feat(web): migrate web frontend to Vercel + switch CI web deploy to Vercel

The Next.js web bundle exceeds Cloudflare's free Worker size limit, so the
frontend moves to Vercel (free Hobby for a non-commercial OSS demo) while the
all-Cloudflare backend (DOs/Workflows/agent loop) stays on the worker chain.
The app has zero CF runtime coupling (HTTP-only backend access), so it builds
as a standard Next.js app.

- next.config: Vercel-safe — omit output:standalone on Vercel (VERCEL env),
  dev-guarded dynamic import of the OpenNext shim (bracket-notation env access
  for noPropertyAccessFromIndexSignature).
- apps/web/package.json: packageManager pnpm@10.33.2 so Vercel uses pnpm
  (npm can't parse the workspace catalog: protocol).
- .vercelignore: exclude the legacy /cheatcode tree (special files break the CLI)
  + non-code dirs, ANCHORED to root so nested source dirs (apps/web/.../docs)
  aren't excluded. Vercel rootDirectory=apps/web; deploy from repo root so the
  whole pnpm workspace uploads.
- CI: replace the dead Cloudflare deploy-web job with deploy-web-vercel
  (vercel deploy --prod; build env lives in the Vercel project). gitignore .vercel.

Author: iamjr15

.github/workflows/deploy-workers.yml

@@ -120,31 +120,23 @@ jobs:
           workingDirectory: apps/preview-proxy
           command: deploy
 
-  deploy-web:
-    # Independent of the worker chain; self-skips until the NEXT_PUBLIC vars exist
-    # so a missing web var can never block the backend cutover.
-    needs: deploy-agent
-    if: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY != '' }}
+  deploy-web-vercel:
+    # The web app is hosted on Vercel: its Next.js bundle exceeds Cloudflare's
+    # Worker size limit, so the frontend lives on Vercel while the all-Cloudflare
+    # backend stays on the worker chain above. Independent of that chain. Build env
+    # (NEXT_PUBLIC_*, CLERK_SECRET_KEY) lives in the Vercel project, so `vercel
+    # deploy` triggers a server-side build — CI only needs the token + project ids.
+    # Self-skips until VERCEL_PROJECT_ID is configured.
+    if: ${{ vars.VERCEL_PROJECT_ID != '' && (github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main')) }}
     runs-on: ubuntu-latest
     environment: production
     steps:
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10.33.2
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      # `run deploy` (not bare `deploy`) — `pnpm deploy` is a reserved built-in
-      # that ignores the package's deploy script and errors NOTHING_TO_DEPLOY.
-      - run: pnpm --filter @cheatcode/web run deploy
+      - run: npm install -g vercel@latest
+      - run: vercel deploy --prod --yes --token="$VERCEL_TOKEN"
         env:
-          CHEATCODE_PROD_DEPLOY_APPROVED: "true"
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
-          NEXT_PUBLIC_POLAR_PRO_MONTHLY_PRODUCT_ID: ${{ vars.NEXT_PUBLIC_POLAR_PRO_MONTHLY_PRODUCT_ID }}
+          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
+          VERCEL_ORG_ID: ${{ vars.VERCEL_ORG_ID }}
+          VERCEL_PROJECT_ID: ${{ vars.VERCEL_PROJECT_ID }}

.gitignore

@@ -4,6 +4,7 @@ node_modules/
 .wrangler/
 .next/
 .open-next/
+.vercel/
 dist/
 coverage/
 .qa/

.vercelignore

@@ -0,0 +1,14 @@
+# Legacy V1 tree (not a V2 workspace member; contains special files like gunicorn.ctl).
+# Leading slash = anchored to repo root, so it does NOT match nested source dirs
+# such as apps/web/src/components/docs.
+/cheatcode/
+/docs/
+/tasks/
+/plans/
+# Build artifacts (match anywhere; Vercel installs + builds fresh)
+node_modules
+.next
+.open-next
+.wrangler
+.turbo
+*.log

apps/web/.gitignore

@@ -1,3 +1,4 @@
 
 # clerk configuration (can include secrets)
 /.clerk/
+.vercel

apps/web/next.config.ts

@@ -10,7 +10,7 @@ const nextConfig = {
   },
   // `standalone` is required by the OpenNext/Cloudflare build but conflicts with
   // Vercel's managed output, so emit it everywhere EXCEPT Vercel builds.
-  ...(process.env.VERCEL ? {} : { output: "standalone" as const }),
+  ...(process.env["VERCEL"] ? {} : { output: "standalone" as const }),
 } satisfies NextConfig;
 
 const withNextIntl = createNextIntlPlugin("./src/lib/intl/request.ts");
@@ -20,7 +20,7 @@ export default withNextIntl(nextConfig);
 // Local-dev only: wire OpenNext's Cloudflare binding shim for `next dev`. Loaded
 // via dynamic import behind a dev guard so production builds (incl. Vercel, which
 // has no @opennextjs/cloudflare and no CF runtime) never resolve it.
-if (process.env.NODE_ENV === "development") {
+if (process.env["NODE_ENV"] === "development") {
   void import("@opennextjs/cloudflare")
     .then((m) => m.initOpenNextCloudflareForDev())
     .catch(() => undefined);

apps/web/package.json

@@ -3,6 +3,7 @@
   "private": true,
   "version": "0.0.0",
   "type": "module",
+  "packageManager": "pnpm@10.33.2",
   "scripts": {
     "build": "next build --webpack && opennextjs-cloudflare build --skipNextBuild",
     "cf-typegen": "wrangler types --env-interface CloudflareEnv cloudflare-env.d.ts",