@wervt/nuxt 0.3.2 → 0.3.4

package/dist/runtime/server/storage-plugin.js

@@ -1,5 +1,5 @@
 import { createS3Provider, setFileStorageProvider } from "#imports";
-//#region src/runtime/server/storage-plugin.ts
+// src/runtime/server/storage-plugin.ts
 function wervtStorage() {
 	const env = process.env;
 	if (!env.WERVT_S3_URL || !env.WERVT_S3_BUCKET) return;
@@ -12,5 +12,4 @@ function wervtStorage() {
 		publicEndpoint: env.WERVT_S3_PUBLIC_URL
 	}));
 }
-//#endregion
 export { wervtStorage as default };

package/dist/runtime/server/task-handlers.d.ts

@@ -1,4 +1,3 @@
-//#region src/runtime/server/task-handlers.d.ts
 type RunTask = (name: string, options: {
   payload?: Record<string, unknown>;
 }) => Promise<{
@@ -12,8 +11,8 @@ type Registry = Record<string, {
 }>;
 /** `POST /_wervt/tasks/:name`: runs a task when the control plane asks. */
 export declare function taskRunHandler(runTask: RunTask): import("nuxt/server").EventHandler<Promise<{
-  error: string;
   result?: undefined;
+  error: string;
 } | {
   error?: undefined;
   result: {} | null;
@@ -25,4 +24,4 @@ export declare function taskListHandler(tasks: Registry): import("nuxt/server").
 }[] | {
   error: string;
 }>>;
-//#endregion
+export {};

package/dist/runtime/server/task-handlers.js

@@ -1,5 +1,5 @@
 import { defineEventHandler } from "nuxt/server";
-//#region src/runtime/server/task-handlers.ts
+// src/runtime/server/task-handlers.ts
 function trusted(event) {
 	if (event.req.headers.get("x-wervt-task") === "1") return true;
 	event.res.status = 404;
@@ -34,5 +34,4 @@ function taskListHandler(tasks) {
 		}));
 	});
 }
-//#endregion
 export { taskListHandler, taskRunHandler };

package/dist/runtime/server/task-list-nitro2.d.ts

@@ -1,9 +1,7 @@
-//#region src/runtime/server/task-list-nitro2.d.ts
 declare const _default: import("nuxt/server").EventHandler<Promise<{
   name: string;
   description: string | undefined;
 }[] | {
   error: string;
 }>>;
-//#endregion
 export { _default as default };

package/dist/runtime/server/task-list-nitro2.js

@@ -1,6 +1,5 @@
 import { taskListHandler } from "./task-handlers.js";
 import { tasks } from "#nitro-internal-virtual/tasks";
-//#region src/runtime/server/task-list-nitro2.ts
+// src/runtime/server/task-list-nitro2.ts
 var task_list_nitro2_default = taskListHandler(tasks);
-//#endregion
 export { task_list_nitro2_default as default };

package/dist/runtime/server/task-list-nitro3.d.ts

@@ -1,9 +1,7 @@
-//#region src/runtime/server/task-list-nitro3.d.ts
 declare const _default: import("nuxt/server").EventHandler<Promise<{
   name: string;
   description: string | undefined;
 }[] | {
   error: string;
 }>>;
-//#endregion
 export { _default as default };

package/dist/runtime/server/task-list-nitro3.js

@@ -1,6 +1,5 @@
 import { taskListHandler } from "./task-handlers.js";
 import { tasks } from "#nitro/virtual/tasks";
-//#region src/runtime/server/task-list-nitro3.ts
+// src/runtime/server/task-list-nitro3.ts
 var task_list_nitro3_default = taskListHandler(tasks);
-//#endregion
 export { task_list_nitro3_default as default };

package/dist/runtime/server/task-run-nitro2.d.ts

@@ -1,4 +1,3 @@
-//#region src/runtime/server/task-run-nitro2.d.ts
 declare const _default: import("nuxt/server").EventHandler<Promise<{
   error: string;
   result?: undefined;
@@ -6,5 +5,4 @@ declare const _default: import("nuxt/server").EventHandler<Promise<{
   error?: undefined;
   result: {} | null;
 }>>;
-//#endregion
 export { _default as default };

