@swissjs/swite 0.3.5 → 0.4.1

package/dist/dev-engine/middleware/static-files.js

@@ -12,7 +12,9 @@ import { findWorkspaceRoot } from "../../kernel/workspace.js";
  * Setup static file serving for public directory, node_modules, and workspace packages
  */
 export async function setupStaticFiles(app, config) {
-    console.log(chalk.magenta(`[static-files] ⚡ setupStaticFiles called with root: ${config.root}`));
+    const _debug = process.env["SWITE_DEBUG"] === "1";
+    if (_debug)
+        console.log(chalk.magenta(`[static-files] ⚡ setupStaticFiles called with root: ${config.root}`));
     // Static file serving - ONLY serve public directory
     // Do NOT serve dist/ folder - it contains old build artifacts with bare imports
     const publicPath = path.join(config.root, config.publicDir);
@@ -111,7 +113,9 @@ export async function setupStaticFiles(app, config) {
                 }
                 next();
             });
-            console.log(chalk.gray(`  📦 Serving workspace node_modules from ${workspaceNodeModules}`));
+            if (_debug) {
+                console.log(chalk.gray(`  📦 Serving workspace node_modules from ${workspaceNodeModules}`));
+            }
         }
         catch {
             // Workspace node_modules doesn't exist, skip
@@ -121,45 +125,69 @@ export async function setupStaticFiles(app, config) {
     // This allows workspace packages to be served via HTTP
     // Reuse workspaceRoot from above if it exists, otherwise find it
     const workspaceRoot = workspaceRootForNodeModules || (await findWorkspaceRoot(config.root));
-    console.log(chalk.blue(`[static-files] Workspace root: ${workspaceRoot}`));
-    console.log(chalk.blue(`[static-files] App root: ${config.root}`));
+    if (_debug) {
+        console.log(chalk.blue(`[static-files] Workspace root: ${workspaceRoot}`));
+    }
+    if (_debug) {
+        console.log(chalk.blue(`[static-files] App root: ${config.root}`));
+    }
     // Try to serve lib/ directory - check both workspace root and app root parent
     let libPath = null;
-    console.log(chalk.blue(`[static-files] Determining lib/ path... workspaceRoot: ${workspaceRoot}, config.root: ${config.root}`));
+    if (_debug) {
+        console.log(chalk.blue(`[static-files] Determining lib/ path... workspaceRoot: ${workspaceRoot}, config.root: ${config.root}`));
+    }
     // First, try workspace root
     if (workspaceRoot && workspaceRoot !== config.root) {
         libPath = path.join(workspaceRoot, "lib");
-        console.log(chalk.blue(`[static-files] Trying workspace root lib/: ${libPath}`));
+        if (_debug) {
+            console.log(chalk.blue(`[static-files] Trying workspace root lib/: ${libPath}`));
+        }
     }
     else {
-        console.log(chalk.yellow(`[static-files] Workspace root equals app root, trying parent directories...`));
+        if (_debug) {
+            console.log(chalk.yellow(`[static-files] Workspace root equals app root, trying parent directories...`));
+        }
         // If workspace root equals app root, try going up from app root
         const parentDir = path.dirname(config.root);
         const parentLibPath = path.join(parentDir, "lib");
-        console.log(chalk.blue(`[static-files] Trying parent lib/: ${parentLibPath}`));
+        if (_debug) {
+            console.log(chalk.blue(`[static-files] Trying parent lib/: ${parentLibPath}`));
+        }
         try {
             await fs.access(parentLibPath);
             libPath = parentLibPath;
-            console.log(chalk.blue(`[static-files] Using parent directory lib/: ${libPath}`));
+            if (_debug) {
+                console.log(chalk.blue(`[static-files] Using parent directory lib/: ${libPath}`));
+            }
         }
         catch (error) {
-            console.log(chalk.yellow(`[static-files] Parent lib/ not found: ${error instanceof Error ? error.message : String(error)}`));
+            if (_debug) {
+                console.log(chalk.yellow(`[static-files] Parent lib/ not found: ${error instanceof Error ? error.message : String(error)}`));
+            }
             // Parent lib/ doesn't exist, try grandparent
             const grandparentDir = path.dirname(parentDir);
             const grandparentLibPath = path.join(grandparentDir, "lib");
