@venizia/ardor 0.3.6 → 0.4.0

package/dist/presets/app/files/.configs/builders/Dockerfile

@@ -5,7 +5,7 @@
 #   docker build -f {{appPath}}/.configs/builders/Dockerfile -t {{app}} \
 #     --build-arg APP_BUILD_COMMIT="$(git rev-parse HEAD)" \
 #     --build-arg APP_BUILD_BRANCH="$(git rev-parse --abbrev-ref HEAD)" .
-#   docker run --rm -p 8080:8080 -e API_UPSTREAM=http://api:3000 {{app}}
+#   docker run --rm -p 8080:8080 -e API_UPSTREAM=http://api:3000 -e VITE_API_URL=/api {{app}}
 #
 # The preset cannot know which workspace packages this app needs, so the whole context is copied (the
 # .dockerignore at the root filters it), then installed and built. A project can list the packages by
@@ -64,14 +64,25 @@ LABEL org.opencontainers.image.revision="${APP_BUILD_COMMIT}"
 COPY --from=builder /home/bun/app/{{appPath}}/.configs/builders/nginx.conf.template /etc/nginx/templates/default.conf.template
 COPY --from=builder --chown=101:101 /home/bun/app/{{appPath}}/dist /usr/share/nginx/html
 
+# The runtime config: this script writes /usr/share/nginx/html/config.js from the VITE_ environment variables
+# when the container starts. 0755 because the base entrypoint skips a script without the executable bit; the
+# file it rewrites is the one the build copied from src/public, owned by 101 above.
+COPY --from=builder --chmod=0755 /home/bun/app/{{appPath}}/.configs/builders/docker-entrypoint.d/40-runtime-config.sh /docker-entrypoint.d/40-runtime-config.sh
+
 # Where /api goes: a compose service name, a cluster service, an address (an origin, with no path).
 ENV API_UPSTREAM=http://api:3000
 
+# The variables the app cannot run without, comma separated. A container that starts without one of them,
+# or with it empty, stops and names it instead of falling back to a build-time value. Any name works, not
+# only VITE_ ones; `-e APP_REQUIRED_ENV=...` overrides the list for one environment. Uncomment and list yours:
+# ENV APP_REQUIRED_ENV=VITE_API_URL
+
 # The base image reads the DNS servers of /etc/resolv.conf into ${NGINX_LOCAL_RESOLVERS}, which the template
 # gives to `resolver`: nginx looks the upstream up per request, so the container starts without it.
 ENV NGINX_ENTRYPOINT_LOCAL_RESOLVERS=1
 
-# No ENTRYPOINT on purpose: the base image's /docker-entrypoint.sh renders the templates.
+# No ENTRYPOINT on purpose: the base image's /docker-entrypoint.sh renders the templates and runs the
+# scripts of /docker-entrypoint.d/ (a custom ENTRYPOINT would replace it and skip both).
 EXPOSE 8080
 
 CMD ["nginx", "-g", "daemon off;"]

package/dist/presets/app/files/.configs/builders/docker-entrypoint.d/40-runtime-config.sh

