@noy-db/in-nuxt 0.4.0 → 0.6.0-pre.0

package/dist/index.d.ts

@@ -87,6 +87,10 @@ interface ModuleOptions {
      * Optional REST API integration. When `enabled: true`, mounts a catch-all
      * Nitro server handler at `basePath/**` using `@noy-db/in-rest`.
      *
+     * The handler is a ciphertext RPC proxy — it never unlocks a vault or
+     * sees plaintext, and it is FAIL-CLOSED: without `authToken`, every
+     * `POST {basePath}/rpc` request is rejected with 401.
+     *
      * The handler is scaffold-level: it reads `event.context.noydbStore` which
      * a separate Nitro plugin must populate. spec follow-up for the store
      * wiring. The module simply registers the route here.
@@ -96,10 +100,20 @@ interface ModuleOptions {
         enabled?: boolean;
         /** Base path for all REST routes. Default: '/api/noydb'. */
         basePath?: string;
-        /** User ID forwarded to createRestHandler. */
-        user?: string;
-        /** Session TTL in seconds. Default: 900. */
-        ttlSeconds?: number;
+        /**
+         * Bearer token required on every `/rpc` request's `Authorization`
+         * header. REQUIRED to accept any traffic — omitting it leaves the
+         * handler fail-closed (every request → 401). Kept OFF the public
+         * runtime config (never sent to the browser bundle); the module
+         * stashes it under the private `runtimeConfig.noydb.rest.authToken`
+         * instead, which only the Nitro server process can read.
+         *
+         * For anything beyond a static bearer token (per-user auth, JWT
+         * verification, …), call `createRestHandler` from `@noy-db/in-rest`
+         * directly with a custom `authorize` callback instead of using this
+         * module's REST integration.
+         */
+        authToken?: string;
     };
 }
 /**
@@ -130,6 +144,14 @@ declare module '@nuxt/schema' {
     interface PublicRuntimeConfig {
         noydb?: ModuleOptions;
     }
+    interface RuntimeConfig {
+        /** Private (server-only) mirror — carries only `rest.authToken`. */
+        noydb?: {
+            rest?: {
+                authToken?: string;
+            };
+        };
+    }
 }
 
 /**

package/dist/index.js

@@ -16,14 +16,22 @@ var module_default = defineNuxtModule({
   },
   setup(options, nuxt) {
     const resolver = createResolver(import.meta.url);
+    const { authToken, ...publicRest } = options.rest ?? {};
     nuxt.options.runtimeConfig.public.noydb = {
       // The cast is necessary because Nuxt's runtimeConfig type is
       // structurally `Record<string, any>` — modules are expected to
       // own their own typing via module augmentation (which we do
       // below).
       ...nuxt.options.runtimeConfig.public.noydb ?? {},
-      ...options
+      ...options,
+      ...options.rest ? { rest: publicRest } : {}
     };
+    if (authToken) {
+      nuxt.options.runtimeConfig.noydb = {
+        ...nuxt.options.runtimeConfig.noydb ?? {},
+        rest: { authToken }
+      };
+    }
     addImports([
       { name: "useNoydb", from: "@noy-db/in-vue" },
       { name: "useCollection", from: "@noy-db/in-vue" },

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/module.ts","../src/index.ts"],"sourcesContent":["/**\n * Nuxt 4 module for noy-db.\n *\n * Built with `@nuxt/kit`'s `defineNuxtModule`. Targets Nuxt 4+ exclusively\n * (no Nuxt 3 compatibility shim — Nuxt 3 users should consume `@noy-db/vue`\n * and `@noy-db/pinia` directly with a hand-written plugin).\n *\n * Module responsibilities:\n *\n *   1. Auto-import the @noy-db/in-vue composables (`useNoydb`, `useCollection`,\n *      `useSync`) and, when `pinia: true` (default), the @noy-db/in-pinia\n *      helpers (`defineNoydbStore`, `createNoydbPiniaPlugin`, `setActiveNoydb`).\n *\n *   2. Expose the user's `noydb:` config through `runtimeConfig.public.noydb`\n *      so the runtime plugin and downstream composables can read it\n *      without re-parsing nuxt.config.ts.\n *\n *   3. Register a CLIENT-ONLY runtime plugin (`runtime/plugin.client.ts`)\n *      that sets up the noydb context. The server bundle is never touched —\n *      this is the load-bearing SSR-safety property.\n *\n * Deferred to follow-up issues:\n *   - Devtools tab via @nuxt/devtools-kit\n *   - Optional Nitro server proxy (`/api/_noydb/...`)\n *   - Optional Nitro scheduled backup task\n *   - `nuxi noydb` CLI extension\n *   - Eager Noydb instantiation (requires the user's secret callback,\n *     which can't be serialized through runtime config — better to let\n *     users call setActiveNoydb from their own setup file)\n */\n\nimport { defineNuxtModule, addImports, addPlugin, addServerHandler, createResolver, extendPages } from '@nuxt/kit'\n\n/**\n * Configuration shape for the `noydb:` key in `nuxt.config.ts`.\n *\n * Every field is optional. The defaults give a reasonable bootstrap for\n * a typical Vue/Nuxt app — Pinia helpers auto-imported, `to-browser-idb`\n * as the default store. Users override by passing the relevant fields.\n */\nexport interface ModuleOptions {\n  /**\n   * Which built-in store package to prefer. The runtime plugin reads this\n   * and picks the matching store. Defaults to `'to-browser-idb'` because\n   * Nuxt apps run in the browser at runtime.\n   *\n   * Note: this is just a HINT. Users can always construct their own\n   * store and pass it to `createNoydb()` directly — this option exists\n   * to keep simple cases simple.