@wervt/nuxt 0.2.1 → 0.2.5

package/dist/dev.d.ts

@@ -7,6 +7,10 @@ export interface DevOptions {
   dbSecret?: string;
   electricUrl?: string;
   electricSecret?: string;
+  /** The local Garage, for apps with ablage: S3 API and admin API. */
+  s3Url?: string;
+  garageAdminUrl?: string;
+  garageAdminToken?: string;
   /**
    * Who `/_wervt/login` signs in as during `nuxt dev` (there's no wervt auth locally).
    * Defaults to a dev user with a Twitch account linked.

package/dist/dev.js

@@ -1,14 +1,18 @@
-import { appDatabaseUrl, dbRole, provisionDatabase } from "./provision.js";
+import { createStorage } from "./storage.js";
+import { appDatabaseUrl, dbRole, provisionDatabase, storageCredentials } from "./provision.js";
 import { useLogger } from "nuxt/kit";
-import { existsSync, watch } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
+import { existsSync, watch } from "node:fs";
 //#region src/dev.ts
 const DEFAULTS = {
 	adminUrl: "postgres://postgres:postgres@localhost:5432/wervt",
 	dbSecret: "dev-secret",
 	electricUrl: "http://localhost:3030",
-	electricSecret: "dev-electric-secret"
+	electricSecret: "dev-electric-secret",
+	s3Url: "http://localhost:3900",
+	garageAdminUrl: "http://localhost:3903",
+	garageAdminToken: "dev-garage-admin"
 };
 const logger = useLogger("wervt");
 /**
@@ -16,7 +20,7 @@ const logger = useLogger("wervt");
 * runs its migrations (again whenever `drizzle/` changes) and points the dev server
 * at the app's database and Electric.
 */
-async function setupDev(nuxt, app, options) {
+async function setupDev(nuxt, app, options, features = {}) {
 	const config = {
 		adminUrl: process.env.WERVT_PG_ADMIN_URL ?? options.adminUrl ?? DEFAULTS.adminUrl,
 		dbSecret: process.env.WERVT_DB_SECRET ?? options.dbSecret ?? DEFAULTS.dbSecret,
@@ -29,6 +33,7 @@ async function setupDev(nuxt, app, options) {
 		name: "Dev",
 		accounts: { twitch: "dev" }
 	});
+	if (features.storage) await setupStorage(app, config.dbSecret, options);
 	const migrationsFolder = join(nuxt.options.rootDir, "drizzle");
 	if (!existsSync(migrationsFolder)) return;
 	const provision = {
@@ -61,6 +66,30 @@ async function setupDev(nuxt, app, options) {
 	});
 	nuxt.hook("close", () => watcher.close());
 }
+/** The app's bucket in the local Garage, and WERVT_S3_* for ablage, like in production. */
+async function setupStorage(app, secret, options) {
+	const s3Url = process.env.WERVT_S3_URL ?? options.s3Url ?? DEFAULTS.s3Url;
+	const storage = createStorage({
+		adminUrl: options.garageAdminUrl ?? DEFAULTS.garageAdminUrl,
+		adminToken: process.env.WERVT_GARAGE_ADMIN_TOKEN ?? options.garageAdminToken ?? DEFAULTS.garageAdminToken,
+		s3Url,
+		secret
+	});
+	try {
+		await storage.ensureLayout();
+		const { bucket } = await storage.provision(app, "*");
+		logger.success(`Storage bucket \`${bucket}\` is ready`);
+	} catch (e) {
+		return logger.warn("Could not set up storage. Is the wervt stack running (docker compose up -d)?", e instanceof Error ? e.message : e);
+	}
+	const creds = await storageCredentials(app, secret);
+	process.env.WERVT_S3_URL ??= s3Url;
+	process.env.WERVT_S3_PUBLIC_URL ??= s3Url;
+	process.env.WERVT_S3_REGION ??= "garage";
+	process.env.WERVT_S3_BUCKET ??= creds.bucket;
+	process.env.WERVT_S3_ACCESS_KEY_ID ??= creds.accessKeyId;
+	process.env.WERVT_S3_SECRET_ACCESS_KEY ??= creds.secretAccessKey;
+}
 /** App name from the module option or package.json, normalised to `[a-z0-9-]+`. */
 async function resolveAppName(rootDir, name) {
 	if (!name) {

