@wervt/nuxt 0.3.2 → 0.3.4

package/dist/storage.js

@@ -1,7 +1,76 @@
 import { storageCredentials } from "./provision.js";
 import { AwsClient } from "aws4fetch";
-//#region src/storage.ts
+// src/storage.ts
 var StorageError = class extends Error {};
+/**
+* ablage marks bytes uploaded straight from browsers (`x-amz-meta-ablage-direct-upload`). Its
+* metadata object (`<group>/meta/<id>`) is only written once `completeUpload()` has checked them,
+* so marked bytes without one belong to an upload that was never completed.
+*/
+const DIRECT_UPLOAD_MARKER = "x-amz-meta-ablage-direct-upload";
+/**
+* How old abandoned direct-upload bytes must be before the sweep deletes them. The browser calls
+* `completeUpload()` right after its `PUT` finishes, so a day leaves any upload in flight alone;
+* it matches the lifecycle rule for multipart uploads.
+*/
+const ABANDONED_UPLOAD_GRACE_MS = 864e5;
+/** ablage's S3 layout: `<group>/data/<id>` holds the bytes, `<group>/meta/<id>` the metadata. */
+function metaKeyOf(key) {
+	const parts = key.split("/");
+	if (parts.length < 3 || parts.at(-2) !== "data" || !parts.at(-1)) return void 0;
+	return [
+		...parts.slice(0, -2),
+		"meta",
+		parts.at(-1)
+	].join("/");
+}
+const unescapeXml = (text) => text.replace(/&(amp|lt|gt|quot|apos|#x?[0-9a-f]+);/gi, (_, entity) => {
+	const named = {
+		amp: "&",
+		lt: "<",
+		gt: ">",
+		quot: "\"",
+		apos: "'"
+	};
+	if (entity in named) return named[entity];
+	const hex = entity[1] === "x" || entity[1] === "X";
+	return String.fromCodePoint(parseInt(entity.slice(hex ? 2 : 1), hex ? 16 : 10));
+});
+/**
+* Objects of a ListObjectsV2 page, its folders (listed with a delimiter), and the token for the
+* next page.
+*/
+function parseObjectList(xml) {
+	const objects = [...xml.matchAll(/<Contents>([\s\S]*?)<\/Contents>/g)].map(([, entry]) => ({
+		key: unescapeXml(/<Key>([^<]*)<\/Key>/.exec(entry)?.[1] ?? ""),
+		lastModified: Date.parse(/<LastModified>([^<]*)<\/LastModified>/.exec(entry)?.[1] ?? ""),
+		size: Number(/<Size>([^<]*)<\/Size>/.exec(entry)?.[1] ?? 0)
+	}));
+	const prefixes = [...xml.matchAll(/<CommonPrefixes>([\s\S]*?)<\/CommonPrefixes>/g)].map(([, entry]) => unescapeXml(/<Prefix>([^<]*)<\/Prefix>/.exec(entry)?.[1] ?? ""));
+	const next = /<IsTruncated>true<\/IsTruncated>/.test(xml) ? /<NextContinuationToken>([^<]*)<\/NextContinuationToken>/.exec(xml)?.[1] : void 0;
+	return {
+		objects,
+		prefixes,
+		next: next === void 0 ? void 0 : unescapeXml(next)
+	};
+}
+/**
+* ablage keeps a file as bytes and metadata, which only make sense together: the metadata key
+* for bytes, the bytes for metadata, undefined for anything else.
+*/
+function companionKeyOf(key) {
+	const meta = metaKeyOf(key);
+	if (meta !== void 0) return meta;
+	const parts = key.split("/");
+	if (parts.length < 3 || parts.at(-2) !== "meta" || !parts.at(-1)) return void 0;
+	return [
+		...parts.slice(0, -2),
+		"data",
+		parts.at(-1)
+	].join("/");
+}
+/** S3's limit for object keys, in bytes. */
+const MAX_KEY_BYTES = 1024;
 function createStorage(options) {
 	async function admin(path, body) {
 		const res = await fetch(`${options.adminUrl}/v2/${path}`, {
@@ -52,8 +121,9 @@ function createStorage(options) {
 	/**
 	* Creates the app's bucket and key if they're missing, lets the app's origin upload and
 	* download from browsers (CORS), and cleans up abandoned uploads. Safe to run on every deploy.
+	* With `quota`, sets the bucket's size limit too; without, leaves it as it is.
