@antelopejs/dms 0.11.0 → 0.12.0

package/frontend-vue/layers/dms-core/app/composables/auth/usePermissions.ts

@@ -40,31 +40,19 @@ export function usePermissions() {
   const permissions = computed(() => new Set(loaded.value?.ids ?? []));
   const isLoaded = computed(() => loaded.value != null);
 
-  // A caller that only needs a set joins the load in flight instead of
-  // starting another: one request per page however many ask.
   async function loadPermissions(): Promise<void> {
-    // The load it joined may be cleared meanwhile (another account): its
-    // answer is dropped, and this caller still needs one.
     for (let attempt = 0; attempt < 2 && !loaded.value; attempt++) {
       const result = await permissionsData();
       if (!result.data.value && result.error.value) throw result.error.value;
     }
   }
 
-  // A refresh (the set changed on the backend) asked while a read is in
-  // flight replaces it rather than taking its older answer, so an
-  // invalidation is never swallowed. A failed one keeps the last set, and
-  // rejects so the caller knows it is stale.
   async function fetchPermissions(): Promise<void> {
     if (loaded.value) await refreshLoadedSet();
     else await refreshDmsData(PERMISSIONS_KEY);
     await loadPermissions();
   }
 
-  // `refreshDmsData` does not say whether the read failed: the set's own
-  // async data does. Its binding lives in a scope stopped once the read
-  // settled, so refreshes do not pile bindings up; the load that brought
-  // the set keeps the key bound, so stopping it never aborts nor evicts.
   async function refreshLoadedSet(): Promise<void> {
     const scope = effectScope(true);
     const data = scope.run(() => permissionsData(false))!;
@@ -73,7 +61,7 @@ export function usePermissions() {
     } finally {
       scope.stop();
     }
-    // A later refresh that replaced this one reports its own failure.
+
     if (data.status.value === "error") throw data.error.value;
   }
 
@@ -88,8 +76,6 @@ export function usePermissions() {
     return set.has(WILDCARD_PERMISSION) || set.has(permissionId);
   }
 
-  // Empties the set and drops the answer of a read in flight, so a logout or
-  // an account switch is never overwritten by the previous account's set.
   function clear() {
     permissionsData(false).clear();
   }

package/frontend-vue/layers/dms-core/app/composables/auth/useSessionRecovery.ts

@@ -6,18 +6,13 @@ const IN_FLIGHT_REFRESH_KEY = "__dmsAuthInFlightRefresh";
 export const useSessionRecovery = () => {
   const dmsApp = useDmsApp();
   const { loggedIn, fetch: fetchSession } = useDmsUserSession();
-  // useDmsRoute() must not be called here: this composable runs inside route
-  // middleware (via useAuthFetch), where the DMS runtime warns that useDmsRoute is
-  // misleading. Resolve the route lazily from the router instead.
+
   const router = useDmsRouter();
 
-  // Refresh the user session at most once concurrently (see runDeduped): the
-  // realtime stream, $authFetch and route middleware can all hit a 401 at the
-  // same time, and parallel /api/auth/refresh calls with the same rotating
-  // refresh token would invalidate the session and log the user out.
   function refreshSession(): Promise<boolean> {
     return runDeduped(
-      dmsApp as unknown as Record<PropertyKey, unknown>,
+      // oxlint-disable-next-line anti-slop/no-chained-type-assertions, anti-slop/require-safety-comment-for-type-assertion -- DmsAppContext lacks runDeduped's arbitrary property index. Owner-derived holder typing still requires this conversion; preserve the shared app holder without a wrapper or changed identity.
+      dmsApp as unknown as Parameters<typeof runDeduped>[0],
       IN_FLIGHT_REFRESH_KEY,
       () =>
         fetchSession()

package/frontend-vue/layers/dms-core/app/composables/components/useComponentEvent.ts

@@ -1,6 +1,10 @@
 import { isUndefined } from "../../utils/type-check";
 
