@wervt/nuxt 0.3.9 → 0.3.10

package/dist/brand.d.ts

@@ -1,5 +1,8 @@
 export interface BrandOptions {
-  /** The product name the login shows ("Sign in to …"). Defaults to the app's `app.head.title`. */
+  /**
+   * The product name the login shows ("Sign in to …"). Defaults to the app's `app.head.title` up
+   * to its first separator, so "Lightdrop · Drop it. Get it." gives "Lightdrop".
+   */
   name?: string;
   /**
    * A wide logo for the top of the login page: a file in `public/` or an https URL. Without one,
@@ -8,10 +11,14 @@ export interface BrandOptions {
   logo?: string;
   /**
    * A square icon for the tab and the code mail: a file in `public/` or an https URL. PNG for the
-   * mail, since Gmail and Outlook don't show SVG. Defaults to the app's `<link rel="icon">`.
+   * mail, since Gmail and Outlook don't show SVG. Defaults to the app's PNG icon in `app.head`
+   * (`<link rel="icon">` or `apple-touch-icon`), else its first `<link rel="icon">`.
    */
   icon?: string;
-  /** The login's primary color as hex (`#ff5a1f`). Defaults to the `theme-color` meta tag. */
+  /**
+   * The login's primary color as hex (`#ff5a1f`). Without it the login keeps wervt's: the
+   * `theme-color` meta tag is usually the page background, not an accent.
+   */
   color?: string;
   /**
    * The small "Secured by wervt" under the login and in the mail footer. On by default: it says

package/dist/brand.js

@@ -1,4 +1,4 @@
-import { headIcon, headMeta } from "./preview.js";
+import { headIcon } from "./preview.js";
 // src/brand.ts
 const SIGN_IN_METHODS = [
 	"google",
@@ -16,21 +16,35 @@ function signInMethods(value) {
 	return methods.length ? methods : void 0;
 }
 const HEX_COLOR = /^#(?:[0-9a-f]{3}|[0-9a-f]{6})$/i;
+/** Image types Gmail and Outlook show; SVG and ICO stay blank there. */
+const MAIL_IMAGE = /\.(png|jpe?g|gif)(\?.*)?$/i;
+const TITLE_SEPARATOR = /\s+[·|–—-]\s+|\s*[·|–—]\s*|:\s+/;
+/** The product name in a page title, without its tagline. */
+function titleName(title) {
+	return title.split(TITLE_SEPARATOR)[0].trim() || title.trim();
+}
+function mailIcon(head) {
+	return (head.link?.find((link) => [
+		"icon",
+		"shortcut icon",
+		"apple-touch-icon"
+	].includes(String(link.rel)) && typeof link.href === "string" && MAIL_IMAGE.test(link.href)))?.href;
+}
 /** The login's branding for the app, or undefined while the app keeps wervt's. */
 function brandManifest(option, head, app, favicon) {
 	if (!option) return void 0;
 	const custom = option === true ? {} : option;
 	const pick = (value, fallback) => value?.trim() || fallback;
-	const title = typeof head.title === "string" && head.title.trim() ? head.title.trim() : app;
-	const color = pick(custom.color, headMeta(head, "theme-color"));
+	const title = typeof head.title === "string" && head.title.trim() ? titleName(head.title) : app;
+	const color = custom.color?.trim();
 	const signIn = signInMethods(custom.signIn);
 	return {
 		name: pick(custom.name, title).slice(0, 60),
 		logo: pick(custom.logo, void 0),
-		icon: pick(custom.icon, headIcon(head) ?? favicon),
+		icon: pick(custom.icon, mailIcon(head) ?? headIcon(head) ?? favicon),
 		color: color && HEX_COLOR.test(color) ? color : void 0,
 		...custom.securedByWervt === false && { securedByWervt: false },
 		...signIn && { signIn }
 	};
 }
-export { HEX_COLOR, SIGN_IN_METHODS, brandManifest, signInMethods };
+export { HEX_COLOR, MAIL_IMAGE, SIGN_IN_METHODS, brandManifest, signInMethods, titleName };

