@podosoft/podokit 1.5.0 → 1.6.1

package/dist/deploy-schema.d.ts

@@ -1,3 +1,4 @@
+import type { AppProxyTimeout, AppProxyTimeouts } from "./app-proxy-timeouts";
 /**
  * Validation primitives shared by every deployment driver.
  *
@@ -30,6 +31,23 @@ export declare const SENSITIVE_KEY: RegExp;
 export declare const STABLE_SEMVER_TAG_PATTERN = "^v(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$";
 /** Keys PodoKit derives itself, so a profile may not set them. */
 export declare const MANAGED_RUNTIME_CONFIG_KEYS: string[];
+/**
+ * Keys that decide which forwarded address web and API record. They follow from
+ * the proxies in front of the deployment, so a profile states that one number and
+ * PodoKit renders the four values that agree with it.
+ */
+export declare const CLIENT_ADDRESS_KEYS: string[];
+export declare function parseEdgeProxies(exposure: Record<string, unknown>, fallback: number): number;
+/**
+ * What the web server and the API trust, given how many proxies each request to
+ * the web server has passed. Behind at least one, the web server takes its origin
+ * from X-Forwarded-Proto and X-Forwarded-Host and the client from the
+ * X-Forwarded-For entry the outermost trusted proxy wrote (XFF_DEPTH); with none
+ * it trusts no forwarded header. It forwards that one address to the API, so the
+ * API always trusts one hop: the web proxy, the Compose gateway, or an Ingress
+ * that trusts no proxy in front of it.
+ */
+export declare function proxyTrustConfig(webProxyHops: number, trustForwardedOrigin?: boolean): Record<string, string>;
 export declare function containsUrlCredentials(value: string): boolean;
 export declare function isRecord(value: unknown): value is Record<string, unknown>;
 export declare function assertOnlyKeys(value: Record<string, unknown>, allowed: string[], field: string): void;
@@ -50,13 +68,53 @@ export declare function validateImage(value: string, field: string): void;
 export declare function validateImageRepository(value: string, field: string): void;
 export declare function parseReleaseProfile(release: Record<string, unknown>): ReleaseProfile;
 export declare function parseRuntimeConfig(runtimeConfig: Record<string, unknown>): Record<string, string>;
+/**
+ * An application-owned PostgreSQL pool each API or worker process opens beside
+ * PodoKit's own. Either `sizeKey` names the runtimeConfig key that caps it, or
+ * `size` is the cap the application's code sets, such as a driver's default.
+ * `extraConnections` counts connections it opens beyond that cap, such as one to
+ * check a server that stopped answering.
+ */
+export type AppConnectionPool = {
+    sizeKey: string;
+    extraConnections: number;
+} | {
+    size: number;
+    extraConnections: number;
+};
+/** What the connection budget needs to know about the database, beyond its mode. */
+export interface PostgresBudgetProfile {
+    /** The server's max_connections; PodoKit sets it on a database it runs. */
+    maxConnections?: number;
+    appPools?: AppConnectionPool[];
+}
+export declare function parsePostgresBudget(value: Record<string, unknown>, field: string, runtimeConfig: Record<string, string>): PostgresBudgetProfile;
+/** Bun closes silent connections on a 4-second tick, up to 4 seconds before their idle timeout. */
+export declare const IDLE_TICK_SECONDS = 4;
+export declare const MAX_IDLE_TIMEOUT_SECONDS = 255;
+export declare const IDLE_TIMEOUT_KEYS: readonly ["CONNECTION_IDLE_TIMEOUT", "API_IDLE_TIMEOUT"];
+/** The longest the /api proxy waits for response headers, and what sets it. */
+export interface LongestProxyWait {
+    /** Milliseconds, or null for a route without a deadline. */
+    timeoutMs: number | null;
+    source: string;
+}
+/**
+ * BACKEND_PROXY_TIMEOUT_MS, or the application's longest APP_PROXY_TIMEOUTS
+ * entry when that waits longer; an entry without a deadline wins outright.
