ReviewOS

stacks/stx

feat(config): add typed public/private runtime configuration with deployment-time overrides

#1968
Closed glennmichael123 opened this 10 days ago ·
10 days ago

Problem

stx's public environment support substitutes browser values during build. Deploying the same built artifact to environments with different public API URLs therefore needs additional application plumbing or another build.

A runtime configuration API would let the server resolve deployment-specific values and expose only the declared public subset to the browser.

Evidence

Reviewed at 7d93c4c: public-env.ts explicitly implements build-time substitutions. This request complements that existing behavior.

Scope and acceptance criteria

  • Declare typed configuration defaults with explicit public and server-only sections.
  • Resolve documented environment overrides when the production server starts.
  • Expose the public subset consistently during SSR and browser hydration.
  • Keep private keys out of HTML payloads, client bundles, and client type access.
  • Preserve current import.meta.env build-time substitution for existing apps.
  • Test one build served with two different runtime configurations.
  • Define SPA navigation behavior and document limitations for fully static deployments.
  • Provide a documented API with inferred types and predictable override rules.

Prior art: Nuxt runtime config.

10 days ago

Implemented in 89ba777. Added typed public/private runtime configuration, startup environment overrides, request-isolated server access, public SSR/SPA hydration payloads, generated client/server declarations, and client/source-serving privacy guards. One build is tested against two concurrent deployments after removing the source tree. Existing import.meta.env behavior is unchanged. Static/prerender limitations and the explicit secret-exposure boundary are documented in docs/features/runtime-config.md. Full local suite: 13,153 passing; CI all jobs green: https://github.com/stacksjs/stx/actions/runs/36013103816

10 days ago

Follow-ups landed: d3edc01 validates array/null environment overrides against inferred types; 1fbb3a0 preserves host runtime configuration through nested shared components and pre-pipeline server-script extraction. Regression tests reproduce the cross-app failures before the fix and pass afterward. Final CI is green, including tests and package publishing: https://github.com/stacksjs/stx/actions/runs/36016382789

Sign in to comment on this issue.