@venizia/ardor 0.4.8-5 → 0.4.8-6

package/dist/codemod/cli.d.ts

@@ -1,6 +1,6 @@
 /** `ardor codemod namespace`: a dry run unless `--write`; `--check` is the dry run that fails on work left. */
 export declare class NamespaceCommand {
-    static readonly USAGE = "Usage: ardor codemod namespace [paths...] [--hooks] [--write [--allow-dirty] | --check]\n\nMoves the names removed from @venizia/ardor to what replaces them:\n\n  isDefined, isString, isNumber, isObject, isValidDate   ValueUtility.<name>\n  isBrowser                                             BrowserUtility.isBrowser\n  toDataUrl                                             FileUtility.toDataUrl\n  getRuntimeConfig                                      RuntimeConfig.get\n  createAppDispatch, createAppSelectors                 DispatchHooks.create, SelectorHooks.create\n  resolveApplicationProviders                           ApplicationProviders.resolve\n  hasPendingFeatureMessages, loadFeatureMessages        Features.hasPendingMessages, Features.loadMessages\n  NumberIdType, StringIdType, NullableType              number, string, undefined | null | void\n  BaseHelper, LogLevels, ILogger, TLogLevel             the same names from @venizia/ignis-helpers/core\n  Logger.getInstance({ scope }), new Logger({ scope })  LoggerFactory.getLogger([scope]) (enableDebug is dropped, with a note)\n  Logger (a type)                                       ILogger\n  ISendResponse                                         INetworkResponse\n\nRemoved with nothing to write in their place, so only listed with their line: isEditableTarget,\nTDataCount, ISyncFC, IListFilter.offset (use skip; listed wherever a file that imports IListFilter or ListFilterBuilder reads or sets .offset), useSizer (use useElementSize), useInjectableContainer (renamed useApplicationContainer), App.DEFAULT_LOCALE, HeaderConstants.REQUEST_DEVICE_INFO, HeaderConstants.RESPONSE_FORMAT,\nthe enableDebug prop of ArdorApplication (pass logger instead), and a Logger use with no one-line form.\n\nIt rewrites a name imported from @venizia/ardor, @venizia/ardor-kernel, @venizia/ardor-react or\n@venizia/ardor-admin, its uses, and the import. It reads syntax only: a name the file also declares\nitself, a re-export by name and a class name already taken are listed with their line and left for you.\n\n  --hooks    also move a hook imported from @venizia/ardor to the Ardor namespace (useRepository()\n             becomes Ardor.useRepository()). A hook imported from @venizia/ardor-react or\n             @venizia/ardor-admin is never touched: those packages cannot import Ardor.\n  --write    write the changed files (without it, nothing is written)\n  --allow-dirty  with --write, also write a file that has local changes, such as one another codemod\n             just changed (devz codemod namespace-functions --write leaves the tree dirty)\n  --check    dry run that exits 1 when anything would change or is left (for CI)\n  --help     print this text and exit\n\nWith no flag it lists what would change and writes nothing. Inside a git repository it reads the\nfiles git knows (tracked, or untracked and not ignored), and --write refuses a file with local\nchanges (changed, staged or untracked), so git can undo the codemod: the file is listed as \"refused\"\nwith its path, the summary counts it and the run exits 1. Commit or stash it and run again, or run\nagain with --allow-dirty to write it anyway (it keeps the other codemod's edits). To run two codemods\none after the other in a dirty tree, give this one --write --allow-dirty.\nRun your formatter afterwards: the new names are appended to the import they join.";
