@mauroandre/velojs 0.0.50 → 0.0.51

package/agent/skills/velojs-production-deploy/SKILL.md

@@ -71,6 +71,45 @@ export default defineConfig({
 
 In dev, `velojs dev --port 5000` still overrides everything (it's passed straight to Vite).
 
+## Choosing the bind interface (hostname)
+
+By default `velojs start` binds to **all interfaces** (`::`) — the norm for Node servers and what containers and cloud platforms expect (they route traffic through the network interface; loopback-only would make the container unreachable). To change it, in order of precedence:
+
+1. The `HOST` environment variable.
+2. The `hostname` field in `defineConfig`.
+3. The Node default (all interfaces).
+
+### Secure bind for local/sensitive apps
+
+If your app is **local and single-user** — a cockpit with a terminal, file access, real user data — it must listen on loopback only. An all-interfaces bind exposes that surface to the whole network without any error: the developer finds out by scanning, not by the app telling them.
+
+```bash
+# Deploy do app local: bind em loopback, sempre
+HOST=127.0.0.1 velojs start
+```
+
+Because "set HOST" is easy to forget, sensitive apps should also **fail fast if the bind is wrong** — check the real address after the server starts, via `onServer`:
+
+```typescript
+// app/server.tsx
+import { onServer } from "@mauroandre/velojs/server";
+
+onServer((server) => {
+    const addr = server.address();
+    const loopback = ["127.0.0.1", "::1", "::ffff:127.0.0.1"];
+    if (!addr || typeof addr !== "object" || !loopback.includes(addr.address)) {
+        console.error(
+            `[${process.env.APP_NAME ?? "app"}][CRIT] ` +
+            `server bound on ${addr && typeof addr === "object" ? addr.address : "?"} — outside loopback. ` +
+            `This app runs commands on this machine: it may only listen on 127.0.0.1/::1. Aborting.`
+        );
+        process.exit(1);
+    }
+});
+```
+
+This pattern caught a real exposure in production: the server had bound to `::` and the guard aborted instead of serving. When deploying the same app to a VPS later, the bind changes **consciously** to `HOST=0.0.0.0` — together with authentication and its own security spec, not by accident.
+
 ## Static assets on CDN
 
 If you want to serve static assets (JS, CSS, images) from a CDN or S3 bucket instead of the Node.js server, set the `STATIC_BASE_URL` environment variable:

package/dist/config.d.ts

@@ -25,6 +25,12 @@ export interface VeloConfig {
      * @default 3000
      */
     port?: number;
+    /**
+     * Interface de bind do servidor de produção. A env `HOST` tem precedência.
+     * Default do Node: todas as interfaces (o que Docker/cloud esperam).
+     * Apps locais/sensíveis devem declarar "127.0.0.1".
+     */
+    hostname?: string;
     /**
      * Padrões adicionais de URL que o dev server deve delegar ao Vite em vez
      * de interceptar como página (ex.: artefatos de geradores build-time como

package/dist/server.d.ts

@@ -7,6 +7,12 @@ export declare function onServer(fn: ServerCallback): void;
 export interface StartServerOptions {
     routes: AppRoutes;
     port?: number;
+    /**
+     * Hostname/interface to bind. Precedence: HOST env > this option > Node
+     * default (all interfaces — the ecosystem norm for containers/proxies).
+     * Local/sensitive apps should bind "127.0.0.1".
+     */
+    hostname?: string;
 }
 export declare function addRoutes(fn: (app: Hono) => void | Promise<void>): void;
 /**

