@antelopejs/dms-frontend 0.10.0 → 0.10.1

package/templates/vue/server/module-server.mjs

@@ -3,7 +3,7 @@ import { fileURLToPath } from "node:url";
 import { allowedEstablishEndpoints } from "./auth/establish-endpoints.mjs";
 import { serverAuth } from "./auth-hooks.mjs";
 import { answerModuleRoute } from "./module-event.mjs";
-import { isNonNullObject, isString } from "./type-guards.mjs";
+import { isNonNullObject, isRecord, isString } from "./type-guards.mjs";
 import {
   matchModuleRoute,
   mayHaveModuleRoute,
@@ -81,19 +81,24 @@ function readJsonFile(url, fallback) {
 const UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 /**
- * The object holding `path`'s last key, when every key up to it is own.
+ * The object holding `path`'s last key, and that key, when every key up to it
+ * is own.
  *
  * @param {Record<string, unknown>} target
  * @param {string[]} path
+ * @returns {{ holder: Record<string, unknown>, key: string } | undefined}
  */
-function holderOf(target, path) {
+function slotOf(target, path) {
+  const key = path.at(-1);
+  if (key === undefined || UNSAFE_KEYS.has(key)) return undefined;
   let node = target;
-  for (const key of path.slice(0, -1)) {
-    if (UNSAFE_KEYS.has(key) || !Object.hasOwn(node, key)) return undefined;
-    node = node[key];
-    if (!isNonNullObject(node)) return undefined;
+  for (const step of path.slice(0, -1)) {
+    if (UNSAFE_KEYS.has(step) || !Object.hasOwn(node, step)) return undefined;
+    const next = node[step];
+    if (!isRecord(next)) return undefined;
+    node = next;
   }
-  return UNSAFE_KEYS.has(path.at(-1)) ? undefined : node;
+  return { holder: node, key };
 }
 
 /**
@@ -104,10 +109,12 @@ function holderOf(target, path) {
  * @param {string} value
  */
 function fillPath(target, path, value) {
-  const holder = holderOf(target, path);
-  const key = path.at(-1);
-  if (holder && (holder[key] === undefined || holder[key] === ""))
-    holder[key] = value;
+  const slot = slotOf(target, path);
+  if (
+    slot &&
+    (slot.holder[slot.key] === undefined || slot.holder[slot.key] === "")
+  )
+    slot.holder[slot.key] = value;
 }
 
 /**
@@ -118,10 +125,13 @@ function fillPath(target, path, value) {
  * @param {string} value
  */
 function fillEmptied(target, path, value) {
-  const holder = holderOf(target, path);
-  const key = path.at(-1);
-  if (holder && Object.hasOwn(holder, key) && holder[key] === "")
-    holder[key] = value;
+  const slot = slotOf(target, path);
+  if (
+    slot &&
+    Object.hasOwn(slot.holder, slot.key) &&
+    slot.holder[slot.key] === ""
+  )
+    slot.holder[slot.key] = value;
 }
 
 /**
@@ -327,7 +337,7 @@ export async function loadServerModules(devServer) {
  * module route serves is the module's for every method: another method is
  * answered `405`.
  *
- * @param {import("node:http").IncomingMessage} request The Node request
+ * @param {import("./request-target.mjs").ServerRequest} request The Node request
  * @param {import("node:http").ServerResponse} response The Node response
  * @param {string} pathname The request's normalized path
  * @param {ServerModules} modules What `loadServerModules` or `createServerModules` returned

package/templates/vue/server/module-testing.mjs

@@ -2,7 +2,9 @@ import { createServer } from "node:http";
 import { RequestBodyError, UpstreamError } from "./auth/backend.mjs";
 import { UNEXPECTED_ERROR_BODY } from "./backend-response.mjs";
 import { createServerModules, handleModuleRoute } from "./module-server.mjs";
-import { failureStatus } from "./request-failure.mjs";
+import { failureStatus, writeBadRequest } from "./request-failure.mjs";
+import { isServerRequest } from "./request-target.mjs";
+import { isString } from "./type-guards.mjs";
 