+    static readonly USAGE = "Usage: ardor codemod namespace [paths...] [--hooks] [--write [--allow-dirty] | --check]\n\nMoves the names removed from @venizia/ardor to what replaces them:\n\n  isDefined, isString, isNumber, isObject, isValidDate   ValueUtility.<name>\n  isBrowser                                             BrowserUtility.isBrowser\n  toDataUrl                                             FileUtility.toDataUrl\n  getRuntimeConfig                                      RuntimeConfig.get\n  createAppDispatch, createAppSelectors                 DispatchHooks.create, SelectorHooks.create\n  resolveApplicationProviders                           ApplicationProviders.resolve\n  hasPendingFeatureMessages, loadFeatureMessages        Features.hasPendingMessages, Features.loadMessages\n  NumberIdType, StringIdType, NullableType              number, string, undefined | null | void\n  BaseHelper, LogLevels, ILogger, TLogLevel             the same names from @venizia/ignis-helpers/core\n  Logger.getInstance({ scope }), new Logger({ scope })  LoggerFactory.getLogger([scope]) (enableDebug is dropped, with a note)\n  Logger (a type)                                       ILogger\n  ISendResponse                                         INetworkResponse\n\nRemoved with nothing to write in their place, so only listed with their line: isEditableTarget,\nTDataCount, ISyncFC, IListFilter.offset (use skip; listed wherever a file that imports IListFilter or ListFilterBuilder reads or sets .offset), useSizer (use useElementSize), useInjectableContainer (renamed useApplicationContainer), App.DEFAULT_LOCALE, HeaderConstants.REQUEST_DEVICE_INFO, HeaderConstants.RESPONSE_FORMAT,\nthe enableDebug prop of ArdorApplication (pass logger instead), and a Logger use with no one-line form.\n\nIt rewrites a name imported from @venizia/ardor, @venizia/ardor-kernel, @venizia/ardor-react or\n@venizia/ardor-admin, its uses, and the import. It reads syntax only: a name the file also declares\nitself, a re-export by name and a class name already taken are listed with their line and left for you.\n\n  --hooks    also move a hook imported from @venizia/ardor to the Ardor namespace (useRepository()\n             becomes Ardor.useRepository()). A hook imported from @venizia/ardor-react or\n             @venizia/ardor-admin is never touched: those packages cannot import Ardor.\n  --write    write the changed files (without it, nothing is written)\n  --allow-dirty  with --write, also write a file that has local changes, such as one another codemod\n             just changed (devz codemod namespace-functions --write leaves the tree dirty)\n  --check    dry run that exits 1 when anything would change or is left (for CI)\n  --help     print this text and exit\n\n--write is all or nothing: it reads and rewrites every file in memory first, and writes only if every\nfile went through. A file that cannot be parsed or rewritten is listed as \"failed\" with its path, the\nrun exits 1 and nothing is written. A file that is not valid UTF-8 and would change is a failure too:\nit is left alone rather than damaged. Outside a git repository nothing can undo a write, so --write\nrefuses unless you give --allow-dirty.\n\nWith no flag it lists what would change and writes nothing. Inside a git repository it reads the\nfiles git knows (tracked, or untracked and not ignored), and --write refuses a file with local\nchanges (changed, staged or untracked), so git can undo the codemod: the file is listed as \"refused\"\nwith its path, the summary counts it and the run exits 1. Commit or stash it and run again, or run\nagain with --allow-dirty to write it anyway (it keeps the other codemod's edits). To run two codemods\none after the other in a dirty tree, give this one --write --allow-dirty.\nRun your formatter afterwards: the new names are appended to the import they join.";
     /** Runs the command and returns the exit code; prints to the console. */
     static run(opts: {
         root: string;
@@ -8,6 +8,15 @@ export declare class NamespaceCommand {
     }): Promise<number>;
     private static loadTypeScript;
     private static sweep;
+    /**
+     * Writes every file next to itself first, and renames them into place only when all were written,
+     * so a failure leaves no file changed. A file that is not the file that was read (a link swapped in,
+     * an edit made meanwhile) is refused: the rename replaces a link instead of following it, and a
+     * hard link is not written through.
+     */
+    private static writeAll;
+    /** Text for the terminal: control, format and line-separator characters, such as an escape sequence in a file name, become `?`. */
+    private static clean;
     private static report;
 }
 //# sourceMappingURL=cli.d.ts.map

