@jay-framework/dev-server 0.25.4 → 0.26.0

package/dist/index.d.ts

@@ -39,6 +39,19 @@ interface DevServerOptions {
     logLevel?: LogLevel;
     /** HTTP server for HMR WebSocket attachment (avoids default port 24678 collision) */
     httpServer?: Server;
+    /**
+     * Hosts the dev server's Vite host-check accepts, beyond localhost (DL#220). A list of hosts
+     * (Vite host-suffix syntax, e.g. `.example.dev`), or `true` to disable the check entirely — for
+     * cloud preview proxies. Merged with the `__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS` env var.
+     */
+    allowedHosts?: string[] | true;
+    /**
+     * Enable source-editing dev markers (DL#219). When true, the pre-render pipeline injects
+     * `jay-dev-src` / `jay-dev-item` attributes so the source-editing inspector can map a rendered
+     * pixel back to its jay-html source. Off by default — the markers change rendered output, so
+     * they are only emitted for AIditor / source-editing sessions.
+     */
+    sourceEditing?: boolean;
 }
 
 /**
@@ -173,6 +186,35 @@ declare class DevServerService {
     loadRouteParams(routePath: string): AsyncGenerator<Record<string, string>[]>;
 }
 
+/**
+ * Percent-encode `[`/`]` in the path of asset URLs (`href`/`src`) in served HTML.
+ *
+ * Dynamic routes produce asset paths with literal brackets (e.g.
+ * `.../pre-rendered/products/[slug]/page.css`), whether Vite serves them as
+ * `/@fs/…` or root-relative. Bare brackets in a URL are rejected by some
+ * dev-machine hosting proxies — the browser then sees an empty MIME type
+ * ("Refused to apply style … MIME type ('')"). This mirrors the production fix
+ * (DL#144/R7), which encodes brackets in *all* frontend asset paths; it is
+ * deliberately NOT `/@fs/`-specific (production has no `@fs`).
+ *
+ * Encoding only the emitted URL is sufficient and safe: the dev servers that
+ * handle these requests — Vite (`decodeURI`) and serve-static/express
+ * (`decodeURIComponent`) — decode `%5B` back to `[`, and CSS/module loading
+ * resolves via the plugin's `meta.originId` (not the id), so the encoded URL
+ * still maps to the literal on-disk file. Only the path (before `?`) is touched,
+ * so query strings (e.g. `?a[]=1`) are intact. In practice only asset URLs carry
+ * brackets — resolved navigation hrefs do not — so real links are unaffected.
+ * Exported so the dev-serving test guards the real behavior rather than a copy.
+ */
+declare function encodeBracketsInAssetUrls(html: string): string;
+/**
+ * Filesystem-safe name for the per-route debug artifact, derived from the route
+ * path only (DL#229). The query string is dropped — otherwise a long query
+ * (e.g. an ~800-char auth token passed by a hosting proxy) pushes the filename
+ * past `NAME_MAX` (255) and `fs.writeFile` throws `ENAMETOOLONG`. Also strips
+ * non-fs-safe characters and length-caps as defense-in-depth. Pure → unit-tested.
+ */
+declare function debugPageName(url: string | undefined): string;
 interface DevServerRoute {
     path: string;
     handler: RequestHandler;
@@ -277,7 +319,21 @@ interface CreateViteServerOptions {
     clearScreen?: boolean;
     /** HTTP server for HMR WebSocket (avoids default port 24678 collision) */
     httpServer?: Server;
+    /**
+     * Hosts Vite's dev-server host-check accepts, beyond localhost (DL#220). A list of hosts (Vite
+     * host-suffix syntax, e.g. `.example.dev`), or `true` to disable the check entirely. Merged with
+     * the `__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS` env var. `undefined`/empty → Vite's default.
+     */
+    allowedHosts?: string[] | true;
 }
+/**
+ * Resolves Vite's `server.allowedHosts` from the `.jay` config value and the
+ * `__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS` env var (Vite's own convention — honored natively only in
+ * Vite 6, so the nested Vite 5.4 needs us to read it). Returns `true` (disable check) if either source
+ * says so, a de-duplicated merged list otherwise, or `undefined` when neither is set (Vite keeps its
+ * localhost-only default). (DL#220)
+ */
+declare function resolveAllowedHosts(fromConfig: string[] | true | undefined, env: string | undefined): string[] | true | undefined;
 /**
  * Creates a Vite server configured for Jay Stack.
