@storyshelf/core 0.1.0

package/dist/index.mjs

@@ -0,0 +1,327 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { validateConfig, validateUiConfig } from "./config.mjs";
+import { createShelfLogger } from "./logger.mjs";
+import { rateLimit } from "./middleware/rate-limit.mjs";
+import { csrf } from "./middleware/csrf.mjs";
+import { baselines, buildLabels, builds, comments, labelTypes, projectMembers, projectStatusConfigs, projects, schema, snapshots, tokens, users, webhooks } from "./schema.mjs";
+import { slugify, ulid } from "./utils/ulid.mjs";
+import { BuildModel } from "./models/build.mjs";
+import { ProjectModel } from "./models/project.mjs";
+import { BUILD_STATUSES, PERSISTENT_LABEL_KEY, PROJECT_ROLES, RESERVED_LABEL_KEYS, SEEDED_LABEL_KEYS, SITE_ROLES, SNAPSHOT_STATUSES, TERMINAL_BUILD_STATUSES } from "./types.mjs";
+import { Retention } from "./retention/purge.mjs";
+import { getStore, runWithStore } from "./store.mjs";
+import { registerAdmin } from "./routers/admin.mjs";
+import { registerAssets } from "./routers/assets.mjs";
+import { registerAuth } from "./routers/auth.mjs";
+import { baselinePath, diffPath, screenshotPath, storybookDir, storybookZipPath } from "./utils/paths.mjs";
+import { registerBuilds } from "./routers/builds.mjs";
+import { registerLabels } from "./routers/labels.mjs";
+import { registerMedia } from "./routers/media.mjs";
+import { registerMembers } from "./routers/members.mjs";
+import { registerProjects } from "./routers/projects.mjs";
+import { registerStatusConfigs } from "./routers/status-configs.mjs";
+import { registerTokens } from "./routers/tokens.mjs";
+import { registerUiPages } from "./routers/ui.mjs";
+import { registerWebhooks } from "./routers/webhooks.mjs";
+import { diffImages } from "./diff/engine.mjs";
+import { persistCapture } from "./capture/pipeline.mjs";
+import { StorybookAdapter } from "./capture/storybook.mjs";
+import { DEFAULT_VIEWPORTS } from "./capture/adapter.mjs";
+import { executeCaptureJob } from "./capture/orchestrator.mjs";
+import { InMemoryCaptureQueue } from "./capture/queue.mjs";
+import { buildCommentMarkdown, commentMarker, describeStatus } from "./adapter/git-host/helpers.mjs";
+import { postStatusesForBuild } from "./capture/status-fanout.mjs";
+import { createUrlBuilder } from "./urls.mjs";
+import { swaggerUI } from "@hono/swagger-ui";
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { requestId } from "hono/request-id";
+//#region src/index.tsx
+function buildAdapterSnapshot(options) {
+	const snap = {};
+	if (options.database.metadata) snap["database"] = options.database.metadata;
+	if (options.storage.metadata) snap["storage"] = options.storage.metadata;
+	if (options.captureRunner?.metadata) snap["captureRunner"] = options.captureRunner.metadata;
+	if (options.captureQueue?.metadata) snap["captureQueue"] = options.captureQueue.metadata;
+	if (options.auth?.metadata) snap["auth"] = options.auth.metadata;
+	for (const p of options.gitHosts ?? []) snap[`git:${p.metadata.kind}`] = p.metadata;
+	return snap;
+}
+async function hasApprovedBuildForSha(db, projectId, sha, excludeBuildId) {
+	return (await new BuildModel(db).list(projectId)).some((b) => b.gitSha === sha && b.id !== excludeBuildId && b.status === "approved");
+}
+async function isAlreadyMerged(opts) {
+	if (opts.providers.length === 0) return false;
+	const { StatusConfigModel } = await import("./models/status-config.mjs");
+	const model = new StatusConfigModel(opts.db, opts.secret);
+	const rows = await model.list(opts.projectId);
+	for (const row of rows) {
+		const provider = opts.providers.find((p) => p.metadata.kind === row.provider);
+		if (!provider) continue;
+		let parsed;
+		try {
+			parsed = JSON.parse(row.config);
+			provider.metadata.schema.parse(parsed);
+		} catch {
+			continue;
+		}
+		let token;
+		try {
+			token = model.decryptToken(row);
+		} catch {
+			continue;
+		}
+		const adapter = provider.create({
+			config: parsed,
+			token,
+			logger: opts.logger
+		});
+		if (!adapter.isMerged) continue;
+		try {
+			if (await adapter.isMerged({
+				sha: opts.sha,
+				branch: opts.branch
+			})) return true;
+		} catch {}
+	}
+	return false;
+}
+async function resolveUser(c, options) {
+	if (!options.auth) return null;
+	if (c.req.header("authorization")) return null;
+	return await options.auth.check(c.req.raw);
+}
+function createShelfRouter(options) {
+	const app = new OpenAPIHono();
+	const rawConfig = options.config ? validateConfig(options.config) : {};
+	const ui = options.ui ? validateUiConfig(options.ui) : {};
+	const logger = options.logger ?? createShelfLogger();
+	const authEnabled = options.auth !== void 0;
+	const gitHosts = options.gitHosts ?? [];
+	const config = rawConfig.adapters ? rawConfig : {
+		...rawConfig,
+		adapters: buildAdapterSnapshot(options)
+	};
+	let queue = null;
+	let enqueueCapture;
+	if (options.captureRunner) {
+		if (!config.scratchDir) throw new Error("captureRunner is enabled but ShelfConfig.scratchDir is not set");
+		const jobOptions = {
+			db: options.database,
+			storage: options.storage,
+			runner: options.captureRunner,
+			scratchDir: config.scratchDir,
+			viewports: config.viewports,
+			logger
+		};
+		const captureQueue = options.captureQueue ?? new InMemoryCaptureQueue({
+			concurrency: config.captureConcurrency ?? 2,
+			logger,
+			runJob: async (job) => {
+				const builds = new BuildModel(options.database);
+				const build = await builds.get(job.buildId);
+				if (!build) {
+					await executeCaptureJob({
+						buildId: job.buildId,
+						reqId: job.reqId
+					}, jobOptions);
+					return;
+				}
+				const project = await new ProjectModel(options.database).get(build.projectId);
+				if (!project) {
+					await executeCaptureJob({
+						buildId: job.buildId,
+						reqId: job.reqId
+					}, jobOptions);
+					return;
+				}
+				const pendingUrl = `/projects/${project.slug}/builds/${job.buildId}`;
+				await postStatusesForBuild({
+					db: options.database,
+					project,
+					sha: build.gitSha,
+					status: "pending",
+					url: pendingUrl,
+					providers: gitHosts,
+					secret: config.secret,
+					logger
+				}).catch((error) => {
+					logger.error({ err: error }, "failed to post pending status");
+				});
+				if (!build.isDefault) {
+					if (await isAlreadyMerged({
+						providers: gitHosts,
+						sha: build.gitSha,
+						branch: build.gitBranch,
+						secret: config.secret,
+						db: options.database,
+						projectId: project.id,
+						logger
+					}).catch(() => false)) {
+						logger.info({
+							buildId: build.id,
+							sha: build.gitSha,
+							branch: build.gitBranch
+						}, "skipping capture — already merged");
+						await builds.setStatus(build.id, "approved").catch(() => {});
+						await postStatusesForBuild({
+							db: options.database,
