@podosoft/podokit 1.3.0 → 1.4.1

package/dist/templates/fullstack/apps/web/src/error.html

@@ -0,0 +1,73 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="color-scheme" content="light dark" />
+    <title>%sveltekit.status% %sveltekit.error.message%</title>
+    <!-- SvelteKit serves this page when the root layout or a server hook fails,
+         so it cannot use the app's styles, scripts, assets, or components. It
+         fills in only the status and the HTML-escaped error message. -->
+    <style>
+      :root {
+        --background: oklch(1 0 0);
+        --foreground: oklch(0.141 0.005 285.823);
+        --muted-foreground: oklch(0.552 0.016 285.938);
+        --border: oklch(0.92 0.004 286.32);
+      }
+
+      @media (prefers-color-scheme: dark) {
+        :root {
+          --background: oklch(0.141 0.005 285.823);
+          --foreground: oklch(0.985 0 0);
+          --muted-foreground: oklch(0.705 0.015 286.067);
+          --border: oklch(1 0 0 / 15%);
+        }
+      }
+
+      body {
+        box-sizing: border-box;
+        display: grid;
+        min-height: 100vh;
+        margin: 0;
+        padding: 1.5rem;
+        place-items: center;
+        background: var(--background);
+        color: var(--foreground);
+        font-family: ui-sans-serif, system-ui, sans-serif;
+        line-height: 1.5;
+      }
+
+      main {
+        display: flex;
+        align-items: center;
+        gap: 1rem;
+        max-width: 32rem;
+      }
+
+      .status {
+        margin: 0;
+        color: var(--muted-foreground);
+        font-size: 2.25rem;
+        font-variant-numeric: tabular-nums;
+        font-weight: 600;
+        line-height: 1;
+      }
+
+      h1 {
+        margin: 0;
+        padding-left: 1rem;
+        border-left: 1px solid var(--border);
+        font-size: 1rem;
+        font-weight: 500;
+        overflow-wrap: anywhere;
+      }
+    </style>
+  </head>
+  <body>
+    <main>
+      <p class="status">%sveltekit.status%</p>
+      <h1>%sveltekit.error.message%</h1>
+    </main>
+  </body>
+</html>

package/dist/templates/fullstack/apps/web/src/lib/components/ui/textarea/index.ts

@@ -0,0 +1,7 @@
+import Root from "./textarea.svelte";
+
+export {
+	Root,
+	//
+	Root as Textarea,
+};

package/dist/templates/fullstack/apps/web/src/lib/components/ui/textarea/textarea.svelte

@@ -0,0 +1,22 @@
+<script lang="ts">
+	import { cn, type WithElementRef, type WithoutChildren } from "#lib/utils.js";
+	import type { HTMLTextareaAttributes } from "svelte/elements";
+
+	let {
+		ref = $bindable(null),
+		value = $bindable(),
+		class: className,
+		"data-slot": dataSlot = "textarea",
+		...restProps
+	}: WithoutChildren<WithElementRef<HTMLTextareaAttributes>> = $props();
+</script>
+
+<textarea
+	bind:this={ref}
+	data-slot={dataSlot}
+	class={cn(
+		"border-input dark:bg-input/30 focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:aria-invalid:border-destructive/50 disabled:bg-input/50 dark:disabled:bg-input/80 rounded-lg border bg-transparent px-2.5 py-2 text-base transition-colors focus-visible:ring-3 aria-invalid:ring-3 md:text-sm flex field-sizing-content min-h-16 w-full outline-none placeholder:text-muted-foreground disabled:cursor-not-allowed disabled:opacity-50",
+		className
+	)}
+	bind:value
+	{...restProps}></textarea>

package/dist/templates/fullstack/apps/web/src/lib/server/backend-proxy.test.ts

@@ -2,7 +2,15 @@ import { createServer } from "node:http";
 import type { AddressInfo } from "node:net";
 import { gzipSync } from "node:zlib";
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { proxyRequest, rawSubpath, resolveClientIp } from "./backend-proxy";
+import {
+  bodyLimitFor,
+  IN_MEMORY_RESPONSE_BYTES,
+  proxyRequest,
+  rawSubpath,
+  resolveClientIp,
+  sortedBodyLimits,
+  withAppHeaders,
+} from "./backend-proxy";
 
 describe("backend proxy client address handling", () => {
   afterEach(() => {
@@ -173,6 +181,47 @@ describe("backend proxy client address handling", () => {
     expect(await response.text()).toBe("0123456789");
   });
 
