@antelopejs/dms-frontend 0.7.0 → 0.8.0

package/dist/project-modules.js

@@ -0,0 +1,233 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FRONTEND_DECLARATION_FIELD = void 0;
+exports.loadProjectConfig = loadProjectConfig;
+exports.readShippingVersion = readShippingVersion;
+exports.readProjectFrontendModules = readProjectFrontendModules;
+const node_fs_1 = require("node:fs");
+const fsPromises = __importStar(require("node:fs/promises"));
+const node_path_1 = require("node:path");
+const cli_1 = require("@antelopejs/core/cli");
+const layers_1 = require("./layers");
+const private_values_1 = require("./private-values");
+exports.FRONTEND_DECLARATION_FIELD = "dmsFrontend";
+const FRONTEND_SOURCE_DIR = "frontend-vue";
+const RENDERER = { name: "vue", version: "3" };
+const CONFIG_VAR_PATTERN = /\$\{@([^.}]+)\.([^}]+)\}/g;
+const PURE_CONFIG_VAR = /^\$\{@([^.}]+)\.([^}]+)\}$/;
+const TRAILING_SLASHES = /\/+$/;
+const DEFAULT_API_PORT = 80;
+const LOOPBACK_HOST = "127.0.0.1";
+const WILDCARD_HOSTS = new Set(["0.0.0.0", "::", "[::]"]);
+const NODE_FILE_SYSTEM = {
+    readFile: (path) => fsPromises.readFile(path),
+    readFileString: (path, encoding = "utf-8") => fsPromises.readFile(path, encoding),
+    writeFile: (path, data) => fsPromises.writeFile(path, data),
+    readdir: (path) => fsPromises.readdir(path),
+    stat: (path) => fsPromises.stat(path),
+    mkdir: async (path, options) => {
+        await fsPromises.mkdir(path, options);
+    },
+    rm: (path, options) => fsPromises.rm(path, options),
+    exists: async (path) => (0, node_fs_1.existsSync)(path),
+    access: (path) => fsPromises.access(path),
+    copyFile: (src, dest) => fsPromises.copyFile(src, dest),
+    rename: (oldPath, newPath) => fsPromises.rename(oldPath, newPath),
+};
+function apiLocalBaseUrl(server) {
+    const host = !server.host || WILDCARD_HOSTS.has(server.host)
+        ? LOOPBACK_HOST
+        : server.host;
+    const protocol = server.protocol ?? "http";
+    return `${protocol}://${host}:${server.port ?? DEFAULT_API_PORT}`;
+}
+const CONFIG_VAR_PROVIDERS = {
+    api: (config) => {
+        const api = (config ?? {});
+        const server = api.servers?.[0];
+        if (!server)
+            return {};
+        const local = apiLocalBaseUrl(server);
+        return {
+            API_PORT: server.port ?? DEFAULT_API_PORT,
+            API_LOCAL_BASE_URL: local,
+            API_PUBLIC_BASE_URL: api.publicBaseUrl?.trim().replace(TRAILING_SLASHES, "") || local,
+        };
+    },
+};
+function projectConfigVars(config) {
+    return Object.fromEntries(Object.entries(CONFIG_VAR_PROVIDERS)
+        .filter(([id]) => config.modules[id])
+        .map(([id, provide]) => [id, provide(config.modules[id].config)]));
+}
+function substituteConfigVars(value, vars) {
+    if (typeof value === "string") {
+        const pure = value.match(PURE_CONFIG_VAR);
+        if (pure)
+            return vars[pure[1]]?.[pure[2]];
+        return value.replace(CONFIG_VAR_PATTERN, (token, module, name) => {
+            const resolved = vars[module]?.[name];
+            return resolved === undefined ? token : String(resolved);
+        });
+    }
+    if (Array.isArray(value))
+        return value.map((item) => substituteConfigVars(item, vars));
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            key,
+            substituteConfigVars(item, vars),
+        ]));
+    }
+    return value;
+}
+async function loadProjectConfig(projectDir, environment) {
+    const { ConfigLoader } = await Promise.resolve().then(() => __importStar(require("@antelopejs/core")));
+    const loader = new ConfigLoader(NODE_FILE_SYSTEM);
+    let loaded;
+    try {
+        loaded = (await loader.load(projectDir, environment));
+    }
+    catch (error) {
+        throw new cli_1.CliError({
+            title: `Could not evaluate the project's configuration in ${projectDir}`,
+            reason: error instanceof Error ? error.message : String(error),
+            fixes: ["Run from the project root, or pass --project <dir>"],
+        }, { cause: error });
+    }
+    const vars = projectConfigVars(loaded);
+    return {
+        cacheFolder: loaded.cacheFolder,
+        modules: Object.fromEntries(Object.entries(loaded.modules).map(([id, module]) => [
+            id,
+            { ...module, config: substituteConfigVars(module.config, vars) },
+        ])),
+    };
+}