package/dist/runtime/server/task-run-nitro2.js

@@ -1,6 +1,5 @@
 import { taskRunHandler } from "./task-handlers.js";
 import { runTask } from "nitropack/runtime";
-//#region src/runtime/server/task-run-nitro2.ts
+// src/runtime/server/task-run-nitro2.ts
 var task_run_nitro2_default = taskRunHandler(runTask);
-//#endregion
 export { task_run_nitro2_default as default };

package/dist/runtime/server/task-run-nitro3.d.ts

@@ -1,4 +1,3 @@
-//#region src/runtime/server/task-run-nitro3.d.ts
 declare const _default: import("nuxt/server").EventHandler<Promise<{
   error: string;
   result?: undefined;
@@ -6,5 +5,4 @@ declare const _default: import("nuxt/server").EventHandler<Promise<{
   error?: undefined;
   result: {} | null;
 }>>;
-//#endregion
 export { _default as default };

package/dist/runtime/server/task-run-nitro3.js

@@ -1,7 +1,6 @@
 import { taskRunHandler } from "./task-handlers.js";
 import { runTask } from "../../node_modules/.pnpm/nitro@3.0.260903-beta/node_modules/nitro/dist/runtime/internal/task.js";
 import "../../node_modules/.pnpm/nitro@3.0.260903-beta/node_modules/nitro/dist/runtime/task.js";
-//#region src/runtime/server/task-run-nitro3.ts
+// src/runtime/server/task-run-nitro3.ts
 var task_run_nitro3_default = taskRunHandler(runTask);
-//#endregion
 export { task_run_nitro3_default as default };

package/dist/runtime/server/tasks.d.ts

@@ -1,4 +1,3 @@
-//#region src/runtime/server/tasks.d.ts
 export interface TaskEvent<P = Record<string, unknown>> {
   name: string;
   /** `{ scheduledTime }` for scheduled runs, or what was passed to a manual run. */
@@ -16,5 +15,4 @@ export interface Task<R = unknown, P = Record<string, unknown>> {
   run(event: TaskEvent<P>): TaskResult<R> | Promise<TaskResult<R>>;
 }
 /** A task in `server/tasks/` (`server/tasks/presence/sweep.ts` is `presence:sweep`). */
-export declare function defineTask<R = unknown, P = Record<string, unknown>>(task: Task<R, P>): Task<R, P>;
-//#endregion
+export declare function defineTask<R = unknown, P = Record<string, unknown>>(task: Task<R, P>): Task<R, P>;

package/dist/runtime/server/tasks.js

@@ -1,4 +1,4 @@
-//#region src/runtime/server/tasks.ts
+// src/runtime/server/tasks.ts
 /** A task in `server/tasks/` (`server/tasks/presence/sweep.ts` is `presence:sweep`). */
 function defineTask(task) {
 	if (typeof task.run !== "function") task.run = () => {
@@ -6,5 +6,4 @@ function defineTask(task) {
 	};
 	return task;
 }
-//#endregion
 export { defineTask };

package/dist/runtime/server/tool-handlers.d.ts

@@ -1,6 +1,5 @@
 import { Input } from "./validate.js";
 import { Tool } from "./tools.js";
-//#region src/runtime/server/tool-handlers.d.ts
 /**
  * Every tool by the name agents see. A tool may rename itself (`name`), so the file-derived
  * keys of `#wervt/tools` are only a default and the whole list is loaded once.
@@ -40,5 +39,4 @@ export declare const runTool: import("nuxt/server").EventHandler<Promise<{
   error?: undefined;
   issues?: undefined;
   result: {} | null;
-}>>;
-//#endregion
+}>>;

