canopycms-next 0.0.67-int.89 → 0.0.67-int.90

package/dist/config.cjs

@@ -36,7 +36,187 @@ module.exports = __toCommonJS(config_exports);
 
 // src/with-canopy.ts
 var import_node_module = require("node:module");
+var import_node_path2 = __toESM(require("node:path"), 1);
+
+// src/sharp-tracing.ts
+var import_node_fs = require("node:fs");
 var import_node_path = __toESM(require("node:path"), 1);
+var LOCKFILES = ["pnpm-lock.yaml", "package-lock.json", "yarn.lock", "bun.lock", "bun.lockb"];
+var LEGACY_LOCKFILES = ["pnpm-lock.yaml", "package-lock.json", "yarn.lock", "bun.lockb"];
+var NEXT_CONFIG_FILES = ["next.config.js", "next.config.mjs", "next.config.ts", "next.config.mts"];
+var GLOB_METACHARACTERS = /[*?[\]{}(),!\\]/;
+var LIBVIPS_PACKAGE = /^@img\/sharp-libvips-/;
+var NATIVE_BINDING_PACKAGE = /^@img\/sharp-(?!libvips-)/;
+function messageOf(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  return String(err);
+}
+function isFile(candidate) {
+  try {
+    return (0, import_node_fs.statSync)(candidate).isFile();
+  } catch {
+    return false;
+  }
+}
+function isDirectory(candidate) {
+  try {
+    return (0, import_node_fs.statSync)(candidate).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function isOutside(root, target) {
+  const relative = import_node_path.default.relative(root, target);
+  return relative === ".." || relative.startsWith(`..${import_node_path.default.sep}`) || import_node_path.default.isAbsolute(relative);
+}
+function readManifest(packageDir) {
+  const parsed = JSON.parse((0, import_node_fs.readFileSync)(import_node_path.default.join(packageDir, "package.json"), "utf8"));
+  const manifest = { optionalDependencyNames: [] };
+  if (typeof parsed !== "object" || parsed === null) return manifest;
+  if ("name" in parsed && typeof parsed.name === "string") manifest.name = parsed.name;
+  if ("version" in parsed && typeof parsed.version === "string") manifest.version = parsed.version;
+  if ("optionalDependencies" in parsed && typeof parsed.optionalDependencies === "object" && parsed.optionalDependencies !== null) {
+    manifest.optionalDependencyNames = Object.keys(parsed.optionalDependencies);
+  }
+  return manifest;
+}
+function nodeModulesLookupDirs(fromDir) {
+  const dirs = [];
+  for (let dir = import_node_path.default.resolve(fromDir); ; dir = import_node_path.default.dirname(dir)) {
+    if (import_node_path.default.basename(dir) !== "node_modules") dirs.push(import_node_path.default.join(dir, "node_modules"));
+    if (import_node_path.default.dirname(dir) === dir) return dirs;
+  }
+}
+function findInstalledPackage(fromDir, name) {
+  for (const lookupDir of nodeModulesLookupDirs(fromDir)) {
+    const candidate = import_node_path.default.join(lookupDir, name);
+    if (isFile(import_node_path.default.join(candidate, "package.json"))) return (0, import_node_fs.realpathSync)(candidate);
+  }
+  return null;
+}
+function installedNextMajor(projectDir) {
+  try {
+    const nextDir = findInstalledPackage(projectDir, "next");
+    if (!nextDir) return null;
+    const major = Number.parseInt(readManifest(nextDir).version ?? "", 10);
+    return Number.isNaN(major) ? null : major;
+  } catch {
+    return null;
+  }
+}
+function hasNextConfig(dir) {
+  return NEXT_CONFIG_FILES.some((name) => isFile(import_node_path.default.join(dir, name)));
+}
+function findLockFileUpwards(startDir, names) {
+  for (let dir = startDir; ; dir = import_node_path.default.dirname(dir)) {
+    for (const name of names) {
+      const candidate = import_node_path.default.join(dir, name);
+      if (isFile(candidate)) return candidate;
+    }
+    if (import_node_path.default.dirname(dir) === dir) return null;
+  }
+}
+function resolveTracingRoot(input) {
+  const configured = input.outputFileTracingRoot || input.turbopackRoot;
+  if (configured) return import_node_path.default.resolve(input.projectDir, configured);
+  if (input.lockfileRoot === "closest") {
+    const closest = findLockFileUpwards(input.projectDir, LEGACY_LOCKFILES);
+    return closest ? import_node_path.default.dirname(closest) : input.projectDir;
+  }
+  let lockFile = findLockFileUpwards(input.projectDir, LOCKFILES);
+  if (!lockFile) return input.projectDir;
+  for (; ; ) {
+    const lockDir = import_node_path.default.dirname(lockFile);
+    const parentDir = import_node_path.default.dirname(lockDir);
+    if (parentDir === lockDir) break;
+    const outer = findLockFileUpwards(parentDir, LOCKFILES);
+    if (!outer) break;
+    lockFile = outer;
+  }
+  return import_node_path.default.dirname(lockFile);
+}
+function nativeLibraryDirsFor(sharpDir) {
+  const found = /* @__PURE__ */ new Set();
+  const collectLibvips = (fromDir, dependencyNames) => {
+    for (const name of dependencyNames.filter((n) => LIBVIPS_PACKAGE.test(n))) {
+      const dir = findInstalledPackage(fromDir, name);
+      if (dir) found.add(dir);
+    }
+  };
+  const sharpDependencies = readManifest(sharpDir).optionalDependencyNames;
+  collectLibvips(sharpDir, sharpDependencies);
+  for (const bindingName of sharpDependencies.filter((n) => NATIVE_BINDING_PACKAGE.test(n))) {
+    const bindingDir = findInstalledPackage(sharpDir, bindingName);
+    if (!bindingDir) continue;
+    const bindingDependencies = readManifest(bindingDir).optionalDependencyNames;
+    if (bindingDependencies.some((n) => LIBVIPS_PACKAGE.test(n))) {
+      collectLibvips(bindingDir, bindingDependencies);
+    } else {
+      found.add(bindingDir);
+    }
+  }
+  return [...found];
+}
+function sharpTracingIncludes(input) {
+  try {
+    const projectDir = (0, import_node_fs.realpathSync)(input.projectDir);
+    const root = (0, import_node_fs.realpathSync)(resolveTracingRoot(input));
+    if (isOutside(root, projectDir)) {
+      return {
+        includes: [],
+        problem: `the project directory ${projectDir} is outside the tracing root ${root}`
+      };
+    }
+    const sharpDirs = /* @__PURE__ */ new Set();
+    const canopycmsDir = findInstalledPackage(projectDir, "canopycms");
+    for (const candidate of [
+      canopycmsDir && findInstalledPackage(canopycmsDir, "sharp"),
+      findInstalledPackage(projectDir, "sharp")
+    ]) {
+      if (candidate && readManifest(candidate).name === "sharp") sharpDirs.add(candidate);
+    }
+    if (sharpDirs.size === 0) {
+      return {
+        includes: [],
+        problem: canopycmsDir ? `no sharp is installed for canopycms at ${canopycmsDir}` : `canopycms is not installed where ${projectDir} can find it`
+      };
+    }
+    const includes = /* @__PURE__ */ new Set();
+    const notes = [];
+    for (const sharpDir of sharpDirs) {
+      const libraryDirs = nativeLibraryDirsFor(sharpDir);
+      if (libraryDirs.length === 0) {
+        notes.push(
+          `no libvips package is installed for sharp at ${sharpDir}, and no installed native binding carries its own library`
+        );
+      }
+      for (const libraryDir of libraryDirs) {
+        const libDir = import_node_path.default.join(libraryDir, "lib");
+        if (!isDirectory(libDir)) {
+          notes.push(`${libDir} does not exist`);
+          continue;
