@antelopejs/dms 0.11.1 → 0.12.1

package/frontend-vue/layers/dms-ui/app/build/composables/table-view/utils/reorder.ts

@@ -16,8 +16,12 @@ export function moveRow<T>(rows: readonly T[], from: number, to: number): T[] {
   return next;
 }
 
-const positionOf = (row: unknown, field: string): number | undefined => {
-  const value = Number(get(row as Record<string, unknown>, field));
+const positionOf = (
+  row: Parameters<typeof reorderEdits>[0][number],
+  field: string,
+): number | undefined => {
+  // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- reorderEdits accepts arbitrary rows. Nuxt get's object declaration cannot describe its null and primitive handling; preserve the unchecked lookup using its owner input type.
+  const value = Number(get(row as Parameters<typeof get>[0], field));
   return Number.isFinite(value) ? value : undefined;
 };
 
@@ -48,8 +52,9 @@ export function reorderEdits(
   field: string,
   rowIdKey: string,
 ): ReorderEdit[] {
-  const idOf = (row: unknown) =>
-    String(get(row as Record<string, unknown>, rowIdKey));
+  const idOf = (row: (typeof rows)[number]) =>
+    // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- Arbitrary rows remain part of reorderEdits' contract. The get owner requires objects but its implementation also reads primitives and missing neighbours.
+    String(get(row as Parameters<typeof get>[0], rowIdKey));
   const slot = slotBetween(
     positionOf(rows[movedIndex - 1], field),
     positionOf(rows[movedIndex + 1], field),

package/frontend-vue/layers/dms-ui/app/build/composables/table-view/utils/sortableColumns.ts

@@ -1,4 +1,9 @@
 import type { SortingState } from "@tanstack/vue-table";
+import {
+  isNumber,
+  isObject as hasObjectType,
+  isString,
+} from "#dms-core/app/utils/type-check";
 
 /** The part of a column config sorting depends on. */
 interface SortableColumnLike {
@@ -48,7 +53,7 @@ export const sanitizeSorting = (
   sortable: ReadonlySet<string>,
 ): SortingState => {
   const [first] = Array.isArray(sorting) ? sorting : [];
-  if (!first || typeof first.id !== "string" || !sortable.has(first.id)) {
+  if (!first || !isString(first.id) || !sortable.has(first.id)) {
     return [];
   }
   return [{ id: first.id, desc: first.desc === true }];
@@ -170,24 +175,24 @@ export const sortDirectionLabelKey = (
   desc: boolean,
 ): string => `dms.sort.direction.${kind}.${desc ? "desc" : "asc"}`;
 
-const isObject = (value: unknown): value is Record<string, unknown> =>
-  typeof value === "object" && value !== null;
+/* oxlint-disable anti-slop/no-unsafe-dictionary-type -- This error parser accepts arbitrary thrown values, including non-ofetch objects and inherited fields. No common error schema owns these values; validating a FetchError would change which errors match. */
+const isObject = (
+  value: Parameters<typeof isUnsortableFieldError>[0],
+): value is Record<string, unknown> => hasObjectType(value) && value !== null;
 
 const statusOf = (error: Record<string, unknown>): number | undefined => {
   const response = isObject(error.response) ? error.response : undefined;
   const status = error.statusCode ?? error.status ?? response?.status;
-  return typeof status === "number" ? status : undefined;
+  return isNumber(status) ? status : undefined;
 };
 
 const messagesOf = (error: Record<string, unknown>): string[] => {
   const { data } = error;
   return [
-    typeof data === "string" ? data : undefined,
-    isObject(data) && typeof data.message === "string"
-      ? data.message
-      : undefined,
-    typeof error.statusMessage === "string" ? error.statusMessage : undefined,
-    typeof error.message === "string" ? error.message : undefined,
+    isString(data) ? data : undefined,
+    isObject(data) && isString(data.message) ? data.message : undefined,
+    isString(error.statusMessage) ? error.statusMessage : undefined,
+    isString(error.message) ? error.message : undefined,
   ].filter((message): message is string => !!message);
 };
 
