@wssto2/vue-core 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.15.0 — 2026-10-19
+
+What arv-next kept to itself and the library can say once: server field messages, a WhatsApp link, a stat card and the "no access" panel, two architecture rules and the request helpers every `api.ts` redefined. go-core is unchanged (`v1.19.0`). Breaking only in that `useForm` now words go-core's `validation_errors.*` keys itself (see Changed).
+
+### New
+- **i18n:** `useServerMessages({ prefixes })`. A field message that starts with one of the prefixes (default `["validation_errors"]`, go-core's) is a key: the application's text for it, else the library's `core.<key>`; a rule whose text needs a parameter the server does not send (`min`, `max`, `min_value`, `max_value`, `between`, `in`, `not_in`) reads as `<prefix>.out_of_range`. `fieldMessageWith(translator, options)` is the same outside setup. New text `core.validation_errors.out_of_range` in hr, en, sl, bs and sr-Latn.
+- **phone:** `whatsAppLink(value, country)`: a `https://wa.me/` link for a number as typed; a local number gets the dial code of `country` (ISO code, any case), a number with `+` or `00` keeps its own, fewer than six digits give `null`.
+- **content:** `StatSummary` (and `StatItem`, `StatTone`): one grouped card of numbers with tones, share bars, and header and footer rows.
+- **access:** `RestrictedPanel`: the lock, `core.no_access` text, an optional `contact` address and a Back button (the application's history, else `home`). For `createApplication({ noAccess: () => h(RestrictedPanel, { contact }) })`. New texts `core.no_access.contact` and `core.no_access.back` in five languages.
+- **client:** `RequestOptions.idempotencyKey`: sent as the `Idempotency-Key` header of that call (it wins over a header of the same name) and again on the renew-and-retry after a 401. The library's incident and service-account calls use it.
+- **app:** `currentHttp()`: the current application's platform client, for an `api.ts`.
+- **devkit:** `vue-core check-architecture` rule `no-hardcoded-copy` (`architecture.copy: { pattern, scope, properNames }`, allowlist `allow["no-hardcoded-copy"]`): no text in the authors' language in a template, in `form.ts` strings or, inside `scope`, in any string literal or copy attribute. It is arv-next's own heuristic, ported unchanged (checked against it on 951 files of its tree).
+- **devkit:** rule `no-route-policy` (`architecture.routeAccess: { sessionField, exclude }`): no `policy:` / `requires:` in a `routes.ts`, and no `authStore.<sessionField>` / `state.<sessionField>`.
+
+### Changed
+- **form:** a form with no `describeFieldError` of its own and none from the application now words go-core's `validation_errors.*` keys (it showed them as sent before). Other messages still show as sent.
+- **eslint:** `vueCoreConfig` gives `tests/**/*.{ts,vue}`, as well as `**/*.test.ts`, the vitest globals and the stub-component allowances.
+
+### Tests
+- Moved from arv-next's e2e: the saved-view save popover (Replace on a taken name), and the profile code step (resend countdown, tries left, expiry, the refusal sentences).
+
 ## 0.14.0 — 2026-10-19
 
 An incident's occurrences for the staff, and Bosnian month names. Needs go-core v1.19.0 (`goCore`, `src/modules` synced).

package/README.md

@@ -11,12 +11,12 @@ Its plan and rules are in [PLAN.md](PLAN.md).
 | Import | For |
 |---|---|
 | `@wssto2/vue-core/platform` | `readBootstrap`, `createPlatform` (HTTP client, session, access), `AccessGate`, typed contexts |
-| `@wssto2/vue-core/app` | `createApplication`, `defineFeature`, `currentApplication` and `application.report` (outside setup, handled errors), shell outlets, effects |
+| `@wssto2/vue-core/app` | `createApplication`, `defineFeature`, `currentApplication`, `currentHttp` and `application.report` (outside setup, handled errors), shell outlets, effects |
 | `@wssto2/vue-core/shell` | `backofficeShell`, the shell's parts for a custom one |
 | `@wssto2/vue-core/router` | `defineRoutes` (typed targets), guards, navigation |
 | `@wssto2/vue-core/collection` | `defineCollection`, `useCollection`, `CollectionPage`, `DataTable` (a table over an array), record neighbors |
 | `@wssto2/vue-core/resource`, `/page` | `useRouteResource`, `ResourcePage`, `SectionNavigator`, `AdaptivePageShell` |
-| `@wssto2/vue-core/button`, `/controls`, `/content`, `/state`, `/overlay`, `/modal`, `/icon` | the primitives |
+| `@wssto2/vue-core/button`, `/controls`, `/content`, `/state`, `/overlay`, `/modal`, `/icon` | the primitives (`/content` includes `Panel`, `KeyValueList`, `StatSummary`, the grouped card of numbers) |
 | `@wssto2/vue-core/i18n`, `/format`, `/client` | messages, `useDescribeError`, formatting, `HttpClient` and `ApiError` |
 | `@wssto2/vue-core/identity`, `/access` | go-core's module contracts (types, route tables) and, in `/identity`, `identityFeature` (sign-in page, language), `identityPlatform()` and `usersFeature` (users, "my profile") and `serviceAccountsFeature` (service accounts and their API keys): [sign-in](docs/recipes/sign-in.md), [users](docs/recipes/users.md), [service accounts](docs/recipes/service-accounts.md) |
 | `@wssto2/vue-core/access` (screens) | `accessFeature({ catalogue })`: roles list and editor, compare, replace, a person's roles (`PersonAccess`) and what they can do: [roles and access](docs/recipes/access.md) |

