@antelopejs/dms-frontend 0.10.0 → 0.10.2

package/templates/vue/server/auth-hooks.mjs

@@ -1,6 +1,7 @@
 import { readSession, setRequestSession } from "./auth/session.mjs";
 import { createServerEvent } from "./module-event.mjs";
-import { compilePathPattern } from "./path-patterns.mjs";
+import { compilePathPattern, PATH_PATTERN_FORMS } from "./path-patterns.mjs";
+import { isFunction, isRecord, isString } from "./type-guards.mjs";
 
 const DEFAULT_SIGN_IN_PATH = "/auth";
 const DEFAULT_ONBOARDING_PATH = "/onboarding";
@@ -17,7 +18,44 @@ const HOOK_ROUTE = Object.freeze({ bodyLimit: 0 });
  */
 function defaultExempt(signInPath) {
   const signIn = signInPath === "/" ? "/" : `${signInPath}/**`;
-  return [signIn, DEFAULT_ONBOARDING_PATH].map(compilePathPattern);
+  return [signIn, DEFAULT_ONBOARDING_PATH].flatMap(
+    (pattern) => compilePathPattern(pattern) ?? [],
+  );
+}
+
+const AUTH_HOOKS = ["refreshSession", "publicSession"];
+
+/**
+ * Why an auth hooks registration is ignored, or `undefined`.
+ *
+ * @param {unknown} auth
+ */
+export function authRejection(auth) {
+  if (!isRecord(auth)) return "it is not an object";
+  for (const hook of AUTH_HOOKS)
+    if (auth[hook] !== undefined && !isFunction(auth[hook]))
+      return `${hook} is not a function`;
+  if (
+    auth.signInPath !== undefined &&
+    (!isString(auth.signInPath) ||
+      !compilePathPattern(auth.signInPath) ||
+      auth.signInPath.includes("*"))
+  )
+    return "signInPath is not a page path";
+  return exemptionRejection(auth.signInExempt);
+}
+
+/** @param {unknown} signInExempt */
+function exemptionRejection(signInExempt) {
+  if (signInExempt === undefined) return undefined;
+  if (!Array.isArray(signInExempt))
+    return `signInExempt is not a list of ${PATH_PATTERN_FORMS} patterns`;
+  for (const pattern of signInExempt)
+    if (!compilePathPattern(pattern))
+      return isString(pattern)
+        ? `signInExempt holds "${pattern}", which is not ${PATH_PATTERN_FORMS}`
+        : "signInExempt holds an entry that is not a string";
+  return undefined;
 }
 
 /**
@@ -72,7 +110,7 @@ export function serverAuth(provider, context) {
      * Renews the request's session after the backend refused it. Returns the
      * new session, which the rest of the request runs with, or `undefined`.
      *
-     * @param {import("node:http").IncomingMessage} request
+     * @param {import("./request-target.mjs").ServerRequest} request
      * @param {import("node:http").ServerResponse} response
      */
     async refresh(request, response) {

package/templates/vue/server/backend-proxies.mjs

@@ -1,5 +1,5 @@
-import { compilePathPattern } from "./path-patterns.mjs";
-import { isNonNullObject } from "./type-guards.mjs";
+import { compilePathPattern, PATH_PATTERN_FORMS } from "./path-patterns.mjs";
+import { isNonNullObject, isString } from "./type-guards.mjs";
 
 /** @typedef {import("../server-module.ts").DmsBackendProxyOptions} ProxyOptions */
 /**
@@ -53,12 +53,13 @@ function literalPrefix(pattern) {
 /**
  * Why a proxy declaration is ignored, or `undefined`.
  *
- * @param {string} pattern
+ * @param {string | undefined} pattern
  * @param {ProxyOptions | undefined} options
  */
 export function proxyRejection(pattern, options) {
   const compiled = compilePathPattern(pattern);
-  if (!compiled) return "the pattern is not /x, /x/* or /x/**";
+  if (!compiled || !isString(pattern))
+    return `the pattern is not ${PATH_PATTERN_FORMS}`;
   const prefix = literalPrefix(pattern);
   if (prefix === "/")
     return "its first segment is not literal: it would take every page";
@@ -81,15 +82,15 @@ export function proxyRejection(pattern, options) {
 }
 
