@webjsdev/server 0.8.68 → 0.8.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.68",
+  "version": "0.8.69",
   "type": "module",
   "description": "The server for WebJs, a full-stack JavaScript framework built on web components with server-side rendering and no build step. Provides the file-based router, SSR, server actions, route handlers, middleware, and live reload on Node 24+ or Bun.",
   "main": "index.js",

package/src/dev/config.js

@@ -317,6 +317,28 @@ export async function readDevWatchPathsFromApp(appDir) {
   return out;
 }
 
+/**
+ * The dev tooling switches in `webjs.dev` (#1504): `embedOrigins` (the embed
+ * bridge, #1498) and `sourceLocations` (#1499). Raw values; the env overrides
+ * and validation live with each feature (`resolveEmbedOrigins`,
+ * `sourceLocationsRequested`). A missing or unreadable package.json is both
+ * off.
+ *
+ * @param {string} appDir
+ * @returns {Promise<{ embedOrigins: unknown, sourceLocations: unknown }>}
+ */
+export async function readDevToolingFromApp(appDir) {
+  let dev;
+  try {
+    const pkg = JSON.parse(await readFile(join(appDir, 'package.json'), 'utf8'));
+    dev = pkg && pkg.webjs && pkg.webjs.dev;
+  } catch {
+    dev = undefined;
+  }
+  if (!dev || typeof dev !== 'object') return { embedOrigins: undefined, sourceLocations: undefined };
+  return { embedOrigins: dev.embedOrigins, sourceLocations: dev.sourceLocations };
+}
+
 /**
  * Resolve the node:http server timeouts (issue #237) from the app's
  * package.json `webjs.requestTimeoutMs` / `webjs.headersTimeoutMs` /

package/src/dev/handler.js

@@ -41,7 +41,7 @@ import { setAssetUrlProvider, setFormActionResolver } from '@webjsdev/core';
 import { resolveActionIdentity } from '../form-action-identity.js';
 import { setAssetRoots, clearAssetHashCache, setElisionFingerprint, withAssetHash, assetHashFor, resolveAssetUrl } from '../asset-hash.js';
 import { applySecurityHeaders, webRequestIsHttps } from '../headers.js';
-import { parseEmbedOrigins, setEmbedOrigins, allowEmbedFraming } from '../dev-embed.js';
+import { resolveEmbedOrigins, setEmbedOrigins, allowEmbedFraming } from '../dev-embed.js';
 import {
   applyRedirects,
   applyTrailingSlash,
@@ -62,6 +62,7 @@ import {
   readAllowedOriginsFromApp,
   readCspConfigFromApp,
   readBodyLimitsFromApp,
+  readDevToolingFromApp,
 } from './config.js';
 import {
   exists, kebab, resolveRequestId, shouldAccessLog, loadAppEnv, collectRouteModules,
@@ -216,11 +217,14 @@ export async function createRequestHandler(opts) {
   // analysis pass re-reads it each rebuild so a dev toggle takes effect live.
   setClientRouterEnabled(await readClientRouterEnabled(appDir));
 
-  // Dev embed bridge (#1498): `WEBJS_EMBED_ORIGINS` lets the listed parent
+  // Dev embed bridge (#1498): `WEBJS_EMBED_ORIGINS` (or `webjs.dev.embedOrigins`) lets the listed parent
   // origins frame this dev server and receive the bridge's messages. Read once
   // here, and only in dev, so a production handler records no origins and
   // neither injects the script nor relaxes a framing header.
-  const embedOriginsValue = dev ? parseEmbedOrigins(process.env.WEBJS_EMBED_ORIGINS) : [];
+  // `webjs.dev.embedOrigins` in package.json is the default (#1504); a set
+  // env var replaces it for one run.
+  const devTooling = dev ? await readDevToolingFromApp(appDir) : { embedOrigins: undefined, sourceLocations: undefined };
+  const embedOriginsValue = dev ? resolveEmbedOrigins(process.env.WEBJS_EMBED_ORIGINS, devTooling.embedOrigins) : [];
   setEmbedOrigins(embedOriginsValue);
 
   const coreDir = locateCoreDir(appDir);
@@ -288,13 +292,15 @@ export async function createRequestHandler(opts) {
   // on seeding would mean `webjs.seed: false` silently broke every no-JS form.
   await registerActionHooks({ seed: await readSeedEnabled(appDir), dev });
 
-  // Dev source locations (#1499): `WEBJS_SOURCE_LOCATIONS=1` under `webjs dev`
+  // Dev source locations (#1499): `WEBJS_SOURCE_LOCATIONS=1` (or
+  // `webjs.dev.sourceLocations: true`) under `webjs dev`
   // stamps `data-webjs-src="<file>:<line>"` on the element opening tags of the
   // app's `html` templates. Read once (the SSR load hook is process-global and
   // cannot be uninstalled), never in prod. The browser half reads
   // `state.sourceLocations` in serve.js; the SSR half is this load hook, which
   // must be in place before any app module is imported.
-  const sourceLocations = dev && sourceLocationsRequested();
+  // `webjs.dev.sourceLocations` is the default (#1504); the env var wins.
+  const sourceLocations = dev && sourceLocationsRequested(process.env, devTooling.sourceLocations);
   if (sourceLocations) {
     registerSourceLocationHook(appDir);
     // Module URLs are realpaths, so a symlinked app dir registers both forms.