package/dist/server.js

@@ -1,94 +1,94 @@
-import { jsx as _ } from "preact/jsx-runtime";
-import { Hono as j } from "hono";
-import { logger as E } from "hono/logger";
-import { trimTrailingSlash as T } from "hono/trailing-slash";
+import { jsx as v } from "preact/jsx-runtime";
+import { Hono as R } from "hono";
+import { logger as T } from "hono/logger";
+import { trimTrailingSlash as E } from "hono/trailing-slash";
 import { render as C } from "preact-render-to-string";
-import { Router as k } from "wouter-preact";
-import { AsyncLocalStorage as A } from "node:async_hooks";
-import { getAppContext as w } from "./app-context.js";
-import { flushPendingStreamRoutes as D, registerStreamHandler as $ } from "./events.js";
-import { registerSocketRoutes as I, injectWebSocketServer as S } from "./sockets.js";
-const P = new A();
+import { Router as $ } from "wouter-preact";
+import { AsyncLocalStorage as k } from "node:async_hooks";
+import { getAppContext as _ } from "./app-context.js";
+import { flushPendingStreamRoutes as A, registerStreamHandler as D } from "./events.js";
+import { registerSocketRoutes as O, injectWebSocketServer as S } from "./sockets.js";
+const P = new k();
 globalThis.__veloServerData = P;
-let v = null;
+let g = null;
 function Z(e) {
-  if (v) {
-    e(v);
+  if (g) {
+    e(g);
     return;
   }
-  w().serverCallbacks.push(e);
+  _().serverCallbacks.push(e);
 }
 function b(e) {
-  v = e;
-  const t = w();
+  g = e;
+  const t = _();
   for (const s of t.serverCallbacks) s(e);
   t.serverCallbacks.length = 0;
 }
 function ee(e) {
-  w().pendingRoutes.push(e);
+  _().pendingRoutes.push(e);
 }
-const N = (e) => JSON.stringify(e).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029"), O = (e, t, s, r) => {
-  if (r && r !== 200 && e.status(r), e.req.query("_data") === "1") {
-    const c = globalThis.__veloBuildHash || void 0, i = s ? { ...s, __buildHash: c } : { __buildHash: c };
-    return e.json(i);
+const I = (e) => JSON.stringify(e).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029"), N = (e, t, s, a) => {
+  if (a && a !== 200 && e.status(a), e.req.query("_data") === "1") {
+    const c = globalThis.__veloBuildHash || void 0, r = s ? { ...s, __buildHash: c } : { __buildHash: c };
+    return e.json(r);
   }
   const o = e.req.path, n = P.run(
     s ?? {},
-    () => C(/* @__PURE__ */ _(k, { ssrPath: o, children: t }))
+    () => C(/* @__PURE__ */ v($, { ssrPath: o, children: t }))
   );
   if (e.header("Cache-Control", "no-cache"), !s)
     return e.html(n);
-  const a = `<script>window.__PAGE_DATA__=${N(s)}<\/script>`;
-  return e.html(n.replace("</head>", () => `${a}</head>`));
-}, G = async (e, t) => {
-  const s = t.req.param(), r = t.req.query(), o = { params: s, query: r, c: t }, n = await Promise.all(
-    e.map(async (i) => {
-      if (!i.loader) return null;
-      const l = await i.loader(o), d = i.metadata?.moduleId;
-      return d ? { moduleId: d, loaderData: l } : null;
+  const i = `<script>window.__PAGE_DATA__=${I(s)}<\/script>`;
+  return e.html(n.replace("</head>", () => `${i}</head>`));
+}, H = async (e, t) => {
+  const s = t.req.param(), a = t.req.query(), o = { params: s, query: a, c: t }, n = await Promise.all(
+    e.map(async (r) => {
+      if (!r.loader) return null;
+      const f = await r.loader(o), l = r.metadata?.moduleId;
+      return l ? { moduleId: l, loaderData: f } : null;
     })
   );
-  let a;
-  for (const i of n)
-    if (i && i.loaderData instanceof Response) {
-      a = i.loaderData;
+  let i;
+  for (const r of n)
+    if (r && r.loaderData instanceof Response) {
+      i = r.loaderData;
       break;
     }
   const c = {
     __params: s,
-    __query: r,
+    __query: a,
     __pathname: t.req.path
   };
-  for (const i of n)
-    i && !(i.loaderData instanceof Response) && (c[i.moduleId] = i.loaderData);
