@cosmicdrift/kumiko-bundled-features 0.374.0 → 0.378.0

package/dist/host-routing/constants.js

@@ -1,6 +1,7 @@
 export const HOST_ROUTING_FEATURE = "host-routing";
 export const HostRoutingQueries = {
     tenantKeyExists: `${HOST_ROUTING_FEATURE}:query:tenant-key-exists`,
+    hostTenantExists: `${HOST_ROUTING_FEATURE}:query:host-tenant-exists`,
 };
 // Matches tenant:write:create's key limit; keeps lookups for absurd keys out
 // of the database.
@@ -17,3 +18,5 @@ const PATH_TENANT_KEY_PATTERN = /^[A-Za-z0-9._~-]+$/;
 export function isPathTenantKeyCandidate(value) {
     return value.length <= TENANT_KEY_MAX_LENGTH && PATH_TENANT_KEY_PATTERN.test(value);
 }
+// Longest Host header value a hostname plus port can take.
+export const HOST_HEADER_MAX_LENGTH = 260;

package/dist/host-routing/dispatch.d.ts

@@ -1,4 +1,4 @@
-import type { PageHeadSystemQuery } from "@cosmicdrift/kumiko-headless/apex";
+import type { PageHeadSystemQuery } from "@cosmicdrift/kumiko-renderer/headless/apex";
 import type { HostRoutingOptions } from "./options.ts";
 export type HostRoutingDispatchResult = {
     readonly kind: "html";