\n   */\n  store?: 'to-browser-idb' | 'to-browser-local' | 'to-memory' | 'to-file' | 'to-aws-dynamo' | 'to-aws-s3'\n\n  /**\n   * Auto-import the @noy-db/pinia helpers (`defineNoydbStore`,\n   * `createNoydbPiniaPlugin`, `setActiveNoydb`). Defaults to `true`\n   * because Pinia is the recommended state layer for.\n   *\n   * Set to `false` if you only want the bare @noy-db/vue composables\n   * (saves ~3 KB from the auto-import metadata).\n   */\n  pinia?: boolean\n\n  /**\n   * Optional sync configuration. Currently a passthrough — the runtime\n   * plugin reads it from `runtimeConfig.public.noydb.sync` and the user\n   * is responsible for wiring it into their `createNoydb()` call.\n   */\n  sync?: {\n    store?: 'to-aws-dynamo' | 'to-aws-s3'\n    table?: string\n    region?: string\n    bucket?: string\n    mode?: 'auto' | 'manual' | 'off'\n  }\n\n  /**\n   * Optional auth configuration metadata. Same passthrough pattern as\n   * `sync`. The user provides the actual secret / biometric callback\n   * in their own setup file.\n   */\n  auth?: {\n    mode?: 'secret' | 'biometric' | 'session'\n    sessionTimeout?: string\n  }\n\n  /**\n   * Whether to enable the (planned) devtools tab in `nuxi dev`. Currently\n   * a passthrough — the devtools tab itself ships in a follow-up.\n   */\n  devtools?: boolean\n\n  /**\n   * Optional REST API integration. When `enabled: true`, mounts a catch-all\n   * Nitro server handler at `basePath/**` using `@noy-db/in-rest`.\n   *\n   * The handler is scaffold-level: it reads `event.context.noydbStore` which\n   * a separate Nitro plugin must populate. spec follow-up for the store\n   * wiring. The module simply registers the route here.\n   */\n  rest?: {\n    /** Enable the REST API server handler. Default: false. */\n    enabled?: boolean\n    /** Base path for all REST routes. Default: '/api/noydb'. */\n    basePath?: string\n    /** User ID forwarded to createRestHandler. */\n    user?: string\n    /** Session TTL in seconds. Default: 900. */\n    ttlSeconds?: number\n  }\n}\n\n/**\n * The exported Nuxt module factory.\n *\n * Test-friendly: `defineNuxtModule` returns a NuxtModule object whose\n * `.meta`, `.getOptions`, and `.setup` fields can be inspected without a\n * full Nuxt build. Unit tests use those introspection points instead of\n * spinning up `@nuxt/test-utils`.\n */\nexport default defineNuxtModule<ModuleOptions>({\n  meta: {\n    name: '@noy-db/in-nuxt',\n    configKey: 'noydb',\n    compatibility: {\n      // Nuxt 4 only — see the module-level docstring for the rationale.\n      nuxt: '^4.0.0',\n    },\n  },\n\n  defaults: {\n    store: 'to-browser-idb',\n    pinia: true,\n    devtools: true,\n  },\n\n  setup(options, nuxt) {\n    const resolver = createResolver(import.meta.url)\n\n    // ─── 1. Expose the user's options to runtime via runtimeConfig ───\n    //\n    // We stash the typed options under `runtimeConfig.public.noydb` so\n    // the client plugin (and any downstream composable) can read them\n    // without re-parsing nuxt.config.ts. `public` is required so the\n    // values reach the browser bundle — but EVERY field is metadata\n    // (store name, table name, etc.), NEVER a secret. Secrets\n    // and tokens are still provided at runtime via user callbacks.\n    nuxt.options.runtimeConfig.public.noydb = {\n      // The cast is necessary because Nuxt's runtimeConfig type is\n      // structurally `Record<string, any>` — modules are expected to\n      // own their own typing via module augmentation (which we do\n      // below).\n      ...(nuxt.options.runtimeConfig.public.noydb ?? {}),\n      ...options,\n    }\n\n    // ─── 2. Auto-imports for @noy-db/vue composables ────────────────\n    //\n    // These are the composables shipped by @noy-db/vue. Importing\n    // them automatically removes one line of boilerplate per component.\n    addImports([\n      { name: 'useNoydb', from: '@noy-db/in-vue' },\n      { name: 'useCollection', from: '@noy-db/in-vue' },\n      { name: 'useSync', from: '@noy-db/in-vue' },\n    ])\n\n    // ─── 3. Auto-imports for @noy-db/pinia (opt-out) ────────────────\n    //\n    // Most users want the Pinia helpers — `defineNoydbStore` is the\n    // headline API. We default to enabling them and let users\n    // opt out via `pinia: false` if they're not using Pinia at all.\n    if (options.pinia !== false) {\n      addImports([\n        { name: 'defineNoydbStore', from: '@noy-db/in-pinia' },\n        { name: 'createNoydbPiniaPlugin', from: '@noy-db/in-pinia' },\n        { name: 'setActiveNoydb', from: '@noy-db/in-pinia' },\n        { name: 'getActiveNoydb', from: '@noy-db/in-pinia' },\n      ])\n    }\n\n    // ─── 4. Register the client-only runtime plugin ─────────────────\n    //\n    // mode: 'client' is the LOAD-BEARING SSR-safety guarantee. Nuxt\n    // skips this plugin entirely on the server, so the server bundle\n    // never imports any code that touches `crypto.subtle`. The CI\n    // bundle assertion (planned for a follow-up) verifies this by\n    // grepping the built nitro output for forbidden symbols.\n    //\n    // The path resolves to the COMPILED runtime file in `dist/runtime/`.\n    // tsup builds this as a separate entry alongside the module index.\n    addPlugin({\n      src: resolver.resolve('./runtime/plugin.client.js'),\n      mode: 'client',\n    })\n\n    // ─── 5. REST API server handler (opt-in) ────────────────────────\n    //\n    // When `rest.enabled: true`, mount a catch-all Nitro server handler\n    // at `basePath/**`. The handler delegates to `@noy-db/in-rest` via\n    // the nitroAdapter. Store wiring (populating event.context.noydbStore)\n    // is a follow-up concern tracked separately.