mnfst-render 0.5.15 → 0.5.17

package/manifest.render.mjs

@@ -609,32 +609,46 @@ function stripDevOnlyContent(html) {
   return out;
 }
 
-// --- Strip plugin scripts injected by the loader during prerender so only the loader tag remains ---
-// When the static page loads, the loader runs once and adds plugins; avoids
-// duplicate script execution (which would cause `const` re-declaration errors).
-// Matches both CDN-minified (.min.js) and self-hosted (.js) plugin URLs.
-// Also strips the loader-injected Alpine script (both defer and non-defer
-// forms) — at runtime the loader re-injects Alpine AFTER plugin registration,
-// and if Chromium serialized an Alpine script tag during the Puppeteer render,
-// leaving it in place would cause Alpine to execute synchronously during HTML
-// parse, before plugins have a chance to register their directives.
-function stripInjectedPluginScripts(html) {
-  // Safety-net regex strip for any Manifest plugin scripts that survived the
-  // DOM-level removal in the Puppeteer evaluate phase.  Uses a broad pattern
-  // that matches ANY `manifest.*.js` or `manifest.*.min.js` script — no need
-  // to enumerate individual plugin names.  New plugins are covered automatically.
-  const pluginPattern =
-    /<script[^>]*\ssrc=["'][^"']*manifest\.[a-z][\w.-]*\.(?:min\.)?js["'][^>]*>\s*<\/script>/gi;
-  let out = html.replace(pluginPattern, '');
-  // Alpine (re-injected by the loader at runtime after plugin registration)
-  const alpinePattern =
-    /<script[^>]*\ssrc=["'][^"']*\/alpinejs@[^"']*["'][^>]*>\s*<\/script>/gi;
-  out = out.replace(alpinePattern, '');
-  // Runtime library scripts loaded by plugins (yaml parser, markdown, etc.)
-  const runtimePattern =
-    /<script[^>]*\ssrc=["'][^"']*(?:papaparse[^"']*\.min\.js|marked[^"']*\.min\.js|highlight[^"']*\.min\.js|js-yaml[^"']*\.min\.js)[^"']*["'][^>]*>\s*<\/script>/gi;
-  out = out.replace(runtimePattern, '');
-  return out;
+// --- Strip scripts injected at runtime during prerender ---
+// The Manifest loader, Alpine, plugins, and third-party libraries inject
+// <script> tags into the DOM during the Puppeteer render.  These must be
+// removed from the serialized HTML so the loader can re-inject them fresh
+// at runtime (otherwise the addScript function finds an existing tag, waits
+// for a load event that already fired, and hangs forever).
+//
+// Approach: diff the prerendered HTML against the ORIGINAL index.html from
+// disk.  Any <script src="..."> whose src does NOT appear in the original
+// file was injected at runtime and must be stripped.  Inline scripts without
+// src are left alone (author-written analytics snippets, etc.).
+//
+// This is future-proof — new framework plugins, Alpine version bumps, and
+// arbitrary third-party scripts (webchat, analytics) are all handled
+// automatically without maintaining a hardcoded allowlist.
+let _originalScriptSrcs = null;
+
+function buildOriginalScriptSrcSet(rootDir) {
+  if (_originalScriptSrcs) return _originalScriptSrcs;
+  _originalScriptSrcs = new Set();
+  const indexPath = join(rootDir, 'index.html');
+  if (!existsSync(indexPath)) return _originalScriptSrcs;
+  const html = readFileSync(indexPath, 'utf8');
+  const srcPattern = /<script[^>]*\ssrc=["']([^"']+)["'][^>]*>/gi;
+  let m;
+  while ((m = srcPattern.exec(html)) !== null) {
+    _originalScriptSrcs.add(m[1]);
+  }
+  return _originalScriptSrcs;
+}
+
+function stripInjectedPluginScripts(html, rootDir) {
+  const originals = buildOriginalScriptSrcSet(rootDir);
+  // Remove every <script src="...">...</script> whose src is NOT in the
+  // original index.html.  This catches all loader-injected plugins, Alpine,
+  // runtime libraries (js-yaml, marked, highlight, etc.), and any third-party
+  // scripts added dynamically during the render.
+  return html.replace(/<script[^>]*\ssrc=["']([^"']+)["'][^>]*>\s*<\/script>/gi,
+    (full, src) => originals.has(src) ? full : ''
+  );
 }
 
 function stripRuntimeTailwindArtifacts(html) {
@@ -1391,7 +1405,7 @@ function generateLocaleVariantHtml({
 
   // Standard Node.js post-processing (same sequence as processPath)
   html = stripDevOnlyContent(html);
-  html = stripInjectedPluginScripts(html);
+  html = stripInjectedPluginScripts(html, config.root);
   if (tailwindBuilt) html = stripRuntimeTailwindArtifacts(html);
 
