@lukoweb/apitogo 0.2.65 → 0.2.71

package/dist/cli/cli.js

@@ -7661,6 +7661,13 @@ function secretRules(config2, resolved, context, out, skipped, paid) {
         message: `a plan has a price, and the Stripe key (secret ${ref.name}) is not set yet.`,
         hint: `apitogo deploy asks for it. Or run: apitogo secrets set ${ref.name}`
       });
+    } else if (ref.path === "plans.billing.webhookSecret" && !context.knownSecrets.has(ref.name)) {
+      out.warn({
+        code: "SECRET_NOT_SET",
+        path: ref.path,
+        message: `the Stripe webhook secret (${ref.name}) is not set yet, so payments do not activate plans until it is.`,
+        hint: `Deploy first: it prints the webhook address. Add it in Stripe, then run "apitogo secrets set ${ref.name}" with its signing secret and deploy again.`
+      });
     } else if (!context.knownSecrets.has(ref.name)) {
       out.error({
         code: "SECRET_NOT_SET",
@@ -7816,6 +7823,19 @@ function requiredServices(resolved) {
   if (resolved.plans?.enabled === true && consoleOn) needs.push("plans");
   return needs;
 }
+function onlyConfiguredServices(manifest, resolved) {
+  const configured = {
+    identity: resolved.identity?.enabled === true,
+    gateway: resolved.gateway?.enabled === true,
+    plans: resolved.plans?.enabled === true
+  };
+  const services = Object.fromEntries(
+    Object.entries(manifest.services).filter(
+      ([name]) => !(name in configured) || configured[name]
+    )
+  );
+  return Object.keys(services).length === Object.keys(manifest.services).length ? manifest : { ...manifest, services };
+}
 function missingManifestServices(resolved, manifest) {
   return requiredServices(resolved).filter((name) => manifest?.services[name] === void 0).map(
     (name) => issue(
@@ -8739,7 +8759,7 @@ async function preparePortal(resolved, manifest, mode, options = {}) {
     ]);
   }
   if (manifest) {
-    effective = manifest;
+    effective = onlyConfiguredServices(manifest, resolved);
     manifestSource = "file";
     if (mode === "production") {
       issues.push(...missingManifestServices(resolved, manifest));
@@ -11433,7 +11453,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.2.65",
+  version: "0.2.71",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -27011,7 +27031,25 @@ async function apply(argv) {
 
 // src/cli/deploy/command.ts
 import path85 from "node:path";
+
+// src/cli/common/failure-output.ts
 init_invariant();
+function errorCode(error) {
+  if (!(error instanceof Error) || !("code" in error)) return void 0;
+  return typeof error.code === "string" && /^[A-Z][A-Z0-9_]*$/.test(error.code) ? error.code : void 0;
+}
+function failureJson(error) {
+  return {
+    status: "failed",
+    error: error instanceof Error ? error.message : String(error),
+    code: errorCode(error) ?? null,
+    hint: (error instanceof ApitogoError ? error.developerHint : void 0) ?? null
+  };
+}
+function failureText(error) {
+  const { error: message, code, hint } = failureJson(error);
+  return [message, code ? `[${code}]` : void 0, hint ?? void 0].filter(Boolean).join(" ");
+}
 