+function moduleFolder(projectDir, cacheFolder, source) {
+    const candidates = source.type === "local" && source.path
+        ? [(0, node_path_1.resolve)(projectDir, source.path)]
+        : source.package
+            ? [
+                (0, node_path_1.join)(projectDir, "node_modules", source.package),
+                (0, node_path_1.resolve)(projectDir, cacheFolder, source.package),
+            ]
+            : [];
+    return candidates.find((folder) => (0, node_fs_1.existsSync)((0, node_path_1.join)(folder, "package.json")));
+}
+function readShippingVersion(sourcePath) {
+    try {
+        const pkg = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)((0, node_path_1.dirname)(sourcePath), "package.json"), "utf-8"));
+        return typeof pkg.version === "string" ? pkg.version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function toLayer(registration) {
+    const name = (0, layers_1.readLayerPackage)(registration.sourcePath)?.name;
+    return {
+        path: registration.sourcePath,
+        name: registration.name,
+        sourcePath: registration.sourcePath,
+        packageName: typeof name === "string" ? name : undefined,
+        priority: registration.priority ?? 0,
+        configKey: registration.configKey,
+        options: registration.options ?? {},
+        privateOptions: registration.privateOptions &&
+            (0, private_values_1.emptiedOptions)(registration.privateOptions),
+        authEstablishEndpoints: registration.authEstablishEndpoints ?? [],
+        publicEndpoints: registration.publicEndpoints ?? [],
+        backendProxies: registration.backendProxies ?? [],
+    };
+}
+function warnMissingModule(id) {
+    (0, cli_1.getProcessUi)().message("warn", `${id} is not installed in the project: its pages, if it has any, are left out`, { detail: "Install the project's modules first: ajs project build" });
+}
+function warnUndeclaredFrontend(id, folder) {
+    if (!(0, node_fs_1.existsSync)((0, node_path_1.join)(folder, FRONTEND_SOURCE_DIR)))
+        return;
+    (0, cli_1.getProcessUi)().message("warn", `${id} ships ${FRONTEND_SOURCE_DIR}/ but declares no ${exports.FRONTEND_DECLARATION_FIELD} in its package.json: its pages are left out`);
+}
+function registrationOf(id, folder, config, context) {
+    const declaration = (0, layers_1.readLayerPackage)(folder)?.[exports.FRONTEND_DECLARATION_FIELD];
+    if (typeof declaration !== "string") {
+        warnUndeclaredFrontend(id, folder);
+        return undefined;
+    }
+    const { frontendModule } = require((0, node_path_1.join)(folder, declaration));
+    if (typeof frontendModule !== "function") {
+        throw new cli_1.CliError({
+            title: `${id}: ${declaration} exports no frontendModule function`,
+            fixes: [`Export frontendModule(config, context) from ${declaration}`],
+        });
+    }
+    return frontendModule(config, context);
+}
+function isServedRenderer(registration) {
+    return (registration.renderer.name === RENDERER.name &&
+        registration.renderer.version === RENDERER.version);
+}
+function keepHighestPriority(registrations) {
+    const byName = new Map();
+    for (const registration of registrations) {
+        const kept = byName.get(registration.name);
+        if (!kept || (kept.priority ?? 0) <= (registration.priority ?? 0))
+            byName.set(registration.name, registration);
+    }
+    return [...byName.values()];
+}
+async function readProjectFrontendModules(options) {
+    const projectDir = (0, node_path_1.resolve)(options.projectDir);
+    const config = await loadProjectConfig(projectDir, options.environment);
+    const context = { dev: !!options.dev };
+    const registrations = Object.entries(config.modules).flatMap(([id, module]) => {
+        const folder = moduleFolder(projectDir, config.cacheFolder, module.source);
+        if (!folder) {
+            warnMissingModule(id);
+            return [];
+        }
+        const registration = registrationOf(id, folder, module.config, context);
+        return registration && isServedRenderer(registration)
+            ? [registration]
+            : [];
+    });
+    return keepHighestPriority(registrations)
+        .sort((left, right) => (right.priority ?? 0) - (left.priority ?? 0))
+        .map((registration) => ({
+        layer: toLayer(registration),
+        version: readShippingVersion(registration.sourcePath),
+    }));
+}

