residual fixes

src/routes/api/v1/libs/+server.ts

@@ -28,8 +28,8 @@ export const GET: RequestHandler = ({ url }) => {
 		const libraries = service.list({ state: state ?? undefined, limit, offset });
 		const total = service.count(state ?? undefined);
 
-		// Augment each library with its versions array
-		const enriched = libraries.map((repo) => ({
+		// Augment each library with its versions array; strip sensitive fields.
+		const enriched = libraries.map(({ githubToken: _token, ...repo }) => ({
 			...repo,
 			versions: service.getVersions(repo.id)
 		}));
@@ -63,8 +63,9 @@ export const POST: RequestHandler = async ({ request }) => {
 			jobResponse = { id: job.id, status: job.status };
 		}
 
+		const { githubToken: _token, ...safeRepo } = repo;
 		return json(
-			{ library: repo, ...(jobResponse ? { job: jobResponse } : {}) },
+			{ library: safeRepo, ...(jobResponse ? { job: jobResponse } : {}) },
 			{ status: 201 }
 		);
 	} catch (err) {

src/routes/api/v1/libs/[id]/+server.ts

@@ -22,7 +22,8 @@ export const GET: RequestHandler = ({ params }) => {
 			return json({ error: 'Repository not found', code: 'NOT_FOUND' }, { status: 404 });
 		}
 		const versions = service.getVersions(id);
-		return json({ ...repo, versions });
+		const { githubToken: _token, ...safeRepo } = repo;
+		return json({ ...safeRepo, versions });
 	} catch (err) {
 		return handleServiceError(err);
 	}
@@ -39,7 +40,8 @@ export const PATCH: RequestHandler = async ({ params, request }) => {
 			branch: body.branch,
 			githubToken: body.githubToken
 		});
-		return json(updated);
+		const { githubToken: _token, ...safeUpdated } = updated;
+		return json(safeUpdated);
 	} catch (err) {
 		return handleServiceError(err);
 	}