@tollwyn/baukasten 1.3.1 → 1.3.3

package/dist/server/api.d.ts

@@ -14,7 +14,10 @@ export declare class ApiError extends Error {
 }
 /** Runs a handler of the API: an ApiError becomes its answer, anything else a logged 500. */
 export declare function respond(log: Log, messages: Messages, handler: () => Promise<Response>): Promise<Response>;
-/** The JSON body of a request, parsed with `schema`: 400 when it is no JSON, 422 when it does not fit. */
+/**
+ * The JSON body of a request, parsed with `schema`: 400 when it is no JSON, 413 when it is over the
+ * limit of the server, 422 when it does not fit.
+ */
 export declare function readBody<S extends z.ZodType>(request: Request, schema: S, messages: Messages): Promise<z.output<S>>;
 /** The key in `Authorization: Bearer <prefix>_<secret>`, or null. */
 export declare function bearerKey(headers: Headers, prefix: string): string | null;

package/dist/server/api.js

@@ -30,14 +30,28 @@ export async function respond(log, messages, handler) {
         return errorResponse(new ApiError(500, 'internal', messages.api.internal));
     }
 }
-/** The JSON body of a request, parsed with `schema`: 400 when it is no JSON, 422 when it does not fit. */
+/**
+ * SvelteKit errors the body of a request over BODY_SIZE_LIMIT with an error of its own that carries
+ * the status 413, and does so only while the body is read.
+ */
+const overLimit = (error) => error instanceof Error && 'status' in error && error.status === 413;
+/**
+ * The JSON body of a request, parsed with `schema`: 400 when it is no JSON, 413 when it is over the
+ * limit of the server, 422 when it does not fit.
+ */
 export async function readBody(request, schema, messages) {
     let body;
     try {
         body = await request.json();
     }
-    catch {
-        throw new ApiError(400, 'invalid_json', messages.api.invalidJson);
+    catch (caught) {
+        if (caught instanceof SyntaxError) {
+            throw new ApiError(400, 'invalid_json', messages.api.invalidJson);
+        }
+        if (overLimit(caught)) {
+            throw new ApiError(413, 'payload_too_large', messages.api.payloadTooLarge);
+        }
+        throw caught;
     }
     const result = schema.safeParse(body);
     if (!result.success) {
@@ -80,10 +94,15 @@ export async function asApiError(response, messages) {
     if (response.status < 400)
         return response;
     if (response.headers.get('content-type')?.startsWith('application/json') === true) {
+        // A body that claims to be JSON and is none gets the shape; a failure to read it goes on.
         const body = await response
             .clone()
             .json()
-            .catch(() => null);
+            .catch((caught) => {
+            if (caught instanceof SyntaxError)
+                return null;
+            throw caught;
+        });
         if (isShaped(body))
             return response;
     }

package/dist/server/hook.d.ts

@@ -71,7 +71,10 @@ export interface Kit<E extends ProductEnv = ProductEnv> {
     api: {
         /** Runs a handler: an ApiError becomes its answer, anything else a logged 500. */
         respond(handler: () => Promise<Response>): Promise<Response>;
-        /** The JSON body of a request, parsed with `schema`: else 400 or 422 with each problem. */
+        /**
+         * The JSON body of a request, parsed with `schema`: else 400, 413 over the limit of the server,
+         * or 422 with each problem.
+         */
         body<S extends z.ZodType>(request: Request, schema: S): Promise<z.output<S>>;
         /** The account of the bearer key: else 401, and 429 past the limit of the key. */
         account(event: RequestEvent): Promise<Account>;