package/dist/codemod/cli.js

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, lstatSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
 import { relative, resolve } from 'node:path';
 import { CodemodFiles } from './files.js';
 import { Migration } from './migrate.js';
@@ -36,6 +36,12 @@ itself, a re-export by name and a class name already taken are listed with their
   --check    dry run that exits 1 when anything would change or is left (for CI)
   --help     print this text and exit
 
+--write is all or nothing: it reads and rewrites every file in memory first, and writes only if every
+file went through. A file that cannot be parsed or rewritten is listed as "failed" with its path, the
+run exits 1 and nothing is written. A file that is not valid UTF-8 and would change is a failure too:
+it is left alone rather than damaged. Outside a git repository nothing can undo a write, so --write
+refuses unless you give --allow-dirty.
+
 With no flag it lists what would change and writes nothing. Inside a git repository it reads the
 files git knows (tracked, or untracked and not ignored), and --write refuses a file with local
 changes (changed, staged or untracked), so git can undo the codemod: the file is listed as "refused"
@@ -98,6 +104,11 @@ export class NamespaceCommand {
         const paths = args.filter((argument) => !argument.startsWith('-'));
         const targets = (paths.length > 0 ? paths : ['.']).map((path) => resolve(root, path));
         const hooks = args.includes(CodemodFlags.HOOKS);
+        const missing = targets.filter((target) => !existsSync(target));
+        if (missing.length > 0) {
+            console.error(`ardor codemod: no such file or folder: ${missing.map(NamespaceCommand.clean).join(', ')}`);
+            return USAGE_ERROR_CODE;
+        }
         return NamespaceCommand.sweep({ root, ts, targets, hooks, isWrite, isCheck, isAllowDirty });
     }
     static async loadTypeScript() {
@@ -114,43 +125,118 @@ export class NamespaceCommand {
     static sweep(opts) {
         const { root, ts, targets, hooks, isWrite, isCheck, isAllowDirty } = opts;
         const files = [...new Set(targets.flatMap((target) => CodemodFiles.collect({ target })))];
-        const dirty = isWrite && !isAllowDirty
-            ? new Set(targets.flatMap((target) => [...(CodemodFiles.dirty({ target }) ?? [])]))
-            : new Set();
+        const dirtyOf = targets.map((target) => CodemodFiles.dirty({ target }));
+        if (isWrite && !isAllowDirty && dirtyOf.some((dirty) => dirty === undefined)) {
+            console.error(`ardor codemod: this is not a git repository, so nothing can undo ${CodemodFlags.WRITE}; run again with ${CodemodFlags.ALLOW_DIRTY} to write anyway`);
+            return 1;
+        }
+        const dirty = new Set(isAllowDirty ? [] : dirtyOf.flatMap((paths) => [...(paths ?? [])]));
         const changes = [];
+        const pending = [];
         const refused = [];
+        const failed = [];
         const left = [];
         const notes = [];
         for (const path of files) {
-            const text = readFileSync(path, 'utf8');
-            const result = Migration.run({ ts, fileName: path, text, hooks });
-            for (const finding of result.findings) {
-                (finding.kind === 'note' ? notes : left).push({ path, finding });
+            try {
+                const stat = lstatSync(path);
+                const bytes = readFileSync(path);
+                const text = bytes.toString('utf8');
+                const result = Migration.run({ ts, fileName: path, text, hooks });
+                for (const finding of result.findings) {
+                    (finding.kind === 'note' ? notes : left).push({ path, finding });
+                }
+                if (result.text === text) {
+                    continue;
+                }
+                if (!Buffer.from(text, 'utf8').equals(bytes)) {
+                    failed.push({ path, reason: 'it is not valid UTF-8, so a rewrite would damage it' });
+                    continue;
+                }
+                if (isWrite && dirty.has(path)) {
+                    refused.push(path);
+                    continue;
+                }
+                changes.push({ path, renamed: result.renamed });
+                pending.push({ path, text: result.text, stat });
             }
-            if (result.text === text) {
-                continue;
+            catch (error) {
+                failed.push({ path, reason: error instanceof Error ? error.message : String(error) });
             }
-            if (isWrite && dirty.has(path)) {
-                refused.push(path);
-                continue;
+        }
+        if (isWrite && failed.length === 0) {
+            failed.push(...NamespaceCommand.writeAll({ pending }));
+        }
+        return NamespaceCommand.report({
+            root,
+            isWrite,
+            isCheck,
+            changes,
+            refused,
+            failed,
+            left,
+            notes,
+        });
+    }
+    /**
+     * Writes every file next to itself first, and renames them into place only when all were written,
+     * so a failure leaves no file changed. A file that is not the file that was read (a link swapped in,
+     * an edit made meanwhile) is refused: the rename replaces a link instead of following it, and a
+     * hard link is not written through.
+     */
+    static writeAll(opts) {
+        const staged = [];
+        const failures = [];
+        for (const { path, text, stat } of opts.pending) {
+            const temp = `${path}.${process.pid}.codemod`;
+            try {
+                const now = lstatSync(path);
+                if (!now.isFile() || now.mtimeMs !== stat.mtimeMs || now.size !== stat.size) {
+                    failures.push({
+                        path,
+                        reason: 'it changed while the codemod ran, so it was not written',
+                    });
+                    continue;
+                }
+                writeFileSync(temp, text);
+                chmodSync(temp, now.mode & 0o7777);
+                staged.push({ path, temp });
+            }
+            catch (error) {
+                rmSync(temp, { force: true });
+                failures.push({ path, reason: error instanceof Error ? error.message : String(error) });
             }
-            changes.push({ path, renamed: result.renamed });
-            if (isWrite) {
-                writeFileSync(path, result.text);
+        }
+        if (failures.length > 0) {
+            for (const { temp } of staged) {
+                rmSync(temp, { force: true });
             }
+            return failures;
         }
-        return NamespaceCommand.report({ root, isWrite, isCheck, changes, refused, left, notes });
+        for (const { path, temp } of staged) {
+            renameSync(temp, path);
+        }
+        return [];
+    }
+    /** Text for the terminal: control, format and line-separator characters, such as an escape sequence in a file name, become `?`. */
+    static clean(text) {
+        return text.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, '?');
     }
     static report(opts) {
-        const { root, isWrite, isCheck, changes, refused, left, notes } = opts;
-        const verb = isWrite ? 'changed' : 'would change';
-        const show = (path) => relative(root, path) || path;
+        const { root, isWrite, isCheck, changes, refused, failed, left, notes } = opts;
+        // Nothing is written when a file failed, so the files are not "changed".
+        const verb = isWrite && failed.length === 0 ? 'changed' : 'would change';
+        // A path comes from the file system: a control character in it is shown as `?`, never sent to the terminal.
+        const show = (path) => NamespaceCommand.clean(relative(root, path) || path);
         for (const change of changes) {
             console.log(`${verb} ${show(change.path)} (${change.renamed} use${change.renamed === 1 ? '' : 's'})`);
         }
         for (const path of refused) {
             console.error(`refused ${show(path)}: it has local changes, so git cannot undo the codemod there; commit or stash it and run again, or run again with ${CodemodFlags.ALLOW_DIRTY}`);
         }
+        for (const { path, reason } of failed) {
+            console.error(NamespaceCommand.clean(`failed ${show(path)}: ${reason}`));
+        }
         // A note is a change made on purpose that is worth knowing; it is not work left, so --check ignores it.
         for (const { path, finding } of notes) {
             console.log(`note ${show(path)}:${finding.line} ${finding.name}: ${finding.reason}`);
@@ -158,9 +244,14 @@ export class NamespaceCommand {
         for (const { path, finding } of left) {
             console.error(`left ${show(path)}:${finding.line} ${finding.name}: ${finding.reason}`);
         }
-        const refusedNote = refused.length > 0 ? `, ${refused.length} refused (listed above)` : '';
+        const refusedNote = [
+            refused.length > 0 ? `, ${refused.length} refused (listed above)` : '',
+            failed.length > 0
+                ? `, ${failed.length} failed (listed above)${isWrite ? ', nothing was written' : ''}`
+                : '',
+        ].join('');
         console.log(`${changes.length} file${changes.length === 1 ? '' : 's'} ${verb}${refusedNote}, ${left.length} left for you${isWrite || changes.length === 0 ? '' : '. Run again with --write to apply.'}`);
-        if (refused.length > 0) {
+        if (refused.length > 0 || failed.length > 0) {
             return 1;
         }
         return isCheck && (changes.length > 0 || left.length > 0) ? 1 : 0;

