@ultimat3/cli 22.5.1 → 22.6.0

package/CLAUDE.md

@@ -79,8 +79,9 @@ Commands: `bun test packages/cli` (from the repo root — the test preload lives
 | `runtime-jobs.ts` / `runtime-realtime.ts` / `runtime-notify-retention.ts` / `runtime-cache.ts` / `runtime-purge.ts` / `runtime-replica.ts` | `app.config.ts` sections the boot obeys, and what each wires |
 | `role-start.ts` / `role-start-types.ts` / `role-realtime.ts` | `--role` selection and start/stop for `web`, `sync`, `worker`, `scheduler`; `realtime.enabled: false` drops `sync` and `replicator` |
 | `role-sync.ts` / `role-replicator.ts` / `runtime-live-feed.ts` | the sync node, the change feed |
-| `runtime-render.ts` / `runtime-assets.ts` / `runtime-storage.ts` / `runtime-hooks.ts` / `api-routes.ts` | the HTTP surface: pages, `/icons` + `/media`, `/_storage`, authz, the app's API |
-| `runtime-overrides.ts` | the one field a host hands the framework a driver through |
+| `runtime-render.ts` / `runtime-assets.ts` / `runtime-storage.ts` / `runtime-hooks.ts` / `api-routes.ts` | the HTTP surface: pages, `/icons` + `/media`, `/_storage`, authz, the app's API — plus its bearer mounts (`apiMountRoutes`) and pages' bound `POST`s (`pagePostRoutes`), mounted by BOTH boots |
+| `runtime-overrides.ts` | the one field a host hands the framework a driver through — and `routes`, the plain routes for a wire format no primitive speaks (OAuth token endpoint) |
+| `app-openapi.ts` | `openapi.json` (complete when `defineApi({ openapi })` is declared) and each bearer mount's own document; staleness for all of them |
 | `script-csp.ts` / `style-csp.ts` / `style-bundle.ts` / `page-sync.ts` / `worker-bundle.ts` | CSP hashes, the CSS file, the page's sync target and worker |
 | `island-bundle.ts` / `island-store.ts` / `island-realtime.ts` / `solid-loader.ts` | islands: one `Bun.build` each, source-addressed; `x build --target docker` writes a verified store the container loads |
 | `dev-*.ts` | `x dev` only: dashboard sources, traces, the N+1 ledger, the watcher, the reload, the lock, the port |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/cli",
-  "version": "22.5.1",
+  "version": "22.6.0",
   "description": "The `x` binary: new, dev, build, verify, generate, db, mcp, doctor, deploy",
   "license": "MIT",
   "type": "module",
@@ -38,33 +38,33 @@
   },
   "dependencies": {
     "@babel/core": "^8.0.1",
-    "@ultimat3/action": "22.5.1",
-    "@ultimat3/admin": "22.5.1",
-    "@ultimat3/ai": "22.5.1",
-    "@ultimat3/auth": "22.5.1",
-    "@ultimat3/cache": "22.5.1",
-    "@ultimat3/core": "22.5.1",
-    "@ultimat3/db": "22.5.1",
-    "@ultimat3/entity": "22.5.1",
-    "@ultimat3/flags": "22.5.1",
-    "@ultimat3/http": "22.5.1",
-    "@ultimat3/i18n": "22.5.1",
-    "@ultimat3/jobs": "22.5.1",
-    "@ultimat3/mail": "22.5.1",
-    "@ultimat3/manifest": "22.5.1",
-    "@ultimat3/mcp": "22.5.1",
-    "@ultimat3/money": "22.5.1",
-    "@ultimat3/notify": "22.5.1",
-    "@ultimat3/policy": "22.5.1",
-    "@ultimat3/pwa": "22.5.1",
-    "@ultimat3/query": "22.5.1",
-    "@ultimat3/realtime": "22.5.1",
-    "@ultimat3/render": "22.5.1",
-    "@ultimat3/schema": "22.5.1",
-    "@ultimat3/seo": "22.5.1",
-    "@ultimat3/storage": "22.5.1",
-    "@ultimat3/testing": "22.5.1",
-    "@ultimat3/time": "22.5.1",
+    "@ultimat3/action": "22.6.0",
+    "@ultimat3/admin": "22.6.0",
+    "@ultimat3/ai": "22.6.0",
+    "@ultimat3/auth": "22.6.0",
+    "@ultimat3/cache": "22.6.0",
+    "@ultimat3/core": "22.6.0",
+    "@ultimat3/db": "22.6.0",
+    "@ultimat3/entity": "22.6.0",
+    "@ultimat3/flags": "22.6.0",
+    "@ultimat3/http": "22.6.0",
+    "@ultimat3/i18n": "22.6.0",
+    "@ultimat3/jobs": "22.6.0",
+    "@ultimat3/mail": "22.6.0",
+    "@ultimat3/manifest": "22.6.0",
+    "@ultimat3/mcp": "22.6.0",
+    "@ultimat3/money": "22.6.0",
+    "@ultimat3/notify": "22.6.0",
+    "@ultimat3/policy": "22.6.0",
+    "@ultimat3/pwa": "22.6.0",
+    "@ultimat3/query": "22.6.0",
+    "@ultimat3/realtime": "22.6.0",
+    "@ultimat3/render": "22.6.0",
+    "@ultimat3/schema": "22.6.0",
+    "@ultimat3/seo": "22.6.0",
+    "@ultimat3/storage": "22.6.0",
+    "@ultimat3/testing": "22.6.0",
+    "@ultimat3/time": "22.6.0",
     "babel-preset-solid": "^1.9.15"
   }
 }