+							project,
+							sha: build.gitSha,
+							status: "success",
+							url: pendingUrl,
+							providers: gitHosts,
+							secret: config.secret,
+							logger
+						}).catch(() => {});
+						return;
+					}
+				}
+				if (await hasApprovedBuildForSha(options.database, project.id, build.gitSha, build.id)) {
+					logger.info({
+						buildId: build.id,
+						sha: build.gitSha
+					}, "skipping capture — duplicate sha already approved");
+					await builds.setStatus(build.id, "approved").catch(() => {});
+					await postStatusesForBuild({
+						db: options.database,
+						project,
+						sha: build.gitSha,
+						status: "success",
+						url: pendingUrl,
+						providers: gitHosts,
+						secret: config.secret,
+						logger
+					}).catch(() => {});
+					return;
+				}
+				try {
+					await executeCaptureJob({
+						buildId: job.buildId,
+						reqId: job.reqId
+					}, jobOptions);
+					const updated = await builds.get(job.buildId);
+					if (updated) {
+						const terminal = updated.status === "approved" ? "success" : updated.status === "rejected" || updated.status === "failed" ? "failure" : null;
+						if (terminal) await postStatusesForBuild({
+							db: options.database,
+							project,
+							sha: updated.gitSha,
+							status: terminal,
+							url: pendingUrl,
+							providers: gitHosts,
+							secret: config.secret,
+							logger
+						}).catch((error) => {
+							logger.error({ err: error }, "failed to post terminal status");
+						});
+					}
+				} catch (error) {
+					await postStatusesForBuild({
+						db: options.database,
+						project,
+						sha: build.gitSha,
+						status: "failure",
+						url: pendingUrl,
+						providers: gitHosts,
+						secret: config.secret,
+						logger
+					}).catch(() => {});
+					throw error;
+				}
+			}
+		});
+		queue = captureQueue;
+		enqueueCapture = async (buildId, reqId) => {
+			await captureQueue.enqueue({
+				buildId,
+				reqId
+			});
+		};
+	}
+	app.use("*", requestId());
+	app.use("*", async (c, next) => {
+		const started = performance.now();
+		const id = c.get("requestId");
+		logger.info({
+			reqId: id,
+			method: c.req.method,
+			url: c.req.path
+		}, "request start");
+		await next();
+		logger.info({
+			reqId: id,
+			method: c.req.method,
+			url: c.req.path,
+			status: c.res.status,
+			durationMs: Math.round(performance.now() - started)
+		}, "request end");
+	});
+	app.use("/api/v1/*", rateLimit({
+		windowMs: 6e4,
+		max: 100
+	}));
+	app.use("/api/v1/tokens/*", rateLimit({
+		windowMs: 6e4,
+		max: 10
+	}));
+	app.use("/api/v1/webhooks/*", rateLimit({
+		windowMs: 6e4,
+		max: 20
+	}));
+	app.use("/projects/:slug/settings/*", csrf());
+	app.use("*", async (c, next) => {
+		const user = await resolveUser(c, options);
+		return runWithStore({
+			db: options.database,
+			storage: options.storage,
+			config,
+			ui,
+			logger,
+			user,
+			authEnabled,
+			enqueueCapture,
+			captureQueue: queue,
+			gitHosts
+		}, async () => {
+			await next();
+		});
+	});
+	app.use("*", async (c, next) => {
+		const { user, authEnabled: isAuthEnabled } = getStore();
+		const path = c.req.path;
+		if (!isAuthEnabled || user || path.startsWith("/api/") || path.startsWith("/auth/") || path.startsWith("/assets/")) return next();
+		if (c.req.header("HX-Request") === "true") {
+			c.header("HX-Redirect", "/auth/login");
+			return c.body(null, 204);
+		}
+		return c.redirect("/auth/login", 302);
+	});
+	registerProjects(app);
+	registerBuilds(app);
+	registerLabels(app);
+	registerMedia(app);
+	registerMembers(app);
+	registerTokens(app);
+	registerWebhooks(app);
+	registerStatusConfigs(app);
+	registerAdmin(app);
+	if (options.auth) registerAuth(app, options.auth);
+	registerAssets(app);
+	registerUiPages(app);
+	app.doc("/api/v1/openapi.json", {
+		openapi: "3.0.0",
+		info: {
+			title: "StoryShelf API",
+			description: "REST API for the StoryShelf visual testing platform. JSON endpoints live under /api/v1; HTML pages are served at /.",
+			version: "1.0.0"
+		}
+	});
+	app.get("/api/v1/docs", swaggerUI({ url: "/api/v1/openapi.json" }));
+	return app;
+}
+//#endregion
+export { BUILD_STATUSES, DEFAULT_VIEWPORTS, InMemoryCaptureQueue, PERSISTENT_LABEL_KEY, PROJECT_ROLES, RESERVED_LABEL_KEYS, Retention, SEEDED_LABEL_KEYS, SITE_ROLES, SNAPSHOT_STATUSES, StorybookAdapter, TERMINAL_BUILD_STATUSES, baselinePath, baselines, buildCommentMarkdown, buildLabels, builds, commentMarker, comments, createShelfLogger, createShelfRouter, createUrlBuilder, describeStatus, diffImages, diffPath, executeCaptureJob, labelTypes, persistCapture, projectMembers, projectStatusConfigs, projects, schema, screenshotPath, slugify, snapshots, storybookDir, storybookZipPath, tokens, ulid, users, webhooks };
+
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.tsx"],"sourcesContent":["import { swaggerUI } from \"@hono/swagger-ui\";\nimport { OpenAPIHono } from \"@hono/zod-openapi\";\nimport { requestId } from \"hono/request-id\";\nimport type { AuthUser } from \"./adapters/auth.ts\";\nimport type { CaptureQueue } from \"./adapters/capture-queue.ts\";\nimport type { ShelfOptions } from \"./config.ts\";\nimport type { AdapterMetadata, GitAdapterMetadata } from \"./adapters/metadata.ts\";\nimport { validateConfig, validateUiConfig } from \"./config.ts\";\nimport { createShelfLogger } from \"./logger.ts\";\nimport { csrf, rateLimit } from \"./middleware/index.ts\";\nimport { BuildModel } from \"./models/build.ts\";\nimport { ProjectModel } from \"./models/project.ts\";\nimport { registerAdmin } from \"./routers/admin.ts\";\nimport { registerAssets } from \"./routers/assets.ts\";\nimport { registerAuth } from \"./routers/auth.ts\";\nimport { registerBuilds } from \"./routers/builds.ts\";\nimport { registerLabels } from \"./routers/labels.ts\";\nimport { registerMedia } from \"./routers/media.ts\";\nimport { registerMembers } from \"./routers/members.ts\";\nimport { registerProjects } from \"./routers/projects.ts\";\nimport { registerStatusConfigs } from \"./routers/status-configs.ts\";\nimport { registerTokens } from \"./routers/tokens.ts\";\nimport { registerUiPages } from \"./routers/ui.ts\";\nimport { registerWebhooks } from \"./routers/webhooks.ts\";\nimport { getStore, runWithStore } from \"./store.ts\";\nimport { executeCaptureJob, type CaptureJobOptions } from \"./capture/orchestrator.ts\";\nimport { InMemoryCaptureQueue } from \"./capture/queue.ts\";\nimport { postStatusesForBuild } from \"./capture/status-fanout.ts\";\n\nexport type ShelfContext = {\n  requestId?: string;\n  db: import(\"./adapters/database.ts\").DatabaseAdapter;\n  storage: import(\"./adapters/storage.ts\").StorageAdapter;\n  config: import(\"./config.ts\").ShelfConfig;\n  ui: import(\"./config.ts\").UIConfig;\n  logger: ReturnType<typeof createShelfLogger>;\n  