@mauroandre/velojs 0.0.54 → 0.0.55

package/README.md

@@ -159,6 +159,8 @@ export const Component = () => {
 npm run dev     # http://localhost:3000
 ```
 
+To expose the dev server beyond loopback — a VPS behind a reverse proxy, an app reached by hostname — set `HOST=0.0.0.0`, in the shell or in the project's `.env`; no `--host` flag by hand. The security trade-off: a broad bind in dev (`0.0.0.0`, `::`, or `--host` with no value) turns Vite's Host check off, so a request whose `Host` header carries that domain is served instead of 403'd — the DNS-rebinding protection you get on loopback is consciously given up. Stay on localhost unless you are behind a proxy; a `server.allowedHosts` declared in `vite.config.ts` still pins the allowed list.
+
 ### Configuration
 
 ```typescript
@@ -167,6 +169,7 @@ veloPlugin({
     routesFile: "routes.tsx",   // default
     serverInit: "server.tsx",   // default
     clientInit: "client.tsx",   // default
+    hostname: "127.0.0.1",      // bind interface, dev and production (the HOST env wins)
 });
 ```
 
@@ -1272,6 +1275,7 @@ Callbacks queue until the server starts. If called after startup, executes immed
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `PORT` | `3000` | Server port. Overrides the `port` set in `defineConfig` |
+| `HOST` | — | Bind interface, in dev and production. Overrides `defineConfig`'s `hostname`; in dev an explicit `--host`/`server.host` still wins |
 | `NODE_ENV` | — | Set automatically by `velojs start`. Enables static file serving |
 | `STATIC_BASE_URL` | `""` | CDN/bucket prefix for static assets |
 
@@ -1475,6 +1479,8 @@ interface VeloConfig {
     routesFile?: string;     // default: "routes.tsx"
     serverInit?: string;     // default: "server.tsx"
     clientInit?: string;     // default: "client.tsx"
+    port?: number;           // default: 3000; the PORT env wins
+    hostname?: string;       // bind interface, dev and production; the HOST env wins
 }
 ```
 

package/agent/skills/velojs-getting-started/SKILL.md

@@ -175,6 +175,8 @@ npm run dev
 
 Open `http://localhost:3000` in your browser. Changes to your code will hot-reload instantly.
 
+The dev server binds loopback by default. To expose it beyond that — a VPS behind a reverse proxy, an app reached by a real hostname — set `HOST=0.0.0.0`, in the shell or in the project's `.env`; no `--host` flag by hand. A broad bind in dev (`0.0.0.0`, `::`, or `--host` with no value) also turns Vite's Host check off, so a request whose `Host` header carries that domain is served instead of 403'd — the DNS-rebinding protection you get on loopback is consciously traded away. A `server.allowedHosts` declared in `vite.config.ts` still pins the allowed list.
+
 ## Configuration
 
 The `veloPlugin()` accepts optional configuration:

package/agent/skills/velojs-production-deploy/SKILL.md

@@ -79,6 +79,12 @@ By default `velojs start` binds to **all interfaces** (`::`) — the norm for No
 2. The `hostname` field in `defineConfig`.
 3. The Node default (all interfaces).
 
+The same declaration covers the dev server, with one extra step at the top: `velojs dev --host <value>` (or a `server.host` in `vite.config.ts`) wins, then `HOST`, then `hostname`, then Vite's default (loopback). `HOST=0.0.0.0` in the shell or in the project's `.env` therefore lifts `velojs dev` beyond loopback with no flag by hand.
+
+### Dev behind a reverse proxy: the Host check
+
+When a dev server binds broad it sits behind the proxy (or is reached by hostname), and requests arrive carrying the proxy's domain in the `Host` header. Vite's DNS-rebinding protection answers `403 Blocked request. This host is not allowed.` for any host outside its allow list — so the framework opens it whenever the declared bind is broad (`0.0.0.0`, `::`, or `--host` with no value): any `Host` is served. That is a conscious trade-off — the guard exists for loopback development, and leaving loopback means giving it up. If the project declared `server.allowedHosts`, that list wins and stays restrictive even on a broad bind.
+
 ### Secure bind for local/sensitive apps
 
 If your app is **local and single-user** — a cockpit with a terminal, file access, real user data — it must listen on loopback only. An all-interfaces bind exposes that surface to the whole network without any error: the developer finds out by scanning, not by the app telling them.

package/agent/skills/velojs-server-api/SKILL.md

@@ -151,5 +151,6 @@ Callbacks registered with `onServer` queue until the server starts. If called af
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `PORT` | `3000` | The port the server listens on. Overrides `defineConfig`'s `port`. |
+| `HOST` | — | The bind interface, in dev and production. Overrides `defineConfig`'s `hostname`; in dev an explicit `--host`/`server.host` still wins. |
 | `NODE_ENV` | — | Set automatically by `velojs start` to `production` |
 | `STATIC_BASE_URL` | `""` | CDN/bucket prefix for static assets |