package/dist/runtime/server/tool-handlers.js

@@ -4,7 +4,7 @@ import { TOOL_ROUTE } from "./tools.js";
 import { defineEventHandler } from "nuxt/server";
 import { toJsonSchema } from "@valibot/to-json-schema";
 import { routeMethods, tools } from "#wervt/tools";
-//#region src/runtime/server/tool-handlers.ts
+// src/runtime/server/tool-handlers.ts
 let index;
 /**
 * Every tool by the name agents see. A tool may rename itself (`name`), so the file-derived
@@ -90,5 +90,4 @@ const runTool = defineEventHandler(async (event) => {
 	}
 	return { result: await tool.handler(event, input) ?? null };
 });
-//#endregion
 export { allTools, listTools, loadTool, runTool, toolInputSchema };

package/dist/runtime/server/tool-list.js

@@ -1,5 +1,4 @@
 import { listTools } from "./tool-handlers.js";
-//#region src/runtime/server/tool-list.ts
+// src/runtime/server/tool-list.ts
 var tool_list_default = listTools;
-//#endregion
 export { tool_list_default as default };

package/dist/runtime/server/tool-run.js

@@ -1,5 +1,4 @@
 import { runTool } from "./tool-handlers.js";
-//#region src/runtime/server/tool-run.ts
+// src/runtime/server/tool-run.ts
 var tool_run_default = runTool;
-//#endregion
 export { tool_run_default as default };

package/dist/runtime/server/tools.d.ts

@@ -1,6 +1,5 @@
 import { Input, Output } from "./validate.js";
 import { RequestEvent } from "nuxt/server";
-//#region src/runtime/server/tools.d.ts
 export interface Tool<I extends Input | undefined = Input | undefined, R = unknown> {
   /** Overrides the name from the file path. Agents see it, so keep it short and stable. */
   name?: string;
@@ -48,4 +47,4 @@ export declare const TOOL_ROUTE: unique symbol;
 export declare function defineToolRoute<R, P extends Input | undefined = undefined, I extends Input | undefined = undefined>(route: ToolRoute<P, I, R>): import("nuxt/server").EventHandler<Promise<R>> & {
   [TOOL_ROUTE]: Tool<Input | undefined, unknown>;
 };
-//#endregion
+export {};

package/dist/runtime/server/tools.js

@@ -1,7 +1,7 @@
 import { validate } from "./validate.js";
 import { defineEventHandler, getQuery, getRouterParams, readBody } from "nuxt/server";
 import * as v from "valibot";
-//#region src/runtime/server/tools.ts
+// src/runtime/server/tools.ts
 /** A tool in `server/tools/` (`server/tools/todos/add.ts` is `todos.add`). */
 function defineTool(tool) {
 	return tool;
@@ -55,5 +55,4 @@ function entries(input) {
 	if ("entries" in input) return input.entries;
 	throw new Error("defineToolRoute: `params` and `input` must be objects to merge into a tool.");
 }
-//#endregion
 export { TOOL_ROUTE, defineTool, defineToolRoute };

package/dist/runtime/server/user-route.d.ts

@@ -1,8 +1,6 @@
 import { WervtUser } from "../shared/user.js";
 import "./user.js";
-//#region src/runtime/server/user-route.d.ts
 declare const _default: import("nuxt/server").EventHandler<{
   user: WervtUser | null;
 }>;
-//#endregion
 export { _default as default };

package/dist/runtime/server/user-route.js

@@ -1,9 +1,8 @@
 import { useWervtUser } from "./user.js";
 import { defineEventHandler } from "nuxt/server";
-//#region src/runtime/server/user-route.ts
+// src/runtime/server/user-route.ts
 var user_route_default = defineEventHandler((event) => {
 	event.res.headers.set("cache-control", "private, no-store");
 	return { user: useWervtUser(event) ?? null };
 });
-//#endregion
 export { user_route_default as default };