+  it("reads a body of known, modest size before relaying it, so Bun keeps its length", async () => {
+    let pulls = 0;
+    vi.stubGlobal("fetch", async () => new Response(new ReadableStream<Uint8Array>({
+      pull(controller): void {
+        pulls += 1;
+        controller.enqueue(new TextEncoder().encode("0123456789"));
+        controller.close();
+      },
+    }, { highWaterMark: 0 }), { headers: { "content-length": "10" } }));
+
+    const response = await proxyRequest(
+      new Request("http://app.localhost/api/profile-images/a.png"),
+      "http://api:5002/profile-images/a.png",
+    );
+
+    expect(pulls).toBe(1);
+    expect(response.headers.get("content-length")).toBe("10");
+    expect(await response.text()).toBe("0123456789");
+  });
+
+  it("streams a larger body through without reading it first", async () => {
+    const size = IN_MEMORY_RESPONSE_BYTES + 1;
+    let pulls = 0;
+    vi.stubGlobal("fetch", async () => new Response(new ReadableStream<Uint8Array>({
+      pull(controller): void {
+        pulls += 1;
+        controller.enqueue(new Uint8Array(size));
+        controller.close();
+      },
+    }, { highWaterMark: 0 }), { headers: { "content-length": String(size) } }));
+
+    const response = await proxyRequest(
+      new Request("http://app.localhost/api/storage/large"),
+      "http://api:5002/storage/large",
+    );
+
+    expect(pulls).toBe(0);
+    expect(response.headers.get("content-length")).toBe(String(size));
+    expect((await response.arrayBuffer()).byteLength).toBe(size);
+  });
+
   it("drops content-length when the upstream body was compressed", async () => {
     vi.stubGlobal("fetch", async () => new Response("decoded body", {
       headers: { "content-encoding": "gzip", "content-length": "4" },
@@ -289,3 +338,229 @@ describe("backend proxy raw path", () => {
     expect(rawSubpath(new URL("http://localhost/other"), "/api/")).toBe("/other");
   });
 });
+
+describe("backend proxy application header lists", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.doUnmock("./proxy-headers");
+    vi.resetModules();
+  });
+
+  async function proxyWithAppHeaders(request: string[], response: string[]): Promise<typeof proxyRequest> {
+    vi.resetModules();
+    vi.doMock("./proxy-headers", () => ({
+      APP_FORWARDED_REQUEST_HEADERS: request,
+      APP_RELAYED_RESPONSE_HEADERS: response,
+    }));
+    return (await import("./backend-proxy")).proxyRequest;
+  }
+
+  it("forwards and relays the headers an application lists", async () => {
+    const proxy = await proxyWithAppHeaders(["X-API-Key", "mcp-session-id"], ["X-Checksum-SHA256", "www-authenticate"]);
+    let upstreamHeaders: Headers | undefined;
+    vi.stubGlobal("fetch", async (_input: RequestInfo | URL, init?: RequestInit) => {
+      upstreamHeaders = new Headers(init?.headers);
+      return new Response(null, {
+        status: 401,
+        headers: {
+          "x-checksum-sha256": "abc123",
+          "www-authenticate": "Bearer",
+          "x-internal-trace": "hidden",
+        },
+      });
+    });
+
+    const response = await proxy(
+      new Request("http://app.localhost/api/documents/1", {
+        headers: { "x-api-key": "key", "mcp-session-id": "s1", "x-unlisted": "dropped" },
+      }),
+      "http://api:5002/documents/1",
+    );
+
+    expect(upstreamHeaders?.get("x-api-key")).toBe("key");
+    expect(upstreamHeaders?.get("mcp-session-id")).toBe("s1");
+    expect(upstreamHeaders?.get("x-unlisted")).toBeNull();
+    expect(response.headers.get("x-checksum-sha256")).toBe("abc123");
+    expect(response.headers.get("www-authenticate")).toBe("Bearer");
+    expect(response.headers.get("x-internal-trace")).toBeNull();
+  });
+
+  it("drops application headers that no list names", async () => {
