@wervt/nuxt 0.3.1 → 0.3.3

package/dist/runtime/email/invite.d.ts

@@ -0,0 +1,75 @@
+//#region src/runtime/email/invite.d.ts
+/**
+ * An invitation to an app: who invited, where to go, and that signing in with this address is
+ * all it takes. Send it with `sendMail({ to, template: InviteEmail, props: { by, app, url } })`.
+ */
+export declare const InviteEmail: import("vue").DefineComponent<import("vue").ExtractPropTypes<{
+  /** Who invited them, by name or email. */
+  by: {
+    type: StringConstructor;
+    required: true;
+  };
+  /** The app they're invited to, as people know it. */
+  app: {
+    type: StringConstructor;
+    required: true;
+  };
+  /** Where the button goes: the app, or a link that lets them in. */
+  url: {
+    type: StringConstructor;
+    required: true;
+  };
+  /** What the app is, in a sentence after "<by> invited you to <app>." */
+  message: {
+    type: StringConstructor;
+    default: string;
+  };
+  /** The button's label; "Open <app>" unless set. */
+  action: {
+    type: StringConstructor;
+    default: string;
+  };
+  /** A hint under the button; by default, to sign in with this address. */
+  note: {
+    type: StringConstructor;
+    default: string;
+  };
+}>, () => import("vue").VNode<import("vue").RendererNode, import("vue").RendererElement, {
+  [key: string]: any;
+}>, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<import("vue").ExtractPropTypes<{
+  /** Who invited them, by name or email. */
+  by: {
+    type: StringConstructor;
+    required: true;
+  };
+  /** The app they're invited to, as people know it. */
+  app: {
+    type: StringConstructor;
+    required: true;
+  };
+  /** Where the button goes: the app, or a link that lets them in. */
+  url: {
+    type: StringConstructor;
+    required: true;
+  };
+  /** What the app is, in a sentence after "<by> invited you to <app>." */
+  message: {
+    type: StringConstructor;
+    default: string;
+  };
+  /** The button's label; "Open <app>" unless set. */
+  action: {
+    type: StringConstructor;
+    default: string;
+  };
+  /** A hint under the button; by default, to sign in with this address. */
+  note: {
+    type: StringConstructor;
+    default: string;
+  };
+}>> & Readonly<{}>, {
+  message: string;
+  action: string;
+  note: string;
+}, {}, {}, {}, string, import("vue").ComponentProvideOptions, true, {}, any>;
+//#endregion

package/dist/runtime/email/invite.js

@@ -0,0 +1,60 @@
+import { EmailButton, EmailHeading, EmailMuted, EmailText, WervtEmail } from "./components.js";
+import { defineComponent, h } from "vue";
+//#region src/runtime/email/invite.ts
+/**
+* An invitation to an app: who invited, where to go, and that signing in with this address is
+* all it takes. Send it with `sendMail({ to, template: InviteEmail, props: { by, app, url } })`.
+*/
+const InviteEmail = defineComponent({
+	name: "InviteEmail",
+	props: {
+		/** Who invited them, by name or email. */
+		by: {
+			type: String,
+			required: true
+		},
+		/** The app they're invited to, as people know it. */
+		app: {
+			type: String,
+			required: true
+		},
+		/** Where the button goes: the app, or a link that lets them in. */
+		url: {
+			type: String,
+			required: true
+		},
+		/** What the app is, in a sentence after "<by> invited you to <app>." */
+		message: {
+			type: String,
+			default: ""
+		},
+		/** The button's label; "Open <app>" unless set. */
+		action: {
+			type: String,
+			default: ""
+		},
+		/** A hint under the button; by default, to sign in with this address. */
+		note: {
+			type: String,
+			default: ""
+		}
+	},
+	setup(props) {
+		return () => h(WervtEmail, {
+			subject: `${props.by} invited you to ${props.app}`,
+			app: props.app,
+			preview: props.message || `Join ${props.app}`,
+			reason: `You received this email because ${props.by} invited this address.`
+		}, () => [
+			h(EmailHeading, { eyebrow: "Invitation" }, () => `You're invited to ${props.app}`),
+			h(EmailText, () => [`${props.by} invited you to ${props.app}.`, props.message].filter(Boolean).join(" ")),
+			h(EmailButton, {
+				href: props.url,
+				color: "neutral"
+			}, () => props.action || `Open ${props.app}`),
+			h(EmailMuted, () => props.note || "Sign in with this email address to get in.")
+		]);
+	}
+});
+//#endregion
+export { InviteEmail };