package/src/api-routes.ts

@@ -2,10 +2,16 @@
 // half `@ultimat3/query` projects. `x dev` and `serve.ts` both mount THIS rather than each listing
 // the registries themselves — two lists is how `query.client()` shipped deriving `/_x/query/<kebab>`
 // against a route neither file mounted, compiling everywhere and 404ing everywhere.
+//
+// And the two contributions that are the SAME primitives reached another way, composed here for
+// the same reason: the bearer mounts `defineApi({ http: { mounts } })` declares (`/v1/*`), and the
+// `POST` a page binds to an action (`defineRoute({ post })`).
 
-import { listActions, toRoute } from '@ultimat3/action';
-import type { Route } from '@ultimat3/http';
+import { apiDeclaration, getAction, listActions, toPostBinding, toRoute } from '@ultimat3/action';
+import type { RateLimitStore, Route } from '@ultimat3/http';
+import { bearerMount } from '@ultimat3/http';
 import { listQueries, toQueryRoute } from '@ultimat3/query';
+import { RoutePostInvalidError, routeEntries } from '@ultimat3/render';
 
 /**
  * Whatever loading the app's modules put in the two registries, as routes. Read at call time,
@@ -14,3 +20,47 @@ import { listQueries, toQueryRoute } from '@ultimat3/query';
 export function apiRoutes(): readonly Route[] {
   return [...listActions().map(toRoute), ...listQueries().map(toQueryRoute)];
 }
+
+/**
+ * Every bearer mount the app declared, over the SAME projected routes `apiRoutes()` serves — so
+ * `/v1/create-case` runs `/api/create-case`'s handler, policy and idempotency, and only the
+ * credential, the cut and the per-token allowance differ. `store` is the boot's rate-limit store,
+ * so a fleet counts one token's allowance once.
+ */
+export function apiMountRoutes(store?: RateLimitStore): readonly Route[] {
+  const mounts = apiDeclaration().http?.mounts ?? [];
+  if (mounts.length === 0) return [];
+  const routes = apiRoutes();
+  return mounts.flatMap((mount) =>
+    bearerMount({
+      prefix: mount.prefix,
+      routes,
+      scopes: mount.scopes,
+      resolveToken: mount.resolveToken,
+      ...(mount.rateLimit === undefined ? {} : { rateLimit: mount.rateLimit }),
+      ...(store === undefined ? {} : { rateLimitStore: store }),
+    }),
+  );
+}
+
+/**
+ * `POST <page path>` for every page declaring `defineRoute({ post: '<action>' })`, answered by that
+ * action with the URL's query merged over the posted fields. A name no action is registered under
+ * is refused at boot (`X_ROUTE_POST_INVALID`) — a page promising a POST it cannot answer is the
+ * one-click unsubscribe that silently never unsubscribes.
+ */
+export function pagePostRoutes(): readonly Route[] {
+  const routes: Route[] = [];
+  for (const entry of routeEntries()) {
+    const name = entry.config.post;
+    if (name === undefined) continue;
+    const target = getAction(name);
+    if (target === undefined) {
+      throw new RoutePostInvalidError(
+        `${entry.file} declares post: '${name}', and no action is registered under that name`,
+      );
+    }
+    routes.push(toPostBinding(target, entry.path));
+  }
+  return routes;
+}