user: import(\"./adapters/auth.ts\").AuthUser | null;\n  authEnabled: boolean;\n  enqueueCapture?: (buildId: string, reqId?: string) => Promise<void>;\n  captureQueue: import(\"./adapters/capture-queue.ts\").CaptureQueue | null;\n  gitHosts: import(\"./adapters/git-host/index.ts\").GitHostProvider[];\n};\n\nexport type ShelfApp = OpenAPIHono<{ Variables: ShelfContext }>;\n\nfunction buildAdapterSnapshot(options: ShelfOptions): Record<string, AdapterMetadata | GitAdapterMetadata> {\n  const snap: Record<string, AdapterMetadata | GitAdapterMetadata> = {};\n  if (options.database.metadata) snap[\"database\"] = options.database.metadata;\n  if (options.storage.metadata) snap[\"storage\"] = options.storage.metadata;\n  if (options.captureRunner?.metadata) snap[\"captureRunner\"] = options.captureRunner.metadata;\n  if (options.captureQueue?.metadata) snap[\"captureQueue\"] = options.captureQueue.metadata;\n  if (options.auth?.metadata) snap[\"auth\"] = options.auth.metadata;\n  for (const p of options.gitHosts ?? []) {\n    snap[`git:${p.metadata.kind}`] = p.metadata;\n  }\n  return snap;\n}\n\nasync function hasApprovedBuildForSha(\n  db: import(\"./adapters/database.ts\").DatabaseAdapter,\n  projectId: string,\n  sha: string,\n  excludeBuildId: string,\n): Promise<boolean> {\n  const builds = await new BuildModel(db).list(projectId);\n  return builds.some((b) => b.gitSha === sha && b.id !== excludeBuildId && b.status === \"approved\");\n}\n\n// eslint-disable-next-line max-statements, complexity\nasync function isAlreadyMerged(opts: {\n  providers: import(\"./adapters/git-host/index.ts\").GitHostProvider[];\n  sha: string;\n  branch: string;\n  secret: string | undefined;\n  db: import(\"./adapters/database.ts\").DatabaseAdapter;\n  projectId: string;\n  logger?: import(\"pino\").Logger;\n}): Promise<boolean> {\n  if (opts.providers.length === 0) return false;\n  const { StatusConfigModel } = await import(\"./models/status-config.ts\");\n  const model = new StatusConfigModel(opts.db, opts.secret);\n  const rows = await model.list(opts.projectId);\n  for (const row of rows) {\n    const provider = opts.providers.find((p) => p.metadata.kind === row.provider);\n    if (!provider) continue;\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(row.config);\n      provider.metadata.schema.parse(parsed);\n    } catch {\n      continue;\n    }\n    let token: string;\n    try {\n      token = model.decryptToken(row);\n    } catch {\n      continue;\n    }\n    const adapter = provider.create({ config: parsed, token, logger: opts.logger });\n    if (!adapter.isMerged) continue;\n    try {\n      // eslint-disable-next-line no-await-in-loop -- short-circuit on first merged status\n      const merged = await adapter.isMerged({ sha: opts.sha, branch: opts.branch });\n      if (merged) return true;\n    } catch {\n      // ignore provider errors — do not skip on failure\n    }\n  }\n  return false;\n}\n\nasync function resolveUser(\n  c: { req: { raw: Request; header: (name: string) => string | undefined } },\n  options: ShelfOptions,\n): Promise<AuthUser | null> {\n  if (!options.auth) {\n    return null;\n  }\n  if (c.req.header(\"authorization\")) {\n    return null;\n  }\n  return await options.auth.check(c.req.raw);\n}\n\n\nexport function createShelfRouter(options: ShelfOptions): ShelfApp {\n  const app = new OpenAPIHono<{ Variables: ShelfContext }>();\n  // eslint-disable-next-line typescript/no-unnecessary-type-assertion -- ShelfConfig lacks index signature\n  const rawConfig = options.config ? validateConfig(options.config as unknown as Record<string, unknown>) : {};\n  // eslint-disable-next-line typescript/no-unnecessary-type-assertion -- UIConfig lacks index signature\n  const ui = options.ui ? validateUiConfig(options.ui as unknown as Record<string, unknown>) : {};\n  const logger = options.logger ?? createShelfLogger();\n  const authEnabled = options.auth !== undefined;\n\n  const gitHosts = options.gitHosts ?? [];\n\n  // Adapter introspection — auto-populate config.adapters if not supplied\n  const config: import(\"./config.ts\").ShelfConfig = rawConfig.adapters\n    ? rawConfig\n    : {\n        ...rawConfig,\n        adapters: buildAdapterSnapshot(options),\n      };\n\n  let queue: CaptureQueue | null = null;\n  let enqueueCapture: ((buildId: string, reqId?: string) => Promise<void>) | undefined;\n  if (options.captureRunner) {\n    if (!config.scratchDir) {\n      throw new Error(\"captureRunner is enabled but ShelfConfig.scratchDir is not set\");\n    }\n    const jobOptions: CaptureJobOptions = {\n      db: options.database,\n      storage: options.storage,\n      runner: options.captureRunner,\n      scratchDir: config.scratchDir,\n      viewports: config.viewports,\n      logger,\n    };\n    const captureQueue =\n      options.captureQueue ??\n      new InMemoryCaptureQueue({\n        concurrency: config.captureConcurrency ?? 2,\n        logger,\n        runJob: async (job): Promise<void> => {\n          const builds = new BuildModel(options.database);\n          const build = await builds.get(job.buildId);\n          if (!build) {\n            await executeCaptureJob({ buildId: job.buildId, reqId: job.reqId }, jobOptions);\n            return;\n          }\n          const project = await new ProjectModel(options.database).get(build.projectId);\n          if (!project) {\n            await executeCaptureJob({ buildId: job.buildId, reqId: job.reqId }, jobOptions);\n            return;\n          }\n          const pendingUrl = `/projects/${project.slug}/builds/${job.buildId}`;\n          await postStatusesForBuild({\n            db: options.database,\n            project,\n            sha: build.gitSha,\n            status: \"pending\",\n            url: pendingUrl,\n            providers: gitHosts,\n            secret: config.secret,\n            logger,\n          }).catch((error: unknown) => {\n            logger.error({ err: error }, \"failed to post pending status\");\n          });\n          // Skip capture if already merged (PR closed) or locally deduped\n          if (!build.isDefault) {\n            const merged = await isAlreadyMerged({\n              providers: gitHosts,\n              sha: build.gitSha,\n              branch: build.gitBranch,\n              secret: config.secret,\n              db: options.database,\n              projectId: project.id,\n              logger,\n            }).catch(() => false);\n            if (merged) {\n              logger.info({ buildId: build.id, sha: build.gitSha, branch: build.gitBranch }, \"skipping capture — already merged\");\n              await builds.setStatus(build.id, \"approved\").catch(() => {}); // intentionally empty — fire-and-forget\n              await postStatusesForBuild({\n                db: options.database,\n                