@cosmicdrift/kumiko-samples 0.374.0 → 0.378.0

package/packages/bundled-features/src/channel-email/email-channel.ts

@@ -1,4 +1,5 @@
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import * as z from "zod";
@@ -185,7 +186,7 @@ type EmailChannelTransports =
 export type EmailChannelOptions = EmailChannelTransports & {
   readonly resolveEmail: (
     userId: string,
-    ctx: { db: unknown; tenantId: TenantId },
+    ctx: { db: TenantDb; tenantId: TenantId },
   ) => Promise<string | null>;
 };
 

package/packages/bundled-features/src/compliance-profiles/web/client-plugin.tsx

@@ -1,6 +1,6 @@
 // @runtime client
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import {
   COMPLIANCE_PROFILE_CATALOG_EXTENSION_NAME,
   COMPLIANCE_PROFILES_FEATURE,

package/packages/bundled-features/src/config/feature.ts

@@ -95,7 +95,7 @@ export function createConfigAccessor(
   return configAccessor;
 }
 
-// Pass to the test-stack / server-boot as `_configAccessorFactory` —
+// Pass to the test-stack / server-boot as `configAccessorFactory` —
 // `buildHandlerContext` mints a per-user `ctx.config` from this.
 export function createConfigAccessorFactory(
   registry: Registry,
@@ -115,7 +115,7 @@ export function requireConfigResolver(ctx: HandlerContext, handlerName: string):
     throw new InternalError({
       message:
         `[${handlerName}] ctx.configResolver missing — pass createConfigAccessorFactory's ` +
-        `output via extraContext._configAccessorFactory and the resolver via ` +
+        `output via extraContext.configAccessorFactory and the resolver via ` +
         `extraContext.configResolver at boot.`,
     });
   }

package/packages/bundled-features/src/config/web/i18n.ts

@@ -34,6 +34,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "config.settings.extensionSelectorHint":
       "Choose a provider. Its settings appear below and are saved together with it.",
     "config.settings.provider": "Provider",
+    "config.settings.provider.platformDefault": "Platform default",
     "config.settings.audience.system":
       "Applies to every tenant unless a tenant sets its own value.",
     "config.settings.audience.tenant":

package/packages/bundled-features/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.377.0",
+    "type": "fix",
+    "title": "Forgetting a user also removes their unbound pending uploads",
+    "detail": "forget-subject for a user deleted only files bound to a record. Uploads the user made but never attached (file refs without an entity id) stayed behind. They are now removed with their bytes, except refs a record still names in a single-file column."
+  },
   {
     "version": "0.372.0",
     "type": "fix",

package/packages/bundled-features/src/custom-fields/web/client-plugin.tsx

@@ -11,7 +11,7 @@
 //     } },
 //   ]}
 
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import { CUSTOM_FIELDS_FEATURE_NAME, CUSTOM_FIELDS_FORM_EXTENSION_NAME } from "../constants.ts";
 import { CustomFieldsFormSection } from "./custom-fields-form-section.tsx";
 import { defaultTranslations } from "./i18n.ts";

package/packages/bundled-features/src/delivery/unsubscribe-page.ts

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { mailT } from "@cosmicdrift/kumiko-framework/i18n";
-import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-renderer/headless";
 import type { MailChrome, MailChromeLink } from "../renderer-foundation/index.ts";
 import { DELIVERY_RESUBSCRIBE_PATH, DELIVERY_UNSUBSCRIBE_PATH } from "./public-names.ts";
 import "./unsubscribe-page-strings.ts";

package/packages/bundled-features/src/delivery/web/client-plugin.tsx

@@ -1,6 +1,6 @@
 // @runtime client
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import {
   DELIVERY_CHANNEL_CELL_COMPONENT,
   DELIVERY_ERROR_CELL_COMPONENT,

package/packages/bundled-features/src/delivery/web/delivery-status-cell.tsx

@@ -5,7 +5,7 @@
 // projectionList renderer — only this one cell stays TSX.
 