package/dist/workspace-setup.d.ts

@@ -1,8 +1,8 @@
 import { type ChildProcess, type SpawnOptions } from "node:child_process";
 import { type PathMapper } from "./child-output";
+import { type ProjectModulesOptions } from "./project-modules";
 import { type ManifestSecrets } from "./manifest-secrets";
 import { ResolvedLayer } from "./workspace";
-import { type BuildOrigin, type FrontendSnapshot } from "./snapshot";
 export declare function computeDepsHash(layerPaths: string[], workspacePackage?: string, installInputs?: readonly string[]): string;
 export declare function needsInstall(workspaceDir: string, layerPaths: string[], force: boolean): boolean;
 export declare function saveDepsHash(workspaceDir: string, layerPaths: string[]): void;
@@ -21,18 +21,15 @@ export interface FramedCommandResult {
 }
 export declare function runFramedCommand(command: string, args: string[], options: FramedCommandOptions): Promise<FramedCommandResult>;
 export interface SetupWorkspaceOptions {
-    backendUrl: string;
     force: boolean;
     mode: "dev" | "build";
+    backendUrl?: string;
     offline?: boolean;
     clientUrl?: string;
     workspaceKey?: string;
     bootstrapSecret?: string;
     workspaceDir?: string;
-    snapshot?: {
-        dir: string;
-        snapshot: FrontendSnapshot;
-    };
+    project?: ProjectModulesOptions;
     beforeInstall?: () => Promise<void>;
 }
 export interface SetupWorkspaceResult {
@@ -41,6 +38,5 @@ export interface SetupWorkspaceResult {
     manifestFromCache: boolean;
     manifestFetchedAt?: string;
     manifestSecrets: ManifestSecrets;
-    buildOrigin: BuildOrigin;
 }
 export declare function setupWorkspace(opts: SetupWorkspaceOptions): Promise<SetupWorkspaceResult>;

