@getstrata/core 0.7.5 → 1.0.1

package/dist/entries/database/model.js

@@ -298,8 +298,8 @@ function buildSelectList(table, select, params = []) {
   }
   return select.map((item) => {
     if (item.kind === "column") {
-      const column2 = qualifyColumn(item.table, item.column);
-      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
+      const column = qualifyColumn(item.table, item.column);
+      return item.as ? `${column} AS ${quoteIdentifier(item.as)}` : column;
     }
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
@@ -1919,8 +1919,8 @@ class Model {
     }
     if (updating) {
       const changes = applyTimestampsOnUpdate(table.columns, applyCasts(this.attributes, casts, "dehydrate"), timestamps);
-      const record2 = await this.repository.updateByIdOrThrow(this.id, changes);
-      this.attributes = ModelClass.hydrateAttributes(record2);
+      const record = await this.repository.updateByIdOrThrow(this.id, changes);
+      this.attributes = ModelClass.hydrateAttributes(record);
       await runObservers(this, "updated");
       await runObservers(this, "saved");
       return this;

package/dist/entries/database/mysqlConnection.js

@@ -23,13 +23,29 @@ function createMysqlConnectionFromPool(pool) {
     }
   };
 }
+var MYSQL_SESSION_UTC = "SET time_zone = '+00:00'";
+function pinSessionToUtc(connection) {
+  connection.query(MYSQL_SESSION_UTC, (error) => {
+    if (error) {
+      console.warn(`[mysql] Could not set the session time zone to UTC; DATETIME comparisons may drift: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  });
+}
+function createMysqlPool(url) {
+  const pool = mysql.createPool({ uri: url, timezone: "Z" });
+  pool.on("connection", (connection) => {
+    pinSessionToUtc(connection);
+  });
+  return pool;
+}
 function createMysqlConnection(url) {
   if (!url.trim()) {
     throw new Error("MYSQL_URL is not configured. Set url before creating a MySQL pool.");
   }
-  return createMysqlConnectionFromPool(mysql.createPool(url));
+  return createMysqlConnectionFromPool(createMysqlPool(url));
 }
 export {
   createMysqlConnection,
-  createMysqlConnectionFromPool
+  createMysqlConnectionFromPool,
+  createMysqlPool
 };

package/dist/entries/database/query.js

@@ -275,8 +275,8 @@ function buildSelectList(table, select, params = []) {
   }
   return select.map((item) => {
     if (item.kind === "column") {
-      const column2 = qualifyColumn(item.table, item.column);
-      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
+      const column = qualifyColumn(item.table, item.column);
+      return item.as ? `${column} AS ${quoteIdentifier(item.as)}` : column;
     }
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;

package/dist/entries/database/repositoryQuery.js

@@ -275,8 +275,8 @@ function buildSelectList(table, select, params = []) {
   }
   return select.map((item) => {
     if (item.kind === "column") {
-      const column2 = qualifyColumn(item.table, item.column);
-      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
+      const column = qualifyColumn(item.table, item.column);
+      return item.as ? `${column} AS ${quoteIdentifier(item.as)}` : column;
     }
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
@@ -925,50 +925,50 @@ class RepositoryQuery {
   }
   async hydrateEagerLoad(rows, result, load) {
     if (load.kind === "hasMany") {
-      const relation2 = load.relation;
-      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation2, load.options);
+      const relation = load.relation;
+      const grouped = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
+        row[load.as] = getByRelationKey(grouped, row[relation.localKey]) ?? [];
       }
       return;
     }
     if (load.kind === "morphMany") {
-      const relation2 = load.relation;
-      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation2, load.options);
+      const relation = load.relation;
+      const grouped = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
+        row[load.as] = getByRelationKey(grouped, row[relation.localKey]) ?? [];
       }
       return;
     }
     if (load.kind === "morphOne") {
-      const relation2 = load.relation;
-      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation2, load.options);
+      const relation = load.relation;
+      const grouped = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]);
+        row[load.as] = getByRelationKey(grouped, row[relation.localKey]);
       }
       return;
     }
     if (load.kind === "hasManyThrough") {
-      const relation2 = load.relation;
-      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyThroughForParents(rows, relation2, load.options);
+      const relation = load.relation;
+      const grouped = await load.repository.withConnection(this.repository.getConnection()).loadHasManyThroughForParents(rows, relation, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
+        row[load.as] = getByRelationKey(grouped, row[relation.localKey]) ?? [];
       }
       return;
     }
     if (load.kind === "belongsToMany") {
-      const relation2 = load.relation;
-      const grouped2 = await this.repository.loadBelongsToManyForParents(rows, relation2, load.repository, load.options);
+      const relation = load.relation;
+      const grouped = await this.repository.loadBelongsToManyForParents(rows, relation, load.repository, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.parentKey]) ?? [];
+        row[load.as] = getByRelationKey(grouped, row[relation.parentKey]) ?? [];
       }
       return;
     }
     if (load.kind === "morphTo") {
-      const relation2 = load.relation;
-      const grouped2 = await this.repository.loadMorphToForChildren(rows, relation2, load.morphRepositories ?? new Map, load.options);
+      const relation = load.relation;
+      const grouped = await this.repository.loadMorphToForChildren(rows, relation, load.morphRepositories ?? new Map, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.morphIdKey]);
+        row[load.as] = getByRelationKey(grouped, row[relation.morphIdKey]);
       }
       return;
     }

