@antelopejs/dms-frontend 0.9.1 → 0.9.3

package/templates/vue/server/public-endpoints.mjs

@@ -2,18 +2,23 @@ import { readFileSync } from "node:fs";
 import { json } from "./auth/backend.mjs";
 import { CROSS_ORIGIN_ERROR, isSameOrigin } from "./auth/client-ip.mjs";
 
-// Written at the workspace root by the loader, from the endpoints each backend
-// module declared in the frontend manifest. This file sits one directory up.
+/**
+ * Written at the workspace root by the loader, from the endpoints each
+ * backend module declared in the frontend manifest. This file sits one
+ * directory up.
+ */
 const DECLARED_ENDPOINTS_FILE = new URL(
   "../generated-public-endpoints.json",
   import.meta.url,
 );
 
-// An absolute backend API path whose first segment is literal (a `*` there
-// would open a route of every module) and whose next ones are literal or `*`
-// (exactly one segment): no prefix match, no query string, no segment that
-// climbs out. Kept in step with `PUBLIC_PATH` in the DMS
-// (`frontend-public-endpoints.ts`), which validates the modules' declarations.
+/**
+ * An absolute backend API path whose first segment is literal (a `*` there
+ * would open a route of every module) and whose next ones are literal or `*`
+ * (exactly one segment): no prefix match, no query string, no segment that
+ * climbs out. Kept in step with `PUBLIC_PATH` in the DMS
+ * (`frontend-public-endpoints.ts`), which validates the modules' declarations.
+ */
 const PUBLIC_PATH =
   /^\/api\/[A-Za-z0-9][A-Za-z0-9._~-]*(?:\/(?:\*|[A-Za-z0-9][A-Za-z0-9._~-]*))*$/;
 const SEGMENT_WILDCARD = "*";
@@ -27,9 +32,11 @@ const ALLOWED_METHODS = new Set([
   "DELETE",
 ]);
 const DEFAULT_METHODS = ["POST"];
-// A declared header is a module's own `x-` header. Those the proxy, a reverse
-// proxy or the backend give a meaning to are never taken from the caller.
-// Kept in step with the DMS's `RESERVED_HEADER`.
+/**
+ * A declared header is a module's own `x-` header. Those the proxy, a
+ * reverse proxy or the backend give a meaning to are never taken from the
+ * caller. Kept in step with the DMS's `RESERVED_HEADER`.
+ */
 const HEADER_NAME = /^x-[a-z0-9-]+$/;
 const RESERVED_HEADER =
   /^x-(?:forwarded-|real-ip$|dms-|inertia|http-method|method-override|original-|rewrite-)/;
@@ -56,6 +63,8 @@ export function readDeclaredPublicEndpoints(file = DECLARED_ENDPOINTS_FILE) {
  * The backend proxies the backend modules declared in the manifest, as
  * `{ module, path, auth?, maxBodyBytes? }`, unchecked.
  *
+ * A missing or broken file declares no proxy.
+ *
  * @param file Generated file to read
  */
 export function readDeclaredBackendProxies(file = DECLARED_ENDPOINTS_FILE) {
@@ -65,16 +74,15 @@ export function readDeclaredBackendProxies(file = DECLARED_ENDPOINTS_FILE) {
   try {
     const parsed = JSON.parse(readFileSync(file, "utf8"));
     if (Array.isArray(parsed?.proxies)) proxies = parsed.proxies;
-  } catch {
-    // No file, or a broken one: no proxy declared.
-  }
+  } catch {}
   if (file === DECLARED_ENDPOINTS_FILE) declaredProxies = proxies;
   return proxies;
 }
 
 /**
  * The backend proxies `DMS_BACKEND_PROXIES` adds: a JSON array of
- * `{ path, auth?, maxBodyBytes? }`, as the manifest's `backendProxies`, for an operator.
+ * `{ path, auth?, maxBodyBytes? }`, as the manifest's `backendProxies`, for an
+ * operator. A value that is not a JSON array is reported and ignored.
  *
  * @param declaration The variable's value
  */
@@ -89,9 +97,7 @@ export function environmentBackendProxies(
         ...entry,
         module: "DMS_BACKEND_PROXIES",
       }));
-  } catch {
-    // Reported below.
-  }
+  } catch {}
   console.warn("Ignoring DMS_BACKEND_PROXIES: not a JSON array");
   return [];
 }
@@ -180,8 +186,10 @@ export function allowedPublicEndpoints(
   );
 }
 
