@lukoweb/apitogo 0.1.92 → 0.1.94

package/dist/cli/cli.js

@@ -301,23 +301,15 @@ function firstApiInput(config2) {
   }
   return void 0;
 }
-function mergeAuthenticationGateway(config2) {
+function normalizeGatewayPlacement(config2) {
   const authentication = asRecord2(config2.authentication);
   if (!authentication) {
-    return void 0;
+    return;
   }
-  const authGateway = asRecord2(authentication.gateway);
-  const rootGateway = asRecord2(config2.gateway);
-  if (!authGateway && !rootGateway) {
-    return authentication;
+  if ("gateway" in authentication) {
+    delete authentication.gateway;
+    config2.authentication = authentication;
   }
-  return {
-    ...authentication,
-    gateway: {
-      ...rootGateway,
-      ...authGateway
-    }
-  };
 }
 function ensureModules(config2) {
   const modules = asRecord2(config2.modules) ?? {};
@@ -378,11 +370,10 @@ function normalizeApitogoConfig(config2) {
     };
   }
   normalized.site = site;
-  const authentication = mergeAuthenticationGateway(normalized);
+  const authentication = asRecord2(normalized.authentication);
   if (authentication) {
-    normalized.authentication = authentication;
+    normalizeGatewayPlacement(normalized);
   }
-  delete normalized.gateway;
   const modules = ensureModules(normalized);
   const legacyDocs = asRecord2(normalized.docs);
   const moduleDocs = asRecord2(modules.docs) ?? {};
@@ -533,13 +524,16 @@ function deriveManifestFields(config2) {
       continue;
     }
     if (key === "authentication") {
-      const authentication2 = asRecord2(normalized.authentication);
-      if (authentication2) {
-        manifest.authentication = stripAuthenticationSecrets2(authentication2);
+      const authentication = asRecord2(normalized.authentication);
+      if (authentication) {
+        manifest.authentication = stripAuthenticationSecrets2(authentication);
       }
       continue;
     }
     if (key === "gateway") {
+      if (normalized.gateway !== void 0) {
+        manifest.gateway = normalized.gateway;
+      }
       continue;
     }
     if (key === "pricing") {
@@ -570,10 +564,6 @@ function deriveManifestFields(config2) {
       manifest[key] = normalized[key];
     }
   }
-  const authentication = asRecord2(normalized.authentication);
-  if (authentication?.gateway) {
-    manifest.gateway = authentication.gateway;
-  }
   return manifest;
 }
 function extractManifest(config2) {
@@ -1158,7 +1148,11 @@ var init_local_manifest = __esm({
         oidcAllowedIssuers: z4.array(z4.string()).optional(),
         oidcAudiences: z4.array(z4.string()).optional(),
         limitsJson: z4.string().optional(),
-        publicHealthActionKey: z4.string().optional()
+        publicHealthActionKey: z4.string().optional(),
+        publicRoutes: z4.array(z4.string()).optional(),
+        cors: z4.object({
+          allowedOrigins: z4.array(z4.string()).optional()
+        }).optional()
       }).optional(),
       projectId: z4.string().optional(),
       landing: z4.object({
@@ -6034,6 +6028,7 @@ function manifestFilePath(siteDirectory) {
 var STORED_MANIFEST_KEYS = [
   "authentication",
   "backend",
+  "gateway",
   "projectId"
 ];
 function readPlanItemsFromConfig(config2) {
@@ -6189,12 +6184,6 @@ function extractManifestFromConfig(config2) {
   if (readPricingEnabledFromConfig(config2)) {
     manifest.pricing = { enabled: true };
   }
-  const authConfig = config2.authentication;
-  if (authConfig?.gateway) {
-    manifest.gateway = authConfig.gateway;
-  } else if (config2.gateway) {
-    manifest.gateway = config2.gateway;
-  }
   const landing = readLandingFromConfig(config2);
   if (landing) {
     manifest.landing = landing;
@@ -6234,15 +6223,14 @@ function applyManifestToConfig(config2, manifest) {
   }
   delete next.plans;
   delete next.pricing;
-  if (manifest.gateway) {
-    const authentication = next.authentication ?? {};
-    authentication.gateway = manifest.gateway;
+  if (next.authentication && typeof next.authentication === "object") {
+    const authentication = { ...next.authentication };
+    delete authentication.gateway;
     next.authentication = authentication;
   }
   delete next.siteName;
   delete next.branding;
   delete next.projectName;
-  delete next.gateway;
   return next;
 }
 async function readLegacyManifest(_siteDirectory) {
@@ -9407,7 +9395,8 @@ var PLATFORM_PLAN_CATALOG = [
       "Paid end-user gateway plans (Stripe checkout for API subscribers)",
       "1 custom domain on the dev portal",
       "100k requests included; up to 1M requests / month",
-      "Stripe subscription billing with promotion codes at checkout"
+      "Stripe subscription billing with promotion codes at checkout",
+      "Standard support"
     ],
     limitations: [
       "Requires Stripe checkout to activate",
@@ -9427,7 +9416,8 @@ var PLATFORM_PLAN_CATALOG = [
       "3 custom domains",
       "1M requests included; up to 10M requests / month",
       "Advanced analytics and CDN for your API",
-      "Extended monitoring history and alerts"
+      "Extended monitoring history and alerts",
+      "Enterprise support"
     ],
     limitations: [
       "Requires Stripe checkout to activate",
@@ -9446,8 +9436,8 @@ function buildPlatformPlanSelectionAgentInstruction(quota) {
   const lines = [
     "Before calling ensure_platform_plan, explain the platform hosting tiers to the user using platformPlanCatalog from the bootstrap response or list_platform_plans.",
     "Free: $0/month, dev portal + API hub, no custom domain, free ($0) gateway/API plans only.",
-    "Starter: $99/month via Stripe, custom domain, paid gateway plans, production hosting.",
-    "Professional: $999/month via Stripe, higher limits, multiple domains, advanced analytics.",
+    "Starter: $99/month via Stripe, custom domain, paid gateway plans, production hosting, standard support.",
+    "Professional: $999/month via Stripe, higher limits, multiple domains, advanced analytics, enterprise support.",
     "This is separate from gateway/API plans (what end users pay for API access) configured in apitogo.config.json.",
     "If apitogo.config.json already has paid gateway plans (priceAmount > 0), warn before they pick Free: Free cannot publish paid API plans \u2014 they must choose Starter/Professional, or remove/zero those paid plans first. Never silently strip paid plans."
   ];
@@ -12545,7 +12535,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.1.92",
+  version: "0.1.94",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -18516,12 +18506,13 @@ function buildCreateApitogoCliArgs(invocationArgs, projectName, options) {
   const cliArgs = [
     ...invocationArgs,
     projectName,
-    "--yes",
+    "--typescript",
+    "--eslint",
     "--skip-install",
     "--use-npm"
   ];
   if (options?.withExamples) {
-    cliArgs.push("--with-examples");
+    cliArgs.push("--include-examples");
   }
   return cliArgs;
 }

