@antelopejs/dms-frontend 0.10.0 → 0.10.2

package/dist/verify-source-runner.js

@@ -39,11 +39,11 @@ const cli_1 = require("@antelopejs/core/cli");
 const child_output_1 = require("./child-output");
 const ensure_1 = require("./internal/ensure");
 const guards_1 = require("./internal/guards");
-const plain_object_1 = require("./internal/plain-object");
 const vite_manifest_1 = require("./internal/vite-manifest");
 const common_1 = require("./common");
 const output_1 = require("./output");
 const temporary_workspace_1 = require("./temporary-workspace");
+const verify_source_workspace_1 = require("./verify-source-workspace");
 const verify_source_client_bundle_1 = require("./verify-source-client-bundle");
 const verify_source_build_1 = require("./verify-source-build");
 const verify_source_result_1 = require("./verify-source-result");
@@ -51,48 +51,6 @@ const verify_source_sources_1 = require("./verify-source-sources");
 const vite_output_1 = require("./vite-output");
 const EMAIL_BUILD_SIZE_CEILING_BYTES = 256 * 1024;
 const NON_EMAIL_RUNTIME_PATTERN = /DisplayRichText|ApexCharts|Tiptap|FlowCanvas|app\/.*table|components\/table/i;
-function removeDevelopmentDependencies(root) {
-    const packagePath = (0, node_path_1.join)(root, "package.json");
-    if (!(0, node_fs_1.existsSync)(packagePath))
-        return;
-    const packageData = JSON.parse((0, node_fs_1.readFileSync)(packagePath, "utf8"));
-    if (!(0, plain_object_1.isPlainObject)(packageData))
-        return;
-    delete packageData.devDependencies;
-    (0, node_fs_1.writeFileSync)(packagePath, `${JSON.stringify(packageData, null, 2)}\n`);
-}
-function materializeWorkspace(workspace, layers, localPackages) {
-    const templateRoot = (0, node_path_1.join)((0, common_1.getPackageRoot)(), "templates", "vue");
-    const templateFiles = (0, node_fs_1.readdirSync)(templateRoot).filter((file) => !file.startsWith("npmrc"));
-    for (const file of templateFiles)
-        (0, node_fs_1.cpSync)((0, node_path_1.join)(templateRoot, file), (0, node_path_1.join)(workspace, file), {
-            recursive: true,
-        });
-    (0, common_1.materializeLayers)(workspace, layers);
-    const registry = (0, common_1.createFrontendModuleRegistry)(workspace, layers);
-    registry.modules.forEach((module) => {
-        removeDevelopmentDependencies(module.root);
-    });
-    (0, common_1.writeFrontendModuleRegistry)(workspace, layers);
-    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(workspace, "dms-main.css"), '@import "tailwindcss";\n@import "@nuxt/ui";\n');
-    (0, common_1.writeWorkspacePackageJson)(workspace, layers);
-    const packagePath = (0, node_path_1.join)(workspace, "package.json");
-    const workspacePackage = JSON.parse((0, node_fs_1.readFileSync)(packagePath, "utf8"));
-    (0, ensure_1.ensure)((0, plain_object_1.isPlainObject)(workspacePackage), "The workspace package.json is not a JSON object");
-    workspacePackage.pnpm = {
-        overrides: {
-            ...Object.fromEntries(layers.map((layer) => [
-                String(layer.packageName),
-                "workspace:*",
-            ])),
-            ...Object.fromEntries(Object.entries(localPackages).map(([name, path]) => [
-                name,
-                `link:${(0, node_path_1.resolve)(path)}`,
-            ])),
-        },
-    };
-    (0, node_fs_1.writeFileSync)(packagePath, `${JSON.stringify(workspacePackage, null, 2)}\n`);
-}
 async function checkServerModulesBundle(workspace) {
     const root = (0, node_path_1.join)(workspace, "dist", "server-modules");
     const javascript = (0, node_fs_1.readdirSync)(root, { recursive: true, encoding: "utf8" })
@@ -216,7 +174,7 @@ async function verifySources() {
         env: { ...process.env, [vite_output_1.VITE_LOG_LEVEL_VARIABLE]: (0, vite_output_1.viteLogLevel)(isVerbose) },
     };
     const tasks = (0, cli_1.getProcessTasks)();
-    await tasks.run(`Materializing ${(0, cli_1.pluralize)(layers.length, "module")}`, async () => materializeWorkspace(workspace, layers, options.localPackages), { done: `Materialized ${(0, cli_1.pluralize)(layers.length, "module")}` });
+    await tasks.run(`Materializing ${(0, cli_1.pluralize)(layers.length, "module")}`, async () => (0, verify_source_workspace_1.materializeWorkspace)(workspace, layers, options.localPackages), { done: `Materialized ${(0, cli_1.pluralize)(layers.length, "module")}` });
     await (0, common_1.installDeps)(workspace, context.mapLine, ["--ignore-scripts"]);
     await (0, verify_source_build_1.prepareTypes)(context);
     await (0, verify_source_build_1.buildAndTypeCheck)(context);