  *
@@ -297,4 +353,4 @@ declare function createViteForCli(options: {
     tsConfigFilePath?: string;
 }): Promise<ViteDevServer>;
 
-export { ACTION_ENDPOINT_BASE, type ActionBodyParserOptions, type ActionRouterOptions, type CreateViteServerOptions, DEV_SERVER_SERVICE, type DevServer, type DevServerOptions, type DevServerRoute, type DevServerRouteRegistrar, DevServerService, type FreezeEntry, FreezeStore, type RouteInfo, actionBodyParser, createActionRouter, createViteForCli, createViteServer, mkDevServer };
+export { ACTION_ENDPOINT_BASE, type ActionBodyParserOptions, type ActionRouterOptions, type CreateViteServerOptions, DEV_SERVER_SERVICE, type DevServer, type DevServerOptions, type DevServerRoute, type DevServerRouteRegistrar, DevServerService, type FreezeEntry, FreezeStore, type RouteInfo, actionBodyParser, createActionRouter, createViteForCli, createViteServer, debugPageName, encodeBracketsInAssetUrls, mkDevServer, resolveAllowedHosts };

package/dist/index.js

@@ -7,15 +7,15 @@ import { createRequire } from "module";
 import "@jay-framework/compiler-shared";
 import * as path from "node:path";
 import path__default from "node:path";
-import { parseJayFile, JAY_IMPORT_RESOLVER, discoverHeadlessInstances, assignCoordinatesToJayHtml, parseAction, generateServerElementFile, parseContract, slowRenderTransform } from "@jay-framework/compiler-jay-html";
+import { parseJayFile, JAY_IMPORT_RESOLVER, discoverHeadlessInstances, assignCoordinatesToJayHtml, parseAction, generateServerElementFile, noteExportedTypesFileChanged, injectDevMarkers, parseContract, slowRenderTransform } from "@jay-framework/compiler-jay-html";
 import { getLogger, getDevLogger } from "@jay-framework/logger";
 import { createRequire as createRequire$1 } from "node:module";
 import * as fs from "node:fs";
-import fs__default$1 from "node:fs";
+import fs__default from "node:fs";
 import { scanRoutes, createRoute, routeToExpressRoute } from "@jay-framework/stack-route-scanner";
-import { makePassthroughInstanceComponent, actionRegistry, scanPlugins, serializeHeadTags, mergeHeadTags, serializeScripts, discoverPluginsWithInit, sortPluginsByDependencies, executePluginServerInits, runInitCallbacks, runShutdownCallbacks, clearLifecycleCallbacks, clearServiceRegistry, clearClientInitData, runLoadParams, DevSlowlyChangingPhase, preparePluginClientInits, registerService, getServiceRegistry, parseCookies, renderFastChangingData, getClientInitData, slowRenderInstances, normalizeInstancePropNames, resolveErrorPageToken, buildErrorViewState } from "@jay-framework/stack-server-runtime";
+import { makePassthroughInstanceComponent, actionRegistry, scanPlugins, serializeHeadTags, mergeHeadTags, serializeScripts, discoverPluginsWithInit, sortPluginsByDependencies, executePluginServerInits, runInitCallbacks, runShutdownCallbacks, clearLifecycleCallbacks, clearServiceRegistry, clearClientInitData, crossOriginErrorResponse, needsSameOriginCheck, isCrossOriginRequest, isSecureRequest, parseCookies, runLoadParams, DevSlowlyChangingPhase, preparePluginClientInits, registerService, getServiceRegistry, renderFastChangingData, getClientInitData, slowRenderInstances, normalizeInstancePropNames, resolveErrorPageToken, buildErrorViewState } from "@jay-framework/stack-server-runtime";
 import * as fs$1 from "node:fs/promises";
-import fs__default from "node:fs/promises";
+import fs$1__default from "node:fs/promises";
 import jsBeautify from "js-beautify";
 import fs$2 from "fs";
 import path$1 from "path";
@@ -1052,7 +1052,9 @@ function extractActionFromExpression(node) {
       current = expr.expression;
       continue;
     }
-    if (c$1.isPropertyAccessExpression(expr) && ["withServices", "withCaching", "withHandler", "withTimeout"].includes(expr.name.text)) {
+    if (c$1.isPropertyAccessExpression(expr) && ["withServices", "withCaching", "withHandler", "withTimeout", "withRequest"].includes(
+      expr.name.text
+    )) {
       current = expr.expression;
       continue;
     }
@@ -1518,6 +1520,13 @@ function jayStackCompiler(options = {}) {
 function stripInlineActionBuilders(code, builderNames) {
   return transformJayStackBuilder(code, "action-strip.ts", "client", new Set(builderNames));
 }
+function resolveAllowedHosts(fromConfig, env) {
+  if (fromConfig === true) return true;
+  const envHosts = (env ?? "").split(",").map((host) => host.trim()).filter(Boolean);
+  if (envHosts.includes("true")) return true;
+  const merged = [...fromConfig ?? [], ...envHosts];
+  return merged.length ? Array.from(new Set(merged)) : void 0;
+}
 async function createViteServer(options) {
   const {
     projectRoot,
@@ -1526,14 +1535,21 @@ async function createViteServer(options) {
     jayRollupConfig = { tsConfigFilePath: path__default.join(projectRoot, "tsconfig.json") },
     logLevel = "info",
     clearScreen = true,
-    httpServer
+    httpServer,
+    allowedHosts
   } = options;
+  const resolvedAllowedHosts = resolveAllowedHosts(
+    allowedHosts,
+    process.env.__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS
+  );
   const vite = await createServer({
     // Don't start HTTP server - we use middleware mode
     server: {
       middlewareMode: true,
       hmr: httpServer ? { server: httpServer } : void 0,
-      watch: { ignored: ["**/build/**"] }
+      watch: { ignored: ["**/build/**"] },
+      // Omit the key entirely when unset so Vite keeps its localhost-only default (DL#220).