 // src/cli/project/create-handler.ts
 import path80 from "node:path";
@@ -27172,6 +27210,8 @@ async function settlePaidPlan(projectId, plan2, options, deps) {
       "Moving a project to another plan is not supported yet. Create a new project with --plan in a new folder, or change the plan in the web app."
     );
   }
+  const timeoutMs = options.paymentTimeoutMs ?? 9e5;
+  let checkoutUrl;
   if (!onThisPlan) {
     let session;
     try {
@@ -27195,14 +27235,17 @@ async function settlePaidPlan(projectId, plan2, options, deps) {
         "The platform gave no checkout link.",
         "Run the command again, or choose the plan in the web app."
       );
+    checkoutUrl = session.url;
     api.say?.(`Pay for the ${label(plan2)} plan here: ${session.url}`);
     if (options.waitForPayment === false)
       return { status: "awaiting_checkout", url: session.url };
+    api.say?.(
+      `Waiting for the payment, up to ${Math.round(timeoutMs / 6e4)} minutes. The project's hosting is set up once it is paid; until then \`apitogo status\` shows it as not ready.`
+    );
     if (options.open !== false)
       await api.openUrl?.(session.url).catch(() => {
       });
   }
-  const timeoutMs = options.paymentTimeoutMs ?? 9e5;
   const deadline = now() + timeoutMs;
   for (; ; ) {
     const current = await api.getSubscription(projectId);
@@ -27211,8 +27254,9 @@ async function settlePaidPlan(projectId, plan2, options, deps) {
     if (now() >= deadline)
       throw new ProjectCreateError(
         "CHECKOUT_PENDING",
-        `The payment for the ${label(plan2)} plan is not confirmed yet.`,
-        `Finish paying with the link above, then run \`apitogo project create --plan ${plan2}\` again; it continues the same project (project.id ${projectId}).`
+        // The link again: in piped output the earlier lines may be gone by now (API-94).
+        `The payment for the ${label(plan2)} plan is not confirmed yet.${checkoutUrl ? ` Pay here: ${checkoutUrl}` : ""}`,
+        `Finish paying${checkoutUrl ? "" : " (the link was printed when the checkout started, or pay on the dashboard)"}, then run \`apitogo project create --plan ${plan2}\` again; it continues the same project (project.id ${projectId}).`
       );
     await sleep5(api.pollIntervalMs ?? 3e3);
   }
@@ -27258,9 +27302,10 @@ async function createLinkedProject(argv, dir, options = {}) {
     const progress = createConsoleProgressReporter(process.stderr, {
       verbose: argv.verbose === true
     });
+    const linkedProject = loadConfigV2(dir).resolved.project.id;
     if (!json)
       printDiagnosticsToConsole(
-        `Creating your project: reserving hosting, setting up its addresses, then getting the website ready. This usually takes 1 to 3 minutes.${plan2 && plan2 !== "free" ? " Paying for the plan on the dashboard works too: this command goes on once the payment is in." : ""} Add --verbose to see every step.`
+        `${linkedProject ? `Continuing project ${linkedProject}` : "Creating your project"}: reserving hosting, setting up its addresses, then getting the website ready. This usually takes 1 to 3 minutes.${plan2 && plan2 !== "free" ? " Paying for the plan on the dashboard works too: this command goes on once the payment is in." : ""} Add --verbose to see every step.`
       );
     const result = await createProjectV2(
       {
@@ -27695,6 +27740,51 @@ async function readyCustomDomainOrigin(client, projectId) {
   return `https://${hostname}`;
 }
 
