Release v0.8.0 · Hyperyond/Hover

Highlights

New @hover-dev/transform-source — private workspace package with per-framework transforms (JSX / Vue SFC / Svelte 5 / Astro). Stamps host elements with data-hover-source="<file>:<line>:<col>" so the widget's Fix popover can point your coding agent at the exact file location.
All 5 integration shims now wire the transform at runtime, each using the most idiomatic hook for its bundler:
- vite-plugin-hover: transform() with enforce:'pre'
- @hover-dev/astro: load() interception + plugin re-order (Astro's own compiler runs in load(), so transform() is too late)
- @hover-dev/nuxt: addVitePlugin() into Nuxt's Vite chain
- webpack-plugin-hover: separate dist/loader.js + module rule
- @hover-dev/next: Turbopack turbopack.rules['*.{jsx,tsx}'] pointing at dist/source-loader.js. Also works on next dev --webpack.

ERR_REQUIRE_ESM from mockttp + get-port under @hover-dev/security. engines.node >= 22.12 declared; register-node prints an actionable diagnostic when the failure surfaces with the exact pnpm overrides snippet to apply. Upstream tracking: httptoolkit/mockttp#200.
Cannot get schema for 'PrivateKeyInfo' target when enabling security mode. Root cause: @peculiar/asn1-schema keeps a per-module-instance schema registry; pnpm-induced multi-copy splits it. Pinned 2.6.0 as a direct dep; startProxy() port-retry loop now distinguishes EADDRINUSE from CA-generation failures and rewrites the error into an actionable message. Tracking: PeculiarVentures/asn1-schema#111.
Module not found: Can't resolve 'atpl' on pnpm dev:example:next-app. Turbopack was pulling the source-loader (which barrel-imported Vue/Svelte/Astro transforms) into Server Component bundles, choking on @vue/compiler-sfc's optional template-engine require()s. Switched source-loader to sub-path import @hover-dev/transform-source/jsx; obscured the dynamic specifier so Turbopack's static tracer stops walking through it.
Widget never injected under webpack when consumed via pnpm. HtmlWebpackPlugin.getHooks(compilation) is keyed on a per-module WeakMap; user's copy and our copy were two distinct module instances. Now we createRequire from compiler.context so we load the same instance the user passed to webpack.

4 transforms (JSX/Vue/Svelte/Astro) now report the < character's 1-indexed line+column uniformly. JSX previously pointed at the tag name's first char — different by 1 from the other three.
All Vite-side transforms gain sourceAttribution?: boolean opt-out via HoverOptions.
pnpm dev:example:webpack-app quieted via stats: 'errors-warnings'.
Two Next-dev warnings silenced: tsup import.meta-in-cjs and Turbopack Can't resolve <dynamic>.

All 9 examples smoke-tested:

Example	data-hover-source count
basic-app	61
e-commerce	144
stock-registration	46
canvas-paint	90
astro-app	24 (Astro `load()` interception)
nuxt-app	15 in SSR HTML
next-app	6 in SSR HTML
webpack-app	n/a (vanilla JS, by design)
rn-web-app	0 (RN components are PascalCase, by design)

pnpm typecheck ✓ · pnpm test 209 tests pass · 2 Playwright e2e ✓.

Astro load() interception is unsupported by Astro — the server.config.plugins re-order trick depends on internals. Tested against Astro 5.18.1. Astro minors may break it; if so, only .astro source attribution degrades, the rest stays working.
Next + Turbopack uses our Node-side webpack loader. A native Rust SWC plugin would be faster but is a 3–5 week project; Turbopack's webpack-loader bridge is the maintainer-blessed path and the perf cost (~1ms/file) is negligible for a one-attribute stamp.

See PR #46 for the squashed change, or v0.7.5...v0.8.0 for everything.