-// Compiled once per value of the environment variable, so a malformed entry
-// is reported once rather than on every request.
+/**
+ * Compiled once per value of the environment variable, so a malformed entry
+ * is reported once rather than on every request.
+ */
 let compiled;
 
 function currentPublicEndpoints() {

package/templates/vue/server/public-options.mjs

@@ -1,9 +1,3 @@
-// The modules' public options the running server serves: computed by
-// `ajs dms start` from the project's configuration and handed over in
-// `DMS_PUBLIC_OPTIONS`, a JSON object of options by module id. A build never
-// holds them, so a deployment's variables reach the dashboard without a
-// rebuild. Unset (`ajs dms dev`), the registry's options stand.
-
 const VARIABLE = "DMS_PUBLIC_OPTIONS";
 export const PUBLIC_OPTIONS_ELEMENT_ID = "dms-public-options";
 
@@ -22,7 +16,15 @@ function parse(raw) {
   }
 }
 
-/** The options by module id the server runs with, undefined when unset. */
+/**
+ * The options by module id the server runs with, undefined when unset.
+ *
+ * The modules' public options the running server serves: computed by `ajs
+ * dms start` from the project's configuration and handed over in
+ * `DMS_PUBLIC_OPTIONS`, a JSON object of options by module id. A build never
+ * holds them, so a deployment's variables reach the dashboard without a
+ * rebuild. Unset (`ajs dms dev`), the registry's options stand.
+ */
 export const RUNTIME_PUBLIC_OPTIONS = parse(process.env[VARIABLE]);
 
 /** The options of each module of the registry, the runtime ones first. */

package/templates/vue/server/request-failure.mjs

@@ -1,9 +1,3 @@
-// Answers for requests the server cannot serve at all: an unreadable URL, or a
-// failure while it was already rendering the error page.
-//
-// Lives apart from server.mjs so the file stays under the size the linter
-// allows.
-
 const FRONTEND_ORIGIN = "http://frontend.local";
 const TEXT_TYPE = "text/plain; charset=utf-8";
 
@@ -33,6 +27,10 @@ export function isResponseGone(error, response) {
   );
 }
 
+/**
+ * Answers for requests the server cannot serve at all: an unreadable URL, or
+ * a failure while it was already rendering the error page.
+ */
 export function writeBadRequest(response) {
   response.writeHead(400, { "content-type": TEXT_TYPE });
   response.end("Bad Request");

package/templates/vue/server/request-routing.mjs

@@ -1,14 +1,3 @@
-// Who answers a request: one owner per path, whoever asks and whatever the
-// method, in this order:
-//
-// 1. the renderer: its icon endpoint, Vite's URLs and the built assets, and
-//    any file it has (a development source, a built asset);
-// 2. the module routes of the modules' `dms.server.ts`;
-// 3. the backend proxies the modules declare (`registerBackendProxy`, the
-//    manifest's `backendProxies`);
-// 4. the pages, for everything else: a method other than `GET` and `HEAD` on a
-//    page path is a `404`.
-
 import { matchBackendProxy } from "./backend-proxies.mjs";
 import { isRendererFilePath, moduleRouteMethods } from "./module-routes.mjs";
 
@@ -17,6 +6,14 @@ const PAGE_METHODS = new Set(["GET", "HEAD"]);
 /**
  * The owner of a request.
  *
+ * Who answers a request: one owner per path, whoever asks and whatever the
+ * method, in this order: 1. the renderer: its icon endpoint, Vite's URLs and
+ * the built assets, and any file it has (a development source, a built asset);
+ * 2. the module routes of the modules' `dms.server.ts`; 3. the backend proxies
+ * the modules declare (`registerBackendProxy`, the manifest's
+ * `backendProxies`); 4. the pages, for everything else: a method other than
+ * `GET` and `HEAD` on a page path is a `404`.
+ *
  * @param method The request's method
  * @param pathname The request's normalized path
  * @param modules What `loadServerModules` returned: `routes` and `proxies`

package/templates/vue/server/request-target.mjs

@@ -1,11 +1,5 @@
 import { writeBadRequest } from "./request-failure.mjs";
 