package/dist/module.d.ts

@@ -5,6 +5,20 @@ export interface ModuleOptions {
   app?: string;
   /** Local stack used by `nuxt dev`. Defaults match the wervt compose setup. */
   dev?: DevOptions;
+  /** Time zone of `nitro.scheduledTasks`, e.g. `Europe/Berlin`. Defaults to UTC. */
+  timezone?: string;
+}
+/** `server/wervt-tasks.json` in the build: the app's tasks and schedules, for the control plane. */
+export interface TasksManifest {
+  tasks: {
+    name: string;
+    description?: string;
+  }[];
+  schedules: {
+    cron: string;
+    tasks: string[];
+  }[];
+  timezone?: string;
 }
 declare const _default: import("nuxt/schema").NuxtModule<ModuleOptions, ModuleOptions, false>;
 //#endregion

package/dist/module.js

@@ -1,6 +1,8 @@
 import { resolveAppName, setupDev } from "./dev.js";
-import { addImports, addPlugin, addServerHandler, createResolver, defineNuxtModule, hasNuxtModule, installModule } from "nuxt/kit";
-import { builtinModules } from "node:module";
+import { addImports, addPlugin, addServerHandler, addServerPlugin, createResolver, defineNuxtModule, getNuxtVersion, hasNuxtModule, installModule } from "nuxt/kit";
+import { mkdir, writeFile } from "node:fs/promises";
+import { builtinModules, createRequire } from "node:module";
+import { dirname, join } from "node:path";
 import evlog from "evlog/nuxt";
 //#region src/module.ts
 const CONTENT_DATABASE = {
@@ -67,7 +69,11 @@ var module_default = defineNuxtModule({
 			}
 			if (!nuxt.options.dev) options.rollupConfig = {
 				...options.rollupConfig,
-				plugins: [...[options.rollupConfig?.plugins ?? []].flat(), prefixNodeBuiltins()]
+				plugins: [
+					...[options.rollupConfig?.plugins ?? []].flat(),
+					prefixNodeBuiltins(),
+					configurableWaitUntil()
+				]
 			};
 			options.unenv = [...options.unenv ? [options.unenv].flat() : [], { inject: {
 				Buffer: ["node:buffer", "Buffer"],
@@ -75,9 +81,65 @@ var module_default = defineNuxtModule({
 				clearImmediate: ["node:timers", "clearImmediate"]
 			} }];
 		});
+		const useAblage = hasNuxtModule("ablage", nuxt);
+		if (useAblage) {
+			const options = nuxt.options;
+			options.ablage = {
+				...options.ablage,
+				provider: options.ablage?.provider ?? "custom"
+			};
+			addServerPlugin(resolver.resolve("./runtime/server/storage-plugin"));
+			const require = createRequire(import.meta.url);
+			const aws4fetch = join(dirname(require.resolve("aws4fetch")), "aws4fetch.esm.mjs");
+			nuxt.hook("nitro:config", (config) => {
+				const options = config;
+				options.alias = {
+					...options.alias,
+					aws4fetch
+				};
+			});
+		}
+		nitro.experimental = {
+			...nitro.experimental,
+			tasks: true
+		};
+		const nitroVersion = Number.parseInt(getNuxtVersion(nuxt), 10) >= 5 ? "nitro3" : "nitro2";
+		addServerHandler({
+			route: "/_wervt/tasks/**",
+			method: "post",
+			handler: resolver.resolve(`./runtime/server/task-run-${nitroVersion}`)
+		});
+		addServerHandler({
+			route: "/_wervt/tasks",
+			method: "get",
+			handler: resolver.resolve(`./runtime/server/task-list-${nitroVersion}`)
+		});
+		if (!nuxt.options.dev) {
+			const timezone = options.timezone;
+			nuxt.hook("nitro:init", (instance) => {
+				const nitroOptions = instance.options;
+				const schedules = Object.entries(nitroOptions.scheduledTasks ?? {}).map(([cron, tasks]) => ({
+					cron,
+					tasks: [tasks].flat()
+				}));
+				nitroOptions.scheduledTasks = {};
+				instance.hooks.hook("compiled", async () => {
+					const manifest = {
+						tasks: Object.entries(nitroOptions.tasks ?? {}).map(([name, task]) => ({
+							name,
+							description: task.description || void 0
+						})),
+						schedules,
+						timezone
+					};
+					await mkdir(nitroOptions.output.serverDir, { recursive: true });
+					await writeFile(join(nitroOptions.output.serverDir, "wervt-tasks.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+				});
+			});
+		}
 		if (nuxt.options.dev && !nuxt.options._prepare) {
 			const app = await resolveAppName(nuxt.options.rootDir, options.app);
-			await setupDev(nuxt, app, options.dev ?? {});
+			await setupDev(nuxt, app, options.dev ?? {}, { storage: useAblage });
 		}
 		if (nuxt.options.dev) for (const route of ["/_wervt/login", "/_wervt/logout"]) addServerHandler({
 			route,
@@ -133,6 +195,27 @@ function prefixNodeBuiltins() {
 		}
 	};
 }
+/**
+* srvx (Nitro 3's server layer) pins `waitUntil` on each request as a non-configurable property.
+* Edge Runtime hands the app a Proxy whose `get` returns its own `waitUntil`, which breaks the
+* proxy invariant for non-configurable properties: reading `req.waitUntil` throws. Nitro's
+* error handler reads it, so every thrown error (404, 400, …) became a 500. Configurable, the
+* proxy may answer with its own function, which works the same.
+*/
+function configurableWaitUntil() {
+	const PIN_RE = /waitUntil:\s*\{\s*value:\s*(this\.#wait\?\.waitUntil)\s*\}/g;
+	return {
+		name: "wervt:configurable-wait-until",
+		renderChunk(code) {
+			if (!code.includes("waitUntil")) return null;
+			const out = code.replace(PIN_RE, "waitUntil: { value: $1, configurable: true, writable: true }");
+			return out === code ? null : {
+				code: out,
+				map: null
+			};
+		}
+	};
+}
 /** `pattern`, except for files of this module's runtime. */
 function exceptRuntime(pattern) {
 	if (pattern.source.startsWith("^")) return pattern;