-            console.log(chalk.blue(`[static-files] Trying grandparent lib/: ${grandparentLibPath}`));
+            if (_debug) {
+                console.log(chalk.blue(`[static-files] Trying grandparent lib/: ${grandparentLibPath}`));
+            }
             try {
                 await fs.access(grandparentLibPath);
                 libPath = grandparentLibPath;
-                console.log(chalk.blue(`[static-files] Using grandparent directory lib/: ${libPath}`));
+                if (_debug) {
+                    console.log(chalk.blue(`[static-files] Using grandparent directory lib/: ${libPath}`));
+                }
             }
             catch (error2) {
-                console.log(chalk.yellow(`[static-files] Grandparent lib/ not found: ${error2 instanceof Error ? error2.message : String(error2)}`));
+                if (_debug) {
+                    console.log(chalk.yellow(`[static-files] Grandparent lib/ not found: ${error2 instanceof Error ? error2.message : String(error2)}`));
+                }
             }
         }
     }
     // Serve lib/ directory if found
-    console.log(chalk.blue(`[static-files] Checking for lib/ directory... libPath: ${libPath}`));
+    if (_debug) {
+        console.log(chalk.blue(`[static-files] Checking for lib/ directory... libPath: ${libPath}`));
+    }
     // ALWAYS try to register /lib/ static serving
     // Calculate the lib path - prefer workspace root, fallback to parent of app root
     let finalLibPath;
@@ -174,32 +202,50 @@ export async function setupStaticFiles(app, config) {
         const parentDir = path.dirname(config.root);
         finalLibPath = path.join(parentDir, "lib");
     }
-    console.log(chalk.blue(`[static-files] Final lib path to check: ${finalLibPath}`));
-    console.log(chalk.blue(`[static-files] workspaceRoot: ${workspaceRoot}, config.root: ${config.root}`));
+    if (_debug) {
+        console.log(chalk.blue(`[static-files] Final lib path to check: ${finalLibPath}`));
+    }
+    if (_debug) {
+        console.log(chalk.blue(`[static-files] workspaceRoot: ${workspaceRoot}, config.root: ${config.root}`));
+    }
     // Try to access the directory
     let libPathExists = false;
     try {
         await fs.access(finalLibPath);
         libPathExists = true;
-        console.log(chalk.green(`[static-files] ✅ Found lib/ directory at: ${finalLibPath}`));
+        if (_debug) {
+            console.log(chalk.green(`[static-files] ✅ Found lib/ directory at: ${finalLibPath}`));
+        }
         // Verify the CSS file exists
         const testCssPath = path.join(finalLibPath, "skltn", "src", "css", "index.css");
         try {
             await fs.access(testCssPath);
-            console.log(chalk.green(`[static-files] ✅ Test CSS file exists: ${testCssPath}`));
+            if (_debug) {
+                console.log(chalk.green(`[static-files] ✅ Test CSS file exists: ${testCssPath}`));
+            }
         }
         catch (error) {
-            console.error(chalk.yellow(`[static-files] ⚠️  Test CSS file NOT found: ${testCssPath}`));
+            if (_debug) {
+                console.error(chalk.yellow(`[static-files] ⚠️  Test CSS file NOT found: ${testCssPath}`));
+            }
         }
     }
     catch (error) {
-        console.error(chalk.red(`[static-files] ❌ lib/ directory not found at: ${finalLibPath}`));
-        console.error(chalk.red(`[static-files] Error: ${error instanceof Error ? error.message : String(error)}`));
-        console.error(chalk.red(`[static-files] ⚠️  /lib middleware will NOT be registered - CSS files will 404!`));
+        if (_debug) {
+            console.error(chalk.red(`[static-files] ❌ lib/ directory not found at: ${finalLibPath}`));
+        }
+        if (_debug) {
+            console.error(chalk.red(`[static-files] Error: ${error instanceof Error ? error.message : String(error)}`));
+        }
+        if (_debug) {
+            console.error(chalk.red(`[static-files] ⚠️  /lib middleware will NOT be registered - CSS files will 404!`));
+        }
     }
     // Register static file middleware ONLY if directory exists
     if (libPathExists) {
-        console.log(chalk.green(`[static-files] ✅ Registering /lib middleware with finalLibPath: ${finalLibPath}`));
+        if (_debug) {
+            console.log(chalk.green(`[static-files] ✅ Registering /lib middleware with finalLibPath: ${finalLibPath}`));
