@swissjs/swite 0.3.4 → 0.4.1

package/dist/config/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,SAAS,EAAE,OAAO,CAAC;IACnB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAClB,yFAAyF;QACzF,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,8FAA8F;QAC9F,QAAQ,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAChD,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAErE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,SAAS,EAAE,OAAO,CAAC;IACnB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAClB,yFAAyF;QACzF,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,8FAA8F;QAC9F,QAAQ,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAChD,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAErE"}

package/dist/dev-engine/handlers/base-handler.d.ts

@@ -17,7 +17,13 @@ export declare function setDevHeaders(res: Response): void;
  */
 export declare class BaseHandler {
     protected context: HandlerContext;
+    private compiler;
     constructor(context: HandlerContext);
+    /**
+     * Shared compile-and-serve pipeline used by UIHandler and UIXHandler.
+     * Compiles a .ui/.uix file, rewrites imports, applies path fixup, and sends the response.
+     */
+    protected compileAndServe(url: string, filePath: string, res: Response, label: string): Promise<void>;
     protected resolveFilePath(url: string): Promise<string>;
     protected fileExists(filePath: string): Promise<boolean>;
     protected getDependencies(compiled: string): Promise<string[]>;

package/dist/dev-engine/handlers/base-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../src/dev-engine/handlers/base-handler.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAMjD;AAED;;GAEG;AACH,qBAAa,WAAW;IACV,SAAS,CAAC,OAAO,EAAE,cAAc;gBAAvB,OAAO,EAAE,cAAc;cAE7B,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI7C,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAS9C,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAmBrE"}
+{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../src/dev-engine/handlers/base-handler.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIxC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAM9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAMjD;AAID;;GAEG;AACH,qBAAa,WAAW;IAGV,SAAS,CAAC,OAAO,EAAE,cAAc;IAF7C,OAAO,CAAC,QAAQ,CAAoB;gBAEd,OAAO,EAAE,cAAc;IAE7C;;;OAGG;cACa,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC;cA0FA,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAI7C,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAS9C,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAmBrE"}