package/dist/host-routing/dispatch.js

@@ -2,7 +2,8 @@ import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { RateLimitError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { HostRoutingQueries, isPathTenantKeyCandidate, isTenantKeyCandidate } from "./constants.js";
-import { classifyHost } from "./host.js";
+import { classifyHost, splitFirstSegment, tenantKeyFromPath } from "./host.js";
+import { matchRedirect, sameOriginPath } from "./redirects.js";
 import { validateHostRoutingOptions } from "./validate-options.js";
 const tenantKeyExistsResultSchema = z.object({ exists: z.boolean() });
 async function isTenantKeyKnown(systemQuery, key) {
@@ -21,6 +22,23 @@ async function isTenantKeyKnown(systemQuery, key) {
     }
     return tenantKeyExistsResultSchema.parse(result).exists;
 }
+async function isHostKnown(systemQuery, host) {
+    let result;
+    try {
+        result = await systemQuery(HostRoutingQueries.hostTenantExists, { host }, SYSTEM_TENANT_ID);
+    }
+    catch (error) {
+        if (error instanceof ValidationError)
+            return false;
+        // The shell is harmless: the API resolver is authoritative and answers
+        // tenant_required for unknown hosts, while a 404 would hit visitors behind
+        // a shared NAT under load.
+        if (error instanceof RateLimitError)
+            return true;
+        throw error;
+    }
+    return tenantKeyExistsResultSchema.parse(result).exists;
+}
 function serve(surface, file = surface.file) {
     return surface.csp === undefined
         ? { kind: "html", file }
@@ -33,19 +51,6 @@ function notFound(surface) {
         ? { kind: "not-found", file: surface.file }
         : { kind: "not-found", file: surface.file, csp: surface.csp };
 }
-// Redirect targets are always same-origin paths. Collapsing leading slashes
-// and backslashes keeps "/de//evil.example" from turning into the
-// protocol-relative "//evil.example".
-function sameOriginPath(path) {
-    return `/${path.replace(/^[/\\]+/, "")}`;
-}
-function splitFirstSegment(path) {
-    const withoutLeading = path.replace(/^\/+/, "");
-    const slash = withoutLeading.indexOf("/");
-    if (slash === -1)
-        return { segment: withoutLeading, rest: "/" };
-    return { segment: withoutLeading.slice(0, slash), rest: withoutLeading.slice(slash) };
-}
 function apexPage(options, req) {
     const { apex, locales } = options;
     if (locales === undefined)
@@ -57,28 +62,26 @@ function apexPage(options, req) {
     const locale = locales.prefixed.includes(segment) ? segment : locales.default;
     return serve(apex, apex.localeFiles?.[locale] ?? apex.file);
 }
-async function tenantPage(options, key, systemQuery) {
+async function tenantPage(options, key, systemQuery, keySource) {
     // No key (bare tenant prefix): the shell handles login and tenant choice.
     if (key === null)
         return serve(options.tenant);
-    const isCandidate = options.tenantBy === "path" ? isPathTenantKeyCandidate : isTenantKeyCandidate;
+    const isCandidate = keySource === "path" ? isPathTenantKeyCandidate : isTenantKeyCandidate;
     if (!isCandidate(key))
         return notFound(options.unknownTenant);
     return (await isTenantKeyKnown(systemQuery, key))
         ? serve(options.tenant)
         : notFound(options.unknownTenant);
 }
-function tenantKeyFromPath(prefix, path) {
-    if (path !== prefix && !path.startsWith(`${prefix}/`))
-        return undefined;
-    const { segment } = splitFirstSegment(path.slice(prefix.length));
-    return segment === "" ? null : segment;
-}
 // The routing decision for runProdApp's `hostDispatch` (and, via
 // toDevHostDispatch, the dev server). Unknown hosts fail closed with 404.
 export function createHostDispatch(options) {
     validateHostRoutingOptions(options);
+    const redirects = options.redirects ?? [];
     return async (req, { systemQuery }) => {
+        const redirect = matchRedirect(redirects, req.host, req.path, req.search);
+        if (redirect !== undefined)
+            return { kind: "redirect", ...redirect };
         const host = classifyHost(req.host, options);
         switch (host.kind) {
             case "fixed":
@@ -88,12 +91,19 @@ export function createHostDispatch(options) {
             case "subdomain":
                 if (options.tenantBy !== "host")
                     return notFound(undefined);
-                return tenantPage(options, host.key, systemQuery);
+                return tenantPage(options, host.key, systemQuery, "subdomain");
+            case "resolved": {
+                if (await isHostKnown(systemQuery, host.hostname))
+                    return serve(options.tenant);
+                return notFound(host.hostname.endsWith(`.${options.baseDomain.toLowerCase()}`)
+                    ? options.unknownTenant
+                    : undefined);
+            }
             case "apex": {
-                if (options.tenantBy === "path") {
+                if (options.tenantPathPrefix !== undefined) {
                     const key = tenantKeyFromPath(options.tenantPathPrefix, req.path);
                     if (key !== undefined)
-                        return tenantPage(options, key, systemQuery);
+                        return tenantPage(options, key, systemQuery, "path");
                 }
                 return apexPage(options, req);
             }

