npm - @aurostack/stacks - Versions diffs - 0.1.0 - Mend

@aurostack/stacks 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (601) hide show

package/templates/react-monorepo/files/apps/landing/.bin/secrets.js ADDED Viewed

@@ -0,0 +1,57 @@
+import { execSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+// Pulls this workspace's env from Infisical into the matching .env file.
+// The Infisical path is derived from the package name, e.g.
+//   @scope/types -> /frontend/types, landing -> /frontend/landing
+//
+// The project ID comes from the environment rather than being hardcoded: it
+// identifies one organisation's vault, so a value baked in here would follow
+// every copy of this scaffold to projects it has nothing to do with. Put it in
+// your shell profile, or in a committed `.infisical.json`.
+const PROJECT_ID = process.env.INFISICAL_PROJECT_ID;
+const SECRET_ROOT = process.env.INFISICAL_PATH_PREFIX ?? '/frontend';
+const ENV_FILES = {
+	dev: '.env',
+	test: '.env.test',
+	staging: '.env.staging',
+	prod: '.env.production'
+};
+const normalizeEnv = (raw) => {
+	if (['dev', 'development'].includes(raw)) return 'dev';
+	if (['test', 'testing'].includes(raw)) return 'test';
+	if (['prod', 'production'].includes(raw)) return 'prod';
+	if (raw === 'staging') return 'staging';
+	throw new Error(`Unknown env '${raw}' (use one of: dev, test, staging, prod)`);
+};
+const parseEnvArg = () => {
+	const args = process.argv.slice(2);
+	const flagIndex = args.findIndex((a) => a === '-e' || a === '--env');
+	if (flagIndex !== -1 && args[flagIndex + 1]) return args[flagIndex + 1];
+	const inline = args.find((a) => a.startsWith('--env='));
+	if (inline) return inline.slice('--env='.length);
+	return 'development';
+};
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'));
+const slug = pkg.name.replace(/^@[^/]+\//, '');
+const secretPath = `${SECRET_ROOT}/${slug}`;
+if (!PROJECT_ID) {
+	console.error('INFISICAL_PROJECT_ID is not set — nothing to fetch from.');
+	process.exit(1);
+}
+const env = normalizeEnv(parseEnvArg());
+const envFile = ENV_FILES[env];
+console.log(`Fetching secrets for '${slug}' (${env}) -> ${envFile}...`);
+execSync(`infisical export --projectId="${PROJECT_ID}" --path="${secretPath}" --env=${env} > ${envFile}`, {
+	stdio: 'inherit'
+});

package/templates/react-monorepo/files/apps/landing/.env.example ADDED Viewed

@@ -0,0 +1,20 @@
+# Copy to .env. Vite only exposes variables prefixed VITE_, and inlines them at
+# build time — never put a secret here, it ships to the browser.
+# Backend base URL. Better Auth lives at ${VITE_APP_API_URL}/auth.
+VITE_APP_API_URL='http://localhost:5000'
+# Sibling app origins. All four share one session cookie across subdomains, so
+# these must agree with the backend's BETTER_AUTH_COOKIE_DOMAIN and its
+# trustedOrigins list, or login will appear to succeed and then bounce.
+VITE_APP_LANDING='http://localhost:3000'
+VITE_APP_AUTH_HOST='http://localhost:3001'
+VITE_APP_CLIENT_HOST='http://localhost:3002'
+VITE_APP_ADMIN_HOST='http://localhost:3003'
+# This app's own dev port.
+PORT='3000'
+# Canonical public URL, used for sitemap/robots/OG tags at build time.
+VITE_APP_SITE_URL='http://localhost:3000'
+VITE_APP_SUPPORT_EMAIL='support@example.com'

package/templates/react-monorepo/files/apps/landing/eslint.config.mjs ADDED Viewed