+ */
+export declare function longestProxyWait(runtimeConfig: Record<string, string>, entries: AppProxyTimeout[]): LongestProxyWait;
+export declare function describeProxyWait(wait: LongestProxyWait): string;
+/** Whether an idle timeout keeps a silent connection open for the whole wait. */
+export declare function idleTimeoutCovers(seconds: number, wait: LongestProxyWait): boolean;
 /**
  * The idle timeouts of the web server (CONNECTION_IDLE_TIMEOUT) and the API
  * (API_IDLE_TIMEOUT), both run by Bun. Each is the profile's own value, or else
  * the fewest seconds that keep a silent connection open past the /api proxy's
- * BACKEND_PROXY_TIMEOUT_MS deadline: 35 for the default 30000 ms.
+ * longest wait: 35 for the default 30000 ms, and 0 (off) when an application
+ * route has no deadline.
  */
-export declare function idleTimeoutConfig(runtimeConfig: Record<string, string>): Record<string, string>;
+export declare function idleTimeoutConfig(runtimeConfig: Record<string, string>, proxyTimeouts: AppProxyTimeouts): Record<string, string>;
 export declare function validateHttpsOrigin(value: string): void;
 export declare function parseVerification(verification: Record<string, unknown>): VerificationProfile;
 export declare function profileDirectory(projectRoot: string): string;

package/dist/deploy-schema.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MANAGED_RUNTIME_CONFIG_KEYS = exports.STABLE_SEMVER_TAG_PATTERN = exports.SENSITIVE_KEY = exports.DNS_LABEL = exports.PROFILE_NAME = void 0;
+exports.IDLE_TIMEOUT_KEYS = exports.MAX_IDLE_TIMEOUT_SECONDS = exports.IDLE_TICK_SECONDS = exports.CLIENT_ADDRESS_KEYS = exports.MANAGED_RUNTIME_CONFIG_KEYS = exports.STABLE_SEMVER_TAG_PATTERN = exports.SENSITIVE_KEY = exports.DNS_LABEL = exports.PROFILE_NAME = void 0;
+exports.parseEdgeProxies = parseEdgeProxies;
+exports.proxyTrustConfig = proxyTrustConfig;
 exports.containsUrlCredentials = containsUrlCredentials;
 exports.isRecord = isRecord;
 exports.assertOnlyKeys = assertOnlyKeys;
@@ -17,6 +19,10 @@ exports.validateImage = validateImage;
 exports.validateImageRepository = validateImageRepository;
 exports.parseReleaseProfile = parseReleaseProfile;
 exports.parseRuntimeConfig = parseRuntimeConfig;
+exports.parsePostgresBudget = parsePostgresBudget;
+exports.longestProxyWait = longestProxyWait;
+exports.describeProxyWait = describeProxyWait;
+exports.idleTimeoutCovers = idleTimeoutCovers;
 exports.idleTimeoutConfig = idleTimeoutConfig;
 exports.validateHttpsOrigin = validateHttpsOrigin;
 exports.parseVerification = parseVerification;
@@ -36,6 +42,38 @@ exports.MANAGED_RUNTIME_CONFIG_KEYS = [
     "PROTOCOL_HEADER",
     "HOST_HEADER",
 ];
+/**
+ * Keys that decide which forwarded address web and API record. They follow from
+ * the proxies in front of the deployment, so a profile states that one number and
+ * PodoKit renders the four values that agree with it.
+ */
+exports.CLIENT_ADDRESS_KEYS = ["ADDRESS_HEADER", "XFF_DEPTH", "TRUSTED_PROXY_HOPS", "TRUSTED_PROXY_HEADER"];
+/** Edge proxies are counted, not configured; more than this is a typo. */
+const MAX_EDGE_PROXIES = 8;
+function parseEdgeProxies(exposure, fallback) {
+    const value = exposure.edgeProxies ?? fallback;
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > MAX_EDGE_PROXIES) {
+        throw new Error(`Deployment profile field "exposure.edgeProxies" must be an integer from 0 to ${MAX_EDGE_PROXIES}.`);
+    }
+    return value;
+}
+/**
+ * What the web server and the API trust, given how many proxies each request to
+ * the web server has passed. Behind at least one, the web server takes its origin
+ * from X-Forwarded-Proto and X-Forwarded-Host and the client from the
+ * X-Forwarded-For entry the outermost trusted proxy wrote (XFF_DEPTH); with none
+ * it trusts no forwarded header. It forwards that one address to the API, so the
+ * API always trusts one hop: the web proxy, the Compose gateway, or an Ingress
+ * that trusts no proxy in front of it.
