmB,YAAY;CACnC,QAAQ;CACR,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,SAAS,EAAE,OAAO;CAAE,CAAC,EAAE;CACvE,WAAW;EACT,KAAK,EAAE,aAAa,gBAAgB;EACpC,GAAGA;CACL;AACF,CAAC;AAED,SAAgB,eAAe,KAAqB;CAClD,IAAI,QAAQ,iBAAiB,OAAO,MAAM;EACxC,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,UAAU;EAC1F,MAAM,EAAE,QAAQ,WAAW,EAAE,IAAI,MAAM,OAAO;EAC9C,MAAM,SAAS,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI;GAAE;GAAQ,QAAQ,UAAU,KAAA;EAAU,CAAC;EACrG,OAAO,EAAE,KAAK,MAAM,MAAM;CAC5B,CAAC;CAED,IAAI,QAAQ,kBAAkB,OAAO,MAAM;EACzC,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,eAAe;EAC/F,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;EAElC,MAAM,SAAS,SAAS,KAAK,IAAI,QAAQ,CAAC,KAAK;EAC/C,MAAM,YAAY,SAAS,KAAK,IAAI,WAAW,CAAC,KAAK;EACrD,IAAI,CAAC,UAAU,CAAC,WACd,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,oCAAoC,CAAC;EAE/E,MAAM,cAAc,SAAS,KAAK,IAAI,aAAa,CAAC;EACpD,MAAM,aAAa,SAAS,KAAK,IAAI,YAAY,CAAC;EAClD,MAAM,UAAU,SAAS,KAAK,IAAI,SAAS,CAAC;EAE5C,MAAM,QAAQ,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI;GACnE;GACA;GACA,WAAW,cAAc,QAAQ;GACjC;GACA;GACA;EACF,CAAC;EAED,MAAM,iBAAiB,SAAS,CAAC,CAAC,IAAI,QAAQ,IAAI,iBAAiB;GACjE,SAAS,MAAM;GACf;GACA;GACA;GACA;GACA;EACF,CAAC;EAED,MAAM,MAAM,KAAK,IAAI,KAAK;EAC1B,IAAI,OAAO,OAAO,QAAQ,UAAU;GAClC,MAAM,SAAS,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC;GAClD,MAAM,SAAS,CAAC,CAAC,QAAQ,MAAM,iBAAiB,QAAQ,IAAI,MAAM,EAAE,GAAG,MAAM;EAC/E;EAEA,MAAM,QAAQ,EAAE,IAAI,WAAW;EAC/B,MAAM,SAAS,CAAC,CAAC,iBAAiB,MAAM,IAAI,KAAK;EACjD,OAAO,EAAE,KAAK,OAAO,GAAG;CAC1B,CAAC;CAED,IAAI,QAAQ,eAAe,OAAO,MAAM;EACtC,MAAM,EAAE,MAAM,YAAY,EAAE,IAAI,MAAM,OAAO;EAC7C,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,UAAU;EACrE,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,IAAI,OAAO;EACvD,OAAO,EAAE,KAAK,KAAK;CACrB,CAAC;CAED,IAAI,QAAQ,iBAAiB,OAAO,MAAM;EACxC,MAAM,EAAE,MAAM,YAAY,EAAE,IAAI,MAAM,OAAO;EAC7C,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,eAAe;EAC1E,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,IAAI,OAAO;EACvD,MAAM,UAAU,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,MAAM,IAAI,SAAS;EACjF,OAAO,EAAE,KAAK,SAAS,GAAG;CAC5B,CAAC;CAED,IAAI,QAAQ,kBAAkB,OAAO,MAAM;EACzC,MAAM,EAAE,MAAM,YAAY,EAAE,IAAI,MAAM,OAAO;EAC7C,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,cAAc;EACzE,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,IAAI,OAAO;EACvD,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,MAAM,EAAE;EACnD,OAAO,EAAE,KAAK,MAAM,GAAG;CACzB,CAAC;CAED,kBAAkB,GAAG;CACrB,iBAAiB,GAAG;AACtB"}

package/dist/routers/comments.mjs

@@ -0,0 +1,89 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { notFound, resolveAuthorizedProject } from "./helpers.mjs";
+import { commentCreateSchema, commentSchema, notFound as notFound$1, unauthorized } from "./schemas.mjs";
+import { DEVELOPER_ROLES, VIEW_ROLES, buildForProject } from "./builds.handlers.mjs";
+import { CommentModel } from "../models/comment.mjs";
+import { createRoute, z } from "@hono/zod-openapi";
+//#region src/routers/comments.ts
+const listCommentsRoute = createRoute({
+	method: "get",
+	path: "/api/v1/projects/{slug}/builds/{buildId}/comments",
+	request: { params: z.object({
+		slug: z.string(),
+		buildId: z.string()
+	}) },
+	responses: {
+		200: {
+			content: { "application/json": { schema: commentSchema.array() } },
+			description: "List comments on a build"
+		},
+		...notFound$1,
+		...unauthorized
+	}
+});
+const createCommentRoute = createRoute({
+	method: "post",
+	path: "/api/v1/projects/{slug}/builds/{buildId}/comments",
+	request: {
+		params: z.object({
+			slug: z.string(),
+			buildId: z.string()
+		}),
+		body: { content: { "application/json": { schema: commentCreateSchema } } }
+	},
+	responses: {
+		201: {
+			content: { "application/json": { schema: commentSchema } },
+			description: "Comment created"
+		},
