@carlonicora/nextjs-jsonapi 4.0.8 → 4.1.0

package/dist/next-config/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"names":[],"mappings":"AAAA;AACE;AACF,uDAA6B;AAC7B;AACA;ACoBA,IAAM,gBAAA,EAA+E;AAAA,EACnF,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,CAAC,uBAAuB,CAAA;AAAA,IACtC,SAAA,EAAW,CAAC,sBAAsB,CAAA;AAAA,IAClC,aAAA,EAAe,CAAC,wBAAwB,CAAA;AAAA,IACxC,WAAA,EAAa,CAAC,uBAAA,EAAyB,0BAA0B;AAAA,EACnE,CAAA;AAAA,EACA,UAAA,EAAY;AAAA,IACV,YAAA,EAAc,CAAC,6BAA6B,CAAA;AAAA,IAC5C,SAAA,EAAW,CAAC,6BAAA,EAA+B,0BAA0B,CAAA;AAAA,IACrE,aAAA,EAAe,CAAC,6BAAA,EAA+B,+BAA+B;AAAA,EAChF,CAAA;AAAA,EACA,SAAA,EAAW;AAAA,IACT,YAAA,EAAc,CAAC,mCAAmC,CAAA;AAAA,IAClD,aAAA,EAAe,CAAC,mCAAmC,CAAA;AAAA,IACnD,WAAA,EAAa,CAAC,mCAAmC;AAAA,EACnD,CAAA;AAAA,EACA,OAAA,EAAS;AAAA,IACP,SAAA,EAAW,CAAC,4BAA4B;AAAA,EAC1C,CAAA;AAAA,EACA,WAAA,EAAa;AAAA,IACX,WAAA,EAAa,CAAC,8BAA8B,CAAA;AAAA,IAC5C,UAAA,EAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF,CAAA;AAEA,SAAS,gBAAA,CAAiB,GAAA,EAAkC;AAC1D,EAAA,OAAO,GAAA,CAAI,cAAA,EAAgB,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,EAAA,GAAM,CAAA,CAAE,IAAA,CAAK,CAAC,EAAA,EAAI,CAAC,CAAA;AAClF;AAFS,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AAOF,SAAS,QAAA,CAAS,OAAA,EAAqB,GAAA,EAAgC;AAC5E,EAAA,MAAM,OAAA,EAAS,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAC1C,EAAA,MAAM,aAAA,EAAe,gBAAA,CAAiB,GAAG,CAAA;AACzC,EAAA,MAAM,SAAA,mBAAW,OAAA,CAAQ,QAAA,UAAY,CAAC,GAAA;AAItC,EAAA,MAAM,gBAAA,EAA+E;AAAA;AAAA,IAEnF,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAA,EAAmB,eAAe,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAElF,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAiB,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAEhE,SAAA,EAAW,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAA,EAAS,OAAO,CAAA,EAAG,OAAA,EAAS,aAAa,CAAA;AAAA;AAAA,IAEvE,UAAA,EAAY,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAE5C,aAAA,EAAe;AAAA,MACb,IAAA,EAAM,CAAC,QAAQ,CAAA;AAAA,MACf,OAAA,EAAS;AAAA,QACP,MAAA;AAAA;AAAA,QAEA,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,QAC5B,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF,CAAA;AAAA;AAAA,IAEA,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAE7C,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAO,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE;AAAA,EACzD,CAAA;AAEA,EAAA,MAAM,UAAA,kBAAY,qCAAA,CAAC,IAAA,EAAA,GAA+B;AAChD,IAAA,MAAM,EAAE,IAAA,EAAM,QAAQ,EAAA,EAAI,eAAA,CAAgB,IAAI,CAAA;AAC9C,IAAA,MAAM,aAAA,EAAe,QAAA,CAAS,OAAA,CAAQ,CAAC,OAAA,EAAA,oBAAY,eAAA,CAAgB,OAAO,CAAA,CAAE,IAAI,CAAA,UAAK,CAAC,GAAC,CAAA;AACvF,IAAA,MAAM,QAAA,EAAU,CAAC,GAAG,IAAA,EAAM,GAAG,YAAA,EAAc,oCAAI,OAAA,mBAAQ,GAAA,4BAAA,CAAM,IAAI,GAAA,UAAK,CAAC,GAAA,EAAI,GAAG,OAAO,CAAA,CAAE,MAAA;AAAA,MACrF,CAAC,MAAA,EAAA,GAAW,OAAA,IAAW;AAAA,IACzB,CAAA;AACA,IAAA,OAAO,CAAC,IAAA,EAAM,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7C,CAAA,EAPkB,WAAA,CAAA;AASlB,EAAA,OAAO;AAAA,IACL,oBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA,IACtB,SAAA,CAAU,WAAW,CAAA;AAAA,IACrB,SAAA,CAAU,SAAS,CAAA;AAAA,IACnB,SAAA,CAAU,UAAU,CAAA;AAAA,IACpB,SAAA,CAAU,aAAa,CAAA;AAAA,IACvB,SAAA,CAAU,WAAW,CAAA;AAAA;AAAA,IAErB,wBAAA;AAAA;AAAA,IAEA,oBAAA;AAAA;AAAA,IAEA,iBAAA;AAAA;AAAA,IAEA,mBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,GAAA,CAAI,SAAA,IAAa,aAAA,GAAgB,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,4BAAA,EAA8B;AAAA,EAC5F,CAAA,CACG,MAAA,CAAO,OAAO,CAAA,CACd,IAAA,CAAK,IAAI,CAAA;AACd;AAtEgB,qCAAA,QAAA,EAAA,UAAA,CAAA;AD0ChB;AACA;AExFO,SAAS,oBAAA,CAAqB,OAAA,EAAgC,GAAA,EAAsC;AACzG,EAAA,MAAM,OAAA,kBAAS,OAAA,qBAAQ,iBAAA,6BAAmB,SAAA,IAAW,OAAA,EAAS,GAAA,EAAK,MAAA;AAEnE,EAAA,OAAO;AAAA,IACL;AAAA;AAAA,MAEE,MAAA,EAAQ,SAAA;AAAA,MACR