@getstrata/core 1.0.0 → 1.0.2

package/dist/entries/http/clientIp.js

@@ -1,19 +1,37 @@
 // @bun
 // ../../src/core/http/clientIp.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
 }
-function readClientIp(request, env = process.env) {
-  if (!trustForwardedFor(env)) {
-    return;
+function isPrivateAddress(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
+}
+function forwardedClientIp(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop && !isPrivateAddress(hop)) {
+      return hop;
+    }
   }
-  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
-  if (forwarded) {
-    return forwarded;
+  if (hops.length > 0) {
+    return hops[hops.length - 1];
   }
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
+function readClientIp(request, env = process.env) {
+  if (trustForwardedFor(env)) {
+    const forwarded = forwardedClientIp(request);
+    if (forwarded) {
+      return forwarded;
+    }
+  }
+  return currentRequestMeta().ipAddress ?? undefined;
+}
 export {
+  isPrivateAddress,
   readClientIp,
   trustForwardedFor
 };

package/dist/entries/http/corsMiddleware.js

@@ -1,8 +1,16 @@
 // @bun
+// ../../src/core/runtime/appEnv.ts
+function isProductionEnv(env = process.env) {
+  return env.APP_ENV === "production" || env.NODE_ENV === "production";
+}
+
 // ../../src/core/http/corsMiddleware.ts
+function defaultAllowedOrigins() {
+  return isProductionEnv() ? "" : "*";
+}
 function resolveCorsConfig() {
   return {
-    allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean),
+    allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? defaultAllowedOrigins()).split(",").map((origin) => origin.trim()).filter(Boolean),
     allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
     allowedHeaders: [
       "Authorization",
@@ -42,12 +50,15 @@ function buildCorsHeaders(request) {
   const origin = request.headers.get("origin");
   const corsConfig = resolveCorsConfig();
   const allowedOrigins = corsConfig.allowedOrigins;
-  const allowOrigin = allowedOrigins.includes("*") || origin && allowedOrigins.includes(origin) ? origin ?? "*" : allowedOrigins[0] ?? "*";
+  headers.set("Vary", "Origin");
+  const allowOrigin = allowedOrigins.includes("*") ? "*" : origin && allowedOrigins.includes(origin) ? origin : null;
+  if (!allowOrigin) {
+    return headers;
+  }
   headers.set("Access-Control-Allow-Origin", allowOrigin);
   headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
   headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
   headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
-  headers.set("Vary", "Origin");
   return headers;
 }
 export {

package/dist/entries/http/loginThrottleMiddleware.js

@@ -57,19 +57,36 @@ function sdkClientClassName() {
 }
 
 // ../../src/core/http/clientIp.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
 }
-function readClientIp(request, env = process.env) {
-  if (!trustForwardedFor(env)) {
-    return;
+function isPrivateAddress(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
+}
+function forwardedClientIp(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop && !isPrivateAddress(hop)) {
+      return hop;
+    }
   }
-  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
-  if (forwarded) {
-    return forwarded;
+  if (hops.length > 0) {
+    return hops[hops.length - 1];
   }
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
+function readClientIp(request, env = process.env) {
+  if (trustForwardedFor(env)) {
+    const forwarded = forwardedClientIp(request);
+    if (forwarded) {
+      return forwarded;
+    }
+  }
+  return currentRequestMeta().ipAddress ?? undefined;
+}
 
 // ../../src/core/runtime/frontendMode.ts
 var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
@@ -111,7 +128,7 @@ function readSpaPrefix() {
 }
 
 // ../../src/core/view/webErrorView.ts
-import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
 
 // ../../src/core/view/htmlResponse.ts
 function withCharset(contentType) {
@@ -212,7 +229,7 @@ async function renderWebErrorHtml(input) {
   try {
     return await render({
       ...input,
-      request: input.request ?? currentRequestMeta().request
+      request: input.request ?? currentRequestMeta2().request
     });
   } catch {
     return renderKernelErrorChrome(input);

package/dist/entries/http/memoryThrottleMiddleware.js

@@ -54,19 +54,36 @@ function sdkClientClassName() {
 }
 
 // ../../src/core/http/clientIp.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
 }
-function readClientIp(request, env = process.env) {
-  if (!trustForwardedFor(env)) {
-    return;
+function isPrivateAddress(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
+}
+function forwardedClientIp(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop && !isPrivateAddress(hop)) {
+      return hop;
+    }
   }
-  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
-  if (forwarded) {
-    return forwarded;
+  if (hops.length > 0) {
+    return hops[hops.length - 1];
   }
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
+function readClientIp(request, env = process.env) {
+  if (trustForwardedFor(env)) {
+    const forwarded = forwardedClientIp(request);
+    if (forwarded) {
+      return forwarded;
+    }
+  }
+  return currentRequestMeta().ipAddress ?? undefined;
+}
 