+		...notFound$1
+	}
+});
+const resolveCommentRoute = createRoute({
+	method: "post",
+	path: "/api/v1/projects/{slug}/builds/{buildId}/comments/{commentId}/resolve",
+	request: { params: z.object({
+		slug: z.string(),
+		buildId: z.string(),
+		commentId: z.string()
+	}) },
+	responses: {
+		200: {
+			content: { "application/json": { schema: commentSchema } },
+			description: "Comment resolved"
+		},
+		...notFound$1
+	}
+});
+function registerComments(app) {
+	app.openapi(listCommentsRoute, async (c) => {
+		const { slug, buildId } = c.req.valid("param");
+		const project = await resolveAuthorizedProject(c, slug, ...VIEW_ROLES);
+		const build = await buildForProject(project.id, buildId);
+		return c.json(await new CommentModel(getStore().db).listByBuild(build.id));
+	});
+	app.openapi(createCommentRoute, async (c) => {
+		const { slug, buildId } = c.req.valid("param");
+		const project = await resolveAuthorizedProject(c, slug, ...DEVELOPER_ROLES);
+		const build = await buildForProject(project.id, buildId);
+		const body = c.req.valid("json");
+		const userId = getStore().user?.id ?? "anonymous";
+		const comment = await new CommentModel(getStore().db).create(project.id, build.id, userId, body);
+		return c.json(comment, 201);
+	});
+	app.openapi(resolveCommentRoute, async (c) => {
+		const { slug, buildId, commentId } = c.req.valid("param");
+		const project = await resolveAuthorizedProject(c, slug, ...DEVELOPER_ROLES);
+		const build = await buildForProject(project.id, buildId);
+		const comment = await new CommentModel(getStore().db).resolve(commentId);
+		if (comment.buildId !== build.id) notFound("Comment not found");
+		return c.json(comment);
+	});
+}
+//#endregion
+export { registerComments };
+
+//# sourceMappingURL=comments.mjs.map

package/dist/routers/comments.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments.mjs","names":["notFound"],"sources":["../../src/routers/comments.ts"],"sourcesContent":["import { createRoute, z } from \"@hono/zod-openapi\";\nimport type { ShelfApp } from \"../index.tsx\";\n\nimport { CommentModel } from \"../models/comment.ts\";\nimport { getStore } from \"../store.ts\";\nimport { resolveAuthorizedProject, notFound as throwNotFound } from \"./helpers.ts\";\nimport { commentSchema, commentCreateSchema, notFound, unauthorized } from \"./schemas.ts\";\nimport { VIEW_ROLES, DEVELOPER_ROLES, buildForProject } from \"./builds.handlers.ts\";\n\nconst listCommentsRoute = createRoute({\n  method: \"get\",\n  path: \"/api/v1/projects/{slug}/builds/{buildId}/comments\",\n  request: { params: z.object({ slug: z.string(), buildId: z.string() }) },\n  responses: {\n    200: { content: { \"application/json\": { schema: commentSchema.array() } }, description: \"List comments on a build\" },\n    ...notFound,\n    ...unauthorized,\n  },\n});\n\nconst createCommentRoute = createRoute({\n  method: \"post\",\n  path: \"/api/v1/projects/{slug}/builds/{buildId}/comments\",\n  request: {\n    params: z.object({ slug: z.string(), buildId: z.string() }),\n    body: { content: { \"application/json\": { schema: commentCreateSchema } } },\n  },\n  responses: {\n    201: { content: { \"application/json\": { schema: commentSchema } }, description: \"Comment created\" },\n    ...notFound,\n  },\n});\n\nconst resolveCommentRoute = createRoute({\n  method: \"post\",\n  path: \"/api/v1/projects/{slug}/builds/{buildId}/comments/{commentId}/resolve\",\n  request: { params: z.object({ slug: z.string(), buildId: z.string(), commentId: z.string() }) },\n  responses: {\n    200: { content: { \"application/json\": { schema: commentSchema } }, description: \"Comment resolved\" },\n    ...notFound,\n  },\n});\n\nexport function registerComments(app: ShelfApp): void {\n  app.openapi(listCommentsRoute, async (c) => {\n    const { slug, buildId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...VIEW_ROLES);\n    const build = await buildForProject(project.id, buildId);\n    return c.json(await new CommentModel(getStore().db).listByBuild(build.id));\n  });\n\n  app.openapi(createCommentRoute, async (c) => {\n    const { slug, buildId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...DEVELOPER_ROLES);\n    const build = await buildForProject(project.id, buildId);\n    const body = c.req.valid(\"json\");\n    const userId = getStore().user?.id ?? \"anonymous\";\n    const comment = await new CommentModel(getStore().db).create(project.id, build.id, userId, body);\n    return c.json(comment, 201);\n  });\n\n  app.openapi(resolveCommentRoute, async (c) => {\n    const { slug, buildId, commentId } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...DEVELOPER_ROLES);\n    const build = await buildForProject(project.id, buildId);\n    const comment = await new CommentModel(getStore().db).resolve(commentId);\n    if (comment.buildId !== build.id) {\n      throwNotFound(\"Comment not found\");\n    }\n    return c.json(comment);\n  });\n}"],"mappings":";;;;;;;;;;AASA,MAAM,oBAAoB,YAAY;CACpC,QAAQ;CACR,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,SAAS,EAAE,OAAO;CAAE,CAAC,EAAE;CACvE,WAAW;EACT,KAAK;GAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,cAAc,MAAM,EAAE,EAAE;GAAG,aAAa;EAA2B;EACnH,GAAGA;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,qBAAqB,YAAY;CACrC,QAAQ;CACR,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO;GAAE,MAAM,EAAE,OAAO;GAAG,SAAS,EAAE,OAAO;EAAE,CAAC;EAC1D,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE,EAAE;CAC3E;CACA,WAAW;EACT,KAAK;GAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,cAAc,EAAE;GAAG,aAAa;EAAkB;EAClG,GAAGA;CACL;AACF,CAAC;AAED,MAAM,sBAAsB,YAAY;CACtC,QAAQ;CACR,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,SAAS,EAAE,OAAO;EAAG,WAAW,EAAE,OAAO;CAAE,CAAC,EAAE;CAC9F,WAAW;EACT,KAAK;GAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,cAAc,EAAE;GAAG,aAAa;EAAmB;EACnG,GAAGA;CACL;AACF,CAAC;AAED,SAAgB,iBAAiB,KAAqB;CACpD,IAAI,QAAQ,mBAAmB,OAAO,MAAM;EAC1C,MAAM,EAAE,MAAM,YAAY,EAAE,IAAI,MAAM,OAAO;EAC7C,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,UAAU;EACrE,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,IAAI,OAAO;EACvD,OAAO,EAAE,KAAK,MAAM,IAAI,aAAa,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,MAAM,EAAE,CAAC;CAC3E,CAAC;CAED,IAAI,QAAQ,oBAAoB,OAAO,MAAM;EAC3C,MAAM,EAAE,MAAM,YAAY,EAAE,IAAI,MAAM,OAAO;EAC7C,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,eAAe;EAC1E,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,IAAI,OAAO;EACvD,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,MAAM,SAAS,SAAS,CAAC,CAAC,MAAM,MAAM;EACtC,MAAM,UAAU,MAAM,IAAI,aAAa,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI,MAAM,IAAI,QAAQ,IAAI;EAC/F,OAAO,EAAE,KAAK,SAAS,GAAG;CAC5B,CAAC;CAED,IAAI,QAAQ,qBAAqB,OAAO,MAAM;EAC5C,MAAM,EAAE,MAAM,SAAS,cAAc,EAAE,IAAI,MAAM,OAAO;EACxD,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,eAAe;EAC1E,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,IAAI,OAAO;EACvD,MAAM,UAAU,MAAM,IAAI,aAAa,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,SAAS;EACvE,IAAI,QAAQ,YAAY,MAAM,IAC5B,SAAc,mBAAmB;EAEnC,OAAO,EAAE,KAAK,OAAO;CACvB,CAAC;AACH"}

package/dist/routers/helpers.mjs

@@ -0,0 +1,76 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { projects } from "../schema.mjs";
+import { ProjectModel } from "../models/project.mjs";
+import { getStore } from "../store.mjs";
+import { MemberModel } from "../models/member.mjs";
+import { TokenModel } from "../models/token.mjs";
+import { sha256 } from "../utils/hash.mjs";
+import { eq } from "drizzle-orm";
+import { HTTPException } from "hono/http-exception";
+//#region src/routers/helpers.ts
+function unauthorized() {
