@wervt/nuxt 0.3.2 → 0.3.4

package/README.md

@@ -20,6 +20,8 @@ export default defineNuxtConfig({
 - `useWervtUser()`: the signed-in wervt user, on the server and in the app.
 - `useWervtAccess(event)`: invites on invite-only apps (`wervt access <app> --invite`), as the
   signed-in user.
+- `useAnthropic()` (`@wervt/nuxt/anthropic`): an Anthropic client without an API key, through the
+  app's wervt identity (`wervt identity enable <app>`); `useWorkloadIdentity()` for the raw token.
 - `useValidatedBody()` / `useValidatedQuery()` / `useValidatedParams()`: valibot validation.
 - `useWervtTrack()`: custom events for wervt's cookieless analytics (page views are counted automatically).
 - `wervt: { feedback: { key } }` and `useWervtFeedback()`: the kontor feedback widget, reports go into a kontor project's triage.

package/dist/dev.d.ts

@@ -1,5 +1,5 @@
+import { WervtRole } from "./runtime/shared/user.js";
 import "nuxt/schema";
-//#region src/dev.d.ts
 export interface DevOptions {
   /** Superuser URL of the local wervt Postgres. */
   adminUrl?: string;
@@ -18,7 +18,7 @@ export interface DevOptions {
   seed?: boolean;
   /**
    * Who `/_wervt/login` signs in as during `nuxt dev` (there's no wervt auth locally).
-   * Defaults to a dev user with a Twitch account linked.
+   * Defaults to a dev user with a Twitch account linked. Without `role`, they're the app's owner.
    */
   user?: {
     id: string;
@@ -26,6 +26,6 @@ export interface DevOptions {
     name?: string;
     image?: string;
     accounts?: Record<string, string>;
+    role?: WervtRole;
   };
-}
-//#endregion
+}