package/agent/skills/velojs-type-reference/SKILL.md

@@ -138,5 +138,6 @@ interface VeloConfig {
     serverInit?: string;     // default: "server.tsx"
     clientInit?: string;     // default: "client.tsx"
     port?: number;           // default: 3000 (the PORT env always wins)
+    hostname?: string;       // bind interface, dev and production; the HOST env wins
 }
 ```

package/dist/config.d.ts

@@ -26,9 +26,11 @@ export interface VeloConfig {
      */
     port?: number;
     /**
-     * Interface de bind do servidor de produção. A env `HOST` tem precedência.
-     * Default do Node: todas as interfaces (o que Docker/cloud esperam).
-     * Apps locais/sensíveis devem declarar "127.0.0.1".
+     * Interface de bind do servidor, em dev e em produção. A env `HOST` tem
+     * precedência nos dois modos; em dev a ordem é: `server.host` do Vite
+     * (`--host`/vite.config) > env `HOST` > este campo. Default do Node:
+     * todas as interfaces (o que Docker/cloud esperam). Apps
+     * locais/sensíveis devem declarar "127.0.0.1".
      */
     hostname?: string;
     /**

package/dist/vite.d.ts

@@ -1,4 +1,4 @@
-import type { PluginOption } from "vite";
+import { type PluginOption } from "vite";
 import type { VeloConfig } from "./config.js";
 import * as t from "@babel/types";
 export declare function injectMetadata(code: string, moduleId: string, fullPath?: string, path?: string): string;

package/dist/vite.js

@@ -1,60 +1,61 @@
+import { loadEnv as R } from "vite";
 import d from "node:path";
-import g from "node:fs";
-import R from "@preact/preset-vite";
-import $, { defaultOptions as J } from "@hono/vite-dev-server";
-import { parse as _ } from "@babel/parser";
-import j from "@babel/traverse";
-import L from "@babel/generator";
+import S from "node:fs";
+import $ from "@preact/preset-vite";
+import H, { defaultOptions as J } from "@hono/vite-dev-server";
+import { parse as v } from "@babel/parser";
+import A from "@babel/traverse";
+import N from "@babel/generator";
 import * as e from "@babel/types";
 import { buildGraph as U } from "./graph.js";
-const m = typeof j == "function" ? j : j.default, h = typeof L == "function" ? L : L.default;
-function W(u, o, n, i) {
-  const l = _(u, {
+const m = typeof A == "function" ? A : A.default, _ = typeof N == "function" ? N : N.default;
+function W(p, s, r, i) {
+  const l = v(p, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
   let t = !1;
   if (m(l, {
     // Procura: export const metadata = { ... }
-    ExportNamedDeclaration(s) {
-      const c = s.node.declaration;
+    ExportNamedDeclaration(o) {
+      const c = o.node.declaration;
       if (e.isVariableDeclaration(c) && c.declarations.length === 1) {
-        const r = c.declarations[0];
-        if (r && e.isIdentifier(r.id, { name: "metadata" }) && e.isObjectExpression(r.init)) {
+        const n = c.declarations[0];
+        if (n && e.isIdentifier(n.id, { name: "metadata" }) && e.isObjectExpression(n.init)) {
           t = !0;
-          const f = r.init.properties.filter((v) => e.isObjectProperty(v) && e.isIdentifier(v.key) ? v.key.name !== "moduleId" && v.key.name !== "fullPath" && v.key.name !== "path" : !0), y = [
+          const f = n.init.properties.filter((y) => e.isObjectProperty(y) && e.isIdentifier(y.key) ? y.key.name !== "moduleId" && y.key.name !== "fullPath" && y.key.name !== "path" : !0), h = [
             e.objectProperty(
               e.identifier("moduleId"),
-              e.stringLiteral(o)
+              e.stringLiteral(s)
             )
           ];
-          n !== void 0 && y.push(
+          r !== void 0 && h.push(
             e.objectProperty(
               e.identifier("fullPath"),
-              e.stringLiteral(n)
+              e.stringLiteral(r)
             )
-          ), i !== void 0 && y.push(
+          ), i !== void 0 && h.push(
             e.objectProperty(
               e.identifier("path"),
               e.stringLiteral(i)
             )
-          ), r.init.properties = [...y, ...f];
+          ), n.init.properties = [...h, ...f];
         }
       }
     }
   }), !t) {
-    const s = [
+    const o = [
       e.objectProperty(
         e.identifier("moduleId"),
-        e.stringLiteral(o)
+        e.stringLiteral(s)
       )
     ];
-    n !== void 0 && s.push(
+    r !== void 0 && o.push(
       e.objectProperty(
         e.identifier("fullPath"),
-        e.stringLiteral(n)
+        e.stringLiteral(r)
       )
-    ), i !== void 0 && s.push(
+    ), i !== void 0 && o.push(
       e.objectProperty(
         e.identifier("path"),
         e.stringLiteral(i)
@@ -64,51 +65,51 @@ function W(u, o, n, i) {
       e.variableDeclaration("const", [
         e.variableDeclarator(
