@wervt/nuxt 0.3.2 → 0.3.4

package/dist/runtime/email/render.d.ts

@@ -1,5 +1,4 @@
 import { Component } from "vue";
-//#region src/runtime/email/render.d.ts
 export interface RenderedEmail {
   subject: string;
   html: string;
@@ -13,5 +12,4 @@ export type EmailProps<T> = T extends (new () => {
  * Renders an email template (a component with `<WervtEmail>` at its root) to HTML, a plain-text
  * part and its subject.
  */
-export declare function renderEmail<T extends Component>(template: T, props?: EmailProps<T>): Promise<RenderedEmail>;
-//#endregion
+export declare function renderEmail<T extends Component>(template: T, props?: EmailProps<T>): Promise<RenderedEmail>;

package/dist/runtime/email/render.js

@@ -2,7 +2,7 @@ import { SUBJECT_KEY } from "./components.js";
 import { createSSRApp } from "vue";
 import { convert } from "html-to-text";
 import { renderToString } from "vue/server-renderer";
-//#region src/runtime/email/render.ts
+// src/runtime/email/render.ts
 const DOCTYPE = "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">";
 /**
 * Renders an email template (a component with `<WervtEmail>` at its root) to HTML, a plain-text
@@ -64,5 +64,4 @@ function toText(html) {
 		]
 	}).trim();
 }
-//#endregion
 export { renderEmail };

package/dist/runtime/server/access.d.ts

@@ -1,5 +1,4 @@
 import { RequestEvent } from "nuxt/server";
-//#region src/runtime/server/access.d.ts
 export interface WervtInvite {
   email: string;
   /** Who invited them. */
@@ -24,11 +23,11 @@ export interface WervtAccess {
 /**
  * Invites on an invite-only app (`wervt access <app> --invite`), as the user of this request: the
  * runtime vouches for them, and only someone with access can invite. Everyone with access may
- * invite; restrict it in the route if the app has its own roles.
+ * invite, or only the owner, members and admins with `wervt access <app> --invite-by owners`;
+ * restrict it further in the route if the app has its own roles.
  *
- * Throws with the platform's status: 401 without a signed-in user, 403 when they have no access,
+ * Throws with the platform's status: 401 without a signed-in user, 403 when they may not invite,
  * 409 when the app isn't invite-only, 429 past the limits (25 invites per person and day, 500 per
  * app).
  */
-export declare function useWervtAccess(event: RequestEvent): WervtAccess;
-//#endregion
+export declare function useWervtAccess(event: RequestEvent): WervtAccess;

package/dist/runtime/server/access.js

@@ -1,13 +1,14 @@
 import { DEV_LOGIN_COOKIE, devUser } from "../shared/user.js";
 import { createError, getCookie } from "nuxt/server";
-//#region src/runtime/server/access.ts
+// src/runtime/server/access.ts
 const devInvites = [];
 /**
 * Invites on an invite-only app (`wervt access <app> --invite`), as the user of this request: the
 * runtime vouches for them, and only someone with access can invite. Everyone with access may
-* invite; restrict it in the route if the app has its own roles.
+* invite, or only the owner, members and admins with `wervt access <app> --invite-by owners`;
+* restrict it further in the route if the app has its own roles.
 *
-* Throws with the platform's status: 401 without a signed-in user, 403 when they have no access,
+* Throws with the platform's status: 401 without a signed-in user, 403 when they may not invite,
 * 409 when the app isn't invite-only, 429 past the limits (25 invites per person and day, 500 per
 * app).
 */
@@ -83,5 +84,4 @@ function devAccess(event) {
 		}
 	};
 }
-//#endregion
 export { useWervtAccess };

package/dist/runtime/server/agent-token-plugin.d.ts

@@ -0,0 +1,11 @@
+interface EnrichContext {
+  event: Record<string, unknown>;
+  headers?: Record<string, string>;
+}
+interface NitroAppHooks {
+  hooks: {
+    hook(name: 'evlog:enrich', handler: (ctx: EnrichContext) => void): unknown;
+  };
+}
+export default function wervtAgentToken(nitroApp: NitroAppHooks): void;
+export {};