@@ -0,0 +1,129 @@
+#!/bin/sh
+# Writes /usr/share/nginx/html/config.js from the container's environment, so one built image serves
+# every environment: `docker run -e VITE_API_URL=https://api.example.com image`.
+#
+# The nginx image runs every executable file of /docker-entrypoint.d/ in `sort -V` order before it starts
+# nginx. The 40 puts this after the base image's own scripts. A script without the executable bit is
+# skipped, hence `COPY --chmod=0755` in the Dockerfile; the Dockerfile must not declare an ENTRYPOINT,
+# which would replace the script that runs this directory.
+#
+# What is published: the variables named VITE_ followed by capitals, digits and underscores, and nothing
+# else. That is Vite's own rule for what reaches the browser, so the same names work in dev and here.
+# Every published value is readable by every visitor: never put a secret in a VITE_ variable. A name
+# with SECRET, PASSWORD or TOKEN in it stops the container, to catch that mistake early (a name with KEY
+# is fine: public keys are normal). Values are escaped as JavaScript string content, so no value can
+# end its string or the file.
+#
+# Required variables: APP_REQUIRED_ENV lists, comma separated, the variables the app cannot run without,
+# for example `ENV APP_REQUIRED_ENV="VITE_API_URL,API_UPSTREAM"` in the app's Dockerfile (an operator
+# overrides it with `-e`). A listed variable that is unset or empty stops the container with exit 1, and
+# the message names every missing one - never a value. Any variable name can be listed, not only VITE_
+# ones; a spaces-only or empty entry is skipped, and an entry that is not a variable name is an error.
+# Nothing listed checks nothing. A mounted config.js is kept before any check, as the operator supplied it.
+#
+# RUNTIME_CONFIG_TARGET names another file, for the tests; it is not a VITE_ name, so it is never published.
+set -eu
+
+TARGET="${RUNTIME_CONFIG_TARGET:-/usr/share/nginx/html/config.js}"
+
+# A read-only file is one the operator mounted over config.js: keep it as it is.
+if [ -e "$TARGET" ] && [ ! -w "$TARGET" ]; then
+  echo "[runtime-config] $TARGET is read-only (mounted): keeping the supplied file"
+  exit 0
+fi
+
+# One awk program, so the values never pass through a shell expansion. ENVIRON holds them as they are.
+BODY=$(awk '
+function escape(text,   result, index_, character) {
+  result = ""
+  for (index_ = 1; index_ <= length(text); index_++) {
+    character = substr(text, index_, 1)
+    result = result ((character in escapes) ? escapes[character] : character)
+  }
+  return result
+}
+
+BEGIN {
+  for (code = 1; code < 32; code++) {
+    escapes[sprintf("%c", code)] = sprintf("\\u%04x", code)
+  }
+  escapes[sprintf("%c", 127)] = "\\u007f"
+  escapes["\\"] = "\\\\"
+  escapes["\""] = "\\\""
+  escapes["<"] = "\\u003c"
+  escapes[">"] = "\\u003e"
+  escapes["&"] = "\\u0026"
+
+  count = 0
+  failed = 0
+
+  # Names only, in the order declared; a value never reaches a message.
+  entries = split(ENVIRON["APP_REQUIRED_ENV"], declared, ",")
+  missing = ""
+  for (position = 1; position <= entries; position++) {
+    entry = declared[position]
+    gsub(/^[ \t]+/, "", entry)
+    gsub(/[ \t]+$/, "", entry)
+    if (entry == "") {
+      continue
+    }
+    if (entry !~ /^[A-Za-z_][A-Za-z0-9_]*$/) {
+      print "[runtime-config] FATAL: APP_REQUIRED_ENV entry " position " is not a variable name (letters, digits and _, not starting with a digit)" > "/dev/stderr"
+      failed = 1
+      continue
+    }
+    if (entry in seen) {
+      continue
+    }
+    seen[entry] = 1
+    if (!(entry in ENVIRON) || ENVIRON[entry] == "") {
+      missing = missing (missing == "" ? "" : ", ") entry
+    }
+  }
+  if (missing != "") {
+    print "[runtime-config] FATAL: required variable(s) missing or empty: " missing > "/dev/stderr"
+    failed = 1
+  }
+
+  for (name in ENVIRON) {
+    if (name !~ /^VITE_[A-Z0-9_]+$/) {
+      continue
+    }
+    if (name ~ /SECRET|PASSWORD|TOKEN/) {
+      print "[runtime-config] " name " looks like a secret, and every VITE_ variable is published to every visitor: rename it or keep it out of VITE_" > "/dev/stderr"
+      failed = 1
+      continue
+    }
+    names[++count] = name
+  }
+  if (failed) {
+    exit 1
+  }
+
+  for (i = 2; i <= count; i++) {
+    current = names[i]
+    for (j = i - 1; j >= 1 && names[j] > current; j--) {
+      names[j + 1] = names[j]
+    }
+    names[j + 1] = current
+  }
+
+  for (i = 1; i <= count; i++) {
+    printf "  \"%s\": \"%s\"%s\n", names[i], escape(ENVIRON[names[i]]), (i < count ? "," : "")
+  }
+}
+' </dev/null) || {
+  echo "[runtime-config] FATAL: config.js was not written" >&2
+  exit 1
+}
+
+{
+  printf 'window.__APP_CONFIG__ = Object.freeze({'
+  if [ -n "$BODY" ]; then
+    printf '\n%s\n' "$BODY"
+  fi
+  printf '});\n'
+} >"$TARGET"
+
+NAMES=$(printf '%s\n' "$BODY" | sed -n 's/^  "\([A-Z0-9_]*\)": .*/\1/p' | tr '\n' ' ')
+echo "[runtime-config] wrote $TARGET with: ${NAMES:-nothing}"