package/bin/architecture/engine.mjs

@@ -4,6 +4,7 @@ import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
 
 import { PACKS } from "./packs.mjs";
+import { builtInRules } from "./rules.mjs";
 
 const SOURCE_EXTENSIONS = new Set([".ts", ".vue"]);
 const toPosix = (value) => value.split(path.sep).join("/");
@@ -24,6 +25,7 @@ export function check({ root, config, configName }) {
   const docRef = (key, join = " (") => (doc[key] ? `${join}${doc[key]}${join === " (" ? ")" : ""}` : "");
   const packs = config.packs.map((name) => PACKS[name]);
   const packRules = packs.flatMap((pack, index) => pack.rules.map((rule) => ({ ...rule, pack: packs[index], seen: new Set() })));
+  const builtIns = builtInRules(config);
   const featuresRoot = path.join(root, featuresDir);
   const violations = [];
   const warnings = [];
@@ -99,6 +101,14 @@ export function check({ root, config, configName }) {
       }
     }
 
+    // the built-in rules with options (`copy`, `routeAccess`)
+    for (const rule of builtIns) {
+      const message = rule.check({ file, content, isVue, isTest });
+      if (!message) continue;
+      if (allowed(rule.id).has(file)) rule.seen.add(file);
+      else violations.push(`${file}: ${rule.id} — ${message}${docRef(rule.id)}.`);
+    }
+
     // a failed request is vue-core's `ApiError`; a second class makes `isApiError` miss the errors of the other client
     if (/\bclass\s+\w*ApiError\b/.test(content)) {
       violations.push(
@@ -124,7 +134,7 @@ export function check({ root, config, configName }) {
   }
 
   // a stale allowlist entry (the file no longer trips the rule) is a violation: the lists only shrink
-  for (const rule of packRules) {
+  for (const rule of [...packRules, ...builtIns]) {
     for (const entry of allowed(rule.id)) {
       if (!rule.seen.has(entry)) {
         violations.push(`${entry}: stale ${rule.id} allowlist entry in ${configName} — the file no longer trips the rule; remove it from the allowlist.`);