,OAAA,EAAS;AAAA;AAAA,QAEP;AAAA,UACE,GAAA,EAAK,yBAAA;AAAA,UACL,KAAA,EAAO,QAAA,CAAS,OAAA,EAAS,GAAG;AAAA,QAC9B,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,wBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAClB,CAAC,EAAA,EACD;AAAA,UACE;AAAA,YACE,GAAA,EAAK,2BAAA;AAAA,YACL,KAAA,EAAO;AAAA,UACT;AAAA,QACF,CAAA;AAAA;AAAA,QAEJ;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,oBAAA;AAAA,UACL,KAAA,EAAO,CAAA,QAAA,EAAW,MAAM,CAAA,gCAAA;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAhDgB,qCAAA,oBAAA,EAAA,sBAAA,CAAA;AFwIhB;AACA;AGnHA,SAAS,iBAAA,CAAkB,GAAA,EAAyC;AAClE,EAAA,OAAO,GAAA,CAAI,cAAA,EACP,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,GAAA,EAAA,GAAQ;AACxC,IAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAU,KAAK,EAAA,EAAI,IAAI,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AACvD,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,MAClC,QAAA;AAAA,MACA,IAAA,EAAM,KAAA,GAAQ,KAAA;AAAA,IAChB,CAAA;AAAA,EACF,CAAC,EAAA,EACD,CAAC,CAAA;AACP;AAXS,qCAAA,iBAAA,EAAA,mBAAA,CAAA;AAaF,SAAS,gBAAA,CAAiB,OAAA,EAA2C;AAC1E,EAAA,MAAM,IAAA,EAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,cAAA,EAAgB,OAAA,CAAQ,cAAA,IAAkB,IAAA;AAEhD,EAAA,MAAM,OAAA,EAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,EAAE,OAAA,EAAS,YAAY,EAAA,EAAI,CAAC,CAAA;AAAA,IAC3D,eAAA,EAAiB,IAAA;AAAA,IACjB,kBAAA,EAAoB,IAAA;AAAA,IACpB,aAAA;AAAA,IACA,YAAA,EAAc;AAAA,MACZ,aAAA,EAAe;AAAA,QACb,aAAA,EAAe;AAAA,MACjB,CAAA;AAAA;AAAA;AAAA;AAAA,MAIA,cAAA,mBAAgB,OAAA,CAAQ,cAAA,UAAkB,MAAA;AAAA,MAC1C,WAAA,EAAa,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,cAAA,EAAgB,EAAE,0BAAA,EAA4B,KAAK,EAAA,EAAI,CAAC;AAAA,IAC9D,CAAA;AAAA,IACA,iBAAA,EAAmB,OAAA,CAAQ,UAAA;AAAA,IAC3B,cAAA,EAAgB,OAAA,CAAQ,IAAA,EAAM,CAAC,IAAA,EAAM,KAAA,EAAO,KAAK,EAAA,EAAI,CAAC,IAAA,EAAM,KAAK,CAAA;AAAA,IACjE,MAAA,EAAQ;AAAA,MACN,eAAA,mBAAiB,OAAA,CAAQ,oBAAA,UAAwB,IAAA;AAAA,MACjD,cAAA,EAAgB,iBAAA,CAAkB,GAAG,CAAA;AAAA,MACrC,uBAAA,EAAyB;AAAA,IAC3B,CAAA;AAAA,IACA,eAAA,EAAiB,KAAA;AAAA,IACjB,eAAA,EAAiB,KAAA;AAAA,IACjB,GAAA,EAAK;AAAA,MACH,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,4BAAA,mBAA8B,GAAA,CAAI,4BAAA,UAAgC,IAAA;AAAA,MAClE,+BAAA,mBAAiC,GAAA,CAAI,+BAAA,UAAmC,IAAA;AAAA,MACxE,GAAG,OAAA,CAAQ;AAAA,IACb,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,OAAA,CAAQ,QAAA,EAAU,EAAE,sBAAA,EAAwB,CAAC,SAAA,EAAW,cAAc,EAAE,EAAA,EAAI,CAAC,CAAA;AAAA;AAAA;AAAA,IAGjF,SAAA,EAAW;AAAA,MACT,YAAA,EAAc;AAAA,QACZ,GAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,KAAA,EAAO;AACrC,IAAA,MAAA,CAAO,QAAA,EAAU,MAAA,CAAA,EAAA,GAAY,oBAAA,CAAqB,OAAA,EAAS,OAAA,CAAQ,GAAG,CAAA;AAAA,EACxE;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,QAAA;AAEhD,EAAA,OAAO,OAAA,CAAQ,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,MAAM,EAAA,EAAI,MAAA;AACnD;AArEgB,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AHqLhB;AACE;AACA;AACF,yEAAC","file":"/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","sourcesContent":[null,"// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n  \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n *   `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n  services?: CspService[];\n  csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n  stripe: {\n    \"script-src\": [\"https://js.stripe.com\"],\n    \"img-src\": [\"https://*.stripe.com\"],\n    \"connect-src\": [\"https://api.stripe.com\"],\n    \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n  },\n  googleMaps: {\n    \"script-src\": [\"https://maps.googleapis.com\"],\n    \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n    \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n  },\n  turnstile: {\n    \"script-src\": [\"https://challenges.cloudflare.com\"],\n    \"connect-src\": [\"https://challenges.cloudflare.com\"],\n    \"frame-src\": [\"https://challenges.cloudflare.com\"],\n  },\n  discord: {\n    \"img-src\": [\"https://cdn.discordapp.com\"],\n  },\n  googleFonts: {\n    \"style-src\": [\"https://fonts.googleapis.com\"],\n    \"font-src\": [\"https://fonts.gstatic.com\"],\n  },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n  const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n  const imageSources = listImageSources(env);\n  const services = options.services ?? [];\n\n  // Each fetch directive: what Next itself needs, then the named services, then\n  // the app's extras, then the sources derived from the env.\n  const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n    // Scripts: self, and unsafe-inline/eval for Next.js\n    \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n    // Styles: self and unsafe-inline for styled-components/emotion\n    \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n    // Images: self, data URIs, blobs, and configured image sources\n    \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: imageSources },\n    // Fonts: self\n    \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n    \"connect-src\": {\n      base: [\"'self'\"],\n      fromEnv: [\n        apiUrl,\n        // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n        apiUrl.replace(/^http/, \"ws\"),\n        env.NEXT_PUBLIC_ADDRESS || \"\",\n        ...imageSources,\n      ],\n    },\n    // Frames: self\n    \"frame-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Worker sources: self and blob (for Web Workers with dynamic imports)\n    \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n  };\n\n  const directive = (name: CspDirective): string => {\n    const { base, fromEnv } = fetchDirectives[name];\n    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n    const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n      (source) => source !== \"\",\n    );\n    return [name, ...new Set(sources)].join(\" \");\n  };\n\n  return [\n    \"default-src 'self'\",\n    directive(\"script-src\"),\n    directive(\"style-src\"),\n    directive(\"img-src\"),\n    directive(\"font-src\"),\n    directive(\"connect-src\"),\n    directive(\"frame-src\"),\n    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n    \"frame-ancestors 'none'\",\n    // Form actions: only self\n    \"form-action 'self'\",\n    // Base URI: only self\n    \"base-uri 'self'\",\n    // Object sources: none (no plugins)\n    \"object-src 'none'\",\n    directive(\"worker-src\"),\n    // Upgrade insecure requests in production.\n    //\n    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n    // and serves it over plain http on a custom hostname. With this directive\n    // the browser rewrites every /_next/static asset to https, which nothing is\n    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n    // never hydrates, and each spec sees only server-rendered markup.\n    env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n  ]\n    .filter(Boolean)\n    .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n  source: string;\n  headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n  const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n  return [\n    {\n      // Apply to all routes\n      source: \"/:path*\",\n      headers: [\n        // Content Security Policy - prevents XSS attacks\n        {\n          key: \"Content-Security-Policy\",\n          value: buildCsp(options, env),\n        },\n        // X-Frame-Options - prevents clickjacking (backup for older browsers)\n        {\n          key: \"X-Frame-Options\",\n          value: \"DENY\",\n        },\n        // X-Content-Type-Options - prevents MIME sniffing\n        {\n          key: \"X-Content-Type-Options\",\n          value: \"nosniff\",\n        },\n        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n        // the suite speaks plain http, and an HSTS pin would force https on every\n        // later request to this host from the same browser profile.