@carlonicora/nextjs-jsonapi 4.0.1 → 4.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/next-config/index.js +4 -1
  2. package/dist/next-config/index.js.map +1 -1
  3. package/dist/next-config/index.mjs +4 -1
  4. package/dist/next-config/index.mjs.map +1 -1
  5. package/package.json +1 -1
  6. package/src/next-config/__tests__/createNextConfig.test.ts +2 -1
  7. package/src/next-config/index.ts +4 -1
package/dist/next-config/index.js CHANGED
@@ -183,7 +183,10 @@ function createNextConfig(options) {
183
183
  // rendering the nearest unauthorized.tsx.
184
184
  authInterrupts: _nullishCoalesce(options.authInterrupts, () => ( true)),
185
185
  turbopackGc: true,
186
- turbopackLazyDynamicImports: true,
186
+ // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily
187
+ // imported request module unactivated ("Lazily compiled dynamic import of ...
188
+ // JsonApiRequest ... was not activated"), so every client-side read returns
189
+ // nothing. Seen with the package installed from npm; production builds are unaffected.
187
190
  ...reactCompiler ? { turbopackRustReactCompiler: true } : {}
188
191
  },
189
192
  allowedDevOrigins: options.devOrigins,
package/dist/next-config/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"names":[],"mappings":"AAAA;AACE;AACF,uDAA6B;AAC7B;AACA;ACoBA,IAAM,gBAAA,EAA+E;AAAA,EACnF,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,CAAC,uBAAuB,CAAA;AAAA,IACtC,SAAA,EAAW,CAAC,sBAAsB,CAAA;AAAA,IAClC,aAAA,EAAe,CAAC,wBAAwB,CAAA;AAAA,IACxC,WAAA,EAAa,CAAC,uBAAA,EAAyB,0BAA0B;AAAA,EACnE,CAAA;AAAA,EACA,UAAA,EAAY;AAAA,IACV,YAAA,EAAc,CAAC,6BAA6B,CAAA;AAAA,IAC5C,SAAA,EAAW,CAAC,6BAAA,EAA+B,0BAA0B,CAAA;AAAA,IACrE,aAAA,EAAe,CAAC,6BAAA,EAA+B,+BAA+B;AAAA,EAChF,CAAA;AAAA,EACA,SAAA,EAAW;AAAA,IACT,YAAA,EAAc,CAAC,mCAAmC,CAAA;AAAA,IAClD,aAAA,EAAe,CAAC,mCAAmC,CAAA;AAAA,IACnD,WAAA,EAAa,CAAC,mCAAmC;AAAA,EACnD,CAAA;AAAA,EACA,OAAA,EAAS;AAAA,IACP,SAAA,EAAW,CAAC,4BAA4B;AAAA,EAC1C,CAAA;AAAA,EACA,WAAA,EAAa;AAAA,IACX,WAAA,EAAa,CAAC,8BAA8B,CAAA;AAAA,IAC5C,UAAA,EAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF,CAAA;AAEA,SAAS,gBAAA,CAAiB,GAAA,EAAkC;AAC1D,EAAA,OAAO,GAAA,CAAI,cAAA,EAAgB,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,EAAA,GAAM,CAAA,CAAE,IAAA,CAAK,CAAC,EAAA,EAAI,CAAC,CAAA;AAClF;AAFS,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AAOF,SAAS,QAAA,CAAS,OAAA,EAAqB,GAAA,EAAgC;AAC5E,EAAA,MAAM,OAAA,EAAS,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAC1C,EAAA,MAAM,aAAA,EAAe,gBAAA,CAAiB,GAAG,CAAA;AACzC,EAAA,MAAM,SAAA,mBAAW,OAAA,CAAQ,QAAA,UAAY,CAAC,GAAA;AAItC,EAAA,MAAM,gBAAA,EAA+E;AAAA;AAAA,IAEnF,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAA,EAAmB,eAAe,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAElF,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAiB,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAEhE,SAAA,EAAW,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAA,EAAS,OAAO,CAAA,EAAG,OAAA,EAAS,aAAa,CAAA;AAAA;AAAA,IAEvE,UAAA,EAAY,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAE5C,aAAA,EAAe;AAAA,MACb,IAAA,EAAM,CAAC,QAAQ,CAAA;AAAA,MACf,OAAA,EAAS;AAAA,QACP,MAAA;AAAA;AAAA,QAEA,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,QAC5B,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF,CAAA;AAAA;AAAA,IAEA,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAE7C,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAO,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE;AAAA,EACzD,CAAA;AAEA,EAAA,MAAM,UAAA,kBAAY,qCAAA,CAAC,IAAA,EAAA,GAA+B;AAChD,IAAA,MAAM,EAAE,IAAA,EAAM,QAAQ,EAAA,EAAI,eAAA,CAAgB,IAAI,CAAA;AAC9C,IAAA,MAAM,aAAA,EAAe,QAAA,CAAS,OAAA,CAAQ,CAAC,OAAA,EAAA,oBAAY,eAAA,CAAgB,OAAO,CAAA,CAAE,IAAI,CAAA,UAAK,CAAC,GAAC,CAAA;AACvF,IAAA,MAAM,QAAA,EAAU,CAAC,GAAG,IAAA,EAAM,GAAG,YAAA,EAAc,oCAAI,OAAA,mBAAQ,GAAA,4BAAA,CAAM,IAAI,GAAA,UAAK,CAAC,GAAA,EAAI,GAAG,OAAO,CAAA,CAAE,MAAA;AAAA,MACrF,CAAC,MAAA,EAAA,GAAW,OAAA,IAAW;AAAA,IACzB,CAAA;AACA,IAAA,OAAO,CAAC,IAAA,EAAM,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7C,CAAA,EAPkB,WAAA,CAAA;AASlB,EAAA,OAAO;AAAA,IACL,oBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA,IACtB,SAAA,CAAU,WAAW,CAAA;AAAA,IACrB,SAAA,CAAU,SAAS,CAAA;AAAA,IACnB,SAAA,CAAU,UAAU,CAAA;AAAA,IACpB,SAAA,CAAU,aAAa,CAAA;AAAA,IACvB,SAAA,CAAU,WAAW,CAAA;AAAA;AAAA,IAErB,wBAAA;AAAA;AAAA,IAEA,oBAAA;AAAA;AAAA,IAEA,iBAAA;AAAA;AAAA,IAEA,mBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,GAAA,CAAI,SAAA,IAAa,aAAA,GAAgB,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,4BAAA,EAA8B;AAAA,EAC5F,CAAA,CACG,MAAA,CAAO,OAAO,CAAA,CACd,IAAA,CAAK,IAAI,CAAA;AACd;AAtEgB,qCAAA,QAAA,EAAA,UAAA,CAAA;AD0ChB;AACA;AExFO,SAAS,oBAAA,CAAqB,OAAA,EAAgC,GAAA,EAAsC;AACzG,EAAA,MAAM,OAAA,kBAAS,OAAA,qBAAQ,iBAAA,6BAAmB,SAAA,IAAW,OAAA,EAAS,GAAA,EAAK,MAAA;AAEnE,EAAA,OAAO;AAAA,IACL;AAAA;AAAA,MAEE,MAAA,EAAQ,SAAA;AAAA,MACR,OAAA,EAAS;AAAA;AAAA,QAEP;AAAA,UACE,GAAA,EAAK,yBAAA;AAAA,UACL,KAAA,EAAO,QAAA,CAAS,OAAA,EAAS,GAAG;AAAA,QAC9B,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,wBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAClB,CAAC,EAAA,EACD;AAAA,UACE;AAAA,YACE,GAAA,EAAK,2BAAA;AAAA,YACL,KAAA,EAAO;AAAA,UACT;AAAA,QACF,CAAA;AAAA;AAAA,QAEJ;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,oBAAA;AAAA,UACL,KAAA,EAAO,CAAA,QAAA,EAAW,MAAM,CAAA,gCAAA;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAhDgB,qCAAA,oBAAA,EAAA,sBAAA,CAAA;AFwIhB;AACA;AGnHA,SAAS,iBAAA,CAAkB,GAAA,EAAyC;AAClE,EAAA,OAAO,GAAA,CAAI,cAAA,EACP,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,GAAA,EAAA,GAAQ;AACxC,IAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAU,KAAK,EAAA,EAAI,IAAI,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AACvD,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,MAClC,QAAA;AAAA,MACA,IAAA,EAAM,KAAA,GAAQ,KAAA;AAAA,IAChB,CAAA;AAAA,EACF,CAAC,EAAA,EACD,CAAC,CAAA;AACP;AAXS,qCAAA,iBAAA,EAAA,mBAAA,CAAA;AAaF,SAAS,gBAAA,CAAiB,OAAA,EAA2C;AAC1E,EAAA,MAAM,IAAA,EAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,cAAA,EAAgB,OAAA,CAAQ,cAAA,IAAkB,IAAA;AAEhD,EAAA,MAAM,OAAA,EAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,EAAE,OAAA,EAAS,YAAY,EAAA,EAAI,CAAC,CAAA;AAAA,IAC3D,eAAA,EAAiB,IAAA;AAAA,IACjB,kBAAA,EAAoB,IAAA;AAAA,IACpB,aAAA;AAAA,IACA,YAAA,EAAc;AAAA,MACZ,aAAA,EAAe;AAAA,QACb,aAAA,EAAe;AAAA,MACjB,CAAA;AAAA;AAAA;AAAA;AAAA,MAIA,cAAA,mBAAgB,OAAA,CAAQ,cAAA,UAAkB,MAAA;AAAA,MAC1C,WAAA,EAAa,IAAA;AAAA,MACb,2BAAA,EAA6B,IAAA;AAAA,MAC7B,GAAI,cAAA,EAAgB,EAAE,0BAAA,EAA4B,KAAK,EAAA,EAAI,CAAC;AAAA,IAC9D,CAAA;AAAA,IACA,iBAAA,EAAmB,OAAA,CAAQ,UAAA;AAAA,IAC3B,cAAA,EAAgB,OAAA,CAAQ,IAAA,EAAM,CAAC,IAAA,EAAM,KAAA,EAAO,KAAK,EAAA,EAAI,CAAC,IAAA,EAAM,KAAK,CAAA;AAAA,IACjE,MAAA,EAAQ;AAAA,MACN,eAAA,mBAAiB,OAAA,CAAQ,oBAAA,UAAwB,IAAA;AAAA,MACjD,cAAA,EAAgB,iBAAA,CAAkB,GAAG,CAAA;AAAA,MACrC,uBAAA,EAAyB;AAAA,IAC3B,CAAA;AAAA,IACA,eAAA,EAAiB,KAAA;AAAA,IACjB,eAAA,EAAiB,KAAA;AAAA,IACjB,GAAA,EAAK;AAAA,MACH,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,4BAAA,mBAA8B,GAAA,CAAI,4BAAA,UAAgC,IAAA;AAAA,MAClE,+BAAA,mBAAiC,GAAA,CAAI,+BAAA,UAAmC,IAAA;AAAA,MACxE,GAAG,OAAA,CAAQ;AAAA,IACb,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,OAAA,CAAQ,QAAA,EAAU,EAAE,sBAAA,EAAwB,CAAC,SAAA,EAAW,cAAc,EAAE,EAAA,EAAI,CAAC,CAAA;AAAA;AAAA;AAAA,IAGjF,SAAA,EAAW;AAAA,MACT,YAAA,EAAc;AAAA,QACZ,GAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,KAAA,EAAO;AACrC,IAAA,MAAA,CAAO,QAAA,EAAU,MAAA,CAAA,EAAA,GAAY,oBAAA,CAAqB,OAAA,EAAS,OAAA,CAAQ,GAAG,CAAA;AAAA,EACxE;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,QAAA;AAEhD,EAAA,OAAO,OAAA,CAAQ,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,MAAM,EAAA,EAAI,MAAA;AACnD;AAlEgB,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AHkLhB;AACE;AACA;AACF,yEAAC","file":"/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","sourcesContent":[null,"// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n * `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n services?: CspService[];\n csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n stripe: {\n \"script-src\": [\"https://js.stripe.com\"],\n \"img-src\": [\"https://*.stripe.com\"],\n \"connect-src\": [\"https://api.stripe.com\"],\n \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n },\n googleMaps: {\n \"script-src\": [\"https://maps.googleapis.com\"],\n \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n },\n turnstile: {\n \"script-src\": [\"https://challenges.cloudflare.com\"],\n \"connect-src\": [\"https://challenges.cloudflare.com\"],\n \"frame-src\": [\"https://challenges.cloudflare.com\"],\n },\n discord: {\n \"img-src\": [\"https://cdn.discordapp.com\"],\n },\n googleFonts: {\n \"style-src\": [\"https://fonts.googleapis.com\"],\n \"font-src\": [\"https://fonts.gstatic.com\"],\n },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n const imageSources = listImageSources(env);\n const services = options.services ?? [];\n\n // Each fetch directive: what Next itself needs, then the named services, then\n // the app's extras, then the sources derived from the env.\n const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n // Scripts: self, and unsafe-inline/eval for Next.js\n \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n // Styles: self and unsafe-inline for styled-components/emotion\n \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n // Images: self, data URIs, blobs, and configured image sources\n \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: imageSources },\n // Fonts: self\n \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n \"connect-src\": {\n base: [\"'self'\"],\n fromEnv: [\n apiUrl,\n // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n apiUrl.replace(/^http/, \"ws\"),\n env.NEXT_PUBLIC_ADDRESS || \"\",\n ...imageSources,\n ],\n },\n // Frames: self\n \"frame-src\": { base: [\"'self'\"], fromEnv: [] },\n // Worker sources: self and blob (for Web Workers with dynamic imports)\n \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n };\n\n const directive = (name: CspDirective): string => {\n const { base, fromEnv } = fetchDirectives[name];\n const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n (source) => source !== \"\",\n );\n return [name, ...new Set(sources)].join(\" \");\n };\n\n return [\n \"default-src 'self'\",\n directive(\"script-src\"),\n directive(\"style-src\"),\n directive(\"img-src\"),\n directive(\"font-src\"),\n directive(\"connect-src\"),\n directive(\"frame-src\"),\n // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n \"frame-ancestors 'none'\",\n // Form actions: only self\n \"form-action 'self'\",\n // Base URI: only self\n \"base-uri 'self'\",\n // Object sources: none (no plugins)\n \"object-src 'none'\",\n directive(\"worker-src\"),\n // Upgrade insecure requests in production.\n //\n // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n // and serves it over plain http on a custom hostname. With this directive\n // the browser rewrites every /_next/static asset to https, which nothing is\n // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n // never hydrates, and each spec sees only server-rendered markup.\n env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n ]\n .filter(Boolean)\n .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n source: string;\n headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n return [\n {\n // Apply to all routes\n source: \"/:path*\",\n headers: [\n // Content Security Policy - prevents XSS attacks\n {\n key: \"Content-Security-Policy\",\n value: buildCsp(options, env),\n },\n // X-Frame-Options - prevents clickjacking (backup for older browsers)\n {\n key: \"X-Frame-Options\",\n value: \"DENY\",\n },\n // X-Content-Type-Options - prevents MIME sniffing\n {\n key: \"X-Content-Type-Options\",\n value: \"nosniff\",\n },\n // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n // the suite speaks plain http, and an HSTS pin would force https on every\n // later request to this host from the same browser profile.\n ...(env.E2E_BUILD === \"true\"\n ? []\n : [\n {\n key: \"Strict-Transport-Security\",\n value: \"max-age=31536000; includeSubDomains\",\n },\n ]),\n // Referrer-Policy - controls referrer information\n {\n key: \"Referrer-Policy\",\n value: \"strict-origin-when-cross-origin\",\n },\n // Permissions-Policy - restricts browser features\n {\n key: \"Permissions-Policy\",\n value: `camera=(${camera}), microphone=(), geolocation=()`,\n },\n ],\n },\n ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n devOrigins: string[];\n /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n services?: CspService[];\n /** Extra CSP sources per directive, for hosts no named service covers. */\n csp?: Partial<Record<CspDirective, string[]>>;\n env?: Record<string, string>;\n imageMinimumCacheTTL?: number;\n permissionsPolicy?: { camera?: \"none\" | \"self\" };\n mdx?: boolean;\n serwist?: boolean;\n securityHeaders?: boolean;\n authInterrupts?: boolean;\n reactCompiler?: boolean;\n rewrites?: NextConfig[\"rewrites\"];\n extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n return env.IMAGE_SOURCES\n ? env.IMAGE_SOURCES.split(\",\").map((url) => {\n const { hostname, protocol, port } = new URL(url.trim());\n return {\n protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n hostname,\n port: port || undefined,\n };\n })\n : [];\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n const env = process.env;\n const reactCompiler = options.reactCompiler === true;\n\n const config: NextConfig = {\n // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n // `next dev` server may still be running against the same worktree. `next\n // build` and `next dev` share `.next`, so a build performed underneath a live\n // dev server clobbers it and that dev server then 404s every route. Giving\n // the e2e build its own directory keeps the two independent. E2E_BUILD must\n // be set for `next build` AND for `next start`, or `start` looks in `.next`\n // and serves someone else's output.\n ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n cacheComponents: true,\n partialPrefetching: true,\n reactCompiler,\n experimental: {\n serverActions: {\n bodySizeLimit: \"5mb\",\n },\n // Required by `unauthorized()` (next/navigation), which ServerSession.checkPermission\n // calls to deny access. Without this flag the function throws a plain Error instead of\n // rendering the nearest unauthorized.tsx.