@mauroandre/velojs 0.0.49 → 0.0.51

package/agent/skills/velojs-production-deploy/SKILL.md

@@ -71,6 +71,45 @@ export default defineConfig({
 
 In dev, `velojs dev --port 5000` still overrides everything (it's passed straight to Vite).
 
+## Choosing the bind interface (hostname)
+
+By default `velojs start` binds to **all interfaces** (`::`) — the norm for Node servers and what containers and cloud platforms expect (they route traffic through the network interface; loopback-only would make the container unreachable). To change it, in order of precedence:
+
+1. The `HOST` environment variable.
+2. The `hostname` field in `defineConfig`.
+3. The Node default (all interfaces).
+
+### Secure bind for local/sensitive apps
+
+If your app is **local and single-user** — a cockpit with a terminal, file access, real user data — it must listen on loopback only. An all-interfaces bind exposes that surface to the whole network without any error: the developer finds out by scanning, not by the app telling them.
+
+```bash
+# Deploy do app local: bind em loopback, sempre
+HOST=127.0.0.1 velojs start
+```
+
+Because "set HOST" is easy to forget, sensitive apps should also **fail fast if the bind is wrong** — check the real address after the server starts, via `onServer`:
+
+```typescript
+// app/server.tsx
+import { onServer } from "@mauroandre/velojs/server";
+
+onServer((server) => {
+    const addr = server.address();
+    const loopback = ["127.0.0.1", "::1", "::ffff:127.0.0.1"];
+    if (!addr || typeof addr !== "object" || !loopback.includes(addr.address)) {
+        console.error(
+            `[${process.env.APP_NAME ?? "app"}][CRIT] ` +
+            `server bound on ${addr && typeof addr === "object" ? addr.address : "?"} — outside loopback. ` +
+            `This app runs commands on this machine: it may only listen on 127.0.0.1/::1. Aborting.`
+        );
+        process.exit(1);
+    }
+});
+```
+
+This pattern caught a real exposure in production: the server had bound to `::` and the guard aborted instead of serving. When deploying the same app to a VPS later, the bind changes **consciously** to `HOST=0.0.0.0` — together with authentication and its own security spec, not by accident.
+
 ## Static assets on CDN
 
 If you want to serve static assets (JS, CSS, images) from a CDN or S3 bucket instead of the Node.js server, set the `STATIC_BASE_URL` environment variable:

package/agent/skills/velojs-vite-plugin/SKILL.md

@@ -7,17 +7,36 @@ description: "The `veloPlugin` build pipeline: the 9 AST transforms that inject
 
 The `veloPlugin()` is the core of VeloJS. It's a single function that returns 6 Vite plugins working together to handle routing, SSR, code transforms, and more.
 
-## The 6 plugins
+## The 7 plugins
 
 | Plugin | What it does |
 |--------|-------------|
 | `velo:config` | Sets up build config for client/server modes, Preact aliases, and environment defines |
 | `velo:transform` | Performs AST transforms on your code (the most important plugin) |
 | `velo:static-url` | Rewrites CSS `url(/path)` to use `STATIC_BASE_URL` in production builds |
+| `velo:graph` | Generates `.velojs/graph.json` (route tree + dependency graph) on build and dev |
 | `@preact/preset-vite` | Adds Preact JSX support |
 | `@hono/vite-dev-server` | Runs the SSR dev server |
 | `velo:ws-bridge` | Exposes Vite's HTTP server for WebSocket handlers during development |
 
+## Dev server: what is served × intercepted
+
+During `velojs dev`, every request that is **not** excluded falls through to the SSR app — if no route matches, it gets the app's 404/fallback HTML. Excluded (delegated to Vite, which serves and transforms them as modules): `.js`, `.mjs`, `.ts`, `.tsx`, `.jsx`, `.css`, `.md`, `.svelte`, `.vue`, `/@vite/*`, `/node_modules/*`, `/static/*`, and `?t=` cache-busted requests.
+
+Project `.mjs` files are covered — relevant for build-time generators (Panda CSS, vanilla-extract) that emit ESM artifacts such as `styled-system/`.
+
+Need more patterns? Declare them in the plugin config — they are **composed with** the defaults, not a replacement:
+
+```typescript
+export default defineConfig({
+    plugins: [
+        veloPlugin({
+            devServerExclude: ["/generated/**"],
+        }),
+    ],
+});
+```
+
 ## AST Transformations
 
 The `velo:transform` plugin uses Babel to modify your code at build time. It applies 9 transformations to `.ts`/`.tsx` files inside your `appDirectory` (a file elsewhere, or a `.js`/`.jsx` one, is not transformed at all):

package/dist/config.d.ts

@@ -25,5 +25,18 @@ export interface VeloConfig {
      * @default 3000
      */
     port?: number;
+    /**
+     * Interface de bind do servidor de produção. A env `HOST` tem precedência.
+     * Default do Node: todas as interfaces (o que Docker/cloud esperam).
+     * Apps locais/sensíveis devem declarar "127.0.0.1".
+     */
+    hostname?: string;
+    /**
+     * Padrões adicionais de URL que o dev server deve delegar ao Vite em vez
+     * de interceptar como página (ex.: artefatos de geradores build-time como
+     * Panda CSS — "/styled-system/**"). Compostos com os defaults do
+     * @hono/vite-dev-server, não os substituem.
+     */
+    devServerExclude?: (string | RegExp)[];
 }
 export declare function defineConfig(config: VeloConfig): VeloConfig;

package/dist/server.d.ts

@@ -7,6 +7,12 @@ export declare function onServer(fn: ServerCallback): void;
 export interface StartServerOptions {
     routes: AppRoutes;
     port?: number;
+    /**
+     * Hostname/interface to bind. Precedence: HOST env > this option > Node
+     * default (all interfaces — the ecosystem norm for containers/proxies).
+     * Local/sensitive apps should bind "127.0.0.1".
+     */
+    hostname?: string;
 }
 export declare function addRoutes(fn: (app: Hono) => void | Promise<void>): void;
 /**