package/dist/server/messages.d.ts

@@ -99,7 +99,7 @@ export interface Messages {
         url: string;
         price: string;
         quantity: string;
-        errors: Record<'invalidJson' | 'invalidRequest' | 'emailTaken' | 'unauthorized' | 'rateLimited' | 'forbidden' | 'subscribed' | 'noCustomer' | 'notConfigured', string>;
+        errors: Record<'invalidJson' | 'payloadTooLarge' | 'invalidRequest' | 'emailTaken' | 'unauthorized' | 'rateLimited' | 'forbidden' | 'subscribed' | 'noCustomer' | 'notConfigured', string>;
     };
 }
 export declare const MESSAGES: Record<Language, Messages>;

package/dist/server/messages.js

@@ -103,6 +103,7 @@ const en = {
         quantity: 'For a subscription that counts a quantity, like seats; 1 without.',
         errors: {
             invalidJson: 'The body is not JSON (invalid_json).',
+            payloadTooLarge: 'The body is over the limit of the server (payload_too_large).',
             invalidRequest: 'The body is not valid (invalid_request); details name each problem.',
             emailTaken: 'An account with this email address exists (email_taken).',
             unauthorized: 'No valid API key (unauthorized).',
@@ -220,6 +221,7 @@ const de = {
         quantity: 'Für ein Abo mit einer Menge, etwa Plätzen; ohne 1.',
         errors: {
             invalidJson: 'Der Inhalt ist kein JSON (invalid_json).',
+            payloadTooLarge: 'Der Inhalt ist grösser, als der Server annimmt (payload_too_large).',
             invalidRequest: 'Der Inhalt ist nicht gültig (invalid_request); details nennt jedes Problem.',
             emailTaken: 'Zu dieser E-Mail-Adresse besteht ein Konto (email_taken).',
             unauthorized: 'Kein gültiger API-Schlüssel (unauthorized).',

package/dist/server/openapi.js

@@ -49,6 +49,7 @@ export function openApiPart(origin, messages) {
                         '400': error(o.errors.invalidJson),
                         '403': error(o.errors.forbidden),
                         '409': error(o.errors.emailTaken),
+                        '413': error(o.errors.payloadTooLarge),
                         '422': error(o.errors.invalidRequest),
                         '429': error(o.errors.rateLimited)
                     }
@@ -88,6 +89,7 @@ export function openApiPart(origin, messages) {
                         '400': error(o.errors.invalidJson),
                         '401': error(o.errors.unauthorized),
                         '409': error(o.errors.subscribed),
+                        '413': error(o.errors.payloadTooLarge),
                         '422': error(o.errors.invalidRequest),
                         '429': error(o.errors.rateLimited),
                         '503': error(o.errors.notConfigured)

package/dist/testing/app.d.ts

@@ -1,5 +1,6 @@
 import type { SmtpDouble } from './smtp.js';
 import type { StripeDouble } from './stripe.js';
+/** A line of stdout as JSON object; a line that is none is { notJson } or, as JSON, { notAnObject }. */
 export type LogLine = Record<string, unknown>;
 export interface AppProcess {
     logs: LogLine[];

package/dist/testing/app.js

@@ -38,15 +38,8 @@ export function spawnNode(args, env, options = {}) {
         buffer += chunk.toString();
         let end;
         while ((end = buffer.indexOf('\n')) >= 0) {
-            const text = buffer.slice(0, end);
+            const line = asLine(buffer.slice(0, end));
             buffer = buffer.slice(end + 1);
-            let line;
-            try {
-                line = asLine(JSON.parse(text));
-            }
-            catch {
-                line = { notJson: text };
-            }
             logs.push(line);
             events.emit('line', line);
         }
@@ -101,10 +94,18 @@ export function spawnNode(args, env, options = {}) {
         }
     };
 }
-/** A log line is a JSON object; anything else is kept as text. */
-function asLine(value) {
+/** A log line is a JSON object; anything else is kept as text, under notJson or notAnObject. */
+function asLine(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        // JSON.parse of a string fails only with a SyntaxError.
+        return { notJson: text };
+    }
     if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-        throw new Error('not an object');
+        return { notAnObject: text };
     }
     return Object.fromEntries(Object.entries(value));
 }