-// The request target as the server reads it. Node hands `request.url` over
-// verbatim, so it is not always a path: `//host/x`, `/\host/x` and the
-// absolute form `http://host/x` all name another host once resolved, which
-// turned the proxy into an open one. Every routing decision and the URL sent to
-// the backend read the same normalized path from here.
-
 const FRONTEND_ORIGIN = "http://frontend.local";
 
 /**
@@ -45,6 +39,12 @@ export function backendUrl(
 /**
  * Answers 400 to a request whose target is not origin-form, before any route
  * reads it. Returns whether it answered.
+ *
+ * The request target as the server reads it. Node hands `request.url` over
+ * verbatim, so it is not always a path: `//host/x`, `/\host/x` and the absolute
+ * form `http://host/x` all name another host once resolved, which turned the
+ * proxy into an open one. Every routing decision and the URL sent to the
+ * backend read the same normalized path from here.
  */
 export function refuseForeignTarget(request, response) {
   if (isOriginForm(request.url)) return false;

package/templates/vue/server/route-rules.mjs

@@ -1,7 +1,3 @@
-// Route rules the modules declare in their `dms.server.ts`: how a page is
-// rendered and which headers its document and Inertia answers carry. They
-// change rendering and caching, never who may see a page.
-
 import { compilePathPattern } from "./path-patterns.mjs";
 
 const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9a-z-]+$/;
@@ -60,7 +56,13 @@ function cacheRejection(cache) {
   return undefined;
 }
 
-/** Why a rule is ignored, or `undefined`. */
+/**
+ * Why a rule is ignored, or `undefined`.
+ *
+ * Route rules the modules declare in their `dms.server.ts`: how a page is
+ * rendered and which headers its document and Inertia answers carry. They
+ * change rendering and caching, never who may see a page.
+ */
 export function ruleRejection(pattern, rule) {
   if (!compilePathPattern(pattern))
     return "the pattern is not /x, /x/* or /x/**";

package/templates/vue/server/static-files.mjs

@@ -1,9 +1,11 @@
 import { createReadStream, existsSync, statSync } from "node:fs";
 import { extname } from "node:path";
 
-// What a build or a module's `public/` directory may hold. A type missing
-// here went out as `application/octet-stream`: fonts among them, which a
-// browser then reports as a mismatch against the `font/woff2` it preloaded.
+/**
+ * What a build or a module's `public/` directory may hold. A type missing
+ * here went out as `application/octet-stream`: fonts among them, which a
+ * browser then reports as a mismatch against the `font/woff2` it preloaded.
+ */
 const MIME_TYPES = {
   ".avif": "image/avif",
   ".css": "text/css",
@@ -32,12 +34,16 @@ const MIME_TYPES = {
   ".xml": "application/xml",
 };
 const DEFAULT_MIME_TYPE = "application/octet-stream";
-// Vite names everything under `assets/` after its content: a new build
-// writes new names, so a client never needs to ask again.
+/**
+ * Vite names everything under `assets/` after its content: a new build
+ * writes new names, so a client never needs to ask again.
+ */
 const IMMUTABLE_CACHE = "public, max-age=31536000, immutable";
-// Any other file keeps its name across builds (a module's `public/` file,
-// a favicon): the client asks again on each use, and is answered 304 while
-// it has not changed.
+/**
+ * Any other file keeps its name across builds (a module's `public/` file, a
+ * favicon): the client asks again on each use, and is answered 304 while it
+ * has not changed.
+ */
 const REVALIDATED_CACHE = "no-cache";
 
 const isFile = (path) => existsSync(path) && statSync(path).isFile();
@@ -62,7 +68,11 @@ function entityTag(stats) {
 
 const opaqueTag = (tag) => tag.trim().replace(/^W\//, "");
 
-/** RFC 9110 §13.1.2 and §13.1.3: `If-None-Match` first, the date otherwise. */
+/**
+ * RFC 9110 §13.1.2 and §13.1.3: `If-None-Match` first, the date otherwise.
+ *
+ * The header has a one-second resolution.
+ */
 function isNotModified(request, tag, stats) {
   const noneMatch = request.headers["if-none-match"];
   if (noneMatch !== undefined) {
@@ -73,7 +83,6 @@ function isNotModified(request, tag, stats) {
       .some((candidate) => opaqueTag(candidate) === wanted);
   }
   const since = Date.parse(request.headers["if-modified-since"] ?? "");
-  // The header has a one-second resolution.
   return (
     !Number.isNaN(since) && Math.floor(stats.mtimeMs / 1000) * 1000 <= since
   );