package/dist/dev-engine/handlers/base-handler.js

@@ -4,8 +4,14 @@
  * Licensed under the MIT License.
  */
 import { promises as fs } from "node:fs";
+import { UiCompiler } from "@swissjs/compiler";
+import chalk from "chalk";
 import { ModuleResolver } from "../../resolution/resolver.js";
 import { resolveFilePath } from "../../resolution/path/file-path-resolver.js";
+import { rewriteImports } from "../../resolution/rewriting/import-rewriter.js";
+import { inlineEnvReferences } from "../../config/env.js";
+import { compilationCache } from "../../internal/cache/compilation-cache.js";
+import { fixSwissLibPaths } from "../../resolution/path/path-fixup.js";
 /**
  * Set cache-busting headers for development
  */
@@ -16,12 +22,97 @@ export function setDevHeaders(res) {
     res.setHeader("Expires", "0");
     res.setHeader("Surrogate-Control", "no-store");
 }
+const BARE_IMPORT_RE = /(?:import|from|export).*['"](@[^'"]+\/[^'"]+)(?!\/)[^'"]*['"]/;
 /**
  * Base handler utilities
  */
 export class BaseHandler {
     constructor(context) {
         this.context = context;
+        this.compiler = new UiCompiler();
+    }
+    /**
+     * Shared compile-and-serve pipeline used by UIHandler and UIXHandler.
+     * Compiles a .ui/.uix file, rewrites imports, applies path fixup, and sends the response.
+     */
+    async compileAndServe(url, filePath, res, label) {
+        const pathFixupEnabled = this.context.userConfig?.compilerPathFixup?.enabled !== false;
+        const pathFixupPatterns = this.context.userConfig?.compilerPathFixup?.patterns;
+        const applyPathFixup = (code) => pathFixupEnabled ? fixSwissLibPaths(code, pathFixupPatterns) : code;
+        // Cache hit
+        const cached = await compilationCache.get(filePath, (c) => this.getDependencies(c));
+        if (cached) {
+            const fixed = applyPathFixup(cached);
+            setDevHeaders(res);
+            res.setHeader("Content-Type", "application/javascript; charset=utf-8");
+            res.setHeader("Content-Length", Buffer.byteLength(fixed, "utf-8"));
+            res.end(fixed, "utf-8");
+            return;
+        }
+        // Cache miss — compile
+        const source = await fs.readFile(filePath, "utf-8");
+        let compiled = await this.compiler.compileAsync(source, filePath);
+        const esbuild = await import("esbuild");
+        const tsResult = await esbuild.transform(compiled, {
+            loader: "ts",
+            format: "esm",
+            target: "esnext",
+            sourcefile: filePath,
+        });
+        compiled = tsResult.code;
+        compiled = applyPathFixup(compiled);
+        compiled = inlineEnvReferences(compiled, this.context.env);
+        // Handle CSS imports:
+        // - Named/default imports (CSS modules): replace with const binding to empty object
+        //   so that apps using `import styles from "./x.module.css"` get {} instead of undefined.
