Package verified Dune checkpoints for TrueNAS and HTTPS proxying

Serve built Workers directly through pinned Miniflare with persistent D1-compatible storage and startup migrations. Build and verify Docker images in CI; publish main checkpoints to GHCR for manual TrueNAS updates on port 33046. Preserve explicit public-origin checks and LAN-compatible cryptographic operation IDs.

Validation: 5,153 offline tests, typecheck, lint and build; 49 HTTP integration cases; HTTPS-origin create/join/chat/seat protection, foreign-origin rejection, exact saved-seat restart and browser asset serving. Independent persistence/proxy review completed. Clean Docker CI and actual NAS installation follow this source checkpoint.

app/api/rooms/[code]/route.ts

@@ -1,3 +1,4 @@
+import { requestOrigin } from '@/lib/request-origin';
 import {
   readSeatView,
   authenticate,
@@ -9,7 +10,7 @@ import {
 } from '@/db/rooms';
 import { RuleError } from '@/game/engine';
 import type { FactionId } from '@/game/catalog';
-import { waitUntil } from 'cloudflare:workers';
+import { env, waitUntil } from 'cloudflare:workers';
 import { resumeRoom } from '@/db/room-continuation';
 
 const codeOf = (req: Request) => {
@@ -68,7 +69,7 @@ export async function POST(req: Request) {
   try {
     if (
       req.headers.get('origin') &&
-      req.headers.get('origin') !== new URL(req.url).origin
+      req.headers.get('origin') !== requestOrigin(req, env.DUNE_PUBLIC_ORIGIN)
     )
       return Response.json(
         { error: 'Invalid request origin.' },
@@ -115,7 +116,7 @@ export async function POST(req: Request) {
           headers: {
             ...(r.token
               ? {
-                  'Set-Cookie': `dune_${code}=${r.token}; HttpOnly; SameSite=Strict; Path=/api/rooms/${code}; Max-Age=2592000${new URL(req.url).protocol === 'https:' ? '; Secure' : ''}`,
+                  'Set-Cookie': `dune_${code}=${r.token}; HttpOnly; SameSite=Strict; Path=/api/rooms/${code}; Max-Age=2592000${requestOrigin(req, env.DUNE_PUBLIC_ORIGIN).startsWith('https:') ? '; Secure' : ''}`,
                 }
               : {}),
             'Cache-Control': 'no-store',