next.config.ts

import type { NextConfig } from "next";
import { withSentryConfig } from "@sentry/nextjs";
import { securityHeaders } from "./src/lib/security-headers";

const isProd = process.env.NODE_ENV === "production";

const nextConfig: NextConfig = {
  images: {
    remotePatterns: [
      // Robohash fallbacks — `src/lib/doctor-avatar.ts`, `src/lib/patient-portrait.ts`.
      { protocol: "https", hostname: "robohash.org", pathname: "/**" },
      // User uploads via Vercel Blob — keep in sync with `src/lib/vercelBlob.ts` public URLs.
      { protocol: "https", hostname: "*.public.blob.vercel-storage.com", pathname: "/**" },
    ],
  },
  async headers() {
    const rules = [
      {
        source: "/(.*)",
        headers: securityHeaders,
      },
    ];

    if (isProd) {
      rules.push({
        source: "/_next/static/(.*)",
        headers: [
          { key: "Cache-Control", value: "public, max-age=31536000, immutable" },
        ],
      });
    }

    return rules;
  },
};

export default withSentryConfig(nextConfig, {
  org: process.env.SENTRY_ORG,
  project: process.env.SENTRY_PROJECT,
  silent: !process.env.CI,
  // Source map upload only when auth token present (CI / release builds).
  authToken: process.env.SENTRY_AUTH_TOKEN,
  widenClientFileUpload: true,
  /** Aligns webpack SDK with initSentryClient tunnel — ad-blocker safe same-origin ingest. */
  tunnelRoute: "/api/monitoring",
});