@@ -0,0 +1,3 @@
+import config from '@acme/config/eslint';
+export default config;

package/templates/react-monorepo/files/apps/landing/index.html ADDED Viewed

@@ -0,0 +1,51 @@
+<!doctype html>
+<html lang="en">
+	<head>
+		<meta charset="UTF-8" />
+		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
+		<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
+		<link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
+		<link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
+		<link rel="icon" href="/favicon.ico" sizes="any" />
+		<link rel="manifest" href="/site.webmanifest" />
+		<meta name="theme-color" content="%THEME_LIGHT%" />
+		<!--
+			Applies the saved (or system) theme before first paint, so the app never
+			flashes light then flips to dark. Mirrors `themeInitScript` in @acme/ui —
+			inlined because it must run before any module loads. Keep the two in sync.
+			%THEME_LIGHT/DARK% come from THEME_COLORS via the shared vite config.
+		-->
+		<script>
+			(function () {
+				try {
+					var m = localStorage.getItem('acme-theme');
+					var d =
+						m === 'dark' || ((m === null || m === 'system') && matchMedia('(prefers-color-scheme: dark)').matches);
+					var r = document.documentElement;
+					r.classList.toggle('dark', d);
+					r.style.colorScheme = d ? 'dark' : 'light';
+					var t = document.querySelector('meta[name="theme-color"]');
+					if (t) t.setAttribute('content', d ? '%THEME_DARK%' : '%THEME_LIGHT%');
+				} catch (e) {}
+			})();
+		</script>
+		<!--
+			globals.css only styles `body`, so without this the UA canvas paints white
+			for the moment before the stylesheet lands — a white flash on a dark load.
+		-->
+		<style>
+			html {
+				background: %THEME_LIGHT%;
+			}
+			html.dark {
+				background: %THEME_DARK%;
+			}
+		</style>
+		<meta name="description" content="Acme Corp." />
+		<title>%APP_TITLE%</title>
+	</head>
+	<body>
+		<div id="root"></div>
+		<script type="module" src="/src/main.tsx"></script>
+	</body>
+</html>

package/templates/react-monorepo/files/apps/landing/package.json ADDED Viewed

@@ -0,0 +1,33 @@
+{
+	"name": "landing",
+	"private": true,
+	"version": "0.0.0",
+	"type": "module",
+	"scripts": {
+		"dev": "vite",
+		"build": "tsc --noEmit && vite build",
+		"preview": "vite preview",
+		"lint": "eslint .",
+		"typecheck": "tsc --noEmit",
+		"secrets": "node .bin/secrets.js"
+	},
+	"dependencies": {
+		"@acme/api": "workspace:*",
+		"@acme/auth": "workspace:*",
+		"@acme/layouts": "workspace:*",
+		"@acme/types": "workspace:*",
+		"@acme/ui": "workspace:*",
+		"@reduxjs/toolkit": "^2.12.0",
+		"lucide-react": "^1.17.0",
+		"react": "^19.2.6",
+		"react-dom": "^19.2.6",
+		"react-redux": "^9.3.0",
+		"react-router": "^8.2.0"
+	},
+	"devDependencies": {
+		"@acme/config": "workspace:*",
+		"@types/react": "^19.2.14",
+		"@types/react-dom": "^19.2.3",
+		"vite": "^8.0.12"
+	}
+}

package/templates/react-monorepo/files/apps/landing/src/App.tsx ADDED Viewed

@@ -0,0 +1,3 @@
+// The Landing app is driven by the router (see app/router.tsx); this module is
+// intentionally empty and no longer rendered.
+export {};

package/templates/react-monorepo/files/apps/landing/src/app/providers.tsx ADDED Viewed

