@cosmicdrift/kumiko-bundled-features 0.373.0 → 0.377.0

package/dist/file-provider-s3/env-named-feature.js

@@ -0,0 +1,23 @@
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
+import { createRuntimeS3EnvSchema } from "./env-schema.js";
+import { createS3ProviderFromEnv } from "./lib/env-helper.js";
+/** An additional S3 provider next to `"s3-env"`, reading its credentials from `<envPrefix>BUCKET` etc. */
+export function createFileProviderS3NamedEnvFeature(options) {
+    const envSchema = createRuntimeS3EnvSchema(options.envPrefix);
+    const feature = defineFeature(`file-provider-s3-env-${options.name}`, (r) => {
+        r.describe(`Registers the "${options.name}" provider for \`file-foundation\`: one shared S3 bucket for every tenant, credentials from the \`${options.envPrefix}*\` env vars. A second bucket next to the \`"s3-env"\` provider (for example release artifacts).`);
+        r.uiHints({
+            displayLabel: `File Provider · S3 (${options.name})`,
+            category: "storage",
+            recommended: false,
+        });
+        r.requires({ features: ["file-foundation"] });
+        r.envSchema(envSchema);
+        const plugin = {
+            build: async (_ctx, _tenantId) => createS3ProviderFromEnv(options.envPrefix), // @wrapper-known semantic-alias
+        };
+        r.useExtension("fileProvider", options.name, plugin);
+    }, { dedupeOptions: { name: options.name, envPrefix: options.envPrefix } });
+    return featureWithEnvSchema(feature, envSchema);
+}

package/dist/file-provider-s3/env-schema.d.ts

@@ -9,6 +9,13 @@ export declare const s3EndpointSchema: z.ZodURL;
 export declare function createS3EnvSchema<const TPrefix extends string>(options: {
     readonly prefix: TPrefix;
 }): z.ZodObject<S3EnvShape<TPrefix> extends infer T ? { -readonly [P in keyof T]: T[P]; } : never, z.core.$strip>;
+/** Same block for a prefix only known at runtime (named providers); keys are typed as a record. */
+export declare function createRuntimeS3EnvSchema(prefix: string): z.ZodObject<{
+    [x: string]: z.ZodOptional<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>> | z.ZodOptional<z.ZodString> | z.ZodOptional<z.ZodUnion<readonly [z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>, z.ZodURL]>>;
+}, z.core.$strip>;
 type OptionalString = z.ZodOptional<z.ZodString>;
 type S3EnvShape<TPrefix extends string> = {
     [Key in `${TPrefix}${"BUCKET" | "REGION" | "ACCESS_KEY" | "SECRET_KEY"}`]: OptionalString;

package/dist/file-provider-s3/env-schema.js

@@ -15,15 +15,8 @@ function isAcceptableEndpoint(value) {
 export const s3EndpointSchema = z
     .url({ protocol: /^https?$/ })
     .refine(isAcceptableEndpoint, "must use https unless the host is loopback");
-/** Builds the env block `createS3ProviderFromEnv(prefix)` reads, e.g.
- *  `createS3EnvSchema({ prefix: "RELEASES_S3_" })` for a second bucket.
- *  Every field is optional: an app that mounts the env provider next to
- *  another one picks the provider at runtime, and the provider reports
- *  missing credentials on its first file operation. */
-export function createS3EnvSchema(options) {
-    const { prefix } = options;
-    // @cast-boundary schema-walk — computed template keys widen to an index signature; the literal keys below are exactly the ones S3EnvShape names.
-    const shape = {
+function buildS3Shape(prefix) {
+    return {
         [`${prefix}BUCKET`]: z.string().min(1).optional().describe("S3 bucket."),
         [`${prefix}REGION`]: z.string().min(1).optional().describe("S3 region."),
         [`${prefix}ACCESS_KEY`]: z
@@ -48,7 +41,19 @@ export function createS3EnvSchema(options) {
             .optional()
             .describe('Path-style bucket addressing ("true"), needed by MinIO and some S3 clones.'),
     };
-    return z.object(shape);
+}
+/** Builds the env block `createS3ProviderFromEnv(prefix)` reads, e.g.
+ *  `createS3EnvSchema({ prefix: "RELEASES_S3_" })` for a second bucket.
+ *  Every field is optional: an app that mounts the env provider next to
+ *  another one picks the provider at runtime, and the provider reports
+ *  missing credentials on its first file operation. */
+export function createS3EnvSchema(options) {
+    // @cast-boundary schema-walk — computed template keys widen to an index signature; the literal keys below are exactly the ones S3EnvShape names.
+    return z.object(buildS3Shape(options.prefix));
+}
+/** Same block for a prefix only known at runtime (named providers); keys are typed as a record. */
+export function createRuntimeS3EnvSchema(prefix) {
+    return z.object(buildS3Shape(prefix));
 }
 /** The `S3_*` block of the `"s3-env"` provider. */
 export const s3EnvSchema = createS3EnvSchema({ prefix: "S3_" });