+        }
+        if (isOutside(root, libDir)) {
+          notes.push(`${libDir} is outside the tracing root ${root}`);
+          continue;
+        }
+        const relative = import_node_path.default.relative(projectDir, libDir).split(import_node_path.default.sep).join("/");
+        if (GLOB_METACHARACTERS.test(relative)) {
+          notes.push(`${relative} contains a glob metacharacter`);
+          continue;
+        }
+        includes.add(`${relative}/**/*`);
+      }
+    }
+    if (includes.size === 0) return { includes: [], problem: notes.join("; ") };
+    return { includes: [...includes] };
+  } catch (err) {
+    return { includes: [], problem: messageOf(err) };
+  }
+}
+
+// src/with-canopy.ts
 var REQUIRED_PACKAGES = ["canopycms"];
 var OPTIONAL_PACKAGES = [
   "canopycms-next",
@@ -70,8 +250,8 @@ function withAssetsRewrite(existingRewrites) {
 function resolveReactAliases(resolve) {
   try {
     return {
-      react: import_node_path.default.dirname(resolve("react")),
-      "react-dom": import_node_path.default.dirname(resolve("react-dom"))
+      react: import_node_path2.default.dirname(resolve("react")),
+      "react-dom": import_node_path2.default.dirname(resolve("react-dom"))
     };
   } catch {
     return null;
@@ -100,8 +280,82 @@ function resolveStaticBuildId() {
   }
   return trimmed;
 }
+var ALL_ROUTES = "/**";
+function isTracingIncludes(value) {
+  return typeof value === "object" && value !== null && Object.values(value).every(
+    (globs) => Array.isArray(globs) && globs.every((g) => typeof g === "string")
+  );
+}
+function readProperty(value, key) {
+  return typeof value === "object" && value !== null ? Reflect.get(value, key) : void 0;
+}
+function stringOrUndefined(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function isSet(value) {
+  return value !== void 0 && value !== null;
+}
+function mergeTracingIncludes(existing, includes) {
+  return {
+    ...existing,
+    [ALL_ROUTES]: [.../* @__PURE__ */ new Set([...existing?.[ALL_ROUTES] ?? [], ...includes])]
+  };
+}
+function sharpTracingWarning(problem, nextVersionUnknown) {
+  return "CanopyCMS: could not add sharp's libvips to this standalone build's file tracing" + (problem ? ` (${problem})` : "") + ". Next.js file tracing can miss that library for sharp 0.35 (https://github.com/vercel/next.js/issues/97973), and the built server then fails to load sharp with ERR_DLOPEN_FAILED. Add it in next.config yourself, with paths relative to the project directory. For pnpm: outputFileTracingIncludes: { '/**': ['node_modules/.pnpm/@img+sharp-libvips-*/node_modules/@img/*/lib/**/*'] }. For npm: outputFileTracingIncludes: { '/**': ['node_modules/@img/sharp-libvips-*/lib/**/*'] }." + (nextVersionUnknown ? " The installed Next.js version could not be read either: on Next 13 or 14, put outputFileTracingIncludes under experimental." : "");
+}
+function unknownNextVersionWarning(projectDir) {
+  return `CanopyCMS: could not read the version of the next package installed for ${projectDir}, so sharp's libvips was added to the top-level outputFileTracingIncludes key, which Next 15 and later read. Next 13 and 14 ignore that key: on those versions, move the entry under experimental.outputFileTracingIncludes.`;
+}
+var warnedAboutSharpTracing = false;
+function sharpTracingConfig(nextConfig, options) {
+  if (options.staticBuild || nextConfig.output === "export") return {};
+  const projectDir = process.cwd();
+  const nextMajor = installedNextMajor(projectDir);
+  const experimental = nextConfig.experimental ?? {};
+  const experimentalOnly = nextMajor !== null && nextMajor < 15;
+  const includesUnderExperimental = experimentalOnly || isSet(readProperty(experimental, "outputFileTracingIncludes"));
+  const rootUnderExperimental = experimentalOnly || isSet(readProperty(experimental, "outputFileTracingRoot"));
+  const writtenIncludes = includesUnderExperimental ? readProperty(experimental, "outputFileTracingIncludes") : nextConfig.outputFileTracingIncludes;
+  const existing = isSet(writtenIncludes) ? writtenIncludes : void 0;
+  if (existing !== void 0 && !isTracingIncludes(existing)) return {};
+  const configuredRoot = stringOrUndefined(
+    rootUnderExperimental ? readProperty(experimental, "outputFileTracingRoot") : nextConfig.outputFileTracingRoot
+  );
+  const turbopack = nextConfig.turbopack;
+  const turbopackHasRootKey = typeof turbopack === "object" && turbopack !== null && "root" in turbopack;
+  const legacyTurbopackRoot = nextMajor === 15 && !turbopackHasRootKey ? stringOrUndefined(readProperty(readProperty(experimental, "turbo"), "root")) : void 0;
+  const turbopackRoot = experimentalOnly ? void 0 : stringOrUndefined(readProperty(turbopack, "root")) ?? legacyTurbopackRoot;
+  const { includes, problem } = hasNextConfig(projectDir) ? sharpTracingIncludes({
+    projectDir,
+    outputFileTracingRoot: configuredRoot,
+    turbopackRoot,
+    lockfileRoot: experimentalOnly ? "closest" : "outermost"
+  }) : {
+    includes: [],
+    problem: `the working directory ${projectDir} has no next.config file, so withCanopy cannot tell where the project is`
+  };
+  const nextVersionUnknown = nextMajor === null;
+  if (includes.length === 0) {
+    if (nextConfig.output === "standalone" && !warnedAboutSharpTracing) {
+      warnedAboutSharpTracing = true;
+      console.warn(sharpTracingWarning(problem, nextVersionUnknown));
+    }
+    return {};
+  }
+  const merged = mergeTracingIncludes(existing, includes);
+  if (!includesUnderExperimental) {
+    if (nextVersionUnknown && nextConfig.output === "standalone" && !warnedAboutSharpTracing) {
+      warnedAboutSharpTracing = true;
+      console.warn(unknownNextVersionWarning(projectDir));
+    }
+    return { outputFileTracingIncludes: merged };
+  }
+  const legacyExperimental = { ...experimental, outputFileTracingIncludes: merged };
+  return { experimental: legacyExperimental };
+}
 function withCanopy(nextConfig = {}, options = {}) {
-  const resolve = (0, import_node_module.createRequire)(import_node_path.default.join(process.cwd(), "noop.js")).resolve;
+  const resolve = (0, import_node_module.createRequire)(import_node_path2.default.join(process.cwd(), "noop.js")).resolve;
   const installedOptional = OPTIONAL_PACKAGES.filter((pkg) => {
     try {
       resolve(pkg);
@@ -136,6 +390,8 @@ function withCanopy(nextConfig = {}, options = {}) {
     }
     return config;
   } : existingWebpack;
+  const nextMajor = installedNextMajor(process.cwd());
+  const answerTurbopackGuard = webpack !== void 0 && !isSet(existingWebpack) && !isSet(nextConfig.turbopack) && nextMajor !== null && nextMajor >= 16;
   const pageExtensions = [
     .../* @__PURE__ */ new Set([
       ...nextConfig.pageExtensions ?? NEXTJS_DEFAULT_PAGE_EXTENSIONS,
@@ -149,9 +405,11 @@ function withCanopy(nextConfig = {}, options = {}) {
     pageExtensions,
     webpack,
     rewrites: withAssetsRewrite(nextConfig.rewrites),
+    ...sharpTracingConfig(nextConfig, options),
     // Spread conditionally: emitting `generateBuildId: undefined` would be a key Next has to
     // reason about, where absence is unambiguous.
