@starci/hfs 5.2.0 → 5.3.0

package/templates/be/skeleton-lite/src/modules/integrations/mail/mail.config.ts

@@ -0,0 +1,33 @@
+import type { MailSecurity } from "@starci/mail"
+import type { EnvSource } from "@modules/platform/config"
+import type { MailLanguage, MailOptions } from "./mail.options"
+
+const DEFAULT_PORT = 587
+const CONFIRM_TTL_SECONDS = 86_400
+const RESET_TTL_SECONDS = 3_600
+
+const readSecurity = (env: EnvSource): MailSecurity => {
+    const value = env.optional("MAIL_SECURITY") ?? "starttls"
+    if (value !== "tls" && value !== "starttls" && value !== "none") throw new Error("MAIL_SECURITY must be tls, starttls or none")
+    return value
+}
+
+const readLanguage = (env: EnvSource): MailLanguage => {
+    const value = env.optional("MAIL_DEFAULT_LANGUAGE") ?? "en"
+    if (value !== "vi" && value !== "en") throw new Error("MAIL_DEFAULT_LANGUAGE must be vi or en")
+    return value
+}
+
+/** Reads the mail configuration with no credential or server defaults; the login is optional and its password reads `<KEY>_FILE` first. */
+export const parseMailConfig = (env: EnvSource): MailOptions => ({
+    host: env.string("MAIL_HOST"),
+    port: env.int("MAIL_PORT", DEFAULT_PORT),
+    security: readSecurity(env),
+    ...(env.has("MAIL_USER") ? { auth: { user: env.string("MAIL_USER"), pass: env.secret("MAIL_PASSWORD") } } : {}),
+    from: { name: env.string("MAIL_FROM_NAME"), address: env.string("MAIL_FROM") },
+    webOrigin: new URL(env.url("AUTH_WEB_ORIGIN")).origin,
+    brandName: env.string("MAIL_FROM_NAME"),
+    defaultLanguage: readLanguage(env),
+    confirmTtlSeconds: env.int("MAIL_CONFIRM_TTL_SECONDS", CONFIRM_TTL_SECONDS),
+    resetTtlSeconds: env.int("MAIL_RESET_TTL_SECONDS", RESET_TTL_SECONDS),
+})

package/templates/be/skeleton-lite/src/modules/integrations/mail/mail.decorators.ts

@@ -0,0 +1,14 @@
+import { MAILER } from "@starci/mail"
+import type { Mailer } from "@starci/mail"
+import { injector } from "@modules/platform/composition"
+import type { TypedParameterDecorator } from "@modules/platform/composition"
+import type { MailOptions } from "./mail.options"
+
+/** Token of the app's mail settings (the brand, the default language, the link lifetimes). */
+export const MAIL_SETTINGS: unique symbol = Symbol("integrations.mail.settings")
+
+/** Injects the mail port of `@starci/mail`. Parameter type: Mailer. */
+export const InjectMailer = (): TypedParameterDecorator<Mailer> => injector<Mailer>(MAILER)
+
+/** Injects the app's mail settings. Parameter type: MailOptions. */
+export const InjectMailSettings = (): TypedParameterDecorator<MailOptions> => injector<MailOptions>(MAIL_SETTINGS)

package/templates/be/skeleton-lite/src/modules/integrations/mail/mail.module-definition.ts

@@ -0,0 +1,12 @@
+import { ConfigurableModuleBuilder, type ConfigurableModuleHost } from "@nestjs/common"
+import type { MailOptions } from "./mail.options"
+
+const built = new ConfigurableModuleBuilder<MailOptions>()
+    .setExtras({ isGlobal: false }, (definition, extras) => ({ ...definition, global: extras.isGlobal }))
+    .build()
+type Host = ConfigurableModuleHost<MailOptions, "register", "create", { isGlobal: boolean }>
+
+/** The configurable-module base of the mail glue; `isGlobal` is decided by the app root. */
+export const ConfigurableModuleClass: Host["ConfigurableModuleClass"] = built.ConfigurableModuleClass
+/** The options of a synchronous registration, for the register signature. */
+export const OPTIONS_TYPE: Host["OPTIONS_TYPE"] = built.OPTIONS_TYPE

