@dokebi/template-inertia 0.4.1 → 0.4.4

package/dist/index.js

@@ -1,22 +1,60 @@
 import { createHash } from 'node:crypto';
-import { existsSync } from 'node:fs';
+import { createReadStream, existsSync } from 'node:fs';
 import { readFile, stat } from 'node:fs/promises';
+import { isIP } from 'node:net';
 import { basename, dirname, extname, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { types } from 'node:util';
 import { definePlugin, optionalDependency, providerDependency, } from '@dokebi/core';
 import { diagnostics } from '@dokebi/core/libraries';
 import { formBackTarget, formOldInput } from '@dokebi/web';
-import { viewEngines } from '@dokebi/web/points';
+import { collectViewData, pluginRouteIds, viewData, viewEngines, } from '@dokebi/web/points';
+import { bootHashes } from './boot-fallback.js';
+import { builtFolderFile, HASHED } from './built-files.js';
 import { InertiaError, InertiaUsageError } from './errors.js';
 import { options } from './options.js';
 import { InertiaResponder, normalizeInertiaOptions, vary, } from './responder.js';
-import { openViteDev, viteDevRequested } from './vite-dev.js';
+import { isViteUpgrade, openViteDev, viteDevRequested } from './vite-dev.js';
+import { DEV_CLIENT_HEADER, isLoopbackHost, isRemoteRequest } from './vite-files.js';
 export { InertiaError, InertiaUsageError, } from './errors.js';
 export { options } from './options.js';
 export { deepMerge, defer, InertiaProp, isInertiaProp, merge, once, } from './props.js';
-const MANIFEST_MAX_BYTES = 4 * 1024 * 1024;
+/** The SSR render deadline when `ssr.timeoutMs` is not set (D-0107 §4); the schema's default. */
+const SSR_TIMEOUT_MS = 5000;
+const SSR_TIMEOUT_MAX_MS = 600_000;
+/** A scope's `app` (a log field): 1-64 printable ASCII characters, no control characters. */
+const SCOPE_APP = /^[\x20-\x7e]{1,64}$/;
+/**
+ * Route config of the built files and the Vite dev modules (D-0097 §1): a login page loads them
+ * before anyone is signed in, so they are public under `dokebi-auth.default: required` too. Read
+ * by @dokebi/auth only; without it the key is ignored. With the route id (D-0142). Served while
+ * a required health check is down or the app drains (`readiness: false`): the files need no
+ * database, and a page with `readiness: false` must open during an outage (community request A5).
+ */
+const publicAsset = (ids, key) => ids.config(key, { auth: false, readiness: false });
+/**
+ * The bytes of a built file to keep, or null when it is larger than `maxBytes`
+ * (`assetCacheMaxBytes`; streamed per request).
+ */
+async function builtAsset(file, maxBytes) {
+    const info = await stat(file);
+    return info.size > maxBytes ? null : readFile(file);
+}
 const { describeError, Repeats } = diagnostics;
+/**
+ * The bytes a client sent after its upgrade request, as @fastify/websocket kept them for a route
+ * (its private `Symbol('ws-head')`, 11.x); empty when there are none. A WebSocket client waits for
+ * the 101 before sending, so this is usually empty.
+ */
+function upgradeHead(request) {
+    for (const symbol of Object.getOwnPropertySymbols(request))
+        if (symbol.description === 'ws-head') {
+            const head = request[symbol];
+            if (Buffer.isBuffer(head))
+                return head;
+        }
+    return Buffer.alloc(0);
+}
 function parseVite(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input) || types.isProxy(input))
         throw new InertiaUsageError('INVALID_SCOPE', 'Invalid Inertia vite options');
@@ -36,14 +74,90 @@ function parseSsr(input) {
         return undefined;
     if (input === null || typeof input !== 'object' || Array.isArray(input) || types.isProxy(input))
         throw new InertiaUsageError('INVALID_SCOPE', 'Invalid Inertia ssr options');
-    const { bundle, failure = 'fallback', entry, ...rest } = input;
+    const { bundle, failure = 'fallback', entry, timeoutMs = SSR_TIMEOUT_MS, ...rest } = input;
     if (Object.keys(rest).length ||
         typeof bundle !== 'string' ||
         !bundle ||
         (failure !== 'fallback' && failure !== 'error') ||
-        (entry !== undefined && (typeof entry !== 'string' || !entry || entry.includes('..'))))
+        (entry !== undefined && (typeof entry !== 'string' || !entry || entry.includes('..'))) ||
+        !Number.isInteger(timeoutMs) ||
+        timeoutMs < 1 ||
+        timeoutMs > SSR_TIMEOUT_MAX_MS)
         throw new InertiaUsageError('INVALID_SCOPE', 'Invalid Inertia ssr options');
-    return Object.freeze({ bundle, failure, ...(entry ? { entry: entry } : {}) });
+    return Object.freeze({
+        bundle,
+        failure,
+        timeoutMs: timeoutMs,
+        ...(entry ? { entry: entry } : {}),
+    });
+}
+/**
+ * One render under the deadline (D-0107 §4). A render that passes it fails with `SSR_TIMEOUT`;
+ * the request goes on (fallback or error, as `failure` says) and the late outcome is only logged.
+ * Only a render that waits (I/O, the Vite host) can be cut: synchronous work blocks the process.
+ */
+function renderWithin(render, page, timeoutMs, late) {
+    const began = performance.now();
+    return new Promise((resolve, reject) => {
+        let expired = false;
+        const timer = setTimeout(() => {
+            expired = true;
+            reject(new InertiaError('SSR_TIMEOUT', `Inertia SSR render of ${page.component} took longer than ${timeoutMs} ms (ssr.timeoutMs)`, { data: { component: page.component, timeoutMs } }));
+        }, timeoutMs);
+        Promise.resolve()
+            .then(() => render(page))
+            .then((result) => {
+            if (expired)
+                late('resolved', Math.round(performance.now() - began));
+            else {
+                clearTimeout(timer);
+                resolve(result);
+            }
+        }, (error) => {
+            if (expired)
+                late('rejected', Math.round(performance.now() - began), error);
+            else {
+                clearTimeout(timer);
+                reject(error);
+            }
+        });
+    });
+}
+/**
+ * The Vite dev routes answer loopback names, IP addresses (a page of another site cannot get
+ * either as its own origin through DNS rebinding), the domains of @dokebi/app and `devHosts`
+ * (exact names; `.example.com` also allows its subdomains), like Vite's `allowedHosts`.
+ * Nothing is learned from requests, so the set never grows (D-0107 §5).
+ */
+class DevHosts {
+    #exact;
+    #suffixes;
+    constructor(appDomains, configured) {
+        const exact = new Set(appDomains.map((host) => host.toLowerCase().replace(/:\d+$/, '')));
+        const suffixes = [];
+        for (const host of configured) {
+            const name = host.toLowerCase();
+            if (name.startsWith('.')) {
+                suffixes.push(name);
+                exact.add(name.slice(1));
+            }
+            else
+                exact.add(name);
+        }
+        this.#exact = exact;
+        this.#suffixes = Object.freeze(suffixes);
+    }
+    /** Some of the names, for a debug log. */
+    sample() {
+        return [...this.#exact].slice(0, 64);
+    }
+    allows(host) {
+        return (host === 'localhost' ||
+            host.endsWith('.localhost') ||
+            isIP(host) !== 0 ||
+            this.#exact.has(host) ||
+            this.#suffixes.some((suffix) => host.endsWith(suffix)));
+    }
 }
 /**
  * Imports the SSR bundle. A missing file or a bundle without `render` stops the start: SSR that
@@ -86,30 +200,45 @@ const CONTENT_TYPES = {
  * Reads the manifest once and returns the document asset settings for the entry, plus the built
  * files the entry can load (its chunks, their CSS and assets) so they can be served.
  */
-async function viteAssets(vite) {
+async function viteAssets(vite, maxBytes) {
     const path = resolve(vite.manifest);
     const info = await stat(path).catch((cause) => {
         if (cause.code !== 'ENOENT')
             throw cause;
         throw new InertiaError('VITE_MANIFEST_MISSING', `Vite manifest not found: ${vite.manifest}. Build the views first (npm run build).`, { cause });
     });
-    if (!info.isFile() || info.size > MANIFEST_MAX_BYTES)
-        throw new InertiaError('VITE_MANIFEST_INVALID', 'Invalid Vite manifest file');
+    if (!info.isFile() || info.size > maxBytes)
+        throw new InertiaError('VITE_MANIFEST_INVALID', info.isFile()
+            ? `Vite manifest is larger than viteManifestMaxBytes (${maxBytes})`
+            : 'Invalid Vite manifest file');
     // Vite writes <outDir>/.vite/manifest.json; a custom manifest name sits in outDir itself.
     const outDir = basename(dirname(path)) === '.vite' ? dirname(dirname(path)) : dirname(path);
     const text = await readFile(path, 'utf8');
-    const manifest = JSON.parse(text);
+    let manifest;
+    try {
+        manifest = JSON.parse(text);
+    }
+    catch (cause) {
+        throw new InertiaError('VITE_MANIFEST_INVALID', `Vite manifest ${vite.manifest} is not JSON. Build the views again (npm run build).`, { cause });
+    }
+    if (manifest === null || typeof manifest !== 'object' || Array.isArray(manifest))
+        throw new InertiaError('VITE_MANIFEST_INVALID', `Vite manifest ${vite.manifest} is not an object of chunks`);
     const entry = Object.hasOwn(manifest, vite.entry) ? manifest[vite.entry] : undefined;
     if (entry?.isEntry !== true || typeof entry.file !== 'string')
         throw new InertiaError('VITE_MANIFEST_INVALID', 'Vite manifest has no entry ' + JSON.stringify(vite.entry));
     const styles = [];
     const files = new Map();
+    const folders = new Map();
     const strings = (value) => Array.isArray(value) ? value.filter((item) => typeof item === 'string') : [];
     const serve = (file) => {
         // Manifest paths are relative to outDir; anything that leaves it is not served.
         if (typeof file !== 'string' || file.split('/').some((part) => part === '..' || !part))
             return;
         files.set(vite.base + file, join(outDir, file));
+        // A file in outDir itself names no folder: outDir also holds .vite/ and ssr/, never served.