           e.identifier("metadata"),
-          e.objectExpression(s)
+          e.objectExpression(o)
         )
       ])
     );
     l.program.body.unshift(c);
   }
-  return h(l, { retainLines: !0 }).code;
+  return _(l, { retainLines: !0 }).code;
 }
-function M(u, o) {
-  const n = _(u, {
+function B(p, s) {
+  const r = v(p, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
-  return m(n, {
+  return m(r, {
     CallExpression(l) {
-      const t = l.node.callee, a = e.isIdentifier(t, { name: "Loader" }) || e.isTSInstantiationExpression(t) && e.isIdentifier(t.expression, { name: "Loader" }), s = e.isIdentifier(t, { name: "useLoader" }) || e.isTSInstantiationExpression(t) && e.isIdentifier(t.expression, { name: "useLoader" });
-      if (!a && !s) return;
-      const c = l.node.arguments, r = e.stringLiteral(o), p = c[0];
-      e.isStringLiteral(p) && p.value.includes("/") || (l.node.arguments = [r, ...c]);
+      const t = l.node.callee, a = e.isIdentifier(t, { name: "Loader" }) || e.isTSInstantiationExpression(t) && e.isIdentifier(t.expression, { name: "Loader" }), o = e.isIdentifier(t, { name: "useLoader" }) || e.isTSInstantiationExpression(t) && e.isIdentifier(t.expression, { name: "useLoader" });
+      if (!a && !o) return;
+      const c = l.node.arguments, n = e.stringLiteral(s), u = c[0];
+      e.isStringLiteral(u) && u.value.includes("/") || (l.node.arguments = [n, ...c]);
     }
-  }), h(n, { retainLines: !0 }).code;
+  }), _(r, { retainLines: !0 }).code;
 }
-function B(u, o) {
-  const n = _(u, {
+function M(p, s) {
+  const r = v(p, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
-  return m(n, {
+  return m(r, {
     ExportNamedDeclaration(l) {
       const t = l.node.declaration;
       if (!e.isVariableDeclaration(t)) return;
       const a = t.declarations[0];
       if (!a || !e.isIdentifier(a.id)) return;
-      const s = a.id.name;
-      if (!s.startsWith("action_")) return;
-      const c = s.replace("action_", ""), r = a.init;
-      if (!e.isArrowFunctionExpression(r) || !r.async) return;
-      const p = r.params, f = H(o, c, p);
-      r.body = e.blockStatement([e.returnStatement(f)]), G(r, p);
+      const o = a.id.name;
+      if (!o.startsWith("action_")) return;
+      const c = o.replace("action_", ""), n = a.init;
+      if (!e.isArrowFunctionExpression(n) || !n.async) return;
+      const u = n.params, f = G(s, c, u);
+      n.body = e.blockStatement([e.returnStatement(f)]), z(n, u);
     }
-  }), h(n, { retainLines: !0 }).code;
+  }), _(r, { retainLines: !0 }).code;
 }
-function H(u, o, n) {
-  const i = `/_action/${u}/${o}`;
-  return n.length === 0 ? e.callExpression(
+function G(p, s, r) {
+  const i = `/_action/${p}/${s}`;
+  return r.length === 0 ? e.callExpression(
     e.memberExpression(
       e.callExpression(e.identifier("fetch"), [
         e.stringLiteral(i),
@@ -176,13 +177,13 @@ function H(u, o, n) {
     ]
   );
 }
-function G(u, o) {
-  if (o.length === 0) return;
-  const n = o[0];
-  if (e.isObjectPattern(n)) {
+function z(p, s) {
+  if (s.length === 0) return;
+  const r = s[0];
+  if (e.isObjectPattern(r)) {
     let i = null;
-    if (e.isTSTypeAnnotation(n.typeAnnotation) && e.isTSTypeReference(n.typeAnnotation.typeAnnotation)) {
-      const a = n.typeAnnotation.typeAnnotation;
+    if (e.isTSTypeAnnotation(r.typeAnnotation) && e.isTSTypeReference(r.typeAnnotation.typeAnnotation)) {
+      const a = r.typeAnnotation.typeAnnotation;
       e.isIdentifier(a.typeName, { name: "ActionArgs" }) && a.typeParameters?.params[0] && (i = a.typeParameters.params[0]);
     }
     const l = e.objectProperty(
@@ -199,23 +200,23 @@ function G(u, o) {
           e.tsTypeAnnotation(i)
         )
       ])
-    )), u.params = [t];
+    )), p.params = [t];
   }
 }
-function z(u, o) {
-  const n = _(u, {
+function Y(p, s) {
+  const r = v(p, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
-  return m(n, {
+  return m(r, {
     ExportNamedDeclaration(l) {
       const t = l.node.declaration;
       if (!e.isVariableDeclaration(t)) return;
       const a = t.declarations[0];
       if (!a || !e.isIdentifier(a.id)) return;
-      const s = a.id.name;
-      if (!s.startsWith("stream_")) return;
-      const c = s.replace("stream_", ""), r = `/_event/${o}/${c}`;
+      const o = a.id.name;
+      if (!o.startsWith("stream_")) return;
+      const c = o.replace("stream_", ""), n = `/_event/${s}/${c}`;
       a.init = e.objectExpression([
         e.objectProperty(
           e.identifier("__isVeloEventStream"),
@@ -223,26 +224,26 @@ function z(u, o) {
         ),
         e.objectProperty(
           e.identifier("__path"),
-          e.stringLiteral(r)
+          e.stringLiteral(n)
         )
