@dokebi/template-inertia 0.4.0 → 0.4.2

package/AI.md

@@ -1,6 +1,6 @@
-# AI guide — @dokebi/template-inertia 0.4.0
+# AI guide — @dokebi/template-inertia 0.4.2
 
-An Inertia (v3) server adapter. The first request is answered with HTML (plus `script[data-page]` JSON), later `X-Inertia` requests with page JSON. It reads the Vite manifest to fill in scripts, styles and the version, and serves the build files itself. Optionally it server-renders the first HTML in the same process (SSR, D-0039). Vue and Vite are not server dependencies (they are the app's dev dependencies). Node >=24.0.0, core ^0.4.0, @dokebi/web (peer). Details are in the [README](README.md).
+An Inertia (v3) server adapter. The first request is answered with HTML (plus `script[data-page]` JSON), later `X-Inertia` requests with page JSON. It reads the Vite manifest to fill in scripts, styles and the version, and serves the build files itself. Optionally it server-renders the first HTML in the same process (SSR, D-0039). Vue and Vite are not server dependencies (they are the app's dev dependencies). Node >=24.0.0, core ^0.4.0, @dokebi/web ^0.4.2 (peer). Details are in the [README](README.md).
 
 ## 1. Install and project layout
 
@@ -45,7 +45,8 @@ route.post('/orders', async (request, reply, page) => {
 ```
 
 - `render(request, reply, component, props?, { encryptHistory?, clearHistory? }?)`: GET/HEAD only. The fifth argument sets history handling for this response (otherwise the scope setting and the session signal). Return or await it in the handler. component is `/`-separated parts matching `[A-Za-z0-9][A-Za-z0-9_-]*`.
-- props: JSON values, async lazy functions or the helpers of §3.1. A partial reload (`only`, `except`) evaluates only the selected ones; `errors` is always included. Non-JSON values (`undefined`, functions, symbols, `NaN`, `Infinity`) fail with `TypeError: Page props must be JSON serializable`, BigInt and cycles with `JSON.stringify`'s `TypeError`. Development and tests (`NODE_ENV` not `production`) check every value of the page; production checks only the top-level props and leaves the rest to `JSON.stringify` (D-0068; a 30 KB page went from 112 to 24 µs), so this mistake is caught during development.
+- props: JSON values, async lazy functions or the helpers of §3.1. A partial reload (`only`, `except`) evaluates only the selected ones; `errors` is always included. Non-JSON values (`undefined`, functions, symbols, `NaN`, `Infinity`) fail with `TypeError: Page props must be JSON serializable`, BigInt with `JSON.stringify`'s `TypeError`, cycles with a `TypeError` `Converting circular structure to JSON` (outside production at once, naming the prop that closes the cycle; an object used twice without a cycle is fine). Development and tests (`NODE_ENV` not `production`) check every value of the page; production checks only the top-level props and leaves the rest to `JSON.stringify` (D-0068; a 30 KB page went from 112 to 24 µs), so this mistake is caught during development.
+- Prop types in TypeScript: describe props with `type` aliases (`type Post = { id: number; title: string }`), not `interface`. An interface has no index signature, so TypeScript refuses it where `Json` is required (`npm run typecheck` fails with "Index signature for type 'string' is missing"); a `type` with the same fields is accepted (AI-M04).
 - `redirect(request, reply, localUrl)`: 302 for GET/HEAD, 303 for mutations; an Inertia `#` navigation gets 409 + `X-Inertia-Redirect`.
 - `location(request, reply, url)`: a local or external http(s) navigation. Inertia requests get 409 + `X-Inertia-Location`.
 
@@ -93,7 +94,7 @@ route.post('/orders', async (request, reply, page) => {
 
 **Refuse input with a validation error, never with your own 422.** A refused route schema (`schema.body`, `schema.querystring`) and `throw validationError({ name: 'Already taken' })` (from `@dokebi/web`) in the handler are the same 422 `VALIDATION_FAILED` with `fields` and `errors`. For an Inertia request (`X-Inertia`) this plugin answers it like Laravel does:
 
-- **With @dokebi/session**: the `errors` (`{ field: message }`) and the `old` input (the body's top-level strings, numbers and booleans, without password-, token-, secret- or card-like fields; left out above 8 KB) go into the session flash, and the answer is **303 back** to the `Referer` when it is this host (another origin is never followed), otherwise to `/` for a POST/PUT/PATCH/DELETE. The next page gets the flashed `errors` as its **`errors` prop** (under errors the handler passed itself) and `old` stays in the page `flash` (`usePage().flash.old`). The client keeps the form's own state on a non-GET visit, so `useForm().errors.name` just shows the message. A GET refused by its query schema without a usable referer (a redirect to itself would loop) gets the JSON below.
+- **With @dokebi/session**: the `errors` (`{ field: message }`) and the `old` input (the body's top-level strings, numbers and booleans, without password-, token-, secret- or card-like fields; left out above 8 KB) go into the session flash, and the answer is **303 back** to the `Referer` when it is this host (another origin is never followed, nor a path that reads as another host such as `//other.host/…`), otherwise to `/` for a POST/PUT/PATCH/DELETE. The next page gets the flashed `errors` as its **`errors` prop** (under errors the handler passed itself) and `old` stays in the page `flash` (`usePage().flash.old`). The client keeps the form's own state on a non-GET visit, so `useForm().errors.name` just shows the message. A GET refused by its query schema without a usable referer (a redirect to itself would loop) gets the JSON below. The target and the old input come from @dokebi/web's form helpers (`formBackTarget`, `formOldInput`, 0.4.1), the same rules @dokebi/app uses for HTML forms.