package/dist/runtime/server/agent-token-plugin.js

@@ -0,0 +1,9 @@
+import { parseAgentToken } from "../shared/agent-token.js";
+// src/runtime/server/agent-token-plugin.ts
+function wervtAgentToken(nitroApp) {
+	nitroApp.hooks.hook("evlog:enrich", (ctx) => {
+		const agentToken = parseAgentToken(ctx.headers?.["x-wervt-agent-token"]);
+		if (agentToken) ctx.event.agentToken = agentToken;
+	});
+}
+export { wervtAgentToken as default };

package/dist/runtime/server/anthropic.d.ts

@@ -0,0 +1,19 @@
+import Anthropic from "@anthropic-ai/sdk";
+export interface UseAnthropicOptions {
+  /**
+   * The key for `nuxt dev`, where there is no workload identity. Default: `ANTHROPIC_API_KEY`.
+   * Never used on wervt.
+   */
+  devApiKey?: string;
+}
+/**
+ * An Anthropic client that authenticates as this app through its wervt identity: no API key, only
+ * IDs from the Anthropic Console in the app's env (`ANTHROPIC_FEDERATION_RULE_ID`,
+ * `ANTHROPIC_ORGANIZATION_ID`, optionally `ANTHROPIC_SERVICE_ACCOUNT_ID` and
+ * `ANTHROPIC_WORKSPACE_ID`). The SDK trades an identity token for an Anthropic token and renews it
+ * before it runs out.
+ *
+ * Needs `wervt identity enable <app>` and a federation rule for the app's subject
+ * (`wervt identity status <app>`). In `nuxt dev` it uses `options.devApiKey` instead.
+ */
+export declare function useAnthropic(options?: UseAnthropicOptions): Anthropic;

package/dist/runtime/server/anthropic.js

@@ -0,0 +1,52 @@
+import { useWorkloadIdentity } from "./identity.js";
+import { createError } from "nuxt/server";
+import Anthropic from "@anthropic-ai/sdk";
+import { oidcFederationProvider } from "@anthropic-ai/sdk/lib/credentials/oidc-federation";
+// src/runtime/server/anthropic.ts
+const BASE_URL = "https://api.anthropic.com";
+let client;
+/**
+* An Anthropic client that authenticates as this app through its wervt identity: no API key, only
+* IDs from the Anthropic Console in the app's env (`ANTHROPIC_FEDERATION_RULE_ID`,
+* `ANTHROPIC_ORGANIZATION_ID`, optionally `ANTHROPIC_SERVICE_ACCOUNT_ID` and
+* `ANTHROPIC_WORKSPACE_ID`). The SDK trades an identity token for an Anthropic token and renews it
+* before it runs out.
+*
+* Needs `wervt identity enable <app>` and a federation rule for the app's subject
+* (`wervt identity status <app>`). In `nuxt dev` it uses `options.devApiKey` instead.
+*/
+function useAnthropic(options = {}) {
+	return client ??= create(options);
+}
+function create(options) {
+	if (!process.env.WERVT_RUNTIME_URL) {
+		const apiKey = options.devApiKey ?? process.env.ANTHROPIC_API_KEY;
+		if (!apiKey) throw createError({
+			status: 503,
+			message: "useAnthropic() in `nuxt dev` needs an API key (ANTHROPIC_API_KEY or devApiKey)."
+		});
+		return new Anthropic({ apiKey });
+	}
+	const federationRuleId = process.env.ANTHROPIC_FEDERATION_RULE_ID;
+	const organizationId = process.env.ANTHROPIC_ORGANIZATION_ID;
+	if (!federationRuleId || !organizationId) throw createError({
+		status: 503,
+		message: "useAnthropic() needs ANTHROPIC_FEDERATION_RULE_ID and ANTHROPIC_ORGANIZATION_ID (wervt env <app> --set …)."
+	});
+	const identity = useWorkloadIdentity();
+	return new Anthropic({
+		apiKey: null,
+		authToken: null,
+		baseURL: BASE_URL,
+		credentials: oidcFederationProvider({
+			identityTokenProvider: () => identity.token(BASE_URL),
+			federationRuleId,
+			organizationId,
+			serviceAccountId: process.env.ANTHROPIC_SERVICE_ACCOUNT_ID || void 0,
+			workspaceId: process.env.ANTHROPIC_WORKSPACE_ID || void 0,
+			baseURL: BASE_URL,
+			fetch: (...args) => fetch(...args)
+		})
+	});
+}
+export { useAnthropic };

