@aurostack/stacks 0.1.0

package/templates/react-app/template.json

@@ -0,0 +1,222 @@
+{
+	"name": "react-app",
+	"version": "0.1.0",
+	"title": "React app (single Vite app)",
+	"description": "One Vite/React 19 app carrying the whole frontend: an RTK Query data layer with a single baseApi, better-auth session handling and route guards, the login/signup/reset screens as routes, a shadcn-style UI kit with light/dark theming, layouts and state screens, and generated OpenAPI types. Same stack as react-monorepo, one deployment.",
+	"derivedFrom": "react-monorepo",
+	"defaults": {
+		"port": 3000
+	},
+	"aliasRoots": {
+		"@/": "src/"
+	},
+	"generatedPaths": [
+		"**/node_modules/**",
+		"src/shared/types/api/**"
+	],
+	"replacements": [
+		{
+			"from": "acme-app",
+			"to": "{{name}}"
+		},
+		{
+			"from": "Acme Corp",
+			"to": "{{Name}}"
+		},
+		{
+			"from": "AcmeCorp",
+			"to": "{{pascal}}"
+		},
+		{
+			"from": "acme-corp",
+			"to": "{{name}}"
+		},
+		{
+			"from": "acme",
+			"to": "{{name}}"
+		}
+	],
+	"features": {
+		"ui": {
+			"title": "UI kit (src/shared/ui)",
+			"description": "shadcn-style Radix components, a Formik+Zod form helper, light/dark theming with a no-flash init script, and page-meta helpers.",
+			"core": true
+		},
+		"api": {
+			"title": "Data layer (src/shared/api)",
+			"description": "One RTK Query baseApi that every feature extends via injectEndpoints, a configured store, and an upload-aware base query. Endpoint names and tagTypes live in one global namespace — collisions are silent, so keep them unique.",
+			"core": true
+		},
+		"auth": {
+			"title": "Auth (src/shared/auth)",
+			"description": "better-auth browser client, session slice, and route guards. Single origin, so the guard navigates to /login rather than redirecting to another host.",
+			"core": true
+		},
+		"layouts": {
+			"title": "Layouts (src/shared/layouts)",
+			"description": "App shell, auth layout, marketing layout, error boundary and the loading/empty/forbidden/not-found state screens.",
+			"core": true
+		},
+		"auth-screens": {
+			"title": "Auth screens",
+			"description": "Login, signup, forgot/reset password, email verification as routes. Drop this only if you are bringing your own /login — the guards and the 401 handler both send unauthenticated users there.",
+			"default": true,
+			"files": [
+				"src/routes/auth/**",
+				"src/features/auth/**"
+			]
+		},
+		"hooks": {
+			"title": "Shared hooks (src/shared/hooks)",
+			"default": true,
+			"files": [
+				"src/shared/hooks/**"
+			]
+		},
+		"types": {
+			"title": "Generated API types (src/shared/types)",
+			"description": "OpenAPI-generated request/response types and Zod schemas, regenerated from the backend's /openapi-json by `yarn gen`.",
+			"default": true,
+			"files": [
+				"src/shared/types/**",
+				"openapi-ts.config.ts",
+				".bin/openapi.js"
+			],
+			"packageJson": {
+				"devDependencies": [
+					"@hey-api/client-fetch",
+					"@hey-api/openapi-ts",
+					"axios",
+					"dotenv",
+					"tiny-invariant"
+				],
+				"scripts": [
+					"gen",
+					"gen:schema",
+					"gen:types"
+				]
+			}
+		},
+		"marketing": {
+			"title": "Marketing site",
