import type { NextConfig } from "next";

// Security headers (CSP, X-Frame-Options, etc.) live in proxy.ts, not here.
// This file's headers() is resolved once at build time and frozen into the
// standalone output - fine for a static value like the sw.js rule below, but
// wrong for the CSP's connect-src, which needs the container's actual
// runtime API_URL. That mistake shipped a permanently-wrong connect-src
// (build-time env, if any, or the localhost fallback) to every environment
// regardless of the real deployed API_URL, silently CSP-blocking every API
// call including login. Proxy runs fresh on every request and reads env
// correctly - see proxy.ts for the real header logic.
const nextConfig: NextConfig = {
  output: "standalone",
  async headers() {
    return [
      {
        // Browsers are supposed to bypass HTTP cache when checking for a new
        // service worker, but that's not reliably honored everywhere - an
        // explicit no-cache header here is the only way to guarantee a sw.js
        // fix actually reaches already-open tabs promptly after a deploy,
        // instead of possibly sitting cached for hours.
        source: "/sw.js",
        headers: [{ key: "Cache-Control", value: "no-cache, no-store, must-revalidate" }],
      },
    ];
  },
};

export default nextConfig;