\n authInterrupts: options.authInterrupts ?? true,\n turbopackGc: true,\n turbopackLazyDynamicImports: true,\n ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n },\n allowedDevOrigins: options.devOrigins,\n pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n images: {\n minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n remotePatterns: parseImageSources(env),\n dangerouslyAllowLocalIP: true,\n },\n poweredByHeader: false,\n reactStrictMode: false,\n env: {\n NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n ...options.env,\n },\n // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n // does nothing but append these two entries. Requiring the package here\n // instead CRASHES production: it is a devDependency, next.config.js is loaded\n // at RUNTIME by `next start`, and the web-production image installs with\n // --prod. Do not re-add a require of any devDependency to this file.\n ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n // single instance in both modes.\n turbopack: {\n resolveAlias: {\n yjs: \"./node_modules/yjs\",\n },\n },\n };\n\n if (options.securityHeaders !== false) {\n config.headers = async () => buildSecurityHeaders(options, process.env);\n }\n\n if (options.rewrites) config.rewrites = options.rewrites;\n\n return options.extend ? options.extend(config) : config;\n}\n"]}
1
+ {"version":3,"sources":["/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"names":[],"mappings":"AAAA;AACE;AACF,uDAA6B;AAC7B;AACA;ACoBA,IAAM,gBAAA,EAA+E;AAAA,EACnF,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,CAAC,uBAAuB,CAAA;AAAA,IACtC,SAAA,EAAW,CAAC,sBAAsB,CAAA;AAAA,IAClC,aAAA,EAAe,CAAC,wBAAwB,CAAA;AAAA,IACxC,WAAA,EAAa,CAAC,uBAAA,EAAyB,0BAA0B;AAAA,EACnE,CAAA;AAAA,EACA,UAAA,EAAY;AAAA,IACV,YAAA,EAAc,CAAC,6BAA6B,CAAA;AAAA,IAC5C,SAAA,EAAW,CAAC,6BAAA,EAA+B,0BAA0B,CAAA;AAAA,IACrE,aAAA,EAAe,CAAC,6BAAA,EAA+B,+BAA+B;AAAA,EAChF,CAAA;AAAA,EACA,SAAA,EAAW;AAAA,IACT,YAAA,EAAc,CAAC,mCAAmC,CAAA;AAAA,IAClD,aAAA,EAAe,CAAC,mCAAmC,CAAA;AAAA,IACnD,WAAA,EAAa,CAAC,mCAAmC;AAAA,EACnD,CAAA;AAAA,EACA,OAAA,EAAS;AAAA,IACP,SAAA,EAAW,CAAC,4BAA4B;AAAA,EAC1C,CAAA;AAAA,EACA,WAAA,EAAa;AAAA,IACX,WAAA,EAAa,CAAC,8BAA8B,CAAA;AAAA,IAC5C,UAAA,EAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF,CAAA;AAEA,SAAS,gBAAA,CAAiB,GAAA,EAAkC;AAC1D,EAAA,OAAO,GAAA,CAAI,cAAA,EAAgB,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,EAAA,GAAM,CAAA,CAAE,IAAA,CAAK,CAAC,EAAA,EAAI,CAAC,CAAA;AAClF;AAFS,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AAOF,SAAS,QAAA,CAAS,OAAA,EAAqB,GAAA,EAAgC;AAC5E,EAAA,MAAM,OAAA,EAAS,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAC1C,EAAA,MAAM,aAAA,EAAe,gBAAA,CAAiB,GAAG,CAAA;AACzC,EAAA,MAAM,SAAA,mBAAW,OAAA,CAAQ,QAAA,UAAY,CAAC,GAAA;AAItC,EAAA,MAAM,gBAAA,EAA+E;AAAA;AAAA,IAEnF,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAA,EAAmB,eAAe,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAElF,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAiB,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAEhE,SAAA,EAAW,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAA,EAAS,OAAO,CAAA,EAAG,OAAA,EAAS,aAAa,CAAA;AAAA;AAAA,IAEvE,UAAA,EAAY,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAE5C,aAAA,EAAe;AAAA,MACb,IAAA,EAAM,CAAC,QAAQ,CAAA;AAAA,MACf,OAAA,EAAS;AAAA,QACP,MAAA;AAAA;AAAA,QAEA,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,QAC5B,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF,CAAA;AAAA;AAAA,IAEA,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAE7C,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAO,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE;AAAA,EACzD,CAAA;AAEA,EAAA,MAAM,UAAA,kBAAY,qCAAA,CAAC,IAAA,EAAA,GAA+B;AAChD,IAAA,MAAM,EAAE,IAAA,EAAM,QAAQ,EAAA,EAAI,eAAA,CAAgB,IAAI,CAAA;AAC9C,IAAA,MAAM,aAAA,EAAe,QAAA,CAAS,OAAA,CAAQ,CAAC,OAAA,EAAA,oBAAY,eAAA,CAAgB,OAAO,CAAA,CAAE,IAAI,CAAA,UAAK,CAAC,GAAC,CAAA;AACvF,IAAA,MAAM,QAAA,EAAU,CAAC,GAAG,IAAA,EAAM,GAAG,YAAA,EAAc,oCAAI,OAAA,mBAAQ,GAAA,4BAAA,CAAM,IAAI,GAAA,UAAK,CAAC,GAAA,EAAI,GAAG,OAAO,CAAA,CAAE,MAAA;AAAA,MACrF,CAAC,MAAA,EAAA,GAAW,OAAA,IAAW;AAAA,IACzB,CAAA;AACA,IAAA,OAAO,CAAC,IAAA,EAAM,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7C,CAAA,EAPkB,WAAA,CAAA;AASlB,EAAA,OAAO;AAAA,IACL,oBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA,IACtB,SAAA,CAAU,WAAW,CAAA;AAAA,IACrB,SAAA,CAAU,SAAS,CAAA;AAAA,IACnB,SAAA,CAAU,UAAU,CAAA;AAAA,IACpB,SAAA,CAAU,aAAa,CAAA;AAAA,IACvB,SAAA,CAAU,WAAW,CAAA;AAAA;AAAA,IAErB,wBAAA;AAAA;AAAA,IAEA,oBAAA;AAAA;AAAA,IAEA,iBAAA;AAAA;AAAA,IAEA,mBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,GAAA,CAAI,SAAA,IAAa,aAAA,GAAgB,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,4BAAA,EAA8B;AAAA,EAC5F,CAAA,CACG,MAAA,CAAO,OAAO,CAAA,CACd,IAAA,CAAK,IAAI,CAAA;AACd;AAtEgB,qCAAA,QAAA,EAAA,UAAA,CAAA;AD0ChB;AACA;AExFO,SAAS,oBAAA,CAAqB,OAAA,EAAgC,GAAA,EAAsC;AACzG,EAAA,MAAM,OAAA,kBAAS,OAAA,qBAAQ,iBAAA,6BAAmB,SAAA,IAAW,OAAA,EAAS,GAAA,EAAK,MAAA;AAEnE,EAAA,OAAO;AAAA,IACL;AAAA;AAAA,MAEE,MAAA,EAAQ,SAAA;AAAA,MACR,OAAA,EAAS;AAAA;AAAA,QAEP;AAAA,UACE,GAAA,EAAK,yBAAA;AAAA,UACL,KAAA,EAAO,QAAA,CAAS,OAAA,EAAS,GAAG;AAAA,QAC9B,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,wBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAClB,CAAC,EAAA,EACD;AAAA,UACE;AAAA,YACE,GAAA,EAAK,2BAAA;AAAA,YACL,KAAA,EAAO;AAAA,UACT;AAAA,QACF,CAAA;AAAA;AAAA,QAEJ;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,oBAAA;AAAA,UACL,KAAA,EAAO,CAAA,QAAA,EAAW,MAAM,CAAA,gCAAA;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAhDgB,qCAAA,oBAAA,EAAA,sBAAA,CAAA;AFwIhB;AACA;AGnHA,SAAS,iBAAA,CAAkB,GAAA,EAAyC;AAClE,EAAA,OAAO,GAAA,CAAI,cAAA,EACP,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,GAAA,EAAA,GAAQ;AACxC,IAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAU,KAAK,EAAA,EAAI,IAAI,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AACvD,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,MAClC,QAAA;AAAA,MACA,IAAA,EAAM,KAAA,GAAQ,KAAA;AAAA,IAChB,CAAA;AAAA,EACF,CAAC,EAAA,EACD,CAAC,CAAA;AACP;AAXS,qCAAA,iBAAA,EAAA,mBAAA,CAAA;AAaF,SAAS,gBAAA,CAAiB,OAAA,EAA2C;AAC1E,EAAA,MAAM,IAAA,EAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,cAAA,EAAgB,OAAA,CAAQ,cAAA,IAAkB,IAAA;AAEhD,EAAA,MAAM,OAAA,EAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,EAAE,OAAA,EAAS,YAAY,EAAA,EAAI,CAAC,CAAA;AAAA,IAC3D,eAAA,EAAiB,IAAA;AAAA,IACjB,kBAAA,EAAoB,IAAA;AAAA,IACpB,aAAA;AAAA,IACA,YAAA,EAAc;AAAA,MACZ,aAAA,EAAe;AAAA,QACb,aAAA,EAAe;AAAA,MACjB,CAAA;AAAA;AAAA;AAAA;AAAA,MAIA,cAAA,mBAAgB,OAAA,CAAQ,cAAA,UAAkB,MAAA;AAAA,MAC1C,WAAA,EAAa,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,cAAA,EAAgB,EAAE,0BAAA,EAA4B,KAAK,EAAA,EAAI,CAAC;AAAA,IAC9D,CAAA;AAAA,IACA,iBAAA,EAAmB,OAAA,CAAQ,UAAA;AAAA,IAC3B,cAAA,EAAgB,OAAA,CAAQ,IAAA,EAAM,CAAC,IAAA,EAAM,KAAA,EAAO,KAAK,EAAA,EAAI,CAAC,IAAA,EAAM,KAAK,CAAA;AAAA,IACjE,MAAA,EAAQ;AAAA,MACN,eAAA,mBAAiB,OAAA,CAAQ,oBAAA,UAAwB,IAAA;AAAA,MACjD,cAAA,EAAgB,iBAAA,CAAkB,GAAG,CAAA;AAAA,MACrC,uBAAA,EAAyB;AAAA,IAC3B,CAAA;AAAA,IACA,eAAA,EAAiB,KAAA;AAAA,IACjB,eAAA,EAAiB,KAAA;AAAA,IACjB,GAAA,EAAK;AAAA,MACH,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,4BAAA,mBAA8B,GAAA,CAAI,4BAAA,UAAgC,IAAA;AAAA,MAClE,+BAAA,mBAAiC,GAAA,CAAI,+BAAA,UAAmC,IAAA;AAAA,MACxE,GAAG,OAAA,CAAQ;AAAA,IACb,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,OAAA,CAAQ,QAAA,EAAU,EAAE,sBAAA,EAAwB,CAAC,SAAA,EAAW,cAAc,EAAE,EAAA,EAAI,CAAC,CAAA;AAAA;AAAA;AAAA,IAGjF,SAAA,EAAW;AAAA,MACT,YAAA,EAAc;AAAA,QACZ,GAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,KAAA,EAAO;AACrC,IAAA,MAAA,CAAO,QAAA,EAAU,MAAA,CAAA,EAAA,GAAY,oBAAA,CAAqB,OAAA,EAAS,OAAA,CAAQ,GAAG,CAAA;AAAA,EACxE;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,QAAA;AAEhD,EAAA,OAAO,OAAA,CAAQ,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,MAAM,EAAA,EAAI,MAAA;AACnD;AArEgB,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AHqLhB;AACE;AACA;AACF,yEAAC","file":"/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","sourcesContent":[null,"// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n * `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n services?: CspService[];\n csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n stripe: {\n \"script-src\": [\"https://js.stripe.com\"],\n \"img-src\": [\"https://*.stripe.com\"],\n \"connect-src\": [\"https://api.stripe.com\"],\n \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n },\n googleMaps: {\n \"script-src\": [\"https://maps.googleapis.com\"],\n \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n },\n turnstile: {\n \"script-src\": [\"https://challenges.cloudflare.com\"],\n \"connect-src\": [\"https://challenges.cloudflare.com\"],\n \"frame-src\": [\"https://challenges.cloudflare.com\"],\n },\n discord: {\n \"img-src\": [\"https://cdn.discordapp.com\"],\n },\n googleFonts: {\n \"style-src\": [\"https://fonts.googleapis.com\"],\n \"font-src\": [\"https://fonts.gstatic.com\"],\n },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n const imageSources = listImageSources(env);\n const services = options.services ?? [];\n\n // Each fetch directive: what Next itself needs, then the named services, then\n // the app's extras, then the sources derived from the env.\n const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n // Scripts: self, and unsafe-inline/eval for Next.js\n \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n // Styles: self and unsafe-inline for styled-components/emotion\n \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n // Images: self, data URIs, blobs, and configured image sources\n \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: imageSources },\n // Fonts: self\n \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n \"connect-src\": {\n base: [\"'self'\"],\n fromEnv: [\n apiUrl,\n // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n apiUrl.replace(/^http/, \"ws\"),\n env.NEXT_PUBLIC_ADDRESS || \"\",\n ...imageSources,\n ],\n },\n // Frames: self\n \"frame-src\": { base: [\"'self'\"], fromEnv: [] },\n // Worker sources: self and blob (for Web Workers with dynamic imports)\n \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n };\n\n const directive = (name: CspDirective): string => {\n const { base, fromEnv } = fetchDirectives[name];\n const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n (source) => source !== \"\",\n );\n return [name, ...new Set(sources)].join(\" \");\n };\n\n return [\n \"default-src 'self'\",\n directive(\"script-src\"),\n directive(\"style-src\"),\n directive(\"img-src\"),\n directive(\"font-src\"),\n directive(\"connect-src\"),\n directive(\"frame-src\"),\n // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n \"frame-ancestors 'none'\",\n // Form actions: only self\n \"form-action 'self'\",\n // Base URI: only self\n \"base-uri 'self'\",\n // Object sources: none (no plugins)\n \"object-src 'none'\",\n directive(\"worker-src\"),\n // Upgrade insecure requests in production.\n //\n // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n // and serves it over plain http on a custom hostname. With this directive\n // the browser rewrites every /_next/static asset to https, which nothing is\n // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n // never hydrates, and each spec sees only server-rendered markup.\n env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n ]\n .filter(Boolean)\n .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n source: string;\n headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n return [\n {\n // Apply to all routes\n source: \"/:path*\",\n headers: [\n // Content Security Policy - prevents XSS attacks\n {\n key: \"Content-Security-Policy\",\n value: buildCsp(options, env),\n },\n // X-Frame-Options - prevents clickjacking (backup for older browsers)\n {\n key: \"X-Frame-Options\",\n value: \"DENY\",\n },\n // X-Content-Type-Options - prevents MIME sniffing\n {\n key: \"X-Content-Type-Options\",\n value: \"nosniff\",\n },\n // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n // the suite speaks plain http, and an HSTS pin would force https on every\n // later request to this host from the same browser profile.\n ...(env.E2E_BUILD === \"true\"\n ? []\n : [\n {\n key: \"Strict-Transport-Security\",\n value: \"max-age=31536000; includeSubDomains\",\n },\n ]),\n // Referrer-Policy - controls referrer information\n {\n key: \"Referrer-Policy\",\n value: \"strict-origin-when-cross-origin\",\n },\n // Permissions-Policy - restricts browser features\n {\n key: \"Permissions-Policy\",\n value: `camera=(${camera}), microphone=(), geolocation=()`,\n },\n ],\n },\n ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n devOrigins: string[];\n /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n services?: CspService[];\n /** Extra CSP sources per directive, for hosts no named service covers. */\n csp?: Partial<Record<CspDirective, string[]>>;\n env?: Record<string, string>;\n imageMinimumCacheTTL?: number;\n permissionsPolicy?: { camera?: \"none\" | \"self\" };\n mdx?: boolean;\n serwist?: boolean;\n securityHeaders?: boolean;\n authInterrupts?: boolean;\n reactCompiler?: boolean;\n rewrites?: NextConfig[\"rewrites\"];\n extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n return env.IMAGE_SOURCES\n ? env.IMAGE_SOURCES.split(\",\").map((url) => {\n const { hostname, protocol, port } = new URL(url.trim());\n return {\n protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n hostname,\n port: port || undefined,\n };\n })\n : [];\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n const env = process.env;\n const reactCompiler = options.reactCompiler === true;\n\n const config: NextConfig = {\n // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n // `next dev` server may still be running against the same worktree. `next\n // build` and `next dev` share `.next`, so a build performed underneath a live\n // dev server clobbers it and that dev server then 404s every route. Giving\n // the e2e build its own directory keeps the two independent. E2E_BUILD must\n // be set for `next build` AND for `next start`, or `start` looks in `.next`\n // and serves someone else's output.\n ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n cacheComponents: true,\n partialPrefetching: true,\n reactCompiler,\n experimental: {\n serverActions: {\n bodySizeLimit: \"5mb\",\n },\n // Required by `unauthorized()` (next/navigation), which ServerSession.checkPermission\n // calls to deny access. Without this flag the function throws a plain Error instead of\n // rendering the nearest unauthorized.tsx.\n authInterrupts: options.authInterrupts ?? true,\n turbopackGc: true,\n // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n // imported request module unactivated (\"Lazily compiled dynamic import of ...