fix: close SSRF bypass, make marketing surface reachable, replace fabricated AI assistant (#1016)

* fix(pulse-webhooks)!: close the SSRF bypass in the delivery guard

`WebhookDelivery` kept its own `net.BlockList` of private ranges, separate
from the list in `UrlValidator`. The two drifted, and the copy guarding
outbound deliveries was the weaker one: it omitted `0.0.0.0/8`, the IPv6
unspecified address, CGNAT `100.64.0.0/10` and `192.0.0.0/24`.

Because each of those is an IP literal, `validateResolvedHostname` returned
early and never re-checked them. So `http://0.0.0.0:8080/` passed validation
and was fetched - and on Linux `0.0.0.0` routes to loopback, meaning a
customer-registered webhook URL could reach services bound to 127.0.0.1 on
the delivery worker. Verified end to end: `validateUrl` returned null for
`0.0.0.0` while correctly blocking `127.0.0.1`, and a real fetch reached a
loopback-bound server.

Extract the range checks into `private-ip.ts` and have both callers use it,
so there is nothing left to drift. `validateUrl` also picks up the
`.localhost` suffix check it was missing - RFC 6761 reserves the whole
suffix, not just the bare label.

`UrlValidator` is now exported. Its own docs claimed consumers wire it in
front of their own fetch, but it was never re-exported from index.ts, so
nobody could - the claim was false and the class was unreachable.

Adds 8 regression cases against the delivery path, not just the validator.

* fix(web): make the marketing surface reachable and stop overstating it

A first-time visitor landing on `/` could not get anywhere. Every nav link,
both hero buttons, the CTA, and all nine footer links were `href="#"` -
sixteen dead links on pages whose destinations (`/docs`, `/reference`,
`/demo/contracts`, `/starters`, `/changelog`) all already existed and worked.

Centralise every off-page destination in `lib/links.ts` so a renamed route
breaks in one file instead of rotting silently in four.

Also fixed, all in the same category of claiming more than is true:

- `/starters` linked three repos that do not exist - `orbital-next-starter`,
  `orbital-express-starter`, `orbital-anchor-starter` all 404, so every
  source link and all six deploy buttons pointed at nothing. Repointed at
  the in-repo `examples/`, with the repo path now an actual link. Vercel's
  clone flow takes `root-directory`, so the Next.js starter keeps a working
  one-click; Railway's `templateUrl` has no subdirectory equivalent, so
  those two link to their README rather than ship a button that deploys the
  repo root by mistake.
- The anchor starter was described as having "a live React dashboard". It is
  a CLI that writes an append-only JSON Lines audit log. Description now
  matches the code.
- The footer hardcoded "● All systems operational" next to a Status link
  that went nowhere. There is no uptime monitor behind it, so it read green
  while the demo endpoint was returning 503. Removed rather than faked.
- The footer listed 2 of the published packages as unlinked plain text. Now
  lists the 4 that are actually on npm, linked. `anchor-sdk` and
  `orbital-indexer` are deliberately absent - they 404 on the registry, and
  linking them would recreate the exact problem this commit fixes.
- The product is called Orbital, not "Orbit Stellar" - including in the
  `<title>`, so the browser tab was wrong too.
- Twitter is dropped: no account exists, and an invented handle is worse
  than an absent row.

`examples/next-starter` was untracked and unfinished - no page, no layout,
no README, and `lib/engine.ts` imported `./config.js`, which does not
resolve under `moduleResolution: "bundler"`, so it could never have built.
Completed and verified with a real `next build`.

* fix(web): replace the fabricated AI assistant and cap two open endpoints

The docs sidebar shipped an "AI Assistant" with no model behind it. It
greeted every visitor with "Ask me anything about the SDK, webhooks, or
real-time events", waited a hardcoded 1200ms to look like it was thinking,
then returned a canned template string with the question interpolated into
it. No "coming soon" label, mounted unconditionally, so it was live on every
/docs page - a developer evaluating the SDK asked a real question and got a
confident non-answer.