 import { type ColumnRendererProps, useTranslation } from "@cosmicdrift/kumiko-renderer";
-import { StatusBadge, type StatusTone } from "@cosmicdrift/kumiko-renderer-web";
+import { StatusBadge, type StatusTone } from "@cosmicdrift/kumiko-renderer/web";
 import type { ReactNode } from "react";
 import { translateOrRaw } from "../../shared/web/translate-or-raw.ts";
 import { DeliveryStatus } from "../public-names.ts";

package/packages/bundled-features/src/feature-toggles/web/client-plugin.tsx

@@ -1,6 +1,6 @@
 // @runtime client
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import { FEATURE_TOGGLES_FEATURE } from "../constants.ts";
 import { defaultTranslations } from "./i18n.ts";
 

package/packages/bundled-features/src/file-provider-s3/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.376.0",
+    "type": "improvement",
+    "title": "Named S3 provider feature",
+    "detail": "createFileProviderS3NamedEnvFeature mounts an additional S3 provider under its own name with an env prefix, next to the default one, so a second bucket needs no hand-written wiring."
+  },
   {
     "version": "0.371.0",
     "type": "improvement",

package/packages/bundled-features/src/file-provider-s3/env-named-feature.ts

@@ -0,0 +1,45 @@
+import type {
+  FileProviderContext,
+  FileProviderPlugin,
+} from "@cosmicdrift/kumiko-bundled-features/file-foundation";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
+import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
+import { createRuntimeS3EnvSchema } from "./env-schema.ts";
+import { createS3ProviderFromEnv } from "./lib/env-helper.ts";
+
+export type NamedS3EnvProviderOptions = {
+  /** Provider key tenants select in `file-foundation`'s `provider` config; the feature is `file-provider-s3-env-<name>`. */
+  readonly name: string;
+  /** Env prefix of the credential set, e.g. `RELEASES_S3_`. */
+  readonly envPrefix: string;
+  /** Tolerate missing credentials at boot; the provider then fails on its first file operation. */
+  readonly lazy?: boolean;
+};
+
+/** An additional S3 provider next to `"s3-env"`, reading its credentials from `<envPrefix>BUCKET` etc. */
+export function createFileProviderS3NamedEnvFeature(options: NamedS3EnvProviderOptions) {
+  const envSchema = createRuntimeS3EnvSchema(options.envPrefix);
+  const feature = defineFeature(
+    `file-provider-s3-env-${options.name}`,
+    (r) => {
+      r.describe(
+        `Registers the "${options.name}" provider for \`file-foundation\`: one shared S3 bucket for every tenant, credentials from the \`${options.envPrefix}*\` env vars. A second bucket next to the \`"s3-env"\` provider (for example release artifacts).`,
+      );
+      r.uiHints({
+        displayLabel: `File Provider · S3 (${options.name})`,
+        category: "storage",
+        recommended: false,
+      });
+      r.requires({ features: ["file-foundation"] });
+      r.envSchema(envSchema);
+      const plugin: FileProviderPlugin = {
+        build: async (_ctx: FileProviderContext, _tenantId: string): Promise<FileStorageProvider> =>
+          createS3ProviderFromEnv(options.envPrefix), // @wrapper-known semantic-alias
+      };
+      r.useExtension("fileProvider", options.name, plugin);
+    },
+    { dedupeOptions: { name: options.name, envPrefix: options.envPrefix } },
+  );
+  return featureWithEnvSchema(feature, envSchema);
+}

package/packages/bundled-features/src/file-provider-s3/env-schema.ts

@@ -17,17 +17,8 @@ export const s3EndpointSchema = z
   .url({ protocol: /^https?$/ })
   .refine(isAcceptableEndpoint, "must use https unless the host is loopback");
 