package/dist/runtime/server/access.d.ts

@@ -0,0 +1,35 @@
+import { RequestEvent } from "nuxt/server";
+//#region src/runtime/server/access.d.ts
+export interface WervtInvite {
+  email: string;
+  /** Who invited them. */
+  by: string;
+  /** ISO time. */
+  at: string;
+}
+export interface WervtAccess {
+  /** Lets `email` into the app. `invited` is false when they could already get in. */
+  invite(email: string): Promise<{
+    email: string;
+    invited: boolean;
+  }>;
+  /** Takes back an invite (not the owner's allow list). */
+  revoke(email: string): Promise<{
+    email: string;
+    revoked: boolean;
+  }>;
+  /** Everyone the app invited, with who invited them and when. */
+  list(): Promise<WervtInvite[]>;
+}
+/**
+ * Invites on an invite-only app (`wervt access <app> --invite`), as the user of this request: the
+ * runtime vouches for them, and only someone with access can invite. Everyone with access may
+ * invite, or only the owner, members and admins with `wervt access <app> --invite-by owners`;
+ * restrict it further in the route if the app has its own roles.
+ *
+ * Throws with the platform's status: 401 without a signed-in user, 403 when they may not invite,
+ * 409 when the app isn't invite-only, 429 past the limits (25 invites per person and day, 500 per
+ * app).
+ */
+export declare function useWervtAccess(event: RequestEvent): WervtAccess;
+//#endregion

package/dist/runtime/server/access.js

@@ -0,0 +1,88 @@
+import { DEV_LOGIN_COOKIE, devUser } from "../shared/user.js";
+import { createError, getCookie } from "nuxt/server";
+//#region src/runtime/server/access.ts
+const devInvites = [];
+/**
+* Invites on an invite-only app (`wervt access <app> --invite`), as the user of this request: the
+* runtime vouches for them, and only someone with access can invite. Everyone with access may
+* invite, or only the owner, members and admins with `wervt access <app> --invite-by owners`;
+* restrict it further in the route if the app has its own roles.
+*
+* Throws with the platform's status: 401 without a signed-in user, 403 when they may not invite,
+* 409 when the app isn't invite-only, 429 past the limits (25 invites per person and day, 500 per
+* app).
+*/
+function useWervtAccess(event) {
+	const runtime = process.env.WERVT_RUNTIME_URL;
+	if (!runtime) return devAccess(event);
+	async function call(method, body) {
+		const res = await fetch(new URL("/_wervt/access", runtime), {
+			method,
+			headers: {
+				"content-type": "application/json",
+				"x-wervt-app": process.env.WERVT_APP ?? "",
+				"x-wervt-token": process.env.WERVT_TOKEN ?? "",
+				"x-wervt-user": event.req.headers.get("x-wervt-user") ?? "",
+				"x-wervt-user-proof": event.req.headers.get("x-wervt-user-proof") ?? ""
+			},
+			body: body && JSON.stringify(body)
+		});
+		const data = await res.json().catch(() => ({}));
+		if (!res.ok) throw createError({
+			status: res.status,
+			message: data.error ?? `access ${res.status}`
+		});
+		return data;
+	}
+	return {
+		invite: (email) => call("POST", { email }),
+		revoke: (email) => call("DELETE", { email }),
+		list: async () => (await call("GET")).invited
+	};
+}
+function devAccess(event) {
+	const user = devUser(getCookie(event, DEV_LOGIN_COOKIE) === "1");
+	const by = () => {
+		if (!user) throw createError({
+			status: 401,
+			message: "sign in at /_wervt/login first"
+		});
+		return user.email;
+	};
+	return {
+		async invite(email) {
+			const inviter = by();
+			email = email.trim().toLowerCase();
+			if (devInvites.some((invite) => invite.email === email)) return {
+				email,
+				invited: false
+			};
+			devInvites.push({
+				email,
+				by: inviter,
+				at: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			console.info(`[access] ${inviter} invited ${email} (dev: not stored)`);
+			return {
+				email,
+				invited: true
+			};
+		},
+		async revoke(email) {
+			by();
+			email = email.trim().toLowerCase();
+			const index = devInvites.findIndex((invite) => invite.email === email);
+			if (index >= 0) devInvites.splice(index, 1);
+			return {
+				email,
+				revoked: index >= 0
+			};
+		},
+		async list() {
+			by();
+			return [...devInvites];
+		}
+	};
+}
+//#endregion
+export { useWervtAccess };