@@ -0,0 +1,42 @@
+import type { ReactNode } from 'react';
+import { Provider } from 'react-redux';
+import { configureApi } from '@acme/api';
+import { AuthProvider, configureAuth, redirectToLogin } from '@acme/auth';
+import { MetaProvider, ThemeProvider, Toaster, installZodErrorMap } from '@acme/ui';
+import { store } from './store';
+const env = import.meta.env;
+const apiBaseUrl = env.VITE_APP_API_URL;
+const authAppUrl = env.VITE_APP_AUTH_HOST as string;
+const trustedOrigins = [env.VITE_APP_LANDING, env.VITE_APP_CLIENT_HOST, env.VITE_APP_ADMIN_HOST, authAppUrl].filter(
+	(value): value is string => Boolean(value)
+);
+// Wire the shared API + auth clients once, before rendering. The landing site is public, so a 401 is not automatically a redirect.
+configureApi({ baseUrl: apiBaseUrl, onUnauthorized: () => redirectToLogin() });
+configureAuth({
+	authApiBaseUrl: `${apiBaseUrl}/auth`,
+	authAppUrl,
+	trustedOrigins,
+	defaultRedirect: (env.VITE_APP_LANDING as string | undefined) ?? window.location.origin
+});
+installZodErrorMap();
+export function Providers({ children }: { children: ReactNode }) {
+	return (
+		// ThemeProvider above the Redux Provider: it only touches the document
+		// (`dark` class, color-scheme, theme-color meta) and must not re-render
+		// through the store.
+		<ThemeProvider>
+			<MetaProvider>
+				<Provider store={store}>
+					<AuthProvider>
+						{children}
+						<Toaster />
+					</AuthProvider>
+				</Provider>
+			</MetaProvider>
+		</ThemeProvider>
+	);
+}

package/templates/react-monorepo/files/apps/landing/src/app/router.tsx ADDED Viewed

@@ -0,0 +1,21 @@
+import { createBrowserRouter } from 'react-router';
+import { ErrorBoundary, MarketingLayout, NotFound } from '@acme/layouts';
+import { HomeRoute } from '../routes/home';
+/**
+ * The landing site is public — no auth guard. `MarketingLayout` takes `header`
+ * and `footer` slots and falls back to the router's <Outlet /> for content.
+ * `ErrorBoundary` wraps it rather than being the route's `errorElement`: it is
+ * a plain React error boundary taking `children`.
+ */
+export const router = createBrowserRouter([
+	{
+		element: (
+			<ErrorBoundary>
+				<MarketingLayout />
+			</ErrorBoundary>
+		),
+		children: [{ index: true, element: <HomeRoute /> }]
+	},
+	{ path: '*', element: <NotFound /> }
+]);

package/templates/react-monorepo/files/apps/landing/src/app/store.ts ADDED Viewed

@@ -0,0 +1,18 @@
+import { makeStore } from '@acme/api';
+import { authReducer } from '@acme/auth';
+import { useDispatch, useSelector } from 'react-redux';
+// `auth` holds the Better Auth session so the header can swap its CTAs for a
+// signed-in visitor. Landing still has no protected routes and no guards — it
+// reads the session purely to render, and every page stays fully public.
+export const store = makeStore({
+	reducer: {
+		auth: authReducer
+	}
+});
+export type RootState = ReturnType<typeof store.getState>;
+export type AppDispatch = typeof store.dispatch;
+export const useAppDispatch = useDispatch.withTypes<AppDispatch>();
+export const useAppSelector = useSelector.withTypes<RootState>();

package/templates/react-monorepo/files/apps/landing/src/features/seo/routes.ts ADDED Viewed