package/dist/host-routing/feature.js

@@ -1,31 +1,70 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, defineQueryHandler, isSystemTenant, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, } from "../auth-foundation/index.js";
-import { isTenantServingPublicContent, tenantTable, } from "../tenant/index.js";
-import { HOST_ROUTING_FEATURE, TENANT_KEY_MAX_LENGTH } from "./constants.js";
-import { classifyHost } from "./host.js";
+import { HOST_HEADER_MAX_LENGTH, HOST_ROUTING_FEATURE, TENANT_KEY_MAX_LENGTH, } from "./constants.js";
+import { classifyHost, normalizeHostname } from "./host.js";
+import { isTenantServing, servingTenantIdByKey, servingTenantIdByResolver, } from "./tenant-lookup.js";
 import { validateHostRoutingOptions } from "./validate-options.js";
-// Disabled tenants and tenants in any destroy phase are not routable, the same
-// rule public files and pages follow.
-async function servingTenantIdByKey(db, key) {
-    const row = await fetchOne(db, tenantTable, { key });
-    return row !== undefined && isTenantServingPublicContent(row) ? row.id : null;
-}
-async function isTenantServing(db, id) {
-    const row = await fetchOne(db, tenantTable, { id });
-    return row !== undefined && isTenantServingPublicContent(row);
-}
 // auth-foundation types the Hono context as unknown to stay free of a hono dep.
-function isHostHeaderReader(c) {
+function isRequestReader(c) {
     return (typeof c === "object" &&
         c !== null &&
         "req" in c &&
         typeof c.req === "object" &&
         c.req !== null &&
         "header" in c.req &&
-        typeof c.req.header === "function");
+        typeof c.req.header === "function" &&
+        "url" in c.req &&
+        typeof c.req.url === "string" &&
+        "path" in c.req &&
+        typeof c.req.path === "string");
+}
+// Hono routes on the decoded path and ignores a trailing slash, so the
+// allowlist must compare the same shape: "/api/%71uery" and "/api/query/"
+// reach the query handler too.
+function routedPathOf(c) {
+    return c.req.path.length > 1 ? c.req.path.replace(/\/+$/, "") : c.req.path;
+}
+// "example.com" and "www.example.com" are one site: a host without its own
+// entry falls back to the other variant's entry instead of keeping the anchor.
+function allowlistFor(options, hostname) {
+    const allowlists = options.apexAnonymousQueryAllowlist;
+    if (allowlists === undefined)
+        return undefined;
+    const counterpart = hostname.startsWith("www.") ? hostname.slice(4) : `www.${hostname}`;
+    for (const key of [hostname, counterpart]) {
+        if (Object.hasOwn(allowlists, key))
+            return allowlists[key];
+    }
+    return undefined;
+}
+// Both carry { type, payload } and run read handlers; /api/batch is commands only.
+const TYPED_READ_PATHS = new Set(["/api/query", "/api/stream"]);
+const queryTypeBodySchema = z.object({ type: z.string() });
+// Reads the query type from a clone, so the body stays intact for the handler.
+async function peekQueryType(c) {
+    if (c.req.raw === undefined)
+        return null;
+    try {
+        const parsed = queryTypeBodySchema.safeParse(await c.req.raw.clone().json());
+        return parsed.success ? parsed.data.type : null;
+    }
+    catch {
+        return null;
+    }
+}
+// Apex anchor tenant for anonymous calls. A host with an allowlist only gets
+// the anchor for the listed query types on read paths; other paths keep it.
+async function apexAnchorFor(options, c, hostname) {
+    const anchor = options.apexAnonymousTenantId ?? null;
+    if (anchor === null)
+        return null;
+    const allowlist = allowlistFor(options, hostname);
+    if (allowlist === undefined || !TYPED_READ_PATHS.has(routedPathOf(c)))
+        return anchor;
+    const type = await peekQueryType(c);
+    return type !== null && allowlist.includes(type) ? anchor : null;
 }
 // Returns only { exists }: the same fact the tenant 404 page already makes
 // public, never other tenant fields. Rate-limited so it is no cheap oracle.
@@ -47,34 +86,66 @@ const tenantKeyExistsQuery = defineQueryHandler({
         return { exists: (await servingTenantIdByKey(db, query.payload.key)) !== null };