package/dist/dev.js

@@ -1,11 +1,11 @@
 import { createStorage } from "./storage.js";
-import { appDatabaseUrl, dbRole, provisionDatabase, storageCredentials } from "./provision.js";
+import { appDatabaseUrl, dbRole, migrateAs, provisionDatabase, storageCredentials } from "./provision.js";
 import { SEED_TASK, runDevSeed } from "./seed.js";
 import { useLogger } from "nuxt/kit";
 import { existsSync, watch } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
-//#region src/dev.ts
+// src/dev.ts
 const DEFAULTS = {
 	adminUrl: "postgres://postgres:postgres@localhost:5432/wervt",
 	dbSecret: "dev-secret",
@@ -22,6 +22,7 @@ const logger = useLogger("wervt");
 * points the dev server at the app's database and Electric.
 */
 async function setupDev(nuxt, app, options, features = {}) {
+	forgetOwnEnv(nuxt.options.rootDir);
 	const config = {
 		adminUrl: process.env.WERVT_PG_ADMIN_URL ?? options.adminUrl ?? DEFAULTS.adminUrl,
 		dbSecret: process.env.WERVT_DB_SECRET ?? options.dbSecret ?? DEFAULTS.dbSecret,
@@ -43,13 +44,18 @@ async function setupDev(nuxt, app, options, features = {}) {
 		secret: config.dbSecret,
 		migrationsFolder
 	};
+	const given = process.env.DATABASE_URL && process.env.WERVT_DB_SCHEMA ? {
+		url: process.env.DATABASE_URL,
+		schema: process.env.WERVT_DB_SCHEMA
+	} : void 0;
+	const database = given?.schema ?? dbRole(app);
 	let serverUrl;
 	let seedPending = false;
 	const seed = async () => {
 		if (!seedPending || !serverUrl) return;
 		seedPending = false;
 		try {
-			if ((await runDevSeed(serverUrl)).status === "seeded") logger.success(`Seeded \`${dbRole(app)}\` (${SEED_TASK})`);
+			if ((await runDevSeed(serverUrl)).status === "seeded") logger.success(`Seeded \`${database}\` (${SEED_TASK})`);
 		} catch (e) {
 			logger.warn(`\`${SEED_TASK}\` failed:`, e instanceof Error ? e.message : e);
 		}
@@ -60,21 +66,29 @@ async function setupDev(nuxt, app, options, features = {}) {
 	});
 	const migrate = async () => {
 		try {
-			const { fresh } = await provisionDatabase(provision);
-			logger.success(`Database \`${dbRole(app)}\` is up to date`);
+			const { fresh } = given ? await migrateAs({
+				...given,
+				migrationsFolder
+			}) : await provisionDatabase(provision);
+			logger.success(`Database \`${database}\` is up to date`);
 			if (fresh && options.seed !== false) {
 				seedPending = true;
 				seed();
 			}
 		} catch (e) {
-			logger.warn(`Could not migrate \`${dbRole(app)}\`. Is the wervt stack running (docker compose up -d)?`, e instanceof Error ? e.message : e);
+			logger.warn(given ? `Could not migrate \`${database}\`.` : `Could not migrate \`${database}\`. Is the wervt stack running (docker compose up -d)?`, e instanceof Error ? e.message : e);
 		}
 	};
 	await migrate();
-	process.env.DATABASE_URL ??= await appDatabaseUrl(provision);
-	process.env.WERVT_DB_SCHEMA ??= dbRole(app);
-	process.env.ELECTRIC_URL ??= config.electricUrl;
-	process.env.ELECTRIC_SECRET ??= config.electricSecret;
+	const own = {
+		DATABASE_URL: await appDatabaseUrl(provision),
+		WERVT_DB_SCHEMA: dbRole(app),
+		ELECTRIC_URL: config.electricUrl,
+		ELECTRIC_SECRET: config.electricSecret
+	};
+	const set = Object.fromEntries(Object.entries(own).filter(([key]) => process.env[key] === void 0));
+	Object.assign(process.env, set);
+	process.env[OWN_ENV] = JSON.stringify(set);
 	let timer;
 	const watcher = watch(migrationsFolder, { recursive: true }, (_event, file) => {
 		if (!file?.endsWith(".sql")) return;
@@ -86,6 +100,15 @@ async function setupDev(nuxt, app, options, features = {}) {
 	});
 	nuxt.hook("close", () => watcher.close());
 }
+const OWN_ENV = "WERVT_DEV_OWN_ENV";
+function forgetOwnEnv(rootDir) {
+	const own = process.env[OWN_ENV];
+	if (!own) return;
+	for (const [key, value] of Object.entries(JSON.parse(own))) if (process.env[key] === value) delete process.env[key];
+	delete process.env[OWN_ENV];
+	const file = join(rootDir, ".env");
+	if (existsSync(file)) process.loadEnvFile(file);
+}
 /** The app's bucket in the local Garage, and WERVT_S3_* for ablage, like in production. */
 async function setupStorage(app, secret, options) {
 	const s3Url = process.env.WERVT_S3_URL ?? options.s3Url ?? DEFAULTS.s3Url;
@@ -118,5 +141,4 @@ async function resolveAppName(rootDir, name) {
 	}
 	return name.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
 }
-//#endregion
 export { resolveAppName, setupDev };

package/dist/env-types.js

@@ -0,0 +1,13 @@
+// src/env-types.ts
+/** `.nuxt/types/wervt-env.d.ts`: types for the `process.env` the isolate provides. */
+const PROCESS_ENV_TYPES = `declare namespace NodeJS {
+  interface ProcessEnv {
+    [key: string]: string | undefined
+  }
+  interface Process {
+    env: ProcessEnv
+  }
+}
+declare var process: NodeJS.Process
+`;
+export { PROCESS_ENV_TYPES };

