Skip to content

Fix Next.js turbopack ENV inlining for workspace packages and browser-only files - #1136

Merged
theoephraim merged 2 commits into
mainfrom
nextjs-turbopack-client-env-inlining
Sep 28, 2026
Merged

theoephraim merged 2 commits into
mainfrom
nextjs-turbopack-client-env-inlining

Conversation

@theoephraim

@theoephraim theoephraim commented Sep 28, 2026 •

Copy link
Copy Markdown
Member

Fixes ENV values coming through as undefined in the browser with Turbopack, reported for a pnpm monorepo using one schema per package.

Two loader bugs:

  • Workspace packages outside the app dir were never transformed. The loader skipped every file outside rootContext (meant to skip symlinked varlock/env), so ENV.X in packages/* was never inlined, in dev or build. Now only node_modules and varlock's own package dirs (resolved through symlinks) are skipped. Files outside the project root get ENV inlining only, not the server init guard: its require()s resolve from the file's own location, where @varlock/nextjs-integration usually isn't installed (pnpm strict layout), and the app's own files already run it.
  • Browser-only files without 'use client' were treated as server files. Client detection only sniffed the directive, so instrumentation-client.ts (and plain modules imported from client components) got no inlining in dev, plus the server init guard injected into the browser bundle. The plugin now adds a separate browser-conditioned turbopack rule (Next 16 condition, Next 15.5 per-condition object) that flags browser compiles to the loader. Next <15.5 falls back to matching instrumentation-client.* by name.

Rule construction moved to turbopack-rules.ts so it can be unit tested. Webpack is unaffected (DefinePlugin already covered all files).

Verified in a pnpm monorepo repro (Next 16.3.6): turbopack dev and build now inline values in both the app's instrumentation-client.ts and a client-imported workspace package, and a server-imported workspace package (no integration dep) builds and serves; webpack build still works. Next.js v15/v16 framework tests pass.

The loader skipped every file outside the app dir, so ENV refs in monorepo
workspace packages were never inlined for the browser. It also only treated
'use client' files as client code, so browser-only files like
instrumentation-client.ts got undefined values in dev plus the server init
guard. Now only node_modules and varlock's own packages are skipped, and a
browser-conditioned turbopack rule marks browser-compiled files.
@github-actions

github-actions Bot commented Sep 28, 2026 •

Copy link
Copy Markdown
Contributor

bumpy-frog

The changes in this PR will be included in the next version bump.

patch Patch releases

  • @varlock/nextjs-integration 1.2.2 → 1.2.3

Bump files in this PR

Click here if you want to add another bump file to this PR


This comment is maintained by bumpy.

@pullfrog pullfrog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ No new issues found.

Reviewed changes in the Next.js integration's Turbopack loader eligibility, browser compilation detection, version-specific rule construction, and associated tests.

  • Workspace package transforms: Source outside the app root is now transformed while node_modules, the integration package, and resolved varlock package paths remain excluded.
  • Browser-targeted compilation: Browser rules flag client output without relying solely on a use client directive, with an instrumentation-client.* fallback for older Next.js versions.
  • Version-specific rules: Next 16+ uses disjoint browser and non-browser conditions, Next 15.5 uses keyed node and browser rules, and older versions retain the flat rule.
  • Regression coverage: Loader and rule tests cover browser inlining, server guard exclusion, workspace paths, dependency exclusions, versioned rule shapes, and build mode.

Pullfrog  | View workflow run | Using azure/gpt-5.6-sol | 𝕏

@pkg-pr-new

pkg-pr-new Bot commented Sep 28, 2026 •

Copy link
Copy Markdown

Open in StackBlitz

varlock

npm i https://pkg.pr.new/varlock@1136

@varlock/nextjs-integration

npm i https://pkg.pr.new/@varlock/nextjs-integration@1136

@varlock/native-helper-darwin

npm i https://pkg.pr.new/@varlock/native-helper-darwin@1136

@varlock/native-helper-linux-arm64

npm i https://pkg.pr.new/@varlock/native-helper-linux-arm64@1136

@varlock/native-helper-linux-x64

npm i https://pkg.pr.new/@varlock/native-helper-linux-x64@1136

@varlock/native-helper-win32-x64

npm i https://pkg.pr.new/@varlock/native-helper-win32-x64@1136

commit: 23d545d

Its require()s resolve from the file's location, and workspace packages
usually don't have @varlock/nextjs-integration installed (pnpm strict
layout), so server files in packages failed with Module not found.

@pullfrog pullfrog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ No new issues found.

Reviewed changes since the prior Pullfrog review, focusing on the new handling for server files outside the Next.js project root.

  • Restricted guard injection: Limited the server initialization guard to app-root files so workspace packages do not receive imports that cannot resolve under strict package layouts.
  • Preserved build inlining: Kept static ENV replacement active for server files outside the app root while leaving browser and app-root handling unchanged.
  • Added regression coverage: Verified outside-root server files omit integration imports while build-time values remain inlined.

Pullfrog  | View workflow run | Using azure/gpt-5.6-sol | 𝕏

@theoephraim
theoephraim merged commit 1b88065 into main Sep 28, 2026
28 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant