nucleus-core-ts 0.10.20 → 0.10.21

package/dist/src/Nucleus/routes/shared/clientIp.d.ts

@@ -27,3 +27,26 @@ export declare function resolveClientIp(socketIp: string | null | undefined, for
  * 1350 of them on a dashboard route, all keyed by `::ffff:127.0.0.1`.
  */
 export declare const isNonDiscriminatingPeer: (ip: string) => boolean;
+/**
+ * Watches whether the peer address ever varies.
+ *
+ * `isNonDiscriminatingPeer` only recognises loopback, which catches a frontend
+ * on the same host and nothing else. The identical failure happens whenever the
+ * API is reached through one hop that is not declared as a trusted proxy -- a
+ * frontend pod calling a cluster IP, a sidecar, a NAT gateway. Those addresses
+ * look perfectly ordinary, so no shape test can spot them.
+ *
+ * What CAN be spotted is the consequence: if every request the process has ever
+ * seen arrived from one address, that address is not telling callers apart, and
+ * every rate-limit bucket keyed on it is one counter for everybody. So this
+ * observes instead of guessing, and gives up the moment a second address shows
+ * up -- a deployment with real client addresses pays one Set lookup and is never
+ * bothered again.
+ */
+export declare function createPeerDiversityWatcher(sampleSize?: number): {
+    /**
+     * Returns the single address once it is established that every caller
+     * shares it, and null otherwise. Answers at most once.
+     */
+    observe(ip: string): string | null;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nucleus-core-ts",
-  "version": "0.10.20",
+  "version": "0.10.21",
   "description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
   "author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
   "license": "SEE LICENSE IN LICENSE",