package/src/app-artifacts.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path'; // why: Bun ships no path-join primitive.
 import type { Manifest } from '@ultimat3/manifest';
 import { MANIFEST_FILENAME } from '@ultimat3/manifest';
 import { writeAppManifest } from './app-manifest';
-import { OPENAPI_FILE, openApiJson } from './app-openapi';
+import { openApiArtifacts } from './app-openapi';
 
 export interface ArtifactOptions {
   /** `x manifest --no-openapi` writes the manifest alone. */
@@ -31,9 +31,11 @@ export async function writeAppArtifacts(
     await writeAppManifest(root, manifest);
     written.push(MANIFEST_FILENAME);
   }
-  if (options.openapi && (await present(OPENAPI_FILE))) {
-    await Bun.write(join(root, OPENAPI_FILE), openApiJson(manifest));
-    written.push(OPENAPI_FILE);
+  // `openapi.json`, then each bearer mount's own document (`openapi.v1.json`), from one projection.
+  for (const artifact of options.openapi ? openApiArtifacts(manifest) : []) {
+    if (!(await present(artifact.file))) continue;
+    await Bun.write(join(root, artifact.file), artifact.text);
+    written.push(artifact.file);
   }
   return written;
 }

package/src/app-mcp.ts

@@ -11,6 +11,7 @@ import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { logger } from '@ultimat3/core';
 import type { Route } from '@ultimat3/http';
+import { json, selfOrigin } from '@ultimat3/http';
 import { type AppMcp, McpAppUnmountedError } from '@ultimat3/mcp';
 import { APP_CONFIG_EXPORT } from './app-auth';
 import { APP_CONFIG_FILE } from './app-root';
@@ -113,14 +114,37 @@ export async function appMcpMount(root: string): Promise<AppMcpMount> {
         warning: new McpAppUnmountedError({ reason: 'no-route', path: declared.path, file }),
       };
     }
+    // The PUBLIC origin, as the pipeline resolved it (`ctx.https` honours a trusted proxy's
+    // `x-forwarded-proto`): behind a TLS-terminating ingress the raw request URL is `http://` on
+    // an internal host, and a `resource_metadata` naming that is a URL no client can reach.
+    const resource = route.protectedResource;
     return {
       routes: [
         {
           method: 'POST',
           path: declared.path,
-          handler: (request) => route.handle(request.raw),
+          handler: (request, ctx) =>
+            route.handle(request.raw, { origin: selfOrigin(ctx.url, ctx.https) }),
           meta: { name: APP_MCP_ROUTE_NAME, auth: 'public', enforcedBy: 'handler' },
         },
+        // RFC 9728 protected-resource metadata, when the app declared `oauth`: path-inserted and
+        // at the root, so a client probing either finds the authorization server.
+        ...(resource === undefined
+          ? []
+          : resource.paths.map(
+              (path): Route => ({
+                method: 'GET',
+                path,
+                handler: (_request, ctx) => {
+                  const response = json(resource.document(selfOrigin(ctx.url, ctx.https)));
+                  // A browser-hosted MCP client reads this cross-origin; it holds nothing secret.
+                  response.headers.set('access-control-allow-origin', '*');
+                  response.headers.set('cache-control', 'public, max-age=3600');
+                  return response;
+                },
+                meta: { name: `${APP_MCP_ROUTE_NAME}.oauth-protected-resource`, auth: 'public' },
+              }),
+            )),
       ],
       path: declared.path,
       warning: undefined,

package/src/app-openapi.ts

@@ -7,41 +7,106 @@
 
 // why: Bun ships no path-join primitive.
 import { join } from 'node:path';
-import { buildOpenApi, serializeOpenApi } from '@ultimat3/action';
+import type { OpenApiDocument } from '@ultimat3/action';
+import {
+  apiDeclaration,
+  buildOpenApi,
+  completeOpenApi,
+  mountOpenApi,
+  serializeOpenApi,
+} from '@ultimat3/action';
 import { ERROR_DOCS_URL } from '@ultimat3/core';
+import { bearerMount } from '@ultimat3/http';
 import type { Manifest } from '@ultimat3/manifest';
 import { queryOpenApiPaths } from '@ultimat3/query';
+import { apiRoutes } from './api-routes';
 import type { Finding } from './output';
 
 export const OPENAPI_FILE = 'openapi.json';
 