project,\n                sha: build.gitSha,\n                status: \"success\",\n                url: pendingUrl,\n                providers: gitHosts,\n                secret: config.secret,\n                logger,\n              }).catch(() => {}); // intentionally empty — fire-and-forget\n              return;\n            }\n          }\n          // Local dedupe: if another approved build for same sha exists, skip render\n          const dup = await hasApprovedBuildForSha(options.database, project.id, build.gitSha, build.id);\n          if (dup) {\n            logger.info({ buildId: build.id, sha: build.gitSha }, \"skipping capture — duplicate sha already approved\");\n            await builds.setStatus(build.id, \"approved\").catch(() => {}); // intentionally empty — fire-and-forget\n            await postStatusesForBuild({\n              db: options.database,\n              project,\n              sha: build.gitSha,\n              status: \"success\",\n              url: pendingUrl,\n              providers: gitHosts,\n              secret: config.secret,\n              logger,\n            }).catch(() => {}); // intentionally empty — fire-and-forget\n            return;\n          }\n          try {\n            await executeCaptureJob({ buildId: job.buildId, reqId: job.reqId }, jobOptions);\n            const updated = await builds.get(job.buildId);\n            if (updated) {\n              const terminal =\n                updated.status === \"approved\"\n                  ? \"success\"\n                  : updated.status === \"rejected\" || updated.status === \"failed\"\n                    ? \"failure\"\n                    : null;\n              if (terminal) {\n                await postStatusesForBuild({\n                  db: options.database,\n                  project,\n                  sha: updated.gitSha,\n                  status: terminal,\n                  url: pendingUrl,\n                  providers: gitHosts,\n                  secret: config.secret,\n                  logger,\n                }).catch((error: unknown) => {\n                  logger.error({ err: error }, \"failed to post terminal status\");\n                });\n              }\n            }\n          } catch (error: unknown) {\n            await postStatusesForBuild({\n              db: options.database,\n              project,\n              sha: build.gitSha,\n              status: \"failure\",\n              url: pendingUrl,\n              providers: gitHosts,\n              secret: config.secret,\n              logger,\n            }).catch(() => {\n              // ignore: status post failure already logged\n            });\n            throw error;\n          }\n        },\n      });\n    queue = captureQueue;\n    enqueueCapture = async (buildId: string, reqId?: string): Promise<void> => {\n      await captureQueue.enqueue({ buildId, reqId });\n    };\n  }\n\n  app.use(\"*\", requestId());\n\n  // Structured request logging. Uses a Hono-native middleware rather than\n  // pino-http, which expects a Node server response (`res.on`) incompatible\n  // with Hono's Web `Request`/`Response` model.\n  app.use(\"*\", async (c, next) => {\n    const started = performance.now();\n    const id = c.get(\"requestId\");\n    logger.info({ reqId: id, method: c.req.method, url: c.req.path }, \"request start\");\n    await next();\n    logger.info(\n      {\n        reqId: id,\n        method: c.req.method,\n        url: c.req.path,\n        status: c.res.status,\n        durationMs: Math.round(performance.now() - started),\n      },\n      \"request end\",\n    );\n  });\n\n  app.use(\"/api/v1/*\", rateLimit({ windowMs: 60_000, max: 100 }));\n  app.use(\"/api/v1/tokens/*\", rateLimit({ windowMs: 60_000, max: 10 }));\n  app.use(\"/api/v1/webhooks/*\", rateLimit({ windowMs: 60_000, max: 20 }));\n  app.use(\"/projects/:slug/settings/*\", csrf());\n\n  app.use(\"*\", async (c, next) => {\n    const user = await resolveUser(c, options);\n    return runWithStore(\n      {\n        db: options.database,\n        storage: options.storage,\n        config,\n        ui,\n        logger,\n        user,\n        authEnabled,\n        enqueueCapture,\n        captureQueue: queue,\n        gitHosts,\n      },\n      async () => {\n        await next();\n      },\n    );\n  });\n\n  // Gate the server-rendered UI behind auth (ADR 0008): unauthenticated HTML\n  // requests are redirected to the login page. API and auth routes are handled\n  // by their own routers (401/403 vs the login flow).\n  // eslint-disable-next-line require-await -- async is required to match Hono's middleware signature\n  app.use(\"*\", async (c, next) => {\n    const { user, authEnabled: isAuthEnabled } = getStore();\n    const path = c.req.path;\n    if (\n      !isAuthEnabled ||\n      user ||\n      path.startsWith(\"/api/\") ||\n      path.startsWith(\"/auth/\") ||\n      path.startsWith(\"/assets/\")\n    ) {\n      return next();\n    }\n    if (c.req.header(\"HX-Request\") === \"true\") {\n      c.header(\"HX-Redirect\", \"/auth/login\");\n      return c.body(null, 204);\n    }\n    return c.redirect(\"/auth/login\", 302);\n  });\n\n  registerProjects(app);\n  registerBuilds(app);\n  registerLabels(app);\n  registerMedia(app);\n  registerMembers(app);\n  registerTokens(app);\n  registerWebhooks(app);\n  registerStatusConfigs(app);\n  registerAdmin(app);\n  if (options.auth) {\n    registerAuth(app, options.auth);\n  }\n  registerAssets(app);\n  registerUiPages(app);\n\n  app.doc(\"/api/v1/openapi.json\", {\n    openapi: \"3.0.0\",\n    info: {\n      title: \"StoryShelf API\",\n      description:\n        \"REST API for the StoryShelf visual testing platform. JSON endpoints live under /api/v1; HTML pages are served at /.\",\n      version: \"1.0.0\",\n    },\n  });\n  app.get(\"/api/v1/docs\", swaggerUI({ url: \"/api/v1/openapi.json\" }));\n\n  return app;\n}\n\nexport type { ShelfOptions, ShelfConfig, UIConfig, BrandTheme } from \"./config.ts\";\nexport type { DatabaseAdapter, ListOptions } from \"./adapters/database.ts\";\nexport type { StorageAdapter } from \"./adapters/storage.ts\";\nexport type {\n  CaptureRunner,\n  JobStatus,\n  RenderedSnapshot,\n  RenderResult,\n  RenderFailure,\n} from \"./adapters/capture-runner.ts\";\nexport type { CaptureQueue, CaptureJob, QueueEntry } from \"./adapters/capture-queue.ts\";\nexport type { AuthAdapter, AuthUser, AuthCallback } from \"./adapters/auth.ts\";\nexport type { GitHostProvider, GitHostAdapter, CheckStatus } from \"./adapters/git-host/index.ts\";\nexport type { AdapterMetadata, GitAdapterMetadata } from \"./adapters/metadata.ts\";\nexport { describeStatus, buildCommentMarkdown, commentMarker } from \"./adapters/git-host/helpers.ts\";\nexport type { DiffOptions, DiffResult } from \"./diff/options.ts\";\nexport