package/templates/be/skeleton-lite/src/modules/integrations/mail/mail.module.ts

@@ -0,0 +1,27 @@
+import { MailModule as PackageMailModule } from "@starci/mail"
+import type { MailOptions as PackageMailOptions } from "@starci/mail"
+import { Module } from "@nestjs/common"
+import type { DynamicModule } from "@nestjs/common"
+import { MAIL_SETTINGS } from "./mail.decorators"
+import { ConfigurableModuleClass, OPTIONS_TYPE } from "./mail.module-definition"
+
+@Module({})
+/** Composes `@starci/mail` with the app's typed settings and provides the settings of the app's own mail. */
+export class MailModule extends ConfigurableModuleClass {
+    /** Registers the capability once per app. */
+    static register(options: typeof OPTIONS_TYPE): DynamicModule {
+        const { webOrigin, brandName, defaultLanguage, confirmTtlSeconds, resetTtlSeconds, isGlobal, ...transport } = options
+        const base = super.register(options)
+        const mail = PackageMailModule.register({ ...(transport satisfies PackageMailOptions), isGlobal: false })
+        return {
+            ...base,
+            imports: [...(base.imports ?? []), mail],
+            providers: [
+                ...(base.providers ?? []),
+                { provide: MAIL_SETTINGS, useValue: { ...transport, webOrigin, brandName, defaultLanguage, confirmTtlSeconds, resetTtlSeconds } },
+            ],
+            exports: [...(base.exports ?? []), mail, MAIL_SETTINGS],
+            global: isGlobal === true,
+        }
+    }
+}

package/templates/be/skeleton-lite/src/modules/integrations/mail/mail.options.ts

@@ -0,0 +1,22 @@
+import type { MailOptions as MailSettings } from "@starci/mail"
+
+/** The languages the app writes its mail in. */
+export type MailLanguage = "vi" | "en"
+
+/**
+ * Outgoing mail parsed once at API boot: the settings of `@starci/mail` and what the app's own mail needs (the product name in
+ * the header, the language of a mail whose request names none, how long a confirmation or reset link lives). The words and
+ * layout of each mail belong to the domain that sends it.
+ */
+export interface MailOptions extends MailSettings {
+    /** The origin of the web app: the links of a confirmation or reset mail open its pages. */
+    readonly webOrigin: string
+    /** The product name in the header of every mail. */
+    readonly brandName: string
+    /** The language of a mail whose request names none. */
+    readonly defaultLanguage: MailLanguage
+    /** How long a confirmation link lives, in seconds. */
+    readonly confirmTtlSeconds: number
+    /** How long a password reset link lives, in seconds. */
+    readonly resetTtlSeconds: number
+}

package/templates/be/skeleton-lite/src/modules/integrations/object-storage/object-storage.module-definition.ts

@@ -1,12 +1,5 @@
-import { ConfigurableModuleBuilder, type ConfigurableModuleHost } from "@nestjs/common"
+import { defineCapabilityModule } from "@starci/nest-kit"
 import type { ObjectStorageOptions } from "./object-storage.options"
 
-const built = new ConfigurableModuleBuilder<ObjectStorageOptions>()
-    .setExtras({ isGlobal: false }, (definition, extras) => ({ ...definition, global: extras.isGlobal }))
-    .build()
-type Host = ConfigurableModuleHost<ObjectStorageOptions, "register", "create", { isGlobal: boolean }>
-
 /** The configurable-module base of the object storage glue; `isGlobal` is decided by the app root. */
-export const ConfigurableModuleClass: Host["ConfigurableModuleClass"] = built.ConfigurableModuleClass
-/** The options of a synchronous registration, for the register signature. */
-export const OPTIONS_TYPE: Host["OPTIONS_TYPE"] = built.OPTIONS_TYPE
+export const { ConfigurableModuleClass, OPTIONS_TYPE } = defineCapabilityModule<ObjectStorageOptions>()