+      ...resolvedAllowedHosts !== void 0 && { allowedHosts: resolvedAllowedHosts }
     },
     // Use Jay Stack compiler for .jay-html and other custom transforms
     plugins: [
@@ -1623,7 +1639,7 @@ function resolveClientImportPath(route) {
   return route.compPath;
 }
 async function loadPageParts(vite, route, pagesBase, projectBase, jayRollupConfig, options) {
-  const exists = await fs__default.access(route.compPath, fs__default.constants.F_OK).then(() => true).catch(() => false);
+  const exists = await fs$1__default.access(route.compPath, fs$1__default.constants.F_OK).then(() => true).catch(() => false);
   const parts = [];
   const validations = [];
   if (exists) {
@@ -1643,7 +1659,7 @@ async function loadPageParts(vite, route, pagesBase, projectBase, jayRollupConfi
     }
   }
   const jayHtmlFilePath = options?.preRenderedPath ?? route.jayHtmlPath;
-  const jayHtmlSource = options?.preRenderedContent ?? (await fs__default.readFile(jayHtmlFilePath)).toString();
+  const jayHtmlSource = options?.preRenderedContent ?? (await fs$1__default.readFile(jayHtmlFilePath)).toString();
   const fileName = path__default.basename(route.jayHtmlPath);
   const dirName = path__default.dirname(route.jayHtmlPath);
   const jayHtmlWithValidations = await parseJayFile(
@@ -2018,8 +2034,9 @@ function buildPageReloadHmrScript() {
         });
       }`;
 }
-function buildFreezeScript(routePattern) {
+function buildFreezeScript(routePattern, sourceFile) {
   const routePatternLiteral = routePattern ? `'${routePattern}'` : "undefined";
+  const sourceFileLiteral = sourceFile ? JSON.stringify(sourceFile) : "undefined";
   return `
       // Page Freeze (DL#127, DL#128 iframe addendum)
       // Sticky embed mode: URL param sets a session cookie so in-iframe navigation preserves it
@@ -2074,13 +2091,152 @@ function buildFreezeScript(routePattern) {
           }
       }
 
+      // Source-editing inspector (DL#219). Resolves a viewport point/rect to the jay-dev-* source
+      // markers emitted when the dev server runs with sourceEditing on. Harmless without markers —
+      // it simply finds no jay-dev-src and replies node:null. Reply carries source LOCATORS (line
+      // ranges + route) plus runtime identities (forEach record id, region name + static props);
+      // the agent reads bound expressions / collection / if-conditions from the jay-html itself.
+      function __jayParseLines(s) {
+        if (!s) return null;
+        const parts = s.split(':');
+        return { from: parseInt(parts[0], 10), to: parseInt(parts[1], 10) };
+      }
+      function __jayLines(el) {
+        return __jayParseLines(el.getAttribute('jay-dev-src'));
+      }
+      // A significant enclosing frame: a forEach item root or a region boundary. Returns null for
+      // plain wrapper elements (the agent reconstructs those from source via node.lines).
+      function __jayFrame(el) {
+        const item = el.getAttribute('jay-dev-item');
+        if (item) return { kind: 'forEach', lines: __jayLines(el), itemId: item };
+        const region = el.getAttribute('jay-dev-region');
+        if (region) {
+          // Region lines live in jay-dev-region-src (the <jay:…> tag's range), distinct from the
+          // root element's own jay-dev-src.
+          const frame = { kind: 'region', lines: __jayParseLines(el.getAttribute('jay-dev-region-src')), name: region };
+          const rawProps = el.getAttribute('jay-dev-region-props');
+          if (rawProps) { try { frame.props = JSON.parse(decodeURIComponent(rawProps)); } catch (e) {} }
+          return frame;
+        }
+        return null;
+      }
+      // One-level HTML of an element: its open tag (authored attrs only, jay-* stripped), its direct
+      // children shown as empty tags (grandchildren elided with …), and its text — so the agent sees
+      // exactly what was clicked inside generated content without the whole subtree.
+      function __jayOneLevelHtml(el) {
+        if (!el || !el.tagName) return '';
+        const tag = el.tagName.toLowerCase();
+        let attrs = '';
+        for (let i = 0; i < el.attributes.length; i++) {
+          const a = el.attributes[i];
+          if (a.name.indexOf('jay-') === 0) continue; // strip jay-dev-* / jay-coordinate
+          attrs += ' ' + a.name + '="' + a.value + '"';
+        }
+        let inner = '';
+        const kids = el.childNodes || [];
+        for (let i = 0; i < kids.length; i++) {
+          const c = kids[i];
+          if (c.nodeType === 3) inner += (c.textContent || '');
+          else if (c.nodeType === 1) {
+            const ct = c.tagName.toLowerCase();
+            inner += '<' + ct + '>' + (c.childNodes && c.childNodes.length ? '…' : '') + '</' + ct + '>';
+          }
+        }
+        if (inner.length > 300) inner = inner.slice(0, 300) + '…';
+        return '<' + tag + attrs + '>' + inner + '</' + tag + '>';
+      }
+      function __jayResolveElement(el) {
+        if (!el) return null;
+        // Walk el up to (but excluding) <body>.
+        const entries = [];
+        let cur = el;
+        while (cur && cur.nodeType === 1 && cur.tagName && cur.tagName.toLowerCase() !== 'body') {
+          entries.push(cur);
+          cur = cur.parentElement;
+        }
+        // Source anchor = nearest element at/above el carrying a source marker (its line range).
+        let sourceEl = null;
+        for (let i = 0; i < entries.length; i++) {
+          if (entries[i].getAttribute('jay-dev-src')) { sourceEl = entries[i]; break; }
+        }
+        if (!sourceEl) return null;
+        // Stack = only the significant enclosing frames (forEach + region), innermost → outermost.
+        const stack = [];
+        for (let i = 0; i < entries.length; i++) {
+          const f = __jayFrame(entries[i]);
+          if (f) stack.push(f);
+        }
+        // node describes the ACTUAL element el (what the pointer hit / the rect chose). html — a
+        // one-level rendering (open tag with authored attrs, direct children as empty tags, inline
+        // text; grandchildren + long text elided) — is the single content field: it carries the tag,
+        // attributes (src/href/value), and value, bounded in size. lines come from the source anchor;
+        // for bound/generated content (an html-string value) el has no jay-dev-src of its own, so
+        // lines point to the ENCLOSING binding (the editable source) and contentFromBinding flags it.
