@anteros/core 0.0.19 → 0.0.21

package/server/hono.ts

@@ -1,22 +1,111 @@
-import { Hono } from "hono";
+import { Hono, type Context } from "hono";
 import { cors } from "hono/cors"
 import { compress } from 'hono/compress'
 import { ipRestriction } from "hono/ip-restriction"
 import { bodyLimit } from "hono/body-limit"
 import { secureHeaders } from "hono/secure-headers"
+import { HTTPException } from "hono/http-exception"
 import { getConnInfo } from "hono/bun"
+import type { ConnInfo, GetConnInfo } from "hono/conninfo"
+import { Redis } from "ioredis"
 import { cfg } from "./config"
-import { rateLimit } from "./security"
+import { rateLimit, createRedisStore, createMemoryStore, type RateLimitStore } from "./security"
 import { initializeRoutes } from "./routes";
-import { sessionCtxStorage, asyncContextStorage, requestCtxStorage } from "../lib/asyncContextStorage";
+import { asyncContextStorage, requestCtxStorage } from "../lib/asyncContextStorage";
 import { initializeApi } from "./api";
+import { initializeMcp } from "./mcp";
 import { getGlobalMiddlewares } from "../lib/middleware";
 import { jwt } from "../utils/func";
 import { AppError } from "../lib/error";
+import { getMetrics } from "./metrics";
 import type { HonoVariables } from "./env";
 
-const app = new Hono<{ Variables: HonoVariables }>();
+// ─── Redis-backed rate limiting (C3) ─────────────────────────────────────────
+// Lazy singleton: created once per process and reused across createApp() calls.
+// Each increment falls back to the in-memory store if Redis is unavailable,
+// so the limiter keeps working during a Redis outage.
+let redisRateLimitStore: RateLimitStore | null | undefined;
+let redisRateLimitSignature: string | undefined;
+
+function getRedisRateLimitStore(): RateLimitStore | null {
+    const rl = cfg.server.rateLimit;
+    // Re-evaluate only when the rate-limit config or Redis env vars change,
+    // so multiple createApp() calls (tests, hot reload) reuse the same client.
+    const signature = JSON.stringify([
+        rl?.useRedis,
+        rl?.redis,
+        process.env.REDIS_URL,
+        process.env.REDIS_HOST,
+        process.env.REDIS_PORT,
+        process.env.REDIS_PASSWORD,
+    ]);
+    if (redisRateLimitSignature === signature && redisRateLimitStore !== undefined) return redisRateLimitStore;
+    redisRateLimitSignature = signature;
+
+    if (!rl) {
+        redisRateLimitStore = null;
+        return null;
+    }
+
+    // Redis is used AUTOMATICALLY when connection info is present (rateLimit.redis
+    // block or REDIS_* env vars) — no need for useRedis: true.
+    //   - useRedis: false  → force the in-memory store
+    //   - useRedis: true   → force Redis even without connection info (localhost)
+    //   - unset            → auto: Redis if configured, else memory
+    const conn = rl.redis ?? {};
+    const hasRedisConfig =
+        Boolean(conn.url || conn.host || conn.port || conn.password) ||
+        Boolean(process.env.REDIS_URL || process.env.REDIS_HOST || process.env.REDIS_PORT || process.env.REDIS_PASSWORD);
+    const useRedis = rl.useRedis === true || (rl.useRedis !== false && hasRedisConfig);
+
+    if (!useRedis) {
+        redisRateLimitStore = null;
+        return null;
+    }
+
+    try {
+        const conn = rl.redis ?? {};
+        // Stop reconnecting after a few attempts: a dead Redis must not spam logs
+        // or keep the process alive — the limiter falls back to memory meanwhile.
+        const retryStrategy = (times: number) => (times > 5 ? null : Math.min(times * 500, 3000));
+        const client = conn.url
+            ? new Redis(conn.url, { retryStrategy, maxRetriesPerRequest: 2 })
+            : new Redis({
+                host: conn.host ?? process.env.REDIS_HOST ?? 'localhost',
+                port: conn.port ?? (Number(process.env.REDIS_PORT) || 6379),
+                password: conn.password ?? process.env.REDIS_PASSWORD,
+                retryStrategy,
+                maxRetriesPerRequest: 2,
+            });
+        let errorLogged = false;
+        client.on('error', (err) => {
+            if (errorLogged) return;
+            errorLogged = true;
+            console.error('[rateLimit] Redis connection error:', err?.message);
+        });
+
+        const redisStore = createRedisStore(client);
+        const memoryFallback = createMemoryStore();
+        redisRateLimitStore = {
+            async increment(key: string, windowMs: number) {
+                try {
+                    return await redisStore.increment(key, windowMs);
+                } catch (err: any) {
+                    console.error('[rateLimit] Redis store failed, falling back to in-memory:', err?.message);
+                    return memoryFallback.increment(key, windowMs);
+                }
+            },
+        };
+        console.log('[rateLimit] store: Redis (with in-memory fallback)');
+    } catch (err: any) {
+        console.error('[rateLimit] Redis init failed, using in-memory store:', err?.message);
+        redisRateLimitStore = null;
+    }
+    return redisRateLimitStore;
+}
+
 function createApp(): Hono<{ Variables: HonoVariables }> {
+    const app = new Hono<{ Variables: HonoVariables }>();
     const allowHeaders = [
         "Tenant-Id",
         "Content-Type",
@@ -43,17 +132,78 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
         "HEAD",
         ...(cfg.server.cors?.allowMethods as string[] || []),
     ]
-    // cors
-    const corsOrigin = cfg.server.cors?.origin as string[] | undefined;
-    const corsCredentials = cfg.server.cors?.credentials as boolean | undefined ?? false;
+    // cors — origin accepts string | string[] | function (see ServerConfig type)
+    const corsConfig = cfg.server.cors?.origin;
+    const corsCredentials = cfg.server.cors?.credentials ?? false;
+
+    // Detect a wildcard in any supported form without breaking on string/function origins
+    const hasWildcardOrigin =
+        corsConfig === '*' ||
+        (Array.isArray(corsConfig) && corsConfig.includes('*'));
 
