@dargmuesli/nuxt-vio 22.0.11 → 23.0.0-beta.10

package/app/app.config.ts

@@ -4,63 +4,3 @@ export default defineAppConfig({
     themeColor: undefined,
   },
 })
-
-declare module '@nuxt/schema' {
-  interface AppConfig {
-    vio: {
-      seo?: {
-        ogImage?: {
-          defaultComponent: string // TODO: keyof OgImageComponents
-        }
-      }
-      pages?: {
-        legalNotice?: {
-          contact: {
-            email: string
-          }
-          responsibility: {
-            address: {
-              city: string
-              name: string
-              street: string
-            }
-          }
-          tmg: {
-            address: {
-              city: string
-              name: string
-              street: string
-            }
-          }
-        }
-        privacyPolicy?: {
-          hostingCdn?: {
-            external: {
-              address: {
-                city: string
-                name: string
-                street: string
-              }
-            }
-          }
-          mandatoryInfo?: {
-            responsible: {
-              address: {
-                city: string
-                email: string
-                name: string
-                street: string
-              }
-            }
-          }
-        }
-      }
-      server?: {
-        middleware: {
-          headers: Record<string, string>
-        }
-      }
-      themeColor?: string
-    }
-  }
-}

package/app/components/vio/button/VioButtonHome.vue

@@ -1,7 +1,7 @@
 <template>
   <VioButtonColored
     :aria-label="t('home')"
-    :to="localePath('/')"
+    :to="localePath({ path: '/' })"
     @click="emit('click')"
   >
     {{ t('home') }}

package/app/components/vio/layout/VioLayoutBreadcrumbs.vue

@@ -4,7 +4,7 @@
       :aria-label="t('home')"
       data-testid="breadcrumb-prefix-/"
       :is-colored="false"
-      :to="localePath('/')"
+      :to="localePath({ path: '/' })"
     >
       <VioIconHome classes="h-6 w-6" />
     </VioLink>

package/app/composables/networking.ts

@@ -4,23 +4,22 @@ export const useGetServiceHref = () => {
   const isTesting = useIsTesting()
 
   return ({
-    isSsr = true,
+    allowInternal = true,
     name,
     path,
-    port,
   }: {
-    isSsr?: boolean
-    name: string
+    allowInternal?: boolean
+    name: ServiceName
     path?: string
-    port?: number
   }) =>
     getServiceHref({
+      allowInternal,
       host,
-      isSsr,
+      isServer: import.meta.server,
       isTesting,
       name,
       path,
-      port,
+      services: runtimeConfig.public.vio.services,
       stagingHost: runtimeConfig.public.vio.stagingHost,
     })
 }

package/app/composables/sentry.ts

@@ -0,0 +1,17 @@
+import { getSharedSentryConfig } from '../../node/static'
+
+export const useSharedSentryConfig = () => {
+  const isTesting = useIsTesting()
+  const runtimeConfig = useRuntimeConfig()
+
+  return getSharedSentryConfig({
+    enableLogs: runtimeConfig.public.sentry.logs.enable,
+    environment: runtimeConfig.public.sentry.environment,
+    host: runtimeConfig.public.sentry.host,
+    isInProduction: runtimeConfig.public.vio.isInProduction,
+    isTesting,
+    projectId: runtimeConfig.public.sentry.project.id,
+    projectPublicKey: runtimeConfig.public.sentry.project.publicKey,
+    release: runtimeConfig.public.sentry.release,
+  })
+}

package/app/composables/strapi.ts

@@ -5,5 +5,4 @@ export const useStrapiFetch = (
     ...(options ? options : {}),
     name: options?.name || 'strapi',
     path: options?.path || '/api',
-    port: options?.port || 1337,
   })

package/app/stores/auth.ts

@@ -1,9 +1,11 @@
+import * as Sentry from '@sentry/nuxt'
 import { decodeJwt } from 'jose'
 import type { JWTPayload } from 'jose'
 import { defineStore } from 'pinia'
 import { ref } from 'vue'
 
 export const useVioAuthStore = defineStore('vio-auth', () => {
+  const runtimeConfig = useRuntimeConfig()
   const jwt = ref<string>()
   const jwtDecoded = ref<JWTPayload>()
   const signedInUsername = ref<string>()
@@ -21,6 +23,17 @@ export const useVioAuthStore = defineStore('vio-auth', () => {
       jwtDecodedNew.exp > Math.floor(Date.now() / 1000)
         ? (jwtDecodedNew.username as string | undefined)
         : undefined
+
+    if (runtimeConfig.public.sentry.features.userTracking) {
+      Sentry.setUser(
+        signedInUsername.value
+          ? {
+              id: jwtDecodedNew?.sub as string | undefined,
+              username: signedInUsername.value,
+            }
+          : null,
+      )
+    }
   }
 
