@antelopejs/dms-frontend 0.1.9 → 0.2.1

package/README.md

@@ -44,7 +44,7 @@ making the template root (`src/materialize.ts`) and the manifest query
 `--renderer` flag and no renderer registry; the single-renderer assumption is
 deliberate until a second renderer exists. Whatever a renderer names its module
 entry is its own convention: `dms.frontend.ts` and the
-`#dms-inertia/frontend-module` alias belong to the Vue renderer, not to the
+`#dms/frontend-module` alias belong to the Vue renderer, not to the
 loader.
 
 ## Application ownership
@@ -104,7 +104,7 @@ Manifest negotiation and module materialization are the renderer contract descri
 
 The generated Vue application uses `@inertiajs/vue3`, `@nuxt/ui/vite` with `{ router: "inertia" }`, and `@nuxt/ui/vue-plugin`. The Node server resolves each Inertia visit through `/dms/page?path=…`, including fresh shared data so account, tenant, and permission changes update navigation state. It proxies backend routes and manages authentication through server-side sessions. `DMS_BOOTSTRAP_SECRET` is used only by the CLI's server-to-server frontend manifest and module archive requests and is never sent by, or exposed to, browser traffic.
 
-Vue modules use `dms.frontend.ts` and the `#dms-inertia/frontend-module` SDK alias, which replaces the former `#cms-inertia` alias and is the import path every DMS frontend module now uses. Email templates register separately through `dms.email.ts`.
+Vue modules register through `dms.frontend.ts` and import the SDK from the `#dms/frontend-module` alias, which the loader resolves to the generated `frontend-module.ts`: `defineDmsPlugin`, `useDmsRouter`, the page and session types, and everything else a module needs from the host. Email templates register separately through `dms.email.ts`.
 
 An email entry exports `serverEmailTemplates` and may export a plain `appConfig` object, such as shared branding defaults. Email rendering merges these configurations in manifest-priority order and provides them to `useDmsAppConfig` per render. Public runtime options come from the module manifest; `DMS_CLIENT_BASE_URL` overrides `public.dms.clientBaseUrl`. Email entries must not import the browser frontend module.
 
