@teamscala/service-boot 0.23.546 → 0.23.548

package/src/register-api-routes.ts

@@ -3,112 +3,118 @@
  * @status handwritten
  */
 
-import type { ServiceInstallConfig } from "./load-service-install-row";
+import { getEntriesByType } from "@teamscala/db/registry/accessors";
+import { ApiRouteConfigSchema } from "@teamscala/registry-schemas/registry-schemas/api-route";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { BootFatalError } from "@teamscala/os/errors/boot-error";
+import type { ServiceInstallConfig } from "./load-service-install-row";
 import type { MountRegistry } from "@teamscala/os/runtime-contracts/mount-context";
 import type { Context, Hono } from "hono";
 import { getConnInfo } from "hono/bun";
 import { CALLER_HEADERS } from "@teamscala/os/contracts/mcp";
+import {
+	selectServiceApiRoutes,
+	type ApiRouteRowShape,
+} from "./select-service-api-routes.ts";
+import * as v from "valibot";
 
-// From CALLER_HEADERS, never a literal: this name is one end of a contract the
-// gateway's caller-resolution reads, and a literal stores it twice. The
-// 2026-08-02 outage was that exact drift on a sibling header (reader on
-// `x-user-id`, writer on `x-caller-user-id`), and it took every tool on the
-// cloud MCP down once the branch masking it was closed.
 const REMOTE_PORT_HEADER = CALLER_HEADERS.REMOTE_PORT;
-// Verified socket-peer address (unforgeable transport origin). Sanitized
-// (client-supplied value deleted) then set from getConnInfo so handlers that
-// receive only a Request (e.g. mcp-tool-runtime/mount.ts) can gate on the
-// genuine transport origin per no-client-controlled-trust-signals — an external
-// attacker cannot make their TCP connection appear on the server's loopback.
 const REMOTE_ADDR_HEADER = CALLER_HEADERS.REMOTE_ADDRESS;
 
+function readApiRouteRows(log: ReturnType<typeof getAppLogger>): ApiRouteRowShape[] {
+	const rows: ApiRouteRowShape[] = [];
+	for (const entry of getEntriesByType("api_route")) {
+		if (!entry.is_active) continue;
+		const parsed = v.safeParse(ApiRouteConfigSchema, entry.config);
+		if (!parsed.success) {
+			const issues = parsed.issues
+				.map((issue) => {
+					const path = v.getDotPath(issue);
+					return path ? `${path}: ${issue.message}` : issue.message;
+				})
+				.join("; ");
+			log.error(
+				`[register-api-routes] api_route "${entry.slug}" does not satisfy its own schema, so none of its routes are served: ${issues}`,
+			);
+			continue;
+		}
+		rows.push({ slug: entry.slug, config: parsed.output });
+	}
+	return rows;
+}
+
 export function registerApiRoutes(
 	app: Hono,
-	config: ServiceInstallConfig,
+	_config: ServiceInstallConfig,
 	mountRegistry: MountRegistry,
 	serviceSlug: string,
 ): number {
 	const log = getAppLogger();
+	const decisions = selectServiceApiRoutes(
+		readApiRouteRows(log),
+		serviceSlug,
+		[...mountRegistry.handlers.keys()],
+	);
 	let count = 0;
-	for (const route of config.api_routes ?? []) {
-		const handler = mountRegistry.handlers.get(route.handler_slug);
-		if (!handler) {
-			throw new BootFatalError(
-				"register-api-routes",
-				serviceSlug,
-				`api_route "${route.method} ${route.path}" references handler_slug "${route.handler_slug}" but no server_package registered it`,
-			);
-		}
-		const method = route.method.toLowerCase() as
-			| "get"
-			| "post"
-			| "put"
-			| "delete"
-			| "patch";
-		(app as never as Record<string, (path: string, h: never) => void>)[method](
-			route.path,
-			(async (c: Context) => {
-				let req: Request = c.req.raw;
-				try {
-					if (typeof c.env !== "object" || c.env === null) {
-						log.debug(
-							`[register-api-routes] getConnInfo skipped: c.env is ${typeof c.env}`,
-						);
-					} else {
-						const info = getConnInfo(c);
-						const port = info?.remote?.port;
-						const address = info?.remote?.address ?? null;
-						// Port: set when not already present (caller-identity pane
-						// resolution preserves a chained value). Address: sanitize +
-						// re-set ONLY when getConnInfo returned one — the canonical
-						// address injection lives in service-runtime's serve.ts
-						// (server.requestIP, which reliably returns address; Hono's
-						// getConnInfo does not on Bun). Touching the address here
-						// only when we can re-verify avoids clobbering serve.ts's
-						// injection.
-						const needsPort =
-							typeof port === "number" &&
-							port > 0 &&
-							!req.headers.has(REMOTE_PORT_HEADER);
-						if (address !== null || needsPort) {
-							const headers = new Headers(req.headers);
-							if (address) {
-								headers.delete(REMOTE_ADDR_HEADER);
-								headers.set(REMOTE_ADDR_HEADER, String(address));
-							}
-							if (needsPort) headers.set(REMOTE_PORT_HEADER, String(port));
-							req = new Request(req.url, {
-								method: req.method,
-								headers,
-								body: req.body,
-							});
+	for (const decision of decisions) {
+		const mount = decision.mount;
+		if (!mount) continue;
+		const handler = mountRegistry.handlers.get(mount.handlerSlug);
+		if (!handler) continue;
+		const register = app as unknown as Record<
+			string,
+			(path: string, handler: (c: Context) => Promise<Response>) => void
+		>;
+		register[mount.method](mount.path, async (c: Context) => {
+			let req: Request = c.req.raw;
+			try {
+				if (typeof c.env !== "object" || c.env === null) {
+					log.debug(
+						`[register-api-routes] getConnInfo skipped: c.env is ${typeof c.env}`,
+					);
+				} else {
+					const info = getConnInfo(c);
+					const port = info?.remote?.port;
+					const address = info?.remote?.address ?? null;
+					const needsPort =
+						typeof port === "number" &&
+						port > 0 &&
+						!req.headers.has(REMOTE_PORT_HEADER);
+					if (address !== null || needsPort) {
+						const headers = new Headers(req.headers);
+						if (address) {
+							headers.delete(REMOTE_ADDR_HEADER);
+							headers.set(REMOTE_ADDR_HEADER, String(address));
 						}
-						log.debug(
-							`[register-api-routes] getConnInfo port=${port ?? "undefined"} address=${address ?? "undefined"}`,
-						);
+						if (needsPort) headers.set(REMOTE_PORT_HEADER, String(port));
+						req = new Request(req.url, {
+							method: req.method,
+							headers,
+							body: req.body,
+						});
 					}
-				} catch (e) {
-					getAppLogger().error(
-						`[register-api-routes] getConnInfo failed: ${e}`,
+					log.debug(
+						`[register-api-routes] getConnInfo port=${port ?? "undefined"} address=${address ?? "undefined"}`,
 					);
 				}
-				const params = c.req.param();
-				return handler(req, params);
-			}) as never,
-		);
+			} catch (e) {
+				log.error(`[register-api-routes] getConnInfo failed: ${e}`);
+			}
+			return handler(req, c.req.param());
+		});
 		count++;
 	}
 