+        }
         // CRITICAL: First middleware to block source files BEFORE any express.static can serve them
         // This MUST run before express.static to prevent wrong MIME types
         app.use("/lib", (req, res, next) => {
@@ -212,10 +258,14 @@ export async function setupStaticFiles(app, config) {
                 path.endsWith(".ui") || path.endsWith(".uix") || path.endsWith(".ts") ||
                 (path.endsWith(".js") && !path.includes("node_modules")) || path.endsWith(".mjs");
             if (isSourceFile) {
-                console.log(chalk.red(`[static-files] ⚠️  FIRST BLOCK: Skipping source file: url=${url}, path=${path} - should be handled by module middleware`));
+                if (_debug) {
+                    console.log(chalk.red(`[static-files] ⚠️  FIRST BLOCK: Skipping source file: url=${url}, path=${path} - should be handled by module middleware`));
+                }
                 return next(); // Let module transformation middleware handle it
             }
-            console.log(chalk.cyan(`[static-files] Request for /lib${path} (static file)`));
+            if (_debug) {
+                console.log(chalk.cyan(`[static-files] Request for /lib${path} (static file)`));
+            }
             next();
         });
         // REMOVED: Logging middleware - it was just adding noise
@@ -230,7 +280,9 @@ export async function setupStaticFiles(app, config) {
                     res.setHeader("Expires", "0");
                 }
                 catch (error) {
-                    console.error(chalk.red(`[static-files] Error setting headers for ${filePath}:`), error);
+                    if (_debug) {
+                        console.error(chalk.red(`[static-files] Error setting headers for ${filePath}:`), error);
+                    }
                 }
             },
         });
@@ -246,7 +298,9 @@ export async function setupStaticFiles(app, config) {
                 path.endsWith(".ui") || path.endsWith(".uix") || path.endsWith(".ts") ||
                 (path.endsWith(".js") && !path.includes("node_modules")) || path.endsWith(".mjs");
             if (isSourceFile) {
-                console.log(chalk.red(`[static-files /lib express.static] ⚠️  BLOCKING source file: url=${url}, path=${path} - should be handled by module transformation middleware`));
+                if (_debug) {
+                    console.log(chalk.red(`[static-files /lib express.static] ⚠️  BLOCKING source file: url=${url}, path=${path} - should be handled by module transformation middleware`));
+                }
                 // CRITICAL: Don't call libStatic - return next() to skip it
                 return next(); // Let module transformation middleware handle it
             }
@@ -257,7 +311,9 @@ export async function setupStaticFiles(app, config) {
         // Source files should be handled by module transformation middleware (registered before this)
         // Only static files (CSS, images) should be served, and they're handled by the custom handler above
         // If a file isn't found, let it 404 rather than serving with wrong MIME type
-        console.log(chalk.gray(`  📦 Serving workspace lib/ from ${finalLibPath}`));
+        if (_debug) {
+            console.log(chalk.gray(`  📦 Serving workspace lib/ from ${finalLibPath}`));
+        }
     }
     // Continue with other workspace directories if workspaceRoot is different from app root
     if (workspaceRoot && workspaceRoot !== config.root) {
@@ -266,7 +322,9 @@ export async function setupStaticFiles(app, config) {
         try {
             await fs.access(librariesPath);
             app.use("/libraries", express.static(librariesPath));
-            console.log(chalk.gray(`  📦 Serving workspace libraries/ from ${librariesPath}`));
+            if (_debug) {
+                console.log(chalk.gray(`  📦 Serving workspace libraries/ from ${librariesPath}`));
+            }
         }
         catch {
             // libraries/ doesn't exist, skip
@@ -294,7 +352,9 @@ export async function setupStaticFiles(app, config) {
                 }
                 express.static(modulesPath)(req, res, next);
             });
-            console.log(chalk.gray(`  📦 Serving workspace modules/ from ${modulesPath}`));
