@antelopejs/dms-frontend 0.9.3 → 0.10.0

package/templates/vue/server/public-endpoints.mjs

@@ -1,6 +1,33 @@
 import { readFileSync } from "node:fs";
 import { json } from "./auth/backend.mjs";
 import { CROSS_ORIGIN_ERROR, isSameOrigin } from "./auth/client-ip.mjs";
+import { PROXY_AUTH_MODES } from "./backend-proxies.mjs";
+import {
+  isNonNullObject,
+  isNumber,
+  isObjectLike,
+  isRecord,
+  isString,
+} from "./type-guards.mjs";
+
+/**
+ * A public endpoint, compiled from a declaration that passed every check.
+ *
+ * @typedef {object} PublicEndpoint
+ * @property {string} path
+ * @property {string[]} methods
+ * @property {string[]} headers
+ * @property {RegExp} matcher
+ */
+
+/**
+ * A declaration as the manifest or the environment holds it, before any check.
+ *
+ * @typedef {object} PublicEndpointDeclaration
+ * @property {unknown} [path]
+ * @property {unknown} [methods]
+ * @property {unknown} [headers]
+ */
 
 /**
  * Written at the workspace root by the loader, from the endpoints each
@@ -41,39 +68,101 @@ const HEADER_NAME = /^x-[a-z0-9-]+$/;
 const RESERVED_HEADER =
   /^x-(?:forwarded-|real-ip$|dms-|inertia|http-method|method-override|original-|rewrite-)/;
 
+/** @type {unknown[] | undefined} */
 let declaredEndpoints;
+/** @type {import("./backend-proxies.mjs").ManifestProxy[] | undefined} */
 let declaredProxies;
 
 /**
  * The public endpoints the modules of this deployment declared, unchecked.
  *
- * @param file Generated file to read
- * @returns The declared entries, or none when the file is absent or broken
+ * @param {URL | string} [file] Generated file to read
+ * @returns {unknown[]} The declared entries, or none when the file is absent or broken
  */
 export function readDeclaredPublicEndpoints(file = DECLARED_ENDPOINTS_FILE) {
   try {
+    /** @type {unknown} */
     const parsed = JSON.parse(readFileSync(file, "utf8"));
-    return Array.isArray(parsed?.endpoints) ? parsed.endpoints : [];
+    const endpoints = isObjectLike(parsed) ? parsed.endpoints : undefined;
+    return Array.isArray(endpoints) ? endpoints : [];
   } catch {
     return [];
   }
 }
 