-/** The exact bytes on disk — deterministic, so `x verify` can compare them literally. */
-export const openApiJson = (manifest: Manifest): string => {
+/** One generated document: its app-root file and its exact bytes. */
+export interface OpenApiArtifact {
+  readonly file: string;
+  readonly text: string;
+}
+
+/** Both registries in one document — the shape every app had before it declared `openapi`. */
+function mergedDocument(manifest: Manifest): OpenApiDocument {
   const document = buildOpenApi({ title: manifest.app.name, version: manifest.app.version });
   // Action paths are `/api/...`, query paths `/_x/query/...`: disjoint by prefix, so the spread
   // can never shadow one with the other. `serializeOpenApi` sorts the merged keys.
-  return serializeOpenApi({ ...document, paths: { ...document.paths, ...queryOpenApiPaths() } });
+  return { ...document, paths: { ...document.paths, ...queryOpenApiPaths() } };
+}
+
+/**
+ * The exact bytes on disk — deterministic, so `x verify` can compare them literally. An app that
+ * declared `defineApi({ openapi })` gets the COMPLETE document (its info and servers, security
+ * schemes, 401/429 on authenticated operations); one that did not keeps the bytes it had.
+ */
+export const openApiJson = (manifest: Manifest): string => {
+  const merged = mergedDocument(manifest);
+  const declared = apiDeclaration();
+  if (declared.openapi === undefined) return serializeOpenApi(merged);
+  return serializeOpenApi(
+    completeOpenApi(merged, {
+      declared: declared.openapi,
+      routes: apiRoutes(),
+      bearer: (declared.http?.mounts ?? []).length > 0,
+    }),
+  );
+};
+
+/**
+ * Every document the app maintains: `openapi.json`, then one per bearer mount that names a file
+ * (`mounts: [{ prefix: '/v1', openapi: 'openapi.v1.json', … }]`) — only the cut, at the mounted
+ * paths. The mount is built once here as the boot builds it, so a scope naming a primitive nothing
+ * registered is refused by `x manifest` as it would be by the server (`X_BEARER_MOUNT_INVALID`).
+ */
+export const openApiArtifacts = (manifest: Manifest): readonly OpenApiArtifact[] => {
+  const declared = apiDeclaration();
+  const mounts = (declared.http?.mounts ?? []).filter((mount) => mount.openapi !== undefined);
+  const artifacts: OpenApiArtifact[] = [{ file: OPENAPI_FILE, text: openApiJson(manifest) }];
+  if (mounts.length === 0) return artifacts;
+  const merged = mergedDocument(manifest);
+  const routes = apiRoutes();
+  for (const mount of mounts) {
+    bearerMount({ prefix: mount.prefix, routes, scopes: mount.scopes, resolveToken: () => null });
+    artifacts.push({
+      file: mount.openapi ?? OPENAPI_FILE,
+      text: serializeOpenApi(
+        mountOpenApi(merged, { declared: declared.openapi ?? {}, mount, routes }),
+      ),
+    });
+  }
+  return artifacts;
 };
 
 /**
  * The typed client is generated from `openapi.json`, so a stale spec ships a wrong client. One
  * check, read by `x verify`'s `manifest` step AND `x manifest --check` — which looked at
- * `x.manifest.json` alone and answered "fresh" over a spec the gate refused.
+ * `x.manifest.json` alone and answered "fresh" over a spec the gate refused. A mount's document
+ * is checked the same way, and — because the app ASKED for it by naming the file — is stale when
+ * it is missing, where an absent `openapi.json` is an app that does not maintain one.
  */
 export async function openApiStaleness(
   root: string,
   manifest: Manifest,
 ): Promise<readonly Finding[]> {
-  const path = join(root, OPENAPI_FILE);
-  if (!(await Bun.file(path).exists())) return [];
-  if ((await Bun.file(path).text()) === openApiJson(manifest)) return [];
-  return [
-    {
+  const findings: Finding[] = [];
+  for (const artifact of openApiArtifacts(manifest)) {
+    const path = join(root, artifact.file);
+    const exists = await Bun.file(path).exists();
+    if (!exists && artifact.file === OPENAPI_FILE) continue;
+    if (exists && (await Bun.file(path).text()) === artifact.text) continue;
+    findings.push({
       code: 'X_MANIFEST_STALE',
-      cause: `${OPENAPI_FILE} does not match the actions the code registers`,
+      cause: exists
+        ? `${artifact.file} does not match the actions the code registers`
+        : `${artifact.file} is declared by a bearer mount and has not been written`,
       fix: 'x manifest',
       docs: ERROR_DOCS_URL,
-      at: OPENAPI_FILE,
-    },
-  ];
+      at: artifact.file,
+    });
+  }
+  return findings;
 }

