fix(zane): sync current envs, optional n1

.env.docker

@@ -32,11 +32,10 @@ DC_HERBATIKA_PUBLIC_PORT=3001
 DC_HERBATIKA_NEXT_PUBLIC_STOREFRONT_AUTH_MODE=session_proxy
 DC_HERBATIKA_MEDUSA_BACKEND_URL_INTERNAL=http://medusa-be:9000
 DC_HERBATIKA_NEXT_PUBLIC_MEDUSA_BACKEND_URL=http://localhost:9000
-DC_HERBATIKA_MEILISEARCH_HOST=http://medusa-meilisearch:7700
 DC_HERBATIKA_NEXT_PUBLIC_PACKETA_WIDGET_COUNTRIES=sk
 DC_HERBATIKA_NEXT_PUBLIC_PACKETA_WIDGET_API_KEY=
+DC_HERBATIKA_NEXT_PUBLIC_PPL_WIDGET_API_KEY=
 DC_HERBATIKA_NEXT_PUBLIC_PAYLOAD_BASE_URL=http://localhost:8083
-DC_HERBATIKA_MEILISEARCH_SEARCH_API_KEY=MEILISEARCH_SEARCH_READONLY_KEY_FOR_FRONTEND
 DC_HERBATIKA_NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY=
 
 # Medusa BE container: app runtime

README.md

@@ -85,7 +85,7 @@
       * `DC_ZANE_OPERATOR_ZANE_USERNAME` / `DC_ZANE_OPERATOR_ZANE_PASSWORD` are the login credentials for that ZaneOps instance; `zane-operator` uses session + CSRF login upstream, not a direct Zane token
       * create one canonical Zane project and note its slug; local CI-style deploy tests use that slug as `ZANE_PROJECT_SLUG`
       * each Zane project gets a protected `production` environment by default; preview clones in this repo always use that environment as the base
-      * service names in that Zane project must match `apps/new-engine-ctl/config/stack-manifest.yaml` currently: `medusa-db`, `medusa-valkey`, `medusa-minio`, `medusa-meilisearch`, `medusa-be`, `payload`, `n1`
+      * service names in that Zane project must match `apps/new-engine-ctl/config/stack-manifest.yaml` currently: `medusa-db`, `medusa-valkey`, `medusa-minio`, `medusa-meilisearch`, `medusa-be`, `payload`, `herbatika`; `n1` remains an explicitly selectable reference storefront and is excluded from automatic CI scope
       * preview environments are derived in CI script space as `pr-<number>` by default
       * preview teardown is explicit in this repo's CI flow; do not rely on built-in Zane preview auto-teardown for these cloned environments
 

apps/herbatika/package.json

@@ -4,6 +4,7 @@
   "private": true,
   "scripts": {
     "dev": "next dev --turbopack -p 3001",
+    "start:ci-dev": "next dev --turbopack --hostname 0.0.0.0 --port 3000",
     "build": "next build --turbopack",
     "start": "next start",
     "lint": "biome check",