package/dist/icons.js

@@ -0,0 +1,30 @@
+import { dependencyNames } from "./og-image.js";
+// src/icons.ts
+const ICONIFY_JSON = "@iconify-json/";
+/** The whole Iconify set in one package; @nuxt/icon finds every collection in it. */
+const ICONIFY_ALL = "@iconify/json";
+/** Where the app's icons can come from without the Iconify API. */
+async function iconSources(rootDir) {
+	const names = await dependencyNames(rootDir);
+	return {
+		collections: names.filter((name) => name.startsWith(ICONIFY_JSON)).map((name) => name.slice(14)).toSorted(),
+		everything: names.includes(ICONIFY_ALL)
+	};
+}
+/**
+* @nuxt/icon defaults for a wervt build. Its `serverBundle: 'auto'` already resolves to the
+* locally installed collections on the Deno preset (auto-discovery also covers layers and
+* transitive deps), so only the API fallback needs changing: the isolate can't reach the Iconify
+* API, and a server request would time out for every icon of a missing collection. The browser
+* may still fall back. An app's own `icon` config wins over these.
+*/
+function iconDefaults() {
+	return { fallbackToApi: "client-only" };
+}
+/** Why icons won't render on wervt, if they won't. Nuxt UI's own icons are Lucide icons. */
+function iconWarning(sources, nuxtUi) {
+	if (sources.everything) return void 0;
+	if (nuxtUi && !sources.collections.includes("lucide")) return "Nuxt UI uses Lucide icons, but `@iconify-json/lucide` is not installed, so they won't render on wervt (the isolate can't reach the Iconify API). Run `pnpm add -D @iconify-json/lucide`, plus `@iconify-json/<name>` for every other icon collection the app uses.";
+	if (sources.collections.length === 0) return "No icon collection is installed, so icons won't render on wervt (the isolate can't reach the Iconify API). Install the collections the app uses, e.g. `pnpm add -D @iconify-json/lucide`.";
+}
+export { iconDefaults, iconSources, iconWarning };

package/dist/loading.js

@@ -0,0 +1,30 @@
+import { WERVT_MARK } from "./runtime/shared/mark.js";
+// src/loading.ts
+const previewLoadingTemplate = () => `<!doctype html>
+<html lang="de">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+<title>Einen Moment …</title>
+<style>
+  :root { color-scheme: light dark; --fg: #0a0a0b; --muted: #6b6b70; --bg: #fafaf9; --a: #2f5bff; }
+  @media (prefers-color-scheme: dark) { :root { --fg: #fafaf9; --muted: #a1a1a6; --bg: #0a0a0b; --a: #5885ff; } }
+  html, body { height: 100%; margin: 0; }
+  body { display: grid; place-content: center; justify-items: center; gap: 1rem; background: var(--bg);
+    color: var(--fg); font: 500 1rem/1.4 system-ui, -apple-system, sans-serif; text-align: center; }
+  svg { width: 3rem; height: 3rem; color: var(--fg); animation: pulse 1.6s ease-in-out infinite; }
+  p { margin: 0; color: var(--muted); }
+  @keyframes pulse { 50% { opacity: .45; transform: scale(.94); } }
+  @media (prefers-reduced-motion: reduce) { svg { animation: none; } }
+</style>
+</head>
+<body>
+${WERVT_MARK}
+<p id="m">Einen Moment, die App wird gerade aktualisiert …</p>
+<script>
+  if (!navigator.language.toLowerCase().startsWith('de'))
+    document.getElementById('m').textContent = 'One moment, the app is being updated …'
+<\/script>
+</body>
+</html>`;
+export { previewLoadingTemplate };

package/dist/module.d.ts

@@ -1,6 +1,5 @@
 import { DevOptions } from "./dev.js";
 import { PreviewOptions } from "./preview.js";
-//#region src/module.d.ts
 export interface ModuleOptions {
   /** App name on wervt. Defaults to the package.json name. */
   app?: string;
@@ -82,5 +81,4 @@ export interface TasksManifest {
   timezone?: string;
 }
 declare const _default: import("nuxt/schema").NuxtModule<ModuleOptions, ModuleOptions, false>;
-//#endregion
 export { _default as default };

