// ── Next.js Config ──────────────────────────────────────────────────
// Security headers, image remote patterns, and build-time ESLint checks.
// Applied globally to all routes via the headers() async function.

import type { NextConfig } from "next"

const nextConfig: NextConfig = {
  // Fail the build on ESLint errors — no silent ignores
  eslint: {
    ignoreDuringBuilds: false,
  },
  // Allow external avatar images from ui-avatars.com
  images: {
    remotePatterns: [
      {
        protocol: "https",
        hostname: "ui-avatars.com",
      },
    ],
  },
  // ── Security Headers ──────────────────────────────────────────────
  // Applied to all routes. HSTS is production-only to avoid localhost issues.
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [
          { key: "X-Content-Type-Options", value: "nosniff" },
          { key: "X-Frame-Options", value: "DENY" },
          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
          { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
          ...(process.env.NODE_ENV === "production"
            ? [{ key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" }]
            : []),
        ],
      },
    ]
  },
}

export default nextConfig
