fix(nextjs): Inject _sentrySpotlight via globalThis for reliable Spotlight auto-enablement

The valueInjectionLoader now injects both NEXT_PUBLIC_SENTRY_SPOTLIGHT and
_sentrySpotlight into globalThis. This provides a reliable fallback chain:

1. globalThis.NEXT_PUBLIC_SENTRY_SPOTLIGHT - primary (valueInjectionLoader)
2. process.env._sentrySpotlight - fallback (Next.js env config replacement)
3. globalThis._sentrySpotlight - final fallback (valueInjectionLoader)

This ensures Spotlight auto-enablement works in Next.js 15 Turbopack dev mode
where Next.js doesn't reliably replace process.env values in node_modules code.

Also adds _sentrySpotlight to the env config buildTimeVariables for build-time
replacement in production builds.

Author: cursoragent

packages/nextjs/src/client/index.ts

@@ -43,6 +43,7 @@ const globalWithInjectedValues = GLOBAL_OBJ as typeof GLOBAL_OBJ & {
   _sentryBasePath?: string;
   _sentryRelease?: string;
   _experimentalThirdPartyOriginStackFrames?: string;
+  _sentrySpotlight?: string;
   NEXT_PUBLIC_SENTRY_SPOTLIGHT?: string;
 };
 
@@ -150,11 +151,14 @@ function getDefaultIntegrations(options: BrowserOptions): Integration[] {
   // We handle this in the Next.js SDK rather than the browser SDK because the browser SDK's
   // auto-detection is development-only (stripped from production builds that users install).
   //
-  // Check both globalThis (valueInjectionLoader) and process.env (Next.js build-time replacement).
-  // globalThis is for Turbopack builds, process.env is replaced by Next.js at build time for
-  // NEXT_PUBLIC_* variables. We need both because valueInjectionLoader may not run in all scenarios.
+  // Check multiple locations for Spotlight config (in priority order):
+  // 1. globalThis.NEXT_PUBLIC_SENTRY_SPOTLIGHT - set by valueInjectionLoader
+  // 2. process.env._sentrySpotlight - set via Next.js env config (works in node_modules)
+  // 3. process.env.NEXT_PUBLIC_SENTRY_SPOTLIGHT - direct env var (may not work in node_modules in dev mode)
   const spotlightEnvValue =
-    globalWithInjectedValues.NEXT_PUBLIC_SENTRY_SPOTLIGHT ?? process.env.NEXT_PUBLIC_SENTRY_SPOTLIGHT;
+    globalWithInjectedValues.NEXT_PUBLIC_SENTRY_SPOTLIGHT ??
+    process.env._sentrySpotlight ??
+    globalWithInjectedValues._sentrySpotlight;
 
   // Parse the env var value if present (could be 'true', 'false', or a URL)
   let envSpotlight: boolean | string | undefined;

packages/nextjs/src/config/turbopack/generateValueInjectionRules.ts

@@ -38,8 +38,10 @@ export function generateValueInjectionRules({
   // Inject Spotlight config for client so the browser SDK can auto-enable Spotlight.
   // Next.js doesn't expose NEXT_PUBLIC_* vars to node_modules, so we inject it via
   // globalThis. The browser SDK's getEnvValue() checks globalThis as a fallback.
+  // We also inject _sentrySpotlight as a fallback for the Next.js SDK's client/index.ts.
   if (spotlightConfig) {
     clientValues.NEXT_PUBLIC_SENTRY_SPOTLIGHT = spotlightConfig;
+    clientValues._sentrySpotlight = spotlightConfig;
   }
 
   if (Object.keys(isomorphicValues).length > 0) {

packages/nextjs/src/config/webpack.ts

@@ -770,7 +770,9 @@ function addValueInjectionLoader({
     _sentryRouteManifest: JSON.stringify(routeManifest),
     // Inject Spotlight config so the browser SDK can auto-enable Spotlight.
     // The browser SDK's getEnvValue() checks globalThis as a fallback for bundler-injected values.
+    // We also inject _sentrySpotlight as a fallback for the Next.js SDK's client/index.ts.
     NEXT_PUBLIC_SENTRY_SPOTLIGHT: spotlightConfig,
+    _sentrySpotlight: spotlightConfig,
   };
 
   if (buildContext.isServer) {

packages/nextjs/src/config/withSentryConfig.ts

@@ -623,8 +623,13 @@ function setUpBuildTimeVariables(
     buildTimeVariables._sentryRelease = releaseName;
   }
 
-  // Note: Spotlight config (_sentrySpotlight) is injected via webpack DefinePlugin in webpack.ts
-  // because Next.js doesn't replace process.env.* in node_modules code via next.config.js env.
+  // Inject Spotlight config so the Next.js SDK can auto-enable Spotlight.
+  // We use an internal name (_sentrySpotlight) because Next.js replaces process.env.* in ALL code
+  // (including node_modules) for variables defined in the env config.
+  const spotlightConfig = userNextConfig.env?.NEXT_PUBLIC_SENTRY_SPOTLIGHT ?? process.env.NEXT_PUBLIC_SENTRY_SPOTLIGHT;
+  if (spotlightConfig) {
+    buildTimeVariables._sentrySpotlight = spotlightConfig;
+  }
 
   if (typeof userNextConfig.env === 'object') {
     userNextConfig.env = { ...buildTimeVariables, ...userNextConfig.env };