package/dist/testing/connection.js

@@ -294,7 +294,7 @@ export function connectionTest(product, playwright) {
         });
         test('the log of the product is JSON lines without the address, and stderr stays empty, to its end', async () => {
             await app.stop();
-            expect(app.logs.filter((line) => 'notJson' in line)).toEqual([]);
+            expect(app.logs.filter((line) => 'notJson' in line || 'notAnObject' in line)).toEqual([]);
             expect(JSON.stringify(app.logs)).not.toContain(EMAIL);
             expect(app.stderr()).toBe('');
         });

package/dist/testing/shopify-connection.js

@@ -296,7 +296,7 @@ export function shopifyConnectionTest(app, playwright) {
         });
         test('it writes JSON lines only, and no token into its log', () => {
             expect(running.stderr()).toBe('');
-            expect(running.logs.filter((line) => 'notJson' in line)).toEqual([]);
+            expect(running.logs.filter((line) => 'notJson' in line || 'notAnObject' in line)).toEqual([]);
             // Every ID token starts with the same header, so any of them in the log would show it.
             const [header = ''] = shopify.idToken(SHOP).split('.');
             expect(header).not.toBe('');

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@tollwyn/baukasten",
-	"version": "1.3.1",
+	"version": "1.3.3",
 	"description": "What every product built on this kit shares: configuration, log and server, database with two-layer migrations, health, accounts with sessions and API keys, limits, mail, payment through Stripe, the numbers for sales, the frame and pages, the stubs that hang them into a product and the check of a product, and the tools to test one, its connection test among them; and for a Shopify app its installation with tokens, the frame of the admin, its webhooks, its plan through the Partner API and its privacy text.",
 	"license": "UNLICENSED",
 	"type": "module",
@@ -60,35 +60,35 @@
 		"svelte": "^5.57.0"
 	},
 	"dependencies": {
-		"nodemailer": "10.0.16",
+		"nodemailer": "10.1.1",
 		"pg": "8.23.1",
-		"smol-toml": "1.9.0",
+		"smol-toml": "1.9.1",
 		"stripe": "22.6.2",
-		"zod": "4.6.5"
+		"zod": "4.6.7"
 	},
 	"devDependencies": {
-		"@eslint-community/eslint-plugin-eslint-comments": "4.7.2",
+		"@eslint-community/eslint-plugin-eslint-comments": "4.8.1",
 		"@eslint/js": "10.0.1",
-		"@playwright/test": "1.62.1",
+		"@playwright/test": "1.64.0",
 		"@sveltejs/kit": "2.70.3",
 		"@sveltejs/package": "2.5.8",
-		"@sveltejs/vite-plugin-svelte": "7.3.0",
-		"@types/node": "24.19.1",
+		"@sveltejs/vite-plugin-svelte": "7.3.1",
+		"@types/node": "24.19.2",
 		"@types/pg": "8.23.1",
 		"@types/smtp-server": "3.5.13",
-		"eslint": "10.9.1",
+		"eslint": "10.12.0",
 		"eslint-config-prettier": "10.1.8",
-		"eslint-plugin-svelte": "3.23.0",
-		"globals": "17.12.0",
-		"prettier": "3.9.6",
+		"eslint-plugin-svelte": "3.23.1",
+		"globals": "17.13.0",
+		"prettier": "3.9.10",
 		"prettier-plugin-svelte": "4.1.1",
-		"smtp-server": "3.19.17",
+		"smtp-server": "3.19.22",
 		"svelte": "5.57.2",
 		"svelte-check": "4.7.6",
 		"typescript": "6.0.3",
-		"typescript-eslint": "8.69.0",
-		"vite": "8.2.2",
-		"vitest": "5.0.3"
+		"typescript-eslint": "8.71.2",
+		"vite": "8.3.4",
+		"vitest": "5.0.4"
 	},
 	"overrides": {
 		"cookie": "0.7.0"