   return {

package/node/networking.ts

@@ -0,0 +1,87 @@
+import { SERVICES } from './services'
+import type { Service, ServiceName } from './services'
+import { SITE_URL_TYPED } from './static'
+
+export const getHost = (event: { headers: Headers }) => {
+  const host = event.headers.get('host')
+
+  if (!host) throw new Error('Host header is not given!')
+
+  return host
+}
+
+export const getRootHost = (host: string) => {
+  const hostParts = host.split('.')
+  const hostPartsLast = hostParts[hostParts.length - 1]
+
+  if (hostParts.length === 1) return hostParts[0]
+
+  // only a single subdomain directly on bare localhost collapses to the root; e.g. app.localhost must keep its "app" label
+  if (
+    hostParts.length === 2 &&
+    hostPartsLast &&
+    /^localhost(:[0-9]+)?$/.test(hostPartsLast)
+  )
+    return hostPartsLast
+
+  return `${hostParts[hostParts.length - 2]}.${hostPartsLast}`
+}
+
+export const getServiceHref = ({
+  allowInternal = true,
+  host,
+  isServer,
+  isTesting,
+  name,
+  path,
+  protocol = SITE_URL_TYPED.protocol,
+  services = SERVICES,
+  stagingHost,
+}: {
+  allowInternal?: boolean
+  host?: string
+  isServer: boolean
+  isTesting?: boolean
+  name: ServiceName
+  path?: string
+  protocol?: string
+  services?: Record<string, Service>
+  stagingHost?: string
+}) => {
+  const service = services[name]
+
+  if (!service) throw new Error(`Service "${name}" is not registered!`)
+
+  const { hasSubdomain, port } = service
+  const nameSubdomainString = `${name.replaceAll('_', '-')}.`
+  const pathString = path ? `/${path.replace(/^\/+/, '')}` : ''
+
+  const assertHasSubdomain = () => {
+    if (!hasSubdomain)
+      throw new Error(`Service "${name}" has no public subdomain!`)
+  }
+
+  if (isTesting) {
+    assertHasSubdomain()
+
+    return `${protocol}//${nameSubdomainString}${SITE_URL_TYPED.host}${pathString}`
+  }
+
+  if (stagingHost) {
+    assertHasSubdomain()
+
+    return `${protocol}//${nameSubdomainString}${stagingHost}${pathString}`
+  }
+
+  if (isServer && allowInternal) {
+    return `http://${name}:${port}${pathString}`
+  }
+
+  if (host) {
+    assertHasSubdomain()
+
+    return `${protocol}//${nameSubdomainString}${getRootHost(host)}${pathString}`
+  }
+
+  throw new Error('Could not get service href!')
+}

package/node/services.ts

@@ -0,0 +1,11 @@
+export type Service = {
+  hasSubdomain: boolean
+  port: number
+}
+
+export const SERVICES = {
+  strapi: { hasSubdomain: true, port: 1337 },
+} as const satisfies Record<string, Service>
+
+// The open string branch accepts services registered by extending projects through VIO_NUXT_BASE_CONFIG's `services` option, while still keeping autocomplete for the built-in names.
+export type ServiceName = keyof typeof SERVICES | (string & {})

package/node/static/index.ts

@@ -1,2 +1,3 @@
 export * from './environment'
 export * from './nuxt'
+export * from './sentry'

package/node/static/nuxt.ts

@@ -1,11 +1,15 @@
 import type { defineNuxtConfig } from 'nuxt/config'
 
+import type { Service } from '../services'
+import { SERVICES } from '../services'
 import { IS_IN_FRONTEND_DEVELOPMENT } from './'
 
 export const VIO_NUXT_BASE_CONFIG = ({
+  services,
   siteName,
   stagingHost,
 }: {
+  services?: Record<string, Service>
   siteName: string
   stagingHost?: string
 }) =>
@@ -18,6 +22,7 @@ export const VIO_NUXT_BASE_CONFIG = ({
     runtimeConfig: {
       public: {
         vio: {
+          services: { ...SERVICES, ...services },
           stagingHost: IS_IN_FRONTEND_DEVELOPMENT ? stagingHost : undefined,
         },
       },