package/dist/server.js

@@ -1,94 +1,94 @@
-import { jsx as _ } from "preact/jsx-runtime";
-import { Hono as j } from "hono";
-import { logger as E } from "hono/logger";
-import { trimTrailingSlash as T } from "hono/trailing-slash";
+import { jsx as v } from "preact/jsx-runtime";
+import { Hono as R } from "hono";
+import { logger as T } from "hono/logger";
+import { trimTrailingSlash as E } from "hono/trailing-slash";
 import { render as C } from "preact-render-to-string";
-import { Router as k } from "wouter-preact";
-import { AsyncLocalStorage as A } from "node:async_hooks";
-import { getAppContext as w } from "./app-context.js";
-import { flushPendingStreamRoutes as D, registerStreamHandler as $ } from "./events.js";
-import { registerSocketRoutes as I, injectWebSocketServer as S } from "./sockets.js";
-const P = new A();
+import { Router as $ } from "wouter-preact";
+import { AsyncLocalStorage as k } from "node:async_hooks";
+import { getAppContext as _ } from "./app-context.js";
+import { flushPendingStreamRoutes as A, registerStreamHandler as D } from "./events.js";
+import { registerSocketRoutes as O, injectWebSocketServer as S } from "./sockets.js";
+const P = new k();
 globalThis.__veloServerData = P;
-let v = null;
+let g = null;
 function Z(e) {
-  if (v) {
-    e(v);
+  if (g) {
+    e(g);
     return;
   }
-  w().serverCallbacks.push(e);
+  _().serverCallbacks.push(e);
 }
 function b(e) {
-  v = e;
-  const t = w();
+  g = e;
+  const t = _();
   for (const s of t.serverCallbacks) s(e);
   t.serverCallbacks.length = 0;
 }
 function ee(e) {
-  w().pendingRoutes.push(e);
+  _().pendingRoutes.push(e);
 }
-const N = (e) => JSON.stringify(e).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029"), O = (e, t, s, r) => {
-  if (r && r !== 200 && e.status(r), e.req.query("_data") === "1") {
-    const c = globalThis.__veloBuildHash || void 0, i = s ? { ...s, __buildHash: c } : { __buildHash: c };
-    return e.json(i);
+const I = (e) => JSON.stringify(e).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029"), N = (e, t, s, a) => {
+  if (a && a !== 200 && e.status(a), e.req.query("_data") === "1") {
+    const c = globalThis.__veloBuildHash || void 0, r = s ? { ...s, __buildHash: c } : { __buildHash: c };
+    return e.json(r);
   }
   const o = e.req.path, n = P.run(
     s ?? {},
-    () => C(/* @__PURE__ */ _(k, { ssrPath: o, children: t }))
+    () => C(/* @__PURE__ */ v($, { ssrPath: o, children: t }))
   );
   if (e.header("Cache-Control", "no-cache"), !s)
     return e.html(n);
-  const a = `<script>window.__PAGE_DATA__=${N(s)}<\/script>`;
-  return e.html(n.replace("</head>", () => `${a}</head>`));
-}, G = async (e, t) => {
-  const s = t.req.param(), r = t.req.query(), o = { params: s, query: r, c: t }, n = await Promise.all(
-    e.map(async (i) => {
-      if (!i.loader) return null;
-      const l = await i.loader(o), d = i.metadata?.moduleId;
-      return d ? { moduleId: d, loaderData: l } : null;
+  const i = `<script>window.__PAGE_DATA__=${I(s)}<\/script>`;
+  return e.html(n.replace("</head>", () => `${i}</head>`));
+}, H = async (e, t) => {
+  const s = t.req.param(), a = t.req.query(), o = { params: s, query: a, c: t }, n = await Promise.all(
+    e.map(async (r) => {
+      if (!r.loader) return null;
+      const f = await r.loader(o), l = r.metadata?.moduleId;
+      return l ? { moduleId: l, loaderData: f } : null;
     })
   );
-  let a;
-  for (const i of n)
-    if (i && i.loaderData instanceof Response) {
-      a = i.loaderData;
+  let i;
+  for (const r of n)
+    if (r && r.loaderData instanceof Response) {
+      i = r.loaderData;
       break;
     }
   const c = {
     __params: s,
-    __query: r,
+    __query: a,
     __pathname: t.req.path
   };
-  for (const i of n)
-    i && !(i.loaderData instanceof Response) && (c[i.moduleId] = i.loaderData);
+  for (const r of n)
+    r && !(r.loaderData instanceof Response) && (c[r.moduleId] = r.loaderData);
   return {
-    components: e.map((i) => i.Component),
+    components: e.map((r) => r.Component),
     data: c,
-    shortCircuit: a
+    shortCircuit: i
   };
-}, H = (e) => {
+}, G = (e) => {
   if (e.length === 0) return null;
   const t = e.filter(Boolean);
   if (t.length === 0) return null;
   if (t.length === 1) {
     const o = t[0];
-    return /* @__PURE__ */ _(o, {});
+    return /* @__PURE__ */ v(o, {});
   }
   const s = t[t.length - 1];
-  return t.slice(0, -1).reduceRight((o, n) => /* @__PURE__ */ _(n, { children: o }), /* @__PURE__ */ _(s, {}));
-}, y = (e, t, s = [], r = []) => {
+  return t.slice(0, -1).reduceRight((o, n) => /* @__PURE__ */ v(n, { children: o }), /* @__PURE__ */ v(s, {}));
+}, y = (e, t, s = [], a = []) => {
   for (const o of t) {
     if (o.handler && !o.module) {
       o.children && y(
         e,
         o.children,
         s,
-        [...r, ...o.middlewares || []]
+        [...a, ...o.middlewares || []]
       );
       continue;
     }
-    const n = o.module ? [...s, o.module] : s, a = [
-      ...r,
+    const n = o.module ? [...s, o.module] : s, i = [
+      ...a,