package/dist/runtime/server/boot.d.ts

@@ -1,4 +1,3 @@
-//#region src/runtime/server/boot.d.ts
 declare const _default: import("nuxt/server").EventHandler<{
   error: string;
   ok?: undefined;
@@ -6,5 +5,4 @@ declare const _default: import("nuxt/server").EventHandler<{
   error?: undefined;
   ok: boolean;
 }>;
-//#endregion
 export { _default as default };

package/dist/runtime/server/boot.js

@@ -1,5 +1,5 @@
 import { defineEventHandler } from "nuxt/server";
-//#region src/runtime/server/boot.ts
+// src/runtime/server/boot.ts
 var boot_default = defineEventHandler((event) => {
 	event.res.headers.set("cache-control", "no-store");
 	if (event.req.headers.get("x-wervt-task") !== "1") {
@@ -8,5 +8,4 @@ var boot_default = defineEventHandler((event) => {
 	}
 	return { ok: true };
 });
-//#endregion
 export { boot_default as default };

package/dist/runtime/server/db.d.ts

@@ -1,6 +1,5 @@
 import { PostgresJsDatabase } from "drizzle-orm/postgres-js";
 import { AnyRelations, EmptyRelations } from "drizzle-orm";
-//#region src/runtime/server/db.d.ts
 /**
  * Drizzle client for the app's database. In production the wervt runtime injects
  * DATABASE_URL for the app's own role, whose search_path is its own schema, so
@@ -15,5 +14,4 @@ import { AnyRelations, EmptyRelations } from "drizzle-orm";
  */
 export declare function useDb<TRelations extends AnyRelations = EmptyRelations>(options?: {
   relations?: TRelations;
-}): PostgresJsDatabase<TRelations>;
-//#endregion
+}): PostgresJsDatabase<TRelations>;

package/dist/runtime/server/db.js

@@ -1,6 +1,6 @@
 import { drizzle } from "drizzle-orm/postgres-js";
 import postgres from "postgres";
-//#region src/runtime/server/db.ts
+// src/runtime/server/db.ts
 let client;
 const clients = /* @__PURE__ */ new Map();
 /**
@@ -32,5 +32,4 @@ function useDb(options) {
 	}
 	return db;
 }
-//#endregion
 export { useDb };

package/dist/runtime/server/dev-auth.d.ts

@@ -1,4 +1,2 @@
-//#region src/runtime/server/dev-auth.d.ts
 declare const _default: import("nuxt/server").EventHandler<string>;
-//#endregion
 export { _default as default };

package/dist/runtime/server/dev-auth.js

@@ -1,6 +1,6 @@
 import { DEV_LOGIN_COOKIE } from "../shared/user.js";
 import { defineEventHandler, deleteCookie, getQuery, sendRedirect, setCookie } from "nuxt/server";
-//#region src/runtime/server/dev-auth.ts
+// src/runtime/server/dev-auth.ts
 var dev_auth_default = defineEventHandler((event) => {
 	const { redirect } = getQuery(event);
 	const target = typeof redirect === "string" && redirect.startsWith("/") ? redirect : "/";
@@ -11,5 +11,4 @@ var dev_auth_default = defineEventHandler((event) => {
 	else deleteCookie(event, DEV_LOGIN_COOKIE, { path: "/" });
 	return sendRedirect(event, target);
 });
-//#endregion
 export { dev_auth_default as default };

package/dist/runtime/server/email-preview.d.ts

@@ -1,4 +1,2 @@
-//#region src/runtime/server/email-preview.d.ts
 declare const _default: import("nuxt/server").EventHandler<Promise<Response>>;
-//#endregion
 export { _default as default };

package/dist/runtime/server/email-preview.js

@@ -1,7 +1,7 @@
 import { renderEmail } from "../email/render.js";
 import { createError, defineEventHandler, getQuery } from "nuxt/server";
 import { templates } from "#wervt/emails";
-//#region src/runtime/server/email-preview.ts
+// src/runtime/server/email-preview.ts
 const list = templates;
 const page = (body) => new Response(`<!doctype html><meta charset="utf-8"><title>Emails</title><body style="font:15px/1.6 system-ui;margin:40px">${body}</body>`, { headers: { "content-type": "text/html; charset=utf-8" } });
 const escape = (value) => value.replace(/[&<>"]/g, (c) => ({
@@ -26,5 +26,4 @@ var email_preview_default = defineEventHandler(async (event) => {
 	if ("text" in getQuery(event)) return new Response(`Subject: ${mail.subject}\n\n${mail.text}\n`, { headers: { "content-type": "text/plain; charset=utf-8" } });
 	return new Response(mail.html, { headers: { "content-type": "text/html; charset=utf-8" } });
 });
-//#endregion
 export { email_preview_default as default };

package/dist/runtime/server/identity.d.ts

@@ -0,0 +1,18 @@
+export interface WorkloadIdentity {
+  /**
+   * A fresh JWT that says "I am this wervt app", for `audience` (a provider on wervt's list, e.g.
+   * `https://api.anthropic.com`). Valid for 5 minutes and single-use: trade it for a provider
+   * token right away. Each call signs a new one; providers' SDKs cache what they get for it.
+   */
+  token(audience: string): Promise<string>;
+}
+/**
+ * The app's workload identity: tokens signed by wervt's issuer, so the app can authenticate to an
+ * AI provider (Anthropic's Workload Identity Federation) without an API key. Its owner turns it
+ * on with `wervt identity enable <app>`; `useAnthropic()` (`@wervt/nuxt/anthropic`) uses it.
+ *
+ * Throws with the platform's status: 403 when the app has no identity, 400 for an audience wervt
+ * doesn't sign for, 429 past 10 tokens a minute, 503 when the issuer is off. In `nuxt dev` there
+ * is no issuer, so it always throws.
+ */
+export declare function useWorkloadIdentity(): WorkloadIdentity;

package/dist/runtime/server/identity.js

@@ -0,0 +1,36 @@
+import { createError } from "nuxt/server";
+// src/runtime/server/identity.ts
+/**
+* The app's workload identity: tokens signed by wervt's issuer, so the app can authenticate to an
+* AI provider (Anthropic's Workload Identity Federation) without an API key. Its owner turns it
+* on with `wervt identity enable <app>`; `useAnthropic()` (`@wervt/nuxt/anthropic`) uses it.
+*
+* Throws with the platform's status: 403 when the app has no identity, 400 for an audience wervt
+* doesn't sign for, 429 past 10 tokens a minute, 503 when the issuer is off. In `nuxt dev` there
+* is no issuer, so it always throws.
+*/
+function useWorkloadIdentity() {
+	return { async token(audience) {
+		const runtime = process.env.WERVT_RUNTIME_URL;
+		if (!runtime) throw createError({
+			status: 503,
+			message: "Workload identity only exists on wervt, not in `nuxt dev`."
+		});
+		const res = await fetch(new URL("/_wervt/identity-token", runtime), {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				"x-wervt-app": process.env.WERVT_APP ?? "",
+				"x-wervt-token": process.env.WERVT_TOKEN ?? ""
+			},
+			body: JSON.stringify({ audience })
+		});
+		const body = await res.json().catch(() => ({}));
+		if (!res.ok || !body.token) throw createError({
+			status: res.status,
+			message: body.error ?? `identity token failed (${res.status})`
+		});
+		return body.token;
+	} };
+}
+export { useWorkloadIdentity };