 /**
- * @param {string} pattern A pattern `proxyRejection` accepted
+ * @param {import("./path-patterns.mjs").CompiledPathPattern} compiled A pattern `proxyRejection` accepted
  * @param {ProxyOptions | undefined} options
  * @param {string} owner Who declared it
  * @returns {BackendProxy}
  */
-function compileProxy(pattern, options, owner) {
+function compileProxy(compiled, options, owner) {
   return {
-    pattern: compilePathPattern(pattern),
-    path: pattern,
+    pattern: compiled,
+    path: compiled.pattern,
     owner,
     auth: options?.auth ?? DEFAULT_AUTH,
     maxBodyBytes: options?.maxBodyBytes,
@@ -122,15 +123,18 @@ export function resolveBackendProxies(declared, manifest, warn) {
    * @param {string} owner
    */
   const add = (pattern, options, owner) => {
-    const reason = proxyRejection(pattern, options);
+    const compiled = compilePathPattern(pattern);
     const current = kept.get(pattern);
-    if (reason || current) {
+    const reason =
+      proxyRejection(pattern, options) ??
+      (current && `${current.owner} declares it`);
+    if (!compiled || reason) {
       warn(
-        `${owner} declares the backend proxy "${pattern}", which is ignored: ${reason ?? `${current.owner} declares it`}.`,
+        `${owner} declares the backend proxy "${pattern}", which is ignored: ${reason}.`,
       );
       return;
     }
-    kept.set(pattern, compileProxy(pattern, options, owner));
+    kept.set(pattern, compileProxy(compiled, options, owner));
   };
   for (const { id, pattern, options } of declared)
     add(pattern, options, `Frontend module ${id}`);

package/templates/vue/server/backend-response.mjs

@@ -1,6 +1,6 @@
 import { GENERIC_ERROR_MESSAGE } from "./auth/backend.mjs";
 import { isFrontendVisit, redirectFrontendVisit } from "./inertia.mjs";
-import { isString } from "./type-guards.mjs";
+import { isObjectLike, isString } from "./type-guards.mjs";
 
 /**
  * What a JSON caller gets when the backend fails: the generic i18n key of
@@ -45,7 +45,7 @@ async function refusalCode(response) {
   try {
     /** @type {unknown} */
     const data = JSON.parse(text);
-    value = isString(data) ? data : data?.message;
+    value = isObjectLike(data) ? data.message : data;
   } catch {}
   return isString(value) && REFUSAL_CODE.test(value) ? value : undefined;
 }
@@ -67,7 +67,7 @@ export async function backendResponseError(response) {
  * qualifies: a refused destination sent to itself again would loop.
  *
  * @param {unknown} error What the request failed with
- * @param {import("node:http").IncomingMessage} request
+ * @param {import("./request-target.mjs").ServerRequest} request
  * @param {import("node:http").ServerResponse} response
  * @param {() => Promise<typeof import("../ssr-renderer.ts")>} loadRenderer
  * @returns {Promise<boolean>} Whether the visit was redirected

package/templates/vue/server/cli-report.mjs

@@ -13,7 +13,11 @@ const WILDCARD_ADDRESSES = ["0.0.0.0", "::"];
  */
 async function report(message, line, write) {
   if (!process.send) return write(line);
-  await new Promise((sent) => process.send(message, () => sent()));
+  /** @type {Promise<void>} */
+  const sent = new Promise((resolve) =>
+    process.send?.(message, () => resolve()),
+  );
+  await sent;
 }
 
 /**
@@ -40,6 +44,23 @@ export async function reportReady(address, port) {
   );
 }
 