Rewritten as what it can honestly be: a docs search panel over the existing
/api/docs/search endpoint, using the same debounced fetch as SearchDialog.
Every line it shows is now a real section with a real link, and when nothing
matches it says so instead of inventing prose. Button relabelled AI ->
Search.

Two unmetered amplifiers on the same surface:

- /api/docs/search re-read, re-parsed and re-stripped every markdown file in
  the corpus on every request, uncached, with no rate limit, on a route the
  UI calls on a 200ms debounce. The content is build-time static, so it is
  now parsed once per process. Query length is capped at 128 chars.
- /api/webhook-sample read an unbounded JSON body and HMAC-ed over an
  unbounded caller-supplied secret. Body now capped at 4KB (413 past that),
  secret at 256 chars, address at 56.

Also: clientIp() silently collapses every caller into a single "unknown"
bucket when neither x-vercel-forwarded-for nor TRUSTED_PROXY_HOPS is
available. Failing closed is right, but it turns perIpStreams: 1 into a
global limit - one SSE slot for the whole internet on a non-Vercel deploy.
Now warns once per process naming the fix.

* fix(pulse-core): stop dropping unified cursor writes, and de-flake two suites

`onCursor` fired `void this.persistUnifiedCursor(...)`, discarding the
promise. Nothing tracked it, so `stop()` could not wait for it and two writes
were never ordered against each other. Two consequences: a shutdown could
lose the newest cursor, and on a store whose writes complete out of order
(Postgres, Redis, the filesystem under load) the OLDER cursor could be the
one that survived. Either way the next start replays events that were
already delivered - which matters for a pipeline the anchor starter sells as
"audit-grade, replay-safe".

Writes are now chained, and `stop()` awaits the tail. The chain is null until
the first write is queued, deliberately: making `stop()` await
unconditionally deferred the teardown after it by a microtask and broke three
callers that read engine state immediately after stopping.

That also removes the race behind
EventEngine.unifiedCursorResume.test.ts, which slept 20ms after `stop()` and
hoped. It failed 2 of 3 local runs; now 3 of 3.

The two DeadLetterStore flakes had a different cause: unlike its sibling
pulse-webhooks.test.ts, that file never mocked `dns/promises`, so every
delivery attempt did a real DNS lookup of example.com - on real time, inside
`vi.useFakeTimers()`, where `vi.waitFor` could not wait for it. Mocked, as
the sibling already does.

examples/next-starter declared a `test` script with no tests, failing
`pnpm -r test`. Covered the config validation instead, which is the part
worth testing. Widened `loadConfig` to take the env shape it actually reads.

abi-registry's CLI-only config loader is annotated so bundlers stop trying to
trace a runtime path. This does NOT clear the "whole project was traced"
warning in apps/web - that needs the module moved behind its own subpath
export and dropped from index.ts, which is a public-API change, so the
comment says so rather than implying it is fixed.

---------

Co-authored-by: Salmatcre8 <118213044+Salmatcre8@users.noreply.github.com>

Author: determined-001

apps/web/app/api/docs/search/route.ts

@@ -44,16 +44,29 @@ function getSnippet(content: string, query: string, length = 160): string {
   return snippet
 }
 
-export async function GET(request: NextRequest) {
-  const query = request.nextUrl.searchParams.get('q')?.trim() ?? ''
+type IndexedDoc = {
+  title: string
+  href: string
+  section: string
+  plainContent: string
+  lowerTitle: string
+  lowerContent: string
+}
 
-  if (query.length < 2) {
-    return NextResponse.json([] as SearchResult[])
-  }
+/**
+ * The docs corpus, parsed once per process.
+ *
+ * Every request used to `existsSync` + `readFileSync` + `gray-matter` + regex
+ * strip every doc file, on a route with no rate limit that the search UI calls
+ * on a 200ms debounce. The content is build-time static - it cannot change
+ * while the server is running - so there is no reason to redo any of it.
+ */
+let corpus: IndexedDoc[] | null = null
 