package/dist/runtime/server/index.d.ts

@@ -1,7 +1,8 @@
-import { WervtUser } from "../shared/user.js";
+import { WervtRole, WervtUser } from "../shared/user.js";
 import { EmailProps, RenderedEmail, renderEmail } from "../email/render.js";
 import { WervtAccess, WervtInvite, useWervtAccess } from "./access.js";
 import { useDb } from "./db.js";
+import { WorkloadIdentity, useWorkloadIdentity } from "./identity.js";
 import { createEvlogError, log, useLogger } from "./logger.js";
 import { SendMailOptions, sendMail } from "./mail.js";
 import { McpTokenContext } from "./mcp-auth.js";
@@ -11,5 +12,5 @@ import { ShapeOptions, ShapeRow, proxyShape } from "./shape.js";
 import { Task, TaskEvent, TaskResult, defineTask } from "./tasks.js";
 import { SafeResult, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, vh } from "./validate.js";
 import { Tool, ToolRoute, defineTool, defineToolRoute } from "./tools.js";
-import { useWervtUser } from "./user.js";
-export { type EmailProps, type McpTokenContext, type RenderedEmail, type SafeResult, type SendMailOptions, type ShapeOptions, type ShapeResponse, type ShapeRow, type Task, type TaskEvent, type TaskResult, type Tool, type ToolRoute, type WervtAccess, type WervtInvite, type WervtUser, createEvlogError, defineTask, defineTool, defineToolRoute, log, proxyShape, renderEmail, seedTable, sendMail, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtAccess, useWervtUser, vh };
+import { requireWervtRole, useWervtUser } from "./user.js";
+export { type EmailProps, type McpTokenContext, type RenderedEmail, type SafeResult, type SendMailOptions, type ShapeOptions, type ShapeResponse, type ShapeRow, type Task, type TaskEvent, type TaskResult, type Tool, type ToolRoute, type WervtAccess, type WervtInvite, type WervtRole, type WervtUser, type WorkloadIdentity, createEvlogError, defineTask, defineTool, defineToolRoute, log, proxyShape, renderEmail, requireWervtRole, seedTable, sendMail, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtAccess, useWervtUser, useWorkloadIdentity, vh };

package/dist/runtime/server/index.js

@@ -1,6 +1,7 @@
+import { renderEmail } from "../email/render.js";
 import { useWervtAccess } from "./access.js";
+import { useWorkloadIdentity } from "./identity.js";
 import { useDb } from "./db.js";
-import { renderEmail } from "../email/render.js";
 import { createEvlogError, log, useLogger } from "./logger.js";
 import { sendMail } from "./mail.js";
 import { seedTable } from "./seed.js";
@@ -8,5 +9,5 @@ import { proxyShape } from "./shape.js";
 import { defineTask } from "./tasks.js";
 import { useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, vh } from "./validate.js";
 import { defineTool, defineToolRoute } from "./tools.js";
-import { useWervtUser } from "./user.js";
-export { createEvlogError, defineTask, defineTool, defineToolRoute, log, proxyShape, renderEmail, seedTable, sendMail, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtAccess, useWervtUser, vh };
+import { requireWervtRole, useWervtUser } from "./user.js";
+export { createEvlogError, defineTask, defineTool, defineToolRoute, log, proxyShape, renderEmail, requireWervtRole, seedTable, sendMail, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtAccess, useWervtUser, useWorkloadIdentity, vh };

package/dist/runtime/server/logger.d.ts

@@ -1,7 +1,5 @@
 import { RequestEvent } from "nuxt/server";
 import { createEvlogError, log } from "evlog";
-//#region src/runtime/server/logger.d.ts
 /** The request's wide event: `useLogger(event).set({ user: { id } })` adds fields to it. */
 export declare function useLogger<T extends object = Record<string, unknown>>(event: RequestEvent, service?: string): import("evlog").AuditableLogger<T>;
-//#endregion
 export { createEvlogError, log };

package/dist/runtime/server/logger.js

@@ -1,8 +1,7 @@
 import { createEvlogError, log, useLogger as useLogger$1 } from "evlog";
-//#region src/runtime/server/logger.ts
+// src/runtime/server/logger.ts
 /** The request's wide event: `useLogger(event).set({ user: { id } })` adds fields to it. */
 function useLogger(event, service) {
 	return useLogger$1(event, service);
 }
-//#endregion
 export { createEvlogError, log, useLogger };