package/dist/module.d.ts

@@ -1,6 +1,7 @@
-import { DevOptions } from "./dev.js";
 import { PreviewOptions } from "./preview.js";
 import { BrandOptions } from "./brand.js";
+import { TasksManifest } from "@wervt/core";
+import { DevOptions } from "@wervt/platform/dev";
 export interface ModuleOptions {
   /** App name on wervt. Defaults to the package.json name. */
   app?: string;
@@ -76,17 +77,5 @@ export interface McpOptions {
   /** How to use the tools together, e.g. which one to call first. Clients pass it to the model. */
   instructions?: string;
 }
-/** `server/wervt-tasks.json` in the build: the app's tasks and schedules, for the control plane. */
-export interface TasksManifest {
-  tasks: {
-    name: string;
-    description?: string;
-  }[];
-  schedules: {
-    cron: string;
-    tasks: string[];
-  }[];
-  timezone?: string;
-}
 declare const _default: import("nuxt/schema").NuxtModule<ModuleOptions, ModuleOptions, false>;
-export { _default as default };
+export { type TasksManifest, _default as default };

package/dist/module.js

@@ -1,20 +1,20 @@
-import { SEED_TASK, unscheduleSeed } from "./seed.js";
-import { resolveAppName, setupDev } from "./dev.js";
 import { setupStudioPreview } from "./studio-preview.js";
 import { PROCESS_ENV_TYPES } from "./env-types.js";
 import { dependencyNames, ogImageDefaults, ogImageWarning } from "./og-image.js";
 import { iconDefaults, iconSources, iconWarning } from "./icons.js";
-import { stripJsdocImports } from "./jsdoc-imports.js";
 import { findRouteTools } from "./route-tools.js";
 import { localFiles, previewManifest } from "./preview.js";
-import { SIGN_IN_METHODS, brandManifest } from "./brand.js";
+import { MAIL_IMAGE, SIGN_IN_METHODS, brandManifest } from "./brand.js";
 import { findShapeRoutes, shapeRoutesTypes, shapesManifest } from "./shapes.js";
+import { BUNDLE_MANIFEST } from "@wervt/core";
+import { SEED_TASK, resolveAppName, setupDev, unscheduleSeed } from "@wervt/platform/dev";
 import { addImports, addPlugin, addServerHandler, addServerPlugin, addServerTemplate, addTypeTemplate, createResolver, defineNuxtModule, getNuxtVersion, hasNuxtModule, installModule, updateTemplates, useLogger } from "nuxt/kit";
 import { existsSync } from "node:fs";
 import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
-import { builtinModules, createRequire } from "node:module";
+import { createRequire } from "node:module";
 import { dirname, extname, join, relative, resolve, sep } from "node:path";
 import evlog from "evlog/nuxt";
+import { DENO_INJECT, denoPlugins } from "@wervt/nitro/build";
 // src/module.ts
 const CONTENT_DATABASE = {
 	type: "postgres",
@@ -86,7 +86,7 @@ var module_default = defineNuxtModule({
 				inline: [
 					...options.externals?.inline ?? [],
 					resolver.resolve("./runtime"),
-					/(^|\/node_modules\/)(drizzle-orm|postgres|valibot|@valibot\/to-json-schema|@electric-sql\/client|evlog)(\/|$)/
+					/(^|\/node_modules\/)(@wervt\/(core|client)|drizzle-orm|postgres|valibot|@valibot\/to-json-schema|@electric-sql\/client|evlog)(\/|$)/
 				]
 			};
 			const exclude = options.esbuild?.options?.exclude ?? /node_modules/;
@@ -106,18 +106,9 @@ var module_default = defineNuxtModule({
 			}
 			if (!nuxt.options.dev) options.rollupConfig = {
 				...options.rollupConfig,
-				plugins: [
-					...[options.rollupConfig?.plugins ?? []].flat(),
-					prefixNodeBuiltins(),
-					configurableWaitUntil(),
-					stripJsdocImports()
-				]
+				plugins: [...[options.rollupConfig?.plugins ?? []].flat(), ...denoPlugins()]
 			};
-			options.unenv = [...options.unenv ? [options.unenv].flat() : [], { inject: {
-				Buffer: ["node:buffer", "Buffer"],
-				setImmediate: ["node:timers", "setImmediate"],
-				clearImmediate: ["node:timers", "clearImmediate"]
-			} }];
+			options.unenv = [...options.unenv ? [options.unenv].flat() : [], { inject: DENO_INJECT }];
 		});
 		if (nitroMajor >= 3 && !nuxt.options.dev) nuxt.hook("vite:extendConfig", (config, { isServer }) => {