+        const folder = file.includes('/') ? file.slice(0, file.lastIndexOf('/')) : undefined;
+        if (folder && !folder.split('/').some((part) => part.startsWith('.')))
+            folders.set(`${vite.base}${folder}/`, join(outDir, folder));
     };
     const seen = new Set();
     // Static imports decide the document CSS; dynamic imports are only served.
@@ -139,6 +268,7 @@ async function viteAssets(vite) {
         styles,
         version: createHash('sha256').update(text).digest('hex').slice(0, 32),
         files,
+        folders,
     };
 }
 /**
@@ -154,13 +284,14 @@ function hasCookie(header, name) {
     return text.split(';').some((part) => part.slice(0, part.indexOf('=')).trim() === name);
 }
 /**
- * dokebi-web 0.4.1 or later: the validation redirect uses its form helpers (`formBackTarget`,
- * `formOldInput`, D-0074 addendum 1), shared with @dokebi/app. A local descriptor instead of
+ * dokebi-web 0.4.3 or later: the validation redirect uses its form helpers (`formBackTarget`,
+ * `formOldInput`, D-0074 addendum 1), shared with @dokebi/app; 0.4.2 never answers a Referer
+ * path that reads as another host (ISSUE-0006 A02); 0.4.3 has the view data point (D-0076 §5). A local descriptor instead of
  * '@dokebi/web/dependency' (whose range stays ^0.4.0 for the plugins that need nothing newer).
  */
 const web = providerDependency({
     name: 'dokebi-web',
-    version: '^0.4.1',
+    version: '^0.4.3',
     packageName: '@dokebi/web',
     load: () => import('@dokebi/web'),
 });
@@ -172,19 +303,32 @@ const session = optionalDependency({
 function sealSsrConflict() {
     return new InertiaError('SEAL_SSR_CONFLICT', 'An Inertia scope of seal hosts cannot use SSR: server rendering writes the props as plain HTML. Set ssr: false for this app or drop seal from its hosts.');
 }
+/** The boot text of a scope for its debug record: the CSP hashes of its inline style and script. */
+function bootLog(options) {
+    const boot = options.bootFallback;
+    return boot.enabled
+        ? { timeoutMs: boot.timeoutMs, cspHashes: bootHashes(options.rootId, boot.timeoutMs) }
+        : false;
+}
 /** Settings of the parsed options (the declaration checked them, D-0063 §3). */
 function settings(parsed) {
-    const { vite, ssr, ...rest } = parsed;
+    const { vite, ssr, devHosts = [], viteManifestMaxBytes = 4_194_304, assetCacheMaxBytes = 4_194_304, logRepeatWindowMs = 10_000, 
+    // Read by the Vite dev host of dokebi dev (vite-host.ts, D-0128), not by the app.
+    devDepsRepairIntervalMs: _devDepsRepairIntervalMs, routeIds, ...rest } = parsed;
     const document = normalizeInertiaOptions(rest);
     return Object.freeze({
         document,
+        routeIds: pluginRouteIds('dokebi-template-inertia', ['assets', 'viteDev'], routeIds),
+        limits: Object.freeze({ viteManifestMaxBytes, assetCacheMaxBytes, logRepeatWindowMs }),
         defaultVersion: vite === undefined && rest.version === undefined,
+        devHosts: Object.freeze([...devHosts]),
         ...(vite ? { vite: Object.freeze({ ...vite }) } : {}),
         ...(ssr
             ? {
                 ssr: Object.freeze({
                     bundle: ssr.bundle,
                     failure: ssr.failure,
+                    timeoutMs: ssr.timeoutMs,
                     ...(ssr.entry ? { entry: ssr.entry } : {}),
                 }),
             }
@@ -223,23 +367,34 @@ class InertiaRuntime {
         this.shared = shared;
     }
     async setup(context) {
-        if (this.settings.defaultVersion)
-            context.logger.log('warn', 'Inertia asset version is not configured', {
-                code: 'INERTIA_VERSION_DEFAULT',
-            });
         const server = context.getDependency(web);
         const logger = context.logger;
+        // D-0076 §5: plugin view data (dokebi-auth `auth`) under the entry's shared props.