-    ...generateBuildId ? { generateBuildId } : {}
+    ...generateBuildId ? { generateBuildId } : {},
+    ...answerTurbopackGuard ? { turbopack: {} } : {}
   };
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/config.mjs

@@ -1,6 +1,186 @@
 // src/with-canopy.ts
 import { createRequire } from "node:module";
+import path2 from "node:path";
+
+// src/sharp-tracing.ts
+import { readFileSync, realpathSync, statSync } from "node:fs";
 import path from "node:path";
+var LOCKFILES = ["pnpm-lock.yaml", "package-lock.json", "yarn.lock", "bun.lock", "bun.lockb"];
+var LEGACY_LOCKFILES = ["pnpm-lock.yaml", "package-lock.json", "yarn.lock", "bun.lockb"];
+var NEXT_CONFIG_FILES = ["next.config.js", "next.config.mjs", "next.config.ts", "next.config.mts"];
+var GLOB_METACHARACTERS = /[*?[\]{}(),!\\]/;
+var LIBVIPS_PACKAGE = /^@img\/sharp-libvips-/;
+var NATIVE_BINDING_PACKAGE = /^@img\/sharp-(?!libvips-)/;
+function messageOf(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  return String(err);
+}
+function isFile(candidate) {
+  try {
+    return statSync(candidate).isFile();
+  } catch {
+    return false;
+  }
+}
+function isDirectory(candidate) {
+  try {
+    return statSync(candidate).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function isOutside(root, target) {
+  const relative = path.relative(root, target);
+  return relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
+}
+function readManifest(packageDir) {
+  const parsed = JSON.parse(readFileSync(path.join(packageDir, "package.json"), "utf8"));
+  const manifest = { optionalDependencyNames: [] };
+  if (typeof parsed !== "object" || parsed === null) return manifest;
+  if ("name" in parsed && typeof parsed.name === "string") manifest.name = parsed.name;
+  if ("version" in parsed && typeof parsed.version === "string") manifest.version = parsed.version;
+  if ("optionalDependencies" in parsed && typeof parsed.optionalDependencies === "object" && parsed.optionalDependencies !== null) {
+    manifest.optionalDependencyNames = Object.keys(parsed.optionalDependencies);
+  }
+  return manifest;
+}
+function nodeModulesLookupDirs(fromDir) {
+  const dirs = [];
+  for (let dir = path.resolve(fromDir); ; dir = path.dirname(dir)) {
+    if (path.basename(dir) !== "node_modules") dirs.push(path.join(dir, "node_modules"));
+    if (path.dirname(dir) === dir) return dirs;
+  }
+}
+function findInstalledPackage(fromDir, name) {
+  for (const lookupDir of nodeModulesLookupDirs(fromDir)) {
+    const candidate = path.join(lookupDir, name);
+    if (isFile(path.join(candidate, "package.json"))) return realpathSync(candidate);
+  }
+  return null;
+}
+function installedNextMajor(projectDir) {
+  try {
+    const nextDir = findInstalledPackage(projectDir, "next");
+    if (!nextDir) return null;
+    const major = Number.parseInt(readManifest(nextDir).version ?? "", 10);
+    return Number.isNaN(major) ? null : major;
+  } catch {
+    return null;
+  }
+}
+function hasNextConfig(dir) {
+  return NEXT_CONFIG_FILES.some((name) => isFile(path.join(dir, name)));
+}
+function findLockFileUpwards(startDir, names) {
+  for (let dir = startDir; ; dir = path.dirname(dir)) {
+    for (const name of names) {
+      const candidate = path.join(dir, name);
+      if (isFile(candidate)) return candidate;
+    }
+    if (path.dirname(dir) === dir) return null;
+  }
+}
+function resolveTracingRoot(input) {
+  const configured = input.outputFileTracingRoot || input.turbopackRoot;
+  if (configured) return path.resolve(input.projectDir, configured);
+  if (input.lockfileRoot === "closest") {
+    const closest = findLockFileUpwards(input.projectDir, LEGACY_LOCKFILES);
+    return closest ? path.dirname(closest) : input.projectDir;
+  }
+  let lockFile = findLockFileUpwards(input.projectDir, LOCKFILES);
+  if (!lockFile) return input.projectDir;
+  for (; ; ) {
+    const lockDir = path.dirname(lockFile);
+    const parentDir = path.dirname(lockDir);
+    if (parentDir === lockDir) break;
+    const outer = findLockFileUpwards(parentDir, LOCKFILES);
+    if (!outer) break;
+    lockFile = outer;
+  }
+  return path.dirname(lockFile);
+}
+function nativeLibraryDirsFor(sharpDir) {
+  const found = /* @__PURE__ */ new Set();
+  const collectLibvips = (fromDir, dependencyNames) => {
+    for (const name of dependencyNames.filter((n) => LIBVIPS_PACKAGE.test(n))) {
+      const dir = findInstalledPackage(fromDir, name);
+      if (dir) found.add(dir);
+    }
+  };
+  const sharpDependencies = readManifest(sharpDir).optionalDependencyNames;
+  collectLibvips(sharpDir, sharpDependencies);
+  for (const bindingName of sharpDependencies.filter((n) => NATIVE_BINDING_PACKAGE.test(n))) {
+    const bindingDir = findInstalledPackage(sharpDir, bindingName);
+    if (!bindingDir) continue;
+    const bindingDependencies = readManifest(bindingDir).optionalDependencyNames;
+    if (bindingDependencies.some((n) => LIBVIPS_PACKAGE.test(n))) {
+      collectLibvips(bindingDir, bindingDependencies);
+    } else {
+      found.add(bindingDir);
+    }
+  }
+  return [...found];
+}
+function sharpTracingIncludes(input) {
+  try {
+    const projectDir = realpathSync(input.projectDir);
+    const root = realpathSync(resolveTracingRoot(input));
+    if (isOutside(root, projectDir)) {
+      return {
+        includes: [],
+        problem: `the project directory ${projectDir} is outside the tracing root ${root}`
+      };
+    }
+    const sharpDirs = /* @__PURE__ */ new Set();
+    const canopycmsDir = findInstalledPackage(projectDir, "canopycms");
+    for (const candidate of [
+      canopycmsDir && findInstalledPackage(canopycmsDir, "sharp"),
+      findInstalledPackage(projectDir, "sharp")
+    ]) {
+      if (candidate && readManifest(candidate).name === "sharp") sharpDirs.add(candidate);
+    }
+    if (sharpDirs.size === 0) {
+      return {
+        includes: [],
+        problem: canopycmsDir ? `no sharp is installed for canopycms at ${canopycmsDir}` : `canopycms is not installed where ${projectDir} can find it`
+      };
+    }
+    const includes = /* @__PURE__ */ new Set();
+    const notes = [];
+    for (const sharpDir of sharpDirs) {
+      const libraryDirs = nativeLibraryDirsFor(sharpDir);
+      if (libraryDirs.length === 0) {
+        notes.push(
+          `no libvips package is installed for sharp at ${sharpDir}, and no installed native binding carries its own library`
+        );
+      }
+      for (const libraryDir of libraryDirs) {
+        const libDir = path.join(libraryDir, "lib");
+        if (!isDirectory(libDir)) {
+          notes.push(`${libDir} does not exist`);
+          continue;
+        }
+        if (isOutside(root, libDir)) {
+          notes.push(`${libDir} is outside the tracing root ${root}`);
+          continue;
+        }
+        const relative = path.relative(projectDir, libDir).split(path.sep).join("/");
+        if (GLOB_METACHARACTERS.test(relative)) {
+          notes.push(`${relative} contains a glob metacharacter`);
+          continue;
+        }
+        includes.add(`${relative}/**/*`);
+      }
+    }
+    if (includes.size === 0) return { includes: [], problem: notes.join("; ") };
+    return { includes: [...includes] };
+  } catch (err) {
+    return { includes: [], problem: messageOf(err) };
+  }
+}
+
+// src/with-canopy.ts
 var REQUIRED_PACKAGES = ["canopycms"];
 var OPTIONAL_PACKAGES = [
   "canopycms-next",
@@ -34,8 +214,8 @@ function withAssetsRewrite(existingRewrites) {
 function resolveReactAliases(resolve) {
   try {
     return {
-      react: path.dirname(resolve("react")),
-      "react-dom": path.dirname(resolve("react-dom"))
+      react: path2.dirname(resolve("react")),
+      "react-dom": path2.dirname(resolve("react-dom"))
     };
   } catch {
     return null;
@@ -64,8 +244,82 @@ function resolveStaticBuildId() {
   }
   return trimmed;
 }
+var ALL_ROUTES = "/**";
+function isTracingIncludes(value) {
+  return typeof value === "object" && value !== null && Object.values(value).every(
+    (globs) => Array.isArray(globs) && globs.every((g) => typeof g === "string")
+  );
+}
+function readProperty(value, key) {
+  return typeof value === "object" && value !== null ? Reflect.get(value, key) : void 0;
+}
+function stringOrUndefined(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function isSet(value) {
+  return value !== void 0 && value !== null;
+}
+function mergeTracingIncludes(existing, includes) {
+  return {
+    ...existing,
+    [ALL_ROUTES]: [.../* @__PURE__ */ new Set([...existing?.[ALL_ROUTES] ?? [], ...includes])]
+  };
+}
+function sharpTracingWarning(problem, nextVersionUnknown) {