package/dist/entries/database/schema.js

@@ -542,8 +542,8 @@ function buildSelectList(table, select, params = []) {
   }
   return select.map((item) => {
     if (item.kind === "column") {
-      const column2 = qualifyColumn(item.table, item.column);
-      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
+      const column = qualifyColumn(item.table, item.column);
+      return item.as ? `${column} AS ${quoteIdentifier(item.as)}` : column;
     }
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;

package/dist/entries/database/sqliteConnection.js

@@ -14,6 +14,11 @@ function createSqliteConnection(filename) {
   }
   const db = new Database(filename, { create: true });
   db.exec("PRAGMA foreign_keys = ON");
+  db.exec("PRAGMA busy_timeout = 5000");
+  if (filename !== ":memory:") {
+    db.exec("PRAGMA journal_mode = WAL");
+    db.exec("PRAGMA synchronous = NORMAL");
+  }
   return {
     async unsafe(query, params = []) {
       const statement = db.query(query);

package/dist/entries/http/clientIp.js

@@ -1,19 +1,37 @@
 // @bun
 // ../../src/core/http/clientIp.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
 }
-function readClientIp(request, env = process.env) {
-  if (!trustForwardedFor(env)) {
-    return;
+function isPrivateAddress(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
+}
+function forwardedClientIp(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop && !isPrivateAddress(hop)) {
+      return hop;
+    }
   }
-  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
-  if (forwarded) {
-    return forwarded;
+  if (hops.length > 0) {
+    return hops[hops.length - 1];
   }
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
+function readClientIp(request, env = process.env) {
+  if (trustForwardedFor(env)) {
+    const forwarded = forwardedClientIp(request);
+    if (forwarded) {
+      return forwarded;
+    }
+  }
+  return currentRequestMeta().ipAddress ?? undefined;
+}
 export {
+  isPrivateAddress,
   readClientIp,
   trustForwardedFor
 };

package/dist/entries/http/corsMiddleware.js

@@ -1,8 +1,16 @@
 // @bun
+// ../../src/core/runtime/appEnv.ts
+function isProductionEnv(env = process.env) {
+  return env.APP_ENV === "production" || env.NODE_ENV === "production";
+}
+
 // ../../src/core/http/corsMiddleware.ts
+function defaultAllowedOrigins() {
+  return isProductionEnv() ? "" : "*";
+}
 function resolveCorsConfig() {
   return {
-    allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean),
+    allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? defaultAllowedOrigins()).split(",").map((origin) => origin.trim()).filter(Boolean),
     allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
     allowedHeaders: [
       "Authorization",
@@ -42,12 +50,15 @@ function buildCorsHeaders(request) {
   const origin = request.headers.get("origin");
   const corsConfig = resolveCorsConfig();
   const allowedOrigins = corsConfig.allowedOrigins;
-  const allowOrigin = allowedOrigins.includes("*") || origin && allowedOrigins.includes(origin) ? origin ?? "*" : allowedOrigins[0] ?? "*";
+  headers.set("Vary", "Origin");
+  const allowOrigin = allowedOrigins.includes("*") ? "*" : origin && allowedOrigins.includes(origin) ? origin : null;
+  if (!allowOrigin) {
+    return headers;
+  }
   headers.set("Access-Control-Allow-Origin", allowOrigin);
   headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
   headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
   headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
-  headers.set("Vary", "Origin");
   return headers;
 }
 export {

package/dist/entries/http/loginThrottleMiddleware.js

@@ -57,19 +57,36 @@ function sdkClientClassName() {
 }
 
 // ../../src/core/http/clientIp.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
 }
-function readClientIp(request, env = process.env) {
-  if (!trustForwardedFor(env)) {
-    return;
+function isPrivateAddress(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
+}
+function forwardedClientIp(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop && !isPrivateAddress(hop)) {
+      return hop;
+    }
   }
-  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
-  if (forwarded) {
-    return forwarded;
+  if (hops.length > 0) {
+    return hops[hops.length - 1];
   }
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
+function readClientIp(request, env = process.env) {
+  if (trustForwardedFor(env)) {
+    const forwarded = forwardedClientIp(request);
+    if (forwarded) {
+      return forwarded;
+    }
+  }
+  return currentRequestMeta().ipAddress ?? undefined;
+}
 