package/node/static/sentry.ts

@@ -0,0 +1,42 @@
+import type * as Sentry from '@sentry/nuxt'
+
+export const NUXT_PUBLIC_SENTRY_ENVIRONMENT =
+  process.env.NUXT_PUBLIC_SENTRY_ENVIRONMENT
+export const NUXT_PUBLIC_SENTRY_HOST = process.env.NUXT_PUBLIC_SENTRY_HOST || ''
+export const NUXT_PUBLIC_SENTRY_LOGS_ENABLE =
+  process.env.NUXT_PUBLIC_SENTRY_LOGS_ENABLE !== 'false'
+export const NUXT_PUBLIC_SENTRY_PROJECT_ID =
+  process.env.NUXT_PUBLIC_SENTRY_PROJECT_ID || ''
+export const NUXT_PUBLIC_SENTRY_PROJECT_PUBLIC_KEY =
+  process.env.NUXT_PUBLIC_SENTRY_PROJECT_PUBLIC_KEY || ''
+export const NUXT_PUBLIC_SENTRY_RELEASE = process.env.RELEASE_NAME
+
+export const getSharedSentryConfig = ({
+  enableLogs,
+  environment,
+  host,
+  isInProduction,
+  isTesting,
+  projectId,
+  projectPublicKey,
+  release,
+}: {
+  enableLogs?: boolean
+  environment?: string
+  host?: string
+  isInProduction: boolean
+  isTesting?: boolean
+  projectId?: string
+  projectPublicKey?: string
+  release?: string
+}): Parameters<typeof Sentry.init>[0] => ({
+  dsn:
+    projectPublicKey && host && projectId
+      ? `https://${projectPublicKey}@${host}/${projectId}`
+      : undefined,
+  enabled: isInProduction && !isTesting,
+  enableLogs,
+  environment,
+  release,
+  tracesSampleRate: 1.0,
+})

package/nuxt.config.ts

@@ -2,7 +2,17 @@ import tailwindcss from '@tailwindcss/vite'
 import { defu } from 'defu'
 import { createResolver } from 'nuxt/kit'
 
-import { IS_IN_STACK, SITE_URL, VIO_NUXT_BASE_CONFIG } from './node/static'
+import {
+  IS_IN_STACK,
+  NUXT_PUBLIC_SENTRY_ENVIRONMENT,
+  NUXT_PUBLIC_SENTRY_HOST,
+  NUXT_PUBLIC_SENTRY_LOGS_ENABLE,
+  NUXT_PUBLIC_SENTRY_PROJECT_ID,
+  NUXT_PUBLIC_SENTRY_PROJECT_PUBLIC_KEY,
+  NUXT_PUBLIC_SENTRY_RELEASE,
+  SITE_URL,
+  VIO_NUXT_BASE_CONFIG,
+} from './node/static'
 import {
   GTAG_COOKIE_ID,
   TIMEZONE_COOKIE_NAME,
@@ -11,6 +21,10 @@ import {
 } from './shared/utils/constants'
 
 const { resolve } = createResolver(import.meta.url)
+const SHARED_TYPE_REFERENCES = [
+  { path: resolve('shared/types/app-config.d.ts') },
+  { path: resolve('shared/types/request-event-context.d.ts') },
+]
 