+  return "CanopyCMS: could not add sharp's libvips to this standalone build's file tracing" + (problem ? ` (${problem})` : "") + ". Next.js file tracing can miss that library for sharp 0.35 (https://github.com/vercel/next.js/issues/97973), and the built server then fails to load sharp with ERR_DLOPEN_FAILED. Add it in next.config yourself, with paths relative to the project directory. For pnpm: outputFileTracingIncludes: { '/**': ['node_modules/.pnpm/@img+sharp-libvips-*/node_modules/@img/*/lib/**/*'] }. For npm: outputFileTracingIncludes: { '/**': ['node_modules/@img/sharp-libvips-*/lib/**/*'] }." + (nextVersionUnknown ? " The installed Next.js version could not be read either: on Next 13 or 14, put outputFileTracingIncludes under experimental." : "");
+}
+function unknownNextVersionWarning(projectDir) {
+  return `CanopyCMS: could not read the version of the next package installed for ${projectDir}, so sharp's libvips was added to the top-level outputFileTracingIncludes key, which Next 15 and later read. Next 13 and 14 ignore that key: on those versions, move the entry under experimental.outputFileTracingIncludes.`;
+}
+var warnedAboutSharpTracing = false;
+function sharpTracingConfig(nextConfig, options) {
+  if (options.staticBuild || nextConfig.output === "export") return {};
+  const projectDir = process.cwd();
+  const nextMajor = installedNextMajor(projectDir);
+  const experimental = nextConfig.experimental ?? {};
+  const experimentalOnly = nextMajor !== null && nextMajor < 15;
+  const includesUnderExperimental = experimentalOnly || isSet(readProperty(experimental, "outputFileTracingIncludes"));
+  const rootUnderExperimental = experimentalOnly || isSet(readProperty(experimental, "outputFileTracingRoot"));
+  const writtenIncludes = includesUnderExperimental ? readProperty(experimental, "outputFileTracingIncludes") : nextConfig.outputFileTracingIncludes;
+  const existing = isSet(writtenIncludes) ? writtenIncludes : void 0;
+  if (existing !== void 0 && !isTracingIncludes(existing)) return {};
+  const configuredRoot = stringOrUndefined(
+    rootUnderExperimental ? readProperty(experimental, "outputFileTracingRoot") : nextConfig.outputFileTracingRoot
+  );
+  const turbopack = nextConfig.turbopack;
+  const turbopackHasRootKey = typeof turbopack === "object" && turbopack !== null && "root" in turbopack;
+  const legacyTurbopackRoot = nextMajor === 15 && !turbopackHasRootKey ? stringOrUndefined(readProperty(readProperty(experimental, "turbo"), "root")) : void 0;
+  const turbopackRoot = experimentalOnly ? void 0 : stringOrUndefined(readProperty(turbopack, "root")) ?? legacyTurbopackRoot;
+  const { includes, problem } = hasNextConfig(projectDir) ? sharpTracingIncludes({
+    projectDir,
+    outputFileTracingRoot: configuredRoot,
+    turbopackRoot,
+    lockfileRoot: experimentalOnly ? "closest" : "outermost"
+  }) : {
+    includes: [],
+    problem: `the working directory ${projectDir} has no next.config file, so withCanopy cannot tell where the project is`
+  };
+  const nextVersionUnknown = nextMajor === null;
+  if (includes.length === 0) {
+    if (nextConfig.output === "standalone" && !warnedAboutSharpTracing) {
+      warnedAboutSharpTracing = true;
+      console.warn(sharpTracingWarning(problem, nextVersionUnknown));
+    }
+    return {};
+  }
+  const merged = mergeTracingIncludes(existing, includes);
+  if (!includesUnderExperimental) {
+    if (nextVersionUnknown && nextConfig.output === "standalone" && !warnedAboutSharpTracing) {
+      warnedAboutSharpTracing = true;
+      console.warn(unknownNextVersionWarning(projectDir));
+    }
+    return { outputFileTracingIncludes: merged };
+  }
+  const legacyExperimental = { ...experimental, outputFileTracingIncludes: merged };
+  return { experimental: legacyExperimental };
+}
 function withCanopy(nextConfig = {}, options = {}) {
-  const resolve = createRequire(path.join(process.cwd(), "noop.js")).resolve;
+  const resolve = createRequire(path2.join(process.cwd(), "noop.js")).resolve;
   const installedOptional = OPTIONAL_PACKAGES.filter((pkg) => {
     try {
       resolve(pkg);
@@ -100,6 +354,8 @@ function withCanopy(nextConfig = {}, options = {}) {
     }
     return config;
   } : existingWebpack;
+  const nextMajor = installedNextMajor(process.cwd());
+  const answerTurbopackGuard = webpack !== void 0 && !isSet(existingWebpack) && !isSet(nextConfig.turbopack) && nextMajor !== null && nextMajor >= 16;
   const pageExtensions = [
     .../* @__PURE__ */ new Set([
       ...nextConfig.pageExtensions ?? NEXTJS_DEFAULT_PAGE_EXTENSIONS,
@@ -113,9 +369,11 @@ function withCanopy(nextConfig = {}, options = {}) {
     pageExtensions,
     webpack,
     rewrites: withAssetsRewrite(nextConfig.rewrites),
+    ...sharpTracingConfig(nextConfig, options),
     // Spread conditionally: emitting `generateBuildId: undefined` would be a key Next has to
     // reason about, where absence is unambiguous.
-    ...generateBuildId ? { generateBuildId } : {}
+    ...generateBuildId ? { generateBuildId } : {},
+    ...answerTurbopackGuard ? { turbopack: {} } : {}
   };
 }
 export {

package/dist/context-wrapper.js

@@ -183,10 +183,11 @@ export async function createNextCanopyContext(options) {
     //
     // No base-branch context resolution here (unlike the previous copy):
     // that call existed only to source groups.json from the (wrong) content
-    // branch. Actual content reads (buildContentTree/listEntries/read) already
-    // provision the base/active branch themselves via loadOrCreateBranchContext
-    // (see context.ts's resolveSchemaContext), so dropping it here removes a
-    // redundant per-request EFS round-trip rather than losing provisioning.
+    // branch. Actual request-time content reads (buildContentTree/listEntries/
+    // read) already provision the base/active branch themselves via
+    // loadOrCreateBranchContext (see context.ts's resolveSchemaContext; build-time
+    // reads never provision, they read the checkout), so dropping it here removes
+    // a redundant per-request EFS round-trip rather than losing provisioning.
     const extractUser = async () => {
         const headersList = await headers();
         const authResult = await authPlugin.authenticate(headersList);

package/dist/sharp-tracing.d.ts

@@ -0,0 +1,57 @@
+export interface SharpTracingInput {
+    /** The directory `next build` runs for. `withCanopy` passes `process.cwd()`. */
+    projectDir: string;
+    /** The adopter's `outputFileTracingRoot`, as written (relative values resolve like Next's). */
+    outputFileTracingRoot?: string;
+    /** The adopter's `turbopack.root`, as written. */
+    turbopackRoot?: string;
+    /**
+     * Which lockfile a root nobody configured comes from.
+     * - `'outermost'`, the default: Next 15 and 16 walk up to the outermost lockfile (`findRootDir` in
+     *   15.5.21, `findRootDirAndLockFiles` in 16.1.7, both in `next/dist/lib/find-root.js`).
+     * - `'closest'`: Next 13 and 14 stop at the nearest one. Their `findRootDir` is a different
+     *   function with the same name, called from `assignDefaults` in `server/config.ts` (14.2.25 lines
+     *   629-630, 13.5.7 lines 524-525).
+     */
+    lockfileRoot?: 'outermost' | 'closest';
+}
+export interface SharpTracingResult {
+    /** Project-relative POSIX globs, one per native-library `lib/` directory found. */
+    includes: string[];
+    /** Why nothing was found. Set exactly when `includes` is empty. */
+    problem?: string;
+}
+/**
+ * The real directory of package `name` as a bundler would find it from `fromDir`, or null.
+ *
+ * Deliberately not `require.resolve(name)`. That goes through the package's `exports` map, and two
+ * of the packages this module needs defeat it:
+ * - a `canopycms` published without a `require` condition throws ERR_PACKAGE_PATH_NOT_EXPORTED;
+ * - sharp exports no `./package.json` at all.
+ */
+export declare function findInstalledPackage(fromDir: string, name: string): string | null;
+/** The major version of the `next` installed for `projectDir`, or null if it cannot be read. */
+export declare function installedNextMajor(projectDir: string): number | null;
+/** Whether `dir` holds a config file Next would load, i.e. whether it can be Next's project dir. */
+export declare function hasNextConfig(dir: string): boolean;
+/**
+ * The tracing root Next will use (`loadConfig` in `next/dist/server/config.js`).
+ *
+ * The precedence is `outputFileTracingRoot`, then `turbopack.root`, then a lockfile's directory:
+ * - by default, as in Next 15 and 16: the outermost lockfile, found by searching upwards again from
+ *   each found lockfile's parent;
+ * - with `lockfileRoot: 'closest'`, as in Next 13 and 14: the nearest one.
+ *
+ * `SharpTracingInput.lockfileRoot` cites the Next source for each.
