@antelopejs/dms-frontend 0.9.2 → 0.10.0

package/templates/vue/client-server-guard.mjs

@@ -2,11 +2,20 @@ import { relative, sep } from "node:path";
 
 const SERVER_ENTRY = /(?:^|[\\/])dms\.server\.[cm]?[jt]sx?$/;
 
+/**
+ * @param {string} id
+ * @returns {string}
+ */
 function stripQuery(id) {
   const query = id.indexOf("?");
   return query === -1 ? id : id.slice(0, query);
 }
 
+/**
+ * @param {string} file
+ * @param {readonly string[]} moduleRoots
+ * @returns {boolean}
+ */
 function insideModuleServerDirectory(file, moduleRoots) {
   return moduleRoots.some((root) => {
     const path = relative(root, file);
@@ -20,6 +29,10 @@ function insideModuleServerDirectory(file, moduleRoots) {
  * Whether `id`, a resolved module id, is server code: a module's server entry
  * (`dms.server.*`) or a file under a `server/` directory of a module. Installed
  * packages never are: `node_modules` has its own `server` directories.
+ *
+ * @param {string} id
+ * @param {readonly string[]} moduleRoots
+ * @returns {boolean}
  */
 export function isServerSource(id, moduleRoots) {
   if (id.startsWith("\0")) return false;
@@ -44,6 +57,9 @@ export function isServerSource(id, moduleRoots) {
  * import; the guard sits in the module graph instead, where every resolved file
  * passes. Kept beside vite.config.ts rather than inside it so the plugin can be
  * exercised on its own, the way head-order.mjs is.
+ *
+ * @param {readonly string[]} moduleRoots
+ * @returns {import("vite").Plugin}
  */
 export function rejectServerSourcesInClient(moduleRoots) {
   let ssrBuild = false;

package/templates/vue/compress-assets.mjs

@@ -16,10 +16,14 @@ const MINIMUM_SIZE_BYTES = 1_024;
 const compressBrotli = promisify(brotliCompress);
 const compressGzip = promisify(gzip);
 
+/**
+ * @param {string} directory
+ * @returns {Promise<string[]>}
+ */
 async function assetFiles(directory) {
   const entries = await readdir(directory, { withFileTypes: true });
   const files = await Promise.all(
-    entries.map((entry) => {
+    entries.map(async (entry) => {
       const path = join(directory, entry.name);
       return entry.isDirectory() ? assetFiles(path) : [path];
     }),
@@ -27,6 +31,10 @@ async function assetFiles(directory) {
   return files.flat();
 }
 
+/**
+ * @param {string} path
+ * @returns {Promise<void>}
+ */
 async function compressAsset(path) {
   if (!COMPRESSIBLE_EXTENSIONS.has(extname(path))) return;
   const content = await readFile(path);

package/templates/vue/entry-weight.mjs

@@ -10,11 +10,20 @@ export const TRANSLATIONS_OWNER = "translations";
 
 const LOCALE_CATALOG = /[\\/]locales\.generated[\\/]/;
 
+/**
+ * @param {string} id
+ * @returns {string}
+ */
 function stripQuery(id) {
   const query = id.indexOf("?");
   return query === -1 ? id : id.slice(0, query);
 }
 