+        const pluginData = collectViewData(context.collect(viewData), {
+            plugin: 'dokebi-template-inertia',
+            reserved: ['errors', 'flash'],
+        });
+        const entryShared = this.shared;
+        const shared = !pluginData.keys.length
+            ? entryShared
+            : entryShared
+                ? async (request) => ({
+                    ...(await pluginData.values(request)),
+                    ...(await entryShared(request)),
+                })
+                : async (request) => (await pluginData.values(request));
         const sessions = context.getOptionalDependency(session);
+        const sessionOf = (request) => 
+        // Static paths excluded by the session plugin have none (`request.session` is null).
+        request.session ? sessions?.of(request) : undefined;
+        // A page on an excluded path has no flash (`of` would throw NOT_ATTACHED there).
         const flash = sessions
-            ? async (request) => (await sessions.of(request).takeFlash())
+            ? async (request) => ((await sessionOf(request)?.takeFlash()) ?? {})
             : undefined;
         // D-0062: sealed requests (dokebi-web decides) and the session's history reset (logout, login).
         // A page shown in the request that reset uses it at once; otherwise the reset cookie carries
         // it to the next page, which also clears that cookie.
         const resets = new WeakMap();
-        const sessionOf = (request) => 
-        // Static paths excluded by the session plugin have none (`request.session` is null).
-        request.session ? sessions?.of(request) : undefined;
         const hooks = Object.freeze({
             sealOf: (request) => server.sealOf(request),
             ...(sessions
@@ -254,7 +409,7 @@ class InertiaRuntime {
                     // D-0074 §3: flash errors and old input, 303 back; the next page gets `errors`.
                     validation: async (request, reply, errors) => {
                         const current = sessionOf(request);
-                        const target = formBackTarget(request, server.requestHost(request), '/');
+                        const target = formBackTarget(request, server.requestHost(request), '/', server.formLimits);
                         if (!current?.flash || target === undefined) {
                             if (logger.isEnabled('debug'))
                                 logger.log('debug', 'Inertia validation answered as JSON', {
@@ -265,7 +420,7 @@ class InertiaRuntime {
                             return false;
                         }
                         await current.flash('errors', { ...errors });
-                        const old = formOldInput(request.body);
+                        const old = formOldInput(request.body, server.formLimits);
                         if (old)
                             await current.flash('old', old);
                         if (logger.isEnabled('debug'))
@@ -306,12 +461,26 @@ class InertiaRuntime {
         // Development (D-0045): one Vite for every scope, reached by the first `vite` (the host of
         // `dokebi dev`, shared by every worker, or one started in this process).
         const develop = viteDevRequested();
+        // D-0149: the HMR socket of the Vite dev host is on its own port of the page's host name;
+        // the default CSP (connect-src 'self') would block it. When the dev host restarts, Vite's
+        // client pings it from a `blob:` SharedWorker, which script-src would block without
+        // worker-src (community request A4). Development only.
+        if (develop)
+            server.contentSecurityPolicy({
+                plugin: 'dokebi-template-inertia',
+                directives: {
+                    'connect-src': ['ws://*:*', 'wss://*:*'],
+                    'worker-src': ["'self'", 'blob:'],
+                },
+            });
         logger.log('debug', 'Inertia settings resolved', {
             develop,
             vite: this.settings.vite ? { ...this.settings.vite } : false,
             ssr: this.settings.ssr ? { ...this.settings.ssr } : false,
+            devHosts: this.settings.devHosts.length,
             defaultVersion: this.settings.defaultVersion,
-            shared: this.shared !== undefined,
+            shared: entryShared !== undefined,
+            viewData: pluginData.keys,
             flash: flash !== undefined,
             historyReset: hooks.historyReset !== undefined,
             encryptHistory: this.settings.document.encryptHistory,
@@ -319,30 +488,109 @@ class InertiaRuntime {
             propsCheck: process.env.NODE_ENV === 'production' ? 'top-level' : 'deep',
         });
         // Per-request failures are logged once per interval with the count of repeats (D-0047).
-        const repeats = new Repeats();
+        const limits = this.settings.limits;
+        const routeIds = this.settings.routeIds;
+        const repeats = new Repeats({ intervalMs: limits.logRepeatWindowMs });
         let devServer;
         const devBases = new Set();
-        // Vite refuses hosts other than localhost (DNS rebinding). Its check is off; instead the dev
-        // routes serve loopback names, the domains of @dokebi/app (the same in every cluster worker)
-        // and hosts this process answered with an Inertia page. An app domain (a.com through a hosts
-        // file or a tunnel) works; an unknown host does not.
