meno-core 1.0.53 → 1.1.0

package/lib/server/services/fileWatcherService.ts

@@ -3,12 +3,12 @@
  * Manages file watching for pages and components
  */
 
-import { FileWatcher, type FileWatchCallbacks } from '../fileWatcher';
-import { WebSocketManager } from '../websocketManager';
-import { ComponentService } from './componentService';
-import { PageService } from './pageService';
+import { FileWatcher } from '../fileWatcher';
+import type { WebSocketManager } from '../websocketManager';
+import type { ComponentService } from './componentService';
+import type { PageService } from './pageService';
 import type { CMSService } from './cmsService';
-import { PageCache } from '../pageCache';
+import type { PageCache } from '../pageCache';
 import { colorService } from './ColorService';
 import { variableService } from './VariableService';
 import { enumService } from './EnumService';
@@ -22,10 +22,10 @@ export class FileWatcherService {
   constructor(
     private componentService: ComponentService,
     private pageService: PageService,
-    private pageCache: PageCache,
+    _pageCache: PageCache,
     private wsManager: WebSocketManager,
     private cmsService?: CMSService,
-    private onImageAdded?: (filename: string) => Promise<void>
+    private onImageAdded?: (filename: string) => Promise<void>,
   ) {}
 
   /**
@@ -63,6 +63,41 @@ export class FileWatcherService {
           }, 50);
         }
       },
+      onCMSTemplateChange: async () => {
+        // An astro CMS template page (src/pages/<col>/[slug].astro) was added,
+        // edited, or removed. Unlike a regular page edit this changes the set of
+        // collections, so refresh the CMS schema cache AND reconcile the page
+        // cache's /templates/<id> entries — otherwise the new collection and its
+        // template page only appear after a dev-server restart. Debounced (shares
+        // refreshSchemasTimer) to coalesce burst fs.watch events from one write.
+        if (!this.cmsService) return;
+        if (this.refreshSchemasTimer !== null) {
+          clearTimeout(this.refreshSchemasTimer);
+        }
+        const cmsService = this.cmsService;
+        const pageService = this.pageService;
+        const wsManager = this.wsManager;
+        this.refreshSchemasTimer = setTimeout(async () => {
+          this.refreshSchemasTimer = null;
+          await cmsService.refreshSchemas();
+          // In astro projects every /templates/<id> page-cache entry is a CMS
+          // template (regular pages keep their real path), so reconcile them 1:1
+          // with the fresh schema set: drop entries for removed collections,
+          // (re)load entries for current ones.
+          const ids = new Set(cmsService.getAllSchemas().keys());
+          for (const path of pageService.getAllPagePaths()) {
+            if (path.startsWith('/templates/') && !ids.has(path.slice('/templates/'.length))) {
+              await pageService.deletePage(path);
+            }
+          }
+          for (const id of ids) {
+            await pageService.reloadPageFromDisk(`/templates/${id}`);
+          }
+          // Refresh the studio's collections list (CMS panel) and page list (dropdown).
+          wsManager.broadcastCollectionsUpdate();
+          wsManager.broadcastUpdate();
+        }, 50);
+      },
       onColorsChange: async () => {
         // Clear the color service cache so it reloads on next request
         colorService.clearCache();
@@ -119,4 +154,3 @@ export class FileWatcherService {
     }
   }
 }
-

package/lib/server/services/index.ts

@@ -7,4 +7,3 @@ export { PageService } from './pageService';
 export { ComponentService, type ComponentInfo } from './componentService';
 export { FileWatcherService } from './fileWatcherService';
 export { CMSService, type ReferenceLocation } from './cmsService';
-

package/lib/server/services/pageService.test.ts

@@ -1,4 +1,4 @@
-import { test, expect, describe, beforeEach, afterEach, mock } from 'bun:test';
+import { test, expect, describe, beforeEach, afterEach } from 'bun:test';
 import { PageService } from './pageService';
 import { PageCache } from '../pageCache';
 import { createMockPageData } from '../../test-utils';
@@ -122,9 +122,7 @@ describe('PageService', () => {
       const serviceWithoutProvider = new PageService(pageCache);
       const testData = createMockPageData();
 
-      await expect(serviceWithoutProvider.savePage('/', testData)).rejects.toThrow(
-        'PageProvider not set'
-      );
+      await expect(serviceWithoutProvider.savePage('/', testData)).rejects.toThrow('PageProvider not set');
     });
 
     test('should strip _lineMap from saved data', async () => {
@@ -229,8 +227,8 @@ describe('PageService', () => {
       const mappings = pageService.getSlugMappings();
 
       expect(mappings).toHaveLength(1);
-      expect(mappings[0].pageId).toBe('about');
-      expect(mappings[0].slugs).toEqual({ en: 'about', pl: 'o-nas' });
+      expect(mappings[0]!.pageId).toBe('about');
+      expect(mappings[0]!.slugs).toEqual({ en: 'about', pl: 'o-nas' });
     });
 
     test('should create default slug for pages without explicit slugs', () => {
@@ -240,8 +238,8 @@ describe('PageService', () => {
       const mappings = pageService.getSlugMappings();
 
       expect(mappings).toHaveLength(1);
-      expect(mappings[0].pageId).toBe('about');
-      expect(mappings[0].slugs).toEqual({ _default: 'about' });
+      expect(mappings[0]!.pageId).toBe('about');
+      expect(mappings[0]!.slugs).toEqual({ _default: 'about' });
     });
 
     test('should handle index page correctly', () => {
@@ -251,8 +249,8 @@ describe('PageService', () => {
       const mappings = pageService.getSlugMappings();
 
       expect(mappings).toHaveLength(1);
-      expect(mappings[0].pageId).toBe('index');
-      expect(mappings[0].slugs).toEqual({ _default: '' });
+      expect(mappings[0]!.pageId).toBe('index');
+      expect(mappings[0]!.slugs).toEqual({ _default: '' });
     });
   });
 

package/lib/server/services/pageService.ts

@@ -6,12 +6,14 @@
  * and managing page data including saving and deletion.
  */
 
-import { existsSync, readdirSync, mkdirSync, rmdirSync } from 'fs';
-import { join } from 'path';
-import { PageCache } from '../pageCache';
+import { existsSync, readdirSync, mkdirSync, rmdirSync } from 'node:fs';
+import { join } from 'node:path';
+import type { PageCache } from '../pageCache';
 import { parseJSON } from '../jsonLoader';
 import { buildLineMap } from '../utils/jsonLineMapper';
 import { projectPaths } from '../projectContext';
+import { logRuntimeError } from '../../shared/errorLogger';
+import { isPathWithinRoot } from '../../shared/pathSecurity';
 import type { JSONPage } from '../../shared/types';
 import type { SlugMap } from '../../shared/slugTranslator';
 import type { PageProvider } from '../../shared/interfaces/contentProvider';
@@ -25,7 +27,7 @@ export class PageService {
    */
   constructor(
     private pageCache: PageCache,
-    private provider?: PageProvider
+    private provider?: PageProvider,
   ) {}
 
   /**
@@ -165,8 +167,10 @@ export class PageService {
     let content: string | null = null;
     try {
       content = await this.provider.get(path);
-    } catch {
+    } catch (error) {
       // Transient (mid-write / partial .astro parse error) — keep the cache as-is.
+      // Logged (dev-gated) so a persistent read/parse failure isn't fully invisible.
+      logRuntimeError('pageService.reloadPageFromDisk', error, { path });
       return false;
     }
 
@@ -241,19 +245,24 @@ export class PageService {
    * // [{ path: "/", isDraft: false }, { path: "/about", isDraft: true }]
    * ```
    */
-  getAllPagesWithInfo(): Array<{ path: string; isDraft: boolean; folder?: string }> {
-    const paths = this.pageCache.keys().filter(p => !p.startsWith('/_sketch/'));
-    return paths.map(path => {
+  getAllPagesWithInfo(): Array<{ path: string; isDraft: boolean; folder?: string; source?: 'cms' | 'ssr' }> {
+    const paths = this.pageCache.keys().filter((p) => !p.startsWith('/_sketch/'));
+    return paths.map((path) => {
       const pageData = this.getPageData(path);
       // Extract folder from path: /blog/post -> blog, /templates/blog-post -> templates
       // Root-level pages (e.g., /, /about) have no folder
       const pathWithoutSlash = path === '/' ? 'index' : path.substring(1);
       const slashIndex = pathWithoutSlash.lastIndexOf('/');
       const folder = slashIndex > 0 ? pathWithoutSlash.substring(0, slashIndex) : undefined;
+      // Surface a non-static page source (`cms` template / `ssr` live page) so the editor's
+      // page picker can group them apart from plain static pages. Static/undefined omitted.
+      const metaSource = pageData?.meta?.source;
+      const source = metaSource === 'cms' || metaSource === 'ssr' ? metaSource : undefined;
       return {
         path,
         isDraft: pageData?.meta?.draft === true,
-        ...(folder ? { folder } : {})
+        ...(folder ? { folder } : {}),
+        ...(source ? { source } : {}),
       };
     });
   }
@@ -309,7 +318,9 @@ export class PageService {
           result.push(...collectFolders(join(dir, entry.name), relativePath));
         }
         return result;
-      } catch { return []; }
+      } catch {
+        return [];
+      }
     };
 
