@antelopejs/dms-frontend 0.3.0 → 0.3.2

package/README.md

@@ -112,6 +112,8 @@ An email entry exports `serverEmailTemplates` and may export a plain `appConfig`
 
 Email builds ship complete merged translation catalogs as JSON under `dist/server/locales/`, separate from executable JavaScript. Deploy the entire `dist/server` directory. Each render loads only its requested language and the English fallback; arbitrary translation keys and module overrides remain available. Unknown languages fall back to English, while missing or corrupt files for a supported language fail rendering rather than silently dropping translations. The source harness keeps the 256 KiB JavaScript ceiling and reports locale-data bytes separately.
 
+`ajs-dms dev` builds the email bundle too, once the dev server is ready, and rebuilds it whenever an email template changes. The build runs in a separate low-priority process, so page reloads and HMR never wait on it; a render requested while a build is running waits for that build to finish.
+
 ## Frontend modules
 
 A materialized module opts into the Vue adapter with a root `dms.frontend.ts`:
@@ -133,6 +135,19 @@ export default frontendModule;
 
 The SDK also exposes `use` for Vue plugins. Entries execute by descending manifest priority, then stable module id. Modules without `dms.frontend.ts` are skipped by the generated loader. Registered page keys match a route's `fullSlug`, request path, or `default`; unregistered pages and components use the generic card renderer.
 
+### Redirecting typed access refusals
+
+A backend can refuse a whole surface with a typed 403 whose body is a machine-readable code, such as a tenant access gate blocking a suspended workspace. A module that owns such a code registers where a refused page visit goes instead of the error page:
+
+```ts
+sdk.registerAccessRedirect(
+  "saas.errors.workspace.access_blocked",
+  "/workspace-suspended",
+);
+```
+
+The server answers the refused visit, document or Inertia, with a redirect to that path before anything renders, so a reload lands there directly. The body may be the bare code or JSON (`"code"` or `{ "message": "code" }`). A destination refused in turn keeps the error page instead of looping. The first registration of a code wins, in manifest-priority order.
+
 ### Components rendered inside `<svg>`
 
 Modules usually register their components lazily, with `defineAsyncComponent`, and the page is rendered under a `<Suspense>`. Vue mounts an async component that resolves under a `<Suspense>` with the `<Suspense>`'s element namespace rather than the namespace of the place it is rendered: a component resolved by name (`resolveComponent` or a template tag) whose root is an SVG element (`<path>`, `<g>`, …) is created as an HTML element inside the `<svg>`, and the browser draws nothing ([vuejs/core#15639](https://github.com/vuejs/core/issues/15639)). Import such components directly instead, for example the node and edge types passed to Vue Flow:
@@ -304,6 +319,11 @@ the matching Inertia page object to the browser for hydration. Subsequent
 plugins and `DmsClientOnly` defer browser-only work while the same generated
 frontend-module registry drives server and client entries.
 
+Under `ajs dms dev`, an edit to a module's `i18n/locales/*.json` regenerates the
+merged catalogs the application imports: the next server render uses them, and
+the open page applies them in place, without a reload. Adding or removing a
+locale reloads the page instead.
+
 ## Options
 
 | Option | Environment | Purpose |
@@ -316,11 +336,15 @@ frontend-module registry drives server and client entries.
 | | `DMS_COOKIE_SECURE` | Secure cookies (`true` by default; `ajs dms dev` defaults to `false`) |
 | | `DMS_TRUSTED_PROXY_HOPS` | Number of trusted, rightmost reverse-proxy hops (default `0`) |
 | | `DMS_SESSION_SECRET` | Session cookie encryption key, 32 characters or more (required for login) |
+| | `DMS_HTML_RENDER_SECRET` | Secret that verifies the backend's signed HTML/email render requests; without it, e-mail renders are refused. Defaults to the `htmlRender.serviceSecret` the backend publishes in the frontend manifest |
+| | `DMS_OAUTH_RELAY_SECRET` | Secret the server presents to the backend's OAuth endpoints; without it, the backend refuses OAuth sign-in. Defaults to the `oauth.relaySecret` the backend publishes in the frontend manifest |
 | | `DMS_AUTH_ESTABLISH_ENDPOINTS` | Extra backend endpoints `/auth/establish` may open a session from, on top of those the backend's modules declare (comma-separated, empty by default) |
 | | `DMS_CLIENT_BASE_URL` | Public frontend URL used in generated links and emails |
 
 All of these can be set in the project's `.env` instead of the environment; see [Configuration](#configuration).
 
