feat(cloud): add nitro docker deployment

.gitignore

@@ -46,4 +46,10 @@ apps/desktop/resources/
 
 # cloud local dev database
 .pglite
+
+# nitro build output
+.output
+
+# tanstack router generated
+.tanstack
 .claude/

apps/cloud/.env.prod

@@ -0,0 +1,4 @@
+WORKOS_API_KEY=op://Personal/Work OS API Key Prod/credential
+WORKOS_CLIENT_ID=op://Personal/Work OS Client ID Prod/credential
+WORKOS_COOKIE_PASSWORD=op://Personal/Work OS Cookie Password Prod/password
+APP_URL=https://your-cloud-domain.example.com

apps/cloud/Dockerfile

@@ -0,0 +1,43 @@
+FROM oven/bun:1.3-alpine AS base
+WORKDIR /app
+
+# Dependencies - cached when package.json files unchanged
+FROM base AS deps
+COPY --link bun.lock package.json ./
+COPY --link packages/core/api/package.json ./packages/core/api/
+COPY --link packages/core/config/package.json ./packages/core/config/
+COPY --link packages/core/execution/package.json ./packages/core/execution/
+COPY --link packages/core/sdk/package.json ./packages/core/sdk/
+COPY --link packages/core/storage-file/package.json ./packages/core/storage-file/
+COPY --link packages/core/storage-postgres/package.json ./packages/core/storage-postgres/
+COPY --link packages/hosts/mcp/package.json ./packages/hosts/mcp/
+COPY --link packages/kernel/core/package.json ./packages/kernel/core/
+COPY --link packages/kernel/ir/package.json ./packages/kernel/ir/
+COPY --link packages/kernel/runtime-deno-subprocess/package.json ./packages/kernel/runtime-deno-subprocess/
+COPY --link packages/kernel/runtime-quickjs/package.json ./packages/kernel/runtime-quickjs/
+COPY --link packages/plugins/file-secrets/package.json ./packages/plugins/file-secrets/
+COPY --link packages/plugins/google-discovery/package.json ./packages/plugins/google-discovery/
+COPY --link packages/plugins/graphql/package.json ./packages/plugins/graphql/
+COPY --link packages/plugins/keychain/package.json ./packages/plugins/keychain/
+COPY --link packages/plugins/mcp/package.json ./packages/plugins/mcp/
+COPY --link packages/plugins/onepassword/package.json ./packages/plugins/onepassword/
+COPY --link packages/plugins/openapi/package.json ./packages/plugins/openapi/
+COPY --link packages/react/package.json ./packages/react/
+COPY --link apps/cloud/package.json ./apps/cloud/
+COPY --link apps/desktop/package.json ./apps/desktop/
+RUN bun install --frozen-lockfile
+
+# Build
+FROM deps AS build
+COPY --link . .
+RUN cd apps/cloud && bun run build
+
+# Production
+FROM node:22-alpine AS production
+ENV NODE_ENV=production
+ENV HOST=0.0.0.0
+ENV PORT=3000
+WORKDIR /app
+COPY --link --from=build /app/apps/cloud/.output ./apps/cloud/.output
+EXPOSE 3000
+CMD ["node", "./apps/cloud/.output/server/index.mjs"]

apps/cloud/package.json

@@ -7,6 +7,7 @@
     "@effect-atom/atom-react": "^0.5.0",
     "@effect/platform": "catalog:",
     "@executor/api": "workspace:*",
+    "@executor/env": "workspace:*",
     "@executor/execution": "workspace:*",
     "@executor/plugin-google-discovery": "workspace:*",
     "@executor/plugin-graphql": "workspace:*",
@@ -32,14 +33,15 @@
     "@types/react": "catalog:",
     "@types/react-dom": "catalog:",
     "@vitejs/plugin-react": "catalog:",
+    "nitro": "3.0.0",
     "portless": "^0.10.1",
     "typescript": "catalog:",
     "vite": "catalog:"
   },
   "scripts": {
     "dev": "op run --env-file=.env -- portless run --name executor-cloud vite dev",
     "build": "vite build",
-    "start": "bun ./server.ts",
+    "start": "node .output/server/index.mjs",
     "typecheck": "tsc --noEmit"
   }
 }

apps/cloud/railway.toml

@@ -0,0 +1,10 @@
+[build]
+builder = "DOCKERFILE"
+dockerfilePath = "apps/cloud/Dockerfile"
+watchPatterns = ["/apps/cloud/**", "/packages/**", "/Dockerfile", "/package.json", "/bun.lock"]
+
+[deploy]
+healthcheckPath = "/"
+healthcheckTimeout = 60
+restartPolicyType = "ON_FAILURE"
+restartPolicyMaxRetries = 5