@@ -196,6 +201,7 @@ const messagesOf = (error: Record<string, unknown>): string[] => {
  * not sortable.`): a sort the route never accepted, or a column whose
  * `@Sortable()` was removed since the page was loaded.
  */
+// oxlint-disable-next-line anti-slop/no-unknown-parameters -- Any JavaScript value may be thrown. FetchError is not the owner of every rejection; inference cannot narrow the input without excluding existing false-result cases.
 export const isUnsortableFieldError = (error: unknown): boolean => {
   if (!isObject(error)) return false;
   const status = statusOf(error);
@@ -204,3 +210,4 @@ export const isUnsortableFieldError = (error: unknown): boolean => {
     UNSORTABLE_FIELD_PATTERN.test(message),
   );
 };
+/* oxlint-enable anti-slop/no-unsafe-dictionary-type */

package/frontend-vue/layers/dms-ui/app/build/composables/table-view/utils/tableQuery.ts

@@ -27,7 +27,7 @@ export const isFilterEffective = (filter: TableFilter): boolean => {
   if (NO_VALUE_COMPARE_MODES.has(filter.mode)) return true;
   const value = filter.value;
   if (value === undefined || value === null) return false;
-  if (typeof value === "string" && value === "") return false;
+  if (value === "") return false;
   if (Array.isArray(value)) {
     if (value.length === 0) return false;
     if (value.some((v) => v === undefined || v === null || v === "")) {
@@ -38,13 +38,12 @@ export const isFilterEffective = (filter: TableFilter): boolean => {
 };
 
 const buildFiltersQuery = (filters: TableFilter[]): Record<string, string> => {
-  return filters.filter(isFilterEffective).reduce(
-    (acc, val) => {
+  return filters
+    .filter(isFilterEffective)
+    .reduce<Record<string, string>>((acc, val) => {
       acc[`filter_${val.accessorKey}`] = `${val.mode}:${val.value}`;
       return acc;
-    },
-    {} as Record<string, string>,
-  );
+    }, {});
 };
 
 /**
@@ -58,7 +57,7 @@ const combineFilters = (
   hidden: Record<string, string>,
   column: Record<string, string>,
 ): Record<string, string | string[]> => {
-  const combined: Record<string, string | string[]> = { ...hidden };
+  const combined: ReturnType<typeof combineFilters> = { ...hidden };
   for (const [key, value] of Object.entries(column)) {
     const hiddenValue = hidden[key];
     combined[key] =
@@ -66,6 +65,7 @@ const combineFilters = (
         ? value
         : [hiddenValue, value];
   }
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- The return owner permits collision arrays for arbitrary filter keys; returning the owner-typed accumulator preserves that contract and inherited-key lookups.
   return combined;
 };
 

package/frontend-vue/layers/dms-ui/app/build/composables/table-view/utils/urlFilters.ts

@@ -1,12 +1,13 @@
 import type { TableUrlFilter } from "../../../components/table/Table.vue";
 import type { QueryParamFilters } from "../../../../composables/table-view/types/config";
+import type { LocationQuery } from "#dms/frontend-module";
 
 const DEFAULT_FILTER_MODE = "is";
 
 /** The `queryParamFilters` declared `visible` that the URL applies now. */
 export function visibleUrlFilters(
   filters: QueryParamFilters | undefined,
-  query: Record<string, unknown>,
+  query: LocationQuery,
 ): TableUrlFilter[] {
   return Object.entries(filters ?? {})
     .filter(([param, config]) => config.visible && query[param] !== undefined)
@@ -20,12 +21,12 @@ export function visibleUrlFilters(
 }
 
