@wervt/nuxt 0.3.1 → 0.3.3

package/dist/storage.d.ts

@@ -13,14 +13,61 @@ export interface StorageUsage {
   bytes: number;
   /** Multipart uploads started but never completed or aborted. */
   unfinishedUploads: number;
+  /** The bucket's size limit in bytes, null for none. */
+  maxBytes: number | null;
+}
+export interface StorageQuota {
+  /** Bytes the bucket may hold; null for no limit. Garage refuses uploads past it. */
+  maxBytes: number | null;
 }
 export declare class StorageError extends Error {}
+export interface StoredObject {
+  key: string;
+  size: number;
+  /** ISO time. */
+  lastModified: string;
+}
+export interface ObjectListing {
+  prefix: string;
+  /** Prefixes one level below `prefix`, ending in `/`. */
+  folders: string[];
+  files: StoredObject[];
+  /** Pass as `token` for the next page. */
+  next?: string;
+}
+export interface ObjectDetails extends StoredObject {
+  contentType: string | null;
+  /** `x-amz-meta-*` headers, without the prefix. */
+  metadata: Record<string, string>;
+}
+/** S3's limit for object keys, in bytes. */
+export declare const MAX_KEY_BYTES = 1024;
 export declare function createStorage(options: StorageOptions): {
   ensureLayout: () => Promise<void>;
-  provision: (app: string, appOrigin: string) => Promise<{
+  provision: (app: string, appOrigin: string, quota?: StorageQuota) => Promise<{
     bucket: string;
   }>;
+  setQuota: (app: string, quota: StorageQuota) => Promise<boolean>;
   usage: (app: string) => Promise<StorageUsage | undefined>;
+  list: (app: string, { prefix, token, limit }?: {
+    prefix?: string;
+    token?: string;
+    limit?: number;
+  }) => Promise<ObjectListing | undefined>;
+  describe: (app: string, key: string) => Promise<ObjectDetails | undefined>;
+  downloadUrl: (app: string, key: string, { publicUrl, expiresIn }: {
+    publicUrl: string;
+    expiresIn?: number;
+  }) => Promise<string>;
+  remove: (app: string, key: string) => Promise<{
+    deleted: string[];
+  } | undefined>;
+  sweepAbandonedUploads: (app: string, { graceMs, now }?: {
+    graceMs?: number | undefined;
+    now?: number | undefined;
+  }) => Promise<{
+    deleted: string[];
+  }>;
   drop: (app: string) => Promise<void>;
 };
 //#endregion

package/dist/storage.js

@@ -2,6 +2,75 @@ import { storageCredentials } from "./provision.js";
 import { AwsClient } from "aws4fetch";
 //#region src/storage.ts
 var StorageError = class extends Error {};
+/**
+* ablage marks bytes uploaded straight from browsers (`x-amz-meta-ablage-direct-upload`). Its
+* metadata object (`<group>/meta/<id>`) is only written once `completeUpload()` has checked them,
+* so marked bytes without one belong to an upload that was never completed.
+*/
+const DIRECT_UPLOAD_MARKER = "x-amz-meta-ablage-direct-upload";
+/**
+* How old abandoned direct-upload bytes must be before the sweep deletes them. The browser calls
+* `completeUpload()` right after its `PUT` finishes, so a day leaves any upload in flight alone;
+* it matches the lifecycle rule for multipart uploads.
+*/
+const ABANDONED_UPLOAD_GRACE_MS = 864e5;
+/** ablage's S3 layout: `<group>/data/<id>` holds the bytes, `<group>/meta/<id>` the metadata. */
+function metaKeyOf(key) {
+	const parts = key.split("/");
+	if (parts.length < 3 || parts.at(-2) !== "data" || !parts.at(-1)) return void 0;
+	return [
+		...parts.slice(0, -2),
+		"meta",
+		parts.at(-1)
+	].join("/");
+}
+const unescapeXml = (text) => text.replace(/&(amp|lt|gt|quot|apos|#x?[0-9a-f]+);/gi, (_, entity) => {
+	const named = {
+		amp: "&",
+		lt: "<",
+		gt: ">",
+		quot: "\"",
+		apos: "'"
+	};
+	if (entity in named) return named[entity];
+	const hex = entity[1] === "x" || entity[1] === "X";
+	return String.fromCodePoint(parseInt(entity.slice(hex ? 2 : 1), hex ? 16 : 10));
+});
+/**
+* Objects of a ListObjectsV2 page, its folders (listed with a delimiter), and the token for the
+* next page.