       ]), a.id.typeAnnotation = null;
     }
-  }), h(n, { retainLines: !0 }).code;
+  }), _(r, { retainLines: !0 }).code;
 }
-function Y(u, o) {
-  const n = _(u, {
+function X(p, s) {
+  const r = v(p, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
-  return m(n, {
+  return m(r, {
     ExportNamedDeclaration(l) {
       const t = l.node.declaration;
       if (!e.isVariableDeclaration(t)) return;
       const a = t.declarations[0];
       if (!a || !e.isIdentifier(a.id)) return;
-      const s = a.id.name;
-      if (!s.startsWith("socket_")) return;
-      const c = s.replace("socket_", ""), r = `/_socket/${o}/${c}`;
+      const o = a.id.name;
+      if (!o.startsWith("socket_")) return;
+      const c = o.replace("socket_", ""), n = `/_socket/${s}/${c}`;
       a.init = e.objectExpression([
         e.objectProperty(
           e.identifier("__isVeloSocket"),
@@ -250,300 +251,303 @@ function Y(u, o) {
         ),
         e.objectProperty(
           e.identifier("__path"),
-          e.stringLiteral(r)
+          e.stringLiteral(n)
         )
       ]), a.id.typeAnnotation = null;
     }
-  }), h(n, { retainLines: !0 }).code;
+  }), _(r, { retainLines: !0 }).code;
 }
-function X(u) {
-  const o = _(u, {
+function q(p) {
+  const s = v(p, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
   });
-  return m(o, {
+  return m(s, {
     ExportNamedDeclaration(i) {
       const l = i.node.declaration;
       if (!e.isVariableDeclaration(l)) return;
       const t = l.declarations[0];
       !t || !e.isIdentifier(t.id) || t.id.name === "loader" && i.remove();
     }
-  }), h(o, { retainLines: !0 }).code;
+  }), _(s, { retainLines: !0 }).code;
 }
-function q(u) {
-  const o = _(u, {
+function K(p) {
+  const s = v(p, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
-  }), n = /* @__PURE__ */ new Set();
-  x(o.program, n);
+  }), r = /* @__PURE__ */ new Set();
+  I(s.program, r);
   let i = !1;
-  return m(o, {
+  return m(s, {
     ImportDeclaration(t) {
       const a = t.node.specifiers;
       if (a.length === 0) return;
-      const s = a.filter((c) => n.has(c.local.name));
-      s.length !== a.length && (i = !0, s.length === 0 ? t.remove() : t.node.specifiers = s);
+      const o = a.filter((c) => r.has(c.local.name));
+      o.length !== a.length && (i = !0, o.length === 0 ? t.remove() : t.node.specifiers = o);
     }
-  }), i ? h(o, { retainLines: !0 }).code : u;
+  }), i ? _(s, { retainLines: !0 }).code : p;
 }
-function K(u) {
-  const o = _(u, {
+function Q(p) {
+  const s = v(p, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
-  }), n = [];
-  if (m(o, {
-    ObjectProperty(s) {
-      e.isIdentifier(s.node.key, { name: "middlewares" }) && (n.push(s.node.value), s.remove());
+  }), r = [];
+  if (m(s, {
+    ObjectProperty(o) {
+      e.isIdentifier(o.node.key, { name: "middlewares" }) && (r.push(o.node.value), o.remove());
     }
-  }), n.length === 0) return u;
+  }), r.length === 0) return p;
   const i = /* @__PURE__ */ new Set();
-  for (const s of n)
-    x(s, i);
+  for (const o of r)
+    I(o, i);
   const l = /* @__PURE__ */ new Set();
-  x(o.program, l);
+  I(s.program, l);
   const t = /* @__PURE__ */ new Set();
-  for (const s of i)
-    l.has(s) || t.add(s);
-  return t.size > 0 && m(o, {
-    ImportDeclaration(s) {
-      const c = s.node.specifiers, r = c.filter((p) => !t.has(p.local.name));
-      r.length === 0 ? s.remove() : r.length !== c.length && (s.node.specifiers = r);
+  for (const o of i)
+    l.has(o) || t.add(o);
+  return t.size > 0 && m(s, {
+    ImportDeclaration(o) {
+      const c = o.node.specifiers, n = c.filter((u) => !t.has(u.local.name));
+      n.length === 0 ? o.remove() : n.length !== c.length && (o.node.specifiers = n);
     }
-  }), h(o, { retainLines: !0 }).code;
+  }), _(s, { retainLines: !0 }).code;
 }
-function x(u, o) {
-  const n = (i) => {
+function I(p, s) {
+  const r = (i) => {
     if (!(!i || typeof i != "object")) {
       if (Array.isArray(i)) {
-        for (const l of i) n(l);
+        for (const l of i) r(l);
         return;
       }
       if (i.type === "Identifier") {
-        o.add(i.name), i.typeAnnotation && n(i.typeAnnotation);
+        s.add(i.name), i.typeAnnotation && r(i.typeAnnotation);
         return;
       }
       if (i.type === "JSXIdentifier") {
-        o.add(i.name);
+        s.add(i.name);
         return;
       }
       if (i.type === "MemberExpression") {
-        n(i.object), i.computed && n(i.property);
+        r(i.object), i.computed && r(i.property);
         return;
       }
       if ((i.type === "ObjectProperty" || i.type === "ObjectMethod") && !i.computed) {
-        i.type === "ObjectProperty" ? n(i.value) : n(i.body);
