minutework 0.1.53 → 0.1.54

package/README.md

@@ -147,7 +147,7 @@ minutework deploy --preview
 
 Combined **tenant-app + sidecar** workspaces keep sidecar setup explicit. Root `pnpm install` stays Node-only and does not run `poetry install` for you. If you need the sidecar, run `pnpm run install:sidecar` from the workspace root or `cd sidecar && poetry install` yourself before `minutework dev` or `minutework test`. Sidecar-only scaffolds have no root `package.json`; install Python deps once inside `sidecar/` before running local sidecar workflows.
 
-For direct third-party web hosts such as Vercel, deploy `tenant-app` only. In Vercel, point the project Root Directory at `tenant-app`; the optional sidecar remains a separate Poetry-managed surface. To keep `@minutework/web-auth` same-origin on a bring-your-own host, set `MW_GATEWAY_BASE_URL` to the platform gateway base URL — the template's `next.config.mjs` then proxies `/_mw/*` to the gateway — and run `minutework deploy --live --host <your-domain>` so the gateway recognizes that host as your tenant's live canonical customer-web origin.
+For direct third-party web hosts such as Vercel, deploy `tenant-app` only. In Vercel, point the project Root Directory at `tenant-app`; the optional sidecar remains a separate Poetry-managed surface. To keep `@minutework/web-auth` same-origin on a bring-your-own host, set `MW_GATEWAY_BASE_URL` to the canonical live customer-web host returned by `minutework deploy --live` — the template's `next.config.mjs` then proxies `/_mw/*` to the gateway — and run `minutework deploy --live --host <your-domain>` so the gateway recognizes that host as your tenant's live canonical customer-web origin. For local auth against dev, target `https://dev.minutework.ai`, deploy live there, then set `MW_GATEWAY_BASE_URL` to the returned `https://<label>.customers.dev.minutework.ai` host, not bare `https://dev.minutework.ai`.
 
 `link` provisions or resolves the default published-site property for the active tenant and stores that property key in repo-local state. The SDK-based `tenant-app/.env.example` contains only the app metadata contract used by the template: `NEXT_PUBLIC_MW_APP_ID`, `MW_TEMPLATE_APP_NAME`, and optional `MW_PUBLIC_BASE_URL`. Browser auth and manifest calls use same-origin `/_mw` routes through `@minutework/web-auth`; do not add platform content tokens or public-site property vars to the tenant app.
 

package/assets/claude-local/skills/tenant-app-customer-auth-deploy/SKILL.md

@@ -55,6 +55,14 @@ unattended; without `--yes` it returns `confirmation_required`).
   activate. On a BYO host, set `MW_GATEWAY_BASE_URL` in the tenant-app so the
   template's `next.config.mjs` proxies same-origin `/_mw/*` to the gateway
   (managed-subdomain hosts are gateway-fronted and need no rewrite).
+- **Local tenant-app against the dev platform:** target the dev platform
+  explicitly (`export MW_CLI_PLATFORM_BASE_URL=https://dev.minutework.ai` and
+  `minutework login --platform https://dev.minutework.ai`), link a sandbox
+  runtime, then run `minutework deploy --live`. Set `tenant-app/.env.local`
+  `MW_GATEWAY_BASE_URL` to the returned canonical live customer-web host such as
+  `https://<label>.customers.dev.minutework.ai` before running local `next dev`.
+  Do not set it to bare `https://dev.minutework.ai`; the gateway resolves
+  `/_mw` customer auth by the live customer-web host.
 
 ## Boundaries and current limits
 

package/assets/templates/next-tenant-app/.env.example

@@ -1,7 +1,9 @@
 NEXT_PUBLIC_MW_APP_ID=tenant.app
 MW_TEMPLATE_APP_NAME=Tenant App
 MW_PUBLIC_BASE_URL=
-# Only needed when hosting this app off-platform (Vercel / custom domain). Set to the
-# MinuteWork platform gateway base URL to transparently proxy same-origin /_mw/* customer
-# auth to the gateway. Leave blank for managed-subdomain hosts (gateway-fronted).
+# Only needed when hosting this app off-platform (Vercel / custom domain) or
+# running local next dev against a live customer-web binding. Set this to the
+# canonical live customer-web host returned by `minutework deploy --live`, such as
+# https://<label>.customers.dev.minutework.ai. Do not set it to bare
+# https://dev.minutework.ai.
 MW_GATEWAY_BASE_URL=

package/assets/templates/next-tenant-app/README.md

@@ -64,6 +64,21 @@ runtime-command demo, or a server-only public-content token adapter.
   defaults to `tenant.app`
 - `MW_TEMPLATE_APP_NAME` controls the display name and defaults to `Tenant App`
 - `MW_PUBLIC_BASE_URL` is optional and only affects metadata routes
+- `MW_GATEWAY_BASE_URL` is only needed when the app is not directly
+  gateway-fronted. For local auth against dev, set it to the canonical live
+  customer-web host returned by `minutework deploy --live`, for example
+  `https://<label>.customers.dev.minutework.ai`. Do not set it to bare
+  `https://dev.minutework.ai`; `/_mw` auth is resolved from the live
+  customer-web host.
+
+Local real-auth dev loop:
+
+1. `export MW_CLI_PLATFORM_BASE_URL=https://dev.minutework.ai`
+2. `minutework login --platform https://dev.minutework.ai`
+3. `minutework link --runtime --sandbox`
+4. `minutework deploy --live`
+5. set `MW_GATEWAY_BASE_URL` to the returned `*.customers.dev.minutework.ai`
+   live host, then run local `next dev`.
 
 ## Validation
 

package/assets/templates/next-tenant-app/next.config.mjs

@@ -22,11 +22,11 @@ function resolveTurbopackRoot(startDirectory) {
 
 // Bring-your-own host support: when this tenant-app is hosted off-platform (Vercel
 // or a custom domain) instead of being fronted by the MinuteWork gateway, set
-// MW_GATEWAY_BASE_URL so same-origin `/_mw/*` customer-auth calls are transparently
-// proxied to the platform gateway. The gateway serves customer auth for this tenant's
-// live canonical customer-web host (provisioned via `minutework deploy --live`), so
-// @minutework/web-auth keeps its same-origin contract without a remote project URL.
-// Unset by default: managed-subdomain hosts are gateway-fronted and need no rewrite.
+// MW_GATEWAY_BASE_URL to the live canonical customer-web host returned by
+// `minutework deploy --live`. The gateway serves customer auth only for that
+// host, so local dev should point at e.g. https://<label>.customers.dev.minutework.ai,
+// not the bare platform origin. Unset by default: managed-subdomain hosts are
+// gateway-fronted and need no rewrite.
 const gatewayBaseUrl = (process.env.MW_GATEWAY_BASE_URL || "").trim().replace(/\/+$/, "");
 
 const nextConfig = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "minutework",
-  "version": "0.1.53",
+  "version": "0.1.54",
   "description": "MinuteWork CLI for workspace scaffolding, local preview workflows, and hosted preview deploys.",
   "type": "module",
   "bin": {