@substrat-run/vertical-host 0.141.0 → 0.142.0

package/dist/live.d.ts

@@ -45,9 +45,9 @@
 import type { Context, Env, Hono } from 'hono';
 import { isUpgradeRequest, type LiveReadSurface } from '@substrat-run/kernel';
 /**
- * Is this request asking to be upgraded to a WebSocket? Moving here from the kernel (#1978),
- * which keeps the `LiveReadSurface` contract. For one release the definition still lives in
- * `@substrat-run/kernel` and this is that same binding. Import it from here.
+ * Is this request asking to be upgraded to a WebSocket? Defined in the kernel beside the
+ * `LiveReadSurface` contract, because the hosted adapter's door asks it too (#1978); this is
+ * that same binding, beside the route that asks it first.
  */
 export { isUpgradeRequest };
 /** Where `mountLiveReads` mounts the route unless told otherwise. */

package/dist/live.js

@@ -1,9 +1,9 @@
 import { LIVE_MODE_HEADER } from '@substrat-run/contracts';
 import { isUpgradeRequest } from '@substrat-run/kernel';
 /**
- * Is this request asking to be upgraded to a WebSocket? Moving here from the kernel (#1978),
- * which keeps the `LiveReadSurface` contract. For one release the definition still lives in
- * `@substrat-run/kernel` and this is that same binding. Import it from here.
+ * Is this request asking to be upgraded to a WebSocket? Defined in the kernel beside the
+ * `LiveReadSurface` contract, because the hosted adapter's door asks it too (#1978); this is
+ * that same binding, beside the route that asks it first.
  */
 export { isUpgradeRequest };
 /** Where `mountLiveReads` mounts the route unless told otherwise. */

package/dist/routed-node.d.ts

@@ -1,11 +1,87 @@
+import type { ScopeId, TenantId } from '@substrat-run/contracts';
 /**
- * Reading the node the router asserted (K-26, #1978).
+ * A tenant or scope id: a ULID, exactly what `@substrat-run/contracts`' `tenantId` and
+ * `scopeId` schemas accept (`z.string().regex(ULID).brand()`).
  *
- * Moving here from the kernel: every vertical reads it, and nothing in it needs a kernel
- * guarantee. For one release the definition still lives in `@substrat-run/kernel` and this
- * module re-exports that same binding, so an import from either package is the one
- * function. Import it from here.
+ * Checked with the pattern itself rather than through those schemas since #1893, because
+ * this file is bundled into the platform's entry in front of EVERY deployed vertical
+ * (`withInvocationLog`), and a runtime import of the contracts package pulls all of it —
+ * and zod — into that bundle: 750 KB added to every upload to run one regex. The brands
+ * are types, so they still come from contracts; `routed-node.test.ts` holds this pattern to
+ * those schemas so the two cannot drift.
  */
-export { readRoutedNode, RouterAssertionError } from '@substrat-run/kernel';
-export type { RoutedNode, HeaderReader, ReadRoutedNodeOptions } from '@substrat-run/kernel';
+export declare const ROUTED_ID: RegExp;
+/**
+ * Reading the node the router asserted (K-26).
+ *
+ * The router resolves `hostname → (tenant, scope, surface)` and forwards over a
+ * service binding with that resolution in headers. This is the vertical's side of
+ * that contract, shared because every vertical needs it and none of them should be
+ * re-deriving how to trust it. Here rather than in the kernel since #1978: nothing in it
+ * needs a kernel guarantee.
+ *
+ * Web-standard only and structurally typed: the base tsconfig is `ES2023` with no
+ * DOM lib, deliberately, so no package assumes a browser. Taking the one method we
+ * need rather than the whole `Headers` type keeps that true and costs nothing — a
+ * real `Headers` satisfies it, and so does a plain object in a test.
+ */
+/** The one method this needs from a `Headers`. A real `Headers` satisfies it. */
+export interface HeaderReader {
+    get(name: string): string | null;
+}
+export interface RoutedNode {
+    tenantId: TenantId;
+    scopeId: ScopeId;
+    /** Which app answers: `app`, `storefront`, `back-office`, … Vertical vocabulary. */
+    surface: string;
+    verticalSlug: string | null;
+}
+/** Thrown when headers are present but not trustworthy. Never means "no router". */
+export declare class RouterAssertionError extends Error {
+}
+export interface ReadRoutedNodeOptions {
+    /**
+     * The router's shared secret, as this worker holds it (`ROUTER_SECRET`). When set,
+     * an assertion is trusted only if `x-substrat-router` matches it — always, even
+     * with `allowUnsigned`.
+     */
+    expectedSecret?: string;
+    /**
+     * Accept an assertion nobody signed, when no secret is configured (#966).
+     *
+     * Off by default, and that default is the boundary: a worker deployed without
+     * its secret used to trust any `x-substrat-*` headers it was handed, which is a
+     * forged tenant from anyone who could reach the script directly. Now it refuses
+     * them — loudly, as a `RouterAssertionError` — until the secret is provisioned.
+     *
+     * The one legitimate exception is an un-routed local instance behind a dev
+     * router that has no secret either, which is what `ALLOW_DEV_NODE` already
+     * names; a host sets this from that flag and from nothing else.
+     */
+    allowUnsigned?: boolean;
+}
+/**
+ * The `(tenant, scope)` this request is for, or `null` when no router fronted it.
+ *
+ * Three outcomes, kept distinct on purpose:
+ *
+ *   - **null** — no assertion at all. The caller decides: a single-tenant standalone
+ *     deploy substitutes its own node, anything else refuses.
+ *   - **throws** — headers are present but wrong: a bad or missing secret, a secret
+ *     this worker cannot verify because it holds none, or ids that are not ULIDs.
+ *     Present-but-wrong is a misconfiguration or an attack, and collapsing it into
+ *     `null` would let either one fall through to whatever the caller does for
+ *     "unrouted".
+ *   - **a node** — trustworthy, and the tenant whose data this request may touch.
+ *
+ * `expectedSecret` is what makes the headers trustworthy in code. K-26's real
+ * boundary is that vertical workers have no public route, so the router is the only
+ * possible source — but that is a deployment fact, and `workers.dev` is on by
+ * default. When the secret is configured, a request that did not come from the
+ * router cannot assert a tenant no matter how the routes are configured. When it is
+ * NOT configured the assertion fails closed (#966): an unsigned assertion is refused
+ * unless the host opted in with `allowUnsigned`, so forgetting to provision the
+ * secret is a visible outage rather than an open door.
+ */
+export declare function readRoutedNode(headers: HeaderReader, options?: ReadRoutedNodeOptions): RoutedNode | null;
 //# sourceMappingURL=routed-node.d.ts.map