@@ -0,0 +1,65 @@
+/**
+ * Every indexable route, with the metadata that describes it.
+ *
+ * **This is the single source.** `PageSeo` renders per-route tags from it and
+ * the build emits `sitemap.xml` from it (see `vite.config.ts`), so the sitemap
+ * cannot list a route that does not exist or miss one that does — the classic
+ * way a sitemap rots. Add a route here on the same commit that adds it to
+ * `app/router.tsx`, and remove it the same way; a sitemap advertising a 404
+ * stays invisible until a crawler finds it.
+ *
+ * Kept free of React imports: `vite.config.ts` imports this directly, and the
+ * config is bundled with esbuild.
+ */
+export type SeoRoute = {
+	/** Path as it appears in the router, leading slash, no trailing slash. */
+	path: string;
+	/** Page segment only — `MetaProvider` appends the brand suffix. */
+	title: string;
+	description: string;
+	/** Relative priority for the sitemap; the homepage leads. */
+	priority: string;
+	changefreq: 'daily' | 'weekly' | 'monthly' | 'yearly';
+};
+export const SEO_ROUTES: SeoRoute[] = [
+	{
+		path: '/',
+		title: 'Home',
+		description: 'Replace with the description search results should show.',
+		priority: '1.0',
+		changefreq: 'weekly'
+	}
+];
+/**
+ * The one origin that may be indexed. Staging and preview builds compare
+ * unequal and are served `noindex`, so a preview deploy cannot outrank
+ * production for its own content.
+ */
+export const PRODUCTION_ORIGIN = 'https://example.com';
+export const seoRouteFor = (path: string) => SEO_ROUTES.find((route) => route.path === path);
+/**
+ * Absolute URL for a path — canonical, `og:url` and sitemap entries all need one.
+ *
+ * `origin` is passed in rather than read here so this file stays free of
+ * `import.meta.env`: it is imported by `vite.config.ts`, where `import.meta.env`
+ * does not exist. App code gets the origin from its env, the build from its own
+ * `loadEnv`.
+ */
+export const absoluteUrl = (path: string, origin: string) => (path === '/' ? `${origin}/` : `${origin}${path}`);
+/** Strip a trailing slash so joins don't produce `//about`. */
+export const normalizeOrigin = (origin: string) => origin.replace(/\/$/, '');
+/*
+ * Not included here: **prerendering**. `vite build` emits a single SPA shell,
+ * so a crawler that does not execute JavaScript sees an empty `#root` for every
+ * route. `robots.txt` and `sitemap.xml` are emitted from this table at build
+ * time (see `vite.config.ts`), which is the half that matters for discovery —
+ * but if these pages need to rank on their content, add a post-build pass that
+ * renders each `SEO_ROUTES` entry to `dist/<path>/index.html`. Drive it from
+ * this table, not a second list, or the sitemap and the prerendered set drift.
+ */

package/templates/react-monorepo/files/apps/landing/src/lib/env.ts ADDED Viewed

@@ -0,0 +1,10 @@
+const env = import.meta.env;
+export const API_URL = env.VITE_APP_API_URL;
+export const AUTH_HOST = env.VITE_APP_AUTH_HOST;
+export const CLIENT_HOST = env.VITE_APP_CLIENT_HOST;
+/** Support inbox shown on /contact. Per-environment, so it is never hardcoded —
+ *  it must match the backend's SMTP_SUPPORT_EMAIL, which is where the form
+ *  actually posts. Falsy when the build arg is missing; the UI hides the block
+ *  rather than rendering `mailto:undefined`. */
+export const SUPPORT_EMAIL = env.VITE_APP_SUPPORT_EMAIL;

package/templates/react-monorepo/files/apps/landing/src/main.tsx ADDED Viewed

@@ -0,0 +1,14 @@
+import { StrictMode } from 'react';
+import { createRoot } from 'react-dom/client';
+import { RouterProvider } from 'react-router';
+import '@acme/ui/globals.css';
+import { Providers } from './app/providers';
+import { router } from './app/router';
+createRoot(document.getElementById('root')!).render(
+	<StrictMode>
+		<Providers>
+			<RouterProvider router={router} />
+		</Providers>
+	</StrictMode>
+);

package/templates/react-monorepo/files/apps/landing/src/routes/home.tsx ADDED Viewed