       ...o.middlewares || []
     ];
     if (o.children)
@@ -96,104 +96,104 @@ const N = (e) => JSON.stringify(e).replace(/</g, "\\u003c").replace(/>/g, "\\u00
         e,
         o.children,
         n,
-        a
+        i
       );
     else if (o.module) {
-      const c = o.path === "*", i = o.statusCode ?? (c ? 404 : void 0), l = o.module.metadata?.fullPath;
-      if (!l && !c) {
+      const c = o.path === "*", r = o.statusCode ?? (c ? 404 : void 0), f = o.module.metadata?.fullPath;
+      if (!f && !c) {
         console.warn(
           `Module ${o.module.metadata?.moduleId} has no fullPath`
         );
         continue;
       }
-      const d = async (h) => {
-        const { components: u, data: m, shortCircuit: f } = await G(n, h);
-        if (f) {
-          const g = f.headers.get("Location");
-          return h.req.query("_data") === "1" && g && f.status >= 300 && f.status < 400 ? h.json({ __redirect: g }) : f;
+      const l = async (d) => {
+        const { components: u, data: h, shortCircuit: m } = await H(n, d);
+        if (m) {
+          const w = m.headers.get("Location");
+          return d.req.query("_data") === "1" && w && m.status >= 300 && m.status < 400 ? d.json({ __redirect: w }) : m;
         }
-        const p = H(u);
-        return O(h, p, m, i);
+        const p = G(u);
+        return N(d, p, h, r);
       };
-      c ? e.notFound(d) : a.length > 0 ? e.on(["GET"], [l], ...a, d) : e.on(["GET"], [l], d);
+      c ? e.notFound(l) : i.length > 0 ? e.on(["GET"], [f], ...i, l) : e.on(["GET"], [f], l);
     } else
       continue;
   }
 }, q = (e, t, s = []) => {
-  for (const r of t) {
-    const o = r.module?.metadata?.moduleId, n = [
+  for (const a of t) {
+    const o = a.module?.metadata?.moduleId, n = [
       ...s,
-      ...r.middlewares || []
+      ...a.middlewares || []
     ];
-    if (r.module && o) {
-      const a = Object.keys(r.module).filter(
+    if (a.module && o) {
+      const i = Object.keys(a.module).filter(
         (c) => c.startsWith("action_")
       );
-      for (const c of a) {
-        const i = c.replace("action_", ""), l = r.module[c];
-        if (typeof l == "function") {
-          const d = `/_action/${o}/${i}`, h = async (u) => {
-            let m = {};
+      for (const c of i) {
+        const r = c.replace("action_", ""), f = a.module[c];
+        if (typeof f == "function") {
+          const l = `/_action/${o}/${r}`, d = async (u) => {
+            let h = {};
             try {
-              m = await u.req.json();
+              h = await u.req.json();
             } catch {
             }
-            const f = {
-              body: m,
+            const m = {
+              body: h,
               params: u.req.param(),
               query: u.req.query(),
               c: u
             };
             try {
-              const p = await l(f);
+              const p = await f(m);
               return u.json(p ?? { ok: !0 });
             } catch (p) {
-              const g = p instanceof Error ? p.message : "Action failed";
-              return u.json({ error: g }, 500);
+              const w = p instanceof Error ? p.message : "Action failed";
+              return u.json({ error: w }, 500);
             }
           };
           n.length > 0 ? e.on(
             ["POST"],
-            [d],
+            [l],
             ...n,
-            h
-          ) : e.on(["POST"], [d], h);
+            d
+          ) : e.on(["POST"], [l], d);
         }
       }
     }
-    r.children && q(e, r.children, n);
+    a.children && q(e, a.children, n);
   }
 }, x = async (e, t, s = []) => {
-  const r = (o, n) => {
-    for (const a of o) {
-      const c = a.module?.metadata?.moduleId, i = [
+  const a = (o, n) => {
+    for (const i of o) {
+      const c = i.module?.metadata?.moduleId, r = [
         ...n,
-        ...a.middlewares || []
+        ...i.middlewares || []
       ];
-      if (a.module && c) {
-        const l = Object.keys(a.module).filter(
-          (d) => d.startsWith("stream_")
+      if (i.module && c) {
+        const f = Object.keys(i.module).filter(
+          (l) => l.startsWith("stream_")
         );
-        for (const d of l) {
-          const h = d.replace("stream_", ""), u = a.module[d];
+        for (const l of f) {
+          const d = l.replace("stream_", ""), u = i.module[l];
           if (u?.__isVeloEventStream) {
-            const m = `/_event/${c}/${h}`;
-            u.__path = m, $(
+            const h = `/_event/${c}/${d}`;
+            u.__path = h, D(
               e,
-              m,
+              h,
               u,
-              i
+              r
             );
           }
         }
       }
-      a.children && r(a.children, i);
+      i.children && a(i.children, r);
     }
   };
-  r(t, s);
+  a(t, s);
 }, V = (e, t) => t ? t.startsWith("/") ? e + t : e ? e + "/" + t : "/" + t : e || "", W = (e) => {
-  const t = /* @__PURE__ */ new Set(), s = (r) => {
-    for (const o of r) {
+  const t = /* @__PURE__ */ new Set(), s = (a) => {
+    for (const o of a) {
       if (o.module && !o.children) {