+ */
+function proxyTrustConfig(webProxyHops, trustForwardedOrigin = webProxyHops > 0) {
+    return {
+        ...(trustForwardedOrigin ? { PROTOCOL_HEADER: "x-forwarded-proto", HOST_HEADER: "x-forwarded-host" } : {}),
+        ...(webProxyHops > 0 ? { ADDRESS_HEADER: "x-forwarded-for", XFF_DEPTH: String(webProxyHops) } : {}),
+        TRUSTED_PROXY_HOPS: "1",
+        TRUSTED_PROXY_HEADER: "x-forwarded-for",
+    };
+}
 /** Keys the generated API no longer reads; it refuses to start while they are set. */
 const RENAMED_RUNTIME_CONFIG_KEYS = {
     RATE_LIMIT_TRUSTED_PROXY_HOPS: "TRUSTED_PROXY_HOPS",
@@ -189,6 +227,10 @@ function parseRuntimeConfig(runtimeConfig) {
         if (exports.MANAGED_RUNTIME_CONFIG_KEYS.includes(key)) {
             throw new Error(`Deployment runtimeConfig key "${key}" is managed by PodoKit.`);
         }
+        if (exports.CLIENT_ADDRESS_KEYS.includes(key)) {
+            throw new Error(`Deployment runtimeConfig key "${key}" is derived from exposure.edgeProxies, the number of reverse ` +
+                "proxies in front of the deployment; remove it and set exposure.edgeProxies instead.");
+        }
         const renamed = RENAMED_RUNTIME_CONFIG_KEYS[key];
         if (renamed) {
             throw new Error(`Deployment runtimeConfig key "${key}" was renamed to "${renamed}".`);
@@ -203,33 +245,118 @@ function parseRuntimeConfig(runtimeConfig) {
     }
     return parsed;
 }
+/** PostgreSQL's own ceiling for max_connections. */
+const MAX_POSTGRES_CONNECTIONS = 262_143;
+/** Pools whose sizes the connection budget already reads. */
+const PODOKIT_POOL_KEYS = ["DB_POOL_MAX", "DB_AUTH_POOL_MAX"];
+function parsePostgresBudget(value, field, runtimeConfig) {
+    const parsed = {};
+    if (value.maxConnections !== undefined) {
+        const maxConnections = value.maxConnections;
+        if (typeof maxConnections !== "number" ||
+            !Number.isInteger(maxConnections) ||
+            maxConnections < 4 ||
+            maxConnections > MAX_POSTGRES_CONNECTIONS) {
+            throw new Error(`Deployment profile field "${field}.maxConnections" must be an integer from 4 to ${MAX_POSTGRES_CONNECTIONS}.`);
+        }
+        parsed.maxConnections = maxConnections;
+    }
+    if (value.appPools !== undefined) {
+        if (!Array.isArray(value.appPools)) {
+            throw new Error(`Deployment profile field "${field}.appPools" must be an array.`);
+        }
+        const seen = new Set();
+        parsed.appPools = value.appPools.map((entry, index) => {
+            const entryField = `${field}.appPools[${index}]`;
+            if (!isRecord(entry))
+                throw new Error(`Deployment profile field "${entryField}" must be an object.`);
+            assertOnlyKeys(entry, ["sizeKey", "size", "extraConnections"], entryField);
+            if ((entry.sizeKey === undefined) === (entry.size === undefined)) {
+                throw new Error(`Deployment profile field "${entryField}" must set either sizeKey, the runtimeConfig key that caps the pool, ` +
+                    "or size, the cap the application sets itself.");
+            }
+            const extraConnections = entry.extraConnections ?? 0;
+            if (typeof extraConnections !== "number" || !Number.isInteger(extraConnections) || extraConnections < 0) {