     },
 });
+function hostTenantExistsQueryFor(options) {
+    return defineQueryHandler({
+        name: "host-tenant-exists",
+        schema: z.object({ host: z.string().min(1).max(HOST_HEADER_MAX_LENGTH) }),
+        access: { roles: ["anonymous"] },
+        rateLimit: { per: "ip+handler", limit: 120, windowSeconds: 60 },
+        // Page-routing plumbing, not a task an agent performs.
+        agent: { expose: false },
+        description: "Anonymous host check backing the unknown-host 404 of the host-routing hostDispatch in tenantBy resolver mode. Returns only { exists }.",
+        handler: async (query, ctx) => {
+            if (!ctx.systemDb) {
+                throw new InternalError({
+                    message: "host-routing:query:host-tenant-exists requires ctx.systemDb (r.systemScope())",
+                });
+            }
+            const hostname = normalizeHostname(query.payload.host);
+            if (hostname === null)
+                return { exists: false };
+            const db = ctx.systemDb.acknowledgeCrossTenant("host existence check for the host-routing 404 — publicly observable via the 404 itself");
+            return { exists: (await servingTenantIdByResolver(options, db, hostname)) !== null };
+        },
+    });
+}
 function tenantResolverFor(options) {
-    const apexTenantId = options.apexAnonymousTenantId ?? null;
-    if (options.tenantBy === "host") {
+    if (options.tenantBy !== "path") {
         return {
             trust: "authoritative",
             build: ({ db }) => async (c) => {
-                if (!isHostHeaderReader(c))
+                if (!isRequestReader(c))
                     return null;
-                const host = classifyHost(c.req.header("Host") ?? "", options);
-                if (host.kind === "subdomain")
-                    return servingTenantIdByKey(db, host.key);
+                const hostHeader = c.req.header("Host") ?? "";
+                const host = classifyHost(hostHeader, options);
                 // Fixed and unknown hosts have no anonymous tenant: an authoritative
                 // null answers tenant_required, whatever X-Tenant says.
-                return host.kind === "apex" ? apexTenantId : null;
+                switch (host.kind) {
+                    case "subdomain":
+                        return servingTenantIdByKey(db, host.key);
+                    case "resolved":
+                        return servingTenantIdByResolver(options, db, host.hostname);
+                    case "apex":
+                        return apexAnchorFor(options, c, normalizeHostname(hostHeader) ?? "");
+                    case "fixed":
+                    case "unknown":
+                        return null;
+                }
             },
         };
     }
-    if (apexTenantId === null)
+    if (options.apexAnonymousTenantId === undefined)
         return undefined;
     // Path mode: the client names its tenant; the apex default only fills in
     // when it does not.
     return {
         trust: "fallback-only",
         build: () => async (c) => {
-            if (!isHostHeaderReader(c))
+            if (!isRequestReader(c))
                 return null;
-            return classifyHost(c.req.header("Host") ?? "", options).kind === "apex"
-                ? apexTenantId
+            const hostHeader = c.req.header("Host") ?? "";
+            return classifyHost(hostHeader, options).kind === "apex"
+                ? apexAnchorFor(options, c, normalizeHostname(hostHeader) ?? "")
                 : null;
         },
     };
@@ -89,6 +160,8 @@ export function createHostRoutingFeature(options) {
         r.requires({ features: ["auth-foundation", "tenant"] });
         r.systemScope();
         r.queryHandler(tenantKeyExistsQuery);
+        if (typeof options.tenantBy === "function")
+            r.queryHandler(hostTenantExistsQueryFor(options));
         const resolver = tenantResolverFor(options);
         if (resolver !== undefined) {
             // biome-ignore lint/correctness/useHookAtTopLevel: r.useExtension is a registrar method, not a React hook; path mode without an apex tenant must leave the resolver slot free.