\n    if (options.rest?.enabled) {\n      const basePath = options.rest.basePath ?? '/api/noydb'\n      addServerHandler({\n        route: `${basePath}/**`,\n        handler: resolver.resolve('./runtime/rest'),\n      })\n    }\n\n    // ─── 6. DevTools tab (dev mode only) ────────────────────────\n    //\n    // Registers a virtual Nuxt page at /_noydb-devtools and exposes it\n    // as a tab in the Nuxt DevTools overlay. The page runs inside the\n    // user's full Vue app context — no iframe bridge, direct access to\n    // getActiveNoydb() and the inspector facade.\n    //\n    // Guarded on nuxt.options.dev: never ships to production builds.\n    // Users can opt out with `noydb: { devtools: false }`.\n    if (nuxt.options.dev && options.devtools !== false) {\n      const panelFile = resolver.resolve('./runtime/devtools/DevtoolsPanel.vue')\n\n      extendPages((pages) => {\n        pages.push({\n          name: 'noydb-devtools',\n          path: '/_noydb-devtools',\n          file: panelFile,\n        })\n      })\n\n      // `devtools:customTabs` is not in Nuxt's static HookKeys type but IS\n      // dispatched at runtime by @nuxt/devtools. Cast to bypass the type\n      // guard while keeping the hook strictly dev-only.\n      ;(nuxt as unknown as { hook(event: string, fn: (tabs: unknown[]) => void): void })\n        .hook('devtools:customTabs', (tabs: unknown[]) => {\n          tabs.push({\n            name: 'noy-db',\n            title: 'noy-db',\n            icon: 'i-carbon-data-base',\n            view: { type: 'iframe', src: '/_noydb-devtools' },\n          })\n        })\n    }\n  },\n})\n\n/**\n * Module augmentation so the `noydb:` config key in `nuxt.config.ts`\n * is fully typed and autocompleted in the IDE.\n *\n * The augmentation is a side-effect of importing the module — once a\n * project adds `'@noy-db/in-nuxt'` to its `modules` array, TypeScript picks\n * up the typed `noydb` option without requiring an explicit import.\n */\ndeclare module '@nuxt/schema' {\n  interface NuxtConfig {\n    noydb?: ModuleOptions\n  }\n  interface NuxtOptions {\n    noydb?: ModuleOptions\n  }\n  interface PublicRuntimeConfig {\n    noydb?: ModuleOptions\n  }\n}\n","/**\n * @noy-db/nuxt — Nuxt 4 module for noy-db.\n *\n * Public API:\n *   - default export: the Nuxt module factory\n *   - `ModuleOptions` type: shape of the `noydb:` key in `nuxt.config.ts`\n *\n * The module auto-imports the @noy-db/vue and (optionally) @noy-db/pinia\n * composables, exposes the user's options through Nuxt's runtime config,\n * and registers a CLIENT-ONLY runtime plugin so the SSR bundle never\n * touches `crypto.subtle`. Eager Noydb instantiation is intentionally\n * left to user code — see the README \"Bootstrap\" section.\n */\n\nimport noydbModule, { type ModuleOptions } from './module.js'\n\nexport default noydbModule\nexport type { ModuleOptions }\n"],"mappings":";AA+BA,SAAS,kBAAkB,YAAY,WAAW,kBAAkB,gBAAgB,mBAAmB;AAwFvG,IAAO,iBAAQ,iBAAgC;AAAA,EAC7C,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,WAAW;AAAA,IACX,eAAe;AAAA;AAAA,MAEb,MAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,UAAU;AAAA,IACR,OAAO;AAAA,IACP,OAAO;AAAA,IACP,UAAU;AAAA,EACZ;AAAA,EAEA,MAAM,SAAS,MAAM;AACnB,UAAM,WAAW,eAAe,YAAY,GAAG;AAU/C,SAAK,QAAQ,cAAc,OAAO,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,MAKxC,GAAI,KAAK,QAAQ,cAAc,OAAO,SAAS,CAAC;AAAA,MAChD,GAAG;AAAA,IACL;AAMA,eAAW;AAAA,MACT,EAAE,MAAM,YAAY,MAAM,iBAAiB;AAAA,MAC3C,EAAE,MAAM,iBAAiB,MAAM,iBAAiB;AAAA,MAChD,EAAE,MAAM,WAAW,MAAM,iBAAiB;AAAA,IAC5C,CAAC;AAOD,QAAI,QAAQ,UAAU,OAAO;AAC3B,iBAAW;AAAA,QACT,EAAE,MAAM,oBAAoB,MAAM,mBAAmB;AAAA,QACrD,EAAE,MAAM,0BAA0B,MAAM,mBAAmB;AAAA,QAC3D,EAAE,MAAM,kBAAkB,MAAM,mBAAmB;AAAA,QACnD,EAAE,MAAM,kBAAkB,MAAM,mBAAmB;AAAA,MACrD,CAAC;AAAA,IACH;AAYA,cAAU;AAAA,MACR,KAAK,SAAS,QAAQ,4BAA4B;AAAA,MAClD,MAAM;AAAA,IACR,CAAC;AAQD,QAAI,QAAQ,MAAM,SAAS;AACzB,YAAM,WAAW,QAAQ,KAAK,YAAY;AAC1C,uBAAiB;AAAA,QACf,OAAO,GAAG,QAAQ;AAAA,QAClB,SAAS,SAAS,QAAQ,gBAAgB;AAAA,MAC5C,CAAC;AAAA,IACH;AAWA,QAAI,KAAK,QAAQ,OAAO,QAAQ,aAAa,OAAO;AAClD,YAAM,YAAY,SAAS,QAAQ,sCAAsC;AAEzE,kBAAY,CAAC,UAAU;AACrB,cAAM,KAAK;AAAA,UACT,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,QACR,CAAC;AAAA,MACH,CAAC;AAKA,MAAC,KACC,KAAK,uBAAuB,CAAC,SAAoB;AAChD,aAAK,KAAK;AAAA,UACR,MAAM;AAAA,UACN,OAAO;AAAA,UACP,MAAM;AAAA,UACN,MAAM,EAAE,MAAM,UAAU,KAAK,mBAAmB;AAAA,QAClD,CAAC;AAAA,MACH,CAAC;AAAA,IACL;AAAA,EACF;AACF,CAAC;;;AClOD,IAAO,gBAAQ;","names":[]}
+{"version":3,"sources":["../src/module.ts","../src/index.ts"],"sourcesContent":["/**\n * Nuxt 4 module for noy-db.\n *\n * Built with `@nuxt/kit`'s `defineNuxtModule`. Targets Nuxt 4+ exclusively\n * (no Nuxt 3 compatibility shim — Nuxt 3 users should consume `@noy-db/vue`\n * and `@noy-db/pinia` directly with a hand-written plugin).\n *\n * Module responsibilities:\n *\n *   1. Auto-import the @noy-db/in-vue composables (`useNoydb`, `useCollection`,\n *      `useSync`) and, when `pinia: true` (default), the @noy-db/in-pinia\n *      helpers (`defineNoydbStore`, `createNoydbPiniaPlugin`, `setActiveNoydb`).\n *\n *   2. Expose the user's `noydb:` config through `runtimeConfig.public.noydb`\n *      so the runtime plugin and downstream composables can read it\n *      without re-parsing nuxt.config.ts.\n *\n *   3. Register a CLIENT-ONLY runtime plugin (`runtime/plugin.client.ts`)\n *      that sets up the noydb context. The server bundle is never touched —\n *      this is the load-bearing SSR-safety property.