 - **Without a session** the answer is the 422 JSON with `errors`: Inertia hands a non-page answer to `onHttpException`, so read it there: `form.post(url, { onHttpException: (response) => { form.setError(response.data.errors); return false } })`.
 - **Submit with `only`.** The GET after the 303 is a new visit, and a full visit must send every prop of the page again (Inertia replaces all props, so the server cannot trim it by itself). Pass the props the submit changes and Inertia keeps the partial headers across the redirect; `errors` always comes along:
 
@@ -109,7 +110,7 @@ form.post('/guestbook', { only: ['entries'], onSuccess: () => form.reset('text')
 
 ## 4. Serving build files
 
-With `vite`, the manifest (at most 4 MiB) is read once in setup, and only the files reachable from the entry (static and dynamic chunks, CSS, assets) are served at the exact path `<base><file>` (`cache-control: public, max-age=31536000, immutable`). The manifest itself, files outside that list and `dist/ssr/` are never served. A missing manifest fails the start (`Vite manifest not found: … Build the views first (npm run build).`), and so does a missing entry.
+With `vite`, the manifest (at most 4 MiB) is read once in setup, and only the files reachable from the entry (static and dynamic chunks, CSS, assets) are served at the exact path `<base><file>` (`cache-control: public, max-age=31536000, immutable`). Each file is read on its first request and kept in memory (files above 4 MiB are streamed per request), so rebuild with new hashed names and restart instead of changing a served file in place. The manifest itself, files outside that list and `dist/ssr/` are never served. A missing manifest fails the start (`Vite manifest not found: … Build the views first (npm run build).`), and so does a missing entry.
 
 ## 5. SSR (D-0039)
 

package/README.md

@@ -1,4 +1,4 @@
-# @dokebi/template-inertia 0.4.0
+# @dokebi/template-inertia 0.4.2
 
 An optional package for Node >=24.0.0 and core ^0.4.0 (public on npm). Its ID is `dokebi-template-inertia` and it depends on `dokebi-web`. `@dokebi/web` is a peer dependency (not the pinned dependency it used to be). EJS, Vue and Vite are not installed as required dependencies of the server package.
 
@@ -21,7 +21,7 @@ const pages = createInertia({
 
 The x-user header above only illustrates the API; it is not authentication. Build user props from the app's authentication result. Call `render(request, reply, component, props?)` only for GET/HEAD and always return or await it in the handler. The first visit is answered with HTML and a JSON page script, later X-Inertia requests with page JSON, in Inertia v3's `script[data-page="app"]` format. `rootId` defaults to app, title to an empty string and version to development. Without a configured version a warn log (`code: INERTIA_VERSION_DEFAULT`) is written once in setup: clients then cannot notice changed assets, so real deployments set a per-build version and that manifest's scripts and styles. With a Vite build, `vite: { manifest, entry, base? }` does this instead. Setup reads the manifest (`.vite/manifest.json`, relative to the working folder or absolute, at most 4 MiB) once and fills in the entry's script, the CSS of the entry and the chunks it imports, and a version from the manifest's content hash (the first 32 characters of SHA-256). `base` (default `/`) is the URL prefix of the build files. `vite` together with `version`, `scripts` or `styles` is refused. When the entry is not in the manifest the start fails and the error names the entry ([ISSUE-0005](https://git.nyx-zone.com/dokebi/framework/-/blob/main/docs/issues/ISSUE-0005-playground-findings.md) PG-07). A missing manifest file fails with `Vite manifest not found: <path>. Build the views first (npm run build).`.
 
-This plugin serves the build files itself through dokebi-web ([D-0031](https://git.nyx-zone.com/dokebi/framework/-/blob/main/docs/decisions/D-0031-project-layout.md), supplement 1). Only files reachable from the entry are served: static and dynamic import chunks, CSS and assets. Each file is registered as a GET route at the exact path `<base><file>`; no wildcard routes are used, so the manifest itself and files outside the list are never served. When several apps use the same chunk it is registered once. The files are in outDir when the manifest is `<outDir>/.vite/manifest.json`, otherwise in the manifest's folder. Responses get a content type per extension and `cache-control: public, max-age=31536000, immutable`, because build files are expected to have a hash in their names. To serve them from a CDN or another static server, put them at the same paths.
+This plugin serves the build files itself through dokebi-web ([D-0031](https://git.nyx-zone.com/dokebi/framework/-/blob/main/docs/decisions/D-0031-project-layout.md), supplement 1). Only files reachable from the entry are served: static and dynamic import chunks, CSS and assets. Each file is registered as a GET route at the exact path `<base><file>`; no wildcard routes are used, so the manifest itself and files outside the list are never served. When several apps use the same chunk it is registered once. The files are in outDir when the manifest is `<outDir>/.vite/manifest.json`, otherwise in the manifest's folder. Responses get a content type per extension and `cache-control: public, max-age=31536000, immutable`, because build files are expected to have a hash in their names. Each file is read on its first request and kept in memory (one read shared by concurrent requests; a failed read is not kept); files above 4 MiB are streamed on every request instead. To serve them from a CDN or another static server, put them at the same paths.
 