package/dist/host-routing/host.d.ts

@@ -8,7 +8,16 @@ export type HostClass = {
 } | {
     readonly kind: "subdomain";
     readonly key: string;
+} | {
+    readonly kind: "resolved";
+    readonly hostname: string;
 } | {
     readonly kind: "unknown";
 };
 export declare function classifyHost(host: string, options: HostRoutingOptions): HostClass;
+export declare function splitFirstSegment(path: string): {
+    readonly segment: string;
+    readonly rest: string;
+};
+export declare function tenantKeyFromPath(prefix: string, path: string): string | null | undefined;
+export declare function isApexHostname(hostname: string, baseDomain: string): boolean;

package/dist/host-routing/host.js

@@ -23,9 +23,11 @@ export function classifyHost(host, options) {
         : undefined;
     if (fixed !== undefined)
         return { kind: "fixed", surface: fixed };
-    const baseDomain = options.baseDomain.toLowerCase();
-    if (hostname === baseDomain || hostname === `www.${baseDomain}`)
+    if (isApexHostname(hostname, options.baseDomain))
         return { kind: "apex" };
+    const baseDomain = options.baseDomain.toLowerCase();
+    if (typeof options.tenantBy === "function")
+        return { kind: "resolved", hostname };
     const suffix = `.${baseDomain}`;
     if (!hostname.endsWith(suffix))
         return { kind: "unknown" };
@@ -35,3 +37,23 @@ export function classifyHost(host, options) {
         return { kind: "unknown" };
     return { kind: "subdomain", key: label };
 }
+export function splitFirstSegment(path) {
+    const withoutLeading = path.replace(/^\/+/, "");
+    const slash = withoutLeading.indexOf("/");
+    if (slash === -1)
+        return { segment: withoutLeading, rest: "/" };
+    return { segment: withoutLeading.slice(0, slash), rest: withoutLeading.slice(slash) };
+}
+// undefined: path is outside the prefix; null: bare prefix without a key.
+export function tenantKeyFromPath(prefix, path) {
+    if (path !== prefix && !path.startsWith(`${prefix}/`))
+        return undefined;
+    const { segment } = splitFirstSegment(path.slice(prefix.length));
+    return segment === "" ? null : segment;
+}
+// Apex hostnames are the only ones that may carry a path-named tenant or an
+// anonymous anchor tenant.
+export function isApexHostname(hostname, baseDomain) {
+    const base = baseDomain.toLowerCase();
+    return hostname === base || hostname === `www.${base}`;
+}

package/dist/host-routing/index.d.ts

@@ -2,4 +2,5 @@ export { HOST_ROUTING_FEATURE, HostRoutingQueries, isTenantKeyCandidate, TENANT_
 export { createHostDispatch, type HostRoutingDispatchFn, type HostRoutingDispatchResult, type HostRoutingRequest, } from "./dispatch.ts";
 export { createHostRoutingFeature } from "./feature.ts";
 export { normalizeHostname } from "./host.ts";
-export type { HostRoutingApexSurface, HostRoutingLocales, HostRoutingOptions, HostRoutingSurface, HostRoutingTenantMode, } from "./options.ts";
+export type { HostRoutingApexSurface, HostRoutingLocales, HostRoutingOptions, HostRoutingRedirect, HostRoutingSurface, HostRoutingTenantMode, HostTenantResolver, } from "./options.ts";
+export { createHostTenantIdResolver } from "./tenant-lookup.ts";

package/dist/host-routing/index.js

@@ -2,3 +2,4 @@ export { HOST_ROUTING_FEATURE, HostRoutingQueries, isTenantKeyCandidate, TENANT_
 export { createHostDispatch, } from "./dispatch.js";
 export { createHostRoutingFeature } from "./feature.js";
 export { normalizeHostname } from "./host.js";
+export { createHostTenantIdResolver } from "./tenant-lookup.js";

package/dist/host-routing/options.d.ts

@@ -1,3 +1,4 @@
+import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 export type HostRoutingSurface = {
     readonly file: string;
@@ -10,11 +11,22 @@ export type HostRoutingLocales = {
     readonly default: string;
     readonly prefixed: readonly string[];
 };
+export type HostTenantResolver = (host: string, db: DbConnection | TenantDb) => Promise<TenantId | null> | TenantId | null;
 export type HostRoutingTenantMode = {
     readonly tenantBy: "host";
+    readonly tenantPathPrefix?: string;
 } | {
     readonly tenantBy: "path";
     readonly tenantPathPrefix: string;
+} | {
+    readonly tenantBy: HostTenantResolver;
+    readonly tenantPathPrefix?: string;
+};
+export type HostRoutingRedirect = {
+    readonly from: string;
+    readonly to: string;
+    readonly host?: string;
+    readonly status?: 301 | 302;
 };
 export type HostRoutingOptions = HostRoutingTenantMode & {
     readonly baseDomain: string;
@@ -24,4 +36,6 @@ export type HostRoutingOptions = HostRoutingTenantMode & {
     readonly hosts?: Readonly<Record<string, HostRoutingSurface>>;
     readonly locales?: HostRoutingLocales;
     readonly apexAnonymousTenantId?: TenantId;
+    readonly apexAnonymousQueryAllowlist?: Readonly<Record<string, readonly string[]>>;
+    readonly redirects?: readonly HostRoutingRedirect[];
 };