package/dist/runtime/server/mail.d.ts

@@ -1,6 +1,5 @@
 import { EmailProps } from "../email/render.js";
 import { Component } from "vue";
-//#region src/runtime/server/mail.d.ts
 export interface SendMailOptions<T extends Component> {
   /** One recipient. */
   to: string;
@@ -19,5 +18,4 @@ export interface SendMailOptions<T extends Component> {
  */
 export declare function sendMail<T extends Component>(options: SendMailOptions<T>): Promise<{
   id: string;
-}>;
-//#endregion
+}>;

package/dist/runtime/server/mail.js

@@ -1,6 +1,6 @@
 import { renderEmail } from "../email/render.js";
 import { createError } from "nuxt/server";
-//#region src/runtime/server/mail.ts
+// src/runtime/server/mail.ts
 /**
 * Renders a template and sends it through wervt. Throws on failure, with the status the platform
 * answered: 400 (invalid mail), 429 (the app's or the recipient's hourly limit), 502/503.
@@ -39,5 +39,4 @@ async function sendMail(options) {
 	});
 	return { id: body.id ?? "" };
 }
-//#endregion
 export { sendMail };

package/dist/runtime/server/mcp-auth-server.d.ts

@@ -1,4 +1,2 @@
-//#region src/runtime/server/mcp-auth-server.d.ts
 declare const _default: import("nuxt/server").EventHandler<Promise<Response>>;
-//#endregion
 export { _default as default };

package/dist/runtime/server/mcp-auth-server.js

@@ -1,6 +1,6 @@
 import { CORS, fetchAuth, mcpEndpoint } from "./mcp-auth.js";
 import { defineEventHandler } from "nuxt/server";
-//#region src/runtime/server/mcp-auth-server.ts
+// src/runtime/server/mcp-auth-server.ts
 var mcp_auth_server_default = defineEventHandler(async (event) => {
 	const endpoint = mcpEndpoint(event);
 	if (event.req.method === "OPTIONS") return new Response(null, {
@@ -17,5 +17,4 @@ var mcp_auth_server_default = defineEventHandler(async (event) => {
 	});
 	return Response.json(await res.json(), { headers: CORS });
 });
-//#endregion
 export { mcp_auth_server_default as default };

package/dist/runtime/server/mcp-auth.d.ts

@@ -1,6 +1,5 @@
 import { WervtUser } from "../shared/user.js";
 import { RequestEvent } from "nuxt/server";
-//#region src/runtime/server/mcp-auth.d.ts
 /** What `wervt:mcp:token` handlers get: set `user` to accept the token. */
 export interface McpTokenContext {
   token: string;
@@ -57,5 +56,4 @@ export declare function verifyAccessToken(token: string, endpoint: McpEndpoint):
 /** The user a bearer token on `/mcp` stands for: a wervt access token, or the app's own. */
 export declare function authenticateMcp(token: string, event: RequestEvent, endpoint: McpEndpoint): Promise<WervtUser | undefined>;
 /** Makes `useWervtUser(event)` return the token's user while a tool runs over MCP. */
-export declare function setMcpUser(event: RequestEvent, user: WervtUser): void;
-//#endregion
+export declare function setMcpUser(event: RequestEvent, user: WervtUser): void;

package/dist/runtime/server/mcp-auth.js

@@ -1,7 +1,7 @@
 import { userFromClaims } from "./mcp-claims.js";
 import { getRequestURL, useServerHooks } from "nuxt/server";
 import { createRemoteJWKSet, customFetch, errors, jwtVerify } from "jose";
-//#region src/runtime/server/mcp-auth.ts
+// src/runtime/server/mcp-auth.ts
 const trimSlash = (url) => url.replace(/\/+$/, "");
 /**
 * Where this app's `/mcp` and wervt's login live, from the runtime's `WERVT_APP_URL` and
@@ -95,5 +95,4 @@ async function authenticateMcp(token, event, endpoint) {
 function setMcpUser(event, user) {
 	event.context.wervtMcpUser = user;
 }
-//#endregion
 export { CORS, authenticateMcp, fetchAuth, mcpEndpoint, protectedResourceMetadata, setMcpUser, verifyAccessToken };

