@cosmicdrift/kumiko-samples 0.373.0 → 0.377.0

package/packages/bundled-features/src/cap-overview/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.374.0",
+    "type": "breaking",
+    "title": "tenant-caps:list pages by offset and rejects cursor",
+    "detail": "The cap overview list showed page 1 on every page because the pager sends offset and the query only read cursor. tenant-caps:list now takes offset like the pager; a cursor in the payload is rejected with a 400 validation error and sort is an enum of the sortable fields. The unused cap-overview.errors.invalidCursor and sortFieldUnsupported keys are gone.",
+    "migration": "Callers of cap-overview:query:tenant-caps:list must send offset instead of cursor, and only a sortable field name as sort. Apps that override the removed i18n keys cap-overview.errors.invalidCursor or cap-overview.errors.sortFieldUnsupported can delete them. No caller in the kumiko-enterprise, kumiko-platform, kumiko-studio or app repos sends a cursor or defines these keys."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/packages/bundled-features/src/cap-overview/handlers/tenant-caps-list.query.ts

@@ -1,17 +1,12 @@
-import {
-  buildEntityTable,
-  decodeCursor,
-  encodeCursor,
-  selectMany,
-} from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   type ConfigAccessor,
   definePagedQueryHandler,
-  MAX_LIST_LIMIT,
+  pagedListSchema,
+  pageRows,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
-import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { subscriptionsProjectionTable } from "../../billing-foundation/index.ts";
 import type { CapLimitContext } from "../../cap-counter/index.ts";
@@ -59,7 +54,6 @@ const FILTER_OP = z.enum(["eq", "ne", "lt", "gt", "in"]);
 type FilterOp = z.infer<typeof FILTER_OP>;
 
 const SORTABLE_FIELDS = ["name", "tier", "billing"] as const;
-type SortableField = (typeof SORTABLE_FIELDS)[number];
 
 function tenantCapKey(tenantId: string, capId: string): string {
   return JSON.stringify([tenantId, capId]);
@@ -83,10 +77,6 @@ async function resolveLimitsByTenantAndCap(
   return new Map(entries);
 }
 
-function isSortableField(field: string): field is SortableField {
-  return isOneOf(SORTABLE_FIELDS, field);
-}
-
 // tier is a plain string with no defined ordering — lt/gt have no meaning
 // on it and are rejected rather than silently treated as "no filter".
 function assertSupportedTierFilterOp(op: FilterOp): void {
@@ -152,16 +142,10 @@ export function createTenantCapsListQuery(caps: readonly CapSpec[], listCaps: re
     name: "tenant-caps:list",
     description:
       "Lists every tenant on the platform with its tier, billing provider/status and per-cap usage, paged, searchable by name and filterable by tier; use it as the operator-wide capacity overview.",
-    schema: z.object({
-      cursor: z.string().optional(),
-      limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(50),
-      sort: z.string().optional(),
-      sortDirection: z.enum(["asc", "desc"]).optional(),
-      search: z.string().optional(),
+    schema: pagedListSchema(SORTABLE_FIELDS).extend({
       filters: z
         .array(z.object({ field: z.string(), op: FILTER_OP, value: z.unknown() }))
         .optional(),
-      totalCount: z.boolean().optional(),
     }),
     access: { roles: ["SystemAdmin"] },
     escapeHatch: {
@@ -190,68 +174,30 @@ export function createTenantCapsListQuery(caps: readonly CapSpec[], listCaps: re
       const assignmentByTenant = new Map(assignments.map((row) => [row.tenantId, row]));
       const subscriptionByTenant = new Map(subscriptions.map((row) => [row.tenantId, row]));
 
-      // Case-insensitive substring search has no `ilike` operator in the
-      // query builder (only `like`, SQL-LIKE case-sensitive) — filtered here
-      // in JS, same as tenant/team-list.query.ts's search.
-      const search = query.payload.search?.trim().toLowerCase();
       const tierFilter = extractTierFilter(query.payload.filters ?? []);
 
       const merged = tenants
-        .filter(
-          (tenant) =>
-            search === undefined || search === "" || tenant.name.toLowerCase().includes(search),
-        )
         .map((tenant) => {
           const assignment = assignmentByTenant.get(tenant.id);
           return {
+            id: tenant.id,
             tenantId: tenant.id,
             name: tenant.name,
             tier: assignment?.tier ?? "",
-            source: assignment?.source ?? null,
             billing: billingLabel(subscriptionByTenant.get(tenant.id), assignment?.source ?? null),
           };
         })
         .filter((row) => matchesTierFilter(row.tier, tierFilter));
 