package/dist/verify-source-workspace.d.ts

@@ -0,0 +1,2 @@
+import { type ResolvedLayer } from "./common";
+export declare function materializeWorkspace(workspace: string, layers: ResolvedLayer[], localPackages: Record<string, string>): void;

package/dist/verify-source-workspace.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.materializeWorkspace = materializeWorkspace;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const yaml_1 = require("yaml");
+const common_1 = require("./common");
+const ensure_1 = require("./internal/ensure");
+const guards_1 = require("./internal/guards");
+const plain_object_1 = require("./internal/plain-object");
+const output_1 = require("./output");
+function removeDevelopmentDependencies(root) {
+    const packagePath = (0, node_path_1.join)(root, "package.json");
+    if (!(0, node_fs_1.existsSync)(packagePath))
+        return;
+    const packageData = JSON.parse((0, node_fs_1.readFileSync)(packagePath, "utf8"));
+    if (!(0, plain_object_1.isPlainObject)(packageData))
+        return;
+    delete packageData.devDependencies;
+    (0, node_fs_1.writeFileSync)(packagePath, `${JSON.stringify(packageData, null, 2)}\n`);
+}
+const PATH_PROTOCOLS = ["file:", "link:"];
+const WORKSPACE_PROTOCOL = "workspace:";
+const LOCKFILE = "pnpm-lock.yaml";
+const WORKSPACE_FILE = "pnpm-workspace.yaml";
+const OWN_LOCKFILES = /^\s*shared-workspace-lockfile\s*=\s*false\s*$/m;
+function findUp(directory, file) {
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(directory, file)))
+        return directory;
+    const parent = (0, node_path_1.dirname)(directory);
+    return parent === directory ? undefined : findUp(parent, file);
+}
+function sharesLockfile(root) {
+    const npmrc = (0, node_path_1.join)(root, ".npmrc");
+    if ((0, node_fs_1.existsSync)(npmrc) && OWN_LOCKFILES.test((0, node_fs_1.readFileSync)(npmrc, "utf8")))
+        return false;
+    const settings = (0, yaml_1.parse)((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, WORKSPACE_FILE), "utf8"));
+    return !((0, plain_object_1.isPlainObject)(settings) && settings.sharedWorkspaceLockfile === false);
+}
+function findLockfile(directory) {
+    const workspaceRoot = findUp(directory, WORKSPACE_FILE);
+    const lockfileRoot = workspaceRoot && sharesLockfile(workspaceRoot)
+        ? workspaceRoot
+        : findUp(directory, LOCKFILE);
+    if (!lockfileRoot)
+        return undefined;
+    const lockfile = (0, node_path_1.join)(lockfileRoot, LOCKFILE);
+    const outsideWorkspace = workspaceRoot !== undefined &&
+        (0, node_path_1.relative)(workspaceRoot, lockfileRoot).startsWith("..");
+    return (0, node_fs_1.existsSync)(lockfile) && !outsideWorkspace ? lockfile : undefined;
+}
+function readLayerOverrides(layer) {
+    const lockfile = findLockfile(layer.path);
+    if (!lockfile)
+        return [];
+    const root = (0, node_path_1.dirname)(lockfile);
+    const overrides = [];
+    for (const document of (0, yaml_1.parseAllDocuments)((0, node_fs_1.readFileSync)(lockfile, "utf8"))) {
+        const [error] = document.errors;
+        (0, ensure_1.ensure)(error === undefined, `${(0, output_1.showPath)(lockfile)} is not a pnpm lockfile`, error?.message);
+        const lock = document.toJS();
+        if (!(0, plain_object_1.isPlainObject)(lock) || !(0, plain_object_1.isPlainObject)(lock.overrides))
+            continue;
+        for (const [name, spec] of Object.entries(lock.overrides)) {
+            if (!(0, guards_1.isText)(spec) || spec.startsWith(WORKSPACE_PROTOCOL))
+                continue;
+            overrides.push([name, resolveSpec(root, spec)]);
+        }
+    }
+    return overrides;
+}
+function resolveSpec(root, spec) {
+    const protocol = PATH_PROTOCOLS.find((prefix) => spec.startsWith(prefix));
+    if (!protocol)
+        return spec;
+    const path = spec.slice(protocol.length);
+    return (0, node_path_1.isAbsolute)(path) ? spec : `${protocol}${(0, node_path_1.resolve)(root, path)}`;
+}
+function materializeWorkspace(workspace, layers, localPackages) {
+    const templateRoot = (0, node_path_1.join)((0, common_1.getPackageRoot)(), "templates", "vue");
+    const templateFiles = (0, node_fs_1.readdirSync)(templateRoot).filter((file) => !file.startsWith("npmrc"));
+    for (const file of templateFiles)
+        (0, node_fs_1.cpSync)((0, node_path_1.join)(templateRoot, file), (0, node_path_1.join)(workspace, file), {
+            recursive: true,
+        });
+    (0, common_1.materializeLayers)(workspace, layers);
+    const registry = (0, common_1.createFrontendModuleRegistry)(workspace, layers);
+    registry.modules.forEach((module) => {
+        removeDevelopmentDependencies(module.root);
+    });
+    (0, common_1.writeFrontendModuleRegistry)(workspace, layers);
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(workspace, "dms-main.css"), '@import "tailwindcss";\n@import "@nuxt/ui";\n');
+    (0, common_1.writeWorkspacePackageJson)(workspace, layers);
+    const packagePath = (0, node_path_1.join)(workspace, "package.json");
+    const workspacePackage = JSON.parse((0, node_fs_1.readFileSync)(packagePath, "utf8"));
+    (0, ensure_1.ensure)((0, plain_object_1.isPlainObject)(workspacePackage), "The workspace package.json is not a JSON object");
+    workspacePackage.pnpm = {
+        overrides: {
+            ...Object.fromEntries(layers.flatMap(readLayerOverrides)),
+            ...Object.fromEntries(layers.map((layer) => [
+                String(layer.packageName),
+                "workspace:*",
+            ])),
+            ...Object.fromEntries(Object.entries(localPackages).map(([name, path]) => [
+                name,
+                `link:${(0, node_path_1.resolve)(path)}`,
+            ])),
+        },
+    };
+    (0, node_fs_1.writeFileSync)(packagePath, `${JSON.stringify(workspacePackage, null, 2)}\n`);
+}