+  for (const r of n)
+    r && !(r.loaderData instanceof Response) && (c[r.moduleId] = r.loaderData);
   return {
-    components: e.map((i) => i.Component),
+    components: e.map((r) => r.Component),
     data: c,
-    shortCircuit: a
+    shortCircuit: i
   };
-}, H = (e) => {
+}, G = (e) => {
   if (e.length === 0) return null;
   const t = e.filter(Boolean);
   if (t.length === 0) return null;
   if (t.length === 1) {
     const o = t[0];
-    return /* @__PURE__ */ _(o, {});
+    return /* @__PURE__ */ v(o, {});
   }
   const s = t[t.length - 1];
-  return t.slice(0, -1).reduceRight((o, n) => /* @__PURE__ */ _(n, { children: o }), /* @__PURE__ */ _(s, {}));
-}, y = (e, t, s = [], r = []) => {
+  return t.slice(0, -1).reduceRight((o, n) => /* @__PURE__ */ v(n, { children: o }), /* @__PURE__ */ v(s, {}));
+}, y = (e, t, s = [], a = []) => {
   for (const o of t) {
     if (o.handler && !o.module) {
       o.children && y(
         e,
         o.children,
         s,
-        [...r, ...o.middlewares || []]
+        [...a, ...o.middlewares || []]
       );
       continue;
     }
-    const n = o.module ? [...s, o.module] : s, a = [
-      ...r,
+    const n = o.module ? [...s, o.module] : s, i = [
+      ...a,
       ...o.middlewares || []
     ];
     if (o.children)
@@ -96,104 +96,104 @@ const N = (e) => JSON.stringify(e).replace(/</g, "\\u003c").replace(/>/g, "\\u00
         e,
         o.children,
         n,
-        a
+        i
       );
     else if (o.module) {
-      const c = o.path === "*", i = o.statusCode ?? (c ? 404 : void 0), l = o.module.metadata?.fullPath;
-      if (!l && !c) {
+      const c = o.path === "*", r = o.statusCode ?? (c ? 404 : void 0), f = o.module.metadata?.fullPath;
+      if (!f && !c) {
         console.warn(
           `Module ${o.module.metadata?.moduleId} has no fullPath`
         );
         continue;
       }
-      const d = async (h) => {
-        const { components: u, data: m, shortCircuit: f } = await G(n, h);
-        if (f) {
-          const g = f.headers.get("Location");
-          return h.req.query("_data") === "1" && g && f.status >= 300 && f.status < 400 ? h.json({ __redirect: g }) : f;
+      const l = async (d) => {
+        const { components: u, data: h, shortCircuit: m } = await H(n, d);
+        if (m) {
+          const w = m.headers.get("Location");
+          return d.req.query("_data") === "1" && w && m.status >= 300 && m.status < 400 ? d.json({ __redirect: w }) : m;
         }
-        const p = H(u);
-        return O(h, p, m, i);
+        const p = G(u);
+        return N(d, p, h, r);
       };
-      c ? e.notFound(d) : a.length > 0 ? e.on(["GET"], [l], ...a, d) : e.on(["GET"], [l], d);
+      c ? e.notFound(l) : i.length > 0 ? e.on(["GET"], [f], ...i, l) : e.on(["GET"], [f], l);
     } else
       continue;
   }
 }, q = (e, t, s = []) => {
-  for (const r of t) {
-    const o = r.module?.metadata?.moduleId, n = [
+  for (const a of t) {
+    const o = a.module?.metadata?.moduleId, n = [
       ...s,
-      ...r.middlewares || []
+      ...a.middlewares || []
     ];
-    if (r.module && o) {
-      const a = Object.keys(r.module).filter(
+    if (a.module && o) {
+      const i = Object.keys(a.module).filter(
         (c) => c.startsWith("action_")
       );
-      for (const c of a) {
-        const i = c.replace("action_", ""), l = r.module[c];
-        if (typeof l == "function") {
-          const d = `/_action/${o}/${i}`, h = async (u) => {
-            let m = {};
+      for (const c of i) {
+        const r = c.replace("action_", ""), f = a.module[c];
+        if (typeof f == "function") {
+          const l = `/_action/${o}/${r}`, d = async (u) => {
+            let h = {};
             try {
-              m = await u.req.json();
+              h = await u.req.json();