 /** The URL query without `param`, for a chip the user removed. */
-export function withoutQueryParam<Query extends Record<string, unknown>>(
+export function withoutQueryParam<Query extends LocationQuery>(
   query: Query,
   param: string,
-): Query {
+) {
   const { [param]: _removed, ...rest } = query;
-  return rest as Query;
+  return rest;
 }
 
 /** The query of a URL, absolute or relative to the page, one value per key. */
@@ -39,9 +40,7 @@ export function queryOfUrl(url: string): Record<string, string> {
  * route, which follows the last visit, can still hold a key the browser no
  * longer shows: a visit rebuilt from it would bring the key back.
  */
-export function currentQuery(
-  routeQuery: Record<string, unknown>,
-): Record<string, unknown> {
+export function currentQuery(routeQuery: LocationQuery): LocationQuery {
   if (typeof window === "undefined") return routeQuery;
   return queryOfUrl(window.location.href);
 }

package/frontend-vue/layers/dms-ui/app/build/composables/table-view/utils/views.ts

@@ -1,4 +1,5 @@
 import type { SortingState, VisibilityState } from "@tanstack/vue-table";
+import { isString } from "#dms-core/app/utils/type-check";
 import type {
   TableViewViewConfig,
   TableViewViewStateConfig,
@@ -9,6 +10,7 @@ import type {
 } from "../../../components/table/Table.vue";
 import { mergeColumnOrder } from "../../table/utils/columnOrder";
 import { isFilterEffective } from "./tableQuery";
+import type { LocationQuery } from "#dms/frontend-module";
 
 /** Everything a view sets on the table, as the table holds it. */
 export interface TableStateSnapshot {
@@ -214,9 +216,7 @@ export function writeTableUrlKey(
   const scopedKey = tableUrlKey(scope, key);
   if (value) url.searchParams.set(scopedKey, value);
   else url.searchParams.delete(scopedKey);
-  // The only table reads its prefixed key first (`readTableUrlKey`): a link
-  // naming it (`content.tab=`) would otherwise outlive the short key written
-  // over it, and win again on reload.
+
   if (scope.tableId && scopedKey === key) {
     url.searchParams.delete(`${scope.tableId}.${key}`);
   }
@@ -234,14 +234,14 @@ const readUrlValue = (value: string): UrlKeyReading =>
  * left empty reads as cleared, not as absent.
  */
 export function readTableUrlKey(
-  query: Record<string, unknown>,
+  query: LocationQuery,
   scope: TableUrlScope,
   key: string,
 ): UrlKeyReading {
   const prefixed = scope.tableId ? query[`${scope.tableId}.${key}`] : undefined;
-  if (typeof prefixed === "string") return readUrlValue(prefixed);
+  if (isString(prefixed)) return readUrlValue(prefixed);
   const short = query[key];
-  if (typeof short !== "string") return {};
+  if (!isString(short)) return {};
   if (scope.isSoleTableView) return readUrlValue(short);
   return short ? { ignoredShortKey: true } : {};
 }

package/frontend-vue/layers/dms-ui/app/build/composables/table-view/utils/writeError.ts

@@ -9,7 +9,7 @@ import { resolveActionError } from "../../confirm/actionError";
  * required."). Never the raw ofetch error line.
  */
 export function describeTableWriteError(
-  error: unknown,
+  error: Parameters<typeof resolveActionError>[0],
   translate: I18nTranslate,
   columns: ReadonlyArray<Pick<TableViewColumn, "accessorKey" | "header">>,
   processI18n: (text: string) => string,

package/frontend-vue/layers/dms-ui/app/build/composables/unsaved-changes/formValue.ts

@@ -1,14 +1,19 @@
+import {
+  isObject,
+  isNumber,
+} from "../../../../../dms-core/app/utils/type-check";
 /**
  * Value comparison behind the "unsaved changes" state of every form: a form
  * is dirty when what it holds differs, by value, from what it loaded (or last
  * saved). Typing a value then putting the original back makes it clean again.
  */
 