package/dist/presets/app/files/.configs/builders/nginx.conf.template

@@ -20,6 +20,12 @@ server {
     proxy_set_header X-Forwarded-Proto $scheme;
   }
 
+  # The runtime config is written when the container starts and has no hash in its name: never cached.
+  location = /config.js {
+    add_header Cache-Control "no-store";
+    try_files $uri =404;
+  }
+
   # The built files carry a content hash in their name, so a browser may keep them for good.
   location /assets/ {
     expires 1y;

package/dist/presets/app/files/.configs/formatters/.ignore

@@ -1,4 +1,4 @@
-# Paths oxfmt skips: one gitignore-style pattern per line, relative to this app.
-# `devz lint` passes each line on as !pattern; lines starting with # are comments.
+# Paths bun fmt skips: one gitignore-style pattern per line, relative to this app.
+# `devz lint` passes each line on as --ignore-pattern; lines starting with # are comments.
 # Example: vendored code that keeps its own format.
 # src/vendor/**

package/dist/presets/app/files/_env.example

@@ -6,3 +6,8 @@ PORT={{devPort}}
 
 # The backend the dev server forwards /api to. Empty: the one chosen when the app was added (none, if it had no backend).
 API_URL={{apiUrl}}
+
+# The API the app calls. Empty: /api. In dev the app reads it as import.meta.env.VITE_API_URL; in the image it
+# is the VITE_API_URL given to `docker run -e`, which config.js carries to the browser when the container starts.
+# Every VITE_ variable is public: anything published is readable by every visitor. Never put a secret in one.
+VITE_API_URL=

package/dist/presets/app/files/src/application.test.ts

@@ -1,10 +1,11 @@
 import 'reflect-metadata';
 
-import { describe, expect, test } from 'bun:test';
+import { afterEach, describe, expect, test } from 'bun:test';
 
 import {
   BaseArdorApplication,
   CoreBindings,
+  RUNTIME_CONFIG_GLOBAL,
   type IApplicationInfo,
   type IArtifactIndex,
 } from '@venizia/ardor';
@@ -24,14 +25,26 @@ class TestApplication extends BaseArdorApplication {
   bindContext(): void {}
 }
 
+const restUrlOf = async (): Promise<unknown> => {
+  const application = new TestApplication();
+
+  await application.start();
+
+  return application.get<{ url: string }>({ key: CoreBindings.REST_DATA_PROVIDER_OPTIONS }).url;
+};
+
 describe('AdminConfiguration', () => {
+  afterEach(() => {
+    Reflect.deleteProperty(globalThis, RUNTIME_CONFIG_GLOBAL);
+  });
+
   test('binds the REST data provider options under their key', async () => {
-    const application = new TestApplication();
+    expect(await restUrlOf()).toBe('/api');
+  });
 
-    await application.start();
+  test('the API url is the one config.js wrote when the container started', async () => {
+    Reflect.set(globalThis, RUNTIME_CONFIG_GLOBAL, { VITE_API_URL: 'https://api.example.com' });
 
-    expect(application.get({ key: CoreBindings.REST_DATA_PROVIDER_OPTIONS })).toMatchObject({
-      url: '/api',
-    });
+    expect(await restUrlOf()).toBe('https://api.example.com');
   });
 });

package/dist/presets/app/files/src/configurations/admin.configuration.ts

@@ -5,6 +5,7 @@ import {
   DefaultI18nProvider,
   DefaultRestDataProvider,
   englishMessages,
+  getRuntimeConfig,
   inject,
   provide,
 } from '@venizia/ardor';
@@ -20,8 +21,16 @@ export class AdminConfiguration {
 
