@antelopejs/dms-frontend 0.10.0 → 0.10.1

package/dist/verify-source-workspace.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.materializeWorkspace = materializeWorkspace;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const yaml_1 = require("yaml");
+const common_1 = require("./common");
+const ensure_1 = require("./internal/ensure");
+const guards_1 = require("./internal/guards");
+const plain_object_1 = require("./internal/plain-object");
+const output_1 = require("./output");
+function removeDevelopmentDependencies(root) {
+    const packagePath = (0, node_path_1.join)(root, "package.json");
+    if (!(0, node_fs_1.existsSync)(packagePath))
+        return;
+    const packageData = JSON.parse((0, node_fs_1.readFileSync)(packagePath, "utf8"));
+    if (!(0, plain_object_1.isPlainObject)(packageData))
+        return;
+    delete packageData.devDependencies;
+    (0, node_fs_1.writeFileSync)(packagePath, `${JSON.stringify(packageData, null, 2)}\n`);
+}
+const PATH_PROTOCOLS = ["file:", "link:"];
+const WORKSPACE_PROTOCOL = "workspace:";
+const LOCKFILE = "pnpm-lock.yaml";
+const WORKSPACE_FILE = "pnpm-workspace.yaml";
+const OWN_LOCKFILES = /^\s*shared-workspace-lockfile\s*=\s*false\s*$/m;
+function findUp(directory, file) {
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(directory, file)))
+        return directory;
+    const parent = (0, node_path_1.dirname)(directory);
+    return parent === directory ? undefined : findUp(parent, file);
+}
+function sharesLockfile(root) {
+    const npmrc = (0, node_path_1.join)(root, ".npmrc");
+    if ((0, node_fs_1.existsSync)(npmrc) && OWN_LOCKFILES.test((0, node_fs_1.readFileSync)(npmrc, "utf8")))
+        return false;
+    const settings = (0, yaml_1.parse)((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, WORKSPACE_FILE), "utf8"));
+    return !((0, plain_object_1.isPlainObject)(settings) && settings.sharedWorkspaceLockfile === false);
+}
+function findLockfile(directory) {
+    const workspaceRoot = findUp(directory, WORKSPACE_FILE);
+    const lockfileRoot = workspaceRoot && sharesLockfile(workspaceRoot)
+        ? workspaceRoot
+        : findUp(directory, LOCKFILE);
+    if (!lockfileRoot)
+        return undefined;
+    const lockfile = (0, node_path_1.join)(lockfileRoot, LOCKFILE);
+    const outsideWorkspace = workspaceRoot !== undefined &&
+        (0, node_path_1.relative)(workspaceRoot, lockfileRoot).startsWith("..");
+    return (0, node_fs_1.existsSync)(lockfile) && !outsideWorkspace ? lockfile : undefined;
+}
+function readLayerOverrides(layer) {
+    const lockfile = findLockfile(layer.path);
+    if (!lockfile)
+        return [];
+    const root = (0, node_path_1.dirname)(lockfile);
+    const overrides = [];
+    for (const document of (0, yaml_1.parseAllDocuments)((0, node_fs_1.readFileSync)(lockfile, "utf8"))) {
+        const [error] = document.errors;
+        (0, ensure_1.ensure)(error === undefined, `${(0, output_1.showPath)(lockfile)} is not a pnpm lockfile`, error?.message);
+        const lock = document.toJS();
+        if (!(0, plain_object_1.isPlainObject)(lock) || !(0, plain_object_1.isPlainObject)(lock.overrides))
+            continue;
+        for (const [name, spec] of Object.entries(lock.overrides)) {
+            if (!(0, guards_1.isText)(spec) || spec.startsWith(WORKSPACE_PROTOCOL))
+                continue;
+            overrides.push([name, resolveSpec(root, spec)]);
+        }
+    }
+    return overrides;
+}
+function resolveSpec(root, spec) {
+    const protocol = PATH_PROTOCOLS.find((prefix) => spec.startsWith(prefix));
+    if (!protocol)
+        return spec;
+    const path = spec.slice(protocol.length);
+    return (0, node_path_1.isAbsolute)(path) ? spec : `${protocol}${(0, node_path_1.resolve)(root, path)}`;
+}
+function materializeWorkspace(workspace, layers, localPackages) {
+    const templateRoot = (0, node_path_1.join)((0, common_1.getPackageRoot)(), "templates", "vue");
+    const templateFiles = (0, node_fs_1.readdirSync)(templateRoot).filter((file) => !file.startsWith("npmrc"));
+    for (const file of templateFiles)
+        (0, node_fs_1.cpSync)((0, node_path_1.join)(templateRoot, file), (0, node_path_1.join)(workspace, file), {
+            recursive: true,
+        });
+    (0, common_1.materializeLayers)(workspace, layers);
+    const registry = (0, common_1.createFrontendModuleRegistry)(workspace, layers);
+    registry.modules.forEach((module) => {
+        removeDevelopmentDependencies(module.root);
+    });
+    (0, common_1.writeFrontendModuleRegistry)(workspace, layers);
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(workspace, "dms-main.css"), '@import "tailwindcss";\n@import "@nuxt/ui";\n');
+    (0, common_1.writeWorkspacePackageJson)(workspace, layers);
+    const packagePath = (0, node_path_1.join)(workspace, "package.json");
+    const workspacePackage = JSON.parse((0, node_fs_1.readFileSync)(packagePath, "utf8"));
+    (0, ensure_1.ensure)((0, plain_object_1.isPlainObject)(workspacePackage), "The workspace package.json is not a JSON object");
+    workspacePackage.pnpm = {
+        overrides: {
+            ...Object.fromEntries(layers.flatMap(readLayerOverrides)),
+            ...Object.fromEntries(layers.map((layer) => [
+                String(layer.packageName),
+                "workspace:*",
+            ])),
+            ...Object.fromEntries(Object.entries(localPackages).map(([name, path]) => [
+                name,
+                `link:${(0, node_path_1.resolve)(path)}`,
+            ])),
+        },
+    };
+    (0, node_fs_1.writeFileSync)(packagePath, `${JSON.stringify(workspacePackage, null, 2)}\n`);
+}

