@wssto2/vue-core 0.15.3 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.17.0 — 2026-11-04
+
+What every app built on vue-core wrote again: the phase and to-do components, date values in the date fields' own shape, a lazy locale loader, the author of a list row, "today at 14:35", typed access, two architecture rules as data, and the Playwright and vitest setup. Breaking only in that `Platform.access` is now typed by the registered permissions (see Changed).
+
+### New
+- **state:** `PhaseTrack`, `PhaseTiles`, `TodoRow`, `NextStepPanel`, `RequirementList` and their types (`PhaseStep`, `PhaseTile`, `PhaseTone`, `RequirementItem`, `TodoRowAction`, `TodoRowState`): where a record stands, what is next, and what is still missing. New texts `core.stepper`, `core.next_step`, `core.requirements`, `core.todo_state`, `core.phase_tiles` in the five locales. Recipe: `docs/recipes/workflow.md`.
+- **i18n:** `localeMessages(namespace, import.meta.glob("./*.json"))`, still lazy: nothing loads until the namespace is needed. A file's locale is its name; `createApplication({ localeFiles: { bs: "ba" } })` renames the exceptions.
+- **form:** `dateValue(api)` (`YYYY-MM-DD`, sliced as written), `dateTimeValue(api)` (`YYYY-MM-DDTHH:mm` in local time, the shape `DateTimeField` writes), `parseDateValue(model)` (the `T` and the space form, as local time), `now()`; `today()` is exported. Go's zero date is `null`.
+- **collection:** `authorOf(meta, id)`, `ResourceAuthor`, `ResourceMeta`, for go-core's `meta.authors` / `meta.author` / `meta.editor`.
+- **format:** `format.when(value)`: just now, minutes ago, today / yesterday / tomorrow at a time, else the date and time. New texts `core.when.*`.
+- **platform:** `useAccess()`. An application registers its generated permissions once (`interface PermissionRegistry extends Record<Permission, true> {}`); `useAccess()`, `Platform.access`, route meta `access` and `AccessGate` then refuse an unknown permission at compile time, template literals over a namespace type included.
+- **devkit:** `check-architecture` rule `permission-texts` (`architecture.permissions: { generated, keys, locales, dir }`): every generated permission has each key (`policies.{id}`, `policy_descriptions.{id}`) in each locale, and no locale keeps a text for one that is gone.
+- **devkit:** `architecture.forbidden: [{ id, pattern, message, exclude? }]`: text rules as data. Comments are stripped (a `//` in a string or URL is kept), tests, e2e, docs and scripts are skipped by default, and each rule has its allowlist `allow[id]`.
+- **playwright:** `playwrightConfig({ testDir, timezone, ignore, port, report }, overrides)`: `E2E_PORT`, the dev server, CI retries and workers, the reporters plus the JSON report `vue-core e2e-timings` reads, and the time zone for the specs and the browser.
+- **config:** `vitestDefaults({ timezone, setupFiles })` for the vitest `test` block: globals, happy-dom, `e2e/` and `review/` excluded, `TZ` pinned.
+
+### Changed
+- **platform:** `Platform.access` is `AccessClient<Permission>`, the registered permissions. Code that assigned it to a narrower `AccessClient<X>` registers `X` instead.
+- **format:** `Formatting.translate` receives the message parameters.
+
+## 0.16.0 — 2026-10-22
+
+Back to the page a record was opened from.
+
+### New
+- **page:** `useBackLinks()` returns `backHere(to)` and `keepBack(to)`. `backHere` adds `?back=<current path>&back_title=<the page's title>` (the title is the page chrome's, so a caller passes nothing and the link updates once the record has loaded); `keepBack` carries the page's own `back` and `back_title`. `BACK_PARAM` and `BACK_TITLE_PARAM` are exported.
+- **page:** `AdaptivePageShell` (so `EditorPage`, `ResourcePage` and list pages) replaces the page's back with the valid `?back=`, on the desktop toolbar and the phone bar alike. The label is `back_title` (text, trimmed, 80 characters), else the target route's `meta.titleKey`. A back that is not a single-slash path of this app, resolves to no route (the catch-all does not count), is the current page, or has no label is ignored and the page keeps its own.
+
+### Changed
+- **router:** `useRouteSections` keeps `back` and `back_title` in a sub-page's section links (the rest of a sub-page's query is still left behind); sections already kept the whole query.
+- **collection:** the previous / next links of `useCollectionNeighbors` drop `back` and `back_title`: another record is not reached from the page the user came from.
+
 ## 0.15.3 — 2026-10-21
 