+        const r = el.getBoundingClientRect();
+        const node = {
+          lines: __jayLines(sourceEl),
+          tag: el.tagName ? el.tagName.toLowerCase() : '',
+          html: __jayOneLevelHtml(el),
+          rect: { x: r.x, y: r.y, width: r.width, height: r.height },
+        };
+        const childEls = Array.prototype.slice.call(el.children || []);
+        const childrenGenerated =
+          childEls.length > 0 && childEls.every((c) => !c.getAttribute('jay-dev-src'));
+        if (!el.getAttribute('jay-dev-src') || childrenGenerated) {
+          node.contentFromBinding = true;
+        }
+        return { node, stack };
+      }
+      function __jayInspectPoint(x, y) {
+        return __jayResolveElement(document.elementFromPoint(x, y));
+      }
+      function __jayInspectRect(x, y, w, h) {
+        const sel = { left: x, top: y, right: x + w, bottom: y + h };
+        const marked = Array.prototype.slice.call(document.querySelectorAll('[jay-dev-src]'));
+        let best = null, bestArea = -1;
+        for (let i = 0; i < marked.length; i++) {
+          const el = marked[i];
+          const r = el.getBoundingClientRect();
+          const elArea = r.width * r.height;
+          if (elArea <= 0) continue;
+          const ix = Math.max(0, Math.min(sel.right, r.right) - Math.max(sel.left, r.left));
+          const iy = Math.max(0, Math.min(sel.bottom, r.bottom) - Math.max(sel.top, r.top));
+          // Rect rule (DL#219): keep elements the box mostly encloses (overlap over the ELEMENT's
+          // own area >= 0.8), then pick the LARGEST — the element the box was drawn around. A tight
+          // box only clears the threshold for the small element; a big box clears it for the
+          // container too, and largest-area returns the container (not its first child).
+          if ((ix * iy) / elArea >= 0.8 && elArea > bestArea) {
+            bestArea = elArea;
+            best = el;
+          }
+        }
+        if (best) return __jayResolveElement(best);
+        return __jayInspectPoint(x + w / 2, y + h / 2);
+      }
+
       if (__jayEmbedMode) {
         // Notify parent of the current route on load (DL#128 route addendum)
         window.parent.postMessage({ type: 'jay:route', route: window.location.pathname, routePattern: ${routePatternLiteral} }, '*');
 
-        // Embed mode: parent triggers freeze via postMessage
+        // Embed mode: parent triggers freeze / inspect via postMessage
         window.addEventListener('message', (e) => {
-          if (e.data?.type === 'jay:requestFreeze') __jayDoFreeze();
+          const d = e.data;
+          if (!d) return;
+          if (d.type === 'jay:requestFreeze') { __jayDoFreeze(); return; }
+          if (d.type === 'jay:inspectPoint' || d.type === 'jay:inspectRect') {
+            const result = d.type === 'jay:inspectPoint'
+              ? __jayInspectPoint(d.x, d.y)
+              : __jayInspectRect(d.x, d.y, d.width, d.height);
+            window.parent.postMessage({
+              type: 'jay:inspectResult',
+              requestId: d.requestId,
+              file: ${sourceFileLiteral},
+              route: window.location.pathname,
+              routePattern: ${routePatternLiteral},
+              node: result ? result.node : null,   // node.rect is the matched element's on-screen box
+              stack: result ? result.stack : [],
+            }, '*');
+          }
         });
       } else {
         // Standalone: Alt+S / Option+S keyboard shortcut
@@ -2105,7 +2261,7 @@ function buildAutomationWrap(options, mode) {
   }
   const appendLine = appendDom ? `
       target.appendChild(wrapped.element.dom);` : "";
-  const freezeScript = buildFreezeScript(options.routePattern);
+  const freezeScript = buildFreezeScript(options.routePattern, options.sourceFile);
   if (hasSlowViewState) {
     return `
       // Wrap with automation for dev tooling
@@ -2358,7 +2514,7 @@ async function generateFrozenPageHtml(vite, jayHtmlContent, jayHtmlFilename, jay
     if (cached.cssHref) {
       try {
         const cssPath = cached.cssHref.replace(/^\/@fs/, "").replace(/\?.*$/, "");
-        const cssContent = await fs__default.readFile(cssPath, "utf-8");
+        const cssContent = await fs$1__default.readFile(cssPath, "utf-8");
         inlineCss = `<style>${cssContent}</style>`;
       } catch {
         inlineCss = `<link rel="stylesheet" href="${cached.cssHref}" />`;
@@ -2437,11 +2593,11 @@ async function compileAndLoadServerElement(vite, jayHtmlContent, jayHtmlFilename
     generateServerElementFile(parsedJayFile, serverElementOptions)
   );
   const serverElementDir = path__default.join(buildFolder, "pre-rendered", routeDir);
-  await fs__default.mkdir(serverElementDir, { recursive: true });
+  await fs$1__default.mkdir(serverElementDir, { recursive: true });
   const adjustedCode = rebaseRelativeImports(serverElementCode, jayHtmlDir, serverElementDir);
   const serverElementFilename = jayHtmlFilename.replace(".jay-html", ".server-element.ts");
   const serverElementPath = path__default.join(serverElementDir, serverElementFilename);
-  await fs__default.writeFile(serverElementPath, adjustedCode, "utf-8");
+  await fs$1__default.writeFile(serverElementPath, adjustedCode, "utf-8");