+        // Vite refuses hosts it does not know (DNS rebinding). Its check is off (one Vite serves
+        // every app); instead the dev routes check the host themselves: loopback names, IPs, the
+        // domains of @dokebi/app (the same in every cluster worker) and `devHosts` (D-0107 §5).
         const appDomains = context.app.config['dokebi-app']
             ?.domains;
-        const pageHosts = new Set(Object.keys(appDomains ?? {}).map((host) => host.toLowerCase().replace(/:\d+$/, '')));
+        const devHosts = new DevHosts(Object.keys(appDomains ?? {}), this.settings.devHosts);
         const hostName = (request) => server
             .requestHost(request)
+            .toLowerCase()
             .replace(/:\d+$/, '')
             .replace(/^\[(.*)\]$/, '$1');
-        const devHostAllowed = (host) => host === 'localhost' ||
-            host.endsWith('.localhost') ||
-            host === '::1' ||
-            /^127\.\d+\.\d+\.\d+$/.test(host) ||
-            pageHosts.has(host);
         // Registered now: scopes are created later, from other plugins' setup.
         context.defer(async () => {
             if (devServer)
                 await (await devServer).close();
         });
+        // HMR through the page's own origin (2026-10-28): Vite's client connects to `<base>` on the
+        // port the page came from (a tunnel's 443, a proxy, `localhost:<app port>`), and this process
+        // joins that upgrade to the Vite host on loopback. The same host check as the dev routes
+        // runs first, and Vite checks its token. Upgrades reach Fastify only through a WebSocket
+        // plugin's listener (@fastify/websocket routes them); without one this listener takes them.
+        let nodeServer;
+        const VITE_UPGRADE = Symbol.for('dokebi.template-inertia.vite-upgrade');
+        const devBaseOf = (url) => {
+            const path = (url ?? '').split('?', 1)[0] ?? '';
+            for (const base of devBases)
+                if (path.startsWith(base))
+                    return base;
+            return undefined;
+        };
+        const reportUpgrade = (base) => (failure) => {
+            const repeated = repeats.take(`vite upgrade ${failure instanceof Error ? failure.name : typeof failure}`);
+            if (repeated !== undefined)
+                logger.log('error', 'Vite HMR socket could not reach the Vite dev host', {
+                    code: 'INERTIA_VITE_DEV_FAILED',
+                    base,
+                    error: describeError(failure),
+                    ...(repeated ? { repeated } : {}),
+                });
+        };
+        /** Joins one Vite upgrade to the host after the dev routes' host check. */
+        const joinUpgrade = (request, socket, head, base) => {
+            const host = hostName(request);
+            if (!devHosts.allows(host)) {
+                if (logger.isEnabled('debug'))
+                    logger.log('debug', 'Vite HMR upgrade refused a host', {
+                        host: host.slice(0, 253),
+                        base,
+                    });
+                socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
+                return;
+            }
+            const opened = devServer;
+            if (!opened) {
+                socket.destroy();
+                return;
+            }
+            opened.then((vite) => vite.upgrade(request, socket, head, reportUpgrade(base)), (error) => {
+                reportUpgrade(base)(error);
+                socket.destroy();
+            });
+        };
+        /** Upgrade listeners that own upgrades besides this one (dokebi-web's own only marks). */
+        const otherUpgradeOwners = () => (nodeServer?.listeners('upgrade') ?? []).some((listener) => listener !== onUpgrade &&
+            listener[Symbol.for('dokebi.web.upgrade-mark')] !== true);
+        function onUpgrade(request, socket, head) {
+            const base = devBaseOf(request.url);
+            if (otherUpgradeOwners()) {
+                // A WebSocket plugin routes every upgrade through Fastify: the dev route joins Vite's
+                // there (after web's request hooks), so the socket has one owner.
+                return;
+            }
+            if (base !== undefined && isViteUpgrade(request)) {
+                request[VITE_UPGRADE] = true;
+                joinUpgrade(request, socket, head, base);
+                return;
+            }
+            // This listener is the only owner: without it Node would have answered the upgrade as a
+            // plain request, and no route here upgrades it.
+            if (logger.isEnabled('debug'))
+                logger.log('debug', 'Upgrade that is not Vite HMR refused in development', {
+                    path: String(request.url ?? '')
+                        .split('?', 1)[0]
+                        ?.slice(0, 200),
+                });
+            socket.end('HTTP/1.1 404 Not Found\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
+        }
+        if (develop) {
+            // The Node server comes with a Fastify scope (WebApi has no server of its own to hand out).