@@ -0,0 +1,18 @@
+import { PageMeta } from '@acme/ui';
+import { Section, SectionHeading } from '@acme/layouts';
+export function HomeRoute() {
+	return (
+		<>
+			{/* `title` is the page segment only — MetaProvider appends the brand. */}
+			<PageMeta title="Home" />
+			<Section>
+				<SectionHeading
+					eyebrow="Acme Corp"
+					title="Replace this with your hero"
+					lede="One sentence on what this product does, written for someone who has never heard of it."
+				/>
+			</Section>
+		</>
+	);
+}

package/templates/react-monorepo/files/apps/landing/src/vite-env.d.ts ADDED Viewed

@@ -0,0 +1,15 @@
+/// <reference types="vite/client" />
+/// <reference types="vite-plugin-svgr/client" />
+interface ImportMetaEnv {
+	VITE_APP_API_URL: string;
+	VITE_APP_ALLOWED_HOSTS: string;
+	VITE_APP_AUTH_HOST: string;
+	VITE_APP_CLIENT_HOST: string;
+	VITE_APP_ADMIN_HOST: string;
+	VITE_APP_SUPPORT_EMAIL: string;
+}
+interface ImportMeta {
+	readonly env: ImportMetaEnv;
+}

package/templates/react-monorepo/files/apps/landing/tsconfig.json ADDED Viewed

@@ -0,0 +1,10 @@
+{
+	"extends": "@acme/config/tsconfig/react.json",
+	"compilerOptions": {
+		"types": ["vite/client"],
+		"paths": {
+			"@/*": ["./src/*"]
+		}
+	},
+	"include": ["src"]
+}