 A group sheet focuses its first error.

package/README.md

@@ -116,8 +116,8 @@ export function createTicketsFeature(http: HttpClient) {
     id: "tickets",
     routes: ticketRoutes.records,
     context: provideContext(TICKETS, { api, list: createTicketList(api) }),
-    // Loaded the first time a route of this feature is entered, in the active locale.
-    messages: localeMessages("tickets", { en: () => import("./i18n/en.json"), hr: () => import("./i18n/hr.json") }),
+    // Loaded the first time a route of this feature is entered, in the active locale. The lazy glob takes the file names as locales (en.json, hr.json); `createApplication({ localeFiles: { bs: "ba" } })` renames the exceptions.
+    messages: localeMessages("tickets", import.meta.glob("./i18n/*.json")),
     // The backend's menu names destinations; this says which route opens "tickets" and which records keep it highlighted.
     navigation: [{ destination: "tickets", to: ticketRoutes.index, within: ["tickets.record"] }],
   });
@@ -327,7 +327,7 @@ Dark mode is the `dark` class on `<html>`; nothing is decided for you. An app th
 
 ## Texts and locales
 
-The library's own texts are under the `core` namespace in English, Croatian, Bosnian and Slovenian (`t("core.actions.cancel")`). `createApplication` merges them into its vue-i18n instance; override any key with `i18n.messages` and restrict the offered locales with `locale.supported`. A feature's texts are a namespace (`localeMessages("tickets", { en: () => import("./i18n/en.json") })`, used as `t("tickets.title")`) loaded per locale on demand. A locale switch (the account menu has one) loads every namespace in use first, so nothing shows a raw key; `locale.onChange` lets you save the choice on the user.
+The library's own texts are under the `core` namespace in English, Croatian, Bosnian and Slovenian (`t("core.actions.cancel")`). `createApplication` merges them into its vue-i18n instance; override any key with `i18n.messages` and restrict the offered locales with `locale.supported`. A feature's texts are a namespace (`localeMessages("tickets", import.meta.glob("./i18n/*.json"))`, or one `() => import("./i18n/en.json")` per locale; used as `t("tickets.title")`) loaded per locale on demand. A locale switch (the account menu has one) loads every namespace in use first, so nothing shows a raw key; `locale.onChange` lets you save the choice on the user.
 
 ## Recipes
 
@@ -345,6 +345,7 @@ The library's own texts are under the `core` namespace in English, Croatian, Bos
 - [Notifications](docs/recipes/notifications.md): the bell, the inbox and the live stream, categories, the failed-events page, trying it against go-core's dev server
 - [Incidents](docs/recipes/incidents.md): go-core's incident module: the list and an incident, "Report a bug", the browser's errors reported (what is and is not sent), source maps
 - [Preferences and tips](docs/recipes/preferences.md): `usePreferences`, the person's stored settings, `darkMode()` on them, the `Tip` beside something new
+- [Where a record stands](docs/recipes/workflow.md): `PhaseTrack`, `PhaseTiles`, `TodoRow`, `NextStepPanel`, `RequirementList` in `/state`
 - [Theming](docs/recipes/theming.md): brand accent, dark mode, tokens, status tones and category hues
 - [Testing](docs/recipes/testing.md): the application's environment and a fake backend for your tests
 - [End-to-end specs](docs/recipes/e2e.md): `@wssto2/vue-core/playwright`, the Playwright mocks of go-core's envelope, session, access, notification, profile and users routes

package/bin/architecture/engine.mjs

@@ -4,6 +4,7 @@ import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
 
 import { PACKS } from "./packs.mjs";
+import { checkPermissionTexts } from "./permissions.mjs";
 import { builtInRules } from "./rules.mjs";
 
 const SOURCE_EXTENSIONS = new Set([".ts", ".vue"]);
@@ -142,6 +143,8 @@ export function check({ root, config, configName }) {
     }
   }
 