+/** The `ANTELOPEJS_QUIET` values that leave a run verbose, as `@antelopejs/core` reads them. */
+const DISABLED_FLAG_VALUES = ["0", "false"];
+
+/**
+ * Prints the routing summary, unless the run is quiet: `-q` given to `ajs` or
+ * `ajs dms` reaches the server as `ANTELOPEJS_QUIET`, and a quiet ready server
+ * prints only its `Local` url.
+ *
+ * @param {readonly string[]} lines What `routingReport` returned
+ * @param {NodeJS.ProcessEnv} [env]
+ */
+export function reportRouting(lines, env = process.env) {
+  const quiet = env.ANTELOPEJS_QUIET;
+  if (quiet && !DISABLED_FLAG_VALUES.includes(quiet.toLowerCase())) return;
+  for (const line of lines) console.log(line);
+}
+
 /**
  * The server cannot listen: a port taken by another process, an address this
  * host does not have. Reported instead of Node's unhandled-error dump, then

package/templates/vue/server/client-error.mjs

@@ -11,6 +11,7 @@ const HEADER_OVERFLOW_HINT_INTERVAL_MS = 60_000;
 
 let lastHeaderOverflowHint = -Infinity;
 
+/** @param {number} maxHeaderSize */
 function warnHeaderOverflow(maxHeaderSize) {
   const now = Date.now();
   if (now - lastHeaderOverflowHint < HEADER_OVERFLOW_HINT_INTERVAL_MS) return;
@@ -32,6 +33,10 @@ function warnHeaderOverflow(maxHeaderSize) {
  *
  * Once a response went out on this connection, a status line would land in the
  * middle of it.
+ *
+ * @param {NodeJS.ErrnoException} error
+ * @param {import("node:stream").Duplex & { bytesWritten?: number }} socket
+ * @param {number} maxHeaderSize
  */
 export function handleClientError(error, socket, maxHeaderSize) {
   let response = BAD_REQUEST_RESPONSE;

package/templates/vue/server/content.mjs

@@ -11,17 +11,14 @@ export const MINIMUM_COMPRESSION_BYTES = 1_024;
 const DYNAMIC_BROTLI_QUALITY = 4;
 
 /**
- * A compressor for a body generated or relayed now, in the encoding the client
- * accepts (Brotli first), or `undefined` when it accepts neither. `streaming`
- * flushes what each write gives at once, for a body written over time: the
- * client gets each part when it is written, not when a block fills.
- *
- * Implicit identity is a fallback, not a preference over compression.
+ * The codings among `br` and `gzip` the client accepts, most wanted first
+ * (Brotli on a tie). Empty when it accepts neither, or ranks identity above
+ * both: implicit identity is a fallback, not a preference over compression.
  *
  * @param {import("node:http").IncomingMessage} request
- * @param {{ streaming?: boolean }} [options]
+ * @returns {("br" | "gzip")[]}
  */
-export function acceptedEncoder(request, { streaming = false } = {}) {
+export function acceptedCodings(request) {
   const accepted = request.headers["accept-encoding"] ?? "";
   /** @type {Map<string, number>} */
   const qualities = new Map();
@@ -46,8 +43,24 @@ export function acceptedEncoder(request, { streaming = false } = {}) {
   const br = quality("br");
   const gzip = quality("gzip");
   const identity = qualities.get("identity") ?? 0;
-  if (identity > Math.max(br, gzip)) return undefined;
-  if (br > 0 && br >= gzip)
+  if (identity > Math.max(br, gzip)) return [];
+  /** @type {("br" | "gzip")[]} */
+  const ranked = gzip > br ? ["gzip", "br"] : ["br", "gzip"];
+  return ranked.filter((coding) => quality(coding) > 0);
+}
+
+/**
+ * A compressor for a body generated or relayed now, in the encoding the client
+ * wants most (see `acceptedCodings`), or `undefined` when it accepts neither.
+ * `streaming` flushes what each write gives at once, for a body written over
+ * time: the client gets each part when it is written, not when a block fills.
+ *
+ * @param {import("node:http").IncomingMessage} request
+ * @param {{ streaming?: boolean }} [options]
+ */
+export function acceptedEncoder(request, { streaming = false } = {}) {
+  const [coding] = acceptedCodings(request);
+  if (coding === "br")
     return {
       encoding: "br",
       stream: createBrotliCompress({
@@ -57,7 +70,7 @@ export function acceptedEncoder(request, { streaming = false } = {}) {
         },
       }),
     };
-  if (gzip > 0)
+  if (coding === "gzip")
     return {
       encoding: "gzip",
       stream: createGzip(