+`ajs dms dev` takes the two manifest secrets from the manifest it fetches, and `ajs dms start` from the manifest cached by `ajs dms build`. An explicitly set variable always wins over the manifest value. Before the server starts, both commands log where each secret comes from (`env`, `manifest`, `build-time manifest` or `not set`), never its value. When several modules publish the same secret, the first one in manifest-priority order wins, and a module publishing a different value is named in a warning.
+
 Use pnpm for all repository and workspace operations.
 
 ## Verify local frontend modules

package/dist/commands/dev.js

@@ -66,7 +66,7 @@ function cmdDev() {
         const spinner = new cli_ui_1.Spinner("Setting up workspace...");
         await spinner.start();
         try {
-            const { workspaceDir, layers, manifestFromCache, manifestFetchedAt } = await (0, common_1.setupWorkspace)({
+            const { workspaceDir, layers, manifestFromCache, manifestFetchedAt, manifestSecrets, } = await (0, common_1.setupWorkspace)({
                 backendUrl,
                 force: !!options.force,
                 mode: "dev",
@@ -90,6 +90,8 @@ function cmdDev() {
             console.log(chalk_1.default.dim(`  Workspace: ${workspaceDir}`));
             console.log(chalk_1.default.dim(`  Backend:   ${backendUrl}`));
             console.log(chalk_1.default.dim(`  Watching:  ${layers.length} layer source tree(s)`));
+            const secrets = (0, common_1.resolveManifestSecrets)(manifestSecrets);
+            (0, common_1.reportManifestSecrets)(secrets);
             console.log("");
             const nodeModulesDir = (0, node_path_1.join)(workspaceDir, "node_modules");
             await reserved.release();
@@ -103,6 +105,7 @@ function cmdDev() {
                     DMS_API_BASE_URL: backendUrl,
                     DMS_BOOTSTRAP_SECRET: bootstrapSecret,
                     DMS_SESSION_SECRET: sessionSecret,
+                    ...secrets.env,
                     NODE_OPTIONS: "--max-old-space-size=4096",
                     NODE_PATH: nodeModulesDir,
                 },

package/dist/commands/start.js

@@ -35,6 +35,8 @@ function cmdStart() {
         console.log("");
         (0, cli_ui_1.info)(`Starting production server on port ${chalk_1.default.cyan(options.port)}...`);
         console.log(chalk_1.default.dim(`  Workspace: ${workspaceDir}`));
+        const secrets = (0, common_1.resolveManifestSecrets)((0, common_1.collectManifestSecrets)((0, common_1.readCachedManifest)(workspaceDir)?.manifest.modules ?? []));
+        (0, common_1.reportManifestSecrets)(secrets, "build-time manifest");
         console.log("");
         const code = await (0, common_1.runCommand)("node", [serverPath], {
             cwd: workspaceDir,
@@ -43,6 +45,7 @@ function cmdStart() {
                 PORT: options.port,
                 DMS_API_BASE_URL: options.backendUrl,
                 DMS_SESSION_SECRET: sessionSecret,
+                ...secrets.env,
                 DMS_COOKIE_SECURE: process.env.DMS_COOKIE_SECURE ?? "true",
             },
         });

package/dist/common.d.ts

@@ -3,6 +3,7 @@ export * from "./layers";
 export * from "./layer-aliases";
 export * from "./manifest";
 export * from "./fs-sync";
+export * from "./manifest-secrets";
 export * from "./layer-watch";
 export * from "./materialize";
 export * from "./workspace";