package/dist/module.js

@@ -1,5 +1,9 @@
 import { SEED_TASK, unscheduleSeed } from "./seed.js";
 import { resolveAppName, setupDev } from "./dev.js";
+import { setupStudioPreview } from "./studio-preview.js";
+import { PROCESS_ENV_TYPES } from "./env-types.js";
+import { dependencyNames, ogImageDefaults, ogImageWarning } from "./og-image.js";
+import { iconDefaults, iconSources, iconWarning } from "./icons.js";
 import { findRouteTools } from "./route-tools.js";
 import { localFiles, previewManifest } from "./preview.js";
 import { findShapeRoutes, shapeRoutesTypes, shapesManifest } from "./shapes.js";
@@ -9,7 +13,7 @@ import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { builtinModules, createRequire } from "node:module";
 import { dirname, extname, join, relative, resolve, sep } from "node:path";
 import evlog from "evlog/nuxt";
-//#region src/module.ts
+// src/module.ts
 const CONTENT_DATABASE = {
 	type: "postgres",
 	url: "{{DATABASE_URL}}"
@@ -19,6 +23,19 @@ var module_default = defineNuxtModule({
 		name: "@wervt/nuxt",
 		configKey: "wervt"
 	},
+	async moduleDependencies(nuxt) {
+		if (nuxt.options.dev) return {};
+		return {
+			"@nuxt/icon": {
+				optional: true,
+				defaults: iconDefaults()
+			},
+			"nuxt-og-image": {
+				optional: true,
+				defaults: ogImageDefaults()
+			}
+		};
+	},
 	async setup(options, nuxt) {
 		const resolver = createResolver(import.meta.url);
 		const nitro = nuxt.options.nitro;
@@ -51,6 +68,7 @@ var module_default = defineNuxtModule({
 				});
 			}
 		}
+		addServerPlugin(resolver.resolve("./runtime/server/agent-token-plugin"));
 		const useContentDatabase = !nuxt.options.dev && hasNuxtModule("@nuxt/content", nuxt);
 		if (useContentDatabase) {
 			const options = nuxt.options;
@@ -123,6 +141,16 @@ var module_default = defineNuxtModule({
 				};
 			});
 		}
+		const nuxtUi = hasNuxtModule("@nuxt/ui", nuxt);
+		if (!nuxt.options.dev && !nuxt.options._prepare && (nuxtUi || hasNuxtModule("@nuxt/icon", nuxt))) {
+			const warning = iconWarning(await iconSources(nuxt.options.rootDir), nuxtUi);
+			if (warning) logger.warn(warning);
+		}
+		nuxt.hook("modules:done", async () => {
+			if (nuxt.options.dev || nuxt.options._prepare || !hasNuxtModule("nuxt-og-image", nuxt)) return;
+			const warning = ogImageWarning(await dependencyNames(nuxt.options.rootDir));
+			if (warning) logger.warn(warning);
+		});
 		addServerHandler({
 			route: "/_wervt/boot",
 			method: "get",
@@ -248,6 +276,7 @@ var module_default = defineNuxtModule({
 		if (nuxt.options.dev && nitroMajor >= 3) {
 			if (!hasPackage(nuxt.options.rootDir, "vue")) logger.warn("`vue` is not a dependency of this app, so `nuxt dev` fails with \"module is not defined\". Run `pnpm add vue`.");
 		}
+		if (nuxt.options.dev && process.env.WERVT_PREVIEW) setupStudioPreview(nuxt);
 		if (nuxt.options.dev && !nuxt.options._prepare) {
 			const app = await resolveAppName(nuxt.options.rootDir, options.app);
 			await setupDev(nuxt, app, options.dev ?? {}, { storage: useAblage });
@@ -256,6 +285,18 @@ var module_default = defineNuxtModule({
 			filename: "types/wervt-email.d.ts",
 			getContents: () => "declare module '*.vue' {\n  import type { DefineComponent } from 'vue'\n  const component: DefineComponent<Record<string, unknown>>\n  export default component\n}\n"
 		}, { nitro: true });
+		addTypeTemplate({
+			filename: "types/wervt-env.d.ts",
+			getContents: () => PROCESS_ENV_TYPES
+		}, { nitro: true });
+		const sourceEnv = resolver.resolve("./env.d.ts");
+		if (existsSync(sourceEnv)) addTypeTemplate({
+			filename: "types/wervt-source-env.d.ts",
+			getContents: () => `/// <reference path=${JSON.stringify(sourceEnv)} />\n`
+		}, {
+			nitro: true,
+			nuxt: true
+		});
 		if (nuxt.options.dev) {
 			const templates = await findEmailTemplates([join(nuxt.options.srcDir, "emails"), join(nuxt.options.rootDir, "emails")]);
 			addServerTemplate({
@@ -496,5 +537,4 @@ function exceptRuntime(pattern) {
 	if (pattern.source.startsWith("^")) return pattern;
 	return new RegExp(`^(?![\\s\\S]*[\\\\/]@wervt[\\\\/]nuxt[\\\\/]src[\\\\/]runtime[\\\\/])[\\s\\S]*?(?:${pattern.source})`, pattern.flags);
 }
-//#endregion
 export { module_default as default };

package/dist/node_modules/.pnpm/nitro@3.0.260903-beta/node_modules/nitro/dist/runtime/internal/task.js