+/**
+ * @param {string} root
+ * @param {string} file
+ * @returns {boolean}
+ */
 function isInside(root, file) {
   const path = relative(root, file);
   return Boolean(path) && !path.startsWith("..") && !path.startsWith(sep);
@@ -26,7 +35,9 @@ function isInside(root, file) {
  * what every page shares (the renderer's runtime, the UI and icon libraries,
  * an installed package).
  *
+ * @param {string} id
  * @param {{ root: string, name?: string, packageName?: string, id: string }[]} modules
+ * @returns {string}
  */
 export function entryOwner(id, modules) {
   if (id.startsWith("\0")) return SHARED_OWNER;
@@ -42,13 +53,18 @@ export function entryOwner(id, modules) {
 /**
  * The files a page loads before its first line runs: the entry chunks and
  * their static imports, transitively, by file name.
+ *
+ * @param {import("vite").Rollup.OutputBundle} bundle
+ * @returns {(import("vite").Rollup.OutputChunk | undefined)[]}
  */
 function entryClosure(bundle) {
   const chunks = Object.values(bundle).filter(
     (output) => output.type === "chunk",
   );
   const byName = new Map(chunks.map((chunk) => [chunk.fileName, chunk]));
+  /** @type {Set<string>} */
   const seen = new Set();
+  /** @param {import("vite").Rollup.OutputChunk | undefined} chunk */
   const visit = (chunk) => {
     if (!chunk || seen.has(chunk.fileName)) return;
     seen.add(chunk.fileName);
@@ -64,10 +80,13 @@ function entryClosure(bundle) {
  * rendered for each (`renderedLength`, before minification): an estimate that
  * needs nothing the bundle does not already hold.
  *
+ * @param {import("vite").Rollup.OutputBundle} bundle
+ * @param {{ root: string, name?: string, packageName?: string, id: string }[]} modules
  * @returns {{ files: string[], bytes: number, owners: Record<string, number> }}
  */
 export function attributeEntry(bundle, modules) {
   const files = entryClosure(bundle);
+  /** @type {Record<string, number>} */
   const owners = {};
   let bytes = 0;
   for (const chunk of files) {
@@ -109,6 +128,9 @@ export function attributeEntry(bundle, modules) {
  *
  * The weight is recorded once the bundle is written: plugins that generate the
  * bundle after this one still rewrite the chunks' code.
+ *
+ * @param {{ root: string, name?: string, packageName?: string, id: string }[]} modules
+ * @returns {import("vite").Plugin}
  */
 export function recordEntryWeight(modules) {
   let ssrBuild = false;

package/templates/vue/frontend-module.ts

@@ -34,6 +34,7 @@ export type {
   DmsFetchTransformContext,
   UseAsyncDataOptions,
   UseFetchOptions,
+  DmsServerFetch,
   DmsErrorData,
   DmsPayload,
   DmsStateOptions,

package/templates/vue/frontend-runtime/module-registration.ts

@@ -1,5 +1,4 @@
 import { usePage } from "@inertiajs/vue3";
-import { ofetch } from "ofetch";
 import {
   type Component,
   type EffectScope,
@@ -19,6 +18,7 @@ import {
   type DmsPluginRegistrationOptions,
   type DmsPluginSetup,
   type DmsRoute,
+  type DmsServerFetch,
   type DmsSharedPagePayload,
   type RouteLocationRaw,
 } from "./types";
@@ -212,7 +212,7 @@ export interface DmsFrontendRuntime {
   /** Whether to warn about what a development render does wrong. */
   devWarnings?: boolean;
   runtimeHooks: Map<string, DmsRuntimeHook[]>;
-  serverFetch?: typeof ofetch;
+  serverFetch?: DmsServerFetch;
   currentError: Ref<Error | null>;
   route: DmsRoute;
   currentRoutePattern?: string;

package/templates/vue/frontend-runtime/state.ts

@@ -1,4 +1,3 @@
-import { ofetch } from "ofetch";
 import {
   type App,
   effectScope,
@@ -19,6 +18,7 @@ import {
 import {
   type DmsAppContext,
   type DmsRoute,
+  type DmsServerFetch,
   type DmsRuntimeConfig,
 } from "./types";
 
@@ -65,7 +65,7 @@ export function forgetBrowserRuntime(runtime: DmsFrontendRuntime): void {
 
 /** Creates mutable runtime state owned by one Vue application. */
 export function createDmsFrontendRuntime(
-  serverFetch?: typeof ofetch,
+  serverFetch?: DmsServerFetch,
   hydratedAsyncData?: Record<string, unknown>,
   isServer = false,
   requestCookies?: string,

package/templates/vue/frontend-runtime/types.ts

@@ -1,5 +1,5 @@
 import { type InertiaLinkProps } from "@inertiajs/vue3";
-import { type FetchOptions, ofetch } from "ofetch";
+import { type FetchOptions } from "ofetch";
 import {
   type App,
   type ComputedRef,
@@ -246,6 +246,12 @@ export interface UseAsyncDataOptions<T> {
    */
   refreshInterval?: MaybeRefOrGetter<number | null | undefined>;
 }
+/** What the runtime calls to read the backend: `ofetch`, or a stand-in for it. */
+export type DmsServerFetch = (
+  request: string,
+  options?: FetchOptions,
+) => Promise<unknown>;
+
 /**
  * `useDmsFetch`'s options: ofetch's request options, of which the method, the
  * query, the params and the body may be refs or getters, and the async data
@@ -271,7 +277,7 @@ export interface UseFetchOptions<T>
     context: DmsFetchTransformContext,
   ) => T | Promise<T>;
   /** Replaces the fetch function; it receives the run's signal. */
-  $fetch?: typeof ofetch;
+  $fetch?: DmsServerFetch;
 }
 export interface DmsErrorData {
   statusCode?: number;