package/templates/be/skeleton-lite/src/modules/integrations/passport/index.ts

@@ -1,4 +1,4 @@
-export { AuthError, isPresentablePassword, normalizeEmail } from "@starci/auth/server"
+export { AuthError, digestOf, isAcceptablePassword, isPresentablePassword, normalizeEmail } from "@starci/auth/server"
 export type {
     AccountDirectory,
     AccountStanding,

package/templates/be/skeleton-lite/src/modules/platform/database/index.ts

@@ -1,4 +1,5 @@
 export { DatabaseModule } from "./database.module"
+export { callDbFunction } from "./database.client"
 export { DATABASE_PROBE, InjectDatabaseProbe, InjectPrimaryEntityManager, PRIMARY_ENTITY_MANAGER } from "./primary.decorators"
 export { DatabaseProbeService } from "./database-probe.service"
 export type { DatabaseConnectionOptions } from "./database.options"

package/templates/be/skeleton-lite/src/modules/platform/http-security/rate-limit.guard.spec.ts

@@ -129,6 +129,17 @@ describe("RateLimitGuard", () => {
         expect(entityManager.update).not.toHaveBeenCalled()
     })
 
+    it("counts with an increment the database evaluates, so concurrent hits never overwrite each other", async () => {
+        const { entityManager, counting } = liveWindow(2)
+        const { guard } = await build(entityManager)
+
+        await guard.canActivate(contextOf("127.0.0.1"))
+
+        const assignment: unknown = counting?.callsOf("set")[0]?.[0]
+        const increment: unknown = typeof assignment === "object" && assignment !== null && "hits" in assignment && typeof assignment.hits === "function" ? Reflect.apply(assignment.hits, undefined, []) : undefined
+        expect(increment).toBe("hits + 1")
+    })
+
     it("refuses a caller whose shared window is over the default limit", async () => {
         const { guard } = await build(liveWindow(3).entityManager)
 

package/templates/be/skeleton-lite/src/tests/fixtures/builders/api.builder.ts

@@ -46,6 +46,17 @@ export const buildWiringProof = (): WiringProof => ({
             secretAccessKey: new Secret("fixture-only"),
             defaultExpiresIn: 300,
         },
+        mail: {
+            host: "127.0.0.1",
+            port: 2525,
+            security: "none",
+            from: { name: "Fixture", address: "no-reply@fixture.example" },
+            webOrigin: "https://app.fixture.example",
+            brandName: "Fixture",
+            defaultLanguage: "en",
+            confirmTtlSeconds: 86400,
+            resetTtlSeconds: 3600,
+        },
     },
     overrides: [
         { token: PRIMARY_DATA_SOURCE, value: { manager: {} } },

package/templates/be/table/api/feature.module-definition.ts.tpl

@@ -1,12 +1,6 @@
-import { ConfigurableModuleBuilder, type ConfigurableModuleHost } from "@nestjs/common"
+import { defineConfigurableModule } from "@starci/nest-kit"
 import type { {{Name}}ApiOptions } from "./{{name}}.options"
 
-const built = new ConfigurableModuleBuilder<{{Name}}ApiOptions>().setClassMethodName("register").build()
-type Host = ConfigurableModuleHost<{{Name}}ApiOptions, "register", "create", {}>
-
 /** The configurable-module base of the {{name}} module. */
-export const ConfigurableModuleClass: Host["ConfigurableModuleClass"] = built.ConfigurableModuleClass
-/** The injection token of the registered options. */
-export const MODULE_OPTIONS_TOKEN: Host["MODULE_OPTIONS_TOKEN"] = built.MODULE_OPTIONS_TOKEN
-/** The options of a synchronous registration, for the register signature. */
-export const OPTIONS_TYPE: Host["OPTIONS_TYPE"] = built.OPTIONS_TYPE
+export const { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE } =
+    defineConfigurableModule<{{Name}}ApiOptions>()

package/templates/be/table/api/graphql.module-definition.ts.tpl

@@ -1,12 +1,6 @@
-import { ConfigurableModuleBuilder, type ConfigurableModuleHost } from "@nestjs/common"
+import { defineConfigurableModule } from "@starci/nest-kit"
 import type { {{Name}}GraphqlOptions } from "./{{name}}-graphql.options"
 
