9b5e5b5710
Add an "API Keys" page to the buyer SPA (marketplace.vector.apexfusion.org) that mints a custodial gateway API key by POSTing directly to the gateway's public /signup, then shows the key once + deposit address + a base_url/curl usage snippet. Page lives behind the SPA's existing operator login; per-user registration is a later feature. Gateway: - GATEWAY_CORS_ORIGINS env -> corsOrigins allowlist; corsMiddleware echoes Access-Control-* only for allowlisted Origins, answers OPTIONS preflight 204, no credentials. Empty allowlist = CORS off (default safe). Buyer: - GATEWAY_PUBLIC_URL env -> injected into __BUYER_BOOT__.gatewayUrl (only in the authenticated boot block). SPA resolveGatewayUrl() falls back to deriving "api." + location.host so the post-login-no-reload case (boot block absent) still works. - New ApiKeys page + /api-keys route + nav link. Deploy (mainnet compose): gateway GATEWAY_CORS_ORIGINS and buyer GATEWAY_PUBLIC_URL set to the marketplace/api hosts. NOTE: both images must be REBUILT (gateway runs tsx from copied source; buyer SPA is vite-built at image build) — an env-only recreate would silently ship the old code. Typecheck + vite build clean; 205 tests pass. Adversarial multi-agent review (4 dimensions, per-finding verification) surfaced only the rebuild-required deploy note above; no code/security defects. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Local Agents Marketplace
Local Agents Marketplace MVP. See docs/ARCHITECTURE.md for the architecture spec. Monorepo managed with pnpm workspaces. Work-in-progress; not production-ready.