@adhd/apigen-engine-runtime 0.3.2 → 0.3.4

package/lib/bind-host.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Listen-host policy shared by every apigen TypeScript host (fastify, express,
+ * mcp). Defaults to IPv4 loopback; binding anything else is a deliberate
+ * override (`--opt host=…` / `options.host`) and logs a warning. Node's
+ * `listen(port)` with no host — or with an empty string — binds ALL
+ * interfaces, so the empty/whitespace case is treated as unset.
+ *
+ * Pure (no sockets), so the default is unit-testable without binding a port.
+ */
+/** Default listen address for every apigen host: IPv4 loopback. */
+export declare const DEFAULT_LISTEN_HOST = "127.0.0.1";
+/** True for `localhost`, `127.0.0.0/8`, `::1` and IPv4-mapped loopback. */
+export declare function isLoopbackListenHost(host: string): boolean;
+/**
+ * Resolve the effective listen host from the plugin `host` option. Non-string,
+ * empty and whitespace-only values fall back to {@link DEFAULT_LISTEN_HOST}.
+ */
+export declare function resolveListenHost(raw: unknown): string;
+/**
+ * Emit a warning when `host` is not loopback (unauthenticated-by-default
+ * hosts become network-reachable). Returns whether it warned.
+ */
+export declare function warnIfNonLoopbackListen(host: string, label: string, logger?: {
+    warn: (obj: Record<string, unknown>, msg: string) => void;
+}): boolean;

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@adhd/apigen-engine-runtime",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "dependencies": {
     "ajv": "^8.20.0",
     "ajv-formats": "2.1.1",
     "pino": "10.3.1",
-    "@adhd/apigen-core-client": "^0.3.3",
+    "@adhd/apigen-core-client": "^0.3.5",
     "@adhd/apigen-base-logical": "^0.1.4",
     "@adhd/apigen-base-errors": "^0.2.3",
-    "@adhd/apigen-engine-naming": "^0.2.5",
+    "@adhd/apigen-engine-naming": "^0.2.6",
     "better-sqlite3": "12.10.0"
   },
   "main": "./index.js",