+// src/cli/deploy/poll-read.ts
+init_invariant();
+var PlatformUnreachableError = class extends ApitogoError {
+  code = "PLATFORM_UNREACHABLE";
+  constructor(what, attempts, cause) {
+    const reason = cause instanceof Error ? cause.message : String(cause);
+    super(
+      `Lost contact with the platform while waiting for ${what}: ${attempts} status calls in a row failed (last: ${reason}).`,
+      {
+        title: "Cannot reach the platform",
+        developerHint: "The job may still be running on the platform. Run `apitogo deploy` again to keep waiting; finished steps are not done again.",
+        cause: cause instanceof Error ? cause : void 0
+      }
+    );
+    this.name = "PlatformUnreachableError";
+  }
+};
+function isTransientPlatformError(error) {
+  if (error instanceof PlatformApiError) return error.status >= 500;
+  if (!(error instanceof Error)) return false;
+  return error.name === "AbortError" || /fetch failed|econnreset|econnrefused|etimedout|enotfound|socket hang up|network/i.test(
+    `${error.message} ${error.cause instanceof Error ? error.cause.message : ""}`
+  );
+}
+async function pollRead(read, options) {
+  const now = options.now ?? Date.now;
+  const maxAttempts = options.maxAttempts ?? 5;
+  const maxErrorMs = options.maxErrorMs ?? 12e4;
+  const delayMs = options.delayMs ?? ((failures2) => Math.min(15e3, 3e3 * failures2));
+  let failures = 0;
+  let firstFailureAt = 0;
+  for (; ; ) {
+    try {
+      return await read();
+    } catch (error) {
+      if (!isTransientPlatformError(error)) throw error;
+      failures++;
+      if (failures === 1) firstFailureAt = now();
+      if (failures >= maxAttempts || now() - firstFailureAt >= maxErrorMs)
+        throw new PlatformUnreachableError(options.what, failures, error);
+      await options.sleep(delayMs(failures));
+    }
+  }
+}
+
 // src/cli/deploy/gateway.ts
 var GatewayDeployError = class extends ApitogoError {
   constructor(code, message, developerHint) {
@@ -27862,9 +27952,9 @@ async function deployGateway(resolved, projectId, deps, options = {}) {
     await client.activateModule?.(projectId, API_HOSTING_MODULE);
     const deadline = now() + backendTimeoutMs;
     for (; ; ) {
-      const state = await client.getInfrastructureStatus?.(
-        projectId,
-        API_HOSTING_MODULE
+      const state = await pollRead(
+        async () => client.getInfrastructureStatus?.(projectId, API_HOSTING_MODULE),
+        { what: "the API hosting", sleep: sleep5, now }
       );
       if (!state || isTerminalInfrastructureStatus(state.status)) {
         if (state?.status.toLowerCase() === "failed")
@@ -27928,9 +28018,9 @@ async function deployGateway(resolved, projectId, deps, options = {}) {
         if (!started.reused) {
           const deadline = now() + backendTimeoutMs;
           for (; ; ) {
-            const state = await client.getDeploymentStatus(
-              projectId,
-              started.deploymentId
+            const state = await pollRead(
+              () => client.getDeploymentStatus(projectId, started.deploymentId),
+              { what: "your backend deployment", sleep: sleep5, now }
             );
             if (state.status.toLowerCase() === "healthy") break;
             if (isTerminalDeploymentStatus(state.status))
@@ -28023,7 +28113,10 @@ async function deployGateway(resolved, projectId, deps, options = {}) {
         );
       const deadline = now() + timeoutMs;
       for (; ; ) {
-        const state = await client.getGatewayReconciliation(projectId, ticket);
+        const state = await pollRead(
+          () => client.getGatewayReconciliation(projectId, ticket),
+          { what: "the gateway config to be applied", sleep: sleep5, now }
+        );
         if (state.state === "Succeeded") break;
         if (state.state === "Failed" || state.state === "Superseded")
           throw new GatewayDeployError(
@@ -28158,7 +28251,7 @@ function webhookStatusLine(status2, now = Date.now()) {
   const ago = minutes < 1 ? "just now" : minutes < 120 ? `${minutes} min ago` : minutes < 48 * 60 ? `${Math.round(minutes / 60)} h ago` : `${Math.round(minutes / (24 * 60))} days ago`;
   return `Stripe webhook: verified (last event ${ago}${status2.lastEventType ? `, ${status2.lastEventType}` : ""})`;
 }
-async function plansInputs(resolved, projectId) {
+async function plansInputs(resolved, projectId, options = {}) {
   const plans = resolved.plans;
   if (!plans) throw new Error("plans is not in the config.");
   const billing = plans.billing;
@@ -28189,6 +28282,7 @@ async function plansInputs(resolved, projectId) {
       provider: billingOn ? "stripe" : "none",
       apiKey: billingOn ? billing.apiKey : void 0,
       webhookSecret: billingOn ? billing.webhookSecret : void 0,
+      ...billingOn && options.webhookSecretMissing ? { webhookSecretMissing: true } : {},
       successUrl: billingOn ? billing.successUrl : void 0,
       cancelUrl: billingOn ? billing.cancelUrl : void 0
     }),
@@ -28239,6 +28333,18 @@ function billingRefused(error) {
   }
   throw error;
 }
+async function webhookSecretMissing(client, projectId, reference) {
+  const name = /^secret:([A-Za-z_][A-Za-z0-9_]*)$/.exec(
+    reference?.trim() ?? ""
+  )?.[1];