package/templates/react-monorepo/files/apps/landing/vite.config.ts ADDED Viewed

@@ -0,0 +1,169 @@
+import { defineAppConfig } from '@acme/config/vite';
+import { BRAND } from '@acme/ui/brand';
+import { THEME_COLORS } from '@acme/ui/theme-colors';
+import { loadEnv, type Plugin } from 'vite';
+import { PRODUCTION_ORIGIN, SEO_ROUTES, absoluteUrl, normalizeOrigin } from './src/features/seo/routes';
+/**
+ * Emits `robots.txt` and `sitemap.xml` at build time from `SEO_ROUTES`.
+ *
+ * Generated rather than committed to `public/` so the sitemap cannot drift from
+ * the routes that actually exist. A sitemap advertising a 404, or missing a real
+ * page, is the usual failure here and it stays invisible until a crawler finds
+ * it. `/roadmap` is absent from the table precisely because its route is
+ * currently commented out in `app/router.tsx`.
+ *
+ * `apply: 'build'` — `public/` isn't written in dev and the dev server has no
+ * use for either file.
+ */
+function seoFiles(origin: string, indexable: boolean): Plugin {
+	return {
+		name: 'acme:seo-files',
+		apply: 'build',
+		generateBundle() {
+			// Non-production keeps the same file, inverted: a dev server serving the
+			// same copy as production is duplicate content, and it must not advertise a
+			// sitemap it doesn't want crawled.
+			const robots = (
+				indexable
+					? [
+							'# Public marketing site — crawling is welcome here.',
+							'# The app, auth and admin subdomains are deliberately noindex (MAI-102).',
+							'User-agent: *',
+							'Allow: /',
+							...(origin ? ['', `Sitemap: ${origin}/sitemap.xml`] : []),
+							''
+						]
+					: [
+							`# Not production (origin: ${origin || 'unset'}). Only ${PRODUCTION_ORIGIN} should be indexed.`,
+							'# Paired with the noindex meta tag in index.html — robots.txt alone does not deindex.',
+							'User-agent: *',
+							'Disallow: /',
+							''
+						]
+			).join('\n');
+			this.emitFile({ type: 'asset', fileName: 'robots.txt', source: robots });
+			// Every <loc> must be absolute per the sitemap spec, so without an origin
+			// emit nothing rather than something invalid. robots.txt above then also
+			// omits its Sitemap line, keeping the two consistent.
+			if (!origin) {
+				this.warn('VITE_APP_SITE_URL is not set — skipping sitemap.xml, which requires absolute URLs.');
+				return;
+			}
+			const urls = SEO_ROUTES.map(
+				(route) =>
+					'\t<url>\n' +
+					`\t\t<loc>${absoluteUrl(route.path, origin)}</loc>\n` +
+					`\t\t<changefreq>${route.changefreq}</changefreq>\n` +
+					`\t\t<priority>${route.priority}</priority>\n` +
+					'\t</url>'
+			).join('\n');
+			this.emitFile({
+				type: 'asset',
+				fileName: 'sitemap.xml',
+				source:
+					'<?xml version="1.0" encoding="UTF-8"?>\n' +
+					'<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n' +
+					`${urls}\n` +
+					'</urlset>\n'
+			});
+		}
+	};
+}
+/**
+ * When the security policy expires, as an RFC 9116 `Expires:` field must. A date
+ * in the past makes the whole file invalid to the tools that read it, so this
+ * needs bumping — along with a review of the policy itself — before it lapses.
+ */
+const SECURITY_TXT_EXPIRES = '2027-09-01T00:00:00.000Z';
+/**
+ * Emits `/.well-known/security.txt` (RFC 9116) pointing at the `/security` route.
+ *
+ * Researchers and automated scanners look for this file, not for a footer link,
+ * so without it the policy page is one nobody arrives at. `Contact:` must stay
+ * the same address as the policy states in its Sections 1, 8 and 19.
+ *
+ * Production-only, unlike `robots.txt`: `Canonical:` must be the URL the file is
+ * actually served from, so a preview environment publishing one that claims to
+ * live on the production origin would be advertising a false record rather than
+ * a harmless duplicate. `docker/nginx.conf` needs its `^~ /.well-known/` block
+ * for this to be reachable at all — the dotfile deny would otherwise 403 it.
+ */
+function securityTxt(origin: string, indexable: boolean, securityEmail: string): Plugin {
+	return {
+		name: 'acme:security-txt',
+		apply: 'build',
+		generateBundle() {
+			if (!indexable || !origin || !securityEmail) return;
+			this.emitFile({
+				type: 'asset',
+				fileName: '.well-known/security.txt',
+				source: [
+					'# Acme Corp — Security & Responsible Disclosure',
+					`# Full policy: ${absoluteUrl('/security', origin)}`,
+					'',
+					`Contact: mailto:${securityEmail}`,
+					`Expires: ${SECURITY_TXT_EXPIRES}`,
+					`Policy: ${absoluteUrl('/security', origin)}`,
+					'Preferred-Languages: en',
+					`Canonical: ${origin}/.well-known/security.txt`,
+					''
+				].join('\n')
+			});
+		}
+	};
+}
+/**
+ * Injects `noindex, nofollow` into `index.html` on every non-production build.
+ *
+ * The meta tag is the half that actually deindexes — `robots.txt` only asks a
+ * crawler not to fetch, and a URL it already knows can still be listed without
+ * ever being fetched. Both halves are emitted together, from the same flag.
+ *
+ * `index.html` is the shell the prerender pass copies for all seven routes, so
+ * one tag here covers the whole site.
+ */
+function noindexOffProduction(indexable: boolean): Plugin {
+	return {
+		name: 'acme:noindex-off-production',
+		apply: 'build',
+		transformIndexHtml() {
+			if (indexable) return;
+			return [{ tag: 'meta', attrs: { name: 'robots', content: 'noindex, nofollow' }, injectTo: 'head' }];
+		}
+	};
+}
+// `loadEnv` rather than `process.env`: VITE_APP_* live in the app's `.env` files
+// (pulled from Infisical), not the shell, so the build would otherwise never see
+// the site URL.
+const env = loadEnv(process.env.NODE_ENV ?? 'production', import.meta.dirname, '');
+const siteOrigin = normalizeOrigin(env.VITE_APP_SITE_URL ?? '');
+// Omitted rather than guessed: a security.txt pointing at an unmonitored
+// address is worse than none at all, so an unset value skips the file.
+const securityEmail = env.VITE_APP_SUPPORT_EMAIL ?? '';
+// An unset or unrecognised origin counts as non-production — see PRODUCTION_ORIGIN.
+const indexable = siteOrigin === PRODUCTION_ORIGIN;
+// `themeColors` substitutes %THEME_LIGHT%/%THEME_DARK% into index.html — the
+// pre-paint theme script and the `html` background both need them, and HTML
+// can't import. `appTitle` substitutes %APP_TITLE% for the same reason: the
+// static <title> must match the suffix MetaProvider appends at runtime.
+export default defineAppConfig({
+	rootDir: import.meta.dirname,
+	themeColors: THEME_COLORS,
+	appTitle: BRAND.name,
+	plugins: [
+		seoFiles(siteOrigin, indexable),
+		securityTxt(siteOrigin, indexable, securityEmail),
+		noindexOffProduction(indexable)
+	]
+});