+// oxlint-disable-next-line anti-slop/no-unsafe-dictionary-type -- Form controls may hold arbitrary plugin values, including non-JSON instances.
 type PlainObject = Record<string, unknown>;
 
 /** Whether a value is a plain object (not a list, a date, a file or an instance). */
 export function isPlainObject(value: unknown): value is PlainObject {
-  if (typeof value !== "object" || value === null) return false;
+  if (!isObject(value) || value === null) return false;
   if (Array.isArray(value) || value instanceof Date) return false;
   if (typeof Blob !== "undefined" && value instanceof Blob) return false;
   const prototype = Object.getPrototypeOf(value);
@@ -21,10 +26,11 @@ export function isPlainObject(value: unknown): value is PlainObject {
  * filled). A control that empties itself to `""`, `null`, `[]` or `false`
  * leaves its field as clean as one never touched.
  */
+// oxlint-disable-next-line anti-slop/no-unknown-parameters -- Emptiness accepts every value a plugin control can produce without rejecting malformed inputs.
 export function isEmptyFormValue(value: unknown): boolean {
   if (value === undefined || value === null) return true;
   if (value === "" || value === false) return true;
-  if (typeof value === "number") return Number.isNaN(value);
+  if (isNumber(value)) return Number.isNaN(value);
   if (value instanceof Date) return Number.isNaN(value.getTime());
   if (Array.isArray(value)) return value.length === 0;
   if (isPlainObject(value)) return Object.values(value).every(isEmptyFormValue);
@@ -36,6 +42,7 @@ export function isEmptyFormValue(value: unknown): boolean {
  * by item (order counts), objects key by key (whatever their order), dates by
  * their time; any two empty values are the same (see {@link isEmptyFormValue}).
  */
+// oxlint-disable-next-line anti-slop/no-unknown-parameters -- Deep comparison intentionally accepts arbitrary control values on both sides.
 export function sameFormValue(left: unknown, right: unknown): boolean {
   if (Object.is(left, right)) return true;
   const isLeftEmpty = isEmptyFormValue(left);
@@ -70,10 +77,14 @@ export function sameFormValue(left: unknown, right: unknown): boolean {
  */
 export function snapshotFormValue<T>(value: T): T {
   if (Array.isArray(value)) {
+    // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- Preserve the existing generic snapshot contract; array subclasses are not validated here.
     return value.map((item) => snapshotFormValue(item)) as T;
   }
+  // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- The existing clone returns a Date even for subclasses; do not claim that it verifies every T refinement.
   if (value instanceof Date) return new Date(value.getTime()) as T;
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- The plain-object classifier must accept generic values without restricting plugin control types.
   if (isPlainObject(value)) {
+    // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- Preserve the existing generic clone contract without claiming validation of T refinements.
     return Object.fromEntries(
       Object.entries(value).map(([key, part]) => [
         key,
@@ -86,7 +97,9 @@ export function snapshotFormValue<T>(value: T): T {
 
 /** The keys whose value differs between the current values and the baseline. */
 export function changedFormKeys(
+  // oxlint-disable-next-line anti-slop/no-unsafe-dictionary-type -- Field names and values are defined by plugin controls, not a closed schema.
   current: Readonly<Record<string, unknown>>,
+  // oxlint-disable-next-line anti-slop/no-unsafe-dictionary-type -- The saved baseline holds the same arbitrary control values as current.
   baseline: Readonly<Record<string, unknown>>,
   keys: Iterable<string> = new Set([
     ...Object.keys(current),

package/frontend-vue/layers/dms-ui/app/build/composables/unsaved-changes/registry.ts