package/templates/vue/server/email-bundle-watch.mjs

@@ -1,13 +1,15 @@
 import { fileURLToPath } from "node:url";
 import { build } from "vite";
+import { isObjectLike } from "./type-guards.mjs";
 
 const PROJECT_ROOT = fileURLToPath(new URL("..", import.meta.url));
 
 process.on("disconnect", () => process.exit(0));
 
+/** @type {(() => void) | undefined} */
 let startBuild;
 process.on("message", (message) => {
-  if (message?.state !== "build") return;
+  if (!isObjectLike(message) || message.state !== "build") return;
   startBuild?.();
   startBuild = undefined;
 });
@@ -17,10 +19,12 @@ const serverHandoff = {
   name: "dms-email-bundle-handoff",
   buildStart() {
     if (!process.send) return;
-    return new Promise((start) => {
+    /** @type {Promise<void>} */
+    const held = new Promise((start) => {
       startBuild = start;
-      process.send({ state: "building" });
+      process.send?.({ state: "building" });
     });
+    return held;
   },
 };
 
@@ -34,6 +38,8 @@ const watcher = await build({
   build: { watch: {} },
 });
 
+if (!("on" in watcher))
+  throw new TypeError("The email bundle build did not start a watcher");
 watcher.on("event", (event) => {
   if (event.code === "END") process.send?.({ state: "ready" });
   else if (event.code === "ERROR") process.send?.({ state: "failed" });

package/templates/vue/server/email.mjs

@@ -1,6 +1,7 @@
 import { fork } from "node:child_process";
 import { constants, setPriority } from "node:os";
 import { fileURLToPath } from "node:url";
+import { isObjectLike } from "./type-guards.mjs";
 
 const EMAIL_RENDERER_URL = new URL(
   "../dist/server/email-renderer.js",
@@ -75,10 +76,11 @@ export function watchEmailBundle() {
     cwd: fileURLToPath(new URL("..", import.meta.url)),
   });
   try {
-    setPriority(builder.pid, constants.priority.PRIORITY_BELOW_NORMAL);
+    if (builder.pid !== undefined)
+      setPriority(builder.pid, constants.priority.PRIORITY_BELOW_NORMAL);
   } catch {}
   builder.on("message", (message) => {
-    if (message?.state !== "building") {
+    if (!isObjectLike(message) || message.state !== "building") {
       emailBuildSettled();
       return;
     }
@@ -115,7 +117,7 @@ async function waitForEmailBuild() {
 /** @returns {Promise<typeof import("../email-renderer.ts")>} */
 function loadEmailRenderer() {
   const url = new URL(EMAIL_RENDERER_URL);
-  if (emailBundleVersion) url.searchParams.set("v", emailBundleVersion);
+  if (emailBundleVersion) url.searchParams.set("v", String(emailBundleVersion));
   return import(url.href);
 }
 