+            if (_debug) {
+                console.log(chalk.gray(`  📦 Serving workspace modules/ from ${modulesPath}`));
+            }
         }
         catch {
             // modules/ doesn't exist, skip
@@ -309,22 +369,20 @@ export async function setupStaticFiles(app, config) {
  * Setup SPA fallback - serves index.html for all unmatched routes
  */
 export async function setupSPAFallback(app, config) {
-    console.log(chalk.magenta(`[SWITE] setupSPAFallback loaded - VERSION 3.0.0 (NO HARDCODED CSS)`));
+    const _debug = process.env["SWITE_DEBUG"] === "1";
+    if (_debug) {
+        console.log(chalk.magenta(`[SWITE] setupSPAFallback loaded - VERSION 0.3.5 (NO HARDCODED CSS)`));
+    }
     // Use app.all() to catch ALL HTTP methods, but only for non-source files
     app.all("*", async (req, res, next) => {
         const url = req.url.split("?")[0];
         const fullUrl = req.url;
         const accept = String(req.headers?.accept || "");
         // DEBUG: Verify handler is being called
-        process.stderr.write(`[SPA FALLBACK] Handler called for: ${req.method} ${fullUrl}\n`);
-        console.error(`[SWITE CSS DEBUG] ========== SPA FALLBACK HANDLER START ==========`);
-        console.error(`[SWITE CSS DEBUG] URL: ${url}, Full URL: ${fullUrl}`);
         // --- CRITICAL SAFETY CHECK ---
         // NEVER serve HTML for /src/* requests - these are source files that must be handled by middleware
         // Even if middleware fails, we should return 404, not HTML
         if (req.path?.startsWith("/src/") || url.startsWith("/src/")) {
-            console.error(chalk.red(`[SPA FALLBACK] ⚠️  BLOCKED: Attempt to serve HTML for source path: ${req.method} ${fullUrl}`));
-            console.error(chalk.red(`[SPA FALLBACK] This should have been handled by /src middleware! Returning 404.`));
             res.status(404).setHeader("Content-Type", "text/plain");
             res.send(`File not found: ${url}`);
             return;
@@ -333,8 +391,6 @@ export async function setupSPAFallback(app, config) {
         // NEVER serve HTML for /swiss-packages/* requests - these are SWISS framework packages
         // They should be handled by TS/JS handlers to rewrite imports
         if (req.path?.startsWith("/swiss-packages/") || url.startsWith("/swiss-packages/")) {
-            console.error(chalk.red(`[SPA FALLBACK] ⚠️  BLOCKED: Attempt to serve HTML for SWISS package: ${req.method} ${fullUrl}`));
-            console.error(chalk.red(`[SPA FALLBACK] This should have been handled by module transformation middleware! Returning 404.`));
             res.status(404).setHeader("Content-Type", "text/plain");
             res.send(`File not found: ${url}`);
             return;
@@ -343,19 +399,13 @@ export async function setupSPAFallback(app, config) {
         // NEVER serve HTML for /lib/* requests - these are workspace library files
         // They should be handled by static file middleware
         if (req.path?.startsWith("/lib/") || url.startsWith("/lib/")) {
-            console.error(chalk.red(`[SPA FALLBACK] ⚠️  BLOCKED: Attempt to serve HTML for /lib/ path: ${req.method} ${fullUrl}`));
-            console.error(chalk.red(`[SPA FALLBACK] This should have been handled by static file middleware! Returning 404.`));
             res.status(404).setHeader("Content-Type", "text/plain");
             res.send(`File not found: ${url}`);
             return;
         }
         // Log every request that hits the fallback (for diagnostics)
-        console.log(chalk.gray(`[SPA FALLBACK] Serving HTML for: ${req.method} ${fullUrl}`));
-        process.stderr.write(`[SPA FALLBACK] About to read HTML file...\n`);
         // Log if SPA fallback is being hit for .ui files (this should NOT happen after /src check)
         if (url.endsWith(".ui")) {
-            console.error(chalk.red(`[SPA FALLBACK] ⚠️  WARNING: SPA fallback intercepted .ui file: ${fullUrl}`));
-            console.error(chalk.red(`[SPA FALLBACK] This should have been handled by module transformation middleware!`));
         }
         // DO NOT serve HTML for source files - they should be handled by handlers
         // This prevents the SPA fallback from catching .ui, .uix, .ts, .js, .mjs files
@@ -369,7 +419,6 @@ export async function setupSPAFallback(app, config) {
             url.endsWith(".json")) {
