next.config.mjs

const fallbackSupabaseOrigin = "https://*.supabase.co";

export function buildContentSecurityPolicy(
  supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL,
) {
  const supabaseOrigin = normalizeOrigin(supabaseUrl) ?? fallbackSupabaseOrigin;
  const supabaseWebsocketOrigin = supabaseOrigin.startsWith("https://")
    ? supabaseOrigin.replace("https://", "wss://")
    : "wss://*.supabase.co";

  return [
    "default-src 'self'",
    "base-uri 'self'",
    "form-action 'self'",
    "frame-ancestors 'none'",
    "object-src 'none'",
    "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://checkout.razorpay.com https://va.vercel-scripts.com",
    "style-src 'self' 'unsafe-inline'",
    "img-src 'self' data: blob: https://*.supabase.co https://cdn.simpleicons.org",
    "font-src 'self' data:",
    `connect-src 'self' ${supabaseOrigin} ${supabaseWebsocketOrigin} https://*.supabase.co wss://*.supabase.co https://api.razorpay.com https://checkout.razorpay.com https://va.vercel-scripts.com`,
    "frame-src https://api.razorpay.com https://checkout.razorpay.com",
    "media-src 'self' data: blob: https://*.supabase.co",
    "worker-src 'self' blob:",
    "manifest-src 'self'",
  ].join("; ");
}

export const securityHeaders = [
  {
    key: "X-Content-Type-Options",
    value: "nosniff",
  },
  {
    key: "Referrer-Policy",
    value: "strict-origin-when-cross-origin",
  },
  {
    key: "X-Frame-Options",
    value: "DENY",
  },
  {
    key: "Permissions-Policy",
    value:
      "camera=(), microphone=(), geolocation=(), browsing-topics=(), payment=(self)",
  },
  {
    key: "Content-Security-Policy",
    value: buildContentSecurityPolicy(),
  },
];

const immutableCacheHeader = {
  key: "Cache-Control",
  value: "public, max-age=31536000, immutable",
};

/** @type {import('next').NextConfig} */
const nextConfig = {
  allowedDevOrigins: ["127.0.0.1"],
  images: {
    formats: ["image/avif", "image/webp"],
  },
  // Escape hatch for measurement builds: `NEXT_DIST_DIR=.next-measure npm run
  // build` writes to an isolated directory so a running `next dev` (which owns
  // .next and rewrites it on demand) can't clobber the artifacts mid-analysis.
  // Unset in CI and production, so the default output path is unchanged.
  //
  // Note: `next build` rewrites tsconfig.json's `include` to point at whatever
  // distDir is active, so a measurement build leaves tsconfig dirty. Revert it
  // (`git checkout -- tsconfig.json`) before committing.
  distDir: process.env.NEXT_DIST_DIR || ".next",
  // Pin the workspace root to this project. A stray lockfile in a parent
  // directory (e.g. /home/user/package-lock.json) otherwise makes Turbopack
  // infer the wrong root, which breaks App Router route resolution in dev
  // (every route 404s). `next build` is unaffected, so this only fixes dev.
  turbopack: {
    root: import.meta.dirname,
  },
  // Tree-shake large icon/animation packages so only used exports ship.
  experimental: {
    optimizePackageImports: [
      "lucide-react",
      "framer-motion",
      "@gsap/react",
    ],
  },
  compiler: {
    // Strip console.* (except errors/warnings) from production bundles.
    removeConsole:
      process.env.NODE_ENV === "production"
        ? { exclude: ["error", "warn"] }
        : false,
  },
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: securityHeaders,
      },
      {
        source: "/_next/static/:path*",
        headers: [immutableCacheHeader],
      },
      {
        source: "/:path*.woff2",
        headers: [immutableCacheHeader],
      },
    ];
  },
};

function normalizeOrigin(value) {
  if (!value) {
    return null;
  }

  try {
    return new URL(value).origin;
  } catch {
    return null;
  }
}

// Opt-in bundle analysis: `ANALYZE=true npm run build` opens treemaps of the
// client/server bundles. Guarded so normal builds never touch it, and so the
// build still succeeds if @next/bundle-analyzer isn't installed.
let finalConfig = nextConfig;
if (process.env.ANALYZE === "true") {
  try {
    const { createRequire } = await import("node:module");
    const require = createRequire(import.meta.url);
    const withBundleAnalyzer = require("@next/bundle-analyzer")({
      enabled: true,
    });
    finalConfig = withBundleAnalyzer(nextConfig);
  } catch {
    console.warn(
      "[next.config] ANALYZE=true but @next/bundle-analyzer is not installed — run `npm i -D @next/bundle-analyzer`.",
    );
  }
}

export default finalConfig;