 // ../../src/core/runtime/frontendMode.ts
 var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
@@ -108,7 +125,7 @@ function readSpaPrefix() {
 }
 
 // ../../src/core/view/webErrorView.ts
-import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
 
 // ../../src/core/view/htmlResponse.ts
 function withCharset(contentType) {
@@ -209,7 +226,7 @@ async function renderWebErrorHtml(input) {
   try {
     return await render({
       ...input,
-      request: input.request ?? currentRequestMeta().request
+      request: input.request ?? currentRequestMeta2().request
     });
   } catch {
     return renderKernelErrorChrome(input);

package/dist/entries/http/response.js

@@ -6,6 +6,7 @@ import { toHttpError as toHttpError3 } from "@getstrata/core/errors/http";
 import {
   BadRequestError,
   ConflictError,
+  InternalServerError,
   toHttpError,
   UnprocessableEntityError
 } from "@getstrata/core/errors/http";
@@ -24,14 +25,55 @@ function getPostgresSqlState(error) {
   }
   return;
 }
+var MYSQL_ERRNO_MESSAGES = {
+  1062: () => new ConflictError("A record with these values already exists."),
+  1451: () => new UnprocessableEntityError("Record is still referenced by other records."),
+  1452: () => new UnprocessableEntityError("Referenced record does not exist."),
+  1048: () => new BadRequestError("Required field is missing."),
+  3819: () => new BadRequestError("Value violates a database constraint.")
+};
+function mapSqliteError(error) {
+  const code = typeof error.code === "string" ? error.code : "";
+  if (!code.startsWith("SQLITE_")) {
+    return null;
+  }
+  if (code === "SQLITE_CONSTRAINT_UNIQUE" || code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+    return new ConflictError("A record with these values already exists.");
+  }
+  if (code === "SQLITE_CONSTRAINT_FOREIGNKEY") {
+    return new UnprocessableEntityError("Referenced record does not exist.");
+  }
+  if (code === "SQLITE_CONSTRAINT_NOTNULL") {
+    return new BadRequestError("Required field is missing.");
+  }
+  if (code.startsWith("SQLITE_CONSTRAINT")) {
+    return new BadRequestError("Value violates a database constraint.");
+  }
+  return new InternalServerError("Database operation failed.");
+}
+function mapMysqlError(error) {
+  const code = typeof error.code === "string" ? error.code : "";
+  if (!code.startsWith("ER_")) {
+    return null;
+  }
+  const factory = typeof error.errno === "number" ? MYSQL_ERRNO_MESSAGES[error.errno] : undefined;
+  return factory ? factory() : new InternalServerError("Database operation failed.");
+}
 function mapDatabaseError(error) {
   const httpError = toHttpError(error);
   if (httpError) {
     return httpError;
   }
   if (!isPostgresError(error)) {
-    const message = error instanceof Error ? error.message : "Database operation failed.";
-    return new BadRequestError(message);
+    return new InternalServerError;
+  }
+  const sqlite = mapSqliteError(error);
+  if (sqlite) {
+    return sqlite;
+  }
+  const mysql = mapMysqlError(error);
+  if (mysql) {
+    return mysql;
   }
   const sqlState = getPostgresSqlState(error);
   switch (sqlState) {
@@ -52,10 +94,7 @@ function mapDatabaseError(error) {
         constraint: error.constraint
       });
     default:
-      return new BadRequestError(error.message ?? "Database operation failed.", {
-        code: error.code,
-        sqlState
-      });
+      return new InternalServerError("Database operation failed.");
   }
 }
 async function withDatabaseErrorHandling(operation) {
@@ -68,6 +107,12 @@ async function withDatabaseErrorHandling(operation) {
 