+                throw new Error(`Deployment profile field "${entryField}.extraConnections" must be a non-negative integer.`);
+            }
+            if (entry.size !== undefined) {
+                const size = entry.size;
+                if (typeof size !== "number" || !Number.isInteger(size) || size < 1 || size > MAX_POSTGRES_CONNECTIONS) {
+                    throw new Error(`Deployment profile field "${entryField}.size" must be an integer from 1 to ${MAX_POSTGRES_CONNECTIONS}.`);
+                }
+                return { size, extraConnections };
+            }
+            const sizeKey = requiredString(entry, "sizeKey");
+            if (!/^[A-Z][A-Z0-9_]*$/.test(sizeKey) || PODOKIT_POOL_KEYS.includes(sizeKey) || seen.has(sizeKey)) {
+                throw new Error(`Deployment profile field "${entryField}.sizeKey" must name another pool's runtimeConfig key, once; ` +
+                    `${PODOKIT_POOL_KEYS.join(" and ")} are counted already.`);
+            }
+            seen.add(sizeKey);
+            if (!/^[1-9][0-9]*$/.test(runtimeConfig[sizeKey] ?? "")) {
+                throw new Error(`Deployment profile field "${entryField}.sizeKey" names ${sizeKey}, which runtimeConfig must set to a positive integer.`);
+            }
+            return { sizeKey, extraConnections };
+        });
+    }
+    return parsed;
+}
 /** Bun closes silent connections on a 4-second tick, up to 4 seconds before their idle timeout. */
-const IDLE_TICK_SECONDS = 4;
-const MAX_IDLE_TIMEOUT_SECONDS = 255;
+exports.IDLE_TICK_SECONDS = 4;
+exports.MAX_IDLE_TIMEOUT_SECONDS = 255;
 const DEFAULT_BACKEND_PROXY_TIMEOUT_MS = 30_000;
+exports.IDLE_TIMEOUT_KEYS = ["CONNECTION_IDLE_TIMEOUT", "API_IDLE_TIMEOUT"];
+/**
+ * BACKEND_PROXY_TIMEOUT_MS, or the application's longest APP_PROXY_TIMEOUTS
+ * entry when that waits longer; an entry without a deadline wins outright.
+ */
+function longestProxyWait(runtimeConfig, entries) {
+    const proxyTimeout = runtimeConfig.BACKEND_PROXY_TIMEOUT_MS?.trim();
+    let longest = {
+        timeoutMs: proxyTimeout && /^\d+$/.test(proxyTimeout) ? Number(proxyTimeout) : DEFAULT_BACKEND_PROXY_TIMEOUT_MS,
+        source: "BACKEND_PROXY_TIMEOUT_MS",
+    };
+    for (const entry of entries) {
+        if (longest.timeoutMs !== null && (entry.timeoutMs === null || entry.timeoutMs > longest.timeoutMs)) {
+            longest = { timeoutMs: entry.timeoutMs, source: `APP_PROXY_TIMEOUTS entry ${entry.pathPrefix}` };
+        }
+    }
+    return longest;
+}
+function describeProxyWait(wait) {
+    return `${wait.timeoutMs === null ? "no deadline" : `${wait.timeoutMs} ms`}, ${wait.source}`;
+}
+/** Whether an idle timeout keeps a silent connection open for the whole wait. */
+function idleTimeoutCovers(seconds, wait) {
+    return seconds === 0 || (wait.timeoutMs !== null && (seconds - exports.IDLE_TICK_SECONDS) * 1000 > wait.timeoutMs);
+}
 /**
  * The idle timeouts of the web server (CONNECTION_IDLE_TIMEOUT) and the API
  * (API_IDLE_TIMEOUT), both run by Bun. Each is the profile's own value, or else
  * the fewest seconds that keep a silent connection open past the /api proxy's
- * BACKEND_PROXY_TIMEOUT_MS deadline: 35 for the default 30000 ms.
+ * longest wait: 35 for the default 30000 ms, and 0 (off) when an application
+ * route has no deadline.