package/dist/codemod/files.d.ts

@@ -7,7 +7,7 @@ export declare class CodemodFiles {
     static isSource(opts: {
         name: string;
     }): boolean;
-    /** Every source file under `target`; a file target is returned as it is. */
+    /** Every source file under `target`; a file target is returned as it is. A symlink or a file that is not a source file is never returned. */
     static collect(opts: {
         target: string;
     }): string[];

package/dist/codemod/files.js

@@ -1,5 +1,5 @@
 import { execFileSync } from 'node:child_process';
-import { existsSync, readdirSync, statSync } from 'node:fs';
+import { lstatSync, readdirSync, statSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 const SKIPPED_DIRECTORIES = new Set(['node_modules', 'dist', 'build', '.git']);
 const SOURCE_PATTERN = /\.(?:ts|tsx|mts|cts)$/;
@@ -13,11 +13,15 @@ export class CodemodFiles {
     static isSource(opts) {
         return SOURCE_PATTERN.test(opts.name) && !DECLARATION_PATTERN.test(opts.name);
     }
-    /** Every source file under `target`; a file target is returned as it is. */
+    /** Every source file under `target`; a file target is returned as it is. A symlink or a file that is not a source file is never returned. */
     static collect(opts) {
         const { target } = opts;
-        if (statSync(target).isFile()) {
-            return [target];
+        // Read without following a link: a symlink is never a file to write, whatever it points to.
+        if (lstatSync(target).isFile()) {
+            return CodemodFiles.isSource({ name: target }) ? [target] : [];
+        }
+        if (!statSync(target).isDirectory()) {
+            return [];
         }
         return CodemodFiles.fromGit({ target }) ?? CodemodFiles.fromWalk({ target });
     }
@@ -42,7 +46,7 @@ export class CodemodFiles {
             .filter((path) => path !== '' && CodemodFiles.isSource({ name: path }))
             .filter((path) => !path.split('/').some((segment) => SKIPPED_DIRECTORIES.has(segment)))
             .map((path) => join(target, path))
-            .filter((path) => existsSync(path) && statSync(path).isFile());
+            .filter((path) => lstatSync(path, { throwIfNoEntry: false })?.isFile() === true);
     }
     static fromWalk(opts) {
         const files = [];

package/dist/presets/app/files/.configs/builders/Dockerfile

@@ -17,6 +17,11 @@
 FROM docker.io/oven/bun:1.4.3-alpine AS deps
 
 # A private registry, when the build runs where the public one is not reachable. Empty by default.
+# The URL stays in the metadata of this stage and the next two (not in the final image): never put a user or a
+# password in it. For a registry that needs credentials, mount a bunfig.toml for the install only, with BuildKit:
+#   RUN --mount=type=secret,id=bunfig,target=/home/bun/.bunfig.toml,uid=1000 bun install ...
+#   docker build --secret id=bunfig,src=./bunfig.toml ...
+# A project that wants fixed base images pins them by digest (FROM image@sha256:...).
 ARG BUN_CONFIG_REGISTRY=
 ENV BUN_CONFIG_REGISTRY=${BUN_CONFIG_REGISTRY}
 

package/dist/presets/app/files/.configs/builders/docker-entrypoint.d/40-runtime-config.sh

@@ -10,8 +10,9 @@
 # What is published: the variables named VITE_ followed by capitals, digits and underscores, and nothing
 # else. That is Vite's own rule for what reaches the browser, so the same names work in dev and here.
 # Every published value is readable by every visitor: never put a secret in a VITE_ variable. A name
-# with SECRET, PASSWORD or TOKEN in it stops the container, to catch that mistake early (a name with KEY
-# is fine: public keys are normal). Values are escaped as JavaScript string content, so no value can
+# naming a secret (SECRET, PASSWORD, PASSWD, PASSPHRASE, PASSCODE, PASS as a word, PRIVATE, CREDENTIAL or TOKEN),
+# or a value that is a URL carrying a user and a password, stops the container, to catch that mistake early
+# (a name with KEY is fine, public keys are normal; this is a best-effort tripwire, not a secret scanner). Values are escaped as JavaScript string content, so no value can
 # end its string or the file.
 #
 # Required variables: APP_REQUIRED_ENV lists, comma separated, the variables the app cannot run without,
@@ -89,7 +90,8 @@ BEGIN {
     if (name !~ /^VITE_[A-Z0-9_]+$/) {
       continue
     }
-    if (name ~ /SECRET|PASSWORD|TOKEN/) {
+    # Names that say secret, and a URL that carries a user and a password; a value is never printed.
+    if (name ~ /SECRET|PASSWORD|PASSWD|PASSPHRASE|PASSCODE|(^|_)PASS(_|$)|PRIVATE|CREDENTIAL|TOKEN/ || ENVIRON[name] ~ /(^|:)\/\/[^\/@?# ]*:[^\/@?# ]+@/) {
       print "[runtime-config] " name " looks like a secret, and every VITE_ variable is published to every visitor: rename it or keep it out of VITE_" > "/dev/stderr"
       failed = 1
       continue

package/dist/presets/app/files/.configs/builders/docker-entrypoint.d/45-api-proxy.sh

@@ -10,6 +10,8 @@
 # The upstream is written into the nginx configuration, so it must be an address and nothing else: a value with a
 # character outside letters, digits, brackets (an IPv6 address) and `._:/@%+-` stops the container, naming the variable and never the value.
 #
+# NGINX_LOCAL_RESOLVERS is checked the same way: addresses and spaces.
+#
 # API_PROXY_SOURCE and API_PROXY_TARGET name other files, for the tests; they are not VITE_ names, so never published.
 set -eu
 
@@ -31,6 +33,23 @@ case "$API_UPSTREAM" in
     ;;
 esac
 
+# The resolvers are written into the nginx configuration too: addresses (IPv4, IPv6 in brackets) and
+# spaces between them, nothing else.
+case "${NGINX_LOCAL_RESOLVERS:-}" in
+  *[!\ ]*) ;;
+  *)
+    echo "[api-proxy] FATAL: NGINX_LOCAL_RESOLVERS is empty, and nginx needs at least one resolver for /api" >&2
+    exit 1
+    ;;
+esac
+
+case "${NGINX_LOCAL_RESOLVERS:-}" in
+  *[!][0-9A-Fa-f.:\ ]*)
+    echo "[api-proxy] FATAL: NGINX_LOCAL_RESOLVERS has a character that is not part of an address" >&2
+    exit 1
+    ;;
+esac
+
 # Only these two: nginx's own variables ($api_upstream, $host) stay as they are.
 envsubst '${API_UPSTREAM} ${NGINX_LOCAL_RESOLVERS}' < "$SOURCE" > "$TARGET"
 echo "[api-proxy] /api goes to the upstream of API_UPSTREAM"

package/dist/presets/app/files/.configs/builders/nginx-snippets/api-proxy.conf

@@ -9,6 +9,10 @@ location /api/ {
   proxy_pass $api_upstream;
   proxy_http_version 1.1;
   proxy_set_header Host $host;
+  # Behind a trusted front proxy (an ingress, a load balancer) this keeps the client address it appends. A
+  # browser can put its own value first in X-Forwarded-For, and $scheme is http here whatever the front proxy
+  # served: a backend must trust only the entries its own proxy added, and learn the scheme from that proxy. With
+  # no front proxy, replace the value with $remote_addr.
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;
 }

package/dist/presets/app/files/.configs/builders/nginx-snippets/security-headers.conf

@@ -4,8 +4,10 @@ add_header X-Content-Type-Options "nosniff" always;
 add_header Referrer-Policy "strict-origin-when-cross-origin" always;
 add_header X-Frame-Options "SAMEORIGIN" always;
 