package/dist/runtime/server/mcp-claims.d.ts

@@ -1,5 +1,3 @@
 import { WervtUser } from "../shared/user.js";
-//#region src/runtime/server/mcp-claims.d.ts
 /** The wervt user an access token's claims name, or undefined when they're incomplete. */
-export declare function userFromClaims(claims: Record<string, unknown>): WervtUser | undefined;
-//#endregion
+export declare function userFromClaims(claims: Record<string, unknown>): WervtUser | undefined;

package/dist/runtime/server/mcp-claims.js

@@ -1,4 +1,4 @@
-//#region src/runtime/server/mcp-claims.ts
+// src/runtime/server/mcp-claims.ts
 /** The wervt user an access token's claims name, or undefined when they're incomplete. */
 function userFromClaims(claims) {
 	const { sub, email, name, picture, accounts } = claims;
@@ -14,5 +14,4 @@ function userFromClaims(claims) {
 function isAccounts(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((id) => typeof id === "string");
 }
-//#endregion
 export { userFromClaims };

package/dist/runtime/server/mcp-metadata.d.ts

@@ -1,4 +1,2 @@
-//#region src/runtime/server/mcp-metadata.d.ts
 declare const _default: import("nuxt/server").EventHandler<Response>;
-//#endregion
 export { _default as default };

package/dist/runtime/server/mcp-metadata.js

@@ -1,6 +1,6 @@
 import { CORS, mcpEndpoint, protectedResourceMetadata } from "./mcp-auth.js";
 import { defineEventHandler, getRequestURL } from "nuxt/server";
-//#region src/runtime/server/mcp-metadata.ts
+// src/runtime/server/mcp-metadata.ts
 var mcp_metadata_default = defineEventHandler((event) => {
 	const endpoint = mcpEndpoint(event);
 	if (event.req.method === "OPTIONS") return new Response(null, {
@@ -11,5 +11,4 @@ var mcp_metadata_default = defineEventHandler((event) => {
 	const mcp = getRequestURL(event).pathname.endsWith("/mcp");
 	return Response.json(protectedResourceMetadata(endpoint, mcp ? endpoint.resource : endpoint.app), { headers: CORS });
 });
-//#endregion
 export { mcp_metadata_default as default };

package/dist/runtime/server/mcp.d.ts

@@ -1,4 +1,2 @@
-//#region src/runtime/server/mcp.d.ts
 declare const _default: import("nuxt/server").EventHandler<Promise<unknown>>;
-//#endregion
 export { _default as default };

package/dist/runtime/server/mcp.js

@@ -6,7 +6,7 @@ import { allTools, toolInputSchema } from "./tool-handlers.js";
 import { defineEventHandler } from "nuxt/server";
 import { server } from "#wervt/mcp";
 import { defineMcpHandler } from "h3-mcp";
-//#region src/runtime/server/mcp.ts
+// src/runtime/server/mcp.ts
 const MAX_BODY = 4194304;
 const text = (value) => [{
 	type: "text",
@@ -104,5 +104,4 @@ var mcp_default = defineEventHandler(async (event) => {
 	});
 	return (await handler)(event);
 });
-//#endregion
 export { mcp_default as default };

package/dist/runtime/server/preview-errors-plugin.d.ts

@@ -0,0 +1,13 @@
+interface ErrorContext {
+  event?: {
+    req?: Request;
+    path?: string;
+  };
+}
+interface NitroAppHooks {
+  hooks: {
+    hook(name: 'error', handler: (error: unknown, context: ErrorContext) => void): unknown;
+  };
+}
+export default function wervtPreviewErrors(nitroApp: NitroAppHooks): void;
+export {};