@@ -62,7 +62,7 @@ function inScope(entry: UnsavedChangesEntry, scope: LeaveScope): boolean {
 export function registerUnsavedChanges(
   source: UnsavedChangesSource,
   prompt: DiscardPrompt,
-): { entry: UnsavedChangesEntry; unregister: () => void } {
+) {
   const entry: UnsavedChangesEntry = { ...source, prompt, released: false };
   entries.add(entry);
   return { entry, unregister: () => entries.delete(entry) };
@@ -113,7 +113,7 @@ export interface BrowserLeaveGuardsOptions {
   /** The path the page shows. */
   path: () => string;
   /** Runs a page visit again once the user chose to leave. */
-  revisit: (href: string) => unknown;
+  revisit: (href: string) => void;
 }
 
 /** The part of a router visit the guard reads (Inertia's `inertia:before`). */
@@ -131,15 +131,15 @@ interface TraverseEvent extends Event {
 }
 
 interface NavigationLike extends EventTarget {
-  traverseTo: (key: string) => unknown;
+  traverseTo: (key: string) => void;
 }
 
 let browserGuardsInstalled = false;
 let currentPath: () => string = () => window.location.pathname;
-let revisit: (href: string) => unknown = (href) => {
+let revisit: BrowserLeaveGuardsOptions["revisit"] = (href) => {
   window.location.href = href;
 };
-// The user chose to leave: the history step run again goes through.
+
 let isTraversing = false;
 
 /**
@@ -173,8 +173,7 @@ export function installBrowserLeaveGuards(
   browserGuardsInstalled = true;
 
   document.addEventListener("inertia:before", (event) => {
-    const visit = (event as CustomEvent<{ visit?: PendingVisit }>).detail
-      ?.visit;
+    const visit = event.detail?.visit;
     if (!isLeavingVisit(visit, currentPath())) return;
     if (!hasUnsavedChanges()) return;
     event.preventDefault();
@@ -187,22 +186,21 @@ export function installBrowserLeaveGuards(
   window.addEventListener("beforeunload", (event) => {
     if (!hasUnsavedChanges()) return;
     event.preventDefault();
-    // Older browsers only prompt when a value is set.
+
     event.returnValue = "";
   });
 
-  const navigation = (window as unknown as { navigation?: NavigationLike })
-    .navigation;
+  // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- Window's DOM declaration omits the optional Navigation API; retain the unchecked property read and unsupported-browser fallback.
+  const navigation = (window as { navigation?: NavigationLike }).navigation;
   navigation?.addEventListener("navigate", (event) => {
-    const traverse = event as TraverseEvent;
+    const traverse: TraverseEvent = event;
     const destination = traverse.destination;
     if (traverse.navigationType !== "traverse" || !destination) return;
     if (isTraversing) {
       isTraversing = false;
       return;
     }
-    // Another document unloads this one: `beforeunload` asks. A hash or
-    // query change keeps the page and its forms.
+
     if (!destination.sameDocument || !traverse.cancelable) return;
     if (new URL(destination.url).pathname === currentPath()) return;
     if (!hasUnsavedChanges()) return;

package/frontend-vue/layers/dms-ui/app/build/types/tree.ts

@@ -28,10 +28,6 @@ function isExcludedFromRoot(item: SiteLayoutTree): boolean {
   );
 }
 
-// A registered entry links to its own slug, narrowed by the query parameters it
-// declares so a single page (with `validation.requiredQueryParams`) can back
-// several entries. The sidebar tells those sibling entries apart itself (see
-// `isMenuItemActive`), so the link stays a plain string.
 export function buildMenuItemTarget(item: SiteLayoutTree): string | undefined {
   if (!item.layoutUrl) {
     return undefined;
@@ -98,10 +94,6 @@ function convertToTreeItems(node: SiteLayoutTree): NavigationMenuItem[][] {
   return groups;
 }
 