package/dist/host-routing/redirects.d.ts

@@ -0,0 +1,6 @@
+import type { HostRoutingRedirect } from "./options.ts";
+export declare function sameOriginPath(path: string): string;
+export declare function matchRedirect(redirects: readonly HostRoutingRedirect[], host: string, path: string, search: string): {
+    readonly to: string;
+    readonly status: 301 | 302;
+} | undefined;

package/dist/host-routing/redirects.js

@@ -0,0 +1,27 @@
+import { normalizeHostname } from "./host.js";
+// Same-origin targets collapse leading slashes and backslashes so an appended
+// "//evil.example" remainder can never turn into a protocol-relative URL.
+export function sameOriginPath(path) {
+    return `/${path.replace(/^[/\\]+/, "")}`;
+}
+function remainderAfter(from, path) {
+    if (path === from)
+        return "";
+    const prefix = from.endsWith("/") ? from : `${from}/`;
+    return path.startsWith(prefix) ? path.slice(prefix.length - 1) : null;
+}
+export function matchRedirect(redirects, host, path, search) {
+    const hostname = normalizeHostname(host);
+    for (const rule of redirects) {
+        if (rule.host !== undefined && rule.host !== hostname)
+            continue;
+        const remainder = remainderAfter(rule.from, path);
+        if (remainder === null)
+            continue;
+        const target = rule.to.startsWith("https://")
+            ? `${rule.to.replace(/\/$/, "")}${remainder}`
+            : sameOriginPath(`${rule.to.replace(/\/$/, "")}${remainder}`);
+        return { to: `${target}${search}`, status: rule.status ?? 301 };
+    }
+    return undefined;
+}

package/dist/host-routing/tenant-lookup.d.ts

@@ -0,0 +1,7 @@
+import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { HostRoutingOptions } from "./options.ts";
+export declare function servingTenantIdByKey(db: DbConnection | TenantDb, key: string): Promise<TenantId | null>;
+export declare function isTenantServing(db: DbConnection | TenantDb, id: TenantId): Promise<boolean>;
+export declare function servingTenantIdByResolver(options: HostRoutingOptions, db: DbConnection | TenantDb, hostname: string): Promise<TenantId | null>;
+export declare function createHostTenantIdResolver(options: HostRoutingOptions, db: DbConnection | TenantDb): (host: string) => Promise<TenantId | null>;

package/dist/host-routing/tenant-lookup.js

@@ -0,0 +1,39 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
+import { isTenantServingPublicContent, tenantTable, } from "../tenant/index.js";
+import { classifyHost } from "./host.js";
+// Disabled tenants and tenants in any destroy phase are not routable, the same
+// rule public files and pages follow.
+export async function servingTenantIdByKey(db, key) {
+    const row = await fetchOne(db, tenantTable, { key });
+    return row !== undefined && isTenantServingPublicContent(row) ? row.id : null;
+}
+export async function isTenantServing(db, id) {
+    const row = await fetchOne(db, tenantTable, { id });
+    return row !== undefined && isTenantServingPublicContent(row);
+}
+export async function servingTenantIdByResolver(options, db, hostname) {
+    if (typeof options.tenantBy !== "function")
+        return null;
+    const resolved = await options.tenantBy(hostname, db);
+    return resolved !== null && (await isTenantServing(db, resolved)) ? resolved : null;
+}
+// The tenant a Host header belongs to, without any request: subdomain key,
+// resolver result or the apex anchor. Fixed and unknown hosts have none.
+// Meant for features that serve per-tenant content by host, e.g. the
+// `resolveApexTenant` option of managed-pages.
+export function createHostTenantIdResolver(options, db) {
+    return async (host) => {
+        const classified = classifyHost(host, options);
+        switch (classified.kind) {
+            case "subdomain":
+                return options.tenantBy === "host" ? servingTenantIdByKey(db, classified.key) : null;
+            case "resolved":
+                return servingTenantIdByResolver(options, db, classified.hostname);
+            case "apex":
+                return options.apexAnonymousTenantId ?? null;
+            case "fixed":
+            case "unknown":
+                return null;
+        }
+    };
+}