+*/
+function parseObjectList(xml) {
+	const objects = [...xml.matchAll(/<Contents>([\s\S]*?)<\/Contents>/g)].map(([, entry]) => ({
+		key: unescapeXml(/<Key>([^<]*)<\/Key>/.exec(entry)?.[1] ?? ""),
+		lastModified: Date.parse(/<LastModified>([^<]*)<\/LastModified>/.exec(entry)?.[1] ?? ""),
+		size: Number(/<Size>([^<]*)<\/Size>/.exec(entry)?.[1] ?? 0)
+	}));
+	const prefixes = [...xml.matchAll(/<CommonPrefixes>([\s\S]*?)<\/CommonPrefixes>/g)].map(([, entry]) => unescapeXml(/<Prefix>([^<]*)<\/Prefix>/.exec(entry)?.[1] ?? ""));
+	const next = /<IsTruncated>true<\/IsTruncated>/.test(xml) ? /<NextContinuationToken>([^<]*)<\/NextContinuationToken>/.exec(xml)?.[1] : void 0;
+	return {
+		objects,
+		prefixes,
+		next: next === void 0 ? void 0 : unescapeXml(next)
+	};
+}
+/**
+* ablage keeps a file as bytes and metadata, which only make sense together: the metadata key
+* for bytes, the bytes for metadata, undefined for anything else.
+*/
+function companionKeyOf(key) {
+	const meta = metaKeyOf(key);
+	if (meta !== void 0) return meta;
+	const parts = key.split("/");
+	if (parts.length < 3 || parts.at(-2) !== "meta" || !parts.at(-1)) return void 0;
+	return [
+		...parts.slice(0, -2),
+		"data",
+		parts.at(-1)
+	].join("/");
+}
+/** S3's limit for object keys, in bytes. */
+const MAX_KEY_BYTES = 1024;
 function createStorage(options) {
 	async function admin(path, body) {
 		const res = await fetch(`${options.adminUrl}/v2/${path}`, {
@@ -52,8 +121,9 @@ function createStorage(options) {
 	/**
 	* Creates the app's bucket and key if they're missing, lets the app's origin upload and
 	* download from browsers (CORS), and cleans up abandoned uploads. Safe to run on every deploy.
+	* With `quota`, sets the bucket's size limit too; without, leaves it as it is.
 	*/
-	async function provision(app, appOrigin) {
+	async function provision(app, appOrigin, quota) {
 		const { creds, client, base } = await s3(app);
 		const bucket = await exists(`GetBucketInfo?globalAlias=${creds.bucket}`) ?? await admin("CreateBucket", { globalAlias: creds.bucket });
 		if (!await exists(`GetKeyInfo?id=${creds.accessKeyId}`)) await admin("ImportKey", {
@@ -70,6 +140,7 @@ function createStorage(options) {
 				owner: true
 			}
 		});
+		if (quota) await applyQuota(bucket.id, quota);
 		const cors = `<CORSConfiguration><CORSRule>
 <AllowedOrigin>${appOrigin}</AllowedOrigin>
 <AllowedMethod>GET</AllowedMethod><AllowedMethod>HEAD</AllowedMethod>
@@ -92,6 +163,20 @@ function createStorage(options) {
 		if (!rules.ok) throw new StorageError(`setting the lifecycle for ${creds.bucket}: ${await rules.text()}`);
 		return { bucket: creds.bucket };
 	}
+	function applyQuota(bucketId, quota) {
+		return admin(`UpdateBucket?id=${bucketId}`, { quotas: {
+			maxSize: quota.maxBytes,
+			maxObjects: null
+		} });
+	}
+	/** Changes the size limit of an existing bucket. False when the app has no bucket yet. */
+	async function setQuota(app, quota) {
+		const { creds } = await s3(app);
+		const bucket = await exists(`GetBucketInfo?globalAlias=${creds.bucket}`);
+		if (!bucket) return false;
+		await applyQuota(bucket.id, quota);
+		return true;
+	}
 	async function usage(app) {
 		const { creds } = await s3(app);
 		const info = await exists(`GetBucketInfo?globalAlias=${creds.bucket}`);
@@ -100,9 +185,48 @@ function createStorage(options) {
 			bucket: creds.bucket,
 			objects: info.objects,
 			bytes: info.bytes,
-			unfinishedUploads: info.unfinishedMultipartUploads
+			unfinishedUploads: info.unfinishedMultipartUploads,
+			maxBytes: info.quotas?.maxSize ?? null
 		};
 	}
+	/**
+	* Deletes the bytes of direct uploads that were never completed: marked by ablage, older than
+	* `graceMs` and without a metadata object. ablage never lists them, but they count against the
+	* bucket quota. Safe to run any time and as often as wanted.