         const n = o.module.metadata?.fullPath;
         n && t.add(n);
@@ -202,68 +202,77 @@ const N = (e) => JSON.stringify(e).replace(/</g, "\\u003c").replace(/>/g, "\\u00
     }
   };
   return s(e), t;
-}, R = (e, t, s, r = "", o = []) => {
+}, j = (e, t, s, a = "", o = []) => {
   for (const n of t) {
-    const a = V(r, n.path), c = [
+    const i = V(a, n.path), c = [
       ...o,
       ...n.middlewares || []
-    ], i = !!n.handler, l = !!n.method;
-    if (i && !l ? console.warn(
-      `[velojs] invalid route at "${a || "/"}" — "handler" set without "method"; endpoint skipped`
-    ) : l && !i ? console.warn(
-      `[velojs] invalid route at "${a || "/"}" — "method" set without "handler"; endpoint skipped`
-    ) : i && n.module ? console.warn(
-      `[velojs] ambiguous route at "${a || "/"}" — both "module" and "handler" set; endpoint ignored, page kept`
-    ) : i && n.isRoot && console.warn(
-      `[velojs] "isRoot" has no effect on endpoint at "${a || "/"}"; ignored`
-    ), i && l && !n.module) {
-      const h = n.method;
-      h === "GET" && s.has(a) && console.warn(
-        `[velojs] path "${a}" has both a page GET and an endpoint GET; the page wins and the endpoint is unreachable. Consider renaming one.`
+    ], r = !!n.handler, f = !!n.method;
+    if (r && !f ? console.warn(
+      `[velojs] invalid route at "${i || "/"}" — "handler" set without "method"; endpoint skipped`
+    ) : f && !r ? console.warn(
+      `[velojs] invalid route at "${i || "/"}" — "method" set without "handler"; endpoint skipped`
+    ) : r && n.module ? console.warn(
+      `[velojs] ambiguous route at "${i || "/"}" — both "module" and "handler" set; endpoint ignored, page kept`
+    ) : r && n.isRoot && console.warn(
+      `[velojs] "isRoot" has no effect on endpoint at "${i || "/"}"; ignored`
+    ), r && f && !n.module) {
+      const d = n.method;
+      d === "GET" && s.has(i) && console.warn(
+        `[velojs] path "${i}" has both a page GET and an endpoint GET; the page wins and the endpoint is unreachable. Consider renaming one.`
       );
-      const u = n.handler, m = async (f) => await u({
-        c: f,
-        params: f.req.param(),
-        query: f.req.query()
+      const u = n.handler, h = async (m) => await u({
+        c: m,
+        params: m.req.param(),
+        query: m.req.query()
       });
-      c.length > 0 ? e.on([h], [a], ...c, m) : e.on([h], [a], m);
+      c.length > 0 ? e.on([d], [i], ...c, h) : e.on([d], [i], h);
     }
-    n.children && R(
+    n.children && j(
       e,
       n.children,
       s,
-      a,
+      i,
       c
     );
   }
 }, K = async (e) => {
-  const t = new j();
-  t.use(T()), process.env.NODE_ENV !== "production" && t.use("*", E());
-  const r = w().pendingRoutes.splice(0);
-  for (const n of r)
+  const t = new R();
+  t.use(E()), process.env.NODE_ENV !== "production" && t.use("*", T());
+  const a = _().pendingRoutes.splice(0);
+  for (const n of a)
     await n(t);
   y(t, e), q(t, e), await x(t, e);
   const o = W(e);
-  if (R(t, e, o), await I(t, e), D(t), process.env.NODE_ENV !== "production" && !v) {
+  if (j(t, e, o), await O(t, e), A(t), process.env.NODE_ENV !== "production" && !g) {
     const n = globalThis.__veloDevServer;
     n && (b(n), await S(t, n));
   }
   return t;
 }, te = async (e) => {
-  const { routes: t } = e, s = Number(process.env.PORT) || e.port || 3e3, r = await K(t);
+  const { routes: t } = e, s = Number(process.env.PORT) || e.port || 3e3, a = process.env.HOST || e.hostname || void 0, o = await K(t);
   if (process.env.NODE_ENV === "production" && !process.env.VELO_STATIC) {
-    const { serve: o } = await import("@hono/node-server"), { serveStatic: n } = await import("@hono/node-server/serve-static"), { join: a } = await import("node:path"), c = a(process.cwd(), "dist/client");
-    (process.env.STATIC_BASE_URL || "").startsWith("http") || r.use("/*", n({ root: c })), console.log(`Server running on http://localhost:${s}`);
-    const l = o({ fetch: r.fetch, port: s });
-    await S(r, l), b(l);
+    const { serve: n } = await import("@hono/node-server"), { serveStatic: i } = await import("@hono/node-server/serve-static"), { join: c } = await import("node:path"), r = c(process.cwd(), "dist/client");
+    (process.env.STATIC_BASE_URL || "").startsWith("http") || o.use("/*", i({ root: r }));
+    const l = n({ fetch: o.fetch, port: s, ...a ? { hostname: a } : {} });
+    l.listening || await new Promise((u) => l.once("listening", u));
+    const d = l.address();
+    if (d && typeof d == "object") {
+      const h = d.address === "::" || d.address === "0.0.0.0" ? "0.0.0.0 (all interfaces)" : d.address;
+      console.log(`Server running on ${h}:${d.port}`);
+    } else
+      console.log(`Server running on port ${s}`);
+    await S(o, l), b(l), l.once("close", () => {
+      g === l && (g = null);
+    });
   }
-  return r;
+  return o;
 };
 export {
   ee as addRoutes,
   K as createApp,
   K as default,
-  N as jsonForScript,
+  I as jsonForScript,
   Z as onServer,
   P as serverDataStorage,
   te as startServer