@@ -1,6 +1,6 @@
 import { tasks } from "#nitro/virtual/tasks";
 import { HTTPError } from "h3";
-//#region ../../node_modules/.pnpm/nitro@3.0.260903-beta/node_modules/nitro/dist/runtime/internal/task.mjs
+// ../../node_modules/.pnpm/nitro@3.0.260903-beta/node_modules/nitro/dist/runtime/internal/task.mjs
 const __runningTasks__ = {};
 async function runTask(name, { payload = {}, context = {} } = {}) {
 	if (__runningTasks__[name]) return __runningTasks__[name];
@@ -25,5 +25,4 @@ async function runTask(name, { payload = {}, context = {} } = {}) {
 		delete __runningTasks__[name];
 	}
 }
-//#endregion
 export { runTask };

package/dist/node_modules/.pnpm/nitro@3.0.260903-beta/node_modules/nitro/dist/runtime/task.js

@@ -1,2 +1 @@
-import { runTask } from "./internal/task.js";
-export { runTask };
+export { runTask } from "./internal/task.js";

package/dist/og-image.js

@@ -0,0 +1,38 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+// src/og-image.ts
+/** The app's dependencies and devDependencies, by name. */
+async function dependencyNames(rootDir) {
+	const pkg = JSON.parse(await readFile(join(rootDir, "package.json"), "utf8").catch(() => "{}"));
+	return Object.keys({
+		...pkg.dependencies,
+		...pkg.devDependencies
+	});
+}
+/**
+* nuxt-og-image defaults for a wervt build. It treats the deno-server preset like Node and picks
+* the native renderers (N-API bindings, sharp, a local Chrome), which an Edge Runtime isolate
+* can't load, so OG image requests fail with a 500. The WebAssembly builds run there; without
+* sharp, images are PNG only. An app's own `ogImage` config wins over these.
+*/
+function ogImageDefaults() {
+	return { compatibility: { runtime: {
+		takumi: "wasm",
+		satori: "wasm",
+		resvg: "wasm",
+		sharp: false,
+		browser: false
+	} } };
+}
+/**
+* Why OG images won't render on wervt, if they won't. The WebAssembly package renders; the native
+* one is needed too because nuxt-og-image checks for the packages of the preset's own defaults
+* (Node for deno-server) and fails the build without them, whatever `compatibility` says.
+*/
+function ogImageWarning(dependencies) {
+	const has = (name) => dependencies.includes(name);
+	const missing = [...has("@takumi-rs/core") || has("@takumi-rs/wasm") || !has("satori") ? ["@takumi-rs/core", "@takumi-rs/wasm"] : [], ...has("satori") ? ["@resvg/resvg-js", "@resvg/resvg-wasm"] : []].filter((name) => !has(name));
+	if (missing.length === 0) return void 0;
+	return `OG images render with WebAssembly on wervt (an isolate can't load native renderers), and nuxt-og-image's build also wants the native package, but ${missing.map((name) => `\`${name}\``).join(", ")} ${missing.length > 1 ? "are" : "is"} not installed. Run \`pnpm add ${missing.join(" ")}\`.`;
+}
+export { dependencyNames, ogImageDefaults, ogImageWarning };

package/dist/preview.d.ts

@@ -1,4 +1,3 @@
-//#region src/preview.d.ts
 export interface PreviewOptions {
   /** Defaults to the app's `app.head.title`. */
   title?: string;
@@ -10,5 +9,4 @@ export interface PreviewOptions {
   icon?: string;
   /** Defaults to the app's `theme-color` meta tag. */
   themeColor?: string;
-}
-//#endregion
+}

package/dist/preview.js

@@ -1,4 +1,4 @@
-//#region src/preview.ts
+// src/preview.ts
 /**
 * What the runtime shows. Without `preview`, only the app's name and icon: for some private apps
 * the title alone says too much, so the rest of the head is only used once the app opts in.
@@ -35,5 +35,4 @@ function localFiles(manifest) {
 	if (!manifest) return [];
 	return [manifest.image, manifest.icon].filter((path) => !!path && path.startsWith("/") && !path.startsWith("//"));
 }
-//#endregion
 export { localFiles, previewManifest };