 // ../../src/core/http/webErrorResponse.ts
 import { toHttpError as toHttpError2, ValidationError } from "@getstrata/core/errors/http";
+import { appLogger } from "@getstrata/core/logging/logger";
+
+// ../../src/core/runtime/appEnv.ts
+function isProductionEnv(env = process.env) {
+  return env.APP_ENV === "production" || env.NODE_ENV === "production";
+}
 
 // ../../src/core/runtime/frontendMode.ts
 var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
@@ -319,14 +364,27 @@ function errorPageTitle(status, message) {
   return message;
 }
 function publicErrorMessage(status, message) {
-  if (status >= 500 && false) {}
+  if (status >= 500 && isProductionEnv()) {
+    return "Something went wrong.";
+  }
   return message;
 }
+function logServerError(error, mappedError) {
+  if (mappedError.status < 500) {
+    return;
+  }
+  appLogger.error("Unhandled request error", {
+    status: mappedError.status,
+    error: error instanceof Error ? error.message : String(error),
+    stack: error instanceof Error ? error.stack : undefined
+  });
+}
 async function webErrorResponse(error, request) {
   if (!request || !isViewsEnabled() || requestPrefersJson(request)) {
     return null;
   }
   const mappedError = toHttpError2(error) ?? mapDatabaseError(error);
+  logServerError(error, mappedError);
   if (mappedError.status === 401) {
     return Response.redirect(loginRedirectLocation(request), 302);
   }
@@ -355,6 +413,7 @@ function noContentResponse() {
 }
 function errorResponse(error) {
   const mappedError = toHttpError3(error) ?? mapDatabaseError(error);
+  logServerError(error, mappedError);
   return Response.json({
     error: mappedError.message,
     ...mappedError.details === undefined ? {} : { details: mappedError.details }

package/dist/entries/http/scimThrottleMiddleware.js

@@ -57,19 +57,36 @@ function sdkClientClassName() {
 }
 
 // ../../src/core/http/clientIp.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
 }
-function readClientIp(request, env = process.env) {
-  if (!trustForwardedFor(env)) {
-    return;
+function isPrivateAddress(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
+}
+function forwardedClientIp(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop && !isPrivateAddress(hop)) {
+      return hop;
+    }
   }
-  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
-  if (forwarded) {
-    return forwarded;
+  if (hops.length > 0) {
+    return hops[hops.length - 1];
   }
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
+function readClientIp(request, env = process.env) {
+  if (trustForwardedFor(env)) {
+    const forwarded = forwardedClientIp(request);
+    if (forwarded) {
+      return forwarded;
+    }
+  }
+  return currentRequestMeta().ipAddress ?? undefined;
+}
 
 // ../../src/core/http/scimThrottleMiddleware.ts
 var memoryBuckets = new Map;

package/dist/entries/http/throttleMiddleware.js

@@ -59,19 +59,36 @@ function sdkClientClassName() {
 }
 
 // ../../src/core/http/clientIp.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
 }
-function readClientIp(request, env = process.env) {
-  if (!trustForwardedFor(env)) {
-    return;
+function isPrivateAddress(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
+}
+function forwardedClientIp(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop && !isPrivateAddress(hop)) {
+      return hop;
+    }
   }
-  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
-  if (forwarded) {
-    return forwarded;
+  if (hops.length > 0) {
+    return hops[hops.length - 1];
   }
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
+function readClientIp(request, env = process.env) {
+  if (trustForwardedFor(env)) {
+    const forwarded = forwardedClientIp(request);
+    if (forwarded) {
+      return forwarded;
+    }
+  }
+  return currentRequestMeta().ipAddress ?? undefined;
+}
 
 // ../../src/core/runtime/frontendMode.ts
 var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
@@ -113,7 +130,7 @@ function readSpaPrefix() {
 }
 
 // ../../src/core/view/webErrorView.ts
-import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
 
