orionplace-svelte 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Orionplace contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,244 @@
+# orionplace-svelte
+
+Set up a SvelteKit 2 storefront for your personal Orionplace marketplace API.
+The package includes a setup CLI, the SvelteKit starter with typed AppLoad
+initialization, and commented server source that is copied into your project
+alongside an integration README.
+
+Requires Node.js 20.19+, Svelte 5 and `@sveltejs/adapter-node`. Static and
+edge-only adapters cannot read the domain files this integration uses.
+
+## Quick start from zero
+
+Your personal backend domain is already provided in your account at
+[orionmarket.place](https://orionmarket.place). You can change it there.
+Replace `your-project.orionplace.app` below with that domain and
+`shop.example.com` with the public domain of your own storefront.
+With Node.js 20.19+ and npm installed, run this from the parent folder;
+no existing SvelteKit project is needed:
+
+```bash
+npx --yes orionplace-svelte init my-marketplace
+cd my-marketplace
+npm install
+npx orionplace-svelte set backend your-project.orionplace.app
+npx orionplace-svelte add frontend shop.example.com
+npm run dev
+```
+
+The first command creates the SvelteKit configuration, starter routes and
+integration README. The first frontend becomes the local MIMIC domain. Open the
+local URL printed by Vite (normally http://localhost:5173); the starter's AppLoad
+state should show `Loaded`. If it shows `Failed`, check your domain mapping and
+backend response. The backend command accepts either a hostname or its full HTTPS
+`/api` URL. The frontend command accepts a public hostname or its root HTTPS URL.
+
+## Existing SvelteKit 2 project
+
+```bash
+npm install orionplace-svelte
+npx orionplace-svelte init --dry-run
+npx orionplace-svelte set backend your-project.orionplace.app
+npx orionplace-svelte add frontend shop.example.com
+npm install
+npm run dev
+```
+
+The CLI preserves unrelated SvelteKit settings, scripts, and environment
+variables. It never replaces your own `svelte.config.js`, `vite.config.ts`,
+`src/app.html`, `src/hooks.server.ts`, root layout or home page: it keeps your
+file and prints its path so you can merge the starter yourself. Switch to
+`@sveltejs/adapter-node` and resolve an existing `/api` catch-all route before
+setup.
+
+No install or postinstall hook changes your application. Only explicitly running
+the CLI writes files. Use `--cwd <directory>` to select a project and `--dry-run`
+to inspect planned changes without writing them.
+
+## Commands
+
+```bash
+npx orionplace-svelte init [directory]
+npx orionplace-svelte update
+npx orionplace-svelte set backend your-project.orionplace.app
+npx orionplace-svelte add frontend shop.example.com
+npx orionplace-svelte add frontend www.shop.example.com
+npx orionplace-svelte remove frontend www.shop.example.com
+npx orionplace-svelte set mimic shop.example.com
+npx orionplace-svelte help
+```
+
+Either domain command can run first. Both settings are needed for a usable mapping.
+After setup, these npm script aliases are also available:
+
+```bash
+npm run orionplace:backend -- your-project.orionplace.app
+npm run orionplace:add-frontend -- shop.example.com
+npm run orionplace:remove-frontend -- www.shop.example.com
+npm run orionplace:mimic -- shop.example.com
+npm run orionplace:help
+npm run orionplace:update
+```
+
+`npm set` belongs to npm's own configuration system; use the commands above.
+These commands configure local integration files. They do not provision a backend,
+change your account, create DNS records, configure TLS, or deploy a VPS.
+
+## Generated files
+
+| Path | Purpose |
+| --- | --- |
+| `src/routes/api/[...orionplace]/+server.ts` | Route serving `/api/...` from your project. |
+| `src/routes/+layout.server.ts` | Initializes AppLoad before your pages render. |
+| `src/routes/+layout.svelte` | Creates the store for this session and puts it in context. |
+| `src/routes/+page.svelte` | Starter page showing the AppLoad state; replace it with your storefront. |
+| `src/hooks.server.ts` | Marks personalized pages `private, no-store` and varies them by domain. |
+| `src/lib/orionplace/` | Server transport with cookie relay, browser transport, envelope checks, domain resolution. |
+| `src/lib/orionplace/store.svelte.ts` | Typed snapshot, status, merged discovery and derived data as Svelte 5 runes. |
+| `src/lib/interfaces/orionplace/` | The AppLoad response envelope and every nested model. |
+| `svelte.config.js`, `vite.config.ts` | Node adapter, and your storefront domains as allowed development hosts. |
+| `orionplace/runtime/marketplace.mjs` | Commented domain lookup and HTTP transport. |
+| `orionplace/README.md` | Your settings, API examples, file explanations, verification and VPS deployment. |
+| `orionplace/settings.json` | Domain values selected by the CLI. |
+| `orionplace/.generated.json` | File hashes used to preserve your edits on subsequent setup. |
+| `sitemaps/shop.example.com.cfg` | One line: `https://your-project.orionplace.app/api`. |
+| `.env` | `MIMIC_FRONT_DOMAIN="shop.example.com"` for localhost. |
+
+All generated source is yours to read and customize. Later setup runs preserve
+edited files and report which ones were preserved. Unchanged generated files can
+be refreshed with `npx orionplace-svelte update`. A manually edited domain file is
+never silently overwritten. Keep the hash manifest in version control.