\n *\n * Deferred to follow-up issues:\n *   - Devtools tab via @nuxt/devtools-kit\n *   - Optional Nitro server proxy (`/api/_noydb/...`)\n *   - Optional Nitro scheduled backup task\n *   - `nuxi noydb` CLI extension\n *   - Eager Noydb instantiation (requires the user's secret callback,\n *     which can't be serialized through runtime config — better to let\n *     users call setActiveNoydb from their own setup file)\n */\n\nimport { defineNuxtModule, addImports, addPlugin, addServerHandler, createResolver, extendPages } from '@nuxt/kit'\n\n/**\n * Configuration shape for the `noydb:` key in `nuxt.config.ts`.\n *\n * Every field is optional. The defaults give a reasonable bootstrap for\n * a typical Vue/Nuxt app — Pinia helpers auto-imported, `to-browser-idb`\n * as the default store. Users override by passing the relevant fields.\n */\nexport interface ModuleOptions {\n  /**\n   * Which built-in store package to prefer. The runtime plugin reads this\n   * and picks the matching store. Defaults to `'to-browser-idb'` because\n   * Nuxt apps run in the browser at runtime.\n   *\n   * Note: this is just a HINT. Users can always construct their own\n   * store and pass it to `createNoydb()` directly — this option exists\n   * to keep simple cases simple.\n   */\n  store?: 'to-browser-idb' | 'to-browser-local' | 'to-memory' | 'to-file' | 'to-aws-dynamo' | 'to-aws-s3'\n\n  /**\n   * Auto-import the @noy-db/pinia helpers (`defineNoydbStore`,\n   * `createNoydbPiniaPlugin`, `setActiveNoydb`). Defaults to `true`\n   * because Pinia is the recommended state layer for.\n   *\n   * Set to `false` if you only want the bare @noy-db/vue composables\n   * (saves ~3 KB from the auto-import metadata).\n   */\n  pinia?: boolean\n\n  /**\n   * Optional sync configuration. Currently a passthrough — the runtime\n   * plugin reads it from `runtimeConfig.public.noydb.sync` and the user\n   * is responsible for wiring it into their `createNoydb()` call.\n   */\n  sync?: {\n    store?: 'to-aws-dynamo' | 'to-aws-s3'\n    table?: string\n    region?: string\n    bucket?: string\n    mode?: 'auto' | 'manual' | 'off'\n  }\n\n  /**\n   * Optional auth configuration metadata. Same passthrough pattern as\n   * `sync`. The user provides the actual secret / biometric callback\n   * in their own setup file.\n   */\n  auth?: {\n    mode?: 'secret' | 'biometric' | 'session'\n    sessionTimeout?: string\n  }\n\n  /**\n   * Whether to enable the (planned) devtools tab in `nuxi dev`. Currently\n   * a passthrough — the devtools tab itself ships in a follow-up.\n   */\n  devtools?: boolean\n\n  /**\n   * Optional REST API integration. When `enabled: true`, mounts a catch-all\n   * Nitro server handler at `basePath/**` using `@noy-db/in-rest`.\n   *\n   * The handler is a ciphertext RPC proxy — it never unlocks a vault or\n   * sees plaintext, and it is FAIL-CLOSED: without `authToken`, every\n   * `POST {basePath}/rpc` request is rejected with 401.\n   *\n   * The handler is scaffold-level: it reads `event.context.noydbStore` which\n   * a separate Nitro plugin must populate. spec follow-up for the store\n   * wiring. The module simply registers the route here.\n   */\n  rest?: {\n    /** Enable the REST API server handler. Default: false. */\n    enabled?: boolean\n    /** Base path for all REST routes. Default: '/api/noydb'. */\n    basePath?: string\n    /**\n     * Bearer token required on every `/rpc` request's `Authorization`\n     * header. REQUIRED to accept any traffic — omitting it leaves the\n     * handler fail-closed (every request → 401). Kept OFF the public\n     * runtime config (never sent to the browser bundle); the module\n     * stashes it under the private `runtimeConfig.noydb.rest.authToken`\n     * instead, which only the Nitro server process can read.\n     *\n     * For anything beyond a static bearer token (per-user auth, JWT\n     * verification, …), call `createRestHandler` from `@noy-db/in-rest`\n     * directly with a custom `authorize` callback instead of using this\n     * module's REST integration.\n     */\n    authToken?: string\n  }\n}\n\n/**\n * The exported Nuxt module factory.\n *\n * Test-friendly: `defineNuxtModule` returns a NuxtModule object whose\n * `.meta`, `.getOptions`, and `.setup` fields can be inspected without a\n * full Nuxt build. Unit tests use those introspection points instead of\n * spinning up `@nuxt/test-utils`.\n */\nexport default defineNuxtModule<ModuleOptions>({\n  meta: {\n    name: '@noy-db/in-nuxt',\n    configKey: 'noydb',\n    compatibility: {\n      // Nuxt 4 only — see the module-level docstring for the rationale.\n      nuxt: '^4.0.0',\n    },\n  },\n\n  defaults: {\n    store: 'to-browser-idb',\n    pinia: true,\n    devtools: true,\n  },\n\n  setup(options, nuxt) {\n    const resolver = createResolver(import.meta.url)\n\n    // ─── 1. Expose the user's options to runtime via runtimeConfig ───\n    //\n    // We stash the typed options under `runtimeConfig.public.noydb` so\n    // the client plugin (and any downstream composable) can read them\n    // without re-parsing nuxt.config.ts. `public` is required so the\n    // values reach the browser bundle — but EVERY field there is metadata\n    // (store name, table name, etc.), NEVER a secret.\n    //\n    // `rest.authToken` is the one genuine secret this module accepts. It\n    // is deliberately kept OFF `runtimeConfig.public` and stashed on the\n    // private `runtimeConfig.noydb.rest.authToken` instead, which Nitro\n    // never ships to the client bundle — only `packages/in-nuxt`'s own\n    // server handler (`runtime/rest.ts`) reads it.