   const existingModule = vite.moduleGraph.getModuleById(serverElementPath);
   if (existingModule) {
     vite.moduleGraph.invalidateModule(existingModule);
@@ -2453,7 +2609,7 @@ async function compileAndLoadServerElement(vite, jayHtmlContent, jayHtmlFilename
   if (parsedJayFile.css) {
     const cssFilename = jayHtmlFilename.replace(".jay-html", ".css");
     const cssPath = path__default.join(serverElementDir, cssFilename);
-    await fs__default.writeFile(cssPath, parsedJayFile.css, "utf-8");
+    await fs$1__default.writeFile(cssPath, parsedJayFile.css, "utf-8");
     const cssModules = vite.moduleGraph.getModulesByFile(cssPath);
     if (cssModules) {
       for (const mod of cssModules) {
@@ -3530,7 +3686,7 @@ class SlowRenderCache {
     const preRenderedPath = this.computeCachePath(jayHtmlPath, params, routeDir);
     let fileContent;
     try {
-      fileContent = await fs__default.readFile(preRenderedPath, "utf-8");
+      fileContent = await fs$1__default.readFile(preRenderedPath, "utf-8");
     } catch {
       return void 0;
     }
@@ -3558,8 +3714,8 @@ class SlowRenderCache {
       carryForward,
       jayHtmlPath
     );
-    await fs__default.mkdir(path__default.dirname(preRenderedPath), { recursive: true });
-    await fs__default.writeFile(preRenderedPath, fileContent, "utf-8");
+    await fs$1__default.mkdir(path__default.dirname(preRenderedPath), { recursive: true });
+    await fs$1__default.writeFile(preRenderedPath, fileContent, "utf-8");
     this.trackFile(jayHtmlPath, preRenderedPath);
     return {
       preRenderedPath,
@@ -3575,7 +3731,7 @@ class SlowRenderCache {
   async has(jayHtmlPath, params, routeDir) {
     const preRenderedPath = this.computeCachePath(jayHtmlPath, params, routeDir);
     try {
-      await fs__default.access(preRenderedPath);
+      await fs$1__default.access(preRenderedPath);
       return true;
     } catch {
       return false;
@@ -3590,7 +3746,7 @@ class SlowRenderCache {
     if (files) {
       for (const filePath of files) {
         try {
-          await fs__default.unlink(filePath);
+          await fs$1__default.unlink(filePath);
         } catch {
         }
       }
@@ -3627,14 +3783,14 @@ class SlowRenderCache {
     for (const files of this.pathToFiles.values()) {
       for (const filePath of files) {
         try {
-          await fs__default.unlink(filePath);
+          await fs$1__default.unlink(filePath);
         } catch {
         }
       }
     }
     this.pathToFiles.clear();
     try {
-      await fs__default.rm(this.cacheDir, { recursive: true, force: true });
+      await fs$1__default.rm(this.cacheDir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -3685,11 +3841,11 @@ class SlowRenderCache {
     const basename = path__default.basename(jayHtmlPath, ".jay-html");
     const cacheSubDir = path__default.join(this.cacheDir, dir);
     try {
-      const files = await fs__default.readdir(cacheSubDir);
+      const files = await fs$1__default.readdir(cacheSubDir);
       for (const file of files) {
         if (file.startsWith(basename)) {
           try {
-            await fs__default.unlink(path__default.join(cacheSubDir, file));
+            await fs$1__default.unlink(path__default.join(cacheSubDir, file));
           } catch {
           }
         }
@@ -4005,6 +4161,10 @@ function createActionRouter(options) {
       });
       return;
     }
+    if (isRejectedCrossOrigin(action, req)) {
+      res.status(403).json(crossOriginErrorResponse(actionName));
+      return;
+    }
     let input;
     try {
       if (requestMethod === "GET") {
@@ -4036,11 +4196,15 @@ function createActionRouter(options) {
     const cleanup = () => {
       if (tempDir) cleanupTempDir(tempDir);
     };
+    const incoming = action.needsRequest ? readIncomingRequest(req) : void 0;
+    if (action.needsRequest) {
+      res.set("Cache-Control", registry.getCacheHeaders(actionName));
+    }
     if (registry.isStreaming(actionName)) {
       res.setHeader("Content-Type", "application/x-ndjson");
       res.setHeader("Transfer-Encoding", "chunked");
       try {
-        const generator = registry.executeStream(actionName, input);
+        const generator = registry.executeStream(actionName, input, incoming);
         for await (const chunk of generator) {
           res.write(JSON.stringify({ chunk }) + "\n");
         }
@@ -4053,7 +4217,7 @@ function createActionRouter(options) {
       timing?.end();
       return;
     }
-    const result = await registry.execute(actionName, input);
+    const result = await registry.execute(actionName, input, incoming);
     cleanup();
     if (requestMethod === "GET" && result.success) {
       const cacheHeaders = registry.getCacheHeaders(actionName);
@@ -4062,6 +4226,9 @@ function createActionRouter(options) {
       }
     }
     if (result.success) {
+      for (const setCookie of result.setCookies ?? []) {
+        res.append("Set-Cookie", setCookie);
+      }
       res.status(200).json({
         success: true,
         data: result.data
@@ -4076,6 +4243,19 @@ function createActionRouter(options) {
     timing?.end();
   };
 }
+function isRejectedCrossOrigin(action, req) {
+  return needsSameOriginCheck(action) && isCrossOriginRequest({
+    secFetchSite: req.headers["sec-fetch-site"],