package/dist/node_modules/.pnpm/h3@2.0.1_crossws@0.4.12_srvx@1.0.5__ocache@0.3.0/node_modules/h3/dist/response.js

@@ -0,0 +1,96 @@
+String.raw`%(?:2[146-9A-E]|3[0-9ABD]|4[0-9A-F]|5[0-9ABDF]|6[1-9A-F]|7[0-9ACE])`;
+const DISALLOWED_STATUS_CHARS = /[^\u0009\u0020-\u007E]/g;
+function sanitizeStatusMessage(statusMessage = "") {
+	return statusMessage.replace(DISALLOWED_STATUS_CHARS, "");
+}
+function sanitizeStatusCode(statusCode, defaultStatusCode = 200) {
+	if (!statusCode) return defaultStatusCode;
+	if (typeof statusCode === "string") statusCode = +statusCode;
+	if (!Number.isInteger(statusCode) || statusCode < 100 || statusCode > 599) return defaultStatusCode;
+	return statusCode;
+}
+var HTTPError = class HTTPError extends Error {
+	get name() {
+		return "HTTPError";
+	}
+	status;
+	statusText;
+	headers;
+	cause;
+	data;
+	body;
+	unhandled;
+	static isError(input) {
+		return input instanceof Error && input?.name === "HTTPError" && input.status > 99;
+	}
+	static status(status, statusText, details) {
+		return new HTTPError({
+			...details,
+			statusText,
+			status
+		});
+	}
+	constructor(arg1, arg2) {
+		let messageInput;
+		let details;
+		if (typeof arg1 === "string") {
+			messageInput = arg1;
+			details = arg2;
+		} else details = arg1;
+		const status = sanitizeStatusCode(details?.status || details?.statusCode || (details?.cause)?.status || (details?.cause)?.statusCode, 500);
+		const statusText = sanitizeStatusMessage(details?.statusText || details?.statusMessage || (details?.cause)?.statusText || (details?.cause)?.statusMessage);
+		const message = messageInput || details?.message || (details?.cause)?.message || details?.statusText || details?.statusMessage || [
+			"HTTPError",
+			status,
+			statusText
+		].filter(Boolean).join(" ");
+		super(message, { cause: details });
+		this.cause = details;
+		this.status = status;
+		this.statusText = statusText || void 0;
+		const rawHeaders = details?.headers || (details?.cause)?.headers;
+		this.headers = rawHeaders ? new Headers(rawHeaders) : void 0;
+		this.unhandled = details?.unhandled ?? (details?.cause)?.unhandled ?? void 0;
+		this.data = details?.data;
+		this.body = details?.body;
+	}
+	get statusCode() {
+		return this.status;
+	}
+	get statusMessage() {
+		return this.statusText;
+	}
+	toJSON() {
+		const unhandled = this.unhandled;
+		return {
+			status: this.status,
+			statusText: this.statusText,
+			unhandled,
+			message: unhandled ? "HTTPError" : this.message,
+			data: unhandled ? void 0 : this.data,
+			...unhandled ? void 0 : this.body
+		};
+	}
+};
+const kHTTPResponse = /* @__PURE__ */ Symbol.for("h3.HTTPResponse");
+var HTTPResponse = class {
+	#headers;
+	#init;
+	body;
+	constructor(body, init) {
+		this.body = body;
+		this.#init = init;
+	}
+	get status() {
+		return this.#init?.status;
+	}
+	get statusText() {
+		return this.#init?.statusText;
+	}
+	get headers() {
+		return this.#headers ||= new Headers(this.#init?.headers);
+	}
+};
+HTTPResponse.prototype[kHTTPResponse] = true;
+//#endregion
+export { HTTPError, HTTPResponse, sanitizeStatusCode, sanitizeStatusMessage };

package/dist/node_modules/.pnpm/nitro@3.0.260903-beta/node_modules/nitro/dist/runtime/internal/task.js