+			"description": "A public landing page at `/`, an SEO route table, and build-time robots.txt / sitemap.xml / security.txt. Including it moves the authenticated app to /app so the landing page can own the root — see src/lib/paths.ts.",
+			"files": [
+				"src/routes/marketing/**",
+				"src/features/seo/**"
+			]
+		},
+		"admin": {
+			"title": "Admin console",
+			"description": "A role-gated /admin branch with its own nav, over the same data layer. The guard decides what renders; the API still has to enforce the role.",
+			"files": [
+				"src/routes/admin/**"
+			]
+		},
+		"realtime": {
+			"title": "Socket.IO client",
+			"description": "socket.io-client wired to the backend's /realtime path, with room helpers and shared event-name constants. Pairs with the nest-api realtime feature.",
+			"files": [
+				"src/shared/api/socket.ts",
+				"src/shared/api/realtime-events.ts"
+			],
+			"packageJson": {
+				"dependencies": [
+					"socket.io-client"
+				]
+			}
+		},
+		"pwa": {
+			"title": "Installable PWA",
+			"description": "vite-plugin-pwa: app-shell offline caching and an update prompt rather than a silent takeover.",
+			"packageJson": {
+				"devDependencies": [
+					"vite-plugin-pwa"
+				]
+			}
+		},
+		"charts": {
+			"title": "Charts",
+			"description": "ApexCharts via react-apexcharts, theme-aware through the shared chart palette.",
+			"packageJson": {
+				"dependencies": [
+					"apexcharts",
+					"react-apexcharts"
+				]
+			}
+		},
+		"husky": {
+			"title": "Git hooks + lint-staged",
+			"default": true,
+			"files": [
+				".husky/**"
+			],
+			"packageJson": {
+				"devDependencies": [
+					"husky",
+					"lint-staged"
+				],
+				"scripts": [
+					"prepare"
+				]
+			}
+		},
+		"docker": {
+			"title": "Docker image",
+			"description": "Multi-stage build producing a static bundle, served by the nginx config in docker/ (cache rules, SPA fallback, security headers).",
+			"default": true,
+			"files": [
+				"Dockerfile",
+				".dockerignore",
+				"build.sh",
+				"docker/**"
+			]
+		},
+		"ci": {
+			"title": "Forgejo Actions CI",
+			"default": true,
+			"files": [
+				".forgejo/**"
+			]
+		},
+		"secrets": {
+			"title": "Infisical secret sync",
+			"default": true,
+			"files": [
+				".bin/secrets.js"
+			],
+			"packageJson": {
+				"scripts": [
+					"secrets"
+				]
+			}
+		}
+	},
+	"hooks": [
+		{
+			"title": "seed .env from .env.example",
+			"run": "cp -n .env.example .env; true",
+			"optional": true
+		},
+		{
+			"title": "yarn install",
+			"run": "yarn install",
+			"optional": true
+		},
+		{
+			"title": "format (the feature strip leaves valid but unformatted code)",
+			"run": "yarn format",
+			"optional": true
+		},
+		{
+			"title": "git init",
+			"run": "git init -q && git add -A && git commit -qm 'chore: scaffold {{name}} from the react-app template'",
+			"optional": true
+		}
+	],
+	"nextSteps": [
+		"Edit .env — VITE_APP_API_URL must point at your backend.",
+		"yarn dev            # http://localhost:{{port}}",
+		"yarn typecheck      # app + build config",
+		"Routes live in src/routes; shared code in src/shared; see src/lib/paths.ts for where the app is mounted."
+	]
+}