+ *
+ * Next resolves a relative configured root against the working directory; `withCanopy` only calls
+ * this when that directory is the project dir.
+ */
+export declare function resolveTracingRoot(input: SharpTracingInput): string;
+/**
+ * The `outputFileTracingIncludes` globs that ship sharp's libvips, or why there are none.
+ *
+ * Never throws. A failure anywhere becomes `problem`, because this runs inside the adopter's
+ * `next.config` and must not be the thing that breaks their build.
+ */
+export declare function sharpTracingIncludes(input: SharpTracingInput): SharpTracingResult;

package/dist/sharp-tracing.js

@@ -0,0 +1,347 @@
+/**
+ * Finds sharp's libvips shared library so `withCanopy` can add it to Next.js output file tracing.
+ *
+ * **The gap.** sharp loads libvips with `dlopen`, through its native binding's rpath. Nothing
+ * `require`s the library, so a tracer that follows imports never sees it. Next's JS tracer
+ * (`next/dist/compiled/@vercel/nft`) covers that with a sharp-specific handler, but the handler only
+ * fires on a path ending in `sharp/lib/index.js`, which is sharp 0.34's entry point. sharp 0.35
+ * ships `dist/index.{cjs,mjs}` instead.
+ *
+ * Measured on a Next 16.1.7 Turbopack `output: 'standalone'` build (`.claude/future-tasks/`
+ * `cms-image-build-epic.md`, "The tracer misses the `.so`"): the route traces list libvips's
+ * `package.json` and the binding's rpath symlink, but not `lib/libvips-cpp.so.*`. Every load of
+ * sharp in the resulting server then fails with ERR_DLOPEN_FAILED.
+ *
+ * A webpack build under pnpm has a different problem. On Next 15.5.21, Next's webpack externals
+ * resolution bundles sharp's JavaScript into a server chunk, so no sharp 0.35 package is traced and
+ * the bundled copy cannot reach its native binding, whether or not this include ships libvips (root
+ * cause in `.claude/future-tasks/webpack-standalone-sharp-bundled.md`). An npm install and Next
+ * 16's `next build --webpack` have not been checked. Where Next's JS tracer does trace the library
+ * itself, the include adds no duplicate: it merges traced and included files into one `Set`
+ * (`next/dist/build/collect-build-traces.js:505` in 16.1.7).
+ *
+ * Upstream: https://github.com/vercel/next.js/issues/97973 (open). On sharp's side, see
+ * https://github.com/lovell/sharp/issues/4567 and https://github.com/lovell/sharp/issues/4543.
+ * Once a Next release traces the library itself, this module and its call in `withCanopy` should go.
+ *
+ * **Finding the directory.** Packages are located by walking up the `node_modules` hierarchy, the
+ * way a bundler resolves a bare specifier, never by globbing one package manager's layout. The walk:
+ * - start from the `canopycms` the project resolves;
+ * - find that copy's `sharp`, and also any `sharp` the project resolves directly;
+ * - find each `@img/sharp-libvips-*` optional dependency, from sharp and from each installed native
+ *   binding (the binding's rpath looks for libvips beside the binding, so that is the copy it loads);
+ * - an installed binding that lists no libvips package has to carry its native library itself, so
+ *   take the binding instead (sharp 0.35.3's win32-x64 and win32-arm64 bindings list none, and ship
+ *   `libvips-42.dll` and `libvips-cpp-8.18.3.dll` in their own `lib/`);
+ * - take each package's real `lib/` directory.
+ *
+ * **Real paths, not symlinks.** The includes name real directories. Under pnpm, the binding's rpath
+ * reaches libvips through a sibling symlink whose target is that real directory, and the images
+ * this was verified on load the library from there.
+ *
+ * **What the include does NOT cover.** Under pnpm, the binding reaches the library only through its
+ * sibling symlink `.pnpm/@img+sharp-<platform>@<version>/node_modules/@img/sharp-libvips-<platform>`.
+ * (Checked with `otool` on sharp 0.35.3's darwin-arm64 binding: none of its other rpath entries
+ * resolves in a pnpm layout.) Next 16.1.7's Turbopack traces that symlink already, and the
+ * standalone copy recreates it. If a Next upgrade stops tracing it, the library is present but
+ * unreachable. Only a smoke test that loads sharp inside the built image would notice.
+ *
+ * **Cost.** Turbopack matches includes in "contains" mode (`crates/next-api/src/nft_json.rs:312` at
+ * v16.1.7), which leaves the pattern unanchored (`turbo-tasks-fs/src/globset.rs:104-114`). Its
+ * directory walk is therefore not confined to the directory an include names, and it follows
+ * symlinked directories (`read_glob.rs:87-99`). Measured on one Next 16.1.7 app's standalone build,
+ * the include added about 5 s of compile time (12.8 s to 17.9 s, mean of three runs; recorded in
+ * `.claude/future-tasks/upstream-next-sharp-tracing-recheck.md`).
+ */
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+/**
+ * The lockfiles Next 15 and later look for when inferring a root, in their order
+ * (`findRootLockFile` in `next/dist/lib/find-root.js`).
+ */
+const LOCKFILES = ['pnpm-lock.yaml', 'package-lock.json', 'yarn.lock', 'bun.lock', 'bun.lockb'];
+/**
+ * The same list in Next 14.2.25 (`lib/find-root.ts`), which predates `bun.lock`. Next 13.5.7's list
+ * also lacks `bun.lockb`. So for a Bun project on Next 13, this list can pick a wider root than
+ * Next does.
+ */
+const LEGACY_LOCKFILES = ['pnpm-lock.yaml', 'package-lock.json', 'yarn.lock', 'bun.lockb'];
+/**
+ * The config file names Next loads (`CONFIG_FILES` in `next/dist/shared/lib/constants.js`).
+ * `.mts` is Next 16's, loaded when Node supports TypeScript.
+ */
+const NEXT_CONFIG_FILES = ['next.config.js', 'next.config.mjs', 'next.config.ts', 'next.config.mts'];
+/**
+ * Characters that make a path mean something else as a glob.
+ *
+ * - Turbopack's glob parser treats `? * [ { } , \` specially (`turbo-tasks-fs/src/globset.rs:397-403`
+ *   at v16.1.7), and `]` is refused along with `[`. The comma matters because Turbopack joins a
+ *   route's includes into one `{a,b}` alternation (`crates/next-api/src/nft_json.rs:336`).
+ * - Next's JS tracer globs includes with its compiled `glob` (`collect-build-traces.js:424` in
+ *   16.1.7), whose minimatch also reads `( ) !` as extglob syntax.
+ *
+ * `@` and `+` stay allowed: pnpm directory names are full of them, and neither tracer gives them a
+ * meaning unless `(` follows.
+ */
+const GLOB_METACHARACTERS = /[*?[\]{}(),!\\]/;
+const LIBVIPS_PACKAGE = /^@img\/sharp-libvips-/;
+const NATIVE_BINDING_PACKAGE = /^@img\/sharp-(?!libvips-)/;
+/**
+ * `getErrorMessage` from `canopycms/utils/error`, restated.
+ *
+ * This module is bundled into `dist/config.*`, which esbuild builds with `--packages=external`. An
+ * import of that subpath would stay a runtime import inside the adopter's `next.config`, and in this
+ * workspace that subpath resolves to raw TypeScript. ARCHITECTURE.md explains why this entrypoint
+ * must be plain JavaScript all the way down ("Why the `./config` export ships pre-built").
+ */
+function messageOf(err) {
+    if (err instanceof Error)
+        return err.message;
+    if (typeof err === 'string')
+        return err;
+    return String(err);
+}
+/**
+ * Whether `candidate` is a regular file.
+ *
+ * Any failed stat answers false instead of throwing: a missing path, a race with a delete, or a
+ * permission error. `hasNextConfig` calls this outside any `try`, and it runs inside the adopter's
+ * `next.config`.