package/dist/vite.d.ts

@@ -66,4 +66,14 @@ export declare function buildFullPathMap(code: string): Map<string, PathInfo>;
  * Percorre recursivamente a árvore de rotas e coleta moduleName → { fullPath, path }
  */
 export declare function collectFullPaths(elements: (t.Expression | t.SpreadElement | null)[], parentPath: string, result: Map<string, PathInfo>): void;
+/**
+ * @hono/vite-dev-server treats `exclude` as all-or-nothing: passing one
+ * replaces the defaults entirely. We compose instead — the upstream defaults
+ * (imported, so they track the installed version) plus `.mjs`, which upstream
+ * misses: build-time generators (Panda CSS, vanilla-extract) emit ESM
+ * artifacts inside the project, and a project `.mjs` that falls through to
+ * the SSR app comes back as fallback HTML/404 — the browser's ESM import
+ * dies silently.
+ */
+export declare function devServerExcludeFor(veloConfig: VeloConfig): (string | RegExp)[];
 export declare function veloPlugin(config?: VeloConfig): PluginOption[];

package/dist/vite.js

@@ -1,15 +1,15 @@
 import d from "node:path";
 import g from "node:fs";
 import R from "@preact/preset-vite";
-import $ from "@hono/vite-dev-server";
-import { parse as h } from "@babel/parser";
+import $, { defaultOptions as J } from "@hono/vite-dev-server";
+import { parse as _ } from "@babel/parser";
 import j from "@babel/traverse";
 import L from "@babel/generator";
 import * as e from "@babel/types";
 import { buildGraph as U } from "./graph.js";
-const m = typeof j == "function" ? j : j.default, _ = typeof L == "function" ? L : L.default;
-function W(p, o, n, i) {
-  const l = h(p, {
+const m = typeof j == "function" ? j : j.default, h = typeof L == "function" ? L : L.default;
+function W(u, o, n, i) {
+  const l = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
@@ -70,10 +70,10 @@ function W(p, o, n, i) {
     );
     l.program.body.unshift(c);
   }
-  return _(l, { retainLines: !0 }).code;
+  return h(l, { retainLines: !0 }).code;
 }
-function J(p, o) {
-  const n = h(p, {
+function M(u, o) {
+  const n = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
@@ -81,13 +81,13 @@ function J(p, o) {
     CallExpression(l) {
       const t = l.node.callee, a = e.isIdentifier(t, { name: "Loader" }) || e.isTSInstantiationExpression(t) && e.isIdentifier(t.expression, { name: "Loader" }), s = e.isIdentifier(t, { name: "useLoader" }) || e.isTSInstantiationExpression(t) && e.isIdentifier(t.expression, { name: "useLoader" });
       if (!a && !s) return;
-      const c = l.node.arguments, r = e.stringLiteral(o), u = c[0];
-      e.isStringLiteral(u) && u.value.includes("/") || (l.node.arguments = [r, ...c]);
+      const c = l.node.arguments, r = e.stringLiteral(o), p = c[0];
+      e.isStringLiteral(p) && p.value.includes("/") || (l.node.arguments = [r, ...c]);
     }
-  }), _(n, { retainLines: !0 }).code;
+  }), h(n, { retainLines: !0 }).code;
 }
-function B(p, o) {
-  const n = h(p, {
+function B(u, o) {
+  const n = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
@@ -101,13 +101,13 @@ function B(p, o) {
       if (!s.startsWith("action_")) return;
       const c = s.replace("action_", ""), r = a.init;
       if (!e.isArrowFunctionExpression(r) || !r.async) return;
-      const u = r.params, f = M(o, c, u);
-      r.body = e.blockStatement([e.returnStatement(f)]), H(r, u);
+      const p = r.params, f = H(o, c, p);
+      r.body = e.blockStatement([e.returnStatement(f)]), G(r, p);
     }
-  }), _(n, { retainLines: !0 }).code;
+  }), h(n, { retainLines: !0 }).code;
 }
-function M(p, o, n) {
-  const i = `/_action/${p}/${o}`;
+function H(u, o, n) {
+  const i = `/_action/${u}/${o}`;
   return n.length === 0 ? e.callExpression(
     e.memberExpression(
       e.callExpression(e.identifier("fetch"), [
@@ -176,7 +176,7 @@ function M(p, o, n) {
     ]
   );
 }
-function H(p, o) {
+function G(u, o) {
   if (o.length === 0) return;
   const n = o[0];
   if (e.isObjectPattern(n)) {
@@ -199,11 +199,11 @@ function H(p, o) {
           e.tsTypeAnnotation(i)
         )
       ])
-    )), p.params = [t];
+    )), u.params = [t];
   }
 }
-function G(p, o) {
-  const n = h(p, {
+function z(u, o) {
+  const n = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
@@ -227,10 +227,10 @@ function G(p, o) {
         )