-      const sortField = query.payload.sort ?? "name";
-      if (!isSortableField(sortField)) {
-        throw new ValidationError({
-          fields: [
-            {
-              path: "sort",
-              code: "unsupported_field",
-              i18nKey: "cap-overview.errors.sortFieldUnsupported",
-              params: { field: sortField },
-            },
-          ],
-        });
-      }
-      const sortDirection = query.payload.sortDirection ?? "asc";
-      const directionMultiplier = sortDirection === "asc" ? 1 : -1;
-      const sorted = [...merged].sort(
-        (a, b) => a[sortField].localeCompare(b[sortField]) * directionMultiplier,
-      );
-
-      // ponytail: base64-wrapped offset, not a SQL keyset — rows come from a
-      // JS merge of three tables (tenant/tier-assignment/subscription), same
-      // rationale as tenant/team-list.query.ts. Holds up to tier-engine's
-      // documented "single-pass scan" scale (a few thousand tenants); past
-      // that the fix is a real combined read-projection, not a cursor
-      // bolted onto this merge.
-      const offset = query.payload.cursor ? Number(decodeCursor(query.payload.cursor)) : 0;
-      if (!Number.isInteger(offset) || offset < 0) {
-        throw new ValidationError({
-          fields: [
-            {
-              path: "cursor",
-              code: "invalid_cursor",
-              i18nKey: "cap-overview.errors.invalidCursor",
-            },
-          ],
-        });
-      }
-      const limit = query.payload.limit;
-      const page = sorted.slice(offset, offset + limit);
+      // Search and paging run in memory because the rows are a JS merge of
+      // three tables (tenant/tier-assignment/subscription), same rationale as
+      // tenant/team-list.query.ts. Holds up to tier-engine's documented
+      // "single-pass scan" scale (a few thousand tenants); past that the fix
+      // is a real combined read-projection.
+      const { rows: page, total } = pageRows(merged, query.payload, {
+        searchFields: ["name"],
+        defaultSort: "name",
+      });
 
       // Usage is computed only for this page's tenant ids, never for the
       // full tenant set; caps without usageBatch still cost one query per
@@ -302,14 +248,7 @@ export function createTenantCapsListQuery(caps: readonly CapSpec[], listCaps: re
         };
       });
 
-      const nextCursor =
-        offset + limit < sorted.length ? encodeCursor(String(offset + limit)) : null;
-
-      return {
-        rows,
-        nextCursor,
-        ...(query.payload.totalCount === true && { total: merged.length }),
-      };
+      return { rows, nextCursor: null, ...(total !== undefined && { total }) };
     },
   });
 }

package/packages/bundled-features/src/cap-overview/i18n.ts

@@ -17,11 +17,9 @@ export const CAP_OVERVIEW_I18N: Readonly<Record<string, LocalizedString>> = {
   "cap-overview.errors.progressPrimitiveMissing": {
     en: "Usage bar unavailable — Progress primitive is not registered.",
   },
-  "cap-overview.errors.invalidCursor": { en: "The pagination cursor is invalid." },
   "cap-overview.errors.filterFieldUnsupported": {
     en: "Filtering by this field is not supported, or tier was filtered more than once.",
   },
-  "cap-overview.errors.sortFieldUnsupported": { en: "Sorting by this field is not supported." },
   "cap-overview.errors.tenantOverrideRequiresSystemAdmin": {
     en: "Only SystemAdmin may query another tenant's data.",
   },