-	// NO hand-rolled OPTIONS/CORS here: two-phase-minimal-app registers the
-	// official hono/cors middleware GLOBALLY before this runs, and its OPTIONS
-	// branch answers preflights without calling next() — a hand preflight
-	// handler registered here is shadowed dead code (measured: zero
-	// invocations across trusted/no/foreign-origin preflights, bun probe
-	// 2026-09-27). The middleware also decorates ACTUAL cross-origin
-	// responses and reflects origins only inside the cookie domain — the
-	// dead copy reflected ANY origin with credentials.
+	const unserved = decisions.filter((decision) => decision.mount === null);
+	if (unserved.length > 0) {
+		log.warn(
+			`[scala-install:${serviceSlug}] ${unserved.length} api_route row(s) naming this service are NOT served: ${unserved
+				.map((decision) => `"${decision.slug}" (${decision.notMounted})`)
+				.join(", ")}`,
+		);
+	}
+	log.info(
+		`[scala-install:${serviceSlug}] registered ${count} api_route mount(s) from registry rows`,
+	);
 
 	return count;
 }

package/src/select-service-api-routes.ts

@@ -0,0 +1,82 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ */
+
+import { toCapabilitySlug } from "./capability-slug.ts";
+
+export interface ApiRouteRowShape {
+	slug: string;
+	config: {
+		service: string;
+		method: string;
+		path: string;
+		handler?: string;
+		handler_slug?: string;
+	};
+}
+
+export type MountMethod = "get" | "post" | "put" | "delete" | "patch";
+
+export interface MountShape {
+	method: MountMethod;
+	path: string;
+	handlerSlug: string;
+}
+
+export type NotMountedBecause = "declares-no-mount-handler" | "handler-not-mounted";
+
+export interface ApiRouteDecision {
+	slug: string;
+	service: string;
+	mount: MountShape | null;
+	notMounted: NotMountedBecause | null;
+}
+
+const MOUNT_METHODS: ReadonlySet<string> = new Set([
+	"get",
+	"post",
+	"put",
+	"delete",
+	"patch",
+]);
+
+export function selectServiceApiRoutes<T extends ApiRouteRowShape>(
+	rows: readonly T[],
+	serviceSlug: string,
+	mountedHandlers: readonly string[],
+): ApiRouteDecision[] {
+	const capability = toCapabilitySlug(serviceSlug);
+	const mounted = new Set(mountedHandlers);
+	const decisions: ApiRouteDecision[] = [];
+	for (const row of rows) {
+		const service = row.config.service;
+		if (toCapabilitySlug(service) !== capability) continue;
+		const handlerSlug = row.config.handler ?? row.config.handler_slug;
+		if (handlerSlug === undefined) {
+			decisions.push({
+				slug: row.slug,
+				service,
+				mount: null,
+				notMounted: "declares-no-mount-handler",
+			});
+			continue;
+		}
+		const method = row.config.method.toLowerCase();
+		if (!MOUNT_METHODS.has(method)) {
+			throw new Error(
+				`api_route "${row.slug}" declares method "${row.config.method}", which no HTTP surface can serve`,
+			);
+		}
+		const isMounted = mounted.has(handlerSlug);
+		decisions.push({
+			slug: row.slug,
+			service,
+			mount: isMounted
+				? { method: method as MountMethod, path: row.config.path, handlerSlug }
+				: null,
+			notMounted: isMounted ? null : "handler-not-mounted",
+		});
+	}
+	return decisions;
+}