package/dist/workspace-setup.js

@@ -15,11 +15,11 @@ const cli_1 = require("@antelopejs/core/cli");
 const child_output_1 = require("./child-output");
 const layers_1 = require("./layers");
 const manifest_1 = require("./manifest");
+const project_modules_1 = require("./project-modules");
 const manifest_secrets_1 = require("./manifest-secrets");
 const renderer_range_1 = require("./renderer-range");
 const materialize_1 = require("./materialize");
 const workspace_1 = require("./workspace");
-const snapshot_1 = require("./snapshot");
 const cancellation_1 = require("./cancellation");
 const output_1 = require("./output");
 const config_1 = require("./config");
@@ -215,77 +215,57 @@ async function runFramedCommand(command, args, options) {
     await Promise.race([ended, drainTimeout()]);
     return { code, lines: tails.flatMap((tail) => tail.lines()) };
 }
-function manifestCacheUse(mode, offline) {
-    if (offline)
-        return "offline";
-    return mode === "build" ? "never" : "fallback";
-}
-async function snapshotLayers({ dir, snapshot }, workspaceDir) {
-    const { manifest, takenAt } = snapshot;
-    const cacheDir = (0, node_path_1.join)(dir, snapshot_1.SNAPSHOT_LAYERS_DIR);
-    (0, layers_1.assertCachedArchivesExist)(manifest.modules, cacheDir, takenAt);
-    (0, manifest_1.writeCachedManifest)(workspaceDir, manifest, "drop", takenAt);
+async function projectLayers(project) {
+    const modules = await (0, project_modules_1.readProjectFrontendModules)(project);
     return {
-        manifest,
         fromCache: false,
-        layers: await (0, layers_1.buildLayersFromCache)(manifest.modules, cacheDir),
+        layers: modules.map((module) => module.layer),
+        secrets: { published: {}, conflicts: [] },
     };
 }
-async function servedLayers(opts, workspaceDir) {
-    const { backendUrl, force, mode, offline, clientUrl, bootstrapSecret } = opts;
-    const resolved = await (0, manifest_1.resolveManifest)(workspaceDir, backendUrl, manifestCacheUse(mode, offline), {
-        clientUrl,
+async function servedLayers(opts, backendUrl, workspaceDir) {
+    const { offline, clientUrl, bootstrapSecret } = opts;
+    const cacheUse = offline ? "offline" : "fallback";
+    const { manifest, fromCache, fetchedAt } = await (0, manifest_1.resolveManifest)(workspaceDir, backendUrl, cacheUse, { clientUrl, bootstrapSecret });
+    (0, layers_1.assertLayerPathsServed)(manifest.modules, backendUrl, {
         bootstrapSecret,
-        privateValues: mode === "build" ? "drop" : "keep",
+        cache: fromCache ? { fetchedAt } : undefined,
     });
-    const { manifest, fromCache, fetchedAt } = resolved;
-    if (mode === "dev") {
-        (0, layers_1.assertLayerPathsServed)(manifest.modules, backendUrl, {
-            bootstrapSecret,
-            cache: fromCache ? { fetchedAt } : undefined,
-        });
-        if (fromCache) {
-            (0, manifest_1.assertCachedLayerPathsExist)(manifest.modules, fetchedAt);
-        }
-        return { ...resolved, layers: (0, layers_1.buildLayersFromPaths)(manifest.modules) };
-    }
-    const cacheDir = (0, node_path_1.join)(workspaceDir, ".layers-cache");
     if (fromCache) {
-        if (!(0, node_fs_1.existsSync)(cacheDir)) {
-            throw new cli_1.CliError({
-                title: "No layers archive was downloaded for this workspace",
-                fixes: [
-                    "Run once without --offline, with the backend reachable, first",
-                ],
-            });
-        }
-        (0, layers_1.assertCachedArchivesExist)(manifest.modules, cacheDir, fetchedAt);