+
+## Multiple frontend domains
+
+Each frontend gets its own `sitemaps/<domain>.cfg`. `add frontend` preserves other
+domains and can be repeated safely. `set backend` updates every CLI-managed mapping
+to the new personal API; it refuses to overwrite a manually edited mapping.
+
+A new project starts with `MIMIC_FRONT_DOMAIN=""` in `.env`. Setting a backend
+alone leaves it empty. The first added frontend becomes MIMIC; further additions
+preserve that choice. `set mimic <domain>` selects an already-added frontend and
+updates MIMIC without changing any domain mappings. Unknown domains are rejected;
+add them with `add frontend` first.
+
+`help`, `--help`, and `-h` display commands without writing files. The legacy
+`set frontend <domain>` shortcut remains supported: it adds and selects a domain.
+
+`remove frontend <domain>` removes that domain from the list and deletes only its
+unchanged generated `.cfg`. Removing the MIMIC domain selects the first remaining
+domain. Removing the last one clears MIMIC. Unknown or edited mappings cause a
+clear error without changing files. Unrelated configurations remain untouched.
+
+Restart development after domain changes so Vite reloads its allowed hosts and
+SvelteKit reloads `.env`. Production reloads mapping files on each API request;
+reload the process environment when changing MIMIC. Configure DNS, TLS, and the
+hosting proxy for each frontend separately.
+
+## Runtime behavior
+
+The hosting proxy must overwrite `X-Front-Domain`, `X-Forwarded-Host`, and `Host`.
+The gateway selects the first valid public domain in that order, with the request
+URL hostname as another fallback. On localhost it uses `MIMIC_FRONT_DOMAIN`.
+An unknown public domain returns `503`; it never uses another domain's mapping.
+
+The corresponding `.cfg` is read on every request. Backend URLs must use HTTPS,
+end in `/api`, and belong to `*.orionplace.app`. API methods, query strings, bodies,
+authorization and cookies are forwarded. Backend statuses are retained and cookie
+Domain attributes are removed to bind cookies to the storefront. Gateway responses
+use `Cache-Control: no-store`. Network failures return `502`. Cross-site mutations
+are rejected with `403`.
+
+SvelteKit ignores a request body sent without a `Content-Type` header, so always
+set it on your own API calls; browsers do this automatically for `fetch`.
+
+Browser requests use `/api/...`. Server loads call the same gateway in process
+through `src/lib/orionplace/appLoadServer.ts`, which forwards the current
+request's domain, cookies and language.
+
+Deploy `sitemaps` with the production server, or set an absolute `SITEMAPS_DIR`.
+The production process reads `MIMIC_FRONT_DOMAIN` without rebuilding. Run the
+server from the project root or explicitly point it at the configuration directory.
+
+## AppLoad starter
+
+The root layout load awaits `POST /api/appload` in light mode before your pages
+render and returns the snapshot to every route, so `await parent()` in a page load
+reuses it instead of requesting again. The root layout component creates one store
+per browser session and hydrates it from that snapshot; components read it with
+`getOrionplaceContext()`. Reading the store never starts a request, and
+initialization never opens an authentication prompt. `store.refresh()` reloads
+explicitly, and SvelteKit's `invalidateAll()` also works: the layout load runs
+again and the store adopts the new snapshot.
+
+Live discovery from `page_data.unauth.paths` and, for a signed-in session,
+`page_data.auth.paths`, is merged into one lookup without mutating the response.
+Discovery describes availability; the backend still checks permissions on each call.