package/templates/react-monorepo/files/.dockerignore

@@ -0,0 +1,19 @@
+# Keep the build context small and the image reproducible.
+node_modules
+**/node_modules
+**/dist
+**/dev-dist
+.turbo
+**/.turbo
+
+# Env files are NOT copied into the image — the URLs are passed as build args.
+# Copying them would bake whichever environment happened to be checked out.
+**/.env
+**/.env.*
+!**/.env.example
+
+.git
+.github
+.forgejo
+*.log
+.DS_Store

package/templates/react-monorepo/files/.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = tab
+indent_size = 2
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

package/templates/react-monorepo/files/.forgejo/workflows/build-and-push.yml

@@ -0,0 +1,98 @@
+# Builds and pushes all four frontend apps from one Dockerfile.
+#
+# Unlike web-backend / web-coming-soon this repo produces FOUR images, so the
+# tag is generated once in a separate job and shared by every matrix leg —
+# otherwise each app would get its own random tag and there would be no way to
+# deploy a matching set.
+#
+# Vite compiles the VITE_* URLs into each bundle at build time, so these images
+# are specific to one environment. See frontend/docker/README.md.
+
+name: Build and Push
+
+on:
+  push:
+    branches:
+      - main
+  # Day-to-day work happens on `development`; this lets a build be cut without
+  # merging to main first.
+  workflow_dispatch:
+
+jobs:
+  # One tag for the whole set, so `web-client:26_07_26_12345` and
+  # `web-auth:26_07_26_12345` are guaranteed to be from the same commit.
+  meta:
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.tag.outputs.TAG }}
+      owner: ${{ steps.tag.outputs.OWNER }}
+    steps:
+      - name: Generate image tag
+        id: tag
+        run: |
+          DATE=$(date +'%y_%m_%d')
+          RAND=$(printf '%05d' "$((RANDOM % 100000))")
+          echo "TAG=${DATE}_${RAND}" >> "$GITHUB_OUTPUT"
+          # Derived from `github.repository` (which web-backend's workflow already
+          # relies on) rather than `github.repository_owner`, so this doesn't
+          # depend on a context variable Forgejo may not populate. This repo is
+          # `acme-corp/web-frontend`, so OWNER=acme-corp and the
+          # images land as <registry>/acme-corp/web-<app>, matching
+          # stack/frontend.compose.yml.
+          echo "OWNER=$(echo '${{ github.repository }}' | cut -d/ -f1)" >> "$GITHUB_OUTPUT"
+
+  build-and-push:
+    runs-on: ubuntu-latest
+    needs: meta
+    strategy:
+      # Report every app's result rather than cancelling siblings on the first
+      # failure. Note this means a partial set can be pushed — re-run the job.
+      fail-fast: false
+      matrix:
+        app: [landing, auth, client, admin]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ secrets.REGISTRY_URL }}
+          username: ${{ secrets.DK_USER }}
+          password: ${{ secrets.DK_ACCESS_TOKEN }}
+
+      - name: Build and Push ${{ matrix.app }}
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: .
+          # Every value goes to every app; each app reads only what it needs.
+          # Passing an unused build arg is harmless and keeps this matrix from
+          # needing per-app argument lists. Note `landing` is NOT argument-free:
+          # it calls the API and renders the support address.
+          build-args: |
+            APP=${{ matrix.app }}
+            VITE_APP_API_URL=${{ secrets.VITE_APP_API_URL }}
+            VITE_APP_AUTH_HOST=${{ secrets.VITE_APP_AUTH_HOST }}
+            VITE_APP_CLIENT_HOST=${{ secrets.VITE_APP_CLIENT_HOST }}
+            VITE_APP_ADMIN_HOST=${{ secrets.VITE_APP_ADMIN_HOST }}
+            VITE_APP_LANDING=${{ secrets.VITE_APP_LANDING }}
+            VITE_APP_SUPPORT_EMAIL=${{ secrets.VITE_APP_SUPPORT_EMAIL }}
+            VITE_APP_SITE_URL=${{ secrets.VITE_APP_SITE_URL }}
+          tags: |
+            ${{ secrets.REGISTRY }}/${{ needs.meta.outputs.owner }}/web-${{ matrix.app }}:latest
+            ${{ secrets.REGISTRY }}/${{ needs.meta.outputs.owner }}/web-${{ matrix.app }}:${{ needs.meta.outputs.tag }}
+          # Optional speed-up: each matrix leg runs its own `yarn install`, so a
+          # registry layer cache cuts most of that. Enable only after confirming
+          # the registry accepts OCI cache manifests — some reject them and the
+          # push then fails.
+          # cache-from: type=registry,ref=${{ secrets.REGISTRY }}/${{ needs.meta.outputs.owner }}/web-${{ matrix.app }}:buildcache
+          # cache-to: type=registry,ref=${{ secrets.REGISTRY }}/${{ needs.meta.outputs.owner }}/web-${{ matrix.app }}:buildcache,mode=max
+
+      - name: Summary
+        run: |
+          echo "Pushed web-${{ matrix.app }}:${{ needs.meta.outputs.tag }}" >> "$GITHUB_STEP_SUMMARY"

