next.config.ts

import type { NextConfig } from "next";
import path from "node:path";

const nextConfig: NextConfig = {
  turbopack: {
    root: path.resolve(__dirname, ".."),
  },
  async headers() {
    // Next/Turbopack's dev-mode client uses eval() for HMR and stack-trace
    // reconstruction (React's own error message: "React will never use
    // eval() in production mode") — script-src must allow it in `next dev`
    // or every page throws a CSP console error, but production keeps the
    // stricter policy since eval() is never needed (or wanted) there.
    const scriptSrc =
      process.env.NODE_ENV === "production"
        ? "script-src 'self' 'unsafe-inline'"
        : "script-src 'self' 'unsafe-inline' 'unsafe-eval'";
    return [{
      source: "/:path*",
      headers: [
        { key: "Content-Security-Policy", value: `default-src 'self'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; object-src 'none'; ${scriptSrc}; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; upgrade-insecure-requests` },
        { key: "Referrer-Policy", value: "no-referrer" },
        { key: "X-Content-Type-Options", value: "nosniff" },
        { key: "X-Frame-Options", value: "DENY" },
        { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=(), payment=(), usb=()" },
        { key: "Cross-Origin-Opener-Policy", value: "same-origin" },
      ],
    }];
  },
  // WDK's crypto layer (via bare-node-runtime) loads native addons
  // (sodium-native) through a custom `require.addon(...)` resolver that
  // Next's build-time file tracer can't statically follow — it fails with
  // "Cannot find addon '.'" during "Collecting page data" otherwise. Marking
  // these packages external tells Next to leave them as plain `require()`
  // calls resolved by Node at runtime instead of bundling/tracing them.
  //
  // Turbopack (Next 16's default production bundler) mishandles this
  // combined with @tetherto/wdk's conditional "bare"/"default" exports map:
  // it externalizes the import under a corrupted, content-hashed specifier
  // (e.g. "@tetherto/wdk-<hash>") that doesn't exist anywhere, so any page
  // touching the WDK wallet 500s at runtime with ERR_MODULE_NOT_FOUND.
  // Webpack's externals handling doesn't have this bug, so package.json's
  // "build" script runs `next build --webpack` (Next's documented escape
  // hatch — see the version-16 upgrade guide) until this is fixed upstream.
  serverExternalPackages: [
    "sodium-native",
    "bare-node-runtime",
    "@tetherto/wdk",
    "@tetherto/wdk-cli",
    "@tetherto/wdk-wallet",
    "@tetherto/wdk-wallet-evm",
  ],
  // serverExternalPackages tells Next not to trace sodium-native at all, so
  // Vercel's own output-file-tracing step (which decides what non-JS files
  // get copied into the deployed function) never learns it needs the
  // prebuilt native addon either — every route touching the WDK wallet
  // 500s at runtime with "Cannot find addon '.'" (ADDON_NOT_FOUND) once the
  // Turbopack bug above is fixed. Force-including it here is the documented
  // fix for exactly this class of problem (see the "Common include
  // patterns for native/runtime assets" example in Next's own output.md).
  outputFileTracingIncludes: {
    "/*": ["node_modules/sodium-native/**/*"],
  },
};

export default nextConfig;