package/dist/runtime/server/user.d.ts

@@ -1,12 +1,16 @@
-import { DEV_LOGIN_COOKIE, WervtUser, parseWervtUser } from "../shared/user.js";
+import { DEV_LOGIN_COOKIE, WervtRole, WervtUser, parseWervtUser } from "../shared/user.js";
 import { RequestEvent } from "nuxt/server";
-//#region src/runtime/server/user.d.ts
 /**
  * The signed-in wervt user, or `undefined` when nobody is signed in.
  * Private apps always have one (the runtime checked the login and the allow-list); public
  * apps get one when the visitor is signed in. Send people to `/_wervt/login` to sign in.
  * In a tool called over MCP, it's the user the client signed in as.
  */
-export declare const useWervtUser: (event: RequestEvent) => WervtUser | undefined;
-//#endregion
-export { DEV_LOGIN_COOKIE, type WervtUser, parseWervtUser };
+export declare function useWervtUser(event: RequestEvent): WervtUser | undefined;
+/**
+ * The signed-in user if their role is one of `roles`, e.g.
+ * `requireWervtRole(event, 'owner', 'member', 'admin')` for the app's own admin features.
+ * Throws 401 without a signed-in user, 403 with another role.
+ */
+export declare function requireWervtRole(event: RequestEvent, ...roles: WervtRole[]): WervtUser;
+export { DEV_LOGIN_COOKIE, type WervtRole, type WervtUser, parseWervtUser };

package/dist/runtime/server/user.js

@@ -1,6 +1,6 @@
 import { DEV_LOGIN_COOKIE, devUser, parseWervtUser } from "../shared/user.js";
-import { getCookie } from "nuxt/server";
-//#region src/runtime/server/user.ts
+import { createError, getCookie } from "nuxt/server";
+// src/runtime/server/user.ts
 const MCP_USER = "wervtMcpUser";
 /**
 * The signed-in wervt user, or `undefined` when nobody is signed in.
@@ -8,6 +8,30 @@ const MCP_USER = "wervtMcpUser";
 * apps get one when the visitor is signed in. Send people to `/_wervt/login` to sign in.
 * In a tool called over MCP, it's the user the client signed in as.
 */
-const useWervtUser = (event) => event.context[MCP_USER] ?? parseWervtUser(event.req.headers.get("x-wervt-user")) ?? devUser(getCookie(event, "wervt_dev_login") === "1");
-//#endregion
-export { DEV_LOGIN_COOKIE, parseWervtUser, useWervtUser };
+function useWervtUser(event) {
+	const header = parseWervtUser(event.req.headers.get("x-wervt-user"));
+	const mcp = event.context[MCP_USER];
+	if (mcp) return mcp.role || header?.id !== mcp.id ? mcp : {
+		...mcp,
+		role: header.role
+	};
+	return header ?? devUser(getCookie(event, "wervt_dev_login") === "1");
+}
+/**
+* The signed-in user if their role is one of `roles`, e.g.
+* `requireWervtRole(event, 'owner', 'member', 'admin')` for the app's own admin features.
+* Throws 401 without a signed-in user, 403 with another role.
+*/
+function requireWervtRole(event, ...roles) {
+	const user = useWervtUser(event);
+	if (!user) throw createError({
+		status: 401,
+		message: "sign in at /_wervt/login first"
+	});
+	if (!user.role || !roles.includes(user.role)) throw createError({
+		status: 403,
+		message: `needs role ${roles.join(", ")}`
+	});
+	return user;
+}
+export { DEV_LOGIN_COOKIE, parseWervtUser, requireWervtRole, useWervtUser };

package/dist/runtime/server/validate.d.ts

@@ -1,6 +1,5 @@
 import { RequestEvent } from "nuxt/server";
 import * as v from "valibot";
-//#region src/runtime/server/validate.d.ts
 type Schema = v.GenericSchema | v.GenericSchemaAsync;
 type Shape = v.ObjectEntriesAsync;
 export type Input = Schema | Shape;
@@ -40,4 +39,4 @@ export declare const vh: {
   /** Positive integer id (e.g. a serial primary key) → number. */
   id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.DigitsAction<string, undefined>, v.TransformAction<any, number>, v.SafeIntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>;
 };
-//#endregion
+export {};