package/dist/declarations/cli/platform/helpers/dev-portal-manifest.d.ts

@@ -58,6 +58,9 @@ export interface DevPortalLocalManifest {
         limitsJson?: string;
         publicHealthActionKey?: string;
         publicRoutes?: string[];
+        cors?: {
+            allowedOrigins?: string[];
+        };
     };
     projectId?: string;
     landing?: LandingManifestInput;

package/dist/declarations/config/local-manifest.d.ts

@@ -89,6 +89,10 @@ export declare const DevPortalLocalManifestSchema: z.ZodObject<{
         oidcAudiences: z.ZodOptional<z.ZodArray<z.ZodString>>;
         limitsJson: z.ZodOptional<z.ZodString>;
         publicHealthActionKey: z.ZodOptional<z.ZodString>;
+        publicRoutes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        cors: z.ZodOptional<z.ZodObject<{
+            allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     projectId: z.ZodOptional<z.ZodString>;
     landing: z.ZodOptional<z.ZodObject<{

package/docs/cli/commands.md

@@ -29,7 +29,8 @@ same commands so agents and humans get identical behavior.
 | `init [dir]` | Named folder; `--install` (default), `--overwrite`, `--json`, `--openapi-search` |
 | `config` | Interactive on TTY; flags: `--openapi`, `--page-*`, `--plan`, `--backend`, `--theme`, `--patch`, `--json` |
 
-`npm create @lukoweb/apitogo@latest` remains an interactive alternative for new folders.
+`npx @lukoweb/create-apitogo@latest` remains an interactive alternative for new folders.
+Pass `--typescript --eslint` to skip those prompts. See [Install the CLI](./setup.md#scaffold-options).
 
