@arponascension/express-inertia 1.0.0 → 1.5.0

package/dist/index.mjs

@@ -1,7 +1,10 @@
+import { randomUUID } from 'crypto';
 import fs from 'fs';
 import ejs from 'ejs';
 import path from 'path';
 
+// src/middleware.ts
+
 // src/utils.ts
 function lazy(callback) {
   return {
@@ -127,6 +130,10 @@ function safeStringify(obj) {
   });
 }
 var DEFAULT_COMPONENT_NAME_PATTERN = /^[\w-]+(?:\/[\w-]+)*$/;
+var DEFAULT_SECURITY_OPTIONS = {
+  validateComponentNames: true,
+  sanitizeViewData: true
+};
 function validateComponentName(component, pattern = DEFAULT_COMPONENT_NAME_PATTERN) {
   if (!pattern.test(component)) {
     throw new TypeError(
@@ -161,8 +168,13 @@ function sanitizeViewData(data) {
   }
   return sanitize(data);
 }
+var cryptoModule;
+async function getCrypto() {
+  cryptoModule ??= await import('crypto');
+  return cryptoModule;
+}
 async function generateSriHash(content) {
-  const crypto = await import('crypto');
+  const crypto = await getCrypto();
   const hash = crypto.createHash("sha384").update(content);
   return `sha384-${hash.digest("base64")}`;
 }
@@ -226,6 +238,12 @@ var DEFAULT_CIRCUIT_OPTIONS = {
   cooldownMs: 3e4,
   probeDelayMs: 1e3
 };
+var DEFAULT_RETRY_OPTIONS = {
+  maxRetries: 2,
+  baseDelayMs: 200,
+  maxDelayMs: 2e3,
+  retryableStatusCodes: [408, 429, 500, 502, 503, 504]
+};
 var CircuitBreaker = class {
   constructor(options = DEFAULT_CIRCUIT_OPTIONS) {
     this.options = options;
@@ -315,16 +333,19 @@ function calculateBackoff(attempt, baseDelayMs, maxDelayMs) {
 // src/ssr.ts
 var DEFAULT_SSR_URL = "http://127.0.0.1:13714/render";
 var DEFAULT_TIMEOUT = 2e3;
+var MAX_CIRCUIT_BREAKERS = 100;
 var logger = createLogger({ prefix: "express-inertia:ssr" });
-var DEFAULT_RETRY_OPTIONS = {
-  maxRetries: 2,
-  baseDelayMs: 200,
-  maxDelayMs: 2e3,
-  retryableStatusCodes: [408, 429, 500, 502, 503, 504]
-};
 var circuitBreakers = /* @__PURE__ */ new Map();
+function serializeCircuitOptions(options) {
+  if (!options) return "";
+  const ordered = Object.keys(options).sort().reduce((acc, key) => {
+    acc[key] = options[key];
+    return acc;
+  }, {});
+  return JSON.stringify(ordered);
+}
 function getCircuitBreaker(endpoint, options) {
-  const key = options?.circuitBreaker ? `${endpoint}:${JSON.stringify(options.circuitBreaker)}` : endpoint;
+  const key = options?.circuitBreaker ? `${endpoint}:${serializeCircuitOptions(options.circuitBreaker)}` : endpoint;
   let breaker = circuitBreakers.get(key);
   if (!breaker) {
     const cbOptions = {
@@ -332,6 +353,12 @@ function getCircuitBreaker(endpoint, options) {
       ...options?.circuitBreaker
     };
     breaker = new CircuitBreaker(cbOptions);
+    if (circuitBreakers.size >= MAX_CIRCUIT_BREAKERS) {
+      const oldest = circuitBreakers.keys().next().value;
+      if (oldest !== void 0) {
+        circuitBreakers.delete(oldest);
+      }
+    }
     circuitBreakers.set(key, breaker);
   }
   return breaker;
@@ -401,26 +428,30 @@ async function renderHttpSSR(page, endpoint, timeout) {
   try {
     pageJson = JSON.stringify(page);
   } catch (err) {
-    throw new Error(`Failed to serialize page for SSR: ${err.message}`);
+    clearTimeout(timer);
+    throw new Error(`Failed to serialize page for SSR: ${err instanceof Error ? err.message : String(err)}`);
   }
-  const response = await fetch(endpoint, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Accept: "application/json"
-    },
-    body: pageJson,
-    signal: controller.signal
-  });
-  clearTimeout(timer);
-  if (!response.ok) {
-    throw new Error(`SSR server responded with status: ${response.status} ${response.statusText}`);
+  try {
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: pageJson,
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      throw new Error(`SSR server responded with status: ${response.status} ${response.statusText}`);
+    }
+    const data = await response.json();
+    return {
+      head: Array.isArray(data.head) ? data.head : [],
+      body: typeof data.body === "string" ? data.body : ""
+    };
+  } finally {
+    clearTimeout(timer);
   }
-  const data = await response.json();
-  return {
-    head: Array.isArray(data.head) ? data.head : [],
-    body: typeof data.body === "string" ? data.body : ""
-  };
 }
 async function renderWithRetry(fn, retryOptions, context) {
   const options = {
@@ -445,12 +476,15 @@ async function renderWithRetry(fn, retryOptions, context) {
         attempt: attempt + 1,
         maxRetries: options.maxRetries,
         delayMs: Math.round(delay),
-        error: err.message,
+        error: err instanceof Error ? err.message : String(err),
         component: context
       });
       await new Promise((resolve) => setTimeout(resolve, delay));
     }
   }
+  if (lastError === void 0) {
+    throw new Error("SSR renderWithRetry: no attempts executed");
+  }
   throw lastError;
 }
 