-function sendComponentEvent(name: string, componentId: string, data?: unknown) {
+function sendComponentEvent(
+  name: string,
+  componentId: string,
+  data?: ComponentEventData["data"],
+) {
   if (!isUndefined(window)) {
     const customEvent = new CustomEvent<ComponentEventData>(name, {
       detail: {

package/frontend-vue/layers/dms-core/app/composables/data-types/useDataType.ts

@@ -11,6 +11,7 @@ export type RecordWithDefault<T> = Record<string, T> & { default: T };
  * shorter grid rendering), `empty` (drawn instead of the fallback for a
  * null/undefined value), and one per compare mode for filter chips.
  */
+/* oxlint-disable anti-slop/no-unknown-parameters, anti-slop/no-unknown-returns, anti-slop/no-unsafe-dictionary-type -- These declarations own the open module data-type extension contract. No shared schema exists for plugin values, options, rows or render results; inference from built-in implementations would exclude third-party formats. */
 export type DataTypeFormatter = (
   value: unknown,
   locale: string,
@@ -43,6 +44,7 @@ export type DataTypeValueComparer = (
  * keeps its text, so the query is unchanged.
  */
 export type DataTypeFilterEditorValue = (text: string, mode: string) => unknown;
+/* oxlint-enable anti-slop/no-unknown-parameters, anti-slop/no-unknown-returns, anti-slop/no-unsafe-dictionary-type */
 
 /**
  * Where the rows a value names are read: the `select` route of the table a
@@ -71,7 +73,9 @@ export interface DataType {
    * relation): where those rows are read, from the options of the type's
    * control. A filter chip or a read-only list names the ids through it.
    */
-  selectSource?: (options: unknown) => DataTypeSelectSource | undefined;
+  selectSource?: (
+    options: Parameters<DataTypeFormatter>[2],
+  ) => DataTypeSelectSource | undefined;
   displayComponent?: Component;
 }
 const dataTypes: Record<string, DataType> = {};

package/frontend-vue/layers/dms-core/app/composables/functions/useDefinedFunction.ts

@@ -1,4 +1,10 @@
-type CallableFunction = (...args: any[]) => unknown;
+import type { isFunction } from "../../utils/type-check";
+
+type CallableFunction = typeof isFunction extends (
+  value: Parameters<typeof isFunction>[0],
+) => value is infer Fn
+  ? Fn
+  : never;
 
 const registeredFunctions = ref<Map<string, CallableFunction>>(new Map());
 

package/frontend-vue/layers/{dms-layout → dms-core}/app/composables/page/useSiteLayout.ts

@@ -14,13 +14,17 @@ interface PageLayoutRequest {
   promise: Promise<PageLayout>;
 }
 
+declare module "#dms/frontend-module" {
+  interface DmsAppContext {
+    [IN_FLIGHT_SITE_LAYOUT_KEY]?: Promise<boolean> | null;
+    [IN_FLIGHT_PAGE_LAYOUTS_KEY]?: Map<string, PageLayoutRequest>;
+  }
+}
+
 interface MatchRouteOptions {
   includeCategories: boolean;
 }
 
-// The categories a URL resolves against, by slug, per served layout: the
-// layout lists them by full id, and a `urlTransparent` one answers at its
-// parent's slug, so it is never a URL's target.
 const navigableCategoriesByLayout = new WeakMap<
   SiteLayout,
   Map<string, CategoryInfo>
@@ -49,20 +53,12 @@ interface MatchRouteResult {
   params: Record<string, string>;
 }
 
-// A route pattern can carry the same placeholder name twice: a page-mode form
-// sub-page under a page whose own slug is `:id` resolves to
-// `/workspaces/:id/invoiceTable/:id/edit`. The bare name holds the LAST
-// occurrence, so `params.id` keeps meaning the row id the way it does on every
-// single-placeholder form route, and each occurrence of a repeated name is
-// exposed as well under `<name>:<n>`, numbered from 1 in pattern order, so the
-// id of the carrying page stays reachable as `id:1`. A name that occurs only
-// once gets no indexed key: those bags are exactly what they were.
 const OCCURRENCE_KEY_SEPARATOR = ":";
 
 const occurrenceKey = (name: string, occurrence: number): string =>
   `${name}${OCCURRENCE_KEY_SEPARATOR}${occurrence}`;
 
-function countByName(names: string[]): Record<string, number> {
+function countByName(names: string[]) {
   const totals: Record<string, number> = {};
   for (const name of names) {
     totals[name] = (totals[name] ?? 0) + 1;
@@ -70,10 +66,7 @@ function countByName(names: string[]): Record<string, number> {
   return totals;
 }
 