\n // JsonApiRequest ... was not activated\"), so every client-side read returns\n // nothing. Seen with the package installed from npm; production builds are unaffected.\n ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n },\n allowedDevOrigins: options.devOrigins,\n pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n images: {\n minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n remotePatterns: parseImageSources(env),\n dangerouslyAllowLocalIP: true,\n },\n poweredByHeader: false,\n reactStrictMode: false,\n env: {\n NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n ...options.env,\n },\n // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n // does nothing but append these two entries. Requiring the package here\n // instead CRASHES production: it is a devDependency, next.config.js is loaded\n // at RUNTIME by `next start`, and the web-production image installs with\n // --prod. Do not re-add a require of any devDependency to this file.\n ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n // single instance in both modes.\n turbopack: {\n resolveAlias: {\n yjs: \"./node_modules/yjs\",\n },\n },\n };\n\n if (options.securityHeaders !== false) {\n config.headers = async () => buildSecurityHeaders(options, process.env);\n }\n\n if (options.rewrites) config.rewrites = options.rewrites;\n\n return options.extend ? options.extend(config) : config;\n}\n"]}
package/dist/next-config/index.mjs CHANGED
@@ -183,7 +183,10 @@ function createNextConfig(options) {
183
183
  // rendering the nearest unauthorized.tsx.
184
184
  authInterrupts: options.authInterrupts ?? true,
185
185
  turbopackGc: true,
186
- turbopackLazyDynamicImports: true,
186
+ // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily
187
+ // imported request module unactivated ("Lazily compiled dynamic import of ...
188
+ // JsonApiRequest ... was not activated"), so every client-side read returns
189
+ // nothing. Seen with the package installed from npm; production builds are unaffected.
187
190
  ...reactCompiler ? { turbopackRustReactCompiler: true } : {}
188
191
  },
189
192
  allowedDevOrigins: options.devOrigins,
package/dist/next-config/index.mjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"sourcesContent":["// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n * `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n services?: CspService[];\n csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n stripe: {\n \"script-src\": [\"https://js.stripe.com\"],\n \"img-src\": [\"https://*.stripe.com\"],\n \"connect-src\": [\"https://api.stripe.com\"],\n \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n },\n googleMaps: {\n \"script-src\": [\"https://maps.googleapis.com\"],\n \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n },\n turnstile: {\n \"script-src\": [\"https://challenges.cloudflare.com\"],\n \"connect-src\": [\"https://challenges.cloudflare.com\"],\n \"frame-src\": [\"https://challenges.cloudflare.com\"],\n },\n discord: {\n \"img-src\": [\"https://cdn.discordapp.com\"],\n },\n googleFonts: {\n \"style-src\": [\"https://fonts.googleapis.com\"],\n \"font-src\": [\"https://fonts.gstatic.com\"],\n },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n const imageSources = listImageSources(env);\n const services = options.services ?? [];\n\n // Each fetch directive: what Next itself needs, then the named services, then\n // the app's extras, then the sources derived from the env.\n const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n // Scripts: self, and unsafe-inline/eval for Next.js\n \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n // Styles: self and unsafe-inline for styled-components/emotion\n \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n // Images: self, data URIs, blobs, and configured image sources\n \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: imageSources },\n // Fonts: self\n \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n \"connect-src\": {\n base: [\"'self'\"],\n fromEnv: [\n apiUrl,\n // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n apiUrl.replace(/^http/, \"ws\"),\n env.NEXT_PUBLIC_ADDRESS || \"\",\n ...imageSources,\n ],\n },\n // Frames: self\n \"frame-src\": { base: [\"'self'\"], fromEnv: [] },\n // Worker sources: self and blob (for Web Workers with dynamic imports)\n \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n };\n\n const directive = (name: CspDirective): string => {\n const { base, fromEnv } = fetchDirectives[name];\n const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n (source) => source !== \"\",\n );\n return [name, ...new Set(sources)].join(\" \");\n };\n\n return [\n \"default-src 'self'\",\n directive(\"script-src\"),\n directive(\"style-src\"),\n directive(\"img-src\"),\n directive(\"font-src\"),\n directive(\"connect-src\"),\n directive(\"frame-src\"),\n // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n \"frame-ancestors 'none'\",\n // Form actions: only self\n \"form-action 'self'\",\n // Base URI: only self\n \"base-uri 'self'\",\n // Object sources: none (no plugins)\n \"object-src 'none'\",\n directive(\"worker-src\"),\n // Upgrade insecure requests in production.\n //\n // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n // and serves it over plain http on a custom hostname. With this directive\n // the browser rewrites every /_next/static asset to https, which nothing is\n // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n // never hydrates, and each spec sees only server-rendered markup.\n env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n ]\n .filter(Boolean)\n .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n source: string;\n headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n return [\n {\n // Apply to all routes\n source: \"/:path*\",\n headers: [\n // Content Security Policy - prevents XSS attacks\n {\n key: \"Content-Security-Policy\",\n value: buildCsp(options, env),\n },\n // X-Frame-Options - prevents clickjacking (backup for older browsers)\n {\n key: \"X-Frame-Options\",\n value: \"DENY\",\n },\n // X-Content-Type-Options - prevents MIME sniffing\n {\n key: \"X-Content-Type-Options\",\n value: \"nosniff\",\n },\n // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n // the suite speaks plain http, and an HSTS pin would force https on every\n // later request to this host from the same browser profile.\n ...