apps/new-engine-ctl/NEW_ENGINE_CTL_ARCHITECTURE.md

@@ -118,6 +118,9 @@ Phase intent:
 - `prepare` is for shared-resource prerequisites and input validation only.
 - preview `prepare` owns baseline-aware shared-resource ensure decisions. It must not rely only on the originally requested service set when a baseline replay will expand deploy scope to the full preview clone set.
 - runtime-provider execution belongs in deploy orchestration after the provider source service is deployed and healthy, except that consumer-only deploys may reuse already-persisted contract-owned provider outputs from healthy target deployments when the source service is not in the current plan.
+- project bootstrap/sync must not materialize or clean service envs owned by
+  runtime providers; empty local provider-output placeholders are inputs for
+  local reconciliation, not empty upstream desired values.
 - deploy-to-verify/render runtime-provider handoff is generic:
   - deploy emits `runtime_provider_outputs_json` and `runtime_provider_output_keys_csv`
   - verify/render consume `--runtime-provider-outputs-json`
@@ -133,7 +136,11 @@ Phase intent:
 - preview route identity is repo-owned. When a preview environment is cloned or reused, authenticated URL reconciliation, stale cloned/default URL removal, preview-excluded service cleanup, and preview service-spec convergence belong in `zane-operator`, while deploy/baseline policy stays in `apps/new-engine-ctl`.
 - preview shared-env reconciliation is also repo-owned and typed: preview deploy syncs the existing shared host/DB keys from the preview environment topology plus prepared DB credentials before service deploy stages consume them.
 - `service_reconciliation` should stay lean: source-sync behavior is the default for preview-cloned services, and the YAML should only encode non-default policy such as lane-specific build-stage targets.
-- Current lane-specific builder-stage policy in `service_reconciliation`: `medusa-be`, `payload`, and `n1` use `ci-dev` for preview and `prod` for main.
+- Current lane-specific builder-stage policy in `service_reconciliation`: `medusa-be`, `payload`, `herbatika`, and optional `n1` use `ci-dev` for preview and `prod` for main.
+- `ci.enabled_by_default: false` keeps optional deployable services such as
+  `n1` out of affected-service scope and ordinary preview baselines while
+  preserving explicit `--services-csv n1` deployment and provider
+  reconciliation.
 - workflow YAML may use workflow-safe concurrency groups to cancel superseded runs, but workflow cancellation complements rather than replaces lane-owned deployment adoption/cancel rules.
 - Preview runtime address policy has two scopes: operator-side provisioners must use preview-scoped global/private identities, while shared/service env values consumed by services inside the preview environment may keep local private aliases from `preview_runtime_reconciliation` when those consumers run on the same preview environment network.
 - main deploys and redeploy-only preview runs should not reprovision unrelated runtime-provider outputs just because the provider source service is healthy; when required persisted env values already exist on in-scope consumers, CTL may reuse them instead of forcing a fresh provider run.

apps/new-engine-ctl/config/stack-inputs.yaml

@@ -231,8 +231,6 @@ runtime_providers:
           target_envs:
             - service_id: n1
               env_var: NEXT_PUBLIC_MEILISEARCH_API_KEY
-            - service_id: herbatika
-              env_var: MEILISEARCH_SEARCH_API_KEY
           policy:
             kind: meilisearch_key
             uid: 4b7f7f7e-8798-4b3f-8e73-c0f76f8b35d6
@@ -264,6 +262,8 @@ runtime_providers:
           target_envs:
             - service_id: n1
               env_var: NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY
+            - service_id: herbatika
+              env_var: NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY
           policy:
             kind: medusa_publishable_key
             title: Storefront Publishable Key
@@ -282,11 +282,17 @@ local_env_aliases:
       env_var: NEXT_PUBLIC_MEILISEARCH_API_KEY
       local_env_var: DC_N1_NEXT_PUBLIC_MEILISEARCH_API_KEY
 
-    - provider_id: meili_api_credentials
+    - provider_id: medusa_publishable_key
+      output_id: frontend_key
+      service_id: n1
+      env_var: NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY
+      local_env_var: DC_N1_NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY
+
+    - provider_id: medusa_publishable_key
       output_id: frontend_key
       service_id: herbatika
-      env_var: MEILISEARCH_SEARCH_API_KEY
-      local_env_var: DC_HERBATIKA_MEILISEARCH_SEARCH_API_KEY
+      env_var: NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY
+      local_env_var: DC_HERBATIKA_NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY
 
 preview_runtime_reconciliation:
   shared_env:
@@ -335,7 +341,7 @@ preview_runtime_reconciliation:
       env_var: STORE_CORS
       source:
         kind: service_public_origin
-        service_id: n1
+        service_id: herbatika
 