+        i.type === "ObjectProperty" ? r(i.value) : r(i.body);
         return;
       }
       if (!(i.type === "ImportSpecifier" || i.type === "ImportDefaultSpecifier" || i.type === "ImportNamespaceSpecifier"))
         for (const l of Object.keys(i))
-          l === "loc" || l === "start" || l === "end" || l === "leadingComments" || l === "trailingComments" || l === "innerComments" || n(i[l]);
+          l === "loc" || l === "start" || l === "end" || l === "leadingComments" || l === "trailingComments" || l === "innerComments" || r(i[l]);
     }
   };
-  n(u);
+  r(p);
 }
-function Q(u) {
-  for (const o of u.properties)
-    if (e.isObjectProperty(o) && e.isIdentifier(o.key) && o.key.name === "handler")
+function Z(p) {
+  for (const s of p.properties)
+    if (e.isObjectProperty(s) && e.isIdentifier(s.key) && s.key.name === "handler")
       return !0;
   return !1;
 }
-function Z(u) {
-  for (const o of u.properties)
-    if (e.isObjectProperty(o) && e.isIdentifier(o.key) && o.key.name === "children" && e.isArrayExpression(o.value))
-      return o.value;
+function ee(p) {
+  for (const s of p.properties)
+    if (e.isObjectProperty(s) && e.isIdentifier(s.key) && s.key.name === "children" && e.isArrayExpression(s.value))
+      return s.value;
   return null;
 }
-function ee(u) {
-  const o = _(u, {
+function te(p) {
+  const s = v(p, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
-  }), n = [], i = (c) => {
-    for (let r = c.elements.length - 1; r >= 0; r--) {
-      const p = c.elements[r];
-      if (!e.isObjectExpression(p)) continue;
-      if (Q(p)) {
-        n.push(p), c.elements.splice(r, 1);
+  }), r = [], i = (c) => {
+    for (let n = c.elements.length - 1; n >= 0; n--) {
+      const u = c.elements[n];
+      if (!e.isObjectExpression(u)) continue;
+      if (Z(u)) {
+        r.push(u), c.elements.splice(n, 1);
         continue;
       }
-      const f = Z(p);
+      const f = ee(u);
       f && i(f);
     }
   };
-  if (m(o, {
+  if (m(s, {
     ExportDefaultDeclaration(c) {
-      const r = c.node.declaration;
-      let p = null;
-      e.isArrayExpression(r) ? p = r : (e.isTSSatisfiesExpression(r) && e.isArrayExpression(r.expression) || e.isTSAsExpression(r) && e.isArrayExpression(r.expression)) && (p = r.expression), p && i(p);
+      const n = c.node.declaration;
+      let u = null;
+      e.isArrayExpression(n) ? u = n : (e.isTSSatisfiesExpression(n) && e.isArrayExpression(n.expression) || e.isTSAsExpression(n) && e.isArrayExpression(n.expression)) && (u = n.expression), u && i(u);
     }
-  }), n.length === 0) return u;
+  }), r.length === 0) return p;
   const l = /* @__PURE__ */ new Set();
-  for (const c of n)
-    x(c, l);
+  for (const c of r)
+    I(c, l);
   const t = /* @__PURE__ */ new Set();
-  x(o.program, t);
+  I(s.program, t);
   const a = /* @__PURE__ */ new Set();
   for (const c of l)
     t.has(c) || a.add(c);
-  return a.size > 0 && m(o, {
+  return a.size > 0 && m(s, {
     ImportDeclaration(c) {
-      const r = c.node.specifiers, p = r.filter((f) => !a.has(f.local.name));
-      p.length === 0 ? c.remove() : p.length !== r.length && (c.node.specifiers = p);
+      const n = c.node.specifiers, u = n.filter((f) => !a.has(f.local.name));
+      u.length === 0 ? c.remove() : u.length !== n.length && (c.node.specifiers = u);
     }
-  }), h(o, { retainLines: !0 }).code;
+  }), _(s, { retainLines: !0 }).code;
 }
-function A(u) {
-  const o = _(u, {
+function w(p) {
+  const s = v(p, {
     sourceType: "module",
     plugins: ["typescript", "jsx"]
-  }), n = /* @__PURE__ */ new Map();
-  m(o, {
+  }), r = /* @__PURE__ */ new Map();
+  m(s, {
     ImportDeclaration(t) {
       const a = t.node.source.value;
-      for (const s of t.node.specifiers)
-        e.isImportNamespaceSpecifier(s) && n.set(s.local.name, a);
+      for (const o of t.node.specifiers)
+        e.isImportNamespaceSpecifier(o) && r.set(o.local.name, a);
     }
   });
   const i = /* @__PURE__ */ new Map();
-  m(o, {
+  m(s, {
     ExportDefaultDeclaration(t) {
       const a = t.node.declaration;
-      let s = null;
-      e.isArrayExpression(a) ? s = a : (e.isTSSatisfiesExpression(a) || e.isTSAsExpression(a)) && e.isArrayExpression(a.expression) && (s = a.expression), s && C(s.elements, "", i);
+      let o = null;
+      e.isArrayExpression(a) ? o = a : (e.isTSSatisfiesExpression(a) || e.isTSAsExpression(a)) && e.isArrayExpression(a.expression) && (o = a.expression), o && k(o.elements, "", i);
     }
   });
   const l = /* @__PURE__ */ new Map();
   for (const [t, a] of i) {
-    const s = n.get(t);
-    if (s) {
-      const c = s.replace(/^\.\//, "").replace(/\.(tsx?|jsx?|js)$/, "");
+    const o = r.get(t);
+    if (o) {