package/dist/workspace-setup.d.ts

@@ -31,6 +31,7 @@ export interface SetupWorkspaceOptions {
     workspaceDir?: string;
     project?: ProjectModulesOptions;
     beforeInstall?: () => Promise<void>;
+    install?: boolean;
 }
 export interface SetupWorkspaceResult {
     workspaceDir: string;

package/dist/workspace-setup.js

@@ -299,7 +299,8 @@ async function setupWorkspace(opts) {
     writeDerivedOutputs(workspaceDir, layers);
     (0, materialize_1.writeDmsMainCss)(workspaceDir, layers);
     const layerPaths = layers.map((layer) => layer.path);
-    const shouldInstall = needsInstall(workspaceDir, layerPaths, opts.force);
+    const shouldInstall = opts.install !== false &&
+        needsInstall(workspaceDir, layerPaths, opts.force);
     if (shouldInstall) {
         await opts.beforeInstall?.();
         await installDeps(workspaceDir, (0, child_output_1.createPathMapper)(workspaceDir, layers));
@@ -321,6 +322,6 @@ function writeDerivedOutputs(workspaceDir, layers) {
         if (!(error instanceof locale_files_1.InvalidLocaleFileError))
             throw error;
         const showSource = (0, child_output_1.createPathMapper)(workspaceDir, layers);
-        throw new locale_files_1.InvalidLocaleFileError(showSource(error.path), error.reason);
+        throw new locale_files_1.InvalidLocaleFileError(showSource(error.path), error.reason, error.details);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antelopejs/dms-frontend",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Frontend-agnostic loader for AntelopeJS DMS, shipping the Vue 3 renderer (Vite, Inertia, SSR)",
   "keywords": [
     "antelope",
@@ -66,7 +66,7 @@
     "test:real-source": "pnpm run build && node dist/verify-source-runner.js",
     "format": "oxfmt .",
     "lint": "oxlint && antelopejs-check-interface-ranges && pnpm run docs:reference:check && pnpm run source-checks",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && tsx scripts/typecheck-projects.ts tsconfig.templates.json tsconfig.tests.json",
     "lint:fix": "oxlint --fix --max-warnings=1000000 && oxfmt .",
     "knip": "knip --dependencies",
     "knip:all": "knip",
@@ -87,12 +87,13 @@
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",
     "ignore": "^7.0.5",
-    "semver": "^7.7.4"
+    "semver": "^7.7.4",
+    "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@antelopejs/core": "^1.20.0",
+    "@antelopejs/core": "^1.21.0",
     "@antelopejs/interface-dms": "^0.10.0",
-    "@antelopejs/tooling-configs": "^0.2.17",
+    "@antelopejs/tooling-configs": "^0.3.3",
     "@iconify/utils": "^3.1.0",
     "@iconify/vue": "^5.0.1",
     "@inertiajs/vue3": "^3.7.1",
@@ -104,6 +105,7 @@
     "@vueuse/core": "14.4.0",
     "defu": "^6.1.4",
     "devalue": "^5.9.4",
+    "fast-check": "^4.10.2",
     "knip": "^6.34.0",
     "lefthook": "^2.2.2",
     "ofetch": "^1.5.1",

