@podosoft/podokit 0.17.4 → 1.0.1

package/dist/deploy-compose-sync.js

@@ -23,14 +23,11 @@ const HEALTH_POLL_INTERVAL_MS = 2_000;
  * What the images ship outside their dependency tree.
  *
  * Every entry mirrors a `COPY --from=build` line in the generated Dockerfiles, which
- * is what makes the copy equivalent to a rebuild for code-only changes. Two entries
- * exist for a reason worth keeping:
- *
- * - `apps/web/server.js` and `apps/web/src/lib/server` ship as SOURCE, outside the
- *   bundle, because the entry point has to run before the adapter does. Syncing only
- *   `build/` would leave a stale entry running new routes.
- * - `packages/*` are copied as real directories rather than the symlinks npm leaves
- *   behind, so their `dist/` is a separate destination from the apps'.
+ * is what makes the copy equivalent to a rebuild for code-only changes. The web
+ * image is different from the API image: the official Bun adapter bundles the web
+ * application and its workspace dependencies into `apps/web/build`, so that one
+ * directory is the complete web payload. API and worker processes still load
+ * workspace package output separately.
  *
  * `node_modules` is deliberately absent: the image installs a production-only,
  * workspace-scoped tree for its own platform, and a developer's tree is neither.
@@ -47,14 +44,12 @@ function composeSyncArtifacts(projectRoot) {
         for (const entry of (0, node_fs_1.readdirSync)(packagesDir).sort()) {
             if (!(0, node_fs_1.existsSync)((0, node_path_1.join)(packagesDir, entry, "package.json")))
                 continue;
-            push(`packages/${entry}/dist`, `/app/packages/${entry}/dist`, "directory", ["api", "web", "worker"]);
+            push(`packages/${entry}/dist`, `/app/packages/${entry}/dist`, "directory", ["api", "worker"]);
         }
     }
     push("apps/api/dist", "/app/apps/api/dist", "directory", ["api", "worker"]);
     push("apps/api/scripts", "/app/apps/api/scripts", "directory", ["api", "worker"]);
     push("apps/web/build", "/app/apps/web/build", "directory", ["web"]);
-    push("apps/web/server.js", "/app/apps/web/server.js", "file", ["web"]);
-    push("apps/web/src/lib/server", "/app/apps/web/src/lib/server", "directory", ["web"]);
     return artifacts;
 }
 /** The excludes that fall inside one artifact, as paths relative to it. */
@@ -67,12 +62,11 @@ function excludesWithin(artifact, excludes) {
 /**
  * Whether the image's dependency tree can still run this code.
  *
- * Only the runtime dependency sets matter: `npm ci --omit=dev` installed what these
- * declare and nothing else, so a change to any of them means the container is
- * missing a package the new code imports -- a failure that surfaces as a crash loop
- * after the restart rather than as a copy error. `devDependencies` are absent from
- * the image by design and a `version` bump changes nothing at runtime, so neither
- * takes part.
+ * Only the runtime dependency sets matter for API and worker images: their package
+ * manager installed what these manifests declare and nothing else, so a change can
+ * leave the container without a package the new code imports. The web image has no
+ * runtime dependency tree; the official Bun adapter includes those dependencies in
+ * the synced build instead. `devDependencies` and package versions do not take part.
  */
 function runtimeDependenciesOf(manifest) {
     return JSON.stringify({
@@ -83,9 +77,10 @@ function runtimeDependenciesOf(manifest) {
 }
 /** The manifests whose runtime dependencies a role's container was built from. */
 function manifestPathsFor(projectRoot, role) {
-    const app = role === "web" ? "web" : "api";
+    if (role === "web")
+        return [];
     const pairs = [
-        [(0, node_path_1.join)(projectRoot, "apps", app, "package.json"), `/app/apps/${app}/package.json`],
+        [(0, node_path_1.join)(projectRoot, "apps", "api", "package.json"), "/app/apps/api/package.json"],
     ];
     const packagesDir = (0, node_path_1.join)(projectRoot, "packages");
     if ((0, node_fs_1.existsSync)(packagesDir)) {
@@ -165,19 +160,23 @@ function planComposeSync(projectRoot, profileName, runner = deploy_compose_exec_
  */
 function buildArtifacts(projectRoot, runner) {
     const manifest = (0, lockfile_1.readManifest)(projectRoot);
-    const pm = manifest?.packageManager ?? "npm";
+    const pm = manifest?.toolchain.packageManager ?? "npm";
     const packagesDir = (0, node_path_1.join)(projectRoot, "packages");
     if ((0, node_fs_1.existsSync)(packagesDir)) {
         for (const entry of (0, node_fs_1.readdirSync)(packagesDir).sort()) {
             if (!(0, node_fs_1.existsSync)((0, node_path_1.join)(packagesDir, entry, "package.json")))
                 continue;
-            (0, deploy_compose_exec_1.checked)(runner, pm, ["run", "build", "--if-present", "--workspace", `packages/${entry}`], false);
+            (0, deploy_compose_exec_1.checked)(runner, pm, pm === "bun"
+                ? ["run", "--cwd", `packages/${entry}`, "--if-present", "build"]
+                : ["run", "build", "--if-present", "--workspace", `packages/${entry}`], false);
         }
     }
     for (const app of ["api", "web"]) {
         if (!(0, node_fs_1.existsSync)((0, node_path_1.join)(projectRoot, "apps", app, "package.json")))
             continue;
-        (0, deploy_compose_exec_1.checked)(runner, pm, ["run", "build", "--if-present", "--workspace", `apps/${app}`], false);
+        (0, deploy_compose_exec_1.checked)(runner, pm, pm === "bun"
+            ? ["run", "--cwd", `apps/${app}`, "--if-present", "build"]
+            : ["run", "build", "--if-present", "--workspace", `apps/${app}`], false);
     }
 }
 function assertNoManifestDrift(projectRoot, profile, targets, runner) {