+    const proxy = await proxyWithAppHeaders([], []);
+    let upstreamHeaders: Headers | undefined;
+    vi.stubGlobal("fetch", async (_input: RequestInfo | URL, init?: RequestInit) => {
+      upstreamHeaders = new Headers(init?.headers);
+      return new Response(null, { status: 204, headers: { "x-checksum-sha256": "abc123" } });
+    });
+
+    const response = await proxy(
+      new Request("http://app.localhost/api/documents/1", { headers: { "x-api-key": "key" } }),
+      "http://api:5002/documents/1",
+    );
+
+    expect(upstreamHeaders?.get("x-api-key")).toBeNull();
+    expect(response.headers.get("x-checksum-sha256")).toBeNull();
+  });
+
+  it("refuses to load with a reserved or invalid application header", async () => {
+    await expect(proxyWithAppHeaders(["x-forwarded-for"], [])).rejects.toThrow(
+      'APP_FORWARDED_REQUEST_HEADERS cannot contain "x-forwarded-for"',
+    );
+    await expect(proxyWithAppHeaders([], ["Set-Cookie"])).rejects.toThrow(
+      'APP_RELAYED_RESPONSE_HEADERS cannot contain "set-cookie"',
+    );
+  });
+
+  it("lowercases, deduplicates, and validates application names", () => {
+    const reserved = new Set(["host", "transfer-encoding"]);
+    expect(withAppHeaders(["accept", "etag"], ["ETag", "X-Trace", "x-trace"], reserved, "LIST")).toEqual([
+      "accept",
+      "etag",
+      "x-trace",
+    ]);
+    expect(() => withAppHeaders([], ["Transfer-Encoding"], reserved, "LIST")).toThrow(
+      'LIST cannot contain "transfer-encoding"',
+    );
+    expect(() => withAppHeaders([], ["x trace"], reserved, "LIST")).toThrow(
+      'LIST contains an invalid header name: "x trace"',
+    );
+    expect(() => withAppHeaders([], [""], reserved, "LIST")).toThrow("invalid header name");
+  });
+});
+
+describe("backend proxy application body limits", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.doUnmock("./body-limits");
+    vi.resetModules();
+  });
+
+  async function proxyWithBodyLimits(
+    limits: ReadonlyArray<{ pathPrefix: string; maxBytes: number }>,
+  ): Promise<typeof proxyRequest> {
+    vi.resetModules();
+    vi.doMock("./body-limits", () => ({ APP_BODY_LIMITS: limits }));
+    return (await import("./backend-proxy")).proxyRequest;
+  }
+
+  function recordingFetch(): { bodies: Uint8Array[] } {
+    const record = { bodies: [] as Uint8Array[] };
+    vi.stubGlobal("fetch", async (_input: RequestInfo | URL, init?: RequestInit) => {
+      record.bodies.push(new Uint8Array(await new Response(init?.body).arrayBuffer()));
+      return new Response(null, { status: 204 });
+    });
+    return record;
+  }
+
+  // A body without content-length, as a chunked upload arrives.
+  function streamedRequest(url: string, chunks: number, chunkSize: number): { request: Request; pulled: () => number } {
+    let pulled = 0;
+    const stream = new ReadableStream<Uint8Array>({
+      pull(controller) {
+        if (pulled === chunks) {
+          controller.close();
+          return;
+        }
+        pulled += 1;
+        controller.enqueue(new Uint8Array(chunkSize).fill(pulled));
+      },
+    });
+    const init = { method: "POST", body: stream, duplex: "half" } as RequestInit;
+    return { request: new Request(url, init), pulled: () => pulled };
+  }
+
+  it("rejects a declared body above the route limit before contacting the API", async () => {
+    const proxy = await proxyWithBodyLimits([{ pathPrefix: "/api/feedback/", maxBytes: 8 }]);
+    const record = recordingFetch();
+
+    const response = await proxy(
+      new Request("http://app.localhost/api/feedback/new", { method: "POST", body: "0123456789" }),
+      "http://api:5002/feedback/new",
+    );
+
+    expect(response.status).toBe(413);
+    const envelope = (await response.json()) as {
+      success: boolean;