\n        ...(env.E2E_BUILD === \"true\"\n          ? []\n          : [\n              {\n                key: \"Strict-Transport-Security\",\n                value: \"max-age=31536000; includeSubDomains\",\n              },\n            ]),\n        // Referrer-Policy - controls referrer information\n        {\n          key: \"Referrer-Policy\",\n          value: \"strict-origin-when-cross-origin\",\n        },\n        // Permissions-Policy - restricts browser features\n        {\n          key: \"Permissions-Policy\",\n          value: `camera=(${camera}), microphone=(), geolocation=()`,\n        },\n      ],\n    },\n  ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n  devOrigins: string[];\n  /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n  services?: CspService[];\n  /** Extra CSP sources per directive, for hosts no named service covers. */\n  csp?: Partial<Record<CspDirective, string[]>>;\n  env?: Record<string, string>;\n  imageMinimumCacheTTL?: number;\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n  mdx?: boolean;\n  serwist?: boolean;\n  securityHeaders?: boolean;\n  authInterrupts?: boolean;\n  reactCompiler?: boolean;\n  rewrites?: NextConfig[\"rewrites\"];\n  extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n  return env.IMAGE_SOURCES\n    ? env.IMAGE_SOURCES.split(\",\").map((url) => {\n        const { hostname, protocol, port } = new URL(url.trim());\n        return {\n          protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n          hostname,\n          port: port || undefined,\n        };\n      })\n    : [];\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n  const env = process.env;\n  const reactCompiler = options.reactCompiler === true;\n\n  const config: NextConfig = {\n    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n    // `next dev` server may still be running against the same worktree. `next\n    // build` and `next dev` share `.next`, so a build performed underneath a live\n    // dev server clobbers it and that dev server then 404s every route. Giving\n    // the e2e build its own directory keeps the two independent. E2E_BUILD must\n    // be set for `next build` AND for `next start`, or `start` looks in `.next`\n    // and serves someone else's output.\n    ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n    cacheComponents: true,\n    partialPrefetching: true,\n    reactCompiler,\n    experimental: {\n      serverActions: {\n        bodySizeLimit: \"5mb\",\n      },\n      // Required by `unauthorized()` (next/navigation): without this flag it throws a plain\n      // Error instead of rendering the nearest unauthorized.tsx. The flag is for app code that\n      // calls it; ServerSession.checkPermission does not, it still does `redirect(\"/401\")`.\n      authInterrupts: options.authInterrupts ?? true,\n      turbopackGc: true,\n      // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n      // imported request module unactivated (\"Lazily compiled dynamic import of ...\n      // JsonApiRequest ... was not activated\"), so every client-side read returns\n      // nothing. Seen with the package installed from npm; production builds are unaffected.