package/templates/vue/server/web-body.mjs

@@ -1,7 +1,3 @@
-// Writes a Web-standard body, a backend answer above all, to a Node response.
-//
-// Lives apart from the proxy and the module routes, which both send one.
-
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 
@@ -12,6 +8,9 @@ import { pipeline } from "node:stream/promises";
  * listener, and its next failure (the backend closing, or undici's body
  * timeout on an event stream gone quiet) ended the whole server. The body is
  * cancelled instead, which closes its backend connection too.
+ *
+ * Writes a Web-standard body, a backend answer above all, to a Node response.
+ * It lives apart from the proxy and the module routes, which both send one.
  */
 export async function pipeWebBody(body, ...streams) {
   const response = streams.at(-1);

package/templates/vue/server.mjs

@@ -82,17 +82,26 @@ const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 const LOCAL_ROUTES = [[icons.isIconRequest, icons.handleIcons]];
 const CLIENT_ROOT = join(PROJECT_ROOT, "dist/client");
 const SOURCE_TEMPLATE_PATH = join(PROJECT_ROOT, "index.html");
-// A URL, not a path: on Windows, `import()` reads `C:\...` as a URL whose
-// scheme is `c:` and refuses it.
+/**
+ * A URL, not a path: on Windows, `import()` reads `C:\...` as a URL whose
+ * scheme is `c:` and refuses it.
+ */
 const BUILT_SSR_RENDERER_URL = new URL(
   "dist/ssr/ssr-renderer.js",
   import.meta.url,
 );
-// The SSR bundle keeps vue-i18n external, so Node loads its esm-bundler build,
-// which reads compile-time flags only a bundler replaces. Vite inlines them in
-// the client bundle; without the same value here, installing vue-i18n under
-// NODE_ENV=production throws a ReferenceError on the first render.
-globalThis.__VUE_PROD_DEVTOOLS__ ??= false;
+
+/**
+ * The SSR bundle keeps vue-i18n external, so Node loads its esm-bundler build,
+ * which reads compile-time flags only a bundler replaces. Vite inlines them in
+ * the client bundle; without the same value here, installing vue-i18n under
+ * NODE_ENV=production throws a ReferenceError on the first render.
+ */
+function defineVueCompileFlags() {
+  globalThis.__VUE_PROD_DEVTOOLS__ ??= false;
+}
+
+defineVueCompileFlags();
 let productionSsrRenderer;
 let vite;
 let vitePromise;
@@ -105,7 +114,6 @@ async function developmentServer() {
     .then(({ createServer: createViteServer }) => {
       const serverOptions = {
         middlewareMode: true,
-        // The generated secrets and the modules' server code, never served.
         fs: { deny: DEV_FS_DENY },
       };
       if (frontendHttpServer) serverOptions.ws = { server: frontendHttpServer };
@@ -206,6 +214,16 @@ function redirectSignedOutPrivatePage(request, response, props, auth) {
  * Sends a request to the backend through the proxy it reached.
  * `isProxiedPath` says which backend paths a relayed `Location` may name on
  * the frontend's origin.
+ *
+ * A client that left while the request was routed closed the response already,
+ * and would never abort the request below.
+ *
+ * Cancelling the body alone misses a client that leaves before the backend
+ * answers: its stream, an SSE feed above all, then stayed open for good.
+ *
+ * A backend redirect is the browser's to follow: Media sends a file's link to
+ * the storage's signed URL, on the public origin the server itself may not
+ * reach, which turned every download into a 502.
  */
 async function proxy(request, response, backendProxy, isProxiedPath) {
   const access = proxyAccess(request, SAFE_METHODS, backendProxy);
@@ -213,11 +231,7 @@ async function proxy(request, response, backendProxy, isProxiedPath) {
     refuseCrossOrigin(response);
     return true;
   }
-  // A client that left while the request was routed closed the response
-  // already, and would never abort the request below.
   if (response.closed) return;
-  // Cancelling the body alone misses a client that leaves before the backend
-  // answers: its stream, an SSE feed above all, then stayed open for good.
   const abandoned = new AbortController();
   response.once("close", () => abandoned.abort());
   const init = {
@@ -225,9 +239,6 @@ async function proxy(request, response, backendProxy, isProxiedPath) {
     method: request.method,
     headers: { ...backendHeaders(request, access), ...PLAIN_ANSWER_HEADERS },
     duplex: "half",
-    // A backend redirect is the browser's to follow: Media sends a file's
-    // link to the storage's signed URL, on the public origin the server
-    // itself may not reach, which turned every download into a 502.
     redirect: "manual",
   };
   const upstream = await sendWithinLimit(
@@ -409,11 +420,12 @@ async function answeredByVite(devServer, request, response) {
  * Whether the renderer has a file at `pathname`: a development source Vite
  * serves (under the workspace or its `public/`), or a built asset the
  * production server serves. Only a path with an extension names one.
+ *
+ * The path is decoded as Vite and the asset server read it: `%2E` is a dot.
  */
 function hasRendererFile(devServer, requested) {
   let pathname;
   try {
-    // As Vite and the asset server read it: `%2E` is a dot.
     pathname = decodeURIComponent(requested);
   } catch {
     return false;
@@ -519,12 +531,12 @@ async function writeRequestFailure(error, request, response) {
   await writeBackendError(error, request, response);
 }
 
