feat(shell, strategy-curator, chat): Dockerfile production builds, fix empty-string env fallback (Build-Order Step 9)

Railway's Railpack builder auto-detected this repo as a turborepo (turbo.json
exists at root) and unconditionally ran the root package.json's "build"
script (turbo run build) regardless of each service's configured
buildCommand override — and turbo was never actually an installed binary
here (dev.sh's own comment already avoids `pnpm dev` for this exact
reason), so every Railpack-built frontend failed with "turbo: not found".

Added a Dockerfile per frontend (shell, strategy-curator, chat), each a
direct `pnpm --filter <pkg> build` against the full monorepo context,
matching the Dockerfile pattern already proven reliable for the four
backend services. Verified locally with `docker build` (with and without
build-args) before pushing.

That local verification caught a second, real bug: `?? default` doesn't
protect against a Docker ARG that's declared but never passed — those
resolve to an EMPTY STRING once assigned to ENV, not undefined, so `??`
alone silently shipped `strategyCurator@` (no host) instead of falling
back, and rspack's Module Federation remote-info resolution crashed on
the empty entry ("TypeError: object null is not iterable"). Switched the
four PUBLIC_-var fallbacks (shell/rsbuild.config.ts's two remote URLs;
shell, chat, and strategy-curator's WS_URL) from `??` to `||`.

Files changed:
- shell/Dockerfile (new)
- apps/strategy-curator/Dockerfile (new)
- apps/chat/Dockerfile (new)
- shell/rsbuild.config.ts
- shell/src/App.svelte
- apps/chat/src/App.svelte
- apps/strategy-curator/src/curation.svelte.ts

Author: mpstaton

apps/chat/Dockerfile

@@ -0,0 +1,29 @@
+# Production build for the chat federated remote (didi). Same rationale
+# as shell/Dockerfile — direct pnpm --filter build instead of relying on
+# Railpack's turborepo auto-detection, which overrides any custom
+# buildCommand unconditionally and runs the (nonfunctional, turbo was
+# never actually installed) root "build" script instead.
+#
+# Build context is the repo root (Railway: no rootDirectory set for this
+# service, dockerfilePath: apps/chat/Dockerfile).
+
+FROM node:22-alpine AS build
+WORKDIR /monorepo
+RUN corepack enable
+
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY packages ./packages
+COPY apps ./apps
+COPY shell ./shell
+RUN pnpm install --frozen-lockfile
+
+ARG PUBLIC_WS_URL
+ENV PUBLIC_WS_URL=$PUBLIC_WS_URL
+RUN pnpm --filter @augment-it/chat build
+
+FROM node:22-alpine
+WORKDIR /app
+RUN npm install -g serve
+COPY --from=build /monorepo/apps/chat/dist ./dist
+EXPOSE 3006
+CMD ["serve", "-s", "dist", "-l", "3006"]

apps/chat/src/App.svelte

@@ -16,7 +16,7 @@
   // WS_URL the shell and strategy-curator each read (rsbuild inlines
   // PUBLIC_-prefixed vars into import.meta.env at build time).
   const WS_URL =
-    ((import.meta as { env?: Record<string, string> }).env?.PUBLIC_WS_URL as string | undefined) ??
+    ((import.meta as { env?: Record<string, string> }).env?.PUBLIC_WS_URL as string | undefined) ||
     'ws://localhost:3001/ws';
 
   let connectionStatus = $state<'connecting' | 'open' | 'closed' | 'error'>('connecting');

apps/strategy-curator/Dockerfile

@@ -0,0 +1,29 @@
+# Production build for the strategy-curator federated remote. Same
+# rationale as shell/Dockerfile — direct pnpm --filter build instead of
+# relying on Railpack's turborepo auto-detection, which overrides any
+# custom buildCommand unconditionally and runs the (nonfunctional, turbo
+# was never actually installed) root "build" script instead.
+#
+# Build context is the repo root (Railway: no rootDirectory set for this
+# service, dockerfilePath: apps/strategy-curator/Dockerfile).
+
+FROM node:22-alpine AS build
+WORKDIR /monorepo
+RUN corepack enable
+
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY packages ./packages
+COPY apps ./apps
+COPY shell ./shell
+RUN pnpm install --frozen-lockfile
+
+ARG PUBLIC_WS_URL
+ENV PUBLIC_WS_URL=$PUBLIC_WS_URL
+RUN pnpm --filter @augment-it/strategy-curator build
+
+FROM node:22-alpine
+WORKDIR /app
+RUN npm install -g serve
+COPY --from=build /monorepo/apps/strategy-curator/dist ./dist
+EXPOSE 3017
+CMD ["serve", "-s", "dist", "-l", "3017"]

