mirror of
https://github.com/hanzoai/works.git
synced 2026-10-30 18:17:58 +00:00
zeekay
81660426dc
A one-page site for the operator's half of the cloud — sales, marketing, support, books, cap table, incorporation, workflows — built so that a claim and a served route are the same object. Every card names a real capability, its real /v1 address, and the sentence that capability publishes about itself: its Go package doc, lifted into the OpenAPI tag and read back out of public.yaml, the ga-only public contract. Copy therefore cannot outrun the fleet. A gate asserts llms.txt still names every capability the page shows, because the drift that matters is the one where the site tells a person about something it never tells a model. robots.txt names the AI crawlers and allows them, and declares Content-Signal: search=yes, ai-input=yes, ai-train=yes. It carries no Disallow, and a gate fails the build if one appears. Auth is Hanzo IAM and nothing else — PKCE-S256, which is what lets a static export run it with no server. The gates prove it against the real issuer rather than asserting it.
33 lines
1.4 KiB
JavaScript
33 lines
1.4 KiB
JavaScript
/** @type {import('next').NextConfig} */
|
|
//
|
|
// Plain ESM with a JSDoc type, not TypeScript — the deliberate house choice
|
|
// (hanzo.ai and hanzo.industries both state it): the config is a plain object
|
|
// and never needed the TypeScript compiler API to load it.
|
|
//
|
|
// This site is a STATIC EXPORT and must not grow a server. Login is OIDC
|
|
// Authorization Code + PKCE, a PUBLIC-client flow that completes entirely in
|
|
// the browser, so there is nothing here for a server to hold. The export ships
|
|
// to the Sites plane — POST /v1/projects/hanzo-works/deployments — which is one
|
|
// of the capabilities this page advertises.
|
|
//
|
|
// `trailingSlash: true` is not cosmetic. It makes the export a tree of
|
|
// directory indexes (`out/auth/callback/index.html`) rather than flat siblings
|
|
// (`out/auth/callback.html`), and a directory index is what a plain file server
|
|
// resolves. The flat form 404s the OAuth callback on the way back from IAM.
|
|
|
|
// Response headers are NOT here. `headers()` is silently inert under
|
|
// `output: export` — Next says so on every build — so a block here would be
|
|
// config that reads as a security control and enforces nothing. They live in
|
|
// `public/_headers`, which the serving layer reads, the same way
|
|
// docs.hanzo.ai states its.
|
|
|
|
const nextConfig = {
|
|
output: 'export',
|
|
trailingSlash: true,
|
|
poweredByHeader: false,
|
|
images: { unoptimized: true },
|
|
productionBrowserSourceMaps: false,
|
|
}
|
|
|
|
export default nextConfig
|