package/packages/bundled-features/src/cap-overview/web/cap-cards-panel.tsx

@@ -1,13 +1,13 @@
-import { EMPTY_VALUE_PLACEHOLDER } from "@cosmicdrift/kumiko-headless";
 // @runtime client
 import type { ExtensionSectionProps } from "@cosmicdrift/kumiko-renderer";
 import { usePrimitives, useQuery, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { EMPTY_VALUE_PLACEHOLDER } from "@cosmicdrift/kumiko-renderer/headless";
 import {
   EmptyState,
   StatCard,
   StatusBadge,
   type StatusTone,
-} from "@cosmicdrift/kumiko-renderer-web";
+} from "@cosmicdrift/kumiko-renderer/web";
 import { Database, FileText, Gauge, Hash, Mail, Users } from "lucide-react";
 import type { ComponentType, ReactNode } from "react";
 import { CapOverviewQueries } from "../constants.ts";
@@ -68,7 +68,7 @@ export function CapCardsPanel({ filterParams }: ExtensionSectionProps): ReactNod
   return (
     <div
       // Arbitrary bracket values (grid-cols-[repeat(...)]) never compiled:
-      // styles.css's Tailwind v4 @source scan only covers renderer-web/src,
+      // styles.css's Tailwind v4 @source scan only covers renderer/web/src,
       // renderer/src and samples/**/src (see its comment) — bundled-features
       // isn't scanned, so a class unique to this file has no generated rule
       // and silently no-ops (the grid fell back to one implicit column,

package/packages/bundled-features/src/cap-overview/web/client-plugin.tsx

@@ -1,6 +1,6 @@
 // @runtime client
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import {
   CAP_CARDS_PANEL_COMPONENT,
   CAP_OVERVIEW_FEATURE,

package/packages/bundled-features/src/channel-email/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.376.0",
+    "type": "improvement",
+    "title": "resolveEmail receives a typed tenant database",
+    "detail": "The context of EmailChannelOptions resolveEmail types db as TenantDb, so resolvers read tables without a cast."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/packages/bundled-features/src/channel-email/email-channel.ts

@@ -1,4 +1,5 @@
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import * as z from "zod";
@@ -185,7 +186,7 @@ type EmailChannelTransports =
 export type EmailChannelOptions = EmailChannelTransports & {
   readonly resolveEmail: (
     userId: string,
-    ctx: { db: unknown; tenantId: TenantId },
+    ctx: { db: TenantDb; tenantId: TenantId },
   ) => Promise<string | null>;
 };
 

package/packages/bundled-features/src/compliance-profiles/web/client-plugin.tsx

@@ -1,6 +1,6 @@
 // @runtime client
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import {
   COMPLIANCE_PROFILE_CATALOG_EXTENSION_NAME,
   COMPLIANCE_PROFILES_FEATURE,

package/packages/bundled-features/src/config/feature.ts

@@ -95,7 +95,7 @@ export function createConfigAccessor(
   return configAccessor;
 }
 
-// Pass to the test-stack / server-boot as `_configAccessorFactory` —
+// Pass to the test-stack / server-boot as `configAccessorFactory` —
 // `buildHandlerContext` mints a per-user `ctx.config` from this.
 export function createConfigAccessorFactory(
   registry: Registry,
@@ -115,7 +115,7 @@ export function requireConfigResolver(ctx: HandlerContext, handlerName: string):
     throw new InternalError({
       message:
         `[${handlerName}] ctx.configResolver missing — pass createConfigAccessorFactory's ` +
-        `output via extraContext._configAccessorFactory and the resolver via ` +
+        `output via extraContext.configAccessorFactory and the resolver via ` +
         `extraContext.configResolver at boot.`,
     });
   }

package/packages/bundled-features/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.377.0",
+    "type": "fix",
+    "title": "Forgetting a user also removes their unbound pending uploads",
+    "detail": "forget-subject for a user deleted only files bound to a record. Uploads the user made but never attached (file refs without an entity id) stayed behind. They are now removed with their bytes, except refs a record still names in a single-file column."
+  },
   {
     "version": "0.372.0",
     "type": "fix",

package/packages/bundled-features/src/custom-fields/web/client-plugin.tsx

@@ -11,7 +11,7 @@
 //     } },
 //   ]}
 
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import { CUSTOM_FIELDS_FEATURE_NAME, CUSTOM_FIELDS_FORM_EXTENSION_NAME } from "../constants.ts";
 import { CustomFieldsFormSection } from "./custom-fields-form-section.tsx";
 import { defaultTranslations } from "./i18n.ts";

package/packages/bundled-features/src/delivery/unsubscribe-page.ts

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { mailT } from "@cosmicdrift/kumiko-framework/i18n";
-import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-renderer/headless";
 import type { MailChrome, MailChromeLink } from "../renderer-foundation/index.ts";
 import { DELIVERY_RESUBSCRIBE_PATH, DELIVERY_UNSUBSCRIBE_PATH } from "./public-names.ts";
 import "./unsubscribe-page-strings.ts";

package/packages/bundled-features/src/delivery/web/client-plugin.tsx

@@ -1,6 +1,6 @@
 // @runtime client
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import {
   DELIVERY_CHANNEL_CELL_COMPONENT,
   DELIVERY_ERROR_CELL_COMPONENT,

package/packages/bundled-features/src/delivery/web/delivery-status-cell.tsx

@@ -5,7 +5,7 @@
 // projectionList renderer — only this one cell stays TSX.
 