-    if (corsCredentials && (!corsOrigin || corsOrigin.includes('*'))) {
+    if (corsCredentials && (!corsConfig || hasWildcardOrigin)) {
         throw new Error(
             'CORS misconfiguration: credentials: true is incompatible with origin: *. '
             + 'Set explicit origins in cfg.server.cors.origin.'
         );
     }
 
+    // Config function form: (ctx: { origin, c }) => string | string[]
+    // Hono expects: (origin, c) => string | Promise<string | null | undefined> | null | undefined
+    type CorsOriginOption = NonNullable<Parameters<typeof cors>[0]>['origin'];
+    const corsOrigin =
+        typeof corsConfig === 'function'
+            ? ((origin: string, c: Context) => corsConfig({ origin, c })) as unknown as CorsOriginOption
+            : corsConfig;
+
+    // Global error handler — maps AppError thrown by user routes, global
+    // middlewares and useRest to their proper status/code/message.
+    // (API routes keep their own errorResponse() for backward compat.)
+    app.onError((err, c) => {
+        // Let Hono's HTTPException respond with its own status (401/413/…)
+        if (err instanceof HTTPException) {
+            return err.getResponse();
+        }
+
+        const isAppError = err instanceof AppError;
+        // Always log unexpected errors (default Hono behavior preserved)
+        if (!isAppError) console.error(err);
+
+        const status = isAppError ? Number(err.status) || 500 : 500;
+        return c.json({
+            message: isAppError ? err.message : 'Internal server error',
+            code: isAppError ? err.code : 'INTERNAL_SERVER_ERROR',
+            meta: isAppError ? err.meta : undefined,
+        }, status as any);
+    });
+
+    // ── Client IP: resolved once per request and shared by all middlewares ──
+    // getConnInfo(c) = server.requestIP() → the real socket address. Proxy headers
+    // (CF-Connecting-IP / X-Forwarded-For) are ONLY trusted when cfg.server.trustProxy
+    // is explicitly enabled, otherwise they are spoofable.
+    // getConnInfo throws when the app runs outside a real Bun.serve (e.g. app.request()
+    // in tests) → fall back to an empty address.
+    const safeGetConnInfo = (c: Context): ConnInfo => {
+        try {
+            return getConnInfo(c);
+        } catch {
+            return { remote: {} };
+        }
+    };
+
+    app.use(async (c, next) => {
+        const connInfo = safeGetConnInfo(c);
+        c.set('connInfo', connInfo);
+        c.set('clientIp', cfg.server.trustProxy
+            ? c.req.header('CF-Connecting-IP') ?? c.req.header('X-Forwarded-For') ?? connInfo.remote.address ?? 'unknown'
+            : connInfo.remote.address ?? 'unknown');
+        await next();
+    });
+
+    // Reuse the cached connInfo instead of re-querying the socket per middleware
+    const cachedGetConnInfo: GetConnInfo = (c) =>
+        (c as Context<{ Variables: HonoVariables }>).get('connInfo') ?? safeGetConnInfo(c);
+
 
 
     app.use(cors({
@@ -67,7 +217,7 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
     app.use(compress());
 