package/templates/vue/server/generated-files.mjs

@@ -115,6 +115,14 @@ function isManifestChunk(value) {
   );
 }
 
+/**
+ * @param {unknown} value
+ * @returns {value is import("vite").Manifest}
+ */
+function isManifest(value) {
+  return isPlainRecord(value) && Object.values(value).every(isManifestChunk);
+}
+
 /**
  * The manifest `vite build` wrote to `dist/client/.vite/manifest.json`.
  *
@@ -123,7 +131,7 @@ function isManifestChunk(value) {
  * @throws {Error} When it is not an object of chunks
  */
 export function viteManifestOf(content) {
-  if (!isPlainRecord(content) || !Object.values(content).every(isManifestChunk))
+  if (!isManifest(content))
     throw new Error("the client manifest is not an object of Vite chunks");
   return content;
 }
@@ -132,8 +140,12 @@ export function viteManifestOf(content) {
  * The members of an Iconify collection that `iconCollectionOf` checks, the
  * ones an icon query and a server render read.
  *
+ * @typedef {Parameters<typeof import("@iconify/utils").getIcons>[0]} Iconify
+ */
+
+/**
  * @typedef {Pick<
- *   Parameters<typeof import("@iconify/utils").getIcons>[0],
+ *   Iconify,
  *   | "prefix"
  *   | "icons"
  *   | "aliases"
@@ -142,10 +154,8 @@ export function viteManifestOf(content) {
  *   | "top"
  *   | "width"
  *   | "height"
- *   | "rotate"
- *   | "hFlip"
- *   | "vFlip"
- * >} IconCollection
+ * > &
+ *   Pick<Iconify["icons"][string], "rotate" | "hFlip" | "vFlip">} IconCollection
  */
 
 /**

package/templates/vue/server/icons.mjs

@@ -104,12 +104,12 @@ async function loadCollection(root, prefix) {
  */
 function collection(root, prefix) {
   const key = join(root, prefix);
-  if (!collections.has(key)) {
-    const loading = loadCollection(root, prefix);
-    loading.catch(() => collections.delete(key));
-    collections.set(key, loading);
-  }
-  return collections.get(key);
+  const cached = collections.get(key);
+  if (cached) return cached;
+  const loading = loadCollection(root, prefix);
+  loading.catch(() => collections.delete(key));
+  collections.set(key, loading);
+  return loading;
 }
 
 /**
@@ -128,7 +128,7 @@ export async function installedCollections(root) {
       .filter((prefix) => ICON_NAME.test(prefix))
       .map((prefix) => collection(root, prefix)),
   );
-  return loaded.filter(Boolean);
+  return loaded.filter((loadedCollection) => loadedCollection !== undefined);
 }
 
 /**
@@ -193,13 +193,17 @@ function requestedIcons(url) {
 }
 
 /**
- * Whether the generated server answers `pathname` with `iconResponse`.
+ * Whether the generated server answers `pathname` with `iconResponse`: the
+ * icon endpoint, with or without its trailing slash, and every path under it.
  *
  * @param {string} pathname
  * @returns {boolean}
  */
 export function isIconRequest(pathname) {
-  return pathname.startsWith(ICON_API_PATH);
+  return (
+    pathname === ICON_API_PATH.slice(0, -1) ||
+    pathname.startsWith(ICON_API_PATH)
+  );
 }
 
 /**
@@ -214,7 +218,7 @@ export function isIconRequest(pathname) {
  * @returns {Promise<IconAnswer>}
  */
 export async function iconResponse(root, method, url) {
-  if (!READ_METHODS.has(method)) {
+  if (method === undefined || !READ_METHODS.has(method)) {
     const response = errorResponse(405, "Method not allowed");
     response.headers.allow = [...READ_METHODS].join(", ");
     return response;
@@ -234,7 +238,7 @@ export async function iconResponse(root, method, url) {
  * Serve an Iconify API query from the collections installed in the workspace,
  * the same way under `ajs dms dev` and `ajs dms start`: both run this server.
  *
- * @param {import("node:http").IncomingMessage} request
+ * @param {import("./request-target.mjs").ServerRequest} request
  * @param {import("node:http").ServerResponse} response
  */
 export async function handleIcons(request, response) {