package/dist/provision.d.ts

@@ -1,5 +1,4 @@
-import { StorageError, StorageOptions, StorageUsage, createStorage } from "./storage.js";
-//#region src/provision.d.ts
+import { MAX_KEY_BYTES, ObjectDetails, ObjectListing, StorageError, StorageOptions, StorageQuota, StorageUsage, StoredObject, createStorage } from "./storage.js";
 export interface ProvisionOptions {
   /** App name, `[a-z0-9-]+`. */
   app: string;
@@ -9,7 +8,24 @@ export interface ProvisionOptions {
   secret: string;
   /** Drizzle migrations folder. Skipped when undefined. */
   migrationsFolder?: string;
+  /** Timeouts for the app's role; DEFAULT_ROLE_TIMEOUTS where not given. */
+  timeouts?: Partial<RoleTimeouts>;
 }
+/** Postgres durations (`30s`, `500ms`, `2min`) for the app's role; `0` turns one off. */
+export interface RoleTimeouts {
+  /** Longest a single statement may run. */
+  statement: string;
+  /** Longest a transaction may sit idle, holding its locks and its pooled connection. */
+  idleInTransaction: string;
+}
+export declare const DEFAULT_ROLE_TIMEOUTS: RoleTimeouts;
+/** A Postgres duration as the env gives it, e.g. `WERVT_STATEMENT_TIMEOUT`; the fallback when empty. */
+export declare function parseDuration(value: string | undefined, fallback: string, name?: string): string;
+/**
+ * Sets the timeouts on an existing app role, for apps that aren't redeployed. New sessions get
+ * them; open ones keep theirs. Returns false when the app has no role.
+ */
+export declare function setRoleTimeouts({ app, adminUrl, timeouts }: Pick<ProvisionOptions, 'app' | 'adminUrl' | 'timeouts'>): Promise<boolean>;
 export declare function dbRole(app: string): string;
 export declare function hmac(secret: string, message: string): Promise<string>;
 /** The app's Garage bucket and S3 key, derived from WERVT_DB_SECRET like role passwords. */
@@ -32,6 +48,18 @@ export declare function appDatabaseUrl({ app, adminUrl, secret }: ProvisionOptio
 export declare function provisionDatabase(options: ProvisionOptions): Promise<{
   fresh: boolean;
 }>;
+/**
+ * Runs the Drizzle migrations as the app's own role, into its schema. The role needs CREATE on
+ * the database while this runs (see `provisionDatabase`). `fresh` is true when no migration had
+ * been applied before.
+ */
+export declare function migrateAs({ url, schema, migrationsFolder }: {
+  url: string;
+  schema: string;
+  migrationsFolder: string;
+}): Promise<{
+  fresh: boolean;
+}>;
 /** The role PgBouncer signs in with to look up app roles' password hashes (`auth_query`). */
 export declare const POOLER_ROLE = "pgbouncer";
 /**
@@ -46,5 +74,4 @@ export declare function setupPooler({ adminUrl, password }: {
 }): Promise<void>;
 /** Drops the app's schema (all its data) and role. */
 export declare function dropDatabase({ app, adminUrl }: Pick<ProvisionOptions, 'app' | 'adminUrl'>): Promise<void>;
-//#endregion
-export { StorageError, type StorageOptions, type StorageUsage, createStorage };
+export { MAX_KEY_BYTES, type ObjectDetails, type ObjectListing, StorageError, type StorageOptions, type StorageQuota, type StorageUsage, type StoredObject, createStorage };