 import { type ColumnRendererProps, useTranslation } from "@cosmicdrift/kumiko-renderer";
-import { StatusBadge, type StatusTone } from "@cosmicdrift/kumiko-renderer-web";
+import { StatusBadge, type StatusTone } from "@cosmicdrift/kumiko-renderer/web";
 import type { ReactNode } from "react";
 import { translateOrRaw } from "../../shared/web/translate-or-raw.ts";
 import { DeliveryStatus } from "../public-names.ts";

package/packages/bundled-features/src/feature-toggles/web/client-plugin.tsx

@@ -1,6 +1,6 @@
 // @runtime client
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import { FEATURE_TOGGLES_FEATURE } from "../constants.ts";
 import { defaultTranslations } from "./i18n.ts";
 

package/packages/bundled-features/src/file-provider-s3/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.376.0",
+    "type": "improvement",
+    "title": "Named S3 provider feature",
+    "detail": "createFileProviderS3NamedEnvFeature mounts an additional S3 provider under its own name with an env prefix, next to the default one, so a second bucket needs no hand-written wiring."
+  },
   {
     "version": "0.371.0",
     "type": "improvement",

package/packages/bundled-features/src/file-provider-s3/env-named-feature.ts

@@ -0,0 +1,45 @@
+import type {
+  FileProviderContext,
+  FileProviderPlugin,
+} from "@cosmicdrift/kumiko-bundled-features/file-foundation";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
+import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
+import { createRuntimeS3EnvSchema } from "./env-schema.ts";
+import { createS3ProviderFromEnv } from "./lib/env-helper.ts";
+
+export type NamedS3EnvProviderOptions = {
+  /** Provider key tenants select in `file-foundation`'s `provider` config; the feature is `file-provider-s3-env-<name>`. */
+  readonly name: string;
+  /** Env prefix of the credential set, e.g. `RELEASES_S3_`. */
+  readonly envPrefix: string;
+  /** Tolerate missing credentials at boot; the provider then fails on its first file operation. */
+  readonly lazy?: boolean;
+};
+
+/** An additional S3 provider next to `"s3-env"`, reading its credentials from `<envPrefix>BUCKET` etc. */
+export function createFileProviderS3NamedEnvFeature(options: NamedS3EnvProviderOptions) {
+  const envSchema = createRuntimeS3EnvSchema(options.envPrefix);
+  const feature = defineFeature(
+    `file-provider-s3-env-${options.name}`,
+    (r) => {
+      r.describe(
+        `Registers the "${options.name}" provider for \`file-foundation\`: one shared S3 bucket for every tenant, credentials from the \`${options.envPrefix}*\` env vars. A second bucket next to the \`"s3-env"\` provider (for example release artifacts).`,
+      );
+      r.uiHints({
+        displayLabel: `File Provider · S3 (${options.name})`,
+        category: "storage",
+        recommended: false,
+      });
+      r.requires({ features: ["file-foundation"] });
+      r.envSchema(envSchema);
+      const plugin: FileProviderPlugin = {
+        build: async (_ctx: FileProviderContext, _tenantId: string): Promise<FileStorageProvider> =>
+          createS3ProviderFromEnv(options.envPrefix), // @wrapper-known semantic-alias
+      };
+      r.useExtension("fileProvider", options.name, plugin);
+    },
+    { dedupeOptions: { name: options.name, envPrefix: options.envPrefix } },
+  );
+  return featureWithEnvSchema(feature, envSchema);
+}

package/packages/bundled-features/src/file-provider-s3/env-schema.ts

@@ -17,17 +17,8 @@ export const s3EndpointSchema = z
   .url({ protocol: /^https?$/ })
   .refine(isAcceptableEndpoint, "must use https unless the host is loopback");
 