package/dist/deploy-compose.js

@@ -17,6 +17,8 @@ const deploy_compose_sync_1 = require("./deploy-compose-sync");
 const deploy_compose_profile_1 = require("./deploy-compose-profile");
 const deploy_compose_render_1 = require("./deploy-compose-render");
 const deploy_driver_2 = require("./deploy-driver");
+const lockfile_1 = require("./lockfile");
+const toolchain_1 = require("./toolchain");
 /** How many rollback targets the ledger keeps. */
 const LEDGER_DEPTH = 10;
 function digest(parts) {
@@ -364,7 +366,8 @@ function planComposeDeployment(projectRoot, profileName, release, runner = deplo
     actions.push({
         order: order++,
         kind: "migration",
-        description: `Run ${(profile.migration?.command ?? ["npm", "run", "migrate:all"]).join(" ")} using ${images.api}.`,
+        description: `Run ${(profile.migration?.command ??
+            (0, toolchain_1.toolchainMigrationCommand)((0, lockfile_1.readManifest)(projectRoot)?.toolchain ?? (0, toolchain_1.resolveToolchain)())).join(" ")} using ${images.api}.`,
     });
     actions.push({
         order: order++,

package/dist/deploy-profile.d.ts

@@ -49,6 +49,7 @@ export interface DeployProfileV1 {
         host: string;
         ingressClassName: string;
         tlsSecretName: string | null;
+        webSocketPaths: string[];
     };
     workloads: {
         api: WorkloadProfile;