+  if (config.permissions) violations.push(...checkPermissionTexts({ root, config: config.permissions }));
+
   // every directory name under the features folder is a single lowercase word
   for (const dirPath of collectFeatureDirs(featuresRoot)) {
     const rel = toPosix(path.relative(root, dirPath));

package/bin/architecture/permissions.mjs

@@ -0,0 +1,56 @@
+// permission-texts: the permissions the generated catalogue lists and the texts the locale files keep for them agree. Every id has each key
+// in each locale, and no locale keeps a key for an id that is gone. A key template is `<namespace>.<prefix>{id}`: the namespace is the folder
+// `<dir>/<namespace>/<locale>.json`, and the file is nested by dots (`"crm": { "lead:view": "…" }` holds `crm.lead:view`).
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+
+/** The ids of a generated permissions file: its quoted strings (`export type Permission = 'a:view' | 'b:view'`), comments cut out. */
+export function generatedIds(source) {
+  const code = source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:"'`])\/\/.*$/gm, "$1");
+  // Only the `Permission` union names ids; go-core's generator writes a metadata map after it, full of other strings.
+  const union = /export\s+type\s+Permission\s*=([^;]*);/.exec(code);
+  if (!union) throw new Error("permission-texts: the generated file has no `export type Permission = …;` union");
+  return [...new Set([...union[1].matchAll(/(["'`])([^"'`\n]+)\1/g)].map((match) => match[2]))];
+}
+
+// A nested messages file as the identifiers it holds: a leaf string is named by the dotted path to it.
+function flatten(node, prefix, out) {
+  for (const [key, value] of Object.entries(node)) {
+    if (typeof value === "string") out.add(prefix + key);
+    else if (value && typeof value === "object") flatten(value, `${prefix}${key}.`, out);
+  }
+}
+
+/** The violations of `permission-texts`, as messages that start with the file they concern. */
+export function checkPermissionTexts({ root, config: { generated, keys, locales, dir = "i18n" } }) {
+  const generatedFile = path.join(root, generated);
+  if (!existsSync(generatedFile)) return [`${generated}: permission-texts — the generated permissions file does not exist.`];
+  const ids = generatedIds(readFileSync(generatedFile, "utf8"));
+  const known = new Set(ids);
+  const violations = [];
+  for (const locale of locales) {
+    for (const key of keys) {
+      const [namespace, ...rest] = key.split(".");
+      const prefix = rest.join(".").replace("{id}", "");
+      const file = `${dir}/${namespace}/${locale}.json`;
+      if (!existsSync(path.join(root, file))) {
+        violations.push(`${file}: permission-texts — the file does not exist.`);
+        continue;
+      }
+      let messages;
+      try {
+        messages = JSON.parse(readFileSync(path.join(root, file), "utf8"));
+      } catch (error) {
+        violations.push(`${file}: permission-texts — not valid JSON (${error.message}).`);
+        continue;
+      }
+      const have = new Set();
+      flatten(messages, "", have);
+      for (const id of ids) if (!have.has(prefix + id)) violations.push(`${file}: permission-texts — ${id} has no text (${key.replace("{id}", id)}).`);
+      for (const name of [...have].sort()) {
+        if (name.startsWith(prefix) && !known.has(name.slice(prefix.length))) violations.push(`${file}: permission-texts — ${name.slice(prefix.length)} is not in ${generated}; remove its text.`);
+      }
+    }
+  }
+  return violations;
+}

package/bin/architecture/rules.mjs

@@ -81,6 +81,22 @@ function noRoutePolicy({ sessionField, exclude }) {
   };
 }
 
+/**
+ * forbidden: the application's own text rules as data. The first line of the file (comments cut out, tests never scanned, and by default
+ * not the e2e / review / scripts / tests / docs / templates / static folders) that `pattern` matches. `exclude` replaces that folder default.
+ */
+function forbiddenRule({ pattern, message, exclude = PLAIN_SOURCE }) {
+  return ({ file, content, isTest }) => {
+    if (isTest || matches(exclude, file)) return null;
+    const hit = withoutComments(content)
+      .split("\n")
+      .find((line) => matches(pattern, line));
+    return hit ? `“${hit.trim().slice(0, 80)}” — ${message}` : null;
+  };
+}
+
+const PLAIN_SOURCE = /^(e2e|review|scripts|tests|docs|templates|static)\//;
+
 export const RULE_IDS = ["no-hardcoded-copy", "no-route-policy"];
 