  */
-function idleTimeoutConfig(runtimeConfig) {
-    const proxyTimeout = runtimeConfig.BACKEND_PROXY_TIMEOUT_MS?.trim();
-    const proxyMs = proxyTimeout && /^\d+$/.test(proxyTimeout) ? Number(proxyTimeout) : DEFAULT_BACKEND_PROXY_TIMEOUT_MS;
-    const derived = Math.floor(proxyMs / 1000) + IDLE_TICK_SECONDS + 1;
+function idleTimeoutConfig(runtimeConfig, proxyTimeouts) {
     const config = {};
-    for (const name of ["CONNECTION_IDLE_TIMEOUT", "API_IDLE_TIMEOUT"]) {
+    for (const name of exports.IDLE_TIMEOUT_KEYS) {
         const configured = runtimeConfig[name];
         if (configured !== undefined) {
             config[name] = configured;
+            continue;
         }
-        else if (derived > MAX_IDLE_TIMEOUT_SECONDS) {
-            throw new Error(`Deployment runtimeConfig BACKEND_PROXY_TIMEOUT_MS ${proxyMs} outlasts the longest idle timeout ` +
-                `(${MAX_IDLE_TIMEOUT_SECONDS} seconds); set ${name} to "0" to turn it off.`);
+        if ("error" in proxyTimeouts)
+            throw new Error(proxyTimeouts.error);
+        const wait = longestProxyWait(runtimeConfig, proxyTimeouts.entries);
+        if (wait.timeoutMs === null) {
+            config[name] = "0";
+            continue;
         }
-        else {
-            config[name] = String(derived);
+        const derived = Math.floor(wait.timeoutMs / 1000) + exports.IDLE_TICK_SECONDS + 1;
+        if (derived > exports.MAX_IDLE_TIMEOUT_SECONDS) {
+            throw new Error(`The /api proxy waits up to ${wait.timeoutMs} ms (${wait.source}), longer than the longest idle timeout ` +
+                `(${exports.MAX_IDLE_TIMEOUT_SECONDS} seconds); set ${name} to "0" to turn it off.`);
         }
+        config[name] = String(derived);
     }
     return config;
 }

package/dist/deploy.d.ts

@@ -1,10 +1,7 @@
+import { type DeployFinding } from "./deploy-checks";
 import type { CommandRunner } from "./dev";
 import { type DeploymentImages } from "./deploy-render";
-export interface DeploymentDoctorFinding {
-    code: string;
-    ok: boolean;
-    message: string;
-}
+export type DeploymentDoctorFinding = DeployFinding;
 export interface DeploymentPlanAction {
     order: number;
     kind: "dependencies" | "migration" | "application" | "verification" | "rollback";

package/dist/deploy.js

@@ -14,6 +14,8 @@ const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const api_paths_1 = require("./api-paths");
+const app_proxy_timeouts_1 = require("./app-proxy-timeouts");
+const deploy_checks_1 = require("./deploy-checks");
 const deploy_profile_1 = require("./deploy-profile");
 const deploy_render_1 = require("./deploy-render");
 function defaultRunner(command, args, options) {
@@ -143,7 +145,7 @@ function apiSecretRequirements(profile) {
 }
 function doctorDeployment(projectRoot, profileName, runner = defaultRunner) {
     const profile = (0, deploy_profile_1.loadDeploymentProfile)(projectRoot, profileName);
-    const findings = [];
+    const findings = (0, deploy_checks_1.profileFindings)(projectRoot, profile);
     const fingerprint = inspectClusterFingerprint(profile.target.context, runner);
     findings.push({
         code: "cluster-fingerprint",
@@ -496,11 +498,12 @@ function planDeployment(projectRoot, profileName, release, runner = defaultRunne
         warnings: [
             "Application rollback does not reverse database migrations.",
             "PersistentVolumeClaims and Kubernetes Secrets are never deleted by apply or rollback.",
+            ...[(0, deploy_checks_1.connectionBudgetWarning)(profile, (0, deploy_checks_1.installedModules)(projectRoot))].filter((warning) => warning !== null),
         ],
     };
     const temporaryRoot = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "podokit-deploy-plan-"));
     try {
-        const runtime = (0, deploy_render_1.renderDeployment)(temporaryRoot, profileName, profile, release, images, state.rolloutStateDigest);
+        const runtime = (0, deploy_render_1.renderDeployment)(temporaryRoot, profileName, profile, release, images, state.rolloutStateDigest, (0, app_proxy_timeouts_1.readAppProxyTimeouts)(projectRoot));
         return { ...base, planHash: planDigest(base, runtime) };
     }
     finally {

package/dist/dev.d.ts

@@ -9,6 +9,10 @@ export interface DevConfig {
 export interface DevRuntime {
     alias: string;
     config: DevConfig;
+    /** Browser origins of the development stack, for CORS_ORIGIN. */
+    origins: string[];
+    /** BETTER_AUTH_URL for the containers. */
+    authUrl: string;
     projectRoot: string;
     routeId: string;
     runtimeComposePath: string;
@@ -22,8 +26,25 @@ export type CommandRunner = (command: string, args: string[], options: {
     capture: boolean;
 }) => CommandResult;
 export declare function readDevConfig(projectRoot: string): DevConfig;
+/**
+ * The origins a browser reaches the development stack on: the gateway
+ * hostname, the HTTPS tunnel origin when one is declared, and plain localhost
+ * for the compose file's own proxy.