+            server.register(async (scope) => {
+                nodeServer = scope.server;
+                nodeServer.prependListener('upgrade', onUpgrade);
+                logger.log('debug', 'Vite HMR upgrades are joined through the app port');
+            }, {});
+            context.defer(async () => {
+                nodeServer?.removeListener('upgrade', onUpgrade);
+            });
+        }
         const viteDev = (base) => {
             if (!devServer) {
                 const begin = performance.now();
@@ -351,7 +599,8 @@ class InertiaRuntime {
                     logger.log('debug', 'Vite dev server ready', {
                         ms: Math.round(performance.now() - begin),
                         shared: process.env.DOKEBI_VITE_DEV_URL !== undefined,
-                        hosts: [...pageHosts].slice(0, 64),
+                        hosts: devHosts.sample(),
+                        configured: this.settings.devHosts.length,
                     });
                     return opened;
                 });
@@ -366,19 +615,40 @@ class InertiaRuntime {
                 server.route({
                     method: 'GET', // Fastify adds HEAD
                     url: `${base}*`,
+                    config: publicAsset(routeIds, 'viteDev'),
                     handler: async (request, reply) => {
+                        // An HMR upgrade a WebSocket plugin routed here (see onUpgrade): joined to the host
+                        // with the socket it arrived on; nothing is answered through Fastify.
+                        const raw = request.raw;
+                        if (raw.upgrade === true && isViteUpgrade(raw)) {
+                            reply.hijack();
+                            joinUpgrade(raw, raw.socket, upgradeHead(raw), base);
+                            return;
+                        }
                         const host = hostName(request);
-                        if (!devHostAllowed(host)) {
+                        if (!devHosts.allows(host)) {
                             if (logger.isEnabled('debug'))
                                 logger.log('debug', 'Vite dev route refused a host', {
                                     host: host.slice(0, 253),
                                     base,
+                                    routeId: routeIds.ids.viteDev,
                                 });
                             return reply
                                 .code(403)
                                 .type('text/plain; charset=utf-8')
-                                .send('This host has not been served an Inertia page by this app.');
+                                .send('This host may not load the development views. Add it to devHosts of dokebi-template-inertia (or to the domains of @dokebi/app).');
                         }
+                        // D-0129: the Vite host answers a remote client (a devHosts tunnel, a proxy, a LAN
+                        // address) a short 403 without paths and no open-in-editor. Loopback only when the
+                        // socket peer is loopback, no forwarding header is present and the host name judged
+                        // here (trust-proxy aware) is a loopback name (§12: a tunnel connects from loopback
+                        // and may rewrite Host to localhost). What the browser sent in the header is replaced.
+                        delete request.raw.headers[DEV_CLIENT_HEADER];
+                        request.raw.headers[DEV_CLIENT_HEADER] =
+                            isLoopbackHost(host) &&
+                                !isRemoteRequest(request.raw.headers, request.raw.socket.remoteAddress)
+                                ? 'loopback'
+                                : 'remote';
                         const vite = await current;
                         reply.hijack();
                         // Status, headers and body as the Vite host sent them (504 included).
@@ -394,13 +664,21 @@ class InertiaRuntime {
                         });
                     },
                 });
-                logger.log('debug', 'Vite dev route registered', { url: `${base}*` });
+                logger.log('debug', 'Vite dev route registered', {
+                    url: `${base}*`,
+                    routeId: routeIds.ids.viteDev,
+                });
             }
             return current;
         };
         // Built files are served at their exact URL (no wildcard), once even if apps share chunks.
         const served = new Set();
+        const loaded = new Set();
+        // D-0077 B: `dokebi describe` never serves a page: the build is not needed (or read).
+        const describing = context.runtime.describing === true;
         const built = async (options) => {
+            if (describing)
+                return { scripts: [], styles: [], version: 'describe' };
             if (develop) {
                 await viteDev(options.base);
                 return {
@@ -409,7 +687,7 @@ class InertiaRuntime {
                     version: 'dev',
                 };
             }
-            const { files, ...assets } = await viteAssets(options);
+            const { files, folders, ...assets } = await viteAssets(options, limits.viteManifestMaxBytes);
             logger.log('debug', 'Vite manifest read', {
                 manifest: options.manifest,
                 entry: options.entry,
@@ -423,15 +701,71 @@ class InertiaRuntime {
                     continue;
                 served.add(url);
                 const type = CONTENT_TYPES[extname(file).toLowerCase()] ?? 'application/octet-stream';
+                // Built files are hashed and immutable, and the manifest is read once at start: each is
+                // read on its first request and kept (one read shared by concurrent requests). A file
+                // above assetCacheMaxBytes is streamed instead of held. A failed read is not kept.
+                let content;
                 server.route({
                     method: 'GET',
                     url,
-                    handler: async (_request, reply) => reply
-                        .type(type)
-                        .header('cache-control', 'public, max-age=31536000, immutable')
-                        .send(await readFile(file)),
+                    config: publicAsset(routeIds, 'assets'),
+                    handler: async (_request, reply) => {
+                        const loading = content ?? builtAsset(file, limits.assetCacheMaxBytes);
+                        content = loading;
+                        let body;
+                        try {
+                            body = await loading;
+                        }
+                        catch (error) {
+                            if (content === loading)
+                                content = undefined;
+                            throw error;
+                        }
+                        if (logger.isEnabled('debug') && !loaded.has(url)) {
+                            loaded.add(url);
+                            logger.log('debug', 'Vite built file loaded', {
+                                url,
+                                cached: body !== null,
+                                bytes: body?.length ?? null,
+                            });
+                        }
+                        return reply
+                            .type(type)
+                            .header('cache-control', 'public, max-age=31536000, immutable')
+                            .send(body ?? createReadStream(file));
+                    },
                 });
             }
+            // A rolling deploy runs two builds at once: a page of the new build loads its chunks from
+            // workers that read the old manifest, and a page of the old one the other way round. Every
+            // worker therefore also serves the other hashed files of the build folders (a deploy keeps
+            // the chunks of the previous builds: vite build.emptyOutDir false), streamed from disk;
+            // the manifest, .vite/, ssr/ and anything outside those folders stay unserved.