-# A Content-Security-Policy depends on what the app loads, so none is sent. An example to adapt: start with
-# Content-Security-Policy-Report-Only, watch the browser console, then switch to the enforcing header. Admin
-# libraries often need 'unsafe-inline' for styles. `frame-ancestors` replaces X-Frame-Options where both exist.
-#
-# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
+# A Content-Security-Policy, in report-only mode: the browser reports what it would block in its console and
+# blocks nothing. It fits the app as generated (the config.js script and the module script are of the same
+# origin, the favicon is a data: URL, the styles are linked, /api is of the same origin). Adapt it to what the app
+# loads (an API of another origin goes into connect-src, a CDN into script-src and style-src), watch the console,
+# then change the header name to Content-Security-Policy to enforce it. Admin libraries often need 'unsafe-inline'
+# for styles. `frame-ancestors` replaces X-Frame-Options where both exist.
+add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'" always;

package/dist/presets/app/files/.configs/builders/nginx.conf.template

@@ -8,6 +8,9 @@ server {
   listen 8080;
   server_name _;
 
+  # The Server header and the error pages name no nginx version.
+  server_tokens off;
+
   root /usr/share/nginx/html;
   index index.html;
 

package/dist/presets/app/files/.configs/builders/vite.config.mts

@@ -28,7 +28,9 @@ export default defineConfig(({ mode }) => {
       rolldownOptions: {
         output: {
           // Runs each module after the modules it imports: a split chunk can otherwise run a DI package
-          // before reflect-metadata (vitejs/vite#21866). It costs about 3% of the gzip size; keep it on.
+          // before reflect-metadata (vitejs/vite#21866). It costs about 3% of the gzip size of a small app
+          // and 3 to 20% of the first screen of an app with more than a thousand chunks: keep it on, or
+          // measure (the Vite setup guide).
           strictExecutionOrder: true,
           // React, react-admin and the router weigh about 500 KB before any application code. Two
           // vendor chunks keep the application's own chunk small, cacheable across a deploy, and

package/dist/presets/app/preset.json

@@ -13,12 +13,12 @@
   "dependencies": {
     "@reduxjs/toolkit": "^2.13.0",
     "@tanstack/react-query": "^5.104.5",
-    "@venizia/ardor": "0.4.8-5",
-    "@venizia/ignis-connectors": "0.4.8-4",
-    "@venizia/ignis-filter": "0.4.7-2",
-    "@venizia/ignis-helpers": "0.4.8-4",
+    "@venizia/ardor": "0.4.8-6",
+    "@venizia/ignis-connectors": "0.4.8-5",
+    "@venizia/ignis-filter": "0.4.7-3",
+    "@venizia/ignis-helpers": "0.4.8-5",
     "@venizia/ignis-inversion": "0.4.7-2",
-    "@venizia/ignis-kernel": "0.4.8-4",
+    "@venizia/ignis-kernel": "0.4.8-5",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "ra-core": "^5.15.5",
@@ -36,7 +36,7 @@
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "@venizia/dev-configs": "0.4.8-2",
-    "@venizia/ignis-boot": "0.4.8-4",
+    "@venizia/ignis-boot": "0.4.8-5",
     "@vitejs/plugin-react": "^6.1.2",
     "eslint": "^10.13.0",
     "oxlint": "1.89.0",
@@ -47,11 +47,11 @@
   },
   "peers": {
     "@venizia/dev-configs": "^0.4.0 || ^0.4.8-0",
-    "@venizia/ignis-connectors": "^0.4.8-4",
-    "@venizia/ignis-filter": "^0.4.7-2",
-    "@venizia/ignis-helpers": "^0.4.8-4",
+    "@venizia/ignis-connectors": "^0.4.8-5",
+    "@venizia/ignis-filter": "^0.4.7-3",
+    "@venizia/ignis-helpers": "^0.4.8-5",
     "@venizia/ignis-inversion": "^0.4.7-2",
-    "@venizia/ignis-kernel": "^0.4.8-4"
+    "@venizia/ignis-kernel": "^0.4.8-5"
   },
   "scripts": {
     "server:dev": "vite --config .configs/builders/vite.config.mts",

