Fix Vercel build failure from env/auth initialization in ARIV web app

[harvatechs]

Motivation

• Prevent opaque build-time crashes caused by strict environment parsing and NextAuth initialization during Next.js page data collection.
• Defer enforcement of runtime-only values (ARIV backend URL / OAuth providers) to request execution so builds can complete without production secrets present.
• Preserve hardened security defaults (CSP/headers) while making auth init safe for deployment builds.

Description

• Made environment parsing tolerant at module import time by making AUTH_* and ARIV_API_BASE_URL optional in web/lib/env.ts and added requireArivApiBaseUrl() to enforce the URL at request time.
• Updated web/lib/ariv.ts to call the runtime guard and only require the ARIV base URL when forwarding requests.
• Reworked auth initialization in web/auth.ts to avoid throwing when no OAuth providers are configured by injecting a disabled Credentials fallback provider so NextAuth can initialize during builds.
• Cleaned framework-level issues: fixed root layout typing in web/app/layout.tsx, removed an unused import from web/middleware.ts, and retained/strengthened security headers in web/next.config.js (removed insecure wildcard serverAction origins).
• Documented the build-safe auth behavior and deployment expectations in web/README.md.

Testing

• Observed the original Vercel build failing during page-data collection with TypeError: Cannot read properties of undefined (reading 'value'), indicating import-time crashes (failed).
• Attempted cd web && npm install locally after changes but the install failed due to an external npm registry policy error (403 Forbidden for @hookform/resolvers), preventing a full local next build verification (failed).
• Verified repository changes locally via git status/git log and committed the fix (succeeded).

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ariv	Error		Feb 11, 2026 1:36pm