             // These should have been handled by middleware handlers
             // If we reach here, the file wasn't found, return 404 with proper content type
-            console.error(chalk.red(`[SPA FALLBACK] Returning 404 for ${url} - should have been handled earlier`));
             res.status(404).setHeader("Content-Type", "text/plain");
             res.send(`File not found: ${url}`);
             return;
@@ -409,12 +458,18 @@ export async function setupSPAFallback(app, config) {
         // This dynamically discovers CSS files from the app's entry point
         // CRITICAL: This MUST run before import map injection
         // IMPORTANT: Only inject CSS files that actually exist in the app's directory
-        console.log(chalk.magenta(`[SWITE CSS] ========== CSS EXTRACTION START (VERSION 3.0.0) ==========`));
-        console.log(chalk.magenta(`[SWITE CSS] App root: ${config.root}`));
+        if (_debug) {
+            console.log(chalk.magenta(`[SWITE CSS] ========== CSS EXTRACTION START (VERSION 0.3.5) ==========`));
+        }
+        if (_debug) {
+            console.log(chalk.magenta(`[SWITE CSS] App root: ${config.root}`));
+        }
         try {
             const entryFile = config.entry ?? "src/index.ui";
             const entryPointPath = path.join(config.root, entryFile);
-            console.log(chalk.blue(`[SWITE CSS] Checking entry point: ${entryPointPath}`));
+            if (_debug) {
+                console.log(chalk.blue(`[SWITE CSS] Checking entry point: ${entryPointPath}`));
+            }
             const entryPointContent = await fs.readFile(entryPointPath, "utf-8");
             // Extract CSS imports using regex
             const cssImportPattern = /import\s+['"](.*?\.css)['"];?/g;
@@ -479,10 +534,14 @@ export async function setupSPAFallback(app, config) {
                     // Could not read imported file, skip
                 }
             }
-            console.log(chalk.blue(`[SWITE CSS] Found ${cssImports.size} CSS import(s) in code`));
+            if (_debug) {
+                console.log(chalk.blue(`[SWITE CSS] Found ${cssImports.size} CSS import(s) in code`));
+            }
             if (cssImports.size > 0) {
                 const cssArray = Array.from(cssImports);
-                console.log(chalk.blue(`[SWITE CSS] CSS imports found: ${cssArray.join(", ")}`));
+                if (_debug) {
+                    console.log(chalk.blue(`[SWITE CSS] CSS imports found: ${cssArray.join(", ")}`));
+                }
                 // Verify CSS files exist before injecting them
                 const existingCssFiles = [];
                 for (const cssPath of cssArray) {
@@ -491,22 +550,32 @@ export async function setupSPAFallback(app, config) {
                     const filePath = url.startsWith("/src/")
                         ? path.join(config.root, url.substring(1)) // Remove leading /
                         : path.join(config.root, "src", cssPath);
-                    console.log(chalk.blue(`[SWITE CSS] Checking if CSS file exists: ${filePath} (url: ${url})`));
+                    if (_debug) {
+                        console.log(chalk.blue(`[SWITE CSS] Checking if CSS file exists: ${filePath} (url: ${url})`));
+                    }
                     try {
                         await fs.access(filePath);
-                        console.log(chalk.green(`[SWITE CSS] ✅ CSS file exists: ${filePath}`));
+                        if (_debug) {
+                            console.log(chalk.green(`[SWITE CSS] ✅ CSS file exists: ${filePath}`));
+                        }
                         existingCssFiles.push(url);
                     }
                     catch {
                         // CSS file doesn't exist, skip it
                         // This allows different apps/websites to have different CSS files
-                        console.log(chalk.yellow(`[SWITE CSS] ⚠️  CSS file NOT found: ${filePath}, skipping`));
+                        if (_debug) {
+                            console.log(chalk.yellow(`[SWITE CSS] ⚠️  CSS file NOT found: ${filePath}, skipping`));
+                        }
                     }
                 }
                 // Only inject CSS files that actually exist