type { Viewport, StoryEntry, StorySourceAdapter } from \"./capture/adapter.ts\";\nexport { createShelfLogger, type LoggerOptions, type PinoTransport } from \"./logger.ts\";\nexport { diffImages } from \"./diff/engine.ts\";\nexport type { RenderedContent } from \"./ui/document.tsx\";\nexport { StorybookAdapter } from \"./capture/storybook.ts\";\nexport { persistCapture, type CaptureContext } from \"./capture/pipeline.ts\";\nexport { executeCaptureJob, type CaptureJobOptions } from \"./capture/orchestrator.ts\";\nexport { DEFAULT_VIEWPORTS } from \"./capture/adapter.ts\";\nexport { InMemoryCaptureQueue, type InMemoryCaptureQueueOptions } from \"./capture/queue.ts\";\nexport { Retention } from \"./retention/purge.ts\";\nexport { createUrlBuilder, type UrlBuilder } from \"./urls.ts\";\nexport { ulid, slugify } from \"./utils/ulid.ts\";\nexport {\n  baselinePath,\n  diffPath,\n  screenshotPath,\n  storybookDir,\n  storybookZipPath,\n} from \"./utils/paths.ts\";\nexport * from \"./schema.ts\";\nexport * from \"./types.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,SAAS,qBAAqB,SAA6E;CACzG,MAAM,OAA6D,CAAC;CACpE,IAAI,QAAQ,SAAS,UAAU,KAAK,cAAc,QAAQ,SAAS;CACnE,IAAI,QAAQ,QAAQ,UAAU,KAAK,aAAa,QAAQ,QAAQ;CAChE,IAAI,QAAQ,eAAe,UAAU,KAAK,mBAAmB,QAAQ,cAAc;CACnF,IAAI,QAAQ,cAAc,UAAU,KAAK,kBAAkB,QAAQ,aAAa;CAChF,IAAI,QAAQ,MAAM,UAAU,KAAK,UAAU,QAAQ,KAAK;CACxD,KAAK,MAAM,KAAK,QAAQ,YAAY,CAAC,GACnC,KAAK,OAAO,EAAE,SAAS,UAAU,EAAE;CAErC,OAAO;AACT;AAEA,eAAe,uBACb,IACA,WACA,KACA,gBACkB;CAElB,QAAO,MADc,IAAI,WAAW,EAAE,CAAC,CAAC,KAAK,SAAS,EAAA,CACxC,MAAM,MAAM,EAAE,WAAW,OAAO,EAAE,OAAO,kBAAkB,EAAE,WAAW,UAAU;AAClG;AAGA,eAAe,gBAAgB,MAQV;CACnB,IAAI,KAAK,UAAU,WAAW,GAAG,OAAO;CACxC,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAC3C,MAAM,QAAQ,IAAI,kBAAkB,KAAK,IAAI,KAAK,MAAM;CACxD,MAAM,OAAO,MAAM,MAAM,KAAK,KAAK,SAAS;CAC5C,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,WAAW,KAAK,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,IAAI,QAAQ;EAC5E,IAAI,CAAC,UAAU;EACf,IAAI;EACJ,IAAI;GACF,SAAS,KAAK,MAAM,IAAI,MAAM;GAC9B,SAAS,SAAS,OAAO,MAAM,MAAM;EACvC,QAAQ;GACN;EACF;EACA,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,aAAa,GAAG;EAChC,QAAQ;GACN;EACF;EACA,MAAM,UAAU,SAAS,OAAO;GAAE,QAAQ;GAAQ;GAAO,QAAQ,KAAK;EAAO,CAAC;EAC9E,IAAI,CAAC,QAAQ,UAAU;EACvB,IAAI;GAGF,IAAI,MADiB,QAAQ,SAAS;IAAE,KAAK,KAAK;IAAK,QAAQ,KAAK;GAAO,CAAC,GAChE,OAAO;EACrB,QAAQ,CAER;CACF;CACA,OAAO;AACT;AAEA,eAAe,YACb,GACA,SAC0B;CAC1B,IAAI,CAAC,QAAQ,MACX,OAAO;CAET,IAAI,EAAE,IAAI,OAAO,eAAe,GAC9B,OAAO;CAET,OAAO,MAAM,QAAQ,KAAK,MAAM,EAAE,IAAI,GAAG;AAC3C;AAGA,SAAgB,kBAAkB,SAAiC;CACjE,MAAM,MAAM,IAAI,YAAyC;CAEzD,MAAM,YAAY,QAAQ,SAAS,eAAe,QAAQ,MAA4C,IAAI,CAAC;CAE3G,MAAM,KAAK,QAAQ,KAAK,iBAAiB,QAAQ,EAAwC,IAAI,CAAC;CAC9F,MAAM,SAAS,QAAQ,UAAU,kBAAkB;CACnD,MAAM,cAAc,QAAQ,SAAS,KAAA;CAErC,MAAM,WAAW,QAAQ,YAAY,CAAC;CAGtC,MAAM,SAA4C,UAAU,WACxD,YACA;EACE,GAAG;EACH,UAAU,qBAAqB,OAAO;CACxC;CAEJ,IAAI,QAA6B;CACjC,IAAI;CACJ,IAAI,QAAQ,eAAe;EACzB,IAAI,CAAC,OAAO,YACV,MAAM,IAAI,MAAM,gEAAgE;EAElF,MAAM,aAAgC;GACpC,IAAI,QAAQ;GACZ,SAAS,QAAQ;GACjB,QAAQ,QAAQ;GAChB,YAAY,OAAO;GACnB,WAAW,OAAO;GAClB;EACF;EACA,MAAM,eACJ,QAAQ,gBACR,IAAI,qBAAqB;GACvB,aAAa,OAAO,sBAAsB;GAC1C;GACA,QAAQ,OAAO,QAAuB;IACpC,MAAM,SAAS,IAAI,WAAW,QAAQ,QAAQ;IAC9C,MAAM,QAAQ,MAAM,OAAO,IAAI,IAAI,OAAO;IAC1C,IAAI,CAAC,OAAO;KACV,MAAM,kBAAkB;MAAE,SAAS,IAAI;MAAS,OAAO,IAAI;KAAM,GAAG,UAAU;KAC9E;IACF;IACA,MAAM,UAAU,MAAM,IAAI,aAAa,QAAQ,QAAQ,CAAC,CAAC,IAAI,MAAM,SAAS;IAC5E,IAAI,CAAC,SAAS;KACZ,MAAM,kBAAkB;MAAE,SAAS,IAAI;MAAS,OAAO,IAAI;KAAM,GAAG,UAAU;KAC9E;IACF;IACA,MAAM,aAAa,aAAa,QAAQ,KAAK,UAAU,IAAI;IAC3D,MAAM,qBAAqB;KACzB,IAAI,QAAQ;KACZ;KACA,KAAK,MAAM;KACX,QAAQ;KACR,KAAK;KACL,WAAW;KACX,QAAQ,OAAO;KACf;IACF,CAAC,CAAC,CAAC,OAAO,UAAmB;KAC3B,OAAO,MAAM,EAAE,KAAK,MAAM,GAAG,+BAA+B;IAC9D,CAAC;IAED,IAAI,CAAC,MAAM,WAUL;SAAA,MATiB,gBAAgB;MACnC,WAAW;MACX,KAAK,MAAM;MACX,QAAQ,MAAM;MACd,QAAQ,OAAO;MACf,IAAI,QAAQ;MACZ,WAAW,QAAQ;MACnB;KACF,CAAC,CAAC,CAAC,YAAY,KAAK,GACR;MACV,OAAO,KAAK;OAAE,SAAS,MAAM;OAAI,KAAK,MAAM;OAAQ,QAAQ,MAAM;MAAU,GAAG,mCAAmC;MAClH,MAAM,OAAO,UAAU,MAAM,IAAI,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC;MAC3D,MAAM,qBAAqB;OACzB,IAAI,QAAQ;OACZ;OACA,KAAK,MAAM;OACX,QAAQ;OACR,KAAK;OACL,WAAW;OACX,QAAQ,OAAO;OACf;MACF,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;MACjB;KACF;;IAIF,IAAI,MADc,uBAAuB,QAAQ,UAAU,QAAQ,IAAI,MAAM,QAAQ,MAAM,EAAE,GACpF;KACP,OAAO,KAAK;MAAE,SAAS,MAAM;MAAI,KAAK,MAAM;KAAO,GAAG,mDAAmD;KACzG,MAAM,OAAO,UAAU,MAAM,IAAI,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC;KAC3D,MAAM,qBAAqB;MACzB,IAAI,QAAQ;MACZ;MACA,KAAK,MAAM;MACX,QAAQ;MACR,KAAK;MACL,WAAW;MACX,QAAQ,OAAO;MACf;KACF,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;KACjB;IACF;IACA,IAAI;KACF,MAAM,kBAAkB;MAAE,SAAS,IAAI;MAAS,OAAO,IAAI;KAAM,GAAG,UAAU;KAC9E,MAAM,UAAU,MAAM,OAAO,IAAI,IAAI,OAAO;KAC5C,IAAI,SAAS;MACX,MAAM,WACJ,QAAQ,WAAW,aACf,YACA,QAAQ,WAAW,cAAc,QAAQ,WAAW,WAClD,YACA;MACR,IAAI,UACF,MAAM,qBAAqB;OACzB,IAAI,QAAQ;OACZ;OACA,KAAK,QAAQ;OACb,QAAQ;OACR,KAAK;OACL,WAAW;OACX,QAAQ,OAAO;OACf;MACF,CAAC,CAAC,CAAC,OAAO,UAAmB;OAC3B,OAAO,MAAM,EAAE,KAAK,MAAM,GAAG,gCAAgC;MAC/D,CAAC;KAEL;IACF,SAAS,OAAgB;KACvB,MAAM,qBAAqB;MACzB,IAAI,QAAQ;MACZ;MACA,KAAK,MAAM;MACX,QAAQ;MACR,KAAK;MACL,WAAW;MACX,QAAQ,OAAO;MACf;KACF,CAAC,CAAC,CAAC,YAAY,CAEf,CAAC;KACD,MAAM;IACR;GACF;EACF,CAAC;EACH,QAAQ;EACR,iBAAiB,OAAO,SAAiB,UAAkC;GACzE,MAAM,aAAa,QAAQ;IAAE;IAAS;GAAM,CAAC;EAC/C;CACF;CAEA,IAAI,IAAI,KAAK,UAAU,CAAC;CAKxB,IAAI,IAAI,KAAK,OAAO,GAAG,SAAS;EAC9B,MAAM,UAAU,YAAY,IAAI;EAChC,MAAM,KAAK,EAAE,IAAI,WAAW;EAC5B,OAAO,KAAK;GAAE,OAAO;GAAI,QAAQ,EAAE,IAAI;GAAQ,KAAK,EAAE,IAAI;EAAK,GAAG,eAAe;EACjF,MAAM,KAAK;EACX,OAAO,KACL;GACE,OAAO;GACP,QAAQ,EAAE,IAAI;GACd,KAAK,EAAE,IAAI;GACX,QAAQ,EAAE,IAAI;GACd,YAAY,KAAK,MAAM,YAAY,IAAI,IAAI,OAAO;EACpD,GACA,aACF;CACF,CAAC;CAED,IAAI,IAAI,aAAa,UAAU;EAAE,UAAU;EAAQ,KAAK;CAAI,CAAC,CAAC;CAC9D,IAAI,IAAI,oBAAoB,UAAU;EAAE,UAAU;EAAQ,KAAK;CAAG,CAAC,CAAC;CACpE,IAAI,IAAI,sBAAsB,UAAU;EAAE,UAAU;EAAQ,KAAK;CAAG,CAAC,CAAC;CACtE,IAAI,IAAI,8BAA8B,KAAK,CAAC;CAE5C,IAAI,IAAI,KAAK,OAAO,GAAG,SAAS;EAC9B,MAAM,OAAO,MAAM,YAAY,GAAG,OAAO;EACzC,OAAO,aACL;GACE,IAAI,QAAQ;GACZ,SAAS,QAAQ;GACjB;GACA;GACA;GACA;GACA;GACA;GACA,cAAc;GACd;EACF,GACA,YAAY;GACV,MAAM,KAAK;EACb,CACF;CACF,CAAC;CAMD,IAAI,IAAI,KAAK,OAAO,GAAG,SAAS;EAC9B,MAAM,EAAE,MAAM,aAAa,kBAAkB,SAAS;EACtD,MAAM,OAAO,EAAE,IAAI;EACnB,IACE,CAAC,iBACD,QACA,KAAK,WAAW,OAAO,KACvB,KAAK,WAAW,QAAQ,KACxB,KAAK,WAAW,UAAU,GAE1B,OAAO,KAAK;EAEd,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,QAAQ;GACzC,EAAE,OAAO,eAAe,aAAa;GACrC,OAAO,EAAE,KAAK,MAAM,GAAG;EACzB;EACA,OAAO,EAAE,SAAS,eAAe,GAAG;CACtC,CAAC;CAED,iBAAiB,GAAG;CACpB,eAAe,GAAG;CAClB,eAAe,GAAG;CAClB,cAAc,GAAG;CACjB,gBAAgB,GAAG;CACnB,eAAe,GAAG;CAClB,iBAAiB,GAAG;CACpB,sBAAsB,GAAG;CACzB,cAAc,GAAG;CACjB,IAAI,QAAQ,MACV,aAAa,KAAK,QAAQ,IAAI;CAEhC,eAAe,GAAG;CAClB,gBAAgB,GAAG;CAEnB,IAAI,IAAI,wBAAwB;EAC9B,SAAS;EACT,MAAM;GACJ,OAAO;GACP,aACE;GACF,SAAS;EACX;CACF,CAAC;CACD,IAAI,IAAI,gBAAgB,UAAU,EAAE,KAAK,uBAAuB,CAAC,CAAC;CAElE,OAAO;AACT"}