package/dist/presets/lib/preset.json

@@ -5,14 +5,14 @@
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@types/react": "^19",
-    "@venizia/ardor": "^0.4.8-5",
+    "@venizia/ardor": "^0.4.8-6",
     "@venizia/dev-configs": "0.4.8-2",
-    "@venizia/ignis-boot": "0.4.8-4",
-    "@venizia/ignis-connectors": "0.4.8-4",
-    "@venizia/ignis-filter": "0.4.7-2",
-    "@venizia/ignis-helpers": "0.4.8-4",
+    "@venizia/ignis-boot": "0.4.8-5",
+    "@venizia/ignis-connectors": "0.4.8-5",
+    "@venizia/ignis-filter": "0.4.7-3",
+    "@venizia/ignis-helpers": "0.4.8-5",
     "@venizia/ignis-inversion": "0.4.7-2",
-    "@venizia/ignis-kernel": "0.4.8-4",
+    "@venizia/ignis-kernel": "0.4.8-5",
     "eslint": "^10.13.0",
     "oxlint": "1.89.0",
     "oxlint-tsgolint": "7.0.2004",
@@ -23,7 +23,7 @@
     "typescript": "^6.0.3"
   },
   "peerDependencies": {
-    "@venizia/ardor": "^0.4.8-5",
+    "@venizia/ardor": "^0.4.8-6",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
     "react-router-dom": "^7.18.4",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venizia/ardor",
-  "version": "0.4.8-5",
+  "version": "0.4.8-6",
   "description": "ARDOR - frontend application framework for the VENIZIA family. One entry point over ardor-kernel, ardor-react and ardor-admin: IGNIS inversion of control, a REST data layer, auth and i18n providers, and the React bindings for a react-admin application.",
   "keywords": [
     "ardor",
@@ -79,21 +79,21 @@
     "prepublishOnly": "make rebuild"
   },
   "dependencies": {
-    "@venizia/ardor-admin": "0.4.8-5",
-    "@venizia/ardor-kernel": "0.4.8-5",
-    "@venizia/ardor-react": "0.4.8-5"
+    "@venizia/ardor-admin": "0.4.8-6",
+    "@venizia/ardor-kernel": "0.4.8-6",
+    "@venizia/ardor-react": "0.4.8-6"
   },
   "devDependencies": {
     "@size-limit/preset-small-lib": "^14.2.0",
     "@types/bun": "^1.4.3",
     "@types/node": "^25.0.10",
     "@venizia/dev-configs": "^0.4.8-2",
-    "@venizia/ignis-boot": "^0.4.8-4",
-    "@venizia/ignis-connectors": "^0.4.8-4",
-    "@venizia/ignis-filter": "^0.4.7-2",
-    "@venizia/ignis-helpers": "^0.4.8-4",
+    "@venizia/ignis-boot": "^0.4.8-5",
+    "@venizia/ignis-connectors": "^0.4.8-5",
+    "@venizia/ignis-filter": "^0.4.7-3",
+    "@venizia/ignis-helpers": "^0.4.8-5",
     "@venizia/ignis-inversion": "^0.4.7-2",
-    "@venizia/ignis-kernel": "^0.4.8-4",
+    "@venizia/ignis-kernel": "^0.4.8-5",
     "eslint": "^10.13.0",
     "oxlint": "1.89.0",
     "oxlint-tsgolint": "7.0.2004",
@@ -105,12 +105,12 @@
   "peerDependencies": {
     "@reduxjs/toolkit": ">=2.13.0",
     "@tanstack/react-query": ">=5.104.5",
-    "@venizia/ignis-boot": "^0.4.8-4",
-    "@venizia/ignis-connectors": "^0.4.8-4",
-    "@venizia/ignis-filter": "^0.4.7-2",
-    "@venizia/ignis-helpers": "^0.4.8-4",
+    "@venizia/ignis-boot": "^0.4.8-5",
+    "@venizia/ignis-connectors": "^0.4.8-5",
+    "@venizia/ignis-filter": "^0.4.7-3",
+    "@venizia/ignis-helpers": "^0.4.8-5",
     "@venizia/ignis-inversion": "^0.4.7-2",
-    "@venizia/ignis-kernel": "^0.4.8-4",
+    "@venizia/ignis-kernel": "^0.4.8-5",
     "ra-core": ">=5.15.5",
     "ra-i18n-polyglot": ">=5.15.5",
     "react": ">=19.3.1",