+  if (!name || !client.listSecrets) return false;
+  try {
+    const { secrets: secrets2 } = await client.listSecrets(projectId);
+    return !secrets2.some((secret) => secret.name === name);
+  } catch {
+    return false;
+  }
+}
 async function deployPlans(resolved, projectId, deps, options = {}) {
   const plans = resolved.plans;
   if (!plans) throw new Error("plans is not in the config.");
@@ -28248,6 +28354,11 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
   const intervalMs = deps.pollIntervalMs ?? 2e3;
   const backendTimeoutMs = deps.backendTimeoutMs ?? 9e5;
   const linkTimeoutMs = deps.linkTimeoutMs ?? 6e5;
+  const missingWebhook = await webhookSecretMissing(
+    client,
+    projectId,
+    plans.billing.webhookSecret
+  );
   const {
     wanted,
     manifest,
@@ -28258,7 +28369,9 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
     catalogHash,
     backendHash,
     linkHash
-  } = await plansInputs(resolved, projectId);
+  } = await plansInputs(resolved, projectId, {
+    webhookSecretMissing: missingWebhook
+  });
   const catalogStep = {
     name: "catalog",
     hash: () => catalogHash,
@@ -28369,7 +28482,11 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
         await client.activateModule(projectId, BACKEND_MODULE);
         const deadline = now() + backendTimeoutMs;
         for (; ; ) {
-          fqdn = await backendOf();
+          fqdn = await pollRead(backendOf, {
+            what: "the plans backend",
+            sleep: sleep5,
+            now
+          });
           if (fqdn) break;
           if (now() >= deadline)
             throw new PlansDeployError(
@@ -28387,9 +28504,11 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
   const waitForBackendUpdate = async (jobId, what) => {
     const deadline = now() + linkTimeoutMs;
     for (; ; ) {
-      const job = (await client.listProvisioningJobs(projectId)).jobs.find(
-        (item) => item.id === jobId
-      );
+      const job = (await pollRead(() => client.listProvisioningJobs(projectId), {
+        what: what.text,
+        sleep: sleep5,
+        now
+      })).jobs.find((item) => item.id === jobId);
       const status2 = job?.status.toLowerCase();
       if (status2?.startsWith("completed")) return { jobId };
       if (status2 === "failed")
@@ -28416,7 +28535,9 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
       const body = billingOn ? {
         provider: "stripe",
         apiKey: plans.billing.apiKey,
-        webhookSecret: plans.billing.webhookSecret,
+        // A webhook secret that is not set yet is left out: the platform refuses a missing secret, and the deploy's
+        // webhook note says how to add it (API-92).
+        ...missingWebhook ? {} : { webhookSecret: plans.billing.webhookSecret },
         successUrl: plans.billing.successUrl,
         cancelUrl: plans.billing.cancelUrl
       } : { provider: "none" };
@@ -28800,7 +28921,10 @@ async function deployIdentity(resolved, projectId, deps, options = {}) {
     run: async () => {
       const deadline = now() + timeoutMs;
       for (; ; ) {
-        const found = await client.getProjectIdentity(projectId);
+        const found = await pollRead(
+          () => client.getProjectIdentity(projectId),
+          { what: "the identity", sleep: sleep5, now }
+        );
         if (found?.status === "Active")
           return {
             issuer: found.issuer,
@@ -29934,6 +30058,8 @@ async function deployV2(options, deps) {
       "Run `apitogo project create` to make a platform project and link this folder. Or pass --project-id <id> (saved as project.id), or set APITOGO_DEFAULT_PROJECT_ID."
     );
   }
+  if ((!only || only.includes("gateway")) && config2.gateway && config2.gateway.enabled !== false && config2.portal && config2.portal.enabled !== false && !portalOnlyLinksExternalDocs(resolved))
+    await recordPortalAddressBeforeBuild(options.dir, deps, projectId);
   const results = [];
   for (const service of DEPLOY_ORDER) {
     if (only && !only.includes(service)) continue;
@@ -30123,7 +30249,8 @@ async function recordPortalAddressBeforeBuild(dir, deps, projectId) {
   if (!resolved.portal?.enabled) return;
   const manifest = await readManifest(resolved.state);
   if (manifest?.services.portal?.url) return;
-  const url2 = resolveSwaUrl(await deps.client.getProject(projectId));
+  const project = await deps.client.getProject(projectId);
+  const url2 = project ? resolveSwaUrl(project) : void 0;
   if (!url2) return;
   const profile = portalProfile(resolved);
   await writeManifest(
@@ -30299,22 +30426,12 @@ async function deployProject(argv) {
   }
 }
 async function reportFailure(error, json) {
-  const message = error instanceof Error ? error.message : String(error);
-  const hint = error instanceof ApitogoError ? error.developerHint : void 0;
   if (json) {
-    console.log(
-      JSON.stringify({
-        status: "failed",
-        error: message,
-        hint: hint ?? null
-      })
-    );
+    console.log(JSON.stringify(failureJson(error)));
     process.exitCode = 1;
     return;
   }
-  await printCriticalFailureToConsoleAndExit(
-    hint ? `${message} ${hint}` : message
-  );
+  await printCriticalFailureToConsoleAndExit(failureText(error));
 }
 