   const pageUtilityBlocks = [];
@@ -1460,6 +1474,26 @@ function loadContentForPrerender(manifest, rootDir, locale) {
     content = parseCsvToKeyValue(join(rootDir, data.slice(1)), loc);
   } else if (data && typeof data === 'object' && data.locales && typeof data.locales === 'string') {
     content = parseCsvToKeyValue(join(rootDir, data.locales.slice(1)), loc);
+  } else if (data && typeof data === 'object' && !Array.isArray(data)) {
+    // Per-locale files: { "en": "/data/content.en.yaml", "fr": "/data/content.fr.yaml", ... }
+    const filePath = data[loc] || data[Object.keys(data)[0]];
+    if (typeof filePath === 'string') {
+      const fullPath = join(rootDir, filePath.startsWith('/') ? filePath.slice(1) : filePath);
+      if (existsSync(fullPath)) {
+        try {
+          const raw = readFileSync(fullPath, 'utf8');
+          if (filePath.endsWith('.yaml') || filePath.endsWith('.yml')) {
+            let jsYaml = null;
+            try { jsYaml = require('js-yaml'); } catch { /* skip */ }
+            if (jsYaml) content = jsYaml.load(raw) || {};
+          } else if (filePath.endsWith('.json')) {
+            content = JSON.parse(raw);
+          } else if (filePath.endsWith('.csv')) {
+            content = parseCsvToKeyValue(fullPath, loc);
+          }
+        } catch { /* ignore parse errors */ }
+      }
+    }
   }
   if (manifest.description !== undefined && content.description === undefined) {
     content.description = manifest.description;
@@ -1532,15 +1566,27 @@ function resolveHeadXBindings(html, xData) {
     .replace(/>/g, '&gt;')
     .replace(/"/g, '&quot;');
   return html.replace(/<head>([\s\S]*?)<\/head>/i, (_, headContent) => {
-    let out = headContent.replace(
-      /(\s)(?::|x-bind:)(\w+)=["'](\$x\.[^"']+)["']/g,
-      (_, space, attr, expr) => {
+    // Process each tag in <head> that has a :attr or x-bind:attr binding
+    const out = headContent.replace(/<[^>]+>/g, (tag) => {
+      // Find all :attr="$x...." or x-bind:attr="$x...." bindings in this tag
+      const bindingRe = /\s(?::|x-bind:)(\w+)=["'](\$x\.[^"']+)["']/g;
+      let m;
+      let newTag = tag;
+      while ((m = bindingRe.exec(tag)) !== null) {
+        const attr = m[1];
+        const expr = m[2];
         const path = expr.replace(/^\$x\./, '').trim();
         const value = getXPath(xData, path);
-        if (value === undefined) return _;
-        return `${space}${attr}="${esc(value)}"`;
+        if (value === undefined) continue;
+        // Remove the binding
+        newTag = newTag.replace(m[0], '');
+        // Remove existing static fallback for this attr
+        newTag = newTag.replace(new RegExp(`\\s${attr}=["'][^"']*["']`), '');
+        // Insert the resolved attr before the closing >
+        newTag = newTag.replace(/>$/, ` ${attr}="${esc(value)}">`);
       }
-    );
+      return newTag;
+    });
     return `<head>${out}</head>`;
   });
 }
@@ -1999,22 +2045,6 @@ async function runPrerender(config) {
       // (`hydratePrerenderedPage` in manifest.js) reads the contract and
       // restores source attributes before Alpine starts.
       await page.evaluateOnNewDocument(() => {
-        // Snapshot the script srcs that exist in the author's original HTML
-        // BEFORE any loader/plugin injects additional scripts.  Used later to
-        // strip runtime-injected scripts from the serialized output while
-        // keeping author-intentional ones (analytics, third-party widgets, etc.).
-        window.__manifestOriginalScriptSrcs = new Set();
-        const _snapScripts = () => {
-          document.querySelectorAll('script[src]').forEach(s => {
-            window.__manifestOriginalScriptSrcs.add(s.getAttribute('src'));
-          });
-        };
-        if (document.readyState === 'loading') {
-          document.addEventListener('DOMContentLoaded', _snapScripts, { once: true });
-        }
-        // Also snap immediately for any scripts already parsed
-        _snapScripts();
-
         // element -> { attrName: originalValue (null if attribute was absent) }
         // Keyed by reference so detached elements drop out naturally.
         const sourceAttrs = new Map();
@@ -2857,20 +2887,6 @@ async function runPrerender(config) {
         toRemove.forEach((el) => { if (document.contains(el)) el.remove(); });
       });
 
-      // Remove scripts that were injected at runtime (by the loader, plugins,
-      // or third-party libraries) but were NOT in the author's original HTML.
-      // This is done in the browser context (before serialization) so the
-      // removal is permanent in the captured outerHTML.  The approach is
-      // future-proof: new plugins and arbitrary third-party scripts are handled
-      // automatically without updating a hardcoded allowlist.
-      await page.evaluate(() => {
-        const originals = window.__manifestOriginalScriptSrcs || new Set();
-        document.querySelectorAll('script[src]').forEach(s => {
-          const src = s.getAttribute('src');
-          if (src && !originals.has(src)) s.remove();
-        });
-      });
-
       let html = await page.evaluate(() => document.documentElement.outerHTML);
       // Inject the hydration contract blob into the raw HTML *before* caching
       // it for locale variant generation, so every locale variant inherits the
@@ -2897,7 +2913,7 @@ async function runPrerender(config) {
         pushDebug({ path: displayPath, stage: 'pre-serialize', metrics: post });
       }
       html = stripDevOnlyContent(html);
-      html = stripInjectedPluginScripts(html);
+      html = stripInjectedPluginScripts(html, config.root);
       if (tailwindBuilt) {
         html = stripRuntimeTailwindArtifacts(html);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mnfst-render",
-  "version": "0.5.15",
+  "version": "0.5.17",
   "description": "Render Manifest sites to static HTML for SEO",
   "type": "module",
   "bin": {