 See [Make config (CLI)](../configuration/make-config.mdx) for all `config` flags.
 

package/docs/cli/overview.md

@@ -13,7 +13,7 @@ local files, preview with `apitogo dev`, and publish to APItoGo hosting with `ap
 
 ## What you get
 
-- Scaffold a local portal site (`npm create @lukoweb/apitogo@latest` or `apitogo init`)
+- Scaffold a local portal site (`npx @lukoweb/create-apitogo@latest` or `apitogo init`)
 - Shape backend, OpenAPI, plans, and docs pages via `apitogo config` and file edits
 - Preview locally (`apitogo dev`)
 - Publish to APItoGo hosting (`apitogo apply`) with platform plans **Free**, **Starter**, or

package/docs/cli/setup.md

@@ -23,10 +23,10 @@ need a global install — scaffold commands add it to your project and `npm inst
 
 ### New project (recommended)
 
-`npm create` scaffolds the site **and** installs `@lukoweb/apitogo` locally:
+`npx @lukoweb/create-apitogo` scaffolds the site **and** installs `@lukoweb/apitogo` locally:
 
 ```bash
-npm create @lukoweb/apitogo@latest
+npx @lukoweb/create-apitogo@latest
 cd your-project-name
 npx apitogo config       # interactive: backend, OpenAPI, pages, plans
 npm run dev
@@ -35,14 +35,28 @@ npm run dev
 Also works with `pnpm create @lukoweb/apitogo`, `yarn create @lukoweb/apitogo`, or
 `bunx @lukoweb/create-apitogo`.
 
-Non-interactive example:
+Non-interactive:
 
 ```bash
-npm create @lukoweb/apitogo@latest my-portal -- --yes --typescript
+npx @lukoweb/create-apitogo@latest my-portal --typescript --eslint
 cd my-portal
 npx apitogo config
 ```
 
+#### Scaffold options
+
+| Flag | Effect |
+| ---- | ------ |
+| `--typescript` / `--ts` | TypeScript project |
+| `--javascript` / `--js` | JavaScript project |
+| `--eslint` | Add ESLint config |
+| `--no-eslint` | Skip ESLint |
+| `--include-examples` | Add starter docs and a sample OpenAPI spec (off unless passed) |
+
+Omit flags to be prompted for TypeScript and ESLint. Example files are never prompted.
+
+See `@lukoweb/create-apitogo --help` for package manager and install flags.
+
 ### Scaffold into an existing folder
 
 `apitogo init` writes `package.json` with `@lukoweb/apitogo` as a dependency. Run **`npm install`**
@@ -63,7 +77,7 @@ to preview, then `apitogo apply` when ready to go live.
 
 | Situation | Command |
 | --------- | ------- |
-| After `npm create` or `npm install` in the project | `npx apitogo <command>` (e.g. `npx apitogo config`) |
+| After `npx @lukoweb/create-apitogo` or `npm install` in the project | `npx apitogo <command>` (e.g. `npx apitogo config`) |
 | Same, if `node_modules/.bin` is on your PATH | `apitogo <command>` |
 | One-off, no project yet | `npx @lukoweb/apitogo <command>` |
 | Optional global install | `npm install -g @lukoweb/apitogo` then `apitogo <command>` anywhere |

package/docs/cli/shape.md

@@ -13,10 +13,10 @@ Requires the **`apitogo`** CLI (`@lukoweb/apitogo`). If you have not installed i
 
 ## Happy path
 
-`npm create` installs `@lukoweb/apitogo` into the new project. Then run config via `npx`:
+`npx @lukoweb/create-apitogo` installs `@lukoweb/apitogo` into the new project. Then run config via `npx`:
 
 ```bash
-npm create @lukoweb/apitogo@latest my-portal -- --yes
+npx @lukoweb/create-apitogo@latest my-portal --typescript --eslint
 cd my-portal
 npx apitogo config         # backend, OpenAPI, pages, plans (apply each immediately)
 npm run dev                # http://localhost:3000

package/docs/configuration/make-config.mdx

@@ -20,7 +20,7 @@ on new scaffolds. The command does **not** change `redirects`.
 
 Install the CLI first — see [Install the CLI](../cli/setup.md). In short:
 
-- **New site:** `npm create @lukoweb/apitogo@latest` (installs `@lukoweb/apitogo` into the project)
+- **New site:** `npx @lukoweb/create-apitogo@latest` (installs `@lukoweb/apitogo` into the project)
 - **Existing folder:** `npx @lukoweb/apitogo init .` then `npm install`
 
 Run config from the project root with `npx apitogo config` (or `apitogo config` if