 // ../../src/core/runtime/frontendMode.ts
 var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
@@ -111,7 +128,7 @@ function readSpaPrefix() {
 }
 
 // ../../src/core/view/webErrorView.ts
-import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
 
 // ../../src/core/view/htmlResponse.ts
 function withCharset(contentType) {
@@ -212,7 +229,7 @@ async function renderWebErrorHtml(input) {
   try {
     return await render({
       ...input,
-      request: input.request ?? currentRequestMeta().request
+      request: input.request ?? currentRequestMeta2().request
     });
   } catch {
     return renderKernelErrorChrome(input);

package/dist/entries/http/memoryThrottleMiddleware.js

@@ -54,19 +54,36 @@ function sdkClientClassName() {
 }
 
 // ../../src/core/http/clientIp.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
 }
-function readClientIp(request, env = process.env) {
-  if (!trustForwardedFor(env)) {
-    return;
+function isPrivateAddress(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
+}
+function forwardedClientIp(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop && !isPrivateAddress(hop)) {
+      return hop;
+    }
   }
-  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
-  if (forwarded) {
-    return forwarded;
+  if (hops.length > 0) {
+    return hops[hops.length - 1];
   }
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
+function readClientIp(request, env = process.env) {
+  if (trustForwardedFor(env)) {
+    const forwarded = forwardedClientIp(request);
+    if (forwarded) {
+      return forwarded;
+    }
+  }
+  return currentRequestMeta().ipAddress ?? undefined;
+}
 
 // ../../src/core/runtime/frontendMode.ts
 var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
@@ -108,7 +125,7 @@ function readSpaPrefix() {
 }
 
 // ../../src/core/view/webErrorView.ts
-import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
 
 // ../../src/core/view/htmlResponse.ts
 function withCharset(contentType) {
@@ -209,7 +226,7 @@ async function renderWebErrorHtml(input) {
   try {
     return await render({
       ...input,
-      request: input.request ?? currentRequestMeta().request
+      request: input.request ?? currentRequestMeta2().request
     });
   } catch {
     return renderKernelErrorChrome(input);

package/dist/entries/http/response.js

@@ -6,6 +6,7 @@ import { toHttpError as toHttpError3 } from "@getstrata/core/errors/http";
 import {
   BadRequestError,
   ConflictError,
+  InternalServerError,
   toHttpError,
   UnprocessableEntityError
 } from "@getstrata/core/errors/http";
@@ -24,14 +25,55 @@ function getPostgresSqlState(error) {
   }
   return;
 }
+var MYSQL_ERRNO_MESSAGES = {
+  1062: () => new ConflictError("A record with these values already exists."),
+  1451: () => new UnprocessableEntityError("Record is still referenced by other records."),
+  1452: () => new UnprocessableEntityError("Referenced record does not exist."),
+  1048: () => new BadRequestError("Required field is missing."),
+  3819: () => new BadRequestError("Value violates a database constraint.")
+};
+function mapSqliteError(error) {
+  const code = typeof error.code === "string" ? error.code : "";
+  if (!code.startsWith("SQLITE_")) {
+    return null;
+  }
+  if (code === "SQLITE_CONSTRAINT_UNIQUE" || code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+    return new ConflictError("A record with these values already exists.");
+  }
+  if (code === "SQLITE_CONSTRAINT_FOREIGNKEY") {
+    return new UnprocessableEntityError("Referenced record does not exist.");
+  }
+  if (code === "SQLITE_CONSTRAINT_NOTNULL") {
+    return new BadRequestError("Required field is missing.");
+  }
+  if (code.startsWith("SQLITE_CONSTRAINT")) {
+    return new BadRequestError("Value violates a database constraint.");
+  }
+  return new InternalServerError("Database operation failed.");
+}
+function mapMysqlError(error) {
+  const code = typeof error.code === "string" ? error.code : "";
+  if (!code.startsWith("ER_")) {
+    return null;
+  }
+  const factory = typeof error.errno === "number" ? MYSQL_ERRNO_MESSAGES[error.errno] : undefined;
+  return factory ? factory() : new InternalServerError("Database operation failed.");
+}
 function mapDatabaseError(error) {
   const httpError = toHttpError(error);
   if (httpError) {
     return httpError;
   }
   if (!isPostgresError(error)) {
-    const message = error instanceof Error ? error.message : "Database operation failed.";
-    return new BadRequestError(message);
+    return new InternalServerError;
+  }
+  const sqlite = mapSqliteError(error);
+  if (sqlite) {
+    return sqlite;
+  }
+  const mysql = mapMysqlError(error);
+  if (mysql) {
+    return mysql;
   }
   const sqlState = getPostgresSqlState(error);
   switch (sqlState) {
@@ -52,10 +94,7 @@ function mapDatabaseError(error) {
         constraint: error.constraint
       });
     default:
-      return new BadRequestError(error.message ?? "Database operation failed.", {
-        code: error.code,
-        sqlState
-      });
+      return new InternalServerError("Database operation failed.");
   }
 }
 async function withDatabaseErrorHandling(operation) {
@@ -68,6 +107,12 @@ async function withDatabaseErrorHandling(operation) {
 