+/** An error page failing too must not reject: that would end the process. */
 export async function handleRequestSafely(request, response) {
   try {
     if (refuseForeignTarget(request, response)) return;
     await handleRequest(request, response);
   } catch (error) {
-    // An error page failing too must not reject: that would end the process.
     await writeRequestFailure(error, request, response).catch((failure) =>
       requestFailure.abandonResponse(failure, response),
     );
@@ -564,6 +576,9 @@ async function reportRouting() {
  * Report the server ready. In development Vite would otherwise start with the
  * first request, so it is started here: "ready" then means the first page is
  * served without that wait.
+ *
+ * Only the production build produces the email bundle otherwise. The watcher
+ * starts once the server answers, so it never delays the first page.
  */
 async function announceReady() {
   try {
@@ -575,7 +590,5 @@ async function announceReady() {
   const { address, port } = frontendHttpServer.address();
   await reportReady(address, port);
   await reportRouting();
-  // Only the production build produces the email bundle otherwise. Started
-  // once the server answers, so it never delays the first page.
   if (process.env.DMS_DEV === "true") watchEmailBundle();
 }

package/templates/vue/sfc-global-types.mjs

@@ -1,24 +1,12 @@
-// Vue's SFC compiler turns `defineProps<Props>()` into runtime prop types, and
-// it reads a type from the component's own imports only. A type a module
-// auto-imports (its declared `app/types`, `app/composables`…, and Vue's own
-// `Ref`, `Component`…) is visible to TypeScript through auto-imports.d.ts but
-// not to the compiler, which drops it from the prop without a word:
-// `boolean | RowActionConfig` became `{ type: Boolean }` in a production build.
-//
-// The compiler does read ambient declarations from `script.globalTypeFiles`,
-// but not the `export type { … } from` re-exports auto-imports.d.ts is made
-// of. This writes those types as ambient aliases it can follow, from the same
-// directories and through the same scanner as the auto-imports, before Vite
-// compiles anything, and rewrites them when a dev server sees a module's
-// declared directories change.
-
 import { readFileSync, renameSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 
-// The very unimport the auto-import plugin scans with, so both read the
-// directories the same way. Imported by URL, not by path: on Windows,
-// `import()` reads `C:\...` as a URL whose scheme is `c:` and refuses it.
+/**
+ * The very unimport the auto-import plugin scans with, so both read the
+ * directories the same way. Imported by URL, not by path: on Windows,
+ * `import()` reads `C:\...` as a URL whose scheme is `c:` and refuses it.
+ */
 const unimportUrl = pathToFileURL(
   createRequire(
     createRequire(import.meta.url).resolve("unplugin-auto-import/package.json"),
@@ -41,6 +29,19 @@ const withoutExtension = (path) => path.replace(/\.[cm]?[jt]sx?$/, "");
  * the last of two imports of the same name. A module that exports its own
  * `Component` thus shadows Vue's, for the compiler as for TypeScript.
  *
+ * Vue's SFC compiler turns `defineProps<Props>()` into runtime prop types and
+ * reads a type from the component's own imports only. A type a module auto-
+ * imports (its declared `app/types`, `app/composables`..., and Vue's own `Ref`,
+ * `Component`...) is visible to TypeScript through auto-imports.d.ts but not to
+ * the compiler, which drops it from the prop without a word: `boolean |
+ * RowActionConfig` became `{ type: Boolean }` in a production build. The
+ * compiler does read ambient declarations from `script.globalTypeFiles`, but
+ * not the `export type { ... } from` re-exports auto-imports.d.ts is made of.
+ * These types are therefore written as ambient aliases it can follow, from the
+ * same directories and through the same scanner as the auto-imports, before
+ * Vite compiles anything, and rewritten when a dev server sees a module's
+ * declared directories change.
+ *
  * @param {(string | { glob: string, types?: boolean })[]} dirs the auto-import
  *   directories, as handed to the auto-import plugin
  * @param {string} cwd the workspace
@@ -61,6 +62,11 @@ export async function sfcGlobalTypes(dirs, cwd) {
   return `${HEADER}${[...aliases.values()].join("\n")}\n`;
 }
 