+/**
+ * Whether `entry` names a path and, when it says so, an auth mode and a body
+ * limit of the right type. The path pattern and the limit's range are judged
+ * when the proxies are resolved.
+ *
+ * @param {unknown} entry
+ * @returns {entry is { path: string, auth?: "session" | "none", maxBodyBytes?: number }}
+ */
+function isProxyDeclaration(entry) {
+  return (
+    isRecord(entry) &&
+    !Array.isArray(entry) &&
+    isString(entry.path) &&
+    (entry.auth === undefined ||
+      PROXY_AUTH_MODES.some((mode) => mode === entry.auth)) &&
+    (entry.maxBodyBytes === undefined || isNumber(entry.maxBodyBytes))
+  );
+}
+
+/**
+ * @param {unknown[]} entries
+ * @param {string} source Where they were declared, for the warning
+ * @param {(entry: unknown) => boolean} isUsable
+ */
+function warnUnusableProxies(entries, source, isUsable) {
+  const unusable = entries.filter((entry) => !isUsable(entry)).length;
+  if (unusable)
+    console.warn(
+      `Ignoring ${unusable} ${unusable === 1 ? "entry" : "entries"} of ${source}: not a backend proxy declaration (a path, an auth of session or none, a body limit in bytes)`,
+    );
+}
+
+/**
+ * @param {unknown} entry
+ * @returns {entry is import("./backend-proxies.mjs").ManifestProxy}
+ */
+function isDeclaredProxy(entry) {
+  return (
+    isRecord(entry) &&
+    isProxyDeclaration(entry) &&
+    (entry.module === undefined || isString(entry.module))
+  );
+}
+
 /**
  * The backend proxies the backend modules declared in the manifest, as
- * `{ module, path, auth?, maxBodyBytes? }`, unchecked.
+ * `{ module, path, auth?, maxBodyBytes? }`. An entry that is not one is
+ * reported and left out.
  *
  * A missing or broken file declares no proxy.
  *
- * @param file Generated file to read
+ * @param {URL | string} [file] Generated file to read
+ * @returns {import("./backend-proxies.mjs").ManifestProxy[]}
  */
 export function readDeclaredBackendProxies(file = DECLARED_ENDPOINTS_FILE) {
   if (file === DECLARED_ENDPOINTS_FILE && declaredProxies)
     return declaredProxies;
+  /** @type {import("./backend-proxies.mjs").ManifestProxy[]} */
   let proxies = [];
   try {
+    /** @type {unknown} */
     const parsed = JSON.parse(readFileSync(file, "utf8"));
-    if (Array.isArray(parsed?.proxies)) proxies = parsed.proxies;
+    const listed = isObjectLike(parsed) ? parsed.proxies : undefined;
+    if (Array.isArray(listed)) {
+      /** @type {unknown[]} */
+      const entries = listed;
+      warnUnusableProxies(
+        entries,
+        "the generated manifest file",
+        isDeclaredProxy,
+      );
+      proxies = entries.filter(isDeclaredProxy);
+    }
   } catch {}
   if (file === DECLARED_ENDPOINTS_FILE) declaredProxies = proxies;
   return proxies;
@@ -82,29 +171,40 @@ export function readDeclaredBackendProxies(file = DECLARED_ENDPOINTS_FILE) {
 /**
  * The backend proxies `DMS_BACKEND_PROXIES` adds: a JSON array of
  * `{ path, auth?, maxBodyBytes? }`, as the manifest's `backendProxies`, for an
- * operator. A value that is not a JSON array is reported and ignored.
+ * operator. A value that is not a JSON array is reported and ignored, and so
+ * is each entry that is not a declaration.
  *
- * @param declaration The variable's value
+ * @param {string} [declaration] The variable's value
+ * @returns {import("./backend-proxies.mjs").ManifestProxy[]}
  */
 export function environmentBackendProxies(
   declaration = process.env.DMS_BACKEND_PROXIES,
 ) {
   if (!declaration?.trim()) return [];
   try {
+    /** @type {unknown} */
     const parsed = JSON.parse(declaration);
-    if (Array.isArray(parsed))
-      return parsed.map((entry) => ({
-        ...entry,
-        module: "DMS_BACKEND_PROXIES",
-      }));
+    if (Array.isArray(parsed)) {
+      /** @type {unknown[]} */
+      const entries = parsed;
+      warnUnusableProxies(entries, "DMS_BACKEND_PROXIES", isProxyDeclaration);
+      return entries
+        .filter(isProxyDeclaration)
+        .map((entry) => ({ ...entry, module: "DMS_BACKEND_PROXIES" }));
+    }
   } catch {}
   console.warn("Ignoring DMS_BACKEND_PROXIES: not a JSON array");
   return [];
 }
 
+/**
+ * @param {string | undefined} declaration
+ * @returns {unknown[]}
+ */
 function environmentEndpoints(declaration) {
   if (!declaration?.trim()) return [];
   try {
+    /** @type {unknown} */
     const parsed = JSON.parse(declaration);
     return Array.isArray(parsed) ? parsed : [];
   } catch {
@@ -113,6 +213,7 @@ function environmentEndpoints(declaration) {
   }
 }
 
+/** @param {unknown} methods */
 function normalizedMethods(methods) {
   if (methods === undefined) return DEFAULT_METHODS;
   if (!Array.isArray(methods) || methods.length === 0) return undefined;
@@ -122,6 +223,7 @@ function normalizedMethods(methods) {
     : undefined;
 }
 