package/dist/runtime/server/agent-token-plugin.d.ts

@@ -0,0 +1,13 @@
+//#region src/runtime/server/agent-token-plugin.d.ts
+interface EnrichContext {
+  event: Record<string, unknown>;
+  headers?: Record<string, string>;
+}
+interface NitroAppHooks {
+  hooks: {
+    hook(name: 'evlog:enrich', handler: (ctx: EnrichContext) => void): unknown;
+  };
+}
+export default function wervtAgentToken(nitroApp: NitroAppHooks): void;
+//#endregion
+export {};

package/dist/runtime/server/agent-token-plugin.js

@@ -0,0 +1,10 @@
+import { parseAgentToken } from "../shared/agent-token.js";
+//#region src/runtime/server/agent-token-plugin.ts
+function wervtAgentToken(nitroApp) {
+	nitroApp.hooks.hook("evlog:enrich", (ctx) => {
+		const agentToken = parseAgentToken(ctx.headers?.["x-wervt-agent-token"]);
+		if (agentToken) ctx.event.agentToken = agentToken;
+	});
+}
+//#endregion
+export { wervtAgentToken as default };

package/dist/runtime/server/anthropic.d.ts

@@ -0,0 +1,21 @@
+import Anthropic from "@anthropic-ai/sdk";
+//#region src/runtime/server/anthropic.d.ts
+export interface UseAnthropicOptions {
+  /**
+   * The key for `nuxt dev`, where there is no workload identity. Default: `ANTHROPIC_API_KEY`.
+   * Never used on wervt.
+   */
+  devApiKey?: string;
+}
+/**
+ * An Anthropic client that authenticates as this app through its wervt identity: no API key, only
+ * IDs from the Anthropic Console in the app's env (`ANTHROPIC_FEDERATION_RULE_ID`,
+ * `ANTHROPIC_ORGANIZATION_ID`, optionally `ANTHROPIC_SERVICE_ACCOUNT_ID` and
+ * `ANTHROPIC_WORKSPACE_ID`). The SDK trades an identity token for an Anthropic token and renews it
+ * before it runs out.
+ *
+ * Needs `wervt identity enable <app>` and a federation rule for the app's subject
+ * (`wervt identity status <app>`). In `nuxt dev` it uses `options.devApiKey` instead.
+ */
+export declare function useAnthropic(options?: UseAnthropicOptions): Anthropic;
+//#endregion