     return collectFolders(pagesDir, '').sort();
@@ -359,7 +370,7 @@ export class PageService {
    * @param newFolder - Target folder name (empty string for root)
    */
   async movePage(pagePath: string, newFolder: string): Promise<void> {
-    const { rename } = await import('fs/promises');
+    const { rename } = await import('node:fs/promises');
     const pagesDir = this.pagesBaseDir();
     const ext = this.pageExt();
 
@@ -370,9 +381,14 @@ export class PageService {
     const baseName = slashIndex >= 0 ? pageName.substring(slashIndex + 1) : pageName;
 
     const sourceFile = join(pagesDir, `${pageName}${ext}`);
-    const targetFile = newFolder
-      ? join(pagesDir, newFolder, `${baseName}${ext}`)
-      : join(pagesDir, `${baseName}${ext}`);
+    const targetFile = newFolder ? join(pagesDir, newFolder, `${baseName}${ext}`) : join(pagesDir, `${baseName}${ext}`);
+
+    // Defense-in-depth: a crafted pagePath / newFolder must not move a file out of
+    // (or in from) outside the pages dir. Siblings createFolder/renamePage validate;
+    // movePage previously did not.
+    if (!isPathWithinRoot(sourceFile, pagesDir) || !isPathWithinRoot(targetFile, pagesDir)) {
+      throw new Error(`movePage path escapes pages dir: ${pagePath} -> ${newFolder}`);
+    }
 
     // Create target directory if needed
     if (newFolder) {
@@ -399,9 +415,7 @@ export class PageService {
     }
 
     // Clean up empty source directory
-    const sourceDir = slashIndex >= 0
-      ? join(pagesDir, pageName.substring(0, slashIndex))
-      : null;
+    const sourceDir = slashIndex >= 0 ? join(pagesDir, pageName.substring(0, slashIndex)) : null;
 
     if (sourceDir && sourceDir !== pagesDir) {
       try {
@@ -454,7 +468,7 @@ export class PageService {
       throw new Error('Page slug can only contain lowercase letters, numbers, dashes, and underscores');
     }
 
-    const { rename } = await import('fs/promises');
+    const { rename } = await import('node:fs/promises');
     const pagesDir = this.pagesBaseDir();
     const ext = this.pageExt();
     const sourceFile = join(pagesDir, `${oldName}${ext}`);

package/lib/server/ssr/attributeBuilder.ts

@@ -27,9 +27,21 @@ export function escapeHtml(unsafe: string): string {
 
 /** HTML attributes that must NOT be kebab-cased (single-word or special casing) */
 const NO_KEBAB_ATTRS = new Set([
-  'autoplay', 'playsinline', 'crossorigin', 'novalidate', 'readonly',
-  'nomodule', 'formnovalidate', 'ismap', 'usemap', 'srcset', 'inputmode',
-  'enterkeyhint', 'autocomplete', 'autofocus', 'contenteditable',
+  'autoplay',
+  'playsinline',
+  'crossorigin',
+  'novalidate',
+  'readonly',
+  'nomodule',
+  'formnovalidate',
+  'ismap',
+  'usemap',
+  'srcset',
+  'inputmode',
+  'enterkeyhint',
+  'autocomplete',
+  'autofocus',
+  'contenteditable',
 ]);
 
 /**
@@ -61,9 +73,7 @@ export function buildAttributes(props: Record<string, unknown>, exclude: string[
     const attrName = NO_KEBAB_ATTRS.has(key.toLowerCase())
       ? key.toLowerCase()
       : key.replace(/([A-Z])/g, '-$1').toLowerCase();
-    const attrValue = typeof value === 'boolean'
-      ? (value ? '' : undefined)
-      : escapeHtml(String(value));
+    const attrValue = typeof value === 'boolean' ? (value ? '' : undefined) : escapeHtml(String(value));
 
     if (attrValue !== undefined) {
       if (typeof value === 'boolean' && value) {
@@ -74,7 +84,7 @@ export function buildAttributes(props: Record<string, unknown>, exclude: string[
     }
   }
 