-/** Builds the env block `createS3ProviderFromEnv(prefix)` reads, e.g.
- *  `createS3EnvSchema({ prefix: "RELEASES_S3_" })` for a second bucket.
- *  Every field is optional: an app that mounts the env provider next to
- *  another one picks the provider at runtime, and the provider reports
- *  missing credentials on its first file operation. */
-export function createS3EnvSchema<const TPrefix extends string>(options: {
-  readonly prefix: TPrefix;
-}) {
-  const { prefix } = options;
-  // @cast-boundary schema-walk — computed template keys widen to an index signature; the literal keys below are exactly the ones S3EnvShape names.
-  const shape = {
+function buildS3Shape(prefix: string) {
+  return {
     [`${prefix}BUCKET`]: z.string().min(1).optional().describe("S3 bucket."),
     [`${prefix}REGION`]: z.string().min(1).optional().describe("S3 region."),
     [`${prefix}ACCESS_KEY`]: z
@@ -51,8 +42,24 @@ export function createS3EnvSchema<const TPrefix extends string>(options: {
       .enum(["true", "false"])
       .optional()
       .describe('Path-style bucket addressing ("true"), needed by MinIO and some S3 clones.'),
-  } as S3EnvShape<TPrefix>;
-  return z.object(shape);
+  };
+}
+
+/** Builds the env block `createS3ProviderFromEnv(prefix)` reads, e.g.
+ *  `createS3EnvSchema({ prefix: "RELEASES_S3_" })` for a second bucket.
+ *  Every field is optional: an app that mounts the env provider next to
+ *  another one picks the provider at runtime, and the provider reports
+ *  missing credentials on its first file operation. */
+export function createS3EnvSchema<const TPrefix extends string>(options: {
+  readonly prefix: TPrefix;
+}) {
+  // @cast-boundary schema-walk — computed template keys widen to an index signature; the literal keys below are exactly the ones S3EnvShape names.
+  return z.object(buildS3Shape(options.prefix) as S3EnvShape<TPrefix>);
+}
+
+/** Same block for a prefix only known at runtime (named providers); keys are typed as a record. */
+export function createRuntimeS3EnvSchema(prefix: string) {
+  return z.object(buildS3Shape(prefix));
 }
 
 type OptionalString = z.ZodOptional<z.ZodString>;

package/packages/bundled-features/src/file-provider-s3/index.ts

@@ -1,5 +1,9 @@
 // Public API of the file-provider-s3 bundled-feature.
 
+export {
+  createFileProviderS3NamedEnvFeature,
+  type NamedS3EnvProviderOptions,
+} from "./env-named-feature.ts";
 export { createS3EnvSchema, s3EndpointSchema, s3EnvSchema } from "./env-schema.ts";
 export {
   createFileProviderS3Feature,

package/packages/bundled-features/src/folders/web/client-plugin.tsx

@@ -1,6 +1,6 @@
 // @runtime client
 
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import { FOLDER_SECTION_EXTENSION_NAME, FOLDERS_FEATURE_NAME } from "../constants.ts";
 import { FolderSection } from "./folder-section.tsx";
 import { defaultTranslations } from "./i18n.ts";

package/packages/bundled-features/src/folders/web/folder-section.tsx

@@ -169,10 +169,9 @@ export function FolderSection({
         />
       </Field>
 
-      {/* Inline create-row: das Ordner-Input wächst, der Anlegen-Button sitzt
-          rechts daneben. ponytail: separate Zeile, weil die Combobox keine
-          create-on-type-Affordance hat — fold-in, wenn renderer-web ein
-          onCreate-Prop bekommt. */}
+      {/* Inline create row: the folder input grows, the create button sits next
+          to it. Separate row because the combobox has no create-on-type
+          affordance; fold in once renderer/web gets an onCreate prop. */}
       <div className="flex items-end gap-2">
         <div className="flex-1">
           <Field id="folder-section-new" label={t("folders.section.newLabel")}>

package/packages/bundled-features/src/host-routing/README.md

@@ -87,3 +87,10 @@ default applies. Options are validated when the feature or dispatch is built.
 
