feat: add IsProd components and encryption guardrail

[adrians5j]

What changed

New project templates now include <Infra.Encryption> preconfigured for production environments, driven by the WEBINY_ENCRYPTION_PASSPHRASE environment variable. Additionally, deploying to a production environment without encryption configured now fails with a clear, actionable error rather than silently succeeding.

Two new components, Infra.Env.IsProd and Infra.Env.IsNotProd, make it easy to scope config to production (or non-production) environments without repeating environment name lists. Infra.ProductionEnvironments is mounted in the base template with prod and production as defaults; users can override by declaring their own instance.

Why

Encryption was easy to forget when setting up a production environment — there was no scaffolded reminder in the project template and no guardrail at deploy time. Users could deploy to production without encryption, which is a security gap. The Infra.Env.Is env="prod" pattern also forced users with multiple production environments (e.g. prod-eu, prod-us) to repeat the full env list at every usage site.

How

Infra.Env.IsProd and Infra.Env.IsNotProd read from a new ProductionEnvironmentsContext — a React state context injected by ProductionEnvironmentsCollector in renderConfigWorker.tsx. Infra.ProductionEnvironments gains a render function whose Registrar child calls useEffect to push its environments prop into the context on mount, triggering a re-render before the debounced onChange fires. The multiple: true flag was removed so a user-declared instance fully replaces the default.

ValidateEncryptionBeforeDeploy is a new BeforeDeploy hook registered in Project.tsx. It uses GetProductionEnvironments to check if the current env is production, then looks for an Infra/Encryption extension in the rendered project config via extensionsByType("Infra/Encryption"). If missing, it throws a GracefulError pointing to WEBINY_ENCRYPTION_PASSPHRASE and <Infra.Encryption>.

Changelog

Added Production Environment Helpers and Encryption Guardrail

New project templates now include encryption preconfigured for production environments, and deploying to production without encryption set will fail with a clear error message. Two new components — Infra.Env.IsProd and Infra.Env.IsNotProd — let you scope infrastructure config to production environments without repeating environment name lists everywhere.

Squash Merge Commit

feat: add IsProd components and encryption guardrail (#5131)