-const built = new ConfigurableModuleBuilder<{{Name}}GraphqlOptions>().setClassMethodName("register").build()
-type Host = ConfigurableModuleHost<{{Name}}GraphqlOptions, "register", "create", {}>
-
 /** The configurable-module base of the {{name}}-graphql module. */
-export const ConfigurableModuleClass: Host["ConfigurableModuleClass"] = built.ConfigurableModuleClass
-/** The injection token of the registered options. */
-export const MODULE_OPTIONS_TOKEN: Host["MODULE_OPTIONS_TOKEN"] = built.MODULE_OPTIONS_TOKEN
-/** The options of a synchronous registration, for the register signature. */
-export const OPTIONS_TYPE: Host["OPTIONS_TYPE"] = built.OPTIONS_TYPE
+export const { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE } =
+    defineConfigurableModule<{{Name}}GraphqlOptions>()

package/templates/be/table/module-definition.ts.tpl

@@ -1,12 +1,5 @@
-import { ConfigurableModuleBuilder, type ConfigurableModuleHost } from "@nestjs/common"
+import { defineCapabilityModule } from "@starci/nest-kit"
 import type { {{Name}}Options } from "./{{name}}.options"
 
-const built = new ConfigurableModuleBuilder<{{Name}}Options>()
-    .setExtras({ isGlobal: false }, (definition, extras) => ({ ...definition, global: extras.isGlobal }))
-    .build()
-type Host = ConfigurableModuleHost<{{Name}}Options, "register", "create", { isGlobal: boolean }>
-
 /** The configurable-module base of the {{name}} capability. */
-export const ConfigurableModuleClass: Host["ConfigurableModuleClass"] = built.ConfigurableModuleClass
-/** The options of a synchronous registration, for the register signature. */
-export const OPTIONS_TYPE: Host["OPTIONS_TYPE"] = built.OPTIONS_TYPE
+export const { ConfigurableModuleClass, OPTIONS_TYPE } = defineCapabilityModule<{{Name}}Options>()

package/templates/fe/auth-lite/apps/web/src/modules/auth/email-doors.ts

@@ -0,0 +1,16 @@
+// Managed by starci app sync (slot fe.modules.auth.client); do not edit: run "npx starci app sync --execute".
+import { createAuthClient } from "@starci/auth/client"
+import { apiUrl } from "@/modules/config"
+import type { AuthFailure } from "./contracts"
+
+/** The email doors of the lite back end; the full edition's identity provider owns its own sign-up and recovery flows. */
+export type EmailDoorName = "signup" | "resend" | "confirm" | "forgot" | "reset"
+
+/** The anonymous doors need no session, so they use a client of their own over the same back-end origin. */
+const doors = createAuthClient({ apiOrigin: () => apiUrl() })
+
+/** Calls one email door with its posted fields; answers its failure (the wire code and its kind), or undefined when the back end accepted it. */
+export const sendEmailDoor = async (door: EmailDoorName, body: Readonly<Record<string, string | undefined>>): Promise<AuthFailure | undefined> => {
+    const outcome = await doors.send(door, body)
+    return outcome.success ? undefined : { code: outcome.error, kind: outcome.message, message: "" }
+}

package/templates/fe/auth-lite/apps/web/src/modules/auth/index.ts

@@ -0,0 +1,5 @@
+// Managed by starci app sync (slot fe.modules.auth.client); do not edit: run "npx starci app sync --execute".
+export { authClient } from "./client"
+export { sendEmailDoor } from "./email-doors"
+export type { EmailDoorName } from "./email-doors"
+export type { AuthFailure, AuthSession } from "./contracts"

package/templates/fe/skeleton/packages/__project__-i18n/src/index.ts

@@ -1,81 +1,44 @@
 import "server-only"
-import { hasLocale } from "next-intl"
-import type { AbstractIntlMessages } from "next-intl"
-import { createNavigation } from "next-intl/navigation"
-import { getMessages, getRequestConfig } from "next-intl/server"
-import { notFound } from "next/navigation"
+import { createReadLocaleSegment } from "@starci/next-i18n/layout"
+import type { ReadLocaleSegment } from "@starci/next-i18n/layout"
+import { createI18nNavigation } from "@starci/next-i18n/navigation"
+import type { I18nNavigation } from "@starci/next-i18n/navigation"
+import { createRequestConfig } from "@starci/next-i18n/request"
+import type { I18nRequestConfig } from "@starci/next-i18n/request"
+import type { LoadCatalog } from "@starci/next-i18n"
 import { locale as routeLocale } from "next/root-params"
-import { PRODUCT_TIME_ZONE, routing } from "./routing"
-import type { ProductRouting } from "./routing"
+import { i18n } from "./routing"
+import type { ProductI18n } from "./routing"
 