 ```yaml
 dokebi-template-inertia:
@@ -47,7 +47,7 @@ Supported: the initial HTML, page navigation, shared/lazy/partial props, deferre
 
 ## Forms and validation
 
-Validation follows [D-0074](https://git.nyx-zone.com/dokebi/framework/-/blob/main/docs/decisions/D-0074-error-responses.md). A refused route schema and `throw validationError({ field: 'message' })` (from `@dokebi/web`) are the same 422 `VALIDATION_FAILED` answer. For an Inertia request with [@dokebi/session](https://git.nyx-zone.com/dokebi/framework/-/blob/main/plugins/dokebi-session/README.md) this plugin flashes `errors` (and `old` input without password-like fields) and answers 303 back to the same-origin `Referer`; the next page gets them in its `errors` prop, so `useForm().errors.name` shows the message. Without a session the answer is the 422 JSON with `errors` (read it in `onHttpException`).
+Validation follows [D-0074](https://git.nyx-zone.com/dokebi/framework/-/blob/main/docs/decisions/D-0074-error-responses.md). A refused route schema and `throw validationError({ field: 'message' })` (from `@dokebi/web`) are the same 422 `VALIDATION_FAILED` answer. For an Inertia request with [@dokebi/session](https://git.nyx-zone.com/dokebi/framework/-/blob/main/plugins/dokebi-session/README.md) this plugin flashes `errors` (and `old` input without password-like fields) and answers 303 back to the same-origin `Referer`; the next page gets them in its `errors` prop, so `useForm().errors.name` shows the message. Without a session the answer is the 422 JSON with `errors` (read it in `onHttpException`). The target and the old input follow @dokebi/web's form helpers (shared with @dokebi/app's HTML forms; 0.4.2 refuses a Referer path that reads as another host, such as `//other.host/…`), so this version needs @dokebi/web ^0.4.2.
 
