mnfst-render 0.5.15 → 0.5.16

package/manifest.render.mjs

@@ -609,32 +609,46 @@ function stripDevOnlyContent(html) {
   return out;
 }
 
-// --- Strip plugin scripts injected by the loader during prerender so only the loader tag remains ---
-// When the static page loads, the loader runs once and adds plugins; avoids
-// duplicate script execution (which would cause `const` re-declaration errors).
-// Matches both CDN-minified (.min.js) and self-hosted (.js) plugin URLs.
-// Also strips the loader-injected Alpine script (both defer and non-defer
-// forms) — at runtime the loader re-injects Alpine AFTER plugin registration,
-// and if Chromium serialized an Alpine script tag during the Puppeteer render,
-// leaving it in place would cause Alpine to execute synchronously during HTML
-// parse, before plugins have a chance to register their directives.
-function stripInjectedPluginScripts(html) {
-  // Safety-net regex strip for any Manifest plugin scripts that survived the
-  // DOM-level removal in the Puppeteer evaluate phase.  Uses a broad pattern
-  // that matches ANY `manifest.*.js` or `manifest.*.min.js` script — no need
-  // to enumerate individual plugin names.  New plugins are covered automatically.
-  const pluginPattern =
-    /<script[^>]*\ssrc=["'][^"']*manifest\.[a-z][\w.-]*\.(?:min\.)?js["'][^>]*>\s*<\/script>/gi;
-  let out = html.replace(pluginPattern, '');
-  // Alpine (re-injected by the loader at runtime after plugin registration)
-  const alpinePattern =
-    /<script[^>]*\ssrc=["'][^"']*\/alpinejs@[^"']*["'][^>]*>\s*<\/script>/gi;
-  out = out.replace(alpinePattern, '');
-  // Runtime library scripts loaded by plugins (yaml parser, markdown, etc.)
-  const runtimePattern =
-    /<script[^>]*\ssrc=["'][^"']*(?:papaparse[^"']*\.min\.js|marked[^"']*\.min\.js|highlight[^"']*\.min\.js|js-yaml[^"']*\.min\.js)[^"']*["'][^>]*>\s*<\/script>/gi;
-  out = out.replace(runtimePattern, '');
-  return out;
+// --- Strip scripts injected at runtime during prerender ---
+// The Manifest loader, Alpine, plugins, and third-party libraries inject
+// <script> tags into the DOM during the Puppeteer render.  These must be
+// removed from the serialized HTML so the loader can re-inject them fresh
+// at runtime (otherwise the addScript function finds an existing tag, waits
+// for a load event that already fired, and hangs forever).
+//
+// Approach: diff the prerendered HTML against the ORIGINAL index.html from
+// disk.  Any <script src="..."> whose src does NOT appear in the original
+// file was injected at runtime and must be stripped.  Inline scripts without
+// src are left alone (author-written analytics snippets, etc.).
+//
+// This is future-proof — new framework plugins, Alpine version bumps, and
+// arbitrary third-party scripts (webchat, analytics) are all handled
+// automatically without maintaining a hardcoded allowlist.
+let _originalScriptSrcs = null;
+
+function buildOriginalScriptSrcSet(rootDir) {
+  if (_originalScriptSrcs) return _originalScriptSrcs;
+  _originalScriptSrcs = new Set();
+  const indexPath = join(rootDir, 'index.html');
+  if (!existsSync(indexPath)) return _originalScriptSrcs;
+  const html = readFileSync(indexPath, 'utf8');
+  const srcPattern = /<script[^>]*\ssrc=["']([^"']+)["'][^>]*>/gi;
+  let m;
+  while ((m = srcPattern.exec(html)) !== null) {
+    _originalScriptSrcs.add(m[1]);
+  }
+  return _originalScriptSrcs;
+}
+
+function stripInjectedPluginScripts(html, rootDir) {
+  const originals = buildOriginalScriptSrcSet(rootDir);
+  // Remove every <script src="...">...</script> whose src is NOT in the
+  // original index.html.  This catches all loader-injected plugins, Alpine,
+  // runtime libraries (js-yaml, marked, highlight, etc.), and any third-party
+  // scripts added dynamically during the render.
+  return html.replace(/<script[^>]*\ssrc=["']([^"']+)["'][^>]*>\s*<\/script>/gi,
+    (full, src) => originals.has(src) ? full : ''
+  );
 }
 
 function stripRuntimeTailwindArtifacts(html) {
@@ -1391,7 +1405,7 @@ function generateLocaleVariantHtml({
 
   // Standard Node.js post-processing (same sequence as processPath)
   html = stripDevOnlyContent(html);
-  html = stripInjectedPluginScripts(html);
+  html = stripInjectedPluginScripts(html, config.root);
   if (tailwindBuilt) html = stripRuntimeTailwindArtifacts(html);
 
   const pageUtilityBlocks = [];
@@ -1999,22 +2013,6 @@ async function runPrerender(config) {
       // (`hydratePrerenderedPage` in manifest.js) reads the contract and
       // restores source attributes before Alpine starts.
       await page.evaluateOnNewDocument(() => {
-        // Snapshot the script srcs that exist in the author's original HTML
-        // BEFORE any loader/plugin injects additional scripts.  Used later to
-        // strip runtime-injected scripts from the serialized output while
-        // keeping author-intentional ones (analytics, third-party widgets, etc.).
-        window.__manifestOriginalScriptSrcs = new Set();
-        const _snapScripts = () => {
-          document.querySelectorAll('script[src]').forEach(s => {
-            window.__manifestOriginalScriptSrcs.add(s.getAttribute('src'));
-          });
-        };
-        if (document.readyState === 'loading') {
-          document.addEventListener('DOMContentLoaded', _snapScripts, { once: true });
-        }
-        // Also snap immediately for any scripts already parsed
-        _snapScripts();
-
         // element -> { attrName: originalValue (null if attribute was absent) }
         // Keyed by reference so detached elements drop out naturally.
         const sourceAttrs = new Map();
@@ -2857,20 +2855,6 @@ async function runPrerender(config) {
         toRemove.forEach((el) => { if (document.contains(el)) el.remove(); });
       });
 
-      // Remove scripts that were injected at runtime (by the loader, plugins,
-      // or third-party libraries) but were NOT in the author's original HTML.
-      // This is done in the browser context (before serialization) so the
-      // removal is permanent in the captured outerHTML.  The approach is
-      // future-proof: new plugins and arbitrary third-party scripts are handled
-      // automatically without updating a hardcoded allowlist.
-      await page.evaluate(() => {
-        const originals = window.__manifestOriginalScriptSrcs || new Set();
-        document.querySelectorAll('script[src]').forEach(s => {
-          const src = s.getAttribute('src');
-          if (src && !originals.has(src)) s.remove();
-        });
-      });
-
       let html = await page.evaluate(() => document.documentElement.outerHTML);
       // Inject the hydration contract blob into the raw HTML *before* caching
       // it for locale variant generation, so every locale variant inherits the
@@ -2897,7 +2881,7 @@ async function runPrerender(config) {
         pushDebug({ path: displayPath, stage: 'pre-serialize', metrics: post });
       }
       html = stripDevOnlyContent(html);
-      html = stripInjectedPluginScripts(html);
+      html = stripInjectedPluginScripts(html, config.root);
       if (tailwindBuilt) {
         html = stripRuntimeTailwindArtifacts(html);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mnfst-render",
-  "version": "0.5.15",
+  "version": "0.5.16",
   "description": "Render Manifest sites to static HTML for SEO",
   "type": "module",
   "bin": {