package/dist/common.js

@@ -19,6 +19,7 @@ __exportStar(require("./layers"), exports);
 __exportStar(require("./layer-aliases"), exports);
 __exportStar(require("./manifest"), exports);
 __exportStar(require("./fs-sync"), exports);
+__exportStar(require("./manifest-secrets"), exports);
 __exportStar(require("./layer-watch"), exports);
 __exportStar(require("./materialize"), exports);
 __exportStar(require("./workspace"), exports);

package/dist/config.js

@@ -35,6 +35,7 @@ exports.TEMPLATE_FILES = [
     ["index.html", "index.html"],
     ["main.ts", "main.ts"],
     ["app-runtime.ts", "app-runtime.ts"],
+    ["network-error.ts", "network-error.ts"],
     ["ssr-renderer.ts", "ssr-renderer.ts"],
     ["frontend-module.ts", "frontend-module.ts"],
     ["globals.d.ts", "globals.d.ts"],

package/dist/layer-watch.js

@@ -8,9 +8,11 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const chokidar_1 = __importDefault(require("chokidar"));
 const layers_1 = require("./layers");
+const materialize_1 = require("./materialize");
 const fs_sync_1 = require("./fs-sync");
 const WATCH_DEBOUNCE_MS = 80;
-function createLayerSync(src, dest) {
+const LOCALE_REFRESH_DEBOUNCE_MS = 100;
+function createLayerSync(src, dest, onFlushed) {
     const fileUpserts = new Set();
     const fileDeletes = new Set();
     const dirCreates = new Set();
@@ -25,6 +27,12 @@ function createLayerSync(src, dest) {
     };
     const flush = () => {
         timer = null;
+        const touched = [
+            ...dirCreates,
+            ...fileUpserts,
+            ...fileDeletes,
+            ...dirDeletes,
+        ];
         for (const rel of [...dirCreates].sort((a, b) => a.length - b.length)) {
             try {
                 (0, node_fs_1.mkdirSync)((0, node_path_1.join)(dest, rel), { recursive: true });
@@ -78,6 +86,7 @@ function createLayerSync(src, dest) {
             }
         }
         dirDeletes.clear();
+        onFlushed(touched);
     };
     const arm = () => {
         if (timer)
@@ -124,15 +133,45 @@ function createLayerSync(src, dest) {
         },
     };
 }
+function createLocaleRefresher(workspaceDir, layers) {
+    const registry = (0, materialize_1.createFrontendModuleRegistry)(workspaceDir, layers);
+    let timer = null;
+    const refresh = () => {
+        timer = null;
+        try {
+            (0, materialize_1.writeLocaleMessages)(workspaceDir, registry);
+        }
+        catch (err) {
+            console.warn("[ajs-dms] locale catalogs not regenerated:", err);
+        }
+    };
+    return {
+        schedule() {
+            if (timer)
+                clearTimeout(timer);
+            timer = setTimeout(refresh, LOCALE_REFRESH_DEBOUNCE_MS);
+        },
+        flushNow() {
+            if (!timer)
+                return;
+            clearTimeout(timer);
+            refresh();
+        },
+    };
+}
 function startLayerWatchers(workspaceDir, layers) {
     const watchers = [];
     const syncs = [];
+    const localeRefresher = createLocaleRefresher(workspaceDir, layers);
     for (const layer of layers) {
         if (!layer.packageName)
             continue;
         const dest = (0, layers_1.getLayerWorkspacePath)(workspaceDir, layer);
         const src = layer.path;
-        const sync = createLayerSync(src, dest);
+        const sync = createLayerSync(src, dest, (paths) => {
+            if (paths.some(materialize_1.affectsLocaleMessages))
+                localeRefresher.schedule();
+        });
         syncs.push(sync);
         const watcher = chokidar_1.default.watch(src, {
             ignoreInitial: true,
@@ -150,5 +189,6 @@ function startLayerWatchers(workspaceDir, layers) {
         await Promise.all(watchers.map((w) => w.close().catch(() => { })));
         for (const sync of syncs)
             sync.flushNow();
+        localeRefresher.flushNow();
     };
 }

