Website: Next.js app for accounts, linking, who's online, device sign-in and the console

apps/web: Next.js 16 (App Router), Tailwind 4 and shadcn/ui, light and dark from the system. Pages render on the
server and call the API with Eden Treaty (typed by @t5de/api), forwarding the visitor's cookie; forms use server
actions; sign-up, sign-in and sign-out use Better Auth's React client. /api is rewritten to the API so its cookies
are first-party. Who's online follows the API's event stream (Next's gzip is off: it held the stream back).
Standalone output with a Dockerfile; deploys to Vercel as is.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/next.config.ts

@@ -0,0 +1,25 @@
+import path from "node:path";
+import type { NextConfig } from "next";
+
+// The API's internal address. The browser never calls it directly: /api is rewritten to it, so the API's session
+// cookies are first-party on the website's origin. Rewrites are fixed when the app is built, so API_URL must be set
+// at build time as well as at run time (server components call it directly).
+const apiURL = process.env.API_URL ?? "http://localhost:4101";
+
+// The monorepo's root: standalone output traces workspace packages from here.
+const root = path.join(import.meta.dirname, "../..");
+
+const config: NextConfig = {
+  output: "standalone",
+  outputFileTracingRoot: root,
+  turbopack: { root },
+  // Next's gzip holds back the API's event stream (who's online); compress in front of the app instead (Vercel and
+  // most reverse proxies do).
+  compress: false,
+  agentRules: false,
+  async rewrites() {
+    return [{ source: "/api/:path*", destination: `${apiURL}/api/:path*` }];
+  },
+};
+
+export default config;