\n      ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n    },\n    allowedDevOrigins: options.devOrigins,\n    pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n    images: {\n      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n      remotePatterns: parseImageSources(env),\n      dangerouslyAllowLocalIP: true,\n    },\n    poweredByHeader: false,\n    reactStrictMode: false,\n    env: {\n      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n      ...options.env,\n    },\n    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n    // does nothing but append these two entries. Requiring the package here\n    // instead CRASHES production: it is a devDependency, next.config.js is loaded\n    // at RUNTIME by `next start`, and the web-production image installs with\n    // --prod. Do not re-add a require of any devDependency to this file.\n    ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n    // single instance in both modes.\n    turbopack: {\n      resolveAlias: {\n        yjs: \"./node_modules/yjs\",\n      },\n    },\n  };\n\n  if (options.securityHeaders !== false) {\n    config.headers = async () => buildSecurityHeaders(options, process.env);\n  }\n\n  if (options.rewrites) config.rewrites = options.rewrites;\n\n  return options.extend ? options.extend(config) : config;\n}\n"]}
+{"version":3,"sources":["/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"names":[],"mappings":"AAAA;AACE;AACF,uDAA6B;AAC7B;AACA;ACoBA,IAAM,gBAAA,EAA+E;AAAA,EACnF,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,CAAC,uBAAuB,CAAA;AAAA,IACtC,SAAA,EAAW,CAAC,sBAAsB,CAAA;AAAA,IAClC,aAAA,EAAe,CAAC,wBAAwB,CAAA;AAAA,IACxC,WAAA,EAAa,CAAC,uBAAA,EAAyB,0BAA0B;AAAA,EACnE,CAAA;AAAA,EACA,UAAA,EAAY;AAAA,IACV,YAAA,EAAc,CAAC,6BAA6B,CAAA;AAAA,IAC5C,SAAA,EAAW,CAAC,6BAAA,EAA+B,0BAA0B,CAAA;AAAA,IACrE,aAAA,EAAe,CAAC,6BAAA,EAA+B,+BAA+B;AAAA,EAChF,CAAA;AAAA,EACA,SAAA,EAAW;AAAA,IACT,YAAA,EAAc,CAAC,mCAAmC,CAAA;AAAA,IAClD,aAAA,EAAe,CAAC,mCAAmC,CAAA;AAAA,IACnD,WAAA,EAAa,CAAC,mCAAmC;AAAA,EACnD,CAAA;AAAA,EACA,OAAA,EAAS;AAAA,IACP,SAAA,EAAW,CAAC,4BAA4B;AAAA,EAC1C,CAAA;AAAA,EACA,WAAA,EAAa;AAAA,IACX,WAAA,EAAa,CAAC,8BAA8B,CAAA;AAAA,IAC5C,UAAA,EAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF,CAAA;AAEA,SAAS,gBAAA,CAAiB,GAAA,EAAkC;AAC1D,EAAA,OAAO,GAAA,CAAI,cAAA,EAAgB,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,EAAA,GAAM,CAAA,CAAE,IAAA,CAAK,CAAC,EAAA,EAAI,CAAC,CAAA;AAClF;AAFS,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AAUF,SAAS,cAAA,CAAe,GAAA,EAAkC;AAC/D,EAAA,MAAM,QAAA,EAAoB,CAAC,CAAA;AAC3B,EAAA,IAAA,CAAA,MAAW,IAAA,GAAO,CAAC,GAAA,CAAI,mBAAA,EAAqB,GAAA,CAAI,sBAAsB,CAAA,EAAG;AACvE,IAAA,GAAA,CAAI,CAAC,GAAA,EAAK,QAAA;AACV,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,OAAO,EAAA,EAAI,IAAI,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AACrC,MAAA,GAAA,CAAI,OAAA,IAAW,OAAA,GAAU,CAAC,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,EAAG,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA;AAAA,IACzE,EAAA,UAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAZgB,qCAAA,cAAA,EAAA,gBAAA,CAAA;AAiBT,SAAS,QAAA,CAAS,OAAA,EAAqB,GAAA,EAAgC;AAC5E,EAAA,MAAM,OAAA,EAAS,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAC1C,EAAA,MAAM,aAAA,EAAe,gBAAA,CAAiB,GAAG,CAAA;AACzC,EAAA,MAAM,WAAA,EAAa,cAAA,CAAe,GAAG,CAAA;AACrC,EAAA,MAAM,SAAA,mBAAW,OAAA,CAAQ,QAAA,UAAY,CAAC,GAAA;AAItC,EAAA,MAAM,gBAAA,EAA+E;AAAA;AAAA,IAEnF,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAA,EAAmB,eAAe,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAElF,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAiB,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAEhE,SAAA,EAAW,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAA,EAAS,OAAO,CAAA,EAAG,OAAA,EAAS,CAAC,GAAG,YAAA,EAAc,GAAG,UAAU,EAAE,CAAA;AAAA;AAAA,IAE3F,UAAA,EAAY,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAE5C,aAAA,EAAe;AAAA,MACb,IAAA,EAAM,CAAC,QAAQ,CAAA;AAAA,MACf,OAAA,EAAS;AAAA,QACP,MAAA;AAAA;AAAA,QAEA,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,QAC5B,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF,CAAA;AAAA;AAAA,IAEA,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,WAAW,CAAA;AAAA;AAAA,IAErD,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAO,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE;AAAA,EACzD,CAAA;AAEA,EAAA,MAAM,UAAA,kBAAY,qCAAA,CAAC,IAAA,EAAA,GAA+B;AAChD,IAAA,MAAM,EAAE,IAAA,EAAM,QAAQ,EAAA,EAAI,eAAA,CAAgB,IAAI,CAAA;AAC9C,IAAA,MAAM,aAAA,EAAe,QAAA,CAAS,OAAA,CAAQ,CAAC,OAAA,EAAA,oBAAY,eAAA,CAAgB,OAAO,CAAA,CAAE,IAAI,CAAA,UAAK,CAAC,GAAC,CAAA;AACvF,IAAA,MAAM,QAAA,EAAU,CAAC,GAAG,IAAA,EAAM,GAAG,YAAA,EAAc,oCAAI,OAAA,mBAAQ,GAAA,4BAAA,CAAM,IAAI,GAAA,UAAK,CAAC,GAAA,EAAI,GAAG,OAAO,CAAA,CAAE,MAAA;AAAA,MACrF,CAAC,MAAA,EAAA,GAAW,OAAA,IAAW;AAAA,IACzB,CAAA;AACA,IAAA,OAAO,CAAC,IAAA,EAAM,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7C,CAAA,EAPkB,WAAA,CAAA;AASlB,EAAA,OAAO;AAAA,IACL,oBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA,IACtB,SAAA,CAAU,WAAW,CAAA;AAAA,IACrB,SAAA,CAAU,SAAS,CAAA;AAAA,IACnB,SAAA,CAAU,UAAU,CAAA;AAAA,IACpB,SAAA,CAAU,aAAa,CAAA;AAAA,IACvB,SAAA,CAAU,WAAW,CAAA;AAAA;AAAA,IAErB,wBAAA;AAAA;AAAA,IAEA,oBAAA;AAAA;AAAA,IAEA,iBAAA;AAAA;AAAA,IAEA,mBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,GAAA,CAAI,SAAA,IAAa,aAAA,GAAgB,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,4BAAA,EAA8B;AAAA,EAC5F,CAAA,CACG,MAAA,CAAO,OAAO,CAAA,CACd,IAAA,CAAK,IAAI,CAAA;AACd;AAvEgB,qCAAA,QAAA,EAAA,UAAA,CAAA;ADoChB;AACA;AEtGO,SAAS,oBAAA,CAAqB,OAAA,EAAgC,GAAA,EAAsC;AACzG,EAAA,MAAM,OAAA,kBAAS,OAAA,qBAAQ,iBAAA,6BAAmB,SAAA,IAAW,OAAA,EAAS,GAAA,EAAK,MAAA;AAEnE,EAAA,OAAO;AAAA,IACL;AAAA;AAAA,MAEE,MAAA,EAAQ,SAAA;AAAA,MACR,OAAA,EAAS;AAAA;AAAA,QAEP;AAAA,UACE,GAAA,EAAK,yBAAA;AAAA,UACL,KAAA,EAAO,QAAA,CAAS,OAAA,EAAS,GAAG;AAAA,QAC9B,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,wBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAClB,CAAC,EAAA,EACD;AAAA,UACE;AAAA,YACE,GAAA,EAAK,2BAAA;AAAA,YACL,KAAA,EAAO;AAAA,UACT;AAAA,QACF,CAAA;AAAA;AAAA,QAEJ;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,oBAAA;AAAA,UACL,KAAA,EAAO,CAAA,QAAA,EAAW,MAAM,CAAA,gCAAA;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAhDgB,qCAAA,oBAAA,EAAA,sBAAA,CAAA;AFsJhB;AACA;AG/HA,SAAS,iBAAA,CAAkB,GAAA,EAAyC;AAClE,EAAA,MAAM,aAAA,EAAe,GAAA,CAAI,cAAA,EAAgB,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,GAAA,EAAA,GAAQ,GAAA,CAAI,IAAA,CAAK,CAAC,EAAA,EAAI,CAAC,CAAA;AAClG,EAAA,MAAM,SAAA,EAA4B,CAAC,CAAA;AACnC,EAAA,IAAA,CAAA,MAAW,IAAA,GAAO,CAAC,GAAG,YAAA,EAAc,GAAG,cAAA,CAAe,GAAG,CAAC,CAAA,EAAG;AAC3D,IAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAU,KAAK,EAAA,EAAI,IAAI,GAAA,CAAI,GAAG,CAAA;AAChD,IAAA,MAAM,QAAA,EAAyB;AAAA,MAC7B,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,MAClC,QAAA;AAAA,MACA,IAAA,EAAM,KAAA,GAAQ,KAAA;AAAA,IAChB,CAAA;AACA,IAAA,MAAM,KAAA,EAAO,QAAA,CAAS,IAAA;AAAA,MACpB,CAAC,CAAA,EAAA,GAAM,CAAA,CAAE,SAAA,IAAa,OAAA,CAAQ,SAAA,GAAY,CAAA,CAAE,SAAA,IAAa,OAAA,CAAQ,SAAA,GAAY,CAAA,CAAE,KAAA,IAAS,OAAA,CAAQ;AAAA,IAClG,CAAA;AACA,IAAA,GAAA,CAAI,CAAC,IAAA,EAAM,QAAA,CAAS,IAAA,CAAK,OAAO,CAAA;AAAA,EAClC;AACA,EAAA,OAAO,QAAA;AACT;AAhBS,qCAAA,iBAAA,EAAA,mBAAA,CAAA;AAkBF,SAAS,gBAAA,CAAiB,OAAA,EAA2C;AAC1E,EAAA,MAAM,IAAA,EAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,cAAA