package/dist/workspace-setup.d.ts

@@ -31,6 +31,7 @@ export interface SetupWorkspaceOptions {
     workspaceDir?: string;
     project?: ProjectModulesOptions;
     beforeInstall?: () => Promise<void>;
+    install?: boolean;
 }
 export interface SetupWorkspaceResult {
     workspaceDir: string;

package/dist/workspace-setup.js

@@ -299,7 +299,8 @@ async function setupWorkspace(opts) {
     writeDerivedOutputs(workspaceDir, layers);
     (0, materialize_1.writeDmsMainCss)(workspaceDir, layers);
     const layerPaths = layers.map((layer) => layer.path);
-    const shouldInstall = needsInstall(workspaceDir, layerPaths, opts.force);
+    const shouldInstall = opts.install !== false &&
+        needsInstall(workspaceDir, layerPaths, opts.force);
     if (shouldInstall) {
         await opts.beforeInstall?.();
         await installDeps(workspaceDir, (0, child_output_1.createPathMapper)(workspaceDir, layers));
@@ -321,6 +322,6 @@ function writeDerivedOutputs(workspaceDir, layers) {
         if (!(error instanceof locale_files_1.InvalidLocaleFileError))
             throw error;
         const showSource = (0, child_output_1.createPathMapper)(workspaceDir, layers);
-        throw new locale_files_1.InvalidLocaleFileError(showSource(error.path), error.reason);
+        throw new locale_files_1.InvalidLocaleFileError(showSource(error.path), error.reason, error.details);
     }
 }

