@bractjs/bractjs 0.1.10 → 0.1.12

package/bin/cli.ts

@@ -64,6 +64,9 @@ switch (command) {
     break;
 
   case "dev":
+    // Ensure dev-only handlers gated by isExplicitDev() (e.g. /_hmr/module,
+    // /_bractjs/devtools.js) are reachable when the user hasn't set NODE_ENV.
+    if (!process.env.NODE_ENV) process.env.NODE_ENV = "development";
     await import("../src/dev/server.ts");
     break;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bractjs/bractjs",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Production-grade SSR framework for Bun + React 19. File-based routing, streaming SSR, server actions, typed routes.",
   "license": "MIT",
   "homepage": "https://github.com/bractjs/bractjs#readme",

package/src/dev/hmr-client.ts

@@ -18,7 +18,7 @@ export const hmrClientScript: string = `
     import('/_bractjs/devtools.js').then(function(m) {
       if (typeof m.injectDevtools === 'function') m.injectDevtools();
     }).catch(function() {
-      // DevTools module not available — skip silently.
+      // DevTools module not available - skip silently.
     });
   }
 
@@ -32,7 +32,7 @@ export const hmrClientScript: string = `
         } else if (msg.type === "hmr:route" && msg.pattern != null && msg.chunkUrl) {
           // Validate chunk URL is a same-origin relative path before importing.
           // Prevents a compromised/MITM'd dev WS from executing arbitrary URLs.
-          if (typeof msg.chunkUrl !== 'string' || !/^\/build\//.test(msg.chunkUrl)) {
+          if (typeof msg.chunkUrl !== 'string' || !/^\\/build\\//.test(msg.chunkUrl)) {
             return;
           }
           // Cache-bust so the browser re-fetches the rebuilt chunk.

package/src/server/serve.ts

@@ -95,6 +95,25 @@ export function buildFetchHandler(config: Partial<BractJSConfig>) {
       return handleHmrModuleRequest(url, appDir);
     }
 
+    // Dev-only: serve the DevTools panel module imported by hmr-client.
+    // SECURITY(high): gated by isExplicitDev() so production never compiles
+    // and ships package internals as JS.
+    if (isExplicitDev() && pathname === "/_bractjs/devtools.js") {
+      const devtoolsEntry = resolve(import.meta.dir, "../dev/devtools.ts");
+      const built = await Bun.build({
+        entrypoints: [devtoolsEntry],
+        target: "browser",
+        minify: false,
+        sourcemap: "inline",
+      });
+      if (!built.success || built.outputs.length === 0) {
+        return new Response("DevTools build failed", { status: 500 });
+      }
+      return new Response(await built.outputs[0].text(), {
+        headers: { "Content-Type": "text/javascript", "Cache-Control": "no-store" },
+      });
+    }
+
     // Typed API routes (registered via bract.route())
     if (pathname.startsWith("/api")) {
       const { handleApiRequest } = await import("./api-route.ts");