(env.E2E_BUILD === \"true\"\n ? []\n : [\n {\n key: \"Strict-Transport-Security\",\n value: \"max-age=31536000; includeSubDomains\",\n },\n ]),\n // Referrer-Policy - controls referrer information\n {\n key: \"Referrer-Policy\",\n value: \"strict-origin-when-cross-origin\",\n },\n // Permissions-Policy - restricts browser features\n {\n key: \"Permissions-Policy\",\n value: `camera=(${camera}), microphone=(), geolocation=()`,\n },\n ],\n },\n ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n devOrigins: string[];\n /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n services?: CspService[];\n /** Extra CSP sources per directive, for hosts no named service covers. */\n csp?: Partial<Record<CspDirective, string[]>>;\n env?: Record<string, string>;\n imageMinimumCacheTTL?: number;\n permissionsPolicy?: { camera?: \"none\" | \"self\" };\n mdx?: boolean;\n serwist?: boolean;\n securityHeaders?: boolean;\n authInterrupts?: boolean;\n reactCompiler?: boolean;\n rewrites?: NextConfig[\"rewrites\"];\n extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n return env.IMAGE_SOURCES\n ? env.IMAGE_SOURCES.split(\",\").map((url) => {\n const { hostname, protocol, port } = new URL(url.trim());\n return {\n protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n hostname,\n port: port || undefined,\n };\n })\n : [];\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n const env = process.env;\n const reactCompiler = options.reactCompiler === true;\n\n const config: NextConfig = {\n // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n // `next dev` server may still be running against the same worktree. `next\n // build` and `next dev` share `.next`, so a build performed underneath a live\n // dev server clobbers it and that dev server then 404s every route. Giving\n // the e2e build its own directory keeps the two independent. E2E_BUILD must\n // be set for `next build` AND for `next start`, or `start` looks in `.next`\n // and serves someone else's output.\n ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n cacheComponents: true,\n partialPrefetching: true,\n reactCompiler,\n experimental: {\n serverActions: {\n bodySizeLimit: \"5mb\",\n },\n // Required by `unauthorized()` (next/navigation), which ServerSession.checkPermission\n // calls to deny access. Without this flag the function throws a plain Error instead of\n // rendering the nearest unauthorized.tsx.\n authInterrupts: options.authInterrupts ?? true,\n turbopackGc: true,\n turbopackLazyDynamicImports: true,\n ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n },\n allowedDevOrigins: options.devOrigins,\n pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n images: {\n minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n remotePatterns: parseImageSources(env),\n dangerouslyAllowLocalIP: true,\n },\n poweredByHeader: false,\n reactStrictMode: false,\n env: {\n NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n ...options.env,\n },\n // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n // does nothing but append these two entries. Requiring the package here\n // instead CRASHES production: it is a devDependency, next.config.js is loaded\n // at RUNTIME by `next start`, and the web-production image installs with\n // --prod. Do not re-add a require of any devDependency to this file.\n ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n // single instance in both modes.\n turbopack: {\n resolveAlias: {\n yjs: \"./node_modules/yjs\",\n },\n },\n };\n\n if (options.securityHeaders !== false) {\n config.headers = async () => buildSecurityHeaders(options, process.env);\n }\n\n if (options.rewrites) config.rewrites = options.rewrites;\n\n return options.extend ? options.extend(config) : config;\n}\n"],"mappings":";;;;;AAwBA,IAAM,kBAA+E;AAAA,EACnF,QAAQ;AAAA,IACN,cAAc,CAAC,uBAAuB;AAAA,IACtC,WAAW,CAAC,sBAAsB;AAAA,IAClC,eAAe,CAAC,wBAAwB;AAAA,IACxC,aAAa,CAAC,yBAAyB,0BAA0B;AAAA,EACnE;AAAA,EACA,YAAY;AAAA,IACV,cAAc,CAAC,6BAA6B;AAAA,IAC5C,WAAW,CAAC,+BAA+B,0BAA0B;AAAA,IACrE,eAAe,CAAC,+BAA+B,+BAA+B;AAAA,EAChF;AAAA,EACA,WAAW;AAAA,IACT,cAAc,CAAC,mCAAmC;AAAA,IAClD,eAAe,CAAC,mCAAmC;AAAA,IACnD,aAAa,CAAC,mCAAmC;AAAA,EACnD;AAAA,EACA,SAAS;AAAA,IACP,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA,aAAa;AAAA,IACX,aAAa,CAAC,8BAA8B;AAAA,IAC5C,YAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF;AAEA,SAAS,iBAAiB,KAAkC;AAC1D,SAAO,IAAI,gBAAgB,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAClF;AAFS;AAOF,SAAS,SAAS,SAAqB,KAAgC;AAC5E,QAAM,SAAS,IAAI,uBAAuB;AAC1C,QAAM,eAAe,iBAAiB,GAAG;AACzC,QAAM,WAAW,QAAQ,YAAY,CAAC;AAItC,QAAM,kBAA+E;AAAA;AAAA,IAEnF,cAAc,EAAE,MAAM,CAAC,UAAU,mBAAmB,eAAe,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAElF,aAAa,EAAE,MAAM,CAAC,UAAU,iBAAiB,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAEhE,WAAW,EAAE,MAAM,CAAC,UAAU,SAAS,OAAO,GAAG,SAAS,aAAa;AAAA;AAAA,IAEvE,YAAY,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE5C,eAAe;AAAA,MACb,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,QACP;AAAA;AAAA,QAEA,OAAO,QAAQ,SAAS,IAAI;AAAA,QAC5B,IAAI,uBAAuB;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF;AAAA;AAAA,IAEA,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE7C,cAAc,EAAE,MAAM,CAAC,UAAU,OAAO,GAAG,SAAS,CAAC,EAAE;AAAA,EACzD;AAEA,QAAM,YAAY,wBAAC,SAA+B;AAChD,UAAM,EAAE,MAAM,QAAQ,IAAI,gBAAgB,IAAI;AAC9C,UAAM,eAAe,SAAS,QAAQ,CAAC,YAAY,gBAAgB,OAAO,EAAE,IAAI,KAAK,CAAC,CAAC;AACvF,UAAM,UAAU,CAAC,GAAG,MAAM,GAAG,cAAc,GAAI,QAAQ,MAAM,IAAI,KAAK,CAAC,GAAI,GAAG,OAAO,EAAE;AAAA,MACrF,CAAC,WAAW,WAAW;AAAA,IACzB;AACA,WAAO,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,EAC7C,GAPkB;AASlB,SAAO;AAAA,IACL;AAAA,IACA,UAAU,YAAY;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,UAAU,SAAS;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,UAAU,aAAa;AAAA,IACvB,UAAU,WAAW;AAAA;AAAA,IAErB;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA,IACA,UAAU,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,IAAI,aAAa,gBAAgB,IAAI,cAAc,SAAS,8BAA8B;AAAA,EAC5F,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACd;AAtEgB;;;AC7CT,SAAS,qBAAqB,SAAgC,KAAsC;AACzG,QAAM,SAAS,QAAQ,mBAAmB,WAAW,SAAS,KAAK;AAEnE,SAAO;AAAA,IACL;AAAA;AAAA,MAEE,QAAQ;AAAA,MACR,SAAS;AAAA;AAAA,QAEP;AAAA,UACE,KAAK;AAAA,UACL,OAAO,SAAS,SAAS,GAAG;AAAA,QAC9B;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,IAAI,cAAc,SAClB,CAAC,IACD;AAAA,UACE;AAAA,YACE,KAAK;AAAA,YACL,OAAO;AAAA,UACT;AAAA,QACF;AAAA;AAAA,QAEJ;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO,WAAW,MAAM;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;;;ACsBhB,SAAS,kBAAkB,KAAyC;AAClE,SAAO,IAAI,gBACP,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,QAAQ;AACxC,UAAM,EAAE,UAAU,UAAU,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACvD,WAAO;AAAA,MACL,UAAU,SAAS,QAAQ,KAAK,EAAE;AAAA,MAClC;AAAA,MACA,MAAM,QAAQ;AAAA,IAChB;AAAA,EACF,CAAC,IACD,CAAC;AACP;AAXS;AAaF,SAAS,iBAAiB,SAA2C;AAC1E,QAAM,MAAM,QAAQ;AACpB,QAAM,gBAAgB,QAAQ,kBAAkB;AAEhD,QAAM,SAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,IAAI,cAAc,SAAS,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,IAC3D,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB;AAAA,IACA,cAAc;AAAA,MACZ,eAAe;AAAA,QACb,eAAe;AAAA,MACjB;AAAA;AAAA;AAAA;AAAA,MAIA,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,aAAa;AAAA,MACb,6BAA6B;AAAA,MAC7B,GAAI,gBAAgB,EAAE,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC9D;AAAA,IACA,mBAAmB,QAAQ;AAAA,IAC3B,gBAAgB,QAAQ,MAAM,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AAAA,IACjE,QAAQ;AAAA,MACN,iBAAiB,QAAQ,wBAAwB;AAAA,MACjD,gBAAgB,kBAAkB,GAAG;AAAA,MACrC,yBAAyB;AAAA,IAC3B;AAAA,IACA,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,KAAK;AAAA,MACH,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,8BAA8B,IAAI,gCAAgC;AAAA,MAClE,iCAAiC,IAAI,mCAAmC;AAAA,MACxE,GAAG,QAAQ;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,QAAQ,UAAU,EAAE,wBAAwB,CAAC,WAAW,cAAc,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,IAGjF,WAAW;AAAA,MACT,cAAc;AAAA,QACZ,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,oBAAoB,OAAO;AACrC,WAAO,UAAU,YAAY,qBAAqB,SAAS,QAAQ,GAAG;AAAA,EACxE;AAEA,MAAI,QAAQ,SAAU,QAAO,WAAW,QAAQ;AAEhD,SAAO,QAAQ,SAAS,QAAQ,OAAO,MAAM,IAAI;AACnD;AAlEgB;","names":[]}