package/dist/runtime/server/anthropic.js

@@ -0,0 +1,53 @@
+import { useWorkloadIdentity } from "./identity.js";
+import { createError } from "nuxt/server";
+import Anthropic from "@anthropic-ai/sdk";
+import { oidcFederationProvider } from "@anthropic-ai/sdk/lib/credentials/oidc-federation";
+//#region src/runtime/server/anthropic.ts
+const BASE_URL = "https://api.anthropic.com";
+let client;
+/**
+* An Anthropic client that authenticates as this app through its wervt identity: no API key, only
+* IDs from the Anthropic Console in the app's env (`ANTHROPIC_FEDERATION_RULE_ID`,
+* `ANTHROPIC_ORGANIZATION_ID`, optionally `ANTHROPIC_SERVICE_ACCOUNT_ID` and
+* `ANTHROPIC_WORKSPACE_ID`). The SDK trades an identity token for an Anthropic token and renews it
+* before it runs out.
+*
+* Needs `wervt identity enable <app>` and a federation rule for the app's subject
+* (`wervt identity status <app>`). In `nuxt dev` it uses `options.devApiKey` instead.
+*/
+function useAnthropic(options = {}) {
+	return client ??= create(options);
+}
+function create(options) {
+	if (!process.env.WERVT_RUNTIME_URL) {
+		const apiKey = options.devApiKey ?? process.env.ANTHROPIC_API_KEY;
+		if (!apiKey) throw createError({
+			status: 503,
+			message: "useAnthropic() in `nuxt dev` needs an API key (ANTHROPIC_API_KEY or devApiKey)."
+		});
+		return new Anthropic({ apiKey });
+	}
+	const federationRuleId = process.env.ANTHROPIC_FEDERATION_RULE_ID;
+	const organizationId = process.env.ANTHROPIC_ORGANIZATION_ID;
+	if (!federationRuleId || !organizationId) throw createError({
+		status: 503,
+		message: "useAnthropic() needs ANTHROPIC_FEDERATION_RULE_ID and ANTHROPIC_ORGANIZATION_ID (wervt env <app> --set …)."
+	});
+	const identity = useWorkloadIdentity();
+	return new Anthropic({
+		apiKey: null,
+		authToken: null,
+		baseURL: BASE_URL,
+		credentials: oidcFederationProvider({
+			identityTokenProvider: () => identity.token(BASE_URL),
+			federationRuleId,
+			organizationId,
+			serviceAccountId: process.env.ANTHROPIC_SERVICE_ACCOUNT_ID || void 0,
+			workspaceId: process.env.ANTHROPIC_WORKSPACE_ID || void 0,
+			baseURL: BASE_URL,
+			fetch: (...args) => fetch(...args)
+		})
+	});
+}
+//#endregion
+export { useAnthropic };

package/dist/runtime/server/identity.d.ts

@@ -0,0 +1,20 @@
+//#region src/runtime/server/identity.d.ts
+export interface WorkloadIdentity {
+  /**
+   * A fresh JWT that says "I am this wervt app", for `audience` (a provider on wervt's list, e.g.
+   * `https://api.anthropic.com`). Valid for 5 minutes and single-use: trade it for a provider
+   * token right away. Each call signs a new one; providers' SDKs cache what they get for it.
+   */
+  token(audience: string): Promise<string>;
+}
+/**
+ * The app's workload identity: tokens signed by wervt's issuer, so the app can authenticate to an
+ * AI provider (Anthropic's Workload Identity Federation) without an API key. Its owner turns it
+ * on with `wervt identity enable <app>`; `useAnthropic()` (`@wervt/nuxt/anthropic`) uses it.
+ *
+ * Throws with the platform's status: 403 when the app has no identity, 400 for an audience wervt
+ * doesn't sign for, 429 past 10 tokens a minute, 503 when the issuer is off. In `nuxt dev` there
+ * is no issuer, so it always throws.
+ */
+export declare function useWorkloadIdentity(): WorkloadIdentity;
+//#endregion

