@beignet/core 0.0.46 → 0.0.47

package/dist/server/trusted-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted-proxy.js","sourceRoot":"","sources":["../../src/server/trusted-proxy.ts"],"names":[],"mappings":"AA4EA,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AACpD,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAE/C,SAAS,oBAAoB,CAAC,KAAoB;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAoB,EACpB,MAAc;IAEd,OAAO,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,UAAkB;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,mCAAmC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACjE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IACE,IAAI,IAAI,EAAE;YACV,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,IAAI;YACb,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,GAAG,EACZ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CACpB,KAAyB,EACzB,QAA0B;IAE1B,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,QAAQ,MAAM,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAQ;IACtC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAoB,EACpB,MAAsD;IAEtD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC1C,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,gBAAgB,CACrB,GAAG,EACH,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,uBAAuB,IAAI,MAAM,KAAK,sBAAsB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO,MAAM,KAAK,uBAAuB;YACvC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACZ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAoB,EACpB,SAAyC,KAAK;IAE9C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,QAAQ;YACd,YAAY,EAAE,KAAK;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAClB,MAAM,CAAC,cAAc,KAAK,KAAK;QAC7B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CACf,MAAM,CAAC,cAAc,IAAI,uBAAuB,EAChD,6BAA6B,CAC9B,CAAC;IACR,MAAM,UAAU,GACd,MAAM,CAAC,UAAU,KAAK,KAAK;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CACf,MAAM,CAAC,UAAU,IAAI,mBAAmB,EACxC,yBAAyB,CAC1B,CAAC;IAER,MAAM,QAAQ,GACZ,iBAAiB,CACf,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CACnE,IAAI,YAAY,CAAC;IACpB,MAAM,IAAI,GACR,aAAa,CACX,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,EAC1D,QAAQ,CACT,IAAI,QAAQ,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,GAAG,CAAC,QAAQ,GAAG,GAAG,QAAQ,GAAG,CAAC;IAC9B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAChB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE9D,OAAO;QACL,GAAG;QACH,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ;QACR,IAAI;QACJ,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"trusted-proxy.js","sourceRoot":"","sources":["../../src/server/trusted-proxy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAiF5E,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AACpD,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAE/C,SAAS,oBAAoB,CAAC,KAAoB;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAoB,EACpB,MAAc;IAEd,OAAO,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACjE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IACE,IAAI,IAAI,EAAE;YACV,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,IAAI;YACb,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,GAAG,EACZ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CACpB,KAAyB,EACzB,QAA0B;IAE1B,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,QAAQ,MAAM,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAQ;IACtC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAoB,EACpB,MAAsD;IAEtD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC1C,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,gBAAgB,CACrB,GAAG,EACH,6BAA6B,CAC3B,MAAM,CAAC,MAAM,EACb,8BAA8B,CAC/B,CACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,uBAAuB,IAAI,MAAM,KAAK,sBAAsB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO,MAAM,KAAK,uBAAuB;YACvC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACZ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAoB,EACpB,SAAyC,KAAK;IAE9C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,QAAQ;YACd,eAAe,EAAE,KAAK;YACtB,YAAY,EAAE,KAAK;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAClB,MAAM,CAAC,cAAc,KAAK,KAAK;QAC7B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,6BAA6B,CAC3B,MAAM,CAAC,cAAc,IAAI,uBAAuB,EAChD,6BAA6B,CAC9B,CAAC;IACR,MAAM,UAAU,GACd,MAAM,CAAC,UAAU,KAAK,KAAK;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,6BAA6B,CAC3B,MAAM,CAAC,UAAU,IAAI,mBAAmB,EACxC,yBAAyB,CAC1B,CAAC;IAER,MAAM,QAAQ,GACZ,iBAAiB,CACf,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CACnE,IAAI,YAAY,CAAC;IACpB,MAAM,IAAI,GACR,aAAa,CACX,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,EAC1D,QAAQ,CACT,IAAI,QAAQ,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,GAAG,CAAC,QAAQ,GAAG,GAAG,QAAQ,GAAG,CAAC;IAC9B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAChB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE9D,OAAO;QACL,GAAG;QACH,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ;QACR,IAAI;QACJ,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QACzC,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beignet/core",
-  "version": "0.0.46",
+  "version": "0.0.47",
   "type": "module",
   "description": "Core framework primitives for Beignet",
   "exports": {