     - service_id: medusa-be
       env_var: ADMIN_CORS
@@ -404,30 +410,24 @@ preview_runtime_reconciliation:
         service_id: medusa-minio
         port: 9004
 
-    - service_id: n1
+    - service_id: herbatika
       env_var: MEDUSA_BACKEND_URL_INTERNAL
       source:
         kind: service_internal_origin
         service_id: medusa-be
         port: 9000
 
-    - service_id: n1
+    - service_id: herbatika
       env_var: NEXT_PUBLIC_MEDUSA_BACKEND_URL
       source:
         kind: service_public_origin
         service_id: medusa-be
 
-    - service_id: n1
-      env_var: NEXT_PUBLIC_MEILISEARCH_URL
-      source:
-        kind: service_public_origin
-        service_id: medusa-meilisearch
-
-    - service_id: n1
-      env_var: NEXT_PUBLIC_SITE_URL
+    - service_id: herbatika
+      env_var: NEXT_PUBLIC_PAYLOAD_BASE_URL
       source:
         kind: service_public_origin
-        service_id: n1
+        service_id: payload
 
 preview_verification:
   forbidden_service_env:
@@ -541,7 +541,7 @@ preview_verification:
         - ZANE_USERNAME
         - ZANE_PASSWORD
 
-    - service_id: n1
+    - service_id: herbatika
       env_keys:
         - API_AUTH_TOKEN
         - PGHOST
@@ -891,6 +891,12 @@ service_reconciliation:
           preview: ci-dev
           main: prod
 
+    - service_id: herbatika
+      builder:
+        build_stage_target_by_lane:
+          preview: ci-dev
+          main: prod
+
     - service_id: n1
       builder:
         build_stage_target_by_lane:

apps/new-engine-ctl/config/stack-manifest.yaml

@@ -23,15 +23,15 @@
 #         deploy_lanes: [preview, main]
 #         deploy_stage: 20
 #         service_dependencies: [medusa-db, medusa-valkey, medusa-minio, medusa-meilisearch]
-#   - id: n1
-#     compose_service: n1
+#   - id: herbatika
+#     compose_service: herbatika
 #     local:
 #       phase: frontend
 #     ci:
 #       deployable: true
-#       affected_path_globs: ["docker/development/n1/**"]
+#       affected_path_globs: ["docker/development/herbatika/**"]
 #       zane:
-#         service_slug: n1
+#         service_slug: herbatika
 #         deploy_lanes: [preview, main]
 #         deploy_stage: 25
 #         service_dependencies: [medusa-be]
@@ -49,7 +49,7 @@ ci:
         - ".dockerignore"
       service_ids:
         - "medusa-be"
-        - "n1"
+        - "herbatika"
         - "payload"
         - "zane-operator"
         - "medusa-db"
@@ -65,7 +65,7 @@ ci:
         - "tsconfig.json"
       service_ids:
         - "medusa-be"
-        - "n1"
+        - "herbatika"
         - "payload"
 
 services:
@@ -182,7 +182,10 @@ services:
       # is the active storefront target.
       enabled_by_default: false
     ci:
+      # N1 remains explicitly deployable for compatibility checks, but normal
+      # affected-service scoping and preview baselines follow Herbatika.
       deployable: true
+      enabled_by_default: false
       affected_path_globs:
         - "docker/development/n1/**"
       zane:
@@ -199,7 +202,17 @@ services:
     local:
       phase: "frontend"
     ci:
-      deployable: false
+      deployable: true
+      affected_path_globs:
+        - "apps/herbatika/**"
+        - "docker/development/herbatika/**"
+        - "libs/storefront-data/**"
+        - "libs/ui/**"
+      zane:
+        service_slug: "herbatika"
+        deploy_lanes: ["preview", "main"]
+        deploy_stage: 25
+        service_dependencies: ["medusa-be"]
 
   - id: "zane-operator"
     compose_service: "zane-operator"