+ */
+export declare function devOrigins(config: Pick<DevConfig, "hostname" | "publicUrl">): string[];
+/**
+ * Template variables for files that name the development host. They follow
+ * `.podokit/dev.json` when it exists and is valid, so a renamed host renders
+ * the same way it is routed; otherwise the project name's default.
+ */
+export declare function devTemplateVars(projectName: string, projectRoot?: string): Record<string, string>;
 export declare function resolveDevRuntime(projectRoot: string): DevRuntime;
 export declare function installedDevProfiles(projectRoot: string): string[];
+/**
+ * The compose overlay `podo dev` adds. Besides the gateway network it sets
+ * CORS_ORIGIN and BETTER_AUTH_URL for web and api from `.podokit/dev.json`, so
+ * the browser origins follow the routed hostname whatever `.env.docker` says.
+ */
 export declare function renderRuntimeCompose(runtime: DevRuntime): string;
 export declare function renderRoute(runtime: DevRuntime): string;
 /**

package/dist/dev.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readDevConfig = readDevConfig;
+exports.devOrigins = devOrigins;
+exports.devTemplateVars = devTemplateVars;
 exports.resolveDevRuntime = resolveDevRuntime;
 exports.installedDevProfiles = installedDevProfiles;
 exports.renderRuntimeCompose = renderRuntimeCompose;
@@ -106,6 +108,68 @@ function readDevConfig(projectRoot) {
         apiPaths: (0, api_paths_1.parseApiPaths)(config.apiPaths ?? [], `${DEV_CONFIG}.apiPaths`, webSocketPaths),
     };
 }
+/**
+ * The origins a browser reaches the development stack on: the gateway
+ * hostname, the HTTPS tunnel origin when one is declared, and plain localhost
+ * for the compose file's own proxy.
+ */
+function devOrigins(config) {
+    return [
+        ...new Set([
+            `http://${config.hostname}`,
+            ...(config.publicUrl ? [new URL(config.publicUrl).origin] : []),
+            "http://localhost",
+        ]),
+    ];
+}
+/**
+ * Template variables for files that name the development host. They follow
+ * `.podokit/dev.json` when it exists and is valid, so a renamed host renders
+ * the same way it is routed; otherwise the project name's default.
+ */
+function devTemplateVars(projectName, projectRoot) {
+    let config = { hostname: `${projectName}.localhost` };
+    const path = projectRoot ? (0, node_path_1.join)(projectRoot, DEV_CONFIG) : undefined;
+    if (path && (0, node_fs_1.existsSync)(path)) {
+        try {
+            const parsed = JSON.parse((0, node_fs_1.readFileSync)(path, "utf8"));
+            if (typeof parsed.hostname === "string") {
+                validateHostname(parsed.hostname);
+                if (parsed.publicUrl)
+                    validatePublicUrl(parsed.publicUrl);
+                config = { hostname: parsed.hostname, publicUrl: parsed.publicUrl };
+            }
+        }
+        catch {
+            // podo dev reports an unreadable dev.json; rendering keeps the default.