-// Module roots are only ever direct children of the `modules` category, so the
-// same walk serves the root menu and a module's own menu. A page left out of
-// the menu (refused, or showing the viewer none of its blocks) hands its
-// place to the pages nested under it that the viewer can open.
 function convertChildrenToItems(node: SiteLayoutTree): NavigationMenuItem[] {
   return node.childrenOrders.flatMap((nodeId): NavigationMenuItem[] => {
     const item = node.children[nodeId]!;
@@ -151,11 +143,7 @@ export function convertSiteLayoutTreeToTreeItemsForModule(
   }
 
   const groups: NavigationMenuItem[][] = [];
-  // Fallback grouping: pages that are direct non-label children of the module
-  // root are wrapped in a synthetic "Pages" group. A module's `defaultCategory`
-  // redirects its loose pages (module set, no explicit category) into a real
-  // category child rendered via `subCategoryGroups` above; pages that instead
-  // target the module root explicitly still land here.
+
   if (pageItems.length > 0) {
     groups.push([
       {

package/frontend-vue/layers/dms-ui/app/build/utils/accessibilityPreferences.ts

@@ -1,13 +1,13 @@
-// Accessibility preferences of the Appearance settings page. Like the theme
-// and the density they belong to the device: one cookie, read by the server,
-// so the classes they put on `<html>` are in the first paint. The page CSS
-// (dms-layout main.css) keys on those classes; JavaScript-driven motion
-// (charts) asks `isReducedMotionActive()`.
-
+/* oxlint-disable anti-slop/no-unsafe-dictionary-type -- The decoded cookie has no validated field contract; this open property lookup implements per-field fallback without rejecting the entire cookie or changing inherited-field access. */
 /**
  * `auto` follows the operating system's `prefers-reduced-motion`; `on` and
  * `off` pin the choice whatever the system says.
  */
+import {
+  isObject,
+  isString,
+  isFunction,
+} from "../../../../dms-core/app/utils/type-check";
 export type ReduceMotionPreference = "auto" | "on" | "off";
 
 export interface AccessibilityPreferences {
@@ -43,13 +43,18 @@ const REDUCE_MOTION_PREFERENCES: ReduceMotionPreference[] = [
   "off",
 ];
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+function isRecord(
+  value: Parameters<typeof isObject>[0],
+): value is Record<string, unknown> {
+  return isObject(value) && value !== null && !Array.isArray(value);
 }
+/* oxlint-enable anti-slop/no-unsafe-dictionary-type */
 
 /** The cookie as a value: already parsed, or the raw (URI-encoded) JSON. */
-function decodeCookieValue(raw: unknown): unknown {
-  if (typeof raw !== "string") return raw;
+function decodeCookieValue(
+  raw: Parameters<typeof isString>[0],
+): Parameters<typeof isRecord>[0] {
+  if (!isString(raw)) return raw;
   try {
     return JSON.parse(decodeURIComponent(raw));
   } catch {
@@ -60,7 +65,7 @@ function decodeCookieValue(raw: unknown): unknown {
 function isReduceMotionPreference(
   value: unknown,
 ): value is ReduceMotionPreference {
-  return REDUCE_MOTION_PREFERENCES.includes(value as ReduceMotionPreference);
+  return REDUCE_MOTION_PREFERENCES.some((preference) => preference === value);
 }
 
 /**
@@ -69,7 +74,7 @@ function isReduceMotionPreference(
  * version never breaks the page.
  */
 export function parseAccessibilityPreferences(
-  raw: unknown,
+  raw: Parameters<typeof decodeCookieValue>[0],
 ): AccessibilityPreferences {
   const value = decodeCookieValue(raw);
   const source = isRecord(value) ? value : {};
@@ -129,8 +134,7 @@ export function isReducedMotionActive(): boolean {
   const classList = globalThis.document?.documentElement?.classList;
   if (!classList) return false;
   const systemPrefersReduced =
-    typeof matchMedia === "function" &&
-    matchMedia(REDUCED_MOTION_QUERY).matches;
+    isFunction(matchMedia) && matchMedia(REDUCED_MOTION_QUERY).matches;
   return resolveReducedMotion(
     reduceMotionFromClasses(classList),
     systemPrefersReduced,