 // ../../src/core/http/webErrorResponse.ts
 import { toHttpError as toHttpError2, ValidationError } from "@getstrata/core/errors/http";
+import { appLogger } from "@getstrata/core/logging/logger";
+
+// ../../src/core/runtime/appEnv.ts
+function isProductionEnv(env = process.env) {
+  return env.APP_ENV === "production" || env.NODE_ENV === "production";
+}
 
 // ../../src/core/runtime/frontendMode.ts
 var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
@@ -319,14 +364,27 @@ function errorPageTitle(status, message) {
   return message;
 }
 function publicErrorMessage(status, message) {
-  if (status >= 500 && false) {}
+  if (status >= 500 && isProductionEnv()) {
+    return "Something went wrong.";
+  }
   return message;
 }
+function logServerError(error, mappedError) {
+  if (mappedError.status < 500) {
+    return;
+  }
+  appLogger.error("Unhandled request error", {
+    status: mappedError.status,
+    error: error instanceof Error ? error.message : String(error),
+    stack: error instanceof Error ? error.stack : undefined
+  });
+}
 async function webErrorResponse(error, request) {
   if (!request || !isViewsEnabled() || requestPrefersJson(request)) {
     return null;
   }
   const mappedError = toHttpError2(error) ?? mapDatabaseError(error);
+  logServerError(error, mappedError);
   if (mappedError.status === 401) {
     return Response.redirect(loginRedirectLocation(request), 302);
   }
@@ -355,6 +413,7 @@ function noContentResponse() {
 }
 function errorResponse(error) {
   const mappedError = toHttpError3(error) ?? mapDatabaseError(error);
+  logServerError(error, mappedError);
   return Response.json({
     error: mappedError.message,
     ...mappedError.details === undefined ? {} : { details: mappedError.details }

package/dist/entries/http/scimThrottleMiddleware.js

@@ -57,19 +57,36 @@ function sdkClientClassName() {
 }
 
 // ../../src/core/http/clientIp.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
 }
-function readClientIp(request, env = process.env) {
-  if (!trustForwardedFor(env)) {
-    return;
+function isPrivateAddress(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
+}
+function forwardedClientIp(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop && !isPrivateAddress(hop)) {
+      return hop;
+    }
   }
-  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
-  if (forwarded) {
-    return forwarded;
+  if (hops.length > 0) {
+    return hops[hops.length - 1];
   }
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
+function readClientIp(request, env = process.env) {
+  if (trustForwardedFor(env)) {
+    const forwarded = forwardedClientIp(request);
+    if (forwarded) {
+      return forwarded;
+    }
+  }
+  return currentRequestMeta().ipAddress ?? undefined;
+}
 
 // ../../src/core/http/scimThrottleMiddleware.ts
 var memoryBuckets = new Map;

package/dist/entries/http/throttleMiddleware.js

@@ -59,19 +59,36 @@ function sdkClientClassName() {
 }
 
 // ../../src/core/http/clientIp.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
 }
-function readClientIp(request, env = process.env) {
-  if (!trustForwardedFor(env)) {
-    return;
+function isPrivateAddress(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
+}
+function forwardedClientIp(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop && !isPrivateAddress(hop)) {
+      return hop;
+    }
   }
-  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
-  if (forwarded) {
-    return forwarded;
+  if (hops.length > 0) {
+    return hops[hops.length - 1];
   }
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
+function readClientIp(request, env = process.env) {
+  if (trustForwardedFor(env)) {
+    const forwarded = forwardedClientIp(request);
+    if (forwarded) {
+      return forwarded;
+    }
+  }
+  return currentRequestMeta().ipAddress ?? undefined;
+}
 
 // ../../src/core/runtime/frontendMode.ts
 var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
@@ -113,7 +130,7 @@ function readSpaPrefix() {
 }
 
 // ../../src/core/view/webErrorView.ts
-import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
 
 // ../../src/core/view/htmlResponse.ts
 function withCharset(contentType) {
@@ -214,7 +231,7 @@ async function renderWebErrorHtml(input) {
   try {
     return await render({
       ...input,
-      request: input.request ?? currentRequestMeta().request
+      request: input.request ?? currentRequestMeta2().request
     });
   } catch {
     return renderKernelErrorChrome(input);