package/bin/architecture/rules.mjs

@@ -0,0 +1,95 @@
+// The built-in rules `vue-core check-architecture` runs when the config has their section (`copy`, `routeAccess`). Unlike the packs
+// they take options, and like the packs they have an `id`, a per-rule allowlist (`allow[<id>]`, a ratchet in both directions) and
+// a `doc` reference. `check(source)` returns the text that follows the id in the report, or null.
+
+const escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+// `String.search` ignores a `g` flag's lastIndex, so a pattern given with one still gives the same answer on every line.
+const matches = (pattern, text) => text.search(pattern) !== -1;
+
+const literals = (code) => code.match(/(["'`])(?:\\.|(?!\1).)*\1/g) ?? [];
+const codeWithoutComments = (code) =>
+  code
+    .replace(/\/\*[\s\S]*?\*\//g, "")
+    .split("\n")
+    .map((line) => line.replace(/(^|[^:"'`\\])\/\/.*$/, "$1"))
+    .join("\n");
+const withoutComments = (code) => code.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:"'`])\/\/.*$/gm, "$1");
+
+const COPY_ATTRIBUTE = /(?<![\w-])(:|v-bind:)?(placeholder|title|aria-label|label)="([^"]*)"/g;
+
+/** The literals a user can read in a source file: a `.vue` file's `<script>` strings and its template's copy attributes (a bound one by its quoted parts). */
+function copyLiterals(content, isVue) {
+  const scripts = isVue ? [...content.matchAll(/<script\b[^>]*>([\s\S]*?)<\/script>/g)].map((m) => m[1]) : [content];
+  const found = scripts.flatMap((script) => literals(codeWithoutComments(script)));
+  if (isVue) {
+    const template = (content.match(/<template>([\s\S]*)<\/template>/)?.[1] ?? "").replace(/<!--[\s\S]*?-->/g, "");
+    for (const [, bound, , value] of template.matchAll(COPY_ATTRIBUTE)) found.push(...(bound ? literals(value) : [value]));
+  }
+  return found;
+}
+
+/**
+ * no-hardcoded-copy: the first line of user-facing text that `pattern` (a language's letters or words) matches. Everywhere that is a
+ * `.vue` template's text nodes and the quoted strings of `form.ts`, `*Form.ts` and files under a `forms/` folder; inside `scope`
+ * (default the UI folders) also every string literal of a `.ts` or `<script>` and a template's placeholder / title / aria-label / label.
+ * `properNames` is cut out of what `scope` scans (brand names that use the language's letters). A test is never scanned.
+ */
+function noHardcodedCopy({ pattern, scope, properNames }) {
+  return ({ file, content, isVue, isTest }) => {
+    if (isTest) return null;
+    let scanText = null;
+    if (isVue) {
+      const tpl = content.match(/<template>([\s\S]*)<\/template>/);
+      if (tpl) scanText = tpl[1].replace(/<!--[\s\S]*?-->/g, "").replace(/\{\{[\s\S]*?\}\}/g, "").replace(/<[^>]+>/g, "\n");
+    } else if (file.endsWith(".ts")) {
+      const segments = file.split("/");
+      const base = segments[segments.length - 1];
+      if (base === "form.ts" || /Form\.ts$/.test(base) || segments.includes("forms")) {
+        const noComments = content
+          .replace(/\/\*[\s\S]*?\*\//g, "")
+          .split("\n")
+          .filter((line) => !/^\s*\/\//.test(line))
+          .join("\n");
+        scanText = literals(noComments).join("\n");
+      }
+    }
+    if (matches(scope, file)) {
+      scanText = [scanText ?? "", ...copyLiterals(content, isVue)].join("\n");
+      if (properNames) scanText = scanText.replace(properNames, "");
+    }
+    const hit = scanText
+      ?.split("\n")
+      .map((line) => line.trim())
+      .find((line) => line.length >= 3 && matches(pattern, line));
+    return hit ? `hardcoded copy in a user-facing string (“${hit.slice(0, 60)}”) — move it to an i18n key` : null;
+  };
+}
+
+/**
+ * no-route-policy: a route names its permission in `meta.permission`; `policy:` / `requires:` in a `routes.ts` and the session's
+ * old list (`authStore.<sessionField>`, `state.<sessionField>`) are the model it replaced. Comments, tests and `exclude`d files are not scanned.
+ */
+function noRoutePolicy({ sessionField, exclude }) {
+  const oldList = sessionField ? new RegExp(`\\b(?:authStore|state)\\.${escape(sessionField)}\\b`) : null;
+  return ({ file, content, isTest }) => {
+    if (isTest || (exclude && matches(exclude, file))) return null;
+    const isRouteFile = /(^|\/)routes\.ts$/.test(file);
+    const hit = withoutComments(content)
+      .split("\n")
+      .find((line) => (isRouteFile && /^\s*(policy|requires)\s*:/.test(line)) || (oldList && oldList.test(line)));
+    return hit ? `“${hit.trim().slice(0, 80)}” — a route needs \`meta.permission\` (a catalogued permission, or an array of them)${sessionField ? `, and the session holds \`access\`, not a \`${sessionField}\` list` : ""}` : null;
+  };
+}
+
+export const RULE_IDS = ["no-hardcoded-copy", "no-route-policy"];
+
+/** The rules the config switches on, each `{ id, check, seen }` (`seen`: the allowlisted files that tripped it). */
+export function builtInRules(config) {
+  const rules = [];
+  if (config.copy) {
+    const scope = config.copy.scope ?? new RegExp(`^(?:${config.uiDirs.map(escape).join("|")})/`);
+    rules.push({ id: "no-hardcoded-copy", check: noHardcodedCopy({ ...config.copy, scope }) });
+  }
+  if (config.routeAccess) rules.push({ id: "no-route-policy", check: noRoutePolicy(config.routeAccess) });
+  return rules.map((rule) => ({ ...rule, seen: new Set() }));
+}

package/bin/commands/check-architecture.mjs

@@ -6,6 +6,7 @@ import path from "node:path";
 
 import { check } from "../architecture/engine.mjs";
 import { PACKS } from "../architecture/packs.mjs";
+import { RULE_IDS } from "../architecture/rules.mjs";
 