 /** The rules the config switches on, each `{ id, check, seen }` (`seen`: the allowlisted files that tripped it). */
@@ -91,5 +107,6 @@ export function builtInRules(config) {
     rules.push({ id: "no-hardcoded-copy", check: noHardcodedCopy({ ...config.copy, scope }) });
   }
   if (config.routeAccess) rules.push({ id: "no-route-policy", check: noRoutePolicy(config.routeAccess) });
+  for (const rule of config.forbidden) rules.push({ id: rule.id, check: forbiddenRule(rule) });
   return rules.map((rule) => ({ ...rule, seen: new Set() }));
 }

package/bin/commands/check-architecture.mjs

@@ -20,10 +20,29 @@ export default function run({ config, root, configPath, err }) {
   const packRules = [
     ...settings.packs.filter((name) => Object.hasOwn(PACKS, name)).flatMap((name) => PACKS[name].rules.map((rule) => rule.id)),
     ...RULE_IDS.filter((id) => (id === "no-hardcoded-copy" ? settings.copy : settings.routeAccess)),
+    ...settings.forbidden.map((rule) => rule.id),
   ];
   if (settings.copy && !(settings.copy.pattern instanceof RegExp)) problems.push("copy.pattern: a regular expression for the language's letters and words, e.g. /[čćžšđ]|\\b(Spremi|Odustani)\\b/");
   for (const key of ["scope", "properNames"]) if (settings.copy?.[key] !== undefined && !(settings.copy[key] instanceof RegExp)) problems.push(`copy.${key}: must be a regular expression`);
   if (settings.routeAccess?.exclude !== undefined && !(settings.routeAccess.exclude instanceof RegExp)) problems.push("routeAccess.exclude: must be a regular expression");
+  const ids = new Set([...RULE_IDS, ...ALLOW_RULES, "permission-texts"]);
+  for (const [index, rule] of settings.forbidden.entries()) {
+    const at = `forbidden[${index}]`;
+    if (typeof rule?.id !== "string" || rule.id === "") problems.push(`${at}.id: a rule name, used in the message and the allowlist`);
+    else if (ids.has(rule.id)) problems.push(`${at}.id: "${rule.id}" is a built-in rule's name`);
+    else ids.add(rule.id);
+    if (!(rule?.pattern instanceof RegExp)) problems.push(`${at}.pattern: must be a regular expression`);
+    if (typeof rule?.message !== "string" || rule.message === "") problems.push(`${at}.message: what to do instead`);
+    if (rule?.exclude !== undefined && !(rule.exclude instanceof RegExp)) problems.push(`${at}.exclude: must be a regular expression`);
+  }
+  const texts = settings.permissions;
+  if (texts) {
+    if (typeof texts.generated !== "string") problems.push("permissions.generated: the generated permissions file, relative to the config's folder");
+    if (!Array.isArray(texts.keys) || texts.keys.length === 0 || !texts.keys.every((key) => typeof key === "string" && key.includes("{id}") && key.includes("."))) {
+      problems.push('permissions.keys: message keys with {id}, "<namespace>.{id}", e.g. ["policies.{id}", "policy_descriptions.{id}"]');
+    }
+    if (!Array.isArray(texts.locales) || texts.locales.length === 0) problems.push('permissions.locales: the locale file names, e.g. ["hr", "en"]');
+  }
   for (const rule of Object.keys(settings.allow)) {
     if (!ALLOW_RULES.includes(rule) && !packRules.includes(rule)) problems.push(`allow.${rule}: no such rule; the allowlists are ${[...ALLOW_RULES, ...packRules].join(", ")}`);
   }

package/bin/config.mjs

@@ -32,6 +32,8 @@ export const DEFAULTS = {
     doc: {},
     copy: null,
     routeAccess: null,
+    forbidden: [],
+    permissions: null,
   },
   generator: { template: join(dirname(fileURLToPath(import.meta.url)), "templates", "feature-crud"), out: "features" },
   e2eTimings: { report: "e2e-timings/results.json" },

package/dist/{AccessGate.vue_vue_type_script_setup_true_lang-BH3f0hda.js → AccessGate.vue_vue_type_script_setup_true_lang-Bg8JFAOT.js}