 Custom domains per tenant, legacy host redirects and app-specific query
 allowlists stay in the app: wrap the dispatch function and fall through to it.
+
+## Resolver, redirects and allowlist
+
+- `tenantBy: (host, db) => TenantId | null` resolves every host that is neither the apex nor a fixed host (profile subdomains, custom domains). The tenant must be enabled and active; null means 404 for pages and `tenant_required` for the API. `createHostTenantIdResolver(options, db)` exposes the same mapping for managed-pages' `resolveApexTenant`.
+- `tenantPathPrefix` is optional in host and resolver mode and serves `<prefix>/<key>` on the apex. The API half still takes the apex anchor there; an app that needs a path-named tenant on API calls resolves it itself.
+- `redirects: [{ from, to, host?, status? }]` run before host classification. `to` is configured, never derived from the request.
+- `apexAnonymousQueryAllowlist: { "example.com": ["feature:query:x"] }` limits the anonymous apex anchor to the listed query types on that host, for `/api/query` and `/api/stream`; other paths keep the anchor. `example.com` and `www.example.com` share one entry (a host without its own uses the other's). Combined with `tenantBy: "path"` it throws at boot, because the client names its tenant there (X-Tenant wins over the resolver) and would bypass the allowlist.

package/packages/bundled-features/src/host-routing/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.376.0",
+    "type": "improvement",
+    "title": "tenantBy resolver, apex path tenants, redirects and anonymous query allowlist",
+    "detail": "tenantBy accepts (host, db) => TenantId | null for profile subdomains and custom domains; tenantPathPrefix also works in host and resolver mode for apex path tenants. redirects send fixed 301/302 answers before host classification, apexAnonymousQueryAllowlist limits the anonymous apex anchor to listed query types per host (/api/query and /api/stream), and createHostTenantIdResolver(options, db) maps a Host header to its tenant for managed-pages. Existing \"host\" and \"path\" configs behave as before, except that apexAnonymousQueryAllowlist with tenantBy \"path\" is rejected at boot."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/packages/bundled-features/src/host-routing/constants.ts

@@ -2,6 +2,7 @@ export const HOST_ROUTING_FEATURE = "host-routing";
 
 export const HostRoutingQueries = {
   tenantKeyExists: `${HOST_ROUTING_FEATURE}:query:tenant-key-exists`,
+  hostTenantExists: `${HOST_ROUTING_FEATURE}:query:host-tenant-exists`,
 } as const;
 
 // Matches tenant:write:create's key limit; keeps lookups for absurd keys out
@@ -22,3 +23,6 @@ const PATH_TENANT_KEY_PATTERN = /^[A-Za-z0-9._~-]+$/;
 export function isPathTenantKeyCandidate(value: string): boolean {
   return value.length <= TENANT_KEY_MAX_LENGTH && PATH_TENANT_KEY_PATTERN.test(value);
 }
+
+// Longest Host header value a hostname plus port can take.
+export const HOST_HEADER_MAX_LENGTH = 260;

package/packages/bundled-features/src/host-routing/dispatch.ts

@@ -1,10 +1,11 @@
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { RateLimitError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
-import type { PageHeadSystemQuery } from "@cosmicdrift/kumiko-headless/apex";
+import type { PageHeadSystemQuery } from "@cosmicdrift/kumiko-renderer/headless/apex";
 import * as z from "zod";
 import { HostRoutingQueries, isPathTenantKeyCandidate, isTenantKeyCandidate } from "./constants.ts";
-import { classifyHost } from "./host.ts";
+import { classifyHost, splitFirstSegment, tenantKeyFromPath } from "./host.ts";
 import type { HostRoutingOptions, HostRoutingSurface } from "./options.ts";
+import { matchRedirect, sameOriginPath } from "./redirects.ts";
 import { validateHostRoutingOptions } from "./validate-options.ts";
 
 // Structurally identical to server-runtime's HostDispatchResult. Defined here
@@ -43,6 +44,21 @@ async function isTenantKeyKnown(systemQuery: PageHeadSystemQuery, key: string):
   return tenantKeyExistsResultSchema.parse(result).exists;
 }
 
