next.config.ts

import { withSentryConfig } from "@sentry/nextjs";
import type { NextConfig } from "next";
import { withWorkflow } from "workflow/next";

const nextConfig = {
  output: "standalone",
  // Admin test routes (app/api/admin/test/**/route.staging.ts) are excluded
  // from the prod bundle by omitting "staging.ts" from pageExtensions. See
  // KEEP-237. Staging/PR builds set INCLUDE_TEST_ENDPOINTS=true via the build
  // workflow to compile them in.
  // "js"/"jsx" must remain so that the workflow runtime routes generated by
  // withWorkflow at app/.well-known/workflow/v1/{flow,step,webhook}/route.js
  // are picked up by the Next.js router; without them the in-pod graphile
  // worker POSTs return Next's HTML 404 and every workflow run fails.
  pageExtensions:
    process.env.INCLUDE_TEST_ENDPOINTS === "true"
      ? ["ts", "tsx", "js", "jsx", "staging.ts", "staging.tsx"]
      : ["ts", "tsx", "js", "jsx"],
  // Bake INCLUDE_TEST_ENDPOINTS so lib/admin-auth.ts and lib/auth.ts can
  // gate runtime behavior (admin routes, rate-limit bypass) on the build-
  // time flag. The bundler (Turbopack / webpack) replaces
  // `process.env.INCLUDE_TEST_ENDPOINTS` with the literal captured here, so
  // runtime env cannot override the baked value.
  //
  // NOTE: `env` config inlines into BOTH server and client bundles. The
  // value ("true" or "") is a non-sensitive feature flag, so this is fine.
  // Never put secrets in this block.
  //
  // See KEEP-237.
  env: {
    INCLUDE_TEST_ENDPOINTS: process.env.INCLUDE_TEST_ENDPOINTS ?? "",
  },
  // The SDK loads @workflow/world-postgres via dynamic
  // require(process.env.WORKFLOW_TARGET_WORLD) which the standalone output
  // tracer cannot follow. serverExternalPackages keeps it out of the bundle
  // and outputFileTracingIncludes forces it into the standalone node_modules.
  // .npmrc public-hoist-pattern hoists these from .pnpm/ to top-level
  // node_modules/ so the simple globs below can find them.
  // Full transitive dependency tree of @workflow/world-postgres.
  // Generated by: tsx scripts/list-world-deps.ts
  serverExternalPackages: [
    "@babel/code-frame",
    "@babel/helper-validator-identifier",
    "@cbor-extract/cbor-extract-darwin-arm64",
    "@cbor-extract/cbor-extract-darwin-x64",
    "@cbor-extract/cbor-extract-linux-arm",
    "@cbor-extract/cbor-extract-linux-arm64",
    "@cbor-extract/cbor-extract-linux-x64",
    "@cbor-extract/cbor-extract-win32-x64",
    "@graphile/logger",
    "@types/debug",
    "@types/interpret",
    "@types/ms",
    "@types/node",
    "@types/pg",
    "@types/semver",
    "@vercel/oidc",
    "@vercel/queue",
    "@workflow/errors",
    "@workflow/utils",
    "@workflow/world",
    "@workflow/world-local",
    "@workflow/world-postgres",
    "ansi-regex",
    "ansi-styles",
    "argparse",
    "async-sema",
    "balanced-match",
    "brace-expansion",
    "callsites",
    "cbor-extract",
    "cbor-x",
    "chalk",
    "cliui",
    "color-convert",
    "color-name",
    "cosmiconfig",
    "cron-parser",
    "debug",
    "detect-libc",
    "dotenv",
    "drizzle-orm",
    "emoji-regex",
    "error-ex",
    "escalade",
    "get-caller-file",
    "graphile-config",
    "graphile-worker",
    "has-flag",
    "import-fresh",
    "interpret",
    "is-arrayish",
    "is-fullwidth-code-point",
    "js-tokens",
    "js-yaml",
    "json-parse-even-better-errors",
    "json5",
    "lines-and-columns",
    "minimatch",
    "mixpart",
    "ms",
    "node-gyp-build-optional-packages",
    "parent-module",
    "parse-json",
    "path-type",
    "pg",
    "pg-cloudflare",
    "pg-connection-string",
    "pg-int8",
    "pg-pool",
    "pg-protocol",
    "pg-types",
    "pgpass",
    "picocolors",
    "postgres",
    "postgres-array",
    "postgres-bytea",
    "postgres-date",
    "postgres-interval",
    "require-directory",
    "resolve-from",
    "semver",
    "split2",
    "string-width",
    "strip-ansi",
    "supports-color",
    "tslib",
    "ulid",
    "undici",
    "undici-types",
    "wrap-ansi",
    "xtend",
    "y18n",
    "yargs",
    "yargs-parser",
    "zod",
  ],
  outputFileTracingIncludes: {
    "/*": [
      // Force-include the next package itself. The standalone server.js
      // emitted by `output: "standalone"` does a bare `require('next')`,
      // which needs next/package.json to resolve. Next's tracer only
      // catches that bare specifier when some other file in the bundle
      // also imports next directly. In prod builds INCLUDE_TEST_ENDPOINTS
      // is empty, the staging-only `*.staging.ts` files that triggered
      // the side-effect are excluded, and the standalone output ends up
      // with next/dist/ but no next/package.json -- runtime crashes with
      // "Cannot find module 'next'" on server.js line 16. Including next
      // explicitly here makes the bundle robust regardless of which other
      // pageExtensions are active. See KEEP-348 follow-up incident.
      "./node_modules/next/**/*",
      // Next 16's standalone tracer doesn't follow next's own runtime
      // dependencies through pnpm's .pnpm/ store. Force-include the full
      // set listed in next/package.json `dependencies` plus the
      // architecture-specific @next/swc binary used on Alpine (musl).
      "./node_modules/@next/env/**/*",
      "./node_modules/@next/swc-linux-x64-musl/**/*",
      "./node_modules/@swc/helpers/**/*",