+/**
+ * Written through a temporary file: a build starting meanwhile reads the
+ * previous declarations or the new ones, never a half-written file the
+ * compiler would then keep in its cache.
+ */
 function writeIfChanged(file, content) {
   let current;
   try {
@@ -69,9 +75,6 @@ function writeIfChanged(file, content) {
     current = undefined;
   }
   if (current === content) return false;
-  // Through a temporary file: a build starting meanwhile reads the previous
-  // declarations or the new ones, never a half-written file the compiler
-  // would then keep in its cache.
   const temporary = `${file}.${process.pid}.tmp`;
   writeFileSync(temporary, content);
   renameSync(temporary, file);
@@ -87,6 +90,10 @@ export async function writeSfcGlobalTypes(dirs, cwd, file) {
  * Keeps the declarations in step on a dev server: a type file added, renamed
  * or removed rewrites them, and the Vue plugin reloads the components whose
  * props read the file.
+ *
+ * The file is under the workspace, which Vite watches: rewriting it is the
+ * change the Vue plugin reloads the dependent components on. A failed scan or
+ * write keeps the previous declarations, since it must not end the dev server.
  */
 export function sfcGlobalTypesWatcher(dirs, cwd, file) {
   return {
@@ -98,10 +105,6 @@ export function sfcGlobalTypesWatcher(dirs, cwd, file) {
         if (!/\.[cm]?[jt]sx?$/.test(path) || path === file) return;
         clearTimeout(pending);
         pending = setTimeout(() => {
-          // The file is under the workspace, which Vite watches: rewriting it
-          // is the change the Vue plugin reloads the dependent components on.
-          // A failed scan or write keeps the previous declarations: it must
-          // not end the dev server.
           sfcGlobalTypes(dirs, cwd)
             .then((content) => writeIfChanged(file, content))
             .catch((error) =>

package/templates/vue/ssr-renderer.ts

@@ -30,6 +30,7 @@ import {
   trackDmsServerScopes,
   withPublicOptions,
 } from "./frontend-module";
+import { type DmsMessageSubset, SSR_MESSAGES_ID } from "./message-subset";
 import { parsePublicOptions } from "./public-options";
 import { frontendModules } from "./frontend-modules.generated";
 import {
@@ -129,6 +130,12 @@ function asyncComponentsScript(names: Set<string>): string {
   return `<script id="${SSR_ASYNC_COMPONENTS_ID}" type="application/json">${value}</script>`;
 }
 
+function messagesScript(subset: DmsMessageSubset | undefined): string {
+  if (!subset) return "";
+  const value = JSON.stringify(subset).replaceAll("<", "\\u003c");
+  return `<script id="${SSR_MESSAGES_ID}" type="application/json">${value}</script>`;
+}
+
 function iconsScript(names: Set<string>): string {
   const value = JSON.stringify(serializeDmsIcons(names)).replaceAll(
     "<",
@@ -195,6 +202,7 @@ async function renderDmsPageWithRuntime(
     let iconSymbols = new Map<string, string>();
     let payload: DmsPayload = { data: {}, errors: {}, state: {} };
     let catalogLocale: (() => string | undefined) | undefined;
+    let messageSubset: (() => DmsMessageSubset | undefined) | undefined;
     const inertiaResult = await createInertiaApp({
       page,
       // Read as the HTML is complete: data a run settles afterwards was never
@@ -221,6 +229,7 @@ async function renderDmsPageWithRuntime(
           serverFetch,
         });
         catalogLocale = configured.catalogLocale;
+        messageSubset = configured.messageSubset;
         return app;
       },
     });
@@ -255,7 +264,7 @@ async function renderDmsPageWithRuntime(
     const renderedHead = await renderSSRHead(head);
     return {
       error: page.props.error,
-      body: `${inertiaResult.body}${dmsIconSprite(iconSymbols)}${payloadScript(payload)}${asyncComponentsScript(asyncComponents)}${iconsScript(icons)}`,
+      body: `${inertiaResult.body}${dmsIconSprite(iconSymbols)}${payloadScript(payload)}${asyncComponentsScript(asyncComponents)}${iconsScript(icons)}${messagesScript(messageSubset?.())}`,
       head: {
         bodyAttrs: renderedHead.bodyAttrs,
         headTags: `${inertiaResult.head.join("")}${renderedHead.headTags}`,