package/dist/file-provider-s3/index.d.ts

@@ -1,2 +1,3 @@
+export { createFileProviderS3NamedEnvFeature, type NamedS3EnvProviderOptions, } from "./env-named-feature.ts";
 export { createS3EnvSchema, s3EndpointSchema, s3EnvSchema } from "./env-schema.ts";
 export { createFileProviderS3Feature, type FileProviderS3FeatureOptions, S3_SECRET_ACCESS_KEY, } from "./feature.ts";

package/dist/file-provider-s3/index.js

@@ -1,3 +1,4 @@
 // Public API of the file-provider-s3 bundled-feature.
+export { createFileProviderS3NamedEnvFeature, } from "./env-named-feature.js";
 export { createS3EnvSchema, s3EndpointSchema, s3EnvSchema } from "./env-schema.js";
 export { createFileProviderS3Feature, S3_SECRET_ACCESS_KEY, } from "./feature.js";

package/dist/folders/entity.d.ts

@@ -14,7 +14,7 @@ export declare const folderEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -37,7 +37,7 @@ export declare const folderEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -62,7 +62,7 @@ export declare function createFolderAssignmentEntity(access?: EntityDefinition["
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -85,7 +85,7 @@ export declare function createFolderAssignmentEntity(access?: EntityDefinition["
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -108,7 +108,7 @@ export declare function createFolderAssignmentEntity(access?: EntityDefinition["
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -133,7 +133,7 @@ export declare const folderAssignmentEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -156,7 +156,7 @@ export declare const folderAssignmentEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -179,7 +179,7 @@ export declare const folderAssignmentEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/folders/web/client-plugin.d.ts

@@ -1,2 +1,2 @@
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 export declare function foldersClient(): ClientFeatureDefinition;

package/dist/form-draft/entity.d.ts

@@ -13,7 +13,7 @@ export declare const formDraftEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -36,7 +36,7 @@ export declare const formDraftEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/host-routing/constants.d.ts

@@ -1,8 +1,10 @@
 export declare const HOST_ROUTING_FEATURE = "host-routing";
 export declare const HostRoutingQueries: {
     readonly tenantKeyExists: "host-routing:query:tenant-key-exists";
+    readonly hostTenantExists: "host-routing:query:host-tenant-exists";
 };
 export declare const TENANT_KEY_MAX_LENGTH = 50;
 export declare const TENANT_KEY_PATTERN: RegExp;
 export declare function isTenantKeyCandidate(value: string): boolean;
 export declare function isPathTenantKeyCandidate(value: string): boolean;
+export declare const HOST_HEADER_MAX_LENGTH = 260;

package/dist/host-routing/constants.js

@@ -1,6 +1,7 @@
 export const HOST_ROUTING_FEATURE = "host-routing";
 export const HostRoutingQueries = {
     tenantKeyExists: `${HOST_ROUTING_FEATURE}:query:tenant-key-exists`,
+    hostTenantExists: `${HOST_ROUTING_FEATURE}:query:host-tenant-exists`,
 };
 // Matches tenant:write:create's key limit; keeps lookups for absurd keys out
 // of the database.
@@ -17,3 +18,5 @@ const PATH_TENANT_KEY_PATTERN = /^[A-Za-z0-9._~-]+$/;
 export function isPathTenantKeyCandidate(value) {
     return value.length <= TENANT_KEY_MAX_LENGTH && PATH_TENANT_KEY_PATTERN.test(value);
 }
+// Longest Host header value a hostname plus port can take.
+export const HOST_HEADER_MAX_LENGTH = 260;

