@substrat-run/kernel 0.141.0 → 0.142.0

package/dist/routed-node.d.ts

@@ -1,87 +0,0 @@
-import type { ScopeId, TenantId } from '@substrat-run/contracts';
-/**
- * A tenant or scope id: a ULID, exactly what `@substrat-run/contracts`' `tenantId` and
- * `scopeId` schemas accept (`z.string().regex(ULID).brand()`).
- *
- * Checked with the pattern itself rather than through those schemas since #1893, because
- * this file is bundled into the platform's entry in front of EVERY deployed vertical
- * (`withInvocationLog`), and a runtime import of the contracts package pulls all of it —
- * and zod — into that bundle: 750 KB added to every upload to run one regex. The brands
- * are types, so they still come from contracts; `routed-node.test.ts` holds this pattern to
- * those schemas so the two cannot drift.
- */
-export declare const ROUTED_ID: RegExp;
-/**
- * Reading the node the router asserted (K-26).
- *
- * The router resolves `hostname → (tenant, scope, surface)` and forwards over a
- * service binding with that resolution in headers. This is the vertical's side of
- * that contract, shared because every vertical needs it and none of them should be
- * re-deriving how to trust it. Moving from the kernel to `vertical-host` (#1978), which
- * already re-exports it.
- *
- * Web-standard only and structurally typed: the base tsconfig is `ES2023` with no
- * DOM lib, deliberately, so no package assumes a browser. Taking the one method we
- * need rather than the whole `Headers` type keeps that true and costs nothing — a
- * real `Headers` satisfies it, and so does a plain object in a test.
- */
-/** The one method this needs from a `Headers`. A real `Headers` satisfies it. */
-export interface HeaderReader {
-    get(name: string): string | null;
-}
-export interface RoutedNode {
-    tenantId: TenantId;
-    scopeId: ScopeId;
-    /** Which app answers: `app`, `storefront`, `back-office`, … Vertical vocabulary. */
-    surface: string;
-    verticalSlug: string | null;
-}
-/** Thrown when headers are present but not trustworthy. Never means "no router". */
-export declare class RouterAssertionError extends Error {
-}
-export interface ReadRoutedNodeOptions {
-    /**
-     * The router's shared secret, as this worker holds it (`ROUTER_SECRET`). When set,
-     * an assertion is trusted only if `x-substrat-router` matches it — always, even
-     * with `allowUnsigned`.
-     */
-    expectedSecret?: string;
-    /**
-     * Accept an assertion nobody signed, when no secret is configured (#966).
-     *
-     * Off by default, and that default is the boundary: a worker deployed without
-     * its secret used to trust any `x-substrat-*` headers it was handed, which is a
-     * forged tenant from anyone who could reach the script directly. Now it refuses
-     * them — loudly, as a `RouterAssertionError` — until the secret is provisioned.
-     *
-     * The one legitimate exception is an un-routed local instance behind a dev
-     * router that has no secret either, which is what `ALLOW_DEV_NODE` already
-     * names; a host sets this from that flag and from nothing else.
-     */
-    allowUnsigned?: boolean;
-}
-/**
- * The `(tenant, scope)` this request is for, or `null` when no router fronted it.
- *
- * Three outcomes, kept distinct on purpose:
- *
- *   - **null** — no assertion at all. The caller decides: a single-tenant standalone
- *     deploy substitutes its own node, anything else refuses.
- *   - **throws** — headers are present but wrong: a bad or missing secret, a secret
- *     this worker cannot verify because it holds none, or ids that are not ULIDs.
- *     Present-but-wrong is a misconfiguration or an attack, and collapsing it into
- *     `null` would let either one fall through to whatever the caller does for
- *     "unrouted".
- *   - **a node** — trustworthy, and the tenant whose data this request may touch.
- *
- * `expectedSecret` is what makes the headers trustworthy in code. K-26's real
- * boundary is that vertical workers have no public route, so the router is the only
- * possible source — but that is a deployment fact, and `workers.dev` is on by
- * default. When the secret is configured, a request that did not come from the
- * router cannot assert a tenant no matter how the routes are configured. When it is
- * NOT configured the assertion fails closed (#966): an unsigned assertion is refused
- * unless the host opted in with `allowUnsigned`, so forgetting to provision the
- * secret is a visible outage rather than an open door.
- */
-export declare function readRoutedNode(headers: HeaderReader, options?: ReadRoutedNodeOptions): RoutedNode | null;
-//# sourceMappingURL=routed-node.d.ts.map