+/** @param {unknown} headers */
 function normalizedHeaders(headers) {
   if (headers === undefined) return [];
   if (!Array.isArray(headers)) return undefined;
@@ -133,6 +235,7 @@ function normalizedHeaders(headers) {
     : undefined;
 }
 
+/** @param {string} path */
 function pathMatcher(path) {
   const pattern = path
     .split("/")
@@ -148,11 +251,13 @@ function pathMatcher(path) {
 /**
  * A declaration made usable, or `undefined` when any part of it is malformed:
  * a bad entry is dropped whole, never widened to what it might have meant.
+ *
+ * @param {PublicEndpointDeclaration | null | undefined} entry
+ * @returns {PublicEndpoint | undefined}
  */
 export function compilePublicEndpoint(entry) {
-  if (typeof entry !== "object" || entry === null) return undefined;
-  if (typeof entry.path !== "string" || !PUBLIC_PATH.test(entry.path))
-    return undefined;
+  if (!isNonNullObject(entry)) return undefined;
+  if (!isString(entry.path) || !PUBLIC_PATH.test(entry.path)) return undefined;
   const methods = normalizedMethods(entry.methods);
   const headers = normalizedHeaders(entry.headers);
   if (!methods || !headers) return undefined;
@@ -168,6 +273,10 @@ export function compilePublicEndpoint(entry) {
  * The backend endpoints this deployment serves to anyone: what the backend's
  * modules declared, plus what `DMS_PUBLIC_ENDPOINTS` adds (a JSON array of the
  * same `{ path, methods?, headers? }` entries).
+ *
+ * @param {string} [declaration]
+ * @param {unknown[]} [declared]
+ * @returns {PublicEndpoint[]}
  */
 export function allowedPublicEndpoints(
   declaration = process.env.DMS_PUBLIC_ENDPOINTS,
@@ -189,6 +298,8 @@ export function allowedPublicEndpoints(
 /**
  * Compiled once per value of the environment variable, so a malformed entry
  * is reported once rather than on every request.
+ *
+ * @type {{ declaration: string | undefined, endpoints: PublicEndpoint[] } | undefined}
  */
 let compiled;
 
@@ -202,9 +313,9 @@ function currentPublicEndpoints() {
 /**
  * The public endpoint a request reaches, if any.
  *
- * @param method The request's method
- * @param pathname The request's normalized path, without its query string
- * @param endpoints The endpoints to match, this deployment's by default
+ * @param {string} method The request's method
+ * @param {string} pathname The request's normalized path, without its query string
+ * @param {PublicEndpoint[]} [endpoints] The endpoints to match, this deployment's by default
  */
 export function matchPublicEndpoint(
   method,
@@ -227,9 +338,9 @@ export function matchPublicEndpoint(
  * it reaches a public endpoint, which is why the proxy never sends a public
  * endpoint the session: a cross-site form posting to it acts as nobody.
  *
- * @param request The incoming request
- * @param safeMethods Methods that change nothing and need no Origin
- * @param proxy The backend proxy the request reached
+ * @param {import("node:http").IncomingMessage} request The incoming request
+ * @param {ReadonlySet<string>} safeMethods Methods that change nothing and need no Origin
+ * @param {import("./backend-proxies.mjs").BackendProxy} proxy The backend proxy the request reached
  * @returns `{ anonymous, headers, isRefused }`
  */
 export function proxyAccess(request, safeMethods, proxy) {
@@ -252,7 +363,11 @@ export function proxyAccess(request, safeMethods, proxy) {
   };
 }
 
-/** Answers the 403 of a request `proxyAccess` refused. */
+/**
+ * Answers the 403 of a request `proxyAccess` refused.
+ *
+ * @param {import("node:http").ServerResponse} response
+ */
 export function refuseCrossOrigin(response) {
   json(response, 403, CROSS_ORIGIN_ERROR);
 }

package/templates/vue/server/public-options.mjs

@@ -1,15 +1,25 @@
+import { isRecord } from "./type-guards.mjs";
+
 const VARIABLE = "DMS_PUBLIC_OPTIONS";
 export const PUBLIC_OPTIONS_ELEMENT_ID = "dms-public-options";
 
+/**
+ * The registry the workspace was materialized with.
+ *
+ * @typedef {object} FrontendRegistry
+ * @property {{ id: string, options?: unknown }[]} modules The modules, highest priority first
+ */
+
+/**
+ * @param {string | undefined} raw
+ * @returns {Record<string, unknown> | undefined}
+ */
 function parse(raw) {
   if (!raw) return undefined;
   try {
+    /** @type {unknown} */
     const parsed = JSON.parse(raw);
-    return typeof parsed === "object" &&
-      parsed !== null &&
-      !Array.isArray(parsed)
-      ? parsed
-      : undefined;
+    return isRecord(parsed) && !Array.isArray(parsed) ? parsed : undefined;
   } catch {
     console.warn(`${VARIABLE} is not a JSON object of options by module id`);
     return undefined;
@@ -27,7 +37,11 @@ function parse(raw) {
  */
 export const RUNTIME_PUBLIC_OPTIONS = parse(process.env[VARIABLE]);
 
-/** The options of each module of the registry, the runtime ones first. */
+/**
+ * The options of each module of the registry, the runtime ones first.
+ *
+ * @param {FrontendRegistry} registry
+ */
 export function publicOptionsOf(registry) {
   return Object.fromEntries(
     registry.modules.map((module) => [

package/templates/vue/server/request-failure.mjs

@@ -1,9 +1,13 @@
+import { isNumber, isObjectLike } from "./type-guards.mjs";
+
 const FRONTEND_ORIGIN = "http://frontend.local";
 const TEXT_TYPE = "text/plain; charset=utf-8";
 
 /**
  * Whether the path of `url` holds a percent-escape no decoder accepts, such as
  * `/projects/%E0%A4%A`. Vite and the router decode the path, and throw on it.
+ *
+ * @param {string} url
  */
 export function hasMalformedPath(url) {
   try {
@@ -14,9 +18,23 @@ export function hasMalformedPath(url) {
   }
 }
 
+/**
+ * The status an error asks to be answered with: its integer `status`, else 502.
+ *
+ * @param {unknown} error
+ * @returns {number}
+ */
+export function failureStatus(error) {
+  const status = isObjectLike(error) ? error.status : undefined;
+  return isNumber(status) && Number.isInteger(status) ? status : 502;
+}
+
 /**
  * Whether a failed request can no longer be answered: the client went away, or
  * the response already started.
+ *
+ * @param {unknown} error
+ * @param {import("node:http").ServerResponse} response
  */
 export function isResponseGone(error, response) {
   return (
@@ -30,6 +48,8 @@ export function isResponseGone(error, response) {
 /**
  * Answers for requests the server cannot serve at all: an unreadable URL, or
  * a failure while it was already rendering the error page.
+ *
+ * @param {import("node:http").ServerResponse} response
  */
 export function writeBadRequest(response) {
   response.writeHead(400, { "content-type": TEXT_TYPE });
@@ -40,6 +60,9 @@ export function writeBadRequest(response) {
  * The last resort once even the error page failed: a bare 500, or a dropped
  * connection when the response already started. The server keeps running
  * either way.
+ *
+ * @param {unknown} error
+ * @param {import("node:http").ServerResponse} response
  */
 export function abandonResponse(error, response) {
   console.error("DMS error response failed", error);

package/templates/vue/server/request-routing.mjs

@@ -1,6 +1,19 @@
 import { matchBackendProxy } from "./backend-proxies.mjs";
 import { isRendererFilePath, moduleRouteMethods } from "./module-routes.mjs";
 