 const ALLOW_RULES = ["deep-import", "raw-http", "feature-name", "feature-shape"];
 const DOC_KEYS = ["shared-layer", "api-error"];
@@ -16,7 +17,13 @@ export default function run({ config, root, configPath, err }) {
 
   const problems = [];
   for (const name of settings.packs) if (!Object.hasOwn(PACKS, name)) problems.push(`packs: unknown pack "${name}"; the packs are ${Object.keys(PACKS).join(", ")}`);
-  const packRules = settings.packs.filter((name) => Object.hasOwn(PACKS, name)).flatMap((name) => PACKS[name].rules.map((rule) => rule.id));
+  const packRules = [
+    ...settings.packs.filter((name) => Object.hasOwn(PACKS, name)).flatMap((name) => PACKS[name].rules.map((rule) => rule.id)),
+    ...RULE_IDS.filter((id) => (id === "no-hardcoded-copy" ? settings.copy : settings.routeAccess)),
+  ];
+  if (settings.copy && !(settings.copy.pattern instanceof RegExp)) problems.push("copy.pattern: a regular expression for the language's letters and words, e.g. /[čćžšđ]|\\b(Spremi|Odustani)\\b/");
+  for (const key of ["scope", "properNames"]) if (settings.copy?.[key] !== undefined && !(settings.copy[key] instanceof RegExp)) problems.push(`copy.${key}: must be a regular expression`);
+  if (settings.routeAccess?.exclude !== undefined && !(settings.routeAccess.exclude instanceof RegExp)) problems.push("routeAccess.exclude: must be a regular expression");
   for (const rule of Object.keys(settings.allow)) {
     if (!ALLOW_RULES.includes(rule) && !packRules.includes(rule)) problems.push(`allow.${rule}: no such rule; the allowlists are ${[...ALLOW_RULES, ...packRules].join(", ")}`);
   }

package/bin/config.mjs

@@ -30,6 +30,8 @@ export const DEFAULTS = {
     packs: [],
     rules: [],
     doc: {},
+    copy: null,
+    routeAccess: null,
   },
   generator: { template: join(dirname(fileURLToPath(import.meta.url)), "templates", "feature-crud"), out: "features" },
   e2eTimings: { report: "e2e-timings/results.json" },

package/dist/{AccessGate.vue_vue_type_script_setup_true_lang-DEzXovsY.js → AccessGate.vue_vue_type_script_setup_true_lang-BH3f0hda.js}

@@ -1,5 +1,5 @@
 import { defineComponent as t, computed as i, renderSlot as n } from "vue";
-import { u as l } from "./platform-DtISOEt7.js";
+import { u as l } from "./platform-ORzRR3Tw.js";
 const m = /* @__PURE__ */ t({
   __name: "AccessGate",
   props: {

package/dist/{Activity-C0HUEDUz.js → Activity-MOAIv6s4.js}

@@ -5,15 +5,15 @@ import { _ as T } from "./IconTile.vue_vue_type_script_setup_true_lang-BmxCuUZ9.
 import { _ as z } from "./Tabs.vue_vue_type_script_setup_true_lang-tpkGp98F.js";
 import { u as G } from "./format-Cp1h0vsC.js";
 import { _ as B } from "./DateField.vue_vue_type_script_setup_true_lang-CKKG4JEg.js";
-import { a as H } from "./FormGroup.vue_vue_type_script_setup_true_lang-D6jYfNjW.js";
+import { a as H } from "./FormGroup.vue_vue_type_script_setup_true_lang-CTVuhEbW.js";
 import { g as J } from "./options-B48UiYsG.js";
 import { i as M } from "./preferences-hYhrw8Uy.js";
-import { u as Q } from "./platform-DtISOEt7.js";
+import { u as Q } from "./platform-ORzRR3Tw.js";
 import { b as W } from "./routeResource-DlTsGTg_.js";
 import { _ as X } from "./AsyncSection.vue_vue_type_script_setup_true_lang-DGzQ-Snp.js";
 import { _ as Y } from "./Badge.vue_vue_type_script_setup_true_lang-DJyZc0C7.js";
 import { u as Z } from "./useLoad-M7V-AVwR.js";
-import { P as tt, f as et, j as at } from "./index-D-2NNye6.js";
+import { P as tt, f as et, j as at } from "./index--AF_DNhE.js";
 import { _ as st } from "./ActionRow.vue_vue_type_script_setup_true_lang-DybAIOHS.js";
 const ot = {
   class: "flex min-w-0 flex-col gap-group-gap",