-  return attrs.length > 0 ? ' ' + attrs.join(' ') : '';
+  return attrs.length > 0 ? ` ${attrs.join(' ')}` : '';
 }
 
 /**
@@ -115,7 +125,7 @@ export function buildEditorAttrs(opts: {
     parts.push(`data-component-context="${escapeHtml(opts.componentContext)}"`);
   }
 
-  return ' ' + parts.join(' ');
+  return ` ${parts.join(' ')}`;
 }
 
 /**

package/lib/server/ssr/buildErrorOverlay.ts

@@ -4,9 +4,9 @@
  */
 
 export interface BuildError {
-  file: string;      // e.g., "pages/posts.json"
-  message: string;   // Error message
-  type: string;      // 'minify' | 'render' | 'parse' | 'cms'
+  file: string; // e.g., "pages/posts.json"
+  message: string; // Error message
+  type: string; // 'minify' | 'render' | 'parse' | 'cms'
 }
 
 export interface BuildErrorsData {
@@ -30,10 +30,7 @@ function escapeHtml(str: string): string {
  * Safely encode data for embedding in a script tag
  */
 function safeJsonForScript(data: unknown): string {
-  return JSON.stringify(data)
-    .replace(/</g, '\\u003c')
-    .replace(/>/g, '\\u003e')
-    .replace(/&/g, '\\u0026');
+  return JSON.stringify(data).replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/&/g, '\\u0026');
 }
 
 /**
@@ -52,12 +49,12 @@ export function generateBuildErrorPage(data: BuildErrorsData, cspNonce?: string)
   const nonceAttr = cspNonce ? ` nonce="${cspNonce}"` : '';
 
   // Generate plain text for copying to AI
-  const plainTextErrors = errors.map(err =>
-    `[${err.type.toUpperCase()}] ${err.file}\n${err.message}`
-  ).join('\n\n');
+  const plainTextErrors = errors.map((err) => `[${err.type.toUpperCase()}] ${err.file}\n${err.message}`).join('\n\n');
   const copyText = `Build failed with ${errors.length} error(s):\n\n${plainTextErrors}`;
 
-  const errorListHtml = errors.map((err) => `
+  const errorListHtml = errors
+    .map(
+      (err) => `
     <div class="error-item">
       <div class="error-item-header">
         <div class="error-type">${escapeHtml(err.type)}</div>
@@ -65,7 +62,9 @@ export function generateBuildErrorPage(data: BuildErrorsData, cspNonce?: string)
       </div>
       <div class="error-message">${escapeHtml(err.message)}</div>
     </div>
-  `).join('');
+  `,
+    )
+    .join('');
 
   return `<!DOCTYPE html>
 <html lang="en">

package/lib/server/ssr/clientDataInjector.ts

@@ -18,10 +18,7 @@ const SYSTEM_FIELDS = ['_id', '_url', '_filename', '_slug'];
  * @param fields Fields to include (undefined or empty = all fields)
  * @returns Filtered items with only specified fields
  */
-export function filterItemFields(
-  items: CMSItem[],
-  fields: string[] | undefined
-): CMSItem[] {
+export function filterItemFields(items: CMSItem[], fields: string[] | undefined): CMSItem[] {
   // If no field restriction, return all items as-is
   if (!fields || fields.length === 0) {
     return items;
@@ -31,7 +28,7 @@ export function filterItemFields(
   const allowedFields = new Set([...SYSTEM_FIELDS, ...fields]);
 