package/dist/logger.d.mts

@@ -0,0 +1,39 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { Logger } from "pino";
+//#region src/logger.d.ts
+/** A pino worker transport to attach to the logger output. */
+interface PinoTransport {
+  /** Package name or absolute path of the transport module. */
+  target: string;
+  /** Options passed to the transport worker. */
+  options?: Record<string, unknown>;
+}
+/** Configuration for constructing the shelf logger. */
+interface LoggerOptions {
+  /** Minimum level to emit. Defaults to `"info"`. */
+  level?: string;
+  /** Extra pino worker transports appended to the default stdout sink. */
+  transports?: PinoTransport[];
+  /** Deployment environment recorded in the `env` base field. Defaults to `NODE_ENV`. */
+  env?: string;
+}
+/**
+ * Create the structured JSON logger used across StoryShelf.
+ *
+ * Logging conventions:
+ * - Always log structured objects, never interpolate into the message:
+ *   `logger.info({ projectId, buildId }, "build started")`.
+ * - Attach errors as an `err` child field rather than stringifying into the message:
+ *   `logger.error({ err }, "capture failed")`.
+ * - Derive scoped child loggers for background work:
+ *   `const captureLogger = logger.child({ buildId })`.
+ *
+ * The default sink is stdout. Hosted observability platforms (Sentry, PostHog,
+ * Datadog, GCP, OTEL collector, etc.) are added as pino worker `transports` —
+ * they are sinks for this logger, not standalone loggers.
+ */
+declare function createShelfLogger(options?: LoggerOptions): Logger;
+//#endregion
+export { LoggerOptions, PinoTransport, createShelfLogger };
+//# sourceMappingURL=logger.d.mts.map

package/dist/logger.mjs

@@ -0,0 +1,35 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import pino from "pino";
+//#region src/logger.ts
+/**
+* Create the structured JSON logger used across StoryShelf.
+*
+* Logging conventions:
+* - Always log structured objects, never interpolate into the message:
+*   `logger.info({ projectId, buildId }, "build started")`.
+* - Attach errors as an `err` child field rather than stringifying into the message:
+*   `logger.error({ err }, "capture failed")`.
+* - Derive scoped child loggers for background work:
+*   `const captureLogger = logger.child({ buildId })`.
+*
+* The default sink is stdout. Hosted observability platforms (Sentry, PostHog,
+* Datadog, GCP, OTEL collector, etc.) are added as pino worker `transports` —
+* they are sinks for this logger, not standalone loggers.
+*/
+function createShelfLogger(options = {}) {
+	const targets = [{
+		target: "pino/file",
+		options: { destination: 1 }
+	}, ...options.transports ?? []];
+	const transport = pino.transport({ targets });
+	return pino({
+		level: options.level ?? "info",
+		base: { env: options.env ?? process.env["NODE_ENV"] }
+	}, transport);
+}
+//#endregion
+export { createShelfLogger };
+
+//# sourceMappingURL=logger.mjs.map