+ */
+function isFile(candidate) {
+    try {
+        return statSync(candidate).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether `candidate` is a directory, answering false on any failed stat, as `isFile` does. */
+function isDirectory(candidate) {
+    try {
+        return statSync(candidate).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/** True when `target` is not `root` itself or somewhere beneath it. */
+function isOutside(root, target) {
+    const relative = path.relative(root, target);
+    return relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
+}
+function readManifest(packageDir) {
+    const parsed = JSON.parse(readFileSync(path.join(packageDir, 'package.json'), 'utf8'));
+    const manifest = { optionalDependencyNames: [] };
+    if (typeof parsed !== 'object' || parsed === null)
+        return manifest;
+    if ('name' in parsed && typeof parsed.name === 'string')
+        manifest.name = parsed.name;
+    if ('version' in parsed && typeof parsed.version === 'string')
+        manifest.version = parsed.version;
+    if ('optionalDependencies' in parsed &&
+        typeof parsed.optionalDependencies === 'object' &&
+        parsed.optionalDependencies !== null) {
+        manifest.optionalDependencyNames = Object.keys(parsed.optionalDependencies);
+    }
+    return manifest;
+}
+/**
+ * The `node_modules` directories a bare specifier is looked up in from `fromDir`, nearest first.
+ *
+ * This is only the hierarchy half of Node's lookup (`Module._nodeModulePaths`), on purpose.
+ * `require.resolve.paths` also appends Node's global folders (`~/.node_modules`,
+ * `~/.node_libraries`, the install prefix's `lib/node`, and `NODE_PATH`), which bundlers do not
+ * search. pnpm's bin shims add more: running vitest through `node_modules/.bin`, `NODE_PATH` also
+ * holds vitest's store directories and the repo's hoisted `node_modules/.pnpm/node_modules`. A
+ * package found that way is not one the build resolves.
+ */
+function nodeModulesLookupDirs(fromDir) {
+    const dirs = [];
+    for (let dir = path.resolve(fromDir);; dir = path.dirname(dir)) {
+        if (path.basename(dir) !== 'node_modules')
+            dirs.push(path.join(dir, 'node_modules'));
+        if (path.dirname(dir) === dir)
+            return dirs;
+    }
+}
+/**
+ * The real directory of package `name` as a bundler would find it from `fromDir`, or null.
+ *
+ * Deliberately not `require.resolve(name)`. That goes through the package's `exports` map, and two
+ * of the packages this module needs defeat it:
+ * - a `canopycms` published without a `require` condition throws ERR_PACKAGE_PATH_NOT_EXPORTED;
+ * - sharp exports no `./package.json` at all.
+ */
+export function findInstalledPackage(fromDir, name) {
+    for (const lookupDir of nodeModulesLookupDirs(fromDir)) {
+        const candidate = path.join(lookupDir, name);
+        if (isFile(path.join(candidate, 'package.json')))
+            return realpathSync(candidate);
+    }
+    return null;
+}
+/** The major version of the `next` installed for `projectDir`, or null if it cannot be read. */
+export function installedNextMajor(projectDir) {
+    try {
+        const nextDir = findInstalledPackage(projectDir, 'next');
+        if (!nextDir)
+            return null;
+        const major = Number.parseInt(readManifest(nextDir).version ?? '', 10);
+        return Number.isNaN(major) ? null : major;
+    }
+    catch {
+        return null;
+    }
+}
+/** Whether `dir` holds a config file Next would load, i.e. whether it can be Next's project dir. */
+export function hasNextConfig(dir) {
+    return NEXT_CONFIG_FILES.some((name) => isFile(path.join(dir, name)));
+}
+function findLockFileUpwards(startDir, names) {
+    for (let dir = startDir;; dir = path.dirname(dir)) {
+        for (const name of names) {
+            const candidate = path.join(dir, name);
+            if (isFile(candidate))
+                return candidate;
+        }
+        if (path.dirname(dir) === dir)
+            return null;
+    }
+}
+/**
+ * The tracing root Next will use (`loadConfig` in `next/dist/server/config.js`).
+ *
+ * The precedence is `outputFileTracingRoot`, then `turbopack.root`, then a lockfile's directory:
+ * - by default, as in Next 15 and 16: the outermost lockfile, found by searching upwards again from
+ *   each found lockfile's parent;
+ * - with `lockfileRoot: 'closest'`, as in Next 13 and 14: the nearest one.
+ *
+ * `SharpTracingInput.lockfileRoot` cites the Next source for each.
+ *
+ * Next resolves a relative configured root against the working directory; `withCanopy` only calls
+ * this when that directory is the project dir.
+ */
+export function resolveTracingRoot(input) {
+    const configured = input.outputFileTracingRoot || input.turbopackRoot;
+    if (configured)
+        return path.resolve(input.projectDir, configured);
+    if (input.lockfileRoot === 'closest') {
+        const closest = findLockFileUpwards(input.projectDir, LEGACY_LOCKFILES);
+        return closest ? path.dirname(closest) : input.projectDir;
+    }
+    let lockFile = findLockFileUpwards(input.projectDir, LOCKFILES);
+    if (!lockFile)
+        return input.projectDir;
+    for (;;) {
+        const lockDir = path.dirname(lockFile);
+        const parentDir = path.dirname(lockDir);
+        if (parentDir === lockDir)
+            break;
+        const outer = findLockFileUpwards(parentDir, LOCKFILES);
+        if (!outer)
+            break;
+        lockFile = outer;
+    }
+    return path.dirname(lockFile);
+}
+/**
+ * Every installed package directory, reachable from one copy of sharp, whose `lib/` holds sharp's
+ * native library.
+ *
+ * That is each `@img/sharp-libvips-*` package, plus any installed native binding that lists no
+ * libvips package and so has to carry the library itself.
+ */
+function nativeLibraryDirsFor(sharpDir) {
+    const found = new Set();
+    const collectLibvips = (fromDir, dependencyNames) => {
+        for (const name of dependencyNames.filter((n) => LIBVIPS_PACKAGE.test(n))) {
+            const dir = findInstalledPackage(fromDir, name);
+            if (dir)
+                found.add(dir);
+        }
+    };
+    const sharpDependencies = readManifest(sharpDir).optionalDependencyNames;
+    collectLibvips(sharpDir, sharpDependencies);
+    for (const bindingName of sharpDependencies.filter((n) => NATIVE_BINDING_PACKAGE.test(n))) {
+        const bindingDir = findInstalledPackage(sharpDir, bindingName);
+        if (!bindingDir)
+            continue;
+        const bindingDependencies = readManifest(bindingDir).optionalDependencyNames;
+        if (bindingDependencies.some((n) => LIBVIPS_PACKAGE.test(n))) {
+            collectLibvips(bindingDir, bindingDependencies);
+        }
+        else {
+            found.add(bindingDir);
+        }
+    }
+    return [...found];
+}
+/**
+ * The `outputFileTracingIncludes` globs that ship sharp's libvips, or why there are none.
+ *
+ * Never throws. A failure anywhere becomes `problem`, because this runs inside the adopter's
+ * `next.config` and must not be the thing that breaks their build.
+ */
+export function sharpTracingIncludes(input) {
+    try {
+        const projectDir = realpathSync(input.projectDir);
+        const root = realpathSync(resolveTracingRoot(input));
+        if (isOutside(root, projectDir)) {
+            return {
+                includes: [],
+                problem: `the project directory ${projectDir} is outside the tracing root ${root}`,
+            };
+        }
+        const sharpDirs = new Set();
+        const canopycmsDir = findInstalledPackage(projectDir, 'canopycms');
+        for (const candidate of [
+            canopycmsDir && findInstalledPackage(canopycmsDir, 'sharp'),
+            findInstalledPackage(projectDir, 'sharp'),
+        ]) {
+            if (candidate && readManifest(candidate).name === 'sharp')
+                sharpDirs.add(candidate);
+        }
+        if (sharpDirs.size === 0) {
+            return {
+                includes: [],
+                problem: canopycmsDir
+                    ? `no sharp is installed for canopycms at ${canopycmsDir}`
+                    : `canopycms is not installed where ${projectDir} can find it`,
+            };
+        }
+        const includes = new Set();
+        const notes = [];
+        for (const sharpDir of sharpDirs) {
+            const libraryDirs = nativeLibraryDirsFor(sharpDir);
+            if (libraryDirs.length === 0) {
+                notes.push(`no libvips package is installed for sharp at ${sharpDir}, and no installed native binding carries its own library`);
+            }
+            for (const libraryDir of libraryDirs) {
+                const libDir = path.join(libraryDir, 'lib');
+                if (!isDirectory(libDir)) {
+                    notes.push(`${libDir} does not exist`);
+                    continue;
+                }
+                // Turbopack fails the whole build, not just this include, on a glob that climbs out of
+                // the tracing root.