+        // - Side-effect imports (import "./x.css"): strip silently — no runtime value needed.
+        // - Dynamic imports (import("./x.css")): return empty object.
+        const beforeCss = compiled;
+        // Named/default imports → const <binding> = {}
+        compiled = compiled.replace(/^[^\S\r\n]*import\s+((?:\w+\s*,?\s*)?(?:\{[^}]*\}\s*,?\s*)?(?:\*\s+as\s+\w+\s*)?)\bfrom\s*['"][^'"]*\.css['"]\s*;?[^\S\r\n]*$/gm, (_match, binding) => {
+            // Extract identifiers from the binding clause and emit const declarations
+            const ids = [];
+            const defaultMatch = binding.match(/^(\w+)(?:\s*,|\s*$)/);
+            if (defaultMatch)
+                ids.push(defaultMatch[1]);
+            const nsMatch = binding.match(/\*\s+as\s+(\w+)/);
+            if (nsMatch)
+                ids.push(nsMatch[1]);
+            const namedMatch = binding.match(/\{([^}]+)\}/);
+            if (namedMatch) {
+                namedMatch[1].split(",").forEach((s) => {
+                    const alias = s.trim().split(/\s+as\s+/).pop()?.trim();
+                    if (alias)
+                        ids.push(alias);
+                });
+            }
+            return ids.length ? ids.map((id) => `const ${id} = {};`).join(" ") : "";
+        });
+        // Side-effect imports → strip
+        compiled = compiled.replace(/^[^\S\r\n]*import\s*['"][^'"]*\.css['"]\s*;?[^\S\r\n]*$/gm, "");
+        // Dynamic imports → empty object
+        compiled = compiled.replace(/\bimport\s*\(\s*['"][^'"]*\.css['"]\s*\)/g, "({})");
+        if (beforeCss !== compiled) {
+            const _debug = process.env["SWITE_DEBUG"] === "1";
+            if (_debug)
+                console.log(chalk.blue(`[${label}] Handled CSS imports from ${url}`));
+        }
+        if (BARE_IMPORT_RE.test(compiled)) {
+            console.warn(`[${label}] Compiled output contains bare imports: ${url}`);
+        }
+        const rewritten = await rewriteImports(compiled, filePath, this.context.resolver);
+        const finalCode = applyPathFixup(rewritten);
+        await compilationCache.set(filePath, compiled, finalCode, (c) => this.getDependencies(c));
+        if (BARE_IMPORT_RE.test(finalCode)) {
+            console.error(`[${label}] Bare imports still present after rewriting: ${url}`);
+            for (const m of Array.from(rewritten.matchAll(/(?:import|from|export).*['"](@[^'"]+\/[^'"]+)(?!\/)[^'"]*['"]/g)).slice(0, 3)) {
+                console.error(`[${label}] Unresolved import: ${m[1]}`);
+            }
+        }
+        setDevHeaders(res);
+        res.setHeader("Content-Type", "application/javascript; charset=utf-8");
+        res.setHeader("Content-Length", Buffer.byteLength(finalCode, "utf-8"));
+        res.end(finalCode, "utf-8");
     }
     async resolveFilePath(url) {
         return resolveFilePath(url, this.context.root, this.context.workspaceRoot, this.context.userConfig);