package/dist/runtime/server/preview-errors-plugin.js

@@ -0,0 +1,19 @@
+import { recordPreviewError, trimStack } from "../shared/preview-errors.js";
+// src/runtime/server/preview-errors-plugin.ts
+function wervtPreviewErrors(nitroApp) {
+	const file = process.env.WERVT_PREVIEW_ERRORS;
+	if (!file) return;
+	nitroApp.hooks.hook("error", (error, { event }) => {
+		const status = error ?? {};
+		if ((status.status ?? status.statusCode ?? 500) < 500) return;
+		const err = error instanceof Error ? error : new Error(String(error));
+		recordPreviewError(file, {
+			at: Date.now(),
+			source: "server",
+			message: `${err.name}: ${err.message}`,
+			stack: trimStack(err.stack),
+			url: event?.req ? new URL(event.req.url).pathname : event?.path
+		});
+	});
+}
+export { wervtPreviewErrors as default };

package/dist/runtime/server/seed.d.ts

@@ -1,6 +1,5 @@
 import { InferInsertModel } from "drizzle-orm";
 import { PgTable } from "drizzle-orm/pg-core";
-//#region src/runtime/server/seed.d.ts
 /**
  * Inserts `rows` into `table` only while it is empty, so a seed task can run again without
  * duplicating data or touching what users created. Returns how many rows it inserted.
@@ -14,5 +13,4 @@ import { PgTable } from "drizzle-orm/pg-core";
  *   },
  * })
  */
-export declare function seedTable<T extends PgTable>(table: T, rows: InferInsertModel<T>[]): Promise<number>;
-//#endregion
+export declare function seedTable<T extends PgTable>(table: T, rows: InferInsertModel<T>[]): Promise<number>;

package/dist/runtime/server/seed.js

@@ -1,6 +1,6 @@
 import { useDb } from "./db.js";
 import { sql } from "drizzle-orm";
-//#region src/runtime/server/seed.ts
+// src/runtime/server/seed.ts
 /**
 * Inserts `rows` into `table` only while it is empty, so a seed task can run again without
 * duplicating data or touching what users created. Returns how many rows it inserted.
@@ -23,5 +23,4 @@ async function seedTable(table, rows) {
 	await db.insert(target).values(rows);
 	return rows.length;
 }
-//#endregion
 export { seedTable };

package/dist/runtime/server/shape.d.ts

@@ -1,7 +1,6 @@
 import { ShapeResponse } from "../shared/shape.js";
 import { RequestEvent } from "nuxt/server";
 import { InferSelectModel, Table } from "drizzle-orm";
-//#region src/runtime/server/shape.d.ts
 export interface ShapeOptions<T extends Table | string = Table | string> {
   /**
    * The Drizzle table (`todos` from `server/db/schema`), or its name without schema. With the
@@ -22,5 +21,4 @@ export type ShapeRow<T extends Table | string> = T extends Table ? InferSelectMo
  * In production the request goes through the wervt runtime gateway, which pins the
  * table to this app's schema. In dev it goes to Electric directly (ELECTRIC_URL).
  */
-export declare function proxyShape<T extends Table | string>(event: RequestEvent, { table: tableOrName, where, params, columns }: ShapeOptions<T>): Promise<ShapeResponse<ShapeRow<T>>>;
-//#endregion
+export declare function proxyShape<T extends Table | string>(event: RequestEvent, { table: tableOrName, where, params, columns }: ShapeOptions<T>): Promise<ShapeResponse<ShapeRow<T>>>;

package/dist/runtime/server/shape.js

@@ -1,5 +1,5 @@
 import { getTableName, isTable } from "drizzle-orm";
-//#region src/runtime/server/shape.ts
+// src/runtime/server/shape.ts
 const CLIENT_PARAMS = [
 	"offset",
 	"handle",
@@ -53,5 +53,4 @@ function devTable(table) {
 function quoteIdentifier(name) {
 	return /^[a-z_][a-z0-9_]*$/.test(name) ? name : `"${name.replaceAll("\"", "\"\"")}"`;
 }
-//#endregion
 export { proxyShape };

package/dist/runtime/server/storage-plugin.d.ts

@@ -1,3 +1 @@
-//#region src/runtime/server/storage-plugin.d.ts
-export default function wervtStorage(): void;
-//#endregion
+export default function wervtStorage(): void;