-  const lowerQuery = query.toLowerCase()
-  const results: (SearchResult & { score: number })[] = []
+function getCorpus(): IndexedDoc[] {
+  if (corpus) return corpus
 
+  const docs: IndexedDoc[] = []
   for (const section of docSections) {
     for (const item of section.items) {
       const slug = item.href.replace('/docs/', '').split('/')
@@ -63,26 +76,59 @@ export async function GET(request: NextRequest) {
       const raw = fs.readFileSync(filePath, 'utf-8')
       const { data: fm, content } = matter(raw)
       const title = (fm.title as string) || item.title
-
-      const titleMatch = title.toLowerCase().includes(lowerQuery)
       const plainContent = stripMarkdown(content)
-      const contentMatch = plainContent.toLowerCase().includes(lowerQuery)
-
-      if (!titleMatch && !contentMatch) continue
 
-      const snippet = contentMatch ? getSnippet(plainContent, query) : plainContent.slice(0, 140).trim() + '…'
-
-      results.push({
+      docs.push({
         title,
         href: item.href,
         section: section.title,
-        snippet,
-        matchInTitle: titleMatch,
-        score: titleMatch ? 10 : 1,
+        plainContent,
+        lowerTitle: title.toLowerCase(),
+        lowerContent: plainContent.toLowerCase(),
       })
     }
   }
 
+  corpus = docs
+  return corpus
+}
+
+/**
+ * Longest query we will scan the corpus for. Past this a query cannot match
+ * anything meaningful, and the length is attacker-controlled.
+ */
+const MAX_QUERY_LENGTH = 128
+
+export async function GET(request: NextRequest) {
+  const query = request.nextUrl.searchParams.get('q')?.trim().slice(0, MAX_QUERY_LENGTH) ?? ''
+
+  if (query.length < 2) {
+    return NextResponse.json([] as SearchResult[])
+  }
+
+  const lowerQuery = query.toLowerCase()
+  const results: (SearchResult & { score: number })[] = []
+
+  for (const doc of getCorpus()) {
+    const titleMatch = doc.lowerTitle.includes(lowerQuery)
+    const contentMatch = doc.lowerContent.includes(lowerQuery)
+
+    if (!titleMatch && !contentMatch) continue
+
+    const snippet = contentMatch
+      ? getSnippet(doc.plainContent, query)
+      : doc.plainContent.slice(0, 140).trim() + '…'
+
+    results.push({
+      title: doc.title,
+      href: doc.href,
+      section: doc.section,
+      snippet,
+      matchInTitle: titleMatch,
+      score: titleMatch ? 10 : 1,
+    })
+  }
+
   results.sort((a, b) => b.score - a.score)
 
   return NextResponse.json(

apps/web/app/api/webhook-sample/route.ts

@@ -37,18 +37,39 @@ export async function POST(req: Request) {
     });
   }
 
+  // Nothing this endpoint accepts is large. Reading an unbounded body - and
+  // then HMAC-ing over an unbounded caller-supplied secret - is free CPU for
+  // anyone who asks, on a route that exists only to show what a payload looks
+  // like. Both are capped well above any legitimate input.
+  const MAX_BODY_BYTES = 4_096;
+  const MAX_SECRET_LENGTH = 256;
+  const MAX_ADDRESS_LENGTH = 56;
+
   let body: Body = {};
   try {
     if (req.headers.get("content-type")?.includes("application/json")) {
-      body = (await req.json()) as Body;
+      const raw = await req.text();
+      if (Buffer.byteLength(raw, "utf8") > MAX_BODY_BYTES) {
+        return Response.json(
+          {
+            error: "payload_too_large",
+            message: `Request body is capped at ${MAX_BODY_BYTES} bytes.`,
+          },
+          { status: 413 },
+        );
+      }
+      body = raw ? (JSON.parse(raw) as Body) : {};
     }
   } catch {
-    /* allow empty body */
+    /* allow empty or malformed body */
   }
 