apps/strategy-curator/src/curation.svelte.ts

@@ -19,7 +19,7 @@ const TOKEN_KEY = 'augment-it:session-token';
 // import.meta.env at build time — applies to plain .ts modules too, not
 // just .svelte files).
 const WS_URL =
-  ((import.meta as { env?: Record<string, string> }).env?.PUBLIC_WS_URL as string | undefined) ??
+  ((import.meta as { env?: Record<string, string> }).env?.PUBLIC_WS_URL as string | undefined) ||
   'ws://localhost:3001/ws';
 const ACTIVE_STRATEGY_KEY = 'augment-it:active-strategy';
 // The operator-chosen domain type this surface is currently browsing/

shell/Dockerfile

@@ -0,0 +1,37 @@
+# Production build for the shell — the only one of the three frontend
+# Dockerfiles that needs multi-stage (build with the full pnpm workspace
+# context, serve only the static output). Root package.json's own "build"
+# script (turbo run build) is dead weight — turbo was never actually an
+# installed binary in this repo — so this Dockerfile builds via a direct
+# pnpm --filter invocation instead of relying on Railpack's turborepo
+# auto-detection, which overrides any custom buildCommand unconditionally.
+#
+# Build context is the repo root (Railway: no rootDirectory set for this
+# service, dockerfilePath: shell/Dockerfile).
+
+FROM node:22-alpine AS build
+WORKDIR /monorepo
+RUN corepack enable
+
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY packages ./packages
+COPY apps ./apps
+COPY shell ./shell
+RUN pnpm install --frozen-lockfile
+
+ARG PUBLIC_WS_URL
+ARG PUBLIC_ID_BASE
+ARG PUBLIC_STRATEGY_CURATOR_REMOTE
+ARG PUBLIC_CHAT_REMOTE
+ENV PUBLIC_WS_URL=$PUBLIC_WS_URL
+ENV PUBLIC_ID_BASE=$PUBLIC_ID_BASE
+ENV PUBLIC_STRATEGY_CURATOR_REMOTE=$PUBLIC_STRATEGY_CURATOR_REMOTE
+ENV PUBLIC_CHAT_REMOTE=$PUBLIC_CHAT_REMOTE
+RUN pnpm --filter @augment-it/shell build
+
+FROM node:22-alpine
+WORKDIR /app
+RUN npm install -g serve
+COPY --from=build /monorepo/shell/dist ./dist
+EXPOSE 3100
+CMD ["serve", "-s", "dist", "-l", "3100"]

shell/rsbuild.config.ts

@@ -16,8 +16,15 @@ import { pluginModuleFederation } from '@module-federation/rsbuild-plugin';
 // leaving them pointed at localhost is the same "no isolation, they error
 // if poked" rule the build order already established, just now true for
 // federation URLs too — nobody on this instance ever navigates to them.
-const STRATEGY_CURATOR_REMOTE = process.env.PUBLIC_STRATEGY_CURATOR_REMOTE ?? 'http://localhost:3017/remoteEntry.js';
-const CHAT_REMOTE = process.env.PUBLIC_CHAT_REMOTE ?? 'http://localhost:3006/remoteEntry.js';
+// `|| default` (not `?? default`) deliberately — an unset Docker ARG
+// resolves to an EMPTY STRING once assigned to ENV, not undefined, so `??`
+// alone would silently ship `strategyCurator@` / `chat@` (no host) instead
+// of falling back. Caught locally: a docker build with these vars unset
+// produced "TypeError: object null is not iterable" deep in rspack's
+// Module Federation remote-info resolution — an empty remote URL, not a
+// missing one.
+const STRATEGY_CURATOR_REMOTE = process.env.PUBLIC_STRATEGY_CURATOR_REMOTE || 'http://localhost:3017/remoteEntry.js';
+const CHAT_REMOTE = process.env.PUBLIC_CHAT_REMOTE || 'http://localhost:3006/remoteEntry.js';
 
 export default defineConfig({
   plugins: [

shell/src/App.svelte

@@ -36,7 +36,7 @@
   // second env var — Step 7's /config check needs the same origin, not the
   // WS scheme.
   const WS_URL =
-    ((import.meta as { env?: Record<string, string> }).env?.PUBLIC_WS_URL as string | undefined) ??
+    ((import.meta as { env?: Record<string, string> }).env?.PUBLIC_WS_URL as string | undefined) ||
     'ws://localhost:3001/ws';
   const WS_HTTP_BASE = WS_URL.replace(/^ws/, 'http').replace(/\/ws$/, '');