package/templates/react-monorepo/files/.forgejo/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - "**"
+      - "!main"
+      - "!development"
+  pull_request:
+
+jobs:
+  verify:
+    name: Lint, typecheck, build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Use Node.js 24
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: 'yarn'
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Format check
+        run: yarn format:check
+
+      - name: Lint, typecheck, build
+        run: yarn turbo run lint typecheck build

package/templates/react-monorepo/files/.husky/pre-commit

@@ -0,0 +1 @@
+yarn lint-staged

package/templates/react-monorepo/files/.nvmrc

@@ -0,0 +1 @@
+24.13.0

package/templates/react-monorepo/files/.prettierignore

@@ -0,0 +1,6 @@
+node_modules
+dist
+.turbo
+yarn.lock
+# generated API types are formatted by their own pipeline
+**/src/types/api

package/templates/react-monorepo/files/.prettierrc

@@ -0,0 +1,9 @@
+{
+	"singleQuote": true,
+	"bracketSpacing": true,
+	"useTabs": true,
+	"tabWidth": 2,
+	"printWidth": 120,
+	"semi": true,
+	"trailingComma": "none"
+}

package/templates/react-monorepo/files/.yarnrc.yml

@@ -0,0 +1,2 @@
+nodeLinker: node-modules
+enableTelemetry: false

package/templates/react-monorepo/files/Dockerfile

@@ -0,0 +1,90 @@
+# One Dockerfile for all four apps — pick which with `--build-arg APP=<name>`.
+#
+#   docker build --build-arg APP=client \
+#     --build-arg VITE_APP_API_URL=https://api.acme.site ... -t …/web-client .
+#
+# `landing` additionally requires --build-arg VITE_APP_SITE_URL=https://acme.site
+# for canonical tags and sitemap.xml.
+#
+# IMPORTANT: Vite inlines `VITE_*` values into the JS bundle at BUILD time, so a
+# built image is pinned to one environment. The URLs below are build args, not
+# runtime env — setting them in compose does nothing. Build one image per
+# environment, or move to runtime config (see docker/README.md).
+
+# ---------- deps ----------
+# Manifests only, so `yarn install` re-runs solely when a dependency changes.
+FROM aurostack.dev/wesnetech/nodejs:24 AS deps
+WORKDIR /repo
+
+COPY package.json yarn.lock .yarnrc.yml turbo.json ./
+COPY apps/admin/package.json      apps/admin/
+COPY apps/auth/package.json       apps/auth/
+COPY apps/client/package.json     apps/client/
+COPY apps/landing/package.json    apps/landing/
+COPY packages/api/package.json    packages/api/
+COPY packages/auth/package.json   packages/auth/
+COPY packages/config/package.json packages/config/
+COPY packages/hooks/package.json  packages/hooks/
+COPY packages/layouts/package.json packages/layouts/
+COPY packages/types/package.json  packages/types/
+COPY packages/ui/package.json     packages/ui/
+
+RUN corepack enable && yarn install --immutable
+
+# ---------- build ----------
+FROM aurostack.dev/wesnetech/nodejs:24 AS build
+WORKDIR /repo
+ENV NODE_ENV=production
+# Each stage is a fresh image, so corepack has to be enabled again here —
+# without it `yarn` is the bundled 1.x and refuses the packageManager field.
+RUN corepack enable
+
+COPY --from=deps /repo/node_modules ./node_modules
+COPY . .
+
+ARG APP
+# Build args become env vars so Vite's define step picks them up. Verified:
+# process env takes precedence over a committed .env, so a stale checked-in
+# .env cannot leak into the image as long as the arg is supplied.
+ARG VITE_APP_API_URL
+ARG VITE_APP_AUTH_HOST
+ARG VITE_APP_CLIENT_HOST
+ARG VITE_APP_ADMIN_HOST
+ARG VITE_APP_LANDING
+ARG VITE_APP_SUPPORT_EMAIL
+# Landing only: canonical origin for <link rel="canonical">, og:url and the
+# generated sitemap.xml. Must be a build arg — .dockerignore excludes .env, so a
+# local value never reaches the image.
+ARG VITE_APP_SITE_URL
+ENV VITE_APP_API_URL=$VITE_APP_API_URL \
+	VITE_APP_AUTH_HOST=$VITE_APP_AUTH_HOST \
+	VITE_APP_CLIENT_HOST=$VITE_APP_CLIENT_HOST \
+	VITE_APP_ADMIN_HOST=$VITE_APP_ADMIN_HOST \
+	VITE_APP_LANDING=$VITE_APP_LANDING \
+	VITE_APP_SUPPORT_EMAIL=$VITE_APP_SUPPORT_EMAIL \
+	VITE_APP_SITE_URL=$VITE_APP_SITE_URL
+
+# Fail loudly rather than silently producing a bundle with `undefined` URLs
+# baked in — that failure is invisible until the app 404s at runtime.
+RUN test -n "$APP" || (echo "ERROR: --build-arg APP=<admin|auth|client|landing> is required" && exit 1)
+RUN if [ "$APP" != "landing" ] && [ -z "$VITE_APP_API_URL" ]; then \
+	echo "ERROR: $APP needs --build-arg VITE_APP_API_URL"; exit 1; \
+	fi
+# Landing fails silently without this: no canonical tags and no sitemap.xml, with
+# only a build warning nobody reads. Same reasoning as the check above.
+RUN if [ "$APP" = "landing" ] && [ -z "$VITE_APP_SITE_URL" ]; then \
+	echo "ERROR: landing needs --build-arg VITE_APP_SITE_URL (e.g. https://acme.site)"; exit 1; \
+	fi
+
+# `--filter` builds the app plus only the workspace packages it depends on.
+RUN yarn turbo run build --filter="$APP"
+
+# ---------- runtime ----------
+FROM nginx:stable-alpine AS runtime
+ARG APP
+COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /repo/apps/$APP/dist /usr/share/nginx/html
+
+EXPOSE 80
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
+	CMD wget -qO- http://127.0.0.1/healthz || exit 1