-  const secret = body.secret?.trim() || `whsec_demo_${randomBytes(16).toString("hex")}`;
-  const generatedSecret = !body.secret?.trim();
-  const address = body.address?.trim() || "GABCDEFGHIJKLMNOPQRSTUVWXYZ234567ABCDEFGHIJKLMNOPQRSTUV";
+  const callerSecret = body.secret?.trim().slice(0, MAX_SECRET_LENGTH);
+  const secret = callerSecret || `whsec_demo_${randomBytes(16).toString("hex")}`;
+  const generatedSecret = !callerSecret;
+  const address =
+    body.address?.trim().slice(0, MAX_ADDRESS_LENGTH) ||
+    "GABCDEFGHIJKLMNOPQRSTUVWXYZ234567ABCDEFGHIJKLMNOPQRSTUV";
 
   const event = generateSamplePayment(address);
   const payload = JSON.stringify(event);

apps/web/app/layout.tsx

@@ -13,7 +13,7 @@ const instrumentSerif = Instrument_Serif({
 });
 
 export const metadata: Metadata = {
-  title: "Orbit Stellar - Real-time event infrastructure for Stellar developers",
+  title: "Orbital - Real-time event infrastructure for Stellar developers",
   description:
     "Watch any Stellar address. Register webhooks. React hooks for on-chain events. The missing event layer for Stellar developers.",
 };

apps/web/components/Footer.tsx

@@ -2,6 +2,14 @@
 
 import Link from 'next/link'
 
+import {
+  FOOTER_COMMUNITY_LINKS,
+  FOOTER_PRODUCT_LINKS,
+  NPM_PACKAGES,
+  npmUrl,
+  type NavLink,
+} from '@/lib/links'
+
 const labelStyle: React.CSSProperties = {
   fontFamily: 'var(--font-sans)',
   fontSize: '11px',
@@ -22,6 +30,20 @@ const linkStyle: React.CSSProperties = {
   transition: 'color 0.15s',
 }
 
+function FooterLink({ label, href, external }: NavLink) {
+  return (
+    <Link
+      href={href}
+      {...(external ? { target: '_blank', rel: 'noopener noreferrer' } : {})}
+      style={linkStyle}
+      onMouseEnter={(e) => (e.currentTarget.style.color = '#fff')}
+      onMouseLeave={(e) => (e.currentTarget.style.color = 'var(--muted2)')}
+    >
+      {label}
+    </Link>
+  )
+}
+
 export default function Footer() {
   return (
     <footer style={{ borderTop: '1px solid var(--border)', padding: '80px 52px 0' }}>
@@ -46,7 +68,7 @@ export default function Footer() {
                 marginBottom: '12px',
               }}
             >
-              Orbit Stellar
+              Orbital
             </p>
             <p
               style={{
@@ -69,72 +91,59 @@ export default function Footer() {
             >
               MIT License
             </p>
-            <p
-              style={{
-                fontFamily: 'var(--font-sans)',
-                fontSize: '12px',
-                color: 'var(--muted2)',
-                display: 'flex',
-                alignItems: 'center',
-                gap: '6px',
-              }}
-            >
-              <span style={{ color: 'var(--accent)' }}>●</span>
-              All systems operational
-            </p>
+            {/*
+              A hardcoded "● All systems operational" badge used to sit here,
+              next to a "Status" link that went nowhere. There is no uptime
+              monitor behind it, so it was green even while the demo endpoint
+              was returning 503. Removed rather than faked - put it back only
+              alongside a real status source.
+            */}
           </div>
 
           {/* Product */}
           <div>
             <span style={labelStyle}>Product</span>
-            {['Docs', 'SDKs', 'How it works', 'Changelog', 'Status'].map((item) => (
-              <Link
-                key={item}
-                href="#"
-                style={linkStyle}
-                onMouseEnter={(e) => (e.currentTarget.style.color = '#fff')}
-                onMouseLeave={(e) => (e.currentTarget.style.color = 'var(--muted2)')}
-              >
-                {item}
-              </Link>
+            {FOOTER_PRODUCT_LINKS.map((link) => (
+              <FooterLink key={link.label} {...link} />
             ))}
           </div>
 
