@beignet/next 0.0.45 → 0.0.47

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @beignet/next
 
+## 0.0.47
+
+### Patch Changes
+
+- 3847e21: Resolve trusted request metadata once per request from a server-level policy and share it with context factories, security hooks, rate limiting, and logging observers.
+- Updated dependencies [3847e21]
+  - @beignet/web@0.0.47
+
+## 0.0.46
+
+### Patch Changes
+
+- @beignet/web@0.0.46
+
 ## 0.0.45
 
 ### Patch Changes

package/README.md

@@ -67,11 +67,15 @@ export const getTodo = todos
 
 This adapter quick start uses a tiny demo context. Production Beignet apps
 should use the canonical `AppContext` from the docs and generated starter:
-`requestId`, `actor`, `auth`, `gate`, `ports`, and optional `tenant`.
+`requestId`, `actor`, `auth`, `gate`, `ports`, and optional `requestInfo` and
+`tenant`.
 
 ```typescript
 // app-context.ts
+import type { TrustedRequestInfo } from "@beignet/core/server";
+
 export type AppContext = {
+  requestInfo: TrustedRequestInfo;
   userId: string;
 };
 ```
@@ -140,11 +144,12 @@ export const getServer = createNextServerLoader(() =>
   createNextServer<AppContext>({
     ports: {},
     routes,
-    context: async ({ req }) => {
+    context: async ({ req, requestInfo }) => {
       // DEMO ONLY: this reads an unauthenticated header to simulate identity.
       // Real applications should verify a signed token or session cookie first.
       return {
         userId: req.headers.get("x-user-id") || "anonymous",
+        requestInfo,
       };
     },
     mapUnhandledError: () => ({
@@ -158,6 +163,12 @@ export const getServer = createNextServerLoader(() =>
 );
 ```
 
+Set `trustedProxy` on `createNextServer(...)` only when every request passes
+through an edge that strips or normalizes forwarded headers. The context
+factory and server hooks then receive the same resolved `requestInfo` with the
+external URL, origin, host, protocol, and optional client IP. Forwarding
+headers are ignored when the option is omitted.
+
 ### 5. Set up routes
 
 Expose ordinary application routes through one catch-all framework route. Next
@@ -269,6 +280,8 @@ Creates a Next.js server instance with the given options.
   - `mapUnhandledError`: Error handler function
   - `routes?`: Array of route configurations (contract + handler)
   - `hooks?`: Optional ordered server hooks
+  - `trustedProxy?`: Explicit policy for trusted edge-provided host, protocol,
+    and client-IP metadata; forwarding headers are ignored when omitted
   - `providers?`: Optional array of service providers
   - `providerEnv?`: Optional environment variables for providers
   - `providerConfig?`: Optional provider configuration overrides

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beignet/next",
-  "version": "0.0.45",
+  "version": "0.0.47",
   "type": "module",
   "description": "Next.js server-side handlers for Beignet",
   "main": "./dist/index.js",
@@ -61,7 +61,7 @@
     "next": "^14.0.0 || ^15.0.0 || ^16.0.0"
   },
   "dependencies": {
-    "@beignet/web": "^0.0.45",
+    "@beignet/web": "^0.0.47",
     "@standard-schema/spec": "^1.0.0"
   },
   "devDependencies": {

package/skills/routes-server/SKILL.md

@@ -162,7 +162,12 @@ envelope; do not add a second operational response shape.
 ## Context
 
 `server/context.ts` should use `defineServerContext`. Request context reads the
-session, creates an actor, attaches ports, request IDs, and trace context.
+session, creates an actor, attaches ports, request IDs, trace context, and
+optional `requestInfo`. Configure `trustedProxy` once on `createNextServer(...)`
+when the deployment has a trusted edge; the context factory and server hooks
+then receive the same external URL, origin, host, protocol, and optional client
+IP. Forwarding headers remain untrusted by default, and apps choose whether to
+persist client IPs in logs or audit metadata.
 Service context is for schedules, tasks, outbox drains, and background work;
 create a service actor and do not assume a request session. Focused helpers
 such as `createOutboxDrainRoute(...)`, `createScheduleRoute(...)`, and webhook