package/dist/manifest-secrets.d.ts

@@ -0,0 +1,31 @@
+import type { ManifestModule } from "./workspace";
+export declare const MANIFEST_SECRET_ENV: {
+    readonly DMS_HTML_RENDER_SECRET: readonly ["htmlRender", "serviceSecret"];
+    readonly DMS_OAUTH_RELAY_SECRET: readonly ["oauth", "relaySecret"];
+};
+export type ManifestSecretName = keyof typeof MANIFEST_SECRET_ENV;
+interface PublishedSecret {
+    value: string;
+    module: string;
+}
+export interface ManifestSecretConflict {
+    name: ManifestSecretName;
+    used: string;
+    ignored: string[];
+}
+export interface ManifestSecrets {
+    published: Partial<Record<ManifestSecretName, PublishedSecret>>;
+    conflicts: ManifestSecretConflict[];
+}
+export type ManifestSecretSource = "env" | "manifest" | "not set";
+export interface ResolvedManifestSecrets {
+    env: Partial<Record<ManifestSecretName, string>>;
+    sources: Record<ManifestSecretName, ManifestSecretSource>;
+    conflicts: ManifestSecretConflict[];
+}
+export declare function collectManifestSecrets(modules: readonly ManifestModule[]): ManifestSecrets;
+export declare function resolveManifestSecrets(secrets: ManifestSecrets, env?: NodeJS.ProcessEnv): ResolvedManifestSecrets;
+export declare function formatSecretConflicts(conflicts: readonly ManifestSecretConflict[]): string[];
+export declare function formatSecretSources(sources: ResolvedManifestSecrets["sources"], manifestLabel?: string): string[];
+export declare function reportManifestSecrets(resolved: ResolvedManifestSecrets, manifestLabel?: string, log?: (line: string) => void): void;
+export {};

