fix: require explicit public network binds

[smiggleworth]

Closes #6. Defaults both server entrypoints to 127.0.0.1, rejects implicit public hosts, and documents the allowPublicBind opt-in.

[Copilot]

Pull request overview

This PR hardens the Node adapter’s network exposure defaults by ensuring both listen() and serve() bind to loopback (127.0.0.1) unless the caller explicitly opts into a public bind via allowPublicBind: true, aligning with Issue #6’s security requirement.

Changes:

• Introduces resolveBindHost() to centralize loopback-default binding and public-bind opt-in enforcement.
• Updates listen() and serve() to use the resolved host for both binding and Host allowlisting.
• Adds test coverage and documentation describing the new default and opt-in behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/node.test.ts	Adds a regression test asserting loopback-default binding and requiring explicit public-bind opt-in.
src/serve.ts	Uses resolveBindHost() for consistent binding/allowedHosts behavior in serve().
src/listen.ts	Uses resolveBindHost() for consistent binding/allowedHosts behavior in listen().
src/contracts.ts	Adds allowPublicBind?: boolean to the public options contract (via ListenOptions).
src/bind.ts	Adds shared host resolution + opt-in enforcement helper.
README.md	Documents loopback-default binding and the allowPublicBind opt-in requirement.

Comments suppressed due to low confidence (1)

tests/node.test.ts:37

• Same pattern as above: combining the type check and value assertion can turn a non-TCP address into false === "0.0.0.0", which is harder to debug than an explicit guard.

    const publicAddress = publicServer.address();
    expect(typeof publicAddress === "object" && publicAddress?.address).toBe("0.0.0.0");

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.