 			const ssr = config.environments?.ssr;
@@ -202,6 +193,10 @@ var module_default = defineNuxtModule({
 					};
 					await mkdir(nitroOptions.output.serverDir, { recursive: true });
 					await writeFile(join(nitroOptions.output.serverDir, "wervt-tasks.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+					await writeFile(join(dirname(nitroOptions.output.serverDir), BUNDLE_MANIFEST), `${JSON.stringify({
+						version: 2,
+						framework: "nuxt"
+					}, null, 2)}\n`);
 				});
 			});
 		}
@@ -282,7 +277,15 @@ var module_default = defineNuxtModule({
 		if (nuxt.options.dev && process.env.WERVT_PREVIEW) setupStudioPreview(nuxt);
 		if (nuxt.options.dev && !nuxt.options._prepare) {
 			const app = await resolveAppName(nuxt.options.rootDir, options.app);
-			await setupDev(nuxt, app, options.dev ?? {}, { storage: useAblage });
+			await setupDev({
+				rootDir: nuxt.options.rootDir,
+				onClose: (fn) => nuxt.hook("close", fn),
+				restart: () => void nuxt.callHook("restart"),
+				onListen: (fn) => nuxt.hook("listen", (_server, listener) => {
+					if (listener.url) fn(listener.url);
+				}),
+				logger
+			}, app, options.dev ?? {}, { storage: useAblage });
 		}
 		addTypeTemplate({
 			filename: "types/wervt-email.d.ts",
@@ -397,6 +400,7 @@ var module_default = defineNuxtModule({
 				icon: brand.icon,
 				image: brand.logo
 			} : false)) if (!existsSync(join(publicDir, file))) logger.warn(`The login branding names \`${file}\`, which isn't in public/.`);
+			if (brand?.icon && !MAIL_IMAGE.test(brand.icon)) logger.warn(`The login branding's icon \`${brand.icon}\` won't show in the sign-in mail: Gmail and Outlook need PNG or JPEG. Set \`wervt.brand.icon\` to one.`);
 			if (typeof options.brand === "object" && options.brand.color && !brand?.color) logger.warn("`wervt.brand.color` must be a hex color like `#ff5a1f`; it is ignored.");
 			if (typeof options.brand === "object" && options.brand.signIn) {
 				const unknown = options.brand.signIn.filter((m) => !SIGN_IN_METHODS.includes(m));
@@ -506,47 +510,6 @@ function hasPackage(dir, name) {
 }
 /** evlog's Nitro 2 plugin and error handler, as evlog/nuxt resolves them. */
 const EVLOG_NITRO2_RE = /([\\/]evlog[\\/]dist[\\/]nitro)[\\/](plugin|errorHandler)(\.mjs)?$/;
-const BUILTINS = new Set(builtinModules.filter((name) => !name.startsWith("_")));
-/** Rewrites `from 'os'` / `import('os')` to `node:os` in the output chunks. */
-function prefixNodeBuiltins() {
-	const IMPORT_RE = /(\bfrom\s*|\bimport\s*\(\s*|\bimport\s+)(['"])([a-z_/]+)\2/g;
-	return {
-		name: "wervt:prefix-node-builtins",
-		renderChunk(code) {
-			let changed = false;
-			const out = code.replace(IMPORT_RE, (match, lead, quote, id) => {
-				if (!BUILTINS.has(id)) return match;
-				changed = true;
-				return `${lead}${quote}node:${id}${quote}`;
-			});
-			return changed ? {
-				code: out,
-				map: null
-			} : null;
-		}
-	};
-}
-/**
-* srvx (Nitro 3's server layer) pins `waitUntil` on each request as a non-configurable property.
-* Edge Runtime hands the app a Proxy whose `get` returns its own `waitUntil`, which breaks the
-* proxy invariant for non-configurable properties: reading `req.waitUntil` throws. Nitro's
-* error handler reads it, so every thrown error (404, 400, …) became a 500. Configurable, the
-* proxy may answer with its own function, which works the same.
-*/
-function configurableWaitUntil() {
-	const PIN_RE = /waitUntil:\s*\{\s*value:\s*(this\.#wait\?\.waitUntil)\s*\}/g;
-	return {
-		name: "wervt:configurable-wait-until",
-		renderChunk(code) {
-			if (!code.includes("waitUntil")) return null;
-			const out = code.replace(PIN_RE, "waitUntil: { value: $1, configurable: true, writable: true }");
-			return out === code ? null : {
-				code: out,
-				map: null
-			};
-		}
-	};
-}
 /** `pattern`, except for files of this module's runtime. */
 function exceptRuntime(pattern) {
 	if (pattern.source.startsWith("^")) return pattern;

