The header the trusted Worker stamps with the AUTHENTICATED tenant on every
request it forwards to a thread DO. ONE literal for all three enforcement
points — a typo on any of them must fail closed (the DO's assertion rejects),
and two spellings would silently disable the check on the day one side
changed.
SERVER-STAMPED, never client-supplied. A thread DO is reached only through a
stub fetch from createThreadTopology, which never traverses the Worker's
request pipeline, so no legitimate inbound request carries this header — which
is why createTenantResolver refuses one that does, before any store binds.
The header the trusted Worker stamps with the AUTHENTICATED tenant on every request it forwards to a thread DO. ONE literal for all three enforcement points — a typo on any of them must fail closed (the DO's assertion rejects), and two spellings would silently disable the check on the day one side changed.
SERVER-STAMPED, never client-supplied. A thread DO is reached only through a stub fetch from
createThreadTopology, which never traverses the Worker's request pipeline, so no legitimate inbound request carries this header — which is whycreateTenantResolverrefuses one that does, before any store binds.