package/dist/workspace.js

@@ -105,7 +105,7 @@ function directorySize(dir) {
             continue;
         }
         for (const entry of entries) {
-            const path = (0, node_path_1.join)(current, entry.name);
+            const path = `${current}${node_path_1.sep}${entry.name}`;
             if (entry.isDirectory()) {
                 pending.push(path);
                 continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antelopejs/dms-frontend",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "Frontend-agnostic loader for AntelopeJS DMS, shipping the Vue 3 renderer (Vite, Inertia, SSR)",
   "keywords": [
     "antelope",
@@ -60,20 +60,20 @@
   "scripts": {
     "build": "rimraf dist && tsc",
     "prepack": "pnpm run build",
-    "release": "pnpm run lint && pnpm run format:check && pnpm run test && pnpm run test:cli && release-it",
+    "release": "pnpm run typecheck && pnpm run lint && pnpm run format:check && pnpm run test && pnpm run test:cli && release-it",
     "test": "node --import tsx --test 'tests/!(cli|cli-*).test.{ts,mts}'",
     "test:cli": "pnpm run build && DMS_PREBUILT=1 node --import tsx --test tests/cli.test.ts 'tests/cli-*.test.{ts,mts}'",
     "test:real-source": "pnpm run build && node dist/verify-source-runner.js",
     "format": "oxfmt .",
     "lint": "oxlint && antelopejs-check-interface-ranges && pnpm run docs:reference:check && pnpm run source-checks",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && tsx scripts/typecheck-projects.ts tsconfig.templates.json tsconfig.tests.json",
     "lint:fix": "oxlint --fix --max-warnings=1000000 && oxfmt .",
     "knip": "knip --dependencies",
     "knip:all": "knip",
     "docs:reference": "tsx scripts/docs-reference.ts",
     "docs:reference:check": "tsx scripts/docs-reference.ts --check",
     "source-checks": "tsx scripts/source-checks.ts",
-    "prepare": "if git rev-parse --is-inside-work-tree >/dev/null 2>&1 && command -v lefthook >/dev/null 2>&1; then lefthook install; fi",
+    "prepare": "if [ -e .git ] && command -v git >/dev/null 2>&1 && command -v lefthook >/dev/null 2>&1 && GIT_DIR=.git GIT_WORK_TREE=. git rev-parse --git-dir >/dev/null 2>&1; then GIT_DIR=.git GIT_WORK_TREE=. lefthook install; fi",
     "checks": "antelopejs-checks",
     "size": "antelopejs-check-size",
     "sync": "antelopejs-sync",
@@ -87,12 +87,13 @@
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",
     "ignore": "^7.0.5",
-    "semver": "^7.7.4"
+    "semver": "^7.7.4",
+    "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@antelopejs/core": "^1.20.0",
+    "@antelopejs/core": "^1.21.2",
     "@antelopejs/interface-dms": "^0.10.0",
-    "@antelopejs/tooling-configs": "^0.2.17",
+    "@antelopejs/tooling-configs": "^0.5.1",
     "@iconify/utils": "^3.1.0",
     "@iconify/vue": "^5.0.1",
     "@inertiajs/vue3": "^3.7.1",
@@ -104,15 +105,20 @@
     "@vueuse/core": "14.4.0",
     "defu": "^6.1.4",
     "devalue": "^5.9.4",
+    "fast-check": "^4.10.2",
     "knip": "^6.34.0",
     "lefthook": "^2.2.2",
+    "mongodb-memory-server": "^11.3.0",
     "ofetch": "^1.5.1",
     "oxfmt": "^0.66.0",
     "oxlint": "1.81.0",
     "oxlint-tsgolint": "^7.0.2001",
+    "pixelmatch": "^8.0.0",
+    "playwright-core": "^1.56.1",
     "release-it": "^19.2.4",
     "release-it-changelogen": "^0.1.0",
     "rimraf": "^6.1.2",
+    "sharp": "^0.35.5",
     "tsx": "^4.23.15",
     "typescript": "^6.0.3",
     "unplugin-auto-import": "^20.2.0",
@@ -137,6 +143,13 @@
   "pnpm": {
     "patchedDependencies": {
       "@vueuse/core@14.4.0": "templates/vue/patches/@vueuse__core@14.4.0.patch"
+    },
+    "packageExtensions": {
+      "@antelopejs/core@1.21": {
+        "dependencies": {
+          "@types/mocha": "^10.0.10"
+        }
+      }
     }
   },
   "antelopeJs": {