+async function isHostKnown(systemQuery: PageHeadSystemQuery, host: string): Promise<boolean> {
+  let result: unknown;
+  try {
+    result = await systemQuery(HostRoutingQueries.hostTenantExists, { host }, SYSTEM_TENANT_ID);
+  } catch (error) {
+    if (error instanceof ValidationError) return false;
+    // The shell is harmless: the API resolver is authoritative and answers
+    // tenant_required for unknown hosts, while a 404 would hit visitors behind
+    // a shared NAT under load.
+    if (error instanceof RateLimitError) return true;
+    throw error;
+  }
+  return tenantKeyExistsResultSchema.parse(result).exists;
+}
+
 function serve(
   surface: HostRoutingSurface,
   file: string = surface.file,
@@ -59,20 +75,6 @@ function notFound(surface: HostRoutingSurface | undefined): HostRoutingDispatchR
     : { kind: "not-found", file: surface.file, csp: surface.csp };
 }
 
-// Redirect targets are always same-origin paths. Collapsing leading slashes
-// and backslashes keeps "/de//evil.example" from turning into the
-// protocol-relative "//evil.example".
-function sameOriginPath(path: string): string {
-  return `/${path.replace(/^[/\\]+/, "")}`;
-}
-
-function splitFirstSegment(path: string): { readonly segment: string; readonly rest: string } {
-  const withoutLeading = path.replace(/^\/+/, "");
-  const slash = withoutLeading.indexOf("/");
-  if (slash === -1) return { segment: withoutLeading, rest: "/" };
-  return { segment: withoutLeading.slice(0, slash), rest: withoutLeading.slice(slash) };
-}
-
 function apexPage(options: HostRoutingOptions, req: HostRoutingRequest): HostRoutingDispatchResult {
   const { apex, locales } = options;
   if (locales === undefined) return serve(apex);
@@ -88,27 +90,25 @@ async function tenantPage(
   options: HostRoutingOptions,
   key: string | null,
   systemQuery: PageHeadSystemQuery,
+  keySource: "path" | "subdomain",
 ): Promise<HostRoutingDispatchResult> {
   // No key (bare tenant prefix): the shell handles login and tenant choice.
   if (key === null) return serve(options.tenant);
-  const isCandidate = options.tenantBy === "path" ? isPathTenantKeyCandidate : isTenantKeyCandidate;
+  const isCandidate = keySource === "path" ? isPathTenantKeyCandidate : isTenantKeyCandidate;
   if (!isCandidate(key)) return notFound(options.unknownTenant);
   return (await isTenantKeyKnown(systemQuery, key))
     ? serve(options.tenant)
     : notFound(options.unknownTenant);
 }
 
-function tenantKeyFromPath(prefix: string, path: string): string | null | undefined {
-  if (path !== prefix && !path.startsWith(`${prefix}/`)) return undefined;
-  const { segment } = splitFirstSegment(path.slice(prefix.length));
-  return segment === "" ? null : segment;
-}
-
 // The routing decision for runProdApp's `hostDispatch` (and, via
 // toDevHostDispatch, the dev server). Unknown hosts fail closed with 404.
 export function createHostDispatch(options: HostRoutingOptions): HostRoutingDispatchFn {
   validateHostRoutingOptions(options);
+  const redirects = options.redirects ?? [];
   return async (req, { systemQuery }) => {
+    const redirect = matchRedirect(redirects, req.host, req.path, req.search);
+    if (redirect !== undefined) return { kind: "redirect", ...redirect };
     const host = classifyHost(req.host, options);
     switch (host.kind) {
       case "fixed":
@@ -117,11 +117,19 @@ export function createHostDispatch(options: HostRoutingOptions): HostRoutingDisp
         return notFound(undefined);
       case "subdomain":
         if (options.tenantBy !== "host") return notFound(undefined);
-        return tenantPage(options, host.key, systemQuery);
+        return tenantPage(options, host.key, systemQuery, "subdomain");
+      case "resolved": {
+        if (await isHostKnown(systemQuery, host.hostname)) return serve(options.tenant);
+        return notFound(
+          host.hostname.endsWith(`.${options.baseDomain.toLowerCase()}`)
+            ? options.unknownTenant
+            : undefined,
+        );
+      }
       case "apex": {
-        if (options.tenantBy === "path") {
+        if (options.tenantPathPrefix !== undefined) {
           const key = tenantKeyFromPath(options.tenantPathPrefix, req.path);
-          if (key !== undefined) return tenantPage(options, key, systemQuery);
+          if (key !== undefined) return tenantPage(options, key, systemQuery, "path");
         }
         return apexPage(options, req);
       }