 // src/cli/cmds/deploy.ts
@@ -31691,7 +31808,6 @@ var status_default = {
 import path96 from "node:path";
 
 // src/cli/teardown/command.ts
-init_invariant();
 import path94 from "node:path";
 import { createInterface as createInterface7 } from "node:readline/promises";
 
@@ -32092,22 +32208,12 @@ async function teardownProject(argv) {
       );
     printResultToConsole(result.message);
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    const hint = error instanceof ApitogoError ? error.developerHint : void 0;
     if (json) {
-      console.log(
-        JSON.stringify({
-          status: "failed",
-          error: message,
-          hint: hint ?? null
-        })
-      );
+      console.log(JSON.stringify(failureJson(error)));
       process.exitCode = 1;
       return;
     }
-    await printCriticalFailureToConsoleAndExit(
-      hint ? `${message} ${hint}` : message
-    );
+    await printCriticalFailureToConsoleAndExit(failureText(error));
   }
 }
 
@@ -32215,7 +32321,6 @@ var teardown_default = {
 };
 
 // src/cli/teardown/reset-command.ts
-init_invariant();
 import path97 from "node:path";
 
 // src/cli/teardown/reset.ts
@@ -32367,17 +32472,8 @@ async function resetProject(argv) {
     console.log(result.message);
     if (result.status === "pending") process.exitCode = 2;
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    const hint = error instanceof ApitogoError ? error.developerHint : void 0;
-    if (argv.json)
-      console.log(
-        JSON.stringify({
-          status: "failed",
-          error: message,
-          hint: hint ?? null
-        })
-      );
-    else console.error(hint ? `${message} ${hint}` : message);
+    if (argv.json) console.log(JSON.stringify(failureJson(error)));
+    else console.error(failureText(error));
     process.exitCode = 1;
   }
 }

package/dist/cli/worker.js

@@ -113,8 +113,20 @@ var ProtectedRoutesSchema = z.pipe(
   z.transform(normalizeProtectedRoutes)
 );
 
+// src/lib/util/prerenderedPage.ts
+var PRERENDERED_PATH_ATTRIBUTE = "data-prerendered-path";
+var markPrerenderedPath = (html, urlPath) => html.replace(
+  '<div id="root">',
+  `<div id="root" ${PRERENDERED_PATH_ATTRIBUTE}="${urlPath.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("<", "&lt;")}">`
+);
+
 // src/vite/prerender/utils.ts
 var prerenderFileFor = (urlPath) => urlPath === "/" ? "/index.html" : urlPath.endsWith("/index") ? `${urlPath}/index.html` : `${urlPath}.html`;
+var SCRIPT_SAFE_LT = `${"\\"}u003c`;
+var redirectPageHtml = (to) => (
+  // Every `<` of the target becomes SCRIPT_SAFE_LT, so a target can never close the script early.
+  `<!doctype html><link rel="icon" href="data:,"><script>window.location.href=${JSON.stringify(to).replaceAll("<", SCRIPT_SAFE_LT)};</script>`
+);
 
 // src/vite/prerender/worker.ts
 var { template, distDir, serverConfigPath, entryServerPath, writeRedirects } = Piscina.workerData;
@@ -149,7 +161,7 @@ var renderPage = async ({ urlPath }) => {
   if ([301, 302, 303, 307, 308].includes(response.status)) {
     const redirectTo = response.headers.get("Location") ?? "";
     if (writeRedirects) {
-      const redirectHtml = `<!doctype html><script>window.location.href=${JSON.stringify(redirectTo)};</script>`;
+      const redirectHtml = redirectPageHtml(redirectTo);
       await fs.mkdir(path.dirname(outputPath), { recursive: true });
       await fs.writeFile(outputPath, redirectHtml);
     }
@@ -184,7 +196,7 @@ var renderPage = async ({ urlPath }) => {
     html = bypassResponse.body ? await bypassResponse.text() : "";
   }
   await fs.mkdir(path.dirname(outputPath), { recursive: true });
-  await fs.writeFile(outputPath, fileContent);
+  await fs.writeFile(outputPath, markPrerenderedPath(fileContent, urlPath));
   return {
     outputPath,
     statusCode: response.status,

package/dist/declarations/lib/util/prerenderedPage.d.ts

@@ -0,0 +1,3 @@
+export declare const PRERENDERED_PATH_ATTRIBUTE = "data-prerendered-path";
+export declare const markPrerenderedPath: (html: string, urlPath: string) => string;
+export declare const isPrerenderedFor: (prerenderedPath: string | undefined, pathname: string, basePath?: string) => boolean;

package/docs/configuration/authentication.md

@@ -94,8 +94,7 @@ Register the portal in your provider with the redirect address
 
 ## Use the same sign-in for your API
 
-By default the gateway checks API keys. To have it check the signed-in person's token as well, set
-`gateway.auth`:
+To have the gateway accept the signed-in person's token, set `gateway.auth`:
 
 ```json
 "gateway": {
@@ -103,6 +102,11 @@ By default the gateway checks API keys. To have it check the signed-in person's
 }
 ```
 