+      const c = o.replace(/^\.\//, "").replace(/\.(tsx?|jsx?|js)$/, "");
       l.set(c, a);
     }
   }
   return l;
 }
-function C(u, o, n) {
-  for (const i of u) {
+function k(p, s, r) {
+  for (const i of p) {
     if (!e.isObjectExpression(i)) continue;
-    let l = "", t = o, a = null, s = null;
+    let l = "", t = s, a = null, o = null;
     for (const c of i.properties) {
       if (!e.isObjectProperty(c)) continue;
-      const r = c.key, p = e.isIdentifier(r) ? r.name : null;
-      p === "path" && e.isStringLiteral(c.value) && (l = c.value.value, l && !l.startsWith("/") ? t = o + "/" + l : t = o + l), p === "module" && e.isIdentifier(c.value) && (a = c.value.name), p === "children" && e.isArrayExpression(c.value) && (s = c.value);
+      const n = c.key, u = e.isIdentifier(n) ? n.name : null;
+      u === "path" && e.isStringLiteral(c.value) && (l = c.value.value, l && !l.startsWith("/") ? t = s + "/" + l : t = s + l), u === "module" && e.isIdentifier(c.value) && (a = c.value.name), u === "children" && e.isArrayExpression(c.value) && (o = c.value);
     }
     if (a) {
-      const r = !s && l === "/" ? o || "/" : t;
-      n.set(a, {
-        fullPath: r,
+      const n = !o && l === "/" ? s || "/" : t;
+      r.set(a, {
+        fullPath: n,
         path: l
       });
     }
-    s && C(s.elements, t, n);
+    o && k(o.elements, t, r);
   }
 }
-const E = "virtual:velo/server-entry", b = "virtual:velo/client-entry", N = "\0" + E, P = "\0" + b;
-function te(u, o) {
-  let n = d.resolve(process.cwd(), o);
-  const i = u.routesFile ?? "routes.tsx", l = /* @__PURE__ */ new Map();
+const T = "virtual:velo/server-entry", O = "virtual:velo/client-entry", C = "\0" + T, F = "\0" + O;
+function re(p, s) {
+  let r = d.resolve(process.cwd(), s);
+  const i = p.routesFile ?? "routes.tsx", l = /* @__PURE__ */ new Map();
   return {
     name: "velo:transform",
     enforce: "pre",
     configResolved(t) {
-      n = d.resolve(t.root, o);
+      r = d.resolve(t.root, s);
     },
     buildStart() {
-      const t = d.join(n, i);
-      if (g.existsSync(t)) {
-        const a = g.readFileSync(t, "utf-8"), s = A(a);
+      const t = d.join(r, i);
+      if (S.existsSync(t)) {
+        const a = S.readFileSync(t, "utf-8"), o = w(a);
         l.clear();
-        for (const [c, r] of s)
-          l.set(c, r);
+        for (const [c, n] of o)
+          l.set(c, n);
       }
     },
     handleHotUpdate({ file: t, server: a }) {
-      const s = d.join(n, i);
-      if (t === s) {
-        const c = g.readFileSync(s, "utf-8"), r = A(c);
+      const o = d.join(r, i);
+      if (t === o) {
+        const c = S.readFileSync(o, "utf-8"), n = w(c);
         l.clear();
-        for (const [p, f] of r)
-          l.set(p, f);
+        for (const [u, f] of n)
+          l.set(u, f);
         return a.ws.send({ type: "full-reload" }), [];
       }
     },
     resolveId(t) {
-      return t === E || t.endsWith(E) ? N : t === b || t.endsWith(b) || t === "/__velo_client.js" ? P : null;
+      return t === T || t.endsWith(T) ? C : t === O || t.endsWith(O) || t === "/__velo_client.js" ? F : null;
     },
     load(t) {
-      const a = u.routesFile ?? "routes.tsx", s = u.serverInit ?? "server.tsx", c = u.clientInit ?? "client.tsx", r = d.join(n, a).replace(/\.tsx?$/, ".js"), p = d.join(n, s).replace(/\.tsx?$/, ".js"), f = d.join(n, c).replace(/\.tsx?$/, ".js");
-      return t === N ? `
+      const a = p.routesFile ?? "routes.tsx", o = p.serverInit ?? "server.tsx", c = p.clientInit ?? "client.tsx", n = d.join(r, a).replace(/\.tsx?$/, ".js"), u = d.join(r, o).replace(/\.tsx?$/, ".js"), f = d.join(r, c).replace(/\.tsx?$/, ".js");
+      return t === C ? `
 globalThis.__veloBuildHash = __VELO_BUILD_HASH__;
 globalThis.__veloClientJs = __VELO_CLIENT_JS__;
 globalThis.__veloClientCss = __VELO_CLIENT_CSS__;
-import "${p}";
-import routes from "${r}";
+import "${u}";
+import routes from "${n}";
 import { startServer } from "@mauroandre/velojs/server";
 
 export { routes };
 export default await startServer({ routes, port: __VELO_CONFIG_PORT__, hostname: __VELO_CONFIG_HOSTNAME__ });
-` : t === P ? `
+` : t === F ? `
 import "${f}";
-import routes from "${r}";
+import routes from "${n}";
 import { startClient } from "@mauroandre/velojs/client";
 
 startClient({ routes });
 ` : null;
     },
-    transform(t, a, s) {
-      const c = s?.ssr === !0;
-      if (a.startsWith("\0") || a.includes("/.velojs/") || !a.endsWith(".tsx") && !a.endsWith(".ts") || !a.startsWith(n)) return null;
-      let r = t, p = !1;
-      const f = /middlewares:\s*\[/.test(t), y = /export\s+(const|function)\s+Component/.test(
+    transform(t, a, o) {
+      const c = o?.ssr === !0;