package/templates/vue/server/in-place-render.mjs

@@ -44,7 +44,7 @@ function reusableReadKey(path, options, headers) {
  * A read returns a copy: the render that read it may still change the object it
  * got. A body that cannot be copied is read again.
  *
- * @param {() => HeadersInit} backendHeaders
+ * @param {() => ConstructorParameters<typeof Headers>[0]} backendHeaders
  * @returns {ServerReads}
  */
 export function serverReads(backendHeaders) {
@@ -90,7 +90,7 @@ export function serverReads(backendHeaders) {
  * same path. Any other redirect keeps its own response.
  *
  * @param {import("node:http").IncomingMessage} request
- * @param {string | undefined} from
+ * @param {string} from
  * @param {string} location
  * @returns {boolean}
  */
@@ -114,7 +114,7 @@ function rendersInPlace(request, from, location) {
  * A page that completes its query as it renders is rendered at that query in
  * the same request, rather than answered with a redirect.
  *
- * @template {{ url: string | undefined, props: unknown }} Page
+ * @template {{ url: string, props: unknown }} Page
  * @template {{ redirect?: string }} Rendered
  * @param {import("node:http").IncomingMessage} request
  * @param {Page} page

package/templates/vue/server/inertia.mjs

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
+import { isObjectLike, isString } from "./type-guards.mjs";
 
 const CLIENT_MANIFEST_PATH = fileURLToPath(
   new URL("../dist/client/.vite/manifest.json", import.meta.url),
@@ -53,14 +54,26 @@ export const DMS_PAGE_COMPONENT = "DmsDynamicPage";
  * @typedef {{
  *   component: string,
  *   props: Record<string, unknown>,
- *   url: string | undefined,
+ *   url: string,
  *   version: string,
  *   onceProps?: OnceProps
  * }} InertiaPage
  */
 
 /**
- * @param {string | undefined} url
+ * Whether the page has the props the server render needs: the path and the
+ * page the backend described. A full visit carries both; the page payload is
+ * the backend's JSON, read as the renderer reads it.
+ *
+ * @param {InertiaPage} page
+ * @returns {page is InertiaPage & import("../ssr-renderer.ts").DmsSsrPage}
+ */
+export function isSsrPage(page) {
+  return isString(page.props.path) && isObjectLike(page.props.page);
+}
+
+/**
+ * @param {string} url
  * @param {Record<string, unknown> | undefined} props
  * @param {string} [version]
  * @param {OnceProps} [onceProps]
@@ -72,6 +85,7 @@ export function createInertiaPage(
   version = assetVersion(),
   onceProps,
 ) {
+  /** @type {InertiaPage} */
   const page = {
     component: DMS_PAGE_COMPONENT,
     props: { ...props, errors: props?.errors ?? {} },
@@ -180,7 +194,7 @@ export function isFrontendVisit(request) {
   if (request.method !== "GET") return false;
   return (
     Boolean(request.headers["x-inertia"]) ||
-    request.headers.accept?.includes("text/html")
+    request.headers.accept?.includes("text/html") === true
   );
 }
 

package/templates/vue/server/module-event.mjs

@@ -25,13 +25,15 @@ import {
 import { backendUrl } from "./request-target.mjs";
 import {
   isFunction,
-  isNonNullObject,
   isNumber,
+  isObjectLike,
+  isRecord,
   isString,
 } from "./type-guards.mjs";
 import { pipeWebBody } from "./web-body.mjs";
 
 /** @typedef {import("node:http").IncomingMessage} IncomingMessage */
+/** @typedef {import("./request-target.mjs").ServerRequest} ServerRequest */
 /** @typedef {import("node:http").ServerResponse} ServerResponse */
 /** @typedef {import("../server-module.ts").DmsServerEvent} ServerEvent */
 /** @typedef {import("../server-module.ts").DmsSession} Session */
@@ -40,7 +42,7 @@ import { pipeWebBody } from "./web-body.mjs";
  * What an event is made from.
  *
  * @typedef {object} EventContext
- * @property {IncomingMessage} request
+ * @property {ServerRequest} request
  * @property {ServerResponse} response
  * @property {Pick<import("./module-route-types.mjs").ServerRoute, "bodyLimit">} route
  * @property {Readonly<Record<string, string>>} params
@@ -97,7 +99,7 @@ function limitedBody(request, limit) {
 }
 