 Submit forms with `only` (the props the submit changes, for example `form.post('/posts', { only: ['posts'] })`): the GET after the redirect is a new visit, and a full visit must send every prop again because Inertia replaces all props, so the server cannot trim it by itself. Inertia keeps the partial headers across the redirect, and `errors` is always included. `dokebi check` warns about a submit without `only` (`inertia-form-only`).
 

package/dist/index.js

@@ -1,12 +1,12 @@
 import { createHash } from 'node:crypto';
-import { existsSync } from 'node:fs';
+import { createReadStream, existsSync } from 'node:fs';
 import { readFile, stat } from 'node:fs/promises';
 import { basename, dirname, extname, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { types } from 'node:util';
-import { definePlugin, optionalDependency, } from '@dokebi/core';
+import { definePlugin, optionalDependency, providerDependency, } from '@dokebi/core';
 import { diagnostics } from '@dokebi/core/libraries';
-import { dependency as web } from '@dokebi/web/dependency';
+import { formBackTarget, formOldInput } from '@dokebi/web';
 import { viewEngines } from '@dokebi/web/points';
 import { InertiaError, InertiaUsageError } from './errors.js';
 import { options } from './options.js';
@@ -16,6 +16,13 @@ export { InertiaError, InertiaUsageError, } from './errors.js';
 export { options } from './options.js';
 export { deepMerge, defer, InertiaProp, isInertiaProp, merge, once, } from './props.js';
 const MANIFEST_MAX_BYTES = 4 * 1024 * 1024;
+/** Built files up to this size are kept in memory after their first request; larger ones are streamed. */
+const ASSET_CACHE_MAX_BYTES = 4 * 1024 * 1024;
+/** The bytes of a built file to keep, or null when it is too large to keep (streamed per request). */
+async function builtAsset(file) {
+    const info = await stat(file);
+    return info.size > ASSET_CACHE_MAX_BYTES ? null : readFile(file);
+}
 const { describeError, Repeats } = diagnostics;
 function parseVite(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input) || types.isProxy(input))
@@ -154,54 +161,17 @@ function hasCookie(header, name) {
     return text.split(';').some((part) => part.slice(0, part.indexOf('=')).trim() === name);
 }
 /**
- * Where a validation redirect goes (D-0074 §3): the `Referer` when it is this host (another
- * origin is never followed); otherwise `/` for a POST, PUT, PATCH or DELETE. A GET whose referer
- * is missing or is itself has no way back (a redirect to itself would fail again, forever).
+ * dokebi-web 0.4.2 or later: the validation redirect uses its form helpers (`formBackTarget`,
+ * `formOldInput`, D-0074 addendum 1), shared with @dokebi/app; 0.4.2 never answers a Referer
+ * path that reads as another host (ISSUE-0006 A02). A local descriptor instead of
+ * '@dokebi/web/dependency' (whose range stays ^0.4.0 for the plugins that need nothing newer).
  */
-function backTarget(request, host) {
-    const referer = request.headers.referer;
-    if (typeof referer === 'string' && referer.length <= 4096) {
-        let url;
-        if (URL.canParse(referer))
-            url = new URL(referer);
-        if (url &&
-            (url.protocol === 'http:' || url.protocol === 'https:') &&
-            url.host.toLowerCase() === host.toLowerCase()) {
-            const target = url.pathname + url.search;
-            if (!(['GET', 'HEAD'].includes(request.method) && target === request.url))
-                return target;
-        }
-    }
-    return ['GET', 'HEAD'].includes(request.method) ? undefined : '/';
-}
-/** Field names whose values never go into the session as old input. */
-const SECRET_FIELD = /pass(?:word|wd|phrase)?|secret|token|api[_-]?key|card|cvc|cvv|otp|pin$/i;
-/** Old input kept at most (as JSON text): a larger body is not flashed. */
-const OLD_MAX = 8192;
-/**
- * The old input of a refused form (D-0074 §3): the body's top-level strings, numbers, booleans
- * and nulls, without password-like fields; undefined when nothing is left or it is too large.
- */
-function oldInput(body) {
-    if (body === null || typeof body !== 'object' || Array.isArray(body))
-        return undefined;
-    const old = {};
-    let kept = 0;
-    for (const [key, value] of Object.entries(body)) {
-        if (key === '__proto__' || SECRET_FIELD.test(key))
-            continue;
-        if (value === null ||
-            typeof value === 'boolean' ||