package/templates/vue/backend-boundary.mjs

@@ -0,0 +1,132 @@
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, sep } from "node:path";
+import { isRecord, isString } from "./server/type-guards.mjs";
+
+const BACKEND_SOURCE = "src";
+const QUERY_OR_HASH = /[?#].*$/;
+
+/**
+ * @param {string} manifest
+ * @returns {string | undefined}
+ */
+function manifestName(manifest) {
+  try {
+    /** @type {unknown} */
+    const parsed = JSON.parse(readFileSync(manifest, "utf8"));
+    return isRecord(parsed) && isString(parsed.name) ? parsed.name : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * @typedef {{ root: string, name: string }} BackendPackage
+ */
+
+/**
+ * The backend package that holds `directory`: the nearest `package.json` above
+ * it, when it names one of `backendPackages`.
+ *
+ * @param {string} directory
+ * @param {ReadonlySet<string>} backendPackages
+ * @param {Map<string, BackendPackage | null>} known
+ * @returns {BackendPackage | null}
+ */
+function owningBackend(directory, backendPackages, known) {
+  const cached = known.get(directory);
+  if (cached !== undefined) return cached;
+  const manifest = join(directory, "package.json");
+  const parent = dirname(directory);
+  /** @type {BackendPackage | null} */
+  let owner = null;
+  if (existsSync(manifest)) {
+    const name = manifestName(manifest);
+    owner =
+      name !== undefined && backendPackages.has(name)
+        ? { root: directory, name }
+        : null;
+  } else if (parent !== directory) {
+    owner = owningBackend(parent, backendPackages, known);
+  }
+  known.set(directory, owner);
+  return owner;
+}
+
+/**
+ * The real path of a resolved module id under the `src` of a backend package,
+ * and that package's name, or `undefined`. The package that owns the file
+ * decides, not where it lies, so a backend linked or installed into the
+ * workspace is caught as well as its source checkout. Virtual ids and ids that
+ * are not files are ignored.
+ *
+ * @param {string} id
+ * @param {ReadonlySet<string>} backendPackages
+ * @param {Map<string, BackendPackage | null>} known
+ * @returns {{ file: string, name: string } | undefined}
+ */
+function backendSourceFile(id, backendPackages, known) {
+  const path = id.replace(QUERY_OR_HASH, "");
+  if (!isAbsolute(path)) return undefined;
+  let file;
+  try {
+    file = realpathSync(path);
+  } catch {
+    return undefined;
+  }
+  const owner = owningBackend(dirname(file), backendPackages, known);
+  if (owner === null) return undefined;
+  return relative(owner.root, file).split(sep)[0] === BACKEND_SOURCE
+    ? { file, name: owner.name }
+    : undefined;
+}
+
+/**
+ * @param {ReadonlySet<string>} backendPackages
+ * @returns {import("vite").Plugin}
+ */
+function boundaryCheck(backendPackages) {
+  /** @type {Map<string, BackendPackage | null>} */
+  const known = new Map();
+  return {
+    name: "dms-backend-boundary",
+    enforce: "pre",
+    async resolveId(source, importer, options) {
+      const resolved = await this.resolve(source, importer, {
+        ...options,
+        skipSelf: true,
+      });
+      if (resolved === null) return null;
+      const backend = backendSourceFile(resolved.id, backendPackages, known);
+      if (backend === undefined) return resolved;
+      const from =
+        importer === undefined
+          ? "an entry point"
+          : importer.replace(QUERY_OR_HASH, "");
+      return this.error(
+        `Backend boundary: ${from} imports ${backend.file}, which is under the src of ${backend.name}. ` +
+          "The frontend reaches the backend only through its HTTP interface.",
+      );
+    },
+  };
+}
+
+/**
+ * Fail the build, a worker build and the dev server when a module of the
+ * frontend resolves to a file under the `src` of a backend package: the package
+ * that holds a module's layer, as the registry names it. The browser and the
+ * server renderer reach the backend only through its HTTP interface.
+ *
+ * The check reads what the whole resolution chain returns, so an alias, a
+ * symlink and an id marked external are all seen through. Vite builds workers
+ * with their own plugin list, so the plugin adds the check there too.
+ *
+ * @param {readonly string[]} backendPackages
+ * @returns {import("vite").Plugin}
+ */
+export function rejectBackendSources(backendPackages) {
+  const names = new Set(backendPackages);
+  return {
+    ...boundaryCheck(names),
+    config: () => ({ worker: { plugins: () => [boundaryCheck(names)] } }),
+  };
+}