-    }
-    else {
-        await (0, layers_1.downloadAndExtractLayers)(backendUrl, manifest.pack, cacheDir, force, bootstrapSecret);
+        (0, manifest_1.assertCachedLayerPathsExist)(manifest.modules, fetchedAt);
     }
     return {
-        ...resolved,
-        layers: await (0, layers_1.buildLayersFromCache)(manifest.modules, cacheDir),
+        fromCache,
+        fetchedAt,
+        layers: (0, layers_1.buildLayersFromPaths)(manifest.modules),
+        secrets: (0, manifest_secrets_1.collectManifestSecrets)(manifest.modules),
     };
 }
-async function setupWorkspace(opts) {
-    const { backendUrl, force } = opts;
+function workspaceDirFor(opts) {
+    if (opts.workspaceDir)
+        return (0, workspace_1.ensureExplicitWorkspace)(opts.workspaceDir);
+    const backendUrl = requireDevBackend(opts);
     const workspaceKey = opts.workspaceKey ?? (0, config_1.canonicalizeBackendUrl)(backendUrl);
-    const workspaceDir = opts.workspaceDir
-        ? (0, workspace_1.ensureExplicitWorkspace)(opts.workspaceDir)
-        : (0, workspace_1.ensureWorkspace)(workspaceKey);
+    const workspaceDir = (0, workspace_1.ensureWorkspace)(workspaceKey);
     (0, workspace_1.writeWorkspaceMeta)(workspaceDir, backendUrl, workspaceKey);
-    const { manifest, fromCache, fetchedAt, layers } = opts.snapshot
-        ? await snapshotLayers(opts.snapshot, workspaceDir)
-        : await servedLayers(opts, workspaceDir);
-    const buildOrigin = {
-        source: opts.snapshot ? "snapshot" : "backend",
-        backendUrl: (0, config_1.canonicalizeBackendUrl)(backendUrl),
-        takenAt: opts.snapshot?.snapshot.takenAt ?? fetchedAt ?? new Date().toISOString(),
-        digest: (0, snapshot_1.manifestDigest)(manifest.modules),
-        authenticated: !!opts.snapshot || (!!opts.bootstrapSecret && !fromCache),
-    };
+    return workspaceDir;
+}
+function requireDevBackend(opts) {
+    if (!opts.backendUrl)
+        throw new Error("A dev workspace is set up from a backend URL");
+    return opts.backendUrl;
+}
+function workspaceSource(opts, workspaceDir) {
+    if (opts.mode === "build") {
+        if (!opts.project)
+            throw new Error("A build reads a project");
+        return projectLayers(opts.project);
+    }
+    return servedLayers(opts, requireDevBackend(opts), workspaceDir);
+}
+async function setupWorkspace(opts) {
+    const workspaceDir = workspaceDirFor(opts);
+    const { fromCache, fetchedAt, layers, secrets } = await workspaceSource(opts, workspaceDir);
     (0, renderer_range_1.assertLayersSupportRenderer)(layers, { workspaceDir });
     (0, materialize_1.copyStaticTemplates)(workspaceDir);
     (0, materialize_1.writeWorkspacePackageJson)(workspaceDir, layers);
@@ -293,7 +273,7 @@ async function setupWorkspace(opts) {
     (0, materialize_1.writeFrontendModuleRegistry)(workspaceDir, layers);
     (0, materialize_1.writeDmsMainCss)(workspaceDir, layers);
     const layerPaths = layers.map((layer) => layer.path);
-    const shouldInstall = needsInstall(workspaceDir, layerPaths, force);
+    const shouldInstall = needsInstall(workspaceDir, layerPaths, opts.force);
     if (shouldInstall) {
         await opts.beforeInstall?.();
         await installDeps(workspaceDir, (0, child_output_1.createPathMapper)(workspaceDir, layers));
@@ -304,7 +284,6 @@ async function setupWorkspace(opts) {
         layers,
         manifestFromCache: fromCache,
         manifestFetchedAt: fetchedAt,
-        manifestSecrets: (0, manifest_secrets_1.collectManifestSecrets)(manifest.modules),
-        buildOrigin,
+        manifestSecrets: secrets,
     };
 }