@@ -473,7 +507,7 @@ function createInertiaResponse(req, res, options, globalSharedProps = {}) {
     return currentVersion;
   }
   const renderFn = async (component, props = {}, viewData = {}) => {
-    const securityOptions = options.security ?? { validateComponentNames: true };
+    const securityOptions = options.security ?? DEFAULT_SECURITY_OPTIONS;
     if (securityOptions.validateComponentNames !== false) {
       const pattern = securityOptions.componentNamePattern ?? DEFAULT_COMPONENT_NAME_PATTERN;
       validateComponentName(component, pattern);
@@ -538,8 +572,9 @@ function createInertiaResponse(req, res, options, globalSharedProps = {}) {
     } else if (options.viewData) {
       globalViewData = options.viewData;
     }
-    const sanitizedViewData = securityOptions.validateComponentNames !== false ? sanitizeViewData(viewData) : viewData;
-    const sanitizedGlobalViewData = securityOptions.validateComponentNames !== false ? sanitizeViewData(globalViewData) : globalViewData;
+    const shouldSanitizeViewData = securityOptions.sanitizeViewData !== false;
+    const sanitizedViewData = shouldSanitizeViewData ? sanitizeViewData(viewData) : viewData;
+    const sanitizedGlobalViewData = shouldSanitizeViewData ? sanitizeViewData(globalViewData) : globalViewData;
     const templateData = {
       ...res.locals,
       ...sanitizedGlobalViewData,
@@ -637,17 +672,17 @@ function createInertia(options = {}) {
         resetData
       };
       res.inertia = createInertiaResponse(req, res, options, { ...globalShared });
-      const securityOptions = options.security ?? { validateComponentNames: true };
+      const securityOptions = options.security ?? DEFAULT_SECURITY_OPTIONS;
       if (securityOptions.validateComponentNames !== false && isInertia) {
         const pattern = securityOptions.componentNamePattern ?? DEFAULT_COMPONENT_NAME_PATTERN;
-        const partialComponent2 = req.header("X-Inertia-Partial-Component");
-        if (partialComponent2 && !pattern.test(partialComponent2)) {
+        const requestedPartialComponent = req.header("X-Inertia-Partial-Component");
+        if (requestedPartialComponent && !pattern.test(requestedPartialComponent)) {
           res.setHeader("X-Inertia-Location", req.originalUrl || req.url);
           res.status(409).end();
           return;
         }
       }
-      if (isInertia && req.method === "GET" && options.version) {
+      if (isInertia && options.version) {
         let currentVersion = null;
         if (typeof options.version === "function") {
           currentVersion = await options.version();
@@ -687,19 +722,22 @@ function requestIdMiddleware() {
   };
 }
 function generateRequestId() {
-  const timestamp = Date.now().toString(36);
-  const random = Math.random().toString(36).slice(2, 8);
-  return `${timestamp}-${random}`;
+  return randomUUID();
 }
 