+
+### Session and CSRF cookies
+
+AppLoad establishes the guest/customer session and CSRF cookie through HTTP
+`Set-Cookie` headers, not through `page_data.init`. The browser handles the signed
+HttpOnly `sessionid` cookie; never parse, rewrite, log or store its value in the
+store or localStorage. The readable `csrftoken` supplies `X-CSRFToken` for later
+protected requests through the same-origin `/api/` gateway with credentials enabled.
+Read the CSRF cookie again for every action because login can rotate it.
+
+During a server render the layout load forwards the incoming cookies and relays
+each backend `Set-Cookie` separately through SvelteKit's cookie API, preserving
+the exact signed value and its attributes. Cookies established this way are also
+visible to later calls in the same render. Never share a cookie jar across visitors.
+
+Use `POST /api/csrf_renew` with `{}` to renew CSRF, then re-read the cookie.
+The backend signals CSRF rejection with HTTP `419` and `page_data.csrf: false`;
+a general `403` may mean permissions or origin rejection. Do not automatically
+replay mutations. After confirmed login/logout, reset and refresh AppLoad.
+Those store actions update data; they do not authenticate or delete cookies.
+
+## Update an existing project
+
+After the initial setup, use one command to get the latest package and components:
+
+```bash
+npx orionplace-svelte update
+```
+
+It runs the latest CLI, adds new template files, refreshes unchanged generated
+files, updates the package dependency and runs `npm install` to synchronize the
+lockfile and installed dependencies. Edited files are preserved and listed in the
+output. Review their new versions under `node_modules/orionplace-svelte/templates`
+or `runtime` and merge your changes manually when needed. Removed upstream files
+are retained locally; the updater does not delete customer source.
+
+Domain mappings, domain settings and `.env` remain unchanged. The command does
+not deploy your application: restart development, or rebuild and redeploy the
+production frontend after updating.
+
+```bash
+npx orionplace-svelte update --dry-run
+npm run orionplace:update
+```
+
+Dry-run downloads the latest CLI into npm's cache to inspect its templates but
+leaves project files and dependencies unchanged. `update --local` applies the
+version of the CLI being executed instead of fetching the latest CLI; it still
+installs project dependencies. Use this only when intentionally selecting a version.
+
+Updates require the existing `orionplace/settings.json` and `.generated.json`.
+Conflicting untracked files stop the source update before any writes. If dependency
+installation fails after source generation, run `npm install` and retry `update`.
+
+## Documentation
+
+- [Create a SvelteKit frontend](https://orionmarket.place/sandbox/new-project/svelte)
+- [Marketplace API documentation](https://orionmarket.place/sandbox/)
+
+## Development
+
+```bash
+npm install
+npm test
+npm pack --dry-run
+```
+
+The published tarball includes only the CLI, runtime source, README, license,
+starter templates, and package metadata.

package/bin/orionplace-svelte.mjs

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+import { setupProject } from '../src/setup.mjs';
+import { updateProject } from '../src/update.mjs';
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { createInterface } from 'node:readline/promises';
+
+const help = `Orionplace Svelte setup
+
+From zero (Node.js 20.19+ with npm; run from the parent folder):
+  npx --yes orionplace-svelte init my-marketplace
+  cd my-marketplace
+  npm install
+  npx orionplace-svelte set backend your-project.orionplace.app
+  npx orionplace-svelte add frontend shop.example.com
+  npm run dev
+
+Replace the backend with the domain from your orionmarket.place profile,
+and the frontend with your storefront domain. Open the local URL printed by Vite;
+the starter's AppLoad state should show Loaded.
+
+Commands for an existing project (run from its root):
+  npx orionplace-svelte help
+  npx orionplace-svelte init [directory]
+  npx orionplace-svelte update
+  npx orionplace-svelte set backend <personal-backend.orionplace.app>
+  npx orionplace-svelte add frontend <shop.example.com>
+  npx orionplace-svelte remove frontend <shop.example.com>
+  npx orionplace-svelte set mimic <existing-frontend.example.com>
+  npx orionplace-svelte set frontend <shop.example.com>
+
+Options: --cwd <directory>  --dry-run  --help  --version
+Update option: --local (apply this CLI version instead of fetching the latest release)
+
+Update downloads the latest release, refreshes unedited source, and installs dependencies.
+It preserves edited source, domain mappings and MIMIC. --dry-run leaves project files unchanged.
+Set backend or add frontend also initializes the integration; either can come first.