\n    const { authToken, ...publicRest } = options.rest ?? {}\n    nuxt.options.runtimeConfig.public.noydb = {\n      // The cast is necessary because Nuxt's runtimeConfig type is\n      // structurally `Record<string, any>` — modules are expected to\n      // own their own typing via module augmentation (which we do\n      // below).\n      ...(nuxt.options.runtimeConfig.public.noydb ?? {}),\n      ...options,\n      ...(options.rest ? { rest: publicRest } : {}),\n    }\n    if (authToken) {\n      nuxt.options.runtimeConfig.noydb = {\n        ...(nuxt.options.runtimeConfig.noydb ?? {}),\n        rest: { authToken },\n      }\n    }\n\n    // ─── 2. Auto-imports for @noy-db/vue composables ────────────────\n    //\n    // These are the composables shipped by @noy-db/vue. Importing\n    // them automatically removes one line of boilerplate per component.\n    addImports([\n      { name: 'useNoydb', from: '@noy-db/in-vue' },\n      { name: 'useCollection', from: '@noy-db/in-vue' },\n      { name: 'useSync', from: '@noy-db/in-vue' },\n    ])\n\n    // ─── 3. Auto-imports for @noy-db/pinia (opt-out) ────────────────\n    //\n    // Most users want the Pinia helpers — `defineNoydbStore` is the\n    // headline API. We default to enabling them and let users\n    // opt out via `pinia: false` if they're not using Pinia at all.\n    if (options.pinia !== false) {\n      addImports([\n        { name: 'defineNoydbStore', from: '@noy-db/in-pinia' },\n        { name: 'createNoydbPiniaPlugin', from: '@noy-db/in-pinia' },\n        { name: 'setActiveNoydb', from: '@noy-db/in-pinia' },\n        { name: 'getActiveNoydb', from: '@noy-db/in-pinia' },\n      ])\n    }\n\n    // ─── 4. Register the client-only runtime plugin ─────────────────\n    //\n    // mode: 'client' is the LOAD-BEARING SSR-safety guarantee. Nuxt\n    // skips this plugin entirely on the server, so the server bundle\n    // never imports any code that touches `crypto.subtle`. The CI\n    // bundle assertion (planned for a follow-up) verifies this by\n    // grepping the built nitro output for forbidden symbols.\n    //\n    // The path resolves to the COMPILED runtime file in `dist/runtime/`.\n    // tsup builds this as a separate entry alongside the module index.\n    addPlugin({\n      src: resolver.resolve('./runtime/plugin.client.js'),\n      mode: 'client',\n    })\n\n    // ─── 5. REST API server handler (opt-in) ────────────────────────\n    //\n    // When `rest.enabled: true`, mount a catch-all Nitro server handler\n    // at `basePath/**`. The handler delegates to `@noy-db/in-rest` via\n    // the nitroAdapter. Store wiring (populating event.context.noydbStore)\n    // is a follow-up concern tracked separately.\n    if (options.rest?.enabled) {\n      const basePath = options.rest.basePath ?? '/api/noydb'\n      addServerHandler({\n        route: `${basePath}/**`,\n        handler: resolver.resolve('./runtime/rest'),\n      })\n    }\n\n    // ─── 6. DevTools tab (dev mode only) ────────────────────────\n    //\n    // Registers a virtual Nuxt page at /_noydb-devtools and exposes it\n    // as a tab in the Nuxt DevTools overlay. The page runs inside the\n    // user's full Vue app context — no iframe bridge, direct access to\n    // getActiveNoydb() and the inspector facade.\n    //\n    // Guarded on nuxt.options.dev: never ships to production builds.\n    // Users can opt out with `noydb: { devtools: false }`.\n    if (nuxt.options.dev && options.devtools !== false) {\n      const panelFile = resolver.resolve('./runtime/devtools/DevtoolsPanel.vue')\n\n      extendPages((pages) => {\n        pages.push({\n          name: 'noydb-devtools',\n          path: '/_noydb-devtools',\n          file: panelFile,\n        })\n      })\n\n      // `devtools:customTabs` is not in Nuxt's static HookKeys type but IS\n      // dispatched at runtime by @nuxt/devtools. Cast to bypass the type\n      // guard while keeping the hook strictly dev-only.\n      ;(nuxt as unknown as { hook(event: string, fn: (tabs: unknown[]) => void): void })\n        .hook('devtools:customTabs', (tabs: unknown[]) => {\n          tabs.push({\n            name: 'noy-db',\n            title: 'noy-db',\n            icon: 'i-carbon-data-base',\n            view: { type: 'iframe', src: '/_noydb-devtools' },\n          })\n        })\n    }\n  },\n})\n\n/**\n * Module augmentation so the `noydb:` config key in `nuxt.config.ts`\n * is fully typed and autocompleted in the IDE.\n *\n * The augmentation is a side-effect of importing the module — once a\n * project adds `'@noy-db/in-nuxt'` to its `modules` array, TypeScript picks\n * up the typed `noydb` option without requiring an explicit import.\n */\ndeclare module '@nuxt/schema' {\n  interface NuxtConfig {\n    noydb?: ModuleOptions\n  }\n  interface NuxtOptions {\n    noydb?: ModuleOptions\n  }\n  interface PublicRuntimeConfig {\n    noydb?: ModuleOptions\n  }\n  interface RuntimeConfig {\n    /** Private (server-only) mirror — carries only `rest.authToken`. */\n    noydb?: { rest?: { authToken?: string } }\n  }\n}\n","/**\n * @noy-db/nuxt — Nuxt 4 module for noy-db.\n *\n * Public API:\n *   - default export: the Nuxt module factory\n *   - `ModuleOptions` type: shape of the `noydb:` key in `nuxt.config.ts`\n *\n * The module auto-imports the @noy-db/vue and (optionally) @noy-db/pinia\n * composables, exposes the user's options through Nuxt's runtime config,\n * and registers a CLIENT-ONLY runtime plugin so the SSR bundle never\n * touches `crypto.subtle`. Eager Noydb instantiation is intentionally\n * left to user code — see the README \"Bootstrap\" section.