package/templates/vue/client-chunking.mjs

@@ -18,6 +18,8 @@
  * quarter to four fifths, but every group is loaded whole by each page that
  * uses any of it, and the anonymous pages pay 70 to 115 KB of Brotli for code
  * only the signed-in shell uses.
+ *
+ * @type {import("vite").Rolldown.CodeSplittingOptions}
  */
 export const clientCodeSplitting = {
   groups: [{ name: "entry", tags: ["$initial"] }],

package/templates/vue/entry-weight.mjs

@@ -55,23 +55,27 @@ export function entryOwner(id, modules) {
  * their static imports, transitively, by file name.
  *
  * @param {import("vite").Rollup.OutputBundle} bundle
- * @returns {(import("vite").Rollup.OutputChunk | undefined)[]}
+ * @returns {import("vite").Rollup.OutputChunk[]}
  */
 function entryClosure(bundle) {
   const chunks = Object.values(bundle).filter(
+    /**
+     * @param {import("vite").Rollup.OutputChunk | import("vite").Rollup.OutputAsset} output
+     * @returns {output is import("vite").Rollup.OutputChunk}
+     */
     (output) => output.type === "chunk",
   );
   const byName = new Map(chunks.map((chunk) => [chunk.fileName, chunk]));
-  /** @type {Set<string>} */
-  const seen = new Set();
+  /** @type {Map<string, import("vite").Rollup.OutputChunk>} */
+  const seen = new Map();
   /** @param {import("vite").Rollup.OutputChunk | undefined} chunk */
   const visit = (chunk) => {
     if (!chunk || seen.has(chunk.fileName)) return;
-    seen.add(chunk.fileName);
+    seen.set(chunk.fileName, chunk);
     for (const file of chunk.imports ?? []) visit(byName.get(file));
   };
   for (const chunk of chunks) if (chunk.isEntry) visit(chunk);
-  return [...seen].map((file) => byName.get(file));
+  return [...seen.values()];
 }
 
 /**

package/templates/vue/frontend-build.ts

@@ -31,10 +31,11 @@ export interface DmsFrontendBuild {
 
   /**
    * Adds Vite plugins to the application's build, for `ajs dms dev`,
-   * `ajs dms build` and the preview alike.
+   * `ajs dms build` and the preview alike, and to the bundle of each web worker
+   * it starts with `new Worker(new URL(...))`.
    *
-   * `create` runs in the build process each time Vite loads its configuration,
-   * and returns real Vite plugin objects (an array, each with a `name`; false,
+   * `create` runs in the build process each time Vite loads its configuration
+   * and once more for each worker bundle, and returns real Vite plugin objects (an array, each with a `name`; false,
    * null and undefined entries are skipped and nested arrays flattened, as in a
    * Vite configuration) or nothing. It is synchronous: a Promise is refused,
    * because the configuration is built synchronously. The plugins come after

package/templates/vue/head-order.mjs

@@ -35,8 +35,9 @@ function deprioritize(html) {
 export function orderHeadForFirstPaint(html) {
   const prioritized = deprioritize(html);
   const stylesheet = prioritized.match(STYLESHEET);
-  const script = prioritized.match(SCRIPT);
-  if (!stylesheet || !script || stylesheet.index < script.index)
+  const stylesheetAt = prioritized.search(STYLESHEET);
+  const scriptAt = prioritized.search(SCRIPT);
+  if (!stylesheet || scriptAt < 0 || stylesheetAt < scriptAt)
     return prioritized;
   return prioritized
     .replace(STYLESHEET, "")

package/templates/vue/icon-api.mjs

@@ -9,6 +9,8 @@ export const ICON_API_PATH = "/api/_dms/icons/";
 /**
  * The `@iconify/vue` API provider serving every icon the client bundle lacks
  * from `origin`, instead of `api.iconify.design` and its fallbacks.
+ *
+ * @param {string} origin
  */
 export function sameOriginIconProvider(origin) {
   return { resources: [origin], path: ICON_API_PATH };

package/templates/vue/server/auth/backend.mjs

@@ -1,5 +1,5 @@
 import { REDIRECT_STATUSES } from "../proxy-redirects.mjs";
-import { isString } from "../type-guards.mjs";
+import { isObjectLike, isString } from "../type-guards.mjs";
 import { clientCountryHeader, clientIp, clientIpHeader } from "./client-ip.mjs";
 
