@rebasepro/cli 0.11.1-canary.gfd39654 → 0.12.0

package/templates/template/backend/functions/hello.ts

@@ -1,11 +1,12 @@
-import { defineFunction } from "@rebasepro/server";
+import { defineFunction, requireAuth, requireAdmin } from "@rebasepro/server";
 
 /**
  * Example custom function route.
  *
  * This file is auto-discovered by Rebase and mounted at:
- *   POST /api/functions/hello
- *   GET  /api/functions/hello
+ *   GET  /api/functions/hello          (public)
+ *   POST /api/functions/hello          (signed in)
+ *   GET  /api/functions/hello/stats    (admins only)
  *
  * Call from the client SDK:
  *   const result = await client.call("functions/hello", { name: "World" });
@@ -15,6 +16,20 @@ import { defineFunction } from "@rebasepro/server";
  * singleton via the injected context — use any Hono middleware, define any
  * HTTP methods, access the request/response directly.
  *
+ * **Custom functions are not authenticated for you.** The functions router
+ * parses the caller's token and puts the result in the context, but it does
+ * not reject anonymous requests — a webhook receiver (Stripe, GitHub) has no
+ * token to send, and that has to keep working. So every route in this folder
+ * is public until you say otherwise, and reading `c.get("user")` is not a
+ * check: an anonymous caller just gets `undefined` and the handler runs anyway.
+ *
+ * Say otherwise with `requireAuth` / `requireAdmin`, in the route's own
+ * middleware slot as below. `requireAuth` answers 401 without a valid token.
+ * `requireAdmin` answers 403 without the `admin` role and must come *after*
+ * `requireAuth` — on its own it has no user to inspect. Prefer the per-route
+ * slot over `app.use("/*", requireAuth)`: `use()` only covers routes declared
+ * *below* it, so a route appended later above it is silently unprotected.
+ *
  * `rebase.dataAsAdmin` gives you admin-level access to your data and
  * **bypasses RLS** — use it only for trusted admin work. For request-scoped /
  * RLS-scoped data access, use c.get("user") and c.get("driver"), which carry
@@ -23,19 +38,33 @@ import { defineFunction } from "@rebasepro/server";
 export default defineFunction((app, { rebase }) => {
     void rebase; // available for dataAsAdmin/auth/storage/email — see commented usage below
 
-    app.post("/", async (c) => {
-        const body = await c.req.json().catch(() => ({}));
-        const user = c.get("user");
+    /** The caller's id, or undefined when nobody is signed in. */
+    const uidOf = (user: unknown): string | undefined =>
+        (typeof user === "object" && user !== null && "uid" in user)
+            ? (user as { uid?: string }).uid
+            : undefined;
+
+    // ── Public ────────────────────────────────────────────────────────────
+    // Deliberately public: no guard, so anyone can call it. That is a fine
+    // choice for health probes, webhook receivers and public content — the
+    // point is that it is a choice, written down, and not the default you got
+    // by forgetting.
+    app.get("/", (c) => {
+        return c.json({ status: "ok",
+            endpoint: "hello" });
+    });
 
-        const userId = (user && typeof user === "object" && "userId" in user)
-            ? user.userId
-            : "anonymous";
+    // ── Signed in ─────────────────────────────────────────────────────────
+    // `requireAuth` replies 401 before the handler runs, so the user here is
+    // guaranteed rather than hoped for.
+    app.post("/", requireAuth, async (c) => {
+        const body = await c.req.json().catch(() => ({}));
 
         // Access any Rebase service via the injected `rebase`:
         // await rebase.email.send({
         //     to: "admin@example.com",
         //     subject: "Function called",
-        //     html: `<p>Hello from ${userId}!</p>`,
+        //     html: `<p>Hello from ${uidOf(c.get("user"))}!</p>`,
         // });
         //
         // Admin-scoped data (bypasses RLS — trusted work only):
@@ -45,12 +74,14 @@ export default defineFunction((app, { rebase }) => {
 
         return c.json({
             message: `Hello, ${body.name || "World"}!`,
-            user: userId
+            user: uidOf(c.get("user"))
         });
     });
 