 /**
  * What the frontend server answers an API request whose handler failed.
@@ -52,6 +54,10 @@ export async function serveModuleRoutes(declarations, deployment = {}) {
     warn: (message) => warnings.push(message),
   });
   const server = createServer((request, response) => {
+    if (!isServerRequest(request)) {
+      writeBadRequest(response);
+      return;
+    }
     const { pathname } = new URL(request.url, "http://frontend.local");
     handleModuleRoute(request, response, pathname, modules)
       .then((answered) => {
@@ -61,16 +67,25 @@ export async function serveModuleRoutes(declarations, deployment = {}) {
         /** @param {unknown} error */ (error) => writeFailure(error, response),
       );
   });
-  await new Promise((settle) => server.listen(0, "127.0.0.1", settle));
-  const { port } = server.address();
+  /** @type {Promise<void>} */
+  const listening = new Promise((settle) =>
+    server.listen(0, "127.0.0.1", settle),
+  );
+  await listening;
+  const address = server.address();
+  if (address === null || isString(address))
+    throw new TypeError("The module test server is not listening on a port");
+  const { port } = address;
+  /** @returns {Promise<void>} */
+  const close = () =>
+    new Promise((settle) => {
+      server.closeAllConnections();
+      server.close(() => settle());
+    });
   return {
     url: `http://127.0.0.1:${port}`,
     modules,
     warnings,
-    close: () =>
-      new Promise((settle) => {
-        server.closeAllConnections();
-        server.close(() => settle());
-      }),
+    close,
   };
 }

package/templates/vue/server/page-props.mjs

@@ -46,7 +46,7 @@ const NOT_FOUND = 404;
  *
  * @typedef {{
  *   signInPath: string,
- *   view: (session: unknown) => { user?: unknown, session?: unknown }
+ *   view: (session: import("./auth/session.mjs").Session | undefined) => { user?: unknown, session?: unknown }
  * }} PageAuth
  */
 
@@ -66,8 +66,9 @@ export function pageRoute(props) {
  * browser holding the layout of another account or workspace, after a sign-in,
  * a sign-out or a switch, holds another key, so it is sent the right one.
  *
- * @param {unknown} session The sealed session: any JSON value, since only its
- *   `accountId` and `activeTenantId` are read, as empty when it holds none
+ * @param {{ accountId?: string, activeTenantId?: string } | undefined} session
+ *   The sealed session, of which only the `accountId` and `activeTenantId` are
+ *   read, as empty when it holds none
  * @returns {string}
  */
 export function sharedOnceKey(session) {
@@ -118,7 +119,7 @@ function pagePath(url, withShared) {
   }
   for (const [name, value] of pageQuery) query.set(name, value);
   if (!withShared) query.set(SHARED_PROP, "false");
-  return `/dms/page?${query}`;
+  return `/dms/page?${query.toString()}`;
 }
 
 /**
@@ -206,7 +207,7 @@ export async function propsForQuery(props, url, backend, auth) {
  * session's layout, sent now or already held: declaring it otherwise would let
  * a layout of another session pass for this one.
  *
- * @param {import("node:http").IncomingMessage} request
+ * @param {import("./request-target.mjs").ServerRequest} request
  * @param {PageBackend} backend
  * @param {PageAuth} auth
  * @returns {Promise<{

package/templates/vue/server/page-redirects.mjs

@@ -17,7 +17,7 @@ export function redirectToHomepage(request, response, pathname) {
 }
 
 /**
- * @param {import("node:http").IncomingMessage} request
+ * @param {import("./request-target.mjs").ServerRequest} request
  * @param {import("node:http").ServerResponse} response
  * @param {import("./page-props.mjs").PageProps} props
  * @param {import("./module-server.mjs").ServerModules["serverAuth"]} auth

package/templates/vue/server/path-patterns.mjs

@@ -2,6 +2,19 @@ import { isString } from "./type-guards.mjs";
 
 const SEGMENT = /^[A-Za-z0-9._~-]+$/;
 