+	throw new HTTPException(401, { message: "Unauthorized" });
+}
+function forbidden() {
+	throw new HTTPException(403, { message: "Forbidden" });
+}
+function notFound(message = "Not found") {
+	throw new HTTPException(404, { message });
+}
+async function currentProjectRole(projectId) {
+	const { db, user } = getStore();
+	if (!user) return null;
+	return await new MemberModel(db).effectiveRole(user.role, projectId, user.id);
+}
+async function findProjectBySlug(slug) {
+	const { db } = getStore();
+	return (await db.list(projects, {
+		where: eq(projects.slug, slug),
+		limit: 1
+	}))[0] ?? null;
+}
+async function resolveProjectByToken(c, slug) {
+	const authHeader = c.req.header("authorization");
+	if (authHeader?.startsWith("Bearer ")) {
+		const token = authHeader.slice(7);
+		const found = await new TokenModel(getStore().db).findByHash(sha256(token));
+		if (!found) unauthorized();
+		const project = await new ProjectModel(getStore().db).get(found.projectId);
+		if (!project || project.slug !== slug) forbidden();
+		return project;
+	}
+	return null;
+}
+/**
+* Enforce the caller's project role for a given project.
+*
+* Authorization model (ADR 0008):
+* - No auth adapter configured -> all operations permitted (development mode).
+* - Bearer token (CLI) -> grants access to its own project regardless of role.
+* - Session user -> must have an effective role in `minRoles`.
+*/
+async function assertRole(projectId, ...minRoles) {
+	if (!getStore().authEnabled) return;
+	const role = await currentProjectRole(projectId);
+	if (!role || !minRoles.includes(role)) forbidden();
+}
+async function resolveAuthorizedProject(c, slug, ...minRoles) {
+	const project = await resolveProjectByToken(c, slug);
+	if (project) return project;
+	const found = await findProjectBySlug(slug);
+	if (!found) notFound("Project not found");
+	await assertRole(found.id, ...minRoles);
+	return found;
+}
+/** Require a site-level admin (or permit when auth is disabled). */
+function requireSiteAdmin() {
+	if (!getStore().authEnabled) return;
+	const { user } = getStore();
+	if (user?.role !== "admin") forbidden();
+}
+//#endregion
+export { assertRole, currentProjectRole, findProjectBySlug, forbidden, notFound, requireSiteAdmin, resolveAuthorizedProject, unauthorized };
+
+//# sourceMappingURL=helpers.mjs.map

package/dist/routers/helpers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.mjs","names":[],"sources":["../../src/routers/helpers.ts"],"sourcesContent":["import { eq } from \"drizzle-orm\";\nimport type { Context, Next } from \"hono\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { ContentfulStatusCode } from \"hono/utils/http-status\";\nimport type { ZodType } from \"zod\";\n\nimport { MemberModel } from \"../models/member.ts\";\nimport { ProjectModel } from \"../models/project.ts\";\nimport { TokenModel } from \"../models/token.ts\";\nimport { projects, type Project } from \"../schema.ts\";\nimport { getStore } from \"../store.ts\";\nimport type { ProjectRole } from \"../types.ts\";\nimport { sha256 } from \"../utils/hash.ts\";\n\nexport function json(c: Context, data: unknown, status: ContentfulStatusCode = 200): Response {\n  return c.json(data, status);\n}\n\nexport async function validJson<T>(c: Context, schema: ZodType<T>): Promise<T> {\n  const result = schema.safeParse(await c.req.json());\n  if (!result.success) {\n    throw new HTTPException(400, { message: result.error.message });\n  }\n  return result.data;\n}\n\nexport function unauthorized(): never {\n  throw new HTTPException(401, { message: \"Unauthorized\" });\n}\n\nexport function forbidden(): never {\n  throw new HTTPException(403, { message: \"Forbidden\" });\n}\n\nexport function notFound(message = \"Not found\"): never {\n  throw new HTTPException(404, { message });\n}\n\nexport async function currentProjectRole(projectId: string): Promise<ProjectRole | null> {\n  const { db, user } = getStore();\n  if (!user) {\n    return null;\n  }\n  return await new MemberModel(db).effectiveRole(user.role, projectId, user.id);\n}\n\nexport function requireRole(...roles: ProjectRole[]) {\n  return async (c: Context, next: Next): Promise<void> => {\n    const projectId = c.req.param(\"projectId\") ?? c.req.param(\"slug\");\n    if (!projectId) {\n      forbidden();\n    }\n    const role = await currentProjectRole(projectId);\n    if (!role || !roles.includes(role)) {\n      forbidden();\n    }\n    await next();\n  };\n}\n\nexport async function findProjectBySlug(slug: string): Promise<Project | null> {\n  const { db } = getStore();\n  const rows = await db.list(projects, { where: eq(projects.slug, slug), limit: 1 });\n  return rows[0] ?? null;\n}\n\nasync function resolveProjectByToken(c: Context, slug: string): Promise<Project | null> {\n  const authHeader = c.req.header(\"authorization\");\n  if (authHeader?.startsWith(\"Bearer \")) {\n    const token = authHeader.slice(\"Bearer \".length);\n    const found = await new TokenModel(getStore().db).findByHash(sha256(token));\n    if (!found) {\n      unauthorized();\n    }\n    const project = await new ProjectModel(getStore().db).get(found.projectId);\n    if (!project || project.slug !== slug) {\n      forbidden();\n    }\n    return project;\n  }\n  return null;\n}\n\nexport async function resolveProject(c: Context, slug: string): Promise<Project> {\n  const project = await resolveProjectByToken(c, slug);\n  if (project) return project;\n  const found = await findProjectBySlug(slug);\n  if (!found) {\n    notFound(\"Project not found\");\n  }\n  return found;\n}\n\n/**\n * Enforce the caller's project role for a given project.\n *\n * Authorization model (ADR 0008):\n * - No auth adapter configured -> all operations permitted (development mode).\n * - Bearer token (CLI) -> grants access to its own project regardless of role.\n * - Session user -> must have an effective role in `minRoles`.\n */\nexport async function assertRole(projectId: string, ...minRoles: ProjectRole[]): Promise<void> {\n  if (!getStore().authEnabled) {\n    return;\n  }\n  const role = await currentProjectRole(projectId);\n  if (!role || !minRoles.includes(role)) {\n    forbidden();\n  }\n}\n\nexport async function resolveAuthorizedProject(c: Context, slug: string, ...minRoles: ProjectRole[]): Promise<Project> {\n  const project = await resolveProjectByToken(c, slug);\n  if (project) return project;\n  const found = await findProjectBySlug(slug);\n  if (!found) {\n    notFound(\"Project not found\");\n  }\n  await assertRole(found.id, ...minRoles);\n  return found;\n}\n\n/** Require a site-level admin (or permit when auth is disabled). */\nexport function requireSiteAdmin(): void {\n  if (!getStore().authEnabled) {\n    return;\n  }\n  const { user } = getStore();\n  if (user?.role !== \"admin\") {\n    forbidden();\n  }\n}\n\n/** Require the current session user to hold one of the given project roles. */\nexport async function requireProjectRole(projectId: string, ...minRoles: ProjectRole[]): Promise<void> {\n  await assertRole(projectId, ...minRoles);\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,SAAgB,eAAsB;CACpC,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,eAAe,CAAC;AAC1D;AAEA,SAAgB,YAAmB;CACjC,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,YAAY,CAAC;AACvD;AAEA,SAAgB,SAAS,UAAU,aAAoB;CACrD,MAAM,IAAI,cAAc,KAAK,EAAE,QAAQ,CAAC;AAC1C;AAEA,eAAsB,mBAAmB,WAAgD;CACvF,MAAM,EAAE,IAAI,SAAS,SAAS;CAC9B,IAAI,CAAC,MACH,OAAO;CAET,OAAO,MAAM,IAAI,YAAY,EAAE,CAAC,CAAC,cAAc,KAAK,MAAM,WAAW,KAAK,EAAE;AAC9E;AAgBA,eAAsB,kBAAkB,MAAuC;CAC7E,MAAM,EAAE,OAAO,SAAS;CAExB,QAAO,MADY,GAAG,KAAK,UAAU;EAAE,OAAO,GAAG,SAAS,MAAM,IAAI;EAAG,OAAO;CAAE,CAAC,EAAA,CACrE,MAAM;AACpB;AAEA,eAAe,sBAAsB,GAAY,MAAuC;CACtF,MAAM,aAAa,EAAE,IAAI,OAAO,eAAe;CAC/C,IAAI,YAAY,WAAW,SAAS,GAAG;EACrC,MAAM,QAAQ,WAAW,MAAM,CAAgB;EAC/C,MAAM,QAAQ,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,OAAO,KAAK,CAAC;EAC1E,IAAI,CAAC,OACH,aAAa;EAEf,MAAM,UAAU,MAAM,IAAI,aAAa,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,SAAS;EACzE,IAAI,CAAC,WAAW,QAAQ,SAAS,MAC/B,UAAU;EAEZ,OAAO;CACT;CACA,OAAO;AACT;;;;;;;;;AAoBA,eAAsB,WAAW,WAAmB,GAAG,UAAwC;CAC7F,IAAI,CAAC,SAAS,CAAC,CAAC,aACd;CAEF,MAAM,OAAO,MAAM,mBAAmB,SAAS;CAC/C,IAAI,CAAC,QAAQ,CAAC,SAAS,SAAS,IAAI,GAClC,UAAU;AAEd;AAEA,eAAsB,yBAAyB,GAAY,MAAc,GAAG,UAA2C;CACrH,MAAM,UAAU,MAAM,sBAAsB,GAAG,IAAI;CACnD,IAAI,SAAS,OAAO;CACpB,MAAM,QAAQ,MAAM,kBAAkB,IAAI;CAC1C,IAAI,CAAC,OACH,SAAS,mBAAmB;CAE9B,MAAM,WAAW,MAAM,IAAI,GAAG,QAAQ;CACtC,OAAO;AACT;;AAGA,SAAgB,mBAAyB;CACvC,IAAI,CAAC,SAAS,CAAC,CAAC,aACd;CAEF,MAAM,EAAE,SAAS,SAAS;CAC1B,IAAI,MAAM,SAAS,SACjB,UAAU;AAEd"}

package/dist/routers/htmx.mjs

@@ -0,0 +1,18 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/routers/htmx.ts
+function isHxRequest(c) {
+	return c.req.header("HX-Request") === "true";
+}
+function hxRedirect(c, url) {
+	if (isHxRequest(c)) {
+		c.header("HX-Redirect", url);
+		return c.body(null, 204);
+	}
+	return c.redirect(url, 302);
+}
+//#endregion
+export { hxRedirect, isHxRequest };
+
+//# sourceMappingURL=htmx.mjs.map

package/dist/routers/htmx.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"htmx.mjs","names":[],"sources":["../../src/routers/htmx.ts"],"sourcesContent":["import type { Context } from \"hono\";\n\nexport function isHxRequest(c: Context): boolean {\n  return c.req.header(\"HX-Request\") === \"true\";\n}\n\nexport function hxRedirect(c: Context, url: string): Response {\n  if (isHxRequest(c)) {\n    c.header(\"HX-Redirect\", url);\n    return c.body(null, 204);\n  }\n  return c.redirect(url, 302);\n}"],"mappings":";;;;AAEA,SAAgB,YAAY,GAAqB;CAC/C,OAAO,EAAE,IAAI,OAAO,YAAY,MAAM;AACxC;AAEA,SAAgB,WAAW,GAAY,KAAuB;CAC5D,IAAI,YAAY,CAAC,GAAG;EAClB,EAAE,OAAO,eAAe,GAAG;EAC3B,OAAO,EAAE,KAAK,MAAM,GAAG;CACzB;CACA,OAAO,EAAE,SAAS,KAAK,GAAG;AAC5B"}

package/dist/routers/labels.mjs

@@ -0,0 +1,77 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { LabelModel } from "../models/label.mjs";
+import { getStore } from "../store.mjs";
+import { resolveAuthorizedProject } from "./helpers.mjs";
+import { labelTypeCreateSchema, labelTypeSchema, notFound, unauthorized } from "./schemas.mjs";
+import { createRoute, z } from "@hono/zod-openapi";
+//#region src/routers/labels.ts
+const VIEW_ROLES = [
+	"viewer",
+	"developer",
+	"approver",
+	"admin"
+];
+const ADMIN_ROLES = ["admin"];
+const listLabelsRoute = createRoute({
+	method: "get",
+	path: "/api/v1/projects/{slug}/label-types",
+	request: { params: z.object({ slug: z.string() }) },
+	responses: {
+		200: {
+			content: { "application/json": { schema: labelTypeSchema.array() } },
+			description: "List label types"
+		},
+		...notFound,
+		...unauthorized
+	}
+});
+const createLabelRoute = createRoute({
+	method: "post",
+	path: "/api/v1/projects/{slug}/label-types",
+	request: {
+		params: z.object({ slug: z.string() }),
+		body: { content: { "application/json": { schema: labelTypeCreateSchema } } }
+	},
+	responses: {
+		201: {
+			content: { "application/json": { schema: labelTypeSchema } },
+			description: "Created label type"
+		},
+		...notFound
+	}
+});
+const deleteLabelRoute = createRoute({
+	method: "delete",
+	path: "/api/v1/projects/{slug}/label-types/{key}",
+	request: { params: z.object({
+		slug: z.string(),
+		key: z.string()
+	}) },
+	responses: {
+		204: { description: "Deleted label type" },
+		...notFound
+	}
+});
+function registerLabels(app) {
+	app.openapi(listLabelsRoute, async (c) => {