+MIMIC starts empty. The first added frontend sets it; later additions preserve it.
+Set mimic selects an existing frontend without changing any domain mappings.
+Set frontend is the legacy shortcut to add and select a frontend.
+Set backend updates every managed frontend mapping. Remove frontend deletes only that mapping.
+After creating a new project, run npm install and npm run dev in that directory.
+Documentation and editable gateway source are generated in orionplace/.
+Your SvelteKit source is generated under src/, beside that gateway.`;
+try {
+  const argv = process.argv.slice(2);
+  if (!argv.length || argv[0] === 'help' || argv.includes('--help') || argv.includes('-h')) {
+    console.log(help);
+  } else if (argv.includes('--version')) {
+    console.log(JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8')).version);
+  } else {
+    const positional = [];
+    let cwd          = process.cwd();
+    let dryRun       = false;
+    let local        = false;
+    for (let index = 0; index < argv.length; index++) {
+      if (argv[index] === '--dry-run') dryRun = true;
+      else if (argv[index] === '--local') local = true;
+      else if (argv[index] === '--cwd') {
+        if (!argv[index + 1]) throw new Error('--cwd needs a directory');
+        cwd = resolve(argv[++index]);
+      } else if (argv[index].startsWith('--')) throw new Error(`Unknown option: ${argv[index]}`);
+      else positional.push(argv[index]);
+    }
+    const [command, target] = positional;
+    if (local && command !== 'update') throw new Error('--local is only supported by update.');
+    let result;
+    if (command === 'init' && positional.length <= 2) {
+      result = await setupProject({ cwd: target ? resolve(cwd, target) : cwd, dryRun });
+    } else if (command === 'update' && positional.length === 1) {
+      result = await updateProject({ cwd, dryRun, local });
+    } else if (((command === 'set' && ['backend', 'frontend', 'mimic'].includes(target)) ||
+        (['add', 'remove'].includes(command) && target === 'frontend')) && positional.length <= 3) {
+      let value = positional[2];
+      if (!value && process.stdin.isTTY) {
+        const prompt = createInterface({ input: process.stdin, output: process.stdout });
+        try { value = await prompt.question(`${target === 'backend' ? 'Personal backend API' : target === 'mimic' ? 'Existing frontend to use for MIMIC' : 'Public frontend domain'}: `); }
+        finally { prompt.close(); }
+      }
+      if (!value) throw new Error(`Provide the ${target} domain. See --help.`);
+      result = await setupProject({ cwd, action: command, field: target, value, dryRun });
+    } else throw new Error('Unknown command. See --help.');
+    if (result) {
+      console.log(`${dryRun ? 'Planned' : 'Updated'} ${result.root}`);
+      for (const path of result.changed) console.log(`  ${result.removed.includes(path) ? 'Remove: ' : ''}${path}`);
+      for (const path of result.preserved) console.log(`  Preserved your edits: ${path}`);
+      for (const path of result.skipped) console.log(`  Kept your file, merge the starter manually: ${path}`);
+      console.log(result.settings.backend && result.settings.frontend
+        ? `Ready: ${result.settings.frontends.join(', ')} -> ${result.settings.backend}\nLocal MIMIC: ${result.settings.frontend}`
+        : `Next: ${result.settings.backend ? 'add frontend' : 'set backend'} to complete the domain mapping.`);
+      if (result.changed.some(path => path.endsWith('.cfg') || path === '.env')) console.log('Restart a running development server to reload MIMIC and domain mappings. Reload your production environment when changing MIMIC.');
+      if (result.isNewKit) console.log('Run npm install in the project, then npm run dev.');
+      console.log('Project documentation: orionplace/README.md');
+      if (command === 'update') console.log(dryRun
+        ? 'Dependency installation would run after applying these changes. Project files were not changed.'