1
+ {"version":3,"sources":["../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"sourcesContent":["// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n * `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n services?: CspService[];\n csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n stripe: {\n \"script-src\": [\"https://js.stripe.com\"],\n \"img-src\": [\"https://*.stripe.com\"],\n \"connect-src\": [\"https://api.stripe.com\"],\n \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n },\n googleMaps: {\n \"script-src\": [\"https://maps.googleapis.com\"],\n \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n },\n turnstile: {\n \"script-src\": [\"https://challenges.cloudflare.com\"],\n \"connect-src\": [\"https://challenges.cloudflare.com\"],\n \"frame-src\": [\"https://challenges.cloudflare.com\"],\n },\n discord: {\n \"img-src\": [\"https://cdn.discordapp.com\"],\n },\n googleFonts: {\n \"style-src\": [\"https://fonts.googleapis.com\"],\n \"font-src\": [\"https://fonts.gstatic.com\"],\n },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n const imageSources = listImageSources(env);\n const services = options.services ?? [];\n\n // Each fetch directive: what Next itself needs, then the named services, then\n // the app's extras, then the sources derived from the env.\n const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n // Scripts: self, and unsafe-inline/eval for Next.js\n \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n // Styles: self and unsafe-inline for styled-components/emotion\n \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n // Images: self, data URIs, blobs, and configured image sources\n \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: imageSources },\n // Fonts: self\n \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n \"connect-src\": {\n base: [\"'self'\"],\n fromEnv: [\n apiUrl,\n // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n apiUrl.replace(/^http/, \"ws\"),\n env.NEXT_PUBLIC_ADDRESS || \"\",\n ...imageSources,\n ],\n },\n // Frames: self\n \"frame-src\": { base: [\"'self'\"], fromEnv: [] },\n // Worker sources: self and blob (for Web Workers with dynamic imports)\n \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n };\n\n const directive = (name: CspDirective): string => {\n const { base, fromEnv } = fetchDirectives[name];\n const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n (source) => source !== \"\",\n );\n return [name, ...new Set(sources)].join(\" \");\n };\n\n return [\n \"default-src 'self'\",\n directive(\"script-src\"),\n directive(\"style-src\"),\n directive(\"img-src\"),\n directive(\"font-src\"),\n directive(\"connect-src\"),\n directive(\"frame-src\"),\n // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n \"frame-ancestors 'none'\",\n // Form actions: only self\n \"form-action 'self'\",\n // Base URI: only self\n \"base-uri 'self'\",\n // Object sources: none (no plugins)\n \"object-src 'none'\",\n directive(\"worker-src\"),\n // Upgrade insecure requests in production.\n //\n // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n // and serves it over plain http on a custom hostname. With this directive\n // the browser rewrites every /_next/static asset to https, which nothing is\n // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n // never hydrates, and each spec sees only server-rendered markup.\n env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n ]\n .filter(Boolean)\n .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n source: string;\n headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n return [\n {\n // Apply to all routes\n source: \"/:path*\",\n headers: [\n // Content Security Policy - prevents XSS attacks\n {\n key: \"Content-Security-Policy\",\n value: buildCsp(options, env),\n },\n // X-Frame-Options - prevents clickjacking (backup for older browsers)\n {\n key: \"X-Frame-Options\",\n value: \"DENY\",\n },\n // X-Content-Type-Options - prevents MIME sniffing\n {\n key: \"X-Content-Type-Options\",\n value: \"nosniff\",\n },\n // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n // the suite speaks plain http, and an HSTS pin would force https on every\n // later request to this host from the same browser profile.\n ...(env.E2E_BUILD === \"true\"\n ? []\n : [\n {\n key: \"Strict-Transport-Security\",\n value: \"max-age=31536000; includeSubDomains\",\n },\n ]),\n // Referrer-Policy - controls referrer information\n {\n key: \"Referrer-Policy\",\n value: \"strict-origin-when-cross-origin\",\n },\n // Permissions-Policy - restricts browser features\n {\n key: \"Permissions-Policy\",\n value: `camera=(${camera}), microphone=(), geolocation=()`,\n },\n ],\n },\n ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n devOrigins: string[];\n /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n services?: CspService[];\n /** Extra CSP sources per directive, for hosts no named service covers. */\n csp?: Partial<Record<CspDirective, string[]>>;\n env?: Record<string, string>;\n imageMinimumCacheTTL?: number;\n permissionsPolicy?: { camera?: \"none\" | \"self\" };\n mdx?: boolean;\n serwist?: boolean;\n securityHeaders?: boolean;\n authInterrupts?: boolean;\n reactCompiler?: boolean;\n rewrites?: NextConfig[\"rewrites\"];\n extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n return env.IMAGE_SOURCES\n ? env.IMAGE_SOURCES.split(\",\").map((url) => {\n const { hostname, protocol, port } = new URL(url.trim());\n return {\n protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n hostname,\n port: port || undefined,\n };\n })\n : [];\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n const env = process.env;\n const reactCompiler = options.reactCompiler === true;\n\n const config: NextConfig = {\n // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n // `next dev` server may still be running against the same worktree. `next\n // build` and `next dev` share `.next`, so a build performed underneath a live\n // dev server clobbers it and that dev server then 404s every route. Giving\n // the e2e build its own directory keeps the two independent. E2E_BUILD must\n // be set for `next build` AND for `next start`, or `start` looks in `.next`\n // and serves someone else's output.\n ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n cacheComponents: true,\n partialPrefetching: true,\n reactCompiler,\n experimental: {\n serverActions: {\n bodySizeLimit: \"5mb\",\n },\n // Required by `unauthorized()` (next/navigation), which ServerSession.checkPermission\n // calls to deny access. Without this flag the function throws a plain Error instead of\n // rendering the nearest unauthorized.tsx.\n authInterrupts: options.authInterrupts ?? true,\n turbopackGc: true,\n // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n // imported request module unactivated (\"Lazily compiled dynamic import of ...\n // JsonApiRequest ... was not activated\"), so every client-side read returns\n // nothing. Seen with the package installed from npm; production builds are unaffected.