package/dist/deploy-profile.js

@@ -11,6 +11,7 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const lockfile_1 = require("./lockfile");
 const deploy_schema_1 = require("./deploy-schema");
+const websocket_paths_1 = require("./websocket-paths");
 var deploy_schema_2 = require("./deploy-schema");
 Object.defineProperty(exports, "profileDirectory", { enumerable: true, get: function () { return deploy_schema_2.profileDirectory; } });
 Object.defineProperty(exports, "profilePath", { enumerable: true, get: function () { return deploy_schema_2.profilePath; } });
@@ -116,7 +117,7 @@ function parseProfile(value) {
     const runtimeConfig = (0, deploy_schema_1.requiredRecord)(value, "runtimeConfig");
     (0, deploy_schema_1.assertOnlyKeys)(target, ["context", "clusterFingerprint", "namespace", "release", "createNamespace"], "target");
     (0, deploy_schema_1.assertOnlyKeys)(release, ["strategy", "tagPattern", "apiRepository", "webRepository"], "release");
-    (0, deploy_schema_1.assertOnlyKeys)(exposure, ["mode", "host", "ingressClassName", "tlsSecretName"], "exposure");
+    (0, deploy_schema_1.assertOnlyKeys)(exposure, ["mode", "host", "ingressClassName", "tlsSecretName", "webSocketPaths"], "exposure");
     (0, deploy_schema_1.assertOnlyKeys)(workloads, ["api", "web", "worker"], "workloads");
     (0, deploy_schema_1.assertOnlyKeys)(dependencies, ["postgres", "redis", "objectStorage"], "dependencies");
     (0, deploy_schema_1.assertOnlyKeys)(secrets, ["api", "web", "imagePull"], "secrets");
@@ -162,6 +163,10 @@ function parseProfile(value) {
     const tlsSecretName = (0, deploy_schema_1.optionalString)(exposure, "tlsSecretName");
     if (tlsSecretName)
         (0, deploy_schema_1.validateDnsSubdomain)(tlsSecretName, "exposure.tlsSecretName");
+    const webSocketPaths = (0, websocket_paths_1.parseExactWebSocketPaths)(exposure.webSocketPaths ?? [], "exposure.webSocketPaths");
+    if (exposureMode === "nodePort" && webSocketPaths.length > 0) {
+        throw new Error("Deployment exposure.webSocketPaths requires exposure.mode ingress.");
+    }
     const postgres = parseStatefulDependency((0, deploy_schema_1.requiredRecord)(dependencies, "postgres"), "dependencies.postgres");
     const redis = parseRedisDependency((0, deploy_schema_1.requiredRecord)(dependencies, "redis"), "dependencies.redis");
     const objectStorageRecord = (0, deploy_schema_1.requiredRecord)(dependencies, "objectStorage");
@@ -204,6 +209,7 @@ function parseProfile(value) {
             host,
             ingressClassName,
             tlsSecretName,
+            webSocketPaths,
         },
         workloads: {
             api: parseWorkload((0, deploy_schema_1.requiredRecord)(workloads, "api"), "workloads.api"),
@@ -301,6 +307,7 @@ function initializeDeploymentProfile(projectRoot, name, options) {
             host,
             ingressClassName: "traefik",
             tlsSecretName: null,
+            webSocketPaths: [],
         },
         workloads: {
             api: {
@@ -376,6 +383,7 @@ function initializeDeploymentProfile(projectRoot, name, options) {
             ...(modules.has("rate-limit")
                 ? {
                     RATE_LIMIT_TTL: "60",
+                    RATE_LIMIT_KEY_PREFIX: "podokit:rate-limit",
                     RATE_LIMIT_MAX: "300",
                     RATE_LIMIT_AUTH_TTL: "60",
                     RATE_LIMIT_AUTH_MAX: "20",

package/dist/deploy-render.js

@@ -5,6 +5,8 @@ const node_fs_1 = require("node:fs");