-            (typeof value === 'number' && Number.isFinite(value)) ||
-            typeof value === 'string') {
-            old[key] = value;
-            kept++;
-        }
-    }
-    if (!kept || JSON.stringify(old).length > OLD_MAX)
-        return undefined;
-    return old;
-}
+const web = providerDependency({
+    name: 'dokebi-web',
+    version: '^0.4.2',
+    packageName: '@dokebi/web',
+    load: () => import('@dokebi/web'),
+});
 const session = optionalDependency({
     name: 'dokebi-session',
     version: '^0.4.0',
@@ -292,7 +262,7 @@ class InertiaRuntime {
                     // D-0074 §3: flash errors and old input, 303 back; the next page gets `errors`.
                     validation: async (request, reply, errors) => {
                         const current = sessionOf(request);
-                        const target = backTarget(request, server.requestHost(request));
+                        const target = formBackTarget(request, server.requestHost(request), '/');
                         if (!current?.flash || target === undefined) {
                             if (logger.isEnabled('debug'))
                                 logger.log('debug', 'Inertia validation answered as JSON', {
@@ -303,7 +273,7 @@ class InertiaRuntime {
                             return false;
                         }
                         await current.flash('errors', { ...errors });
-                        const old = oldInput(request.body);
+                        const old = formOldInput(request.body);
                         if (old)
                             await current.flash('old', old);
                         if (logger.isEnabled('debug'))
@@ -438,6 +408,7 @@ class InertiaRuntime {
         };
         // Built files are served at their exact URL (no wildcard), once even if apps share chunks.
         const served = new Set();
+        const loaded = new Set();
         const built = async (options) => {
             if (develop) {
                 await viteDev(options.base);
@@ -461,13 +432,38 @@ class InertiaRuntime {
                     continue;
                 served.add(url);
                 const type = CONTENT_TYPES[extname(file).toLowerCase()] ?? 'application/octet-stream';
+                // Built files are hashed and immutable, and the manifest is read once at start: each is
+                // read on its first request and kept (one read shared by concurrent requests). A file
+                // above ASSET_CACHE_MAX_BYTES is streamed instead of held. A failed read is not kept.
+                let content;
                 server.route({
                     method: 'GET',
                     url,
-                    handler: async (_request, reply) => reply
-                        .type(type)
-                        .header('cache-control', 'public, max-age=31536000, immutable')
-                        .send(await readFile(file)),
+                    handler: async (_request, reply) => {
+                        const loading = content ?? builtAsset(file);
+                        content = loading;
+                        let body;
+                        try {
+                            body = await loading;
+                        }
+                        catch (error) {
+                            if (content === loading)
+                                content = undefined;
+                            throw error;
+                        }
+                        if (logger.isEnabled('debug') && !loaded.has(url)) {
+                            loaded.add(url);
+                            logger.log('debug', 'Vite built file loaded', {
+                                url,
+                                cached: body !== null,
+                                bytes: body?.length ?? null,
+                            });
+                        }
+                        return reply
+                            .type(type)
+                            .header('cache-control', 'public, max-age=31536000, immutable')
+                            .send(body ?? createReadStream(file));
+                    },
                 });
             }
             return assets;
@@ -622,7 +618,7 @@ class InertiaRuntime {
 }
 export const createPlugin = definePlugin({
     name: 'dokebi-template-inertia',
-    version: '0.4.0',
+    version: '0.4.2',
     core: '^0.4.0',
     options,
     entry: parseEntry,