 /**
@@ -39,7 +39,7 @@ export const GENERIC_ERROR_MESSAGE = "error.500.description";
  */
 export function publicBackendMessage(data) {
   /** @type {unknown} */
-  const message = isString(data) ? data : data?.message;
+  const message = isObjectLike(data) ? data.message : data;
   return isString(message) && PUBLIC_AUTH_MESSAGE.test(message)
     ? message
     : undefined;
@@ -59,7 +59,7 @@ export function relayedHeaders(request, names) {
     ...clientCountryHeader(request),
     ...Object.fromEntries(
       names.flatMap((name) =>
-        request.headers[name] ? [[name, request.headers[name]]] : [],
+        request.headers[name] ? [[name, String(request.headers[name])]] : [],
       ),
     ),
   };
@@ -86,7 +86,7 @@ export function relayedHeaders(request, names) {
  *   is not JSON
  */
 export async function backend(path, request, options = {}) {
-  /** @type {Record<string, string | string[]>} */
+  /** @type {Record<string, string>} */
   const headers = Object.fromEntries(
     Object.entries(options.headers ?? {}).map(([name, value]) => [
       name.toLowerCase(),

package/templates/vue/server/auth/establish-endpoints.mjs

@@ -71,8 +71,8 @@ export function allowedEstablishEndpoints(
     .map((entry) => entry.trim());
   return [
     ...new Set(
-      [...declared, ...fromEnvironment].filter(
-        (entry) => isString(entry) && BACKEND_API_PATH.test(entry),
+      [...declared, ...fromEnvironment].flatMap((entry) =>
+        isString(entry) && BACKEND_API_PATH.test(entry) ? [entry] : [],
       ),
     ),
   ];

package/templates/vue/server/auth/session.mjs

@@ -96,7 +96,10 @@ function decode(value) {
     );
     decipher.setAuthTag(payload.subarray(12, 28));
     return JSON.parse(
-      Buffer.concat([decipher.update(payload.subarray(28)), decipher.final()]),
+      Buffer.concat([
+        decipher.update(payload.subarray(28)),
+        decipher.final(),
+      ]).toString(),
     );
   } catch {
     return undefined;
@@ -150,7 +153,7 @@ function appendCookie(response, name, value, cookieAttributes) {
   response.setHeader(
     "set-cookie",
     current
-      ? [cookie, ...(Array.isArray(current) ? current : [current])]
+      ? [cookie, ...(Array.isArray(current) ? current : [String(current)])]
       : cookie,
   );
 }

package/templates/vue/server/auth-declarations.mjs

@@ -0,0 +1,46 @@
+import { authRejection } from "./auth-hooks.mjs";
+import { compilePathPattern } from "./path-patterns.mjs";
+
+/**
+ * @import { AuthProvider, DeclaredModule } from "./module-route-types.mjs"
+ */
+
+/**
+ * The auth hooks: those of the highest-priority module that registers them.
+ * A module registering them twice, or after another one, is reported.
+ *
+ * @param {DeclaredModule[]} modules
+ * @param {(message: string) => void} warn
+ */
+export function resolveAuth(modules, warn) {
+  /** @type {AuthProvider | undefined} */
+  let provider;
+  for (const module of modules) {
+    for (const auth of module.declared.auth) {
+      const reason = authRejection(auth);
+      if (reason) {
+        warn(
+          `Frontend module ${module.id} registers auth hooks, which are ignored: ${reason}.`,
+        );
+        continue;
+      }
+      if (provider) {
+        warn(
+          `Frontend module ${module.id} registers auth hooks, which are ignored: ${provider.id} (priority ${provider.priority ?? 0}) provides them.`,
+        );
+        continue;
+      }
+      provider = {
+        id: module.id,
+        priority: module.priority ?? 0,
+        signInPath: auth.signInPath,
+        signInExempt: auth.signInExempt?.flatMap(
+          (pattern) => compilePathPattern(pattern) ?? [],
+        ),
+        refreshSession: auth.refreshSession?.bind(auth),
+        publicSession: auth.publicSession?.bind(auth),
+      };
+    }
+  }
+  return provider;
+}