package/templates/vue/backend-boundary.mjs

@@ -0,0 +1,132 @@
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, sep } from "node:path";
+import { isRecord, isString } from "./server/type-guards.mjs";
+
+const BACKEND_SOURCE = "src";
+const QUERY_OR_HASH = /[?#].*$/;
+
+/**
+ * @param {string} manifest
+ * @returns {string | undefined}
+ */
+function manifestName(manifest) {
+  try {
+    /** @type {unknown} */
+    const parsed = JSON.parse(readFileSync(manifest, "utf8"));
+    return isRecord(parsed) && isString(parsed.name) ? parsed.name : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * @typedef {{ root: string, name: string }} BackendPackage
+ */
+
+/**
+ * The backend package that holds `directory`: the nearest `package.json` above
+ * it, when it names one of `backendPackages`.
+ *
+ * @param {string} directory
+ * @param {ReadonlySet<string>} backendPackages
+ * @param {Map<string, BackendPackage | null>} known
+ * @returns {BackendPackage | null}
+ */
+function owningBackend(directory, backendPackages, known) {
+  const cached = known.get(directory);
+  if (cached !== undefined) return cached;
+  const manifest = join(directory, "package.json");
+  const parent = dirname(directory);
+  /** @type {BackendPackage | null} */
+  let owner = null;
+  if (existsSync(manifest)) {
+    const name = manifestName(manifest);
+    owner =
+      name !== undefined && backendPackages.has(name)
+        ? { root: directory, name }
+        : null;
+  } else if (parent !== directory) {
+    owner = owningBackend(parent, backendPackages, known);
+  }
+  known.set(directory, owner);
+  return owner;
+}
+
+/**
+ * The real path of a resolved module id under the `src` of a backend package,
+ * and that package's name, or `undefined`. The package that owns the file
+ * decides, not where it lies, so a backend linked or installed into the
+ * workspace is caught as well as its source checkout. Virtual ids and ids that
+ * are not files are ignored.
+ *
+ * @param {string} id
+ * @param {ReadonlySet<string>} backendPackages
+ * @param {Map<string, BackendPackage | null>} known
+ * @returns {{ file: string, name: string } | undefined}
+ */
+function backendSourceFile(id, backendPackages, known) {
+  const path = id.replace(QUERY_OR_HASH, "");
+  if (!isAbsolute(path)) return undefined;
+  let file;
+  try {
+    file = realpathSync(path);
+  } catch {
+    return undefined;
+  }
+  const owner = owningBackend(dirname(file), backendPackages, known);
+  if (owner === null) return undefined;
+  return relative(owner.root, file).split(sep)[0] === BACKEND_SOURCE
+    ? { file, name: owner.name }
+    : undefined;
+}
+
+/**
+ * @param {ReadonlySet<string>} backendPackages
+ * @returns {import("vite").Plugin}
+ */
+function boundaryCheck(backendPackages) {
+  /** @type {Map<string, BackendPackage | null>} */
+  const known = new Map();
+  return {
+    name: "dms-backend-boundary",
+    enforce: "pre",
+    async resolveId(source, importer, options) {
+      const resolved = await this.resolve(source, importer, {
+        ...options,
+        skipSelf: true,
+      });
+      if (resolved === null) return null;
+      const backend = backendSourceFile(resolved.id, backendPackages, known);
+      if (backend === undefined) return resolved;
+      const from =
+        importer === undefined
+          ? "an entry point"
+          : importer.replace(QUERY_OR_HASH, "");
+      return this.error(
+        `Backend boundary: ${from} imports ${backend.file}, which is under the src of ${backend.name}. ` +
+          "The frontend reaches the backend only through its HTTP interface.",
+      );
+    },
+  };
+}
+
+/**
+ * Fail the build, a worker build and the dev server when a module of the
+ * frontend resolves to a file under the `src` of a backend package: the package
+ * that holds a module's layer, as the registry names it. The browser and the
+ * server renderer reach the backend only through its HTTP interface.
+ *
+ * The check reads what the whole resolution chain returns, so an alias, a
+ * symlink and an id marked external are all seen through. Vite builds workers
+ * with their own plugin list, so the plugin adds the check there too.
+ *
+ * @param {readonly string[]} backendPackages
+ * @returns {import("vite").Plugin}
+ */
+export function rejectBackendSources(backendPackages) {
+  const names = new Set(backendPackages);
+  return {
+    ...boundaryCheck(names),
+    config: () => ({ worker: { plugins: () => [boundaryCheck(names)] } }),
+  };
+}