+Without plans, the token is then all a caller needs. With plans, the gateway still asks for the API
+key of the caller's plan and not the token. To require both, write
+`"policies": { "access": { "jwt": true, "apiKey": true } }` in the `gateway` section. The
+[Gateway](./gateway.md#access-who-gets-in) page has the full rules.
+
 The API reference's Try it then also offers **Signed-in user**, which sends that token. See
 [Gateway](./gateway.md).
 

package/docs/configuration/gateway.md

@@ -117,8 +117,10 @@ A token is a login credential. Read it on your own computer, as above, and never
 | `apitogo check` or `deploy` says the auth settings are incomplete | One of `metadataUrl`, `issuers` or `audiences` is empty. All three are needed.                             |
 | The metadata address shows an error in the browser                | The issuer address is wrong, or your provider uses a different path. Check its docs.                       |
 
-> **Not available yet:** `"mode": "identity"` (APItoGo's own sign-up and login for your end users)
-> is a planned service. For now, use `oidc` with your own provider.
+> **Using APItoGo's sign-in?** With an `identity` section in the config, write
+> `"auth": { "mode": "identity" }` instead. The gateway then checks the tokens of your project's own
+> sign-in, and you leave out `metadataUrl`, `issuers` and `audiences`. See
+> [Authentication](./authentication.md).
 
 ## 3. The rules (`policies`)
 
@@ -130,12 +132,23 @@ Rules go in `gateway.policies`. Write them by hand: they are a few lines each.
 "access": { "jwt": true, "apiKey": false }
 ```
 
-| Setting  | Effect                                                                                                                        |
-| -------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `jwt`    | `true`: a valid login token is required.                                                                                      |
-| `apiKey` | `true`: a key in the `Ocp-Apim-Subscription-Key` header is required. Keys need the plans service, which is not available yet. |
+| Setting        | Effect                                                                                                       |
+| -------------- | ------------------------------------------------------------------------------------------------------------ |
+| `jwt`          | `true`: a valid login token is required.                                                                     |
+| `apiKey`       | `true`: an API key is required. Callers get keys from a plan, so this needs the [plans](./plans.md) service. |
+| `apiKeyHeader` | The header the key is sent in. The default is `X-API-Key`.                                                   |
 
-Set `access` yourself and do not rely on the default.
+When you leave `access` out, the gateway asks for one credential, never two by surprise:
+
+| Your config                     | What a caller must send                                        |
+| ------------------------------- | -------------------------------------------------------------- |
+| `auth` set, no plans            | A valid login token. No key.                                   |
+| Plans on                        | An API key from their plan. No token, even when `auth` is set. |
+| You want both a token and a key | Write it out: `"access": { "jwt": true, "apiKey": true }`.     |
+
+A value you write yourself is always kept. When a call is refused, the `401` answer says which check
+failed: _"the access token is missing, expired or not valid for this API"_ for the token, or _"send
+a valid API key in the X-API-Key header"_ for the key.
 
 ### `operations`: open a call to everyone, or close it
 
@@ -262,13 +275,13 @@ curl -i https://YOUR-GATEWAY-ADDRESS/health
 curl -i https://YOUR-GATEWAY-ADDRESS/orders
 ```
 
-| Answer                          | Meaning                                                       |
-| ------------------------------- | ------------------------------------------------------------- |
-| `200` on a public call          | The call is open and your API answered.                       |
-| `401` on a call without a token | The gateway is protecting that call.                          |
-| `404`                           | The path is not in your OpenAPI file.                         |
-| `429`                           | The rate limit was reached.                                   |
-| `502` or `504`                  | Your API did not answer. Check `origin.url` and `healthPath`. |
+| Answer                          | Meaning                                                                          |
+| ------------------------------- | -------------------------------------------------------------------------------- |
+| `200` on a public call          | The call is open and your API answered.                                          |
+| `401` on a call without a token | The gateway is protecting that call. Its message names the missing token or key. |
+| `404`                           | The path is not in your OpenAPI file.                                            |
+| `429`                           | The rate limit was reached.                                                      |
+| `502` or `504`                  | Your API did not answer. Check `origin.url` and `healthPath`.                    |
 
 A change is live a few seconds after `deploy` reports it ready: the gateway keeps answering with the
 previous rules for up to about ten seconds. If a test right after a deploy shows the old behavior,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lukoweb/apitogo",
-  "version": "0.2.65",
+  "version": "0.2.71",
   "type": "module",
   "sideEffects": [
     "**/*.css",

package/src/app/entry.client.tsx

@@ -8,6 +8,10 @@ import config from "virtual:zudoku-config";
 import "vite/modulepreload-polyfill";
 import type { ResolvedModulesConfig } from "../config/validators/ModulesSchema.js";
 import { Bootstrap } from "../lib/components/Bootstrap.js";
+import {
+  isPrerenderedFor,
+  PRERENDERED_PATH_ATTRIBUTE,
+} from "../lib/util/prerenderedPage.js";
 import { getRoutesByConfig } from "./main.js";
 