+      if (a.startsWith("\0") || a.includes("/.velojs/") || !a.endsWith(".tsx") && !a.endsWith(".ts") || !a.startsWith(r)) return null;
+      let n = t, u = !1;
+      const f = /middlewares:\s*\[/.test(t), h = /export\s+(const|function)\s+Component/.test(
         t
-      ), v = /export\s+(const|function)\s+loader/.test(t), D = /export\s+const\s+action_\w+/.test(t), I = /export\s+const\s+stream_\w+/.test(t), T = /export\s+const\s+socket_\w+/.test(t), w = /\bLoader\s*</.test(t) || /\bLoader\s*\(/.test(t), F = /\buseLoader\s*</.test(t) || /\buseLoader\s*\(/.test(t), k = /\bhandler\s*:/.test(t), V = d.join(n, i);
-      if (!c && f && (r = K(r), p = !0), !c && k && a === V && (r = ee(r), p = !0), y || v || D || I || T || w || F) {
-        const S = d.relative(n, a).replace(/\.(tsx?|jsx?)$/, "").replace(/\\/g, "/"), O = l.get(S);
-        r = W(r, S, O?.fullPath, O?.path), r = M(r, S), c || (r = B(
-          r,
-          S
-        )), !c && I && (r = z(
-          r,
-          S
-        )), !c && T && (r = Y(
-          r,
-          S
-        )), c || (r = X(r)), c || (r = q(r)), p = !0;
+      ), y = /export\s+(const|function)\s+loader/.test(t), b = /export\s+const\s+action_\w+/.test(t), j = /export\s+const\s+stream_\w+/.test(t), x = /export\s+const\s+socket_\w+/.test(t), L = /\bLoader\s*</.test(t) || /\bLoader\s*\(/.test(t), P = /\buseLoader\s*</.test(t) || /\buseLoader\s*\(/.test(t), E = /\bhandler\s*:/.test(t), V = d.join(r, i);
+      if (!c && f && (n = Q(n), u = !0), !c && E && a === V && (n = te(n), u = !0), h || y || b || j || x || L || P) {
+        const g = d.relative(r, a).replace(/\.(tsx?|jsx?)$/, "").replace(/\\/g, "/"), D = l.get(g);
+        n = W(n, g, D?.fullPath, D?.path), n = B(n, g), c || (n = M(
+          n,
+          g
+        )), !c && j && (n = Y(
+          n,
+          g
+        )), !c && x && (n = X(
+          n,
+          g
+        )), c || (n = q(n)), c || (n = K(n)), u = !0;
       }
-      return p ? {
-        code: r,
+      return u ? {
+        code: n,
         map: null
       } : null;
     }
   };
 }
-function re(u) {
+function ne(p) {
   return {
     name: "velo:config",
-    config(o, { mode: n }) {
-      const i = n === "server", l = n === "development", t = !!process.env.VELO_STATIC, a = o.server?.port ?? (Number(process.env.PORT) || u.port || 3e3);
-      let s = "client.js", c = "client.css";
+    config(s, { mode: r }) {
+      const i = r === "server", l = r === "development", t = !!process.env.VELO_STATIC, a = s.server?.port ?? (Number(process.env.PORT) || p.port || 3e3), o = d.resolve(
+        process.cwd(),
+        s.root ?? "."
+      ), c = s.envDir ? d.resolve(o, s.envDir) : o, n = R(r, c, ""), u = process.env.HOST?.trim() || n.HOST?.trim() || void 0, f = s.server?.host ?? u ?? p.hostname, h = f === !0 || f === "0.0.0.0" || f === "::", y = s.server?.allowedHosts ?? (h ? !0 : void 0);
+      let b = "client.js", j = "client.css";
       if (i)
         try {
-          const p = d.resolve(process.cwd(), "dist/client/.vite/manifest.json"), y = JSON.parse(g.readFileSync(p, "utf-8"))[b];
-          y && (s = y.file || s, y.css?.[0] && (c = y.css[0]));
+          const L = d.resolve(process.cwd(), "dist/client/.vite/manifest.json"), E = JSON.parse(S.readFileSync(L, "utf-8"))[O];
+          E && (b = E.file || b, E.css?.[0] && (j = E.css[0]));
         } catch {
         }
-      const r = {
+      const x = {
         define: {
           "process.env.NODE_ENV": JSON.stringify(l ? "development" : "production"),
           "process.env.STATIC_BASE_URL": JSON.stringify(process.env.STATIC_BASE_URL || (t ? "/client" : "")),
           __VELO_STATIC__: JSON.stringify(t),
           __VELO_BUILD_HASH__: JSON.stringify(process.env.VELO_BUILD_HASH || Date.now().toString(36)),
-          __VELO_CLIENT_JS__: JSON.stringify(s),
-          __VELO_CLIENT_CSS__: JSON.stringify(c),
+          __VELO_CLIENT_JS__: JSON.stringify(b),
+          __VELO_CLIENT_CSS__: JSON.stringify(j),
           // Baked into the server bundle as startServer's port fallback.
           // null when unset → startServer falls back to PORT env / 3000.
-          __VELO_CONFIG_PORT__: JSON.stringify(u.port ?? null),
+          __VELO_CONFIG_PORT__: JSON.stringify(p.port ?? null),
           // Same for the bind interface: null → HOST env / Node default.
-          __VELO_CONFIG_HOSTNAME__: JSON.stringify(u.hostname ?? null)
+          __VELO_CONFIG_HOSTNAME__: JSON.stringify(p.hostname ?? null)
         },
         resolve: {
           alias: {
@@ -552,11 +556,15 @@ function re(u) {
           }
         },
         server: {
-          port: a
+          port: a,
+          // Host and allowedHosts only shape the dev server; in build