 const node_crypto_1 = require("node:crypto");
 const node_path_1 = require("node:path");
 const deploy_profile_1 = require("./deploy-profile");
+const lockfile_1 = require("./lockfile");
+const toolchain_1 = require("./toolchain");
 function quote(value) {
     return JSON.stringify(value);
 }
@@ -351,6 +353,8 @@ function derivedRuntimeConfig(profile) {
     const result = {
         PORT: "3000",
         BACKEND_INTERNAL_URL: `http://${profile.target.release}-api:3000`,
+        PROTOCOL_HEADER: "x-forwarded-proto",
+        HOST_HEADER: "x-forwarded-host",
         ...profile.runtimeConfig,
     };
     if (profile.dependencies.postgres.mode === "inCluster") {
@@ -517,16 +521,17 @@ spec:
 `;
 }
 function exposure(profile) {
-    const service = `${profile.target.release}-web`;
+    const webService = `${profile.target.release}-web`;
+    const apiService = `${profile.target.release}-api`;
     if (profile.exposure.mode === "nodePort") {
         return `apiVersion: v1
 kind: Service
 metadata:
-  name: ${service}-public
+  name: ${webService}-public
 spec:
   type: NodePort
   selector:
-    app.kubernetes.io/name: ${service}
+    app.kubernetes.io/name: ${webService}
   ports:
     - { name: http, port: 80, targetPort: 3000 }
 `;
@@ -537,6 +542,15 @@ spec:
       secretName: ${quote(profile.exposure.tlsSecretName)}
 `
         : "";
+    const webSocketPaths = profile.exposure.webSocketPaths
+        .map((path) => `          - path: ${quote(path)}
+            pathType: Exact
+            backend:
+              service:
+                name: ${apiService}
+                port: { number: 3000 }
+`)
+        .join("");
     return `apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -547,11 +561,11 @@ ${tls}  rules:
     - host: ${quote(profile.exposure.host)}
       http:
         paths:
-          - path: /
+${webSocketPaths}          - path: /
             pathType: Prefix
             backend:
               service:
-                name: ${service}
+                name: ${webService}
                 port: { number: 3000 }
 `;
 }
@@ -577,9 +591,9 @@ function migrationRuntimeEnv(profile) {
               value: ${quote(value)}`)
         .join("\n");
 }
-function migrationManifest(profile, release, images) {
+function migrationManifest(profile, release, images, defaultCommand) {
     const releaseSlug = release.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-    const command = profile.migration?.command ?? ["npm", "run", "migrate:all"];
+    const command = profile.migration?.command ?? defaultCommand;
     return `apiVersion: batch/v1
 kind: Job
 metadata:
@@ -646,7 +660,8 @@ function renderDeployment(projectRoot, profileName, profile, release, resolvedIm
     const effectiveRolloutStateDigest = rolloutStateDigest ?? offlineRolloutStateDigest(profile);
     const dependencies = dependencyManifest(profile, images, effectiveRolloutStateDigest);
     const application = applicationManifest(profile, images, effectiveRolloutStateDigest);
-    const migration = migrationManifest(profile, release, images);
+    const toolchain = (0, lockfile_1.readManifest)(projectRoot)?.toolchain ?? (0, toolchain_1.resolveToolchain)();
+    const migration = migrationManifest(profile, release, images, (0, toolchain_1.toolchainMigrationCommand)(toolchain));
     chart(dependencyChart, "podokit-dependencies", dependencies);
     chart(applicationChart, "podokit-application", application);
     (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, "migration.yaml"), migration);