package/dist/host-routing/dispatch.d.ts

@@ -1,4 +1,4 @@
-import type { PageHeadSystemQuery } from "@cosmicdrift/kumiko-headless/apex";
+import type { PageHeadSystemQuery } from "@cosmicdrift/kumiko-renderer/headless/apex";
 import type { HostRoutingOptions } from "./options.ts";
 export type HostRoutingDispatchResult = {
     readonly kind: "html";

package/dist/host-routing/dispatch.js

@@ -2,7 +2,8 @@ import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { RateLimitError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { HostRoutingQueries, isPathTenantKeyCandidate, isTenantKeyCandidate } from "./constants.js";
-import { classifyHost } from "./host.js";
+import { classifyHost, splitFirstSegment, tenantKeyFromPath } from "./host.js";
+import { matchRedirect, sameOriginPath } from "./redirects.js";
 import { validateHostRoutingOptions } from "./validate-options.js";
 const tenantKeyExistsResultSchema = z.object({ exists: z.boolean() });
 async function isTenantKeyKnown(systemQuery, key) {
@@ -21,6 +22,23 @@ async function isTenantKeyKnown(systemQuery, key) {
     }
     return tenantKeyExistsResultSchema.parse(result).exists;
 }
+async function isHostKnown(systemQuery, host) {
+    let result;
+    try {
+        result = await systemQuery(HostRoutingQueries.hostTenantExists, { host }, SYSTEM_TENANT_ID);
+    }
+    catch (error) {
+        if (error instanceof ValidationError)
+            return false;
+        // The shell is harmless: the API resolver is authoritative and answers
+        // tenant_required for unknown hosts, while a 404 would hit visitors behind
+        // a shared NAT under load.
+        if (error instanceof RateLimitError)
+            return true;
+        throw error;
+    }
+    return tenantKeyExistsResultSchema.parse(result).exists;
+}
 function serve(surface, file = surface.file) {
     return surface.csp === undefined
         ? { kind: "html", file }
@@ -33,19 +51,6 @@ function notFound(surface) {
         ? { kind: "not-found", file: surface.file }
         : { kind: "not-found", file: surface.file, csp: surface.csp };
 }
-// Redirect targets are always same-origin paths. Collapsing leading slashes
-// and backslashes keeps "/de//evil.example" from turning into the
-// protocol-relative "//evil.example".
-function sameOriginPath(path) {
-    return `/${path.replace(/^[/\\]+/, "")}`;
-}
-function splitFirstSegment(path) {
-    const withoutLeading = path.replace(/^\/+/, "");
-    const slash = withoutLeading.indexOf("/");
-    if (slash === -1)
-        return { segment: withoutLeading, rest: "/" };
-    return { segment: withoutLeading.slice(0, slash), rest: withoutLeading.slice(slash) };
-}
 function apexPage(options, req) {
     const { apex, locales } = options;
     if (locales === undefined)
@@ -57,28 +62,26 @@ function apexPage(options, req) {
     const locale = locales.prefixed.includes(segment) ? segment : locales.default;
     return serve(apex, apex.localeFiles?.[locale] ?? apex.file);
 }
-async function tenantPage(options, key, systemQuery) {
+async function tenantPage(options, key, systemQuery, keySource) {
     // No key (bare tenant prefix): the shell handles login and tenant choice.
     if (key === null)
         return serve(options.tenant);
-    const isCandidate = options.tenantBy === "path" ? isPathTenantKeyCandidate : isTenantKeyCandidate;
+    const isCandidate = keySource === "path" ? isPathTenantKeyCandidate : isTenantKeyCandidate;
     if (!isCandidate(key))
         return notFound(options.unknownTenant);
     return (await isTenantKeyKnown(systemQuery, key))
         ? serve(options.tenant)
         : notFound(options.unknownTenant);
 }
-function tenantKeyFromPath(prefix, path) {
-    if (path !== prefix && !path.startsWith(`${prefix}/`))
-        return undefined;
-    const { segment } = splitFirstSegment(path.slice(prefix.length));
-    return segment === "" ? null : segment;
-}
 // The routing decision for runProdApp's `hostDispatch` (and, via
 // toDevHostDispatch, the dev server). Unknown hosts fail closed with 404.
 export function createHostDispatch(options) {
     validateHostRoutingOptions(options);
+    const redirects = options.redirects ?? [];
     return async (req, { systemQuery }) => {
+        const redirect = matchRedirect(redirects, req.host, req.path, req.search);
+        if (redirect !== undefined)
+            return { kind: "redirect", ...redirect };
         const host = classifyHost(req.host, options);
         switch (host.kind) {
             case "fixed":
@@ -88,12 +91,19 @@ export function createHostDispatch(options) {
             case "subdomain":
                 if (options.tenantBy !== "host")
                     return notFound(undefined);
-                return tenantPage(options, host.key, systemQuery);
+                return tenantPage(options, host.key, systemQuery, "subdomain");
+            case "resolved": {
+                if (await isHostKnown(systemQuery, host.hostname))
+                    return serve(options.tenant);
+                return notFound(host.hostname.endsWith(`.${options.baseDomain.toLowerCase()}`)
+                    ? options.unknownTenant
+                    : undefined);
+            }
             case "apex": {
-                if (options.tenantBy === "path") {
+                if (options.tenantPathPrefix !== undefined) {
                     const key = tenantKeyFromPath(options.tenantPathPrefix, req.path);
                     if (key !== undefined)
-                        return tenantPage(options, key, systemQuery);
+                        return tenantPage(options, key, systemQuery, "path");
                 }
                 return apexPage(options, req);
             }

package/dist/host-routing/feature.js

@@ -1,31 +1,70 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, defineQueryHandler, isSystemTenant, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, } from "../auth-foundation/index.js";
-import { isTenantServingPublicContent, tenantTable, } from "../tenant/index.js";
-import { HOST_ROUTING_FEATURE, TENANT_KEY_MAX_LENGTH } from "./constants.js";
-import { classifyHost } from "./host.js";
+import { HOST_HEADER_MAX_LENGTH, HOST_ROUTING_FEATURE, TENANT_KEY_MAX_LENGTH, } from "./constants.js";
+import { classifyHost, normalizeHostname } from "./host.js";
+import { isTenantServing, servingTenantIdByKey, servingTenantIdByResolver, } from "./tenant-lookup.js";
 import { validateHostRoutingOptions } from "./validate-options.js";
-// Disabled tenants and tenants in any destroy phase are not routable, the same
-// rule public files and pages follow.
-async function servingTenantIdByKey(db, key) {
-    const row = await fetchOne(db, tenantTable, { key });
-    return row !== undefined && isTenantServingPublicContent(row) ? row.id : null;
-}
-async function isTenantServing(db, id) {
-    const row = await fetchOne(db, tenantTable, { id });
-    return row !== undefined && isTenantServingPublicContent(row);
-}
 // auth-foundation types the Hono context as unknown to stay free of a hono dep.
-function isHostHeaderReader(c) {
+function isRequestReader(c) {
     return (typeof c === "object" &&
         c !== null &&
         "req" in c &&
         typeof c.req === "object" &&
         c.req !== null &&
         "header" in c.req &&
-        typeof c.req.header === "function");
+        typeof c.req.header === "function" &&
+        "url" in c.req &&
+        typeof c.req.url === "string" &&
+        "path" in c.req &&
+        typeof c.req.path === "string");
+}
+// Hono routes on the decoded path and ignores a trailing slash, so the
+// allowlist must compare the same shape: "/api/%71uery" and "/api/query/"
+// reach the query handler too.
+function routedPathOf(c) {
+    return c.req.path.length > 1 ? c.req.path.replace(/\/+$/, "") : c.req.path;
+}
+// "example.com" and "www.example.com" are one site: a host without its own
+// entry falls back to the other variant's entry instead of keeping the anchor.
+function allowlistFor(options, hostname) {
+    const allowlists = options.apexAnonymousQueryAllowlist;
+    if (allowlists === undefined)
+        return undefined;
+    const counterpart = hostname.startsWith("www.") ? hostname.slice(4) : `www.${hostname}`;
+    for (const key of [hostname, counterpart]) {
+        if (Object.hasOwn(allowlists, key))
+            return allowlists[key];
+    }
+    return undefined;
+}
+// Both carry { type, payload } and run read handlers; /api/batch is commands only.
+const TYPED_READ_PATHS = new Set(["/api/query", "/api/stream"]);
+const queryTypeBodySchema = z.object({ type: z.string() });
+// Reads the query type from a clone, so the body stays intact for the handler.
+async function peekQueryType(c) {
+    if (c.req.raw === undefined)
+        return null;
+    try {
+        const parsed = queryTypeBodySchema.safeParse(await c.req.raw.clone().json());
+        return parsed.success ? parsed.data.type : null;
+    }
+    catch {
+        return null;
+    }
+}
+// Apex anchor tenant for anonymous calls. A host with an allowlist only gets
+// the anchor for the listed query types on read paths; other paths keep it.
+async function apexAnchorFor(options, c, hostname) {
+    const anchor = options.apexAnonymousTenantId ?? null;
+    if (anchor === null)
+        return null;
+    const allowlist = allowlistFor(options, hostname);
+    if (allowlist === undefined || !TYPED_READ_PATHS.has(routedPathOf(c)))
+        return anchor;
+    const type = await peekQueryType(c);
+    return type !== null && allowlist.includes(type) ? anchor : null;
 }
 // Returns only { exists }: the same fact the tenant 404 page already makes
 // public, never other tenant fields. Rate-limited so it is no cheap oracle.
@@ -47,34 +86,66 @@ const tenantKeyExistsQuery = defineQueryHandler({
         return { exists: (await servingTenantIdByKey(db, query.payload.key)) !== null };
