Update CLAUDE.md and dependencies (#43)

* Update CLAUDE.md with Heroku deployment details

Add production Heroku endpoints, deploy-heroku.yml workflow,
POST_LOGOUT_REDIRECT_URI env var, Heroku PORT compatibility note,
and fix stale JWKS config line reference.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Update dependencies (@types/node, pnpm)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: reverentgeek

CLAUDE.md

@@ -167,12 +167,16 @@ Features:
 
 ### Infrastructure
 
-- All services communicate via HTTPS using Caddy's internal CA
-- Caddy handles routing via `*.localtest.me` subdomains
-- Default endpoints:
+- All services communicate via HTTPS using Caddy's internal CA (local) or Heroku's SSL (production)
+- **Local development**: Caddy handles routing via `*.localtest.me` subdomains
   - Auth: `https://id.localtest.me` (port 3001)
   - API: `https://api.localtest.me` (port 3003)
   - APP: `https://app.localtest.me` (port 3004)
+- **Production (Heroku)**: Deployed as Docker containers to Heroku apps with custom domains
+  - Auth: `https://auth.plaidypus.dev`
+  - API: `https://api.plaidypus.dev`
+  - App: `https://app.plaidypus.dev`
+  - See `docs/heroku-setup.md` for full setup instructions
 - Environment variables in `.env` control service configuration
 - TypeScript with ESM modules across all apps
 - Shared TypeScript configuration via `tsconfig.base.json`
@@ -247,7 +251,7 @@ The authorization server uses JWKS (JSON Web Key Set) to sign JWT tokens:
 - Proper cryptographic key rotation
 - Unique key IDs for debugging (e.g., `key-abc123def456`)
 
-**Configuration location:** `apps/auth/src/index.ts` (lines 68-89) loads JWKS from environment and logs warnings if not set
+**Configuration location:** `apps/auth/src/index.ts` (lines 110-129) loads JWKS from environment and logs warnings if not set
 
 ## Sensitive Data Handling
 
@@ -263,6 +267,7 @@ All sensitive configuration is managed through environment variables:
 | `COOKIE_SECRET` | Session cookie signing | High - Never commit |
 | `JWKS` | Token signing keys (contains private key) | Critical - Never commit |
 | `OIDC_CLIENTS` | Multiple client configurations | High - Never commit |
+| `POST_LOGOUT_REDIRECT_URI` | Post-logout redirect URL | Low - Configurable per environment |
 
 ### Template Configuration Files
 
@@ -340,6 +345,7 @@ This project includes automated CI/CD pipelines and containerization support for
 | -------- | ------- | ------- |
 | `ci.yml` | PRs, push to main | Lint, build, security audit |
 | `security.yml` | Weekly, dependency changes | CodeQL analysis, Docker image scanning |
+| `deploy-heroku.yml` | Push to main, manual | Build and deploy all services to Heroku |
 | `deploy-*.yml` | Push to paths | Deploy individual services to VM |
 
 #### CI Workflow (`ci.yml`)
@@ -388,6 +394,7 @@ docker compose up --build
 - Non-root user for security
 - Health checks for container orchestration
 - Production-only dependencies
+- Heroku PORT compatibility (maps dynamic `PORT` to service-specific port vars)
 
 ### Docker Compose
 

apps/api/package.json

@@ -18,7 +18,7 @@
   },
   "devDependencies": {
     "@types/express": "^5.0.6",
-    "@types/node": "^25.3.0",
+    "@types/node": "^25.3.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3"
   }

apps/app/package.json

@@ -27,7 +27,7 @@
     "@types/cookie-parser": "^1.4.10",
     "@types/ejs": "^3.1.5",
     "@types/express": "^5.0.6",
-    "@types/node": "^25.3.0",
+    "@types/node": "^25.3.1",
     "concurrently": "^9.2.1",
     "tailwindcss": "^4.2.1",
     "tsx": "^4.21.0",

apps/auth/package.json

@@ -23,7 +23,7 @@
     "@tailwindcss/cli": "^4.2.1",
     "@types/ejs": "^3.1.5",
     "@types/express": "^5.0.6",
-    "@types/node": "^25.3.0",
+    "@types/node": "^25.3.1",
     "concurrently": "^9.2.1",
     "tailwindcss": "^4.2.1",
     "tsx": "^4.21.0",

apps/shared/package.json

@@ -53,7 +53,7 @@
   },
   "devDependencies": {
     "@types/express": "^5.0.6",
-    "@types/node": "^25.3.0",
+    "@types/node": "^25.3.1",
     "typescript": "^5.9.3"
   },
   "peerDependencies": {

package.json

@@ -2,7 +2,7 @@
   "name": "core-exchange-node-example",
   "private": true,
   "version": "1.0.1",
-  "packageManager": "pnpm@10.28.2+sha512.41872f037ad22f7348e3b1debbaf7e867cfd448f2726d9cf74c08f19507c31d2c8e7a11525b983febc2df640b5438dee6023ebb1f84ed43cc2d654d2bc326264",
+  "packageManager": "pnpm@10.30.2",
   "type": "module",
   "author": "David Neal <dneal@plaid.com> (https://reverentgeek.com)",
   "contributors": [],