package/templates/react-monorepo/files/_gitignore

@@ -0,0 +1,35 @@
+# dependencies
+node_modules/
+
+# yarn (berry, node-modules linker)
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions
+.pnp.*
+yarn-error.log
+
+# build output
+dist/
+.turbo/
+*.tsbuildinfo
+
+# env
+.env
+.env.local
+.env.*.local
+.env.test
+.env.production
+
+# editor / os
+.DS_Store
+*.log
+
+# generated OpenAPI schema dump
+openapi.json
+
+dev-dist/
+# Intermediate SSR bundle for the landing prerender pass (MAI-88).
+.prerender/

package/templates/react-monorepo/files/apps/admin/.bin/secrets.js

@@ -0,0 +1,57 @@
+import { execSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// Pulls this workspace's env from Infisical into the matching .env file.
+// The Infisical path is derived from the package name, e.g.
+//   @scope/types -> /frontend/types, landing -> /frontend/landing
+//
+// The project ID comes from the environment rather than being hardcoded: it
+// identifies one organisation's vault, so a value baked in here would follow
+// every copy of this scaffold to projects it has nothing to do with. Put it in
+// your shell profile, or in a committed `.infisical.json`.
+const PROJECT_ID = process.env.INFISICAL_PROJECT_ID;
+const SECRET_ROOT = process.env.INFISICAL_PATH_PREFIX ?? '/frontend';
+
+const ENV_FILES = {
+	dev: '.env',
+	test: '.env.test',
+	staging: '.env.staging',
+	prod: '.env.production'
+};
+
+const normalizeEnv = (raw) => {
+	if (['dev', 'development'].includes(raw)) return 'dev';
+	if (['test', 'testing'].includes(raw)) return 'test';
+	if (['prod', 'production'].includes(raw)) return 'prod';
+	if (raw === 'staging') return 'staging';
+	throw new Error(`Unknown env '${raw}' (use one of: dev, test, staging, prod)`);
+};
+
+const parseEnvArg = () => {
+	const args = process.argv.slice(2);
+	const flagIndex = args.findIndex((a) => a === '-e' || a === '--env');
+	if (flagIndex !== -1 && args[flagIndex + 1]) return args[flagIndex + 1];
+	const inline = args.find((a) => a.startsWith('--env='));
+	if (inline) return inline.slice('--env='.length);
+	return 'development';
+};
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'));
+const slug = pkg.name.replace(/^@[^/]+\//, '');
+const secretPath = `${SECRET_ROOT}/${slug}`;
+
+if (!PROJECT_ID) {
+	console.error('INFISICAL_PROJECT_ID is not set — nothing to fetch from.');
+	process.exit(1);
+}
+
+const env = normalizeEnv(parseEnvArg());
+const envFile = ENV_FILES[env];
+
+console.log(`Fetching secrets for '${slug}' (${env}) -> ${envFile}...`);
+execSync(`infisical export --projectId="${PROJECT_ID}" --path="${secretPath}" --env=${env} > ${envFile}`, {
+	stdio: 'inherit'
+});