package/dist/responder.js

@@ -68,43 +68,70 @@ export function normalizeInertiaOptions(options = {}) {
     return Object.freeze(normalized);
 }
 const UNSUPPORTED = 'Page props must be JSON serializable';
+/** Deeper than this the walk stops; JSON.stringify reports what is left (abuse, not a page). */
+const MAX_DEPTH = 512;
+/**
+ * Objects the development check visits at most per page; the rest goes to JSON.stringify
+ * unchecked, as in production. A page of 30 KB has a few thousand values; more than this is an
+ * object shared down many levels (`a.left = a.right = b`, …), whose JSON doubles with each level.
+ */
+const MAX_VISITS = 1_000_000;
 /**
  * Fails on a value JSON.stringify would drop or change silently (undefined, a function, a
- * symbol, NaN or ±Infinity; a BigInt or a cycle fails in stringify itself). A plain walk before
- * a stringify without replacer: a replacer takes V8 off its fast path (4.8× the stringify time
- * for a 30 KB page, D-0068). Objects with toJSON are checked as what toJSON returns.
+ * symbol, NaN or ±Infinity; a BigInt fails in stringify itself) and on a cycle, with
+ * stringify's TypeError. A plain walk before a stringify without replacer: a replacer takes V8
+ * off its fast path (4.8× the stringify time for a 30 KB page, D-0068). An object with toJSON
+ * is checked as what toJSON returns, as stringify serializes it (toJSON is called once).
+ *
+ * `walk.path` holds the objects from the page down to `value`, entered and left (ISSUE-0006
+ * A13): a cycle is refused at once, where it used to be walked down to the depth limit through
+ * every branch (`a.left = a; a.right = a` is 2^512 visits), while an object used twice side by
+ * side is no cycle and is checked each time, as JSON repeats it. `walk.visits` bounds the rest.
  */
-function checkJson(value, depth) {
-    if (depth > 512)
-        return; // deeper than this is a cycle or abuse; stringify reports it
+function checkJson(value, depth, walk) {
+    if (depth > MAX_DEPTH || ++walk.visits > MAX_VISITS)
+        return;
+    walk.path.add(value);
     if (Array.isArray(value)) {
         for (let index = 0; index < value.length; index++)
-            checkValue(value[index], index, depth);
-        return;
+            checkValue(value[index], index, depth, walk, false);
+    }
+    else {
+        const object = value;
+        for (const key in object) {
+            if (!Object.hasOwn(object, key))
+                continue;
+            const item = object[key];
+            // Only an object a toJSON returned can have its own toJSON here: stringify does not call
+            // it again and leaves the method out, which is no data.
+            if (key === 'toJSON' && typeof item === 'function')
+                continue;
+            checkValue(item, key, depth, walk, false);
+        }
     }
-    const object = value;
-    for (const key in object)
-        if (Object.hasOwn(object, key))
-            checkValue(object[key], key, depth);
+    walk.path.delete(value);
 }
-function checkValue(value, key, depth) {
-    const type = typeof value;
-    if (type === 'string' || type === 'boolean')
+function checkValue(value, key, depth, walk, fromToJSON) {
+    if (typeof value !== 'object' || value === null) {
+        checkScalar(value);
         return;
-    if (type === 'number') {
-        if (Number.isFinite(value))
-            return;
     }
-    else if (type === 'object') {
-        if (value === null)
-            return;
-        const json = value.toJSON;
-        if (typeof json === 'function')
-            checkValue(json.call(value, String(key)), key, depth);
-        else
-            checkJson(value, depth + 1);
+    const json = fromToJSON ? undefined : value.toJSON;
+    if (typeof json === 'function') {
+        checkValue(json.call(value, String(key)), key, depth, walk, true);
         return;
     }
+    if (walk.path.has(value))
+        throw new TypeError(`Converting circular structure to JSON: page prop ${JSON.stringify(String(key))} leads back to an object that holds it`);
+    checkJson(value, depth + 1, walk);
+}
+/** A value that is not an object (or is null): JSON keeps it as it is, or it is refused. */
+function checkScalar(value) {
+    const type = typeof value;
+    if (type === 'string' || type === 'boolean' || value === null)
+        return;
+    if (type === 'number' && Number.isFinite(value))
+        return;
     throw new InertiaUsageError('INVALID_PROPS', UNSUPPORTED);
 }
 export class InertiaResponder {
@@ -292,15 +319,22 @@ export class InertiaResponder {
             ...(pageFlash && Object.keys(pageFlash).length ? { flash: pageFlash } : {}),
         };
         // Reject unsupported values rather than silently dropping application data (D-0047).
-        if (this.#deepCheck)
-            checkJson(page, 0);
+        if (this.#deepCheck) {
+            const walk = { path: new WeakSet(), visits: 0 };
+            checkJson(page, 0, walk);
+            if (walk.visits > MAX_VISITS && logger?.isEnabled('debug'))
+                logger.log('debug', 'Inertia props check stopped at its visit limit', {
+                    component,