             } catch {
             }
-            const f = {
-              body: m,
+            const m = {
+              body: h,
               params: u.req.param(),
               query: u.req.query(),
               c: u
             };
             try {
-              const p = await l(f);
+              const p = await f(m);
               return u.json(p ?? { ok: !0 });
             } catch (p) {
-              const g = p instanceof Error ? p.message : "Action failed";
-              return u.json({ error: g }, 500);
+              const w = p instanceof Error ? p.message : "Action failed";
+              return u.json({ error: w }, 500);
             }
           };
           n.length > 0 ? e.on(
             ["POST"],
-            [d],
+            [l],
             ...n,
-            h
-          ) : e.on(["POST"], [d], h);
+            d
+          ) : e.on(["POST"], [l], d);
         }
       }
     }
-    r.children && q(e, r.children, n);
+    a.children && q(e, a.children, n);
   }
 }, x = async (e, t, s = []) => {
-  const r = (o, n) => {
-    for (const a of o) {
-      const c = a.module?.metadata?.moduleId, i = [
+  const a = (o, n) => {
+    for (const i of o) {
+      const c = i.module?.metadata?.moduleId, r = [
         ...n,
-        ...a.middlewares || []
+        ...i.middlewares || []
       ];
-      if (a.module && c) {
-        const l = Object.keys(a.module).filter(
-          (d) => d.startsWith("stream_")
+      if (i.module && c) {
+        const f = Object.keys(i.module).filter(
+          (l) => l.startsWith("stream_")
         );
-        for (const d of l) {
-          const h = d.replace("stream_", ""), u = a.module[d];
+        for (const l of f) {
+          const d = l.replace("stream_", ""), u = i.module[l];
           if (u?.__isVeloEventStream) {
-            const m = `/_event/${c}/${h}`;
-            u.__path = m, $(
+            const h = `/_event/${c}/${d}`;
+            u.__path = h, D(
               e,
-              m,
+              h,
               u,
-              i
+              r
             );
           }
         }
       }
-      a.children && r(a.children, i);
+      i.children && a(i.children, r);
     }
   };
-  r(t, s);
+  a(t, s);
 }, V = (e, t) => t ? t.startsWith("/") ? e + t : e ? e + "/" + t : "/" + t : e || "", W = (e) => {
-  const t = /* @__PURE__ */ new Set(), s = (r) => {
-    for (const o of r) {
+  const t = /* @__PURE__ */ new Set(), s = (a) => {
+    for (const o of a) {
       if (o.module && !o.children) {
         const n = o.module.metadata?.fullPath;
         n && t.add(n);
@@ -202,68 +202,77 @@ const N = (e) => JSON.stringify(e).replace(/</g, "\\u003c").replace(/>/g, "\\u00
     }
   };
   return s(e), t;
-}, R = (e, t, s, r = "", o = []) => {
+}, j = (e, t, s, a = "", o = []) => {
   for (const n of t) {
-    const a = V(r, n.path), c = [
+    const i = V(a, n.path), c = [
       ...o,
       ...n.middlewares || []
-    ], i = !!n.handler, l = !!n.method;
-    if (i && !l ? console.warn(
-      `[velojs] invalid route at "${a || "/"}" — "handler" set without "method"; endpoint skipped`
-    ) : l && !i ? console.warn(
-      `[velojs] invalid route at "${a || "/"}" — "method" set without "handler"; endpoint skipped`
-    ) : i && n.module ? console.warn(
-      `[velojs] ambiguous route at "${a || "/"}" — both "module" and "handler" set; endpoint ignored, page kept`
-    ) : i && n.isRoot && console.warn(
-      `[velojs] "isRoot" has no effect on endpoint at "${a || "/"}"; ignored`
-    ), i && l && !n.module) {
-      const h = n.method;
-      h === "GET" && s.has(a) && console.warn(
-        `[velojs] path "${a}" has both a page GET and an endpoint GET; the page wins and the endpoint is unreachable. Consider renaming one.`
+    ], r = !!n.handler, f = !!n.method;
