chore: split browser and server TypeScript environments in apps/web

[igboyes]

Summary

• Split apps/web type-checking into two projects: tsconfig.server.json (Node types) emits declarations for src/server, and tsconfig.app.json (DOM lib, no Node types) checks browser code and resolves @server/* to those declarations — so server source no longer enters the browser program. pnpm typecheck runs both.
• Make start.ts browser-safe (it's pulled into the client via routeTree.gen.ts): switch its relative ./server/* imports to the @server alias and replace node:crypto with the Web Crypto API.
• This is the precondition for a genuinely Node-free browser program. The upload @ts-expect-error stays for now — it stems from superagent's Node-flavored .attach types and goes away when superagent is dropped for server functions, not from this split. Documented the @server/* alias rule in AGENTS.md.

[linear-code]

VIR-2571

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• In start.ts, documentHeadersMiddleware runs on the server but now relies on btoa and crypto.getRandomValues, which are browser APIs; consider using Buffer.from(...).toString('base64') or a shared utility that works in both Node and the browser to avoid runtime failures in SSR.
• The new nonce generation logic is inlined inside documentHeadersMiddleware; extracting it into a small helper (e.g. generateNonce()) would make it easier to reuse and to swap out if the underlying random/encoding mechanism needs to change for different runtimes.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In `start.ts`, `documentHeadersMiddleware` runs on the server but now relies on `btoa` and `crypto.getRandomValues`, which are browser APIs; consider using `Buffer.from(...).toString('base64')` or a shared utility that works in both Node and the browser to avoid runtime failures in SSR.
- The new nonce generation logic is inlined inside `documentHeadersMiddleware`; extracting it into a small helper (e.g. `generateNonce()`) would make it easier to reuse and to swap out if the underlying random/encoding mechanism needs to change for different runtimes.

## Individual Comments

### Comment 1
<location path="apps/web/src/start.ts" line_range="84-85" />
<code_context>

 		const html = await response.text();
-		const nonce = randomBytes(16).toString("base64");
+		const nonce = btoa(
+			String.fromCharCode(...crypto.getRandomValues(new Uint8Array(16))),
+		);
 		const body = html.replace(/<script(?=[\s>])/g, `<script nonce="${nonce}"`);
</code_context>
<issue_to_address>
**issue (bug_risk):** Using `btoa` and `crypto.getRandomValues` here may break in non-browser server runtimes.

Because this middleware is declared with `.server(...)`, it will likely run in a server/edge runtime, not a browser. In Node, `globalThis.crypto.getRandomValues` is available, but `btoa` is not, so this will throw a `ReferenceError` at runtime. If this runs on Node, please either keep `randomBytes(16).toString("base64")` or use a Node-safe base64 approach (e.g. `Buffer.from(bytes).toString("base64")`). If you truly depend on an environment that provides both `crypto.getRandomValues` and `btoa`, ensure the build cannot be executed in plain Node where `btoa` is missing.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}