package/dist/runtime/server/validate.js

@@ -1,6 +1,6 @@
 import { createError, getQuery, getRouterParams, readBody } from "nuxt/server";
 import * as v from "valibot";
-//#region src/runtime/server/validate.ts
+// src/runtime/server/validate.ts
 function toSchema(input) {
 	return "kind" in input && input.kind === "schema" ? input : v.objectAsync(input);
 }
@@ -47,5 +47,4 @@ const vh = {
 	/** Positive integer id (e.g. a serial primary key) → number. */
 	id: v.pipe(v.string(), v.digits(), v.transform(Number), v.safeInteger(), v.minValue(1))
 };
-//#endregion
 export { safeValidate, toSchema, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, validate, vh };

package/dist/runtime/shared/agent-token.d.ts

@@ -0,0 +1,7 @@
+/** Who minted the agent token a request came with, and its id (the control plane's log). */
+export interface AgentToken {
+  id: string;
+  by: string;
+}
+/** Parses the `x-wervt-agent-token` header the runtime sets (and strips from client requests). */
+export declare function parseAgentToken(header: string | null | undefined): AgentToken | undefined;

package/dist/runtime/shared/agent-token.js

@@ -0,0 +1,16 @@
+// src/runtime/shared/agent-token.ts
+/** Parses the `x-wervt-agent-token` header the runtime sets (and strips from client requests). */
+function parseAgentToken(header) {
+	if (!header) return void 0;
+	try {
+		const value = JSON.parse(decodeURIComponent(header));
+		if (typeof value?.id !== "string" || typeof value.by !== "string") return void 0;
+		return {
+			id: value.id,
+			by: value.by
+		};
+	} catch {
+		return;
+	}
+}
+export { parseAgentToken };

package/dist/runtime/shared/mark.d.ts

@@ -0,0 +1 @@
+export declare const WERVT_MARK = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 32 32\" role=\"img\" aria-label=\"wervt\"><defs> <mask id=\"w56m\" maskUnits=\"userSpaceOnUse\" x=\"-4\" y=\"-4\" width=\"40\" height=\"40\"><rect x=\"-4\" y=\"-4\" width=\"40\" height=\"40\" fill=\"#fff\"/><path d=\"M-15.47 20.8 Q-12.8 19.4 -10.13 20.8 Q-7.47 22.2 -4.8 20.8 Q-2.13 19.4 0.53 20.8 Q3.2 22.2 5.87 20.8 Q8.53 19.4 11.2 20.8 Q13.87 22.2 16.53 20.8 Q19.2 19.4 21.87 20.8 Q24.53 22.2 27.2 20.8 Q29.87 19.4 32.53 20.8 Q35.2 22.2 37.87 20.8\" fill=\"none\" stroke=\"#000\" stroke-width=\"1.5\"/></mask> <clipPath id=\"w56a\"><path d=\"M-15.47 20.8 Q-12.8 19.4 -10.13 20.8 Q-7.47 22.2 -4.8 20.8 Q-2.13 19.4 0.53 20.8 Q3.2 22.2 5.87 20.8 Q8.53 19.4 11.2 20.8 Q13.87 22.2 16.53 20.8 Q19.2 19.4 21.87 20.8 Q24.53 22.2 27.2 20.8 Q29.87 19.4 32.53 20.8 Q35.2 22.2 37.87 20.8 L37.87 -4 L-15.47 -4 Z\"/></clipPath> <clipPath id=\"w56b\"><path d=\"M-15.47 20.8 Q-12.8 19.4 -10.13 20.8 Q-7.47 22.2 -4.8 20.8 Q-2.13 19.4 0.53 20.8 Q3.2 22.2 5.87 20.8 Q8.53 19.4 11.2 20.8 Q13.87 22.2 16.53 20.8 Q19.2 19.4 21.87 20.8 Q24.53 22.2 27.2 20.8 Q29.87 19.4 32.53 20.8 Q35.2 22.2 37.87 20.8 L37.87 40 L-15.47 40 Z\"/></clipPath></defs> <g mask=\"url(#w56m)\"><path d=\"M4 5 L11.8 5 L16 19.66 L20.2 5 L28 5 L18.1 27 L13.9 27 Z\" clip-path=\"url(#w56a)\" fill=\"currentColor\"/><path d=\"M4 5 L11.8 5 L16 19.66 L20.2 5 L28 5 L18.1 27 L13.9 27 Z\" clip-path=\"url(#w56b)\" style=\"fill:var(--a)\"/></g></svg>";