   @provide({ key: CoreBindings.REST_DATA_PROVIDER_OPTIONS })
   restDataProviderOptions() {
-    // No sign-in: no request carries an Authorization header.
-    return { url: '/api', noAuthPathRegex: /./ };
+    // No sign-in: no request carries an Authorization header. The API is `/api` (the image's nginx
+    // forwards it to API_UPSTREAM) unless VITE_API_URL says otherwise: set in .env in dev, or written to
+    // config.js when the container starts, so one built image serves every environment.
+    const url = getRuntimeConfig({
+      key: 'VITE_API_URL',
+      buildTimeEnv: import.meta.env,
+      defaultValue: '/api',
+    });
+
+    return { url, noAuthPathRegex: /./ };
   }
 
   @provide({ key: CoreBindings.I18N_PROVIDER_OPTIONS })

package/dist/presets/app/files/src/index.html

@@ -4,11 +4,17 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="color-scheme" content="light dark" />
-    <link rel="icon" href="data:image/svg+xml,%3Csvg%20xmlns%3D'http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg'%20viewBox%3D'0%200%2092%20123'%3E%3Cpath%20d%3D'M46%202C46%202%204%2052%204%2080a42%2042%200%200%200%2084%200C88%2060%2070%2036%2046%202Z'%20fill%3D'%230091EA'%2F%3E%3Cpath%20d%3D'M30%2092c-6-14-2-32%2014-38-4%2012%204%2022%2014%2024%2010%202%2016-6%2016-14%206%2014%202%2030-10%2038-12%208-28%204-34-10Z'%20fill%3D'%237DF3FF'%2F%3E%3C%2Fsvg%3E" />
+    <link
+      rel="icon"
+      href="data:image/svg+xml,%3Csvg%20xmlns%3D'http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg'%20viewBox%3D'0%200%2092%20123'%3E%3Cpath%20d%3D'M46%202C46%202%204%2052%204%2080a42%2042%200%200%200%2084%200C88%2060%2070%2036%2046%202Z'%20fill%3D'%230091EA'%2F%3E%3Cpath%20d%3D'M30%2092c-6-14-2-32%2014-38-4%2012%204%2022%2014%2024%2010%202%2016-6%2016-14%206%2014%202%2030-10%2038-12%208-28%204-34-10Z'%20fill%3D'%237DF3FF'%2F%3E%3C%2Fsvg%3E"
+    />
     <title>{{app}}</title>
   </head>
   <body>
     <div id="root"></div>
+    <!-- The runtime config: a classic script, so it runs before the module below. The image rewrites it when the
+         container starts; src/public/config.js is the empty one that dev and the build use. -->
+    <script src="/config.js"></script>
     <script type="module" src="/main.tsx"></script>
   </body>
 </html>

package/dist/presets/app/files/src/public/config.js

@@ -0,0 +1,3 @@
+// The runtime config. The image's entrypoint replaces this file when the container starts, with the VITE_
+// environment variables; in dev and in the build it is empty, and the app falls back to import.meta.env.
+window.__APP_CONFIG__ = {};