package/src/cmd-dev.ts

@@ -232,6 +232,8 @@ async function bootDev(
     dashboard,
     islands: () => state.islands,
     realtime: runtime.realtime,
+    rateLimitStore: appRuntime?.rateLimitStore ?? runtime.rateLimitStore,
+    appRoutes: appRuntime?.routes,
   });
 
   // The app's `apps/<app>/runtime.ts`, composed exactly as `runRole` composes a caller's

package/src/dev-route-table.ts

@@ -3,10 +3,10 @@
 // 500-line ceiling; `serve.ts` composes the production table from the same builders.
 
 import type { RealtimeConfig } from '@ultimat3/core';
-import type { Route } from '@ultimat3/http';
+import type { RateLimitStore, Route } from '@ultimat3/http';
 import { describeRoutes } from '@ultimat3/render';
 import type { Storage } from '@ultimat3/storage';
-import { apiRoutes } from './api-routes';
+import { apiMountRoutes, apiRoutes, pagePostRoutes } from './api-routes';
 import { mountAppMcp } from './app-mcp';
 import type { DevDashboardInput } from './dev-dashboard';
 import { devDashboardRoutes } from './dev-dashboard';
@@ -39,6 +39,10 @@ export interface DevRouteTableInput {
   readonly islands: () => IslandBundle;
   /** `app.config.ts`'s `realtime`, as the boot obeyed it: off, no document names a sync node. */
   readonly realtime: Pick<RealtimeConfig, 'enabled'>;
+  /** The web role's limiter store — what a bearer mount counts per-token allowances on. */
+  readonly rateLimitStore?: RateLimitStore | undefined;
+  /** `apps/<app>/runtime.ts`'s plain `routes`, mounted as the container mounts them. */
+  readonly appRoutes?: readonly Route[] | undefined;
 }
 
 export interface DevRouteTable {
@@ -87,7 +91,9 @@ export async function devRouteTable(input: DevRouteTableInput): Promise<DevRoute
     // The same API table the container serves: a read that answers here and 404s in production
     // is exactly the drift one composition exists to prevent.
     ...apiRoutes(),
+    ...apiMountRoutes(input.rateLimitStore),
     ...mcpMount.routes,
+    ...(input.appRoutes ?? []),
     // The image pipeline's only HTTP surface: the icons the web manifest declares, and the
     // variants every `srcset` promises. Mounted before the app's own routes so a page route can
     // never shadow `/icons` or `/media`.
@@ -117,6 +123,7 @@ export async function devRouteTable(input: DevRouteTableInput): Promise<DevRoute
     }),
     ...(serviceWorker === undefined ? [] : serviceWorkerRoutes(serviceWorker)),
     ...sync.routes,
+    ...pagePostRoutes(),
     ...appRoutes({
       buildId: input.buildId,
       resolveIsland: (file) => input.islands().resolverFor(file),

package/src/role-start.ts

@@ -43,6 +43,7 @@ import { pgExecutorFor } from './runtime-queue';
 import type { RunningServices } from './runtime-services';
 import { inlineScriptSources } from './script-csp';
 import { inlineStyleSources } from './style-csp';
+import { syncConnectSources } from './sync-url';
 import { DEV_BINDING } from './web-binding';
 
 // Declared beside the option types so `x dev`'s spec reads it without loading this module.
@@ -248,6 +249,9 @@ function startWeb(options: StartRolesOptions, mount?: WebSocketMount<SyncWs>): S
             extend: {
               'style-src': inlineStyleSources(options.inlineStyles ?? []),
               'script-src': inlineScriptSources(options.inlineScripts ?? []),
+              // A sync node on ANOTHER origin (`SYNC_URL`), admitted by that origin alone — the
+              // baseline's `'self'` is every same-origin rung.
+              'connect-src': syncConnectSources(options.env),
             },
           },
         },

package/src/runtime-overrides.ts

@@ -5,7 +5,7 @@
 // as the first arm of `overrides?.x ?? <the env-selected default>`.
 