 /**
- * @param {IncomingMessage} request
+ * @param {ServerRequest} request
  * @param {EventContext["route"]} route
  */
 function webRequest(request, route) {
@@ -124,9 +126,13 @@ async function readJson(webRequestValue) {
   const chunks = [];
   const reader = webRequestValue.body.getReader();
   for (;;) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    chunks.push(value);
+    const read = await reader.read();
+    if (read.done) break;
+    /** @type {unknown} */
+    const chunk = read.value;
+    if (!(chunk instanceof Uint8Array))
+      throw new RequestBodyError(400, "Invalid request body");
+    chunks.push(chunk);
   }
   if (!chunks.length) return {};
   try {
@@ -237,8 +243,16 @@ function frozenCopy(value) {
  */
 export function createServerEvent(context) {
   const { request, response, route, params } = context;
-  const event = {
-    request: webRequest(request, route),
+  const webRequestValue = webRequest(request, route);
+  // SAFETY: `server-module.ts` lets a handler name the JSON shape it expects from the backend and from the client, as `Response.json()` does; the server parses that JSON and hands it on unchecked, which these two members are the only place to state.
+  const parsedJson = /** @type {Pick<ServerEvent, "backend" | "readJson">} */ ({
+    backend: (/** @type {string} */ path, init = {}) =>
+      backend(path, request, init),
+    readJson: () => readJson(webRequestValue),
+  });
+  return {
+    ...parsedJson,
+    request: webRequestValue,
     params: Object.freeze({ ...params }),
     session: sessionAccess(request, response, context.view),
     cookies: cookieAccess(
@@ -247,8 +261,6 @@ export function createServerEvent(context) {
       context.module.id,
       context.authOwner,
     ),
-    backend: (/** @type {string} */ path, init = {}) =>
-      backend(path, request, init),
     backendUrl: (/** @type {string} */ path) => backendUrl(path),
     clientIp: () => clientIp(request),
     module: Object.freeze({
@@ -266,19 +278,18 @@ export function createServerEvent(context) {
         ...(context.app?.authEstablishEndpoints ?? []),
       ]),
     }),
+    url: new URL(webRequestValue.url),
   };
-  event.url = new URL(event.request.url);
-  event.readJson = () => readJson(event.request);
-  return event;
 }
 
 /** @param {unknown} value */
 function isResponse(value) {
   return (
     value instanceof Response ||
-    (isNonNullObject(value) &&
+    (isRecord(value) &&
       isNumber(value.status) &&
-      isFunction(value.headers?.get) &&
+      isObjectLike(value.headers) &&
+      isFunction(value.headers.get) &&
       "body" in value)
   );
 }
@@ -304,7 +315,7 @@ function asResponse(result) {
  * on the frontend's origin when the frontend proxies its path, no cookie of
  * another site its fetch reached.
  *
- * @param {IncomingMessage} request
+ * @param {ServerRequest} request
  * @param {ServerResponse} response
  * @param {unknown} result
  * @param {(path: string) => boolean} isProxiedPath
@@ -313,6 +324,7 @@ async function writeServerResponse(request, response, result, isProxiedPath) {
   const answer = asResponse(result);
   const cookies = [response.getHeader("set-cookie") ?? []]
     .flat()
+    .map(String)
     .concat(relayableCookies(answer));
   answer.headers.forEach((value, name) => {
     if (name === "set-cookie") return;

package/templates/vue/server/module-route-types.mjs

@@ -2,8 +2,8 @@ export {};
 
 /** @typedef {import("../server-module.ts").DmsServerMethod} ServerMethod */
 /**
- * What `registerAuth` declared. The hooks are read as plain functions, as the
- * server calls them.
+ * What `registerAuth` declared. The server binds each hook to the declared
+ * object, so a hook may use `this`.
  *
  * @typedef {object} AuthDeclaration
  * @property {string} [signInPath]