package/frontend-vue/layers/dms-ui/app/build/utils/addressSuggestions.ts

@@ -1,8 +1,3 @@
-// The geocoder answers the whole world in its own order, and the same place
-// several times (one entry per OSM object: a square, its bus stop, its
-// parking). The list a user picks from holds each place once, the ones in
-// the address's country first.
-
 /** How many results are asked for per suggestion shown, to rank from. */
 export const SUGGESTION_POOL_FACTOR = 4;
 /** The most results asked for at once. */

package/frontend-vue/layers/dms-ui/app/build/utils/blockPreview.ts

@@ -1,3 +1,4 @@
+/* oxlint-disable anti-slop/no-unsafe-dictionary-type -- Preview messages and arbitrary block options are the boundary being checked here. JSON-only owner types or strict schemas would reject currently accepted objects, inherited fields, and extra options. */
 /**
  * The block preview's contract: the tree a docs site or a chat hands
  * `DmsBlockPreview`, the `?state=` parameter carrying it, the `postMessage`
@@ -6,6 +7,11 @@
  */
 
 /** A block of a preview tree, named by its registry type or component name. */
+import {
+  isObject,
+  isString,
+  isBoolean,
+} from "../../../../dms-core/app/utils/type-check";
 export interface PreviewNode {
   /** Block registry type, e.g. `KpiCard`. Wins over `componentName`. */
   type?: string;
@@ -129,12 +135,14 @@ const SAFE_METHODS = new Set(["GET", "HEAD"]);
 const ROUTE_SOURCE_OPTION = "source";
 const BASE64_PADDING_LENGTH = 4;
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+function isRecord(
+  value: Parameters<typeof isObject>[0],
+): value is Record<string, unknown> {
+  return isObject(value) && value !== null && !Array.isArray(value);
 }
 
-function isOptionalString(value: unknown): boolean {
-  return value === undefined || typeof value === "string";
+function isOptionalString(value: Parameters<typeof isString>[0]): boolean {
+  return value === undefined || isString(value);
 }
 
 function isPreviewNode(value: unknown): value is PreviewNode {
@@ -157,8 +165,8 @@ export function isPreviewTheme(value: unknown): value is PreviewTheme {
   return PREVIEW_THEMES.some((theme) => theme === value);
 }
 
-function isOptionalBoolean(value: unknown): boolean {
-  return value === undefined || typeof value === "boolean";
+function isOptionalBoolean(value: Parameters<typeof isBoolean>[0]): boolean {
+  return value === undefined || isBoolean(value);
 }
 
 function hasValidStateExtras(value: Record<string, unknown>): boolean {
@@ -209,7 +217,7 @@ export function decodePreviewState(param: string): PreviewState | undefined {
 }
 
 const INBOUND_VALIDATORS: Record<
-  string,
+  Extract<Parameters<typeof Object.hasOwn>[1], string>,
   (data: Record<string, unknown>) => boolean
 > = {
   render: (data) =>
@@ -225,17 +233,18 @@ const INBOUND_VALIDATORS: Record<
  * window (another channel, a malformed tree): the page ignores those.
  */
 export function parsePreviewMessage(
-  data: unknown,
+  data: Parameters<typeof isRecord>[0],
 ): PreviewInboundMessage | undefined {
   if (!isRecord(data) || data.channel !== PREVIEW_CHANNEL) return undefined;
   const isKnownType =
-    typeof data.type === "string" &&
-    Object.hasOwn(INBOUND_VALIDATORS, data.type);
+    isString(data.type) && Object.hasOwn(INBOUND_VALIDATORS, data.type);
   const validate = isKnownType
-    ? INBOUND_VALIDATORS[data.type as string]
+    ? // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- This legacy lookup rereads an unchecked getter after the string and own-key checks; its value can change, so neither check proves this index is a known protocol name.
+      INBOUND_VALIDATORS[data.type as string]
     : undefined;
   if (!validate?.(data)) return undefined;
-  return data as unknown as PreviewInboundMessage;
+  // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- This legacy parser returns the original object unchecked. Repeated type reads can select an inherited validator such as toString, so successful dispatch does not prove the message union.
+  return data as PreviewInboundMessage & typeof data;
 }
 