package/templates/vue/globals.d.ts

@@ -1 +1,6 @@
 declare const defineDmsAppConfig: typeof import("./frontend-module").defineDmsAppConfig;
+declare module "virtual:nuxt-ui-icons" {
+  export function init(
+    add: (name: string, data: import("@iconify/vue").IconifyIcon) => boolean,
+  ): void;
+}

package/templates/vue/head-order.mjs

@@ -1,6 +1,10 @@
 const SCRIPT = /<script[^>]*\stype="module"[^>]*><\/script>/;
 const STYLESHEET = /[ \t]*<link rel="stylesheet"[^>]*>\n?/;
 
+/**
+ * @param {string} html
+ * @returns {string}
+ */
 function deprioritize(html) {
   return html.replace(SCRIPT, (tag) =>
     tag.includes("fetchpriority")
@@ -24,6 +28,9 @@ function deprioritize(html) {
  * HTTP/1.1 the generated server speaks. Kept beside vite.config.ts rather than
  * inside it so the transform can be exercised on its own, the way
  * client-manifest.mjs is.
+ *
+ * @param {string} html
+ * @returns {string}
  */
 export function orderHeadForFirstPaint(html) {
   const prioritized = deprioritize(html);

package/templates/vue/icon-bundle.ts

@@ -0,0 +1,31 @@
+import { addIcon, type IconifyIcon } from "@iconify/vue";
+
+function register(name: string, data: IconifyIcon): boolean {
+  const colon = name.indexOf(":");
+  if (colon !== -1 && name.slice(0, colon).includes("-")) {
+    addIcon(name.replace(":", "-"), data);
+  }
+  return addIcon(name, data);
+}
+
+let loading: Promise<void> | undefined;
+
+/**
+ * Loads the icons Nuxt UI bundles for the client, once: every icon the
+ * application's sources name. A server render has them from the start (Nuxt
+ * UI's own plugin, left in place by `ui-lazy-icons.mjs`), so there is nothing
+ * to load.
+ *
+ * A failed load is forgotten and resolves: an icon the bundle would have
+ * held is then fetched from the icon API, as one outside the bundle always is.
+ */
+export function loadIconBundle(): Promise<void> {
+  if (import.meta.env.SSR) return Promise.resolve();
+  loading ??= import("virtual:nuxt-ui-icons").then(
+    ({ init }) => init(register),
+    () => {
+      loading = undefined;
+    },
+  );
+  return loading;
+}

package/templates/vue/icon-scan.mjs

@@ -19,6 +19,10 @@ const SOURCE_SCRIPT_GLOB = "app/**/*.ts";
  * fetched from the Iconify API at run time. Every frontend source root lives
  * under the workspace (`frontend-modules/`, enforced when the registry is
  * written), so a relative glob reaches it. Globs are POSIX on every platform.
+ *
+ * @param {string} viteRoot
+ * @param {readonly string[]} sourceRoots
+ * @returns {string[]}
  */
 export function iconScanGlobs(viteRoot, sourceRoots) {
   const sourceGlobs = sourceRoots.map((root) =>