package/templates/react-monorepo/files/apps/admin/.env.example

@@ -0,0 +1,16 @@
+# Copy to .env. Vite only exposes variables prefixed VITE_, and inlines them at
+# build time — never put a secret here, it ships to the browser.
+
+# Backend base URL. Better Auth lives at ${VITE_APP_API_URL}/auth.
+VITE_APP_API_URL='http://localhost:5000'
+
+# Sibling app origins. All four share one session cookie across subdomains, so
+# these must agree with the backend's BETTER_AUTH_COOKIE_DOMAIN and its
+# trustedOrigins list, or login will appear to succeed and then bounce.
+VITE_APP_LANDING='http://localhost:3000'
+VITE_APP_AUTH_HOST='http://localhost:3001'
+VITE_APP_CLIENT_HOST='http://localhost:3002'
+VITE_APP_ADMIN_HOST='http://localhost:3003'
+
+# This app's own dev port.
+PORT='3003'

package/templates/react-monorepo/files/apps/admin/eslint.config.mjs

@@ -0,0 +1,3 @@
+import config from '@acme/config/eslint';
+
+export default config;

package/templates/react-monorepo/files/apps/admin/index.html

@@ -0,0 +1,57 @@
+<!doctype html>
+<html lang="en">
+	<head>
+		<meta charset="UTF-8" />
+		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
+		<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
+		<link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
+		<link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
+		<link rel="icon" href="/favicon.ico" sizes="any" />
+		<link rel="manifest" href="/site.webmanifest" />
+		<meta name="theme-color" content="%THEME_LIGHT%" />
+		<!--
+			Applies the saved (or system) theme before first paint, so the app never
+			flashes light then flips to dark. Mirrors `themeInitScript` in @acme/ui —
+			inlined because it must run before any module loads. Keep the two in sync.
+			%THEME_LIGHT/DARK% come from THEME_COLORS via the shared vite config.
+		-->
+		<script>
+			(function () {
+				try {
+					var m = localStorage.getItem('acme-theme');
+					var d =
+						m === 'dark' || ((m === null || m === 'system') && matchMedia('(prefers-color-scheme: dark)').matches);
+					var r = document.documentElement;
+					r.classList.toggle('dark', d);
+					r.style.colorScheme = d ? 'dark' : 'light';
+					var t = document.querySelector('meta[name="theme-color"]');
+					if (t) t.setAttribute('content', d ? '%THEME_DARK%' : '%THEME_LIGHT%');
+				} catch (e) {}
+			})();
+		</script>
+		<!--
+			globals.css only styles `body`, so without this the UA canvas paints white
+			for the moment before the stylesheet lands — a white flash on a dark load.
+		-->
+		<style>
+			html {
+				background: %THEME_LIGHT%;
+			}
+			html.dark {
+				background: %THEME_DARK%;
+			}
+		</style>
+		<meta name="description" content="Acme Corp admin console." />
+		<!--
+			Private surface: never indexed. `robots.txt` only discourages crawling,
+			while `noindex` prevents listing, so both are present. This app's routes
+			include password-reset and email-verify URLs.
+		-->
+		<meta name="robots" content="noindex, nofollow" />
+		<title>%APP_TITLE%</title>
+	</head>
+	<body>
+		<div id="root"></div>
+		<script type="module" src="/src/main.tsx"></script>
+	</body>
+</html>