 // ../../src/core/view/htmlResponse.ts
 function withCharset(contentType) {
@@ -214,7 +231,7 @@ async function renderWebErrorHtml(input) {
   try {
     return await render({
       ...input,
-      request: input.request ?? currentRequestMeta().request
+      request: input.request ?? currentRequestMeta2().request
     });
   } catch {
     return renderKernelErrorChrome(input);

package/dist/entries/http/webErrorResponse.js

@@ -1,11 +1,13 @@
 // @bun
 // ../../src/core/http/webErrorResponse.ts
 import { toHttpError as toHttpError2, ValidationError } from "@getstrata/core/errors/http";
+import { appLogger } from "@getstrata/core/logging/logger";
 
 // ../../src/core/database/errors.ts
 import {
   BadRequestError,
   ConflictError,
+  InternalServerError,
   toHttpError,
   UnprocessableEntityError
 } from "@getstrata/core/errors/http";
@@ -24,14 +26,55 @@ function getPostgresSqlState(error) {
   }
   return;
 }
+var MYSQL_ERRNO_MESSAGES = {
+  1062: () => new ConflictError("A record with these values already exists."),
+  1451: () => new UnprocessableEntityError("Record is still referenced by other records."),
+  1452: () => new UnprocessableEntityError("Referenced record does not exist."),
+  1048: () => new BadRequestError("Required field is missing."),
+  3819: () => new BadRequestError("Value violates a database constraint.")
+};
+function mapSqliteError(error) {
+  const code = typeof error.code === "string" ? error.code : "";
+  if (!code.startsWith("SQLITE_")) {
+    return null;
+  }
+  if (code === "SQLITE_CONSTRAINT_UNIQUE" || code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+    return new ConflictError("A record with these values already exists.");
+  }
+  if (code === "SQLITE_CONSTRAINT_FOREIGNKEY") {
+    return new UnprocessableEntityError("Referenced record does not exist.");
+  }
+  if (code === "SQLITE_CONSTRAINT_NOTNULL") {
+    return new BadRequestError("Required field is missing.");
+  }
+  if (code.startsWith("SQLITE_CONSTRAINT")) {
+    return new BadRequestError("Value violates a database constraint.");
+  }
+  return new InternalServerError("Database operation failed.");
+}
+function mapMysqlError(error) {
+  const code = typeof error.code === "string" ? error.code : "";
+  if (!code.startsWith("ER_")) {
+    return null;
+  }
+  const factory = typeof error.errno === "number" ? MYSQL_ERRNO_MESSAGES[error.errno] : undefined;
+  return factory ? factory() : new InternalServerError("Database operation failed.");
+}
 function mapDatabaseError(error) {
   const httpError = toHttpError(error);
   if (httpError) {
     return httpError;
   }
   if (!isPostgresError(error)) {
-    const message = error instanceof Error ? error.message : "Database operation failed.";
-    return new BadRequestError(message);
+    return new InternalServerError;
+  }
+  const sqlite = mapSqliteError(error);
+  if (sqlite) {
+    return sqlite;
+  }
+  const mysql = mapMysqlError(error);
+  if (mysql) {
+    return mysql;
   }
   const sqlState = getPostgresSqlState(error);
   switch (sqlState) {
@@ -52,10 +95,7 @@ function mapDatabaseError(error) {
         constraint: error.constraint
       });
     default:
-      return new BadRequestError(error.message ?? "Database operation failed.", {
-        code: error.code,
-        sqlState
-      });
+      return new InternalServerError("Database operation failed.");
   }
 }
 async function withDatabaseErrorHandling(operation) {
@@ -66,6 +106,11 @@ async function withDatabaseErrorHandling(operation) {
   }
 }
 
+// ../../src/core/runtime/appEnv.ts
+function isProductionEnv(env = process.env) {
+  return env.APP_ENV === "production" || env.NODE_ENV === "production";
+}
+
 // ../../src/core/runtime/frontendMode.ts
 var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
 var DEFAULT_SPA_PREFIX = "/app";
@@ -316,14 +361,27 @@ function errorPageTitle(status, message) {
   return message;
 }
 function publicErrorMessage(status, message) {
-  if (status >= 500 && false) {}
+  if (status >= 500 && isProductionEnv()) {
+    return "Something went wrong.";
+  }
   return message;
 }
+function logServerError(error, mappedError) {
+  if (mappedError.status < 500) {
+    return;
+  }
+  appLogger.error("Unhandled request error", {
+    status: mappedError.status,
+    error: error instanceof Error ? error.message : String(error),
+    stack: error instanceof Error ? error.stack : undefined
+  });
+}
 async function webErrorResponse(error, request) {
   if (!request || !isViewsEnabled() || requestPrefersJson(request)) {
     return null;
   }
   const mappedError = toHttpError2(error) ?? mapDatabaseError(error);
+  logServerError(error, mappedError);
   if (mappedError.status === 401) {
     return Response.redirect(loginRedirectLocation(request), 302);
   }
@@ -337,6 +395,7 @@ async function webErrorResponse(error, request) {
   });
 }
 export {
+  logServerError,
   normalizeFieldErrors,
   webErrorResponse
 };

package/dist/entries/jobs/exportAuditLogsJob.js

@@ -191,14 +191,16 @@ async function safeFetch(input, init = {}, options = {}) {
 import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
 
 // ../../src/core/tenant/tenancyConfig.ts
+var TENANCY_DRIVERS = ["rls", "column", "none"];
 function readTenancyDriver(env = process.env) {
-  if (env.TENANCY_DRIVER === "none") {
-    return "none";
+  const raw = env.TENANCY_DRIVER?.trim();
+  if (raw === undefined || raw === "") {
+    return "rls";
   }
-  if (env.TENANCY_DRIVER === "column") {
-    return "column";
+  if (TENANCY_DRIVERS.includes(raw)) {
+    return raw;
   }
-  return "rls";
+  throw new Error(`TENANCY_DRIVER must be one of ${TENANCY_DRIVERS.join(", ")}; received "${raw}".`);
 }
 function isTenancyEnabled(env = process.env) {
   return readTenancyDriver(env) !== "none";

package/dist/entries/logging/requestLoggingMiddleware.js

@@ -1,21 +1,38 @@
 // @bun
 // ../../src/core/logging/requestLoggingMiddleware.ts
-import { currentRequestMeta, runWithRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { currentRequestMeta as currentRequestMeta2, runWithRequestMeta } from "@getstrata/core/http/requestMetaContext";
 
 // ../../src/core/http/clientIp.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 function trustForwardedFor(env = process.env) {
   return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
 }
-function readClientIp(request, env = process.env) {
-  if (!trustForwardedFor(env)) {
-    return;
+function isPrivateAddress(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
+}
+function forwardedClientIp(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop && !isPrivateAddress(hop)) {
+      return hop;
+    }
   }
-  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
-  if (forwarded) {
-    return forwarded;
+  if (hops.length > 0) {
+    return hops[hops.length - 1];
   }
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
+function readClientIp(request, env = process.env) {
+  if (trustForwardedFor(env)) {
+    const forwarded = forwardedClientIp(request);
+    if (forwarded) {
+      return forwarded;
+    }
+  }
+  return currentRequestMeta().ipAddress ?? undefined;
+}
 
 // ../../src/core/logging/logger.ts
 class Logger {
@@ -56,9 +73,10 @@ var appLogger = new Logger("app");
 // ../../src/core/logging/requestLoggingMiddleware.ts
 function createRequestLoggingMiddleware() {
   return async (request, next) => {
+    const ipAddress = readClientIp(request) ?? null;
     return await runWithRequestMeta({
-      ...currentRequestMeta(),
-      ipAddress: readClientIp(request) ?? null,
+      ...currentRequestMeta2(),
+      ipAddress,
       userAgent: request.headers.get("user-agent"),
       request
     }, async () => {
@@ -71,7 +89,8 @@ function createRequestLoggingMiddleware() {
         method: request.method,
         path: new URL(request.url).pathname,
         status: response.status,
-        durationMs
+        durationMs,
+        ipAddress
       });
       return response;
     });

package/dist/entries/openapi/generator.js

@@ -103,7 +103,7 @@ var PUBLIC_ROUTE_DESCRIPTIONS = {
   "GET /health": "Liveness probe",
   "GET /ready": "Readiness probe",
   "GET /metrics": "Prometheus metrics",
-  "GET /api/user": "Current authenticated HiroApp user",
+  "GET /api/user": "Current authenticated user",
   "POST /api/login": "Login with email and password",
   "POST /api/auth/token": "Mint a short-lived JWT with email and password",
   "POST /api/apply/login": "Candidate portal login (opaque token)",