-/** Builds the env block `createS3ProviderFromEnv(prefix)` reads, e.g.
- *  `createS3EnvSchema({ prefix: "RELEASES_S3_" })` for a second bucket.
- *  Every field is optional: an app that mounts the env provider next to
- *  another one picks the provider at runtime, and the provider reports
- *  missing credentials on its first file operation. */
-export function createS3EnvSchema<const TPrefix extends string>(options: {
-  readonly prefix: TPrefix;
-}) {
-  const { prefix } = options;
-  // @cast-boundary schema-walk — computed template keys widen to an index signature; the literal keys below are exactly the ones S3EnvShape names.
-  const shape = {
+function buildS3Shape(prefix: string) {
+  return {
     [`${prefix}BUCKET`]: z.string().min(1).optional().describe("S3 bucket."),
     [`${prefix}REGION`]: z.string().min(1).optional().describe("S3 region."),
     [`${prefix}ACCESS_KEY`]: z
@@ -51,8 +42,24 @@ export function createS3EnvSchema<const TPrefix extends string>(options: {
       .enum(["true", "false"])
       .optional()
       .describe('Path-style bucket addressing ("true"), needed by MinIO and some S3 clones.'),
-  } as S3EnvShape<TPrefix>;
-  return z.object(shape);
+  };
+}
+
+/** Builds the env block `createS3ProviderFromEnv(prefix)` reads, e.g.
+ *  `createS3EnvSchema({ prefix: "RELEASES_S3_" })` for a second bucket.
+ *  Every field is optional: an app that mounts the env provider next to
+ *  another one picks the provider at runtime, and the provider reports
+ *  missing credentials on its first file operation. */
+export function createS3EnvSchema<const TPrefix extends string>(options: {
+  readonly prefix: TPrefix;
+}) {
+  // @cast-boundary schema-walk — computed template keys widen to an index signature; the literal keys below are exactly the ones S3EnvShape names.
+  return z.object(buildS3Shape(options.prefix) as S3EnvShape<TPrefix>);
+}
+
+/** Same block for a prefix only known at runtime (named providers); keys are typed as a record. */
+export function createRuntimeS3EnvSchema(prefix: string) {
+  return z.object(buildS3Shape(prefix));
 }
 
 type OptionalString = z.ZodOptional<z.ZodString>;

package/packages/bundled-features/src/file-provider-s3/index.ts

@@ -1,5 +1,9 @@
 // Public API of the file-provider-s3 bundled-feature.
 
+export {
+  createFileProviderS3NamedEnvFeature,
+  type NamedS3EnvProviderOptions,
+} from "./env-named-feature.ts";
 export { createS3EnvSchema, s3EndpointSchema, s3EnvSchema } from "./env-schema.ts";
 export {
   createFileProviderS3Feature,

package/packages/bundled-features/src/folders/web/client-plugin.tsx

@@ -1,6 +1,6 @@
 // @runtime client
 
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import { FOLDER_SECTION_EXTENSION_NAME, FOLDERS_FEATURE_NAME } from "../constants.ts";
 import { FolderSection } from "./folder-section.tsx";
 import { defaultTranslations } from "./i18n.ts";

package/packages/bundled-features/src/folders/web/folder-section.tsx

@@ -169,10 +169,9 @@ export function FolderSection({
         />
       </Field>
 
-      {/* Inline create-row: das Ordner-Input wächst, der Anlegen-Button sitzt
-          rechts daneben. ponytail: separate Zeile, weil die Combobox keine
-          create-on-type-Affordance hat — fold-in, wenn renderer-web ein
-          onCreate-Prop bekommt. */}
+      {/* Inline create row: the folder input grows, the create button sits next
+          to it. Separate row because the combobox has no create-on-type
+          affordance; fold in once renderer/web gets an onCreate prop. */}
       <div className="flex items-end gap-2">
         <div className="flex-1">
           <Field id="folder-section-new" label={t("folders.section.newLabel")}>

package/packages/bundled-features/src/host-routing/README.md

@@ -87,3 +87,10 @@ default applies. Options are validated when the feature or dispatch is built.
 
 Custom domains per tenant, legacy host redirects and app-specific query
 allowlists stay in the app: wrap the dispatch function and fall through to it.
+
+## Resolver, redirects and allowlist
+
+- `tenantBy: (host, db) => TenantId | null` resolves every host that is neither the apex nor a fixed host (profile subdomains, custom domains). The tenant must be enabled and active; null means 404 for pages and `tenant_required` for the API. `createHostTenantIdResolver(options, db)` exposes the same mapping for managed-pages' `resolveApexTenant`.
+- `tenantPathPrefix` is optional in host and resolver mode and serves `<prefix>/<key>` on the apex. The API half still takes the apex anchor there; an app that needs a path-named tenant on API calls resolves it itself.
+- `redirects: [{ from, to, host?, status? }]` run before host classification. `to` is configured, never derived from the request.
+- `apexAnonymousQueryAllowlist: { "example.com": ["feature:query:x"] }` limits the anonymous apex anchor to the listed query types on that host, for `/api/query` and `/api/stream`; other paths keep the anchor. `example.com` and `www.example.com` share one entry (a host without its own uses the other's). Combined with `tenantBy: "path"` it throws at boot, because the client names its tenant there (X-Tenant wins over the resolver) and would bypass the allowlist.