@@ -0,0 +1,29 @@
+import { HTTPError } from "../../../../../../h3@2.0.1_crossws@0.4.12_srvx@1.0.5__ocache@0.3.0/node_modules/h3/dist/response.js";
+import { tasks } from "#nitro/virtual/tasks";
+//#region ../../node_modules/.pnpm/nitro@3.0.260903-beta/node_modules/nitro/dist/runtime/internal/task.mjs
+const __runningTasks__ = {};
+async function runTask(name, { payload = {}, context = {} } = {}) {
+	if (__runningTasks__[name]) return __runningTasks__[name];
+	if (!(name in tasks)) throw new HTTPError({
+		message: `Task \`${name}\` is not available!`,
+		status: 404
+	});
+	if (!tasks[name].resolve) throw new HTTPError({
+		message: `Task \`${name}\` is not implemented!`,
+		status: 501
+	});
+	const handler = await tasks[name].resolve();
+	const taskEvent = {
+		name,
+		payload,
+		context
+	};
+	__runningTasks__[name] = handler.run(taskEvent);
+	try {
+		return await __runningTasks__[name];
+	} finally {
+		delete __runningTasks__[name];
+	}
+}
+//#endregion
+export { runTask };

package/dist/node_modules/.pnpm/nitro@3.0.260903-beta/node_modules/nitro/dist/runtime/task.js

@@ -0,0 +1,2 @@
+import { runTask } from "./internal/task.js";
+export { runTask };

package/dist/provision.d.ts

@@ -1,3 +1,4 @@
+import { StorageError, StorageOptions, StorageUsage, createStorage } from "./storage.js";
 //#region src/provision.d.ts
 export interface ProvisionOptions {
   /** App name, `[a-z0-9-]+`. */
@@ -11,6 +12,12 @@ export interface ProvisionOptions {
 }
 export declare function dbRole(app: string): string;
 export declare function hmac(secret: string, message: string): Promise<string>;
+/** The app's Garage bucket and S3 key, derived from WERVT_DB_SECRET like role passwords. */
+export declare function storageCredentials(app: string, secret: string): Promise<{
+  bucket: string;
+  accessKeyId: string;
+  secretAccessKey: string;
+}>;
 export declare function dbPassword(app: string, secret: string): Promise<string>;
 /** Connection URL for the app's own role, on the same host and database as `adminUrl`. */
 export declare function appDatabaseUrl({ app, adminUrl, secret }: ProvisionOptions): Promise<string>;
@@ -23,4 +30,5 @@ export declare function appDatabaseUrl({ app, adminUrl, secret }: ProvisionOptio
 export declare function provisionDatabase(options: ProvisionOptions): Promise<void>;
 /** Drops the app's schema (all its data) and role. */
 export declare function dropDatabase({ app, adminUrl }: Pick<ProvisionOptions, 'app' | 'adminUrl'>): Promise<void>;
-//#endregion
+//#endregion
+export { StorageError, type StorageOptions, type StorageUsage, createStorage };

package/dist/provision.js

@@ -1,3 +1,4 @@
+import { StorageError, createStorage } from "./storage.js";
 import { drizzle } from "drizzle-orm/postgres-js";
 import { migrate } from "drizzle-orm/postgres-js/migrator";
 import postgres from "postgres";
@@ -13,6 +14,14 @@ async function hmac(secret, message) {
 	const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(message));
 	return Array.from(new Uint8Array(sig), (b) => b.toString(16).padStart(2, "0")).join("");
 }
+/** The app's Garage bucket and S3 key, derived from WERVT_DB_SECRET like role passwords. */
+async function storageCredentials(app, secret) {
+	return {
+		bucket: `app-${app}`,
+		accessKeyId: `GK${(await hmac(secret, `s3-id:${app}`)).slice(0, 24)}`,
+		secretAccessKey: await hmac(secret, `s3-secret:${app}`)
+	};
+}
 function dbPassword(app, secret) {
 	return hmac(secret, app);
 }
@@ -120,4 +129,4 @@ async function dropDatabase({ app, adminUrl }) {
 	}
 }
 //#endregion
-export { appDatabaseUrl, dbPassword, dbRole, dropDatabase, hmac, provisionDatabase };
+export { StorageError, appDatabaseUrl, createStorage, dbPassword, dbRole, dropDatabase, hmac, provisionDatabase, storageCredentials };