package/dist/workspace.d.ts

@@ -4,7 +4,6 @@ export interface FrontendModuleOptions {
 }
 export interface ManifestModule {
     name: string;
-    archiveName: string;
     renderer?: {
         name: string;
         version: string;
@@ -21,6 +20,7 @@ export interface ManifestModule {
 export interface BackendProxyDeclaration {
     path: string;
     auth?: "session" | "none";
+    maxBodyBytes?: number;
 }
 export interface PublicEndpointDeclaration {
     path: string;
@@ -28,13 +28,11 @@ export interface PublicEndpointDeclaration {
     headers?: string[];
 }
 export interface Manifest {
-    pack: string;
     modules: ManifestModule[];
     settling?: boolean;
 }
 export interface FrontendManifest {
     version: number;
-    archive: string;
     modules: ManifestModule[];
     settling?: boolean;
 }
@@ -70,6 +68,6 @@ export interface WorkspaceListing {
 export declare function listWorkspaces(): WorkspaceListing;
 export declare function directorySize(dir: string): number;
 export declare function writeWorkspaceMeta(workspaceDir: string, backendUrl: string, workspaceKey: string): void;
-export declare const FRONTEND_MANIFEST_VERSION = 1;
+export declare const FRONTEND_MANIFEST_VERSION = 2;
 export declare function bootstrapHeaders(secret?: string): Record<string, string>;
 export declare function isUnauthorized(status: number): boolean;

package/dist/workspace.js

@@ -131,7 +131,7 @@ function writeWorkspaceMeta(workspaceDir, backendUrl, workspaceKey) {
 }
 const BOOTSTRAP_HEADER = "x-dms-bootstrap";
 const UNAUTHORIZED_STATUSES = [401, 403];
-exports.FRONTEND_MANIFEST_VERSION = 1;
+exports.FRONTEND_MANIFEST_VERSION = 2;
 function bootstrapHeaders(secret) {
     return secret ? { [BOOTSTRAP_HEADER]: secret } : {};
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antelopejs/dms-frontend",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Frontend-agnostic loader for AntelopeJS DMS, shipping the Vue 3 renderer (Vite, Inertia, SSR)",
   "keywords": [
     "antelope",
@@ -76,8 +76,7 @@
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",
     "ignore": "^7.0.5",
-    "semver": "^7.7.4",
-    "unzipper": "^0.12.3"
+    "semver": "^7.7.4"
   },
   "devDependencies": {
     "@antelopejs/core": "^1.16.0",
@@ -87,9 +86,8 @@
     "@inertiajs/vue3": "^3.7.1",
     "@types/node": "^24.8.1",
     "@types/semver": "^7.7.1",
-    "@types/unzipper": "^0.10.11",
     "@unhead/vue": "^2.1.4",
-    "@vitejs/plugin-vue": "^6.0.1",
+    "@vitejs/plugin-vue": "^6.0.6",
     "@vue/server-renderer": "^3.5.25",
     "defu": "^6.1.4",
     "devalue": "^5.9.4",
@@ -104,7 +102,7 @@
     "tsx": "^4.20.6",
     "typescript": "^6.0.3",
     "unplugin-auto-import": "^20.2.0",
-    "vite": "^7.2.4",
+    "vite": "^8.3.4",
     "vue": "^3.5.25",
     "vue-i18n": "^11.2.7"
   },
@@ -119,7 +117,7 @@
     "@oxc-parser/binding-win32-x64-msvc": "^0.95.0"
   },
   "engines": {
-    "node": ">=20.12.0"
+    "node": ">=20.19.0"
   },
   "packageManager": "pnpm@10.6.5",
   "antelopeJs": {

package/skills/dms-frontend/SKILL.md

@@ -18,8 +18,8 @@ tags: [frontend, cli, renderer, vue, inertia, ssr, deployment, dms-module]
 