+		const project = await resolveAuthorizedProject(c, c.req.valid("param").slug, ...VIEW_ROLES);
+		return c.json(await new LabelModel(getStore().db).listTypes(project.id));
+	});
+	app.openapi(createLabelRoute, async (c) => {
+		const project = await resolveAuthorizedProject(c, c.req.valid("param").slug, ...ADMIN_ROLES);
+		const body = c.req.valid("json");
+		return c.json(await new LabelModel(getStore().db).createType(project.id, body), 201);
+	});
+	app.openapi(deleteLabelRoute, async (c) => {
+		const { slug, key } = c.req.valid("param");
+		const project = await resolveAuthorizedProject(c, slug, ...ADMIN_ROLES);
+		await new LabelModel(getStore().db).removeType(project.id, key);
+		return c.body(null, 204);
+	});
+}
+//#endregion
+export { registerLabels };
+
+//# sourceMappingURL=labels.mjs.map

package/dist/routers/labels.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"labels.mjs","names":[],"sources":["../../src/routers/labels.ts"],"sourcesContent":["import { createRoute, z } from \"@hono/zod-openapi\";\nimport type { ShelfApp } from \"../index.tsx\";\n\nimport { LabelModel } from \"../models/label.ts\";\nimport { getStore } from \"../store.ts\";\nimport type { ProjectRole } from \"../types.ts\";\nimport { resolveAuthorizedProject } from \"./helpers.ts\";\nimport { labelTypeCreateSchema, labelTypeSchema, notFound, unauthorized } from \"./schemas.ts\";\n\nconst VIEW_ROLES: readonly ProjectRole[] = [\"viewer\", \"developer\", \"approver\", \"admin\"];\nconst ADMIN_ROLES: readonly ProjectRole[] = [\"admin\"];\n\nconst listLabelsRoute = createRoute({\n  method: \"get\",\n  path: \"/api/v1/projects/{slug}/label-types\",\n  request: { params: z.object({ slug: z.string() }) },\n  responses: {\n    200: { content: { \"application/json\": { schema: labelTypeSchema.array() } }, description: \"List label types\" },\n    ...notFound,\n    ...unauthorized,\n  },\n});\n\nconst createLabelRoute = createRoute({\n  method: \"post\",\n  path: \"/api/v1/projects/{slug}/label-types\",\n  request: {\n    params: z.object({ slug: z.string() }),\n    body: { content: { \"application/json\": { schema: labelTypeCreateSchema } } },\n  },\n  responses: {\n    201: { content: { \"application/json\": { schema: labelTypeSchema } }, description: \"Created label type\" },\n    ...notFound,\n  },\n});\n\nconst deleteLabelRoute = createRoute({\n  method: \"delete\",\n  path: \"/api/v1/projects/{slug}/label-types/{key}\",\n  request: { params: z.object({ slug: z.string(), key: z.string() }) },\n  responses: {\n    204: { description: \"Deleted label type\" },\n    ...notFound,\n  },\n});\n\nexport function registerLabels(app: ShelfApp): void {\n  app.openapi(listLabelsRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...VIEW_ROLES);\n    return c.json(await new LabelModel(getStore().db).listTypes(project.id));\n  });\n\n  app.openapi(createLabelRoute, async (c) => {\n    const project = await resolveAuthorizedProject(c, c.req.valid(\"param\").slug, ...ADMIN_ROLES);\n    const body = c.req.valid(\"json\");\n    return c.json(await new LabelModel(getStore().db).createType(project.id, body), 201);\n  });\n\n  app.openapi(deleteLabelRoute, async (c) => {\n    const { slug, key } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...ADMIN_ROLES);\n    await new LabelModel(getStore().db).removeType(project.id, key);\n    return c.body(null, 204);\n  });\n}"],"mappings":";;;;;;;;;AASA,MAAM,aAAqC;CAAC;CAAU;CAAa;CAAY;AAAO;AACtF,MAAM,cAAsC,CAAC,OAAO;AAEpD,MAAM,kBAAkB,YAAY;CAClC,QAAQ;CACR,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE;CAClD,WAAW;EACT,KAAK;GAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,MAAM,EAAE,EAAE;GAAG,aAAa;EAAmB;EAC7G,GAAG;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,mBAAmB,YAAY;CACnC,QAAQ;CACR,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;EACrC,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,sBAAsB,EAAE,EAAE;CAC7E;CACA,WAAW;EACT,KAAK;GAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,EAAE;GAAG,aAAa;EAAqB;EACvG,GAAG;CACL;AACF,CAAC;AAED,MAAM,mBAAmB,YAAY;CACnC,QAAQ;CACR,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,KAAK,EAAE,OAAO;CAAE,CAAC,EAAE;CACnE,WAAW;EACT,KAAK,EAAE,aAAa,qBAAqB;EACzC,GAAG;CACL;AACF,CAAC;AAED,SAAgB,eAAe,KAAqB;CAClD,IAAI,QAAQ,iBAAiB,OAAO,MAAM;EACxC,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,UAAU;EAC1F,OAAO,EAAE,KAAK,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAC;CACzE,CAAC;CAED,IAAI,QAAQ,kBAAkB,OAAO,MAAM;EACzC,MAAM,UAAU,MAAM,yBAAyB,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,WAAW;EAC3F,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,OAAO,EAAE,KAAK,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,QAAQ,IAAI,IAAI,GAAG,GAAG;CACrF,CAAC;CAED,IAAI,QAAQ,kBAAkB,OAAO,MAAM;EACzC,MAAM,EAAE,MAAM,QAAQ,EAAE,IAAI,MAAM,OAAO;EACzC,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,WAAW;EACtE,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,QAAQ,IAAI,GAAG;EAC9D,OAAO,EAAE,KAAK,MAAM,GAAG;CACzB,CAAC;AACH"}

package/dist/routers/media.mjs

@@ -0,0 +1,54 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { BuildModel } from "../models/build.mjs";
+import { getStore } from "../store.mjs";
+import { notFound, resolveAuthorizedProject } from "./helpers.mjs";
+import { BaselineModel } from "../models/baseline.mjs";
+import { SnapshotModel } from "../models/snapshot.mjs";
+//#region src/routers/media.ts
+const VIEW_ROLES = [
+	"viewer",
+	"developer",
+	"approver",
+	"admin"
+];
+const PNG = "image/png";
+function imageResponse(buffer) {
+	return new Response(new Uint8Array(buffer), { headers: {
+		"content-type": PNG,
+		"cache-control": "private, max-age=3600"
+	} });
+}
+function registerMedia(app) {
+	app.get("/api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/image", async (c) => {
+		const project = await resolveAuthorizedProject(c, c.req.param("slug"), ...VIEW_ROLES);
+		const snapshot = await findSnapshot(c.req.param("buildId"), c.req.param("snapshotId"), project.id);
+		return imageResponse(await getStore().storage.read(snapshot.screenshotPath));
+	});
+	app.get("/api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/diff", async (c) => {
+		const project = await resolveAuthorizedProject(c, c.req.param("slug"), ...VIEW_ROLES);
+		const snapshot = await findSnapshot(c.req.param("buildId"), c.req.param("snapshotId"), project.id);
+		if (!snapshot.diffPath) notFound("No diff for this snapshot");
+		return imageResponse(await getStore().storage.read(snapshot.diffPath));
+	});
+	app.get("/api/v1/projects/:slug/builds/:buildId/snapshots/:snapshotId/baseline", async (c) => {
+		const project = await resolveAuthorizedProject(c, c.req.param("slug"), ...VIEW_ROLES);
+		const snapshot = await findSnapshot(c.req.param("buildId"), c.req.param("snapshotId"), project.id);
+		const build = await new BuildModel(getStore().db).get(snapshot.buildId);
+		if (!build) notFound("Build not found");
+		const baselines = new BaselineModel(getStore().db, getStore().storage);
+		const baseline = await baselines.resolve(project.id, snapshot.storyId, snapshot.viewportName, build.gitBranch, project.gitDefaultBranch);
+		if (!baseline) notFound("No baseline for this snapshot");
+		return imageResponse(await baselines.read(baseline));
+	});
+}
+async function findSnapshot(buildId, snapshotId, projectId) {
+	const snapshot = await new SnapshotModel(getStore().db).get(snapshotId);
+	if (!snapshot || snapshot.buildId !== buildId || snapshot.projectId !== projectId) notFound("Snapshot not found");
+	return snapshot;
+}
+//#endregion
+export { registerMedia };
+
+//# sourceMappingURL=media.mjs.map