package/dist/deploy-schema.js

@@ -29,7 +29,12 @@ const IMAGE_TAG = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
 exports.SENSITIVE_KEY = /(password|passphrase|secret|token|private.?key|credential|access.?key|api.?keys?|signing.?key|encryption.?key)/i;
 exports.STABLE_SEMVER_TAG_PATTERN = "^v(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$";
 /** Keys PodoKit derives itself, so a profile may not set them. */
-exports.MANAGED_RUNTIME_CONFIG_KEYS = ["PORT", "BACKEND_INTERNAL_URL"];
+exports.MANAGED_RUNTIME_CONFIG_KEYS = [
+    "PORT",
+    "BACKEND_INTERNAL_URL",
+    "PROTOCOL_HEADER",
+    "HOST_HEADER",
+];
 function containsUrlCredentials(value) {
     if (!value.includes("://"))
         return false;

package/dist/dev.d.ts

@@ -2,6 +2,7 @@ export interface DevConfig {
     schemaVersion: 1;
     hostname: string;
     publicUrl?: string;
+    webSocketPaths: string[];
 }
 export interface DevRuntime {
     alias: string;

package/dist/dev.js

@@ -12,9 +12,12 @@ const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const lockfile_1 = require("./lockfile");
+const websocket_paths_1 = require("./websocket-paths");
 const GATEWAY_CONTAINER = "podokit-dev-gateway";
 const GATEWAY_IMAGE = "traefik:v3.5";
 const GATEWAY_LABEL = "io.podosoft.podokit.dev-gateway";
+const GATEWAY_VERSION = "2";
+const GATEWAY_VERSION_LABEL = "io.podosoft.podokit.dev-gateway.version";
 const GATEWAY_NETWORK = "podokit-dev-gateway";
 const RUNTIME_COMPOSE = ".podokit/runtime/dev.compose.yaml";
 const DEV_CONFIG = ".podokit/dev.json";
@@ -59,7 +62,12 @@ function validatePublicUrl(publicUrl) {
     catch {
         throw new Error(`Invalid publicUrl "${publicUrl}". Use an absolute HTTPS URL.`);
     }
-    if (parsed.protocol !== "https:" || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+    if (parsed.protocol !== "https:" ||
+        parsed.username ||
+        parsed.password ||
+        parsed.pathname !== "/" ||
+        parsed.search ||
+        parsed.hash) {
         throw new Error(`Invalid publicUrl "${publicUrl}". Use an HTTPS origin without a path.`);
     }
 }
@@ -73,14 +81,17 @@ function readDevConfig(projectRoot) {
         throw new Error("PodoKit manifest is missing answers.projectName.");
     const config = (0, node_fs_1.existsSync)(path)
         ? parseJson(path)
-        : { schemaVersion: 1, hostname: `${fallbackName}.localhost` };
+        : { schemaVersion: 1, hostname: `${fallbackName}.localhost`, webSocketPaths: [] };
     if (config.schemaVersion !== 1) {
         throw new Error(`Unsupported ${DEV_CONFIG} schemaVersion: ${String(config.schemaVersion)}`);
     }
     validateHostname(config.hostname);
     if (config.publicUrl)
         validatePublicUrl(config.publicUrl);
-    return config;
+    return {
+        ...config,
+        webSocketPaths: (0, websocket_paths_1.parseExactWebSocketPaths)(config.webSocketPaths ?? [], `${DEV_CONFIG}.webSocketPaths`),
+    };
 }
 function stableId(projectRoot) {
     return (0, node_crypto_1.createHash)("sha256").update(projectRoot).digest("hex").slice(0, 10);
@@ -113,11 +124,23 @@ function installedDevProfiles(projectRoot) {
     ];
 }
 function renderRuntimeCompose(runtime) {
-    return `# Generated by podo dev. Do not edit.\nservices:\n  traefik:\n    profiles: [podokit-legacy-proxy]\n  web:\n    networks:\n      ${GATEWAY_NETWORK}:\n        aliases: [${runtime.alias}]\nnetworks:\n  ${GATEWAY_NETWORK}:\n    external: true\n    name: ${GATEWAY_NETWORK}\n`;
+    const api = runtime.config.webSocketPaths.length
+        ? `  api:\n    networks:\n      ${GATEWAY_NETWORK}:\n        aliases: [${runtime.alias}-api]\n`
+        : "";
+    return `# Generated by podo dev. Do not edit.\nservices:\n  traefik:\n    profiles: [podokit-legacy-proxy]\n  web:\n    networks:\n      ${GATEWAY_NETWORK}:\n        aliases: [${runtime.alias}]\n${api}networks:\n  ${GATEWAY_NETWORK}:\n    external: true\n    name: ${GATEWAY_NETWORK}\n`;
 }
 function renderRoute(runtime) {
     const { alias, config, routeId } = runtime;
-    return `http:\n  routers:\n    ${routeId}:\n      entryPoints: [web]\n      rule: Host(\`${config.hostname}\`)\n      service: ${routeId}\n      middlewares: [${routeId}-compression]\n  services:\n    ${routeId}:\n      loadBalancer:\n        servers:\n          - url: http://${alias}:5001\n  middlewares:\n    ${routeId}-compression:\n      compress: {}\n`;
+    const hosts = routeHosts(config);
+    const hostRule = hosts.map((host) => `Host(\`${host}\`)`).join(" || ");
+    const webSocketHostRule = hosts.length > 1 ? `(${hostRule})` : hostRule;
+    const webSocketRouter = config.webSocketPaths.length
+        ? `    ${routeId}-websocket:\n      entryPoints: [web]\n      rule: ${webSocketHostRule} && Path(${config.webSocketPaths.map((path) => `\`${path}\``).join(", ")})\n      priority: 100\n      service: ${routeId}-api\n`
+        : "";
+    const apiService = config.webSocketPaths.length
+        ? `    ${routeId}-api:\n      loadBalancer:\n        servers:\n          - url: http://${alias}-api:5002\n`
+        : "";