+/**
+ * @typedef {object} RoutingModules
+ * @property {import("./module-route-types.mjs").ServerRoute[]} routes
+ * @property {import("./backend-proxies.mjs").BackendProxy[]} [proxies]
+ */
+/**
+ * @typedef {{ kind: "renderer" }
+ *   | { kind: "module", id: string }
+ *   | { kind: "backend", proxy: import("./backend-proxies.mjs").BackendProxy }
+ *   | { kind: "page" }
+ *   | { kind: "not-found" }} RequestOwner
+ */
+
 const PAGE_METHODS = new Set(["GET", "HEAD"]);
 
 /**
@@ -14,12 +27,12 @@ const PAGE_METHODS = new Set(["GET", "HEAD"]);
  * `backendProxies`); 4. the pages, for everything else: a method other than
  * `GET` and `HEAD` on a page path is a `404`.
  *
- * @param method The request's method
- * @param pathname The request's normalized path
- * @param modules What `loadServerModules` returned: `routes` and `proxies`
- * @param hasRendererFile `(pathname) => boolean`, whether the renderer has a
+ * @param {string} method The request's method
+ * @param {string} pathname The request's normalized path
+ * @param {RoutingModules} modules What `loadServerModules` returned: `routes` and `proxies`
+ * @param {(pathname: string) => boolean} hasRendererFile `(pathname) => boolean`, whether the renderer has a
  *   file at that path
- * @returns `{ kind: "renderer" }`, `{ kind: "module", id }`,
+ * @returns {RequestOwner} `{ kind: "renderer" }`, `{ kind: "module", id }`,
  *   `{ kind: "backend", proxy }`, `{ kind: "page" }` or
  *   `{ kind: "not-found" }`
  */
@@ -41,9 +54,9 @@ export function requestOwner(method, pathname, modules, hasRendererFile) {
  * `Location` on such a path can become a frontend path (see
  * `proxy-redirects.mjs`).
  *
- * @param pathname A normalized path
- * @param modules What `loadServerModules` returned: `routes` and `proxies`
- * @param hasRendererFile `(pathname) => boolean`, whether the renderer has a
+ * @param {string} pathname A normalized path
+ * @param {RoutingModules} modules What `loadServerModules` returned: `routes` and `proxies`
+ * @param {(pathname: string) => boolean} [hasRendererFile] `(pathname) => boolean`, whether the renderer has a
  *   file at that path
  */
 export function reachesBackend(
@@ -56,7 +69,11 @@ export function reachesBackend(
   );
 }
 
-/** The `x-dms-route-owner` value of an owner, for the development server. */
+/**
+ * The `x-dms-route-owner` value of an owner, for the development server.
+ *
+ * @param {RequestOwner} owner
+ */
 export function ownerLabel(owner) {
   if (owner.kind === "module") return `module:${owner.id}`;
   if (owner.kind === "backend") return `backend:${owner.proxy.path}`;

package/templates/vue/server/request-target.mjs

@@ -1,4 +1,5 @@
 import { writeBadRequest } from "./request-failure.mjs";
+import { isString } from "./type-guards.mjs";
 
 const FRONTEND_ORIGIN = "http://frontend.local";
 