+    origin: req.headers.origin,
+    requestOrigin: `${req.protocol}://${req.headers.host}`
+  });
+}
+function readIncomingRequest(req) {
+  return {
+    cookies: parseCookies(req.headers.cookie),
+    secure: isSecureRequest(req.protocol, req.headers["x-forwarded-proto"])
+  };
+}
 function getStatusCodeForError(code, isActionError) {
   if (isActionError) {
     return 422;
@@ -4206,6 +4386,11 @@ function actionBodyParser(options) {
       next();
       return;
     }
+    const routedAction = registryToUse.get(req.path.slice(ACTION_ENDPOINT_BASE.length + 1));
+    if (routedAction && isRejectedCrossOrigin(routedAction, req)) {
+      next();
+      return;
+    }
     const contentType = req.headers["content-type"] || "";
     if (contentType.startsWith("multipart/form-data")) {
       const actionName = req.path.slice(ACTION_ENDPOINT_BASE.length + 1);
@@ -4402,6 +4587,30 @@ class DevServerService {
     yield* runLoadParams(loaded.val.parts);
   }
 }
+function encodeBracketsInAssetUrls(html) {
+  return html.replace(/\b(href|src)="([^"]*)"/g, (whole, attr, value) => {
+    const q = value.indexOf("?");
+    const pathPart = q === -1 ? value : value.slice(0, q);
+    if (!pathPart.includes("[") && !pathPart.includes("]")) return whole;
+    const encodedPath = pathPart.replace(/\[/g, "%5B").replace(/\]/g, "%5D");
+    return `${attr}="${encodedPath}${q === -1 ? "" : value.slice(q)}"`;
+  });
+}
+function debugPageName(url) {
+  const routePath = (url || "/").split("?")[0];
+  if (routePath === "/" || routePath === "") return "index";
+  return routePath.replace(/^\//, "").replace(/\//g, "-").replace(/[^\w.-]/g, "_").slice(0, 200) || "index";
+}
+async function writeDebugPage(options, url, html) {
+  if (options.logLevel !== "verbose" || !options.buildFolder) return;
+  try {
+    const clientScriptDir = path__default.join(options.buildFolder, "debug", "client-entry");
+    await fs$1__default.mkdir(clientScriptDir, { recursive: true });
+    await fs$1__default.writeFile(path__default.join(clientScriptDir, `${debugPageName(url)}.html`), html, "utf-8");
+  } catch (e2) {
+    getLogger().info(`[dev] debug page write skipped: ${e2.message}`);
+  }
+}
 let _watchLinkedFiles = () => {
 };
 async function initRoutes(pagesBaseFolder) {
@@ -4469,7 +4678,7 @@ function resolvePluginExport(pluginPath, exportSubpath) {
   const normalized = exportSubpath.replace(/^\.\//, "");
   const packageJsonPath = path__default.join(pluginPath, "package.json");
   try {
-    const packageJson = JSON.parse(fs__default$1.readFileSync(packageJsonPath, "utf-8"));
+    const packageJson = JSON.parse(fs__default.readFileSync(packageJsonPath, "utf-8"));
     if (packageJson.exports) {
       const exportKey = "./" + normalized;
       const exportValue = packageJson.exports[exportKey];
@@ -4486,7 +4695,7 @@ function resolvePluginExport(pluginPath, exportSubpath) {
   for (const dir of ["dist", "lib", ""]) {
     const candidate = path__default.join(pluginPath, dir, normalized);
     try {
-      fs__default$1.accessSync(candidate);
+      fs__default.accessSync(candidate);
       return candidate;
     } catch {
     }
@@ -4495,14 +4704,14 @@ function resolvePluginExport(pluginPath, exportSubpath) {
 }
 function resolvePluginModule(plugin, exportKey = ".") {
   const pkgJsonPath = path__default.join(plugin.pluginPath, "package.json");
-  if (fs__default$1.existsSync(pkgJsonPath)) {
+  if (fs__default.existsSync(pkgJsonPath)) {
     try {
-      const pkg = JSON.parse(fs__default$1.readFileSync(pkgJsonPath, "utf-8"));
+      const pkg = JSON.parse(fs__default.readFileSync(pkgJsonPath, "utf-8"));
       const mainExport = pkg.exports?.[exportKey];
       const mainPath = typeof mainExport === "string" ? mainExport : mainExport?.default || mainExport?.import || pkg.main;
       if (mainPath) {
         const resolved = path__default.join(plugin.pluginPath, mainPath);
-        if (fs__default$1.existsSync(resolved)) return resolved;
+        if (fs__default.existsSync(resolved)) return resolved;
       }
     } catch {
     }
@@ -4511,7 +4720,7 @@ function resolvePluginModule(plugin, exportKey = ".") {
   for (const ext of [".ts", ".js", "/index.ts", "/index.js"]) {
     const candidate = path__default.join(plugin.pluginPath, modulePath + ext);
     try {
-      fs__default$1.accessSync(candidate);
+      fs__default.accessSync(candidate);
       return candidate;
     } catch {
     }
@@ -4519,7 +4728,7 @@ function resolvePluginModule(plugin, exportKey = ".") {
   for (const ext of [".ts", ".js"]) {
     const candidate = path__default.join(plugin.pluginPath, "lib", path__default.basename(modulePath) + ext);
     try {
-      fs__default$1.accessSync(candidate);
+      fs__default.accessSync(candidate);
       return candidate;
     } catch {
     }
@@ -4547,7 +4756,9 @@ function defaults(options) {
       pagesRoot: pagesRootFolder,
       buildFolder
     },
-    httpServer: options.httpServer
+    httpServer: options.httpServer,
+    allowedHosts: options.allowedHosts,
+    sourceEditing: options.sourceEditing
   };
 }
 let _renderDevErrorPage = async (res, info) => {
@@ -4908,7 +5119,8 @@ async function handlePreRenderRequest(vite, route, options, slowlyPhase, slowRen