package/dist/runtime/shared/mark.js

@@ -0,0 +1,3 @@
+// src/runtime/shared/mark.ts
+const WERVT_MARK = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" role="img" aria-label="wervt"><defs> <mask id="w56m" maskUnits="userSpaceOnUse" x="-4" y="-4" width="40" height="40"><rect x="-4" y="-4" width="40" height="40" fill="#fff"/><path d="M-15.47 20.8 Q-12.8 19.4 -10.13 20.8 Q-7.47 22.2 -4.8 20.8 Q-2.13 19.4 0.53 20.8 Q3.2 22.2 5.87 20.8 Q8.53 19.4 11.2 20.8 Q13.87 22.2 16.53 20.8 Q19.2 19.4 21.87 20.8 Q24.53 22.2 27.2 20.8 Q29.87 19.4 32.53 20.8 Q35.2 22.2 37.87 20.8" fill="none" stroke="#000" stroke-width="1.5"/></mask> <clipPath id="w56a"><path d="M-15.47 20.8 Q-12.8 19.4 -10.13 20.8 Q-7.47 22.2 -4.8 20.8 Q-2.13 19.4 0.53 20.8 Q3.2 22.2 5.87 20.8 Q8.53 19.4 11.2 20.8 Q13.87 22.2 16.53 20.8 Q19.2 19.4 21.87 20.8 Q24.53 22.2 27.2 20.8 Q29.87 19.4 32.53 20.8 Q35.2 22.2 37.87 20.8 L37.87 -4 L-15.47 -4 Z"/></clipPath> <clipPath id="w56b"><path d="M-15.47 20.8 Q-12.8 19.4 -10.13 20.8 Q-7.47 22.2 -4.8 20.8 Q-2.13 19.4 0.53 20.8 Q3.2 22.2 5.87 20.8 Q8.53 19.4 11.2 20.8 Q13.87 22.2 16.53 20.8 Q19.2 19.4 21.87 20.8 Q24.53 22.2 27.2 20.8 Q29.87 19.4 32.53 20.8 Q35.2 22.2 37.87 20.8 L37.87 40 L-15.47 40 Z"/></clipPath></defs> <g mask="url(#w56m)"><path d="M4 5 L11.8 5 L16 19.66 L20.2 5 L28 5 L18.1 27 L13.9 27 Z" clip-path="url(#w56a)" fill="currentColor"/><path d="M4 5 L11.8 5 L16 19.66 L20.2 5 L28 5 L18.1 27 L13.9 27 Z" clip-path="url(#w56b)" style="fill:var(--a)"/></g></svg>`;
+export { WERVT_MARK };

package/dist/runtime/shared/preview-errors.d.ts

@@ -0,0 +1,10 @@
+export interface PreviewError {
+  at: number;
+  source: 'browser' | 'server';
+  message: string;
+  stack?: string;
+  url?: string;
+}
+export declare function recordPreviewError(file: string, error: PreviewError): Promise<void>;
+/** The frames that point at the app; enough to find the line, not a wall of text. */
+export declare function trimStack(stack: string | undefined): string | undefined;