package/dist/host-routing/validate-options.js

@@ -1,6 +1,36 @@
+import { isApexHostname } from "./host.js";
 const DOMAIN_PATTERN = /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/;
 const PATH_PREFIX_PATTERN = /^\/[a-z0-9-]+(?:\/[a-z0-9-]+)*$/;
 const LOCALE_PATTERN = /^[a-z]{2}(?:-[a-z]{2})?$/;
+const REDIRECT_PATH_PATTERN = /^\/[A-Za-z0-9._~/-]*$/;
+// A redirect target is either a same-origin path or an https URL; neither may
+// carry a query or fragment, because the request's query string is appended.
+const REDIRECT_TARGET_PATTERN = /^(?:\/(?!\/)[A-Za-z0-9._~/-]*|https:\/\/[a-z0-9.-]+(?::[0-9]{1,5})?(?:\/[A-Za-z0-9._~/-]*)?)$/;
+function validateRedirects(options) {
+    for (const rule of options.redirects ?? []) {
+        if (!REDIRECT_PATH_PATTERN.test(rule.from)) {
+            throw new Error(`host-routing: redirect from must be a path like "/old", got "${rule.from}"`);
+        }
+        if (!REDIRECT_TARGET_PATTERN.test(rule.to)) {
+            throw new Error(`host-routing: redirect to must be a same-origin path or an https URL without query, got "${rule.to}"`);
+        }
+        if (rule.host !== undefined && !DOMAIN_PATTERN.test(rule.host)) {
+            throw new Error(`host-routing: redirect host must be a lowercase hostname, got "${rule.host}"`);
+        }
+    }
+}
+function validateAnonymousQueryAllowlist(options) {
+    if (options.apexAnonymousQueryAllowlist !== undefined && options.tenantBy === "path") {
+        // Path mode resolves as fallback-only: a client-sent X-Tenant or cookie wins
+        // before the resolver runs, so the allowlist could never hold.
+        throw new Error('host-routing: apexAnonymousQueryAllowlist cannot be used with tenantBy "path", because the client names its tenant there and bypasses the allowlist');
+    }
+    for (const host of Object.keys(options.apexAnonymousQueryAllowlist ?? {})) {
+        if (!isApexHostname(host, options.baseDomain)) {
+            throw new Error(`host-routing: apexAnonymousQueryAllowlist key must be the apex or www.<apex> hostname, got "${host}"`);
+        }
+    }
+}
 // Checked once when the app composes its features, so a config typo fails
 // the boot instead of routing every request to a 404.
 export function validateHostRoutingOptions(options) {
@@ -12,9 +42,12 @@ export function validateHostRoutingOptions(options) {
             throw new Error(`host-routing: hosts key must be a lowercase hostname, got "${host}"`);
         }
     }
-    if (options.tenantBy === "path" && !PATH_PREFIX_PATTERN.test(options.tenantPathPrefix)) {
+    if (options.tenantPathPrefix !== undefined &&
+        !PATH_PREFIX_PATTERN.test(options.tenantPathPrefix)) {
         throw new Error(`host-routing: tenantPathPrefix must look like "/app" (leading slash, no trailing slash), got "${options.tenantPathPrefix}"`);
     }
+    validateRedirects(options);
+    validateAnonymousQueryAllowlist(options);
     const { locales } = options;
     if (locales !== undefined) {
         for (const locale of [locales.default, ...locales.prefixed]) {