 export default defineNuxtConfig(
   defu(
@@ -42,6 +56,25 @@ export default defineNuxtConfig(
           enabled: true,
         },
       },
+      experimental: {
+        early404: true,
+        inlineErrorRendering: true,
+        prerenderErrorPages: true,
+        routeTypedFetch: true,
+        strictRouteTypes: true,
+        typedPages: true,
+      },
+      hooks: {
+        // consumers' generated tsconfigs exclude `node_modules`, so this layer's type augmentations need explicit references
+        'prepare:types'({ nodeReferences, references, sharedReferences }) {
+          for (const list of [nodeReferences, references, sharedReferences]) {
+            list.push(...SHARED_TYPE_REFERENCES)
+          }
+        },
+        'nitro:prepare:types'({ references }) {
+          references.push(...SHARED_TYPE_REFERENCES)
+        },
+      },
       modules: [
         '@dargmuesli/nuxt-cookie-control',
         '@nuxt/devtools',
@@ -53,6 +86,7 @@ export default defineNuxtConfig(
         '@nuxtjs/seo',
         '@nuxtjs/turnstile',
         '@pinia/nuxt',
+        '@sentry/nuxt/module',
         'nuxt-gtag',
         'shadcn-nuxt',
         (_options, nuxt) => {
@@ -72,7 +106,16 @@ export default defineNuxtConfig(
           ) {
             if (nuxt.options.nitro.static) {
               nuxtConfigSecurityHeaders.contentSecurityPolicy = defu(
-                VIO_GET_CSP({ siteUrl: new URL(SITE_URL) }),
+                VIO_GET_CSP({
+                  sentry:
+                    NUXT_PUBLIC_SENTRY_HOST && NUXT_PUBLIC_SENTRY_PROJECT_ID
+                      ? {
+                          host: NUXT_PUBLIC_SENTRY_HOST,
+                          projectId: NUXT_PUBLIC_SENTRY_PROJECT_ID,
+                        }
+                      : undefined,
+                  siteUrl: new URL(SITE_URL),
+                }),
                 nuxtConfigSecurityHeaders.contentSecurityPolicy,
               )
             }
@@ -98,7 +141,6 @@ export default defineNuxtConfig(
         compressPublicAssets: true,
         experimental: {
           asyncContext: true,
-          typedPages: true,
         },
       },
       runtimeConfig: {
@@ -106,6 +148,37 @@ export default defineNuxtConfig(
           i18n: {
             baseUrl: SITE_URL,
           },
+          sentry: {
+            environment: NUXT_PUBLIC_SENTRY_ENVIRONMENT,
+            features: {
+              consoleCapture: true,
+              pinia: true,
+              profiling: true,
+              replay: true,
+              securityHeaders: true,
+              userTracking: true,
+            },
+            host: NUXT_PUBLIC_SENTRY_HOST,
+            logs: {
+              enable: NUXT_PUBLIC_SENTRY_LOGS_ENABLE,
+            },
+            profiles: {
+              sampleRate: 1.0,
+            },
+            project: {
+              id: NUXT_PUBLIC_SENTRY_PROJECT_ID,
+              publicKey: NUXT_PUBLIC_SENTRY_PROJECT_PUBLIC_KEY,
+            },
+            release: NUXT_PUBLIC_SENTRY_RELEASE,
+            replays: {
+              onError: {
+                sampleRate: 1.0,
+              },
+              session: {
+                sampleRate: 0.0,
+              },
+            },
+          },
           site: {
             url: SITE_URL, // TODO: evaluate removal for static builds in favor of i18n.baseUrl
           },
@@ -122,24 +195,19 @@ export default defineNuxtConfig(
         },
       },
       typescript: {
-        nodeTsConfig: {
-          include: [resolve('./node')],
-        },
-        tsConfig: {
-          nodeTsConfig: {
-            include: [
-              resolve('../.config'),
-              resolve('../node'),
-              // resolve('../sentry.server.config.ts'),
-            ],
-          },
+        appTsConfig: {
           vueCompilerOptions: {
             htmlAttributes: [], // https://github.com/johnsoncodehk/volar/issues/1970#issuecomment-1276994634
           },
-          // compilerOptions: {
-          //   noErrorTruncation: true,
-          // },
         },
+        nodeTsConfig: {
+          include: [resolve('./node')],
+        },
+        // tsConfig: {
+        //   compilerOptions: {
+        //     noErrorTruncation: true,
+        //   },
+        // },
       },
       vite: {
         plugins: [
@@ -290,6 +358,16 @@ export default defineNuxtConfig(
         },
         strict: true,
       },
+      sentry: {
+        release: {
+          name: process.env.RELEASE_NAME || undefined,
+        },
+        sourcemaps: {
+          disable: !process.env.SENTRY_AUTH_TOKEN,
+        },
+        telemetry: false,
+        // `org`, `project` and `authToken` are read from the `SENTRY_ORG`, `SENTRY_PROJECT` and `SENTRY_AUTH_TOKEN` environment variables by the module itself.
+      },
       seo: {
         minify: false, // TODO: enable (https://github.com/harlan-zw/nuxt-seo-utils/issues/103)
         validateAppHead: false, // `app.head.htmlAttrs.lang` is only a fallback for the routeless SPA pages, as i18n sets the correct language per locale everywhere else.
@@ -302,6 +380,7 @@ export default defineNuxtConfig(
         credits: false,
         zeroRuntime: true,
       },
+      skewProtection: false, // needs storage that persists across builds (https://nuxtseo.com/docs/skew-protection/guides/storage-configuration), which docker builds in ci do not provide
 
