@lunora/server 1.0.0-alpha.105 → 1.0.0-alpha.106

package/dist/types.d.mts

@@ -2246,10 +2246,18 @@ interface QueryCtx {
    */
   readonly env?: Record<string, unknown>;
   /**
-   * The caller's IP for this request — Cloudflare's trusted `CF-Connecting-IP`,
-   * forwarded server-side (never read from a client header). `undefined` when
-   * unknown: a live-subscription re-run, a server-initiated dispatch, or
-   * non-Cloudflare hosting. A convenient rate-limit key for anonymous traffic.
+   * The caller's IP for this request, or `undefined` when nothing trustworthy
+   * says who called.
+   *
+   * Populated only from Cloudflare's `CF-Connecting-IP`, forwarded server-side,
+   * and only while running ON Cloudflare — that is the one place the edge stamps
+   * the header over anything the client sent. On any other host it is a header
+   * the caller typed, so the runtime resolves nothing rather than hand a handler
+   * an attacker-chosen address; a rate limit keyed on a forgeable `ip` is worse
+   * than no limit, because it reads as enforced. `undefined` therefore covers: a
+   * live-subscription re-run, a server-initiated dispatch, and ANY non-Cloudflare
+   * host. A convenient rate-limit key for anonymous traffic on Cloudflare;
+   * elsewhere, key on something the caller cannot choose.
    */
   readonly ip?: string;
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */
@@ -2302,10 +2310,9 @@ interface MutationCtx {
    */
   readonly env?: Record<string, unknown>;
   /**
-   * The caller's IP for this request — Cloudflare's trusted `CF-Connecting-IP`,
-   * forwarded server-side (never read from a client header). `undefined` when
-   * unknown: a live-subscription re-run, a server-initiated dispatch, or
-   * non-Cloudflare hosting. A convenient rate-limit key for anonymous traffic.
+   * The caller's IP for this request, or `undefined` when nothing trustworthy
+   * says who called. Identical to {@link QueryCtx.ip} — see there for which
+   * host populates it and why every other one deliberately does not.
    */
   readonly ip?: string;
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */
@@ -2380,10 +2387,9 @@ interface ActionCtx {
   readonly env?: Record<string, unknown>;
   readonly fetch: typeof globalThis.fetch;
   /**
-   * The caller's IP for this request — Cloudflare's trusted `CF-Connecting-IP`,
-   * forwarded server-side (never read from a client header). `undefined` when
-   * unknown: a live-subscription re-run, a server-initiated dispatch, or
-   * non-Cloudflare hosting. A convenient rate-limit key for anonymous traffic.
+   * The caller's IP for this request, or `undefined` when nothing trustworthy
+   * says who called. Identical to {@link QueryCtx.ip} — see there for which
+   * host populates it and why every other one deliberately does not.
    */
   readonly ip?: string;
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */

package/dist/types.d.ts

@@ -2246,10 +2246,18 @@ interface QueryCtx {
    */
   readonly env?: Record<string, unknown>;
   /**
-   * The caller's IP for this request — Cloudflare's trusted `CF-Connecting-IP`,
-   * forwarded server-side (never read from a client header). `undefined` when
-   * unknown: a live-subscription re-run, a server-initiated dispatch, or
-   * non-Cloudflare hosting. A convenient rate-limit key for anonymous traffic.
+   * The caller's IP for this request, or `undefined` when nothing trustworthy
+   * says who called.
+   *
+   * Populated only from Cloudflare's `CF-Connecting-IP`, forwarded server-side,
+   * and only while running ON Cloudflare — that is the one place the edge stamps
+   * the header over anything the client sent. On any other host it is a header
+   * the caller typed, so the runtime resolves nothing rather than hand a handler
+   * an attacker-chosen address; a rate limit keyed on a forgeable `ip` is worse
+   * than no limit, because it reads as enforced. `undefined` therefore covers: a
+   * live-subscription re-run, a server-initiated dispatch, and ANY non-Cloudflare
+   * host. A convenient rate-limit key for anonymous traffic on Cloudflare;
+   * elsewhere, key on something the caller cannot choose.
    */
   readonly ip?: string;
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */
@@ -2302,10 +2310,9 @@ interface MutationCtx {
    */
   readonly env?: Record<string, unknown>;
   /**
-   * The caller's IP for this request — Cloudflare's trusted `CF-Connecting-IP`,
-   * forwarded server-side (never read from a client header). `undefined` when
-   * unknown: a live-subscription re-run, a server-initiated dispatch, or
-   * non-Cloudflare hosting. A convenient rate-limit key for anonymous traffic.
+   * The caller's IP for this request, or `undefined` when nothing trustworthy
+   * says who called. Identical to {@link QueryCtx.ip} — see there for which
+   * host populates it and why every other one deliberately does not.
    */
   readonly ip?: string;
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */
@@ -2380,10 +2387,9 @@ interface ActionCtx {
   readonly env?: Record<string, unknown>;
   readonly fetch: typeof globalThis.fetch;
   /**
-   * The caller's IP for this request — Cloudflare's trusted `CF-Connecting-IP`,
-   * forwarded server-side (never read from a client header). `undefined` when
-   * unknown: a live-subscription re-run, a server-initiated dispatch, or
-   * non-Cloudflare hosting. A convenient rate-limit key for anonymous traffic.
+   * The caller's IP for this request, or `undefined` when nothing trustworthy
+   * says who called. Identical to {@link QueryCtx.ip} — see there for which
+   * host populates it and why every other one deliberately does not.
    */
   readonly ip?: string;
   /** Structured, function-attributed logger; see {@link LunoraLogger}. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.105",
+  "version": "1.0.0-alpha.106",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",
@@ -66,9 +66,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.33",
-    "@lunora/scheduler": "1.0.0-alpha.54",
-    "@lunora/values": "1.0.0-alpha.41",
+    "@lunora/errors": "1.0.0-alpha.34",
+    "@lunora/scheduler": "1.0.0-alpha.56",
+    "@lunora/values": "1.0.0-alpha.42",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.13.1"
   },