package/templates/vue/ui-inertia-page.mjs

@@ -1,10 +1,3 @@
-// Nuxt UI reads Inertia's page (`usePage()`) for its links and route stub.
-// Inertia's page is module state, shared by the concurrent requests of a
-// server: a render could read another request's URL. Nuxt UI's files read
-// the DMS's per-request page instead, and the build fails if one reads
-// Inertia's in a form this rewrite does not know, rather than letting the
-// leak come back unnoticed with a Nuxt UI release.
-
 const INERTIA_PAGE_IMPORT =
   /import\s*\{\s*usePage\s*\}\s*from\s*["']@inertiajs\/vue3["']/g;
 const DMS_PAGE_IMPORT =
@@ -16,6 +9,13 @@ const ANY_INERTIA_PAGE_IMPORT =
 /**
  * The rewrite, as a Vite plugin.
  *
+ * Nuxt UI reads Inertia's page (`usePage()`) for its links and route stub.
+ * Inertia's page is module state, shared by the concurrent requests of a
+ * server: a render could read another request's URL. Nuxt UI's files read the
+ * DMS's per-request page instead, and the build fails if one reads Inertia's in
+ * a form this rewrite does not know, rather than letting the leak come back
+ * unnoticed with a Nuxt UI release.
+ *
  * @param isNuxtUiFile `(id) => boolean`, whether a module is Nuxt UI's
  */
 export function uiInertiaPage(isNuxtUiFile) {

package/templates/vue/ui-kbd.mjs

@@ -1,13 +1,3 @@
-// Nuxt UI prints the `meta`, `ctrl` and `alt` of a key hint (`UKbd`, the
-// `kbds` of its menus) from a map every hint shares, blank until the first
-// hint mounts: a hint hydrating after that, in an async component, printed
-// "⌘" or "Ctrl" over the server's blank, a hydration mismatch on every
-// platform. Its `useKbd` is routed to the DMS runtime's `useDmsKbd`, which
-// keeps each hint on the server's value until it mounts and lets the
-// application give the platform to the server render
-// (`provideDmsKbdPlatform`). The build fails if Nuxt UI changes the form
-// rewritten here, rather than letting the mismatch come back unnoticed.
-
 /** Nuxt UI's key hint composable. */
 const USE_KBD = /\/@nuxt\/ui\/dist\/runtime\/composables\/useKbd\.js$/;
 /** Its export as Nuxt UI 4 writes it: one composable shared by every hint. */
@@ -21,6 +11,16 @@ const ROUTED_EXPORT =
 /**
  * The rewrite, as a Vite plugin.
  *
+ * Nuxt UI prints the `meta`, `ctrl` and `alt` of a key hint (`UKbd`, the `kbds`
+ * of its menus) from a map every hint shares, blank until the first hint
+ * mounts: a hint hydrating after that, in an async component, printed "⌘" or
+ * "Ctrl" over the server's blank, a hydration mismatch on every platform. Its
+ * `useKbd` is routed to the DMS runtime's `useDmsKbd`, which keeps each hint on
+ * the server's value until it mounts and lets the application give the platform
+ * to the server render (`provideDmsKbdPlatform`). The build fails if Nuxt UI
+ * changes the form rewritten here, rather than letting the mismatch come back
+ * unnoticed.
+ *
  * @param isNuxtUiFile `(id) => boolean`, whether a module is Nuxt UI's
  */
 export function uiKbd(isNuxtUiFile) {