+	*/
+	async function sweepAbandonedUploads(app, { graceMs = ABANDONED_UPLOAD_GRACE_MS, now = Date.now() } = {}) {
+		const { creds, client, base } = await s3(app);
+		if (!await exists(`GetBucketInfo?globalAlias=${creds.bucket}`)) return { deleted: [] };
+		const url = (key) => `${base}/${key.split("/").map(encodeURIComponent).join("/")}`;
+		const candidates = /* @__PURE__ */ new Map();
+		let token;
+		do {
+			const query = `list-type=2&max-keys=1000${token ? `&continuation-token=${encodeURIComponent(token)}` : ""}`;
+			const res = await client.fetch(`${base}?${query}`);
+			if (!res.ok) throw new StorageError(`listing ${creds.bucket}: ${await res.text()}`);
+			const page = parseObjectList(await res.text());
+			for (const object of page.objects) {
+				candidates.delete(object.key);
+				const metaKey = metaKeyOf(object.key);
+				if (metaKey !== void 0 && now - object.lastModified >= graceMs) candidates.set(metaKey, object.key);
+			}
+			token = page.next;
+		} while (token);
+		const deleted = [];
+		for (const [metaKey, key] of candidates) {
+			const head = await client.fetch(url(key), { method: "HEAD" });
+			if (head.status === 404) continue;
+			if (!head.ok) throw new StorageError(`checking ${key} in ${creds.bucket}: ${head.status}`);
+			if (!head.headers.get(DIRECT_UPLOAD_MARKER)) continue;
+			const meta = await client.fetch(url(metaKey), { method: "HEAD" });
+			if (meta.ok) continue;
+			if (meta.status !== 404) throw new StorageError(`checking ${metaKey} in ${creds.bucket}: ${meta.status}`);
+			const res = await client.fetch(url(key), { method: "DELETE" });
+			if (!res.ok && res.status !== 404) throw new StorageError(`deleting ${key} in ${creds.bucket}: ${await res.text()}`);
+			deleted.push(key);
+		}
+		return { deleted };
+	}
 	/** Deletes every object and unfinished upload, then the bucket. Only with "drop data". */
 	async function drop(app) {
 		const { creds, client, base } = await s3(app);
@@ -133,12 +257,102 @@ function createStorage(options) {
 			await admin(`DeleteBucket?id=${String(bucket.id)}`, {});
 		}
 	}
+	const objectUrl = (base, key) => `${base}/${key.split("/").map(encodeURIComponent).join("/")}`;
+	/**
+	* One page of the bucket, one folder level at a time like a file browser: the files directly
+	* in `prefix` and the folders below it. Undefined when the app has no bucket.
+	*/
+	async function list(app, { prefix = "", token, limit = 200 } = {}) {
+		const { creds, client, base } = await s3(app);
+		const query = new URLSearchParams({
+			"list-type": "2",
+			delimiter: "/",
+			prefix,
+			"max-keys": String(Math.min(Math.max(limit, 1), 1e3))
+		});
+		if (token) query.set("continuation-token", token);
+		const res = await client.fetch(`${base}?${query.toString()}`);
+		if (res.status === 404) return void 0;
+		if (!res.ok) throw new StorageError(`listing ${creds.bucket}: ${await res.text()}`);
+		const page = parseObjectList(await res.text());
+		return {
+			prefix,
+			folders: page.prefixes,
+			files: page.objects.map((object) => ({
+				key: object.key,
+				size: object.size,
+				lastModified: new Date(object.lastModified).toISOString()
+			})),
+			next: page.next
+		};
+	}
+	/** Size, type and metadata of one object; undefined when it doesn't exist. */
+	async function describe(app, key) {
+		const { creds, client, base } = await s3(app);
+		const res = await client.fetch(objectUrl(base, key), { method: "HEAD" });
+		if (res.status === 404) return void 0;
+		if (!res.ok) throw new StorageError(`reading ${key} in ${creds.bucket}: ${res.status}`);
+		const metadata = {};
+		for (const [name, value] of res.headers) if (name.startsWith("x-amz-meta-")) metadata[name.slice(11)] = value;
+		const modified = res.headers.get("last-modified");
+		return {
+			key,
+			size: Number(res.headers.get("content-length") ?? 0),
+			lastModified: modified ? new Date(modified).toISOString() : "",
+			contentType: res.headers.get("content-type"),
+			metadata
+		};
+	}
+	/**
+	* A presigned download link on `publicUrl`, the S3 API as browsers reach it, so files go from
+	* Garage straight to the browser. Always an attachment, never shown inline: the file is the
+	* app's users' content and may well be HTML.
