next.config.ts

import withBundleAnalyzer from "@next/bundle-analyzer";
import type { NextConfig } from "next";

const isProduction = process.env.NODE_ENV === "production";

const baselineSecurityHeaders = [
  { key: "Permissions-Policy", value: "camera=(), geolocation=(), microphone=()" },
  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "X-Frame-Options", value: "DENY" },
  ...(isProduction
    ? [
        {
          key: "Strict-Transport-Security",
          value: "max-age=63072000; includeSubDomains; preload",
        },
      ]
    : []),
] satisfies Array<{ key: string; value: string }>;

const sensitiveNoStoreHeaders = [
  { key: "Cache-Control", value: "private, no-store, max-age=0" },
  { key: "Referrer-Policy", value: "no-referrer" },
  { key: "X-Robots-Tag", value: "noindex, nofollow, noarchive" },
] satisfies Array<{ key: string; value: string }>;

// Authenticated app shell (dashboard, businesses hub, business-scoped pages).
// These URLs are user-private but do NOT carry tokens in the path, so we allow
// the Next.js router cache to prefetch RSC payloads. `private, max-age=0`
// keeps shared caches (CDNs, proxies) out while letting the browser / router
// cache serve instant navigations. Without this relaxation the router cannot
// honor `experimental.staleTimes` and every navigation re-fetches from origin.
const authenticatedAppShellHeaders = [
  { key: "Cache-Control", value: "private, max-age=0, must-revalidate" },
  { key: "Referrer-Policy", value: "no-referrer" },
  { key: "X-Robots-Tag", value: "noindex, nofollow, noarchive" },
] satisfies Array<{ key: string; value: string }>;

const apiNoIndexHeaders = [
  { key: "Cache-Control", value: "private, no-store, max-age=0" },
  { key: "X-Robots-Tag", value: "noindex, nofollow, noarchive" },
] satisfies Array<{ key: string; value: string }>;

const agentDiscoveryHeaders = [
  {
    key: "Link",
    value:
      '</.well-known/api-catalog>; rel="api-catalog", </.well-known/agent-skills/index.json>; rel="agent-skills", </.well-known/mcp/server-card.json>; rel="mcp-server-card"',
  },
] satisfies Array<{ key: string; value: string }>;

const nextConfig: NextConfig = {
  // Skip type-checking during `next build` — types are validated separately
  // via `npm run check`. Works around a Next.js 16 Turbopack bug where the
  // auto-generated route validator truncates paths containing parenthesized
  // route groups (e.g. `(public)/b/[slug]/page`).
  typescript: {
    ignoreBuildErrors: true,
  },
  // Ensure preview bots get full metadata in the initial HTML (see Next.js streaming metadata).
  htmlLimitedBots:
    /facebookexternalhit|Facebot|LinkedInBot|Twitterbot|Pinterest|Slackbot|Discordbot|vkShare|redditbot|Applebot|WhatsApp|TelegramBot|Googlebot|bingbot|Embedly|ChatGPT-User|GPTBot|OAI-SearchBot|anthropic-ai|ClaudeBot|Claude-Web|PerplexityBot|Bytespider|CCBot/i,
  cacheComponents: true,
  // Populate entries here only when `ANALYZE=true npm run build` shows a measurable
  // bundle-size win for a specific package. Keep the block present and documented so
  // future wins (e.g., barrel-heavy icon libraries) have a clear home.
  // NOTE: lucide-react uses dual export names (e.g. ChevronDown + ChevronDownIcon)
  // which breaks modularizeImports transforms. Tree-shaking handles it fine without.
  modularizeImports: {},
  images: {
    // Only add hosts here when a new <Image src="https://..."> is introduced.
    // All current images are local or generated via next/image routes.
    remotePatterns: [],
  },
  experimental: {
    instantNavigationDevToolsToggle: true,
    serverActions: {
      bodySizeLimit: "7mb",
    },
    // Router cache freshness-vs-reuse (ref: bundled staleTimes.md, prefetching.md).
    // dynamic: RSC payloads gated on per-request data (session, business context)
    //   reuse for a short window so back/forward feels instant without serving
    //   meaningfully stale business data. 30s keeps sibling navs snappy while
    //   ensuring mutations surface within half a minute at worst.
    // static: Segments with no per-request variance (prefetched static shells)
    //   tolerate a longer reuse window since their content changes infrequently
    //   and cache-tag invalidations flush them on mutation anyway. 180s balances
    //   network savings against reasonable freshness for non-mutated reads.
    staleTimes: {
      dynamic: 30,
      static: 180,
    },
    inlineCss: true,
  },
  async redirects() {
    return [
      {
        source: "/dashboard",
        destination: "/home",
        permanent: true,
      },
      {
        source: "/:businessSlug/dashboard",
        destination: "/:businessSlug/home",
        permanent: true,
      },
    ];
  },
  async headers() {
    return [
      {
        source: "/",
        headers: agentDiscoveryHeaders,
      },
      {
        source: "/:path*",
        headers: baselineSecurityHeaders,
      },
      {
        source: "/api/:path*",
        headers: apiNoIndexHeaders,
      },
      {
        source: "/businesses/:path*",
        headers: authenticatedAppShellHeaders,
      },
      {
        source: "/account/:path*",
        headers: authenticatedAppShellHeaders,
      },
      {
        source: "/admin/:path*",
        headers: authenticatedAppShellHeaders,
      },
      {
        source: "/onboarding/:path*",
        headers: authenticatedAppShellHeaders,
      },
      {
        source: "/forgot-password",
        headers: sensitiveNoStoreHeaders,
      },
      {
        source: "/invite/:path*",
        headers: sensitiveNoStoreHeaders,
      },
      {
        source: "/login",
        headers: sensitiveNoStoreHeaders,
      },
      {
        source: "/inquire/:path*",
        headers: [
          {
            key: "Cache-Control",
            value: "public, s-maxage=60, stale-while-revalidate=300",
          },
          { key: "Vary", value: "Accept-Encoding" },
        ],
      },
      {
        source: "/quote/:path*",
        headers: [
          {
            key: "Cache-Control",
            value: "public, s-maxage=60, stale-while-revalidate=300",
          },
          { key: "Referrer-Policy", value: "no-referrer" },
          { key: "Vary", value: "Accept-Encoding" },
        ],
      },
      {
        source: "/b/:path*",
        headers: sensitiveNoStoreHeaders,
      },
      {
        source: "/reset-password",
        headers: sensitiveNoStoreHeaders,
      },
      {
        source: "/signup",
        headers: sensitiveNoStoreHeaders,
      },
      {
        source: "/verify-email",
        headers: sensitiveNoStoreHeaders,
      },
      {
        source: "/sw.js",
        headers: [
          {
            key: "Cache-Control",
            value: "public, max-age=0, must-revalidate",
          },
        ],
      },
      {
        source: "/:path*.svg",
        headers: [
          {
            key: "Cache-Control",
            value: "public, max-age=31536000, immutable",
          },
        ],
      },
    ];
  },
};

export default withBundleAnalyzer({ enabled: process.env.ANALYZE === "true" })(
  nextConfig,
);