     // ip restriction
-    app.use(ipRestriction(getConnInfo, {
+    app.use(ipRestriction(cachedGetConnInfo, {
         denyList: cfg.server?.ipRestriction?.denyList || [],
         allowList: cfg.server?.ipRestriction?.allowList || [],
     }))
@@ -88,19 +238,38 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
         maxSize: cfg.server.body?.maxSize ?? 1024 * 1024 * 100, // 100MB
     }));
 
+    // ── Health & metrics (built-in, zero dependency) ──
+    app.get('/health', (c) => {
+        return c.json({
+            ...getMetrics(),
+            ip: c.get('clientIp') ?? 'unknown',
+        });
+    });
+
 
 
     // rate limiting (global)
     if (cfg.server.rateLimit?.enabled !== false) {
+        // Redis-backed store when configured (C3), in-memory otherwise
+        const store = getRedisRateLimitStore() ?? undefined;
+
+        // Distinct keys so the stricter login limit never shares counters with the global one
+        const keyByClientIp = (prefix: string) => (c: Context) =>
+            `rn:rl:${prefix}${(c as any).get('clientIp') ?? 'unknown'}`;
+
         app.use('*', rateLimit({
             windowMs: cfg.server.rateLimit?.windowMs ?? 60_000,
             max: cfg.server.rateLimit?.max ?? 100,
+            store,
+            keyGenerator: keyByClientIp(''),
         }));
 
         // stricter limit for login endpoints
         app.use('/api/*/login', rateLimit({
             windowMs: cfg.server.rateLimit?.login?.windowMs ?? 60_000,
             max: cfg.server.rateLimit?.login?.max ?? 10,
+            store,
+            keyGenerator: keyByClientIp('login:'),
         }));
     }
 
@@ -108,17 +277,20 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
     app.use(async (c, next) => {
         return asyncContextStorage.run(new Map(), async () => {
             const traceId = crypto.randomUUID();
-            const connInfo = getConnInfo(c);
             requestCtxStorage.set('trace', { id: traceId });
             requestCtxStorage.set('internal', false);
 
 
 
+            const requestCtx: Record<string, string> = c.req.header();
+            // Faille 1: never log sensitive headers (JWT, cookies)
+            delete requestCtx.authorization;
+            delete requestCtx.cookie;
             requestCtxStorage.set('meta', {
                 request: {
-                    ip: connInfo.remote.address ?? c.req.header('CF-Connecting-IP') ?? c.req.header('True-Client-IP') ?? c.req.header('X-Forwarded-For') ?? 'unknown',
+                    ip: c.get('clientIp') ?? 'unknown',
                     user_agent: c.req.header('User-Agent') ?? '',
-                    headers: c.req.header(),
+                    headers: requestCtx,
                     method: c.req.method,
                     path: c.req.path,
                     query: c.req.query(),
@@ -129,15 +301,15 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
             })
             const bearer = c.req.header('Authorization')?.replace('Bearer ', '');
             if (bearer) {
-                const { value, error } = await jwt.verify(bearer);
+                const { value, error, expired } = await jwt.verify(bearer);
                 const isValid = !error && value != null;
-                const isExpired = !!error && error.toLowerCase().includes('exp');
 
                 const tokenData = {
-                    value: bearer,
+                    value: isValid ? bearer : null,
                     decoded: isValid ? (value as Record<string, unknown>) : null,
                     provided: true,
-                    expired: isExpired || (value != null && typeof (value as any)?.exp === 'number' && (value as any).exp * 1000 < Date.now()),
+                    // jwt.verify already flags expiry (expired: true, value: null)
+                    expired,
                 };
 
                 requestCtxStorage.set('token', tokenData);
@@ -163,6 +335,9 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
     // initialize api
     initializeApi(app);
 