 // The build resolved the modules and put them in the config; parsing them again would put zod in this bundle.
@@ -32,9 +36,17 @@ if (process.env.SENTRY_DSN) {
   });
 }
 
-if (root.childElementCount > 0) {
+// The host can serve a page for another address (`/404.html` for the sign-in callback): hydrating it would not match
+// the route, so it is rendered fresh instead (API-81).
+const prerenderedFor =
+  root.getAttribute(PRERENDERED_PATH_ATTRIBUTE) ?? undefined;
+if (
+  root.childElementCount > 0 &&
+  isPrerenderedFor(prerenderedFor, window.location.pathname, config.basePath)
+) {
   void hydrate(routes);
 } else {
+  root.replaceChildren();
   void render(routes);
 }
 

package/src/config/v2/manifest.ts

@@ -185,6 +185,32 @@ export function requiredServices(
   return needs;
 }
 
+/**
+ * The manifest without the entries of services the config no longer has (or has switched off). `apitogo remove plans`
+ * changes only the config, so services.json still described the plans service, and the portal kept its plan pages and
+ * signed in through the plans backend (API-99). The config decides which services exist; the manifest only says where
+ * they are. The portal's own entry is always kept.
+ */
+export function onlyConfiguredServices(
+  manifest: ServiceManifest,
+  resolved: Pick<ResolvedConfigV2, "identity" | "gateway" | "plans">,
+): ServiceManifest {
+  const configured: Record<Exclude<ManifestServiceName, "portal">, boolean> = {
+    identity: resolved.identity?.enabled === true,
+    gateway: resolved.gateway?.enabled === true,
+    plans: resolved.plans?.enabled === true,
+  };
+  const services = Object.fromEntries(
+    Object.entries(manifest.services).filter(
+      ([name]) =>
+        !(name in configured) || configured[name as keyof typeof configured],
+    ),
+  ) as ServiceManifest["services"];
+  return Object.keys(services).length === Object.keys(manifest.services).length
+    ? manifest
+    : { ...manifest, services };
+}
+
 /** Problems that stop a production build: a required service without a manifest entry. */
 export function missingManifestServices(
   resolved: ResolvedConfigV2,

package/src/config/v2/rules.ts

@@ -893,6 +893,17 @@ function secretRules(
         message: `a plan has a price, and the Stripe key (secret ${ref.name}) is not set yet.`,
         hint: `apitogo deploy asks for it. Or run: apitogo secrets set ${ref.name}`,
       });
+    } else if (
+      ref.path === "plans.billing.webhookSecret" &&
+      !context.knownSecrets.has(ref.name)
+    ) {
+      // The signing secret exists only once Stripe has the webhook address, which the first deploy prints (API-92).
+      out.warn({
+        code: "SECRET_NOT_SET",
+        path: ref.path,
+        message: `the Stripe webhook secret (${ref.name}) is not set yet, so payments do not activate plans until it is.`,
+        hint: `Deploy first: it prints the webhook address. Add it in Stripe, then run "apitogo secrets set ${ref.name}" with its signing secret and deploy again.`,
+      });
     } else if (!context.knownSecrets.has(ref.name)) {
       out.error({
         code: "SECRET_NOT_SET",

package/src/config/v2/wrapper.ts

@@ -17,6 +17,7 @@ import {
 import {
   hasCapability,
   missingManifestServices,
+  onlyConfiguredServices,
   requiredServices,
   type ServiceManifest,
   serviceReady,
@@ -763,7 +764,8 @@ export async function preparePortal(
   }
 
   if (manifest) {
-    effective = manifest;
+    // A service removed from the config (`apitogo remove plans`) still has its entry in services.json (API-99).
+    effective = onlyConfiguredServices(manifest, resolved);
     manifestSource = "file";
     if (mode === "production") {
       issues.push(...missingManifestServices(resolved, manifest));