+/** The forms a path pattern takes, as the warnings name them. */
+export const PATH_PATTERN_FORMS = "/x, /x/* or /x/**";
+
+/**
+ * The wildcard a pattern may end with: what it matches below the literal
+ * segments, and how it ranks against a pattern with the same literals.
+ */
+const TAILS = new Map([
+  ["*", { matcher: "/[^/]+", rank: 3 }],
+  ["**", { matcher: "(?:/.*)?", rank: 0 }],
+]);
+const NO_TAIL = { matcher: "", rank: 1 };
+
 /**
  * @typedef {object} CompiledPathPattern
  * @property {string} pattern The pattern as declared
@@ -17,7 +30,8 @@ const SEGMENT = /^[A-Za-z0-9._~-]+$/;
  *
  * Page path patterns, as the modules' `dms.server.ts` name them: `/x` is the
  * page itself, `/x/*` one segment below it, `/x/**` the page and everything
- * below it. Nothing else: no prefix match inside a segment, no query string.
+ * below it. Nothing else: a wildcard only as the last segment, no prefix
+ * match inside a segment, no query string.
  *
  * @param {unknown} pattern
  * @returns {CompiledPathPattern | undefined}
@@ -25,26 +39,23 @@ const SEGMENT = /^[A-Za-z0-9._~-]+$/;
 export function compilePathPattern(pattern) {
   if (!isString(pattern) || !pattern.startsWith("/")) return undefined;
   const segments = pattern === "/" ? [] : pattern.slice(1).split("/");
-  const deep = segments.at(-1) === "**";
-  const literal = deep ? segments.slice(0, -1) : segments;
+  const last = TAILS.get(segments.at(-1) ?? "");
+  const literal = last ? segments.slice(0, -1) : segments;
   if (
     literal.some(
       (segment) =>
-        segment !== "*" &&
-        (!SEGMENT.test(segment) || segment === "." || segment === ".."),
+        !SEGMENT.test(segment) || segment === "." || segment === "..",
     )
   )
     return undefined;
+  const tail = last ?? NO_TAIL;
   const body = literal
-    .map((segment) =>
-      segment === "*" ? "/[^/]+" : `/${segment.replaceAll(".", "\\.")}`,
-    )
+    .map((segment) => `/${segment.replaceAll(".", "\\.")}`)
     .join("");
-  const matcher = new RegExp(`^${body}${deep ? "(?:/.*)?" : ""}/?$`);
-  const literals = literal.filter((segment) => segment !== "*").length;
+  const matcher = new RegExp(`^${body}${tail.matcher}/?$`);
   return {
     pattern,
-    specificity: literals * 4 + literal.length * 2 + (deep ? 0 : 1),
+    specificity: literal.length * 6 + tail.rank,
     test: (pathname) => matcher.test(pathname === "" ? "/" : pathname),
   };
 }

package/templates/vue/server/proxy-headers.mjs

@@ -57,7 +57,7 @@ export function writeProxyHeaders(
   for (const name of [...HOP_BY_HOP_HEADERS, ...named]) delete headers[name];
   delete headers["set-cookie"];
   const cookies = upstream.headers.getSetCookie?.() ?? [];
-  if (cookies.length) headers["set-cookie"] = cookies;
+  if (cookies.length) Object.assign(headers, { "set-cookie": cookies });
   if (headers.location && upstream.url)
     headers.location = relayedLocation(
       headers.location,

package/templates/vue/server/proxy-redirects.mjs

@@ -6,6 +6,7 @@ export const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
  * @returns {string | undefined}
  */
 function originOf(url) {
+  if (url === undefined) return undefined;
   try {
     return new URL(url).origin;
   } catch {

package/templates/vue/server/proxy-request.mjs

@@ -21,7 +21,7 @@ const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
  * the storage's signed URL, on the public origin the server itself may not
  * reach, which turned every download into a 502.
  *
- * @param {import("node:http").IncomingMessage} request
+ * @param {import("./request-target.mjs").ServerRequest} request
  * @param {import("node:http").ServerResponse} response
  * @param {import("./backend-proxies.mjs").BackendProxy} backendProxy
  * @param {(path: string) => boolean} isProxiedPath
@@ -36,6 +36,7 @@ export async function proxy(request, response, backendProxy, isProxiedPath) {
   if (response.closed) return;
   const abandoned = new AbortController();
   response.once("close", () => abandoned.abort());
+  /** @type {RequestInit} */
   const init = {
     signal: abandoned.signal,
     method: request.method,

package/templates/vue/server/proxy-transfers.mjs

@@ -1,3 +1,5 @@
+import { isObjectLike } from "./type-guards.mjs";
+
 const PAYLOAD_TOO_LARGE = 413;
 const TOO_LARGE_BODY = JSON.stringify({ message: "Payload Too Large" });
 /**
@@ -41,7 +43,7 @@ async function* limitedChunks(request, maxBodyBytes) {
 }
 
 /**
- * @param {import("node:http").IncomingMessage} request
+ * @param {import("./request-target.mjs").ServerRequest} request
  * @param {number | undefined} maxBodyBytes
  */
 function requestBody(request, maxBodyBytes) {
@@ -70,7 +72,7 @@ function declaresTooLargeBody(request, maxBodyBytes) {
 function isBodyTooLarge(error) {
   return (
     error instanceof BodyTooLargeError ||
-    error?.cause instanceof BodyTooLargeError
+    (isObjectLike(error) && error.cause instanceof BodyTooLargeError)
   );
 }
 
@@ -93,7 +95,10 @@ function refuseTooLargeBody(request, response) {
     connection: "close",
   });
   response.write(TOO_LARGE_BODY);
-  if (request.complete) return response.end();
+  if (request.complete) {
+    response.end();
+    return;
+  }
   const close = () => {
     clearTimeout(timer);
     response.end();
@@ -117,7 +122,7 @@ function refuseTooLargeBody(request, response) {
  * before a byte is passed on, a chunked body is cut off as soon as it goes
  * over.
  *
- * @param {import("node:http").IncomingMessage} request
+ * @param {import("./request-target.mjs").ServerRequest} request
  * @param {import("node:http").ServerResponse} response
  * @param {number | undefined} maxBodyBytes
  * @param {(
@@ -125,18 +130,19 @@ function refuseTooLargeBody(request, response) {
  * ) => Promise<Response>} send The backend request with the body to stream:
  *   none for a GET or a HEAD, the request itself, or its bytes cut off past
  *   the limit
- * @returns {Promise<Response | import("node:http").ServerResponse | undefined>}
- *   The backend's answer, or once the body went over and `response` got the
- *   413: `undefined`, or `response` itself when the request had been read
- *   already (`response.end()`'s own return)
+ * @returns {Promise<Response | undefined>} The backend's answer, or
+ *   `undefined` once the body went over and `response` got the 413
  */
 export async function sendWithinLimit(request, response, maxBodyBytes, send) {
-  if (declaresTooLargeBody(request, maxBodyBytes))
-    return refuseTooLargeBody(request, response);
+  if (declaresTooLargeBody(request, maxBodyBytes)) {
+    refuseTooLargeBody(request, response);
+    return undefined;
+  }
   try {
     return await send(requestBody(request, maxBodyBytes));
   } catch (error) {
     if (!isBodyTooLarge(error)) throw error;
-    return refuseTooLargeBody(request, response);
+    refuseTooLargeBody(request, response);
+    return undefined;
   }
 }

package/templates/vue/server/public-endpoints.mjs

@@ -2,13 +2,7 @@ import { readFileSync } from "node:fs";
 import { json } from "./auth/backend.mjs";
 import { CROSS_ORIGIN_ERROR, isSameOrigin } from "./auth/client-ip.mjs";
 import { PROXY_AUTH_MODES } from "./backend-proxies.mjs";
-import {
-  isNonNullObject,
-  isNumber,
-  isObjectLike,
-  isRecord,
-  isString,
-} from "./type-guards.mjs";
+import { isNumber, isObjectLike, isRecord, isString } from "./type-guards.mjs";
 