+                if (isOutside(root, libDir)) {
+                    notes.push(`${libDir} is outside the tracing root ${root}`);
+                    continue;
+                }
+                const relative = path.relative(projectDir, libDir).split(path.sep).join('/');
+                if (GLOB_METACHARACTERS.test(relative)) {
+                    notes.push(`${relative} contains a glob metacharacter`);
+                    continue;
+                }
+                includes.add(`${relative}/**/*`);
+            }
+        }
+        if (includes.size === 0)
+            return { includes: [], problem: notes.join('; ') };
+        return { includes: [...includes] };
+    }
+    catch (err) {
+        return { includes: [], problem: messageOf(err) };
+    }
+}

package/dist/with-canopy.d.ts

@@ -39,6 +39,20 @@ export interface WithCanopyOptions {
  * - With `staticBuild: true`, honors `CANOPY_BUILD_ID` as Next's build id (Next's default is
  *   random, which puts two builds of one source tree in different `_next/static/` directories).
  *   Unset, or on a non-static build, Next's default is used unchanged.
+ * - Outside a static export, adds sharp's libvips directory to `outputFileTracingIncludes['/**']`,
+ *   so a Turbopack `output: 'standalone'` server can load sharp. Next's file tracing can miss that
+ *   library for sharp 0.35. This does not fix a webpack build: under pnpm, Next 15.5.21 bundles
+ *   sharp into a server chunk that cannot load its native binding.
+ *   - The key follows your Next version (under `experimental` on 13 and 14) and any legacy
+ *     `experimental` spelling you already use.
+ *   - Your own includes are kept.
+ *   - A standalone build warns if the directory cannot be found, or if the Next version cannot be
+ *     read and the entry went under the top-level key.
+ * - On Next 16 and later, sets `turbopack: {}` when your config has neither `turbopack` nor
+ *   `webpack` and the installed Next version can be read (an unreadable version gets no key).
+ *   Next 16 builds and runs `next dev` with Turbopack by default, and exits when the
+ *   config has a `webpack` function (the React aliases above add one) but no `turbopack` config.
+ *   A `turbopack` you already set, `turbopack: {}` included, is kept as it is.
  *
  * **When you need this:**
  * - Always recommended — it replaces manual `transpilePackages` configuration

package/dist/with-canopy.js

@@ -1,5 +1,6 @@
 import { createRequire } from 'node:module';
 import path from 'node:path';
+import { hasNextConfig, installedNextMajor, sharpTracingIncludes } from './sharp-tracing.js';
 /** The core package — always required when using withCanopy. */
 const REQUIRED_PACKAGES = ['canopycms'];
 /**
@@ -160,6 +161,166 @@ function resolveStaticBuildId() {
     }
     return trimmed;
 }
+/**
+ * Every route. Both tracers match include keys as a "contains" glob against the route:
+ * - Turbopack against "/" plus the page name (`crates/next-api/src/nft_json.rs` lines 56 and 312 at
+ *   v16.1.7);
+ * - the JS tracer through picomatch with `contains: true` (`next/dist/build/collect-build-traces.js`
+ *   lines 464 and 475 in 16.1.7).
+ */
+const ALL_ROUTES = '/**';
+function isTracingIncludes(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        Object.values(value).every((globs) => Array.isArray(globs) && globs.every((g) => typeof g === 'string')));
+}
+/** `value[key]` for any object, else undefined: for config keys Next's types no longer declare. */
+function readProperty(value, key) {
+    return typeof value === 'object' && value !== null ? Reflect.get(value, key) : undefined;
+}
+function stringOrUndefined(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+/**
+ * Whether Next treats a config value as set.
+ *
+ * `assignDefaults` in `next/dist/server/config.js` (`assignDefaultsAndValidate` in 16.1.7) drops
+ * `undefined` and `null` values before it migrates legacy keys. That covers top-level keys and, for
+ * object options such as `experimental`, their direct keys. It does not cover Next 15's
+ * `experimental.turbo` merge, which runs on the raw config earlier.
+ */
+function isSet(value) {
+    return value !== undefined && value !== null;
+}
+/** `includes` added under `'/**'`, deduped. Every entry the adopter already wrote is kept as written. */
+function mergeTracingIncludes(existing, includes) {
+    return {
+        ...existing,
+        [ALL_ROUTES]: [...new Set([...(existing?.[ALL_ROUTES] ?? []), ...includes])],
+    };
+}
+function sharpTracingWarning(problem, nextVersionUnknown) {
+    return ("CanopyCMS: could not add sharp's libvips to this standalone build's file tracing" +
+        (problem ? ` (${problem})` : '') +
+        '. Next.js file tracing can miss that library for sharp 0.35 ' +
+        '(https://github.com/vercel/next.js/issues/97973), and the built server then fails to load ' +
+        'sharp with ERR_DLOPEN_FAILED. Add it in next.config yourself, with paths relative to the ' +
+        "project directory. For pnpm: outputFileTracingIncludes: { '/**': " +
+        "['node_modules/.pnpm/@img+sharp-libvips-*/node_modules/@img/*/lib/**/*'] }. For npm: " +
+        "outputFileTracingIncludes: { '/**': ['node_modules/@img/sharp-libvips-*/lib/**/*'] }." +
+        (nextVersionUnknown
+            ? ' The installed Next.js version could not be read either: on Next 13 or 14, put ' +
+                'outputFileTracingIncludes under experimental.'
+            : ''));
+}
+/**
+ * The warning for an include that WAS written, under a key chosen without knowing the Next version.
+ *
+ * That choice is always the top-level key. Next 13 and 14 ignore it, because their config schema
+ * declares the option only under `experimental` (`server/config-schema.ts` line 311 in 14.2.25).
+ */
+function unknownNextVersionWarning(projectDir) {
+    return (`CanopyCMS: could not read the version of the next package installed for ${projectDir}, so ` +
+        "sharp's libvips was added to the top-level outputFileTracingIncludes key, which Next 15 and " +
+        'later read. Next 13 and 14 ignore that key: on those versions, move the entry under ' +
+        'experimental.outputFileTracingIncludes.');
+}
+/**
+ * Whether the warning has fired in this module instance.
+ *
+ * A Turbopack build evaluates the config in the main process and again in a worker thread with its
+ * own module registry (`next/dist/build/turbopack-build/index.js:26` and `impl.js:209` in 16.1.7).
+ * So "once" means once per process or thread, not once per build.
+ */
+let warnedAboutSharpTracing = false;
+/**
+ * The config keys that make a Turbopack `output: 'standalone'` server able to load sharp.
+ *
+ * The rules live in `./sharp-tracing`. This function decides only whether to apply them, and under
+ * which key.
+ */
+function sharpTracingConfig(nextConfig, options) {
+    // A static export has no server, so there is nothing to trace for.
+    if (options.staticBuild || nextConfig.output === 'export')
+        return {};
+    const projectDir = process.cwd();
+    const nextMajor = installedNextMajor(projectDir);
+    // May not be an object in an untyped config (`experimental: true` loads fine in Next), which is why
+    // every read of it below goes through `readProperty`, never an `in` check.
+    const experimental = nextConfig.experimental ?? {};
+    // Read and write each option where Next reads it (`loadConfig` in `next/dist/server/config.js`).
+    // A legacy `experimental` value of `undefined` or `null` counts as unset, because Next drops those
+    // before migrating legacy keys (see `isSet`).
+    // - Next 13 and 14 read the tracing options only under `experimental`.
+    //   - A top-level key is reported as an invalid option and ignored. Their config schema is a
+    //     strict object, and only `images` errors stop the build (`server/config.ts:84-90` in 14.2.25).
+    //   - A root nobody configured comes from the CLOSEST lockfile there (`findRootDir`, called from
+    //     `assignDefaults`), not the outermost.
+    // - Next 15 and 16 still accept the `experimental` spellings, and copy any that is set over the
+    //   top-level key (`warnOptionHasBeenMovedOutOfExperimental`, `config.js:542-544` in 16.1.7 and
+    //   `:546-548` in 15.5.21). So a legacy value wins, and an include written only at the top level
+    //   would be silently replaced.
+    // - Only Next 15 merges `experimental.turbo` into `turbopack`, as `{ ...turbo, ...turbopack }`
+    //   (`config.js:1190` in 15.5.21). Any `root` key on `turbopack` therefore wins, even an empty one.
+    const experimentalOnly = nextMajor !== null && nextMajor < 15;
+    const includesUnderExperimental = experimentalOnly || isSet(readProperty(experimental, 'outputFileTracingIncludes'));
+    const rootUnderExperimental = experimentalOnly || isSet(readProperty(experimental, 'outputFileTracingRoot'));
+    const writtenIncludes = includesUnderExperimental
+        ? readProperty(experimental, 'outputFileTracingIncludes')
+        : nextConfig.outputFileTracingIncludes;
+    const existing = isSet(writtenIncludes) ? writtenIncludes : undefined;
+    // A malformed value is Next's to reject. Merging into it could only turn that into a crash here.