+    return `http:\n  routers:\n${webSocketRouter}    ${routeId}:\n      entryPoints: [web]\n      rule: ${hostRule}\n      service: ${routeId}\n      middlewares: [${routeId}-compression]\n  services:\n${apiService}    ${routeId}:\n      loadBalancer:\n        servers:\n          - url: http://${alias}:5001\n  middlewares:\n    ${routeId}-compression:\n      compress: {}\n`;
 }
 function devHome() {
     return process.env.PODOKIT_DEV_HOME ?? (0, node_path_1.join)((0, node_os_1.homedir)(), ".podokit", "dev-gateway");
@@ -134,6 +157,14 @@ function registryPath(runtime) {
 function routePath(runtime) {
     return (0, node_path_1.join)(routesDirectory(), `${runtime.routeId}.yml`);
 }
+function routeHosts(config) {
+    return [
+        ...new Set([
+            config.hostname,
+            ...(config.publicUrl ? [new URL(config.publicUrl).hostname] : []),
+        ]),
+    ];
+}
 function activeEntries() {
     const dir = registryDirectory();
     if (!(0, node_fs_1.existsSync)(dir))
@@ -157,9 +188,12 @@ function writeRuntimeFiles(runtime) {
 }
 function registerRoute(runtime) {
     const entries = activeEntries();
-    const collision = entries.find((entry) => entry.hostname === runtime.config.hostname && entry.projectRoot !== runtime.projectRoot);
+    const requestedHosts = new Set(routeHosts(runtime.config));
+    const collision = entries.find((entry) => entry.projectRoot !== runtime.projectRoot &&
+        routeHosts(entry).some((hostname) => requestedHosts.has(hostname)));
     if (collision) {
-        throw new Error(`Development hostname ${runtime.config.hostname} is already registered by ${collision.projectRoot}. Change .podokit/dev.json or run podo dev down there.`);
+        const duplicate = routeHosts(collision).find((hostname) => requestedHosts.has(hostname));
+        throw new Error(`Development host ${duplicate ?? runtime.config.hostname} is already registered by ${collision.projectRoot}. Change .podokit/dev.json or run podo dev down there.`);
     }
     for (const stale of entries.filter((entry) => entry.projectRoot === runtime.projectRoot && entry.routeId !== runtime.routeId)) {
         (0, node_fs_1.rmSync)((0, node_path_1.join)(registryDirectory(), `${stale.routeId}.json`), { force: true });
@@ -170,6 +204,7 @@ function registerRoute(runtime) {
     (0, node_fs_1.writeFileSync)(routePath(runtime), renderRoute(runtime));
     const entry = {
         hostname: runtime.config.hostname,
+        ...(runtime.config.publicUrl ? { publicUrl: runtime.config.publicUrl } : {}),
         projectRoot: runtime.projectRoot,
         routeId: runtime.routeId,
     };
@@ -198,19 +233,30 @@ function ensureNetwork(runner) {
     }
 }
 function ensureGateway(runner) {
-    const inspect = runner("docker", ["inspect", "--format", `{{ index .Config.Labels \"${GATEWAY_LABEL}\" }} {{.State.Running}}`, GATEWAY_CONTAINER], { capture: true });
+    const inspect = runner("docker", [
+        "inspect",
+        "--format",
+        `{{ index .Config.Labels \"${GATEWAY_LABEL}\" }} {{.State.Running}} {{ index .Config.Labels \"${GATEWAY_VERSION_LABEL}\" }}`,
+        GATEWAY_CONTAINER,
+    ], { capture: true });
     if (commandSucceeded(inspect)) {
-        const [label, running] = inspect.stdout.trim().split(/\s+/);
+        const [label, running, version] = inspect.stdout.trim().split(/\s+/);
         if (label !== "1") {
             throw new Error(`Container ${GATEWAY_CONTAINER} exists but is not managed by PodoKit.`);
         }
-        if (running !== "true") {
-            const start = runner("docker", ["start", GATEWAY_CONTAINER], { capture: true });
-            if (!commandSucceeded(start)) {
-                throw new Error(`Cannot start ${GATEWAY_CONTAINER}: ${start.stderr.trim()}`);
+        if (version === GATEWAY_VERSION) {
+            if (running !== "true") {
+                const start = runner("docker", ["start", GATEWAY_CONTAINER], { capture: true });
+                if (!commandSucceeded(start)) {
+                    throw new Error(`Cannot start ${GATEWAY_CONTAINER}: ${start.stderr.trim()}`);
+                }
             }
+            return;
+        }
+        const remove = runner("docker", ["rm", "--force", GATEWAY_CONTAINER], { capture: true });
+        if (!commandSucceeded(remove)) {
+            throw new Error(`Cannot upgrade ${GATEWAY_CONTAINER}: ${remove.stderr.trim()}`);
         }
-        return;
     }
     (0, node_fs_1.mkdirSync)(routesDirectory(), { recursive: true });
     const run = runner("docker", [
@@ -220,6 +266,8 @@ function ensureGateway(runner) {
         GATEWAY_CONTAINER,
         "--label",
         `${GATEWAY_LABEL}=1`,
+        "--label",
+        `${GATEWAY_VERSION_LABEL}=${GATEWAY_VERSION}`,
         "--restart",
         "unless-stopped",
         "--network",
@@ -232,6 +280,7 @@ function ensureGateway(runner) {
         "--providers.file.directory=/etc/traefik/dynamic",
         "--providers.file.watch=true",
         "--entrypoints.web.address=:80",
+        "--entrypoints.web.forwardedheaders.insecure=true",
         "--api.dashboard=false",
     ], { capture: true });
     if (!commandSucceeded(run)) {