package/dist/manifest-secrets.js

@@ -0,0 +1,101 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MANIFEST_SECRET_ENV = void 0;
+exports.collectManifestSecrets = collectManifestSecrets;
+exports.resolveManifestSecrets = resolveManifestSecrets;
+exports.formatSecretConflicts = formatSecretConflicts;
+exports.formatSecretSources = formatSecretSources;
+exports.reportManifestSecrets = reportManifestSecrets;
+const chalk_1 = __importDefault(require("chalk"));
+exports.MANIFEST_SECRET_ENV = {
+    DMS_HTML_RENDER_SECRET: ["htmlRender", "serviceSecret"],
+    DMS_OAUTH_RELAY_SECRET: ["oauth", "relaySecret"],
+};
+const SECRET_NAMES = Object.keys(exports.MANIFEST_SECRET_ENV);
+const UNSET_CONSEQUENCE = {
+    DMS_HTML_RENDER_SECRET: "e-mail renders will be refused",
+    DMS_OAUTH_RELAY_SECRET: "OAuth sign-in will be refused by the backend",
+};
+function readPath(options, path) {
+    let value = options;
+    for (const key of path) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return undefined;
+        value = value[key];
+    }
+    return value;
+}
+function byPriority(modules) {
+    return [...modules].sort((a, b) => b.priority - a.priority);
+}
+function collectManifestSecrets(modules) {
+    const published = {};
+    const conflicts = [];
+    const ordered = byPriority(modules);
+    for (const name of SECRET_NAMES) {
+        const ignored = [];
+        for (const module of ordered) {
+            const value = readPath(module.privateOptions, exports.MANIFEST_SECRET_ENV[name]);
+            if (typeof value !== "string" || value === "")
+                continue;
+            const first = published[name];
+            if (!first)
+                published[name] = { value, module: module.name };
+            else if (first.value !== value)
+                ignored.push(module.name);
+        }
+        const used = published[name];
+        if (used && ignored.length)
+            conflicts.push({ name, used: used.module, ignored });
+    }
+    return { published, conflicts };
+}
+function resolveManifestSecrets(secrets, env = process.env) {
+    const resolved = {
+        env: {},
+        sources: {},
+        conflicts: [],
+    };
+    for (const name of SECRET_NAMES) {
+        const explicit = env[name];
+        const published = secrets.published[name];
+        if (explicit) {
+            resolved.env[name] = explicit;
+            resolved.sources[name] = "env";
+        }
+        else if (published) {
+            resolved.env[name] = published.value;
+            resolved.sources[name] = "manifest";
+        }
+        else {
+            resolved.sources[name] = "not set";
+        }
+    }
+    resolved.conflicts = secrets.conflicts.filter((conflict) => resolved.sources[conflict.name] === "manifest");
+    return resolved;
+}
+function formatSecretConflicts(conflicts) {
+    return conflicts.map(({ name, used, ignored }) => `${name}: ${ignored.join(", ")} publish${ignored.length === 1 ? "es" : ""} a different value than ${used}; using ${used}'s`);
+}
+function formatSecretSources(sources, manifestLabel = "manifest") {
+    const width = Math.max(...SECRET_NAMES.map((name) => name.length));
+    return SECRET_NAMES.map((name) => {
+        const source = sources[name];
+        const label = source === "manifest"
+            ? manifestLabel
+            : source === "not set"
+                ? `not set (${UNSET_CONSEQUENCE[name]})`
+                : source;
+        return `${name.padEnd(width)}  ${label}`;
+    });
+}
+function reportManifestSecrets(resolved, manifestLabel = "manifest", log = console.log) {
+    for (const line of formatSecretConflicts(resolved.conflicts))
+        log(`${chalk_1.default.yellow.bold("⚠")} ${chalk_1.default.yellow(line)}`);
+    log(chalk_1.default.dim("  Server secrets:"));
+    for (const line of formatSecretSources(resolved.sources, manifestLabel))
+        log(chalk_1.default.dim(`    ${line}`));
+}

package/dist/materialize.d.ts

@@ -17,4 +17,6 @@ export interface FrontendModuleRegistry {
 export declare function createFrontendModuleRegistry(workspaceDir: string, layers: ResolvedLayer[]): FrontendModuleRegistry;
 export declare function collectAuthEstablishEndpoints(layers: ResolvedLayer[]): string[];
 export declare function writeFrontendModuleRegistry(workspaceDir: string, layers: ResolvedLayer[]): void;
+export declare function affectsLocaleMessages(relativePath: string): boolean;
+export declare function writeLocaleMessages(workspaceDir: string, registry: FrontendModuleRegistry): void;
 export declare function writeDmsMainCss(workspaceDir: string, layers: ResolvedLayer[]): void;