package/packages/bundled-features/src/host-routing/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.376.0",
+    "type": "improvement",
+    "title": "tenantBy resolver, apex path tenants, redirects and anonymous query allowlist",
+    "detail": "tenantBy accepts (host, db) => TenantId | null for profile subdomains and custom domains; tenantPathPrefix also works in host and resolver mode for apex path tenants. redirects send fixed 301/302 answers before host classification, apexAnonymousQueryAllowlist limits the anonymous apex anchor to listed query types per host (/api/query and /api/stream), and createHostTenantIdResolver(options, db) maps a Host header to its tenant for managed-pages. Existing \"host\" and \"path\" configs behave as before, except that apexAnonymousQueryAllowlist with tenantBy \"path\" is rejected at boot."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/packages/bundled-features/src/host-routing/constants.ts

@@ -2,6 +2,7 @@ export const HOST_ROUTING_FEATURE = "host-routing";
 
 export const HostRoutingQueries = {
   tenantKeyExists: `${HOST_ROUTING_FEATURE}:query:tenant-key-exists`,
+  hostTenantExists: `${HOST_ROUTING_FEATURE}:query:host-tenant-exists`,
 } as const;
 
 // Matches tenant:write:create's key limit; keeps lookups for absurd keys out
@@ -22,3 +23,6 @@ const PATH_TENANT_KEY_PATTERN = /^[A-Za-z0-9._~-]+$/;
 export function isPathTenantKeyCandidate(value: string): boolean {
   return value.length <= TENANT_KEY_MAX_LENGTH && PATH_TENANT_KEY_PATTERN.test(value);
 }
+
+// Longest Host header value a hostname plus port can take.
+export const HOST_HEADER_MAX_LENGTH = 260;

package/packages/bundled-features/src/host-routing/dispatch.ts

@@ -1,10 +1,11 @@
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { RateLimitError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
-import type { PageHeadSystemQuery } from "@cosmicdrift/kumiko-headless/apex";
+import type { PageHeadSystemQuery } from "@cosmicdrift/kumiko-renderer/headless/apex";
 import * as z from "zod";
 import { HostRoutingQueries, isPathTenantKeyCandidate, isTenantKeyCandidate } from "./constants.ts";
-import { classifyHost } from "./host.ts";
+import { classifyHost, splitFirstSegment, tenantKeyFromPath } from "./host.ts";
 import type { HostRoutingOptions, HostRoutingSurface } from "./options.ts";
+import { matchRedirect, sameOriginPath } from "./redirects.ts";
 import { validateHostRoutingOptions } from "./validate-options.ts";
 
 // Structurally identical to server-runtime's HostDispatchResult. Defined here
@@ -43,6 +44,21 @@ async function isTenantKeyKnown(systemQuery: PageHeadSystemQuery, key: string):
   return tenantKeyExistsResultSchema.parse(result).exists;
 }
 
+async function isHostKnown(systemQuery: PageHeadSystemQuery, host: string): Promise<boolean> {
+  let result: unknown;
+  try {
+    result = await systemQuery(HostRoutingQueries.hostTenantExists, { host }, SYSTEM_TENANT_ID);
+  } catch (error) {
+    if (error instanceof ValidationError) return false;
+    // The shell is harmless: the API resolver is authoritative and answers
+    // tenant_required for unknown hosts, while a 404 would hit visitors behind
+    // a shared NAT under load.
+    if (error instanceof RateLimitError) return true;
+    throw error;
+  }
+  return tenantKeyExistsResultSchema.parse(result).exists;
+}
+
 function serve(
   surface: HostRoutingSurface,
   file: string = surface.file,
@@ -59,20 +75,6 @@ function notFound(surface: HostRoutingSurface | undefined): HostRoutingDispatchR
     : { kind: "not-found", file: surface.file, csp: surface.csp };
 }
 