package/templates/vue/client-chunking.mjs

@@ -18,6 +18,8 @@
  * quarter to four fifths, but every group is loaded whole by each page that
  * uses any of it, and the anonymous pages pay 70 to 115 KB of Brotli for code
  * only the signed-in shell uses.
+ *
+ * @type {import("vite").Rolldown.CodeSplittingOptions}
  */
 export const clientCodeSplitting = {
   groups: [{ name: "entry", tags: ["$initial"] }],

package/templates/vue/entry-weight.mjs

@@ -55,23 +55,27 @@ export function entryOwner(id, modules) {
  * their static imports, transitively, by file name.
  *
  * @param {import("vite").Rollup.OutputBundle} bundle
- * @returns {(import("vite").Rollup.OutputChunk | undefined)[]}
+ * @returns {import("vite").Rollup.OutputChunk[]}
  */
 function entryClosure(bundle) {
   const chunks = Object.values(bundle).filter(
+    /**
+     * @param {import("vite").Rollup.OutputChunk | import("vite").Rollup.OutputAsset} output
+     * @returns {output is import("vite").Rollup.OutputChunk}
+     */
     (output) => output.type === "chunk",
   );
   const byName = new Map(chunks.map((chunk) => [chunk.fileName, chunk]));
-  /** @type {Set<string>} */
-  const seen = new Set();
+  /** @type {Map<string, import("vite").Rollup.OutputChunk>} */
+  const seen = new Map();
   /** @param {import("vite").Rollup.OutputChunk | undefined} chunk */
   const visit = (chunk) => {
     if (!chunk || seen.has(chunk.fileName)) return;
-    seen.add(chunk.fileName);
+    seen.set(chunk.fileName, chunk);
     for (const file of chunk.imports ?? []) visit(byName.get(file));
   };
   for (const chunk of chunks) if (chunk.isEntry) visit(chunk);
-  return [...seen].map((file) => byName.get(file));
+  return [...seen.values()];
 }
 
 /**

package/templates/vue/frontend-build.ts

@@ -31,10 +31,11 @@ export interface DmsFrontendBuild {
 
   /**
    * Adds Vite plugins to the application's build, for `ajs dms dev`,
-   * `ajs dms build` and the preview alike.
+   * `ajs dms build` and the preview alike, and to the bundle of each web worker
+   * it starts with `new Worker(new URL(...))`.
    *
-   * `create` runs in the build process each time Vite loads its configuration,
-   * and returns real Vite plugin objects (an array, each with a `name`; false,
+   * `create` runs in the build process each time Vite loads its configuration
+   * and once more for each worker bundle, and returns real Vite plugin objects (an array, each with a `name`; false,
    * null and undefined entries are skipped and nested arrays flattened, as in a
    * Vite configuration) or nothing. It is synchronous: a Promise is refused,
    * because the configuration is built synchronously. The plugins come after