       // environments
       $development: {
@@ -327,6 +406,9 @@ export default defineNuxtConfig(
             strictTransportSecurity: false, // prevent endless reload in Chrome
           },
         },
+        sentry: {
+          enabled: false,
+        },
         site: {
           debug: true,
         },

package/package.json

@@ -12,13 +12,14 @@
     "@nuxtjs/color-mode": "4.0.1",
     "@nuxtjs/html-validator": "2.1.0",
     "@nuxtjs/i18n": "10.6.0",
-    "@nuxtjs/seo": "5.3.16",
+    "@nuxtjs/seo": "6.0.1",
     "@nuxtjs/turnstile": "1.1.3",
     "@pinia/nuxt": "1.0.2",
+    "@sentry/nuxt": "10.71.0",
     "@tailwindcss/forms": "0.5.11",
     "@tailwindcss/typography": "0.5.20",
     "@tailwindcss/vite": "4.3.3",
-    "@takumi-rs/core": "2.14.0",
+    "@takumi-rs/core": "2.15.1",
     "@types/lodash-es": "4.17.12",
     "@types/nodemailer": "8.0.2",
     "@urql/core": "6.0.3",
@@ -54,9 +55,9 @@
     "@vueuse/core": "15.0.0",
     "consola": "3.4.2",
     "defu": "6.1.7",
-    "h3": "1.15.11",
     "lodash-es": "4.18.1",
-    "nuxt": "4.6.0",
+    "nuxt": "4.6.1",
+    "nuxtseo-devtools-host": "1.0.1",
     "pinia": "4.0.3",
     "postcss-html": "2.0.0",
     "prettier": "3.9.9",
@@ -74,7 +75,7 @@
     "vue-router": "5.4.0"
   },
   "engines": {
-    "node": "24"
+    "node": "^24.15.0"
   },
   "files": [
     ".config",
@@ -84,12 +85,14 @@
     "server",
     "shared",
     "nuxt.config.ts",
-    "package.json"
+    "package.json",
+    "sentry.client.config.ts",
+    "sentry.server.config.ts"
   ],
   "main": "nuxt.config.ts",
   "name": "@dargmuesli/nuxt-vio",
   "peerDependencies": {
-    "nuxt": "^4.1.0",
+    "nuxt": "^4.6.0",
     "vue": "^3.5.21",
     "vue-router": "^4.5.1 || ^5.0.0"
   },
@@ -101,7 +104,7 @@
     "url": "git+https://github.com/dargmuesli/vio.git"
   },
   "type": "module",
-  "version": "22.0.11",
+  "version": "23.0.0-beta.10",
   "scripts": {
     "build": "pnpm run build:node",
     "build:node": "NUXT_PUBLIC_I18N_BASE_URL=https://app.localhost:3001 nuxt build playground",

package/sentry.client.config.ts

@@ -0,0 +1,38 @@
+import * as Sentry from '@sentry/nuxt'
+
+const runtimeConfig = useRuntimeConfig()
+const sharedSentryConfig = useSharedSentryConfig()
+
+if (sharedSentryConfig.dsn) {
+  const features = runtimeConfig.public.sentry.features
+
+  Sentry.init({
+    ...sharedSentryConfig,
+    integrations: [
+      ...(features.profiling ? [Sentry.browserProfilingIntegration()] : []),
+      ...(features.consoleCapture
+        ? [
+            Sentry.captureConsoleIntegration(),
+            Sentry.consoleLoggingIntegration(),
+          ]
+        : []),
+      Sentry.httpClientIntegration(),
+      ...(features.pinia ? [Sentry.piniaIntegration(usePinia())] : []),
+      ...(features.replay ? [Sentry.replayIntegration()] : []),
+      Sentry.zodErrorsIntegration(),
+    ],
+    profilesSampleRate: features.profiling
+      ? runtimeConfig.public.sentry.profiles.sampleRate
+      : undefined,
+    replaysOnErrorSampleRate: features.replay
+      ? runtimeConfig.public.sentry.replays.onError.sampleRate
+      : undefined,
+    replaysSessionSampleRate: features.replay
+      ? runtimeConfig.public.sentry.replays.session.sampleRate
+      : undefined,
+  })
+} else {
+  console.warn(
+    'Sentry configuration is incomplete, skipping Sentry initialization.',
+  )
+}