+                    visits: MAX_VISITS,
+                });
+        }
         else
             for (const key in resolved) {
                 // Shallow: a missing (undefined) or non-JSON top-level prop, the usual mistake.
                 const value = resolved[key];
                 if (value === null || typeof value === 'object')
                     continue;
-                checkValue(value, key, 1);
+                checkScalar(value);
             }
         const json = JSON.stringify(page);
         if (logger?.isEnabled('debug') && (sealer || clearHistory))
@@ -413,6 +447,24 @@ export class InertiaResponder {
     }
 }
 const RESCUED = Symbol('rescued');
+/**
+ * An ordinary object with the Map's entries as own keys (JSON.stringify keeps its fast path, see
+ * the page props); `__proto__` is defined as an own key, never assigned.
+ */
+function record(entries) {
+    const result = {};
+    for (const [key, value] of entries)
+        if (key === '__proto__')
+            Object.defineProperty(result, key, {
+                value,
+                enumerable: true,
+                writable: true,
+                configurable: true,
+            });
+        else
+            result[key] = value;
+    return result;
+}
 /**
  * Which props this response computes and the page fields that announce the others, following
  * the official adapters (D-0052): a partial reload selects by only/except and announces only the
@@ -423,10 +475,12 @@ function buildMetadata(props, partial, only, except, reset, held) {
     const selected = [];
     const lazy = [];
     const skippedOnce = [];
-    const deferredProps = {};
+    // Group names and once keys come from the app: Maps, so `constructor`, `toString` or
+    // `__proto__` are names like any other, not Object.prototype members.
+    const deferredProps = new Map();
     const lists = { append: [], prepend: [], deep: [] };
     const matchPropsOn = [];
-    const onceProps = {};
+    const onceProps = new Map();
     let announced = false;
     const now = Date.now();
     for (const [key, input] of Object.entries(props)) {
@@ -447,10 +501,10 @@ function buildMetadata(props, partial, only, except, reset, held) {
             }
             const onceKey = prop.once ? (prop.once.key ?? key) : undefined;
             if (prop.once && onceKey !== undefined)
-                onceProps[onceKey] = {
+                onceProps.set(onceKey, {
                     prop: key,
                     expiresAt: prop.once.ttlMs === undefined ? null : now + prop.once.ttlMs,
-                };
+                });
             if (!partial) {
                 // The client keeps its value (also for a deferred once prop: nothing to fetch).
                 if (onceKey !== undefined && held.has(onceKey)) {
@@ -458,9 +512,11 @@ function buildMetadata(props, partial, only, except, reset, held) {
                     continue;
                 }
                 if (prop.group !== undefined) {
-                    const group = deferredProps[prop.group] ?? [];
-                    group.push(key);
-                    deferredProps[prop.group] = group;
+                    const group = deferredProps.get(prop.group);
+                    if (group)
+                        group.push(key);
+                    else
+                        deferredProps.set(prop.group, [key]);
                     continue;
                 }
             }
@@ -470,8 +526,8 @@ function buildMetadata(props, partial, only, except, reset, held) {
         selected.push([key, value, prop]);
     }
     const page = {};
-    if (Object.keys(deferredProps).length)
-        page.deferredProps = deferredProps;
+    if (deferredProps.size)
+        page.deferredProps = record(deferredProps);
     if (lists.append.length)
         page.mergeProps = lists.append;
     if (lists.prepend.length)
@@ -480,7 +536,7 @@ function buildMetadata(props, partial, only, except, reset, held) {
         page.deepMergeProps = lists.deep;
     if (matchPropsOn.length)
         page.matchPropsOn = matchPropsOn;
-    if (Object.keys(onceProps).length)
-        page.onceProps = onceProps;
+    if (onceProps.size)
+        page.onceProps = record(onceProps);
     return { selected, lazy, skippedOnce, page, announced, rescued: [] };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dokebi/template-inertia",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Inertia v3 server adapter for Dokebi: page JSON, Vite manifest assets and optional server-side rendering.",
   "keywords": [
     "dokebi",
@@ -41,7 +41,7 @@
   },
   "peerDependencies": {
     "@dokebi/core": "^0.4.0",
-    "@dokebi/web": "^0.4.0",
+    "@dokebi/web": "^0.4.2",
     "fastify": "^5.12.7"
   },
   "dokebi": {
@@ -51,7 +51,7 @@
     "dependencies": [
       {
         "name": "dokebi-web",
-        "version": "^0.4.0"
+        "version": "^0.4.2"
       },
       {
         "name": "dokebi-session",
@@ -113,8 +113,8 @@
     ]
   },
   "devDependencies": {
-    "@dokebi/session": "0.4.0",
-    "@dokebi/web": "0.4.0"
+    "@dokebi/session": "0.4.1",
+    "@dokebi/web": "0.4.2"
   },
   "publishConfig": {
     "access": "public",