 import type { PurgeDriver } from '@ultimat3/cache';
-import type { Middleware, RateLimitStore } from '@ultimat3/http';
+import type { Middleware, RateLimitStore, Route } from '@ultimat3/http';
 import type { JobDriver } from '@ultimat3/jobs';
 import type { MailDriver } from '@ultimat3/mail';
 import type { SyncAuthenticator, Transport } from '@ultimat3/realtime/server';
@@ -60,6 +60,15 @@ export interface RuntimeOverrides {
   readonly isrStore?: IsrStore;
   /** Prepended to the pipeline by `createServer`, which `startRoles` never passed one. */
   readonly middleware?: readonly Middleware[];
+  /**
+   * Plain HTTP routes at paths no primitive projects to — `/.well-known/oauth-authorization-server`,
+   * a form-encoded `POST /oauth/token` answering RFC 6749 JSON, a feed with its own content type.
+   * Mounted by both boots, after the framework's own and before the pages, through the same
+   * pipeline (`meta.auth` required, CSRF, limits, security headers). The one escape hatch for a
+   * wire format a primitive cannot speak: an action answers JSON or a problem document, a page
+   * answers a document, and a protocol that fixes its own error shape is neither.
+   */
+  readonly routes?: readonly Route[];
   /** The `/media/*` transform. Omitted, `builtinImageDriver` — core's PNG/JPEG pipeline. */
   readonly images?: ImageTransformDriver;
   /**

package/src/serve-boot.ts

@@ -8,7 +8,7 @@ import { configureLifecycle } from '@ultimat3/core';
 import type { Route } from '@ultimat3/http';
 import { describeRoutes } from '@ultimat3/render';
 import { createIsrController } from '@ultimat3/render/server';
-import { apiRoutes } from './api-routes';
+import { apiMountRoutes, apiRoutes, pagePostRoutes } from './api-routes';
 import { loadSignInPath } from './app-auth';
 import { loadApp } from './app-load';
 import { appManifest } from './app-manifest';
@@ -169,7 +169,12 @@ async function webSurface(
   const served = servedStorage(runtime.storage);
   const routes: readonly Route[] = [
     ...apiRoutes(),
+    // The bearer doors onto a cut of the same routes (`defineApi({ http: { mounts } })`), counted
+    // on the store this boot's limiter uses, so one token's allowance is one number fleet-wide.
+    ...apiMountRoutes(options.runtime?.rateLimitStore ?? runtime.rateLimitStore),
     ...mcpMount.routes,
+    // The app's own plain routes (`apps/<app>/runtime.ts` `routes`), before any page can shadow one.
+    ...(options.runtime?.routes ?? []),
     ...(serviceWorker === undefined ? [] : serviceWorkerRoutes(serviceWorker)),
     ...assetRoutes({
       root: options.root,
@@ -186,6 +191,8 @@ async function webSurface(
     ...seoRoutes({ env: options.env, site }),
     // The page's one socket: its worker script, served beside the islands for their reason.
     ...sync.routes,
+    // A page's `POST`, bound to an action (`defineRoute({ post })`) — beside the page's `GET`.
+    ...pagePostRoutes(),
     ...appRoutes({
       buildId,
       resolveIsland: (file) => islands.resolverFor(file),

package/src/sync-url.ts

@@ -31,6 +31,17 @@ export function syncUrlFrom(env: Readonly<Record<string, string | undefined>>):
   return declared;
 }
 
+/**
+ * What the page's CSP `connect-src` must add for the socket: nothing when the node is on the page
+ * origin (`'self'` covers ws/wss there), else `SYNC_URL`'s ORIGIN exactly — never a bare `wss:`
+ * scheme, which would admit a socket to any host (`@ultimat3/http`'s baseline dropped it).
+ */
+export function syncConnectSources(env: Readonly<Record<string, string | undefined>>): string[] {
+  const url = syncUrlFrom(env);
+  if (url === SYNC_PATH) return [];
+  return [new URL(url).origin];
+}
+
 /**
  * The page origins a sync node admits besides its own host name: `APP_URL`'s, when set. Only a
  * deployment that serves the page on another host than the node needs it; an unparsable value is