-    app.get("/", (c) => {
-        return c.json({ status: "ok",
-            endpoint: "hello" });
+    // ── Admins only ───────────────────────────────────────────────────────
+    // Order matters: `requireAuth` first (401 for anonymous), then
+    // `requireAdmin` (403 for a signed-in non-admin).
+    app.get("/stats", requireAuth, requireAdmin, (c) => {
+        return c.json({ admin: uidOf(c.get("user")) });
     });
 });

package/templates/template/backend/package.json

@@ -2,12 +2,9 @@
     "name": "{{PROJECT_NAME}}-backend",
     "version": "1.0.0",
     "description": "Rebase backend with PostgreSQL",
-    "main": "src/index.ts",
     "type": "module",
     "scripts": {
-        "dev": "tsx watch --include=\"../config/**/*\" --include=\"./functions/**/*\" src/index.ts",
-        "build": "rebase schema generate --collections ../config/collections && tsc",
-        "start": "node dist/backend/src/index.js"
+        "build": "rebase schema generate --collections ../config/collections && tsc"
     },
     "dependencies": {
         "{{PROJECT_NAME}}-config": "*",

package/templates/template/backend/tsconfig.json

@@ -13,7 +13,28 @@
     "resolveJsonModule": true,
     "declaration": true,
     "sourceMap": true,
-    "jsx": "preserve"
+    "jsx": "preserve",
+    // Pin the ambient type libraries.
+    //
+    // Unset, TypeScript sweeps every `node_modules/@types` it can reach and
+    // treats each folder as an implicit type library. Under pnpm that reaches
+    // the virtual store, where packages hoisted for peer resolution live —
+    // `dompurify` among them, pulled in transitively by the admin editor. The
+    // backend has no dependency on it and cannot resolve its entry point, so
+    // `rebase build` failed the whole bundle with:
+    //
+    //     error TS2688: Cannot find type definition file for 'dompurify'
+    //
+    // `frontend/tsconfig.json` has always pinned its own list, which is why the
+    // frontend never saw this. Naming what this program needs is both the fix
+    // and the faster compile.
+    "types": ["node"]
   },
-  "include": ["src/**/*", "../config/**/*", "drizzle.config.ts"]
+  // `functions/` is included so `tsc` actually checks your custom routes. It
+  // was omitted here (the baas flavour has always had it), which meant the one
+  // place you write server code by hand was the one place a type error went
+  // unnoticed until runtime. The inferred common root is already the project
+  // root because of `../config`, so this adds no `rootDir` and moves nothing
+  // that dist/ already contains.
+  "include": ["src/**/*", "functions/**/*", "../config/**/*", "drizzle.config.ts"]
 }

package/templates/template/config/tsconfig.json

@@ -13,7 +13,22 @@
     "outDir": "./dist",
     "skipLibCheck": true,
     "forceConsistentCasingInFileNames": true,
-    "resolveJsonModule": true
+    "resolveJsonModule": true,
+    // Pin the ambient type libraries.
+    //
+    // Unset, TypeScript sweeps every `node_modules/@types` it can reach and
+    // treats each folder as an implicit type library. Under pnpm that reaches
+    // the virtual store, where packages hoisted for peer resolution live —
+    // `dompurify` among them, pulled in transitively by the admin editor. The
+    // backend has no dependency on it and cannot resolve its entry point, so
+    // `rebase build` failed the whole bundle with:
+    //
+    //     error TS2688: Cannot find type definition file for 'dompurify'
+    //
+    // `frontend/tsconfig.json` has always pinned its own list, which is why the
+    // frontend never saw this. Naming what this program needs is both the fix
+    // and the faster compile.
+    "types": ["node"]
   },
   "include": ["**/*.ts"],
   "exclude": ["node_modules", "dist"]

package/templates/template/docker-compose.yml

@@ -1,17 +1,32 @@
-# ─── Rebase — Production Docker Compose ──────────────────────────────
+# ─── Self-hosting this project ───────────────────────────────────────
 #
-# Quick start:
-#   cp .env.example .env    # Edit with your secrets
-#   docker compose up -d    # Start everything
+# Two containers: PostgreSQL, and the Rebase runtime with your built project
+# mounted into it. There is no application image to build here — the runtime is
+# the same published image every Rebase deployment runs, and your project
+# travels as a bundle.
 #
-# This runs:
-#   1. PostgreSQL 18 with persistent data
-#   2. Backend (Node.js / Hono) with health checks
-#   3. Frontend (nginx) serving the Vite build
+# That is the point: the artifact you self-host is the artifact Rebase Cloud
+# runs. Nothing about this repository changes when you move between them; only
+# the destination does, and that lives in `.rebase/cloud.json`, which is not
+# committed.
+#
+#   rebase build              # produces ./dist-bundle
+#   docker compose up -d db
+#   rebase db push            # create the collection tables, once
+#   docker compose up
+#
+# One container then serves the API at /api and the admin at / — same origin, so
+# there is no CORS to configure between them and no second web server.
 #
 # For development, use `rebase dev` instead.
+#
+# To upgrade Rebase, change REBASE_VERSION and restart. Your bundle is untouched.
+# To run your OWN server code instead, `rebase eject` — it writes the entrypoint,
+# a Dockerfile and a compose file that builds them.
 # ─────────────────────────────────────────────────────────────────────
 