       ]), a.id.typeAnnotation = null;
     }
-  }), _(n, { retainLines: !0 }).code;
+  }), h(n, { retainLines: !0 }).code;
 }
-function z(p, o) {
-  const n = h(p, {
+function Y(u, o) {
+  const n = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
@@ -254,10 +254,10 @@ function z(p, o) {
         )
       ]), a.id.typeAnnotation = null;
     }
-  }), _(n, { retainLines: !0 }).code;
+  }), h(n, { retainLines: !0 }).code;
 }
-function Y(p) {
-  const o = h(p, {
+function X(u) {
+  const o = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
@@ -268,10 +268,10 @@ function Y(p) {
       const t = l.declarations[0];
       !t || !e.isIdentifier(t.id) || t.id.name === "loader" && i.remove();
     }
-  }), _(o, { retainLines: !0 }).code;
+  }), h(o, { retainLines: !0 }).code;
 }
-function X(p) {
-  const o = h(p, {
+function q(u) {
+  const o = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   }), n = /* @__PURE__ */ new Set();
@@ -284,10 +284,10 @@ function X(p) {
       const s = a.filter((c) => n.has(c.local.name));
       s.length !== a.length && (i = !0, s.length === 0 ? t.remove() : t.node.specifiers = s);
     }
-  }), i ? _(o, { retainLines: !0 }).code : p;
+  }), i ? h(o, { retainLines: !0 }).code : u;
 }
-function q(p) {
-  const o = h(p, {
+function K(u) {
+  const o = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   }), n = [];
@@ -295,7 +295,7 @@ function q(p) {
     ObjectProperty(s) {
       e.isIdentifier(s.node.key, { name: "middlewares" }) && (n.push(s.node.value), s.remove());
     }
-  }), n.length === 0) return p;
+  }), n.length === 0) return u;
   const i = /* @__PURE__ */ new Set();
   for (const s of n)
     x(s, i);
@@ -306,12 +306,12 @@ function q(p) {
     l.has(s) || t.add(s);
   return t.size > 0 && m(o, {
     ImportDeclaration(s) {
-      const c = s.node.specifiers, r = c.filter((u) => !t.has(u.local.name));
+      const c = s.node.specifiers, r = c.filter((p) => !t.has(p.local.name));
       r.length === 0 ? s.remove() : r.length !== c.length && (s.node.specifiers = r);
     }
-  }), _(o, { retainLines: !0 }).code;
+  }), h(o, { retainLines: !0 }).code;
 }
-function x(p, o) {
+function x(u, o) {
   const n = (i) => {
     if (!(!i || typeof i != "object")) {
       if (Array.isArray(i)) {
@@ -339,43 +339,43 @@ function x(p, o) {
           l === "loc" || l === "start" || l === "end" || l === "leadingComments" || l === "trailingComments" || l === "innerComments" || n(i[l]);
     }
   };
-  n(p);
+  n(u);
 }
-function K(p) {
-  for (const o of p.properties)
+function Q(u) {
+  for (const o of u.properties)
     if (e.isObjectProperty(o) && e.isIdentifier(o.key) && o.key.name === "handler")
       return !0;
   return !1;
 }
-function Q(p) {
-  for (const o of p.properties)
+function Z(u) {
+  for (const o of u.properties)
     if (e.isObjectProperty(o) && e.isIdentifier(o.key) && o.key.name === "children" && e.isArrayExpression(o.value))
       return o.value;
   return null;
 }
-function Z(p) {
-  const o = h(p, {
+function ee(u) {
+  const o = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   }), n = [], i = (c) => {
     for (let r = c.elements.length - 1; r >= 0; r--) {
-      const u = c.elements[r];
-      if (!e.isObjectExpression(u)) continue;
-      if (K(u)) {
-        n.push(u), c.elements.splice(r, 1);
+      const p = c.elements[r];
+      if (!e.isObjectExpression(p)) continue;
+      if (Q(p)) {
+        n.push(p), c.elements.splice(r, 1);
         continue;
       }
-      const f = Q(u);
+      const f = Z(p);
       f && i(f);
     }
   };
   if (m(o, {
     ExportDefaultDeclaration(c) {
       const r = c.node.declaration;
-      let u = null;
-      e.isArrayExpression(r) ? u = r : (e.isTSSatisfiesExpression(r) && e.isArrayExpression(r.expression) || e.isTSAsExpression(r) && e.isArrayExpression(r.expression)) && (u = r.expression), u && i(u);
+      let p = null;
+      e.isArrayExpression(r) ? p = r : (e.isTSSatisfiesExpression(r) && e.isArrayExpression(r.expression) || e.isTSAsExpression(r) && e.isArrayExpression(r.expression)) && (p = r.expression), p && i(p);
     }
-  }), n.length === 0) return p;
+  }), n.length === 0) return u;
   const l = /* @__PURE__ */ new Set();
   for (const c of n)
     x(c, l);
@@ -386,13 +386,13 @@ function Z(p) {