package/dist/routed-node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routed-node.d.ts","sourceRoot":"","sources":["../src/routed-node.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"routed-node.d.ts","sourceRoot":"","sources":["../src/routed-node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAIjE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,QAA6B,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AAEH,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,oFAAoF;AACpF,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,YAAY,EACrB,OAAO,GAAE,qBAA0B,GAClC,UAAU,GAAG,IAAI,CA6BnB"}

package/dist/routed-node.js

@@ -1,10 +1,68 @@
+// The subpath, not the root: this file is bundled into the platform's entry (#1893).
+import { secretMatches } from '@substrat-run/contracts/wire-auth';
 /**
- * Reading the node the router asserted (K-26, #1978).
+ * A tenant or scope id: a ULID, exactly what `@substrat-run/contracts`' `tenantId` and
+ * `scopeId` schemas accept (`z.string().regex(ULID).brand()`).
  *
- * Moving here from the kernel: every vertical reads it, and nothing in it needs a kernel
- * guarantee. For one release the definition still lives in `@substrat-run/kernel` and this
- * module re-exports that same binding, so an import from either package is the one
- * function. Import it from here.
+ * Checked with the pattern itself rather than through those schemas since #1893, because
+ * this file is bundled into the platform's entry in front of EVERY deployed vertical
+ * (`withInvocationLog`), and a runtime import of the contracts package pulls all of it —
+ * and zod — into that bundle: 750 KB added to every upload to run one regex. The brands
+ * are types, so they still come from contracts; `routed-node.test.ts` holds this pattern to
+ * those schemas so the two cannot drift.
  */
-export { readRoutedNode, RouterAssertionError } from '@substrat-run/kernel';
+export const ROUTED_ID = /^[0-9A-HJKMNP-TV-Z]{26}$/;
+/** Thrown when headers are present but not trustworthy. Never means "no router". */
+export class RouterAssertionError extends Error {
+}
+/**
+ * The `(tenant, scope)` this request is for, or `null` when no router fronted it.
+ *
+ * Three outcomes, kept distinct on purpose:
+ *
+ *   - **null** — no assertion at all. The caller decides: a single-tenant standalone
+ *     deploy substitutes its own node, anything else refuses.
+ *   - **throws** — headers are present but wrong: a bad or missing secret, a secret
+ *     this worker cannot verify because it holds none, or ids that are not ULIDs.
+ *     Present-but-wrong is a misconfiguration or an attack, and collapsing it into
+ *     `null` would let either one fall through to whatever the caller does for
+ *     "unrouted".
+ *   - **a node** — trustworthy, and the tenant whose data this request may touch.
+ *
+ * `expectedSecret` is what makes the headers trustworthy in code. K-26's real
+ * boundary is that vertical workers have no public route, so the router is the only
+ * possible source — but that is a deployment fact, and `workers.dev` is on by
+ * default. When the secret is configured, a request that did not come from the
+ * router cannot assert a tenant no matter how the routes are configured. When it is
+ * NOT configured the assertion fails closed (#966): an unsigned assertion is refused
+ * unless the host opted in with `allowUnsigned`, so forgetting to provision the
+ * secret is a visible outage rather than an open door.
+ */
+export function readRoutedNode(headers, options = {}) {
+    const rawTenant = headers.get('x-substrat-tenant');
+    const rawScope = headers.get('x-substrat-scope');
+    if (!rawTenant && !rawScope)
+        return null;
+    const { expectedSecret, allowUnsigned = false } = options;
+    if (expectedSecret) {
+        if (!secretMatches(headers.get('x-substrat-router'), expectedSecret)) {
+            throw new RouterAssertionError('router assertion is not signed by a known router');
+        }
+    }
+    else if (!allowUnsigned) {
+        throw new RouterAssertionError('router assertion cannot be verified: this worker has no ROUTER_SECRET configured');
+    }
+    if (!rawTenant || !rawScope) {
+        throw new RouterAssertionError('router assertion is incomplete');
+    }
+    if (!ROUTED_ID.test(rawTenant) || !ROUTED_ID.test(rawScope)) {
+        throw new RouterAssertionError('router assertion carries a malformed id');
+    }
+    return {
+        tenantId: rawTenant,
+        scopeId: rawScope,
+        surface: headers.get('x-substrat-surface') ?? 'app',
+        verticalSlug: headers.get('x-substrat-vertical'),
+    };
+}
 //# sourceMappingURL=routed-node.js.map