+name: {{PROJECT_NAME}}
+
 services:
   # ── PostgreSQL ───────────────────────────────────────────────────────
   db:
@@ -21,20 +36,25 @@ services:
       POSTGRES_USER: rebase
       POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-changeme}
       POSTGRES_DB: rebase
+    # Published so `rebase db push` can reach it from the host. Remove this
+    # mapping once the schema is in place if the database should not be
+    # reachable from outside the compose network.
     ports:
       - "5432:5432"
     volumes:
       - postgres_data:/var/lib/postgresql
     healthcheck:
+      # The runtime must not start before the database can answer, or its first
+      # boot fails on a connection refused and the container restarts for no
+      # reason a reader would understand.
       test: ["CMD-SHELL", "pg_isready -U rebase -d rebase"]
       interval: 5s
       timeout: 5s
       retries: 10
       start_period: 10s
-    # Production tuning (adjust for your workload)
     command:
       - "postgres"
-      - "-c" 
+      - "-c"
       - "shared_buffers=256MB"
       - "-c"
       - "max_connections=100"
@@ -45,44 +65,48 @@ services:
       - "-c"
       - "log_min_duration_statement=1000"
 
-  # ── Backend ──────────────────────────────────────────────────────────
-  backend:
-    build:
-      context: .
-      dockerfile: backend/Dockerfile
+  # ── The Rebase runtime, booting your bundle ──────────────────────────
+  api:
+    image: rebasepro/server:${REBASE_VERSION:-latest}
     restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
     ports:
       - "${PORT:-3001}:3001"
-    env_file: .env
     environment:
-      # Override DATABASE_URL to point to the Docker network service
       DATABASE_URL: postgresql://rebase:${DATABASE_PASSWORD:-changeme}@db:5432/rebase?options=-c%20search_path=public
       ADMIN_CONNECTION_STRING: postgresql://rebase:${DATABASE_PASSWORD:-changeme}@db:5432/rebase?options=-c%20search_path=public
+      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in .env — `rebase init` generates one}
+      REBASE_SERVICE_KEY: ${REBASE_SERVICE_KEY:?set REBASE_SERVICE_KEY in .env — `rebase init` generates one}
       NODE_ENV: production
       PORT: "3001"
-      # The server refuses to boot with local storage under NODE_ENV=production,
-      # because the container filesystem is destroyed on the next restart and
-      # uploads go with it. That does not apply here: the `uploads` volume below
-      # is a durable named volume mounted at the storage path, which is exactly
-      # the case the check tells you to acknowledge with this flag. Switch to
-      # STORAGE_TYPE=s3 or gcs and drop this line if you move storage off-box.
+
+      # The origins a browser will load the admin from. With the admin folded
+      # into the bundle it is served from this very container, so this is just
+      # your own address — but it is still required, because an API that guesses
+      # its allowed origins is one that eventually allows the wrong one.
+      CORS_ORIGINS: ${CORS_ORIGINS:?set CORS_ORIGINS to the origin you browse to, e.g. http://localhost:3001}
+
+      # Auth tables are created at boot. Collection tables are not: run
+      # `rebase db push` once, against the database above. A container restart
+      # must not be able to change a schema as a side effect.
+      REBASE_MIGRATE_ON_BOOT: ${REBASE_MIGRATE_ON_BOOT:-ensure}
+
+      # Uploads land on the named volume below, which survives restarts. That is
+      # the case FORCE_LOCAL_STORAGE exists to acknowledge — without a durable
+      # mount the server refuses local storage in production, because the
+      # container filesystem is destroyed on the next deploy and every uploaded
+      # file goes with it. Switch to STORAGE_TYPE=s3 or gcs and drop both lines
+      # if you move storage off-box.
+      STORAGE_PATH: /uploads
       FORCE_LOCAL_STORAGE: "true"
-    depends_on:
-      db:
-        condition: service_healthy
     volumes:
-      - uploads:/app/backend/uploads
-
-  # ── Frontend ─────────────────────────────────────────────────────────
-  frontend:
-    build:
-      context: .
-      dockerfile: frontend/Dockerfile
-    restart: unless-stopped
-    ports:
-      - "80:80"
-    depends_on:
-      - backend
+      # Your built project. Writable, because the runtime installs the bundle's
+      # declared dependencies into it on first start — `rebase build` emits a
+      # package.json but not a node_modules.
+      - ./dist-bundle:/bundle
+      - uploads:/uploads
 