     t.has(c) || a.add(c);
   return a.size > 0 && m(o, {
     ImportDeclaration(c) {
-      const r = c.node.specifiers, u = r.filter((f) => !a.has(f.local.name));
-      u.length === 0 ? c.remove() : u.length !== r.length && (c.node.specifiers = u);
+      const r = c.node.specifiers, p = r.filter((f) => !a.has(f.local.name));
+      p.length === 0 ? c.remove() : p.length !== r.length && (c.node.specifiers = p);
     }
-  }), _(o, { retainLines: !0 }).code;
+  }), h(o, { retainLines: !0 }).code;
 }
-function A(p) {
-  const o = h(p, {
+function A(u) {
+  const o = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   }), n = /* @__PURE__ */ new Map();
@@ -408,7 +408,7 @@ function A(p) {
     ExportDefaultDeclaration(t) {
       const a = t.node.declaration;
       let s = null;
-      e.isArrayExpression(a) ? s = a : (e.isTSSatisfiesExpression(a) || e.isTSAsExpression(a)) && e.isArrayExpression(a.expression) && (s = a.expression), s && D(s.elements, "", i);
+      e.isArrayExpression(a) ? s = a : (e.isTSSatisfiesExpression(a) || e.isTSAsExpression(a)) && e.isArrayExpression(a.expression) && (s = a.expression), s && C(s.elements, "", i);
     }
   });
   const l = /* @__PURE__ */ new Map();
@@ -421,14 +421,14 @@ function A(p) {
   }
   return l;
 }
-function D(p, o, n) {
-  for (const i of p) {
+function C(u, o, n) {
+  for (const i of u) {
     if (!e.isObjectExpression(i)) continue;
     let l = "", t = o, a = null, s = null;
     for (const c of i.properties) {
       if (!e.isObjectProperty(c)) continue;
-      const r = c.key, u = e.isIdentifier(r) ? r.name : null;
-      u === "path" && e.isStringLiteral(c.value) && (l = c.value.value, l && !l.startsWith("/") ? t = o + "/" + l : t = o + l), u === "module" && e.isIdentifier(c.value) && (a = c.value.name), u === "children" && e.isArrayExpression(c.value) && (s = c.value);
+      const r = c.key, p = e.isIdentifier(r) ? r.name : null;
+      p === "path" && e.isStringLiteral(c.value) && (l = c.value.value, l && !l.startsWith("/") ? t = o + "/" + l : t = o + l), p === "module" && e.isIdentifier(c.value) && (a = c.value.name), p === "children" && e.isArrayExpression(c.value) && (s = c.value);
     }
     if (a) {
       const r = !s && l === "/" ? o || "/" : t;
@@ -437,13 +437,13 @@ function D(p, o, n) {
         path: l
       });
     }
-    s && D(s.elements, t, n);
+    s && C(s.elements, t, n);
   }
 }
-const b = "virtual:velo/server-entry", E = "virtual:velo/client-entry", P = "\0" + b, N = "\0" + E;
-function ee(p, o) {
+const E = "virtual:velo/server-entry", b = "virtual:velo/client-entry", N = "\0" + E, P = "\0" + b;
+function te(u, o) {
   let n = d.resolve(process.cwd(), o);
-  const i = p.routesFile ?? "routes.tsx", l = /* @__PURE__ */ new Map();
+  const i = u.routesFile ?? "routes.tsx", l = /* @__PURE__ */ new Map();
   return {
     name: "velo:transform",
     enforce: "pre",
@@ -464,27 +464,27 @@ function ee(p, o) {
       if (t === s) {
         const c = g.readFileSync(s, "utf-8"), r = A(c);
         l.clear();
-        for (const [u, f] of r)
-          l.set(u, f);
+        for (const [p, f] of r)
+          l.set(p, f);
         return a.ws.send({ type: "full-reload" }), [];
       }
     },
     resolveId(t) {
-      return t === b || t.endsWith(b) ? P : t === E || t.endsWith(E) || t === "/__velo_client.js" ? N : null;
+      return t === E || t.endsWith(E) ? N : t === b || t.endsWith(b) || t === "/__velo_client.js" ? P : null;
     },
     load(t) {
-      const a = p.routesFile ?? "routes.tsx", s = p.serverInit ?? "server.tsx", c = p.clientInit ?? "client.tsx", r = d.join(n, a).replace(/\.tsx?$/, ".js"), u = d.join(n, s).replace(/\.tsx?$/, ".js"), f = d.join(n, c).replace(/\.tsx?$/, ".js");
-      return t === P ? `
+      const a = u.routesFile ?? "routes.tsx", s = u.serverInit ?? "server.tsx", c = u.clientInit ?? "client.tsx", r = d.join(n, a).replace(/\.tsx?$/, ".js"), p = d.join(n, s).replace(/\.tsx?$/, ".js"), f = d.join(n, c).replace(/\.tsx?$/, ".js");
+      return t === N ? `
 globalThis.__veloBuildHash = __VELO_BUILD_HASH__;
 globalThis.__veloClientJs = __VELO_CLIENT_JS__;
 globalThis.__veloClientCss = __VELO_CLIENT_CSS__;
-import "${u}";
+import "${p}";
 import routes from "${r}";
 import { startServer } from "@mauroandre/velojs/server";
 