     },
 });
+function hostTenantExistsQueryFor(options) {
+    return defineQueryHandler({
+        name: "host-tenant-exists",
+        schema: z.object({ host: z.string().min(1).max(HOST_HEADER_MAX_LENGTH) }),
+        access: { roles: ["anonymous"] },
+        rateLimit: { per: "ip+handler", limit: 120, windowSeconds: 60 },
+        // Page-routing plumbing, not a task an agent performs.
+        agent: { expose: false },
+        description: "Anonymous host check backing the unknown-host 404 of the host-routing hostDispatch in tenantBy resolver mode. Returns only { exists }.",
+        handler: async (query, ctx) => {
+            if (!ctx.systemDb) {
+                throw new InternalError({
+                    message: "host-routing:query:host-tenant-exists requires ctx.systemDb (r.systemScope())",
+                });
+            }
+            const hostname = normalizeHostname(query.payload.host);
+            if (hostname === null)
+                return { exists: false };
+            const db = ctx.systemDb.acknowledgeCrossTenant("host existence check for the host-routing 404 — publicly observable via the 404 itself");
+            return { exists: (await servingTenantIdByResolver(options, db, hostname)) !== null };
+        },
+    });
+}
 function tenantResolverFor(options) {
-    const apexTenantId = options.apexAnonymousTenantId ?? null;
-    if (options.tenantBy === "host") {
+    if (options.tenantBy !== "path") {
         return {
             trust: "authoritative",
             build: ({ db }) => async (c) => {
-                if (!isHostHeaderReader(c))
+                if (!isRequestReader(c))
                     return null;
-                const host = classifyHost(c.req.header("Host") ?? "", options);
-                if (host.kind === "subdomain")
-                    return servingTenantIdByKey(db, host.key);
+                const hostHeader = c.req.header("Host") ?? "";
+                const host = classifyHost(hostHeader, options);
                 // Fixed and unknown hosts have no anonymous tenant: an authoritative
                 // null answers tenant_required, whatever X-Tenant says.
-                return host.kind === "apex" ? apexTenantId : null;
+                switch (host.kind) {
+                    case "subdomain":
+                        return servingTenantIdByKey(db, host.key);
+                    case "resolved":
+                        return servingTenantIdByResolver(options, db, host.hostname);
+                    case "apex":
+                        return apexAnchorFor(options, c, normalizeHostname(hostHeader) ?? "");
+                    case "fixed":
+                    case "unknown":
+                        return null;
+                }
             },
         };
     }
-    if (apexTenantId === null)
+    if (options.apexAnonymousTenantId === undefined)
         return undefined;
     // Path mode: the client names its tenant; the apex default only fills in
     // when it does not.
     return {
         trust: "fallback-only",
         build: () => async (c) => {
-            if (!isHostHeaderReader(c))
+            if (!isRequestReader(c))
                 return null;
-            return classifyHost(c.req.header("Host") ?? "", options).kind === "apex"
-                ? apexTenantId
+            const hostHeader = c.req.header("Host") ?? "";
+            return classifyHost(hostHeader, options).kind === "apex"
+                ? apexAnchorFor(options, c, normalizeHostname(hostHeader) ?? "")
                 : null;
         },
     };
@@ -89,6 +160,8 @@ export function createHostRoutingFeature(options) {
         r.requires({ features: ["auth-foundation", "tenant"] });
         r.systemScope();
         r.queryHandler(tenantKeyExistsQuery);
+        if (typeof options.tenantBy === "function")
+            r.queryHandler(hostTenantExistsQueryFor(options));
         const resolver = tenantResolverFor(options);
         if (resolver !== undefined) {
             // biome-ignore lint/correctness/useHookAtTopLevel: r.useExtension is a registrar method, not a React hook; path mode without an apex tenant must leave the resolver slot free.