package/sentry.server.config.ts

@@ -0,0 +1,36 @@
+import * as Sentry from '@sentry/nuxt'
+
+import {
+  getSharedSentryConfig,
+  IS_IN_PRODUCTION,
+  NUXT_PUBLIC_SENTRY_ENVIRONMENT,
+  NUXT_PUBLIC_SENTRY_HOST,
+  NUXT_PUBLIC_SENTRY_LOGS_ENABLE,
+  NUXT_PUBLIC_SENTRY_PROJECT_ID,
+  NUXT_PUBLIC_SENTRY_PROJECT_PUBLIC_KEY,
+  NUXT_PUBLIC_SENTRY_RELEASE,
+} from './node/static'
+
+const sharedSentryConfig = getSharedSentryConfig({
+  enableLogs: NUXT_PUBLIC_SENTRY_LOGS_ENABLE,
+  environment: NUXT_PUBLIC_SENTRY_ENVIRONMENT,
+  host: NUXT_PUBLIC_SENTRY_HOST,
+  isInProduction: IS_IN_PRODUCTION,
+  isTesting: !!process.env.NUXT_PUBLIC_VIO_IS_TESTING,
+  projectId: NUXT_PUBLIC_SENTRY_PROJECT_ID,
+  projectPublicKey: NUXT_PUBLIC_SENTRY_PROJECT_PUBLIC_KEY,
+  release: NUXT_PUBLIC_SENTRY_RELEASE,
+})
+
+if (sharedSentryConfig.dsn) {
+  Sentry.init({
+    ...sharedSentryConfig,
+    integrations: NUXT_PUBLIC_SENTRY_LOGS_ENABLE
+      ? [Sentry.consoleLoggingIntegration()]
+      : [],
+  })
+} else {
+  console.warn(
+    'Sentry configuration is incomplete, skipping Sentry initialization.',
+  )
+}

package/server/api/healthcheck.get.ts

@@ -1,7 +1,6 @@
-import { defineEventHandler } from 'h3'
+import { defineEventHandler } from 'nuxt/server'
 
 export default defineEventHandler((event) => {
-  const { res } = event.node
-  res.setHeader('Content-Type', 'text/plain')
-  res.end('OK')
+  event.res.headers.set('Content-Type', 'text/plain')
+  return 'OK'
 })

package/server/middleware/dateTime.ts

@@ -1,8 +1,11 @@
+import { defineEventHandler } from 'nuxt/server'
+
 export default defineEventHandler(async (event) => {
   const isTesting = useIsTesting()
   event.context.$timeZone = await getTimeZone({ event, isTesting })
 })
 
+// h3 handlers, `useEvent()` and the app's `ssrContext.event` still see h3's context
 declare module 'h3' {
   interface H3EventContext {
     $timeZone?: string

package/server/middleware/headers.ts

@@ -1,9 +1,11 @@
-export default defineEventHandler(async (event) => {
+import { defineEventHandler, useAppConfig } from 'nuxt/server'
+
+export default defineEventHandler((event) => {
   const config = useAppConfig(event)
 
   if (!config.vio.server) return
 
   for (const entry of Object.entries(config.vio.server.middleware.headers)) {
-    appendHeader(event, entry[0], entry[1])
+    event.res.headers.append(entry[0], entry[1])
   }
 })

package/server/middleware/sentry.ts

@@ -0,0 +1,33 @@
+export default defineEventHandler((event) => {
+  const runtimeConfig = useRuntimeConfig(event)
+  const sentryConfig = runtimeConfig.public.sentry
+
+  if (
+    !sentryConfig.features.securityHeaders ||
+    !sentryConfig.host ||
+    !sentryConfig.project.id ||
+    !sentryConfig.project.publicKey
+  ) {
+    return
+  }
+
+  const securityEndpointParams = [
+    `sentry_key=${sentryConfig.project.publicKey}`,
+    sentryConfig.environment &&
+      `sentry_environment=${sentryConfig.environment}`,
+    sentryConfig.release && `sentry_release=${sentryConfig.release}`,
+  ]
+    .filter(Boolean)
+    .join('&')
+
+  appendHeader(
+    event,
+    'NEL',
+    '\'{"report_to":"sentry","max_age":31536000,"include_subdomains":true}\'',
+  )
+  appendHeader(
+    event,
+    'Report-To',
+    `'{"group":"sentry","max_age":31536000,"endpoints":[{"url":"https://${sentryConfig.host}/api/${sentryConfig.project.id}/security/?${securityEndpointParams}"}],"include_subdomains":true}'`,
+  )
+})

package/server/plugins/nodemailer.ts

@@ -27,6 +27,7 @@ export default defineNitroPlugin((nitroApp) => {
   })
 })
 
+// h3 handlers and `useEvent()` still see h3's context
 declare module 'h3' {
   interface H3EventContext {
     $email?: {

package/server/utils/dateTime.ts

@@ -1,10 +1,10 @@
-import type { H3Event } from 'h3'
+import { getCookie, getRequestIP, type RequestEvent } from 'nuxt/server'
 
 export const getTimeZone = async ({
   event,
   isTesting,
 }: {
-  event: H3Event
+  event: RequestEvent
   isTesting?: boolean
 }) => {
   const timeZoneBySsr = event.context.$timeZone
@@ -26,12 +26,8 @@ export const getTimeZone = async ({
   }
 }
 