@@ -117,7 +117,7 @@ A materialized module opts into the Vue adapter with a root `dms.frontend.ts`:
 ```ts
 import MyBlock from "./components/MyBlock.vue";
 import MyPage from "./pages/MyPage.vue";
-import type { DmsFrontendModule } from "../../frontend-module";
+import type { DmsFrontendModule } from "#dms/frontend-module";
 
 const frontendModule: DmsFrontendModule = {
   setup(sdk) {
@@ -163,11 +163,13 @@ started by `dev`, and the production server started by `start`, because those
 child processes inherit the environment. A missing file is not an error; an
 unreadable one is reported and skipped.
 
-`DMS_SESSION_SECRET` is mandatory for anything that touches a session. The
-generated server encrypts its session cookie with it, and with no value — or
-one shorter than 32 characters — the login page at `/auth` fails the first
-sign-in attempt rather than starting degraded. Generate one with
-`openssl rand -hex 32`.
+`ajs dms dev` generates a fresh ephemeral 32-byte secret when
+`DMS_SESSION_SECRET` is absent; all sessions are invalidated when that dev
+server restarts. An explicit value is preserved, but empty or shorter than 32
+characters is rejected. `build` and `start` require a configured secret and
+never generate one, which is required for production so sessions survive
+restarts. The generated server also validates the value as a safety net.
+Generate one with `openssl rand -hex 32`.
 
 ### Opening a session from a module flow
 

package/dist/commands/build.js

@@ -21,6 +21,7 @@ function cmdBuild() {
             (0, cli_ui_1.error)("Backend URL is required. Use -b <url> or set DMS_API_BASE_URL.");
             process.exit(1);
         }
+        const sessionSecret = (0, common_1.resolveSessionSecret)("build");
         const spinner = new cli_ui_1.Spinner("Setting up workspace...");
         await spinner.start();
         try {
@@ -44,6 +45,7 @@ function cmdBuild() {
                 cwd: workspaceDir,
                 env: {
                     ...process.env,
+                    DMS_SESSION_SECRET: sessionSecret,
                     NODE_OPTIONS: "--max-old-space-size=4096",
                     NODE_PATH: nodeModulesDir,
                 },

package/dist/commands/dev.js

@@ -44,6 +44,7 @@ function cmdDev() {
         .action(async (options) => {
         const { backendUrl, workspaceKey } = resolveBackend(options);
         const bootstrapSecret = (0, common_1.resolveBootstrapSecret)(options.bootstrapSecret, backendUrl);
+        const sessionSecret = (0, common_1.resolveSessionSecret)("dev");
         const requestedPort = Number.parseInt(options.port, 10);
         if (Number.isNaN(requestedPort)) {
             (0, cli_ui_1.error)(`Invalid port: ${options.port}`);
@@ -101,6 +102,7 @@ function cmdDev() {
                     DMS_COOKIE_SECURE: process.env.DMS_COOKIE_SECURE ?? "false",
                     DMS_API_BASE_URL: backendUrl,
                     DMS_BOOTSTRAP_SECRET: bootstrapSecret,
+                    DMS_SESSION_SECRET: sessionSecret,
                     NODE_OPTIONS: "--max-old-space-size=4096",
                     NODE_PATH: nodeModulesDir,
                 },

package/dist/commands/start.js

@@ -20,6 +20,7 @@ function cmdStart() {
             (0, cli_ui_1.error)("Backend URL is required. Use -b <url> or set DMS_API_BASE_URL.");
             process.exit(1);
         }
+        const sessionSecret = (0, common_1.resolveSessionSecret)("start");
         const workspaceDir = (0, common_1.getWorkspaceDir)(options.backendUrl);
         const serverPath = (0, node_path_1.join)(workspaceDir, "server.mjs");
         const clientPath = (0, node_path_1.join)(workspaceDir, "dist", "client", "index.html");
@@ -41,6 +42,7 @@ function cmdStart() {
                 ...process.env,
                 PORT: options.port,
                 DMS_API_BASE_URL: options.backendUrl,
+                DMS_SESSION_SECRET: sessionSecret,
                 DMS_COOKIE_SECURE: process.env.DMS_COOKIE_SECURE ?? "true",
             },
         });

package/dist/config.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Options = exports.TAILWIND_SOURCE_GLOB = exports.PNPM_LIFECYCLE_SCRIPTS = exports.layerCopyIgnore = exports.LAYER_COPY_BLOCKLIST = exports.AUTH_ESTABLISH_FILE = exports.FRONTEND_MODULE_ENTRY = exports.LAYERS_SUBDIR = exports.TEMPLATE_FILES = exports.WORKSPACE_DIR_MODE = exports.DEPS_HASH_FILE = exports.DMS_FRONTEND_HOME = void 0;
 exports.writeSecretBearingFile = writeSecretBearingFile;
 exports.normalizeBootstrapSecret = normalizeBootstrapSecret;
+exports.resolveSessionSecret = resolveSessionSecret;
 exports.resolveBootstrapSecret = resolveBootstrapSecret;
 exports.sha256Hex = sha256Hex;
 exports.canonicalizeBackendUrl = canonicalizeBackendUrl;
@@ -109,6 +110,18 @@ function normalizeBootstrapSecret(value, source = DEFAULT_CREDENTIAL_SOURCE) {
     }
     return trimmed;
 }
+function resolveSessionSecret(mode, value = process.env.DMS_SESSION_SECRET) {
+    if (value === undefined && mode === "dev") {
+        return (0, node_crypto_1.randomBytes)(32).toString("hex");
+    }
+    if (value === undefined || value.length < 32) {
+        throw new Error("DMS_SESSION_SECRET must contain at least 32 characters; " +
+            (mode === "dev"
+                ? "set it explicitly or omit it to generate an ephemeral dev secret"
+                : "set it explicitly for build and start"));
+    }
+    return value;
+}
 function resolveBootstrapSecret(explicit, backendUrl, options = {}) {
     const normalized = normalizeBootstrapSecret(explicit);
     if (normalized)

package/dist/index.js

@@ -38,6 +38,9 @@ Environment:
   the other variables below can live in the project's .env. A variable already
   set in the environment always wins over a file, and .env.local wins over .env.
   The generated workspace never loads a .env of its own.
+  'dev' generates an ephemeral 32-byte DMS_SESSION_SECRET when it is absent;
+  restarting dev invalidates its sessions. 'build' and 'start' require a
+  configured secret of at least 32 characters.
 
 Workspaces:
   Each canonical backend URL gets its own workspace under

package/dist/materialize.js

@@ -140,7 +140,7 @@ function writeFrontendModuleRegistry(workspaceDir, layers) {
 }
 function writeFrontendTypePaths(workspaceDir, registry) {
     const paths = {
-        "#dms-inertia/frontend-module": ["./frontend-module.ts"],
+        "#dms/frontend-module": ["./frontend-module.ts"],
         "@frontend/*": ["./frontend-modules/*"],
     };
     [...registry.modules].reverse().forEach((module) => {

package/dist/verify-source-runner.js

@@ -53,7 +53,7 @@ function removeDevelopmentDependencies(root) {
 if (!process.env.DMS_LAYER_SOURCE)
     throw new Error("DMS_LAYER_SOURCE must identify a frontend package");
 const sourceRoot = (0, node_path_1.resolve)(process.env.DMS_LAYER_SOURCE);
-const workspace = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "dms-inertia-real-source-"));
+const workspace = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "dms-frontend-real-source-"));
 const templateRoot = (0, node_path_1.join)((0, common_1.getPackageRoot)(), "templates", "vue");
 const commandEnvironment = { ...process.env };
 const EMAIL_BUILD_SIZE_CEILING_BYTES = 256 * 1024;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antelopejs/dms-frontend",
-  "version": "0.1.9",
+  "version": "0.2.1",
   "description": "Frontend-agnostic loader for AntelopeJS DMS, shipping the Vue 3 renderer (Vite, Inertia, SSR)",
   "keywords": [
     "antelope",

package/templates/vue/vite.config.ts

@@ -135,7 +135,7 @@ export default defineConfig({
   resolve: {
     dedupe: ["vue", "reka-ui", "@nuxt/ui"],
     alias: {
-      "#dms-inertia/frontend-module": resolve(__dirname, "frontend-module.ts"),
+      "#dms/frontend-module": resolve(__dirname, "frontend-module.ts"),
       "#build/nuxt-icon-client-bundle": "virtual:nuxt-ui-icons",
       "#shortcuts-aggregated": resolve(
         __dirname,