package/dist/runtime/shared/preview-errors.js

@@ -0,0 +1,14 @@
+import { appendFile, mkdir } from "node:fs/promises";
+import { dirname } from "node:path";
+// src/runtime/shared/preview-errors.ts
+async function recordPreviewError(file, error) {
+	try {
+		await mkdir(dirname(file), { recursive: true });
+		await appendFile(file, `${JSON.stringify(error)}\n`);
+	} catch {}
+}
+/** The frames that point at the app; enough to find the line, not a wall of text. */
+function trimStack(stack) {
+	return stack?.split("\n").slice(1).filter((line) => !line.includes("node_modules")).slice(0, 6).join("\n");
+}
+export { recordPreviewError, trimStack };

package/dist/runtime/shared/shape.d.ts

@@ -1,4 +1,3 @@
-//#region src/runtime/shared/shape.d.ts
 declare const shapeRow: unique symbol;
 export type ShapeResponse<Row> = Response & {
   readonly [shapeRow]?: Row;
@@ -15,4 +14,4 @@ export declare const shapeParser: {
   timestamp: typeof parseTimestamp;
   timestamptz: typeof parseTimestamp;
 };
-//#endregion
+export {};

package/dist/runtime/shared/shape.js

@@ -1,4 +1,4 @@
-//#region src/runtime/shared/shape.ts
+// src/runtime/shared/shape.ts
 /**
 * Postgres text of a `timestamp`/`timestamptz` as a Date, like Drizzle's default `mode: 'date'`
 * reads it. Drizzle stores `timestamp` without time zone as UTC, so it's read as UTC too.
@@ -12,5 +12,4 @@ const shapeParser = {
 	timestamp: parseTimestamp,
 	timestamptz: parseTimestamp
 };
-//#endregion
 export { parseTimestamp, shapeParser };

package/dist/runtime/shared/user.d.ts

@@ -1,4 +1,9 @@
-//#region src/runtime/shared/user.d.ts
+/**
+ * What the user is to this app: its `owner` or one of its `member`s (`wervt members`), a wervt
+ * `admin`, someone `invited` through the app (invite-only apps) or `allowed` by the app's list
+ * (`wervt access --add`). `public` is anyone else signed in to a public app.
+ */
+export type WervtRole = 'owner' | 'member' | 'admin' | 'invited' | 'allowed' | 'public';
 export interface WervtUser {
   id: string;
   email: string;
@@ -6,11 +11,12 @@ export interface WervtUser {
   image?: string;
   /** Linked login accounts, provider id to the user's id there, e.g. `{ twitch: '1234' }`. */
   accounts?: Record<string, string>;
+  /** Missing only for users an app's own `/mcp` tokens stand for (`wervt:mcp:token`). */
+  role?: WervtRole;
 }
 /** Cookie set by the dev stand-in for `/_wervt/login` (see `server/dev-auth.ts`). */
 export declare const DEV_LOGIN_COOKIE = "wervt_dev_login";
 /** Parses the `x-wervt-user` header the runtime sets (and strips from client requests). */
 export declare function parseWervtUser(header: string | null | undefined): WervtUser | undefined;
 /** During `nuxt dev`: the configured dev user, after `/_wervt/login`. */
-export declare function devUser(loggedIn: boolean): WervtUser | undefined;
-//#endregion
+export declare function devUser(loggedIn: boolean): WervtUser | undefined;

package/dist/runtime/shared/user.js

@@ -1,4 +1,4 @@
-//#region src/runtime/shared/user.ts
+// src/runtime/shared/user.ts
 /** Cookie set by the dev stand-in for `/_wervt/login` (see `server/dev-auth.ts`). */
 const DEV_LOGIN_COOKIE = "wervt_dev_login";
 /** Parses the `x-wervt-user` header the runtime sets (and strips from client requests). */
@@ -14,7 +14,9 @@ function parseWervtUser(header) {
 function devUser(loggedIn) {
 	const user = process.env.WERVT_DEV_USER;
 	if (!import.meta.dev || !loggedIn || !user) return void 0;
-	return JSON.parse(user);
+	return {
+		role: "owner",
+		...JSON.parse(user)
+	};
 }
-//#endregion
 export { DEV_LOGIN_COOKIE, devUser, parseWervtUser };