package/skills/app-architecture/SKILL.md

@@ -65,8 +65,11 @@ themselves.
 - Server-only request context helpers may bridge Server Components to
   Beignet's request-scoped `AppContext`. Keep them outside `client/`, usually
   in `lib/server-context.ts`, and mark them with `@beignet/core/server-only`.
-  Layouts may read `ctx.auth`, `ctx.tenant`, and request metadata for redirects
-  and shell state; feature data still belongs behind use cases.
+  The context factory receives `requestInfo` from the server's explicit
+  `trustedProxy` policy; store it on request contexts when layouts need the
+  external URL, origin, host, protocol, or client IP. Layouts may read that
+  metadata with `ctx.auth` and `ctx.tenant` for redirects and shell state;
+  feature data still belongs behind use cases.
 - Server-only React Query prefetch helpers may consume that context for
   hydrated client state. Use them only for direct `{ contract, useCase }` route
   bindings whose use-case output matches the contract success body.

package/src/server/context.ts

@@ -7,6 +7,7 @@ import type {
 } from "../ports/index.js";
 import type { TraceContext } from "../tracing/index.js";
 import type { HttpRequestLike, MaybePromise } from "./http.js";
+import type { TrustedRequestInfo } from "./trusted-proxy.js";
 
 /**
  * Arguments passed to the `context.request` factory after a route is matched.
@@ -16,6 +17,12 @@ export type RequestContextArgs<Ports extends AnyPorts = AnyPorts> = {
    * Framework-neutral request.
    */
   req: HttpRequestLike;
+  /**
+   * Request metadata resolved from the server's explicit trusted-proxy policy.
+   * Forwarding headers never affect this value unless
+   * `createServer({ trustedProxy })` opts into them.
+   */
+  requestInfo: TrustedRequestInfo;
   /**
    * Final app ports, including ports contributed by providers.
    */

package/src/server/hooks/logging.ts

@@ -3,6 +3,10 @@
  */
 
 import type { HttpContractConfig } from "../../contracts/index.js";
+import {
+  resolveTrustedRequest,
+  type TrustedRequestInfo,
+} from "../trusted-proxy.js";
 import type { HttpRequestLike, ServerHook } from "../types.js";
 import { getRequestIdFromContext } from "./utils.js";
 
@@ -46,6 +50,7 @@ export interface LoggingConfig<Ctx> {
   onRequestStart?: (args: {
     ctx?: Ctx;
     req: HttpRequestLike;
+    requestInfo: TrustedRequestInfo;
     contract?: HttpContractConfig;
   }) => void;
   /**
@@ -54,6 +59,7 @@ export interface LoggingConfig<Ctx> {
   onRequestEnd?: (args: {
     ctx?: Ctx;
     req: HttpRequestLike;
+    requestInfo: TrustedRequestInfo;
     res: { status: number; headers: Record<string, string> };
     durationMs: number;
     contract?: HttpContractConfig;
@@ -61,6 +67,13 @@ export interface LoggingConfig<Ctx> {
   }) => void;
 }
 
+function loggingRequestInfo(
+  req: HttpRequestLike,
+  requestInfo: TrustedRequestInfo | undefined,
+): TrustedRequestInfo {
+  return requestInfo ?? resolveTrustedRequest(req);
+}
+
 /**
  * Create request logging hooks.
  *
@@ -74,10 +87,15 @@ export function createLoggingHooks<Ctx>(
 
   return {
     name: "logging",
-    onRequest: ({ req, contract }) => {
+    onRequest: ({ req, requestInfo, contract }) => {
       if (config.onRequestStart) {
         try {
-          config.onRequestStart({ req, contract, ctx: undefined });
+          config.onRequestStart({
+            req,
+            requestInfo: loggingRequestInfo(req, requestInfo),
+            contract,
+            ctx: undefined,
+          });
         } catch {
           // Ignore logging errors
         }
@@ -86,9 +104,11 @@ export function createLoggingHooks<Ctx>(
 