-export const useTimeZone = async () => {
-  const event = useEvent()
-  const isTesting = useIsTesting()
-
-  return await getTimeZone({ event, isTesting })
-}
+// the `dateTime` middleware has already resolved the time zone for every request
+export const useTimeZone = async () => useEvent().context.$timeZone
 
 export const getTimeZoneByIpApi = async ({ ip }: { ip: string }) => {
   const ipApiResult = await $fetch<{ timezone: string }>(

package/server/utils/dependencies/turnstile.ts

@@ -1,4 +1,6 @@
+import { verifyTurnstileToken } from '@nuxtjs/turnstile/runtime/server/utils/verify.js'
 import { consola } from 'consola'
+import { createError } from 'nuxt/server'
 
 /**
  * Verifies a Turnstile token from the request body

package/server/utils/networking.ts

@@ -6,23 +6,22 @@ export const useGetServiceHref = ({ event }: { event?: H3Event } = {}) => {
   const isTesting = useIsTesting()
 
   return ({
-    isSsr = true,
+    allowInternal = true,
     name,
     path,
-    port,
   }: {
-    isSsr?: boolean
-    name: string
+    allowInternal?: boolean
+    name: ServiceName
     path?: string
-    port?: number
   }) =>
     getServiceHref({
+      allowInternal,
       host,
-      isSsr,
+      isServer: import.meta.server,
       isTesting,
       name,
       path,
-      port,
+      services: runtimeConfig.public.vio.services,
       stagingHost: runtimeConfig.public.vio.stagingHost,
     })
 }

package/server/utils/site.ts

@@ -2,6 +2,11 @@ export const useSiteUrl = () => {
   const runtimeConfig = useRuntimeConfig()
   const siteUrl = runtimeConfig.public.i18n.baseUrl
 
+  // consumers see the i18n module's wider type, which also allows a resolver function
+  if (typeof siteUrl !== 'string') {
+    throw new Error('`runtimeConfig.public.i18n.baseUrl` must be a string')
+  }
+
   return {
     siteUrl,
     siteUrlTyped: new URL(siteUrl),

package/server/utils/testing.ts

@@ -1,5 +1,15 @@
 import type { H3Event } from 'h3'
 
+// `useEvent()` throws whenever there is no Nitro request context, which is the case for everything that runs at startup, such as a Nitro plugin's hooks.
+// Testing detection still works there through the runtime config, so fall back to no event rather than letting that error escape.
+const tryUseEvent = () => {
+  try {
+    return useEvent()
+  } catch {
+    return undefined
+  }
+}
+
 export const useIsTesting = ({
   isCookieEnabled = true,
 }:
@@ -7,7 +17,7 @@ export const useIsTesting = ({
       isCookieEnabled?: boolean
     }
   | undefined = {}) => {
-  const event = useEvent()
+  const event = tryUseEvent()
   const runtimeConfig = useRuntimeConfig()
 
   return getIsTesting({ event, isCookieEnabled, runtimeConfig })

package/shared/types/app-config.d.ts

@@ -0,0 +1,62 @@
+// in `shared/` so that both the app's and the server's `useAppConfig` are typed
+declare module '@nuxt/schema' {
+  interface CustomAppConfig {
+    vio: {
+      seo?: {
+        ogImage?: {
+          defaultComponent: string // TODO: keyof OgImageComponents
+        }
+      }
+      pages?: {
+        legalNotice?: {
+          contact: {
+            email: string
+          }
+          responsibility: {
+            address: {
+              city: string
+              name: string
+              street: string
+            }
+          }
+          tmg: {
+            address: {
+              city: string
+              name: string
+              street: string
+            }
+          }
+        }
+        privacyPolicy?: {
+          hostingCdn?: {
+            external: {
+              address: {
+                city: string
+                name: string
+                street: string
+              }
+            }
+          }
+          mandatoryInfo?: {
+            responsible: {
+              address: {
+                city: string
+                email: string
+                name: string
+                street: string
+              }
+            }
+          }
+        }
+      }
+      server?: {
+        middleware: {
+          headers: Record<string, string>
+        }
+      }
+      themeColor?: string
+    }
+  }
+}
+
+export {}

package/shared/types/request-event-context.d.ts

@@ -0,0 +1,13 @@
+import type { Transporter } from 'nodemailer'
+
+// in `shared/` because typed `$fetch` also type-checks server handlers in the app context
+declare module '@nuxt/schema' {
+  interface RequestEventContext {
+    $email?: {
+      nodemailer: {
+        transporter: Transporter
+      }
+    }
+    $timeZone?: string
+  }
+}