package/dist/routed-node.js.map

@@ -1 +1 @@
-{"version":3,"file":"routed-node.js","sourceRoot":"","sources":["../src/routed-node.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"routed-node.js","sourceRoot":"","sources":["../src/routed-node.ts"],"names":[],"mappings":"AACA,qFAAqF;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,0BAA0B,CAAC;AA8BpD,oFAAoF;AACpF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAwBlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAqB,EACrB,OAAO,GAA0B,EAAE;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,EAAE,cAAc,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1D,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,oBAAoB,CAAC,kDAAkD,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC5B,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,oBAAoB,CAAC,yCAAyC,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAqB;QAC/B,OAAO,EAAE,QAAmB;QAC5B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,KAAK;QACnD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;KACjD,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/vertical-host",
-  "version": "0.141.0",
+  "version": "0.142.0",
   "description": "The platform's /internal/* surface + error envelope, authored once — mount it in a vertical worker instead of re-copying the control-plane contract",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -29,18 +29,18 @@
     "ai": "7.0.128",
     "hono": "^4.13.13",
     "workers-ai-provider": "^4.0.0",
-    "@substrat-run/contracts": "^0.141.0",
-    "@substrat-run/kernel": "^0.141.0",
-    "@substrat-run/model-providers": "^0.5.31"
+    "@substrat-run/contracts": "^0.142.0",
+    "@substrat-run/kernel": "^0.142.0",
+    "@substrat-run/model-providers": "^0.5.32"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^9.6.0",
     "better-sqlite3": "^13.0.3",
     "typescript": "^7.0.0",
     "vitest": "^5.0.3",
-    "@substrat-run/vertical-auth": "^0.21.1",
-    "@substrat-run/contract-tests": "^0.141.0",
-    "@substrat-run/adapter-sqlite": "^0.141.0"
+    "@substrat-run/adapter-sqlite": "^0.142.0",
+    "@substrat-run/contract-tests": "^0.142.0",
+    "@substrat-run/vertical-auth": "^0.22.0"
   },
   "publishConfig": {
     "access": "public"

package/dist/platform-call.d.ts

@@ -1,10 +0,0 @@
-/**
- * Authenticating a call from the platform to a vertical (K-31, #1978).
- *
- * Moving here from the kernel, beside `readRoutedNode`. For one release the definition
- * still lives in `@substrat-run/kernel` and this module re-exports that same binding, so an
- * import from either package is the one function. Import it from here. The header names
- * it reads are wire vocabulary and live in `@substrat-run/contracts`.
- */
-export { assertPlatformCall, PlatformCallError, kickFlags } from '@substrat-run/kernel';
-//# sourceMappingURL=platform-call.d.ts.map

package/dist/platform-call.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform-call.d.ts","sourceRoot":"","sources":["../src/platform-call.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/platform-call.js

@@ -1,10 +0,0 @@
-/**
- * Authenticating a call from the platform to a vertical (K-31, #1978).
- *
- * Moving here from the kernel, beside `readRoutedNode`. For one release the definition
- * still lives in `@substrat-run/kernel` and this module re-exports that same binding, so an
- * import from either package is the one function. Import it from here. The header names
- * it reads are wire vocabulary and live in `@substrat-run/contracts`.
- */
-export { assertPlatformCall, PlatformCallError, kickFlags } from '@substrat-run/kernel';
-//# sourceMappingURL=platform-call.js.map

package/dist/platform-call.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform-call.js","sourceRoot":"","sources":["../src/platform-call.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC"}