@@ -7,9 +8,11 @@ const FRONTEND_ORIGIN = "http://frontend.local";
  * query, that stays on this server once resolved. Anything else (an absolute
  * or authority form, `*`, a path a URL parser reads as another host) is not a
  * request a browser sends to the frontend.
+ *
+ * @param {string | undefined} target
  */
 export function isOriginForm(target) {
-  if (typeof target !== "string" || !target.startsWith("/")) return false;
+  if (!isString(target) || !target.startsWith("/")) return false;
   try {
     return new URL(target, FRONTEND_ORIGIN).origin === FRONTEND_ORIGIN;
   } catch {
@@ -22,8 +25,8 @@ export function isOriginForm(target) {
  * and query on the backend's origin. The path is set, not resolved, so a path
  * normalizing to `//host` (`/x/..//host`) stays a path on the backend.
  *
- * @param target The request target, origin-form
- * @param backendBaseUrl The backend's base URL
+ * @param {string} target The request target, origin-form
+ * @param {string} [backendBaseUrl] The backend's base URL
  */
 export function backendUrl(
   target,
@@ -45,6 +48,9 @@ export function backendUrl(
  * form `http://host/x` all name another host once resolved, which turned the
  * proxy into an open one. Every routing decision and the URL sent to the
  * backend read the same normalized path from here.
+ *
+ * @param {import("node:http").IncomingMessage} request
+ * @param {import("node:http").ServerResponse} response
  */
 export function refuseForeignTarget(request, response) {
   if (isOriginForm(request.url)) return false;

package/templates/vue/server/route-rules.mjs

@@ -1,10 +1,25 @@
 import { compilePathPattern } from "./path-patterns.mjs";
+import { isNonNullObject, isObjectLike, isString } from "./type-guards.mjs";
+
+/** @typedef {import("../server-module.ts").DmsRouteRule} RouteRule */
+/** @typedef {RouteRule & { headers: Record<string, string> }} MergedRouteRule */
+/**
+ * @typedef {object} ResolvedRouteRule
+ * @property {string} id The declaring module
+ * @property {number} priority The declaring module's priority
+ * @property {import("./path-patterns.mjs").CompiledPathPattern} pattern
+ * @property {RouteRule} rule
+ */
 
 const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9a-z-]+$/;
-/** Whether a header value holds a control character other than a tab: a CR
- * or an LF would split the answer. */
+/**
+ * Whether a header value holds a control character other than a tab: a CR
+ * or an LF would split the answer.
+ *
+ * @param {string} value
+ */
 function hasControlCharacter(value) {
-  return [...value].some((character) => {
+  return Array.from(value).some((character) => {
     const code = character.charCodeAt(0);
     return (code < 0x20 && code !== 0x09) || code === 0x7f;
   });
@@ -20,19 +35,21 @@ const RESERVED_HEADERS = new Set([
   "x-inertia-version",
 ]);
 
+/** @param {unknown} value */
 function isSeconds(value) {
   return Number.isSafeInteger(value) && value >= 0;
 }
 
+/** @param {unknown} headers */
 function headersRejection(headers) {
   if (headers === undefined) return undefined;
-  if (typeof headers !== "object" || headers === null || Array.isArray(headers))
+  if (!isNonNullObject(headers) || Array.isArray(headers))
     return "headers is not an object";
   for (const [name, value] of Object.entries(headers)) {
     const lower = name.toLowerCase();
     if (
       !HEADER_NAME.test(lower) ||
-      typeof value !== "string" ||
+      !isString(value) ||
       hasControlCharacter(value)
     )
       return `"${name}" is not a header with a text value`;
@@ -42,11 +59,11 @@ function headersRejection(headers) {
   return undefined;
 }
 