+      error: { code: string; statusCode: number; path: string; details: { maxBytes: number } };
+    };
+    expect(envelope.success).toBe(false);
+    expect(envelope.error).toMatchObject({
+      code: "PAYLOAD_TOO_LARGE",
+      statusCode: 413,
+      path: "/api/feedback/new",
+      details: { maxBytes: 8 },
+    });
+    expect(record.bodies).toEqual([]);
+  });
+
+  it("stops reading a streamed body once it passes the limit", async () => {
+    const proxy = await proxyWithBodyLimits([{ pathPrefix: "/api/feedback", maxBytes: 10 }]);
+    const record = recordingFetch();
+    const { request, pulled } = streamedRequest("http://app.localhost/api/feedback", 100, 4);
+
+    const response = await proxy(request, "http://api:5002/feedback");
+
+    expect(response.status).toBe(413);
+    expect(record.bodies).toEqual([]);
+    expect(pulled()).toBeLessThan(10);
+  });
+
+  it("forwards a body within the limit byte-for-byte", async () => {
+    const proxy = await proxyWithBodyLimits([{ pathPrefix: "/api/feedback/", maxBytes: 12 }]);
+    const record = recordingFetch();
+    const { request } = streamedRequest("http://app.localhost/api/feedback/new", 3, 4);
+
+    const response = await proxy(request, "http://api:5002/feedback/new");
+
+    expect(response.status).toBe(204);
+    expect([...(record.bodies[0] ?? [])]).toEqual([1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3]);
+  });
+
+  it("leaves routes without a limit to the server-wide ceiling", async () => {
+    const proxy = await proxyWithBodyLimits([{ pathPrefix: "/api/feedback/", maxBytes: 1 }]);
+    const record = recordingFetch();
+
+    const response = await proxy(
+      new Request("http://app.localhost/api/feedbacks", { method: "POST", body: "0123456789" }),
+      "http://api:5002/feedbacks",
+    );
+
+    expect(response.status).toBe(204);
+    expect(record.bodies[0]?.byteLength).toBe(10);
+  });
+
+  it("applies the longest matching prefix on the decoded path", () => {
+    const limits = sortedBodyLimits([
+      { pathPrefix: "/api/", maxBytes: 100 },
+      { pathPrefix: "/api/files/uploads/", maxBytes: 10 },
+      { pathPrefix: "/api/files", maxBytes: 50 },
+    ]);
+
+    expect(bodyLimitFor("/api/files/uploads/u1/parts/2", limits)).toBe(10);
+    expect(bodyLimitFor("/api/files/uploads", limits)).toBe(10);
+    expect(bodyLimitFor("/api/files/u1", limits)).toBe(50);
+    expect(bodyLimitFor("/api/filesystem", limits)).toBe(100);
+    expect(bodyLimitFor("/api/%66iles/uploads/u1", limits)).toBe(10);
+    expect(bodyLimitFor("/api/files%2Fuploads/u1", limits)).toBe(10);
+    expect(bodyLimitFor("/api/files/%E0%A4%A", limits)).toBe(50);
+    expect(bodyLimitFor("/other", limits)).toBeUndefined();
+  });
+
+  it.each<[{ pathPrefix: string; maxBytes: number }[], string]>([
+    [[{ pathPrefix: "/feedback/", maxBytes: 10 }], "must be a static path under /api/"],
+    [[{ pathPrefix: "/api/files/*", maxBytes: 10 }], "must be a static path under /api/"],
+    [[{ pathPrefix: "/api//files", maxBytes: 10 }], "must be a static path under /api/"],
+    [[{ pathPrefix: "/api/files/../admin", maxBytes: 10 }], "must be a static path under /api/"],
+    [[{ pathPrefix: "/api/files", maxBytes: 0 }], "positive whole number"],
+    [[{ pathPrefix: "/api/files", maxBytes: 1.5 }], "positive whole number"],
+    [[{ pathPrefix: "/api/files", maxBytes: 10 }, { pathPrefix: "/api/files/", maxBytes: 20 }], "more than once"],
+  ])("rejects an invalid body limit list %#", (limits, message) => {
+    expect(() => sortedBodyLimits(limits)).toThrow(message);
+  });
+
+  it("refuses to load with an invalid application body limit", async () => {
+    await expect(proxyWithBodyLimits([{ pathPrefix: "/upload", maxBytes: 10 }])).rejects.toThrow(
+      "APP_BODY_LIMITS pathPrefix must be a static path under /api/",
+    );
+  });
+});