package/templates/vue/message-subset.ts

@@ -0,0 +1,65 @@
+/** The `<script>` the server render leaves in the document for {@link DmsMessageSubset}. */
+export const SSR_MESSAGES_ID = "dms-ssr-messages";
+
+type Messages = Record<string, unknown>;
+
+/**
+ * The messages a server render read from a locale's catalog, as a catalog of
+ * their own, with the locale they belong to.
+ */
+export interface DmsMessageSubset {
+  locale: string;
+  messages: Messages;
+}
+
+export interface MessageReadRecorder {
+  /** The catalog to give the render: every read through it is recorded. */
+  messages: Messages;
+  /** What the render read so far. */
+  subset: () => Messages;
+}
+
+function isTraversable(value: unknown): value is object {
+  return typeof value === "object" && value !== null;
+}
+
+function isMessages(value: unknown): value is Messages {
+  return isTraversable(value);
+}
+
+type Slot = () => Messages;
+
+/**
+ * Wraps a catalog so that the messages read through it are collected, with
+ * the path they sit at, into a catalog of their own.
+ *
+ * A message is recorded when a string is read from the catalog, whether by a
+ * lookup (`t`), an existence check (`te`) or a walk over a subtree (`tm`).
+ */
+export function recordMessageReads(messages: Messages): MessageReadRecorder {
+  const used: Messages = {};
+  const place = (source: object, parent: Slot, key: string): Slot => {
+    return () => {
+      const holder = parent();
+      const existing = holder[key];
+      if (isMessages(existing)) return existing;
+      const container: Messages = Array.isArray(source) ? [] : {};
+      holder[key] = container;
+      return container;
+    };
+  };
+  const wrap = <T extends object>(source: T, slot: Slot): T =>
+    new Proxy(source, {
+      get(target, key, receiver) {
+        const value: unknown = Reflect.get(target, key, receiver);
+        if (typeof key !== "string" || key === "__proto__") return value;
+        if (typeof value === "string") {
+          slot()[key] = value;
+          return value;
+        }
+        if (isTraversable(value)) return wrap(value, place(value, slot, key));
+        return value;
+      },
+    });
+  return { messages: wrap(messages, () => used), subset: () => used };
+}

package/templates/vue/network-error.ts

@@ -15,6 +15,10 @@ export interface DmsNetworkErrorTranslator {
 
 const NETWORK_ERROR_TOAST_ID = "dms-network-error";
 const NETWORK_ERROR_KEY = "error.network";
+/** The messages a module overrides the built-in texts with. */
+export const NETWORK_ERROR_KEYS = ["title", "description"].map(
+  (name) => `${NETWORK_ERROR_KEY}.${name}`,
+);
 const DEFAULT_LOCALE = "en";
 // Shipped with the renderer, since no module is guaranteed to translate the
 // case; a module overrides them with `error.network.title` and

package/templates/vue/server/auth/backend.mjs

@@ -1,4 +1,5 @@
 import { REDIRECT_STATUSES } from "../proxy-redirects.mjs";
+import { isString } from "../type-guards.mjs";
 import { clientCountryHeader, clientIp, clientIpHeader } from "./client-ip.mjs";
 
 /**
@@ -14,6 +15,10 @@ export const CLIENT_HEADERS = [
 ];
 
 export class UpstreamError extends Error {
+  /**
+   * @param {number} status
+   * @param {string} message
+   */
   constructor(status, message) {
     super(message);
     this.status = status;
@@ -27,9 +32,15 @@ const PUBLIC_AUTH_MESSAGE = /^error\.[a-z0-9_.-]{1,100}$/;
  */
 export const GENERIC_ERROR_MESSAGE = "error.500.description";
 
+/**
+ * @param {unknown} data A backend answer: any JSON value, or the text of one
+ *   that is not JSON
+ * @returns {string | undefined}
+ */
 export function publicBackendMessage(data) {
-  const message = typeof data === "string" ? data : data?.message;
-  return typeof message === "string" && PUBLIC_AUTH_MESSAGE.test(message)
+  /** @type {unknown} */
+  const message = isString(data) ? data : data?.message;
+  return isString(message) && PUBLIC_AUTH_MESSAGE.test(message)
     ? message
     : undefined;
 }
@@ -37,8 +48,10 @@ export function publicBackendMessage(data) {
 /**
  * The headers of a client request the server relays to the backend.
  *
- * @param request The client request
- * @param names Lowercase names of the request headers to copy when present
+ * @param {import("./client-ip.mjs").ForwardedRequest} request The client
+ *   request
+ * @param {readonly string[]} names Lowercase names of the request headers to
+ *   copy when present
  * @returns The client country header, then the copied headers
  */
 export function relayedHeaders(request, names) {
@@ -58,8 +71,22 @@ export function relayedHeaders(request, names) {
  * `options.headers` adds request headers; the client's address and the
  * relayed client headers are set after them, so no caller replaces those.
  * A redirect is not followed: it is no JSON answer, so it fails with a 502.
+ *
+ * @param {string} path
+ * @param {import("./client-ip.mjs").ForwardedRequest} request The client
+ *   request
+ * @param {{
+ *   method?: string,
+ *   body?: unknown,
+ *   token?: string,
+ *   relay?: boolean,
+ *   headers?: Record<string, string>
+ * }} [options]
+ * @returns {Promise<unknown>} The answer's JSON, `{}` for a successful one that
+ *   is not JSON
  */
 export async function backend(path, request, options = {}) {
+  /** @type {Record<string, string | string[]>} */
   const headers = Object.fromEntries(
     Object.entries(options.headers ?? {}).map(([name, value]) => [
       name.toLowerCase(),
@@ -87,6 +114,7 @@ export async function backend(path, request, options = {}) {
     throw new UpstreamError(502, GENERIC_ERROR_MESSAGE);
   }
   const text = await response.text();
+  /** @type {unknown} */
   let data;
   try {
     data = JSON.parse(text);
@@ -105,12 +133,21 @@ export async function backend(path, request, options = {}) {
 }
 