+    // initialize MCP (tools served at /mcp/:tenant_id)
+    initializeMcp(app);
+
 
     return app;
 }
@@ -171,6 +346,5 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
 
 
 export {
-    createApp,
-    app
+    createApp
 }

package/server/mcp.ts

@@ -0,0 +1,232 @@
+import type { Hono, Context } from "hono";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import {
+    ListToolsRequestSchema,
+    CallToolRequestSchema,
+    ListResourcesRequestSchema,
+    ListResourceTemplatesRequestSchema,
+    ReadResourceRequestSchema,
+    McpError,
+    ErrorCode,
+} from "@modelcontextprotocol/sdk/types.js";
+import { StreamableHTTPTransport } from "@hono/mcp";
+import type Joi from "joi";
+import { cfg } from "./config";
+import { useRest } from "../database/rest";
+import type { McpTool, McpResource } from "../types/mcp";
+import type { HonoVariables } from "./env";
+
+// ─── Joi → JSON Schema (for the MCP protocol) ────────────────────────────
+
+function joiTypeToJson(type: string): string {
+    switch (type) {
+        case 'number': return 'number';
+        case 'integer': return 'integer';
+        case 'boolean': return 'boolean';
+        case 'date': return 'string';
+        default: return 'string';
+    }
+}
+
+/** Minimal Joi → JSON Schema converter (covers the common field types). */
+function joiToJsonSchema(schema: Joi.Schema, describe = schema.describe() as any): any {
+    const node: any = {};
+    const type = describe?.type;
+
+    switch (type) {
+        case 'object': {
+            node.type = 'object';
+            const properties: Record<string, any> = {};
+            const required: string[] = [];
+            for (const [key, child] of Object.entries(describe.keys ?? {})) {
+                properties[key] = joiToJsonSchema(child as any, child);
+                if ((child as any)?.flags?.presence === 'required') required.push(key);
+            }
+            node.properties = properties;
+            if (required.length) node.required = required;
+            break;
+        }
+        case 'array': {
+            node.type = 'array';
+            if (describe.items?.length) node.items = joiToJsonSchema(describe.items[0], describe.items[0]);
+            break;
+        }
+        default: {
+            node.type = joiTypeToJson(type);
+            if (type === 'date') node.format = 'date-time';
+            if (type === 'string') {
+                for (const rule of describe.rules ?? []) {
+                    if (['email', 'uri', 'uuid', 'isoDate', 'ip'].includes(rule.name)) {
+                        node.format = rule.name;
+                    }
+                    if (rule.name === 'pattern' && rule.args?.regex) {
+                        node.pattern = String(rule.args.regex).replace(/^\/|\/[gimsuy]*$/g, '');
+                    }
+                }
+            }
+            if (describe.valids?.length && describe.valids.length <= 50) {
+                node.enum = describe.valids;
+            }
+            break;
+        }
+    }
+
+    if (describe?.flags?.presence === 'required') node.description = node.description ?? 'required';
+    if (describe?.flags?.description) node.description = describe.flags.description;
+    return node;
+}
+
+// ─── URI template matching (users://{id} → params) ───────────────────────
+
+function compileTemplate(template: string): { regex: RegExp; params: string[] } {
+    const params: string[] = [];
+    const pattern = template.replace(/\{([^}]+)\}/g, (_, name) => {
+        params.push(name);
+        return '([^/]+)';
+    });
+    return { regex: new RegExp(`^${pattern}$`), params };
+}
+
+function matchUri(uri: string, resources: McpResource[]): { resource: McpResource; params: Record<string, string> } | null {
+    // Exact static match first
+    const staticMatch = resources.find((r) => r.uri === uri);
+    if (staticMatch) return { resource: staticMatch, params: {} };
+
+    // Template match
+    for (const resource of resources) {
+        if (!resource.uri.includes('{')) continue;
+        const { regex, params } = compileTemplate(resource.uri);
+        const m = uri.match(regex);
+        if (!m) continue;
+        const extracted: Record<string, string> = {};
+        params.forEach((name, i) => { extracted[name] = m[i + 1] ?? ''; });
+        return { resource, params: extracted };
+    }
+    return null;
+}
+
+// ─── MCP server (one fresh instance per request — stateless) ─────────────
+
+function buildServer(tenantId: string, tools: McpTool[], resources: McpResource[]): Server {
+    const server = new Server(