       if (!config.logger) return undefined;
       try {
-        const url = new URL(req.url);
         config.logger.info(
-          { method: req.method, url: url.pathname },
+          {
+            method: req.method,
+            url: loggingRequestInfo(req, requestInfo).url.pathname,
+          },
           "Request start",
         );
       } catch {
@@ -114,13 +134,22 @@ export function createLoggingHooks<Ctx>(
           },
         }
       : {}),
-    afterSend: ({ ctx, req, response, durationMs, contract, error }) => {
+    afterSend: ({
+      ctx,
+      req,
+      requestInfo,
+      response,
+      durationMs,
+      contract,
+      error,
+    }) => {
       const headers = response.headers ?? {};
       if (config.onRequestEnd) {
         try {
           config.onRequestEnd({
             ctx,
             req,
+            requestInfo: loggingRequestInfo(req, requestInfo),
             res: { status: response.status, headers },
             durationMs,
             contract,
@@ -134,11 +163,10 @@ export function createLoggingHooks<Ctx>(
 
       if (!config.logger) return;
       try {
-        const url = new URL(req.url);
         const requestId = getRequestIdFromContext(ctx);
         const payload = {
           method: req.method,
-          url: url.pathname,
+          url: loggingRequestInfo(req, requestInfo).url.pathname,
           status: response.status,
           durationMs: Math.round(durationMs),
           ...(requestId !== undefined ? { requestId } : {}),

package/src/server/hooks/rate-limit.ts

@@ -13,6 +13,7 @@ import {
   resolveTrustedClientIp,
   type TrustedProxyClientIpSource,
   type TrustedProxyConfig,
+  type TrustedRequestInfo,
 } from "../trusted-proxy.js";
 import type { HttpRequestLike, ServerHook } from "../types.js";
 
@@ -78,16 +79,16 @@ export interface RateLimitOptions<Ctx> {
    * Resolve the client IP for `ip`-scoped limits.
    *
    * There is no default: when any contract declares an `ip`-scoped rate limit
-   * and neither `trustedProxy.clientIp`, `ipSource`, nor a custom `earlyKey`
-   * is configured, the hook fails at startup. Prefer `trustedProxy.clientIp`
-   * for production proxy headers; keep `ipSource` for custom keying or
-   * compatibility, or pass `"none"` to explicitly accept one shared
-   * `ip:unknown` bucket for all clients.
+   * and neither the server-level `trustedProxy.clientIp`,
+   * this hook's `trustedProxy.clientIp`, `ipSource`, nor a custom `earlyKey`
+   * is configured, the hook fails at startup. Prefer the server-level policy
+   * for production proxy headers; keep these hook-local options for an
+   * intentional override or custom keying.
    */
   ipSource?: RateLimitIpSource;
   /**
-   * Shared trusted-proxy policy used to resolve client IPs when `ipSource` is
-   * not set.
+   * Hook-local trusted-proxy policy used to resolve client IPs when
+   * `ipSource` is not set. This overrides the server-level policy.
    *
    * Configure this only when the app is always behind a platform or reverse
    * proxy that strips or normalizes forwarding headers. For `ip`-scoped rate
@@ -257,23 +258,32 @@ export function createRateLimitHooks<Ctx extends CtxWithRateLimit>(
   const { ipSource, trustedProxy } = options;
   const getClientIp = (
     req: HttpRequestLike,
+    requestInfo: TrustedRequestInfo | undefined,
     contractName: string,
   ): string | undefined => {
     if (ipSource !== undefined) {
       return resolveClientIp(req, ipSource);
     }
-    if (hasTrustedProxyClientIp(trustedProxy) && trustedProxy) {
-      return resolveTrustedClientIp(req, trustedProxy.clientIp);
+    if (trustedProxy !== undefined) {
+      if (hasTrustedProxyClientIp(trustedProxy) && trustedProxy) {
+        return resolveTrustedClientIp(req, trustedProxy.clientIp);
+      }
+      throw ipSourceConfigurationError(formatContractNames([contractName]));
+    }
+    if (requestInfo?.clientIpTrusted) {
+      return requestInfo.clientIp;
     }
     throw ipSourceConfigurationError(formatContractNames([contractName]));
   };
 