     initialPartsResult.val.headlessInstanceComponents,
     partKeys,
     pageParams,
-    pageProps
+    pageProps,
+    options.sourceEditing
   );
   timing?.recordSlowRender(Date.now() - slowStart);
   if (!preRenderResult) {
@@ -5056,26 +5268,26 @@ async function handleClientOnlyRequest(vite, route, options, slowlyPhase, pagePa
     pluginsForPage,
     {
       enableAutomation: !options.disableAutomation,
-      routePattern: routeToExpressRoute(route)
+      routePattern: routeToExpressRoute(route),
+      sourceFile: path__default.relative(options.projectRootFolder, route.jayHtmlPath)
     }
   );
-  if (options.buildFolder) {
-    const pageName = !url || url === "/" ? "index" : url.replace(/^\//, "").replace(/\//g, "-");
-    const clientScriptDir = path__default.join(options.buildFolder, "debug", "client-entry");
-    await fs__default.mkdir(clientScriptDir, { recursive: true });
-    await fs__default.writeFile(path__default.join(clientScriptDir, `${pageName}.html`), pageHtml, "utf-8");
-  }
+  await writeDebugPage(options, url, pageHtml);
   const viteStart = Date.now();
-  const compiledPageHtml = await vite.transformIndexHtml(!!url ? url : "/", pageHtml);
+  const compiledPageHtml = encodeBracketsInAssetUrls(
+    await vite.transformIndexHtml(url?.split("?")[0] || "/", pageHtml)
+  );
   timing?.recordViteClient(Date.now() - viteStart);
   res.status(200).set({ "Content-Type": "text/html" }).send(compiledPageHtml);
   timing?.end();
 }
 async function sendResponse(vite, res, url, jayHtmlPath, sourceJayHtmlPath, pageParts, viewState, carryForward, clientTrackByMap, projectInit, pluginsForPage, options, routePattern, routeDir, slowViewState, timing, preLoadedContent, headTags, scripts, statusCode = 200) {
   let pageHtml;
+  const sourceFile = path__default.relative(options.projectRootFolder, sourceJayHtmlPath);
   try {
     const jayHtmlDir = path__default.dirname(jayHtmlPath);
-    const jayHtmlContent = preLoadedContent ?? await fs__default.readFile(jayHtmlPath, "utf-8");
+    const rawContent = preLoadedContent ?? await fs$1__default.readFile(jayHtmlPath, "utf-8");
+    const jayHtmlContent = options.sourceEditing ? injectDevMarkers(rawContent) : rawContent;
     pageHtml = await generateSSRPageHtml(
       vite,
       jayHtmlContent,
@@ -5096,7 +5308,8 @@ async function sendResponse(vite, res, url, jayHtmlPath, sourceJayHtmlPath, page
       {
         enableAutomation: !options.disableAutomation,
         slowViewState,
-        routePattern
+        routePattern,
+        sourceFile
       },
       void 0,
       headTags,
@@ -5116,23 +5329,21 @@ async function sendResponse(vite, res, url, jayHtmlPath, sourceJayHtmlPath, page
       {
         enableAutomation: !options.disableAutomation,
         slowViewState,
-        routePattern
+        routePattern,
+        sourceFile
       }
     );
   }
-  if (options.buildFolder) {
-    const pageName = !url || url === "/" ? "index" : url.replace(/^\//, "").replace(/\//g, "-");
-    const clientScriptDir = path__default.join(options.buildFolder, "debug", "client-entry");
-    await fs__default.mkdir(clientScriptDir, { recursive: true });
-    await fs__default.writeFile(path__default.join(clientScriptDir, `${pageName}.html`), pageHtml, "utf-8");
-  }
+  await writeDebugPage(options, url, pageHtml);
   for (const [id, mod] of vite.moduleGraph.idToModuleMap) {
     if (id.includes("html-proxy")) {
       vite.moduleGraph.invalidateModule(mod);
     }
   }
   const viteStart = Date.now();
-  const compiledPageHtml = await vite.transformIndexHtml(!!url ? url : "/", pageHtml);
+  const compiledPageHtml = encodeBracketsInAssetUrls(
+    await vite.transformIndexHtml(url?.split("?")[0] || "/", pageHtml)
+  );
   timing?.recordViteClient(Date.now() - viteStart);
   res.status(statusCode).set({ "Content-Type": "text/html" }).send(compiledPageHtml);
   timing?.end();
@@ -5151,7 +5362,7 @@ async function handleFrozenRequest(vite, route, options, freezeStore, slowRender
     const routeDir = getRouteDir(route);
     const cachedEntry = await slowRenderCache.get(route.jayHtmlPath, pageParams, routeDir);
     const jayHtmlPath = cachedEntry?.preRenderedPath ?? route.jayHtmlPath;
-    const jayHtmlContent = cachedEntry?.preRenderedContent ?? await fs__default.readFile(jayHtmlPath, "utf-8");
+    const jayHtmlContent = cachedEntry?.preRenderedContent ?? await fs$1__default.readFile(jayHtmlPath, "utf-8");
     const jayHtmlFilename = path__default.basename(jayHtmlPath);
     const jayHtmlDir = path__default.dirname(jayHtmlPath);
     const sourceDir = path__default.dirname(route.jayHtmlPath);
@@ -5176,7 +5387,9 @@ async function handleFrozenRequest(vite, route, options, freezeStore, slowRender
       headers["Access-Control-Allow-Origin"] = "*";
     }
     if (injectDevHmr) {
-      const compiledHtml = await vite.transformIndexHtml(url || "/", html);
+      const compiledHtml = encodeBracketsInAssetUrls(
+        await vite.transformIndexHtml(url?.split("?")[0] || "/", html)
+      );
       res.status(200).set(headers).send(compiledHtml);
     } else {
       res.status(200).set(headers).send(html);
@@ -5187,13 +5400,14 @@ async function handleFrozenRequest(vite, route, options, freezeStore, slowRender
   }
   timing?.end();
 }