-/** Loads one app's own catalog for a served locale. */
-type LoadMessages = (locale: string) => Promise<unknown>
+/** The locales the product serves, as the catalog loader of an app receives them. */
+type ProductLocale = ProductI18n["locales"][number]
 
-/** The missing message next-intl asks a fallback for. */
-type MissingMessage = { readonly namespace?: string; readonly key: string }
-
-/** The message tree a catalog module exports as its default: the module is read as `unknown` and checked, never trusted as `any`. */
-const isMessages = (value: unknown): value is AbstractIntlMessages => typeof value === "object" && value !== null
-
-const messagesOf = (loaded: unknown): AbstractIntlMessages => {
-    const messages = typeof loaded === "object" && loaded !== null && "default" in loaded ? loaded.default : undefined
-    if (!isMessages(messages)) throw new TypeError("A message catalog module must export its messages as default")
-    return messages
+/** What one app of the product reads of its next-intl stack. */
+export interface AppI18n {
+    readonly navigation: I18nNavigation<ProductI18n["locales"], ProductI18n["localePrefix"]>
+    readonly requestConfig: I18nRequestConfig
+    readonly readLocaleSegment: ReadLocaleSegment<ProductLocale>
 }
 
 /** `next/root-params` is typed only after Next generates its types, so the reader is checked before it is called. */
 const isLocaleReader = (value: unknown): value is () => Promise<unknown> => typeof value === "function"
 
+/**
+ * The `[locale]` route param, read through `next/root-params` (`experimental.rootParams` in the app's next.config.ts), never the
+ * deprecated `requestLocale`. `next/root-params` is importable only where Next bundles it, which is why this workspace package, not
+ * `@starci/next-i18n`, reads it.
+ */
 const readRouteLocale = async (): Promise<unknown> => (isLocaleReader(routeLocale) ? routeLocale() : undefined)
 