package/dist/dev-engine/handlers/ui-handler.d.ts

@@ -1,7 +1,6 @@
 import type { Response } from "express";
 import { BaseHandler, type HandlerContext } from "./base-handler.js";
 export declare class UIHandler extends BaseHandler {
-    private compiler;
     constructor(context: HandlerContext);
     handle(url: string, res: Response): Promise<void>;
 }

package/dist/dev-engine/handlers/ui-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui-handler.d.ts","sourceRoot":"","sources":["../../../src/dev-engine/handlers/ui-handler.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAQxC,OAAO,EACL,WAAW,EAEX,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAE3B,qBAAa,SAAU,SAAQ,WAAW;IACxC,OAAO,CAAC,QAAQ,CAAoB;gBAExB,OAAO,EAAE,cAAc;IAI7B,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAuExD"}
+{"version":3,"file":"ui-handler.d.ts","sourceRoot":"","sources":["../../../src/dev-engine/handlers/ui-handler.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAiB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEpF,qBAAa,SAAU,SAAQ,WAAW;gBAC5B,OAAO,EAAE,cAAc;IAI7B,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAaxD"}

package/dist/dev-engine/handlers/ui-handler.js

@@ -4,17 +4,11 @@
  * Licensed under the MIT License.
  */
 import { promises as fs } from "node:fs";
-import { UiCompiler } from "@swissjs/compiler";
 import chalk from "chalk";
-import { rewriteImports } from "../../resolution/rewriting/import-rewriter.js";
-import { inlineEnvReferences } from "../../config/env.js";
-import { compilationCache } from "../../internal/cache/compilation-cache.js";
-import { fixSwissLibPaths } from "../../resolution/path/path-fixup.js";
-import { BaseHandler, setDevHeaders, } from "./base-handler.js";
+import { BaseHandler, setDevHeaders } from "./base-handler.js";
 export class UIHandler extends BaseHandler {
     constructor(context) {
         super(context);
-        this.compiler = new UiCompiler();
     }
     async handle(url, res) {
         const filePath = await this.resolveFilePath(url);
@@ -26,62 +20,6 @@ export class UIHandler extends BaseHandler {
             console.error(chalk.red(`[.ui] File not found: ${filePath}`));
             throw new Error(`File not found: ${url} (resolved to: ${filePath})`);
         }
-        const pathFixupEnabled = this.context.userConfig?.compilerPathFixup?.enabled !== false;
-        const pathFixupPatterns = this.context.userConfig?.compilerPathFixup?.patterns;
-        const applyPathFixup = (code) => pathFixupEnabled ? fixSwissLibPaths(code, pathFixupPatterns) : code;
-        // Cache hit
-        const cached = await compilationCache.get(filePath, (compiled) => this.getDependencies(compiled));
-        if (cached) {
-            const fixed = applyPathFixup(cached);
-            setDevHeaders(res);
-            res.setHeader("Content-Type", "application/javascript; charset=utf-8");
-            res.setHeader("Content-Length", Buffer.byteLength(fixed, "utf-8"));
-            res.end(fixed, "utf-8");
-            return;
-        }
-        // Cache miss — compile
-        const source = await fs.readFile(filePath, "utf-8");
-        let compiled = await this.compiler.compileAsync(source, filePath);
-        const esbuild = await import("esbuild");
-        const tsResult = await esbuild.transform(compiled, {
-            loader: "ts",
-            format: "esm",
-            target: "esnext",
-            sourcefile: filePath,
-        });
-        compiled = tsResult.code;
-        // Fix compiler-emitted wrong paths before import rewriting
-        compiled = applyPathFixup(compiled);
-        // Inline import.meta.env references before import rewriting
-        compiled = inlineEnvReferences(compiled, this.context.env);
-        // Strip CSS static-asset imports — they are not ES modules
-        compiled = stripCssImports(compiled, url);
-        const bareImportPattern = /(?:import|from|export).*['"](@[^'"]+\/[^'"]+)(?!\/)[^'"]*['"]/;
-        if (bareImportPattern.test(compiled)) {
-            console.warn(`[.ui] Compiled output contains bare imports: ${url}`);
-        }
-        const rewritten = await rewriteImports(compiled, filePath, this.context.resolver);
-        const finalCode = applyPathFixup(rewritten);
-        await compilationCache.set(filePath, compiled, finalCode, (c) => this.getDependencies(c));
-        if (bareImportPattern.test(finalCode)) {
-            console.error(`[.ui] Bare imports still present after rewriting: ${url}`);
-            for (const m of Array.from(rewritten.matchAll(/(?:import|from|export).*['"](@[^'"]+\/[^'"]+)(?!\/)[^'"]*['"]/g)).slice(0, 3)) {
-                console.error(`[.ui] Unresolved import: ${m[1]}`);
-            }
-        }
-        setDevHeaders(res);
-        res.setHeader("Content-Type", "application/javascript; charset=utf-8");
-        res.setHeader("Content-Length", Buffer.byteLength(finalCode, "utf-8"));
-        res.end(finalCode, "utf-8");
-    }
-}
-function stripCssImports(code, url) {
-    // Single well-ordered pass: static imports first, then dynamic imports
-    const before = code;
-    code = code.replace(/^[^\S\r\n]*import\s[^'"]*['"][^'"]*\.css['"]\s*;?[^\S\r\n]*$/gm, "");
-    code = code.replace(/\bimport\s*\(\s*['"][^'"]*\.css['"]\s*\)/g, "undefined");
-    if (before !== code) {
-        console.log(chalk.blue(`[.ui] Stripped CSS imports from ${url}`));
+        await this.compileAndServe(url, filePath, res, ".ui");
     }
-    return code;
 }