 /**
  * A public endpoint, compiled from a declaration that passed every check.
@@ -96,7 +90,7 @@ export function readDeclaredPublicEndpoints(file = DECLARED_ENDPOINTS_FILE) {
  * when the proxies are resolved.
  *
  * @param {unknown} entry
- * @returns {entry is { path: string, auth?: "session" | "none", maxBodyBytes?: number }}
+ * @returns {entry is { path: string, auth?: "session" | "none", maxBodyBytes?: number, module?: unknown }}
  */
 function isProxyDeclaration(entry) {
   return (
@@ -252,11 +246,11 @@ function pathMatcher(path) {
  * A declaration made usable, or `undefined` when any part of it is malformed:
  * a bad entry is dropped whole, never widened to what it might have meant.
  *
- * @param {PublicEndpointDeclaration | null | undefined} entry
+ * @param {unknown} entry
  * @returns {PublicEndpoint | undefined}
  */
 export function compilePublicEndpoint(entry) {
-  if (!isNonNullObject(entry)) return undefined;
+  if (!isObjectLike(entry)) return undefined;
   if (!isString(entry.path) || !PUBLIC_PATH.test(entry.path)) return undefined;
   const methods = normalizedMethods(entry.methods);
   const headers = normalizedHeaders(entry.headers);
@@ -284,7 +278,9 @@ export function allowedPublicEndpoints(
 ) {
   return [...declared, ...environmentEndpoints(declaration)].flatMap(
     (entry) => {
-      const endpoint = compilePublicEndpoint(entry);
+      const endpoint = isRecord(entry)
+        ? compilePublicEndpoint(entry)
+        : undefined;
       if (!endpoint)
         console.warn(
           `Ignoring malformed public endpoint ${JSON.stringify(entry)}: expected ` +
@@ -337,23 +333,23 @@ export function matchPublicEndpoint(
  * Origin. Under `auth: "session"`, a state-changing request needs one unless
  * it reaches a public endpoint, which is why the proxy never sends a public
  * endpoint the session: a cross-site form posting to it acts as nobody.
+ * Under either mode, a request that reaches a public endpoint carries the
+ * endpoint's declared headers.
  *
- * @param {import("node:http").IncomingMessage} request The incoming request
+ * @param {import("./request-target.mjs").ServerRequest} request The incoming request
  * @param {ReadonlySet<string>} safeMethods Methods that change nothing and need no Origin
  * @param {import("./backend-proxies.mjs").BackendProxy} proxy The backend proxy the request reached
  * @returns `{ anonymous, headers, isRefused }`
  */
 export function proxyAccess(request, safeMethods, proxy) {
-  if (proxy.auth === "none")
-    return { anonymous: true, headers: [], isRefused: false };
   const publicEndpoint = matchPublicEndpoint(
     request.method,
     new URL(request.url, "http://frontend.local").pathname,
   );
-  if (publicEndpoint)
+  if (publicEndpoint || proxy.auth === "none")
     return {
       anonymous: true,
-      headers: publicEndpoint.headers,
+      headers: publicEndpoint?.headers ?? [],
       isRefused: false,
     };
   return {

package/templates/vue/server/request-failure.mjs

@@ -38,7 +38,7 @@ export function failureStatus(error) {
  */
 export function isResponseGone(error, response) {
   return (
-    error?.code === "ERR_STREAM_PREMATURE_CLOSE" ||
+    (isObjectLike(error) && error.code === "ERR_STREAM_PREMATURE_CLOSE") ||
     response.destroyed ||
     response.writableEnded ||
     response.headersSent

package/templates/vue/server/request-routing.mjs

@@ -1,4 +1,5 @@
 import { matchBackendProxy } from "./backend-proxies.mjs";
+import { isIconRequest } from "./icons.mjs";
 import { isRendererFilePath, moduleRouteMethods } from "./module-routes.mjs";
 