 // src/directives.ts
 var customDirectives = {};
 function escapeJsString(str) {
-  return str.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+  return str.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
 function registerDirective(name, handler) {
   customDirectives[name] = handler;
 }
+function clearCustomDirectives() {
+  for (const name of Object.keys(customDirectives)) {
+    delete customDirectives[name];
+  }
+}
 function compileBladeDirectives(templateSource, localDirectives) {
   let compiled = templateSource;
   compiled = compiled.replace(
@@ -793,6 +831,8 @@ function resolveDevServerUrl(config, override) {
 }
 function inertiaVitePlugin(options = {}) {
   const logger2 = createLogger({ prefix: "express-inertia:vite" });
+  let cleanupRegistered = false;
+  let exitConfig = null;
   const write = (config, server) => {
     try {
       const hotFile = path.resolve(config.root, options.hotFile || "public/hot");
@@ -811,6 +851,11 @@ function inertiaVitePlugin(options = {}) {
     } catch {
     }
   };
+  const removeOnExit = () => {
+    if (exitConfig) {
+      remove(exitConfig);
+    }
+  };
   return {
     name: "express-inertia-hot-file",
     configResolved(config) {
@@ -822,9 +867,13 @@ function inertiaVitePlugin(options = {}) {
     },
     configureServer(server) {
       write(server.config, server);
+      exitConfig = server.config;
       server.httpServer?.once("listening", () => write(server.config, server));
       server.httpServer?.on("close", () => remove(server.config));
-      process.once("exit", () => remove(server.config));
+      if (!cleanupRegistered) {
+        process.once("exit", removeOnExit);
+        cleanupRegistered = true;
+      }
     },
     buildStart() {
     }
@@ -847,7 +896,7 @@ var ViteHelper = class {
       ),
       base: config?.base || `/${buildDir}/`,
       manifest: config?.manifest || null,
-      isDev: config?.isDev ?? false,
+      isDev: config?.isDev,
       devServerUrlOverride: config?.devServerUrlOverride || null
     };
   }
@@ -859,8 +908,8 @@ var ViteHelper = class {
    * NODE_ENV switch is required to toggle between dev and build assets.
    */
   isDev() {
-    if (this.config.isDev === true) {
-      return true;
+    if (this.config.isDev !== void 0) {
+      return this.config.isDev;
     }
     const candidatePaths = [
       this.config.hotFile,
@@ -894,6 +943,12 @@ var ViteHelper = class {
     }
     return this.config.devServerUrl;
   }
+  /**
+   * Get the production asset base path (always ends with a trailing slash).
+   */
+  getBasePath() {
+    return this.config.base.endsWith("/") ? this.config.base : `${this.config.base}/`;
+  }
   /**
    * Check if manifest file exists.
    */
@@ -934,7 +989,9 @@ var ViteHelper = class {
           this.manifestCache = parsed;
           return parsed;
         } catch (err) {
-          throw new Error(`[express-inertia] Failed to parse Vite manifest at ${p}: ${err.message}`);
+          throw new Error(
+            `[express-inertia] Failed to parse Vite manifest at ${p}: ${err instanceof Error ? err.message : String(err)}`
+          );
         }
       }
     }
@@ -1040,26 +1097,49 @@ var defaultViteHelper = new ViteHelper();
 
 // src/engine.ts
 var engineCaches = /* @__PURE__ */ new Set();
+var engineTimestamps = /* @__PURE__ */ new Set();
+var TEMPLATE_SOURCE_KEY = "__express_inertia_template_source__";
 function createInertiaEngine(options) {
   const viteHelper = options?.vite ? createViteHelper(options.vite) : createViteHelper();
   const shouldCache = options?.cache ?? !viteHelper.isDev();
   const inertiaVersion = options?.inertiaVersion ?? 2;
   const defaultRootElement = options?.rootElement ?? true;
   const templateCache = /* @__PURE__ */ new Map();
+  const templateTimestamps = /* @__PURE__ */ new Map();
   engineCaches.add(templateCache);
+  engineTimestamps.add(templateTimestamps);
   return function inertiaBladeEngine(filePath, rawOptions, callback) {
     try {
-      let compiledTemplate = shouldCache ? templateCache.get(filePath) : void 0;
+      const template = options?.templateSource;
+      const hasTemplateSource = template !== void 0;
+      const cacheKey = hasTemplateSource ? TEMPLATE_SOURCE_KEY : filePath;
+      let compiledTemplate;
+      let templateMtimeMs = -1;
+      if (hasTemplateSource) {
+        compiledTemplate = templateCache.get(cacheKey);
+      } else if (shouldCache) {
+        compiledTemplate = templateCache.get(cacheKey);
+      } else {
+        try {
+          templateMtimeMs = fs.statSync(filePath).mtimeMs;
+        } catch {
+          templateMtimeMs = 0;
+        }
+        if (templateTimestamps.get(cacheKey) === templateMtimeMs) {
+          compiledTemplate = templateCache.get(cacheKey);
+        }
+      }
       if (!compiledTemplate) {
-        const templateSource = options?.templateSource || fs.readFileSync(filePath, "utf-8");
+        const templateSource = template !== void 0 ? template : fs.readFileSync(filePath, "utf-8");
         const compiledSource = options?.compileTemplate ? options.compileTemplate(templateSource) : compileBladeDirectives(templateSource, options?.directives);
         compiledTemplate = ejs.compile(compiledSource, {
           filename: filePath,
-          cache: shouldCache,
+          cache: false,
           async: false
         });
-        if (shouldCache) {
-          templateCache.set(filePath, compiledTemplate);
+        templateCache.set(cacheKey, compiledTemplate);
+        if (!hasTemplateSource) {
+          templateTimestamps.set(cacheKey, templateMtimeMs);
         }
       }
       const locals = { ...rawOptions };
@@ -1111,15 +1191,15 @@ ${scriptTag}`;
       };
       locals.csrf = () => {
         const token = locals._csrf || locals.csrfToken || (typeof locals.req?.csrfToken === "function" ? locals.req.csrfToken() : "") || "";
-        return token ? `<input type="hidden" name="_token" value="${token}">` : "";
+        return token ? `<input type="hidden" name="_token" value="${escapeHtmlAttr(token)}">` : "";
       };
       locals.json = (value) => {
         return JSON.stringify(value);
       };
       if (!locals.routes) {
-        locals.routes = (group) => {
+        locals.routes = (_group) => {
           if (locals.routeConfig || locals.ziggy) {
-            const routesData = JSON.stringify(locals.routeConfig || locals.ziggy);
+            const routesData = JSON.stringify(locals.routeConfig || locals.ziggy).replace(/</g, "\\u003c");
             return `<script>const Ziggy = ${routesData};</script>`;
           }
           return "";
@@ -1128,7 +1208,7 @@ ${scriptTag}`;
       const html = compiledTemplate(locals);
       callback(null, html);
     } catch (err) {
-      callback(err);
+      callback(err instanceof Error ? err : new Error(String(err)));
     }
   };
 }
@@ -1137,6 +1217,9 @@ function clearEngineCache() {
   for (const cache of engineCaches) {
     cache.clear();
   }
+  for (const timestamps of engineTimestamps) {
+    timestamps.clear();
+  }
 }
 