package/dist/runtime/server/identity.js

@@ -0,0 +1,37 @@
+import { createError } from "nuxt/server";
+//#region src/runtime/server/identity.ts
+/**
+* The app's workload identity: tokens signed by wervt's issuer, so the app can authenticate to an
+* AI provider (Anthropic's Workload Identity Federation) without an API key. Its owner turns it
+* on with `wervt identity enable <app>`; `useAnthropic()` (`@wervt/nuxt/anthropic`) uses it.
+*
+* Throws with the platform's status: 403 when the app has no identity, 400 for an audience wervt
+* doesn't sign for, 429 past 10 tokens a minute, 503 when the issuer is off. In `nuxt dev` there
+* is no issuer, so it always throws.
+*/
+function useWorkloadIdentity() {
+	return { async token(audience) {
+		const runtime = process.env.WERVT_RUNTIME_URL;
+		if (!runtime) throw createError({
+			status: 503,
+			message: "Workload identity only exists on wervt, not in `nuxt dev`."
+		});
+		const res = await fetch(new URL("/_wervt/identity-token", runtime), {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				"x-wervt-app": process.env.WERVT_APP ?? "",
+				"x-wervt-token": process.env.WERVT_TOKEN ?? ""
+			},
+			body: JSON.stringify({ audience })
+		});
+		const body = await res.json().catch(() => ({}));
+		if (!res.ok || !body.token) throw createError({
+			status: res.status,
+			message: body.error ?? `identity token failed (${res.status})`
+		});
+		return body.token;
+	} };
+}
+//#endregion
+export { useWorkloadIdentity };

package/dist/runtime/server/index.d.ts

@@ -1,6 +1,8 @@
-import { WervtUser } from "../shared/user.js";
+import { WervtRole, WervtUser } from "../shared/user.js";
 import { EmailProps, RenderedEmail, renderEmail } from "../email/render.js";
+import { WervtAccess, WervtInvite, useWervtAccess } from "./access.js";
 import { useDb } from "./db.js";
+import { WorkloadIdentity, useWorkloadIdentity } from "./identity.js";
 import { createEvlogError, log, useLogger } from "./logger.js";
 import { SendMailOptions, sendMail } from "./mail.js";
 import { McpTokenContext } from "./mcp-auth.js";
@@ -10,5 +12,5 @@ import { ShapeOptions, ShapeRow, proxyShape } from "./shape.js";
 import { Task, TaskEvent, TaskResult, defineTask } from "./tasks.js";
 import { SafeResult, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, vh } from "./validate.js";
 import { Tool, ToolRoute, defineTool, defineToolRoute } from "./tools.js";
-import { useWervtUser } from "./user.js";
-export { type EmailProps, type McpTokenContext, type RenderedEmail, type SafeResult, type SendMailOptions, type ShapeOptions, type ShapeResponse, type ShapeRow, type Task, type TaskEvent, type TaskResult, type Tool, type ToolRoute, type WervtUser, createEvlogError, defineTask, defineTool, defineToolRoute, log, proxyShape, renderEmail, seedTable, sendMail, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtUser, vh };
+import { requireWervtRole, useWervtUser } from "./user.js";
+export { type EmailProps, type McpTokenContext, type RenderedEmail, type SafeResult, type SendMailOptions, type ShapeOptions, type ShapeResponse, type ShapeRow, type Task, type TaskEvent, type TaskResult, type Tool, type ToolRoute, type WervtAccess, type WervtInvite, type WervtRole, type WervtUser, type WorkloadIdentity, createEvlogError, defineTask, defineTool, defineToolRoute, log, proxyShape, renderEmail, requireWervtRole, seedTable, sendMail, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtAccess, useWervtUser, useWorkloadIdentity, vh };

package/dist/runtime/server/index.js

@@ -1,4 +1,6 @@
 import { renderEmail } from "../email/render.js";
+import { useWervtAccess } from "./access.js";
+import { useWorkloadIdentity } from "./identity.js";
 import { useDb } from "./db.js";
 import { createEvlogError, log, useLogger } from "./logger.js";
 import { sendMail } from "./mail.js";
@@ -7,5 +9,5 @@ import { proxyShape } from "./shape.js";
 import { defineTask } from "./tasks.js";
 import { useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, vh } from "./validate.js";
 import { defineTool, defineToolRoute } from "./tools.js";
-import { useWervtUser } from "./user.js";
-export { createEvlogError, defineTask, defineTool, defineToolRoute, log, proxyShape, renderEmail, seedTable, sendMail, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtUser, vh };
+import { requireWervtRole, useWervtUser } from "./user.js";
+export { createEvlogError, defineTask, defineTool, defineToolRoute, log, proxyShape, renderEmail, requireWervtRole, seedTable, sendMail, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtAccess, useWervtUser, useWorkloadIdentity, vh };

