bunderstack 0.24.2 → 0.24.3

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to `bunderstack` will be documented in this file.
 
+## [0.24.3] — 2026-09-16
+
+### Fixed
+
+- Prefer the configured `APP_URL` when resolving relative API URLs during
+  server-side rendering. Internal HTTP reverse-proxy requests no longer
+  override the public HTTPS origin and cause unhandled redirects in RPC
+  clients. Browser requests and the request-origin fallback are unchanged.
+
 ## [0.24.2] — 2026-09-14
 
 ### Fixed

package/dist/start/isomorphic-fetch.d.ts

@@ -1,8 +1,9 @@
 /**
  * SSR-aware fetch: the browser passes `/api/...` through as-is; on the
- * server, relative URLs are resolved against the incoming request's origin
- * (via @tanstack/react-start/server), falling back to APP_URL /
- * BETTER_AUTH_URL / localhost:3000 outside a request context.
+ * server, relative URLs are resolved against APP_URL when configured. This
+ * keeps an internal HTTP reverse-proxy connection from triggering an HTTPS
+ * redirect. Without APP_URL, use the incoming request's origin (via
+ * @tanstack/react-start/server), then BETTER_AUTH_URL / localhost:3000.
  *
  * The server-only module uses a literal dynamic import so bundlers can analyze
  * the boundary statically; the `window` guard means it never runs in browsers.

package/dist/start/isomorphic-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isomorphic-fetch.d.ts","sourceRoot":"","sources":["../../src/start/isomorphic-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CAAO,IAGxE,OAAO,WAAW,GAAG,GAAG,EACxB,OAAO,WAAW,KACjB,OAAO,CAAC,QAAQ,CAAC,CAkBrB"}
+{"version":3,"file":"isomorphic-fetch.d.ts","sourceRoot":"","sources":["../../src/start/isomorphic-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CAAO,IAGxE,OAAO,WAAW,GAAG,GAAG,EACxB,OAAO,WAAW,KACjB,OAAO,CAAC,QAAQ,CAAC,CAiBrB"}

package/dist/start/isomorphic-fetch.js

@@ -1,8 +1,9 @@
 /**
  * SSR-aware fetch: the browser passes `/api/...` through as-is; on the
- * server, relative URLs are resolved against the incoming request's origin
- * (via @tanstack/react-start/server), falling back to APP_URL /
- * BETTER_AUTH_URL / localhost:3000 outside a request context.
+ * server, relative URLs are resolved against APP_URL when configured. This
+ * keeps an internal HTTP reverse-proxy connection from triggering an HTTPS
+ * redirect. Without APP_URL, use the incoming request's origin (via
+ * @tanstack/react-start/server), then BETTER_AUTH_URL / localhost:3000.
  *
  * The server-only module uses a literal dynamic import so bundlers can analyze
  * the boundary statically; the `window` guard means it never runs in browsers.
@@ -13,18 +14,17 @@ export function createIsomorphicFetch(options = {}) {
         if (typeof window !== 'undefined')
             return inner(input, init);
         if (typeof input === 'string' && input.startsWith('/')) {
-            let origin;
-            try {
-                const mod = await import('@tanstack/react-start/server');
-                origin = new URL(mod.getRequest().url).origin;
+            let origin = process.env.APP_URL;
+            if (origin === undefined) {
+                try {
+                    const mod = await import('@tanstack/react-start/server');
+                    origin = new URL(mod.getRequest().url).origin;
+                }
+                catch {
+                    // No request context (background job, test) — fall through to env.
+                }
             }
-            catch {
-                // No request context (background job, test) — fall through to env.
-            }
-            origin ??=
-                process.env.APP_URL ??
-                    process.env.BETTER_AUTH_URL ??
-                    'http://localhost:3000';
+            origin ??= process.env.BETTER_AUTH_URL ?? 'http://localhost:3000';
             return inner(new URL(input, origin), init);
         }
         return inner(input, init);