package/dist/seed.js

@@ -1,4 +1,4 @@
-//#region src/seed.ts
+// src/seed.ts
 /** The conventional seed task: `server/tasks/db/seed.ts`. */
 const SEED_TASK = "db:seed";
 /**
@@ -48,5 +48,4 @@ async function runDevSeed(baseUrl, { fetch: request = fetch, timeout = 12e4, int
 		result: body.result
 	};
 }
-//#endregion
 export { SEED_TASK, runDevSeed, unscheduleSeed };

package/dist/shapes.js

@@ -1,6 +1,6 @@
 import { readdir } from "node:fs/promises";
 import { extname, join, relative, sep } from "node:path";
-//#region src/shapes.ts
+// src/shapes.ts
 const ROUTE_EXTENSIONS = /* @__PURE__ */ new Set([
 	".ts",
 	".mts",
@@ -66,5 +66,4 @@ function shapeRoutesTypes(routes, typesDir, shapeTypes) {
 		""
 	].join("\n");
 }
-//#endregion
 export { findShapeRoutes, shapeRoutes, shapeRoutesTypes, shapesManifest };

package/dist/storage.d.ts

@@ -1,4 +1,3 @@
-//#region src/storage.d.ts
 export interface StorageOptions {
   /** Garage's admin API, e.g. http://garage:3903 */
   adminUrl: string;
@@ -13,14 +12,61 @@ export interface StorageUsage {
   bytes: number;
   /** Multipart uploads started but never completed or aborted. */
   unfinishedUploads: number;
+  /** The bucket's size limit in bytes, null for none. */
+  maxBytes: number | null;
+}
+export interface StorageQuota {
+  /** Bytes the bucket may hold; null for no limit. Garage refuses uploads past it. */
+  maxBytes: number | null;
 }
 export declare class StorageError extends Error {}
+export interface StoredObject {
+  key: string;
+  size: number;
+  /** ISO time. */
+  lastModified: string;
+}
+export interface ObjectListing {
+  prefix: string;
+  /** Prefixes one level below `prefix`, ending in `/`. */
+  folders: string[];
+  files: StoredObject[];
+  /** Pass as `token` for the next page. */
+  next?: string;
+}
+export interface ObjectDetails extends StoredObject {
+  contentType: string | null;
+  /** `x-amz-meta-*` headers, without the prefix. */
+  metadata: Record<string, string>;
+}
+/** S3's limit for object keys, in bytes. */
+export declare const MAX_KEY_BYTES = 1024;
 export declare function createStorage(options: StorageOptions): {
   ensureLayout: () => Promise<void>;
-  provision: (app: string, appOrigin: string) => Promise<{
+  provision: (app: string, appOrigin: string, quota?: StorageQuota) => Promise<{
     bucket: string;
   }>;
+  setQuota: (app: string, quota: StorageQuota) => Promise<boolean>;
   usage: (app: string) => Promise<StorageUsage | undefined>;
+  list: (app: string, { prefix, token, limit }?: {
+    prefix?: string;
+    token?: string;
+    limit?: number;
+  }) => Promise<ObjectListing | undefined>;
+  describe: (app: string, key: string) => Promise<ObjectDetails | undefined>;
+  downloadUrl: (app: string, key: string, { publicUrl, expiresIn }: {
+    publicUrl: string;
+    expiresIn?: number;
+  }) => Promise<string>;
+  remove: (app: string, key: string) => Promise<{
+    deleted: string[];
+  } | undefined>;
+  sweepAbandonedUploads: (app: string, { graceMs, now }?: {
+    graceMs?: number | undefined;
+    now?: number | undefined;
+  }) => Promise<{
+    deleted: string[];
+  }>;
+  hasBucket: (app: string) => Promise<boolean>;
   drop: (app: string) => Promise<void>;
-};
-//#endregion
+};