package/dist/dev-engine/handlers/uix-handler.d.ts

@@ -1,7 +1,6 @@
 import type { Response } from "express";
 import { BaseHandler, type HandlerContext } from "./base-handler.js";
 export declare class UIXHandler extends BaseHandler {
-    private compiler;
     constructor(context: HandlerContext);
     handle(url: string, res: Response): Promise<void>;
 }

package/dist/dev-engine/handlers/uix-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uix-handler.d.ts","sourceRoot":"","sources":["../../../src/dev-engine/handlers/uix-handler.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAQxC,OAAO,EACL,WAAW,EAEX,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAE3B,qBAAa,UAAW,SAAQ,WAAW;IACzC,OAAO,CAAC,QAAQ,CAAoB;gBAExB,OAAO,EAAE,cAAc;IAI7B,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAmExD"}
+{"version":3,"file":"uix-handler.d.ts","sourceRoot":"","sources":["../../../src/dev-engine/handlers/uix-handler.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAErE,qBAAa,UAAW,SAAQ,WAAW;gBAC7B,OAAO,EAAE,cAAc;IAI7B,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAKxD"}

package/dist/dev-engine/handlers/uix-handler.js

@@ -3,71 +3,15 @@
  * SWITE - SWISS Development Server
  * Licensed under the MIT License.
  */
-import { promises as fs } from "node:fs";
-import { UiCompiler } from "@swissjs/compiler";
 import chalk from "chalk";
-import { rewriteImports } from "../../resolution/rewriting/import-rewriter.js";
-import { inlineEnvReferences } from "../../config/env.js";
-import { compilationCache } from "../../internal/cache/compilation-cache.js";
-import { fixSwissLibPaths } from "../../resolution/path/path-fixup.js";
-import { BaseHandler, setDevHeaders, } from "./base-handler.js";
+import { BaseHandler } from "./base-handler.js";
 export class UIXHandler extends BaseHandler {
     constructor(context) {
         super(context);
-        this.compiler = new UiCompiler();
     }
     async handle(url, res) {
         const filePath = await this.resolveFilePath(url);
         console.log(chalk.blue(`[.uix] ${url}`));
-        const pathFixupEnabled = this.context.userConfig?.compilerPathFixup?.enabled !== false;
-        const pathFixupPatterns = this.context.userConfig?.compilerPathFixup?.patterns;
-        const applyPathFixup = (code) => pathFixupEnabled ? fixSwissLibPaths(code, pathFixupPatterns) : code;
-        // Cache hit
-        const cached = await compilationCache.get(filePath, (compiled) => this.getDependencies(compiled));
-        if (cached) {
-            const fixed = applyPathFixup(cached);
-            setDevHeaders(res);
-            res.setHeader("Content-Type", "application/javascript; charset=utf-8");
-            res.send(fixed);
-            return;
-        }
-        // Cache miss — compile
-        const source = await fs.readFile(filePath, "utf-8");
-        let compiled = await this.compiler.compileAsync(source, filePath);
-        const esbuild = await import("esbuild");
-        const tsResult = await esbuild.transform(compiled, {
-            loader: "ts",
-            format: "esm",
-            target: "esnext",
-            sourcefile: filePath,
-        });
-        compiled = tsResult.code;
-        // Fix compiler-emitted wrong paths before import rewriting
-        compiled = applyPathFixup(compiled);
-        // Inline import.meta.env references before import rewriting
-        compiled = inlineEnvReferences(compiled, this.context.env);
-        // Strip CSS static-asset imports — they are not ES modules
-        const beforeCss = compiled;
-        compiled = compiled.replace(/^[^\S\r\n]*import\s[^'"]*['"][^'"]*\.css['"]\s*;?[^\S\r\n]*$/gm, "");
-        compiled = compiled.replace(/\bimport\s*\(\s*['"][^'"]*\.css['"]\s*\)/g, "undefined");
-        if (beforeCss !== compiled) {
-            console.log(chalk.blue(`[.uix] Stripped CSS imports from ${url}`));
-        }
-        const bareImportPattern = /(?:import|from|export).*['"](@[^'"]+\/[^'"]+)(?!\/)[^'"]*['"]/;
-        if (bareImportPattern.test(compiled)) {
-            console.warn(`[.uix] Compiled output contains bare imports: ${url}`);
-        }
-        const rewritten = await rewriteImports(compiled, filePath, this.context.resolver);
-        const finalCode = applyPathFixup(rewritten);
-        await compilationCache.set(filePath, compiled, finalCode, (c) => this.getDependencies(c));
-        if (bareImportPattern.test(finalCode)) {
-            console.error(`[.uix] Bare imports still present after rewriting: ${url}`);
-            for (const m of Array.from(rewritten.matchAll(/(?:import|from|export).*['"](@[^'"]+\/[^'"]+)(?!\/)[^'"]*['"]/g)).slice(0, 3)) {
-                console.error(`[.uix] Unresolved import: ${m[1]}`);
-            }
-        }
-        setDevHeaders(res);
-        res.setHeader("Content-Type", "application/javascript; charset=utf-8");
-        res.send(finalCode);
+        await this.compileAndServe(url, filePath, res, ".uix");
     }
 }

package/dist/dev-engine/hmr/hmr.d.ts

@@ -4,7 +4,16 @@ export declare class HMREngine {
     private watcher?;
     private clients;
     private port;
-    constructor(root: string, hmrPort?: number);
+    /** Origins permitted to connect (e.g. "http://localhost:3000"). */
+    private allowedOrigins;
+    constructor(root: string, hmrPort?: number, allowedOrigins?: string[]);
+    /**
+     * Return true when `origin` is on the allowlist.
+     * - Absent / empty origin header → REJECT (not a browser page request).
+     * - Exact match (scheme + host + optional port) → ALLOW.
+     * - The check is case-insensitive on the scheme+host portion per RFC 6454.
+     */
+    private isOriginAllowed;
     initialize(): Promise<void>;
     private checkPortAvailable;
     private setupWebSocket;

