feat(web-next): custom Node server hosting Next.js + Socket.IO on port 3000

Replaces `next dev` / `next start` with a custom Node http server that
co-hosts Next.js and Socket.IO on the same port, wiring in the
RealtimeHandlerRegistry and session-cookie-based IRealtimeAuthenticator.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web-next/package.json

@@ -5,7 +5,8 @@
   "type": "module",
   "scripts": {
     "build": "echo 'Next.js build requires full environment — use pnpm dev or docker'",
-    "dev": "next dev --port 3000",
+    "dev": "tsx server.ts",
+    "start": "node --import tsx server.ts",
     "lint": "eslint .",
     "test": "vitest run --passWithNoTests",
     "test:e2e": "playwright test",
@@ -18,6 +19,7 @@
     "@repo/core-api": "workspace:*",
     "@repo/core-cms": "workspace:*",
     "@repo/core-events": "workspace:*",
+    "@repo/core-realtime": "workspace:*",
     "@repo/core-shared": "workspace:*",
     "@repo/core-trpc": "workspace:*",
     "@repo/core-ui": "workspace:*",
@@ -33,6 +35,7 @@
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "reflect-metadata": "^0.2.2",
+    "socket.io": "^4.7.0",
     "superjson": "^2.2.1"
   },
   "devDependencies": {
@@ -47,6 +50,7 @@
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "jsdom": "^25.0.0",
+    "tsx": "^4.0.0",
     "vitest": "^3.0.0"
   }
 }

apps/web-next/server.ts

@@ -0,0 +1,62 @@
+// apps/web-next/server.ts
+// SERVER-ONLY entry. Boots Next.js + Socket.IO on the same Node http server.
+import "reflect-metadata";
+import { createServer } from "node:http";
+import next from "next";
+import { Server as IOServer } from "socket.io";
+import {
+  RealtimeHandlerRegistry,
+  SocketIORealtimeBroadcaster,
+  SocketIORealtimeServer,
+  type IRealtimeAuthenticator,
+} from "@repo/core-realtime";
+import { SESSION_COOKIE } from "@repo/auth";
+import { authContainer } from "@repo/auth/di/container";
+import { AUTH_SYMBOLS } from "@repo/auth/di/symbols";
+import { bindAll } from "./src/server/bind-production.js";
+
+const dev = process.env.NODE_ENV !== "production";
+const port = Number(process.env.PORT ?? 3000);
+
+const app = next({ dev });
+const handle = app.getRequestHandler();
+
+await app.prepare();
+
+const httpServer = createServer((req, res) => handle(req, res));
+const io = new IOServer(httpServer);
+
+const broadcaster = new SocketIORealtimeBroadcaster(io);
+const registry = new RealtimeHandlerRegistry();
+
+await bindAll({ realtime: broadcaster, realtimeRegistry: registry });
+
+const authenticator: IRealtimeAuthenticator = {
+  authenticate: async ({ cookies }) => {
+    const sessionId = cookies[SESSION_COOKIE];
+    if (!sessionId) return null;
+    const authService = authContainer.get<{
+      validateSession: (id: string) => Promise<{ user: { id: string }; session: unknown } | null>;
+    }>(AUTH_SYMBOLS.IAuthenticationService);
+    const result = await authService.validateSession(sessionId);
+    return result
+      ? {
+          userId: result.user.id,
+          // Roles are not yet in the session shape; extend here when DB-backed roles ship.
+          roles: (result as unknown as { roles?: string[] }).roles ?? [],
+        }
+      : null;
+  },
+};
+
+const realtimeServer = new SocketIORealtimeServer({
+  httpServer,
+  io,
+  authenticator,
+  registry,
+});
+await realtimeServer.start();
+
+httpServer.listen(port, () => {
+  console.log(`> Ready on http://localhost:${port}`);
+});