   return {
     name: "rate-limit",
-    validate: ({ contracts }) => {
+    validate: ({ contracts, trustedProxy: serverTrustedProxy }) => {
       if (
         ipSource !== undefined ||
-        hasTrustedProxyClientIp(trustedProxy) ||
+        hasTrustedProxyClientIp(
+          trustedProxy !== undefined ? trustedProxy : serverTrustedProxy,
+        ) ||
         options.earlyKey
       ) {
         return;
@@ -286,7 +296,7 @@ export function createRateLimitHooks<Ctx extends CtxWithRateLimit>(
       }
       throw ipSourceConfigurationError(formatContractNames(ipScoped));
     },
-    onRequest: async ({ contract, ports, req }) => {
+    onRequest: async ({ contract, ports, req, requestInfo }) => {
       const rlMeta = contract.metadata?.rateLimit;
       if (!rlMeta) {
         return undefined;
@@ -300,7 +310,7 @@ export function createRateLimitHooks<Ctx extends CtxWithRateLimit>(
       const key =
         options.earlyKey?.({ req, scope }) ??
         defaultEarlyRateLimitKey({ req, scope }, (r) =>
-          getClientIp(r, contract.name),
+          getClientIp(r, requestInfo, contract.name),
         );
 
       await enforceRateLimit(ports, {
@@ -312,7 +322,7 @@ export function createRateLimitHooks<Ctx extends CtxWithRateLimit>(
 
       return undefined;
     },
-    beforeHandle: async ({ ctx, contract, req }) => {
+    beforeHandle: async ({ ctx, contract, req, requestInfo }) => {
       const rlMeta = contract.metadata?.rateLimit;
       if (!rlMeta) {
         return undefined;
@@ -326,7 +336,7 @@ export function createRateLimitHooks<Ctx extends CtxWithRateLimit>(
       const key =
         options.key?.({ ctx, req, scope }) ??
         defaultRateLimitKey({ ctx, req, scope }, (r) =>
-          getClientIp(r, contract.name),
+          getClientIp(r, requestInfo, contract.name),
         );
 
       await enforceRateLimit(ctx.ports, {

package/src/server/hooks/security.ts

@@ -154,12 +154,13 @@ export interface CsrfHooksOptions {
    */
   token?: false | CsrfTokenOptions;
   /**
-   * Shared trusted-proxy policy used when comparing the request's external
-   * origin against `Origin` or `Referer`.
+   * Hook-local trusted-proxy policy used when comparing the request's external
+   * origin against `Origin` or `Referer`. This overrides the server-level
+   * policy.
    *
    * Configure this only when the app is always behind a platform or reverse
    * proxy that strips or normalizes forwarding headers. Without this option,
-   * CSRF uses `req.url` exactly as the adapter provided it.
+   * CSRF uses the `requestInfo` resolved by `createServer(...)`.
    */
   trustedProxy?: TrustedProxyConfig;
   /**
@@ -410,7 +411,7 @@ function enforceOrigin(args: {
   contract: HttpContractConfig;
   allowMissingOrigin: boolean;
   trustedOrigins: CsrfHooksOptions["trustedOrigins"];
-  trustedProxy: TrustedProxyConfig | undefined;
+  requestOrigin: string;
 }): void {
   const origin = originFromRequestHeaders(args.req);
   if (!origin) {
@@ -426,7 +427,7 @@ function enforceOrigin(args: {
       origin,
       req: args.req,
       contract: args.contract,
-      requestOrigin: requestOrigin(args.req, args.trustedProxy),
+      requestOrigin: args.requestOrigin,
       trustedOrigins: args.trustedOrigins,
     })
   ) {
@@ -485,7 +486,7 @@ export function createCsrfHooks<Ctx>(
 
   return {
     name: "csrf",
-    onRequest: async ({ req, contract, params }) => {
+    onRequest: async ({ req, requestInfo, contract, params }) => {
       if (!protectedMethods.has(req.method.toUpperCase())) return undefined;
       if (await options.skip?.({ req, contract, params })) return undefined;
 
