fix: whitelist /robots-test in traefik public rule

Dockerfile

@@ -75,7 +75,7 @@ WORKDIR /app
 
 # Copy standalone output and static files (Monorepo paths)
 # Note: Base image already handles the non-root user and basic env
-COPY --from=builder --chown=1001:65533 /app/apps/web/public ./apps/web/public
+COPY --from=builder --chown=1001:65533 /app/apps/web/public ./public
 COPY --from=builder --chown=1001:65533 /app/apps/web/.next/standalone ./
 COPY --from=builder --chown=1001:65533 /app/apps/web/.next/static ./apps/web/.next/static
 

apps/web/next.config.mjs

@@ -46,57 +46,12 @@ const nextConfig = {
       },
     ];
   },
+  // In Standalone mode, Next.js expects the tracing root to be the monorepo root
   outputFileTracingRoot: path.join(dirname, '../../'),
 };
 
 const withMDX = createMDX({});
 
-// Execute wrappers
-let config = withPayload(withMintelConfig(withMDX(nextConfig)));
-
-/**
- * Injects our critical showcase rewrites into a resolved Next.js config object.
- */
-function injectShowcaseRewrites(resolvedConfig) {
-  const originalRewrites = resolvedConfig.rewrites;
-  
-  resolvedConfig.rewrites = async () => {
-    const existing = await originalRewrites?.() || [];
-    
-    // Normalize existing to object pattern
-    const normalized = Array.isArray(existing) 
-      ? { afterFiles: existing, beforeFiles: [], fallback: [] } 
-      : existing;
-
-    return {
-      ...normalized,
-      beforeFiles: [
-        ...(normalized.beforeFiles || []),
-        // Diagnostic rule
-        { source: '/robots-test', destination: '/robots.txt' },
-        // Showcase Assets
-        { source: '/assets/:path*', destination: '/showcase/klz-cables.com/assets/:path*' },
-        { source: '/wp-content/:path*', destination: '/showcase/klz-cables.com/assets/klz-cables.com/wp-content/:path*' },
-        { source: '/wp-includes/:path*', destination: '/showcase/klz-cables.com/assets/klz-cables.com/wp-includes/:path*' },
-        { source: '/:folder(case-studies|work|blog)/assets/:path*', destination: '/showcase/klz-cables.com/assets/:path*' },
-        { source: '/:folder(case-studies|work|blog)/wp-content/:path*', destination: '/showcase/klz-cables.com/assets/klz-cables.com/wp-content/:path*' },
-        { source: '/:folder(case-studies|work|blog)/wp-includes/:path*', destination: '/showcase/klz-cables.com/assets/klz-cables.com/wp-includes/:path*' },
-      ],
-    };
-  };
-  
-  return resolvedConfig;
-}
-
-// Handle both standard objects and functional wrappers (like withPayload)
-if (typeof config === 'function') {
-  const originalConfigWrapper = config;
-  config = async (phase, args) => {
-    const resolved = await originalConfigWrapper(phase, args);
-    return injectShowcaseRewrites(resolved);
-  };
-} else {
-  config = injectShowcaseRewrites(config);
-}
-
-export default config;
+// Clean, standard wrapper application
+// Rewrites are now handled by src/middleware.ts for maximum robustness
+export default withPayload(withMintelConfig(withMDX(nextConfig)));

apps/web/src/middleware.ts

@@ -0,0 +1,53 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+/**
+ * PRODUCTION STABILIZATION MIDDLEWARE
+ * This middleware handles legacy asset routing for the KLZ showcase,
+ * ensuring assets are correctly mapped regardless of Next.js config wrapper behavior.
+ */
+export function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+
+  // 1. Diagnostic Rewrite
+  if (pathname === '/robots-test') {
+    return NextResponse.rewrite(new URL('/robots.txt', request.url));
+  }
+
+  // 2. Legacy Showcase Asset Mapping
+  // Matches: /wp-content/*, /wp-includes/*, /assets/*, and their relative subpaths
+  const showcaseAssetPattern = /^\/(?:wp-content|wp-includes|assets|(?:case-studies|work|blog)\/(?:wp-content|wp-includes|assets))\/(.*)/;
+  const match = pathname.match(showcaseAssetPattern);
+
+  if (match) {
+    const assetPath = match[0];
+    
+    // Normalize path by stripping the case-studies/work/blog prefix if present
+    const normalizedPath = assetPath.replace(/^\/(?:case-studies|work|blog)/, '');
+    
+    // Map to the literal directory in public/
+    // Destination: /showcase/klz-cables.com/...
+    return NextResponse.rewrite(new URL(`/showcase/klz-cables.com${normalizedPath}`, request.url));
+  }
+
+  return NextResponse.next();
+}
+
+// Optimization: Only run middleware for legacy asset paths to minimize overhead
+export const config = {
+  matcher: [
+    '/robots-test',
+    '/wp-content/:path*',
+    '/wp-includes/:path*',
+    '/assets/:path*',
+    '/case-studies/wp-content/:path*',
+    '/case-studies/wp-includes/:path*',
+    '/case-studies/assets/:path*',
+    '/work/wp-content/:path*',
+    '/work/wp-includes/:path*',
+    '/work/assets/:path*',
+    '/blog/wp-content/:path*',
+    '/blog/wp-includes/:path*',
+    '/blog/assets/:path*',
+  ],
+};

docker-compose.yml

@@ -26,7 +26,7 @@ services:
       - "caddy.reverse_proxy={{upstreams 3000}}"
 
       # Public Router (Whitelist for OG Images, Sitemaps, Health)
-      - 'traefik.http.routers.${PROJECT_NAME}-public.rule=(${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}) && (PathPrefix("/health") || PathPrefix("/api/health") || PathPrefix("/sitemap.xml") || PathPrefix("/robots.txt") || PathPrefix("/manifest.webmanifest") || PathPrefix("/api/og") || PathPrefix("/assets") || PathPrefix("/wp-content") || PathPrefix("/wp-includes") || PathPrefix("/showcase") || PathRegexp(".*opengraph-image.*") || PathRegexp(".*sitemap.*"))'
+      - 'traefik.http.routers.${PROJECT_NAME}-public.rule=(${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}) && (PathPrefix("/health") || PathPrefix("/api/health") || PathPrefix("/sitemap.xml") || PathPrefix("/robots.txt") || PathPrefix("/robots-test") || PathPrefix("/manifest.webmanifest") || PathPrefix("/api/og") || PathPrefix("/assets") || PathPrefix("/wp-content") || PathPrefix("/wp-includes") || PathPrefix("/showcase") || PathRegexp(".*opengraph-image.*") || PathRegexp(".*sitemap.*"))'
       - "traefik.http.routers.${PROJECT_NAME}-public.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
       - "traefik.http.routers.${PROJECT_NAME}-public.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
       - "traefik.http.routers.${PROJECT_NAME}-public.tls=${TRAEFIK_TLS:-false}"