 // src/prefetch.ts
@@ -1154,15 +1237,19 @@ var PrefetchHelper = class {
     const mode = options.mode || "prefetch";
     const tags = [];
     if (this.viteHelper.isDev()) {
-      const devUrl = this.viteHelper["getDevServerUrl"]().replace(/\/$/, "");
+      const devUrl = this.viteHelper.getDevServerUrl().replace(/\/$/, "");
       for (const entry of entrypoints) {
         const cleanEntry = entry.replace(/^\//, "");
-        tags.push(`<link rel="${mode}" href="${devUrl}/${cleanEntry}" crossorigin>`);
+        const attrs = [`rel="${mode}"`, `href="${devUrl}/${cleanEntry}"`];
+        if (options.crossorigin) {
+          attrs.push("crossorigin");
+        }
+        tags.push(`<link ${attrs.join(" ")}>`);
       }
       return tags.join("\n");
     }
-    const manifest = this.viteHelper["getManifest"]();
-    const basePath = this.viteHelper["config"].base.endsWith("/") ? this.viteHelper["config"].base : `${this.viteHelper["config"].base}/`;
+    const manifest = this.viteHelper.getManifest();
+    const basePath = this.viteHelper.getBasePath();
     const rendered = /* @__PURE__ */ new Set();
     for (const entry of entrypoints) {
       const cleanEntry = entry.replace(/^\//, "");
@@ -1213,6 +1300,6 @@ function createPrefetchHelper(viteHelper) {
 // src/index.ts
 var src_default = createInertia;
 
-export { CircuitBreaker, DEFAULT_COMPONENT_NAME_PATTERN, PrefetchHelper, ViteHelper, always, calculateBackoff, clearEngineCache, compileBladeDirectives, createInertia, createInertiaEngine, createLogger, createPrefetchHelper, createViteHelper, src_default as default, defaultViteHelper, defer, escapeHtmlAttr, generateSriHash, getGlobalLogger, createInertia as inertia, inertiaEngine, inertiaVitePlugin, isAlways, isDeferred, isLazy, isMerge, isOptional, lazy, merge, optional, registerDirective, renderSSR, requestIdMiddleware, resetAllCircuitBreakers, resolveProps, safeStringify, sanitizeViewData, serializePage, setGlobalLogger, shouldRetry, validateComponentName };
+export { CircuitBreaker, DEFAULT_COMPONENT_NAME_PATTERN, DEFAULT_SECURITY_OPTIONS, PrefetchHelper, ViteHelper, always, calculateBackoff, clearCustomDirectives, clearEngineCache, compileBladeDirectives, createInertia, createInertiaEngine, createLogger, createPrefetchHelper, createViteHelper, src_default as default, defaultViteHelper, defer, escapeHtmlAttr, generateSriHash, getGlobalLogger, createInertia as inertia, inertiaEngine, inertiaVitePlugin, isAlways, isDeferred, isLazy, isMerge, isOptional, lazy, merge, optional, registerDirective, renderSSR, requestIdMiddleware, resetAllCircuitBreakers, resolveProps, safeStringify, sanitizeViewData, serializePage, setGlobalLogger, shouldRetry, validateComponentName };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map