package/src/dev-embed.js

@@ -2,8 +2,9 @@
  * The dev embed bridge, SERVER half (#1498).
  *
  * `webjs dev` with `WEBJS_EMBED_ORIGINS` set (a comma-separated list of parent
- * origins, e.g. `https://crisp.app,http://localhost:8080`) makes an app ready
- * to be previewed inside an iframe on those origins:
+ * origins, e.g. `https://builder.example,http://localhost:8080`), or the app's
+ * `webjs.dev.embedOrigins` list (#1504), makes an app ready to be previewed
+ * inside an iframe on those origins:
  *
  *   1. every HTML document gets a small inline script (the browser half,
  *      `dev-embed-client.js`) that reports page state to the parent and takes
@@ -73,6 +74,23 @@ export function parseEmbedOrigins(raw, opts) {
   return out;
 }
 
+/**
+ * The effective embed origins (#1504): `WEBJS_EMBED_ORIGINS`, when set and
+ * non-empty, replaces the app's `webjs.dev.embedOrigins`; otherwise the config
+ * list applies. Both go through `parseEmbedOrigins`, so a bad entry is dropped
+ * with the same warning wherever it was written.
+ *
+ * @param {string | undefined} envRaw
+ * @param {unknown} configured the app's `webjs.dev.embedOrigins`
+ * @param {{ warn?: (msg: string) => void }} [opts]
+ * @returns {string[]}
+ */
+export function resolveEmbedOrigins(envRaw, configured, opts) {
+  if (typeof envRaw === 'string' && envRaw.trim()) return parseEmbedOrigins(envRaw, opts);
+  if (!Array.isArray(configured)) return [];
+  return parseEmbedOrigins(configured.filter((o) => typeof o === 'string').join(','), opts);
+}
+
 /**
  * Record the allowed embed origins for this process. `createRequestHandler`
  * calls it at construction: the parsed env value in dev, `[]` otherwise.

package/src/dev-source-locations.js

@@ -64,15 +64,21 @@ const REGEX_AFTER_KEYWORDS = new Set([
 export const SOURCE_LOCATIONS_ENV = 'WEBJS_SOURCE_LOCATIONS';
 
 /**
- * Whether the env asks for source locations. Read by the dev handler once, at
- * construction; the caller also requires `dev`, so production never consults it.
+ * Whether source locations are on (#1499, #1504). The app's
+ * `webjs.dev.sourceLocations` sets the default; the env var, when set, wins
+ * either way (`1` / `true` on, `0` / `false` off), so one run can flip it
+ * without editing package.json. Read by the dev handler once, at construction;
+ * the caller also requires `dev`, so production never consults it.
  *
  * @param {Record<string, string | undefined>} [env]
+ * @param {unknown} [configured] the app's `webjs.dev.sourceLocations`
  * @returns {boolean}
  */
-export function sourceLocationsRequested(env = process.env) {
+export function sourceLocationsRequested(env = process.env, configured = false) {
   const v = String(env[SOURCE_LOCATIONS_ENV] || '').trim().toLowerCase();
-  return v === '1' || v === 'true';
+  if (v === '1' || v === 'true') return true;
+  if (v === '0' || v === 'false') return false;
+  return configured === true;
 }
 
 /**

package/webjs-config.schema.json

@@ -202,6 +202,15 @@
           "description": "Extra directories the dev live-reload watcher follows in addition to the appDir (#894), for content the app reads from outside its own tree (e.g. blog markdown in a repo-root blog/ dir). Each entry is resolved relative to the app root and may escape it (../blog). Read by the server (readDevWatchPathsFromApp).",
           "type": "array",
           "items": { "type": "string" }
+        },
+        "embedOrigins": {
+          "description": "Dev embed bridge (#1498, #1504), DEV-ONLY and off by default. Parent origins (e.g. https://builder.example) allowed to frame the dev server: X-Frame-Options is dropped and frame-ancestors widened for them, and every document carries a nonce-signed script that posts { source: 'webjs-embed', type } messages to such a parent and takes { source: 'webjs-embed-host', type } commands from it. A set WEBJS_EMBED_ORIGINS env var replaces this list. Read by the server (readDevToolingFromApp). Ignored by webjs start.",
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "sourceLocations": {
+          "description": "Dev source locations (#1499, #1504), DEV-ONLY and off by default. When true, element opening tags in the app's html templates carry data-webjs-src=\"<app-relative-file>:<line>\" in SSR output and client renders. WEBJS_SOURCE_LOCATIONS=1 or 0 overrides it for one run. Read by the server (readDevToolingFromApp). Ignored by webjs start.",
+          "type": "boolean"
         }
       }
     },