@@ -494,7 +495,10 @@ export function createCsrfHooks<Ctx>(
         contract,
         allowMissingOrigin,
         trustedOrigins,
-        trustedProxy: options.trustedProxy,
+        requestOrigin:
+          options.trustedProxy !== undefined
+            ? requestOrigin(req, options.trustedProxy)
+            : (requestInfo?.origin ?? requestOrigin(req, false)),
       });
       enforceToken(req, token);
       return undefined;

package/src/server/http.ts

@@ -5,6 +5,10 @@ import type {
   StandardSchema,
 } from "../contracts/index.js";
 import type { AnyPorts } from "../ports/index.js";
+import type {
+  TrustedProxyConfig,
+  TrustedRequestInfo,
+} from "./trusted-proxy.js";
 
 /**
  * Framework-neutral request shape consumed by Beignet server adapters.
@@ -276,6 +280,7 @@ export type OnRequestHook<
   C extends HttpContractConfig = HttpContractConfig,
 > = (args: {
   req: HttpRequestLike;
+  requestInfo: TrustedRequestInfo;
   ports: Ports;
   contract: C;
   params: Record<string, string>;
@@ -303,6 +308,7 @@ export type BeforeHandleHook<
   C extends HttpContractConfig = HttpContractConfig,
 > = (args: {
   req: HttpRequestLike;
+  requestInfo: TrustedRequestInfo;
   ctx: Ctx;
   contract: C;
   path: InferPath<C>;
@@ -323,6 +329,7 @@ export type BeforeSendHook<
   C extends HttpContractConfig = HttpContractConfig,
 > = (args: {
   req: HttpRequestLike;
+  requestInfo: TrustedRequestInfo;
   ctx?: Ctx;
   contract: C;
   path?: InferPath<C>;
@@ -371,6 +378,7 @@ export type AfterSendHook<
   C extends HttpContractConfig = HttpContractConfig,
 > = (args: {
   req: HttpRequestLike;
+  requestInfo: TrustedRequestInfo;
   ctx?: Ctx;
   contract: C;
   path?: InferPath<C>;
@@ -395,6 +403,7 @@ export type ServerCaughtErrorHook<
 > = (args: {
   err: unknown;
   req: HttpRequestLike;
+  requestInfo?: TrustedRequestInfo;
   ctx?: Ctx;
   contract: C;
   path?: InferPath<C>;
@@ -415,6 +424,7 @@ export type ServerUnhandledErrorMapper<
 > = (args: {
   err: unknown;
   req: HttpRequestLike;
+  requestInfo?: TrustedRequestInfo;
   ctx?: Ctx;
   contract: C;
   path?: InferPath<C>;
@@ -447,7 +457,14 @@ export interface ServerHook<Ctx, Ports extends AnyPorts = AnyPorts> {
    * registered later through `server.route(...)` are not seen here, so hooks
    * that need full coverage should keep a runtime check as a backstop.
    */
-  validate?: (args: { contracts: readonly HttpContractConfig[] }) => void;
+  validate?: (args: {
+    contracts: readonly HttpContractConfig[];
+    /**
+     * Server-level trusted-proxy policy. Request phases receive its resolved
+     * value as `requestInfo`.
+     */
+    trustedProxy?: TrustedProxyConfig;
+  }) => void;
   /**
    * Runs after route matching and before body/query/header parsing.
    */

package/src/server/request-executor.ts

@@ -81,6 +81,7 @@ import {
   decodeMatchedParams,
   PathDecodeError,
 } from "./route-matching.js";
+import type { TrustedRequestInfo } from "./trusted-proxy.js";
 
 function withoutHeadResponseBody(
   response: HttpResponse,
@@ -133,6 +134,23 @@ type ExecutionTarget<Ctx, C extends HttpContractConfig> = {
   responseValidationExemptStatus?: number;
 };
 
