Everwhen to Vercel, app half — a code-level reading

What changed, and why nothing changes at merge

Everwhen's hosting moves to Vercel. This PR is the app half, and merging it changes nothing a player can see: playeverwhen.com keeps serving from the cluster until the DNS flip in the companion infra PR (mseeks/zo#26), which also owns the cutover ordering and the rollback plan.

For what it does, the diff is tiny. The 57-line Dockerfile goes, along with a 41-line .dockerignore and 66 lines of CI publish machinery, because the Nuxt/Nitro Vercel preset needs no in-repo config at all and Hobby fluid compute's defaults already cover this app. What arrives: an 8-line README Hosting section, a one-line Sentry config addition (plus its rewritten comment), and a doc sweep of the two files that still described the image era. After cutover a push to main deploys, and any PR gets a working preview URL. The label-gated k8s preview system this replaces was retired earlier.

One scheduling fact belongs up front. The moment this merges, the cluster's :latest image freezes (its publisher job is gone), so nothing new can ship to players until the DNS flip. Merge and cutover belong in the same sitting; mseeks/zo#26 sequences them that way.

CI: the gate stays, the shipping leaves

Two jobs are gone. publish built the SSR image on green main builds and pushed ghcr.io/mseeks/everwhen as :latest plus a :<sha>. publish-preview built a :pr-<N> image whenever a PR carried the preview label. Vercel builds from source on its own runners. The images these jobs made fed the cluster Deployment's :latest pull, and that tag freezes the moment this merges, which is the freeze window named above. check survives byte-identical: the same lint, typecheck, unit suite, build, and mocked Playwright run, on every push and every PR.

The whole remaining jobs section — check, now the end of the file.

.github/workflows/ci.yml · 49 lines

.github/workflows/ci.yml49 lines · YAML

⋯ 19 lines hidden (lines 1–19)1name: CI
2 
3on:
push:
  branches: [main]
# `labeled` is included so adding the `preview` label fires a run (and thus the
# preview-image build below) without waiting for the next push — the common
# case is labeling a finished PR you want to play before approving.
pull_request:
  types: [opened, synchronize, reopened, labeled]
11 
12# Cancel superseded runs on the same ref to save CI minutes.
13concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true
16 
17permissions:
contents: read
19 
20jobs:
check:
  name: check (lint · typecheck · tests)
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v6
    - uses: actions/setup-node@v6
      with:
        node-version: "22"
        cache: npm
    # npm ci installs the committed lockfile exactly, so a dependency-patch
    # PR is verified against the lockfile it ships.
    - run: npm ci
    # Static gates first — fast, and they fail before the heavier build/e2e (#273).
    - run: npm run lint
    - run: npm run format:check
    - run: npx nuxt typecheck
    - run: npx vitest run
    # The agents/ maintenance package is self-contained (its own deps); typecheck
    # it too so the MHE loops can't silently rot — it's gated nowhere else.
    - run: npm --prefix agents ci
    - run: npm --prefix agents run typecheck
    # Build the SSR app and run the mocked Playwright suite on PRs too (#237), so build
    # breakage and e2e regressions surface HERE, not only after merge. The build is an
    # explicit step (fast, clear signal); the Playwright webServer then reuses it via
    # `nuxt preview` in CI (see playwright.config.ts) instead of rebuilding.
    - run: npm run build
    - name: Install Playwright chromium
      run: npx playwright install --with-deps chromium
    - run: npm run test:e2e

The Sentry seam: the one real code change

Server-side Sentry used to boot from the Dockerfile CMD: node --import ./.output/server/sentry.server.config.mjs .output/server/index.mjs. There is no CMD on Vercel. The platform invokes the bundled handler directly, so without a change the server half of Sentry would silently vanish while the client half kept reporting. The Sentry module has a mode for exactly this situation: autoInjectServerSentry: "top-level-import" compiles the init into the server bundle itself.

