web: bind apex stackpanel.com alongside local.stackpanel.com

Production now serves both hostnames from the same Worker:
  - stackpanel.com → marketing/landing
  - local.stackpanel.com → studio (`/studio/*` routes talking to the
    user's local agent at 127.0.0.1:9876)

Both ship the same bundle today; better-auth's crossSubDomainCookies is
scoped to `.stackpanel.com` in production so a sign-in from the apex
carries into the studio subdomain. Outside production cookies stay
host-only — preview stages live on isolated per-PR subdomains and dev
runs on localhost where domain attributes are ignored.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: czxtm

apps/web/alchemy.run.ts

@@ -44,40 +44,49 @@ const program = Effect.gen(function* () {
   let url: Output.Output<string | undefined> = website.url;
 
   if (stage !== "dev") {
-    // Studio is local-agent first (mirrors local.drizzle.studio): the
-    // browser app at local.stackpanel.com talks to the user's machine via
-    // http://127.0.0.1:9876. Apex stackpanel.com is reserved for marketing.
-    const hostname =
+    // Production binds two hostnames to the same worker:
+    //   - apex stackpanel.com → marketing/landing (`/`, `/login`, …)
+    //   - local.stackpanel.com → studio (mirrors local.drizzle.studio: the
+    //     `/studio/*` routes talk to the user's machine via
+    //     http://127.0.0.1:9876).
+    // Both ship the same bundle today; auth cookies are scoped to
+    // `.stackpanel.com` so a session from the apex carries into the studio.
+    // Non-prod stages only get the studio hostname — there's no marketing
+    // preview to host on the apex.
+    const hostnames =
       stage === "production"
-        ? "local.stackpanel.com"
-        : `local.${stage}.stackpanel.com`;
+        ? ["local.stackpanel.com", "stackpanel.com"]
+        : [`local.${stage}.stackpanel.com`];
+    const primary = hostnames[0]!;
     url = Output.all(website.accountId, website.workerName).pipe(
       Output.mapEffect(([accountId, workerName]) =>
         Effect.gen(function* () {
-          const existing = yield* Workers.listDomains({
-            accountId,
-            hostname,
-          });
-          const stale = existing.result.filter(
-            (d) => d.hostname === hostname && d.id,
-          );
-          if (stale.length > 0) {
-            yield* Effect.log(
-              `[alchemy] purging ${stale.length} existing binding(s) at ${hostname}: ${stale
-                .map((d) => `${d.service ?? "?"}#${d.id}`)
-                .join(", ")}`,
+          for (const hostname of hostnames) {
+            const existing = yield* Workers.listDomains({
+              accountId,
+              hostname,
+            });
+            const stale = existing.result.filter(
+              (d) => d.hostname === hostname && d.id,
             );
+            if (stale.length > 0) {
+              yield* Effect.log(
+                `[alchemy] purging ${stale.length} existing binding(s) at ${hostname}: ${stale
+                  .map((d) => `${d.service ?? "?"}#${d.id}`)
+                  .join(", ")}`,
+              );
+            }
+            for (const d of stale) {
+              yield* Workers.deleteDomain({ accountId, domainId: d.id! });
+            }
+            yield* Workers.putDomain({
+              accountId,
+              hostname,
+              service: workerName,
+              zoneId: STACKPANEL_ZONE,
+            });
           }
-          for (const d of stale) {
-            yield* Workers.deleteDomain({ accountId, domainId: d.id! });
-          }
-          yield* Workers.putDomain({
-            accountId,
-            hostname,
-            service: workerName,
-            zoneId: STACKPANEL_ZONE,
-          });
-          return `https://${hostname}` as string | undefined;
+          return `https://${primary}` as string | undefined;
         }).pipe(Effect.orDie),
       ),
     );

packages/auth/src/index.ts

@@ -55,6 +55,18 @@ if (polarClient) {
   );
 }
 
+// In production both stackpanel.com and local.stackpanel.com serve the same
+// app, and the API at api.stackpanel.com sets the session cookie. Scoping
+// the cookie to `.stackpanel.com` lets a sign-in from the apex carry into
+// the studio subdomain. Outside production we leave it host-only — preview
+// stages live on per-PR subdomains that share nothing with each other, and
+// local dev runs on localhost where a domain attribute would be ignored.
+const deployEnv = process.env.STACKPANEL_DEPLOY_ENV;
+const crossSubDomainCookies =
+  deployEnv === "production"
+    ? { enabled: true as const, domain: ".stackpanel.com" }
+    : undefined;
+
 export const auth = betterAuth({
   database: drizzleAdapter(db, {
     provider: "pg",
@@ -69,6 +81,7 @@ export const auth = betterAuth({
       secure: true,
       httpOnly: true,
     },
+    ...(crossSubDomainCookies ? { crossSubDomainCookies } : {}),
   },
   plugins,
 });