\n */\n\nimport noydbModule, { type ModuleOptions } from './module.js'\n\nexport default noydbModule\nexport type { ModuleOptions }\n"],"mappings":";AA+BA,SAAS,kBAAkB,YAAY,WAAW,kBAAkB,gBAAgB,mBAAmB;AAsGvG,IAAO,iBAAQ,iBAAgC;AAAA,EAC7C,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,WAAW;AAAA,IACX,eAAe;AAAA;AAAA,MAEb,MAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,UAAU;AAAA,IACR,OAAO;AAAA,IACP,OAAO;AAAA,IACP,UAAU;AAAA,EACZ;AAAA,EAEA,MAAM,SAAS,MAAM;AACnB,UAAM,WAAW,eAAe,YAAY,GAAG;AAe/C,UAAM,EAAE,WAAW,GAAG,WAAW,IAAI,QAAQ,QAAQ,CAAC;AACtD,SAAK,QAAQ,cAAc,OAAO,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,MAKxC,GAAI,KAAK,QAAQ,cAAc,OAAO,SAAS,CAAC;AAAA,MAChD,GAAG;AAAA,MACH,GAAI,QAAQ,OAAO,EAAE,MAAM,WAAW,IAAI,CAAC;AAAA,IAC7C;AACA,QAAI,WAAW;AACb,WAAK,QAAQ,cAAc,QAAQ;AAAA,QACjC,GAAI,KAAK,QAAQ,cAAc,SAAS,CAAC;AAAA,QACzC,MAAM,EAAE,UAAU;AAAA,MACpB;AAAA,IACF;AAMA,eAAW;AAAA,MACT,EAAE,MAAM,YAAY,MAAM,iBAAiB;AAAA,MAC3C,EAAE,MAAM,iBAAiB,MAAM,iBAAiB;AAAA,MAChD,EAAE,MAAM,WAAW,MAAM,iBAAiB;AAAA,IAC5C,CAAC;AAOD,QAAI,QAAQ,UAAU,OAAO;AAC3B,iBAAW;AAAA,QACT,EAAE,MAAM,oBAAoB,MAAM,mBAAmB;AAAA,QACrD,EAAE,MAAM,0BAA0B,MAAM,mBAAmB;AAAA,QAC3D,EAAE,MAAM,kBAAkB,MAAM,mBAAmB;AAAA,QACnD,EAAE,MAAM,kBAAkB,MAAM,mBAAmB;AAAA,MACrD,CAAC;AAAA,IACH;AAYA,cAAU;AAAA,MACR,KAAK,SAAS,QAAQ,4BAA4B;AAAA,MAClD,MAAM;AAAA,IACR,CAAC;AAQD,QAAI,QAAQ,MAAM,SAAS;AACzB,YAAM,WAAW,QAAQ,KAAK,YAAY;AAC1C,uBAAiB;AAAA,QACf,OAAO,GAAG,QAAQ;AAAA,QAClB,SAAS,SAAS,QAAQ,gBAAgB;AAAA,MAC5C,CAAC;AAAA,IACH;AAWA,QAAI,KAAK,QAAQ,OAAO,QAAQ,aAAa,OAAO;AAClD,YAAM,YAAY,SAAS,QAAQ,sCAAsC;AAEzE,kBAAY,CAAC,UAAU;AACrB,cAAM,KAAK;AAAA,UACT,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,QACR,CAAC;AAAA,MACH,CAAC;AAKA,MAAC,KACC,KAAK,uBAAuB,CAAC,SAAoB;AAChD,aAAK,KAAK;AAAA,UACR,MAAM;AAAA,UACN,OAAO;AAAA,UACP,MAAM;AAAA,UACN,MAAM,EAAE,MAAM,UAAU,KAAK,mBAAmB;AAAA,QAClD,CAAC;AAAA,MACH,CAAC;AAAA,IACL;AAAA,EACF;AACF,CAAC;;;AC7PD,IAAO,gBAAQ;","names":[]}

package/dist/runtime/rest.js

@@ -3,15 +3,27 @@ import { defineEventHandler, getRequestURL, readBody } from "h3";
 import { createRestHandler } from "@noy-db/in-rest";
 import { nitroAdapter } from "@noy-db/in-rest/nitro";
 var _handler = null;
-function getHandler(store, user, ttlSeconds, basePath) {
+function bearerAuthorize(expectedToken) {
+  return (req) => {
+    const auth = req.headers["authorization"] ?? req.headers["Authorization"];
+    if (!auth?.startsWith("Bearer ")) return false;
+    return auth.slice(7) === expectedToken;
+  };
+}
+function getHandler(store, authToken, basePath) {
   if (!_handler) {
-    _handler = createRestHandler({ store, user, ttlSeconds, basePath });
+    _handler = createRestHandler({
+      store,
+      basePath,
+      ...authToken ? { authorize: bearerAuthorize(authToken) } : {}
+    });
   }
   return _handler;
 }
 var rest_default = defineEventHandler(async (event) => {
   const ctx = event.context;
-  const config = ctx.nitro?.runtimeConfig?.public?.noydb?.rest ?? ctx.runtimeConfig?.public?.noydb?.rest ?? {};
+  const publicConfig = ctx.nitro?.runtimeConfig?.public?.noydb?.rest ?? ctx.runtimeConfig?.public?.noydb?.rest ?? {};
+  const privateConfig = ctx.nitro?.runtimeConfig?.noydb?.rest ?? ctx.runtimeConfig?.noydb?.rest ?? {};
   const store = ctx.noydbStore;
   if (!store) {
     return new Response(
@@ -19,11 +31,11 @@ var rest_default = defineEventHandler(async (event) => {
       { status: 500, headers: { "content-type": "application/json" } }
     );
   }
-  const restConfig = config;
+  const restConfig = publicConfig;
+  const authToken = privateConfig.authToken;
   const handler = getHandler(
     store,
-    restConfig.user ?? "api",
-    restConfig.ttlSeconds ?? 900,
+    authToken,
     restConfig.basePath ?? "/api/noydb"
   );
   const url = getRequestURL(event);

package/dist/runtime/rest.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/runtime/rest.ts"],"sourcesContent":["/**\n * Nitro catch-all server handler for the opt-in REST API integration.\n *\n * This file is registered as a server handler entry point by the module when\n * `rest.enabled: true`. It bridges Nitro's H3 event model to\n * `@noy-db/in-rest`'s `NoydbRestHandler` via the `nitroAdapter`.\n *\n * **Store wiring (scaffold note):**\n * The handler reads the noydb store from `event.context.noydbStore`. A\n * separate Nitro server plugin must populate this before requests reach this\n * handler. That wiring is deferred to the  follow-up PR.\n *\n * The handler is intentionally stateless at module scope — the lazy `_handler`\n * singleton is reset on each cold-start (Nitro worker restart), which matches\n * the expected lifecycle.\n */\n\nimport { defineEventHandler, getRequestURL, readBody } from 'h3'\nimport type { H3Event } from 'h3'\nimport { createRestHandler } from '@noy-db/in-rest'\nimport { nitroAdapter } from '@noy-db/in-rest/nitro'\nimport type { NoydbRestHandler } from '@noy-db/in-rest'\nimport type { NoydbStore } from '@noy-db/hub'\n\nlet _handler: NoydbRestHandler | null = null\n\nfunction getHandler(\n  store: NoydbStore,\n  user: string,\n  ttlSeconds: number,\n  basePath: string,\n): NoydbRestHandler {\n  if (!