The rewritten sentry block: source-map upload still off, server init now injected.

nuxt.config.ts · 143 lines

nuxt.config.ts143 lines · TypeScript

⋯ 118 lines hidden (lines 1–118)1/**
* Nuxt 3 Configuration
* https://nuxt.com/docs/api/configuration/nuxt-config
*/
5import { DEFAULT_SENTRY_DSN } from "./sentry.shared";
6 
7export default defineNuxtConfig({
// Ensure compatibility with modern Nuxt features
compatibilityDate: "2025-05-15",
10 
// Enable devtools for development
devtools: { enabled: true },
13 
// Declare the document language app-wide (issue #118). Set here rather than in app.vue so
// it also reaches routes that bypass the app component — Nuxt's built-in error/404 page —
// keeping <html lang="en"> consistent everywhere (accessibility; pairs with og:locale).
app: {
  head: {
    htmlAttrs: { lang: "en" },
  },
},
22 
// Register required modules
modules: [
  "@nuxt/ui",
  "@pinia/nuxt",
  "@nuxtjs/supabase",
  "@nuxt/eslint",
  "@sentry/nuxt/module",
],
31 
// Supabase Auth (accounts). Anonymous-first: every visitor gets an anonymous
// user so the balance keys on a real user id from the first second; an OAuth
// sign-in lands on a fresh or returning account (see utils/sign-in.ts).
// redirect:false — we DON'T gate play behind sign-in (anonymous play is the
// free-trial hook); buying is what requires an account. It also means the module
// registers no /confirm callback route, so the sign-in return is finalized in
// pages/play.vue (see utils/auth-return.ts). For that return to arrive, the
// Supabase project's Auth → URL Configuration → Redirect URLs must allowlist the
// deployed origin's /play (e.g. https://<origin>/play); otherwise Supabase falls
// back to the Site URL and the link never reaches the handler. The client key is
// the PUBLISHABLE key (safe to ship); the service key stays server-only in the
// balance store. Placeholders keep `nuxt build` working in CI without secrets;
// the real values come from NUXT_PUBLIC_SUPABASE_URL / _KEY at runtime.
supabase: {
  url: process.env.SUPABASE_URL || "https://placeholder.supabase.co",
  key: process.env.SUPABASE_PUBLISHABLE_KEY || "sb_publishable_placeholder",
  redirect: false,
  // We don't use generated DB types (the balance store talks to Supabase with the
  // service client directly); disable the lookup so the module doesn't warn.
  types: false,
},
53 
// Global CSS imports
css: ["~/assets/css/main.css"],
56 
// Color mode (via @nuxtjs/color-mode, bundled with @nuxt/ui). classSuffix '' so the
// class on <html> is exactly `dark` / `light` — what the .dark token block and
// Tailwind's dark: variant key off. Defaulting to `system` respects the OS pref, and
// the module's inline no-flash script + localStorage persistence replace the old
// manual classList toggle (which didn't persist and could FOUC).
colorMode: {
  classSuffix: "",
  preference: "system",
  fallback: "light",
},
67 
// Runtime configuration
runtimeConfig: {
  // Private keys (only available on server-side)
  openaiApiKey: process.env.OPENAI_API_KEY,
  anthropicApiKey: process.env.ANTHROPIC_API_KEY,
  // Supabase — the run store (server-side only). Absent → in-memory dev store.
  supabaseUrl: process.env.SUPABASE_URL,
  supabaseSecretKey: process.env.SUPABASE_SECRET_KEY,
  // Stripe — run packs (server-side only). Absent → checkout returns 503.
  stripeSecretKey: process.env.STRIPE_SECRET_KEY,
  stripeWebhookSecret: process.env.STRIPE_WEBHOOK_SECRET,
  // Canonical site origin for Stripe redirect URLs (never the client Host header).
  siteUrl: process.env.EVERWHEN_BASE_URL,
  // Referral credits (issue #96) — server-side only; sane defaults, env-overridable.
  // reward: runs credited to a sharer per qualified email signup. cap: soft per-sharer
  // lifetime limit on credited referrals (<=0 disables). digest: the batched-notice
  // throttle (a kill-switch + threshold + window). See server/utils/referral.ts.
  referralReward: process.env.EVERWHEN_REFERRAL_REWARD,
  referralCap: process.env.EVERWHEN_REFERRAL_CAP,
  referralDigestEnabled: process.env.EVERWHEN_REFERRAL_DIGEST,
  referralDigestThreshold: process.env.EVERWHEN_REFERRAL_DIGEST_THRESHOLD,
  referralDigestWindowHours:
    process.env.EVERWHEN_REFERRAL_DIGEST_WINDOW_HOURS,
  // Operator allowlist for the Steward's Ledger ops dashboard (/steward) and its
  // /api/steward/* endpoints — comma-separated emails. Server-side only; empty →
  // no operators (deny-all). See server/utils/operator-auth.ts.
  operatorEmails: process.env.EVERWHEN_OPERATOR_EMAILS,
  // Public keys (exposed to client-side)
  public: {
    // Developer mode (issue #105). A dev build always has it (`import.meta.dev`);
    // this flag additionally opts a DEPLOYED staging preview in. Never set in
    // production. The server gates the fixture lane on the same env var, so the
    // client panel and the server seam agree on one source of truth.
    devMode: process.env.EVERWHEN_DEV_MODE === "true",
    // The brand's X/Twitter @handle for twitter:site / twitter:creator attribution
    // (issue #118). Unset → those two tags are simply omitted (a guessed handle would
    // mis-attribute the card to a stranger). Set EVERWHEN_TWITTER_HANDLE (e.g.
    // "@everwhen") in production to activate them.
    twitterHandle: process.env.EVERWHEN_TWITTER_HANDLE || "",
    // Sentry monitoring (client init reads this in sentry.client.config.ts). The DSN
    // is a public client identifier — safe to ship (see sentry.shared.ts). Override
    // with EVERWHEN_SENTRY_DSN per environment, or "" to disable; `environment` tags
    // events (production vs a preview) and defaults to NODE_ENV. Sentry reports only
    // from production builds, so local dev stays silent regardless.
    sentry: {
      dsn: process.env.EVERWHEN_SENTRY_DSN ?? DEFAULT_SENTRY_DSN,
      environment:
        process.env.EVERWHEN_SENTRY_ENVIRONMENT ?? process.env.NODE_ENV,
    },
  },
},
119 
// @sentry/nuxt build-time options. Source-map upload is OFF: it needs a Sentry auth
// token (a secret) plus the org/project slugs wired into CI, none of which exist yet,
// so production stack traces stay minified for now — a clean follow-up once a
// SENTRY_AUTH_TOKEN is added to the build. Server init: hosting is Vercel
// Functions, where Sentry documents that `--import` cannot be configured (the
// old Dockerfile's CMD did that), so the module injects the init into the
// server bundle itself. top-level-import is Sentry's documented Vercel mode —
// "limited server tracing": errors and native-Node spans (fetch/http, which
// covers the outbound AI/Supabase/Stripe calls) are captured, deeper
// framework/db auto-instrumentation is not. The old Docker pairing is gone,
// so this no longer risks a double-init.
sentry: {
  sourceMapsUploadOptions: { enabled: false },
⋯ 11 lines hidden (lines 133–143)133    autoInjectServerSentry: "top-level-import",
},
135 
// The standalone agents/ tooling package has its own deps + tsconfig; keep it
// out of the app's type program so `nuxt typecheck` never compiles the loops.
typescript: {
  tsConfig: {
    exclude: ["../agents"],
  },
},
143});