-function buildParamBag(
-  names: string[],
-  values: string[],
-): Record<string, string> {
+function buildParamBag(names: string[], values: string[]) {
   const totals = countByName(names);
   const seen: Record<string, number> = {};
   const params: Record<string, string> = {};
@@ -118,7 +111,7 @@ export function extractRouteParams(
  */
 function reloadSiteLayoutAndPage(): Promise<void> {
   return new Promise((resolve, reject) => {
-    let failure: unknown;
+    let failure: Error | undefined;
     inertiaRouter.reload({
       only: ["shared", "page"],
       onHttpException: (response) => {
@@ -178,7 +171,23 @@ function applySiteLayoutResponse(
   state.lastRefreshTime.value = Date.now();
 }
 
-export const useSiteLayout = () => {
+function useSiteLayoutRequestsInFlight() {
+  const dmsApp = useDmsApp();
+  const pageLayoutPromises =
+    dmsApp[IN_FLIGHT_PAGE_LAYOUTS_KEY] ?? new Map<string, PageLayoutRequest>();
+  dmsApp[IN_FLIGHT_PAGE_LAYOUTS_KEY] = pageLayoutPromises;
+  const loadingPromise = {
+    get value(): Promise<boolean> | null {
+      return dmsApp[IN_FLIGHT_SITE_LAYOUT_KEY] ?? null;
+    },
+    set value(promise: Promise<boolean> | null) {
+      dmsApp[IN_FLIGHT_SITE_LAYOUT_KEY] = promise;
+    },
+  };
+  return { pageLayoutPromises, loadingPromise };
+}
+
+const useSiteLayoutRequests = () => {
   const state = useSiteLayoutState();
   const {
     siteLayout,
@@ -197,31 +206,14 @@ export const useSiteLayout = () => {
     () => ({}),
   );
 
-  // Held on the DMS app rather than in a per-call ref: every caller of
-  // useSiteLayout writes the same shared layout state, so they have to see the
-  // same in-flight fetch. Two instances each running their own would let the
-  // older answer land last and overwrite the fresher menu. Not useDmsState —
-  // a promise does not survive the SSR payload — and not module scope, which
-  // the server would share across requests. Same holder as the session
-  // refresh dedup (see runDeduped).
-  const dmsApp = useDmsApp() as unknown as Record<PropertyKey, unknown>;
-  const pageLayoutPromises =
-    (dmsApp[IN_FLIGHT_PAGE_LAYOUTS_KEY] as Map<string, PageLayoutRequest>) ??
-    new Map<string, PageLayoutRequest>();
-  dmsApp[IN_FLIGHT_PAGE_LAYOUTS_KEY] = pageLayoutPromises;
-  const loadingPromise = {
-    get value(): Promise<boolean> | null {
-      return (dmsApp[IN_FLIGHT_SITE_LAYOUT_KEY] as Promise<boolean>) ?? null;
-    },
-    set value(promise: Promise<boolean> | null) {
-      dmsApp[IN_FLIGHT_SITE_LAYOUT_KEY] = promise;
-    },
-  };
+  const { pageLayoutPromises, loadingPromise } =
+    useSiteLayoutRequestsInFlight();
 
   const SITE_LAYOUT_ERROR_MESSAGE = "Error loading siteLayout";
   const UNKNOWN_SITE_LAYOUT_ERROR = "Unknown error loading siteLayout";
   const HTTP_INTERNAL_ERROR = 500;
 