+            for (const [prefix, folder] of folders) {
+                const url = `${prefix}*`;
+                if (served.has(url))
+                    continue;
+                served.add(url);
+                server.route({
+                    method: 'GET',
+                    url,
+                    config: publicAsset(routeIds, 'assets'),
+                    handler: async (request, reply) => {
+                        const file = await builtFolderFile(folder, request.params['*']);
+                        if (!file)
+                            return reply.code(404).send({ error: 'NOT_FOUND' });
+                        if (logger.isEnabled('debug'))
+                            logger.log('debug', 'Vite built file served from its folder', {
+                                url: request.url.split('?', 1)[0]?.slice(0, 200),
+                            });
+                        return reply
+                            .type(CONTENT_TYPES[extname(file).toLowerCase()] ?? 'application/octet-stream')
+                            .header('cache-control', HASHED.test(file) ? 'public, max-age=31536000, immutable' : 'no-cache')
+                            .send(createReadStream(file));
+                    },
+                });
+                logger.log('debug', 'Vite build folder served', { url, folder });
+            }
             return assets;
         };
         const document = this.settings.vite
@@ -444,7 +778,7 @@ class InertiaRuntime {
         const bundles = new Map();
         const stats = { renders: 0, failures: 0 };
         const serverRendering = async (ssr, vite) => {
-            if (!ssr)
+            if (!ssr || describing)
                 return undefined;
             let render;
             if (develop) {
@@ -460,7 +794,7 @@ class InertiaRuntime {
                     entrySet: ssr.entry !== undefined,
                 });
                 // The Vite host loads the source and renders (one Vite for every worker).
-                render = Promise.resolve(async (page) => (await (await dev).render(source, page)));
+                render = Promise.resolve(async (page) => (await (await dev).render(source, page, ssr.timeoutMs)));
             }
             else {
                 const path = resolve(ssr.bundle);
@@ -477,8 +811,44 @@ class InertiaRuntime {
                     });
                 }
             }
+            const bundleRender = await render;
+            const timeoutMs = ssr.timeoutMs;
+            // A render that settles after its deadline: the request already went on (D-0107 §4).
+            const late = (outcome, ms, error) => {
+                // In development the request to the Vite host is cut at the same deadline (vite-dev.ts):
+                // that end is the timeout already counted and logged, not a second failure.
+                if (outcome === 'rejected' &&
+                    error?.code === 'SSR_TIMEOUT') {
+                    if (logger.isEnabled('debug'))
+                        logger.log('debug', 'Inertia SSR render request cut at its deadline', {
+                            bundle: ssr.bundle,
+                            ms,
+                            timeoutMs,
+                        });
+                    return;
+                }
+                if (outcome === 'rejected') {
+                    const repeated = repeats.take(`ssr late ${ssr.bundle}`);
+                    if (repeated !== undefined)
+                        context.logger.log('error', 'Inertia SSR render failed after its deadline', {
+                            code: 'INERTIA_SSR_FAILED',
+                            bundle: ssr.bundle,
+                            ms,
+                            timeoutMs,
+                            error: describeError(error),
+                            ...(repeated ? { repeated } : {}),
+                        });
+                }
+                else if (logger.isEnabled('debug'))
+                    logger.log('debug', 'Inertia SSR render finished after its deadline', {
+                        bundle: ssr.bundle,
+                        ms,
+                        timeoutMs,
+                    });
+            };
+            logger.log('debug', 'Inertia SSR render deadline', { bundle: ssr.bundle, timeoutMs });
             return Object.freeze({
-                render: await render,
+                render: (page) => renderWithin(bundleRender, page, timeoutMs, late),
                 failure: ssr.failure,
                 rendered: () => {
                     stats.renders++;
@@ -506,14 +876,8 @@ class InertiaRuntime {
         });
         const api = (responder) => {
             responders.push(responder);
-            const render = responder.render.bind(responder);
             return Object.freeze({
-                render: develop
-                    ? (request, reply, component, props, options) => {
-                        pageHosts.add(hostName(request));
-                        return render(request, reply, component, props, options);
-                    }
-                    : render,
+                render: responder.render.bind(responder),
                 redirect: responder.redirect.bind(responder),
                 location: responder.location.bind(responder),
                 answerError: responder.answerError.bind(responder),
@@ -521,7 +885,7 @@ class InertiaRuntime {
         };
         // Prop evaluation (debug) and rescued deferred props (error) are logged by every scope.