_handler) {\n    _handler = createRestHandler({ store, user, ttlSeconds, basePath })\n  }\n  return _handler\n}\n\nexport default defineEventHandler(async (event: H3Event) => {\n  // Read REST config from Nitro's public runtime config. Nitro stores it at\n  // `event.context.nitro.runtimeConfig` (the canonical location — confirmed\n  // by reading nitropack's config.mjs). The fallback on\n  // `event.context.runtimeConfig` covers bespoke setups that might inject\n  // config at that alternate key.\n  const ctx = event.context as {\n    nitro?: { runtimeConfig?: { public?: { noydb?: { rest?: Record<string, unknown> } } } }\n    runtimeConfig?: { public?: { noydb?: { rest?: Record<string, unknown> } } }\n    noydbStore?: NoydbStore\n  }\n  const config =\n    ctx.nitro?.runtimeConfig?.public?.noydb?.rest ??\n    ctx.runtimeConfig?.public?.noydb?.rest ??\n    {}\n\n  // The store must be provided by a separate Nitro server plugin that\n  // creates and populates `event.context.noydbStore` before this handler\n  // runs. See module docstring above.\n  const store = ctx.noydbStore\n\n  if (!store) {\n    return new Response(\n      JSON.stringify({ error: 'noydb_store_not_configured' }),\n      { status: 500, headers: { 'content-type': 'application/json' } },\n    )\n  }\n\n  const restConfig = config as {\n    user?: string\n    ttlSeconds?: number\n    basePath?: string\n  }\n  const handler = getHandler(\n    store,\n    restConfig.user ?? 'api',\n    restConfig.ttlSeconds ?? 900,\n    restConfig.basePath ?? '/api/noydb',\n  )\n\n  // Build the adapter-friendly event shape. We pass event.headers directly\n  // because `nitroAdapter` already handles both `Headers` instances and\n  // plain `Record<string, string>` objects.\n  const url = getRequestURL(event)\n  const method = (event.method ?? 'GET').toUpperCase()\n\n  let body: unknown = null\n  if (method !== 'GET' && method !== 'HEAD' && method !== 'DELETE') {\n    try { body = await readBody(event) } catch { body = null }\n  }\n\n  const h3Adapter = nitroAdapter(handler)\n  return h3Adapter({\n    method,\n    path: url.pathname + url.search,\n    // nitroAdapter's H3Event accepts Headers | Record<string,string> — pass\n    // the Headers instance directly to avoid lossy serialization.\n    headers: event.headers,\n    _body: body,\n  })\n})\n"],"mappings":";AAiBA,SAAS,oBAAoB,eAAe,gBAAgB;AAE5D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAI7B,IAAI,WAAoC;AAExC,SAAS,WACP,OACA,MACA,YACA,UACkB;AAClB,MAAI,CAAC,UAAU;AACb,eAAW,kBAAkB,EAAE,OAAO,MAAM,YAAY,SAAS,CAAC;AAAA,EACpE;AACA,SAAO;AACT;AAEA,IAAO,eAAQ,mBAAmB,OAAO,UAAmB;AAM1D,QAAM,MAAM,MAAM;AAKlB,QAAM,SACJ,IAAI,OAAO,eAAe,QAAQ,OAAO,QACzC,IAAI,eAAe,QAAQ,OAAO,QAClC,CAAC;AAKH,QAAM,QAAQ,IAAI;AAElB,MAAI,CAAC,OAAO;AACV,WAAO,IAAI;AAAA,MACT,KAAK,UAAU,EAAE,OAAO,6BAA6B,CAAC;AAAA,MACtD,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,mBAAmB,EAAE;AAAA,IACjE;AAAA,EACF;AAEA,QAAM,aAAa;AAKnB,QAAM,UAAU;AAAA,IACd;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB,WAAW,cAAc;AAAA,IACzB,WAAW,YAAY;AAAA,EACzB;AAKA,QAAM,MAAM,cAAc,KAAK;AAC/B,QAAM,UAAU,MAAM,UAAU,OAAO,YAAY;AAEnD,MAAI,OAAgB;AACpB,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,UAAU;AAChE,QAAI;AAAE,aAAO,MAAM,SAAS,KAAK;AAAA,IAAE,QAAQ;AAAE,aAAO;AAAA,IAAK;AAAA,EAC3D;AAEA,QAAM,YAAY,aAAa,OAAO;AACtC,SAAO,UAAU;AAAA,IACf;AAAA,IACA,MAAM,IAAI,WAAW,IAAI;AAAA;AAAA;AAAA,IAGzB,SAAS,MAAM;AAAA,IACf,OAAO;AAAA,EACT,CAAC;AACH,CAAC;","names":[]}
+{"version":3,"sources":["../../src/runtime/rest.ts"],"sourcesContent":["/**\n * Nitro catch-all server handler for the opt-in REST API integration.\n *\n * This file is registered as a server handler entry point by the module when\n * `rest.enabled: true`. It bridges Nitro's H3 event model to\n * `@noy-db/in-rest`'s `NoydbRestHandler` via the `nitroAdapter`.\n *\n * **Store wiring (scaffold note):**\n * The handler reads the noydb store from `event.context.noydbStore`. A\n * separate Nitro server plugin must populate this before requests reach this\n * handler. That wiring is deferred to the  follow-up PR.\n *\n * The handler is intentionally stateless at module scope — the lazy `_handler`\n * singleton is reset on each cold-start (Nitro worker restart), which matches\n * the expected lifecycle.\n */\n\nimport { defineEventHandler, getRequestURL, readBody } from 'h3'\nimport type { H3Event } from 'h3'\nimport { createRestHandler } from '@noy-db/in-rest'\nimport { nitroAdapter } from '@noy-db/in-rest/nitro'\nimport type { NoydbRestHandler, RestRequest } from '@noy-db/in-rest'\nimport type { NoydbStore } from '@noy-db/hub'\n\nlet _handler: NoydbRestHandler | null = null\n\n/**\n * Case-insensitive `Authorization: Bearer <token>` check against the\n * configured `rest.authToken`. HTTP header names are case-insensitive on\n * the wire — `nitroAdapter` already lowercases them, but `RestRequest`'s\n * type gives no such guarantee, so both castings are checked defensively\n * (matching what `@noy-db/in-rest`'s own pre-proxy `extractToken` did).\n */\nfunction bearerAuthorize(expectedToken: string) {\n  return (req: RestRequest): boolean => {\n    const auth = req.headers['authorization'] ?? req.headers['Authorization']\n    if (!auth?.startsWith('Bearer ')) return false\n    return auth.slice(7) === expectedToken\n  }\n}\n\nfunction getHandler(\n  store: NoydbStore,\n  authToken: string | undefined,\n  basePath: string,\n): NoydbRestHandler {\n  if (!_handler) {\n    // FAIL-CLOSED: @noy-db/in-rest rejects every /rpc request with 401\n    // when `authorize` is omitted. Without an `authToken`, that's exactly\n    // what happens here — the deployer MUST configure\n    // `noydb.rest.authToken` (or wire a custom handler directly) to\n    // accept any traffic.\n    _handler = createRestHandler({\n      store,\n      basePath,\n      ...