next.config.js

/**
 * Run `build` or `dev` with `SKIP_ENV_VALIDATION` to skip env validation. This is especially useful
 * for Docker builds.
 */
import "./src/env.js";

/** @type {import("next").NextConfig} */
const config = {
  // A stray lockfile in a parent directory otherwise makes Next infer the
  // wrong workspace root, breaking output file tracing in production.
  outputFileTracingRoot: import.meta.dirname,
  // Corsair and its MCP adapter pull in express (dynamic requires) — load
  // them with Node at runtime instead of bundling them.
  serverExternalPackages: [
    "corsair",
    "@corsair-dev/mcp",
    "@corsair-dev/gmail",
    "@corsair-dev/googlecalendar",
  ],
  poweredByHeader: false,
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [
          // Two years of HSTS; safe because the app is HTTPS-only in prod.
          {
            key: "Strict-Transport-Security",
            value: "max-age=63072000; includeSubDomains",
          },
          // The app renders email HTML only inside sandboxed iframes it
          // creates itself; nothing should ever frame the app.
          { key: "X-Frame-Options", value: "DENY" },
          // Gmail attachments are served with caller-supplied MIME types —
          // never let browsers sniff past them.
          { key: "X-Content-Type-Options", value: "nosniff" },
          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
          {
            key: "Permissions-Policy",
            value: "camera=(), microphone=(), geolocation=()",
          },
        ],
      },
    ];
  },
};

export default config;