      "./node_modules/baseline-browser-mapping/**/*",
      "./node_modules/caniuse-lite/**/*",
      "./node_modules/postcss/**/*",
      "./node_modules/styled-jsx/**/*",
      "./node_modules/@babel/code-frame/**/*",
      "./node_modules/@babel/helper-validator-identifier/**/*",
      "./node_modules/@cbor-extract/cbor-extract-darwin-arm64/**/*",
      "./node_modules/@cbor-extract/cbor-extract-darwin-x64/**/*",
      "./node_modules/@cbor-extract/cbor-extract-linux-arm/**/*",
      "./node_modules/@cbor-extract/cbor-extract-linux-arm64/**/*",
      "./node_modules/@cbor-extract/cbor-extract-linux-x64/**/*",
      "./node_modules/@cbor-extract/cbor-extract-win32-x64/**/*",
      "./node_modules/@graphile/logger/**/*",
      "./node_modules/@types/debug/**/*",
      "./node_modules/@types/interpret/**/*",
      "./node_modules/@types/ms/**/*",
      "./node_modules/@types/node/**/*",
      "./node_modules/@types/pg/**/*",
      "./node_modules/@types/semver/**/*",
      "./node_modules/@vercel/oidc/**/*",
      "./node_modules/@vercel/queue/**/*",
      "./node_modules/@workflow/errors/**/*",
      "./node_modules/@workflow/utils/**/*",
      "./node_modules/@workflow/world/**/*",
      "./node_modules/@workflow/world-local/**/*",
      "./node_modules/@workflow/world-postgres/**/*",
      "./node_modules/ansi-regex/**/*",
      "./node_modules/ansi-styles/**/*",
      "./node_modules/argparse/**/*",
      "./node_modules/async-sema/**/*",
      "./node_modules/balanced-match/**/*",
      "./node_modules/brace-expansion/**/*",
      "./node_modules/callsites/**/*",
      "./node_modules/cbor-extract/**/*",
      "./node_modules/cbor-x/**/*",
      "./node_modules/chalk/**/*",
      "./node_modules/cliui/**/*",
      "./node_modules/color-convert/**/*",
      "./node_modules/color-name/**/*",
      "./node_modules/cosmiconfig/**/*",
      "./node_modules/cron-parser/**/*",
      "./node_modules/debug/**/*",
      "./node_modules/detect-libc/**/*",
      "./node_modules/dotenv/**/*",
      "./node_modules/drizzle-orm/**/*",
      "./node_modules/emoji-regex/**/*",
      "./node_modules/error-ex/**/*",
      "./node_modules/escalade/**/*",
      "./node_modules/get-caller-file/**/*",
      "./node_modules/graphile-config/**/*",
      "./node_modules/graphile-worker/**/*",
      "./node_modules/has-flag/**/*",
      "./node_modules/import-fresh/**/*",
      "./node_modules/interpret/**/*",
      "./node_modules/is-arrayish/**/*",
      "./node_modules/is-fullwidth-code-point/**/*",
      "./node_modules/js-tokens/**/*",
      "./node_modules/js-yaml/**/*",
      "./node_modules/json-parse-even-better-errors/**/*",
      "./node_modules/json5/**/*",
      "./node_modules/lines-and-columns/**/*",
      "./node_modules/minimatch/**/*",
      "./node_modules/mixpart/**/*",
      "./node_modules/ms/**/*",
      "./node_modules/node-gyp-build-optional-packages/**/*",
      "./node_modules/parent-module/**/*",
      "./node_modules/parse-json/**/*",
      "./node_modules/path-type/**/*",
      "./node_modules/pg/**/*",
      "./node_modules/pg-cloudflare/**/*",
      "./node_modules/pg-connection-string/**/*",
      "./node_modules/pg-int8/**/*",
      "./node_modules/pg-pool/**/*",
      "./node_modules/pg-protocol/**/*",
      "./node_modules/pg-types/**/*",
      "./node_modules/pgpass/**/*",
      "./node_modules/picocolors/**/*",
      "./node_modules/postgres/**/*",
      "./node_modules/postgres-array/**/*",
      "./node_modules/postgres-bytea/**/*",
      "./node_modules/postgres-date/**/*",
      "./node_modules/postgres-interval/**/*",
      "./node_modules/require-directory/**/*",
      "./node_modules/resolve-from/**/*",
      "./node_modules/semver/**/*",
      "./node_modules/split2/**/*",
      "./node_modules/string-width/**/*",
      "./node_modules/strip-ansi/**/*",
      "./node_modules/supports-color/**/*",
      "./node_modules/tslib/**/*",
      "./node_modules/ulid/**/*",
      "./node_modules/undici/**/*",
      "./node_modules/undici-types/**/*",
      "./node_modules/wrap-ansi/**/*",
      "./node_modules/xtend/**/*",
      "./node_modules/y18n/**/*",
      "./node_modules/yargs/**/*",
      "./node_modules/yargs-parser/**/*",
      "./node_modules/zod/**/*",
      "./node_modules/next/dist/compiled/@vercel/og/**/*",
    ],
  },
  logging: {
    fetches: {
      fullUrl: true,
    },
  },
  eslint: {
    ignoreDuringBuilds: true,
  },
  images: {
    remotePatterns: [
      {
        protocol: "https",
        hostname: "raw.githubusercontent.com",
        pathname: "/trustwallet/assets/**",
      },
    ],
  },
  async rewrites() {
    return [{ source: "/openapi.json", destination: "/api/openapi" }];
  },
  async headers() {
    return [
      {
        source: "/:path*",
        headers: [
          { key: "X-Frame-Options", value: "DENY" },
          { key: "X-Content-Type-Options", value: "nosniff" },
          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
          {
            key: "Strict-Transport-Security",
            value: "max-age=63072000; includeSubDomains",
          },
        ],
      },
    ];
  },
  async redirects() {
    return [
      {
        source: "/llms.txt",
        destination: "https://docs.keeperhub.com/llms.txt",
        permanent: true,
      },
    ];
  },
} satisfies NextConfig & { eslint?: { ignoreDuringBuilds?: boolean } };