package/dist/routed-node.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"routed-node.d.ts","sourceRoot":"","sources":["../src/routed-node.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,QAA6B,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AAEH,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,oFAAoF;AACpF,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,YAAY,EACrB,OAAO,GAAE,qBAA0B,GAClC,UAAU,GAAG,IAAI,CA6BnB"}

package/dist/routed-node.js

@@ -1,67 +0,0 @@
-import { secretMatches } from './platform-call.js';
-/**
- * A tenant or scope id: a ULID, exactly what `@substrat-run/contracts`' `tenantId` and
- * `scopeId` schemas accept (`z.string().regex(ULID).brand()`).
- *
- * Checked with the pattern itself rather than through those schemas since #1893, because
- * this file is bundled into the platform's entry in front of EVERY deployed vertical
- * (`withInvocationLog`), and a runtime import of the contracts package pulls all of it —
- * and zod — into that bundle: 750 KB added to every upload to run one regex. The brands
- * are types, so they still come from contracts; `routed-node.test.ts` holds this pattern to
- * those schemas so the two cannot drift.
- */
-export const ROUTED_ID = /^[0-9A-HJKMNP-TV-Z]{26}$/;
-/** Thrown when headers are present but not trustworthy. Never means "no router". */
-export class RouterAssertionError extends Error {
-}
-/**
- * The `(tenant, scope)` this request is for, or `null` when no router fronted it.
- *
- * Three outcomes, kept distinct on purpose:
- *
- *   - **null** — no assertion at all. The caller decides: a single-tenant standalone
- *     deploy substitutes its own node, anything else refuses.
- *   - **throws** — headers are present but wrong: a bad or missing secret, a secret
- *     this worker cannot verify because it holds none, or ids that are not ULIDs.
- *     Present-but-wrong is a misconfiguration or an attack, and collapsing it into
- *     `null` would let either one fall through to whatever the caller does for
- *     "unrouted".
- *   - **a node** — trustworthy, and the tenant whose data this request may touch.
- *
- * `expectedSecret` is what makes the headers trustworthy in code. K-26's real
- * boundary is that vertical workers have no public route, so the router is the only
- * possible source — but that is a deployment fact, and `workers.dev` is on by
- * default. When the secret is configured, a request that did not come from the
- * router cannot assert a tenant no matter how the routes are configured. When it is
- * NOT configured the assertion fails closed (#966): an unsigned assertion is refused
- * unless the host opted in with `allowUnsigned`, so forgetting to provision the
- * secret is a visible outage rather than an open door.
- */
-export function readRoutedNode(headers, options = {}) {
-    const rawTenant = headers.get('x-substrat-tenant');
-    const rawScope = headers.get('x-substrat-scope');
-    if (!rawTenant && !rawScope)
-        return null;
-    const { expectedSecret, allowUnsigned = false } = options;
-    if (expectedSecret) {
-        if (!secretMatches(headers.get('x-substrat-router'), expectedSecret)) {
-            throw new RouterAssertionError('router assertion is not signed by a known router');
-        }
-    }
-    else if (!allowUnsigned) {
-        throw new RouterAssertionError('router assertion cannot be verified: this worker has no ROUTER_SECRET configured');
-    }
-    if (!rawTenant || !rawScope) {
-        throw new RouterAssertionError('router assertion is incomplete');
-    }
-    if (!ROUTED_ID.test(rawTenant) || !ROUTED_ID.test(rawScope)) {
-        throw new RouterAssertionError('router assertion carries a malformed id');
-    }
-    return {
-        tenantId: rawTenant,
-        scopeId: rawScope,
-        surface: headers.get('x-substrat-surface') ?? 'app',
-        verticalSlug: headers.get('x-substrat-vertical'),
-    };
-}
-//# sourceMappingURL=routed-node.js.map

package/dist/routed-node.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"routed-node.js","sourceRoot":"","sources":["../src/routed-node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,0BAA0B,CAAC;AA8BpD,oFAAoF;AACpF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAwBlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAqB,EACrB,OAAO,GAA0B,EAAE;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,EAAE,cAAc,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1D,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,oBAAoB,CAAC,kDAAkD,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC5B,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,oBAAoB,CAAC,yCAAyC,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAqB;QAC/B,OAAO,EAAE,QAAmB;QAC5B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,KAAK;QACnD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;KACjD,CAAC;AACJ,CAAC"}