-                console.log(chalk.blue(`[SWITE CSS] ${existingCssFiles.length} CSS file(s) exist out of ${cssArray.length} found`));
+                if (_debug) {
+                    console.log(chalk.blue(`[SWITE CSS] ${existingCssFiles.length} CSS file(s) exist out of ${cssArray.length} found`));
+                }
                 if (existingCssFiles.length === 0) {
-                    console.log(chalk.yellow(`[SWITE CSS] ⚠️  No CSS files exist, skipping injection`));
+                    if (_debug) {
+                        console.log(chalk.yellow(`[SWITE CSS] ⚠️  No CSS files exist, skipping injection`));
+                    }
                 }
                 else if (existingCssFiles.length > 0) {
                     const cssLinks = existingCssFiles
@@ -519,14 +588,20 @@ export async function setupSPAFallback(app, config) {
                         const beforeReplace = html;
                         html = html.replace(/\s*<\/head>/i, `${cssLinks}\n  </head>`);
                         if (html === beforeReplace) {
-                            console.warn(chalk.yellow("[SWITE] Failed to inject CSS links - </head> not found"));
+                            if (_debug) {
+                                console.warn(chalk.yellow("[SWITE] Failed to inject CSS links - </head> not found"));
+                            }
                         }
                         else {
-                            console.log(chalk.green(`[SWITE] ✅ Injected ${existingCssFiles.length} CSS link(s): ${existingCssFiles.join(", ")}`));
+                            if (_debug) {
+                                console.log(chalk.green(`[SWITE] ✅ Injected ${existingCssFiles.length} CSS link(s): ${existingCssFiles.join(", ")}`));
+                            }
                         }
                     }
                     else {
-                        console.log(chalk.blue(`[SWITE CSS] CSS links already in HTML, skipping injection`));
+                        if (_debug) {
+                            console.log(chalk.blue(`[SWITE CSS] CSS links already in HTML, skipping injection`));
+                        }
                     }
                 }
             }
@@ -534,7 +609,9 @@ export async function setupSPAFallback(app, config) {
         catch (error) {
             // If entry point doesn't exist or can't be read, continue without CSS injection
             // Silently continue - CSS injection is optional
-            console.log(chalk.yellow(`[SWITE CSS] Could not extract CSS imports: ${error instanceof Error ? error.message : String(error)}`));
+            if (_debug) {
+                console.log(chalk.yellow(`[SWITE CSS] Could not extract CSS imports: ${error instanceof Error ? error.message : String(error)}`));
+            }
         }
         // Add/merge import map to help browser resolve bare module specifiers.
         // If an importmap already exists in HTML, merge .swite/import-map.json entries
@@ -557,15 +634,21 @@ export async function setupSPAFallback(app, config) {
             const beforeReplace = html;
             html = html.replace(/\s*<\/head>/i, `${importMap}\n  </head>`);
             if (html === beforeReplace) {
-                console.warn("[SWITE] Failed to add import map - </head> not found or already replaced");
+                if (_debug) {
+                    console.warn("[SWITE] Failed to add import map - </head> not found or already replaced");
+                }
             }
             else {
-                console.log(`[SWITE] Added import map with ${Object.keys(switeImports).length} entries`);
+                if (_debug) {
+                    console.log(`[SWITE] Added import map with ${Object.keys(switeImports).length} entries`);
+                }
             }
         }
         else {
             // Importmap already in HTML — merge swite entries without overwriting existing ones
-            console.log("[SWITE] Import map already exists in HTML — merging swite entries");
+            if (_debug) {
+                console.log("[SWITE] Import map already exists in HTML — merging swite entries");
+            }
             if (Object.keys(switeImports).length > 0) {
                 html = html.replace(/(<script\s+type=["']importmap["'][^>]*>)\s*([\s\S]*?)(\s*<\/script>)/i, (_match, open, body, close) => {
                     try {

