next.config.ts

import type { NextConfig } from "next";
import withSerwistInit from "@serwist/next";

/**
 * Static security headers. The dynamic, nonce-based Content-Security-Policy is set in
 * `middleware.ts` (a nonce must be generated per request). Together these target
 * securityheaders.com Grade A. `Referrer-Policy` is intentionally omitted per project
 * requirement — see CLAUDE.md §8.
 */
const securityHeaders = [
  {
    key: "Strict-Transport-Security",
    value: "max-age=63072000; includeSubDomains; preload",
  },
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "X-Frame-Options", value: "DENY" },
  { key: "X-DNS-Prefetch-Control", value: "on" },
  {
    key: "Permissions-Policy",
    value: "camera=(), microphone=(), geolocation=(), browsing-topics=(), payment=()",
  },
];

const nextConfig: NextConfig = {
  reactStrictMode: true,
  poweredByHeader: false,
  // Hide the Next.js dev-tools indicator (the floating dev-only badge). Never shipped to prod.
  devIndicators: false,
  images: {
    remotePatterns: [{ protocol: "https", hostname: "*.supabase.co" }],
  },
  async headers() {
    return [{ source: "/:path*", headers: securityHeaders }];
  },
};

const withSerwist = withSerwistInit({
  swSrc: "app/sw.ts",
  swDest: "public/sw.js",
  // Register the SW from our own bundle (components/pwa/register-sw.tsx) instead of an
  // injected inline script, so the strict nonce-based CSP isn't violated.
  register: false,
  // Serwist only builds the service worker for production; disabling in dev avoids
  // caching headaches while iterating.
  disable: process.env.NODE_ENV === "development",
});

// Serwist builds the SW through a webpack plugin. `next dev --turbopack` doesn't run
// webpack, and Next warns when a webpack config is present without a Turbopack equivalent.
// The SW is dev-disabled anyway, so we only apply the Serwist wrapper outside development
// (production `next build` uses webpack) and hand the Turbopack dev server a clean config.
export default process.env.NODE_ENV === "development"
  ? nextConfig
  : withSerwist(nextConfig);