package/dist/runtime/server/index.d.ts

@@ -2,6 +2,7 @@ import { WervtUser } from "../shared/user.js";
 import { useDb } from "./db.js";
 import { createEvlogError, log, useLogger } from "./logger.js";
 import { ShapeOptions, proxyShape } from "./shape.js";
+import { Task, TaskEvent, TaskResult, defineTask } from "./tasks.js";
 import { useWervtUser } from "./user.js";
 import { SafeResult, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, vh } from "./validate.js";
-export { type SafeResult, type ShapeOptions, type WervtUser, createEvlogError, log, proxyShape, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtUser, vh };
+export { type SafeResult, type ShapeOptions, type Task, type TaskEvent, type TaskResult, type WervtUser, createEvlogError, defineTask, log, proxyShape, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtUser, vh };

package/dist/runtime/server/index.js

@@ -1,6 +1,7 @@
 import { useDb } from "./db.js";
 import { createEvlogError, log, useLogger } from "./logger.js";
 import { proxyShape } from "./shape.js";
+import { defineTask } from "./tasks.js";
 import { useWervtUser } from "./user.js";
 import { useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, vh } from "./validate.js";
-export { createEvlogError, log, proxyShape, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtUser, vh };
+export { createEvlogError, defineTask, log, proxyShape, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtUser, vh };

package/dist/runtime/server/storage-plugin.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/server/storage-plugin.d.ts
+export default function wervtStorage(): void;
+//#endregion

package/dist/runtime/server/storage-plugin.js

@@ -0,0 +1,16 @@
+import { createS3Provider, setFileStorageProvider } from "#imports";
+//#region src/runtime/server/storage-plugin.ts
+function wervtStorage() {
+	const env = process.env;
+	if (!env.WERVT_S3_URL || !env.WERVT_S3_BUCKET) return;
+	setFileStorageProvider(createS3Provider({
+		endpoint: env.WERVT_S3_URL,
+		region: env.WERVT_S3_REGION ?? "garage",
+		bucket: env.WERVT_S3_BUCKET,
+		accessKeyId: env.WERVT_S3_ACCESS_KEY_ID,
+		secretAccessKey: env.WERVT_S3_SECRET_ACCESS_KEY,
+		publicEndpoint: env.WERVT_S3_PUBLIC_URL
+	}));
+}
+//#endregion
+export { wervtStorage as default };

package/dist/runtime/server/task-handlers.d.ts

@@ -0,0 +1,28 @@
+//#region src/runtime/server/task-handlers.d.ts
+type RunTask = (name: string, options: {
+  payload?: Record<string, unknown>;
+}) => Promise<{
+  result?: unknown;
+}>;
+type Registry = Record<string, {
+  meta?: {
+    description?: string;
+  };
+  resolve?: () => Promise<unknown>;
+}>;
+/** `POST /_wervt/tasks/:name`: runs a task when the control plane asks. */
+export declare function taskRunHandler(runTask: RunTask): import("nuxt/server").EventHandler<Promise<{
+  error: string;
+  result?: undefined;
+} | {
+  result: {} | null;
+  error?: undefined;
+}>>;
+/** `GET /_wervt/tasks`: the tasks with the descriptions from `defineTask({ meta })`. */
+export declare function taskListHandler(tasks: Registry): import("nuxt/server").EventHandler<Promise<{
+  name: string;
+  description: string | undefined;
+}[] | {
+  error: string;
+}>>;
+//#endregion