package/templates/vue/head-order.mjs

@@ -35,8 +35,9 @@ function deprioritize(html) {
 export function orderHeadForFirstPaint(html) {
   const prioritized = deprioritize(html);
   const stylesheet = prioritized.match(STYLESHEET);
-  const script = prioritized.match(SCRIPT);
-  if (!stylesheet || !script || stylesheet.index < script.index)
+  const stylesheetAt = prioritized.search(STYLESHEET);
+  const scriptAt = prioritized.search(SCRIPT);
+  if (!stylesheet || scriptAt < 0 || stylesheetAt < scriptAt)
     return prioritized;
   return prioritized
     .replace(STYLESHEET, "")

package/templates/vue/icon-api.mjs

@@ -9,6 +9,8 @@ export const ICON_API_PATH = "/api/_dms/icons/";
 /**
  * The `@iconify/vue` API provider serving every icon the client bundle lacks
  * from `origin`, instead of `api.iconify.design` and its fallbacks.
+ *
+ * @param {string} origin
  */
 export function sameOriginIconProvider(origin) {
   return { resources: [origin], path: ICON_API_PATH };

package/templates/vue/server/auth/backend.mjs

@@ -1,5 +1,5 @@
 import { REDIRECT_STATUSES } from "../proxy-redirects.mjs";
-import { isString } from "../type-guards.mjs";
+import { isObjectLike, isString } from "../type-guards.mjs";
 import { clientCountryHeader, clientIp, clientIpHeader } from "./client-ip.mjs";
 
 /**
@@ -39,7 +39,7 @@ export const GENERIC_ERROR_MESSAGE = "error.500.description";
  */
 export function publicBackendMessage(data) {
   /** @type {unknown} */
-  const message = isString(data) ? data : data?.message;
+  const message = isObjectLike(data) ? data.message : data;
   return isString(message) && PUBLIC_AUTH_MESSAGE.test(message)
     ? message
     : undefined;
@@ -59,7 +59,7 @@ export function relayedHeaders(request, names) {
     ...clientCountryHeader(request),
     ...Object.fromEntries(
       names.flatMap((name) =>
-        request.headers[name] ? [[name, request.headers[name]]] : [],
+        request.headers[name] ? [[name, String(request.headers[name])]] : [],
       ),
     ),
   };
@@ -86,7 +86,7 @@ export function relayedHeaders(request, names) {
  *   is not JSON
  */
 export async function backend(path, request, options = {}) {
-  /** @type {Record<string, string | string[]>} */
+  /** @type {Record<string, string>} */
   const headers = Object.fromEntries(
     Object.entries(options.headers ?? {}).map(([name, value]) => [
       name.toLowerCase(),

package/templates/vue/server/auth/establish-endpoints.mjs

@@ -71,8 +71,8 @@ export function allowedEstablishEndpoints(
     .map((entry) => entry.trim());
   return [
     ...new Set(
-      [...declared, ...fromEnvironment].filter(
-        (entry) => isString(entry) && BACKEND_API_PATH.test(entry),
+      [...declared, ...fromEnvironment].flatMap((entry) =>
+        isString(entry) && BACKEND_API_PATH.test(entry) ? [entry] : [],
       ),
     ),
   ];

package/templates/vue/server/auth/session.mjs

@@ -96,7 +96,10 @@ function decode(value) {
     );
     decipher.setAuthTag(payload.subarray(12, 28));
     return JSON.parse(
-      Buffer.concat([decipher.update(payload.subarray(28)), decipher.final()]),
+      Buffer.concat([
+        decipher.update(payload.subarray(28)),
+        decipher.final(),
+      ]).toString(),
     );
   } catch {
     return undefined;
@@ -150,7 +153,7 @@ function appendCookie(response, name, value, cookieAttributes) {
   response.setHeader(
     "set-cookie",
     current
-      ? [cookie, ...(Array.isArray(current) ? current : [current])]
+      ? [cookie, ...(Array.isArray(current) ? current : [String(current)])]
       : cookie,
   );
 }