 export class RequestBodyError extends Error {
+  /**
+   * @param {number} status
+   * @param {string} message
+   */
   constructor(status, message) {
     super(message);
     this.status = status;
   }
 }
 
+/**
+ * @param {import("node:http").ServerResponse} response
+ * @param {number} status
+ * @param {unknown} value Anything `JSON.stringify` writes
+ */
 export function json(response, status, value) {
   response.writeHead(status, { "content-type": "application/json" });
   response.end(JSON.stringify(value));

package/templates/vue/server/auth/client-ip.mjs

@@ -1,5 +1,21 @@
+import { isString } from "../type-guards.mjs";
+
 const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9a-z-]+$/;
 
+/**
+ * A request, whose socket is a TLS one (`encrypted`) when the server itself
+ * terminates TLS.
+ *
+ * @typedef {import("node:http").IncomingMessage & {
+ *   socket: import("node:net").Socket & { encrypted?: boolean }
+ * }} ForwardedRequest
+ */
+
+/**
+ * @param {string | undefined} value A header name from the environment
+ * @returns {string | undefined} The lowercase name, `undefined` when it is not
+ *   a header name
+ */
 function headerName(value) {
   const name = (value ?? "").trim().toLowerCase();
   return HEADER_NAME.test(name) ? name : undefined;
@@ -17,18 +33,26 @@ function trustedHops() {
  * so its presence also vouches for the platform's `X-Forwarded-*`. On a path
  * the platform does not front (a private call from another service), it is
  * absent and the request falls back to `DMS_TRUSTED_PROXY_HOPS`.
+ *
+ * @param {ForwardedRequest} request
+ * @returns {string | undefined}
  */
 function platformClientIp(request) {
   const name = headerName(process.env.DMS_CLIENT_IP_HEADER);
   if (!name) return undefined;
   const value = request.headers?.[name];
-  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+  return isString(value) && value.trim() ? value.trim() : undefined;
 }
 
+/** @param {ForwardedRequest} request */
 function isProxyTrusted(request) {
   return Boolean(platformClientIp(request)) || trustedHops() > 0;
 }
 
+/**
+ * @param {ForwardedRequest} request
+ * @returns {string}
+ */
 export function requestScheme(request) {
   if (isProxyTrusted(request)) {
     const forwarded = String(request.headers["x-forwarded-proto"] ?? "")
@@ -41,6 +65,10 @@ export function requestScheme(request) {
   return request.socket?.encrypted ? "https" : "http";
 }
 
+/**
+ * @param {ForwardedRequest} request
+ * @returns {string | undefined}
+ */
 function requestHost(request) {
   if (!isProxyTrusted(request)) return request.headers.host;
   return (
@@ -62,8 +90,12 @@ function requestHost(request) {
  * proxy wrote it (`DMS_TRUSTED_PROXY_HOPS` above `0`): otherwise any caller
  * could have, and the socket's address replaces it. The scheme and the host
  * are read the same way as the CSRF origin check reads them.
+ *
+ * @param {ForwardedRequest} request
+ * @returns {Record<string, string>}
  */
 export function forwardedHeaders(request) {
+  /** @type {Record<string, string>} */
   const headers = {
     "x-forwarded-for": forwardedFor(request),
     "x-forwarded-proto": requestScheme(request),
@@ -74,6 +106,10 @@ export function forwardedHeaders(request) {
   return headers;
 }
 