+/** @param {unknown} cache */
 function cacheRejection(cache) {
   if (cache === undefined || cache === false) return undefined;
   if (
-    typeof cache !== "object" ||
-    cache === null ||
+    !isNonNullObject(cache) ||
     cache.public !== true ||
     !isSeconds(cache.maxAge) ||
     (cache.staleWhileRevalidate !== undefined &&
@@ -62,11 +79,14 @@ function cacheRejection(cache) {
  * Route rules the modules declare in their `dms.server.ts`: how a page is
  * rendered and which headers its document and Inertia answers carry. They
  * change rendering and caching, never who may see a page.
+ *
+ * @param {string} pattern
+ * @param {unknown} rule
  */
 export function ruleRejection(pattern, rule) {
   if (!compilePathPattern(pattern))
     return "the pattern is not /x, /x/* or /x/**";
-  if (typeof rule !== "object" || rule === null) return "it is not an object";
+  if (!isNonNullObject(rule)) return "it is not an object";
   if (rule.ssr !== undefined && rule.ssr !== false)
     return "ssr is either left out or false";
   return headersRejection(rule.headers) ?? cacheRejection(rule.cache);
@@ -77,10 +97,12 @@ export function ruleRejection(pattern, rule) {
  * specific pattern: a more specific rule overrides `ssr`, `cache` and each
  * header it sets.
  *
- * @param rules The resolved rules, `{ pattern, rule }` each
- * @param pathname The page's path
+ * @param {readonly ResolvedRouteRule[]} rules The resolved rules, `{ pattern, rule }` each
+ * @param {string} pathname The page's path
+ * @returns {MergedRouteRule}
  */
 export function routeRuleFor(rules, pathname) {
+  /** @type {MergedRouteRule} */
   const merged = { headers: {} };
   const matching = rules
     .filter(({ pattern }) => pattern.test(pathname))
@@ -95,6 +117,7 @@ export function routeRuleFor(rules, pathname) {
   return merged;
 }
 
+/** @param {{ maxAge: number, staleWhileRevalidate?: number }} cache */
 function publicCacheControl(cache) {
   const stale =
     cache.staleWhileRevalidate === undefined
@@ -109,10 +132,10 @@ function publicCacheControl(cache) {
  * content language: the answer then holds nobody's data, and `Vary: Cookie`
  * keeps a shared cache from serving it to a visitor who has some.
  *
- * @param rule What `routeRuleFor` returned
- * @param request The page request
- * @param route The page's route, as the backend described it
- * @param status The answer's status: only a 200 is cached
+ * @param {MergedRouteRule} rule What `routeRuleFor` returned
+ * @param {import("node:http").IncomingMessage} request The page request
+ * @param {unknown} route The page's route, as the backend described it: any JSON value, only `publicAccess` is read
+ * @param {number} status The answer's status: only a 200 is cached
  */
 export function ruleHeaders(rule, request, route, status) {
   const headers = { ...rule.headers };
@@ -122,7 +145,8 @@ export function ruleHeaders(rule, request, route, status) {
     request.method === "GET" &&
     !request.headers.cookie &&
     !request.headers["x-content-language"] &&
-    route?.publicAccess === true
+    isObjectLike(route) &&
+    route.publicAccess === true
   ) {
     headers["cache-control"] = publicCacheControl(rule.cache);
     headers.vary = "X-Inertia, Cookie";

package/templates/vue/server/ssr-module.mjs

@@ -0,0 +1,32 @@
+import * as icons from "./icons.mjs";
+
+/** @typedef {import("vite").ViteDevServer} ViteDevServer */
+
+/**
+ * A URL, not a path: on Windows, `import()` reads `C:\...` as a URL whose
+ * scheme is `c:` and refuses it.
+ */
+const BUILT_SSR_RENDERER_URL = new URL(
+  "../dist/ssr/ssr-renderer.js",
+  import.meta.url,
+);
+
+/** @type {Promise<typeof import("../ssr-renderer.ts")> | undefined} */
+let productionSsrRenderer;
+
+/**
+ * The SSR renderer of the workspace: the development server's module, else
+ * the built bundle, loaded once.
+ *
+ * @param {ViteDevServer | undefined} devServer
+ * @returns {Promise<typeof import("../ssr-renderer.ts")>}
+ */
+export async function ssrRenderer(devServer) {
+  /** @type {typeof import("../ssr-renderer.ts")} */
+  // oxlint-disable-next-line typescript/no-unsafe-assignment -- `ssrLoadModule` types every module `Record<string, any>` and the production import takes a URL computed at run time; both load this template's own `ssr-renderer.ts`, the type named above.
+  const renderer = devServer
+    ? await devServer.ssrLoadModule("/ssr-renderer.ts")
+    : await (productionSsrRenderer ??= import(BUILT_SSR_RENDERER_URL.href));
+  await icons.provideIconCollections(renderer);
+  return renderer;
+}