package/dist/index.d.ts

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { type PackageManager } from "./create";
 import { type LocaleDirection } from "./locale";
 import { type DeployDriver } from "./deploy-driver";
 interface ParsedArgs {
@@ -7,7 +6,8 @@ interface ParsedArgs {
     name?: string;
     template?: string;
     dir?: string;
-    pm?: PackageManager;
+    pm?: string;
+    runtime?: string;
     from?: string;
     apply: boolean;
     adopt: boolean;

package/dist/index.js

@@ -41,7 +41,7 @@ Usage:
 Options:
   --template <t> Template to scaffold (see below)
   --dir <path>   Target directory (default: ./<name>)
-  --pm <name>    Package manager: npm | pnpm | yarn (default: npm)
+  --runtime bun  Optional explicit Bun runtime selection
   --name <label> Display name for a locale
   --direction <direction>  Text direction: ltr | rtl (default: ltr)
   --profile <name>         Deployment profile name
@@ -63,7 +63,8 @@ ${(0, templates_1.templateListText)()}
 Example:
   npx @podosoft/podokit create my-app
   npx @podosoft/podokit create my-app --template todo
-  cd my-app && npx @podosoft/podokit add auth
+  bunx --bun @podosoft/podokit create my-app
+  cd my-app && bunx --bun @podosoft/podokit add auth
 `;
 const DEPLOY_HELP = `podo deploy — release an application to Kubernetes or Docker Compose
 
@@ -139,6 +140,9 @@ function parseArgs(argv) {
         else if (arg === "--pm") {
             parsed.pm = argv[++i];
         }
+        else if (arg === "--runtime") {
+            parsed.runtime = argv[++i];
+        }
         else if (arg === "--name") {
             parsed.localeName = argv[++i];
         }
@@ -395,11 +399,13 @@ async function main(argv) {
             const s = (0, inspect_1.status)(process.cwd());
             const tiers = `managed ${s.tiers.managed}, assembled ${s.tiers.assembled}, owned ${s.tiers.owned}`;
             const modules = s.moduleDetails.map((module) => module.version ? `${module.name}@${module.version}` : module.name);
-            process.stdout.write(`PodoKit ${s.podokitVersion}  (template: ${s.template}, ${s.packageManager})\n` +
-                `Modules: ${modules.length ? modules.join(", ") : "(none)"}\n` +
-                `Files:   ${tiers}\n` +
-                `Edited:  ${s.drifted.length} managed file(s)${s.missing.length ? `, ${s.missing.length} missing` : ""}\n` +
-                (s.drifted.length ? s.drifted.map((f) => `  ~ ${f}`).join("\n") + "\n" : ""));
+            process.stdout.write(args.json
+                ? `${JSON.stringify(s, null, 2)}\n`
+                : `PodoKit ${s.podokitVersion}  (template: ${s.template}, ${s.runtime} ${s.runtimeVersion}, ${s.packageManager})\n` +
+                    `Modules: ${modules.length ? modules.join(", ") : "(none)"}\n` +
+                    `Files:   ${tiers}\n` +
+                    `Edited:  ${s.drifted.length} managed file(s)${s.missing.length ? `, ${s.missing.length} missing` : ""}\n` +
+                    (s.drifted.length ? s.drifted.map((f) => `  ~ ${f}`).join("\n") + "\n" : ""));
         }
         catch (err) {
             fail(err.message);
@@ -681,13 +687,13 @@ async function main(argv) {
     }
     const templatesDir = (0, node_path_1.join)(__dirname, "templates");
     try {
-        const resolved = await (0, prompt_1.resolveCreateOptions)({ template: args.template, pm: args.pm }, ask, interactive);
+        const resolved = await (0, prompt_1.resolveCreateOptions)({ template: args.template, pm: args.pm, runtime: args.runtime }, ask, interactive);
         const result = (0, create_1.create)({
             name: args.name,
             templatesDir,
             template: resolved.template,
             targetDir: args.dir,
-            packageManager: resolved.packageManager,
+            runtime: resolved.toolchain.runtime,
             ai: args.ai,
         });
         const relPath = (0, node_path_1.relative)(process.cwd(), result.projectDir) || ".";