-/** The language the address states, its catalog and the product time zone. */
-interface LocaleSegment {
-    readonly locale: string
-    readonly messages: AbstractIntlMessages
-    readonly timeZone: string
-}
-
-/** The navigation helpers of the product's routing (links, redirects, the locale-aware router). */
-type ProductNavigation = ReturnType<typeof createNavigation<ProductRouting["locales"], "as-needed">>
-
-/** What one app of the product reads of its next-intl stack. */
-export interface AppI18n {
-    readonly navigation: ProductNavigation
-    readonly requestConfig: ReturnType<typeof getRequestConfig>
-    readonly readLocaleSegment: (params: Promise<{ readonly locale: string }>) => Promise<LocaleSegment>
-}
-
 /**
- * The next-intl stack of one app of the product, written once here and called once by each app's `modules/i18n` (R59): the
- * product's one routing with its locale-aware navigation, the request config next-intl's plugin loads (the app's
- * `modules/i18n/request.ts` default-exports it) and what the app's `[locale]` layout resolves before it mounts the shell. `app` names
- * the app in the text of a message its catalog lacks (`<app>:<namespace>.<key>`); `loadMessages` loads its own catalogs. A server
- * module: a client component reads the default locale from `./routing`.
+ * What one app of the product calls from its `modules/i18n` (R59): the locale-aware navigation, the request config next-intl's
+ * plugin loads (the app's `modules/i18n/request.ts` default-exports it) and what the app's `[locale]` layout resolves before it
+ * mounts the shell, all built by `@starci/next-i18n` over the product's one description of its languages. `app` names the app in the
+ * text of a message its catalog lacks (`<app>:<namespace>.<key>`); `loadMessages` loads its own catalogs. A server module: a client
+ * component reads the default locale from `./routing`.
  */
-export const createAppI18n = (app: string, loadMessages: LoadMessages): AppI18n => ({
-    navigation: createNavigation<ProductRouting["locales"], "as-needed">(routing),
-    /**
-     * The locale is the `[locale]` route param read through `next/root-params` (`experimental.rootParams` in the app's next.config.ts,
-     * FE-I18N-1), never the deprecated `requestLocale`. An unrecognised locale resolves to the default before the loader runs, so a
-     * missing catalog file is never imported.
-     */
-    requestConfig: getRequestConfig(async () => {
-        const requested = await readRouteLocale()
-        const locale = hasLocale(routing.locales, requested) ? requested : routing.defaultLocale
-        return {
-            locale,
-            timeZone: PRODUCT_TIME_ZONE,
-            messages: messagesOf(await loadMessages(locale)),
-            getMessageFallback: ({ namespace, key }: MissingMessage) => `${app}:${namespace ?? ""}.${key}`,
-        }
-    }),
-    /**
-     * The language the address states, its catalog and the product time zone. An unknown segment is a route that does not exist,
-     * not a request to fall back silently.
-     */
-    readLocaleSegment: async (params: Promise<{ readonly locale: string }>) => {
-        const { locale } = await params
-        if (!hasLocale(routing.locales, locale)) notFound()
-        return { locale, messages: await getMessages(), timeZone: PRODUCT_TIME_ZONE }
-    },
+export const createAppI18n = (app: string, loadMessages: LoadCatalog<ProductLocale>): AppI18n => ({
+    navigation: createI18nNavigation(i18n),
+    requestConfig: createRequestConfig(i18n, { app, loadMessages, readRouteLocale }),
+    readLocaleSegment: createReadLocaleSegment(i18n),
 })

package/templates/fe/skeleton/packages/__project__-i18n/src/proxy.ts

@@ -1,24 +1,9 @@
-import "server-only"
-import createMiddleware from "next-intl/middleware"
-import { NextResponse, type NextRequest } from "next/server"
-import { routing } from "./routing"
-
-/** The first path segments of the API, the health probe and the framework: never locale-negotiated. */
-const UNNEGOTIATED_ROOTS: ReadonlySet<string> = new Set(["api", "health", "_next", "_vercel"])
-
-/** Whether the path belongs to the API, the health probe, the framework or a file with an extension. */
-const isUnnegotiated = (pathname: string): boolean => {
-    const segments = pathname.split("/")
-    const last = segments.at(-1) ?? ""
-    return UNNEGOTIATED_ROOTS.has(segments[1] ?? "") || (last.includes(".") && !last.endsWith("."))
-}
-
-const negotiate = createMiddleware(routing)
+import { createProxy } from "@starci/next-i18n/proxy"
+import type { LocaleProxy } from "@starci/next-i18n/proxy"
+import { i18n } from "./routing"
 
 /**
- * The one thing that runs before a route exists: which language it is in. next-intl's middleware reads the cookie, falls back to
- * the default and serves the default locale (vi) without a prefix. One routing table for every app; each app's `src/proxy.ts`
- * re-exports this.
+ * The one thing that runs before a route exists: which language it is in. The product's one description of its languages, read by
+ * the package's proxy; each app's `src/proxy.ts` re-exports this.
  */
-export const proxy = (request: NextRequest): NextResponse =>
-    isUnnegotiated(request.nextUrl.pathname) ? NextResponse.next() : negotiate(request)
+export const proxy: LocaleProxy = createProxy(i18n)

package/templates/fe/skeleton/packages/__project__-i18n/src/routing.ts

@@ -1,24 +1,18 @@
-import { defineRouting } from "next-intl/routing"
-import type { RoutingConfig } from "next-intl/routing"
+import { defineI18n } from "@starci/next-i18n"
+import type { I18n } from "@starci/next-i18n"
 
 /** The locales every app of the product serves; every catalog of an app has the same keys in each. */
 const LOCALES = ["vi", "en"] as const
 