package/dist/templates/fullstack/apps/web/src/lib/server/backend-proxy.ts

@@ -1,6 +1,10 @@
+import { APP_BODY_LIMITS } from "./body-limits";
+import { APP_FORWARDED_REQUEST_HEADERS, APP_RELAYED_RESPONSE_HEADERS } from "./proxy-headers";
+
 // Server-side proxy boundary. The browser never talks to the API directly:
 // requests go through SvelteKit server routes, which forward an allowlist of
 // headers to BACKEND_INTERNAL_URL and relay the response (including Set-Cookie).
+// Applications add their own header names in the app-owned proxy-headers.ts.
 //
 // `user-agent` is on the list for the same reason the client IP is forwarded
 // below: better-auth records it on the session and the account page shows it as
@@ -39,6 +43,171 @@ const RELAYED_RESPONSE_HEADERS = [
   "x-next-cursor",
 ];
 
+// Hop-by-hop headers describe a single connection, and the proxy sets framing,
+// cookies, and the client address itself, so application lists cannot add these.
+const HOP_BY_HOP_HEADERS = [
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "proxy-connection",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+];
+const RESERVED_REQUEST_HEADERS = new Set([
+  ...HOP_BY_HOP_HEADERS,
+  "host",
+  "content-length",
+  "forwarded",
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-port",
+  "x-forwarded-proto",
+  "x-real-ip",
+]);
+const RESERVED_RESPONSE_HEADERS = new Set([
+  ...HOP_BY_HOP_HEADERS,
+  "content-length",
+  "content-encoding",
+  "set-cookie",
+]);
+const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9a-z-]+$/;
+/** Larger response bodies stream through; smaller ones are relayed with their length. */
+export const IN_MEMORY_RESPONSE_BYTES = 2 * 1024 * 1024;
+
+/** Append an application's header names to a built-in list, lowercased and
+ *  without duplicates. Throws on an invalid or reserved name so a mistake fails
+ *  the build instead of silently dropping the header. */
+export function withAppHeaders(
+  builtIn: readonly string[],
+  app: readonly string[],
+  reserved: ReadonlySet<string>,
+  listName: string,
+): string[] {
+  const names = new Set(builtIn);
+  for (const entry of app) {
+    const name = entry.toLowerCase();
+    if (!HEADER_NAME.test(name)) {
+      throw new Error(`${listName} contains an invalid header name: ${JSON.stringify(entry)}`);
+    }
+    if (reserved.has(name)) {
+      throw new Error(`${listName} cannot contain "${name}": the proxy handles that header itself.`);
+    }
+    names.add(name);
+  }
+  return [...names];
+}
+
+const forwardedHeaders = withAppHeaders(
+  FORWARDED_HEADERS,
+  APP_FORWARDED_REQUEST_HEADERS,
+  RESERVED_REQUEST_HEADERS,
+  "APP_FORWARDED_REQUEST_HEADERS",
+);
+const relayedResponseHeaders = withAppHeaders(
+  RELAYED_RESPONSE_HEADERS,
+  APP_RELAYED_RESPONSE_HEADERS,
+  RESERVED_RESPONSE_HEADERS,
+  "APP_RELAYED_RESPONSE_HEADERS",
+);
+
+export interface BodyLimit {
+  pathPrefix: string;
+  maxBytes: number;
+}
+
+const BODY_LIMIT_PREFIX = /^\/api(?:\/[A-Za-z0-9._~!$&'()+,;=:@-]+)*\/?$/;
+
+/** Validate application body limits and order them so the longest prefix
+ *  matches first. Prefixes are stored without a trailing slash. */
+export function sortedBodyLimits(limits: ReadonlyArray<BodyLimit>): BodyLimit[] {
+  const seen = new Set<string>();