+        : 'Update complete. Restart development, or rebuild and redeploy your production frontend.');
+    }
+  }
+} catch (error) {
+  console.error(`Orionplace: ${error.message}`);
+  process.exitCode = 1;
+}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "orionplace-svelte",
+  "version": "0.1.0",
+  "description": "SvelteKit integration and setup CLI for your Orionplace personal marketplace backend.",
+  "type": "module",
+  "license": "MIT",
+  "author": "Orionplace",
+  "homepage": "https://orionmarket.place/sandbox/new-project/svelte",
+  "keywords": [
+    "svelte",
+    "sveltekit",
+    "orionplace",
+    "marketplace"
+  ],
+  "engines": {
+    "node": ">=20.19.0"
+  },
+  "bin": {
+    "orionplace-svelte": "./bin/orionplace-svelte.mjs"
+  },
+  "main": "./runtime/marketplace.mjs",
+  "types": "./runtime/marketplace.d.mts",
+  "exports": {
+    ".": {
+      "types": "./runtime/marketplace.d.mts",
+      "import": "./runtime/marketplace.mjs"
+    },
+    "./runtime": {
+      "types": "./runtime/marketplace.d.mts",
+      "import": "./runtime/marketplace.mjs"
+    }
+  },
+  "files": [
+    "bin",
+    "src",
+    "runtime",
+    "templates",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
+  },
+  "peerDependencies": {
+    "@sveltejs/kit": "^2.4.0",
+    "svelte": "^5.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "devDependencies": {
+    "esbuild": "^0.27.7",
+    "svelte": "^5.57.0"
+  }
+}

package/runtime/marketplace.d.mts

@@ -0,0 +1,22 @@
+export interface MarketplaceConfiguration {
+	mimicFrontDomain?: string;
+}
+
+export interface MarketplaceTenant {
+	domain: string;
+	api: URL;
+}
+
+export declare function normalizeFrontDomain(value: unknown): string | null;
+
+export declare function resolveFrontDomain(request: Request, mimic?: string): string | null;
+
+export declare function readMarketplace(
+	request: Request,
+	configuration?: MarketplaceConfiguration,
+): Promise<MarketplaceTenant>;
+
+export declare function forwardMarketplace(
+	request: Request,
+	configuration?: MarketplaceConfiguration,
+): Promise<Response>;

package/runtime/marketplace.mjs

@@ -0,0 +1,211 @@
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { isIP } from 'node:net';
+
+const environment = process.env;
+
+const hostnamePattern =
+	/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+/** @param {unknown} value */
+export function normalizeFrontDomain(value) {
+	if (typeof value !== 'string') return null;
+	const domain = value.split(',')[0].trim().toLowerCase().replace(/\.$/, '');
+	return hostnamePattern.test(domain) && !isIP(domain) ? domain : null;
+}
+
+/** @param {Request} request @param {string} mimic */
+export function resolveFrontDomain(
+	request,
+	mimic = environment.MIMIC_FRONT_DOMAIN || '',
+) {
+	// The hosting proxy must overwrite these headers. Public hosts win over MIMIC.
+	for (const candidate of [
+		request.headers.get('x-front-domain'),
+		request.headers.get('x-forwarded-host'),
+		request.headers.get('host'),
+		new URL(request.url).hostname,
+	]) {
+		const domain = normalizeFrontDomain(candidate);
+		if (domain) return domain;
+	}
+	return normalizeFrontDomain(mimic);
+}
+
+/** @param {Request} request @param {{mimicFrontDomain?: string}} configuration */
+export async function readMarketplace(request, configuration = {}) {
+	const domain = resolveFrontDomain(request, configuration.mimicFrontDomain);
+	if (!domain) throw new Error('Invalid storefront domain');
+
+	const directory = environment.SITEMAPS_DIR || resolve('sitemaps');
+	const source    = await readFile(resolve(directory, `${domain}.cfg`), 'utf8');
+	const lines     = source
+		.split(/\r?\n/)
+		.map((line) => line.trim())
+		.filter((line) => line && !line.startsWith('#'));
+	if (lines.length !== 1) throw new Error('Expected one API URL');
+	const value  = lines[0];
+	const api    = new URL(value.includes('://') ? value : `https://${value}`);
+	api.pathname = api.pathname.replace(/\/+$/, '');
+	if (
+		api.protocol !== 'https:' ||
+		!hostnamePattern.test(api.hostname) ||
+		!api.hostname.endsWith('.orionplace.app') ||
+		isIP(api.hostname) ||
+		api.port ||
+		api.username ||
+		api.password ||
+		api.search ||
+		api.hash ||
+		api.pathname !== '/api'
+	) {
+		throw new Error('Expected https://<project>.orionplace.app/api');
+	}
+	return { domain, api };
+}
+
+/** @param {number} status @param {string} message */
+function failure(status, message) {
+	return Response.json(
+		{ error: message },
+		{
+			status,
+			headers: {
+				'Cache-Control': 'no-store',
+				'Vary': 'Host, X-Forwarded-Host, X-Front-Domain',
+			},
+		},
+	);
+}
+
+/** @param {Request} request @param {{mimicFrontDomain?: string}} configuration */
+export async function forwardMarketplace(request, configuration = {}) {
+	let tenant;
+	try {
+		tenant = await readMarketplace(request, configuration);
+	} catch {
+		return failure(
+			503,
+			'Storefront domain configuration is missing or invalid',
+		);
+	}
+
+	const incoming = new URL(request.url);
+	if (!incoming.pathname.startsWith('/api/'))
+		return failure(404, 'Unknown API path');
+	// Prevent encoded separators or traversal from escaping the /api namespace.