@@ -1,5 +1,5 @@
 import { defineComponent as t, computed as i, renderSlot as n } from "vue";
-import { u as l } from "./platform-ORzRR3Tw.js";
+import { u as l } from "./platform-DU9QFts8.js";
 const m = /* @__PURE__ */ t({
   __name: "AccessGate",
   props: {

package/dist/{ActionRow.vue_vue_type_script_setup_true_lang-DybAIOHS.js → ActionRow.vue_vue_type_script_setup_true_lang-B5IMNnTf.js}

@@ -1,7 +1,7 @@
 import { defineComponent as r, openBlock as o, createElementBlock as l, createElementVNode as s, toDisplayString as n, createCommentVNode as d, renderSlot as f, createBlock as u, unref as c, withCtx as p, normalizeClass as _, createVNode as x } from "vue";
-import { g as b } from "./options-B48UiYsG.js";
+import { _ as b } from "./FormRow.vue_vue_type_script_setup_true_lang-CpgNVQF4.js";
 import { _ as h } from "./Icon.vue_vue_type_script_lang-BhhsFYwp.js";
-const k = { class: "flex flex-wrap items-end gap-3 px-row-inset" }, g = { class: "flex min-w-0 grow basis-56 flex-col gap-1" }, w = { class: "text-title font-semibold tracking-tight text-content-strong" }, y = {
+const k = { class: "flex flex-wrap items-end gap-3 px-row-inset" }, w = { class: "flex min-w-0 grow basis-56 flex-col gap-1" }, g = { class: "text-title font-semibold tracking-tight text-content-strong" }, y = {
   key: 0,
   class: "max-w-readable text-subheadline text-content-muted"
 }, E = /* @__PURE__ */ r({
@@ -12,8 +12,8 @@ const k = { class: "flex flex-wrap items-end gap-3 px-row-inset" }, g = { class:
   },
   setup(e) {
     return (i, t) => (o(), l("div", k, [
-      s("div", g, [
-        s("h2", w, n(e.title), 1),
+      s("div", w, [
+        s("h2", g, n(e.title), 1),
         e.description ? (o(), l("p", y, n(e.description), 1)) : d("", !0)
       ]),
       f(i.$slots, "actions")

package/dist/{Activity-DM9t5d3D.js → Activity-CiYn5E6A.js}

@@ -3,18 +3,18 @@ import { useI18n as D } from "vue-i18n";
 import { RouterLink as I } from "vue-router";
 import { _ as T } from "./IconTile.vue_vue_type_script_setup_true_lang-BmxCuUZ9.js";
 import { _ as z } from "./Tabs.vue_vue_type_script_setup_true_lang-tpkGp98F.js";
-import { u as G } from "./format-Cp1h0vsC.js";
-import { _ as B } from "./DateField.vue_vue_type_script_setup_true_lang-DzCvYHAf.js";
-import { a as H } from "./FormGroup.vue_vue_type_script_setup_true_lang-dsO1m9Mm.js";
-import { g as J } from "./options-B48UiYsG.js";
+import { u as G } from "./format-C_HXlOYQ.js";
+import { _ as B } from "./DateField.vue_vue_type_script_setup_true_lang-D0KcfW8R.js";
+import { a as H } from "./FormGroup.vue_vue_type_script_setup_true_lang-lvAuBG-0.js";
+import { _ as J } from "./FormRow.vue_vue_type_script_setup_true_lang-CpgNVQF4.js";
 import { i as M } from "./preferences-hYhrw8Uy.js";
-import { u as Q } from "./platform-ORzRR3Tw.js";
+import { u as Q } from "./platform-DU9QFts8.js";
 import { b as W } from "./routeResource-DlTsGTg_.js";
 import { _ as X } from "./AsyncSection.vue_vue_type_script_setup_true_lang-CX8mpXRE.js";
 import { _ as Y } from "./Badge.vue_vue_type_script_setup_true_lang-DJyZc0C7.js";
 import { u as Z } from "./useLoad-M7V-AVwR.js";
-import { P as tt, f as et, j as at } from "./index-DM_nWOYf.js";
-import { _ as st } from "./ActionRow.vue_vue_type_script_setup_true_lang-DybAIOHS.js";
+import { P as tt, f as et, j as at } from "./index-BA2w8uwD.js";
+import { _ as st } from "./ActionRow.vue_vue_type_script_setup_true_lang-B5IMNnTf.js";
 const ot = {
   class: "flex min-w-0 flex-col gap-group-gap",
   "data-person-activity": ""