+  const sorted = limits.map(({ pathPrefix, maxBytes }) => {
+    if (
+      !BODY_LIMIT_PREFIX.test(pathPrefix) ||
+      pathPrefix.split("/").some((segment) => segment === "." || segment === "..")
+    ) {
+      throw new Error(
+        `APP_BODY_LIMITS pathPrefix must be a static path under /api/, such as "/api/feedback/": ${JSON.stringify(pathPrefix)}`,
+      );
+    }
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) {
+      throw new Error(`APP_BODY_LIMITS maxBytes for ${pathPrefix} must be a positive whole number of bytes.`);
+    }
+    const base = pathPrefix.endsWith("/") ? pathPrefix.slice(0, -1) : pathPrefix;
+    if (seen.has(base)) throw new Error(`APP_BODY_LIMITS lists ${pathPrefix} more than once.`);
+    seen.add(base);
+    return { pathPrefix: base, maxBytes };
+  });
+  return sorted.sort((left, right) => right.pathPrefix.length - left.pathPrefix.length);
+}
+
+const bodyLimits = sortedBodyLimits(APP_BODY_LIMITS);
+
+/** The body limit for a request path, matched on the decoded path so an encoded
+ *  segment cannot step around a prefix. */
+export function bodyLimitFor(pathname: string, limits: readonly BodyLimit[] = bodyLimits): number | undefined {
+  let path = pathname;
+  try {
+    path = decodeURIComponent(pathname);
+  } catch {
+    // Keep the raw path when it holds a malformed escape.
+  }
+  return limits.find(
+    ({ pathPrefix }) => path === pathPrefix || path.startsWith(`${pathPrefix}/`),
+  )?.maxBytes;
+}
+
+/** Read a request body, or return null as soon as it exceeds maxBytes. The rest
+ *  of an oversized body is never buffered. */
+async function readLimitedBody(request: Request, maxBytes: number): Promise<ArrayBuffer | null> {
+  const declared = request.headers.get("content-length");
+  if (declared !== null && Number(declared) > maxBytes) {
+    request.body?.cancel().catch(() => undefined);
+    return null;
+  }
+  if (!request.body) return new ArrayBuffer(0);
+  const reader = request.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > maxBytes) {
+      reader.cancel().catch(() => undefined);
+      return null;
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return body.buffer;
+}
+
+function payloadTooLarge(path: string, maxBytes: number): Response {
+  return Response.json(
+    {
+      success: false,
+      error: {
+        code: "PAYLOAD_TOO_LARGE",
+        message: `Request body exceeds the ${maxBytes}-byte limit for this route`,
+        statusCode: 413,
+        path,
+        timestamp: new Date().toISOString(),
+        details: { maxBytes },
+      },
+    },
+    { status: 413 },
+  );
+}
+
 // SvelteKit decodes rest params, so an encoded "%2F" or "%3F" inside a path
 // segment would reach the API as "/" or "?". Forward the raw pathname instead.
 export function rawSubpath(url: URL, prefix: string): string {
@@ -75,7 +244,7 @@ export async function proxyRequest(
   clientAddress?: string,
 ): Promise<Response> {
   const headers = new Headers();
-  for (const name of FORWARDED_HEADERS) {
+  for (const name of forwardedHeaders) {
     const value = request.headers.get(name);
     if (value) headers.set(name, value);
   }
@@ -84,12 +253,24 @@ export async function proxyRequest(
   if (forwardedIp) headers.set("x-forwarded-for", forwardedIp);
 
