Slugs that can never be ALLOCATED to a client, for three distinct reasons:
the TCB identity above; shared-infrastructure subdomains the commercial
host's subdomain cross-check treats as non-tenant hosts (rejecting them AT
PROVISIONING is the robust half of that check — a tenant literally named
'www' could otherwise satisfy host-tenant === token-tenant on a shared
host); and 'default', the conventional single-tenant id (deploy/README.md),
reserved so a community host running it can adopt this registry later
without finding 'default' sold to a client. Of these only
RESERVED_TENANT_IDS bites at authentication — a single-tenant host whose
tenant is named 'api' or 'default' still authenticates. 'default' is
deliberately a list entry, not an exported constant: a blessed
DEFAULT_TENANT value would invite the tenantId ?? DEFAULT_TENANT
fail-open this design exists to prevent.
Slugs that can never be ALLOCATED to a client, for three distinct reasons: the TCB identity above; shared-infrastructure subdomains the commercial host's subdomain cross-check treats as non-tenant hosts (rejecting them AT PROVISIONING is the robust half of that check — a tenant literally named 'www' could otherwise satisfy
host-tenant === token-tenanton a shared host); and 'default', the conventional single-tenant id (deploy/README.md), reserved so a community host running it can adopt this registry later without finding 'default' sold to a client. Of these only RESERVED_TENANT_IDS bites at authentication — a single-tenant host whose tenant is named 'api' or 'default' still authenticates. 'default' is deliberately a list entry, not an exported constant: a blessed DEFAULT_TENANT value would invite thetenantId ?? DEFAULT_TENANTfail-open this design exists to prevent.