const { SENTRY_ORG, SENTRY_PROJECT, SENTRY_RELEASE } = process.env;

export default withSentryConfig(withWorkflow(nextConfig), {
  // For all available options, see:
  // https://www.npmjs.com/package/@sentry/webpack-plugin#options

  org: SENTRY_ORG,
  project: SENTRY_PROJECT,
  release: SENTRY_RELEASE ? { name: SENTRY_RELEASE } : undefined,

  // Only print logs for uploading source maps in CI
  silent: !process.env.CI,

  // For all available options, see:
  // https://docs.sentry.io/platforms/javascript/guides/nextjs/manual-setup/

  // Upload a larger set of source maps for prettier stack traces (increases build time)
  widenClientFileUpload: true,

  // No-op: source map upload moved to sentry-upload Docker stage (KEEP-280).
  // Kept for safety in case SENTRY_AUTH_TOKEN is ever set during build.
  sourcemaps: {
    deleteSourcemapsAfterUpload: true,
  },

  // Route browser requests to Sentry through a Next.js rewrite to circumvent ad-blockers.
  // This can increase your server load as well as your hosting bill.
  // Note: Check that the configured route will not match with your Next.js middleware, otherwise reporting of client-
  // side errors will fail.
  tunnelRoute: "/monitoring",

  webpack: {
    // Enables automatic instrumentation of Vercel Cron Monitors. (Does not yet work with App Router route handlers.)
    // See the following for more information:
    // https://docs.sentry.io/product/crons/
    // https://vercel.com/docs/cron-jobs
    automaticVercelMonitors: true,

    // Tree-shaking options for reducing bundle size
    treeshake: {
      // Automatically tree-shake Sentry logger statements to reduce bundle size
      removeDebugLogging: true,
    },
  },
});