   const hasBody = request.method !== "GET" && request.method !== "HEAD";
+  let body: ArrayBuffer | undefined;
+  if (hasBody) {
+    // Preserve multipart uploads and other binary bodies byte-for-byte. Reading
+    // them as text corrupts bytes that are not valid UTF-8 before forwarding.
+    const { pathname } = new URL(request.url);
+    const maxBytes = bodyLimitFor(pathname);
+    if (maxBytes === undefined) {
+      body = await request.arrayBuffer();
+    } else {
+      const limited = await readLimitedBody(request, maxBytes);
+      if (limited === null) return payloadTooLarge(pathname, maxBytes);
+      body = limited;
+    }
+  }
   const upstream = await fetch(targetUrl, {
     method: request.method,
     headers,
-    // Preserve multipart uploads and other binary bodies byte-for-byte. Reading
-    // them as text corrupts bytes that are not valid UTF-8 before forwarding.
-    body: hasBody ? await request.arrayBuffer() : undefined,
+    body,
     redirect: "manual",
     // Abort the upstream request when the browser disconnects. Without this, every
     // closed EventSource or aborted request keeps its API socket open until Bun's
@@ -98,20 +279,24 @@ export async function proxyRequest(
   });
 
   const responseHeaders = new Headers();
-  for (const name of RELAYED_RESPONSE_HEADERS) {
+  for (const name of relayedResponseHeaders) {
     const value = upstream.headers.get(name);
     if (value) responseHeaders.set(name, value);
   }
   // Bun's fetch decodes a compressed body but keeps the upstream content-encoding
   // and compressed content-length, which would truncate the decoded body.
   const contentLength = upstream.headers.get("content-length");
-  if (contentLength && !upstream.headers.has("content-encoding")) {
-    responseHeaders.set("content-length", contentLength);
-  }
+  const relayedLength = contentLength && !upstream.headers.has("content-encoding") ? contentLength : null;
+  if (relayedLength) responseHeaders.set("content-length", relayedLength);
   // Relay Set-Cookie so auth session cookies reach the browser.
   for (const cookie of upstream.headers.getSetCookie()) {
     responseHeaders.append("set-cookie", cookie);
   }
 
-  return new Response(upstream.body, { status: upstream.status, headers: responseHeaders });
+  // Bun sends a streamed body with chunked encoding and drops its content-length
+  // unless the body is in memory, so a body of modest, known size is read first.
+  const relayedBody = relayedLength && upstream.body && Number(relayedLength) <= IN_MEMORY_RESPONSE_BYTES
+    ? await upstream.arrayBuffer()
+    : upstream.body;
+  return new Response(relayedBody, { status: upstream.status, headers: responseHeaders });
 }

package/dist/templates/fullstack/apps/web/src/lib/server/body-limits.ts

@@ -0,0 +1,15 @@
+/**
+ * Application-owned request body limits for /api requests that the web server
+ * proxies to the API. An entry caps the body of every request whose path is
+ * pathPrefix or below it, for example
+ *   { pathPrefix: "/api/feedback/", maxBytes: 64 * 1024 }
+ * and the longest matching prefix wins. Above the limit the proxy stops reading
+ * and answers 413 PAYLOAD_TOO_LARGE without contacting the API.
+ *
+ * BODY_SIZE_LIMIT remains the ceiling for every web route: Bun rejects a larger
+ * body before this code runs, so a maxBytes above it has no effect. Routes that
+ * need more belong in the gateway's direct API paths (apiPaths in
+ * .podokit/dev.json and the deployment profile), which bypass the web server.
+ * PodoKit creates this file once and never overwrites it.
+ */
+export const APP_BODY_LIMITS: ReadonlyArray<{ pathPrefix: string; maxBytes: number }> = [];

package/dist/templates/fullstack/apps/web/src/lib/server/proxy-headers.ts

@@ -0,0 +1,12 @@
+/**
+ * Application-owned header names that the managed /api proxy (backend-proxy.ts)
+ * passes through in addition to its built-in lists. Names are case-insensitive.
+ * Request headers listed here are forwarded from the browser to the API, such as
+ * "x-api-key" for machine clients; response headers are relayed from the API to
+ * the browser, such as "x-checksum-sha256". The proxy handles hop-by-hop headers,
+ * host, content-length, content-encoding, set-cookie, and the forwarding headers
+ * that carry the client address itself, so a listed one fails the build.
+ * PodoKit creates this file once and never overwrites it.
+ */
+export const APP_FORWARDED_REQUEST_HEADERS: readonly string[] = [];
+export const APP_RELAYED_RESPONSE_HEADERS: readonly string[] = [];