+  // oxlint-disable-next-line anti-slop/no-unknown-parameters -- Fetch rejection values have no shared owner schema; an Error-only input would exclude malformed thrown values that intentionally use the fallback message.
   const handleSiteLayoutError = (error: unknown) => {
     const errorMessage =
       error instanceof Error ? error.message : UNKNOWN_SITE_LAYOUT_ERROR;
@@ -236,7 +228,7 @@ export const useSiteLayout = () => {
   const requestSiteLayout = async (): Promise<boolean> => {
     const initialLayout = siteLayout.value;
     const initialCache = pageLayouts.value;
-    // A layout another request committed meanwhile is newer than this one.
+
     const isCurrent = () =>
       siteLayout.value === initialLayout && pageLayouts.value === initialCache;
     const { $authFetch } = useAuthFetch();
@@ -253,7 +245,7 @@ export const useSiteLayout = () => {
   const startSiteLayoutFetch = (): Promise<boolean> => {
     const started = requestSiteLayout().finally(() => {
       isLoading.value = false;
-      // A waiting refresh may already have started its replacement request.
+
       if (loadingPromise.value === started) loadingPromise.value = null;
     });
     return started;
@@ -277,20 +269,13 @@ export const useSiteLayout = () => {
     pageLayouts.value = {};
   }
 
-  // A background resync (a realtime menu invalidation) goes through `resync`.
   const refresh = async () => {
     clearPageLayoutCaches();
 
-    // A fetch already in flight was started before whatever prompted this
-    // call, so its answer cannot contain the change: joining it would report
-    // success on stale data and leave the menu wrong until the next event or
-    // the staleness refresh, minutes later. Let it settle, then run exactly
-    // one more — however many refreshes piled up while it was running.
     const inFlight = loadingPromise.value;
     if (inFlight) {
       await inFlight.catch(() => undefined);
-      // The settled promise is still parked here — its cleanup runs a
-      // microtask later — so drop it explicitly rather than joining it again.
+
       if (loadingPromise.value === inFlight) {
         loadingPromise.value = null;
       }
@@ -326,6 +311,82 @@ export const useSiteLayout = () => {
     await refresh();
   };
 
+  return {
+    state,
+    siteLayout,
+    siteLayoutTree,
+    quickActions,
+    modules,
+    isOwner,
+    pageLayouts,
+    pageLayoutPromises,
+    isLoading,
+    loadingError,
+    loadSiteLayout,
+    refresh,
+    resync,
+    refreshIfStale,
+    clearPageLayoutCaches,
+  };
+};
+
+function matchRoute(
+  path: string,
+  layout: SiteLayout,
+  options: MatchRouteOptions,
+): MatchRouteResult | null {
+  const normalizedPath = withoutTrailingSlash(path) || "/";
+
+  if (layout.pages[normalizedPath]) {
+    return {
+      pattern: normalizedPath,
+      metadata: layout.pages[normalizedPath],
+      params: {},
+    };
+  }
+
+  const category = options.includeCategories
+    ? findNavigableCategory(layout, normalizedPath)
+    : undefined;
+  if (category) {
+    return { pattern: normalizedPath, metadata: category, params: {} };
+  }
+
+  for (const [pattern, metadata] of Object.entries(layout.pages)) {
+    if (pattern.includes(":")) {
+      const params = extractRouteParams(pattern, normalizedPath);
+      if (params) {
+        return {
+          pattern,
+          metadata,
+          params,
+        };
+      }
+    }
+  }
+
+  return null;
+}
+
+export const useSiteLayout = () => {
+  const {
+    state,
+    siteLayout,
+    siteLayoutTree,
+    quickActions,
+    modules,
+    isOwner,
+    pageLayouts,
+    pageLayoutPromises,
+    isLoading,
+    loadingError,
+    loadSiteLayout,
+    refresh,
+    resync,
+    refreshIfStale,
+    clearPageLayoutCaches,
+  } = useSiteLayoutRequests();
+
   /**
    * The layout of a page, cached by its layout URL. `query` is the page
    * URL's, which the first request carries for the header buttons whose
@@ -368,44 +429,6 @@ export const useSiteLayout = () => {
     }
   };
 
-  function matchRoute(
-    path: string,
-    layout: SiteLayout,
-    options: MatchRouteOptions,
-  ): MatchRouteResult | null {
-    const normalizedPath = withoutTrailingSlash(path) || "/";
-
-    if (layout.pages[normalizedPath]) {
-      return {
-        pattern: normalizedPath,
-        metadata: layout.pages[normalizedPath],
-        params: {},
-      };
-    }
-
-    const category = options.includeCategories
-      ? findNavigableCategory(layout, normalizedPath)
-      : undefined;
-    if (category) {
-      return { pattern: normalizedPath, metadata: category, params: {} };
-    }
-
-    for (const [pattern, metadata] of Object.entries(layout.pages)) {
-      if (pattern.includes(":")) {
-        const params = extractRouteParams(pattern, normalizedPath);
-        if (params) {
-          return {
-            pattern,
-            metadata,
-            params,
-          };
-        }
-      }
-    }
-
-    return null;
-  }
-
   const findMatchingRoute = (
     path: string,
   ): {
@@ -416,6 +439,7 @@ export const useSiteLayout = () => {
     const layout = siteLayout.value;
     if (!layout) return null;
 