package/dist/presets/app/preset.json

@@ -13,12 +13,12 @@
   "dependencies": {
     "@reduxjs/toolkit": "^2.13.0",
     "@tanstack/react-query": "^5.104.5",
-    "@venizia/ardor": "0.3.6",
-    "@venizia/ignis-connectors": "0.3.6",
-    "@venizia/ignis-filter": "0.3.6",
-    "@venizia/ignis-helpers": "0.3.6",
-    "@venizia/ignis-inversion": "0.3.7",
-    "@venizia/ignis-kernel": "0.3.6",
+    "@venizia/ardor": "0.4.0",
+    "@venizia/ignis-connectors": "0.4.0",
+    "@venizia/ignis-filter": "0.4.0",
+    "@venizia/ignis-helpers": "0.4.0",
+    "@venizia/ignis-inversion": "0.4.0",
+    "@venizia/ignis-kernel": "0.4.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "ra-core": "^5.15.5",
@@ -35,11 +35,10 @@
     "@types/bun": "^1.4.3",
     "@types/react": "^19",
     "@types/react-dom": "^19",
-    "@venizia/dev-configs": "0.3.6",
-    "@venizia/ignis-boot": "0.3.6",
+    "@venizia/dev-configs": "0.4.0",
+    "@venizia/ignis-boot": "0.4.0",
     "@vitejs/plugin-react": "^6.1.2",
     "eslint": "^10.13.0",
-    "oxfmt": "0.74.0",
     "oxlint": "1.89.0",
     "oxlint-tsgolint": "7.0.2004",
     "tailwindcss": "^4.3.3",
@@ -47,12 +46,12 @@
     "vite": "^8.3.5"
   },
   "peers": {
-    "@venizia/dev-configs": "^0.3.6",
-    "@venizia/ignis-connectors": "^0.3.6",
-    "@venizia/ignis-filter": "^0.3.6",
-    "@venizia/ignis-helpers": "^0.3.6",
-    "@venizia/ignis-inversion": "^0.3.7",
-    "@venizia/ignis-kernel": "^0.3.6"
+    "@venizia/dev-configs": "^0.4.0",
+    "@venizia/ignis-connectors": "^0.4.0",
+    "@venizia/ignis-filter": "^0.4.0",
+    "@venizia/ignis-helpers": "^0.4.0",
+    "@venizia/ignis-inversion": "^0.4.0",
+    "@venizia/ignis-kernel": "^0.4.0"
   },
   "scripts": {
     "server:dev": "vite --config .configs/builders/vite.config.mts",

package/dist/presets/lib/files/.configs/formatters/.ignore

@@ -1,4 +1,4 @@
-# Paths oxfmt skips: one gitignore-style pattern per line, relative to this app.
-# `devz lint` passes each line on as !pattern; lines starting with # are comments.
+# Paths bun fmt skips: one gitignore-style pattern per line, relative to this app.
+# `devz lint` passes each line on as --ignore-pattern; lines starting with # are comments.
 # Example: vendored code that keeps its own format.
 # src/vendor/**