+        { name: 'anteros-mcp', version: cfg.version ?? '1.0.0' },
+        { capabilities: { tools: {}, resources: {} } }
+    );
+
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: tools.map((t) => ({
+            name: t.name,
+            title: t.name,
+            description: t.description,
+            inputSchema: joiToJsonSchema(t.inputSchema),
+        })),
+    }));
+
+    server.setRequestHandler(CallToolRequestSchema, async (req) => {
+        const tool = tools.find((t) => t.name === req.params.name);
+        if (!tool) {
+            throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${req.params.name}`);
+        }
+
+        const raw = req.params.arguments ?? {};
+        const { error, value } = tool.inputSchema.validate(raw, { allowUnknown: false });
+        if (error) {
+            return {
+                content: [{ type: 'text' as const, text: `Invalid arguments: ${error.message}` }],
+                isError: true,
+            };
+        }
+
+        const rest = new useRest({ tenant_id: tenantId });
+        try {
+            const result = await tool.exec({ c: undefined as any, rest, args: value });
+            if (result && Array.isArray(result.content)) return result;
+            const text = typeof result === 'string' ? result : JSON.stringify(result);
+            return { content: [{ type: 'text' as const, text }] };
+        } catch (err: any) {
+            return {
+                content: [{ type: 'text' as const, text: `Error: ${err?.message ?? 'unknown'}` }],
+                isError: true,
+            };
+        }
+    });
+
+    server.setRequestHandler(ListResourcesRequestSchema, async () => ({
+        resources: resources
+            .filter((r) => !r.uri.includes('{')) // static only; templates are listed separately
+            .map((r) => ({
+                uri: r.uri,
+                name: r.name,
+                description: r.description,
+                mimeType: r.mimeType,
+            })),
+    }));
+
+    server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => ({
+        resourceTemplates: resources
+            .filter((r) => r.uri.includes('{'))
+            .map((r) => ({
+                uriTemplate: r.uri,
+                name: r.name,
+                description: r.description,
+                mimeType: r.mimeType,
+            })),
+    }));
+
+    server.setRequestHandler(ReadResourceRequestSchema, async (req) => {
+        const uri = req.params.uri;
+        const matched = matchUri(uri, resources);
+        if (!matched) {
+            throw new McpError(ErrorCode.InvalidParams, `Unknown resource URI: ${uri}`);
+        }
+
+        const rest = new useRest({ tenant_id: tenantId });
+        try {
+            const result = await matched.resource.read({
+                c: undefined as any,
+                rest,
+                params: matched.params,
+                uri,
+            });
+            return result;
+        } catch (err: any) {
+            throw new McpError(ErrorCode.InternalError, `Failed to read resource: ${err?.message ?? 'unknown'}`);
+        }
+    });
+
+    return server;
+}
+
+/**
+ * Expose each tenant's MCP tools & resources over the Model Context Protocol
+ * at `GET/POST /mcp/:tenant_id` (Streamable HTTP transport — works with
+ * Claude, Cursor, VS Code, and any MCP client).
+ */
+export function initializeMcp(app: Hono<{ Variables: HonoVariables }>) {
+    const toolsByTenant = new Map<string, McpTool[]>();
+    for (const tool of cfg.mcpTools ?? []) {
+        const list = toolsByTenant.get(tool._tenant_ ?? '') ?? [];
+        list.push(tool);
+        toolsByTenant.set(tool._tenant_ ?? '', list);
+    }
+    const resourcesByTenant = new Map<string, McpResource[]>();
+    for (const resource of cfg.mcpResources ?? []) {
+        const list = resourcesByTenant.get(resource._tenant_ ?? '') ?? [];
+        list.push(resource);
+        resourcesByTenant.set(resource._tenant_ ?? '', list);
+    }
+
+    app.all('/mcp/:tenant_id', async (c: Context<{ Variables: HonoVariables }>) => {
+        const tenantId = c.req.param('tenant_id') ?? '';
+        const tools = toolsByTenant.get(tenantId) ?? [];
+        const resources = resourcesByTenant.get(tenantId) ?? [];
+        if (!tools.length && !resources.length) {
+            return c.json({ error: `No MCP tools or resources for tenant '${tenantId}'` }, 404);
+        }
+
+        const server = buildServer(tenantId, tools, resources);
+        const transport = new StreamableHTTPTransport();
+        await server.connect(transport);
+        return transport.handleRequest(c);
+    });
+}