+function copyTrustedRequestInfo(
+  requestInfo: TrustedRequestInfo,
+): TrustedRequestInfo;
+function copyTrustedRequestInfo(requestInfo: undefined): undefined;
+function copyTrustedRequestInfo(
+  requestInfo: TrustedRequestInfo | undefined,
+): TrustedRequestInfo | undefined;
+function copyTrustedRequestInfo(
+  requestInfo: TrustedRequestInfo | undefined,
+): TrustedRequestInfo | undefined {
+  if (!requestInfo) return undefined;
+  return {
+    ...requestInfo,
+    url: new URL(requestInfo.url),
+  };
+}
+
 /**
  * Build the per-request execution pipeline once.
  *
@@ -151,8 +169,10 @@ export function createRequestExecutor<
     createRequestContext: (
       req: HttpRequestLike,
       contract: HttpContractConfig,
+      requestInfo: TrustedRequestInfo,
     ) => Promise<Ctx>;
     finalizeContext: (seed: ContextSeed<Ctx> | Ctx) => Ctx;
+    resolveRequestInfo: (req: HttpRequestLike) => TrustedRequestInfo;
   },
   hooks: ServerHook<Ctx, FinalPorts>[],
   routeHooks: readonly RouteHook<unknown, object>[] = [],
@@ -179,6 +199,7 @@ export function createRequestExecutor<
     preMatchedParams?: Record<string, string>,
   ) => {
     const { contract, handler: userHandler } = target;
+    let requestInfo: TrustedRequestInfo | undefined;
     let baseCtx: Ctx | undefined;
     let pathValue: HandlerArgs<Ctx, C>["path"] | undefined;
     let queryValue: HandlerArgs<Ctx, C>["query"] | undefined;
@@ -224,6 +245,7 @@ export function createRequestExecutor<
         const args = {
           err: caught,
           req,
+          requestInfo: copyTrustedRequestInfo(requestInfo),
           ctx,
           contract,
           path,
@@ -364,6 +386,7 @@ export function createRequestExecutor<
           const handled = await hook.mapUnhandledError({
             err: currentError,
             req,
+            requestInfo: copyTrustedRequestInfo(requestInfo),
             ctx,
             contract,
             path,
@@ -391,6 +414,7 @@ export function createRequestExecutor<
           const handled = await options.mapUnhandledError({
             err: currentError,
             req,
+            requestInfo: copyTrustedRequestInfo(requestInfo),
             ctx,
             contract,
             path,
@@ -422,6 +446,8 @@ export function createRequestExecutor<
     };
 
     try {
+      const resolvedRequestInfo = contextRuntime.resolveRequestInfo(req);
+      requestInfo = resolvedRequestInfo;
       const url = new URL(req.url);
 
       let matchedParams: Record<string, string>;
@@ -460,6 +486,7 @@ export function createRequestExecutor<
           if (!hook.beforeSend) continue;
           const nextResponse = await hook.beforeSend({
             req,
+            requestInfo: copyTrustedRequestInfo(resolvedRequestInfo),
             ctx: initialResult.ctx,
             contract,
             path: pathValue,
@@ -515,6 +542,7 @@ export function createRequestExecutor<
             if (!hook.beforeSend) continue;
             const nextResponse = await hook.beforeSend({
               req,
+              requestInfo: copyTrustedRequestInfo(resolvedRequestInfo),
               ctx: initialResult.ctx,
               contract,
               path: pathValue,
@@ -612,6 +640,7 @@ export function createRequestExecutor<
         try {
           const hookResult = await hook.onRequest({
             req,
+            requestInfo: copyTrustedRequestInfo(resolvedRequestInfo),
             ports: finalPorts,
             contract,
             params: matchedParams,
@@ -644,7 +673,11 @@ export function createRequestExecutor<
           let createdCtx!: Ctx;
           try {
             createdCtx = await timeStage("contextMs", () =>
-              contextRuntime.createRequestContext(req, contract),
+              contextRuntime.createRequestContext(
+                req,
+                contract,
+                resolvedRequestInfo,
+              ),
             );
             baseCtx = createdCtx;
           } catch (error) {
@@ -727,7 +760,11 @@ export function createRequestExecutor<
             let createdCtx!: Ctx;
             try {
               createdCtx = await timeStage("contextMs", () =>
-                contextRuntime.createRequestContext(req, contract),
+                contextRuntime.createRequestContext(
+                  req,
+                  contract,
+                  resolvedRequestInfo,
+                ),
               );
               baseCtx = createdCtx;
             } catch (error) {
@@ -792,6 +829,7 @@ export function createRequestExecutor<
                   try {
                     const hookResult = await hook.beforeHandle({
                       req,
+                      requestInfo: copyTrustedRequestInfo(resolvedRequestInfo),
                       ctx: currentCtx,
                       contract,
                       path,
@@ -951,6 +989,7 @@ export function createRequestExecutor<
         try {
           await hook.afterSend({
             req,
+            requestInfo: copyTrustedRequestInfo(resolvedRequestInfo),
             ctx: result.ctx,
             contract,
             path: pathValue,
@@ -1110,8 +1149,10 @@ export function buildHandler<
     createRequestContext: (
       req: HttpRequestLike,
       contract: HttpContractConfig,
+      requestInfo: TrustedRequestInfo,
     ) => Promise<Ctx>;
     finalizeContext: (seed: ContextSeed<Ctx> | Ctx) => Ctx;
+    resolveRequestInfo: (req: HttpRequestLike) => TrustedRequestInfo;
   },
   contract: C,
   userHandler: Handler<Ctx, C>,