 	*/
-	async function provision(app, appOrigin) {
+	async function provision(app, appOrigin, quota) {
 		const { creds, client, base } = await s3(app);
 		const bucket = await exists(`GetBucketInfo?globalAlias=${creds.bucket}`) ?? await admin("CreateBucket", { globalAlias: creds.bucket });
 		if (!await exists(`GetKeyInfo?id=${creds.accessKeyId}`)) await admin("ImportKey", {
@@ -70,6 +140,7 @@ function createStorage(options) {
 				owner: true
 			}
 		});
+		if (quota) await applyQuota(bucket.id, quota);
 		const cors = `<CORSConfiguration><CORSRule>
 <AllowedOrigin>${appOrigin}</AllowedOrigin>
 <AllowedMethod>GET</AllowedMethod><AllowedMethod>HEAD</AllowedMethod>
@@ -92,6 +163,20 @@ function createStorage(options) {
 		if (!rules.ok) throw new StorageError(`setting the lifecycle for ${creds.bucket}: ${await rules.text()}`);
 		return { bucket: creds.bucket };
 	}
+	function applyQuota(bucketId, quota) {
+		return admin(`UpdateBucket?id=${bucketId}`, { quotas: {
+			maxSize: quota.maxBytes,
+			maxObjects: null
+		} });
+	}
+	/** Changes the size limit of an existing bucket. False when the app has no bucket yet. */
+	async function setQuota(app, quota) {
+		const { creds } = await s3(app);
+		const bucket = await exists(`GetBucketInfo?globalAlias=${creds.bucket}`);
+		if (!bucket) return false;
+		await applyQuota(bucket.id, quota);
+		return true;
+	}
 	async function usage(app) {
 		const { creds } = await s3(app);
 		const info = await exists(`GetBucketInfo?globalAlias=${creds.bucket}`);
@@ -100,9 +185,53 @@ function createStorage(options) {
 			bucket: creds.bucket,
 			objects: info.objects,
 			bytes: info.bytes,
-			unfinishedUploads: info.unfinishedMultipartUploads
+			unfinishedUploads: info.unfinishedMultipartUploads,
+			maxBytes: info.quotas?.maxSize ?? null
 		};
 	}
+	/**
+	* Deletes the bytes of direct uploads that were never completed: marked by ablage, older than
+	* `graceMs` and without a metadata object. ablage never lists them, but they count against the
+	* bucket quota. Safe to run any time and as often as wanted.
+	*/
+	async function sweepAbandonedUploads(app, { graceMs = ABANDONED_UPLOAD_GRACE_MS, now = Date.now() } = {}) {
+		const { creds, client, base } = await s3(app);
+		if (!await exists(`GetBucketInfo?globalAlias=${creds.bucket}`)) return { deleted: [] };
+		const url = (key) => `${base}/${key.split("/").map(encodeURIComponent).join("/")}`;
+		const candidates = /* @__PURE__ */ new Map();
+		let token;
+		do {
+			const query = `list-type=2&max-keys=1000${token ? `&continuation-token=${encodeURIComponent(token)}` : ""}`;
+			const res = await client.fetch(`${base}?${query}`);
+			if (!res.ok) throw new StorageError(`listing ${creds.bucket}: ${await res.text()}`);
+			const page = parseObjectList(await res.text());
+			for (const object of page.objects) {
+				candidates.delete(object.key);
+				const metaKey = metaKeyOf(object.key);
+				if (metaKey !== void 0 && now - object.lastModified >= graceMs) candidates.set(metaKey, object.key);
+			}
+			token = page.next;
+		} while (token);
+		const deleted = [];
+		for (const [metaKey, key] of candidates) {
+			const head = await client.fetch(url(key), { method: "HEAD" });
+			if (head.status === 404) continue;
+			if (!head.ok) throw new StorageError(`checking ${key} in ${creds.bucket}: ${head.status}`);
+			if (!head.headers.get(DIRECT_UPLOAD_MARKER)) continue;
+			const meta = await client.fetch(url(metaKey), { method: "HEAD" });
+			if (meta.ok) continue;
+			if (meta.status !== 404) throw new StorageError(`checking ${metaKey} in ${creds.bucket}: ${meta.status}`);
+			const res = await client.fetch(url(key), { method: "DELETE" });
+			if (!res.ok && res.status !== 404) throw new StorageError(`deleting ${key} in ${creds.bucket}: ${await res.text()}`);
+			deleted.push(key);
+		}
+		return { deleted };
+	}
+	/** Whether the app's bucket exists, e.g. left over from a deleted app that kept its data. */
+	async function hasBucket(app) {
+		const creds = await storageCredentials(app, options.secret);
+		return Boolean(await exists(`GetBucketInfo?globalAlias=${creds.bucket}`));
+	}
 	/** Deletes every object and unfinished upload, then the bucket. Only with "drop data". */
 	async function drop(app) {
 		const { creds, client, base } = await s3(app);
@@ -133,12 +262,102 @@ function createStorage(options) {
 			await admin(`DeleteBucket?id=${String(bucket.id)}`, {});
 		}
 	}
+	const objectUrl = (base, key) => `${base}/${key.split("/").map(encodeURIComponent).join("/")}`;
+	/**
+	* One page of the bucket, one folder level at a time like a file browser: the files directly
+	* in `prefix` and the folders below it. Undefined when the app has no bucket.