,EAAgB,OAAA,CAAQ,cAAA,IAAkB,IAAA;AAEhD,EAAA,MAAM,OAAA,EAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,EAAE,OAAA,EAAS,YAAY,EAAA,EAAI,CAAC,CAAA;AAAA,IAC3D,eAAA,EAAiB,IAAA;AAAA,IACjB,kBAAA,EAAoB,IAAA;AAAA,IACpB,aAAA;AAAA,IACA,YAAA,EAAc;AAAA,MACZ,aAAA,EAAe;AAAA,QACb,aAAA,EAAe;AAAA,MACjB,CAAA;AAAA;AAAA;AAAA;AAAA,MAIA,cAAA,mBAAgB,OAAA,CAAQ,cAAA,UAAkB,MAAA;AAAA,MAC1C,WAAA,EAAa,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,cAAA,EAAgB,EAAE,0BAAA,EAA4B,KAAK,EAAA,EAAI,CAAC;AAAA,IAC9D,CAAA;AAAA,IACA,iBAAA,EAAmB,OAAA,CAAQ,UAAA;AAAA,IAC3B,cAAA,EAAgB,OAAA,CAAQ,IAAA,EAAM,CAAC,IAAA,EAAM,KAAA,EAAO,KAAK,EAAA,EAAI,CAAC,IAAA,EAAM,KAAK,CAAA;AAAA,IACjE,MAAA,EAAQ;AAAA,MACN,eAAA,mBAAiB,OAAA,CAAQ,oBAAA,UAAwB,IAAA;AAAA,MACjD,cAAA,EAAgB,iBAAA,CAAkB,GAAG,CAAA;AAAA,MACrC,uBAAA,EAAyB;AAAA,IAC3B,CAAA;AAAA,IACA,eAAA,EAAiB,KAAA;AAAA,IACjB,eAAA,EAAiB,KAAA;AAAA,IACjB,GAAA,EAAK;AAAA,MACH,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,4BAAA,mBAA8B,GAAA,CAAI,4BAAA,UAAgC,IAAA;AAAA,MAClE,+BAAA,mBAAiC,GAAA,CAAI,+BAAA,UAAmC,IAAA;AAAA,MACxE,GAAG,OAAA,CAAQ;AAAA,IACb,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,OAAA,CAAQ,QAAA,EAAU,EAAE,sBAAA,EAAwB,CAAC,SAAA,EAAW,cAAc,EAAE,EAAA,EAAI,CAAC,CAAA;AAAA;AAAA;AAAA,IAGjF,SAAA,EAAW;AAAA,MACT,YAAA,EAAc;AAAA,QACZ,GAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,KAAA,EAAO;AACrC,IAAA,MAAA,CAAO,QAAA,EAAU,MAAA,CAAA,EAAA,GAAY,oBAAA,CAAqB,OAAA,EAAS,OAAA,CAAQ,GAAG,CAAA;AAAA,EACxE;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,QAAA;AAEhD,EAAA,OAAO,OAAA,CAAQ,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,MAAM,EAAA,EAAI,MAAA;AACnD;AArEgB,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AHmMhB;AACE;AACA;AACA;AACF,kHAAC","file":"/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","sourcesContent":[null,"// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n  \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n *   `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n  services?: CspService[];\n  csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n  stripe: {\n    \"script-src\": [\"https://js.stripe.com\"],\n    \"img-src\": [\"https://*.stripe.com\"],\n    \"connect-src\": [\"https://api.stripe.com\"],\n    \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n  },\n  googleMaps: {\n    \"script-src\": [\"https://maps.googleapis.com\"],\n    \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n    \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n  },\n  turnstile: {\n    \"script-src\": [\"https://challenges.cloudflare.com\"],\n    \"connect-src\": [\"https://challenges.cloudflare.com\"],\n    \"frame-src\": [\"https://challenges.cloudflare.com\"],\n  },\n  discord: {\n    \"img-src\": [\"https://cdn.discordapp.com\"],\n  },\n  googleFonts: {\n    \"style-src\": [\"https://fonts.googleapis.com\"],\n    \"font-src\": [\"https://fonts.gstatic.com\"],\n  },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n/**\n * Origins of the app's own servers, the API and the corpus, from\n * `NEXT_PUBLIC_API_URL` and `NEXT_PUBLIC_CORPUS_URL`. They serve every stored\n * object link, so images and frames must be allowed from them. Unset or invalid\n * URLs are skipped; the result has no duplicates.\n */\nexport function listAppOrigins(env: NodeJS.ProcessEnv): string[] {\n  const origins: string[] = [];\n  for (const url of [env.NEXT_PUBLIC_API_URL, env.NEXT_PUBLIC_CORPUS_URL]) {\n    if (!url) continue;\n    try {\n      const { origin } = new URL(url.trim());\n      if (origin !== \"null\" && !origins.includes(origin)) origins.push(origin);\n    } catch {\n      // Not a URL: nothing to allow.