package/dist/runtime/server/task-handlers.d.ts

@@ -25,4 +25,5 @@ export declare function taskListHandler(tasks: Registry): import("nuxt/server").
 }[] | {
   error: string;
 }>>;
-//#endregion
+//#endregion
+export {};

package/dist/runtime/server/tools.d.ts

@@ -48,4 +48,5 @@ export declare const TOOL_ROUTE: unique symbol;
 export declare function defineToolRoute<R, P extends Input | undefined = undefined, I extends Input | undefined = undefined>(route: ToolRoute<P, I, R>): import("nuxt/server").EventHandler<Promise<R>> & {
   [TOOL_ROUTE]: Tool<Input | undefined, unknown>;
 };
-//#endregion
+//#endregion
+export {};

package/dist/runtime/server/user.d.ts

@@ -1,4 +1,4 @@
-import { DEV_LOGIN_COOKIE, WervtUser, parseWervtUser } from "../shared/user.js";
+import { DEV_LOGIN_COOKIE, WervtRole, WervtUser, parseWervtUser } from "../shared/user.js";
 import { RequestEvent } from "nuxt/server";
 //#region src/runtime/server/user.d.ts
 /**
@@ -7,6 +7,12 @@ import { RequestEvent } from "nuxt/server";
  * apps get one when the visitor is signed in. Send people to `/_wervt/login` to sign in.
  * In a tool called over MCP, it's the user the client signed in as.
  */
-export declare const useWervtUser: (event: RequestEvent) => WervtUser | undefined;
+export declare function useWervtUser(event: RequestEvent): WervtUser | undefined;
+/**
+ * The signed-in user if their role is one of `roles`, e.g.
+ * `requireWervtRole(event, 'owner', 'member', 'admin')` for the app's own admin features.
+ * Throws 401 without a signed-in user, 403 with another role.
+ */
+export declare function requireWervtRole(event: RequestEvent, ...roles: WervtRole[]): WervtUser;
 //#endregion
-export { DEV_LOGIN_COOKIE, type WervtUser, parseWervtUser };
+export { DEV_LOGIN_COOKIE, type WervtRole, type WervtUser, parseWervtUser };

package/dist/runtime/server/user.js

@@ -1,5 +1,5 @@
 import { DEV_LOGIN_COOKIE, devUser, parseWervtUser } from "../shared/user.js";
-import { getCookie } from "nuxt/server";
+import { createError, getCookie } from "nuxt/server";
 //#region src/runtime/server/user.ts
 const MCP_USER = "wervtMcpUser";
 /**
@@ -8,6 +8,31 @@ const MCP_USER = "wervtMcpUser";
 * apps get one when the visitor is signed in. Send people to `/_wervt/login` to sign in.
 * In a tool called over MCP, it's the user the client signed in as.
 */
-const useWervtUser = (event) => event.context[MCP_USER] ?? parseWervtUser(event.req.headers.get("x-wervt-user")) ?? devUser(getCookie(event, "wervt_dev_login") === "1");
+function useWervtUser(event) {
+	const header = parseWervtUser(event.req.headers.get("x-wervt-user"));
+	const mcp = event.context[MCP_USER];
+	if (mcp) return mcp.role || header?.id !== mcp.id ? mcp : {
+		...mcp,
+		role: header.role
+	};
+	return header ?? devUser(getCookie(event, "wervt_dev_login") === "1");
+}
+/**
+* The signed-in user if their role is one of `roles`, e.g.
+* `requireWervtRole(event, 'owner', 'member', 'admin')` for the app's own admin features.
+* Throws 401 without a signed-in user, 403 with another role.
+*/
+function requireWervtRole(event, ...roles) {
+	const user = useWervtUser(event);
+	if (!user) throw createError({
+		status: 401,
+		message: "sign in at /_wervt/login first"
+	});
+	if (!user.role || !roles.includes(user.role)) throw createError({
+		status: 403,
+		message: `needs role ${roles.join(", ")}`
+	});
+	return user;
+}
 //#endregion
-export { DEV_LOGIN_COOKIE, parseWervtUser, useWervtUser };
+export { DEV_LOGIN_COOKIE, parseWervtUser, requireWervtRole, useWervtUser };

