export const isDev = process.env.NODE_ENV === 'development';
export const isProd = !isDev;
export const isBrowser = typeof window !== 'undefined';

/**
 * Next.js static-export build (`output: 'export'`). Loggers treat it like dev
 * for visibility; some auth/SSR features behave differently under it.
 */
export const isStaticBuild = process.env.NEXT_PUBLIC_STATIC_BUILD === 'true';

/**
 * DPoP (RFC 9449) sender-constrained tokens are enabled for this app.
 *
 * Set by `createBaseNextConfig({ dpop: true })` (inlines
 * `NEXT_PUBLIC_DPOP_ENABLED='true'`). When true: tokens are bound to a
 * non-extractable in-browser key, a copied Bearer token can't be replayed, and
 * the API client signs a per-request DPoP proof. This flag lives in
 * `@djangocfg/api` — the package that implements DPoP — so it is the single
 * source of truth, importable by every higher-level package.
 */
export const dpopEnabled = process.env.NEXT_PUBLIC_DPOP_ENABLED === 'true';