+	let path;
+	try {
+		path = decodeURIComponent(incoming.pathname);
+	} catch {
+		return failure(400, 'Invalid API path');
+	}
+	if (
+		path.includes('\\') ||
+		/%(?:2e|2f|5c)/i.test(path) ||
+		path.split('/').some((part) => part === '.' || part === '..')
+	) {
+		return failure(400, 'Invalid API path');
+	}
+	const target = new URL(
+		incoming.pathname + incoming.search,
+		tenant.api.origin,
+	);
+	if (!target.pathname.startsWith('/api/'))
+		return failure(400, 'Invalid API path');
+
+	const origin      = request.headers.get('origin');
+	const publicHost  = request.headers.get('host') || incoming.host;
+	const originHosts = [publicHost, tenant.domain];
+	if (!['GET', 'HEAD', 'OPTIONS'].includes(request.method)) {
+		try {
+			if (
+				request.headers.get('sec-fetch-site') === 'cross-site' ||
+				(origin && !originHosts.includes(new URL(origin).host))
+			) {
+				return failure(403, 'Cross-site API request rejected');
+			}
+		} catch {
+			return failure(403, 'Invalid Origin');
+		}
+	}
+
+	// An allowlist excludes hop-by-hop and client-supplied routing headers.
+	const headers = new Headers();
+	for (const name of [
+		'accept',
+		'content-type',
+		'authorization',
+		'cookie',
+		'origin',
+		'referer',
+		'x-csrftoken',
+		'accept-language',
+		'user-agent',
+		'x-tz',
+	]) {
+		const value = request.headers.get(name);
+		if (value) headers.set(name, value);
+	}
+	headers.set('X-Front-Domain', tenant.domain);
+	headers.set('Accept-Encoding', 'identity');
+	const clientIp =
+		request.headers.get('x-init-ip') ||
+		request.headers.get('x-real-ip') ||
+		request.headers.get('x-forwarded-for')?.split(',')[0]?.trim();
+	if (clientIp) headers.set('X-Init-Ip', clientIp);
+	/** @type {RequestInit & { duplex: 'half' }} */
+	const options = {
+		method: request.method,
+		headers,
+		redirect: 'manual',
+		cache: 'no-store',
+		signal: AbortSignal.any([request.signal, AbortSignal.timeout(30_000)]),
+		duplex: 'half',
+	};
+	if (!['GET', 'HEAD'].includes(request.method)) options.body = request.body;
+
+	let upstream;
+	try {
+		upstream = await fetch(target, options);
+	} catch {
+		return failure(502, 'Marketplace backend is unavailable');
+	}
+
+	const responseHeaders = new Headers();
+	for (const name of [
+		'content-type',
+		'content-disposition',
+		'www-authenticate',
+		'retry-after',
+		'allow',
+	]) {
+		const value = upstream.headers.get(name);
+		if (value) responseHeaders.set(name, value);
+	}
+	// Keep each cookie separate; remove the backend Domain attribute only.
+	for (const cookie of upstream.headers.getSetCookie()) {
+		responseHeaders.append(
+			'Set-Cookie',
+			cookie.replace(/;\s*Domain=[^;]*/gi, ''),
+		);
+	}
+	const location = upstream.headers.get('location');
+	if (location) {
+		const destination = new URL(location, target);
+		responseHeaders.set(
+			'Location',
+			destination.origin === tenant.api.origin
+				? destination.pathname + destination.search + destination.hash
+				: destination.href,
+		);
+	}
+	responseHeaders.set('Cache-Control', 'no-store');
+	responseHeaders.set('Vary', 'Host, X-Forwarded-Host, X-Front-Domain');
+	// fetch decodes compressed bodies: do not reuse upstream Content-Length/Encoding.
+	return new Response(upstream.body, {
+		status: upstream.status,
+		statusText: upstream.statusText,
+		headers: responseHeaders,
+	});
+}