revert: remove client-side Sentry (#642)

docs/site-map.md

@@ -596,7 +596,6 @@ This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check`
 - `/api/local-project-id` - Local project identity guard. Source: `src/app/api/local-project-id/route.ts`.
 - `/api/medications` - Route discovered from app directory Source: `src/app/api/medications/route.ts`.
 - `/api/medications/[slug]` - Route discovered from app directory Source: `src/app/api/medications/[slug]/route.ts`.
-- `/api/monitoring` - Route discovered from app directory Source: `src/app/api/monitoring/route.ts`.
 - `/api/registry/records` - Registry record collection. Source: `src/app/api/registry/records/route.ts`.
 - `/api/registry/records/[slug]` - Registry record detail. Source: `src/app/api/registry/records/[slug]/route.ts`.
 - `/api/search` - Search endpoint. Source: `src/app/api/search/route.ts`.

next.config.ts

@@ -36,24 +36,12 @@ const nextConfig: NextConfig = {
   turbopack: {
     root: projectRoot,
   },
-  webpack(config, { webpack }) {
+  webpack(config) {
     // Avoid a Next/webpack WasmHash worker crash observed on Node 24 during local production builds.
     config.output = {
       ...config.output,
       hashFunction: "sha256",
     };
-    // Build-time flag so the browser Sentry SDK (@sentry/browser) is fully
-    // tree-shaken out unless a public DSN is set at build. Next does NOT fold an
-    // UNSET NEXT_PUBLIC_* var to a compile-time constant, so a plain
-    // `if (process.env.NEXT_PUBLIC_SENTRY_DSN)` gate leaves the dynamic import (and
-    // its chunk) on disk. This literal boolean lets webpack dead-code-eliminate the
-    // whole block, so an unconfigured build ships zero Sentry bytes. See
-    // src/instrumentation-client.ts.
-    config.plugins.push(
-      new webpack.DefinePlugin({
-        __SENTRY_ENABLED__: JSON.stringify(Boolean(process.env.NEXT_PUBLIC_SENTRY_DSN)),
-      }),
-    );
     return config;
   },
   async headers() {

package.json

@@ -141,7 +141,6 @@
   },
   "dependencies": {
     "@next/env": "16.2.10",
-    "@sentry/browser": "^10.65.0",
     "@sentry/node": "^10.65.0",
     "@supabase/ssr": "^0.12.0",
     "@supabase/supabase-js": "^2.108.2",

src/app/global-error.tsx

@@ -2,8 +2,6 @@
 
 import { useEffect } from "react";
 
-import { captureClientException } from "@/lib/observability/sentry-client";
-
 /**
  * Last-resort boundary for the App Router. Unlike `app/error.tsx`, this replaces
  * the root layout entirely, so it is the ONLY thing that can recover from an
@@ -15,8 +13,6 @@ import { captureClientException } from "@/lib/observability/sentry-client";
 export default function GlobalError({ error, reset }: { error: Error & { digest?: string }; reset: () => void }) {
   useEffect(() => {
     console.error("Fatal error captured by global-error boundary:", error);
-    // No-op unless the browser Sentry SDK was initialized (NEXT_PUBLIC_SENTRY_DSN set at build).
-    captureClientException(error);
   }, [error]);
 
   return (

src/components/route-error-boundary.tsx

@@ -4,7 +4,6 @@ import { useEffect } from "react";
 import { TriangleAlert, RefreshCw } from "lucide-react";
 
 import { cn, primaryControl } from "@/components/ui-primitives";
-import { captureClientException } from "@/lib/observability/sentry-client";
 
 export type RouteErrorBoundaryProps = {
   /** The error thrown by the segment, forwarded by Next.js. */
@@ -41,8 +40,6 @@ export function RouteErrorBoundary({
 }: RouteErrorBoundaryProps) {
   useEffect(() => {
     console.error(logLabel, error);
-    // No-op unless the browser Sentry SDK was initialized (NEXT_PUBLIC_SENTRY_DSN set at build).
-    captureClientException(error);
   }, [error, logLabel]);
 
   return (

src/instrumentation-client.ts

@@ -10,43 +10,5 @@
 // (validation stays correct, just interpreted rather than compiled). The server
 // has no CSP, so it keeps the faster JIT path — this is client-only by design.
 import { config } from "zod";
-import { registerSentryClient } from "@/lib/observability/sentry-client";
 
 config({ jitless: true });
-
-// Gated browser error tracking, the client counterpart to the server-side
-// @sentry/node capture in src/instrumentation.ts. `__SENTRY_ENABLED__` is a
-// build-time literal boolean injected by DefinePlugin (next.config.ts) — true only
-// when a public DSN is set at build. As a real compile-time constant it lets the
-// webpack production build dead-code-eliminate this whole block (and the entire
-// @sentry/browser chunk) when false, so an unconfigured build ships ZERO Sentry
-// bytes. The `typeof` guard keeps it safe under the Turbopack dev server, which
-// does not run the webpack DefinePlugin and so leaves the identifier undefined.
-// Events go through the same-origin tunnel (/api/monitoring) so the strict
-// clinical CSP (connect-src 'self' …) needs no Sentry ingest host.
-declare const __SENTRY_ENABLED__: boolean;
-
-if (typeof __SENTRY_ENABLED__ !== "undefined" && __SENTRY_ENABLED__) {
-  void (async () => {
-    const [Sentry, { scrubClientSentryEvent }] = await Promise.all([
-      import("@sentry/browser"),
-      import("@/lib/observability/sentry-scrub"),
-    ]);
-    Sentry.init({
-      dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
-      tunnel: "/api/monitoring",
-      environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT || process.env.NODE_ENV,
-      // Errors only: no performance tracing (avoids shipping navigation-timing/PII).
-      tracesSampleRate: 0,
-      sendDefaultPii: false,
-      // Same privacy boundary as the server init: strip request + breadcrumbs, and
-      // never record breadcrumbs in the first place.
-      beforeSend: scrubClientSentryEvent,
-      beforeBreadcrumb: () => null,
-    });
-    registerSentryClient(Sentry);
-  })().catch(() => {
-    // Loading/initializing the SDK is best-effort observability; a failed dynamic
-    // import (e.g. blocked chunk) must never surface as an unhandled rejection.
-  });
-}

src/lib/env.ts

@@ -24,16 +24,6 @@ const envSchema = z.object({
     (value) => (typeof value === "string" && value.trim() === "" ? undefined : value),
     z.string().url().optional(),
   ),
-  // Optional client-side (browser) Sentry error capture, the counterpart to the
-  // server SENTRY_DSN above. This public DSN is safe to expose to the browser. Fully
-  // inert when unset: the @sentry/browser SDK is tree-shaken out of the client bundle
-  // (see src/instrumentation-client.ts). Blank is normalized to undefined so an empty
-  // NEXT_PUBLIC_SENTRY_DSN="" never fails envSchema.parse at startup.
-  NEXT_PUBLIC_SENTRY_DSN: z.preprocess(
-    (value) => (typeof value === "string" && value.trim() === "" ? undefined : value),
-    z.string().url().optional(),
-  ),
-  NEXT_PUBLIC_SENTRY_ENVIRONMENT: z.string().optional(),
   NEXT_PUBLIC_LOCAL_NO_AUTH: z.enum(["true", "false"]).optional().default("false"),
   LOCAL_NO_AUTH: z.enum(["true", "false"]).optional().default("false"),
   LOCAL_NO_AUTH_OWNER_EMAIL: z.string().optional(),