package/dist/{Changes-CSaHgVuz.js → Changes-Bu7D0dhY.js}

@@ -1,11 +1,11 @@
 import { defineComponent as h, ref as m, watch as p, openBlock as l, createElementBlock as d, createVNode as c, unref as t, withCtx as y, toDisplayString as x, createBlock as f, createCommentVNode as k } from "vue";
 import { useI18n as C } from "vue-i18n";
 import { i as $ } from "./preferences-hYhrw8Uy.js";
-import { u as b } from "./platform-DtISOEt7.js";
+import { u as b } from "./platform-ORzRR3Tw.js";
 import { b as V } from "./routeResource-DlTsGTg_.js";
 import { _ as R } from "./AsyncSection.vue_vue_type_script_setup_true_lang-DGzQ-Snp.js";
 import { u as E } from "./useLoad-M7V-AVwR.js";
-import { P as N, f as B, k as P, j as S } from "./index-D-2NNye6.js";
+import { P as N, f as B, k as P, j as S } from "./index--AF_DNhE.js";
 import { _ as U } from "./ActionRow.vue_vue_type_script_setup_true_lang-DybAIOHS.js";
 import { _ as I } from "./ViewTabs.vue_vue_type_script_setup_true_lang-BjdDXE3T.js";
 const W = {

package/dist/{CollectionPage.vue_vue_type_script_setup_true_lang-dIrdS_Gn.js → CollectionPage.vue_vue_type_script_setup_true_lang-D5HsYIck.js}

@@ -1,8 +1,8 @@
 import { hasInjectionContext as lt, inject as ot, shallowRef as xe, computed as k, watch as Ve, toValue as Se, ref as ie, getCurrentScope as nt, onScopeDispose as st, defineComponent as be, openBlock as u, createElementBlock as y, createVNode as O, unref as t, createElementVNode as i, toDisplayString as g, Fragment as ee, renderList as le, createCommentVNode as F, createBlock as W, mergeProps as ve, withCtx as q, createTextVNode as G, normalizeClass as ue, useTemplateRef as fe, withModifiers as Ke, withDirectives as Le, vModelText as Fe, nextTick as at, onBeforeUnmount as rt, onMounted as it, renderSlot as ge, useSlots as We, createSlots as Qe, normalizeProps as Xe, guardReactiveProps as Je } from "vue";
 import { routerKey as ct } from "vue-router";
 import { i as qe, a as ut } from "./error-CD7x0Jrz.js";
-import { d as dt } from "./http-DOEfFCDA.js";
-import { d as Re, o as ft, L as Te, e as je, w as pt, r as vt } from "./state-CXMexi0l.js";
+import { d as dt } from "./http-D6qOS6xs.js";
+import { d as Re, o as ft, L as Te, e as je, w as pt, r as vt } from "./state-QDaxntgR.js";
 import { _ as mt } from "./AdaptivePageShell.vue_vue_type_script_setup_true_lang-Bsv5j5Z8.js";
 import { useI18n as he } from "vue-i18n";
 import { _ as ce } from "./Button.vue_vue_type_script_setup_true_lang-C74hcb0N.js";

package/dist/{DeadLetters-CHX4Ypgy.js → DeadLetters-DsujMnLG.js}

@@ -1,15 +1,15 @@
 import { defineComponent as B, useTemplateRef as C, computed as y, ref as v, openBlock as D, createBlock as z, unref as r, withCtx as m, createVNode as F, createElementVNode as b, normalizeClass as $, toDisplayString as h } from "vue";
 import { useI18n as q } from "vue-i18n";
 import { a as k } from "./error-CD7x0Jrz.js";
-import { u as V, _ as N } from "./CollectionPage.vue_vue_type_script_setup_true_lang-dIrdS_Gn.js";
+import { u as V, _ as N } from "./CollectionPage.vue_vue_type_script_setup_true_lang-D5HsYIck.js";
 import { u as P } from "./describeError-B-NMa--w.js";
 import { u as I } from "./format-Cp1h0vsC.js";
-import { e as a, R as O } from "./index-DNeIZpXo.js";
+import { e as a, R as O } from "./index-DYva-K_4.js";
 import { _ as W } from "./AlertDialog.vue_vue_type_script_setup_true_lang-CrFhR9rJ.js";
 import { t as i } from "./toast-CqSDTWRX.js";
 import { u as Y } from "./useLoad-M7V-AVwR.js";
-import { u as j } from "./platform-DtISOEt7.js";
-import { d as G, r as H } from "./http-DOEfFCDA.js";
+import { u as j } from "./platform-ORzRR3Tw.js";
+import { d as G, r as H } from "./http-D6qOS6xs.js";
 function J(u) {
   return G({
     id: "events.deadletters",