/** @type {import('next').NextConfig} */
const nextConfig = {
  reactStrictMode: true,
  output: "standalone",
  images: {
    remotePatterns: [
      // Allow image optimisation from any host. Lock this down once we
      // know exactly which sources we'll pull attachments from.
      { protocol: "http", hostname: "**" },
      { protocol: "https", hostname: "**" },
    ],
  },
  // Allow any host / IP / tunneled domain so the app is reachable from
  // LAN devices, reverse proxies and custom hostnames. Next 16's
  // internal matcher rejects the literal "*", so we also rely on the
  // `scripts/patch-next-dev-blocker.cjs` postinstall hook to neuter
  // the dev-only cross-site guard. Production behaviour is unaffected
  // because the patch only runs in development.
  allowedDevOrigins: ["*"],
  experimental: {
    serverActions: {
      allowedOrigins: ["*"],
    },
  },
};

const withPWA = require("@ducanh2912/next-pwa").default({
  dest: "public",
  cacheOnFrontEndNav: true,
  aggressiveFrontEndNavCaching: true,
  reloadOnOnline: true,
  register: true,
  extendDefaultRuntimeCaching: true,
  workboxOptions: {
    cleanupOutdatedCaches: true,
    clientsClaim: true,
    skipWaiting: true,
    runtimeCaching: [
      // The QR confirmation must always use the server's current local-day
      // decision. A cached yesterday lookup can say OUT while a POST writes IN.
      {
        urlPattern: ({ sameOrigin, url }) =>
          sameOrigin && url.pathname === "/api/clock/employee-lookup",
        handler: "NetworkOnly",
      },
    ],
  },
  // The Web App Manifest lives at public/manifest.json (static file).
  // next-pwa does NOT generate it — the `manifest` option was silently
  // ignored in @ducanh2912/next-pwa@10.2.9. The dashboard metadata lives
  // in public/manifest.json; the chat metadata lives in
  // public/chat.webmanifest. Both are referenced from the per-route
  // metadata blocks in src/app/layout.tsx and src/app/dashboard/chat/page.tsx.
});

module.exports = withPWA(nextConfig);