 ## Rules that bite
 
-- **One workspace per backend URL**, under `~/.antelopejs/dms-frontend/<sha256>/`. `dev` without `-b` keys its own on the project directory instead, so `dev` then `build -b` builds a second workspace. `start` serves the workspace `build` made for the same URL, user and home directory.
-- **Secrets.** `build` and `start` need the same `DMS_SESSION_SECRET` (32+ characters); `dev` generates one only when it is unset. `build` takes `DMS_BOOTSTRAP_SECRET` explicitly, never from `.antelope/dms-dev.json`. A build without it still succeeds, but loses the modules' private options, the manifest's backend proxies and the e-mail and OAuth secrets: `start` then warns that e-mail renders and OAuth sign-in will be refused.
+- **One dev workspace per backend URL**, under `~/.antelopejs/dms-frontend/<sha256>/`. `dev` without `-b` keys its own on the project directory instead. A production build is different: `build` reads the project itself (`antelope.config.ts` with `-e production`, each installed module's `dmsFrontend` function), needs no backend, and writes `<project>/.dms-frontend`, which `start` serves from the project root.
+- **Secrets.** `start` needs `DMS_SESSION_SECRET` (32+ characters); `dev` generates one only when it is unset. `build` needs no secret. `start` reads `DMS_HTML_RENDER_SECRET` and `DMS_OAUTH_RELAY_SECRET` from its environment and warns when they are unset, and computes the modules' public options from the project's configuration with its own variables, which must match the backend's.
 - **`.env`** is read from the current directory only (shell, then `.env.local`, then `.env`). A `DMS_API_BASE_URL` in `.env` turns off backend discovery for `dev`. `clean` never reads it.
 - **`prepare` never fails** without `--strict`: it warns and exits 0. Use `--strict` where the types are required.
 - **Exit codes:** 0 success, 1 failure, 2 usage error, 130 Ctrl+C.

package/templates/vue/client-chunking.mjs

@@ -0,0 +1,61 @@
+// How the client bundle is cut into files, and what the build says about it.
+//
+// Kept beside vite.config.ts rather than inside it so the options can be
+// exercised on their own, the way head-order.mjs and client-server-guard.mjs are.
+
+/**
+ * Rolldown's `output.codeSplitting` for the client build.
+ *
+ * By default Rolldown gives every set of dynamic imports that shares a module
+ * its own common chunk. The DMS's pages are hundreds of dynamic imports (a
+ * module's components and pages are `import.meta.glob`ed), so the code the
+ * entry also needs lands in about sixty small common chunks the entry imports
+ * before anything runs: one request each, 55 to 60 more files on every page
+ * than the single entry file Rollup made, for no byte saved.
+ *
+ * The `$initial` tag is every module the entry imports statically, directly or
+ * not. One group over it puts them in the entry file again, and leaves every
+ * lazy chunk to Rolldown's own splitting, which a page only loads when it needs
+ * it: what an anonymous page loads is still what that page's own routes pull.
+ *
+ * Deliberately not here: groups over what the lazy chunks share (the UI
+ * libraries, a chunk per module). They cut a signed-in page's files by a
+ * quarter to four fifths, but every group is loaded whole by each page that
+ * uses any of it, and the anonymous pages pay 70 to 115 KB of Brotli for code
+ * only the signed-in shell uses.
+ */
+export const clientCodeSplitting = {
+  groups: [{ name: "entry", tags: ["$initial"] }],
+};
+
+const MODULE_ENTRY = /[\\/]dms\.frontend\.[cm]?[jt]sx?$/;
+
+/**
+ * Rolldown's `onLog` for every build: drops the
+ * INEFFECTIVE_DYNAMIC_IMPORT notices whose dynamic importer is a module's
+ * `dms.frontend.ts`.
+ *
+ * That file `import.meta.glob`s every component of the module so a page can
+ * resolve one by name. A few of them (StatusPill, MonoCell, IdentityCell: the
+ * table cell renderers) are also imported statically by the entry, which is
+ * what a cell renderer needs at hydration. The glob entry then resolves to the
+ * chunk already loaded: nothing is duplicated and nothing was meant to be
+ * lazy, and nobody can act on the notice. A `import()` a module author
+ * writes by hand for a file that is also imported statically is the same
+ * mistake with a different cause (the lazy load never happens), and still
+ * warns.
+ *
+ * @param {string} level
+ * @param {{ code?: string, ids?: string[] }} log
+ * @param {(level: string, log: object) => void} defaultHandler
+ */
+export function onBuildLog(level, log, defaultHandler) {
+  if (
+    log.code === "INEFFECTIVE_DYNAMIC_IMPORT" &&
+    log.ids?.length &&
+    MODULE_ENTRY.test(log.ids[0])
+  ) {
+    return;
+  }
+  defaultHandler(level, log);
+}