package/dist/dev-engine/pythonDevManager.js

@@ -3,7 +3,7 @@ import { resolve } from "node:path";
 import chalk from "chalk";
 import { initPythonProxy } from "../adapters/proxy/proxyToPython.js";
 const POLL_INTERVAL_MS = 500;
-const HEALTH_TIMEOUT_MS = 15000;
+const HEALTH_TIMEOUT_MS = 30000;
 const BACKOFF_THRESHOLD = 5;
 let _child = null;
 /**

package/dist/dev-engine/router/file-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-router.d.ts","sourceRoot":"","sources":["../../../src/dev-engine/router/file-router.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAG1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,SAAS,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAClC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,GAAG,IAAI,CAAC;IACnE,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAmI3B"}
+{"version":3,"file":"file-router.d.ts","sourceRoot":"","sources":["../../../src/dev-engine/router/file-router.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,SAAS,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAClC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,GAAG,IAAI,CAAC;IACnE,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAyF3B"}

package/dist/dev-engine/router/file-router.js

@@ -9,7 +9,6 @@ import chalk from "chalk";
 import { RouteScanner } from "@swissjs/plugin-file-router/core";
 import { createFileWatcher } from "@swissjs/plugin-file-router/dev";
 import { HMREngine } from "../hmr/hmr.js";
-import { findWorkspaceRoot } from "../../kernel/workspace.js";
 /**
  * Setup file-based routing
  * Scans for route files in pages/ directories and watches for changes
@@ -21,7 +20,6 @@ export async function setupFileRouter(config) {
         routes: [],
     };
     try {
-        const workspaceRoot = await findWorkspaceRoot(config.root);
         const appRoot = config.root;
         // Initialize route scanner
         result.routeScanner = new RouteScanner({
@@ -30,42 +28,17 @@ export async function setupFileRouter(config) {
             layouts: true,
             lazyLoading: true,
         });
-        // Scan routes from multiple locations:
-        // 1. App's pages directory (apps/alpine/src/pages)
-        // 2. SKLTN's pages directory (framework/skltn/src/pages) - for reusable auth pages
         const routesToScan = [];
-        // App pages
+        // App pages directory
         const appPagesDir = path.join(appRoot, "src", "pages");
         try {
             await fs.access(appPagesDir);
             routesToScan.push(appPagesDir);
-            console.log(chalk.gray(`  📄 Scanning app routes from ${appPagesDir}`));
+            console.log(chalk.gray(`  Scanning app routes from ${appPagesDir}`));
         }
         catch {
             // pages directory doesn't exist, skip
         }
-        // SKLTN pages (if workspace root exists)
-        if (workspaceRoot && workspaceRoot !== appRoot) {
-            // Try framework/skltn first (new location), then fallback to lib/skltn (legacy)
-            const skltnPagesDir = path.join(workspaceRoot, "framework", "skltn", "src", "pages");
-            const legacySkltnPagesDir = path.join(workspaceRoot, "lib", "skltn", "src", "pages");
-            try {
-                await fs.access(skltnPagesDir);
-                routesToScan.push(skltnPagesDir);
-                console.log(chalk.gray(`  📄 Scanning SKLTN routes from ${skltnPagesDir}`));
-            }
-            catch {
-                // Try legacy location
-                try {
-                    await fs.access(legacySkltnPagesDir);
-                    routesToScan.push(legacySkltnPagesDir);
-                    console.log(chalk.gray(`  📄 Scanning SKLTN routes from ${legacySkltnPagesDir} (legacy)`));
-                }
-                catch {
-                    // pages directory doesn't exist, skip
-                }
-            }
-        }
         // Scan all route directories
         for (const pagesDir of routesToScan) {
             try {

package/dist/dev-engine/server.d.ts

@@ -16,6 +16,13 @@ export declare class SwiteServer {
     private routeWatcher;
     private routes;
     constructor(config?: Partial<SwiteConfig>);
+    /**
+     * Build the list of origins that are allowed to open an HMR WebSocket.
+     * Always includes both the configured host and its loopback alias so the
+     * browser can connect regardless of whether the dev typed "localhost" or
+     * "127.0.0.1" in the address bar.
+     */
+    private buildHmrAllowedOrigins;
     private findWorkspaceRoot;
     start(): Promise<void>;
 }

package/dist/dev-engine/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/dev-engine/server.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IAKb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,GAAG,CAAY;IACvB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,YAAY,CACb;IACP,OAAO,CAAC,MAAM,CAAyB;gBAE3B,MAAM,GAAE,OAAO,CAAC,WAAW,CAAM;YAe/B,iBAAiB;IAuBzB,KAAK;CA0EZ"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/dev-engine/server.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IAKb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,GAAG,CAAY;IACvB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,YAAY,CACb;IACP,OAAO,CAAC,MAAM,CAAyB;gBAE3B,MAAM,GAAE,OAAO,CAAC,WAAW,CAAM;IAmB7C;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;YAehB,iBAAiB;IAuBzB,KAAK;CA+EZ"}