+          // they are inert, so we keep them out of the build config.
+          ...l && f !== void 0 ? { host: f } : {},
+          ...l && y !== void 0 ? { allowedHosts: y } : {}
         }
       };
-      return i ? r.build = {
-        ssr: E,
+      return i ? x.build = {
+        ssr: T,
         outDir: "dist",
         emptyOutDir: !1,
         copyPublicDir: !1,
@@ -565,107 +573,107 @@ function re(u) {
             entryFileNames: "server.js"
           }
         }
-      } : l || (r.build = {
+      } : l || (x.build = {
         manifest: !0,
         outDir: "dist/client",
         rollupOptions: {
-          input: b,
+          input: O,
           output: {
             entryFileNames: "client.[hash].js",
-            assetFileNames: (p) => p.names?.[0]?.endsWith(".css") ? "client.[hash].css" : "[name].[hash][extname]"
+            assetFileNames: (L) => L.names?.[0]?.endsWith(".css") ? "client.[hash].css" : "[name].[hash][extname]"
           }
         }
-      }), r;
+      }), x;
     }
   };
 }
-function ne() {
+function ie() {
   return {
     name: "velo:static-url",
     apply: "build",
     enforce: "post",
-    generateBundle(u, o) {
-      const n = process.env.STATIC_BASE_URL || "";
-      if (n)
-        for (const i of Object.values(o))
+    generateBundle(p, s) {
+      const r = process.env.STATIC_BASE_URL || "";
+      if (r)
+        for (const i of Object.values(s))
           i.type === "asset" && typeof i.source == "string" && i.fileName.endsWith(".css") && (i.source = i.source.replace(
             /url\(\s*(['"]?)\/(?!\/)/g,
-            `url($1${n}/`
+            `url($1${r}/`
           ));
     }
   };
 }
-function ie(u, o) {
-  let n = "", i = "", l = !1, t = null;
+function se(p, s) {
+  let r = "", i = "", l = !1, t = null;
   function a() {
-    if (!n) return;
-    const s = d.resolve(n, o);
-    if (!g.existsSync(s)) return;
-    const c = U(s), r = d.join(n, ".velojs");
-    g.mkdirSync(r, { recursive: !0 }), g.writeFileSync(
-      d.join(r, "graph.json"),
+    if (!r) return;
+    const o = d.resolve(r, s);
+    if (!S.existsSync(o)) return;
+    const c = U(o), n = d.join(r, ".velojs");
+    S.mkdirSync(n, { recursive: !0 }), S.writeFileSync(
+      d.join(n, "graph.json"),
       JSON.stringify(c)
     );
   }
   return {
     name: "velo:graph",
-    configResolved(s) {
-      n = s.root, i = s.mode;
+    configResolved(o) {
+      r = o.root, i = o.mode;
     },
     writeBundle() {
       i !== "server" && a();
     },
-    configureServer(s) {
+    configureServer(o) {
       a(), l = !0;
-      const c = d.resolve(n, o);
-      s.watcher.on("all", (r, p) => {
-        l && p.startsWith(c) && (t && clearTimeout(t), t = setTimeout(() => a(), 500));
+      const c = d.resolve(r, s);
+      o.watcher.on("all", (n, u) => {
+        l && u.startsWith(c) && (t && clearTimeout(t), t = setTimeout(() => a(), 500));
       });
     }
   };
 }
-function se(u) {
+function oe(p) {
   return [
     ...J.exclude,
     /.*\.mjs$/,
-    ...u.devServerExclude ?? []
+    ...p.devServerExclude ?? []
   ];
 }
-function ye(u) {
-  const o = u ?? {}, n = o.appDirectory ?? "./app";
+function _e(p) {
+  const s = p ?? {}, r = s.appDirectory ?? "./app";
   return [
-    re(o),
-    te(o, n),
-    ne(),
-    ie(o, n),
-    R(),
-    $({
-      entry: E,
-      exclude: se(o)
+    ne(s),
+    re(s, r),
+    ie(),
+    se(s, r),
+    $(),
+    H({
+      entry: T,
+      exclude: oe(s)
     }),
-    oe()
+    ae()
   ];
 }
-function oe() {
+function ae() {
   return {
     name: "velo:ws-bridge",
-    configureServer(u) {
-      globalThis.__veloDevServer = u.httpServer;
+    configureServer(p) {
+      globalThis.__veloDevServer = p.httpServer;
     }
   };
 }
 export {
-  A as buildFullPathMap,
-  C as collectFullPaths,
-  se as devServerExcludeFor,
+  w as buildFullPathMap,
+  k as collectFullPaths,
+  oe as devServerExcludeFor,
   W as injectMetadata,
-  q as pruneClientOnlyImports,
-  ee as removeEndpointRoutes,
-  X as removeLoaders,
-  K as removeMiddlewares,
-  B as transformActionsForClient,
-  M as transformLoaderFunctions,
-  Y as transformSocketsForClient,
-  z as transformStreamsForClient,
-  ye as veloPlugin
+  K as pruneClientOnlyImports,
+  te as removeEndpointRoutes,
+  q as removeLoaders,
+  Q as removeMiddlewares,
+  M as transformActionsForClient,
+  B as transformLoaderFunctions,
+  X as transformSocketsForClient,
+  Y as transformStreamsForClient,
+  _e as veloPlugin
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mauroandre/velojs",
-    "version": "0.0.54",
+    "version": "0.0.55",
     "type": "module",
     "description": "Fullstack web framework built on Hono + Preact with Vite-powered AST transforms",
     "keywords": [