\n ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n },\n allowedDevOrigins: options.devOrigins,\n pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n images: {\n minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n remotePatterns: parseImageSources(env),\n dangerouslyAllowLocalIP: true,\n },\n poweredByHeader: false,\n reactStrictMode: false,\n env: {\n NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n ...options.env,\n },\n // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n // does nothing but append these two entries. Requiring the package here\n // instead CRASHES production: it is a devDependency, next.config.js is loaded\n // at RUNTIME by `next start`, and the web-production image installs with\n // --prod. Do not re-add a require of any devDependency to this file.\n ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n // single instance in both modes.\n turbopack: {\n resolveAlias: {\n yjs: \"./node_modules/yjs\",\n },\n },\n };\n\n if (options.securityHeaders !== false) {\n config.headers = async () => buildSecurityHeaders(options, process.env);\n }\n\n if (options.rewrites) config.rewrites = options.rewrites;\n\n return options.extend ? options.extend(config) : config;\n}\n"],"mappings":";;;;;AAwBA,IAAM,kBAA+E;AAAA,EACnF,QAAQ;AAAA,IACN,cAAc,CAAC,uBAAuB;AAAA,IACtC,WAAW,CAAC,sBAAsB;AAAA,IAClC,eAAe,CAAC,wBAAwB;AAAA,IACxC,aAAa,CAAC,yBAAyB,0BAA0B;AAAA,EACnE;AAAA,EACA,YAAY;AAAA,IACV,cAAc,CAAC,6BAA6B;AAAA,IAC5C,WAAW,CAAC,+BAA+B,0BAA0B;AAAA,IACrE,eAAe,CAAC,+BAA+B,+BAA+B;AAAA,EAChF;AAAA,EACA,WAAW;AAAA,IACT,cAAc,CAAC,mCAAmC;AAAA,IAClD,eAAe,CAAC,mCAAmC;AAAA,IACnD,aAAa,CAAC,mCAAmC;AAAA,EACnD;AAAA,EACA,SAAS;AAAA,IACP,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA,aAAa;AAAA,IACX,aAAa,CAAC,8BAA8B;AAAA,IAC5C,YAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF;AAEA,SAAS,iBAAiB,KAAkC;AAC1D,SAAO,IAAI,gBAAgB,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAClF;AAFS;AAOF,SAAS,SAAS,SAAqB,KAAgC;AAC5E,QAAM,SAAS,IAAI,uBAAuB;AAC1C,QAAM,eAAe,iBAAiB,GAAG;AACzC,QAAM,WAAW,QAAQ,YAAY,CAAC;AAItC,QAAM,kBAA+E;AAAA;AAAA,IAEnF,cAAc,EAAE,MAAM,CAAC,UAAU,mBAAmB,eAAe,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAElF,aAAa,EAAE,MAAM,CAAC,UAAU,iBAAiB,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAEhE,WAAW,EAAE,MAAM,CAAC,UAAU,SAAS,OAAO,GAAG,SAAS,aAAa;AAAA;AAAA,IAEvE,YAAY,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE5C,eAAe;AAAA,MACb,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,QACP;AAAA;AAAA,QAEA,OAAO,QAAQ,SAAS,IAAI;AAAA,QAC5B,IAAI,uBAAuB;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF;AAAA;AAAA,IAEA,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE7C,cAAc,EAAE,MAAM,CAAC,UAAU,OAAO,GAAG,SAAS,CAAC,EAAE;AAAA,EACzD;AAEA,QAAM,YAAY,wBAAC,SAA+B;AAChD,UAAM,EAAE,MAAM,QAAQ,IAAI,gBAAgB,IAAI;AAC9C,UAAM,eAAe,SAAS,QAAQ,CAAC,YAAY,gBAAgB,OAAO,EAAE,IAAI,KAAK,CAAC,CAAC;AACvF,UAAM,UAAU,CAAC,GAAG,MAAM,GAAG,cAAc,GAAI,QAAQ,MAAM,IAAI,KAAK,CAAC,GAAI,GAAG,OAAO,EAAE;AAAA,MACrF,CAAC,WAAW,WAAW;AAAA,IACzB;AACA,WAAO,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,EAC7C,GAPkB;AASlB,SAAO;AAAA,IACL;AAAA,IACA,UAAU,YAAY;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,UAAU,SAAS;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,UAAU,aAAa;AAAA,IACvB,UAAU,WAAW;AAAA;AAAA,IAErB;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA,IACA,UAAU,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,IAAI,aAAa,gBAAgB,IAAI,cAAc,SAAS,8BAA8B;AAAA,EAC5F,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACd;AAtEgB;;;AC7CT,SAAS,qBAAqB,SAAgC,KAAsC;AACzG,QAAM,SAAS,QAAQ,mBAAmB,WAAW,SAAS,KAAK;AAEnE,SAAO;AAAA,IACL;AAAA;AAAA,MAEE,QAAQ;AAAA,MACR,SAAS;AAAA;AAAA,QAEP;AAAA,UACE,KAAK;AAAA,UACL,OAAO,SAAS,SAAS,GAAG;AAAA,QAC9B;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,IAAI,cAAc,SAClB,CAAC,IACD;AAAA,UACE;AAAA,YACE,KAAK;AAAA,YACL,OAAO;AAAA,UACT;AAAA,QACF;AAAA;AAAA,QAEJ;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO,WAAW,MAAM;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;;;ACsBhB,SAAS,kBAAkB,KAAyC;AAClE,SAAO,IAAI,gBACP,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,QAAQ;AACxC,UAAM,EAAE,UAAU,UAAU,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACvD,WAAO;AAAA,MACL,UAAU,SAAS,QAAQ,KAAK,EAAE;AAAA,MAClC;AAAA,MACA,MAAM,QAAQ;AAAA,IAChB;AAAA,EACF,CAAC,IACD,CAAC;AACP;AAXS;AAaF,SAAS,iBAAiB,SAA2C;AAC1E,QAAM,MAAM,QAAQ;AACpB,QAAM,gBAAgB,QAAQ,kBAAkB;AAEhD,QAAM,SAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,IAAI,cAAc,SAAS,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,IAC3D,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB;AAAA,IACA,cAAc;AAAA,MACZ,eAAe;AAAA,QACb,eAAe;AAAA,MACjB;AAAA;AAAA;AAAA;AAAA,MAIA,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,gBAAgB,EAAE,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC9D;AAAA,IACA,mBAAmB,QAAQ;AAAA,IAC3B,gBAAgB,QAAQ,MAAM,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AAAA,IACjE,QAAQ;AAAA,MACN,iBAAiB,QAAQ,wBAAwB;AAAA,MACjD,gBAAgB,kBAAkB,GAAG;AAAA,MACrC,yBAAyB;AAAA,IAC3B;AAAA,IACA,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,KAAK;AAAA,MACH,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,8BAA8B,IAAI,gCAAgC;AAAA,MAClE,iCAAiC,IAAI,mCAAmC;AAAA,MACxE,GAAG,QAAQ;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,QAAQ,UAAU,EAAE,wBAAwB,CAAC,WAAW,cAAc,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,IAGjF,WAAW;AAAA,MACT,cAAc;AAAA,QACZ,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,oBAAoB,OAAO;AACrC,WAAO,UAAU,YAAY,qBAAqB,SAAS,QAAQ,GAAG;AAAA,EACxE;AAEA,MAAI,QAAQ,SAAU,QAAO,WAAW,QAAQ;AAEhD,SAAO,QAAQ,SAAS,QAAQ,OAAO,MAAM,IAAI;AACnD;AArEgB;","names":[]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@carlonicora/nextjs-jsonapi",
3
- "version": "4.0.1",
3
+ "version": "4.0.2",
4
4
  "description": "Next.js JSON:API client with server/client support and caching",
5
5
  "author": "Carlo Nicora",
6
6
  "license": "GPL-3.0-or-later",
package/src/next-config/__tests__/createNextConfig.test.ts CHANGED
@@ -124,11 +124,12 @@ describe("createNextConfig: behaviour", () => {
124
124
  expect.objectContaining({
125
125
  authInterrupts: true,
126
126
  turbopackGc: true,
127
- turbopackLazyDynamicImports: true,
128
127
  serverActions: { bodySizeLimit: "5mb" },
129
128
  }),
130
129
  );
131
130
  expect(config.experimental).not.toHaveProperty("useCache");
131
+ // Breaks client-side reads of this package in `next dev` (unactivated lazy import).
132
+ expect(config.experimental).not.toHaveProperty("turbopackLazyDynamicImports");
132
133
  });
133
134
 
134
135
  it("derives pageExtensions, serverExternalPackages and images from the options and env", () => {
package/src/next-config/index.ts CHANGED
@@ -70,7 +70,10 @@ export function createNextConfig(options: NjaNextConfigOptions): NextConfig {
70
70
  // rendering the nearest unauthorized.tsx.
71
71
  authInterrupts: options.authInterrupts ?? true,
72
72
  turbopackGc: true,
73
- turbopackLazyDynamicImports: true,
73
+ // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily
74
+ // imported request module unactivated ("Lazily compiled dynamic import of ...
75
+ // JsonApiRequest ... was not activated"), so every client-side read returns
76
+ // nothing. Seen with the package installed from npm; production builds are unaffected.
74
77
  ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),
75
78
  },
76
79
  allowedDevOrigins: options.devOrigins,