 export function previewReadyMessage(): PreviewReadyMessage {
@@ -281,7 +290,6 @@ interface OptionRule {
  * read with `POST`). A user action (a form's submit) stays the user's.
  */
 const OPTION_RULES: OptionRule[] = [
-  // `location` is the route a table view reads, beside its `source.fetchUrl`.
   { issue: "unsafe_url", key: /(url|^location)$/i, isAllowed: isRelativePath },
   { issue: "unsafe_method", key: /urlmethod$/i, isAllowed: isReadMethod },
 ];
@@ -292,8 +300,11 @@ export interface RefusedOption {
   value: string;
 }
 
-function refuseEntry(key: string, entry: unknown): RefusedOption | undefined {
-  if (typeof entry !== "string" || entry === "") return undefined;
+function refuseEntry(
+  key: string,
+  entry: Parameters<typeof isString>[0],
+): RefusedOption | undefined {
+  if (!isString(entry) || entry === "") return undefined;
   const rule = OPTION_RULES.find(
     (candidate) => candidate.key.test(key) && !candidate.isAllowed(entry),
   );
@@ -301,7 +312,9 @@ function refuseEntry(key: string, entry: unknown): RefusedOption | undefined {
 }
 
 /** The first option, at any depth, an {@link OPTION_RULES} rule refuses. */
-export function findRefusedOption(value: unknown): RefusedOption | undefined {
+export function findRefusedOption(
+  value: Parameters<typeof isRecord>[0],
+): RefusedOption | undefined {
   const entries: Array<[string, unknown]> = Array.isArray(value)
     ? value.map((entry) => ["", entry])
     : isRecord(value)
@@ -353,7 +366,7 @@ function matchBlockType(
  */
 function readsRouteSource(options: Record<string, unknown>): boolean {
   const source = options[ROUTE_SOURCE_OPTION];
-  return isRecord(source) && typeof source.fetchUrl === "string";
+  return isRecord(source) && isString(source.fetchUrl);
 }
 
 /** Serialized resource fields may read the preview's immutable demo record. */
@@ -392,6 +405,7 @@ function issueFor(
     ? { key: refused.issue, name: match.name, value: refused.value }
     : undefined;
 }
+/* oxlint-enable anti-slop/no-unsafe-dictionary-type */
 
 function resolveNode(
   node: PreviewChildNode,

package/frontend-vue/layers/{dms-layout → dms-ui}/app/build/utils/categoryPages.ts

@@ -1,4 +1,4 @@
-import type { SiteLayoutTree } from "../../types/page";
+import type { SiteLayoutTree } from "#dms-core/app/types/page";
 
 /** A node's children, in the order the menu lists them (`order`, then name). */
 export function orderedChildren(node: SiteLayoutTree): SiteLayoutTree[] {

package/frontend-vue/layers/dms-ui/app/build/utils/characterCount.ts

@@ -1,8 +1,13 @@
+import { isString } from "../../../../dms-core/app/utils/type-check";
+
 /**
  * The counter a text field shows under `showCount`: the characters typed,
  * out of `maxLength` when the field has one ("4 / 60").
  */
-export function characterCountText(value: unknown, maxLength?: number): string {
-  const count = typeof value === "string" ? [...value].length : 0;
+export function characterCountText(
+  value: Parameters<typeof isString>[0],
+  maxLength?: number,
+): string {
+  const count = isString(value) ? [...value].length : 0;
   return maxLength === undefined ? String(count) : `${count} / ${maxLength}`;
 }