mikser-io 9.62.0 → 9.64.0

package/CLAUDE.md

@@ -423,6 +423,13 @@ Test coverage: `test/unit/source-sweep.test.js`.
   camelCase: `import { vector } from 'mikser-io-vector'`,
   `import { renderHbs } from 'mikser-io'`. Consumer uses
   `plugins: [vector({...})]` — never the bare string.
+- **Route paths**: a plugin mounts at `/<name>`, with a `base` or `path`
+  option to move it — api `/api`, auth `/auth`, drive `/drive`, forms
+  `/forms`, mcp `/mcp`, preview `/preview`, vector `/vector`, decap
+  `/admin`. The output folder is served from `/`, so a route CAN shadow a
+  page; the accepted answer is a predictable name plus a way to change
+  it, not a reserved prefix. Follow the eight, do not invent a ninth
+  shape.
 - **Tool names**: the registry (`src/tools.js`) holds BARE names —
   `explain`, `verify`, `sources`, `search`. The `mikser_` prefix is MCP's
   namespacing, because its tool names are flat across every connected

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikser-io",
-  "version": "9.62.0",
+  "version": "9.64.0",
   "description": "A mixer for content: entities in, configurable render pipelines, outputs of any kind. Static sites are the canonical recipe, not the definition — the same engine renders PDFs, emails and whatever a renderer plugin produces. Files are the source of truth, every lifecycle phase is observable, and the build graph is queryable by an agent.",
   "main": "index.js",
   "exports": {

package/src/routes.js

@@ -79,6 +79,21 @@ export function routeLocation(displayPath) {
 //   authLabel     bracketed reachability text override for the log.
 //
 // Returns the recorded descriptor.
+// WHERE a plugin mounts: `/<name>`, overridable.
+//
+// Not a new rule — the one every plugin already follows. api at /api, auth at
+// /auth, drive at /drive, forms at /forms, mcp at /mcp, preview at /preview,
+// vector at /vector, decap at /admin. Each takes a `base` or `path` option so
+// a project whose content wants that path can move it.
+//
+// The output folder is served from `/`, so a plugin route can shadow a page.
+// That is a real cost and this is the accepted answer to it: a predictable
+// name, and a way to change it. A reserved prefix like `/$name` would make
+// the collision impossible, and would also make this plugin the only one
+// shaped differently from the other eight — which is a worse trade than the
+// collision it avoids, because the collision is rare and visible and the
+// inconsistency is permanent.
+//
 export function registerRoute({
     path,
     plugin,

package/src/server.js

@@ -22,11 +22,25 @@
 
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { networkInterfaces } from 'node:os'
 
 import runtime from './runtime.js'
 import { useLogger } from './engine.js'
 import { onInitialized, onLoad, onLoaded } from './lifecycle.js'
 
+// Every non-loopback IPv4 address this machine answers on.
+//
+// IPv4 only, deliberately. The non-internal IPv6 addresses on a typical
+// machine are link-local (fe80::), which need a zone index to be usable and
+// are not what anyone is going to type into a phone — listing them would make
+// the useful lines harder to find, which is the opposite of the point.
+export function localAddresses() {
+    return Object.values(networkInterfaces())
+        .flat()
+        .filter(iface => iface && iface.family === 'IPv4' && !iface.internal)
+        .map(iface => iface.address)
+}
+
 // Extend the engine's commander with server-related flags. Called by
 // engine.js's onInitialize callback AFTER engine's own options chain
 // and BEFORE the .parse() call — preserves the order of options in
@@ -214,6 +228,28 @@ export function setupServer() {
                     // back to the bind URL when no public origin is set.
                     const externalUrl = runtime.options.url ?? `http://localhost:${runtime.options.port}`
                     logger.info('Server listening: %s', externalUrl)
+
+                    // The addresses that are NOT localhost.
+                    //
+                    // listen(port) binds every interface, so the server is
+                    // already reachable from a phone or a second machine —
+                    // and the one address printed above is the single one
+                    // that will not work from either. Anyone testing a
+                    // layout on a real device has to go and find their own
+                    // IP, every time, on a machine that already knows it.
+                    //
+                    // Only when no public URL is configured. Behind a proxy
+                    // or a tunnel the LAN address is not how the site is
+                    // reached, and offering it would be an invitation to
+                    // debug the wrong origin.
+                    if (!runtime.options.url) {
+                        const lan = localAddresses()
+                        if (lan.length) {
+                            logger.info('Also on: %s', lan
+                                .map(address => `http://${address}:${runtime.options.port}`)
+                                .join('  '))
+                        }
+                    }
                     resolve()
                 })