package/dist/dev-engine/server.js

@@ -30,7 +30,30 @@ export class SwiteServer {
             ...config,
         };
         this.resolver = new ModuleResolver(this.config.root);
-        this.hmr = new HMREngine(this.config.root, this.config.hmrPort);
+        // Security (R-002): build the HMR allowed-origin list from the dev server
+        // host+port so the WebSocket server can reject cross-origin connections.
+        // When host is "localhost" we also add the numeric loopback form and vice
+        // versa — browsers send whichever name the user typed in the address bar.
+        const devOrigins = this.buildHmrAllowedOrigins();
+        this.hmr = new HMREngine(this.config.root, this.config.hmrPort, devOrigins);
+    }
+    /**
+     * Build the list of origins that are allowed to open an HMR WebSocket.
+     * Always includes both the configured host and its loopback alias so the
+     * browser can connect regardless of whether the dev typed "localhost" or
+     * "127.0.0.1" in the address bar.
+     */
+    buildHmrAllowedOrigins() {
+        const { host, port } = this.config;
+        const origins = [];
+        const add = (h) => origins.push(`http://${h}:${port}`);
+        add(host);
+        // When the dev host is either loopback alias, also allow the other form.
+        if (host === "localhost")
+            add("127.0.0.1");
+        else if (host === "127.0.0.1")
+            add("localhost");
+        return origins;
     }
     // CG-03: find workspace root by walking up from startDir
     async findWorkspaceRoot(startDir) {
@@ -110,8 +133,13 @@ export class SwiteServer {
         await this.hmr.start(userConfig?.excludeFromHmr);
         console.timeEnd("HMR Start");
         // Start HTTP server
-        // Use 0.0.0.0 to bind to all interfaces (IPv4 and IPv6)
-        const bindHost = this.config.host === "localhost" ? "0.0.0.0" : this.config.host;
+        // Security (R-001): honour the requested host literally.
+        // The default host is "localhost" which Node binds to the loopback
+        // interface only (127.0.0.1 / ::1).  Binding all interfaces (0.0.0.0)
+        // must be an explicit opt-in: the developer must set host to "0.0.0.0"
+        // in their swite.config.ts or pass --host 0.0.0.0 on the CLI.
+        // We never silently rewrite a requested loopback address to 0.0.0.0.
+        const bindHost = this.config.host;
         console.time("HTTP Listen");
         await new Promise((resolve) => {
             this.app.listen(this.config.port, bindHost, () => {

package/dist/kernel/package-finder.d.ts

@@ -6,10 +6,6 @@ export interface PackageLocation {
     path: string;
     type: 'swiss-lib' | 'workspace' | 'node_modules';
 }
-/**
- * Find any sibling monorepo by searching for its package.json
- */
-export declare function findSiblingRepository(startPath: string, repoName: string): Promise<string | null>;
 /**
  * Find the co-located framework monorepo. Tries each name in `fallbackNames`
  * in order and returns the first match. The default list is ['swiss-lib'] for
@@ -22,8 +18,4 @@ export declare function findSwissLibMonorepo(startPath: string, fallbackNames?:
  * In development, we prioritize local sibling source code.
  */
 export declare function findPackage(packageName: string, startPath: string, workspaceRoot?: string | null): Promise<PackageLocation | null>;
-/**
- * Find all possible workspace roots by searching up the tree
- */
-export declare function findWorkspaceRoots(startPath: string): Promise<string[]>;
 //# sourceMappingURL=package-finder.d.ts.map

package/dist/kernel/package-finder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"package-finder.d.ts","sourceRoot":"","sources":["../../src/kernel/package-finder.ts"],"names":[],"mappings":"AASA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,cAAc,CAAC;CAClD;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyBvG;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,aAAa,GAAE,MAAM,EAAkB,GACtC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC5B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAuEjC;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA2B7E"}
+{"version":3,"file":"package-finder.d.ts","sourceRoot":"","sources":["../../src/kernel/package-finder.ts"],"names":[],"mappings":"AASA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,cAAc,CAAC;CAClD;AAgCD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,aAAa,GAAE,MAAM,EAAkB,GACtC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC5B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAuEjC"}

package/dist/kernel/package-finder.js

@@ -8,7 +8,7 @@ import path from "node:path";
 /**
  * Find any sibling monorepo by searching for its package.json
  */
-export async function findSiblingRepository(startPath, repoName) {
+async function findSiblingRepository(startPath, repoName) {
     let current = startPath;
     for (let i = 0; i < 20; i++) {
         const siblingPath = path.join(current, repoName);
@@ -121,7 +121,7 @@ export async function findPackage(packageName, startPath, workspaceRoot) {
 /**
  * Find all possible workspace roots by searching up the tree
  */
-export async function findWorkspaceRoots(startPath) {
+async function findWorkspaceRoots(startPath) {
     const roots = [];
     let current = startPath;
     for (let i = 0; i < 20; i++) {

package/dist/kernel/package-registry.d.ts

@@ -33,4 +33,10 @@ export declare class PackageRegistry {
     getPackageCount(): number;
 }
 export declare function getPackageRegistry(): PackageRegistry;
+/**
+ * Reset the package registry singleton. For use in tests only.
+ * Call before creating a ModuleResolver to prevent the previous scan state
+ * from leaking between tests.
+ */
+export declare function resetPackageRegistry(): void;
 //# sourceMappingURL=package-registry.d.ts.map