package/dist/runtime/server/validate.d.ts

@@ -40,4 +40,5 @@ export declare const vh: {
   /** Positive integer id (e.g. a serial primary key) → number. */
   id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.DigitsAction<string, undefined>, v.TransformAction<any, number>, v.SafeIntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>;
 };
-//#endregion
+//#endregion
+export {};

package/dist/runtime/shared/agent-token.d.ts

@@ -0,0 +1,9 @@
+//#region src/runtime/shared/agent-token.d.ts
+/** Who minted the agent token a request came with, and its id (the control plane's log). */
+export interface AgentToken {
+  id: string;
+  by: string;
+}
+/** Parses the `x-wervt-agent-token` header the runtime sets (and strips from client requests). */
+export declare function parseAgentToken(header: string | null | undefined): AgentToken | undefined;
+//#endregion

package/dist/runtime/shared/agent-token.js

@@ -0,0 +1,17 @@
+//#region src/runtime/shared/agent-token.ts
+/** Parses the `x-wervt-agent-token` header the runtime sets (and strips from client requests). */
+function parseAgentToken(header) {
+	if (!header) return void 0;
+	try {
+		const value = JSON.parse(decodeURIComponent(header));
+		if (typeof value?.id !== "string" || typeof value.by !== "string") return void 0;
+		return {
+			id: value.id,
+			by: value.by
+		};
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { parseAgentToken };

package/dist/runtime/shared/shape.d.ts

@@ -15,4 +15,5 @@ export declare const shapeParser: {
   timestamp: typeof parseTimestamp;
   timestamptz: typeof parseTimestamp;
 };
-//#endregion
+//#endregion
+export {};

package/dist/runtime/shared/user.d.ts

@@ -1,4 +1,10 @@
 //#region src/runtime/shared/user.d.ts
+/**
+ * What the user is to this app: its `owner` or one of its `member`s (`wervt members`), a wervt
+ * `admin`, someone `invited` through the app (invite-only apps) or `allowed` by the app's list
+ * (`wervt access --add`). `public` is anyone else signed in to a public app.
+ */
+export type WervtRole = 'owner' | 'member' | 'admin' | 'invited' | 'allowed' | 'public';
 export interface WervtUser {
   id: string;
   email: string;
@@ -6,6 +12,8 @@ export interface WervtUser {
   image?: string;
   /** Linked login accounts, provider id to the user's id there, e.g. `{ twitch: '1234' }`. */
   accounts?: Record<string, string>;
+  /** Missing only for users an app's own `/mcp` tokens stand for (`wervt:mcp:token`). */
+  role?: WervtRole;
 }
 /** Cookie set by the dev stand-in for `/_wervt/login` (see `server/dev-auth.ts`). */
 export declare const DEV_LOGIN_COOKIE = "wervt_dev_login";

package/dist/runtime/shared/user.js

@@ -14,7 +14,10 @@ function parseWervtUser(header) {
 function devUser(loggedIn) {
 	const user = process.env.WERVT_DEV_USER;
 	if (!import.meta.dev || !loggedIn || !user) return void 0;
-	return JSON.parse(user);
+	return {
+		role: "owner",
+		...JSON.parse(user)
+	};
 }
 //#endregion
 export { DEV_LOGIN_COOKIE, devUser, parseWervtUser };