package/dist/provision.d.ts

@@ -1,77 +1 @@
-import { MAX_KEY_BYTES, ObjectDetails, ObjectListing, StorageError, StorageOptions, StorageQuota, StorageUsage, StoredObject, createStorage } from "./storage.js";
-export interface ProvisionOptions {
-  /** App name, `[a-z0-9-]+`. */
-  app: string;
-  /** Superuser connection URL to the `wervt` database. */
-  adminUrl: string;
-  /** Secret the role password is derived from (WERVT_DB_SECRET). */
-  secret: string;
-  /** Drizzle migrations folder. Skipped when undefined. */
-  migrationsFolder?: string;
-  /** Timeouts for the app's role; DEFAULT_ROLE_TIMEOUTS where not given. */
-  timeouts?: Partial<RoleTimeouts>;
-}
-/** Postgres durations (`30s`, `500ms`, `2min`) for the app's role; `0` turns one off. */
-export interface RoleTimeouts {
-  /** Longest a single statement may run. */
-  statement: string;
-  /** Longest a transaction may sit idle, holding its locks and its pooled connection. */
-  idleInTransaction: string;
-}
-export declare const DEFAULT_ROLE_TIMEOUTS: RoleTimeouts;
-/** A Postgres duration as the env gives it, e.g. `WERVT_STATEMENT_TIMEOUT`; the fallback when empty. */
-export declare function parseDuration(value: string | undefined, fallback: string, name?: string): string;
-/**
- * Sets the timeouts on an existing app role, for apps that aren't redeployed. New sessions get
- * them; open ones keep theirs. Returns false when the app has no role.
- */
-export declare function setRoleTimeouts({ app, adminUrl, timeouts }: Pick<ProvisionOptions, 'app' | 'adminUrl' | 'timeouts'>): Promise<boolean>;
-export declare function dbRole(app: string): string;
-export declare function hmac(secret: string, message: string): Promise<string>;
-/** The app's Garage bucket and S3 key, derived from WERVT_DB_SECRET like role passwords. */
-export declare function storageCredentials(app: string, secret: string): Promise<{
-  bucket: string;
-  accessKeyId: string;
-  secretAccessKey: string;
-}>;
-export declare function dbPassword(app: string, secret: string): Promise<string>;
-/** Connection URL for the app's own role, on the same host and database as `adminUrl`. */
-export declare function appDatabaseUrl({ app, adminUrl, secret }: ProvisionOptions): Promise<string>;
-/**
- * Creates (or updates) the app's role and schema and runs its Drizzle migrations as
- * that role. Each app gets a role and schema named `app_<name>`; the role's
- * search_path is its own schema, it can't create schemas or touch `public`, and it can
- * only connect to the wervt database.
- *
- * `fresh` is true when no migration had been applied before, so `nuxt dev` knows when to seed.
- */
-export declare function provisionDatabase(options: ProvisionOptions): Promise<{
-  fresh: boolean;
-}>;
-/**
- * Runs the Drizzle migrations as the app's own role, into its schema. The role needs CREATE on
- * the database while this runs (see `provisionDatabase`). `fresh` is true when no migration had
- * been applied before.
- */
-export declare function migrateAs({ url, schema, migrationsFolder }: {
-  url: string;
-  schema: string;
-  migrationsFolder: string;
-}): Promise<{
-  fresh: boolean;
-}>;
-/** The role PgBouncer signs in with to look up app roles' password hashes (`auth_query`). */
-export declare const POOLER_ROLE = "pgbouncer";
-/**
- * Prepares Postgres for PgBouncer in front of the app isolates: a login role for PgBouncer and
- * `pgbouncer.get_auth()`, which hands out the SCRAM hashes of app roles (`app_*`) only, never
- * those of the superuser or other roles. App passwords are derived, not stored anywhere
- * PgBouncer could read them, so it has to ask Postgres.
- */
-export declare function setupPooler({ adminUrl, password }: {
-  adminUrl: string;
-  password: string;
-}): Promise<void>;
-/** Drops the app's schema (all its data) and role. */
-export declare function dropDatabase({ app, adminUrl }: Pick<ProvisionOptions, 'app' | 'adminUrl'>): Promise<void>;
-export { MAX_KEY_BYTES, type ObjectDetails, type ObjectListing, StorageError, type StorageOptions, type StorageQuota, type StorageUsage, type StoredObject, createStorage };
+export * from "@wervt/platform";