         const diagnostics = Object.freeze({ logger, repeats });
-        const root = api(new InertiaResponder(document, this.shared, await serverRendering(this.settings.ssr, this.settings.vite), diagnostics, flash, hooks));
+        const root = api(new InertiaResponder(document, shared, await serverRendering(this.settings.ssr, this.settings.vite), diagnostics, flash, hooks));
         // D-0074 §3: Inertia requests refused by validation go back with `errors` (with a session);
         // the plugin's `errorPage` answers the rest. dokebi-app adds its own responder later, which
         // dokebi-web asks first, so an app's requests use the app's scope.
@@ -529,13 +893,35 @@ class InertiaRuntime {
         logger.log('debug', 'Inertia error answers', {
             validationRedirect: hooks.validation !== undefined,
             errorPage: document.errorPage,
+            bootFallback: bootLog(document),
         });
-        const shared = this.shared;
+        // INERTIA_VERSION_DEFAULT where pages really get the default version (2026-10-28: it was said
+        // at setup from the plugin's options alone, once per worker, also when every app template has
+        // its own vite; nothing said which app). A scope without vite or version, when the plugin has
+        // neither: at its creation, with the app. The plugin's own renderer: at its first render.
+        const VERSION_FIX = "set vite: { manifest, entry } (or version) in this app's inertia options (src/apps/<app>/app.ts), or in options.dokebi-template-inertia for every app";
+        let rootWarned = false;
+        const rootRender = (...args) => {
+            if (this.settings.defaultVersion && !rootWarned) {
+                rootWarned = true;
+                logger.log('warn', 'Inertia asset version is not configured', {
+                    code: 'INERTIA_VERSION_DEFAULT',
+                    where: 'plugin',
+                    fix: 'set vite: { manifest, entry } (or version) in options.dokebi-template-inertia',
+                });
+            }
+            return root.render(...args);
+        };
         const plugin = Object.freeze({
             ...root,
+            render: rootRender,
             ssrStats: () => Object.freeze({ ...stats }),
             scope: async (options) => {
-                const { shared: extra, vite, ssr: ssrInput, sealed = false, ...fields } = (options ?? {});
+                const { shared: extra, vite, ssr: ssrInput, sealed = false, app: appName, ...fields } = (options ?? {});
+                // Audit r6: `app` goes into log records as it is, so it is checked like the other fields
+                // (it used to be refused as an unknown key; anything was accepted once it became one).
+                if (appName !== undefined && (typeof appName !== 'string' || !SCOPE_APP.test(appName)))
+                    throw new InertiaUsageError('INVALID_SCOPE', 'Inertia scope app must be 1-64 printable ASCII characters');
                 if (typeof sealed !== 'boolean')
                     throw new InertiaUsageError('INVALID_SCOPE', 'Inertia scope sealed must be a boolean');
                 const ssr = ssrInput === undefined ? this.settings.ssr : parseSsr(ssrInput);
@@ -561,6 +947,15 @@ class InertiaRuntime {
                     : (extra ?? shared);
                 const scopedVite = vite === undefined ? this.settings.vite : parseVite(vite);
                 const responder = new InertiaResponder(scoped, merged, await serverRendering(ssr, scopedVite), diagnostics, flash, hooks);
+                // Once the scope is valid: a scope refused above serves no page with the default version.
+                if (this.settings.defaultVersion && vite === undefined && fields.version === undefined)
+                    logger.log('warn', 'Inertia asset version is not configured', {
+                        code: 'INERTIA_VERSION_DEFAULT',
+                        where: 'scope',
+                        app: appName ?? null,
+                        title: scoped.title.slice(0, 100),
+                        fix: VERSION_FIX,
+                    });
                 logger.log('debug', 'Inertia scope created', {
                     title: scoped.title,
                     rootId: scoped.rootId,
@@ -570,6 +965,7 @@ class InertiaRuntime {
                     sealed,
                     encryptHistory: scoped.encryptHistory,
                     errorPage: scoped.errorPage,
+                    bootFallback: bootLog(scoped),
                 });
                 return api(responder);
             },
@@ -584,11 +980,12 @@ class InertiaRuntime {
 }
 export const createPlugin = definePlugin({
     name: 'dokebi-template-inertia',
-    version: '0.4.1',
-    core: '^0.4.0',
+    version: '0.4.4',
+    core: '^0.4.2',
     options,
     entry: parseEntry,
     contributes: [viewEngines],
+    collects: [viewData],
     dependencies: () => [web, session],
     instance: ({ options, entry }) => new InertiaRuntime(settings(options), entry?.shared),
 });