 volumes:
   postgres_data:

package/templates/template/frontend/src/main.tsx

@@ -8,12 +8,19 @@ window.addEventListener("unhandledrejection", (event: PromiseRejectionEvent) =>
     console.error("[Rebase] Unhandled promise rejection:", event.reason);
 });
 
+// Where this app is mounted, from the `path` declared in rebase.json.
+//
+// `rebase build` passes it to Vite as `base` (REBASE_APP_BASE), and Vite exposes
+// it back as BASE_URL — so the assets, the router and the server all agree on
+// one value without it being written down three times. At "/" this is "".
+const basename = import.meta.env.BASE_URL.replace(/\/$/, "");
+
 const router = createBrowserRouter([
     {
         path: "/*",
         element: <App/>
     }
-]);
+], { basename });
 
 ReactDOM.createRoot(document.getElementById("root") as HTMLElement).render(
     <React.StrictMode>

package/templates/template/frontend/vite.config.ts

@@ -7,6 +7,11 @@ import { rebaseCollectionsPlugin } from "@rebasepro/app/vitePlugin";
 
 export default defineConfig({
     envDir: path.resolve(__dirname, ".."),
+    // The public path this app is served under, from its `path` in rebase.json.
+    // `rebase build` sets REBASE_APP_BASE; without this line an app declared at
+    // "/admin" would emit assets rooted at "/" and render a blank page. The
+    // build refuses to ship that — see docs/apps-and-runtimes.md §4.2.
+    base: process.env.REBASE_APP_BASE ?? "/",
     // Force a single copy of React and React Router across the app and all
     // @rebasepro/* packages. Without this, a locally `link:`ed Rebase checkout
     // resolves its own copies of react-router, producing "multiple copies of

package/templates/template/rebase.json

@@ -1,20 +1,17 @@
 {
     "$schema": "https://rebase.pro/schemas/rebase.json",
-    "runtime": "^1",
+    "rebase": "^1",
     "apps": {
         "backend": {
-            "type": "backend"
+            "type": "backend",
+            "runtime": "managed"
         },
-        "web": {
+        "admin": {
             "type": "static",
             "root": "frontend",
             "build": "npm run build --workspace frontend",
             "output": "frontend/dist",
-            "spa": true
-        },
-        "admin": {
-            "type": "admin",
-            "mode": "hosted"
+            "path": "/"
         }
     }
 }