package/shared/utils/constants.ts

@@ -12,7 +12,13 @@ export const COOKIE_CONTROL_CONSENT_COOKIE_NAME =
 export const COOKIE_PREFIX = VIO_SITE_NAME.toLocaleLowerCase()
 export const COOKIE_SEPARATOR = '_'
 export const FETCH_RETRY_AMOUNT = 3
-export const VIO_GET_CSP = ({ siteUrl }: { siteUrl: URL }) =>
+export const VIO_GET_CSP = ({
+  sentry,
+  siteUrl,
+}: {
+  sentry?: { host: string; projectId: string }
+  siteUrl: URL
+}) =>
   defu(
     {
       // Cloudflare
@@ -26,6 +32,17 @@ export const VIO_GET_CSP = ({ siteUrl }: { siteUrl: URL }) =>
           }
         : {}),
     },
+    {
+      // Sentry
+      ...(sentry
+        ? {
+            'connect-src': [
+              `https://${sentry.host}/api/${sentry.projectId}/envelope/`,
+            ],
+            'worker-src': ['blob:'],
+          }
+        : {}),
+    },
     {
       // Google Analytics 4 (https://developers.google.com/tag-platform/tag-manager/web/csp)
       'connect-src': [

package/shared/utils/networking.ts

@@ -1,11 +1,11 @@
 import type { CombinedError } from '@urql/core'
-import type { H3Event } from 'h3'
 import { computed, reactive } from 'vue'
 import type { Ref } from 'vue'
 
-import { SITE_URL_TYPED } from '../../node/static'
 import type { ApiData, BackendError } from '../types/api'
 
+export { getHost, getRootHost, getServiceHref } from '../../node/networking'
+
 export const getApiDataDefault = (): ApiData =>
   computed(() =>
     reactive({
@@ -64,70 +64,3 @@ export const getCombinedErrorMessages = (
 
   return errorMessages
 }
-
-export const getRootHost = (host: string) => {
-  const hostParts = host.split('.')
-  const hostPartsLast = hostParts[hostParts.length - 1]
-
-  if (hostParts.length === 1) return hostParts[0]
-
-  // only a single subdomain directly on bare localhost collapses to the root; e.g. app.localhost must keep its "app" label
-  if (
-    hostParts.length === 2 &&
-    hostPartsLast &&
-    /^localhost(:[0-9]+)?$/.test(hostPartsLast)
-  )
-    return hostPartsLast
-
-  return `${hostParts[hostParts.length - 2]}.${hostPartsLast}`
-}
-
-export const getHost = (event: H3Event) => {
-  const host = event.node.req.headers.host
-
-  if (!host) throw new Error('Host header is not given!')
-
-  return host
-}
-
-export const getServiceHref = ({
-  host,
-  isSsr = true,
-  isTesting,
-  name,
-  path,
-  port,
-  stagingHost,
-}: {
-  host?: string
-  isSsr?: boolean
-  isTesting?: boolean
-  name: string
-  path?: string
-  port?: number
-  stagingHost?: string
-}) => {
-  const nameSubdomain =
-    name !== VIO_SITE_NAME ? name?.replaceAll('_', '-') : undefined
-  const nameSubdomainString = nameSubdomain ? `${nameSubdomain}.` : ''
-  const portString = port ? `:${port}` : ''
-  const pathString = path ? `/${path.replace(/^\/+/, '')}` : ''
-
-  if (isTesting) {
-    return `${SITE_URL_TYPED.protocol}//${nameSubdomainString}${SITE_URL_TYPED.host}${pathString}`
-  }
-
-  if (stagingHost) {
-    return `https://${nameSubdomainString}${stagingHost}${pathString}`
-  }
-
-  if (import.meta.server && isSsr) {
-    return `http://${name}${portString}${pathString}`
-  }
-
-  if (host) {
-    return `https://${nameSubdomainString}${getRootHost(host)}${pathString}`
-  }
-
-  throw new Error('Could not get service href!')
-}

package/shared/utils/services.ts

@@ -0,0 +1,2 @@
+export { SERVICES } from '../../node/services'
+export type { Service, ServiceName } from '../../node/services'

package/server/plugins/seo.ts

@@ -1,7 +0,0 @@
-export default defineNitroPlugin((_nitroApp) => {
-  const runtimeConfig = useRuntimeConfig()
-
-  if (runtimeConfig.public.vio.isTesting) {
-    process.env.NUXT_OG_IMAGE_SECRET = 'test'
-  }
-})