   // Filter each item to only include allowed fields
-  return items.map(item => {
+  return items.map((item) => {
     const filtered: CMSItem = { _id: item._id };
 
     for (const [key, value] of Object.entries(item)) {
@@ -52,15 +49,9 @@ export function filterItemFields(
  * @param items Items to embed
  * @returns HTML script tag string
  */
-export function generateInlineDataScript(
-  collection: string,
-  items: CMSItem[]
-): string {
+export function generateInlineDataScript(collection: string, items: CMSItem[]): string {
   // Escape HTML entities in JSON to prevent XSS
-  const jsonString = JSON.stringify(items)
-    .replace(/</g, '\\u003c')
-    .replace(/>/g, '\\u003e')
-    .replace(/&/g, '\\u0026');
+  const jsonString = JSON.stringify(items).replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/&/g, '\\u0026');
 
   return `<script type="application/json" id="meno-cms-${escapeAttr(collection)}">${jsonString}</script>`;
 }
@@ -84,10 +75,7 @@ function escapeAttr(str: string): string {
  * @param itemCount Number of items in collection
  * @returns Effective strategy ('inline' or 'static')
  */
-export function determineStrategy(
-  config: CMSClientDataConfig,
-  itemCount: number
-): 'inline' | 'static' {
+export function determineStrategy(config: CMSClientDataConfig, itemCount: number): 'inline' | 'static' {
   if (config.strategy === 'inline') return 'inline';
   if (config.strategy === 'static') return 'static';
 
@@ -122,7 +110,7 @@ export interface ClientDataCollection {
 export function prepareClientData(
   collection: string,
   items: CMSItem[],
-  config: CMSClientDataConfig | undefined
+  config: CMSClientDataConfig | undefined,
 ): ClientDataCollection | null {
   // Skip if not enabled
   if (!config?.enabled) {
@@ -146,9 +134,7 @@ export function prepareClientData(
  * @param collections Map of collection ID to prepared client data
  * @returns Combined HTML string with all data scripts
  */
-export function generateAllInlineDataScripts(
-  collections: Map<string, ClientDataCollection>
-): string {
+export function generateAllInlineDataScripts(collections: Map<string, ClientDataCollection>): string {
   const scripts: string[] = [];
 
   for (const [collectionId, data] of collections) {

package/lib/server/ssr/cmsSSRProcessor.ts

@@ -4,7 +4,6 @@
  */
 
 import type { I18nConfig } from '../../shared/types/components';
-import type { TemplateContext } from '../../shared/types';
 import { DEFAULT_I18N_CONFIG, resolveI18nValue, isI18nValue } from '../../shared/i18n';
 import type { ValueResolver } from '../../shared/itemTemplateUtils';
 import { tiptapToHtml } from '../../shared/richtext/tiptapToHtml';
@@ -24,10 +23,7 @@ export interface CMSContext {
 /**
  * Get i18n resolver function for value resolution
  */
-export function createI18nResolver(
-  locale?: string,
-  i18nConfig?: I18nConfig
-): ValueResolver | undefined {
+export function createI18nResolver(locale?: string, i18nConfig?: I18nConfig): ValueResolver | undefined {
   if (!locale || !i18nConfig) return undefined;
   return (value: unknown) => resolveI18nValue(value, locale, i18nConfig);
 }
@@ -41,12 +37,12 @@ export function processCMSTemplate(
   template: string,
   cmsItem: Record<string, unknown>,
   locale?: string,
-  i18nConfig?: I18nConfig
+  i18nConfig?: I18nConfig,
 ): string {
   const config = i18nConfig || DEFAULT_I18N_CONFIG;
   const effectiveLocale = locale || config.defaultLocale;
 
-  return template.replace(/\{\{cms\.([^}]+)\}\}/g, (match, fieldPath) => {
+  return template.replace(/\{\{cms\.([^}]+)\}\}/g, (_match, fieldPath) => {
     // Support nested paths like cms.author.name
     const parts = fieldPath.trim().split('.');
     let value: unknown = cmsItem;
@@ -94,7 +90,7 @@ export function processCMSPropsTemplate(
   props: Record<string, unknown>,
   cmsItem: Record<string, unknown>,
   locale?: string,
-  i18nConfig?: I18nConfig
+  i18nConfig?: I18nConfig,
 ): Record<string, unknown> {
   const result: Record<string, unknown> = {};
 

package/lib/server/ssr/cssCollector.ts

@@ -10,7 +10,7 @@ import type { ComponentDefinition } from '../../shared/types';
  */
 export function collectComponentCSS(
   globalComponents: Record<string, ComponentDefinition> = {},
-  pageComponents: Record<string, ComponentDefinition> = {}
+  pageComponents: Record<string, ComponentDefinition> = {},
 ): string {
   const cssBlocks: string[] = [];
 