package/templates/overlays/baas/backend/src/index.ts

@@ -1,216 +0,0 @@
-import { Hono } from "hono";
-import { cors } from "hono/cors";
-import { secureHeaders } from "hono/secure-headers";
-import { getRequestListener } from "@hono/node-server";
-import { createServer } from "http";
-import path from "path";
-import { fileURLToPath } from "url";
-import {
-    initializeRebaseBackend,
-    installShutdownHandlers,
-    HonoEnv,
-    listenWithPortRetry,
-    cleanupDevPortFile,
-    logger
-} from "@rebasepro/server";
-import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgres";
-import { env } from "./env.js";
-import { storageAuthorize } from "./storage.js";
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-
-// ─── App ─────────────────────────────────────────────────────────────
-const app: Hono<HonoEnv> = new Hono<HonoEnv>();
-
-const isProduction = env.NODE_ENV === "production";
-const allowedOrigins = isProduction
-    ? (() => {
-        const origins = env.CORS_ORIGINS || env.FRONTEND_URL;
-        if (!origins) {
-            throw new Error(
-                "CORS_ORIGINS or FRONTEND_URL must be set in production. " +
-                "Example: CORS_ORIGINS=https://yourdomain.com"
-            );
-        }
-        return origins.split(",").map(s => s.trim());
-    })()
-    : [];
-
-// In dev we still restrict which origins are reflected. Because `credentials`
-// is enabled, reflecting an arbitrary Origin would let any website the
-// developer happens to visit make credentialed cross-origin requests to this
-// dev server (and read the responses) using the developer's session. So dev
-// reflects only localhost origins; requests with no Origin (curl, same-origin)
-// are unaffected.
-const isLocalhostOrigin = (origin: string): boolean => {
-    try {
-        const { hostname } = new URL(origin);
-        return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
-    } catch {
-        return false;
-    }
-};
-
-app.use("/*", cors({
-    origin: (origin) => {
-        if (isProduction) return allowedOrigins.includes(origin) ? origin : null;
-        if (!origin) return "*";
-        return isLocalhostOrigin(origin) ? origin : null;
-    },
-    credentials: true
-}));
-
-app.use("/*", secureHeaders());
-
-// ─── Database ────────────────────────────────────────────────────────
-const databaseUrl = env.DATABASE_URL;
-
-const { db, pool, connectionString } = createPostgresDatabaseConnection(databaseUrl);
-
-// ─── Start ───────────────────────────────────────────────────────────
-async function startServer() {
-    const jwtSecret = env.JWT_SECRET;
-    const PORT = env.PORT;
-    const server = createServer(getRequestListener(app.fetch));
-
-    const backend = await initializeRebaseBackend({
-        // BaaS mode: every RLS-protected table is served over REST. There are
-        // no collection files to write or keep in sync — change the schema with
-        // a migration and the API follows.
-        //
-        // Your database's own row-level security is the whole authorization
-        // model here: requests run as the `rebase_user` role, so a table
-        // without RLS has no rules at all and is not served. Protect one with:
-        //   ALTER TABLE mytable ENABLE ROW LEVEL SECURITY;
-        //   CREATE POLICY mytable_read ON mytable FOR SELECT TO public USING (true);
-        mode: "baas",
-        functionsDir: path.resolve(__dirname, "../functions"),
-        server,
-        app,
-        database: createPostgresAdapter({
-            connection: db,
-            adminConnectionString: env.ADMIN_CONNECTION_STRING || databaseUrl,
-            connectionString
-        }),
-        auth: {
-            // No `collection` here: BaaS mode has no collection files, and the
-            // auth adapter owns its own user tables.
-            jwtSecret,
-            accessExpiresIn: env.JWT_ACCESS_EXPIRES_IN,
-            refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN,
-            serviceKey: env.REBASE_SERVICE_KEY,
-            cookieAuth: { sameSite: "Lax" },
-            google: env.GOOGLE_CLIENT_ID
-                ? { clientId: env.GOOGLE_CLIENT_ID }
-                : undefined,
-            allowRegistration: env.ALLOW_REGISTRATION,
-            email: env.SMTP_HOST
-                ? {
-                    from: env.SMTP_FROM || `${env.APP_NAME} <noreply@rebase.pro>`,
-                    smtp: {
-                        host: env.SMTP_HOST,
-                        port: env.SMTP_PORT,
-                        secure: env.SMTP_SECURE,
-                        auth: env.SMTP_USER
-                            ? { user: env.SMTP_USER,
-pass: env.SMTP_PASS! }
-                            : undefined,
-                        name: env.SMTP_NAME
-                    },
-                    appName: env.APP_NAME,
-                    resetPasswordUrl: env.FRONTEND_URL
-                }
-                : undefined
-        },
-        // File storage is opt-in. With no bucket configured, storage is OFF in
-        // production — the upload routes answer 501 STORAGE_NOT_CONFIGURED —
-        // rather than writing to the container filesystem, which is erased on
-        // every restart and redeploy. Uploads that fail loudly are recoverable;
-        // uploads that succeed into a disk about to be wiped are not.
-        // Local disk stays the default in development, where it is what you want.
-        storage: env.STORAGE_TYPE === "s3"
-            ? {
-                type: "s3",
-                bucket: env.S3_BUCKET!,
-                region: env.S3_REGION || "auto",
-                accessKeyId: env.S3_ACCESS_KEY_ID || "",
-                secretAccessKey: env.S3_SECRET_ACCESS_KEY || "",
-                endpoint: env.S3_ENDPOINT,
-                forcePathStyle: env.S3_FORCE_PATH_STYLE
-            }
-            : env.STORAGE_TYPE === "gcs"
-                ? {
-                    type: "gcs",
-                    bucket: env.GCS_BUCKET!,
-                    projectId: env.GCS_PROJECT_ID,
-                    keyFilename: env.GCS_KEY_FILENAME
-                }
-                // Set FORCE_LOCAL_STORAGE=true only if this deployment really
-                // does have a durable volume mounted at STORAGE_PATH.
-                : isProduction && !env.FORCE_LOCAL_STORAGE
-                    ? undefined
-                    : {
-                        type: "local",
-                        basePath: env.STORAGE_PATH || path.resolve(__dirname, "../../uploads")
-                    },
-        // Storage is not under row-level security, so this hook IS its access
-        // model — the server refuses to boot in production without one, because
-        // "signed in" would otherwise be the only thing between a caller and every
-        // file in the bucket. See storage.ts; the default scopes each caller to
-        // `users/<uid>/` and is meant to be replaced with your own rule.
-        storageAuthorize,
-        history: true,
-        enableSwagger: true
-    });
-
-    // ─── Health check ─────────────────────────────────────────────
-    app.get("/health", async (c) => {
-        const result = await backend.healthCheck();
-        const status = result.healthy ? 200 : 503;
-        return c.json({
-            status: result.healthy ? "ok" : "degraded",
-            latencyMs: result.latencyMs,
-            ...(result.details ? { details: result.details } : {})
-        }, status);
-    });
-
-    // No serveSPA: this is a headless API. Point any frontend at it over HTTP.
-
-    if (!isProduction) {
-        // Dev mode: retry the next port if the current one is in use
-        const projectRoot = path.resolve(__dirname, "../..");
-        const actualPort = await listenWithPortRetry(server, PORT, { portFileDir: projectRoot, serviceKey: env.REBASE_SERVICE_KEY });
-
-        // Clean up port file on exit
-        const cleanup = () => cleanupDevPortFile(projectRoot);
-        process.on("SIGINT", cleanup);
-        process.on("SIGTERM", cleanup);
-        process.on("exit", cleanup);
-
-        logger.info(`API running at http://localhost:${actualPort}`);
-        // Docs are only mounted once there is something to document; with no
-        // servable tables the URL would 404, so don't advertise it.
-        if (backend.collectionRegistry.getCollections().length > 0) {
-            logger.info(`API docs at http://localhost:${actualPort}/api/swagger`);
-        }
-    } else {
-        server.listen(PORT, () => {
-            logger.info(`API running at http://localhost:${PORT}`);
-        });
-    }
-
-    // ─── Graceful Shutdown ───────────────────────────────────────────────
-    // Drains HTTP, stops crons, tears down realtime, then closes the pool.
-    // Guards against double signals and force-exits if shutdown hangs.
-    installShutdownHandlers(backend, {
-        onCleanup: () => pool.end()
-    });
-}
-
-startServer().catch(err => {
-    logger.error("Failed to start server", { error: err instanceof Error ? err : new Error(String(err)) });
-    process.exit(1);
-});
-
-export { app };