package/server/metrics.ts

@@ -0,0 +1,110 @@
+import type { Server } from "bun";
+import os from "node:os";
+
+// ─── Zero-dependency runtime metrics (memory, CPU, requests) ─────────────────
+
+export type MetricsSnapshot = {
+  pid: number;
+  startedAt: number;
+  uptime: number;
+  env: string;
+  connections: number;
+  pendingRequests: number;
+  pendingWebSockets: number;
+  requests: {
+    total: number;
+    active: number;
+    errors: number;
+    byMethod: Record<string, number>;
+    byStatus: Record<string, number>;
+  };
+  memory: {
+    rss: number;
+    heapUsed: number;
+    heapTotal: number;
+    external: number;
+  };
+  cpu: {
+    /** % of a single core over the last sample window (0..100*cores) */
+    percent: number;
+    cores: number;
+    user: number;
+    system: number;
+  };
+};
+
+let serverRef: Server<any> | null = null;
+
+const startedAt = Date.now();
+let totalRequests = 0;
+let totalErrors = 0;
+const byMethod = new Map<string, number>();
+const byStatus = new Map<string, number>();
+
+let lastCpu = process.cpuUsage();
+let lastCpuAt = Date.now();
+
+/** Attach the running Bun server (used for connection / pending request counts). */
+export function registerMetrics(server: Server<any>) {
+  serverRef = server;
+}
+
+/** Count a finished request (call once the response is resolved). */
+export function trackRequest(req: Request, res: Response) {
+  totalRequests++;
+  const method = req.method || 'UNKNOWN';
+  byMethod.set(method, (byMethod.get(method) ?? 0) + 1);
+  const status = String(res.status);
+  byStatus.set(status, (byStatus.get(status) ?? 0) + 1);
+  if (res.status >= 500) totalErrors++;
+}
+
+/** Count an error that did not produce a response. */
+export function trackError() {
+  totalErrors++;
+}
+
+/** Build a serializable metrics snapshot for the current process. */
+export function getMetrics(): MetricsSnapshot {
+  const mem = process.memoryUsage();
+  const now = Date.now();
+  const cpu = process.cpuUsage();
+
+  const user = cpu.user - lastCpu.user;
+  const system = cpu.system - lastCpu.system;
+  const elapsedMs = Math.max(1, now - lastCpuAt);
+  const cores = Math.max(1, os.availableParallelism());
+  lastCpu = cpu;
+  lastCpuAt = now;
+
+  const cpuPercent = Math.min(100 * cores, ((user + system) / 1000 / elapsedMs) * 100);
+
+  return {
+    pid: process.pid,
+    startedAt,
+    uptime: Math.floor((now - startedAt) / 1000),
+    env: process.env.NODE_ENV || Bun.env.NODE_ENV || 'dev',
+    connections: serverRef?.pendingWebSockets ?? 0,
+    pendingRequests: serverRef?.pendingRequests ?? 0,
+    pendingWebSockets: serverRef?.pendingWebSockets ?? 0,
+    requests: {
+      total: totalRequests,
+      active: serverRef?.pendingRequests ?? 0,
+      errors: totalErrors,
+      byMethod: Object.fromEntries(byMethod),
+      byStatus: Object.fromEntries(byStatus),
+    },
+    memory: {
+      rss: mem.rss,
+      heapUsed: mem.heapUsed,
+      heapTotal: mem.heapTotal,
+      external: mem.external,
+    },
+    cpu: {
+      percent: Math.round(cpuPercent * 10) / 10,
+      cores,
+      user,
+      system,
+    },
+  };
+}

package/server/security.ts

@@ -1,5 +1,6 @@
 import type { Context } from "hono";
 import { getConnInfo } from "hono/bun";
+import type { ConnInfo } from "hono/conninfo";
 
 // ─── Types ───────────────────────────────────────────────────────────────────
 
@@ -96,15 +97,18 @@ export function createRedisStore(redis: RedisClient): RateLimitStore {
 // ─── Default key generator ───────────────────────────────────────────────────
 
 function defaultKeyGenerator(c: Context): string {
-  const connInfo = getConnInfo(c);
-  const ip =
-    connInfo.remote.address ??
-    c.req.header("CF-Connecting-IP") ??
-    c.req.header("True-Client-IP") ??
-    c.req.header("X-Forwarded-For") ??
-    "unknown";
-
-  return `rn:rl:${ip}`;
+  // Prefer the client IP resolved once by the app middleware (trustProxy-aware).
+  const clientIp = (c as any).get('clientIp') as string | undefined;
+  if (clientIp) return `rn:rl:${clientIp}`;
+
+  // Fallback: real socket address only (no spoofable proxy headers)
+  let connInfo: ConnInfo | null = null;
+  try {
+    connInfo = getConnInfo(c);
+  } catch {
+    // getConnInfo throws outside a real Bun.serve (e.g. unit tests)
+  }
+  return `rn:rl:${connInfo?.remote.address ?? 'unknown'}`;
 }
 
 // ─── Middleware ──────────────────────────────────────────────────────────────