package/dist/logger.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.mjs","names":[],"sources":["../src/logger.ts"],"sourcesContent":["import pino, { type Logger } from \"pino\";\n\n/** A pino worker transport to attach to the logger output. */\nexport interface PinoTransport {\n  /** Package name or absolute path of the transport module. */\n  target: string;\n  /** Options passed to the transport worker. */\n  options?: Record<string, unknown>;\n}\n\n/** Configuration for constructing the shelf logger. */\nexport interface LoggerOptions {\n  /** Minimum level to emit. Defaults to `\"info\"`. */\n  level?: string;\n  /** Extra pino worker transports appended to the default stdout sink. */\n  transports?: PinoTransport[];\n  /** Deployment environment recorded in the `env` base field. Defaults to `NODE_ENV`. */\n  env?: string;\n}\n\n/**\n * Create the structured JSON logger used across StoryShelf.\n *\n * Logging conventions:\n * - Always log structured objects, never interpolate into the message:\n *   `logger.info({ projectId, buildId }, \"build started\")`.\n * - Attach errors as an `err` child field rather than stringifying into the message:\n *   `logger.error({ err }, \"capture failed\")`.\n * - Derive scoped child loggers for background work:\n *   `const captureLogger = logger.child({ buildId })`.\n *\n * The default sink is stdout. Hosted observability platforms (Sentry, PostHog,\n * Datadog, GCP, OTEL collector, etc.) are added as pino worker `transports` —\n * they are sinks for this logger, not standalone loggers.\n */\nexport function createShelfLogger(options: LoggerOptions = {}): Logger {\n  const targets = [{ target: \"pino/file\", options: { destination: 1 } }, ...(options.transports ?? [])];\n  const transport = pino.transport({ targets });\n  return pino(\n    {\n      level: options.level ?? \"info\",\n      base: { env: options.env ?? process.env[\"NODE_ENV\"] },\n    },\n    transport,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAmCA,SAAgB,kBAAkB,UAAyB,CAAC,GAAW;CACrE,MAAM,UAAU,CAAC;EAAE,QAAQ;EAAa,SAAS,EAAE,aAAa,EAAE;CAAE,GAAG,GAAI,QAAQ,cAAc,CAAC,CAAE;CACpG,MAAM,YAAY,KAAK,UAAU,EAAE,QAAQ,CAAC;CAC5C,OAAO,KACL;EACE,OAAO,QAAQ,SAAS;EACxB,MAAM,EAAE,KAAK,QAAQ,OAAO,QAAQ,IAAI,YAAY;CACtD,GACA,SACF;AACF"}

package/dist/middleware/csrf.mjs

@@ -0,0 +1,39 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createHash, randomBytes } from "node:crypto";
+//#region src/middleware/csrf.ts
+const CSRF_SECRET = process.env["CSRF_SECRET"] ?? randomBytes(32).toString("hex");
+function generateToken(sessionId) {
+	const payload = `${sessionId}:${Date.now().toString(36)}`;
+	return `${payload}:${createHash("sha256").update(`${CSRF_SECRET}:${payload}`).digest("hex").slice(0, 16)}`;
+}
+function verifyToken(token, sessionId) {
+	const parts = token.split(":");
+	if (parts.length !== 3) return false;
+	const [payloadTimestamp, signature] = parts.slice(1);
+	if (!payloadTimestamp || !signature) return false;
+	if (signature !== createHash("sha256").update(`${CSRF_SECRET}:${sessionId}:${payloadTimestamp}`).digest("hex").slice(0, 16)) return false;
+	const timestamp = Number.parseInt(payloadTimestamp, 36);
+	const age = Date.now() - timestamp;
+	return age > 0 && age < 864e5;
+}
+function csrf() {
+	return async (c, next) => {
+		const method = c.req.method;
+		if (method === "GET" || method === "HEAD" || method === "OPTIONS") {
+			const token = generateToken(c.req.header("session-id") ?? "default");
+			c.header("X-CSRF-Token", token);
+			await next();
+			return;
+		}
+		const sessionId = c.req.header("session-id") ?? "default";
+		const token = c.req.header("x-csrf-token") ?? c.req.query("csrf_token");
+		if (!token || !verifyToken(token, sessionId)) return c.json({ error: "Invalid CSRF token" }, 403);
+		await next();
+	};
+}
+//#endregion
+export { csrf };
+
+//# sourceMappingURL=csrf.mjs.map

package/dist/middleware/csrf.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.mjs","names":[],"sources":["../../src/middleware/csrf.ts"],"sourcesContent":["import { createHash, randomBytes } from \"node:crypto\";\nimport type { Context, Next } from \"hono\";\n\nconst CSRF_SECRET = process.env[\"CSRF_SECRET\"] ?? randomBytes(32).toString(\"hex\");\n\nfunction generateToken(sessionId: string): string {\n  const timestamp = Date.now().toString(36);\n  const payload = `${sessionId}:${timestamp}`;\n  const signature = createHash(\"sha256\").update(`${CSRF_SECRET}:${payload}`).digest(\"hex\").slice(0, 16);\n  return `${payload}:${signature}`;\n}\n\nfunction verifyToken(token: string, sessionId: string): boolean {\n  const parts = token.split(\":\");\n  if (parts.length !== 3) {\n    return false;\n  }\n  const [payloadTimestamp, signature] = parts.slice(1);\n  if (!payloadTimestamp || !signature) {\n    return false;\n  }\n  const expectedSignature = createHash(\"sha256\").update(`${CSRF_SECRET}:${sessionId}:${payloadTimestamp}`).digest(\"hex\").slice(0, 16);\n  if (signature !== expectedSignature) {\n    return false;\n  }\n  const timestamp = Number.parseInt(payloadTimestamp, 36);\n  const age = Date.now() - timestamp;\n  return age > 0 && age < 24 * 60 * 60 * 1000;\n}\n\nexport function csrf() {\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const method = c.req.method;\n    if (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") {\n      const sessionId = c.req.header(\"session-id\") ?? \"default\";\n      const token = generateToken(sessionId);\n      c.header(\"X-CSRF-Token\", token);\n      await next();\n      return;\n    }\n    const sessionId = c.req.header(\"session-id\") ?? \"default\";\n    const token = c.req.header(\"x-csrf-token\") ?? c.req.query(\"csrf_token\");\n    if (!token || !verifyToken(token, sessionId)) {\n      return c.json({ error: \"Invalid CSRF token\" }, 403);\n    }\n    await next();\n  };\n}\n\nexport function getCsrfToken(sessionId: string): string {\n  return generateToken(sessionId);\n}\n\n"],"mappings":";;;;;AAGA,MAAM,cAAc,QAAQ,IAAI,kBAAkB,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;AAEhF,SAAS,cAAc,WAA2B;CAEhD,MAAM,UAAU,GAAG,UAAU,GADX,KAAK,IAAI,CAAC,CAAC,SAAS,EACE;CAExC,OAAO,GAAG,QAAQ,GADA,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,YAAY,GAAG,SAAS,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EACrE;AAC/B;AAEA,SAAS,YAAY,OAAe,WAA4B;CAC9D,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,IAAI,MAAM,WAAW,GACnB,OAAO;CAET,MAAM,CAAC,kBAAkB,aAAa,MAAM,MAAM,CAAC;CACnD,IAAI,CAAC,oBAAoB,CAAC,WACxB,OAAO;CAGT,IAAI,cADsB,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,YAAY,GAAG,UAAU,GAAG,kBAAkB,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAC9F,GAChC,OAAO;CAET,MAAM,YAAY,OAAO,SAAS,kBAAkB,EAAE;CACtD,MAAM,MAAM,KAAK,IAAI,IAAI;CACzB,OAAO,MAAM,KAAK,MAAM;AAC1B;AAEA,SAAgB,OAAO;CAErB,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,SAAS,EAAE,IAAI;EACrB,IAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAAW;GAEjE,MAAM,QAAQ,cADI,EAAE,IAAI,OAAO,YAAY,KAAK,SACX;GACrC,EAAE,OAAO,gBAAgB,KAAK;GAC9B,MAAM,KAAK;GACX;EACF;EACA,MAAM,YAAY,EAAE,IAAI,OAAO,YAAY,KAAK;EAChD,MAAM,QAAQ,EAAE,IAAI,OAAO,cAAc,KAAK,EAAE,IAAI,MAAM,YAAY;EACtE,IAAI,CAAC,SAAS,CAAC,YAAY,OAAO,SAAS,GACzC,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;EAEpD,MAAM,KAAK;CACb;AACF"}