package/templates/template/frontend/Dockerfile

@@ -1,52 +0,0 @@
-# ─── Multi-stage production Dockerfile for the Rebase frontend ────────
-# Builds the Vite app, then serves via nginx for proper caching/compression.
-#
-# Build context: the project root (where pnpm-workspace.yaml lives)
-# Usage:
-#   docker build -t my-app-frontend -f frontend/Dockerfile .
-
-# ── Stage 1: Install + Build ─────────────────────────────────────────
-FROM node:24-alpine AS builder
-
-ENV PNPM_HOME="/pnpm"
-ENV PATH="$PNPM_HOME:$PATH"
-RUN corepack enable
-
-RUN apk add --no-cache python3 make g++
-
-WORKDIR /app
-
-# Copy workspace root files
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
-
-# Copy workspace packages
-COPY frontend ./frontend
-COPY config ./config
-
-# Install dependencies (skip scripts to avoid @ariga/atlas binary download,
-# which is a backend-only dependency that may fail on certain platforms)
-RUN pnpm install --frozen-lockfile --ignore-scripts
-RUN pnpm rebuild esbuild
-
-# Build config first, then frontend
-RUN pnpm --filter "*-config" run build
-RUN pnpm --filter "*-frontend" run build
-
-# ── Stage 2: Serve with nginx ────────────────────────────────────────
-FROM nginx:1.27-alpine AS runtime
-
-# Remove default nginx page
-RUN rm -rf /usr/share/nginx/html/*
-
-# Copy built assets
-COPY --from=builder /app/frontend/dist /usr/share/nginx/html
-
-# Custom nginx config for SPA routing + compression
-COPY frontend/nginx.conf /etc/nginx/conf.d/default.conf
-
-EXPOSE 80
-
-HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
-    CMD wget --no-verbose --tries=1 --spider http://localhost:80/ || exit 1
-
-CMD ["nginx", "-g", "daemon off;"]