package/templates/vue/server/auth-declarations.mjs

@@ -0,0 +1,46 @@
+import { authRejection } from "./auth-hooks.mjs";
+import { compilePathPattern } from "./path-patterns.mjs";
+
+/**
+ * @import { AuthProvider, DeclaredModule } from "./module-route-types.mjs"
+ */
+
+/**
+ * The auth hooks: those of the highest-priority module that registers them.
+ * A module registering them twice, or after another one, is reported.
+ *
+ * @param {DeclaredModule[]} modules
+ * @param {(message: string) => void} warn
+ */
+export function resolveAuth(modules, warn) {
+  /** @type {AuthProvider | undefined} */
+  let provider;
+  for (const module of modules) {
+    for (const auth of module.declared.auth) {
+      const reason = authRejection(auth);
+      if (reason) {
+        warn(
+          `Frontend module ${module.id} registers auth hooks, which are ignored: ${reason}.`,
+        );
+        continue;
+      }
+      if (provider) {
+        warn(
+          `Frontend module ${module.id} registers auth hooks, which are ignored: ${provider.id} (priority ${provider.priority ?? 0}) provides them.`,
+        );
+        continue;
+      }
+      provider = {
+        id: module.id,
+        priority: module.priority ?? 0,
+        signInPath: auth.signInPath,
+        signInExempt: auth.signInExempt?.flatMap(
+          (pattern) => compilePathPattern(pattern) ?? [],
+        ),
+        refreshSession: auth.refreshSession?.bind(auth),
+        publicSession: auth.publicSession?.bind(auth),
+      };
+    }
+  }
+  return provider;
+}

package/templates/vue/server/auth-hooks.mjs

@@ -1,6 +1,7 @@
 import { readSession, setRequestSession } from "./auth/session.mjs";
 import { createServerEvent } from "./module-event.mjs";
-import { compilePathPattern } from "./path-patterns.mjs";
+import { compilePathPattern, PATH_PATTERN_FORMS } from "./path-patterns.mjs";
+import { isFunction, isRecord, isString } from "./type-guards.mjs";
 
 const DEFAULT_SIGN_IN_PATH = "/auth";
 const DEFAULT_ONBOARDING_PATH = "/onboarding";
@@ -17,7 +18,44 @@ const HOOK_ROUTE = Object.freeze({ bodyLimit: 0 });
  */
 function defaultExempt(signInPath) {
   const signIn = signInPath === "/" ? "/" : `${signInPath}/**`;
-  return [signIn, DEFAULT_ONBOARDING_PATH].map(compilePathPattern);
+  return [signIn, DEFAULT_ONBOARDING_PATH].flatMap(
+    (pattern) => compilePathPattern(pattern) ?? [],
+  );
+}
+
+const AUTH_HOOKS = ["refreshSession", "publicSession"];
+
+/**
+ * Why an auth hooks registration is ignored, or `undefined`.
+ *
+ * @param {unknown} auth
+ */
+export function authRejection(auth) {
+  if (!isRecord(auth)) return "it is not an object";
+  for (const hook of AUTH_HOOKS)
+    if (auth[hook] !== undefined && !isFunction(auth[hook]))
+      return `${hook} is not a function`;
+  if (
+    auth.signInPath !== undefined &&
+    (!isString(auth.signInPath) ||
+      !compilePathPattern(auth.signInPath) ||
+      auth.signInPath.includes("*"))
+  )
+    return "signInPath is not a page path";
+  return exemptionRejection(auth.signInExempt);
+}
+
+/** @param {unknown} signInExempt */
+function exemptionRejection(signInExempt) {
+  if (signInExempt === undefined) return undefined;
+  if (!Array.isArray(signInExempt))
+    return `signInExempt is not a list of ${PATH_PATTERN_FORMS} patterns`;
+  for (const pattern of signInExempt)
+    if (!compilePathPattern(pattern))
+      return isString(pattern)
+        ? `signInExempt holds "${pattern}", which is not ${PATH_PATTERN_FORMS}`
+        : "signInExempt holds an entry that is not a string";
+  return undefined;
 }
 
 /**
@@ -72,7 +110,7 @@ export function serverAuth(provider, context) {
      * Renews the request's session after the backend refused it. Returns the
      * new session, which the rest of the request runs with, or `undefined`.
      *
-     * @param {import("node:http").IncomingMessage} request
+     * @param {import("./request-target.mjs").ServerRequest} request
      * @param {import("node:http").ServerResponse} response
      */
     async refresh(request, response) {

package/templates/vue/server/backend-proxies.mjs

@@ -1,5 +1,5 @@
-import { compilePathPattern } from "./path-patterns.mjs";
-import { isNonNullObject } from "./type-guards.mjs";
+import { compilePathPattern, PATH_PATTERN_FORMS } from "./path-patterns.mjs";
+import { isNonNullObject, isString } from "./type-guards.mjs";
 