+    // SAFETY: includeCategories false skips the category branch, so every non-null match takes metadata directly from layout.pages.
     return matchRoute(path, layout, {
       includeCategories: false,
     }) as ReturnType<typeof findMatchingRoute>;
@@ -434,32 +458,12 @@ export const useSiteLayout = () => {
     return matchRoute(path, layout, { includeCategories: true });
   };
 
-  // Dev-only atomic readiness commit: fetch a FRESH site layout and, ONLY if
-  // `path` resolves in it, commit that exact layout to reactive state and report
-  // success. If the route is absent (mid hot reload, when only some modules have
-  // re-registered) nothing is committed and it returns false so the caller keeps
-  // polling.
-  //
-  // The check and the commit share a single fetch deliberately. A previous
-  // version probed with one fetch and then let `refresh()` re-fetch and commit
-  // with a second — a TOCTOU gap. A hot reload can re-register a module more
-  // than once in quick succession, so a second unregister burst could land
-  // between the probe and the commit, making `refresh()` commit a layout that no
-  // longer contains the route and 404 the page the user is on. Committing the
-  // very layout we validated closes that window.
   const probeAndCommitRoute = async (path: string): Promise<boolean> => {
-    // Dev-only: this fires an extra /dms/sitelayout fetch and exists solely for
-    // the dev-reload plugin. It stays in the composable's return (guarding the
-    // export would make it optional and break the plugin's call site), so no-op
-    // outside dev to keep accidental production use from issuing the request.
     if (!import.meta.env.DEV) return false;
     const { $authFetch } = useAuthFetch();
     try {
       const result = await $authFetch<SiteLayoutResponse>(SITE_LAYOUT_ENDPOINT);
-      // Mirror the page renderer's resolution (findMatchingRoute, pages-only):
-      // the page at `pages/[...slug].vue` and the auth/module-routing middleware
-      // all match with includeCategories:false, so a category-only match here
-      // would commit a layout the renderer still 404s. Gate on a real page.
+
       if (
         matchRoute(path, result.siteLayout, { includeCategories: false }) ===
         null
@@ -507,15 +511,14 @@ export function useRenderedSiteLayout(): void {
   const state = useSiteLayoutState();
   if (state.siteLayout.value) return;
   const layout = useSiteLayout();
-  // Through `loadSiteLayout`, which sets the state: a middleware loading it
-  // at the same time (the auth guard of a custom page) joins this request.
+
   const { data } = useApiData<SiteLayoutResponse | null>(
     RENDERED_SITE_LAYOUT_KEY,
     async () => {
       await layout.loadSiteLayout();
       const { siteLayout, siteLayoutTree, quickActions, modules, isOwner } =
         state;
-      // What the page payload carries: the plain values, not the state.
+
       return siteLayout.value
         ? {
             siteLayout: toRaw(siteLayout.value),

package/frontend-vue/layers/dms-core/app/composables/period/compareResolvers.ts

@@ -5,7 +5,6 @@ const NON_OVERLAP_GAP_MS = 1;
 
 const MS_PER_DAY = 24 * 60 * 60 * 1000;
 
-// In the reader's calendar (`readerClock`), as the range was resolved.
 function isLocalMidnight(date: Date): boolean {
   const { hours, minutes, seconds, milliseconds } = readerClock().wall(date);
   return hours === 0 && minutes === 0 && seconds === 0 && milliseconds === 0;
@@ -33,8 +32,6 @@ function isWholeDayRange(range: PeriodRange): boolean {
 const MONTHS_PER_YEAR = 12;
 const MONTHS_PER_QUARTER = 3;
 