+/**
+ * @param {ForwardedRequest} request
+ * @returns {string}
+ */
 function forwardedFor(request) {
   const platformIp = platformClientIp(request);
   if (platformIp) return platformIp;
@@ -92,12 +128,19 @@ function forwardedFor(request) {
  * address this server resolved, so the backend reads the same address
  * without counting hops. Always written, never relayed: a value the caller
  * sent is replaced. None when the variable is unset.
+ *
+ * @param {ForwardedRequest} request
+ * @returns {Record<string, string>}
  */
 export function clientIpHeader(request) {
   const name = headerName(process.env.DMS_CLIENT_IP_HEADER);
   return name ? { [name]: clientIp(request) } : {};
 }
 
+/**
+ * @param {ForwardedRequest} request
+ * @returns {boolean}
+ */
 export function isSameOrigin(request) {
   const origin = request.headers.origin;
   if (!origin) return false;
@@ -111,6 +154,10 @@ export function isSameOrigin(request) {
   }
 }
 
+/**
+ * @param {ForwardedRequest} request
+ * @returns {string}
+ */
 export function clientIp(request) {
   const platformIp = platformClientIp(request);
   if (platformIp) return platformIp;
@@ -136,6 +183,9 @@ const DEFAULT_COUNTRY_HEADER = "CF-IPCountry";
  * from a trusted reverse proxy (the platform's client IP header, or
  * `DMS_TRUSTED_PROXY_HOPS` above `0`): otherwise any caller could have set
  * it, so nothing is relayed.
+ *
+ * @param {ForwardedRequest} request
+ * @returns {Record<string, string>}
  */
 export function clientCountryHeader(request) {
   const name = headerName(
@@ -143,9 +193,7 @@ export function clientCountryHeader(request) {
   );
   if (!name || !isProxyTrusted(request)) return {};
   const value = request.headers?.[name];
-  return typeof value === "string" && value.trim()
-    ? { [name]: value.trim() }
-    : {};
+  return isString(value) && value.trim() ? { [name]: value.trim() } : {};
 }
 
 /**

package/templates/vue/server/auth/establish-endpoints.mjs

@@ -1,4 +1,5 @@
 import { readFileSync } from "node:fs";
+import { isObjectLike, isString } from "../type-guards.mjs";
 
 /**
  * Absolute backend API paths only: no scheme, no authority, no query string,
@@ -17,6 +18,7 @@ const DECLARED_ENDPOINTS_FILE = new URL(
   import.meta.url,
 );
 
+/** @type {unknown[] | undefined} */
 let declaredEndpoints;
 
 /**
@@ -28,13 +30,15 @@ let declaredEndpoints;
  * workspace built from a DMS that predates the declaration simply has no file,
  * and the list falls back to whatever the environment names.
  *
- * @param file Generated file to read
- * @returns The declared paths, unfiltered
+ * @param {URL | string} [file] Generated file to read
+ * @returns {unknown[]} The declared paths, unfiltered
  */
 export function readDeclaredEstablishEndpoints(file = DECLARED_ENDPOINTS_FILE) {
   try {
+    /** @type {unknown} */
     const parsed = JSON.parse(readFileSync(file, "utf8"));
-    return Array.isArray(parsed?.endpoints) ? parsed.endpoints : [];
+    const endpoints = isObjectLike(parsed) ? parsed.endpoints : undefined;
+    return Array.isArray(endpoints) ? endpoints : [];
   } catch {
     return [];
   }
@@ -54,8 +58,8 @@ export function readDeclaredEstablishEndpoints(file = DECLARED_ENDPOINTS_FILE) {
  * (`DMS_AUTH_ESTABLISH_ENDPOINTS`). The module that owns sign-in reads them as
  * `event.app.authEstablishEndpoints`.
  *
- * @param declaration Comma-separated absolute backend paths from the environment
- * @param declared Paths declared by the backend's frontend modules
+ * @param {string} [declaration] Comma-separated absolute backend paths from the environment
+ * @param {unknown[]} [declared] Paths declared by the backend's frontend modules
  * @returns The well-formed backend API paths, without duplicates
  */
 export function allowedEstablishEndpoints(
@@ -68,7 +72,7 @@ export function allowedEstablishEndpoints(
   return [
     ...new Set(
       [...declared, ...fromEnvironment].filter(
-        (entry) => typeof entry === "string" && BACKEND_API_PATH.test(entry),
+        (entry) => isString(entry) && BACKEND_API_PATH.test(entry),
       ),
     ),
   ];