+	*/
+	async function list(app, { prefix = "", token, limit = 200 } = {}) {
+		const { creds, client, base } = await s3(app);
+		const query = new URLSearchParams({
+			"list-type": "2",
+			delimiter: "/",
+			prefix,
+			"max-keys": String(Math.min(Math.max(limit, 1), 1e3))
+		});
+		if (token) query.set("continuation-token", token);
+		const res = await client.fetch(`${base}?${query.toString()}`);
+		if (res.status === 404) return void 0;
+		if (!res.ok) throw new StorageError(`listing ${creds.bucket}: ${await res.text()}`);
+		const page = parseObjectList(await res.text());
+		return {
+			prefix,
+			folders: page.prefixes,
+			files: page.objects.map((object) => ({
+				key: object.key,
+				size: object.size,
+				lastModified: new Date(object.lastModified).toISOString()
+			})),
+			next: page.next
+		};
+	}
+	/** Size, type and metadata of one object; undefined when it doesn't exist. */
+	async function describe(app, key) {
+		const { creds, client, base } = await s3(app);
+		const res = await client.fetch(objectUrl(base, key), { method: "HEAD" });
+		if (res.status === 404) return void 0;
+		if (!res.ok) throw new StorageError(`reading ${key} in ${creds.bucket}: ${res.status}`);
+		const metadata = {};
+		for (const [name, value] of res.headers) if (name.startsWith("x-amz-meta-")) metadata[name.slice(11)] = value;
+		const modified = res.headers.get("last-modified");
+		return {
+			key,
+			size: Number(res.headers.get("content-length") ?? 0),
+			lastModified: modified ? new Date(modified).toISOString() : "",
+			contentType: res.headers.get("content-type"),
+			metadata
+		};
+	}
+	/**
+	* A presigned download link on `publicUrl`, the S3 API as browsers reach it, so files go from
+	* Garage straight to the browser. Always an attachment, never shown inline: the file is the
+	* app's users' content and may well be HTML.
+	*/
+	async function downloadUrl(app, key, { publicUrl, expiresIn = 300 }) {
+		const { creds, client } = await s3(app);
+		const url = new URL(objectUrl(`${publicUrl.replace(/\/$/, "")}/${creds.bucket}`, key));
+		const name = key.split("/").at(-1) || "download";
+		const ascii = name.replace(/[^\x20-\x7e]|["\\]/g, "_");
+		url.searchParams.set("response-content-disposition", `attachment; filename="${ascii}"; filename*=UTF-8''${encodeURIComponent(name)}`);
+		url.searchParams.set("X-Amz-Expires", String(expiresIn));
+		return (await client.sign(url.toString(), {
+			method: "GET",
+			aws: { signQuery: true }
+		})).url;
+	}
+	/**
+	* Deletes one object, and its ablage companion (see companionKeyOf) so ablage never lists a
+	* file whose bytes are gone. Undefined when the object doesn't exist.