-// The calendar unit a preset counts in, in months: its previous period is
-// the previous month, quarter or year, not the same number of days before.
 const PRESET_MONTH_SPANS: Partial<Record<PeriodPreset, number>> = {
   "this-month": 1,
   "last-month": 1,
@@ -60,7 +57,7 @@ function shiftMonths(date: Date, months: number): Date {
   const clock = readerClock();
   const wall = clock.wall(date);
   const month = wall.month + months;
-  // Day 0 of the next month is the last day of this one.
+
   const lastDay = clock.wall(
     clock.instant({ ...wall, month: month + 1, day: 0 }),
   ).day;
@@ -138,7 +135,6 @@ function shiftCalendarPeriod(
   const from = shiftMonths(range.from, -months);
   const isComplete = end.getTime() === range.to.getTime();
   if (isComplete && isMonthStart(afterRange(range))) {
-    // The span before ends where the range starts: August, then September.
     return { from, to: new Date(range.from.getTime() - NON_OVERLAP_GAP_MS) };
   }
   return { from, to: endOfDay(shiftMonths(end, -months)) };
@@ -156,8 +152,6 @@ function shiftPreviousPeriod(
 }
 
 function shiftEqualLength(range: PeriodRange): PeriodRange {
-  // Whole-day ranges move by calendar days, so a span crossing a daylight
-  // saving change still starts at midnight (a fixed-ms shift lands an hour off).
   if (isWholeDayRange(range)) {
     const end = range.to.getTime() + NON_OVERLAP_GAP_MS;
     const days = Math.round((end - range.from.getTime()) / MS_PER_DAY);

package/frontend-vue/layers/dms-core/app/composables/period/periodClock.ts

@@ -96,14 +96,13 @@ export function zonedClock(timeZone: string): PeriodClock {
       milliseconds: date.getUTCMilliseconds(),
     };
   };
-  // The zone's offset at an instant: how far its wall clock is from UTC.
+
   const offsetAt = (time: number) => utcOf(wall(new Date(time))) - time;
   return {
     wall,
     instant: (target) => {
       const asUtc = utcOf(target);
-      // Twice: the offset at the first guess is the right one unless the
-      // guess and the answer fall on either side of a daylight saving change.
+
       const guess = asUtc - offsetAt(asUtc);
       return new Date(asUtc - offsetAt(guess));
     },

package/frontend-vue/layers/dms-core/app/composables/period/periodLink.ts

@@ -1,3 +1,6 @@
+import { isString } from "../../utils/type-check";
+import type { ValidationRouteContext } from "../../utils/query-validation";
+
 /** The keys one `PeriodSelector` keeps its period under in the page URL. */
 export interface PeriodQueryKeys {
   period: string;
@@ -8,14 +11,6 @@ export interface PeriodQueryKeys {
   compareTo: string;
 }
 
-const KEY_NAMES: Array<keyof PeriodQueryKeys> = [
-  "period",
-  "compare",
-  "from",
-  "to",
-  "compareFrom",
-  "compareTo",
-];
 const QUERY_SEPARATOR = "?";
 const FRAGMENT_SEPARATOR = "#";
 
@@ -25,14 +20,21 @@ const FRAGMENT_SEPARATOR = "#";
  */
 export function periodQueryKeys(id?: string): PeriodQueryKeys {
   const prefix = id ? `${id}.` : "";
-  return Object.fromEntries(
-    KEY_NAMES.map((name) => [name, `${prefix}${name}`]),
-  ) as unknown as PeriodQueryKeys;
+  return {
+    period: `${prefix}period`,
+    compare: `${prefix}compare`,
+    from: `${prefix}from`,
+    to: `${prefix}to`,
+    compareFrom: `${prefix}compareFrom`,
+    compareTo: `${prefix}compareTo`,
+  };
 }
 
-function firstText(value: unknown): string | undefined {
+function firstText(
+  value: Parameters<typeof withPeriodQuery>[1][string],
+): string | undefined {
   const text = Array.isArray(value) ? value[0] : value;
-  return typeof text === "string" && text ? text : undefined;
+  return isString(text) && text ? text : undefined;
 }
 