           {/* Packages */}
           <div>
             <span style={labelStyle}>Packages</span>
-            {[
-              'npm i @orbital-stellar/pulse-webhooks',
-              'npm i @orbital-stellar/pulse-notify',
-            ].map((cmd) => (
-              <p
-                key={cmd}
+            {/*
+              All six published packages, each linked to its npm page. This
+              listed only two of them as unlinked plain text, which understated
+              what is actually shipped and gave the reader nowhere to go.
+            */}
+            {NPM_PACKAGES.map((pkg) => (
+              <Link
+                key={pkg}
+                href={npmUrl(pkg)}
+                target="_blank"
+                rel="noopener noreferrer"
                 style={{
                   fontFamily: 'var(--font-mono)',
                   fontSize: '13px',
                   color: 'var(--muted2)',
+                  textDecoration: 'none',
                   display: 'block',
                   marginTop: '12px',
+                  transition: 'color 0.15s',
                 }}
+                onMouseEnter={(e) => (e.currentTarget.style.color = '#fff')}
+                onMouseLeave={(e) => (e.currentTarget.style.color = 'var(--muted2)')}
               >
-                {cmd}
-              </p>
+                @orbital-stellar/{pkg}
+              </Link>
             ))}
           </div>
 
           {/* Community */}
           <div>
             <span style={labelStyle}>Community</span>
-            {['GitHub', 'Twitter', 'SCF Grant', 'Open an issue'].map((item) => (
-              <Link
-                key={item}
-                href="#"
-                style={linkStyle}
-                onMouseEnter={(e) => (e.currentTarget.style.color = '#fff')}
-                onMouseLeave={(e) => (e.currentTarget.style.color = 'var(--muted2)')}
-              >
-                {item}
-              </Link>
+            {FOOTER_COMMUNITY_LINKS.map((link) => (
+              <FooterLink key={link.label} {...link} />
             ))}
           </div>
         </div>
@@ -157,7 +166,7 @@ export default function Footer() {
               color: 'var(--muted)',
             }}
           >
-            © 2026 Orbit Stellar
+            © 2026 Orbital
           </span>
           <span
             style={{

apps/web/components/Hero.tsx

@@ -3,6 +3,8 @@
 import Link from "next/link";
 import { motion } from "framer-motion";
 
+import { GITHUB_REPO } from "@/lib/links";
+
 const ease = [0.22, 1, 0.36, 1] as const;
 
 const fadeUp = (delay: number) => ({
@@ -85,7 +87,7 @@ export default function Hero() {
         style={{ display: "flex", gap: "12px", flexWrap: "wrap", justifyContent: "center" }}
       >
         <Link
-          href="#"
+          href="/docs"
           style={{
             background: "var(--accent)",
             color: "#000",
@@ -100,7 +102,9 @@ export default function Hero() {
           Read the docs
         </Link>
         <Link
-          href="#"
+          href={GITHUB_REPO}
+          target="_blank"
+          rel="noopener noreferrer"
           style={{
             background: "transparent",
             color: "#fff",

apps/web/components/HowItWorks.tsx

@@ -11,7 +11,7 @@ const STEPS = [
   },
   {
     num: "03",
-    title: "Orbit Stellar",
+    title: "Orbital",
     description: "Filters by address, normalizes the payload, and routes to subscribers.",
   },
   {
@@ -23,7 +23,7 @@ const STEPS = [
 
 export default function HowItWorks() {
   return (
-    <section style={{ padding: "120px 32px" }}>
+    <section id="how-it-works" style={{ padding: "120px 32px" }}>
       <div style={{ maxWidth: "var(--max-width)", margin: "0 auto" }}>
         <h2
           style={{