package/dist/host-routing/host.d.ts

@@ -8,7 +8,16 @@ export type HostClass = {
 } | {
     readonly kind: "subdomain";
     readonly key: string;
+} | {
+    readonly kind: "resolved";
+    readonly hostname: string;
 } | {
     readonly kind: "unknown";
 };
 export declare function classifyHost(host: string, options: HostRoutingOptions): HostClass;
+export declare function splitFirstSegment(path: string): {
+    readonly segment: string;
+    readonly rest: string;
+};
+export declare function tenantKeyFromPath(prefix: string, path: string): string | null | undefined;
+export declare function isApexHostname(hostname: string, baseDomain: string): boolean;

package/dist/host-routing/host.js

@@ -23,9 +23,11 @@ export function classifyHost(host, options) {
         : undefined;
     if (fixed !== undefined)
         return { kind: "fixed", surface: fixed };
-    const baseDomain = options.baseDomain.toLowerCase();
-    if (hostname === baseDomain || hostname === `www.${baseDomain}`)
+    if (isApexHostname(hostname, options.baseDomain))
         return { kind: "apex" };
+    const baseDomain = options.baseDomain.toLowerCase();
+    if (typeof options.tenantBy === "function")
+        return { kind: "resolved", hostname };
     const suffix = `.${baseDomain}`;
     if (!hostname.endsWith(suffix))
         return { kind: "unknown" };
@@ -35,3 +37,23 @@ export function classifyHost(host, options) {
         return { kind: "unknown" };
     return { kind: "subdomain", key: label };
 }
+export function splitFirstSegment(path) {
+    const withoutLeading = path.replace(/^\/+/, "");
+    const slash = withoutLeading.indexOf("/");
+    if (slash === -1)
+        return { segment: withoutLeading, rest: "/" };
+    return { segment: withoutLeading.slice(0, slash), rest: withoutLeading.slice(slash) };
+}
+// undefined: path is outside the prefix; null: bare prefix without a key.
+export function tenantKeyFromPath(prefix, path) {
+    if (path !== prefix && !path.startsWith(`${prefix}/`))
+        return undefined;
+    const { segment } = splitFirstSegment(path.slice(prefix.length));
+    return segment === "" ? null : segment;
+}
+// Apex hostnames are the only ones that may carry a path-named tenant or an
+// anonymous anchor tenant.
+export function isApexHostname(hostname, baseDomain) {
+    const base = baseDomain.toLowerCase();
+    return hostname === base || hostname === `www.${base}`;
+}