package/dist/dev-engine/hmr/hmr.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hmr.d.ts","sourceRoot":"","sources":["../../../src/dev-engine/hmr/hmr.ts"],"names":[],"mappings":"AAUA,qBAAa,SAAS;IAOlB,OAAO,CAAC,IAAI;IANd,OAAO,CAAC,GAAG,CAAmB;IAC9B,OAAO,CAAC,OAAO,CAAC,CAAqB;IACrC,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,IAAI,CAAS;gBAGX,IAAI,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM;IAOZ,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;YAiBnB,kBAAkB;IAUhC,OAAO,CAAC,cAAc;YAYR,YAAY;IAmB1B,OAAO,IAAI,MAAM;IAIX,KAAK,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE;IA2CrC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAYpC,eAAe,IAAI,MAAM;IAIzB,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,SAAS;IAeX,IAAI;CAIX"}
+{"version":3,"file":"hmr.d.ts","sourceRoot":"","sources":["../../../src/dev-engine/hmr/hmr.ts"],"names":[],"mappings":"AAUA,qBAAa,SAAS;IASlB,OAAO,CAAC,IAAI;IARd,OAAO,CAAC,GAAG,CAAmB;IAC9B,OAAO,CAAC,OAAO,CAAC,CAAqB;IACrC,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,IAAI,CAAS;IACrB,mEAAmE;IACnE,OAAO,CAAC,cAAc,CAAc;gBAG1B,IAAI,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,EAChB,cAAc,GAAE,MAAM,EAAO;IAa/B;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAWjB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;YAiBnB,kBAAkB;IAUhC,OAAO,CAAC,cAAc;YA+BR,YAAY;IAmB1B,OAAO,IAAI,MAAM;IAIX,KAAK,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE;IA2CrC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAYpC,eAAe,IAAI,MAAM;IAIzB,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,SAAS;IAeX,IAAI;CAIX"}

package/dist/dev-engine/hmr/hmr.js

@@ -7,13 +7,37 @@ import * as net from "net";
 import chalk from "chalk";
 import { buildHmrClientScript } from "./hmr-client-template.js";
 export class HMREngine {
-    constructor(root, hmrPort) {
+    constructor(root, hmrPort, allowedOrigins = []) {
         this.root = root;
         this.clients = new Set();
         this.port = hmrPort || 24678;
+        // Security (R-002): build an origin allowlist.
+        // Always allow the two canonical loopback forms so a default dev setup
+        // (host: "localhost", port: 3000) works without any extra config.
+        this.allowedOrigins = new Set([
+            ...allowedOrigins,
+        ]);
         // WebSocketServer will be created in initialize() method
         // This allows async port checking before server creation
     }
+    /**
+     * Return true when `origin` is on the allowlist.
+     * - Absent / empty origin header → REJECT (not a browser page request).
+     * - Exact match (scheme + host + optional port) → ALLOW.
+     * - The check is case-insensitive on the scheme+host portion per RFC 6454.
+     */
+    isOriginAllowed(origin) {
+        if (!origin)
+            return false;
+        // Normalise: strip trailing slash, lower-case scheme+host.
+        const normalise = (o) => o.replace(/\/$/, "").toLowerCase();
+        const candidate = normalise(origin);
+        for (const allowed of this.allowedOrigins) {
+            if (normalise(allowed) === candidate)
+                return true;
+        }
+        return false;
+    }
     async initialize() {
         // Check if port is available, if not find a free one
         const isAvailable = await this.checkPortAvailable(this.port);
@@ -35,7 +59,21 @@ export class HMREngine {
         });
     }
     setupWebSocket() {
-        this.wss.on("connection", (ws) => {
+        // Security (R-002): validate the Origin header on every incoming WebSocket
+        // upgrade to prevent cross-site WebSocket hijacking.  A malicious page
+        // served from a different origin cannot subscribe to HMR events (which
+        // include absolute filesystem paths of every changed file).
+        //
+        // Connections with a missing or non-allowlisted Origin are rejected with
+        // a 403 close frame.  Same-origin connections from the dev server's own
+        // host:port are always allowed via this.allowedOrigins.
+        this.wss.on("connection", (ws, req) => {
+            const origin = req.headers["origin"];
+            if (!this.isOriginAllowed(origin)) {
+                console.warn(chalk.red(`[HMR] Rejected connection from disallowed origin: ${origin ?? "(none)"}`));
+                ws.close(1008, "Origin not allowed");
+                return;
+            }
             this.clients.add(ws);
             console.log(chalk.green("[HMR] Client connected"));
             ws.on("close", () => {

package/dist/dev-engine/middleware/static-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static-files.d.ts","sourceRoot":"","sources":["../../../src/dev-engine/middleware/static-files.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAMvC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,IAAI,CAAC,CAuYf;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,IAAI,CAAC,CAgTf"}
+{"version":3,"file":"static-files.d.ts","sourceRoot":"","sources":["../../../src/dev-engine/middleware/static-files.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAMvC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,IAAI,CAAC,CAkcf;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,IAAI,CAAC,CAuUf"}