package/dist/provision.js

@@ -1,8 +1,53 @@
-import { StorageError, createStorage } from "./storage.js";
+import { MAX_KEY_BYTES, StorageError, createStorage } from "./storage.js";
 import { drizzle } from "drizzle-orm/postgres-js";
 import { migrate } from "drizzle-orm/postgres-js/migrator";
 import postgres from "postgres";
-//#region src/provision.ts
+// src/provision.ts
+const DEFAULT_ROLE_TIMEOUTS = {
+	statement: "30s",
+	idleInTransaction: "60s"
+};
+const DURATION_RE = /^\d+(?:ms|s|min|h)?$/;
+/** A Postgres duration as the env gives it, e.g. `WERVT_STATEMENT_TIMEOUT`; the fallback when empty. */
+function parseDuration(value, fallback, name = "timeout") {
+	const trimmed = value?.trim();
+	if (!trimmed) return fallback;
+	if (!DURATION_RE.test(trimmed)) throw new Error(`${name} must be a duration like 30s, 500ms or 2min (0 for none)`);
+	return trimmed;
+}
+function roleTimeouts(timeouts) {
+	const merged = {
+		...DEFAULT_ROLE_TIMEOUTS,
+		...timeouts
+	};
+	return {
+		statement: parseDuration(merged.statement, DEFAULT_ROLE_TIMEOUTS.statement),
+		idleInTransaction: parseDuration(merged.idleInTransaction, DEFAULT_ROLE_TIMEOUTS.idleInTransaction)
+	};
+}
+async function applyRoleTimeouts(admin, role, timeouts) {
+	await admin.unsafe(`alter role "${role}" set statement_timeout = '${timeouts.statement}'`);
+	await admin.unsafe(`alter role "${role}" set idle_in_transaction_session_timeout = '${timeouts.idleInTransaction}'`);
+}
+/**
+* Sets the timeouts on an existing app role, for apps that aren't redeployed. New sessions get
+* them; open ones keep theirs. Returns false when the app has no role.
+*/
+async function setRoleTimeouts({ app, adminUrl, timeouts }) {
+	const role = dbRole(app);
+	const admin = postgres(adminUrl, {
+		max: 1,
+		onnotice: () => {}
+	});
+	try {
+		const [row] = await admin`select exists(select 1 from pg_roles where rolname = ${role})`;
+		if (!row?.exists) return false;
+		await applyRoleTimeouts(admin, role, roleTimeouts(timeouts));
+		return true;
+	} finally {
+		await admin.end();
+	}
+}
 function dbRole(app) {
 	return `app_${app.replaceAll("-", "_")}`;
 }
@@ -56,6 +101,7 @@ async function provisionDatabase(options) {
 		await admin.unsafe(`create schema if not exists "${role}" authorization "${role}"`);
 		await claimSchema(admin, role);
 		await admin.unsafe(`alter role "${role}" set search_path = "${role}"`);
+		await applyRoleTimeouts(admin, role, roleTimeouts(options.timeouts));
 		for (const db of [
 			database,
 			"postgres",
@@ -64,34 +110,50 @@ async function provisionDatabase(options) {
 		await admin.unsafe(`grant connect on database "${database}" to "${role}"`);
 		await admin.unsafe(`revoke all on schema public from public`);
 		if (!migrationsFolder) return { fresh: false };
-		const table = `"${role}"."__drizzle_migrations"`;
-		const [state] = await admin`
-      select to_regclass(${table}) is not null as exists`;
-		let fresh = !state?.exists;
-		if (!fresh) {
-			const [row] = await admin.unsafe(`select exists(select 1 from ${table}) as applied`);
-			fresh = !row?.applied;
-		}
 		await admin.unsafe(`grant create on database "${database}" to "${role}"`);
-		const client = postgres(await appDatabaseUrl(options), {
-			max: 1,
-			onnotice: () => {}
-		});
 		try {
-			await migrate(drizzle({ client }), {
-				migrationsFolder,
-				migrationsSchema: role
+			return await migrateAs({
+				url: await appDatabaseUrl(options),
+				schema: role,
+				migrationsFolder
 			});
 		} finally {
-			await client.end();
 			await admin.unsafe(`revoke create on database "${database}" from "${role}"`);
 		}
-		return { fresh };
 	} finally {
 		await admin.end();
 	}
 }
 /**
+* Runs the Drizzle migrations as the app's own role, into its schema. The role needs CREATE on
+* the database while this runs (see `provisionDatabase`). `fresh` is true when no migration had
+* been applied before.
+*/
+async function migrateAs({ url, schema, migrationsFolder }) {
+	const client = postgres(url, {
+		max: 1,
+		onnotice: () => {}
+	});
+	try {
+		const table = `"${schema}"."__drizzle_migrations"`;
+		const [state] = await client`
+      select to_regclass(${table}) is not null as exists`;
+		let fresh = !state?.exists;
+		if (!fresh) {
+			const [row] = await client.unsafe(`select exists(select 1 from ${table}) as applied`);
+			fresh = !row?.applied;
+		}
+		await client.unsafe("set statement_timeout = 0; set idle_in_transaction_session_timeout = 0");
+		await migrate(drizzle({ client }), {
+			migrationsFolder,
+			migrationsSchema: schema
+		});
+		return { fresh };
+	} finally {
+		await client.end();
+	}
+}
+/**
 * Gives the role its schema and everything in it back. A dump restored with `--no-owner`
 * (Coolify's backups) leaves all of it owned by the restoring superuser.
 */
@@ -173,5 +235,4 @@ async function dropDatabase({ app, adminUrl }) {
 		await admin.end();
 	}
 }
-//#endregion
-export { POOLER_ROLE, StorageError, appDatabaseUrl, createStorage, dbPassword, dbRole, dropDatabase, hmac, provisionDatabase, setupPooler, storageCredentials };
+export { DEFAULT_ROLE_TIMEOUTS, MAX_KEY_BYTES, POOLER_ROLE, StorageError, appDatabaseUrl, createStorage, dbPassword, dbRole, dropDatabase, hmac, migrateAs, parseDuration, provisionDatabase, setRoleTimeouts, setupPooler, storageCredentials };