package/dist/provision.js

@@ -1,238 +1 @@
-import { MAX_KEY_BYTES, StorageError, createStorage } from "./storage.js";
-import { drizzle } from "drizzle-orm/postgres-js";
-import { migrate } from "drizzle-orm/postgres-js/migrator";
-import postgres from "postgres";
-// src/provision.ts
-const DEFAULT_ROLE_TIMEOUTS = {
-	statement: "30s",
-	idleInTransaction: "60s"
-};
-const DURATION_RE = /^\d+(?:ms|s|min|h)?$/;
-/** A Postgres duration as the env gives it, e.g. `WERVT_STATEMENT_TIMEOUT`; the fallback when empty. */
-function parseDuration(value, fallback, name = "timeout") {
-	const trimmed = value?.trim();
-	if (!trimmed) return fallback;
-	if (!DURATION_RE.test(trimmed)) throw new Error(`${name} must be a duration like 30s, 500ms or 2min (0 for none)`);
-	return trimmed;
-}
-function roleTimeouts(timeouts) {
-	const merged = {
-		...DEFAULT_ROLE_TIMEOUTS,
-		...timeouts
-	};
-	return {
-		statement: parseDuration(merged.statement, DEFAULT_ROLE_TIMEOUTS.statement),
-		idleInTransaction: parseDuration(merged.idleInTransaction, DEFAULT_ROLE_TIMEOUTS.idleInTransaction)
-	};
-}
-async function applyRoleTimeouts(admin, role, timeouts) {
-	await admin.unsafe(`alter role "${role}" set statement_timeout = '${timeouts.statement}'`);
-	await admin.unsafe(`alter role "${role}" set idle_in_transaction_session_timeout = '${timeouts.idleInTransaction}'`);
-}
-/**
-* Sets the timeouts on an existing app role, for apps that aren't redeployed. New sessions get
-* them; open ones keep theirs. Returns false when the app has no role.
-*/
-async function setRoleTimeouts({ app, adminUrl, timeouts }) {
-	const role = dbRole(app);
-	const admin = postgres(adminUrl, {
-		max: 1,
-		onnotice: () => {}
-	});
-	try {
-		const [row] = await admin`select exists(select 1 from pg_roles where rolname = ${role})`;
-		if (!row?.exists) return false;
-		await applyRoleTimeouts(admin, role, roleTimeouts(timeouts));
-		return true;
-	} finally {
-		await admin.end();
-	}
-}
-function dbRole(app) {
-	return `app_${app.replaceAll("-", "_")}`;
-}
-async function hmac(secret, message) {
-	const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(message));
-	return Array.from(new Uint8Array(sig), (b) => b.toString(16).padStart(2, "0")).join("");
-}
-/** The app's Garage bucket and S3 key, derived from WERVT_DB_SECRET like role passwords. */
-async function storageCredentials(app, secret) {
-	return {
-		bucket: `app-${app}`,
-		accessKeyId: `GK${(await hmac(secret, `s3-id:${app}`)).slice(0, 24)}`,
-		secretAccessKey: await hmac(secret, `s3-secret:${app}`)
-	};
-}
-function dbPassword(app, secret) {
-	return hmac(secret, app);
-}
-/** Connection URL for the app's own role, on the same host and database as `adminUrl`. */
-async function appDatabaseUrl({ app, adminUrl, secret }) {
-	const url = new URL(adminUrl);
-	url.username = dbRole(app);
-	url.password = await dbPassword(app, secret);
-	return url.href;
-}
-/**
-* Creates (or updates) the app's role and schema and runs its Drizzle migrations as
-* that role. Each app gets a role and schema named `app_<name>`; the role's
-* search_path is its own schema, it can't create schemas or touch `public`, and it can
-* only connect to the wervt database.
-*
-* `fresh` is true when no migration had been applied before, so `nuxt dev` knows when to seed.
-*/
-async function provisionDatabase(options) {
-	const { app, adminUrl, secret, migrationsFolder } = options;