package/dist/runtime/server/task-handlers.js

@@ -0,0 +1,38 @@
+import { defineEventHandler } from "nuxt/server";
+//#region src/runtime/server/task-handlers.ts
+function trusted(event) {
+	if (event.req.headers.get("x-wervt-task") === "1") return true;
+	event.res.status = 404;
+	return false;
+}
+/** `POST /_wervt/tasks/:name`: runs a task when the control plane asks. */
+function taskRunHandler(runTask) {
+	return defineEventHandler(async (event) => {
+		if (!trusted(event)) return { error: "not found" };
+		const name = decodeURIComponent(new URL(event.req.url).pathname.split("/").pop() ?? "");
+		const body = await event.req.json().catch(() => ({}));
+		event.res.headers.set("cache-control", "no-store");
+		try {
+			return { result: (await runTask(name, { payload: body.payload ?? {} })).result ?? null };
+		} catch (e) {
+			console.error(`Task ${name} failed:`, e);
+			event.res.status = e.status ?? 500;
+			return { error: e instanceof Error ? e.message : String(e) };
+		}
+	});
+}
+/** `GET /_wervt/tasks`: the tasks with the descriptions from `defineTask({ meta })`. */
+function taskListHandler(tasks) {
+	return defineEventHandler(async (event) => {
+		if (!trusted(event)) return { error: "not found" };
+		event.res.headers.set("cache-control", "no-store");
+		return Promise.all(Object.entries(tasks).map(async ([name, entry]) => {
+			return {
+				name,
+				description: (await entry.resolve?.().catch(() => void 0))?.meta?.description ?? entry.meta?.description
+			};
+		}));
+	});
+}
+//#endregion
+export { taskListHandler, taskRunHandler };

package/dist/runtime/server/task-list-nitro2.d.ts

@@ -0,0 +1,9 @@
+//#region src/runtime/server/task-list-nitro2.d.ts
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+  name: string;
+  description: string | undefined;
+}[] | {
+  error: string;
+}>>;
+//#endregion
+export { _default as default };

package/dist/runtime/server/task-list-nitro2.js

@@ -0,0 +1,6 @@
+import { taskListHandler } from "./task-handlers.js";
+import { tasks } from "#nitro-internal-virtual/tasks";
+//#region src/runtime/server/task-list-nitro2.ts
+var task_list_nitro2_default = taskListHandler(tasks);
+//#endregion
+export { task_list_nitro2_default as default };

package/dist/runtime/server/task-list-nitro3.d.ts

@@ -0,0 +1,9 @@
+//#region src/runtime/server/task-list-nitro3.d.ts
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+  name: string;
+  description: string | undefined;
+}[] | {
+  error: string;
+}>>;
+//#endregion
+export { _default as default };

package/dist/runtime/server/task-list-nitro3.js

@@ -0,0 +1,6 @@
+import { taskListHandler } from "./task-handlers.js";
+import { tasks } from "#nitro/virtual/tasks";
+//#region src/runtime/server/task-list-nitro3.ts
+var task_list_nitro3_default = taskListHandler(tasks);
+//#endregion
+export { task_list_nitro3_default as default };

package/dist/runtime/server/task-run-nitro2.d.ts

@@ -0,0 +1,10 @@
+//#region src/runtime/server/task-run-nitro2.d.ts
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+  error: string;
+  result?: undefined;
+} | {
+  result: {} | null;
+  error?: undefined;
+}>>;
+//#endregion
+export { _default as default };

package/dist/runtime/server/task-run-nitro2.js

@@ -0,0 +1,6 @@
+import { taskRunHandler } from "./task-handlers.js";
+import { runTask } from "nitropack/runtime";
+//#region src/runtime/server/task-run-nitro2.ts
+var task_run_nitro2_default = taskRunHandler(runTask);
+//#endregion
+export { task_run_nitro2_default as default };

package/dist/runtime/server/task-run-nitro3.d.ts

@@ -0,0 +1,10 @@
+//#region src/runtime/server/task-run-nitro3.d.ts
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+  error: string;
+  result?: undefined;
+} | {
+  result: {} | null;
+  error?: undefined;
+}>>;
+//#endregion
+export { _default as default };

package/dist/runtime/server/task-run-nitro3.js

@@ -0,0 +1,7 @@
+import { taskRunHandler } from "./task-handlers.js";
+import { runTask } from "../../node_modules/.pnpm/nitro@3.0.260903-beta/node_modules/nitro/dist/runtime/internal/task.js";
+import "../../node_modules/.pnpm/nitro@3.0.260903-beta/node_modules/nitro/dist/runtime/task.js";
+//#region src/runtime/server/task-run-nitro3.ts
+var task_run_nitro3_default = taskRunHandler(runTask);
+//#endregion
+export { task_run_nitro3_default as default };

package/dist/runtime/server/tasks.d.ts

@@ -0,0 +1,20 @@
+//#region src/runtime/server/tasks.d.ts
+export interface TaskEvent<P = Record<string, unknown>> {
+  name: string;
+  /** `{ scheduledTime }` for scheduled runs, or what was passed to a manual run. */
+  payload: P;
+  context: Record<string, unknown>;
+}
+export interface TaskResult<R = unknown> {
+  result?: R;
+}
+export interface Task<R = unknown, P = Record<string, unknown>> {
+  meta?: {
+    name?: string;
+    description?: string;
+  };
+  run(event: TaskEvent<P>): TaskResult<R> | Promise<TaskResult<R>>;
+}
+/** A task in `server/tasks/` (`server/tasks/presence/sweep.ts` is `presence:sweep`). */
+export declare function defineTask<R = unknown, P = Record<string, unknown>>(task: Task<R, P>): Task<R, P>;
+//#endregion