package/lib/server/ssr/errorOverlay.test.ts

@@ -64,7 +64,7 @@ describe('generateErrorPage', () => {
     expect(html).toContain("A section couldn't load its content");
     expect(html).toContain('error-friendly');
     // ...while the raw message is still present (under technical details / copy).
-    expect(html).toContain("Cannot read properties of null (reading 'length')");
+    expect(html).toContain('Cannot read properties of null (reading 'length')');
   });
 
   it('sends friendly + raw fields in the PREVIEW_ERROR payload', () => {

package/lib/server/ssr/errorOverlay.ts

@@ -44,10 +44,7 @@ function escapeHtml(str: string): string {
  * Escapes </script> sequences and other problematic characters
  */
 function safeJsonForScript(data: unknown): string {
-  return JSON.stringify(data)
-    .replace(/</g, '\\u003c')
-    .replace(/>/g, '\\u003e')
-    .replace(/&/g, '\\u0026');
+  return JSON.stringify(data).replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/&/g, '\\u0026');
 }
 
 /**
@@ -66,8 +63,7 @@ export function generateErrorPage(error: unknown, context?: string, cspNonce?: s
   const errorMessage = escapeHtml(errorInfo.message);
   const errorStack = errorInfo.stack ? escapeHtml(errorInfo.stack) : '';
   // Escape first (XSS-safe), then turn `backtick` spans into <code> for display.
-  const renderInline = (s: string) =>
-    escapeHtml(s).replace(/`([^`]+)`/g, '<code>$1</code>');
+  const renderInline = (s: string) => escapeHtml(s).replace(/`([^`]+)`/g, '<code>$1</code>');
   const friendlyTitle = escapeHtml(friendly.title);
   const friendlyMessage = renderInline(friendly.friendlyMessage);
   const friendlyHint = friendly.hint ? renderInline(friendly.hint) : '';
@@ -89,9 +85,7 @@ export function generateErrorPage(error: unknown, context?: string, cspNonce?: s
   });
 
   // Full error text for copying
-  const fullErrorText = safeJsonForScript(
-    errorInfo.message + (errorInfo.stack ? '\n\n' + errorInfo.stack : '')
-  );
+  const fullErrorText = safeJsonForScript(errorInfo.message + (errorInfo.stack ? `\n\n${errorInfo.stack}` : ''));
 
   return `<!DOCTYPE html>
 <html lang="en">

package/lib/server/ssr/htmlGenerator.nonce.test.ts

@@ -18,8 +18,8 @@
  */
 
 import { test, expect, describe } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
 
 const CORE = path.resolve(import.meta.dir, '../..', '..');
 const SSR_DIR = path.join(CORE, 'lib/server/ssr');
@@ -55,21 +55,18 @@ const SCRIPT_OPEN_TAG = /<script\b([^>]*)>/g;
  * newlines for the comment content.
  */
 function stripComments(src: string): string {
-  const blockStripped = src.replace(/\/\*[\s\S]*?\*\//g, (m) =>
-    m.replace(/[^\n]/g, ' ')
-  );
-  return blockStripped.replace(/(^|[^:])\/\/[^\n]*/g, (m, prefix) =>
-    prefix + ' '.repeat(m.length - prefix.length)
-  );
+  const blockStripped = src.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, ' '));
+  return blockStripped.replace(/(^|[^:])\/\/[^\n]*/g, (m, prefix) => prefix + ' '.repeat(m.length - prefix.length));
 }
 
 function findInlineScripts(src: string): { attrs: string; index: number }[] {
   const clean = stripComments(src);
   const out: { attrs: string; index: number }[] = [];
-  let match: RegExpExecArray | null;
   SCRIPT_OPEN_TAG.lastIndex = 0;
-  while ((match = SCRIPT_OPEN_TAG.exec(clean))) {
-    out.push({ attrs: match[1], index: match.index });
+  let match: RegExpExecArray | null = SCRIPT_OPEN_TAG.exec(clean);
+  while (match) {
+    out.push({ attrs: match[1]!, index: match.index });
+    match = SCRIPT_OPEN_TAG.exec(clean);
   }
   return out;
 }
@@ -108,9 +105,7 @@ describe('SSR inline script nonce contract', () => {
           }
         }
         if (offenders.length > 0) {
-          throw new Error(
-            `Inline <script> tags missing \${nonceAttr}:\n  ${offenders.join('\n  ')}`,
-          );
+          throw new Error(`Inline <script> tags missing \${nonceAttr}:\n  ${offenders.join('\n  ')}`);
         }
       });
     });