package/templates/react-monorepo/files/build.sh ADDED Viewed

@@ -0,0 +1,61 @@
+#!/bin/sh
+# Build + push one frontend app image.
+#
+#   ./build.sh <admin|auth|client|landing> [env] [tag]
+#
+#   ./build.sh client            # uses .env       -> :latest
+#   ./build.sh client prod       # uses .env.production
+#   ./build.sh client prod 26_07_26_1
+#
+# The VITE_* URLs are compiled INTO the bundle, so the image is specific to the
+# environment it was built for. That is why the env name is an argument: the same
+# image cannot be promoted from staging to prod. Pull the env file first with
+#   yarn workspace <app> secrets -e <env>
+set -eu
+APP="${1:-}"
+ENV_NAME="${2:-dev}"
+TAG="${3:-latest}"
+REGISTRY="aurostack.dev/acme-corp"
+PLATFORMS="linux/amd64,linux/arm64"
+case "$APP" in
+	admin | auth | client | landing) ;;
+	*)
+		echo "usage: $0 <admin|auth|client|landing> [dev|staging|prod] [tag]" >&2
+		exit 1
+		;;
+esac
+case "$ENV_NAME" in
+	dev) ENV_FILE="apps/$APP/.env" ;;
+	test) ENV_FILE="apps/$APP/.env.test" ;;
+	staging) ENV_FILE="apps/$APP/.env.staging" ;;
+	prod | production) ENV_FILE="apps/$APP/.env.production" ;;
+	*) echo "unknown env '$ENV_NAME' (dev|test|staging|prod)" >&2; exit 1 ;;
+esac
+[ -f "$ENV_FILE" ] || {
+	echo "missing $ENV_FILE — run: yarn workspace $APP secrets -e $ENV_NAME" >&2
+	exit 1
+}
+# Read a var out of the env file, tolerating the quoted style these files use.
+read_var() {
+	sed -n "s/^$1=['\"]\{0,1\}\([^'\"]*\)['\"]\{0,1\}$/\1/p" "$ENV_FILE" | tail -1
+}
+BUILD_ARGS="--build-arg APP=$APP"
+for VAR in VITE_APP_API_URL VITE_APP_AUTH_HOST VITE_APP_CLIENT_HOST VITE_APP_ADMIN_HOST VITE_APP_LANDING VITE_APP_SUPPORT_EMAIL; do
+	VALUE="$(read_var "$VAR")"
+	[ -n "$VALUE" ] && BUILD_ARGS="$BUILD_ARGS --build-arg $VAR=$VALUE"
+done
+echo "Building $APP for '$ENV_NAME' -> $REGISTRY/web-$APP:$TAG"
+echo "  (URLs baked in from $ENV_FILE)"
+# shellcheck disable=SC2086
+docker buildx build --push --platform "$PLATFORMS" \
+	$BUILD_ARGS \
+	-t "$REGISTRY/web-$APP:$TAG" \
+	.