package/dist/runtime/server/tasks.js

@@ -0,0 +1,10 @@
+//#region src/runtime/server/tasks.ts
+/** A task in `server/tasks/` (`server/tasks/presence/sweep.ts` is `presence:sweep`). */
+function defineTask(task) {
+	if (typeof task.run !== "function") task.run = () => {
+		throw new TypeError("Task must implement a `run` method!");
+	};
+	return task;
+}
+//#endregion
+export { defineTask };

package/dist/storage.d.ts

@@ -0,0 +1,26 @@
+//#region src/storage.d.ts
+export interface StorageOptions {
+  /** Garage's admin API, e.g. http://garage:3903 */
+  adminUrl: string;
+  adminToken: string;
+  /** Garage's S3 API as the control plane reaches it, e.g. http://garage:3900 */
+  s3Url: string;
+  secret: string;
+}
+export interface StorageUsage {
+  bucket: string;
+  objects: number;
+  bytes: number;
+  /** Multipart uploads started but never completed or aborted. */
+  unfinishedUploads: number;
+}
+export declare class StorageError extends Error {}
+export declare function createStorage(options: StorageOptions): {
+  ensureLayout: () => Promise<void>;
+  provision: (app: string, appOrigin: string) => Promise<{
+    bucket: string;
+  }>;
+  usage: (app: string) => Promise<StorageUsage | undefined>;
+  drop: (app: string) => Promise<void>;
+};
+//#endregion