-async function preRenderJayHtml(route, slowViewState, headlessContracts, headlessInstanceComponents, partKeys = [], pageParams = {}, pageProps = { language: "en", url: "" }) {
-  const jayHtmlWithTemplates = await fs__default.readFile(route.jayHtmlPath, "utf-8");
+async function preRenderJayHtml(route, slowViewState, headlessContracts, headlessInstanceComponents, partKeys = [], pageParams = {}, pageProps = { language: "en", url: "" }, sourceEditing = false) {
+  const rawJayHtml = await fs$1__default.readFile(route.jayHtmlPath, "utf-8");
+  const jayHtmlWithTemplates = sourceEditing ? injectDevMarkers(rawJayHtml) : rawJayHtml;
   const sourceDir = path__default.dirname(route.jayHtmlPath);
   let contract;
   const contractPath = route.jayHtmlPath.replace(".jay-html", ".jay-contract");
   try {
-    const contractContent = await fs__default.readFile(contractPath, "utf-8");
+    const contractContent = await fs$1__default.readFile(contractPath, "utf-8");
     const parseResult = parseContract(contractContent, path__default.basename(contractPath));
     if (parseResult.val) contract = parseResult.val;
   } catch {
@@ -5290,10 +5504,10 @@ async function mkDevServer(rawOptions) {
   const { publicBaseUrlPath, pagesRootFolder, projectRootFolder, buildFolder, jayRollupConfig } = options;
   if (buildFolder) {
     try {
-      const entries = await fs__default.readdir(buildFolder).catch(() => []);
+      const entries = await fs$1__default.readdir(buildFolder).catch(() => []);
       for (const entry of entries) {
         if (entry === "freezes") continue;
-        await fs__default.rm(path__default.join(buildFolder, entry), { recursive: true, force: true });
+        await fs$1__default.rm(path__default.join(buildFolder, entry), { recursive: true, force: true });
       }
     } catch {
     }
@@ -5307,7 +5521,8 @@ async function mkDevServer(rawOptions) {
     base: publicBaseUrlPath,
     jayRollupConfig,
     logLevel: viteLogLevel,
-    httpServer: options.httpServer
+    httpServer: options.httpServer,
+    allowedHosts: options.allowedHosts
   });
   lifecycleManager.setViteServer(vite);
   await lifecycleManager.initialize();
@@ -5369,7 +5584,7 @@ async function mkDevServer(rawOptions) {
     for (let i = devServerRoutes.length - 1; i >= 0; i--) {
       const route = devServerRoutes[i];
       const fsPath = route.fsRoute.jayHtmlPath;
-      const stillOnDisk = scannedRawRoutes.has(route.fsRoute.rawRoute) && fs__default$1.existsSync(fsPath);
+      const stillOnDisk = scannedRawRoutes.has(route.fsRoute.rawRoute) && fs__default.existsSync(fsPath);
       if (!stillOnDisk) {
         devServerRoutes.splice(i, 1);
       }
@@ -5529,6 +5744,9 @@ function setupSlowRenderCacheInvalidation(vite, cache, pagesRootFolder, projectR
     }
   };
   vite.watcher.on("change", (changedPath) => {
+    if (/\.(ts|tsx|jay-contract)$/.test(changedPath)) {
+      noteExportedTypesFileChanged(changedPath);
+    }
     if (watchedFiles.has(changedPath)) {
       clearServerElementCache();
       cache.clear().then(() => {
@@ -5596,5 +5814,8 @@ export {
   createActionRouter,
   createViteForCli,
   createViteServer,
-  mkDevServer
+  debugPageName,
+  encodeBracketsInAssetUrls,
+  mkDevServer,
+  resolveAllowedHosts
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jay-framework/dev-server",
-  "version": "0.25.4",
+  "version": "0.26.0",
   "type": "module",
   "license": "Apache-2.0",
   "main": "dist/index.js",
@@ -23,24 +23,24 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@jay-framework/compiler-jay-stack": "^0.25.4",
-    "@jay-framework/compiler-shared": "^0.25.4",
-    "@jay-framework/component": "^0.25.4",
-    "@jay-framework/fullstack-component": "^0.25.4",
-    "@jay-framework/logger": "^0.25.4",
-    "@jay-framework/runtime": "^0.25.4",
-    "@jay-framework/stack-client-runtime": "^0.25.4",
-    "@jay-framework/stack-route-scanner": "^0.25.4",
-    "@jay-framework/stack-server-build": "^0.25.4",
-    "@jay-framework/stack-server-runtime": "^0.25.4",
-    "@jay-framework/view-state-merge": "^0.25.4",
+    "@jay-framework/compiler-jay-stack": "^0.26.0",
+    "@jay-framework/compiler-shared": "^0.26.0",
+    "@jay-framework/component": "^0.26.0",
+    "@jay-framework/fullstack-component": "^0.26.0",
+    "@jay-framework/logger": "^0.26.0",
+    "@jay-framework/runtime": "^0.26.0",
+    "@jay-framework/stack-client-runtime": "^0.26.0",
+    "@jay-framework/stack-route-scanner": "^0.26.0",
+    "@jay-framework/stack-server-build": "^0.26.0",
+    "@jay-framework/stack-server-runtime": "^0.26.0",
+    "@jay-framework/view-state-merge": "^0.26.0",
     "busboy": "^1.6.0",
-    "vite": "^5.0.11"
+    "vite": "^6.4.4"
   },
   "devDependencies": {
-    "@jay-framework/dev-environment": "^0.25.4",
-    "@jay-framework/jay-cli": "^0.25.4",
-    "@jay-framework/stack-client-runtime": "^0.25.4",
+    "@jay-framework/dev-environment": "^0.26.0",
+    "@jay-framework/jay-cli": "^0.26.0",
+    "@jay-framework/stack-client-runtime": "^0.26.0",
     "@playwright/test": "^1.58.2",
     "@types/busboy": "^1.5.4",
     "@types/express": "^5.0.2",
@@ -52,6 +52,6 @@
     "rimraf": "^5.0.5",
     "tsup": "^8.0.1",
     "typescript": "^5.3.3",
-    "vitest": "^1.2.1"
+    "vitest": "^4.1.11"
   }
 }