package/dist/route-tools.js

@@ -1,6 +1,6 @@
 import { readFile, readdir } from "node:fs/promises";
 import { extname, join, sep } from "node:path";
-//#region src/route-tools.ts
+// src/route-tools.ts
 const EXTENSIONS = /* @__PURE__ */ new Set([
 	".ts",
 	".js",
@@ -40,5 +40,4 @@ async function findRouteTools(dir, prefix = []) {
 	}
 	return found;
 }
-//#endregion
 export { findRouteTools, routeToolName };

package/dist/runtime/app/plugins/analytics.client.d.ts

@@ -1,4 +1,2 @@
-//#region src/runtime/app/plugins/analytics.client.d.ts
 declare const _default: import("#app").Plugin<Record<string, unknown>> & import("#app").ObjectPlugin<Record<string, unknown>>;
-//#endregion
 export { _default as default };

package/dist/runtime/app/plugins/analytics.client.js

@@ -1,5 +1,5 @@
 import { defineNuxtPlugin, useRouter, useRuntimeConfig } from "#app";
-//#region src/runtime/app/plugins/analytics.client.ts
+// src/runtime/app/plugins/analytics.client.ts
 var analytics_client_default = defineNuxtPlugin({
 	name: "wervt:analytics",
 	setup() {
@@ -12,5 +12,4 @@ var analytics_client_default = defineNuxtPlugin({
 		});
 	}
 });
-//#endregion
 export { analytics_client_default as default };

package/dist/runtime/app/plugins/feedback.client.d.ts

@@ -1,4 +1,2 @@
-//#region src/runtime/app/plugins/feedback.client.d.ts
 declare const _default: import("#app").Plugin<Record<string, unknown>> & import("#app").ObjectPlugin<Record<string, unknown>>;
-//#endregion
 export { _default as default };

package/dist/runtime/app/plugins/feedback.client.js

@@ -1,6 +1,6 @@
 import { pendingFeedbackContext } from "../useWervtFeedback.js";
 import { defineNuxtPlugin, onNuxtReady, useRuntimeConfig } from "#app";
-//#region src/runtime/app/plugins/feedback.client.ts
+// src/runtime/app/plugins/feedback.client.ts
 var feedback_client_default = defineNuxtPlugin({
 	name: "wervt:feedback",
 	setup() {
@@ -28,5 +28,4 @@ var feedback_client_default = defineNuxtPlugin({
 		});
 	}
 });
-//#endregion
 export { feedback_client_default as default };

package/dist/runtime/app/plugins/update.client.d.ts

@@ -1,4 +1,2 @@
-//#region src/runtime/app/plugins/update.client.d.ts
 declare const _default: import("#app").Plugin<Record<string, unknown>> & import("#app").ObjectPlugin<Record<string, unknown>>;
-//#endregion
 export { _default as default };