package/dist/middleware/rate-limit.mjs

@@ -0,0 +1,38 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/middleware/rate-limit.ts
+const stores = /* @__PURE__ */ new Map();
+function cleanup() {
+	const now = Date.now();
+	for (const [key, entry] of stores) if (now > entry.resetAt) stores.delete(key);
+}
+setInterval(cleanup, 6e4).unref();
+function rateLimit(options) {
+	const { windowMs, max, keyGenerator } = options;
+	return async (c, next) => {
+		const key = keyGenerator ? keyGenerator(c) : c.req.header("x-forwarded-for") ?? "anonymous";
+		const now = Date.now();
+		let entry = stores.get(key);
+		if (!entry || now > entry.resetAt) {
+			entry = {
+				count: 0,
+				resetAt: now + windowMs
+			};
+			stores.set(key, entry);
+		}
+		entry.count += 1;
+		if (entry.count > max) {
+			const retryAfter = Math.ceil((entry.resetAt - now) / 1e3);
+			c.header("Retry-After", String(retryAfter));
+			return c.json({ error: "Too many requests" }, 429);
+		}
+		c.header("X-RateLimit-Limit", String(max));
+		c.header("X-RateLimit-Remaining", String(Math.max(0, max - entry.count)));
+		await next();
+	};
+}
+//#endregion
+export { rateLimit };
+
+//# sourceMappingURL=rate-limit.mjs.map

package/dist/middleware/rate-limit.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.mjs","names":[],"sources":["../../src/middleware/rate-limit.ts"],"sourcesContent":["import type { Context, Next } from \"hono\";\n\ninterface RateLimitEntry {\n  count: number;\n  resetAt: number;\n}\n\ninterface RateLimitOptions {\n  windowMs: number;\n  max: number;\n  keyGenerator?: (c: Context) => string;\n}\n\nconst stores = new Map<string, RateLimitEntry>();\n\nfunction cleanup(): void {\n  const now = Date.now();\n  for (const [key, entry] of stores) {\n    if (now > entry.resetAt) {\n      stores.delete(key);\n    }\n  }\n}\n\nsetInterval(cleanup, 60_000).unref();\n\nexport function rateLimit(options: RateLimitOptions) {\n  const { windowMs, max, keyGenerator } = options;\n  // oxlint-disable-next-line typescript/no-invalid-void-type -- Hono middleware may not return Response\n  return async (c: Context, next: Next): Promise<Response | void> => {\n    const key = keyGenerator ? keyGenerator(c) : (c.req.header(\"x-forwarded-for\") ?? \"anonymous\");\n    const now = Date.now();\n    let entry = stores.get(key);\n    if (!entry || now > entry.resetAt) {\n      entry = { count: 0, resetAt: now + windowMs };\n      stores.set(key, entry);\n    }\n    entry.count += 1;\n    if (entry.count > max) {\n      const retryAfter = Math.ceil((entry.resetAt - now) / 1000);\n      c.header(\"Retry-After\", String(retryAfter));\n      return c.json({ error: \"Too many requests\" }, 429);\n    }\n    c.header(\"X-RateLimit-Limit\", String(max));\n    c.header(\"X-RateLimit-Remaining\", String(Math.max(0, max - entry.count)));\n    await next();\n  };\n}\n"],"mappings":";;;;AAaA,MAAM,yBAAS,IAAI,IAA4B;AAE/C,SAAS,UAAgB;CACvB,MAAM,MAAM,KAAK,IAAI;CACrB,KAAK,MAAM,CAAC,KAAK,UAAU,QACzB,IAAI,MAAM,MAAM,SACd,OAAO,OAAO,GAAG;AAGvB;AAEA,YAAY,SAAS,GAAM,CAAC,CAAC,MAAM;AAEnC,SAAgB,UAAU,SAA2B;CACnD,MAAM,EAAE,UAAU,KAAK,iBAAiB;CAExC,OAAO,OAAO,GAAY,SAAyC;EACjE,MAAM,MAAM,eAAe,aAAa,CAAC,IAAK,EAAE,IAAI,OAAO,iBAAiB,KAAK;EACjF,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,QAAQ,OAAO,IAAI,GAAG;EAC1B,IAAI,CAAC,SAAS,MAAM,MAAM,SAAS;GACjC,QAAQ;IAAE,OAAO;IAAG,SAAS,MAAM;GAAS;GAC5C,OAAO,IAAI,KAAK,KAAK;EACvB;EACA,MAAM,SAAS;EACf,IAAI,MAAM,QAAQ,KAAK;GACrB,MAAM,aAAa,KAAK,MAAM,MAAM,UAAU,OAAO,GAAI;GACzD,EAAE,OAAO,eAAe,OAAO,UAAU,CAAC;GAC1C,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;EACnD;EACA,EAAE,OAAO,qBAAqB,OAAO,GAAG,CAAC;EACzC,EAAE,OAAO,yBAAyB,OAAO,KAAK,IAAI,GAAG,MAAM,MAAM,KAAK,CAAC,CAAC;EACxE,MAAM,KAAK;CACb;AACF"}

package/dist/models/baseline.d.mts

@@ -0,0 +1,20 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { DatabaseAdapter } from "../adapter/database.mjs";
+import { StorageAdapter } from "../adapter/storage.mjs";
+import { Baseline } from "../schema.mjs";
+//#region src/models/baseline.d.ts
+declare class BaselineModel {
+  private readonly db;
+  private readonly storage;
+  constructor(db: DatabaseAdapter, storage: StorageAdapter);
+  getFor(projectId: string, storyId: string, viewport: string, branch: string): Promise<Baseline | null>;
+  resolve(projectId: string, storyId: string, viewport: string, branch: string, defaultBranch: string): Promise<Baseline | null>;
+  read(baseline: Baseline): Promise<Buffer>;
+  upsert(projectId: string, storyId: string, viewport: string, branch: string, snapshotId: string, sourcePath: string): Promise<Baseline>;
+  list(projectId: string): Promise<Baseline[]>;
+  removeOrphans(projectId: string, validStoryIds: Set<string>): Promise<number>;
+}
+//#endregion
+export { type Baseline, BaselineModel };
+//# sourceMappingURL=baseline.d.mts.map