-	const role = dbRole(app);
-	const password = await dbPassword(app, secret);
-	const database = new URL(adminUrl).pathname.slice(1);
-	const admin = postgres(adminUrl, {
-		max: 1,
-		onnotice: () => {}
-	});
-	try {
-		const [row] = await admin`select exists(select 1 from pg_roles where rolname = ${role})`;
-		const exists = Boolean(row?.exists);
-		await admin.unsafe(`${exists ? "alter" : "create"} role "${role}" login password '${password}' connection limit 10`);
-		await admin.unsafe(`create schema if not exists "${role}" authorization "${role}"`);
-		await claimSchema(admin, role);
-		await admin.unsafe(`alter role "${role}" set search_path = "${role}"`);
-		await applyRoleTimeouts(admin, role, roleTimeouts(options.timeouts));
-		for (const db of [
-			database,
-			"postgres",
-			"template1"
-		]) await admin.unsafe(`revoke all on database "${db}" from public`);
-		await admin.unsafe(`grant connect on database "${database}" to "${role}"`);
-		await admin.unsafe(`revoke all on schema public from public`);
-		if (!migrationsFolder) return { fresh: false };
-		await admin.unsafe(`grant create on database "${database}" to "${role}"`);
-		try {
-			return await migrateAs({
-				url: await appDatabaseUrl(options),
-				schema: role,
-				migrationsFolder
-			});
-		} finally {
-			await admin.unsafe(`revoke create on database "${database}" from "${role}"`);
-		}
-	} finally {
-		await admin.end();
-	}
-}
-/**
-* Runs the Drizzle migrations as the app's own role, into its schema. The role needs CREATE on
-* the database while this runs (see `provisionDatabase`). `fresh` is true when no migration had
-* been applied before.
-*/
-async function migrateAs({ url, schema, migrationsFolder }) {
-	const client = postgres(url, {
-		max: 1,
-		onnotice: () => {}
-	});
-	try {
-		const table = `"${schema}"."__drizzle_migrations"`;
-		const [state] = await client`
-      select to_regclass(${table}) is not null as exists`;
-		let fresh = !state?.exists;
-		if (!fresh) {
-			const [row] = await client.unsafe(`select exists(select 1 from ${table}) as applied`);
-			fresh = !row?.applied;
-		}
-		await client.unsafe("set statement_timeout = 0; set idle_in_transaction_session_timeout = 0");
-		await migrate(drizzle({ client }), {
-			migrationsFolder,
-			migrationsSchema: schema
-		});
-		return { fresh };
-	} finally {
-		await client.end();
-	}
-}
-/**
-* Gives the role its schema and everything in it back. A dump restored with `--no-owner`
-* (Coolify's backups) leaves all of it owned by the restoring superuser.
-*/
-async function claimSchema(admin, role) {
-	await admin.unsafe(`alter schema "${role}" owner to "${role}"`);
-	const objects = await admin`
-    select case c.relkind when 'S' then 'sequence' when 'v' then 'view'
-             when 'm' then 'materialized view' when 'f' then 'foreign table' else 'table' end as kind,
-           format('%I.%I', n.nspname, c.relname) as name
-      from pg_class c join pg_namespace n on n.oid = c.relnamespace
-     where n.nspname = ${role} and c.relkind in ('r', 'p', 'v', 'm', 'f', 'S')
-       and c.relowner <> ${role}::regrole
-       -- identity and serial sequences follow their table
-       and not exists (select 1 from pg_depend d where d.classid = 'pg_class'::regclass
-             and d.objid = c.oid and d.deptype in ('a', 'i'))
-    union all
-    select case t.typtype when 'd' then 'domain' else 'type' end, format('%I.%I', n.nspname, t.typname)