+    if (r && !f ? console.warn(
+      `[velojs] invalid route at "${i || "/"}" — "handler" set without "method"; endpoint skipped`
+    ) : f && !r ? console.warn(
+      `[velojs] invalid route at "${i || "/"}" — "method" set without "handler"; endpoint skipped`
+    ) : r && n.module ? console.warn(
+      `[velojs] ambiguous route at "${i || "/"}" — both "module" and "handler" set; endpoint ignored, page kept`
+    ) : r && n.isRoot && console.warn(
+      `[velojs] "isRoot" has no effect on endpoint at "${i || "/"}"; ignored`
+    ), r && f && !n.module) {
+      const d = n.method;
+      d === "GET" && s.has(i) && console.warn(
+        `[velojs] path "${i}" has both a page GET and an endpoint GET; the page wins and the endpoint is unreachable. Consider renaming one.`
       );
-      const u = n.handler, m = async (f) => await u({
-        c: f,
-        params: f.req.param(),
-        query: f.req.query()
+      const u = n.handler, h = async (m) => await u({
+        c: m,
+        params: m.req.param(),
+        query: m.req.query()
       });
-      c.length > 0 ? e.on([h], [a], ...c, m) : e.on([h], [a], m);
+      c.length > 0 ? e.on([d], [i], ...c, h) : e.on([d], [i], h);
     }
-    n.children && R(
+    n.children && j(
       e,
       n.children,
       s,
-      a,
+      i,
       c
     );
   }
 }, K = async (e) => {
-  const t = new j();
-  t.use(T()), process.env.NODE_ENV !== "production" && t.use("*", E());
-  const r = w().pendingRoutes.splice(0);
-  for (const n of r)
+  const t = new R();
+  t.use(E()), process.env.NODE_ENV !== "production" && t.use("*", T());
+  const a = _().pendingRoutes.splice(0);
+  for (const n of a)
     await n(t);
   y(t, e), q(t, e), await x(t, e);
   const o = W(e);
-  if (R(t, e, o), await I(t, e), D(t), process.env.NODE_ENV !== "production" && !v) {
+  if (j(t, e, o), await O(t, e), A(t), process.env.NODE_ENV !== "production" && !g) {
     const n = globalThis.__veloDevServer;
     n && (b(n), await S(t, n));
   }
   return t;
 }, te = async (e) => {
-  const { routes: t } = e, s = Number(process.env.PORT) || e.port || 3e3, r = await K(t);
+  const { routes: t } = e, s = Number(process.env.PORT) || e.port || 3e3, a = process.env.HOST || e.hostname || void 0, o = await K(t);
   if (process.env.NODE_ENV === "production" && !process.env.VELO_STATIC) {
-    const { serve: o } = await import("@hono/node-server"), { serveStatic: n } = await import("@hono/node-server/serve-static"), { join: a } = await import("node:path"), c = a(process.cwd(), "dist/client");
-    (process.env.STATIC_BASE_URL || "").startsWith("http") || r.use("/*", n({ root: c })), console.log(`Server running on http://localhost:${s}`);
-    const l = o({ fetch: r.fetch, port: s });
-    await S(r, l), b(l);
+    const { serve: n } = await import("@hono/node-server"), { serveStatic: i } = await import("@hono/node-server/serve-static"), { join: c } = await import("node:path"), r = c(process.cwd(), "dist/client");
+    (process.env.STATIC_BASE_URL || "").startsWith("http") || o.use("/*", i({ root: r }));
+    const l = n({ fetch: o.fetch, port: s, ...a ? { hostname: a } : {} });
+    l.listening || await new Promise((u) => l.once("listening", u));
+    const d = l.address();
+    if (d && typeof d == "object") {
+      const h = d.address === "::" || d.address === "0.0.0.0" ? "0.0.0.0 (all interfaces)" : d.address;
+      console.log(`Server running on ${h}:${d.port}`);
+    } else
+      console.log(`Server running on port ${s}`);
+    await S(o, l), b(l), l.once("close", () => {
+      g === l && (g = null);
+    });
   }
-  return r;
+  return o;
 };
 export {
   ee as addRoutes,
   K as createApp,
   K as default,
-  N as jsonForScript,
+  I as jsonForScript,
   Z as onServer,
   P as serverDataStorage,
   te as startServer