 /**
@@ -37,7 +38,11 @@ const PAGE_METHODS = new Set(["GET", "HEAD"]);
  *   `{ kind: "not-found" }`
  */
 export function requestOwner(method, pathname, modules, hasRendererFile) {
-  if (isRendererFilePath(pathname) || hasRendererFile(pathname))
+  if (
+    isIconRequest(pathname) ||
+    isRendererFilePath(pathname) ||
+    hasRendererFile(pathname)
+  )
     return { kind: "renderer" };
   const route = modules.routes.find((candidate) =>
     candidate.matcher.test(pathname),

package/templates/vue/server/request-target.mjs

@@ -1,4 +1,3 @@
-import { writeBadRequest } from "./request-failure.mjs";
 import { isString } from "./type-guards.mjs";
 
 const FRONTEND_ORIGIN = "http://frontend.local";
@@ -30,7 +29,7 @@ export function isOriginForm(target) {
  */
 export function backendUrl(
   target,
-  backendBaseUrl = process.env.DMS_API_BASE_URL,
+  backendBaseUrl = process.env.DMS_API_BASE_URL ?? "",
 ) {
   const { pathname, search } = new URL(target, FRONTEND_ORIGIN);
   const url = new URL(new URL(backendBaseUrl).origin);
@@ -40,8 +39,24 @@ export function backendUrl(
 }
 
 /**
- * Answers 400 to a request whose target is not origin-form, before any route
- * reads it. Returns whether it answered.
+ * A request a server received, whose `url` and `method` Node always sets
+ * (`isServerRequest`).
+ *
+ * @typedef {import("node:http").IncomingMessage & { url: string, method: string }} ServerRequest
+ */
+
+/**
+ * @template {import("node:http").IncomingMessage} Request
+ * @param {Request} request
+ * @returns {request is Request & ServerRequest}
+ */
+export function isServerRequest(request) {
+  return isString(request.url) && isString(request.method);
+}
+
+/**
+ * Whether the request target is origin-form, the only kind the server routes:
+ * a request that fails it is answered 400 before any route reads it.
  *
  * The request target as the server reads it. Node hands `request.url` over
  * verbatim, so it is not always a path: `//host/x`, `/\host/x` and the absolute
@@ -50,10 +65,8 @@ export function backendUrl(
  * backend read the same normalized path from here.
  *
  * @param {import("node:http").IncomingMessage} request
- * @param {import("node:http").ServerResponse} response
+ * @returns {request is ServerRequest}
  */
-export function refuseForeignTarget(request, response) {
-  if (isOriginForm(request.url)) return false;
-  writeBadRequest(response);
-  return true;
+export function hasOriginFormTarget(request) {
+  return isOriginForm(request.url) && isString(request.method);
 }

package/templates/vue/server/route-rules.mjs

@@ -1,5 +1,11 @@
-import { compilePathPattern } from "./path-patterns.mjs";
-import { isNonNullObject, isObjectLike, isString } from "./type-guards.mjs";
+import { compilePathPattern, PATH_PATTERN_FORMS } from "./path-patterns.mjs";
+import {
+  isNonNullObject,
+  isNumber,
+  isObjectLike,
+  isRecord,
+  isString,
+} from "./type-guards.mjs";
 
 /** @typedef {import("../server-module.ts").DmsRouteRule} RouteRule */
 /** @typedef {RouteRule & { headers: Record<string, string> }} MergedRouteRule */
@@ -37,7 +43,7 @@ const RESERVED_HEADERS = new Set([
 
 /** @param {unknown} value */
 function isSeconds(value) {
-  return Number.isSafeInteger(value) && value >= 0;
+  return isNumber(value) && Number.isSafeInteger(value) && value >= 0;
 }
 
 /** @param {unknown} headers */
@@ -63,7 +69,7 @@ function headersRejection(headers) {
 function cacheRejection(cache) {
   if (cache === undefined || cache === false) return undefined;
   if (
-    !isNonNullObject(cache) ||
+    !isRecord(cache) ||
     cache.public !== true ||
     !isSeconds(cache.maxAge) ||
     (cache.staleWhileRevalidate !== undefined &&
@@ -85,8 +91,8 @@ function cacheRejection(cache) {
  */
 export function ruleRejection(pattern, rule) {
   if (!compilePathPattern(pattern))
-    return "the pattern is not /x, /x/* or /x/**";
-  if (!isNonNullObject(rule)) return "it is not an object";
+    return `the pattern is not ${PATH_PATTERN_FORMS}`;
+  if (!isRecord(rule)) return "it is not an object";
   if (rule.ssr !== undefined && rule.ssr !== false)
     return "ssr is either left out or false";
   return headersRejection(rule.headers) ?? cacheRejection(rule.cache);

package/templates/vue/server/static-files.mjs

@@ -1,5 +1,6 @@
 import { createReadStream, existsSync, statSync } from "node:fs";
 import { extname } from "node:path";
+import { acceptedCodings } from "./content.mjs";
 