package/dist/inspect.d.ts

@@ -7,6 +7,8 @@ export interface StatusReport {
     podokitVersion: string;
     template: string;
     packageManager: string;
+    runtime: string;
+    runtimeVersion: string;
     modules: string[];
     moduleDetails: {
         name: string;
@@ -43,6 +45,6 @@ export declare const SUPPORTED_FRAMEWORKS: Record<string, {
     range: string;
     majors: number[];
 }>;
-/** Parse the leading major from a semver range like `^11.1.0` or `>=1.6.23 <1.7`. */
+/** Parse the leading major from a semver range like `^1.4.29` or `>=1.7.1 <1.8`. */
 export declare function leadingMajor(range: string): number | null;
 export declare function doctor(projectRoot: string): DoctorFinding[];

package/dist/inspect.js

@@ -27,7 +27,9 @@ function status(projectRoot) {
     return {
         podokitVersion: manifest.podokitVersion,
         template: manifest.template,
-        packageManager: manifest.packageManager,
+        packageManager: manifest.toolchain.packageManager,
+        runtime: manifest.toolchain.runtime,
+        runtimeVersion: manifest.toolchain.runtimeVersion,
         modules: manifest.modules.map((m) => m.name),
         moduleDetails: manifest.modules.map((m) => ({
             name: m.name,
@@ -51,8 +53,8 @@ function diff(projectRoot) {
  * `@podosoft/*` extensions still match.
  */
 exports.SUPPORTED_FRAMEWORKS = {
-    "@nestjs/core": { app: "api", range: "^11", majors: [11] },
-    "better-auth": { app: "api", range: ">=1.6.23 <1.7", majors: [1] },
+    elysia: { app: "api", range: "^1.4", majors: [1] },
+    "better-auth": { app: "api", range: ">=1.7.1 <1.8", majors: [1] },
     svelte: { app: "web", range: "^5", majors: [5] },
 };
 function declaredVersion(projectRoot, app, pkg) {
@@ -62,7 +64,7 @@ function declaredVersion(projectRoot, app, pkg) {
     const json = JSON.parse((0, node_fs_1.readFileSync)(file, "utf8"));
     return json.dependencies?.[pkg] ?? json.devDependencies?.[pkg] ?? null;
 }
-/** Parse the leading major from a semver range like `^11.1.0` or `>=1.6.23 <1.7`. */
+/** Parse the leading major from a semver range like `^1.4.29` or `>=1.7.1 <1.8`. */
 function leadingMajor(range) {
     const match = range.match(/(\d+)\./);
     return match ? Number(match[1]) : null;

package/dist/lockfile.d.ts

@@ -1,9 +1,11 @@
+import type { TemplateVars } from "@podosoft/podokit-template-engine";
+import { type Toolchain } from "./toolchain";
 /**
  * The generation lockfile (`.podokit/`) records how a project was assembled so
  * `podo update` can rebuild the same inputs and detect user edits. See
  * ADR-0009 (update mechanism) and ADR-0010 (ownership model).
  */
-export declare const LOCK_SCHEMA_VERSION = 2;
+export declare const LOCK_SCHEMA_VERSION = 3;
 /** File ownership tier. See ADR-0010. */
 export type Tier = "managed" | "assembled" | "owned";
 export interface ManifestModule {
@@ -29,7 +31,8 @@ export interface PodokitManifest {
     schemaVersion: number;
     podokitVersion: string;
     template: string;
-    packageManager: string;
+    /** Runtime and package manager selected for generated and converted projects. */
+    toolchain: Toolchain;
     /** Render vars / prompt answers, replayed on update (copier-style). */
     answers: Record<string, string>;
     modules: ManifestModule[];
@@ -63,6 +66,8 @@ export declare function manifestPath(projectRoot: string): string;
 export declare function filesLockPath(projectRoot: string): string;
 export declare function readManifest(projectRoot: string): PodokitManifest | null;
 export declare function writeManifest(projectRoot: string, manifest: PodokitManifest): void;
+/** Complete replay variables for a Bun-only v1 project. */
+export declare function manifestTemplateVars(manifest: PodokitManifest): TemplateVars;
 export declare function writeFilesLock(projectRoot: string, lock: FilesLock): void;
 /** Read the PodoKit CLI's own version to stamp into the manifest. */
 export declare function podokitVersion(): string;
@@ -89,7 +94,7 @@ export interface Drift {
 export declare function computeDrift(projectRoot: string): Drift;
 export interface InitLockOptions {
     template: string;
-    packageManager: string;
+    toolchain?: Toolchain;
     answers: Record<string, string>;
     version?: string;
     ownedGlobs?: string[];