(authToken ? { authorize: bearerAuthorize(authToken) } : {}),\n    })\n  }\n  return _handler\n}\n\nexport default defineEventHandler(async (event: H3Event) => {\n  // Read REST config from Nitro's runtime config. Nitro stores it at\n  // `event.context.nitro.runtimeConfig` (the canonical location — confirmed\n  // by reading nitropack's config.mjs). The fallback on\n  // `event.context.runtimeConfig` covers bespoke setups that might inject\n  // config at that alternate key. `basePath` comes off the PUBLIC branch\n  // (module.ts mirrors it there too, it's not a secret); `authToken` comes\n  // off the PRIVATE branch — module.ts deliberately never puts it under\n  // `.public`, so it never reaches the client bundle.\n  const ctx = event.context as {\n    nitro?: {\n      runtimeConfig?: {\n        public?: { noydb?: { rest?: Record<string, unknown> } }\n        noydb?: { rest?: Record<string, unknown> }\n      }\n    }\n    runtimeConfig?: {\n      public?: { noydb?: { rest?: Record<string, unknown> } }\n      noydb?: { rest?: Record<string, unknown> }\n    }\n    noydbStore?: NoydbStore\n  }\n  const publicConfig =\n    ctx.nitro?.runtimeConfig?.public?.noydb?.rest ??\n    ctx.runtimeConfig?.public?.noydb?.rest ??\n    {}\n  const privateConfig =\n    ctx.nitro?.runtimeConfig?.noydb?.rest ??\n    ctx.runtimeConfig?.noydb?.rest ??\n    {}\n\n  // The store must be provided by a separate Nitro server plugin that\n  // creates and populates `event.context.noydbStore` before this handler\n  // runs. See module docstring above.\n  const store = ctx.noydbStore\n\n  if (!store) {\n    return new Response(\n      JSON.stringify({ error: 'noydb_store_not_configured' }),\n      { status: 500, headers: { 'content-type': 'application/json' } },\n    )\n  }\n\n  const restConfig = publicConfig as { basePath?: string }\n  const authToken = (privateConfig as { authToken?: string }).authToken\n  const handler = getHandler(\n    store,\n    authToken,\n    restConfig.basePath ?? '/api/noydb',\n  )\n\n  // Build the adapter-friendly event shape. We pass event.headers directly\n  // because `nitroAdapter` already handles both `Headers` instances and\n  // plain `Record<string, string>` objects.\n  const url = getRequestURL(event)\n  const method = (event.method ?? 'GET').toUpperCase()\n\n  let body: unknown = null\n  if (method !== 'GET' && method !== 'HEAD' && method !== 'DELETE') {\n    try { body = await readBody(event) } catch { body = null }\n  }\n\n  const h3Adapter = nitroAdapter(handler)\n  return h3Adapter({\n    method,\n    path: url.pathname + url.search,\n    // nitroAdapter's H3Event accepts Headers | Record<string,string> — pass\n    // the Headers instance directly to avoid lossy serialization.\n    headers: event.headers,\n    _body: body,\n  })\n})\n"],"mappings":";AAiBA,SAAS,oBAAoB,eAAe,gBAAgB;AAE5D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAI7B,IAAI,WAAoC;AASxC,SAAS,gBAAgB,eAAuB;AAC9C,SAAO,CAAC,QAA8B;AACpC,UAAM,OAAO,IAAI,QAAQ,eAAe,KAAK,IAAI,QAAQ,eAAe;AACxE,QAAI,CAAC,MAAM,WAAW,SAAS,EAAG,QAAO;AACzC,WAAO,KAAK,MAAM,CAAC,MAAM;AAAA,EAC3B;AACF;AAEA,SAAS,WACP,OACA,WACA,UACkB;AAClB,MAAI,CAAC,UAAU;AAMb,eAAW,kBAAkB;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,GAAI,YAAY,EAAE,WAAW,gBAAgB,SAAS,EAAE,IAAI,CAAC;AAAA,IAC/D,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,IAAO,eAAQ,mBAAmB,OAAO,UAAmB;AAS1D,QAAM,MAAM,MAAM;AAalB,QAAM,eACJ,IAAI,OAAO,eAAe,QAAQ,OAAO,QACzC,IAAI,eAAe,QAAQ,OAAO,QAClC,CAAC;AACH,QAAM,gBACJ,IAAI,OAAO,eAAe,OAAO,QACjC,IAAI,eAAe,OAAO,QAC1B,CAAC;AAKH,QAAM,QAAQ,IAAI;AAElB,MAAI,CAAC,OAAO;AACV,WAAO,IAAI;AAAA,MACT,KAAK,UAAU,EAAE,OAAO,6BAA6B,CAAC;AAAA,MACtD,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,mBAAmB,EAAE;AAAA,IACjE;AAAA,EACF;AAEA,QAAM,aAAa;AACnB,QAAM,YAAa,cAAyC;AAC5D,QAAM,UAAU;AAAA,IACd;AAAA,IACA;AAAA,IACA,WAAW,YAAY;AAAA,EACzB;AAKA,QAAM,MAAM,cAAc,KAAK;AAC/B,QAAM,UAAU,MAAM,UAAU,OAAO,YAAY;AAEnD,MAAI,OAAgB;AACpB,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,UAAU;AAChE,QAAI;AAAE,aAAO,MAAM,SAAS,KAAK;AAAA,IAAE,QAAQ;AAAE,aAAO;AAAA,IAAK;AAAA,EAC3D;AAEA,QAAM,YAAY,aAAa,OAAO;AACtC,SAAO,UAAU;AAAA,IACf;AAAA,IACA,MAAM,IAAI,WAAW,IAAI;AAAA;AAAA;AAAA,IAGzB,SAAS,MAAM;AAAA,IACf,OAAO;AAAA,EACT,CAAC;AACH,CAAC;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/in-nuxt",
-  "version": "0.4.0",
+  "version": "0.6.0-pre.0",
   "description": "Nuxt 4 module for noy-db — auto-imports, SSR-safe runtime plugin, and the @noy-db/in-pinia bridge",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -34,10 +34,10 @@
   },
   "peerDependencies": {
     "nuxt": "^4.0.0",
-    "@noy-db/hub": "0.4.0",
-    "@noy-db/in-pinia": "0.4.0",
-    "@noy-db/in-vue": "0.4.0",
-    "@noy-db/in-rest": "0.4.0"
+    "@noy-db/in-vue": "0.6.0-pre.0",
+    "@noy-db/in-pinia": "0.6.0-pre.0",
+    "@noy-db/hub": "0.6.0-pre.0",
+    "@noy-db/in-rest": "0.6.0-pre.0"
   },
   "peerDependenciesMeta": {
     "@noy-db/in-rest": {
@@ -45,7 +45,7 @@
     }
   },
   "dependencies": {
-    "@noy-db/in-devtools": "0.4.0"
+    "@noy-db/in-devtools": "0.6.0-pre.0"
   },
   "devDependencies": {
     "@nuxt/kit": "^4.4.2",
@@ -56,10 +56,10 @@
     "happy-dom": "^17.4.4",
     "nuxt": "^4.4.2",
     "vue": "^3.5.32",
-    "@noy-db/hub": "0.4.0",
-    "@noy-db/in-pinia": "0.4.0",
-    "@noy-db/in-rest": "0.4.0",
-    "@noy-db/in-vue": "0.4.0"
+    "@noy-db/hub": "0.6.0-pre.0",
+    "@noy-db/in-rest": "0.6.0-pre.0",
+    "@noy-db/in-vue": "0.6.0-pre.0",
+    "@noy-db/in-pinia": "0.6.0-pre.0"
   },
   "keywords": [
     "noy-db",