+	*/
+	async function remove(app, key) {
+		const { creds, client, base } = await s3(app);
+		const present = async (k) => {
+			const res = await client.fetch(objectUrl(base, k), { method: "HEAD" });
+			if (res.status === 404) return false;
+			if (!res.ok) throw new StorageError(`checking ${k} in ${creds.bucket}: ${res.status}`);
+			return true;
+		};
+		if (!await present(key)) return void 0;
+		const companion = companionKeyOf(key);
+		const keys = companion !== void 0 && await present(companion) ? [key, companion] : [key];
+		for (const k of keys) {
+			const res = await client.fetch(objectUrl(base, k), { method: "DELETE" });
+			if (!res.ok && res.status !== 404) throw new StorageError(`deleting ${k} in ${creds.bucket}: ${await res.text()}`);
+		}
+		return { deleted: keys };
+	}
 	return {
 		ensureLayout,
 		provision,
+		setQuota,
 		usage,
+		list,
+		describe,
+		downloadUrl,
+		remove,
+		sweepAbandonedUploads,
+		hasBucket,
 		drop
 	};
 }
-//#endregion
-export { StorageError, createStorage };
+export { ABANDONED_UPLOAD_GRACE_MS, MAX_KEY_BYTES, StorageError, companionKeyOf, createStorage, metaKeyOf, parseObjectList };

package/dist/studio-preview.js

@@ -0,0 +1,34 @@
+import { previewLoadingTemplate } from "./loading.js";
+import { recordPreviewError, trimStack } from "./runtime/shared/preview-errors.js";
+import { addServerPlugin, createResolver } from "nuxt/kit";
+import { join } from "node:path";
+// src/studio-preview.ts
+/** One error per line: what the app raised in the browser or on the server. */
+const PREVIEW_ERRORS = ".data/preview-errors.jsonl";
+function setupStudioPreview(nuxt) {
+	const devtools = nuxt.options.devtools;
+	nuxt.options.devtools = {
+		...typeof devtools === "object" ? devtools : {},
+		enabled: false
+	};
+	nuxt.options.devServer.loadingTemplate = previewLoadingTemplate;
+	nuxt.options.app.head.style = [...nuxt.options.app.head.style ?? [], { innerHTML: "nuxt-error-overlay,[data-nuxt-dev-error]{display:none!important}" }];
+	const resolver = createResolver(import.meta.url);
+	nuxt.hook("app:resolve", (app) => {
+		if (!app.errorComponent || app.errorComponent.includes("nuxt-error-page")) app.errorComponent = resolver.resolve("./runtime/app/preview-error");
+	});
+	const file = join(nuxt.options.rootDir, PREVIEW_ERRORS);
+	process.env.WERVT_PREVIEW_ERRORS = file;
+	addServerPlugin(resolver.resolve("./runtime/server/preview-errors-plugin"));
+	nuxt.hook("vite:serverCreated", (server) => {
+		server.environments?.client?.hot.on("nuxt:dev:client-error", (data) => {
+			recordPreviewError(file, {
+				at: Date.now(),
+				source: "browser",
+				message: `${data.name ?? "Error"}: ${data.message ?? ""}`,
+				stack: trimStack(data.stack)
+			});
+		});
+	});
+}
+export { PREVIEW_ERRORS, setupStudioPreview };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wervt/nuxt",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Nuxt module for apps hosted on wervt: database, live data, MCP and runtime setup.",
   "keywords": [
     "drizzle",
@@ -37,6 +37,10 @@
       "types": "./dist/runtime/email/index.d.ts",
       "default": "./dist/runtime/email/index.js"
     },
+    "./anthropic": {
+      "types": "./dist/runtime/server/anthropic.d.ts",
+      "default": "./dist/runtime/server/anthropic.js"
+    },
     "./provision": {
       "types": "./dist/provision.d.ts",
       "default": "./dist/provision.js"
@@ -46,27 +50,32 @@
     "@electric-sql/client": "^1.5.28",
     "@valibot/to-json-schema": "^1.8.0",
     "aws4fetch": "^1.0.20",
-    "evlog": "^2.30.1",
+    "evlog": "^2.34.0",
     "h3-mcp": "0.2.0",
-    "html-to-text": "^9.0.5",
-    "jose": "^6.2.12",
+    "html-to-text": "^10.0.1",
+    "jose": "^6.2.13",
     "postgres": "^3.4.9",
     "valibot": "^1.5.0"
   },
   "devDependencies": {
+    "@anthropic-ai/sdk": "^1.3.0",
     "@types/html-to-text": "^9.0.4",
-    "drizzle-orm": "1.0.0-rc.4",
-    "h3": "2.0.2",
+    "drizzle-orm": "1.0.0-rc.5",
+    "h3": "2.0.8",
     "nitro": "3.0.260903-beta",
     "nuxt": "npm:nuxt-nightly@5x",
-    "vue": "^3.5.43"
+    "vue": "^3.5.44"
   },
   "peerDependencies": {
-    "drizzle-orm": "1.0.0-rc.4",
+    "@anthropic-ai/sdk": ">=0.97.1",
+    "drizzle-orm": ">=1.0.0-rc.5 <2",
     "h3": "^2.0.1",
     "nuxt": ">=4.2"
   },
   "peerDependenciesMeta": {
+    "@anthropic-ai/sdk": {
+      "optional": true
+    },
     "h3": {
       "optional": true
     }