-// Redirect targets are always same-origin paths. Collapsing leading slashes
-// and backslashes keeps "/de//evil.example" from turning into the
-// protocol-relative "//evil.example".
-function sameOriginPath(path: string): string {
-  return `/${path.replace(/^[/\\]+/, "")}`;
-}
-
-function splitFirstSegment(path: string): { readonly segment: string; readonly rest: string } {
-  const withoutLeading = path.replace(/^\/+/, "");
-  const slash = withoutLeading.indexOf("/");
-  if (slash === -1) return { segment: withoutLeading, rest: "/" };
-  return { segment: withoutLeading.slice(0, slash), rest: withoutLeading.slice(slash) };
-}
-
 function apexPage(options: HostRoutingOptions, req: HostRoutingRequest): HostRoutingDispatchResult {
   const { apex, locales } = options;
   if (locales === undefined) return serve(apex);
@@ -88,27 +90,25 @@ async function tenantPage(
   options: HostRoutingOptions,
   key: string | null,
   systemQuery: PageHeadSystemQuery,
+  keySource: "path" | "subdomain",
 ): Promise<HostRoutingDispatchResult> {
   // No key (bare tenant prefix): the shell handles login and tenant choice.
   if (key === null) return serve(options.tenant);
-  const isCandidate = options.tenantBy === "path" ? isPathTenantKeyCandidate : isTenantKeyCandidate;
+  const isCandidate = keySource === "path" ? isPathTenantKeyCandidate : isTenantKeyCandidate;
   if (!isCandidate(key)) return notFound(options.unknownTenant);
   return (await isTenantKeyKnown(systemQuery, key))
     ? serve(options.tenant)
     : notFound(options.unknownTenant);
 }
 
-function tenantKeyFromPath(prefix: string, path: string): string | null | undefined {
-  if (path !== prefix && !path.startsWith(`${prefix}/`)) return undefined;
-  const { segment } = splitFirstSegment(path.slice(prefix.length));
-  return segment === "" ? null : segment;
-}
-
 // The routing decision for runProdApp's `hostDispatch` (and, via
 // toDevHostDispatch, the dev server). Unknown hosts fail closed with 404.
 export function createHostDispatch(options: HostRoutingOptions): HostRoutingDispatchFn {
   validateHostRoutingOptions(options);
+  const redirects = options.redirects ?? [];
   return async (req, { systemQuery }) => {
+    const redirect = matchRedirect(redirects, req.host, req.path, req.search);
+    if (redirect !== undefined) return { kind: "redirect", ...redirect };
     const host = classifyHost(req.host, options);
     switch (host.kind) {
       case "fixed":
@@ -117,11 +117,19 @@ export function createHostDispatch(options: HostRoutingOptions): HostRoutingDisp
         return notFound(undefined);
       case "subdomain":
         if (options.tenantBy !== "host") return notFound(undefined);
-        return tenantPage(options, host.key, systemQuery);
+        return tenantPage(options, host.key, systemQuery, "subdomain");
+      case "resolved": {
+        if (await isHostKnown(systemQuery, host.hostname)) return serve(options.tenant);
+        return notFound(
+          host.hostname.endsWith(`.${options.baseDomain.toLowerCase()}`)
+            ? options.unknownTenant
+            : undefined,
+        );
+      }
       case "apex": {
-        if (options.tenantBy === "path") {
+        if (options.tenantPathPrefix !== undefined) {
           const key = tenantKeyFromPath(options.tenantPathPrefix, req.path);
-          if (key !== undefined) return tenantPage(options, key, systemQuery);
+          if (key !== undefined) return tenantPage(options, key, systemQuery, "path");
         }
         return apexPage(options, req);
       }

package/packages/bundled-features/src/host-routing/feature.ts

@@ -1,5 +1,3 @@
-import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineFeature,
   defineQueryHandler,
@@ -16,40 +14,30 @@ import {
   type TenantResolverProvider,
 } from "../auth-foundation/index.ts";
 import {
-  isTenantServingPublicContent,
-  type TenantLifecycleStatus,
-  tenantTable,
-} from "../tenant/index.ts";
-import { HOST_ROUTING_FEATURE, TENANT_KEY_MAX_LENGTH } from "./constants.ts";
-import { classifyHost } from "./host.ts";
+  HOST_HEADER_MAX_LENGTH,
+  HOST_ROUTING_FEATURE,
+  TENANT_KEY_MAX_LENGTH,
+} from "./constants.ts";
+import { classifyHost, normalizeHostname } from "./host.ts";
 import type { HostRoutingOptions } from "./options.ts";
+import {
+  isTenantServing,
+  servingTenantIdByKey,
+  servingTenantIdByResolver,
+} from "./tenant-lookup.ts";
 import { validateHostRoutingOptions } from "./validate-options.ts";
 