package/dist/storage.js

@@ -0,0 +1,144 @@
+import { storageCredentials } from "./provision.js";
+import { AwsClient } from "aws4fetch";
+//#region src/storage.ts
+var StorageError = class extends Error {};
+function createStorage(options) {
+	async function admin(path, body) {
+		const res = await fetch(`${options.adminUrl}/v2/${path}`, {
+			method: body === void 0 ? "GET" : "POST",
+			headers: {
+				authorization: `Bearer ${options.adminToken}`,
+				"content-type": "application/json"
+			},
+			body: body === void 0 ? void 0 : JSON.stringify(body)
+		});
+		if (!res.ok) throw new StorageError(`garage ${path}: ${res.status} ${await res.text()}`);
+		return await res.json();
+	}
+	async function exists(path) {
+		const res = await fetch(`${options.adminUrl}/v2/${path}`, { headers: { authorization: `Bearer ${options.adminToken}` } });
+		if (res.status === 404 || res.status === 400) return void 0;
+		if (!res.ok) throw new StorageError(`garage ${path}: ${res.status} ${await res.text()}`);
+		return await res.json();
+	}
+	/**
+	* A fresh single-node Garage has no layout and stores nothing until it gets one. Gives this
+	* node all of its disk, once; later starts find the layout in place.
+	*/
+	async function ensureLayout() {
+		const node = (await admin("GetClusterStatus")).nodes[0];
+		if (!node || node.role) return;
+		await admin("UpdateClusterLayout", { roles: [{
+			id: node.id,
+			zone: "wervt",
+			capacity: node.dataPartition?.available ?? 0xe8d4a51000,
+			tags: []
+		}] });
+		await admin("ApplyClusterLayout", { version: (await admin("GetClusterLayout")).version + 1 });
+	}
+	const s3 = async (app) => {
+		const creds = await storageCredentials(app, options.secret);
+		return {
+			creds,
+			client: new AwsClient({
+				accessKeyId: creds.accessKeyId,
+				secretAccessKey: creds.secretAccessKey,
+				region: "garage",
+				service: "s3"
+			}),
+			base: `${options.s3Url}/${creds.bucket}`
+		};
+	};
+	/**
+	* Creates the app's bucket and key if they're missing, lets the app's origin upload and
+	* download from browsers (CORS), and cleans up abandoned uploads. Safe to run on every deploy.
+	*/
+	async function provision(app, appOrigin) {
+		const { creds, client, base } = await s3(app);
+		const bucket = await exists(`GetBucketInfo?globalAlias=${creds.bucket}`) ?? await admin("CreateBucket", { globalAlias: creds.bucket });
+		if (!await exists(`GetKeyInfo?id=${creds.accessKeyId}`)) await admin("ImportKey", {
+			accessKeyId: creds.accessKeyId,
+			secretAccessKey: creds.secretAccessKey,
+			name: creds.bucket
+		});
+		await admin("AllowBucketKey", {
+			bucketId: bucket.id,
+			accessKeyId: creds.accessKeyId,
+			permissions: {
+				read: true,
+				write: true,
+				owner: true
+			}
+		});
+		const cors = `<CORSConfiguration><CORSRule>
+<AllowedOrigin>${appOrigin}</AllowedOrigin>
+<AllowedMethod>GET</AllowedMethod><AllowedMethod>HEAD</AllowedMethod>
+<AllowedMethod>PUT</AllowedMethod><AllowedMethod>POST</AllowedMethod>
+<AllowedHeader>*</AllowedHeader><ExposeHeader>ETag</ExposeHeader>
+<MaxAgeSeconds>3600</MaxAgeSeconds>
+</CORSRule></CORSConfiguration>`;
+		const res = await client.fetch(`${base}?cors`, {
+			method: "PUT",
+			body: cors
+		});
+		if (!res.ok) throw new StorageError(`setting CORS for ${creds.bucket}: ${await res.text()}`);
+		const rules = await client.fetch(`${base}?lifecycle`, {
+			method: "PUT",
+			body: `<LifecycleConfiguration><Rule>
+<ID>abort-incomplete-uploads</ID><Status>Enabled</Status><Filter></Filter>
+<AbortIncompleteMultipartUpload><DaysAfterInitiation>1</DaysAfterInitiation></AbortIncompleteMultipartUpload>
+</Rule></LifecycleConfiguration>`
+		});
+		if (!rules.ok) throw new StorageError(`setting the lifecycle for ${creds.bucket}: ${await rules.text()}`);
+		return { bucket: creds.bucket };
+	}
+	async function usage(app) {
+		const { creds } = await s3(app);
+		const info = await exists(`GetBucketInfo?globalAlias=${creds.bucket}`);
+		if (!info) return void 0;
+		return {
+			bucket: creds.bucket,
+			objects: info.objects,
+			bytes: info.bytes,
+			unfinishedUploads: info.unfinishedMultipartUploads
+		};
+	}
+	/** Deletes every object and unfinished upload, then the bucket. Only with "drop data". */
+	async function drop(app) {
+		const { creds, client, base } = await s3(app);
+		const bucket = await exists(`GetBucketInfo?globalAlias=${creds.bucket}`);
+		if (bucket) {
+			for (;;) {
+				const keys = [...(await (await client.fetch(`${base}?list-type=2&max-keys=1000`)).text()).matchAll(/<Key>([^<]*)<\/Key>/g)].map((m) => m[1]);
+				if (!keys.length) break;
+				const body = `<Delete><Quiet>true</Quiet>${keys.map((key) => `<Object><Key>${key}</Key></Object>`).join("")}</Delete>`;
+				const res = await client.fetch(`${base}?delete`, {
+					method: "POST",
+					body
+				});
+				if (!res.ok) throw new StorageError(`emptying ${creds.bucket}: ${await res.text()}`);
+			}
+			for (;;) {
+				const uploads = [...(await (await client.fetch(`${base}?uploads&max-uploads=1000`)).text()).matchAll(/<Key>([^<]*)<\/Key>\s*<UploadId>([^<]*)<\/UploadId>/g)].map((m) => ({
+					key: m[1],
+					id: m[2]
+				}));
+				if (!uploads.length) break;
+				for (const upload of uploads) {
+					const url = `${base}/${upload.key.replaceAll("&amp;", "&").split("/").map(encodeURIComponent).join("/")}?uploadId=${encodeURIComponent(upload.id)}`;
+					const res = await client.fetch(url, { method: "DELETE" });
+					if (!res.ok && res.status !== 404) throw new StorageError(`aborting an upload in ${creds.bucket}: ${await res.text()}`);
+				}
+			}
+			await admin(`DeleteBucket?id=${String(bucket.id)}`, {});
+		}
+	}
+	return {
+		ensureLayout,
+		provision,
+		usage,
+		drop
+	};
+}
+//#endregion
+export { StorageError, createStorage };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wervt/nuxt",
-  "version": "0.2.1",
+  "version": "0.2.5",
   "description": "Nuxt module for apps hosted on wervt: database, live data and runtime setup.",
   "keywords": [
     "drizzle",
@@ -39,6 +39,7 @@
   },
   "dependencies": {
     "@electric-sql/client": "^1.5.28",
+    "aws4fetch": "^1.0.20",
     "evlog": "^2.30.0",
     "postgres": "^3.4.9",
     "valibot": "^1.5.0"