apps/cloud/src/api.ts

@@ -29,6 +29,7 @@ import { CloudAuthHandlers, CloudAuthPublicHandlers } from "./auth/handlers";
 import { WorkOSAuth } from "./auth/workos";
 import { DbService } from "./services/db";
 import { createTeamExecutor } from "./services/executor";
+import { server } from "./env";
 
 const ProtectedCloudApi = addGroup(OpenApiGroup)
   .add(McpGroup)
@@ -101,7 +102,7 @@ const COOKIE_OPTIONS = {
   httpOnly: true,
   sameSite: "lax" as const,
   maxAge: 60 * 60 * 24 * 7,
-  secure: process.env.NODE_ENV === "production",
+  secure: server.NODE_ENV === "production",
 };
 
 const resolveAuth = (request: Request) =>
@@ -148,7 +149,7 @@ const resolveExecutor = (teamId: string) =>
     const users = yield* UserStoreService;
     const team = yield* users.use((store) => store.getTeam(teamId));
     const teamName = team?.name ?? "Unknown Team";
-    const encryptionKey = process.env.ENCRYPTION_KEY ?? "local-dev-encryption-key";
+    const encryptionKey = server.ENCRYPTION_KEY;
     return yield* createTeamExecutor(teamId, teamName, encryptionKey);
   });
 

apps/cloud/src/auth/handlers.ts

@@ -6,13 +6,14 @@ import { addGroup } from "@executor/api";
 import { AUTH_PATHS, CloudAuthApi, CloudAuthPublicApi } from "./api";
 import { AuthContext, UserStoreService } from "./context";
 import { WorkOSAuth } from "./workos";
+import { server } from "../env";
 
 const COOKIE_OPTIONS = {
   path: "/",
   httpOnly: true,
   sameSite: "lax" as const,
   maxAge: 60 * 60 * 24 * 7,
-  secure: process.env.NODE_ENV === "production",
+  secure: server.NODE_ENV === "production",
 };
 
 // ---------------------------------------------------------------------------

apps/cloud/src/auth/workos.ts

@@ -5,6 +5,7 @@
 import { Context, Effect, Layer } from "effect";
 import { WorkOS } from "@workos-inc/node";
 import { WorkOSError } from "./errors";
+import { server } from "../env";
 
 const COOKIE_NAME = "wos-session";
 
@@ -14,9 +15,9 @@ const COOKIE_NAME = "wos-session";
 
 
 const make = Effect.gen(function* () {
-  const apiKey = process.env.WORKOS_API_KEY!;
-  const clientId = process.env.WORKOS_CLIENT_ID!;
-  const cookiePassword = process.env.WORKOS_COOKIE_PASSWORD!;
+  const apiKey = server.WORKOS_API_KEY;
+  const clientId = server.WORKOS_CLIENT_ID;
+  const cookiePassword = server.WORKOS_COOKIE_PASSWORD;
 
   if (!cookiePassword || cookiePassword.length < 32) {
     return yield* Effect.die(new Error("WORKOS_COOKIE_PASSWORD must be at least 32 characters"));

apps/cloud/src/env.ts

@@ -0,0 +1,55 @@
+import { createEnv, Env } from "@executor/env";
+
+const sharedShape = {
+  NODE_ENV: Env.literalOr(
+    "NODE_ENV",
+    "development",
+    "development",
+    "test",
+    "production",
+  ),
+};
+
+const serverShape = {
+  DATABASE_URL: Env.stringOr("DATABASE_URL", ""),
+  PGLITE_DATA_DIR: Env.stringOr("PGLITE_DATA_DIR", ".pglite"),
+  ENCRYPTION_KEY: Env.stringOr(
+    "ENCRYPTION_KEY",
+    "local-dev-encryption-key",
+  ),
+  WORKOS_API_KEY: Env.string("WORKOS_API_KEY"),
+  WORKOS_CLIENT_ID: Env.string("WORKOS_CLIENT_ID"),
+  WORKOS_COOKIE_PASSWORD: Env.string("WORKOS_COOKIE_PASSWORD"),
+};
+
+type SharedEnv = Readonly<{
+  NODE_ENV: "development" | "test" | "production";
+}>;
+
+type ServerEnv = SharedEnv & Readonly<{
+  DATABASE_URL: string;
+  PGLITE_DATA_DIR: string;
+  ENCRYPTION_KEY: string;
+  WORKOS_API_KEY: string;
+  WORKOS_CLIENT_ID: string;
+  WORKOS_COOKIE_PASSWORD: string;
+}>;
+
+type WebEnv = Readonly<Record<string, never>>;
+
+export const shared = createEnv(sharedShape, {
+  runtimeEnv: process.env,
+  emptyStringAsUndefined: true,
+}) as SharedEnv;
+
+export const web = createEnv({}, {
+  prefix: "PUBLIC_",
+  runtimeEnv: process.env,
+  emptyStringAsUndefined: true,
+}) as WebEnv;
+
+export const server = createEnv(serverShape, {
+  extends: [shared],
+  runtimeEnv: process.env,
+  emptyStringAsUndefined: true,
+}) as ServerEnv;