Platform fit: checked, not assumed

The claims below were verified against current Vercel and repo state rather than carried over from the static-site migrations, because this app is a different animal — SSR, streaming turns, payments, a native binary:

surface	verdict
streaming turn endpoints (SSE via `createEventStream`)	supported; duration includes streamed response, and Hobby fluid compute allows 300s default and max — wide margin
function memory	2 GB Hobby default vs the pod's 512 Mi limit
OG card's native `@resvg/resvg-js`	bundles within the 250 MB function limit; the route already falls back to the committed static card on rasterizer failure
Stripe webhook	URL and endpoint secret are domain-bound; the domain doesn't change, so nothing moves
env inventory	unchanged — the same production vars, set in the Vercel dashboard, never in-repo
`vercel.json`	none needed; the Nuxt preset auto-detects

Each risk surface, with its verdict.

How this was verified

The repo forbids building from submodule-worktree paths, where Nitro auto-imports silently break, so the gate runs from fresh clones on clean paths. The first gate run proved less than intended. Adversarial review noticed it had cloned before the commit existed, meaning its green results established the baseline, and only that. So the gate ran again, against the actual PR tip this time, and the build produced its own discriminating evidence: line 1 of .output/server/index.mjs reads import './sentry.server.config.mjs';. The injection is in the bundle, byte-visible. The suite passed 1458 tests there too, and CI's full check (mocked Playwright included) is green on the PR.

Runtime verification is deliberately staged in mseeks/zo#26. The Vercel deployment gets exercised on its .vercel.app URL first, including /, /play, a real streamed turn, and the OG card. DNS moves only after that passes, and the k8s namespace keeps running afterward as the instant rollback.