 /** @typedef {import("../server-module.ts").DmsBackendProxyOptions} ProxyOptions */
 /**
@@ -53,12 +53,13 @@ function literalPrefix(pattern) {
 /**
  * Why a proxy declaration is ignored, or `undefined`.
  *
- * @param {string} pattern
+ * @param {string | undefined} pattern
  * @param {ProxyOptions | undefined} options
  */
 export function proxyRejection(pattern, options) {
   const compiled = compilePathPattern(pattern);
-  if (!compiled) return "the pattern is not /x, /x/* or /x/**";
+  if (!compiled || !isString(pattern))
+    return `the pattern is not ${PATH_PATTERN_FORMS}`;
   const prefix = literalPrefix(pattern);
   if (prefix === "/")
     return "its first segment is not literal: it would take every page";
@@ -81,15 +82,15 @@ export function proxyRejection(pattern, options) {
 }
 
 /**
- * @param {string} pattern A pattern `proxyRejection` accepted
+ * @param {import("./path-patterns.mjs").CompiledPathPattern} compiled A pattern `proxyRejection` accepted
  * @param {ProxyOptions | undefined} options
  * @param {string} owner Who declared it
  * @returns {BackendProxy}
  */
-function compileProxy(pattern, options, owner) {
+function compileProxy(compiled, options, owner) {
   return {
-    pattern: compilePathPattern(pattern),
-    path: pattern,
+    pattern: compiled,
+    path: compiled.pattern,
     owner,
     auth: options?.auth ?? DEFAULT_AUTH,
     maxBodyBytes: options?.maxBodyBytes,
@@ -122,15 +123,18 @@ export function resolveBackendProxies(declared, manifest, warn) {
    * @param {string} owner
    */
   const add = (pattern, options, owner) => {
-    const reason = proxyRejection(pattern, options);
+    const compiled = compilePathPattern(pattern);
     const current = kept.get(pattern);
-    if (reason || current) {
+    const reason =
+      proxyRejection(pattern, options) ??
+      (current && `${current.owner} declares it`);
+    if (!compiled || reason) {
       warn(
-        `${owner} declares the backend proxy "${pattern}", which is ignored: ${reason ?? `${current.owner} declares it`}.`,
+        `${owner} declares the backend proxy "${pattern}", which is ignored: ${reason}.`,
       );
       return;
     }
-    kept.set(pattern, compileProxy(pattern, options, owner));
+    kept.set(pattern, compileProxy(compiled, options, owner));
   };
   for (const { id, pattern, options } of declared)
     add(pattern, options, `Frontend module ${id}`);

package/templates/vue/server/backend-response.mjs

@@ -1,6 +1,6 @@
 import { GENERIC_ERROR_MESSAGE } from "./auth/backend.mjs";
 import { isFrontendVisit, redirectFrontendVisit } from "./inertia.mjs";
-import { isString } from "./type-guards.mjs";
+import { isObjectLike, isString } from "./type-guards.mjs";
 
 /**
  * What a JSON caller gets when the backend fails: the generic i18n key of
@@ -45,7 +45,7 @@ async function refusalCode(response) {
   try {
     /** @type {unknown} */
     const data = JSON.parse(text);
-    value = isString(data) ? data : data?.message;
+    value = isObjectLike(data) ? data.message : data;
   } catch {}
   return isString(value) && REFUSAL_CODE.test(value) ? value : undefined;
 }
@@ -67,7 +67,7 @@ export async function backendResponseError(response) {
  * qualifies: a refused destination sent to itself again would loop.
  *
  * @param {unknown} error What the request failed with
- * @param {import("node:http").IncomingMessage} request
+ * @param {import("./request-target.mjs").ServerRequest} request
  * @param {import("node:http").ServerResponse} response
  * @param {() => Promise<typeof import("../ssr-renderer.ts")>} loadRenderer
  * @returns {Promise<boolean>} Whether the visit was redirected