 /**
@@ -43,7 +45,7 @@ function firstText(value: unknown): string | undefined {
  */
 export function withPeriodQuery(
   link: string,
-  query: Record<string, unknown>,
+  query: ValidationRouteContext["query"],
   id: string,
 ): string {
   const [beforeFragment = "", ...fragment] = link.split(FRAGMENT_SEPARATOR);

package/frontend-vue/layers/dms-core/app/composables/period/presetResolvers.ts

@@ -10,8 +10,6 @@ import {
 } from "./types";
 import { readerClock } from "./periodClock";
 
-// Resolved in the reader's calendar (`readerClock`): the browser's zone, on
-// the server as in the browser.
 function atTime(
   date: Date,
   hours: number,

package/frontend-vue/layers/dms-core/app/composables/period/usePeriod.ts

@@ -212,9 +212,7 @@ export function usePeriod(options: UsePeriodOptions = {}): UsePeriodReturn {
     () => options.comparisons ?? DEFAULT_COMPARISONS,
   );
   const presetClock = usePresetClock(refs.preset, options.holdClock);
-  // The server render's instant, until the clock ticks or the period changes
-  // once on screen: what the setup applies (the URL's period) the server
-  // applied as well.
+
   const serverNow = serverRenderNow();
   const renderNow = shallowRef(serverNow === null ? null : new Date(serverNow));
   if (renderNow.value) {

package/frontend-vue/layers/dms-core/app/composables/period/usePeriodScope.ts

@@ -18,8 +18,6 @@ function createRegistry(): PeriodScopeRegistry {
   return markRaw({ scopes: new Map(), version: ref(0) });
 }
 
-// A browser tab runs one application, whose scopes every caller shares; a
-// server renders many requests at once, each with its own scopes.
 const browserRegistry = createRegistry();
 
 function usePeriodScopeRegistry(): PeriodScopeRegistry {

package/frontend-vue/layers/dms-core/app/composables/realtime/usePageRealtime.ts

@@ -49,7 +49,6 @@ export function usePageRealtime(
   const resolvedPageId = computed(() => toValue(pageId) || undefined);
 
   if (import.meta.env.SSR) {
-    // No dispose runs on the server, so a claim there would never be released.
     void user.setPage(resolvedPageId.value ?? null);
   } else {
     const claim: PageClaim = { pageId: undefined };

package/frontend-vue/layers/dms-core/app/composables/realtime/useSseStream.ts

@@ -1,8 +1,10 @@
 import { HTTP_UNAUTHORIZED } from "../../utils/http-status";
+import { isObject } from "../../utils/type-check";
 
 /** Receives decoded data and the frame's id (null if absent, empty if reset). */
 export type SseEventHandler = (
   eventName: string,
+  // oxlint-disable-next-line anti-slop/no-unknown-parameters -- The transport forwards arbitrary JSON or raw text. Event consumers own payload parsing; an event-specific schema would narrow this public transport.
   data: unknown,
   id: string | null,
 ) => void;
@@ -16,6 +18,7 @@ export interface SseStreamOptions {
   headers?: () => Record<string, string>;
   onEvent: SseEventHandler;
   onOpen?: () => void;
+  // oxlint-disable-next-line anti-slop/no-unknown-parameters -- Fetch, stream readers, and caller callbacks can all throw arbitrary values. No single Error owner contract covers these failures.
   onError?: (error: unknown) => void;
   /** Called once after cleanup; errors call onError first. Retry on only one callback. */
   onClose?: (reason: SseCloseReason) => void;
@@ -65,7 +68,7 @@ function parseFrame(frame: string): ParsedFrame | null {
   };
 }
 
-function decodeData(data: string): unknown {
+function decodeData(data: string): Parameters<SseEventHandler>[1] {
   try {
     return JSON.parse(data);
   } catch {
@@ -146,11 +149,11 @@ async function connect(
 }
 
 /** Whether a stream error carries HTTP 401 and may need session recovery. */
-export function isUnauthorizedStreamError(error: unknown): boolean {
+export function isUnauthorizedStreamError(
+  error: Parameters<NonNullable<SseStreamOptions["onError"]>>[0],
+): boolean {
   return (
-    typeof error === "object" &&
-    error !== null &&
-    (error as StreamError).status === HTTP_UNAUTHORIZED
+    isObject(error) && error !== null && error.status === HTTP_UNAUTHORIZED
   );
 }