pipeline/apps/web/next.config.mjs

import { existsSync, readFileSync } from "node:fs";
import { resolve } from "node:path";

// Expose the monorepo-root .env to server-side `process.env.*` reads.
//
// IMPORTANT: do NOT put these into `nextConfig.env`. The `env` config key is
// inlined into the JS bundle at BUILD time, which (a) bakes build-time values
// into the image and ignores the container's runtime environment
// (docker-compose `environment:` / k8s envFrom), and (b) inlines secrets into
// the bundle. Assigning to process.env here runs at config-load (build and
// `next start`); in the container there is no .env (it isn't copied into the
// runtime image — see .dockerignore), so this is a no-op there and the
// container's injected env vars are used as-is. Real/container env always wins
// — .env only fills keys that are still undefined.
const envPath = resolve(import.meta.dirname, "../../.env");
if (existsSync(envPath)) {
  const content = readFileSync(envPath, "utf-8");
  for (const line of content.split("\n")) {
    const trimmed = line.trim();
    if (!trimmed || trimmed.startsWith("#")) continue;
    const eq = trimmed.indexOf("=");
    if (eq < 0) continue;
    const key = trimmed.slice(0, eq).trim();
    if (!key) continue;
    const val = trimmed.slice(eq + 1).trim();
    if (process.env[key] === undefined) process.env[key] = val;
  }
}

/** @type {import('next').NextConfig} */
const nextConfig = {
  transpilePackages: ["@pipeline/shared", "@pipeline/core", "@pipeline/tts"],
};

export default nextConfig;