@cepharum/vue3-commons

@cepharum/vue3-commons

A Vue3 library of components and composables shared across cepharum applications

License

MIT

Install

npm install -D @cepharum/vue3-commons

Changes

See CHANGELOG.md.

Manual

https://cepharum-foss.gitlab.io/vue3-commons/

For coding agents working in a consuming application, AGENTS.md is a condensed briefing, and the manual is served as llms.txt and llms-full.txt as well. Both digests are generated while building the manual, thus they do not drift from it.

Security

Found a vulnerability? Write to security@cepharum.de rather than opening a public issue, or open a confidential one — SECURITY.md says what to include and why the order matters.

Development

npm run dev            # build the library, watching for changes
npm run docs:dev       # serve the manual, to this machine only
npm run docs:dev:lan   # serve the manual to the network, see below
npm run example:dev    # serve the example application and its mock backend

The manual is served to this machine alone unless asked otherwise. VitePress brings a Vite of its own — ^5.4, which is what its latest release pins — and that one carries dev-server advisories whose own precondition is a server published to the network: a bypass of server.fs.deny on Windows, and a path traversal in the handling of .map files. Neither reaches the published package, which contains none of this, nor the pipeline, which builds the manual rather than serving it. Use docs:dev:lan where reading the manual from another device is worth it, and on a network you trust.

npm test               # unit tests
npm run test:e2e       # end-to-end tests against the example application
npm run lint           # report findings, npm run lint:fix writes
npm run types:check    # compile the declarations and their usage
npm run audit          # known vulnerabilities of high severity and up
npm run sbom           # writes sbom.cdx.json, the bill of materials CI keeps

npm install writes the git hooks as well: ESLint fixes what it can before a commit and re-stages it, and a commit message is checked against Conventional Commits — feat, fix, docs, style, refactor, perf, test, build, ci, chore or revert, lowercase, imperative, no trailing period. A message which does not conform is rejected at commit time rather than in review. Set LEFTHOOK=0 to skip the hooks once, e.g. while rebasing history someone else wrote.

See examples/app for the application the end-to-end tests drive.

Publishing a version is done by hand, deliberately — see RELEASING.md for the sequence, for why no job does it, and for the one step no suite can do for you: looking at the thing.

In VS Code, these are available as tasks as well — Run Task offers them by name, and check: everything CI checks runs the sequence the pipeline runs. Personal editor settings stay out of the repository; the tasks are shared.