package/dist/materialize.js

@@ -7,6 +7,8 @@ exports.materializeLayers = materializeLayers;
 exports.createFrontendModuleRegistry = createFrontendModuleRegistry;
 exports.collectAuthEstablishEndpoints = collectAuthEstablishEndpoints;
 exports.writeFrontendModuleRegistry = writeFrontendModuleRegistry;
+exports.affectsLocaleMessages = affectsLocaleMessages;
+exports.writeLocaleMessages = writeLocaleMessages;
 exports.writeDmsMainCss = writeDmsMainCss;
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
@@ -209,6 +211,16 @@ function mergeLocaleMessages(source, existing) {
     }
     return merged;
 }
+const LOCALE_DIRECTORY = "i18n/locales";
+function readLocaleFile(path) {
+    try {
+        return JSON.parse((0, node_fs_1.readFileSync)(path, "utf8"));
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Invalid locale file ${path}: ${reason}`);
+    }
+}
 function readLocaleMessages(assets, registry) {
     const roots = new Map(registry.modules.map((module) => [module.id, module.root]));
     const messages = {};
@@ -217,27 +229,107 @@ function readLocaleMessages(assets, registry) {
         const root = roots.get(asset.moduleId);
         if (!locale || !root)
             continue;
-        const value = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, asset.relativePath), "utf8"));
+        const value = readLocaleFile((0, node_path_1.join)(root, asset.relativePath));
         messages[locale] = mergeLocaleMessages(value, messages[locale] ?? {});
     }
     return messages;
 }
+function affectsLocaleMessages(relativePath) {
+    const segments = (0, fs_sync_1.toPosixPath)(relativePath).split("/");
+    if (segments[0] === "layers" && segments.length <= 2)
+        return true;
+    const withinRoot = segments[0] === "layers" ? segments.slice(2) : segments;
+    return LOCALE_DIRECTORY.split("/").every((segment, index) => index >= withinRoot.length || withinRoot[index] === segment);
+}
+function localeModuleSource(supportedLocales) {
+    const loaders = supportedLocales
+        .filter((locale) => locale !== "en")
+        .map((locale) => `  ${JSON.stringify(locale)}: () => import(${JSON.stringify(`./locales.generated/${locale}`)}),`);
+    return `import defaultMessages from "./locales.generated/en";
+
+type LocaleMessages = Record<string, unknown>;
+type LocaleLoader = () => Promise<{ default: LocaleMessages }>;
+interface LocaleMessagesTarget {
+  setLocaleMessage(locale: string, messages: LocaleMessages): void;
+}
+interface LocaleState {
+  messages: Record<string, LocaleMessages>;
+  targets: Set<LocaleMessagesTarget>;
+  version: number;
+}
+
+export const supportedLocales = ${JSON.stringify(supportedLocales)};
+const localeLoaders: Record<string, LocaleLoader> = {
+  "en": async () => ({ default: defaultMessages }),
+${loaders.join("\n")}
+};
+const shared: LocaleState | undefined = import.meta.hot?.data.state;
+const state: LocaleState = shared ?? {
+  messages: { en: defaultMessages },
+  targets: new Set(),
+  version: 0,
+};
+export const localeMessages = state.messages;
+
+async function readLocaleMessages(locale: string): Promise<LocaleMessages> {
+  return (await localeLoaders[locale]()).default;
+}
+
+export async function loadLocaleMessages(locale: string): Promise<LocaleMessages> {
+  const normalized = locale.slice(0, 2);
+  if (!localeLoaders[normalized]) return localeMessages.en;
+  localeMessages[normalized] ??= await readLocaleMessages(normalized);
+  return localeMessages[normalized];
+}
+
+/** Development only: applies every regenerated catalog to \`target\`. */
+export function syncLocaleMessages(target: LocaleMessagesTarget): void {
+  if (import.meta.hot) state.targets.add(target);
+}
+
+async function refreshLocaleMessages(): Promise<void> {
+  const version = ++state.version;
+  const locales = Object.keys(localeMessages).filter(
+    (locale) => locale in localeLoaders,
+  );
+  const catalogs = await Promise.all(locales.map(readLocaleMessages));
+  if (version !== state.version) return;
+  locales.forEach((locale, index) => {
+    localeMessages[locale] = catalogs[index];
+    for (const target of state.targets)
+      target.setLocaleMessage(locale, catalogs[index]);
+  });
+}
+
+if (import.meta.hot) {
+  import.meta.hot.data.state = state;
+  if (shared) void refreshLocaleMessages();
+  import.meta.hot.accept((next) => {
+    if (next?.supportedLocales.join() !== supportedLocales.join())
+      import.meta.hot?.invalidate("the list of locales changed");
+  });
+}
+`;
+}
 function writeLocaleMessages(workspaceDir, registry) {
-    const locales = discoverAssets(registry, "i18n/locales", [".json"]);
+    const locales = discoverAssets(registry, LOCALE_DIRECTORY, [".json"]);
     const messages = readLocaleMessages(locales, registry);
     const outputDir = (0, node_path_1.join)(workspaceDir, "locales.generated");
-    (0, node_fs_1.rmSync)(outputDir, { recursive: true, force: true });
+    const outputs = new Set();
     (0, node_fs_1.mkdirSync)(outputDir, { recursive: true });
     for (const [locale, value] of Object.entries(messages)) {
-        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(outputDir, `${locale}.json`), JSON.stringify(value));
-        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(outputDir, `${locale}.ts`), `const messages = ${JSON.stringify(value)};\nexport default messages;\n`);
+        const catalog = JSON.stringify(value);
+        (0, fs_sync_1.applyContent)(catalog, (0, node_path_1.join)(outputDir, `${locale}.json`));
+        (0, fs_sync_1.applyContent)(`const messages = ${catalog};\nexport default messages;\n`, (0, node_path_1.join)(outputDir, `${locale}.ts`));
+        outputs.add(`${locale}.json`).add(`${locale}.ts`);
     }
     const supportedLocales = Object.keys(messages);
-    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(workspaceDir, "email-locales.generated.json"), JSON.stringify(supportedLocales));
-    const loaders = supportedLocales
-        .filter((locale) => locale !== "en")
-        .map((locale) => `${JSON.stringify(locale)}: () => import(${JSON.stringify(`./locales.generated/${locale}`)})`);
-    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(workspaceDir, "locales.generated.ts"), `import defaultMessages from "./locales.generated/en";\ninterface LocaleModule { default: Record<string, unknown>; }\ntype LocaleLoader = () => Promise<LocaleModule>;\nexport const supportedLocales = ${JSON.stringify(supportedLocales)};\nexport const localeMessages: Record<string, Record<string, unknown>> = { en: defaultMessages };\nconst localeLoaders: Record<string, LocaleLoader> = { ${loaders.join(", ")} };\nexport async function loadLocaleMessages(locale: string): Promise<Record<string, unknown>> {\n  const normalized = locale.slice(0, 2);\n  const existing = localeMessages[normalized];\n  if (existing) return existing;\n  const loader = localeLoaders[normalized];\n  if (!loader) return defaultMessages;\n  const messages = (await loader()).default;\n  localeMessages[normalized] = messages;\n  return messages;\n}\n`);
+    (0, fs_sync_1.applyContent)(JSON.stringify(supportedLocales), (0, node_path_1.join)(workspaceDir, "email-locales.generated.json"));
+    (0, fs_sync_1.applyContent)(localeModuleSource(supportedLocales), (0, node_path_1.join)(workspaceDir, "locales.generated.ts"));
+    for (const name of (0, node_fs_1.readdirSync)(outputDir)) {
+        if (!outputs.has(name))
+            (0, node_fs_1.rmSync)((0, node_path_1.join)(outputDir, name), { recursive: true, force: true });
+    }
 }
 function writeShortcutExports(workspaceDir, registry) {
     const registries = discoverAssets(registry, "app/config", [