package/dist/vite.js

@@ -1,15 +1,15 @@
 import d from "node:path";
 import g from "node:fs";
 import R from "@preact/preset-vite";
-import $, { defaultOptions as U } from "@hono/vite-dev-server";
-import { parse as h } from "@babel/parser";
+import $, { defaultOptions as J } from "@hono/vite-dev-server";
+import { parse as _ } from "@babel/parser";
 import j from "@babel/traverse";
 import L from "@babel/generator";
 import * as e from "@babel/types";
-import { buildGraph as W } from "./graph.js";
-const m = typeof j == "function" ? j : j.default, v = typeof L == "function" ? L : L.default;
-function J(u, o, n, i) {
-  const l = h(u, {
+import { buildGraph as U } from "./graph.js";
+const m = typeof j == "function" ? j : j.default, h = typeof L == "function" ? L : L.default;
+function W(u, o, n, i) {
+  const l = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
@@ -22,7 +22,7 @@ function J(u, o, n, i) {
         const r = c.declarations[0];
         if (r && e.isIdentifier(r.id, { name: "metadata" }) && e.isObjectExpression(r.init)) {
           t = !0;
-          const f = r.init.properties.filter((_) => e.isObjectProperty(_) && e.isIdentifier(_.key) ? _.key.name !== "moduleId" && _.key.name !== "fullPath" && _.key.name !== "path" : !0), y = [
+          const f = r.init.properties.filter((v) => e.isObjectProperty(v) && e.isIdentifier(v.key) ? v.key.name !== "moduleId" && v.key.name !== "fullPath" && v.key.name !== "path" : !0), y = [
             e.objectProperty(
               e.identifier("moduleId"),
               e.stringLiteral(o)
@@ -70,10 +70,10 @@ function J(u, o, n, i) {
     );
     l.program.body.unshift(c);
   }
-  return v(l, { retainLines: !0 }).code;
+  return h(l, { retainLines: !0 }).code;
 }
-function B(u, o) {
-  const n = h(u, {
+function M(u, o) {
+  const n = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
@@ -84,10 +84,10 @@ function B(u, o) {
       const c = l.node.arguments, r = e.stringLiteral(o), p = c[0];
       e.isStringLiteral(p) && p.value.includes("/") || (l.node.arguments = [r, ...c]);
     }
-  }), v(n, { retainLines: !0 }).code;
+  }), h(n, { retainLines: !0 }).code;
 }
-function M(u, o) {
-  const n = h(u, {
+function B(u, o) {
+  const n = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
@@ -104,7 +104,7 @@ function M(u, o) {
       const p = r.params, f = H(o, c, p);
       r.body = e.blockStatement([e.returnStatement(f)]), G(r, p);
     }
-  }), v(n, { retainLines: !0 }).code;
+  }), h(n, { retainLines: !0 }).code;
 }
 function H(u, o, n) {
   const i = `/_action/${u}/${o}`;
@@ -203,7 +203,7 @@ function G(u, o) {
   }
 }
 function z(u, o) {
-  const n = h(u, {
+  const n = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
@@ -227,10 +227,10 @@ function z(u, o) {
         )
       ]), a.id.typeAnnotation = null;
     }
-  }), v(n, { retainLines: !0 }).code;
+  }), h(n, { retainLines: !0 }).code;
 }
 function Y(u, o) {
-  const n = h(u, {
+  const n = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
@@ -254,10 +254,10 @@ function Y(u, o) {
         )
       ]), a.id.typeAnnotation = null;
     }
-  }), v(n, { retainLines: !0 }).code;
+  }), h(n, { retainLines: !0 }).code;
 }
 function X(u) {
-  const o = h(u, {
+  const o = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
@@ -268,14 +268,14 @@ function X(u) {
       const t = l.declarations[0];
       !t || !e.isIdentifier(t.id) || t.id.name === "loader" && i.remove();
     }
-  }), v(o, { retainLines: !0 }).code;
+  }), h(o, { retainLines: !0 }).code;
 }
 function q(u) {
-  const o = h(u, {
+  const o = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   }), n = /* @__PURE__ */ new Set();
-  S(o.program, n);
+  x(o.program, n);
   let i = !1;
   return m(o, {
     ImportDeclaration(t) {
@@ -284,10 +284,10 @@ function q(u) {
       const s = a.filter((c) => n.has(c.local.name));
       s.length !== a.length && (i = !0, s.length === 0 ? t.remove() : t.node.specifiers = s);
     }
-  }), i ? v(o, { retainLines: !0 }).code : u;