-type TenantRow = {
-  readonly id: TenantId;
-  readonly isEnabled: boolean;
-  readonly status: TenantLifecycleStatus;
+type RequestReader = {
+  readonly req: {
+    readonly header: (name: string) => string | undefined;
+    readonly url: string;
+    readonly path: string;
+    readonly raw?: Request;
+  };
 };
 
-// Disabled tenants and tenants in any destroy phase are not routable, the same
-// rule public files and pages follow.
-async function servingTenantIdByKey(
-  db: DbConnection | TenantDb,
-  key: string,
-): Promise<TenantId | null> {
-  const row = await fetchOne<TenantRow>(db, tenantTable, { key });
-  return row !== undefined && isTenantServingPublicContent(row) ? row.id : null;
-}
-
-async function isTenantServing(db: DbConnection, id: TenantId): Promise<boolean> {
-  const row = await fetchOne<TenantRow>(db, tenantTable, { id });
-  return row !== undefined && isTenantServingPublicContent(row);
-}
-
-type HostHeaderReader = { readonly req: { readonly header: (name: string) => string | undefined } };
-
 // auth-foundation types the Hono context as unknown to stay free of a hono dep.
-function isHostHeaderReader(c: unknown): c is HostHeaderReader {
+function isRequestReader(c: unknown): c is RequestReader {
   return (
     typeof c === "object" &&
     c !== null &&
@@ -57,10 +45,66 @@ function isHostHeaderReader(c: unknown): c is HostHeaderReader {
     typeof c.req === "object" &&
     c.req !== null &&
     "header" in c.req &&
-    typeof c.req.header === "function"
+    typeof c.req.header === "function" &&
+    "url" in c.req &&
+    typeof c.req.url === "string" &&
+    "path" in c.req &&
+    typeof c.req.path === "string"
   );
 }
 
+// Hono routes on the decoded path and ignores a trailing slash, so the
+// allowlist must compare the same shape: "/api/%71uery" and "/api/query/"
+// reach the query handler too.
+function routedPathOf(c: RequestReader): string {
+  return c.req.path.length > 1 ? c.req.path.replace(/\/+$/, "") : c.req.path;
+}
+
+// "example.com" and "www.example.com" are one site: a host without its own
+// entry falls back to the other variant's entry instead of keeping the anchor.
+function allowlistFor(
+  options: HostRoutingOptions,
+  hostname: string,
+): readonly string[] | undefined {
+  const allowlists = options.apexAnonymousQueryAllowlist;
+  if (allowlists === undefined) return undefined;
+  const counterpart = hostname.startsWith("www.") ? hostname.slice(4) : `www.${hostname}`;
+  for (const key of [hostname, counterpart]) {
+    if (Object.hasOwn(allowlists, key)) return allowlists[key];
+  }
+  return undefined;
+}
+
+// Both carry { type, payload } and run read handlers; /api/batch is commands only.
+const TYPED_READ_PATHS: ReadonlySet<string> = new Set(["/api/query", "/api/stream"]);
+const queryTypeBodySchema = z.object({ type: z.string() });
+
+// Reads the query type from a clone, so the body stays intact for the handler.
+async function peekQueryType(c: RequestReader): Promise<string | null> {
+  if (c.req.raw === undefined) return null;
+  try {
+    const parsed = queryTypeBodySchema.safeParse(await c.req.raw.clone().json());
+    return parsed.success ? parsed.data.type : null;
+  } catch {
+    return null;
+  }
+}
+
+// Apex anchor tenant for anonymous calls. A host with an allowlist only gets
+// the anchor for the listed query types on read paths; other paths keep it.
+async function apexAnchorFor(
+  options: HostRoutingOptions,
+  c: RequestReader,
+  hostname: string,
+): Promise<TenantId | null> {
+  const anchor = options.apexAnonymousTenantId ?? null;
+  if (anchor === null) return null;
+  const allowlist = allowlistFor(options, hostname);
+  if (allowlist === undefined || !TYPED_READ_PATHS.has(routedPathOf(c))) return anchor;
+  const type = await peekQueryType(c);
+  return type !== null && allowlist.includes(type) ? anchor : null;
+}
+
 // Returns only { exists }: the same fact the tenant 404 page already makes
 // public, never other tenant fields. Rate-limited so it is no cheap oracle.
 const tenantKeyExistsQuery = defineQueryHandler({
@@ -85,32 +129,68 @@ const tenantKeyExistsQuery = defineQueryHandler({
   },
 });
 