+    if (existing !== undefined && !isTracingIncludes(existing))
+        return {};
+    const configuredRoot = stringOrUndefined(rootUnderExperimental
+        ? readProperty(experimental, 'outputFileTracingRoot')
+        : nextConfig.outputFileTracingRoot);
+    const turbopack = nextConfig.turbopack;
+    const turbopackHasRootKey = typeof turbopack === 'object' && turbopack !== null && 'root' in turbopack;
+    const legacyTurbopackRoot = nextMajor === 15 && !turbopackHasRootKey
+        ? stringOrUndefined(readProperty(readProperty(experimental, 'turbo'), 'root'))
+        : undefined;
+    const turbopackRoot = experimentalOnly
+        ? undefined
+        : (stringOrUndefined(readProperty(turbopack, 'root')) ?? legacyTurbopackRoot);
+    // Next never changes directory for `next build <dir>`: in 16.1.7 its only `process.chdir` is in
+    // the generated standalone `server.js` (`next/dist/build/utils.js:1111`). So a working directory
+    // with no config file in it is not the project, and any glob computed relative to it would be
+    // wrong.
+    const { includes, problem } = hasNextConfig(projectDir)
+        ? sharpTracingIncludes({
+            projectDir,
+            outputFileTracingRoot: configuredRoot,
+            turbopackRoot,
+            lockfileRoot: experimentalOnly ? 'closest' : 'outermost',
+        })
+        : {
+            includes: [],
+            problem: `the working directory ${projectDir} has no next.config file, so withCanopy cannot tell where the project is`,
+        };
+    const nextVersionUnknown = nextMajor === null;
+    if (includes.length === 0) {
+        if (nextConfig.output === 'standalone' && !warnedAboutSharpTracing) {
+            warnedAboutSharpTracing = true;
+            console.warn(sharpTracingWarning(problem, nextVersionUnknown));
+        }
+        return {};
+    }
+    const merged = mergeTracingIncludes(existing, includes);
+    if (!includesUnderExperimental) {
+        // An unreadable version falls back to the key Next 15 and later read. A standalone build says
+        // so: Next 13 and 14 ignore that key, so libvips would not be traced.
+        if (nextVersionUnknown && nextConfig.output === 'standalone' && !warnedAboutSharpTracing) {
+            warnedAboutSharpTracing = true;
+            console.warn(unknownNextVersionWarning(projectDir));
+        }
+        return { outputFileTracingIncludes: merged };
+    }
+    // Built as a variable, not returned as a literal, because Next 15's `ExperimentalConfig` type no
+    // longer declares this key.
+    const legacyExperimental = { ...experimental, outputFileTracingIncludes: merged };
+    return { experimental: legacyExperimental };
+}
 /**
  * Wrap your Next.js config to set up module transpilation and React
  * resolution for CanopyCMS packages.
@@ -177,6 +338,20 @@ function resolveStaticBuildId() {
  * - With `staticBuild: true`, honors `CANOPY_BUILD_ID` as Next's build id (Next's default is
  *   random, which puts two builds of one source tree in different `_next/static/` directories).
  *   Unset, or on a non-static build, Next's default is used unchanged.
+ * - Outside a static export, adds sharp's libvips directory to `outputFileTracingIncludes['/**']`,
+ *   so a Turbopack `output: 'standalone'` server can load sharp. Next's file tracing can miss that
+ *   library for sharp 0.35. This does not fix a webpack build: under pnpm, Next 15.5.21 bundles
+ *   sharp into a server chunk that cannot load its native binding.
+ *   - The key follows your Next version (under `experimental` on 13 and 14) and any legacy
+ *     `experimental` spelling you already use.
+ *   - Your own includes are kept.
+ *   - A standalone build warns if the directory cannot be found, or if the Next version cannot be
+ *     read and the entry went under the top-level key.
+ * - On Next 16 and later, sets `turbopack: {}` when your config has neither `turbopack` nor
+ *   `webpack` and the installed Next version can be read (an unreadable version gets no key).
+ *   Next 16 builds and runs `next dev` with Turbopack by default, and exits when the
+ *   config has a `webpack` function (the React aliases above add one) but no `turbopack` config.
+ *   A `turbopack` you already set, `turbopack: {}` included, is kept as it is.
  *
  * **When you need this:**
  * - Always recommended — it replaces manual `transpilePackages` configuration
@@ -251,6 +426,31 @@ export function withCanopy(nextConfig = {}, options = {}) {
     // Until Turbopack supports absolute path aliases, consumers using
     // file: symlinks must use `next dev --webpack` for local development.
     // Turbopack works fine when canopycms is installed from npm (no symlinks).
+    // Next 16 defaults both `next build` and `next dev` to Turbopack, marking the default with
+    // `TURBOPACK=auto` (`next/dist/lib/bundler.js:76`), and then exits with "This build is using
+    // Turbopack, with a `webpack` config and no `turbopack` config" whenever the exported config's
+    // `webpack` is truthy, its `turbopack` is not, and it has no `experimental.turbo*` key
+    // (`validateTurboNextConfig` in `next/dist/lib/turbopack-warning.js:137-138` and `:158-174`,
+    // 16.1.7).
+    //
+    // The `webpack` function above is withCanopy's own, and Turbopack never runs a `webpack`
+    // function, so its React aliases never applied under Turbopack. That is why the NOTE above sends
+    // `file:` symlink installs to `next dev --webpack`, and why answering the guard with an empty
+    // `turbopack` object is safe for this function. The rules:
+    // - Only when withCanopy added that function and the adopter wrote no `webpack` of their own.
+    //   For theirs, Next's guard is the right one.
+    // - Never over a `turbopack` the adopter set, so a config that already has `turbopack: {}` keeps
+    //   its own value.
+    // - Only on a detected Next 16 or later. Next 15 only warns here (`turbopack-warning.js:172-175`,
+    //   15.5.21), and Next 13 and 14 report an unknown top-level `turbopack` as an invalid option
+    //   (their config schema is a strict object with no such key), so an unreadable version gets no
+    //   key.
+    const nextMajor = installedNextMajor(process.cwd());
+    const answerTurbopackGuard = webpack !== undefined &&
+        !isSet(existingWebpack) &&
+        !isSet(nextConfig.turbopack) &&
+        nextMajor !== null &&
+        nextMajor >= 16;
     // Dual-build support: a static build gets STATIC_PAGE_EXTENSIONS (e.g. `page.static.tsx`)
     // instead of CMS_PAGE_EXTENSIONS, so CMS-only files (`route.server.ts`, `page.server.tsx`)
     // are excluded from static export while the static-only page variants are included.
@@ -285,8 +485,10 @@ export function withCanopy(nextConfig = {}, options = {}) {
         pageExtensions,
         webpack,
         rewrites: withAssetsRewrite(nextConfig.rewrites),
+        ...sharpTracingConfig(nextConfig, options),
         // Spread conditionally: emitting `generateBuildId: undefined` would be a key Next has to
         // reason about, where absence is unambiguous.
         ...(generateBuildId ? { generateBuildId } : {}),
+        ...(answerTurbopackGuard ? { turbopack: {} } : {}),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canopycms-next",
-  "version": "0.0.67-int.89",
+  "version": "0.0.67-int.90",
   "description": "Next.js adapter for CanopyCMS",
   "license": "MIT",
   "repository": {
@@ -38,7 +38,7 @@
   "peerDependencies": {
     "next": "^13.5.7 || ^14.2.25 || ^15.5.21 || >=16.0.0 <16.2.0 || >=16.3.0 <17.0.0",
     "react": "^18.0.0 || ^19.0.0",
-    "canopycms": "0.0.67-int.89"
+    "canopycms": "0.0.67-int.90"
   },
   "devDependencies": {
     "@types/node": "^22.9.0",
@@ -48,7 +48,7 @@
     "react": "^18.3.1",
     "typescript": "^5.6.3",
     "vitest": "^4.1.0",
-    "canopycms": "0.0.67-int.89"
+    "canopycms": "0.0.67-int.90"
   },
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json && node ../../scripts/add-js-extensions.mjs dist && esbuild src/config.ts --bundle --platform=node --packages=external --external:next --format=cjs --outfile=dist/config.cjs && esbuild src/config.ts --bundle --platform=node --packages=external --external:next --format=esm --outfile=dist/config.mjs",