package/dist/start/isomorphic-fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"isomorphic-fetch.js","sourceRoot":"","sources":["../../src/start/isomorphic-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAoC,EAAE;IAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACpC,OAAO,KAAK,UAAU,eAAe,CACnC,KAAwB,EACxB,IAAkB;QAElB,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,IAAI,MAA0B,CAAA;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAA;gBACxD,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;YACrE,CAAC;YACD,MAAM;gBACJ,OAAO,CAAC,GAAG,CAAC,OAAO;oBACnB,OAAO,CAAC,GAAG,CAAC,eAAe;oBAC3B,uBAAuB,CAAA;YACzB,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC3B,CAAC,CAAA;AACH,CAAC","sourcesContent":["/**\n * SSR-aware fetch: the browser passes `/api/...` through as-is; on the\n * server, relative URLs are resolved against the incoming request's origin\n * (via @tanstack/react-start/server), falling back to APP_URL /\n * BETTER_AUTH_URL / localhost:3000 outside a request context.\n *\n * The server-only module uses a literal dynamic import so bundlers can analyze\n * the boundary statically; the `window` guard means it never runs in browsers.\n */\nexport function createIsomorphicFetch(options: { fetch?: typeof fetch } = {}) {\n  const inner = options.fetch ?? fetch\n  return async function isomorphicFetch(\n    input: RequestInfo | URL,\n    init?: RequestInit,\n  ): Promise<Response> {\n    if (typeof window !== 'undefined') return inner(input, init)\n    if (typeof input === 'string' && input.startsWith('/')) {\n      let origin: string | undefined\n      try {\n        const mod = await import('@tanstack/react-start/server')\n        origin = new URL(mod.getRequest().url).origin\n      } catch {\n        // No request context (background job, test) — fall through to env.\n      }\n      origin ??=\n        process.env.APP_URL ??\n        process.env.BETTER_AUTH_URL ??\n        'http://localhost:3000'\n      return inner(new URL(input, origin), init)\n    }\n    return inner(input, init)\n  }\n}\n"]}
+{"version":3,"file":"isomorphic-fetch.js","sourceRoot":"","sources":["../../src/start/isomorphic-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAoC,EAAE;IAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACpC,OAAO,KAAK,UAAU,eAAe,CACnC,KAAwB,EACxB,IAAkB;QAElB,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAA;YAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAA;oBACxD,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;gBAC/C,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;gBACrE,CAAC;YACH,CAAC;YACD,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,uBAAuB,CAAA;YACjE,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC3B,CAAC,CAAA;AACH,CAAC","sourcesContent":["/**\n * SSR-aware fetch: the browser passes `/api/...` through as-is; on the\n * server, relative URLs are resolved against APP_URL when configured. This\n * keeps an internal HTTP reverse-proxy connection from triggering an HTTPS\n * redirect. Without APP_URL, use the incoming request's origin (via\n * @tanstack/react-start/server), then BETTER_AUTH_URL / localhost:3000.\n *\n * The server-only module uses a literal dynamic import so bundlers can analyze\n * the boundary statically; the `window` guard means it never runs in browsers.\n */\nexport function createIsomorphicFetch(options: { fetch?: typeof fetch } = {}) {\n  const inner = options.fetch ?? fetch\n  return async function isomorphicFetch(\n    input: RequestInfo | URL,\n    init?: RequestInit,\n  ): Promise<Response> {\n    if (typeof window !== 'undefined') return inner(input, init)\n    if (typeof input === 'string' && input.startsWith('/')) {\n      let origin = process.env.APP_URL\n      if (origin === undefined) {\n        try {\n          const mod = await import('@tanstack/react-start/server')\n          origin = new URL(mod.getRequest().url).origin\n        } catch {\n          // No request context (background job, test) — fall through to env.\n        }\n      }\n      origin ??= process.env.BETTER_AUTH_URL ?? 'http://localhost:3000'\n      return inner(new URL(input, origin), init)\n    }\n    return inner(input, init)\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bunderstack",
-  "version": "0.24.2",
+  "version": "0.24.3",
   "description": "Batteries-included backend framework for Bun: type-safe oRPC APIs, auth, storage, realtime, jobs, messaging, and validated env from one declaration.",
   "keywords": [
     "backend",