package/src/server/server-context.ts

@@ -16,10 +16,11 @@ import type { ServerContextConfig } from "./context.js";
  * // server/context.ts
  * export const appContext = defineServerContext<AppContext, AppPorts>()({
  *   gate: (ports) => ports.gate,
- *   request: async ({ req, ports, requestId, trace }) => ({
+ *   request: async ({ req, ports, requestId, requestInfo, trace }) => ({
  *     actor: await resolveActor(req),
  *     auth: null,
  *     requestId,
+ *     requestInfo,
  *     ...trace,
  *     ports,
  *   }),

package/src/server/server.ts

@@ -73,6 +73,12 @@ import {
 } from "./route-matching.js";
 import type { RuntimeIntegrityCheck } from "./runtime-integrity.js";
 import { runRuntimeIntegrityCheck } from "./runtime-integrity.js";
+import {
+  resolveTrustedRequest,
+  type TrustedProxyConfig,
+  type TrustedRequestInfo,
+} from "./trusted-proxy.js";
+import { assertValidTrustedProxyConfig } from "./trusted-proxy-internal.js";
 import {
   createUseCaseRouteHandler,
   isUseCaseRouteDef,
@@ -107,6 +113,15 @@ type AnyServiceProvider = ServiceProvider<
   any
 >;
 
+function copyTrustedRequestInfo(
+  requestInfo: TrustedRequestInfo,
+): TrustedRequestInfo {
+  return {
+    ...requestInfo,
+    url: new URL(requestInfo.url),
+  };
+}
+
 /**
  * Options for creating a Beignet server instance.
  */
@@ -155,6 +170,14 @@ export type CreateServerOptions<
     Ports & InferProviderPorts<Providers>,
     ServiceInput
   >;
+  /**
+   * Explicit policy for trusting proxy- or edge-provided request metadata.
+   *
+   * Forwarding headers are ignored by default. Configure this only when every
+   * request reaches the app through a trusted platform or reverse proxy that
+   * strips or normalizes those headers.
+   */
+  trustedProxy?: TrustedProxyConfig;
   /**
    * Server hooks that wrap every registered route.
    */
@@ -387,10 +410,12 @@ export async function createServer<
     ...((options.hooks ?? []) as ServerHook<Ctx, FinalPorts>[]),
   ];
   const contracts = options.routes ? contractsFromRoutes(options.routes) : [];
+  const trustedProxy = options.trustedProxy ?? false;
+  assertValidTrustedProxyConfig(trustedProxy);
 
   // Fail startup on hook misconfiguration before provider setup runs.
   for (const hook of hooks) {
-    hook.validate?.({ contracts });
+    hook.validate?.({ contracts, trustedProxy });
   }
 
   const resolvedContext = resolveServerContext<Ctx, FinalPorts, ServiceInput>(
@@ -403,11 +428,13 @@ export async function createServer<
   const createRequestContext = async (
     req: HttpRequestLike,
     contract?: HttpContractConfig,
+    requestInfo: TrustedRequestInfo = resolveTrustedRequest(req, trustedProxy),
   ): Promise<Ctx> => {
     const { requestId, trace } = instrumentation.prepareRequest(req);
     return finalizeContext(
       await resolvedContext.request({
         req,
+        requestInfo: copyTrustedRequestInfo(requestInfo),
         ports: finalPorts,
         contract,
         requestId,
@@ -502,6 +529,8 @@ export async function createServer<
   const contextRuntime = {
     createRequestContext,
     finalizeContext,
+    resolveRequestInfo: (req: HttpRequestLike) =>
+      resolveTrustedRequest(req, trustedProxy),
   };
 
   let serviceContextsAvailable = false;