-      from pg_type t join pg_namespace n on n.oid = t.typnamespace
-     where n.nspname = ${role} and t.typtype in ('e', 'd')
-       and t.typowner <> ${role}::regrole
-    union all
-    select case p.prokind when 'p' then 'procedure' when 'a' then 'aggregate' else 'function' end,
-           p.oid::regprocedure::text
-      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
-     where n.nspname = ${role} and p.proowner <> ${role}::regrole`;
-	for (const { kind, name } of objects) await admin.unsafe(`alter ${kind} ${name} owner to "${role}"`);
-}
-/** The role PgBouncer signs in with to look up app roles' password hashes (`auth_query`). */
-const POOLER_ROLE = "pgbouncer";
-/**
-* Prepares Postgres for PgBouncer in front of the app isolates: a login role for PgBouncer and
-* `pgbouncer.get_auth()`, which hands out the SCRAM hashes of app roles (`app_*`) only, never
-* those of the superuser or other roles. App passwords are derived, not stored anywhere
-* PgBouncer could read them, so it has to ask Postgres.
-*/
-async function setupPooler({ adminUrl, password }) {
-	const database = new URL(adminUrl).pathname.slice(1);
-	const admin = postgres(adminUrl, {
-		max: 1,
-		onnotice: () => {}
-	});
-	try {
-		const [row] = await admin`select exists(select 1 from pg_roles where rolname = ${POOLER_ROLE})`;
-		await admin.unsafe(`${row?.exists ? "alter" : "create"} role "${POOLER_ROLE}" login password '${password.replaceAll("'", "''")}'`);
-		await admin.unsafe(`grant connect on database "${database}" to "${POOLER_ROLE}"`);
-		await admin.unsafe(`create schema if not exists "${POOLER_ROLE}"`);
-		await admin.unsafe(`revoke all on schema "${POOLER_ROLE}" from public`);
-		await admin.unsafe(`grant usage on schema "${POOLER_ROLE}" to "${POOLER_ROLE}"`);
-		await admin.unsafe(`
-      create or replace function "${POOLER_ROLE}".get_auth(p_usename text)
-      returns table(usename name, passwd text)
-      language sql security definer set search_path = pg_catalog as $$
-        select usename, passwd from pg_shadow
-         where usename = p_usename and usename like 'app_%' and not usesuper
-      $$`);
-		await admin.unsafe(`revoke all on function "${POOLER_ROLE}".get_auth(text) from public`);
-		await admin.unsafe(`grant execute on function "${POOLER_ROLE}".get_auth(text) to "${POOLER_ROLE}"`);
-	} finally {
-		await admin.end();
-	}
-}
-/** Drops the app's schema (all its data) and role. */
-async function dropDatabase({ app, adminUrl }) {
-	const role = dbRole(app);
-	const database = new URL(adminUrl).pathname.slice(1);
-	const admin = postgres(adminUrl, {
-		max: 1,
-		onnotice: () => {}
-	});
-	try {
-		await admin`select pg_terminate_backend(pid) from pg_stat_activity where usename = ${role}`;
-		await admin.unsafe(`drop schema if exists "${role}" cascade`);
-		const [row] = await admin`select exists(select 1 from pg_roles where rolname = ${role})`;
-		if (Boolean(row?.exists)) {
-			await admin.unsafe(`revoke all on database "${database}" from "${role}"`);
-			await admin.unsafe(`drop role "${role}"`);
-		}
-	} finally {
-		await admin.end();
-	}
-}
-export { DEFAULT_ROLE_TIMEOUTS, MAX_KEY_BYTES, POOLER_ROLE, StorageError, appDatabaseUrl, createStorage, dbPassword, dbRole, dropDatabase, hmac, migrateAs, parseDuration, provisionDatabase, setRoleTimeouts, setupPooler, storageCredentials };
+export * from "@wervt/platform";