package/dist/ports.js

@@ -7,7 +7,7 @@ exports.PORT_FALLBACK_RANGE = 20;
 const MAX_TCP_PORT = 65535;
 function tryListen(port) {
     return new Promise((resolve) => {
-        const server = (0, node_net_1.createServer)();
+        const server = (0, node_net_1.createServer)((socket) => socket.destroy());
         server.unref();
         server.once("error", () => resolve(undefined));
         server.listen({ port }, () => resolve(server));

package/dist/workspace-setup.d.ts

@@ -1,4 +1,5 @@
 import { type SpawnOptions } from "node:child_process";
+import { type ManifestSecrets } from "./manifest-secrets";
 import { ResolvedLayer } from "./workspace";
 export declare function computeDepsHash(layerPaths: string[], workspacePackage?: string, installInputs?: readonly string[]): string;
 export declare function needsInstall(workspaceDir: string, layerPaths: string[], force: boolean): boolean;
@@ -19,5 +20,6 @@ export interface SetupWorkspaceResult {
     layers: ResolvedLayer[];
     manifestFromCache: boolean;
     manifestFetchedAt?: string;
+    manifestSecrets: ManifestSecrets;
 }
 export declare function setupWorkspace(opts: SetupWorkspaceOptions): Promise<SetupWorkspaceResult>;