package/templates/vue/email-renderer.ts

@@ -6,6 +6,7 @@ import { appConfigs } from "./app-configs.generated";
 import moduleRegistry from "./generated-frontend-modules.json";
 import { loadEmailLocaleMessages } from "./email-locales";
 import { stripSsrMarkers } from "./email-markup";
+import { parsePublicOptions } from "./public-options";
 
 interface EmailModule {
   default: Component;
@@ -20,6 +21,8 @@ interface EmailRenderOptions {
   locale?: string;
 }
 
+const runtimeOptions = parsePublicOptions(process.env.DMS_PUBLIC_OPTIONS);
+
 const registries = import.meta.glob<EmailRegistry>(
   "/frontend-modules/*/dms.email.ts",
   { eager: true },
@@ -157,7 +160,9 @@ export async function renderEmail(
   app.provide("dmsEmailAppConfig", defu({}, ...emailAppConfigs));
   const publicConfig = defu(
     {},
-    ...moduleRegistry.modules.map((module) => module.options),
+    ...moduleRegistry.modules.map(
+      (module) => runtimeOptions?.[module.id] ?? module.options,
+    ),
   );
   app.provide("dmsEmailRuntimeConfig", {
     public: defu(

package/templates/vue/frontend-build-loader.ts

@@ -1,6 +1,6 @@
 import { isAbsolute, posix, resolve } from "node:path";
 import { normalizePath } from "vite";
-import type { DmsFrontendBuildSetup } from "./frontend-build";
+import type { DmsFrontendBuildSetup } from "./frontend-build.ts";
 
 /** A module's `dms.frontend.build.ts`, as the generated loader imports it. */
 export interface FrontendBuildDeclaration {

package/templates/vue/frontend-module.ts

@@ -55,6 +55,7 @@ import {
   mergeLayerAppConfigs,
   withAppConfigChanges,
 } from "./layer-app-config";
+import type { DmsPublicOptionsById } from "./public-options";
 
 export interface DmsPageRoute {
   displayName?: string;
@@ -457,11 +458,34 @@ export interface DmsFrontendModule {
   setup(sdk: DmsFrontendSdk): void | Promise<void>;
 }
 export interface DmsFrontendModuleRegistration {
+  /** The module's id in the generated module registry. */
+  id?: string;
   /** The module's manifest name, which collision warnings name it by. */
   name?: string;
   module: DmsFrontendModule;
   options: DmsModuleOptions;
 }
+
+/**
+ * The registrations with the public options the server runs with in place of
+ * the build's: `ajs dms start` computes them from the project's configuration
+ * and the deployment's variables. Unset, the build's options stand.
+ */
+export function withPublicOptions(
+  registrations: DmsFrontendModuleRegistration[],
+  byId: DmsPublicOptionsById | undefined,
+): DmsFrontendModuleRegistration[] {
+  if (!byId) return registrations;
+  return registrations.map((registration) => {
+    const options = registration.id ? byId[registration.id] : undefined;
+    return options
+      ? {
+          ...registration,
+          options: { ...registration.options, public: options },
+        }
+      : registration;
+  });
+}
 /** A layer's `app/app.config.ts`, as `app-configs.generated.ts` lists them. */
 export interface DmsLayerAppConfig {
   /** The id of the frontend module the layer belongs to. */