package/dist/presets/lib/preset.json

@@ -5,10 +5,9 @@
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@types/react": "^19",
-    "@venizia/ardor": "^0.3.6",
-    "@venizia/dev-configs": "0.3.6",
+    "@venizia/ardor": "^0.4.0",
+    "@venizia/dev-configs": "0.4.0",
     "eslint": "^10.13.0",
-    "oxfmt": "0.74.0",
     "oxlint": "1.89.0",
     "oxlint-tsgolint": "7.0.2004",
     "react": "^19.3.1",
@@ -18,7 +17,7 @@
     "typescript": "^6.0.3"
   },
   "peerDependencies": {
-    "@venizia/ardor": "^0.3.6",
+    "@venizia/ardor": "^0.4.0",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
     "react-router-dom": "^7.18.4",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venizia/ardor",
-  "version": "0.3.6",
+  "version": "0.4.0",
   "description": "ARDOR - frontend application framework for the VENIZIA family. One entry point over ardor-kernel, ardor-react and ardor-admin: IGNIS inversion of control, a REST data layer, auth and i18n providers, and the React bindings for a react-admin application.",
   "keywords": [
     "ardor",
@@ -18,24 +18,29 @@
     "venizia"
   ],
   "homepage": "https://ardor.venizia.ai",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/VENIZIA-AI/ardor.git",
-    "directory": "packages/ardor"
-  },
   "bugs": {
     "url": "https://github.com/VENIZIA-AI/ardor/issues"
   },
+  "license": "MIT",
   "author": {
     "name": "VENIZIA AI Developer",
     "email": "developer@venizia.ai",
     "url": "https://venizia.ai"
   },
-  "license": "MIT",
-  "engines": {
-    "bun": ">=1.4"
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/VENIZIA-AI/ardor.git",
+    "directory": "packages/ardor"
   },
+  "files": [
+    "README.md",
+    "LICENSE.md",
+    "dist",
+    "!/**/__tests__",
+    "!**/*.tsbuildinfo"
+  ],
   "type": "module",
+  "sideEffects": false,
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -57,20 +62,6 @@
     },
     "./package.json": "./package.json"
   },
-  "sideEffects": false,
-  "vulcan": {
-    "presets": {
-      "app": "./dist/presets/app/preset.json",
-      "lib": "./dist/presets/lib/preset.json"
-    }
-  },
-  "files": [
-    "README.md",
-    "LICENSE.md",
-    "dist",
-    "!/**/__tests__",
-    "!**/*.tsbuildinfo"
-  ],
   "publishConfig": {
     "access": "public"
   },
@@ -79,18 +70,28 @@
     "prepublishOnly": "make rebuild"
   },
   "dependencies": {
-    "@venizia/ardor-admin": "0.3.6",
-    "@venizia/ardor-kernel": "0.3.6",
-    "@venizia/ardor-react": "0.3.6"
+    "@venizia/ardor-admin": "0.4.0",
+    "@venizia/ardor-kernel": "0.4.0",
+    "@venizia/ardor-react": "0.4.0"
+  },
+  "devDependencies": {
+    "@size-limit/preset-small-lib": "^14.2.0",
+    "@venizia/dev-configs": "^0.4.0",
+    "eslint": "^10.13.0",
+    "oxlint": "1.89.0",
+    "oxlint-tsgolint": "7.0.2004",
+    "size-limit": "^14.2.0",
+    "tsc-alias": "~1.8.17",
+    "typescript": "^6.0.3"
   },
   "peerDependencies": {
     "@reduxjs/toolkit": ">=2.13.0",
     "@tanstack/react-query": ">=5.104.5",
-    "@venizia/ignis-connectors": "^0.3.6",
-    "@venizia/ignis-filter": "^0.3.6",
-    "@venizia/ignis-helpers": "^0.3.6",
-    "@venizia/ignis-inversion": "^0.3.7",
-    "@venizia/ignis-kernel": "^0.3.6",
+    "@venizia/ignis-connectors": "^0.4.0",
+    "@venizia/ignis-filter": "^0.4.0",
+    "@venizia/ignis-helpers": "^0.4.0",
+    "@venizia/ignis-inversion": "^0.4.0",
+    "@venizia/ignis-kernel": "^0.4.0",
     "ra-core": ">=5.15.5",
     "ra-i18n-polyglot": ">=5.15.5",
     "react": ">=19.3.1",
@@ -108,17 +109,6 @@
       "optional": true
     }
   },
-  "devDependencies": {
-    "@size-limit/preset-small-lib": "^14.2.0",
-    "@venizia/dev-configs": "^0.3.6",
-    "eslint": "^10.13.0",
-    "oxfmt": "0.74.0",
-    "oxlint": "1.89.0",
-    "oxlint-tsgolint": "7.0.2004",
-    "size-limit": "^14.2.0",
-    "tsc-alias": "~1.8.17",
-    "typescript": "^6.0.3"
-  },
   "size-limit": [
     {
       "path": "dist/index.js",
@@ -140,5 +130,14 @@
       ],
       "limit": "350 B"
     }
-  ]
+  ],
+  "engines": {
+    "bun": ">=1.4"
+  },
+  "vulcan": {
+    "presets": {
+      "app": "./dist/presets/app/preset.json",
+      "lib": "./dist/presets/lib/preset.json"
+    }
+  }
 }

package/dist/presets/app/files/.configs/formatters/oxfmt.config.mts

@@ -1,4 +0,0 @@
-import { defineConfig } from 'oxfmt';
-import { browserOxfmtConfigs } from '@venizia/dev-configs/formatters';
-
-export default defineConfig(browserOxfmtConfigs);

package/dist/presets/lib/files/.configs/formatters/oxfmt.config.mts

@@ -1,4 +0,0 @@
-import { defineConfig } from 'oxfmt';
-import { browserOxfmtConfigs } from '@venizia/dev-configs/formatters';
-
-export default defineConfig(browserOxfmtConfigs);