+  }), i ? h(o, { retainLines: !0 }).code : u;
 }
 function K(u) {
-  const o = h(u, {
+  const o = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   }), n = [];
@@ -298,9 +298,9 @@ function K(u) {
   }), n.length === 0) return u;
   const i = /* @__PURE__ */ new Set();
   for (const s of n)
-    S(s, i);
+    x(s, i);
   const l = /* @__PURE__ */ new Set();
-  S(o.program, l);
+  x(o.program, l);
   const t = /* @__PURE__ */ new Set();
   for (const s of i)
     l.has(s) || t.add(s);
@@ -309,9 +309,9 @@ function K(u) {
       const c = s.node.specifiers, r = c.filter((p) => !t.has(p.local.name));
       r.length === 0 ? s.remove() : r.length !== c.length && (s.node.specifiers = r);
     }
-  }), v(o, { retainLines: !0 }).code;
+  }), h(o, { retainLines: !0 }).code;
 }
-function S(u, o) {
+function x(u, o) {
   const n = (i) => {
     if (!(!i || typeof i != "object")) {
       if (Array.isArray(i)) {
@@ -354,7 +354,7 @@ function Z(u) {
   return null;
 }
 function ee(u) {
-  const o = h(u, {
+  const o = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   }), n = [], i = (c) => {
@@ -378,9 +378,9 @@ function ee(u) {
   }), n.length === 0) return u;
   const l = /* @__PURE__ */ new Set();
   for (const c of n)
-    S(c, l);
+    x(c, l);
   const t = /* @__PURE__ */ new Set();
-  S(o.program, t);
+  x(o.program, t);
   const a = /* @__PURE__ */ new Set();
   for (const c of l)
     t.has(c) || a.add(c);
@@ -389,10 +389,10 @@ function ee(u) {
       const r = c.node.specifiers, p = r.filter((f) => !a.has(f.local.name));
       p.length === 0 ? c.remove() : p.length !== r.length && (c.node.specifiers = p);
     }
-  }), v(o, { retainLines: !0 }).code;
+  }), h(o, { retainLines: !0 }).code;
 }
 function A(u) {
-  const o = h(u, {
+  const o = _(u, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   }), n = /* @__PURE__ */ new Map();
@@ -408,7 +408,7 @@ function A(u) {
     ExportDefaultDeclaration(t) {
       const a = t.node.declaration;
       let s = null;
-      e.isArrayExpression(a) ? s = a : (e.isTSSatisfiesExpression(a) || e.isTSAsExpression(a)) && e.isArrayExpression(a.expression) && (s = a.expression), s && D(s.elements, "", i);
+      e.isArrayExpression(a) ? s = a : (e.isTSSatisfiesExpression(a) || e.isTSAsExpression(a)) && e.isArrayExpression(a.expression) && (s = a.expression), s && C(s.elements, "", i);
     }
   });
   const l = /* @__PURE__ */ new Map();
@@ -421,7 +421,7 @@ function A(u) {
   }
   return l;
 }
-function D(u, o, n) {
+function C(u, o, n) {
   for (const i of u) {
     if (!e.isObjectExpression(i)) continue;
     let l = "", t = o, a = null, s = null;
@@ -437,10 +437,10 @@ function D(u, o, n) {
         path: l
       });
     }
-    s && D(s.elements, t, n);
+    s && C(s.elements, t, n);
   }
 }
-const E = "virtual:velo/server-entry", b = "virtual:velo/client-entry", P = "\0" + E, N = "\0" + b;
+const E = "virtual:velo/server-entry", b = "virtual:velo/client-entry", N = "\0" + E, P = "\0" + b;
 function te(u, o) {
   let n = d.resolve(process.cwd(), o);
   const i = u.routesFile ?? "routes.tsx", l = /* @__PURE__ */ new Map();
@@ -470,11 +470,11 @@ function te(u, o) {
       }
     },
     resolveId(t) {
-      return t === E || t.endsWith(E) ? P : t === b || t.endsWith(b) || t === "/__velo_client.js" ? N : null;
+      return t === E || t.endsWith(E) ? N : t === b || t.endsWith(b) || t === "/__velo_client.js" ? P : null;
     },
     load(t) {
       const a = u.routesFile ?? "routes.tsx", s = u.serverInit ?? "server.tsx", c = u.clientInit ?? "client.tsx", r = d.join(n, a).replace(/\.tsx?$/, ".js"), p = d.join(n, s).replace(/\.tsx?$/, ".js"), f = d.join(n, c).replace(/\.tsx?$/, ".js");
-      return t === P ? `
+      return t === N ? `
 globalThis.__veloBuildHash = __VELO_BUILD_HASH__;
 globalThis.__veloClientJs = __VELO_CLIENT_JS__;
 globalThis.__veloClientCss = __VELO_CLIENT_CSS__;
@@ -483,8 +483,8 @@ import routes from "${r}";
 import { startServer } from "@mauroandre/velojs/server";
 