package/dist/runtime/app/plugins/analytics.client.js

@@ -1,4 +1,5 @@
 import { defineNuxtPlugin, useRouter, useRuntimeConfig } from "#app";
+import { trackPageView } from "@wervt/client";
 // src/runtime/app/plugins/analytics.client.ts
 var analytics_client_default = defineNuxtPlugin({
 	name: "wervt:analytics",
@@ -7,8 +8,7 @@ var analytics_client_default = defineNuxtPlugin({
 		const base = useRuntimeConfig().app.baseURL.replace(/\/$/, "");
 		router.afterEach((to, from, failure) => {
 			if (failure || !from.matched.length || to.path === from.path) return;
-			const body = new Blob([JSON.stringify({ path: `${base}${to.path}` })], { type: "application/json" });
-			navigator.sendBeacon?.(`${base}/_wervt/view`, body);
+			trackPageView(`${base}${to.path}`, { base });
 		});
 	}
 });

package/dist/runtime/app/plugins/feedback.client.js

@@ -1,31 +1,20 @@
-import { pendingFeedbackContext } from "../useWervtFeedback.js";
 import { defineNuxtPlugin, onNuxtReady, useRuntimeConfig } from "#app";
+import { loadFeedback } from "@wervt/client";
 // src/runtime/app/plugins/feedback.client.ts
 var feedback_client_default = defineNuxtPlugin({
 	name: "wervt:feedback",
 	setup() {
 		const config = useRuntimeConfig();
-		const feedback = config.public.wervt?.feedback;
-		if (!feedback?.key) return;
-		onNuxtReady(() => {
-			const script = document.createElement("script");
-			script.src = `${feedback.url.replace(/\/$/, "")}/widget.js`;
-			script.async = true;
-			script.dataset.key = feedback.key;
-			for (const name of [
-				"lang",
-				"position",
-				"label",
-				"color"
-			]) if (feedback[name]) script.dataset[name] = feedback[name];
-			script.dataset.context = JSON.stringify({
-				app: feedback.app,
-				release: config.app.buildId,
-				...pendingFeedbackContext
-			});
-			script.addEventListener("load", () => window.kontor?.setContext(pendingFeedbackContext));
-			document.head.appendChild(script);
-		});
+		const options = config.public.wervt?.feedback;
+		if (!options?.key) return;
+		const { app, ...widget } = options;
+		onNuxtReady(() => loadFeedback({
+			...widget,
+			context: {
+				app,
+				release: config.app.buildId
+			}
+		}));
 	}
 });
 export { feedback_client_default as default };

package/dist/runtime/app/plugins/user.client.js

@@ -1,17 +1,12 @@
 import { useWervtUser } from "../useWervtUser.js";
 import { defineNuxtPlugin } from "#app";
+import { fetchUser } from "@wervt/client";
 // src/runtime/app/plugins/user.client.ts
 var user_client_default = defineNuxtPlugin({
 	name: "wervt:user",
 	async setup(nuxtApp) {
 		if (nuxtApp.payload.serverRendered) return;
-		const user = useWervtUser();
-		try {
-			const res = await fetch("/_wervt/user");
-			user.value = res.ok ? (await res.json()).user : null;
-		} catch {
-			user.value = null;
-		}
+		useWervtUser().value = await fetchUser();
 	}
 });
 export { user_client_default as default };