package/dist/host-routing/index.d.ts

@@ -2,4 +2,5 @@ export { HOST_ROUTING_FEATURE, HostRoutingQueries, isTenantKeyCandidate, TENANT_
 export { createHostDispatch, type HostRoutingDispatchFn, type HostRoutingDispatchResult, type HostRoutingRequest, } from "./dispatch.ts";
 export { createHostRoutingFeature } from "./feature.ts";
 export { normalizeHostname } from "./host.ts";
-export type { HostRoutingApexSurface, HostRoutingLocales, HostRoutingOptions, HostRoutingSurface, HostRoutingTenantMode, } from "./options.ts";
+export type { HostRoutingApexSurface, HostRoutingLocales, HostRoutingOptions, HostRoutingRedirect, HostRoutingSurface, HostRoutingTenantMode, HostTenantResolver, } from "./options.ts";
+export { createHostTenantIdResolver } from "./tenant-lookup.ts";

package/dist/host-routing/index.js

@@ -2,3 +2,4 @@ export { HOST_ROUTING_FEATURE, HostRoutingQueries, isTenantKeyCandidate, TENANT_
 export { createHostDispatch, } from "./dispatch.js";
 export { createHostRoutingFeature } from "./feature.js";
 export { normalizeHostname } from "./host.js";
+export { createHostTenantIdResolver } from "./tenant-lookup.js";

package/dist/host-routing/options.d.ts

@@ -1,3 +1,4 @@
+import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 export type HostRoutingSurface = {
     readonly file: string;
@@ -10,11 +11,22 @@ export type HostRoutingLocales = {
     readonly default: string;
     readonly prefixed: readonly string[];
 };
+export type HostTenantResolver = (host: string, db: DbConnection | TenantDb) => Promise<TenantId | null> | TenantId | null;
 export type HostRoutingTenantMode = {
     readonly tenantBy: "host";
+    readonly tenantPathPrefix?: string;
 } | {
     readonly tenantBy: "path";
     readonly tenantPathPrefix: string;
+} | {
+    readonly tenantBy: HostTenantResolver;
+    readonly tenantPathPrefix?: string;
+};
+export type HostRoutingRedirect = {
+    readonly from: string;
+    readonly to: string;
+    readonly host?: string;
+    readonly status?: 301 | 302;
 };
 export type HostRoutingOptions = HostRoutingTenantMode & {
     readonly baseDomain: string;
@@ -24,4 +36,6 @@ export type HostRoutingOptions = HostRoutingTenantMode & {
     readonly hosts?: Readonly<Record<string, HostRoutingSurface>>;
     readonly locales?: HostRoutingLocales;
     readonly apexAnonymousTenantId?: TenantId;
+    readonly apexAnonymousQueryAllowlist?: Readonly<Record<string, readonly string[]>>;
+    readonly redirects?: readonly HostRoutingRedirect[];
 };

package/dist/host-routing/redirects.d.ts

@@ -0,0 +1,6 @@
+import type { HostRoutingRedirect } from "./options.ts";
+export declare function sameOriginPath(path: string): string;
+export declare function matchRedirect(redirects: readonly HostRoutingRedirect[], host: string, path: string, search: string): {
+    readonly to: string;
+    readonly status: 301 | 302;
+} | undefined;

package/dist/host-routing/redirects.js

@@ -0,0 +1,27 @@
+import { normalizeHostname } from "./host.js";
+// Same-origin targets collapse leading slashes and backslashes so an appended
+// "//evil.example" remainder can never turn into a protocol-relative URL.
+export function sameOriginPath(path) {
+    return `/${path.replace(/^[/\\]+/, "")}`;
+}
+function remainderAfter(from, path) {
+    if (path === from)
+        return "";
+    const prefix = from.endsWith("/") ? from : `${from}/`;
+    return path.startsWith(prefix) ? path.slice(prefix.length - 1) : null;
+}
+export function matchRedirect(redirects, host, path, search) {
+    const hostname = normalizeHostname(host);
+    for (const rule of redirects) {
+        if (rule.host !== undefined && rule.host !== hostname)
+            continue;
+        const remainder = remainderAfter(rule.from, path);
+        if (remainder === null)
+            continue;
+        const target = rule.to.startsWith("https://")
+            ? `${rule.to.replace(/\/$/, "")}${remainder}`
+            : sameOriginPath(`${rule.to.replace(/\/$/, "")}${remainder}`);
+        return { to: `${target}${search}`, status: rule.status ?? 301 };
+    }
+    return undefined;
+}