package/docs/configuration/manifest.md

@@ -25,10 +25,17 @@ metadata, with optional `.env` overrides for secrets and local tweaks.
   "authentication": {
     "enabled": true,
     "type": "dev-portal",
-    "apiBaseUrl": "https://your-dev-portal-api.example.com",
-    "gateway": {
-      "authMode": "bringYourOwnOidc",
-      "oidcMetadataUrl": "https://login.example.com/.well-known/openid-configuration"
+    "apiBaseUrl": "https://your-dev-portal-api.example.com"
+  },
+  "gateway": {
+    "authMode": "bringYourOwnOidc",
+    "oidcMetadataUrl": "https://login.example.com/.well-known/openid-configuration",
+    "publicRoutes": ["/health"],
+    "cors": {
+      "allowedOrigins": [
+        "https://myapp.example.com",
+        "http://localhost:5173"
+      ]
     }
   },
   "modules": {
@@ -60,6 +67,36 @@ metadata, with optional `.env` overrides for secrets and local tweaks.
   `modules.userPanel.plans.items`. Add plans with `apitogo config` or edit the manifest by hand.
   See [Gateway plans](./plans.md). Legacy root `plans` is migrated on load.
 - **Docs / API keys:** configure under `modules.docs` and `modules.userPanel.apiKeys` only.
+- **Gateway:** top-level `gateway` (not under `authentication`). See [Gateway CORS](#gateway-cors)
+  and [Gateway plans](./plans.md).
+
+## Gateway CORS
+
+Browser calls from your developer portal (and any other SPA) to the API gateway are cross-origin.
+APItoGo always allows the portal site origin. Add extra origins under `gateway.cors.allowedOrigins`
+when tenant apps or local frontends call the gateway:
+
+```json
+{
+  "gateway": {
+    "cors": {
+      "allowedOrigins": [
+        "https://myapp.example.com",
+        "http://localhost:5173"
+      ]
+    }
+  }
+}
+```
+
+| Rule | Detail |
+| ---- | ------ |
+| Portal origin | Always allowed by the platform (`https://{your-portal-host}`). Do not list it here. |
+| Extra origins | Absolute `http://` or `https://` origins only — no path, query, or fragment. |
+| Wildcard | `"*"` is allowed (replaces the list; credentials stay off). |
+| Empty / omitted | Portal playground still works; only extras are missing. |
+
+Apply with `apitogo apply` / `publish_dev_portal` so APIM policies pick up the change.
 
 ## Environment variables
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lukoweb/apitogo",
-  "version": "0.1.92",
+  "version": "0.1.94",
   "type": "module",
   "sideEffects": [
     "**/*.css",

package/src/config/apitogo-config-core.ts

@@ -297,28 +297,17 @@ function firstApiInput(config: ApitogoJsonConfig): string | undefined {
   return undefined;
 }
 
-function mergeAuthenticationGateway(
-  config: ApitogoJsonConfig,
-): Record<string, unknown> | undefined {
+/** Keep gateway at config root; strip any nested authentication.gateway. */
+function normalizeGatewayPlacement(config: ApitogoJsonConfig): void {
   const authentication = asRecord(config.authentication);
   if (!authentication) {
-    return undefined;
+    return;
   }
 
-  const authGateway = asRecord(authentication.gateway);
-  const rootGateway = asRecord(config.gateway);
-
-  if (!authGateway && !rootGateway) {
-    return authentication;
+  if ("gateway" in authentication) {
+    delete authentication.gateway;
+    config.authentication = authentication;
   }
-
-  return {
-    ...authentication,
-    gateway: {
-      ...rootGateway,
-      ...authGateway,
-    },
-  };
 }
 
 function ensureModules(config: ApitogoJsonConfig): Record<string, unknown> {
@@ -403,11 +392,10 @@ export function normalizeApitogoConfig(
   }
   normalized.site = site;
 
-  const authentication = mergeAuthenticationGateway(normalized);
+  const authentication = asRecord(normalized.authentication);
   if (authentication) {
-    normalized.authentication = authentication;
+    normalizeGatewayPlacement(normalized);
   }
-  delete normalized.gateway;
 
   const modules = ensureModules(normalized);
   const legacyDocs = asRecord(normalized.docs);
@@ -654,6 +642,9 @@ export function deriveManifestFields(
       continue;
     }
     if (key === "gateway") {
+      if (normalized.gateway !== undefined) {
+        manifest.gateway = normalized.gateway;
+      }
       continue;
     }
     if (key === "pricing") {
@@ -686,11 +677,6 @@ export function deriveManifestFields(
     }
   }
 
-  const authentication = asRecord(normalized.authentication);
-  if (authentication?.gateway) {
-    manifest.gateway = authentication.gateway;
-  }
-
   return manifest;
 }
 

package/src/config/local-manifest.ts

@@ -140,6 +140,12 @@ export const DevPortalLocalManifestSchema = z.object({
       oidcAudiences: z.array(z.string()).optional(),
       limitsJson: z.string().optional(),
       publicHealthActionKey: z.string().optional(),
+      publicRoutes: z.array(z.string()).optional(),
+      cors: z
+        .object({
+          allowedOrigins: z.array(z.string()).optional(),
+        })
+        .optional(),
     })
     .optional(),
   projectId: z.string().optional(),