+        }
+    }
+    return {
+        devHostname: config.hostname,
+        devCorsOrigin: devOrigins(config).join(","),
+        devAuthUrl: `http://${config.hostname}`,
+    };
+}
+/**
+ * BETTER_AUTH_URL for the containers: the gateway origin, or the origin named
+ * by PODOKIT_DEV_AUTH_URL for an OAuth round trip through `publicUrl`.
+ */
+function devAuthUrl(config, origins) {
+    const requested = process.env.PODOKIT_DEV_AUTH_URL?.trim();
+    if (!requested)
+        return `http://${config.hostname}`;
+    let origin;
+    try {
+        origin = new URL(requested).origin;
+    }
+    catch {
+        origin = "";
+    }
+    if (!origins.includes(origin) || origin === "http://localhost") {
+        throw new Error(`PODOKIT_DEV_AUTH_URL must be http://${config.hostname}${config.publicUrl ? ` or ${new URL(config.publicUrl).origin}` : ""} (from ${DEV_CONFIG}).`);
+    }
+    return origin;
+}
 function stableId(projectRoot) {
     return (0, node_crypto_1.createHash)("sha256").update(projectRoot).digest("hex").slice(0, 10);
 }
@@ -118,9 +182,12 @@ function resolveDevRuntime(projectRoot) {
     const config = readDevConfig(root);
     const id = stableId(root);
     const projectSlug = slug(config.hostname.replace(/\.localhost$/, ""));
+    const origins = devOrigins(config);
     return {
         alias: `podokit-${projectSlug}-${id}`,
         config,
+        origins,
+        authUrl: devAuthUrl(config, origins),
         projectRoot: root,
         routeId: `route-${projectSlug}-${id}`,
         runtimeComposePath: (0, node_path_1.join)(root, RUNTIME_COMPOSE),
@@ -143,11 +210,19 @@ function routesToApi(config) {
 function anyOf(matchers) {
     return matchers.length > 1 ? `(${matchers.join(" || ")})` : (matchers[0] ?? "");
 }
+/**
+ * The compose overlay `podo dev` adds. Besides the gateway network it sets
+ * CORS_ORIGIN and BETTER_AUTH_URL for web and api from `.podokit/dev.json`, so
+ * the browser origins follow the routed hostname whatever `.env.docker` says.
+ */
 function renderRuntimeCompose(runtime) {
-    const api = routesToApi(runtime.config)
-        ? `  api:\n    networks:\n      ${GATEWAY_NETWORK}:\n        aliases: [${runtime.alias}-api]\n`
+    const environment = `    environment:\n` +
+        `      CORS_ORIGIN: ${JSON.stringify(runtime.origins.join(","))}\n` +
+        `      BETTER_AUTH_URL: ${JSON.stringify(runtime.authUrl)}\n`;
+    const apiNetworks = routesToApi(runtime.config)
+        ? `    networks:\n      ${GATEWAY_NETWORK}:\n        aliases: [${runtime.alias}-api]\n`
         : "";
-    return `# Generated by podo dev. Do not edit.\nservices:\n  traefik:\n    profiles: [podokit-legacy-proxy]\n  web:\n    networks:\n      ${GATEWAY_NETWORK}:\n        aliases: [${runtime.alias}]\n${api}networks:\n  ${GATEWAY_NETWORK}:\n    external: true\n    name: ${GATEWAY_NETWORK}\n`;
+    return `# Generated by podo dev. Do not edit.\nservices:\n  traefik:\n    profiles: [podokit-legacy-proxy]\n  web:\n${environment}    networks:\n      ${GATEWAY_NETWORK}:\n        aliases: [${runtime.alias}]\n  api:\n${environment}${apiNetworks}networks:\n  ${GATEWAY_NETWORK}:\n    external: true\n    name: ${GATEWAY_NETWORK}\n`;
 }
 function renderRoute(runtime) {
     const { alias, config, routeId } = runtime;

package/dist/eject.js

@@ -17,6 +17,8 @@ function eject(projectRoot, paths) {
             continue;
         }
         if (entry.tier !== "owned") {
+            // A managed file's baseline is what the template generated.
+            entry.templateHash = entry.outHash;
             entry.tier = "owned";
             result.ejected.push(path);
         }