-/** The locale served at the unprefixed path, and the language of a document no locale reached (the global error boundary). */
-export const DEFAULT_LOCALE = "vi"
-
-/** The product's time zone: fixed, not inferred, so the server and the hydrated client format the same instant the same way. */
-export const PRODUCT_TIME_ZONE = "Asia/Ho_Chi_Minh"
+/** The description of the product's languages: the locales and the `as-needed` prefix mode that `defineI18n` types. */
+export type ProductI18n = I18n<typeof LOCALES, "as-needed">
 
-/** The type of the product's routing table: the served locales, no locale prefix for the default one, no localized pathnames or domains. */
-export type ProductRouting = RoutingConfig<typeof LOCALES, "as-needed", never, never>
+/** The locale served at the unprefixed path, and the language of a document no locale reached (the global error boundary). */
+export const DEFAULT_LOCALE: ProductI18n["defaultLocale"] = "vi"
 
 /**
- * The one routing table of the product, for the proxy, the navigation and the request config of every app: vi default, a prefix
- * only when the locale is not the default, so `/vi` means the same thing on every app.
+ * The one description of the product's languages, for the proxy, the navigation and the request config of every app: vi default,
+ * a prefix only when the locale is not the default, and a fixed time zone so the server and the hydrated client format the same
+ * instant the same way. The stack that reads it is `@starci/next-i18n`'s; this package only states the languages (FE-I18N-1).
  */
-export const routing: ProductRouting = defineRouting({
-    locales: LOCALES,
-    defaultLocale: DEFAULT_LOCALE,
-    localePrefix: "as-needed",
-})
+export const i18n: ProductI18n = defineI18n({ locales: LOCALES, defaultLocale: DEFAULT_LOCALE, timeZone: "Asia/Ho_Chi_Minh" })

package/templates/fe/skeleton-lite/apps/web/src/app/[locale]/auth/confirm/page.tsx

@@ -0,0 +1,9 @@
+import { AppConfirmPage } from "@/features/pages/AppConfirmPage"
+
+/** The document title of this page. */
+export { appConfirmMetadata as generateMetadata } from "@/features/pages/AppConfirmPage"
+
+/** The confirm page slot: Next hands the query over as a promise, which the page reads for the token of the mail link. */
+const Page = (props: Parameters<typeof AppConfirmPage>[0]) => <AppConfirmPage {...props} />
+
+export default Page

package/templates/fe/skeleton-lite/apps/web/src/app/[locale]/auth/forgot/page.tsx

@@ -0,0 +1,9 @@
+import { AppForgotPage } from "@/features/pages/AppForgotPage"
+
+/** The document title of this page. */
+export { appForgotMetadata as generateMetadata } from "@/features/pages/AppForgotPage"
+
+/** The forgot page slot. */
+const Page = () => <AppForgotPage />
+
+export default Page

package/templates/fe/skeleton-lite/apps/web/src/app/[locale]/auth/resend/page.tsx

@@ -0,0 +1,9 @@
+import { AppResendPage } from "@/features/pages/AppResendPage"
+
+/** The document title of this page. */
+export { appResendMetadata as generateMetadata } from "@/features/pages/AppResendPage"
+
+/** The resend page slot. */
+const Page = () => <AppResendPage />
+
+export default Page

package/templates/fe/skeleton-lite/apps/web/src/app/[locale]/auth/reset/page.tsx

@@ -0,0 +1,9 @@
+import { AppResetPage } from "@/features/pages/AppResetPage"
+
+/** The document title of this page. */
+export { appResetMetadata as generateMetadata } from "@/features/pages/AppResetPage"
+
+/** The reset page slot: Next hands the query over as a promise, which the page reads for the token of the mail link. */
+const Page = (props: Parameters<typeof AppResetPage>[0]) => <AppResetPage {...props} />
+
+export default Page

package/templates/fe/skeleton-lite/apps/web/src/app/[locale]/auth/signup/page.tsx

