@zerotal/inertia 1.7.5 → 1.8.0

package/CHANGELOG.md

@@ -8,6 +8,20 @@ follows the Zerotal monorepo's unified versioning.
 
 ## [Unreleased]
 
+## [1.8.0] — 2026-08-24
+
+### Fixed
+
+- **A `303` redirect was not marked as Inertia's, so the browser did nothing at all.**
+  `X-Inertia: true` was set inside the 302-to-303 conversion, so it only ever reached a
+  redirect arriving as a 301 or 302 from a non-GET handler. A handler returning the 303 the
+  protocol asks for skipped the only line that marked its response — and `redirect(to, 303)`
+  is exactly what `docs/authentication.md` tells people to write, in eight places. The form
+  submitted, the row was written, the mail went out, and the fields stayed filled in: a hang
+  from both ends. Marking now happens for every redirect status on an Inertia request, with
+  the conversion a separate decision on top of it. `307` and `308` are marked but left alone,
+  since preserving the method is the whole reason to choose them.
+
 ## [1.7.1] — 2026-08-16
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerotal/inertia",
-  "version": "1.7.5",
+  "version": "1.8.0",
   "license": "MIT",
   "maturity": "stable",
   "private": false,
@@ -33,7 +33,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@zerotal/core": "1.7.5"
+    "@zerotal/core": "1.8.0"
   },
   "peerDependencies": {
     "react": "^18 || ^19",

package/src/commands/InertiaBuildCommand.ts

@@ -1,5 +1,5 @@
 import { Command } from "@zerotal/core";
-import { pruneBuildOutput, browserEnvDefines } from "@zerotal/core/dev";
+import { pruneBuildOutput, cleanBuildOutput, browserEnvDefines } from "@zerotal/core/dev";
 import { generatePageRegistry } from "../PageRegistry.ts";
 import { detectCssPlugins } from "../css.ts";
 import { detectVuePlugin } from "../vuePlugin.ts";
@@ -32,6 +32,15 @@ export class InertiaBuildCommand extends Command {
       description: "Build for production (minified, no source maps)",
       default: false,
     },
+    {
+      name: "clean",
+      short: "c",
+      type: "boolean" as const,
+      description:
+        "Delete everything in public/assets that this build did not write. " +
+        "Without it, only chunks and files the last build on THIS machine recorded are removed",
+      default: false,
+    },
   ];
 
   override async run(): Promise<void> {
@@ -72,7 +81,17 @@ export class InertiaBuildCommand extends Command {
 
     // Chunks are named after their content, so the ones this build replaced
     // would otherwise stay behind — and ship.
-    const removed = await pruneBuildOutput(outdir, result.outputs);
+    //
+    // Which of the two runs matters most on a build machine that starts clean
+    // every time. The prune's record of the last build lives in `.zerotal/`,
+    // which is gitignored, so a fresh checkout has nothing to compare against
+    // and only chunk-named files are recognised. `--clean` needs no record: this
+    // directory belongs to the build, and what the build did not write does not
+    // belong in it.
+    const clean = this.flags["clean"] as boolean;
+    const removed = clean
+      ? await cleanBuildOutput(outdir, result.outputs)
+      : await pruneBuildOutput(outdir, result.outputs);
 
     this.info(`Build complete: ${result.outputs.length} files → public/assets/`);
     if (removed.length > 0) this.dim(`  Removed ${removed.length} stale file(s).`);

package/src/middleware/InertiaMiddleware.ts

@@ -21,6 +21,15 @@ import { assetVersion } from "../version.ts";
  * 3. Always set Vary: X-Inertia on all responses
  *    Ensures browser cache treats HTML and JSON versions as distinct.
  */
+/**
+ * Every status the client can be handed as a redirect.
+ *
+ * 307 and 308 are here to be *marked*, not converted — an app that picks a
+ * method-preserving redirect means it, and a response the client cannot
+ * recognise as Inertia's is the failure this list exists to prevent.
+ */
+const REDIRECT_STATUSES = [301, 302, 303, 307, 308];
+
 export class InertiaMiddleware extends BaseMiddleware {
   protected options: Record<string, never> = {};
 
@@ -51,34 +60,46 @@ export class InertiaMiddleware extends BaseMiddleware {
 
     const status = response.status;
     const method = http.request.method;
-    const isRedirect = [301, 302, 303].includes(status);
+    const isRedirect = REDIRECT_STATUSES.includes(status);
 
-    // Fragment redirects: a redirect whose target carries a URL fragment (#...) on an Inertia
-    // request becomes a 409 + X-Inertia-Redirect, so the client performs a standard Inertia visit
-    // (preserving the fragment) instead of a full reload.
     if (isInertia && isRedirect) {
       const target = response.headers.get("Location") ?? "";
+
+      // Fragment redirects: a redirect whose target carries a URL fragment (#...) on an Inertia
+      // request becomes a 409 + X-Inertia-Redirect, so the client performs a standard Inertia visit
+      // (preserving the fragment) instead of a full reload.
       if (target.includes("#")) {
-        // Same header-preservation concern as the 303 branch below.
+        // Same header-preservation concern as the redirect branch below.
         const headers = new Headers(response.headers);
         headers.delete("Location");
         headers.set("X-Inertia-Redirect", target);
         headers.set("X-Inertia", "true");
         return new Response(null, { status: 409, headers });
       }
-    }
 
-    // Convert 302 to 303 for non-GET Inertia redirects
-    // Inertia requires 303 so browsers use GET on the redirect target
-    if (isInertia && [301, 302].includes(status) && method !== "GET") {
       // Carry the original headers over. Rebuilding the Response from just `Location` dropped
       // every other header the handler set — most importantly `Set-Cookie`, so `POST /login`
       // returned a 303 to /dashboard with the session cookie discarded and the user still
       // logged out.
       const headers = new Headers(response.headers);
-      headers.set("Location", response.headers.get("Location") ?? "/");
+      headers.set("Location", target || "/");
+
+      // Stamped on *every* Inertia redirect, not only the ones converted below.
+      //
+      // It used to be set inside the conversion, which meant a handler that
+      // already returned the 303 the protocol asks for — `http.redirect(to, 303)`
+      // — skipped the only line that marked the response as Inertia's. The
+      // request succeeded, the row was written, and the form sat there with the
+      // fields still filled in: the worst shape a failure can take, because
+      // nothing about it looks like an error from either end.
       headers.set("X-Inertia", "true");
-      return new Response(null, { status: 303, headers });
+      if (!headers.has("Vary")) headers.set("Vary", "X-Inertia");
+
+      // A non-GET 301/302 becomes a 303, so the browser follows with GET instead
+      // of repeating the method against the target. 307 and 308 are left alone:
+      // preserving the method is the whole reason to choose them.
+      const needsSeeOther = method !== "GET" && (status === 301 || status === 302);
+      return new Response(null, { status: needsSeeOther ? 303 : status, headers });
     }
 
     // Never wrap streaming responses (e.g. SSE) — re-creating the Response