+	*/
+	async function downloadUrl(app, key, { publicUrl, expiresIn = 300 }) {
+		const { creds, client } = await s3(app);
+		const url = new URL(objectUrl(`${publicUrl.replace(/\/$/, "")}/${creds.bucket}`, key));
+		const name = key.split("/").at(-1) || "download";
+		const ascii = name.replace(/[^\x20-\x7e]|["\\]/g, "_");
+		url.searchParams.set("response-content-disposition", `attachment; filename="${ascii}"; filename*=UTF-8''${encodeURIComponent(name)}`);
+		url.searchParams.set("X-Amz-Expires", String(expiresIn));
+		return (await client.sign(url.toString(), {
+			method: "GET",
+			aws: { signQuery: true }
+		})).url;
+	}
+	/**
+	* Deletes one object, and its ablage companion (see companionKeyOf) so ablage never lists a
+	* file whose bytes are gone. Undefined when the object doesn't exist.
+	*/
+	async function remove(app, key) {
+		const { creds, client, base } = await s3(app);
+		const present = async (k) => {
+			const res = await client.fetch(objectUrl(base, k), { method: "HEAD" });
+			if (res.status === 404) return false;
+			if (!res.ok) throw new StorageError(`checking ${k} in ${creds.bucket}: ${res.status}`);
+			return true;
+		};
+		if (!await present(key)) return void 0;
+		const companion = companionKeyOf(key);
+		const keys = companion !== void 0 && await present(companion) ? [key, companion] : [key];
+		for (const k of keys) {
+			const res = await client.fetch(objectUrl(base, k), { method: "DELETE" });
+			if (!res.ok && res.status !== 404) throw new StorageError(`deleting ${k} in ${creds.bucket}: ${await res.text()}`);
+		}
+		return { deleted: keys };
+	}
 	return {
 		ensureLayout,
 		provision,
+		setQuota,
 		usage,
+		list,
+		describe,
+		downloadUrl,
+		remove,
+		sweepAbandonedUploads,
 		drop
 	};
 }
 //#endregion
-export { StorageError, createStorage };
+export { ABANDONED_UPLOAD_GRACE_MS, MAX_KEY_BYTES, StorageError, companionKeyOf, createStorage, metaKeyOf, parseObjectList };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wervt/nuxt",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Nuxt module for apps hosted on wervt: database, live data, MCP and runtime setup.",
   "keywords": [
     "drizzle",
@@ -37,6 +37,10 @@
       "types": "./dist/runtime/email/index.d.ts",
       "default": "./dist/runtime/email/index.js"
     },
+    "./anthropic": {
+      "types": "./dist/runtime/server/anthropic.d.ts",
+      "default": "./dist/runtime/server/anthropic.js"
+    },
     "./provision": {
       "types": "./dist/provision.d.ts",
       "default": "./dist/provision.js"
@@ -46,7 +50,7 @@
     "@electric-sql/client": "^1.5.28",
     "@valibot/to-json-schema": "^1.8.0",
     "aws4fetch": "^1.0.20",
-    "evlog": "^2.30.1",
+    "evlog": "^2.33.1",
     "h3-mcp": "0.2.0",
     "html-to-text": "^9.0.5",
     "jose": "^6.2.12",
@@ -54,19 +58,24 @@
     "valibot": "^1.5.0"
   },
   "devDependencies": {
+    "@anthropic-ai/sdk": "^0.97.1",
     "@types/html-to-text": "^9.0.4",
-    "drizzle-orm": "1.0.0-rc.4",
-    "h3": "2.0.2",
+    "drizzle-orm": "1.0.0-rc.5",
+    "h3": "2.0.5",
     "nitro": "3.0.260903-beta",
     "nuxt": "npm:nuxt-nightly@5x",
-    "vue": "^3.5.43"
+    "vue": "^3.5.44"
   },
   "peerDependencies": {
-    "drizzle-orm": "1.0.0-rc.4",
+    "@anthropic-ai/sdk": ">=0.97.1",
+    "drizzle-orm": ">=1.0.0-rc.5 <2",
     "h3": "^2.0.1",
     "nuxt": ">=4.2"
   },
   "peerDependenciesMeta": {
+    "@anthropic-ai/sdk": {
+      "optional": true
+    },
     "h3": {
       "optional": true
     }