 export { routes };
-export default await startServer({ routes, port: __VELO_CONFIG_PORT__ });
-` : t === N ? `
+export default await startServer({ routes, port: __VELO_CONFIG_PORT__, hostname: __VELO_CONFIG_HOSTNAME__ });
+` : t === P ? `
 import "${f}";
 import routes from "${r}";
 import { startClient } from "@mauroandre/velojs/client";
@@ -495,39 +495,39 @@ startClient({ routes });
     transform(t, a, s) {
       const c = s?.ssr === !0;
       if (a.startsWith("\0") || a.includes("/.velojs/") || !a.endsWith(".tsx") && !a.endsWith(".ts") || !a.startsWith(n)) return null;
-      let r = t, u = !1;
+      let r = t, p = !1;
       const f = /middlewares:\s*\[/.test(t), y = /export\s+(const|function)\s+Component/.test(
         t
-      ), v = /export\s+(const|function)\s+loader/.test(t), C = /export\s+const\s+action_\w+/.test(t), I = /export\s+const\s+stream_\w+/.test(t), T = /export\s+const\s+socket_\w+/.test(t), w = /\bLoader\s*</.test(t) || /\bLoader\s*\(/.test(t), k = /\buseLoader\s*</.test(t) || /\buseLoader\s*\(/.test(t), F = /\bhandler\s*:/.test(t), V = d.join(n, i);
-      if (!c && f && (r = q(r), u = !0), !c && F && a === V && (r = Z(r), u = !0), y || v || C || I || T || w || k) {
+      ), v = /export\s+(const|function)\s+loader/.test(t), D = /export\s+const\s+action_\w+/.test(t), I = /export\s+const\s+stream_\w+/.test(t), T = /export\s+const\s+socket_\w+/.test(t), w = /\bLoader\s*</.test(t) || /\bLoader\s*\(/.test(t), F = /\buseLoader\s*</.test(t) || /\buseLoader\s*\(/.test(t), k = /\bhandler\s*:/.test(t), V = d.join(n, i);
+      if (!c && f && (r = K(r), p = !0), !c && k && a === V && (r = ee(r), p = !0), y || v || D || I || T || w || F) {
         const S = d.relative(n, a).replace(/\.(tsx?|jsx?)$/, "").replace(/\\/g, "/"), O = l.get(S);
-        r = W(r, S, O?.fullPath, O?.path), r = J(r, S), c || (r = B(
+        r = W(r, S, O?.fullPath, O?.path), r = M(r, S), c || (r = B(
           r,
           S
-        )), !c && I && (r = G(
+        )), !c && I && (r = z(
           r,
           S
-        )), !c && T && (r = z(
+        )), !c && T && (r = Y(
           r,
           S
-        )), c || (r = Y(r)), c || (r = X(r)), u = !0;
+        )), c || (r = X(r)), c || (r = q(r)), p = !0;
       }
-      return u ? {
+      return p ? {
         code: r,
         map: null
       } : null;
     }
   };
 }
-function te(p) {
+function re(u) {
   return {
     name: "velo:config",
     config(o, { mode: n }) {
-      const i = n === "server", l = n === "development", t = !!process.env.VELO_STATIC, a = o.server?.port ?? (Number(process.env.PORT) || p.port || 3e3);
+      const i = n === "server", l = n === "development", t = !!process.env.VELO_STATIC, a = o.server?.port ?? (Number(process.env.PORT) || u.port || 3e3);
       let s = "client.js", c = "client.css";
       if (i)
         try {
-          const u = d.resolve(process.cwd(), "dist/client/.vite/manifest.json"), y = JSON.parse(g.readFileSync(u, "utf-8"))[E];
+          const p = d.resolve(process.cwd(), "dist/client/.vite/manifest.json"), y = JSON.parse(g.readFileSync(p, "utf-8"))[b];
           y && (s = y.file || s, y.css?.[0] && (c = y.css[0]));
         } catch {
         }
@@ -541,7 +541,9 @@ function te(p) {
           __VELO_CLIENT_CSS__: JSON.stringify(c),
           // Baked into the server bundle as startServer's port fallback.
           // null when unset → startServer falls back to PORT env / 3000.
-          __VELO_CONFIG_PORT__: JSON.stringify(p.port ?? null)
+          __VELO_CONFIG_PORT__: JSON.stringify(u.port ?? null),
+          // Same for the bind interface: null → HOST env / Node default.
+          __VELO_CONFIG_HOSTNAME__: JSON.stringify(u.hostname ?? null)
         },
         resolve: {
           alias: {
@@ -554,7 +556,7 @@ function te(p) {
         }
       };
       return i ? r.build = {
-        ssr: b,
+        ssr: E,
         outDir: "dist",
         emptyOutDir: !1,
         copyPublicDir: !1,
@@ -567,22 +569,22 @@ function te(p) {
         manifest: !0,
         outDir: "dist/client",
         rollupOptions: {
-          input: E,
+          input: b,
           output: {
             entryFileNames: "client.[hash].js",
-            assetFileNames: (u) => u.names?.[0]?.endsWith(".css") ? "client.[hash].css" : "[name].[hash][extname]"
+            assetFileNames: (p) => p.names?.[0]?.endsWith(".css") ? "client.[hash].css" : "[name].[hash][extname]"
           }
         }
       }), r;
     }
   };
 }
-function re() {
+function ne() {
   return {
     name: "velo:static-url",
     apply: "build",
     enforce: "post",
-    generateBundle(p, o) {
+    generateBundle(u, o) {
       const n = process.env.STATIC_BASE_URL || "";
       if (n)
         for (const i of Object.values(o))
@@ -593,7 +595,7 @@ function re() {
     }
   };
 }
-function ne(p, o) {
+function ie(u, o) {
   let n = "", i = "", l = !1, t = null;
   function a() {
     if (!n) return;
@@ -616,45 +618,54 @@ function ne(p, o) {
     configureServer(s) {
       a(), l = !0;
       const c = d.resolve(n, o);
-      s.watcher.on("all", (r, u) => {
-        l && u.startsWith(c) && (t && clearTimeout(t), t = setTimeout(() => a(), 500));
+      s.watcher.on("all", (r, p) => {
+        l && p.startsWith(c) && (t && clearTimeout(t), t = setTimeout(() => a(), 500));
       });
     }
   };
 }
-function de(p) {
-  const o = p ?? {}, n = o.appDirectory ?? "./app";
+function se(u) {
   return [
-    te(o),
-    ee(o, n),
-    re(),
-    ne(o, n),
+    ...J.exclude,
+    /.*\.mjs$/,
+    ...u.devServerExclude ?? []
+  ];
+}
+function ye(u) {
+  const o = u ?? {}, n = o.appDirectory ?? "./app";
+  return [
+    re(o),
+    te(o, n),
+    ne(),
+    ie(o, n),
     R(),
     $({
-      entry: b
+      entry: E,
+      exclude: se(o)
     }),
-    ie()
+    oe()
   ];
 }
-function ie() {
+function oe() {
   return {
     name: "velo:ws-bridge",
-    configureServer(p) {
-      globalThis.__veloDevServer = p.httpServer;
+    configureServer(u) {
+      globalThis.__veloDevServer = u.httpServer;
     }
   };
 }
 export {
   A as buildFullPathMap,
-  D as collectFullPaths,
+  C as collectFullPaths,
+  se as devServerExcludeFor,
   W as injectMetadata,
-  X as pruneClientOnlyImports,
-  Z as removeEndpointRoutes,
-  Y as removeLoaders,
-  q as removeMiddlewares,
+  q as pruneClientOnlyImports,
+  ee as removeEndpointRoutes,
+  X as removeLoaders,
+  K as removeMiddlewares,
   B as transformActionsForClient,
-  J as transformLoaderFunctions,
-  z as transformSocketsForClient,
-  G as transformStreamsForClient,
-  de as veloPlugin
+  M as transformLoaderFunctions,
+  Y as transformSocketsForClient,
+  z as transformStreamsForClient,
+  ye as veloPlugin
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mauroandre/velojs",
-    "version": "0.0.49",
+    "version": "0.0.51",
     "type": "module",
     "description": "Fullstack web framework built on Hono + Preact with Vite-powered AST transforms",
     "keywords": [