package/dist/workspace-setup.js

@@ -13,6 +13,7 @@ const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const layers_1 = require("./layers");
 const manifest_1 = require("./manifest");
+const manifest_secrets_1 = require("./manifest-secrets");
 const materialize_1 = require("./materialize");
 const workspace_1 = require("./workspace");
 const config_1 = require("./config");
@@ -183,5 +184,6 @@ async function setupWorkspace(opts) {
         layers,
         manifestFromCache: fromCache,
         manifestFetchedAt: fetchedAt,
+        manifestSecrets: (0, manifest_secrets_1.collectManifestSecrets)(manifest.modules),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antelopejs/dms-frontend",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Frontend-agnostic loader for AntelopeJS DMS, shipping the Vue 3 renderer (Vite, Inertia, SSR)",
   "keywords": [
     "antelope",

package/templates/vue/app-runtime.ts

@@ -1,5 +1,6 @@
 import UApp from "@nuxt/ui/components/App.vue";
 import UIcon from "@nuxt/ui/runtime/vue/components/Icon.vue";
+import { useToast } from "@nuxt/ui/composables/useToast";
 import { useAppConfig } from "@nuxt/ui/runtime/vue/composables/useAppConfig";
 import ui from "@nuxt/ui/vue-plugin";
 import { useHead } from "@unhead/vue";
@@ -43,7 +44,9 @@ import {
   loadLocaleMessages,
   localeMessages,
   supportedLocales,
+  syncLocaleMessages,
 } from "./locales.generated";
+import { showNetworkErrors } from "./network-error";
 
 export interface DmsInertiaSetupProps {
   initialPage: unknown;
@@ -214,11 +217,26 @@ function renderDmsPersistentLayout(
   );
 }
 
+/**
+ * Nuxt UI keeps one app config for the whole process, and defu concatenates
+ * arrays: merged into it on every server render, the compound variants the DMS
+ * declares piled up, and every class list built from them grew with each
+ * request. Each config is merged once; a new one, after a reload, is merged
+ * again.
+ */
+const mergedUiAppConfigs = new WeakSet<object>();
+
+function mergeDmsAppConfig(): void {
+  const uiAppConfig = useAppConfig();
+  if (mergedUiAppConfigs.has(uiAppConfig)) return;
+  Object.assign(uiAppConfig, defu(useDmsAppConfig(), uiAppConfig));
+  mergedUiAppConfigs.add(uiAppConfig);
+}
+
 export async function configureDmsApp(
   options: DmsAppOptions,
 ): Promise<DmsConfiguredApp> {
-  const uiAppConfig = useAppConfig();
-  Object.assign(uiAppConfig, defu(useDmsAppConfig(), uiAppConfig));
+  mergeDmsAppConfig();
   const runtime =
     options.runtime ??
     createDmsFrontendRuntime(
@@ -233,12 +251,19 @@ export async function configureDmsApp(
     fallbackLocale: DEFAULT_LOCALE,
     messages: { ...localeMessages, [locale]: messages },
   });
+  // A translation changed in a layer during development reaches the page
+  // without a reload. A server render imports the new catalogs instead.
+  if (typeof window !== "undefined") syncLocaleMessages(i18n.global);
   provideDmsFrontendRuntime(options.app, runtime);
   options.app.component("Icon", UIcon);
   options.app.use(options.inertiaPlugin).use(options.head).use(ui).use(i18n);
   options.app.runWithContext(() =>
     hydrateDmsPageProps(options.initialPageProps, options.initialPageUrl),
   );
+  if (typeof window !== "undefined") {
+    const toast = options.app.runWithContext(() => useToast());
+    showNetworkErrors(toast.add, i18n.global);
+  }
   // Resolve, before the app mounts, every async component the server
   // rendered: the page, its layout, and the components the render reached.
   // Hydration then adopts the server-rendered markup instead of discarding it.