 /**
  * What a build or a module's `public/` directory may hold. A type missing
@@ -48,22 +49,26 @@ const IMMUTABLE_CACHE = "public, max-age=31536000, immutable";
  */
 const REVALIDATED_CACHE = "no-cache";
 
+/** The suffix the build gives the copy of a file in each coding. */
+const VARIANT_SUFFIXES = { br: ".br", gzip: ".gz" };
+
 /** @param {string} path */
 const isFile = (path) => existsSync(path) && statSync(path).isFile();
 
 /**
- * The precompressed variant of `file` the client accepts, if the build wrote one.
+ * The precompressed variant of `file` the client wants most among those the
+ * build wrote, or `file` itself.
  *
  * @param {string} file
  * @param {import("node:http").IncomingMessage} request
  */
 function acceptedVariant(file, request) {
-  const accepted = request.headers["accept-encoding"] ?? "";
-  if (accepted.includes("br") && isFile(`${file}.br`))
-    return { file: `${file}.br`, encoding: "br" };
-  if (accepted.includes("gzip") && isFile(`${file}.gz`))
-    return { file: `${file}.gz`, encoding: "gzip" };
-  return { file, encoding: undefined };
+  const encoding = acceptedCodings(request).find((coding) =>
+    isFile(`${file}${VARIANT_SUFFIXES[coding]}`),
+  );
+  return encoding
+    ? { file: `${file}${VARIANT_SUFFIXES[encoding]}`, encoding }
+    : { file, encoding: undefined };
 }
 
 /**

package/templates/vue/server/vite-errors.mjs

@@ -1,3 +1,5 @@
+import { isObjectLike, isString } from "./type-guards.mjs";
+
 const INTERNAL_ERROR_STATUS = 500;
 const ERROR_CONTENT_TYPE = "text/plain; charset=utf-8";
 const VITE_ERROR = Symbol("dms.viteError");
@@ -69,9 +71,18 @@ export function runViteMiddlewares(devServer, request, response) {
   });
 }
 
-/** Answers 500 with Vite's error message instead of rendering a page. */
+/**
+ * Answers 500 with Vite's error message instead of rendering a page.
+ *
+ * @param {import("node:http").ServerResponse} response
+ * @param {unknown} error
+ */
 export function writeViteError(response, error) {
   response.statusCode = INTERNAL_ERROR_STATUS;
   response.setHeader("content-type", ERROR_CONTENT_TYPE);
-  response.end(error?.message ?? String(error));
+  response.end(
+    isObjectLike(error) && isString(error.message)
+      ? error.message
+      : String(error),
+  );
 }

package/templates/vue/server/web-body.mjs

@@ -17,10 +17,11 @@ import { pipeline } from "node:stream/promises";
  */
 export async function pipeWebBody(body, ...streams) {
   const response = streams.at(-1);
+  if (!response) throw new TypeError("pipeWebBody needs a response to write");
   if (response.closed || response.destroyed) {
     for (const stream of streams.slice(0, -1)) stream.destroy();
     await body.cancel().catch(() => {});
     return;
   }
-  await pipeline(Readable.fromWeb(body), ...streams);
+  await pipeline([Readable.fromWeb(body), ...streams]);
 }

package/templates/vue/server-module.ts

@@ -186,7 +186,8 @@ export interface DmsServerRouteOptions {
  * The session logic the frontend server runs outside any route, which the
  * module owning sign-in provides. Without `publicSession`, pages carry no
  * `user` and `session`; without `refreshSession`, a session the backend
- * refuses is not renewed; `signInPath` is `/auth` by default.
+ * refuses is not renewed; `signInPath` is `/auth` by default. The server
+ * calls each hook with the registered object as `this`.
  */
 export interface DmsServerAuth {
   /** Where a signed-out visit to a private page goes, with `?redirect=`. */