package/src/lib/util/prerenderedPage.ts

@@ -0,0 +1,46 @@
+/**
+ * The attribute the prerender puts on `#root`: the path the page was rendered for. The host can serve a page for
+ * another address, for example `/404.html` for the sign-in callback `/oauth/callback`. Hydrating the not-found page
+ * with the callback route is a mismatch (React #418 after every sign-in), so the client hydrates only the page that
+ * was rendered for this address and renders anything else fresh (API-81).
+ */
+export const PRERENDERED_PATH_ATTRIBUTE = "data-prerendered-path";
+
+/** Puts the path a page was rendered for on its `#root` element. */
+export const markPrerenderedPath = (html: string, urlPath: string): string =>
+  html.replace(
+    '<div id="root">',
+    `<div id="root" ${PRERENDERED_PATH_ATTRIBUTE}="${urlPath
+      .replaceAll("&", "&amp;")
+      .replaceAll('"', "&quot;")
+      .replaceAll("<", "&lt;")}">`,
+  );
+
+const normalize = (path: string): string => {
+  let decoded = path;
+  try {
+    decoded = decodeURIComponent(path);
+  } catch {
+    // A malformed address is compared as it is.
+  }
+  const trimmed = decoded.replace(/\.html$/, "").replace(/\/+$/, "");
+  return trimmed === "" || trimmed === "/index" ? "/" : trimmed;
+};
+
+/**
+ * Whether the prerendered page in `#root` was rendered for the address being visited, so it can be hydrated. A page
+ * without the attribute (built before it existed) is trusted, as before.
+ */
+export const isPrerenderedFor = (
+  prerenderedPath: string | undefined,
+  pathname: string,
+  basePath = "",
+): boolean => {
+  if (prerenderedPath === undefined) return true;
+  const base = basePath.replace(/\/+$/, "");
+  const visited =
+    base && (pathname === base || pathname.startsWith(`${base}/`))
+      ? pathname.slice(base.length)
+      : pathname;
+  return normalize(prerenderedPath) === normalize(visited);
+};

package/src/vite/prerender/utils.ts

@@ -87,3 +87,15 @@ export const routesToPaths = (routes: RouteObject[]): string[] =>
 
 export const routesToRewrites = (routes: RouteObject[]): RouteRewrite[] =>
   collectRewrites(resolveRoutes(routes));
+
+/** `<` as a JavaScript string escape: a backslash, then u003c. */
+const SCRIPT_SAFE_LT = `${"\\"}u003c`;
+
+/**
+ * The page written for a route that redirects, such as `/` of a portal without a home page of its own. It declares an
+ * empty icon: without one the browser asks for /favicon.ico before the script runs, a 404 and a console error on every
+ * visit of the home page (API-134).
+ */
+export const redirectPageHtml = (to: string): string =>
+  // Every `<` of the target becomes SCRIPT_SAFE_LT, so a target can never close the script early.
+  `<!doctype html><link rel="icon" href="data:,"><script>window.location.href=${JSON.stringify(to).replaceAll("<", SCRIPT_SAFE_LT)};</script>`;

package/src/vite/prerender/worker.ts

@@ -6,8 +6,9 @@ import { ProtectedRoutesSchema } from "../../config/validators/ProtectedRoutesSc
 import type { ZudokuConfig } from "../../config/validators/ZudokuConfig.js";
 import { runPluginTransformConfig } from "../../lib/core/transform-config.js";
 import { joinUrl } from "../../lib/util/joinUrl.js";
+import { markPrerenderedPath } from "../../lib/util/prerenderedPage.js";
 import type { WorkerResult } from "./prerender.js";
-import { prerenderFileFor } from "./utils.js";
+import { prerenderFileFor, redirectPageHtml } from "./utils.js";
 
 type EntryServer = typeof import("../../app/entry.server.js");
 
@@ -75,7 +76,7 @@ const renderPage = async ({ urlPath }: WorkerData): Promise<WorkerResult> => {
     const redirectTo = response.headers.get("Location") ?? "";
 
     if (writeRedirects) {
-      const redirectHtml = `<!doctype html><script>window.location.href=${JSON.stringify(redirectTo)};</script>`;
+      const redirectHtml = redirectPageHtml(redirectTo);
       await fs.mkdir(path.dirname(outputPath), { recursive: true });
       await fs.writeFile(outputPath, redirectHtml);
     }
@@ -118,9 +119,10 @@ const renderPage = async ({ urlPath }: WorkerData): Promise<WorkerResult> => {
     html = bypassResponse.body ? await bypassResponse.text() : "";
   }
 
-  // Write the file
+  // Write the file, marked with the path it was rendered for: the host also serves some files for other addresses
+  // (`404.html` for the sign-in callback), and the client must not hydrate those (API-81).
   await fs.mkdir(path.dirname(outputPath), { recursive: true });
-  await fs.writeFile(outputPath, fileContent);
+  await fs.writeFile(outputPath, markPrerenderedPath(fileContent, urlPath));
 
   return {
     outputPath,