+function hostTenantExistsQueryFor(options: HostRoutingOptions) {
+  return defineQueryHandler({
+    name: "host-tenant-exists",
+    schema: z.object({ host: z.string().min(1).max(HOST_HEADER_MAX_LENGTH) }),
+    access: { roles: ["anonymous"] },
+    rateLimit: { per: "ip+handler", limit: 120, windowSeconds: 60 },
+    // Page-routing plumbing, not a task an agent performs.
+    agent: { expose: false },
+    description:
+      "Anonymous host check backing the unknown-host 404 of the host-routing hostDispatch in tenantBy resolver mode. Returns only { exists }.",
+    handler: async (query, ctx) => {
+      if (!ctx.systemDb) {
+        throw new InternalError({
+          message: "host-routing:query:host-tenant-exists requires ctx.systemDb (r.systemScope())",
+        });
+      }
+      const hostname = normalizeHostname(query.payload.host);
+      if (hostname === null) return { exists: false };
+      const db = ctx.systemDb.acknowledgeCrossTenant(
+        "host existence check for the host-routing 404 — publicly observable via the 404 itself",
+      );
+      return { exists: (await servingTenantIdByResolver(options, db, hostname)) !== null };
+    },
+  });
+}
+
 function tenantResolverFor(options: HostRoutingOptions): TenantResolverProvider | undefined {
-  const apexTenantId = options.apexAnonymousTenantId ?? null;
-  if (options.tenantBy === "host") {
+  if (options.tenantBy !== "path") {
     return {
       trust: "authoritative",
       build:
         ({ db }) =>
         async (c: unknown): Promise<TenantId | null> => {
-          if (!isHostHeaderReader(c)) return null;
-          const host = classifyHost(c.req.header("Host") ?? "", options);
-          if (host.kind === "subdomain") return servingTenantIdByKey(db, host.key);
+          if (!isRequestReader(c)) return null;
+          const hostHeader = c.req.header("Host") ?? "";
+          const host = classifyHost(hostHeader, options);
           // Fixed and unknown hosts have no anonymous tenant: an authoritative
           // null answers tenant_required, whatever X-Tenant says.
-          return host.kind === "apex" ? apexTenantId : null;
+          switch (host.kind) {
+            case "subdomain":
+              return servingTenantIdByKey(db, host.key);
+            case "resolved":
+              return servingTenantIdByResolver(options, db, host.hostname);
+            case "apex":
+              return apexAnchorFor(options, c, normalizeHostname(hostHeader) ?? "");
+            case "fixed":
+            case "unknown":
+              return null;
+          }
         },
     };
   }
-  if (apexTenantId === null) return undefined;
+  if (options.apexAnonymousTenantId === undefined) return undefined;
   // Path mode: the client names its tenant; the apex default only fills in
   // when it does not.
   return {
     trust: "fallback-only",
     build: () => async (c: unknown) => {
-      if (!isHostHeaderReader(c)) return null;
-      return classifyHost(c.req.header("Host") ?? "", options).kind === "apex"
-        ? apexTenantId
+      if (!isRequestReader(c)) return null;
+      const hostHeader = c.req.header("Host") ?? "";
+      return classifyHost(hostHeader, options).kind === "apex"
+        ? apexAnchorFor(options, c, normalizeHostname(hostHeader) ?? "")
         : null;
     },
   };
@@ -128,6 +208,7 @@ export function createHostRoutingFeature(options: HostRoutingOptions): FeatureDe
     r.requires({ features: ["auth-foundation", "tenant"] });
     r.systemScope();
     r.queryHandler(tenantKeyExistsQuery);
+    if (typeof options.tenantBy === "function") r.queryHandler(hostTenantExistsQueryFor(options));
 
     const resolver = tenantResolverFor(options);
     if (resolver !== undefined) {