apps/cloud/src/server.ts

@@ -0,0 +1,3 @@
+import handler from "@tanstack/react-start/server-entry";
+
+export default handler;

apps/cloud/src/services/db.ts

@@ -7,6 +7,7 @@ import { resolve } from "node:path";
 import * as sharedSchema from "@executor/storage-postgres/schema";
 import * as cloudSchema from "./schema";
 import type { DrizzleDb } from "@executor/storage-postgres";
+import { server } from "../env";
 
 const schema = { ...sharedSchema, ...cloudSchema };
 
@@ -23,11 +24,11 @@ type DbResource = {
 };
 
 const createDbResource = async (): Promise<DbResource> => {
-  if (process.env.DATABASE_URL) {
+  if (server.DATABASE_URL) {
     const { drizzle } = await import("drizzle-orm/node-postgres");
     const { migrate } = await import("drizzle-orm/node-postgres/migrator");
     const { Pool } = await import("pg");
-    const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+    const pool = new Pool({ connectionString: server.DATABASE_URL });
     const db = drizzle(pool, { schema }) as DrizzleDb;
     await migrate(db as any, { migrationsFolder: MIGRATIONS_DIR });
     return {
@@ -39,7 +40,7 @@ const createDbResource = async (): Promise<DbResource> => {
   const { PGlite } = await import("@electric-sql/pglite");
   const { drizzle } = await import("drizzle-orm/pglite");
   const { migrate } = await import("drizzle-orm/pglite/migrator");
-  const dataDir = process.env.PGLITE_DATA_DIR ?? ".pglite";
+  const dataDir = server.PGLITE_DATA_DIR;
   const client = new PGlite(dataDir);
   const db = drizzle(client, { schema }) as DrizzleDb;
   await migrate(db, { migrationsFolder: MIGRATIONS_DIR });

apps/cloud/src/web/auth.tsx

@@ -23,9 +23,10 @@ type AuthTeam = {
 // Auth atom — typed query against CloudAuthApi
 // ---------------------------------------------------------------------------
 
-export const authAtom = CloudApiClient.query("cloudAuth", "me", {
-  timeToLive: "5 minutes",
-});
+export const authAtom =
+  CloudApiClient.query("cloudAuth", "me", {
+    timeToLive: "5 minutes",
+  });
 
 // ---------------------------------------------------------------------------
 // Provider + hook

apps/cloud/tsconfig.json

@@ -8,8 +8,8 @@
     "skipLibCheck": true,
     "outDir": "dist",
     "rootDir": ".",
-    "declaration": true,
-    "declarationMap": true,
+    "declaration": false,
+    "declarationMap": false,
     "sourceMap": true,
     "jsx": "react-jsx",
     "plugins": [

apps/cloud/vite.config.ts

@@ -2,18 +2,41 @@ import { defineConfig } from "vite";
 import { tanstackStart } from "@tanstack/react-start/plugin/vite";
 import react from "@vitejs/plugin-react";
 import tailwindcss from "@tailwindcss/vite";
+import { nitro } from "nitro/vite";
+import { createEnv, Env } from "@executor/env";
+
+const server = {
+  PORT: Env.numberOr("PORT", 5173),
+};
+
+type ViteEnv = Readonly<{
+  PORT: number;
+}>;
+
+const viteEnv = createEnv(server, {
+  runtimeEnv: process.env,
+  emptyStringAsUndefined: true,
+}) as ViteEnv;
 
 export default defineConfig({
   server: {
-    port: parseInt(process.env.PORT ?? "5173", 10),
+    port: viteEnv.PORT,
     host: "127.0.0.1",
   },
   resolve: { tsconfigPaths: true },
+  environments: {
+    ssr: {
+      resolve: {
+        external: ["shiki", "shiki/wasm"],
+      },
+    },
+  },
   plugins: [
     tailwindcss(),
     tanstackStart({
       spa: { enabled: true },
     }),
+    nitro({}),
     react(),
   ],
 });