 export { routes };
-export default await startServer({ routes, port: __VELO_CONFIG_PORT__ });
-` : t === N ? `
+export default await startServer({ routes, port: __VELO_CONFIG_PORT__, hostname: __VELO_CONFIG_HOSTNAME__ });
+` : t === P ? `
 import "${f}";
 import routes from "${r}";
 import { startClient } from "@mauroandre/velojs/client";
@@ -498,18 +498,18 @@ startClient({ routes });
       let r = t, p = !1;
       const f = /middlewares:\s*\[/.test(t), y = /export\s+(const|function)\s+Component/.test(
         t
-      ), _ = /export\s+(const|function)\s+loader/.test(t), C = /export\s+const\s+action_\w+/.test(t), I = /export\s+const\s+stream_\w+/.test(t), T = /export\s+const\s+socket_\w+/.test(t), w = /\bLoader\s*</.test(t) || /\bLoader\s*\(/.test(t), k = /\buseLoader\s*</.test(t) || /\buseLoader\s*\(/.test(t), F = /\bhandler\s*:/.test(t), V = d.join(n, i);
-      if (!c && f && (r = K(r), p = !0), !c && F && a === V && (r = ee(r), p = !0), y || _ || C || I || T || w || k) {
-        const x = d.relative(n, a).replace(/\.(tsx?|jsx?)$/, "").replace(/\\/g, "/"), O = l.get(x);
-        r = J(r, x, O?.fullPath, O?.path), r = B(r, x), c || (r = M(
+      ), v = /export\s+(const|function)\s+loader/.test(t), D = /export\s+const\s+action_\w+/.test(t), I = /export\s+const\s+stream_\w+/.test(t), T = /export\s+const\s+socket_\w+/.test(t), w = /\bLoader\s*</.test(t) || /\bLoader\s*\(/.test(t), F = /\buseLoader\s*</.test(t) || /\buseLoader\s*\(/.test(t), k = /\bhandler\s*:/.test(t), V = d.join(n, i);
+      if (!c && f && (r = K(r), p = !0), !c && k && a === V && (r = ee(r), p = !0), y || v || D || I || T || w || F) {
+        const S = d.relative(n, a).replace(/\.(tsx?|jsx?)$/, "").replace(/\\/g, "/"), O = l.get(S);
+        r = W(r, S, O?.fullPath, O?.path), r = M(r, S), c || (r = B(
           r,
-          x
+          S
         )), !c && I && (r = z(
           r,
-          x
+          S
         )), !c && T && (r = Y(
           r,
-          x
+          S
         )), c || (r = X(r)), c || (r = q(r)), p = !0;
       }
       return p ? {
@@ -541,7 +541,9 @@ function re(u) {
           __VELO_CLIENT_CSS__: JSON.stringify(c),
           // Baked into the server bundle as startServer's port fallback.
           // null when unset → startServer falls back to PORT env / 3000.
-          __VELO_CONFIG_PORT__: JSON.stringify(u.port ?? null)
+          __VELO_CONFIG_PORT__: JSON.stringify(u.port ?? null),
+          // Same for the bind interface: null → HOST env / Node default.
+          __VELO_CONFIG_HOSTNAME__: JSON.stringify(u.hostname ?? null)
         },
         resolve: {
           alias: {
@@ -599,7 +601,7 @@ function ie(u, o) {
     if (!n) return;
     const s = d.resolve(n, o);
     if (!g.existsSync(s)) return;
-    const c = W(s), r = d.join(n, ".velojs");
+    const c = U(s), r = d.join(n, ".velojs");
     g.mkdirSync(r, { recursive: !0 }), g.writeFileSync(
       d.join(r, "graph.json"),
       JSON.stringify(c)
@@ -624,7 +626,7 @@ function ie(u, o) {
 }
 function se(u) {
   return [
-    ...U.exclude,
+    ...J.exclude,
     /.*\.mjs$/,
     ...u.devServerExclude ?? []
   ];
@@ -654,15 +656,15 @@ function oe() {
 }
 export {
   A as buildFullPathMap,
-  D as collectFullPaths,
+  C as collectFullPaths,
   se as devServerExcludeFor,
-  J as injectMetadata,
+  W as injectMetadata,
   q as pruneClientOnlyImports,
   ee as removeEndpointRoutes,
   X as removeLoaders,
   K as removeMiddlewares,
-  M as transformActionsForClient,
-  B as transformLoaderFunctions,
+  B as transformActionsForClient,
+  M as transformLoaderFunctions,
   Y as transformSocketsForClient,
   z as transformStreamsForClient,
   ye as veloPlugin

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mauroandre/velojs",
-    "version": "0.0.50",
+    "version": "0.0.51",
     "type": "module",
     "description": "Fullstack web framework built on Hono + Preact with Vite-powered AST transforms",
     "keywords": [