Why would you guess that? This ain't our first rodeo.

Because you started with a bunch of JavaScript recommendations that have nothing to do with the actual design or implementation of the application. It's leading off with the most trivial stuff imaginable.

Specifically, I'm guessing your architecture doesn't implement ROCA server recommendations #2, #5, #9, or client recommendations #1, #4, or #5. I'm happy to be proven wrong, though.

And I'm happy not to have to prove anything to a thirsty rando who assumes we need to repeat some common knowledge best practices in our nascent work-in-progress document (which, btw, we didn't post anywhere for feedback but is simply open source and was randomly shared).

We're a JavaScript consultancy. Clients specifically want us to help them with their tooling, and we need to reference this stuff a lot, that's why we happened to write the webpack stuff down first. This is not a blog post series and there is no implied significance to the ordering so we didn't really "lead off" with one thing or the other.

Anyway, good luck with your prescriptivism and billing your clients for adding "another authentication mechanism […] for non-browser access" (AUTH) – they will love that.