@@ -0,0 +1,9 @@
+import { AppSignupPage } from "@/features/pages/AppSignupPage"
+
+/** The document title of this page. */
+export { appSignupMetadata as generateMetadata } from "@/features/pages/AppSignupPage"
+
+/** The signup page slot. */
+const Page = () => <AppSignupPage />
+
+export default Page

package/templates/fe/skeleton-lite/apps/web/src/app/[locale]/layout.tsx

@@ -1,10 +1,8 @@
-import { hasLocale } from "next-intl"
-import { getMessages } from "next-intl/server"
-import { notFound } from "next/navigation"
+import { createReadLocaleSegment } from "@starci/next-i18n/layout"
 import type { Metadata } from "next"
 import type { ReactElement, ReactNode } from "react"
 import { AppLayout, appLayoutMetadata } from "@/features/layouts/AppLayout"
-import { PRODUCT_TIME_ZONE, routing } from "@/modules/i18n"
+import { i18n } from "@/modules/i18n"
 import { Providers } from "./providers"
 import "../globals.css"
 import "@/modules/brand"
@@ -17,16 +15,14 @@ type LayoutProps = {
 /** The localized document title of this route segment. */
 export const generateMetadata = async (props: LayoutProps): Promise<Metadata> => appLayoutMetadata((await props.params).locale)
 
-/** The locale segment's document, providers and app chrome. */
+/** The locale segment's document, providers and app chrome; an unknown locale is a 404. */
 const Layout = async (props: LayoutProps): Promise<ReactElement> => {
-    const { locale } = await props.params
-    if (!hasLocale(routing.locales, locale)) notFound()
-    const messages = await getMessages()
+    const { locale, messages, timeZone } = await createReadLocaleSegment(i18n)(props.params)
     return (
         <AppLayout
             locale={locale}
             content={
-                <Providers locale={locale} messages={messages} timeZone={PRODUCT_TIME_ZONE}>
+                <Providers locale={locale} messages={messages} timeZone={timeZone}>
                     {props.children}
                 </Providers>
             }

package/templates/fe/skeleton-lite/apps/web/src/components/blocks/EmailDoorForm/component.tsx

@@ -0,0 +1,51 @@
+import { Button, Form, Input, Link, Text } from "@starci/grammar/common"
+
+/** One destination under the form: a sibling door or the sign-in page. */
+export interface EmailDoorLink {
+    readonly href: string
+    readonly label: string
+}
+
+/** Copy, fields, state and action supplied by the connected email-door block. */
+export interface EmailDoorFormBaseProps {
+    readonly props: {
+        readonly title: string
+        readonly description: string
+        /** The label of the email field, or undefined when the door takes none. */
+        readonly emailLabel: string | undefined
+        /** The label of the password field, or undefined when the door takes none. */
+        readonly passwordLabel: string | undefined
+        readonly submitLabel: string
+        readonly pending: boolean
+        /** The resolved message of the last refusal, or undefined. */
+        readonly errorMessage: string | undefined
+        /** The message shown once the back end accepted the request, or undefined while it has not. */
+        readonly doneMessage: string | undefined
+        readonly links: readonly EmailDoorLink[]
+    }
+    readonly on: { readonly submit: (input: FormData) => void }
+}
+
+/** Draws one email door (sign up, resend, forgot, reset) without reading navigation, copy or request state. */
+export const EmailDoorFormBase = (props: EmailDoorFormBaseProps) => (
+    <>
+        {props.props.doneMessage === undefined ? (
+            <Form label={props.props.title} isPending={props.props.pending} onSubmit={props.on.submit}>
+                <Text>{props.props.description}</Text>
+                {props.props.emailLabel === undefined ? null : <Input id="email-door-email" name="email" label={props.props.emailLabel} kind="email" isRequired />}
+                {props.props.passwordLabel === undefined ? null : <Input id="email-door-password" name="password" label={props.props.passwordLabel} kind="password" isRequired />}
+                {props.props.errorMessage === undefined ? null : <Text live="assertive">{props.props.errorMessage}</Text>}
+                <Button type="submit" intent="commit" isPending={props.props.pending}>
+                    {props.props.submitLabel}
+                </Button>
+            </Form>
+        ) : (
+            <Text live="polite">{props.props.doneMessage}</Text>
+        )}
+        {props.props.links.map((link) => (
+            <Link key={link.href} href={link.href}>
+                {link.label}
+            </Link>
+        ))}
+    </>
+)