\n    }\n  }\n  return origins;\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n  const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n  const imageSources = listImageSources(env);\n  const appOrigins = listAppOrigins(env);\n  const services = options.services ?? [];\n\n  // Each fetch directive: what Next itself needs, then the named services, then\n  // the app's extras, then the sources derived from the env.\n  const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n    // Scripts: self, and unsafe-inline/eval for Next.js\n    \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n    // Styles: self and unsafe-inline for styled-components/emotion\n    \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n    // Images: self, data URIs, blobs, configured image sources, and the api/corpus origins\n    \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: [...imageSources, ...appOrigins] },\n    // Fonts: self\n    \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n    \"connect-src\": {\n      base: [\"'self'\"],\n      fromEnv: [\n        apiUrl,\n        // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n        apiUrl.replace(/^http/, \"ws\"),\n        env.NEXT_PUBLIC_ADDRESS || \"\",\n        ...imageSources,\n      ],\n    },\n    // Frames: self, and the api/corpus origins (inline previews of stored objects)\n    \"frame-src\": { base: [\"'self'\"], fromEnv: appOrigins },\n    // Worker sources: self and blob (for Web Workers with dynamic imports)\n    \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n  };\n\n  const directive = (name: CspDirective): string => {\n    const { base, fromEnv } = fetchDirectives[name];\n    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n    const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n      (source) => source !== \"\",\n    );\n    return [name, ...new Set(sources)].join(\" \");\n  };\n\n  return [\n    \"default-src 'self'\",\n    directive(\"script-src\"),\n    directive(\"style-src\"),\n    directive(\"img-src\"),\n    directive(\"font-src\"),\n    directive(\"connect-src\"),\n    directive(\"frame-src\"),\n    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n    \"frame-ancestors 'none'\",\n    // Form actions: only self\n    \"form-action 'self'\",\n    // Base URI: only self\n    \"base-uri 'self'\",\n    // Object sources: none (no plugins)\n    \"object-src 'none'\",\n    directive(\"worker-src\"),\n    // Upgrade insecure requests in production.\n    //\n    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n    // and serves it over plain http on a custom hostname. With this directive\n    // the browser rewrites every /_next/static asset to https, which nothing is\n    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n    // never hydrates, and each spec sees only server-rendered markup.\n    env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n  ]\n    .filter(Boolean)\n    .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n  source: string;\n  headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n  const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n  return [\n    {\n      // Apply to all routes\n      source: \"/:path*\",\n      headers: [\n        // Content Security Policy - prevents XSS attacks\n        {\n          key: \"Content-Security-Policy\",\n          value: buildCsp(options, env),\n        },\n        // X-Frame-Options - prevents clickjacking (backup for older browsers)\n        {\n          key: \"X-Frame-Options\",\n          value: \"DENY\",\n        },\n        // X-Content-Type-Options - prevents MIME sniffing\n        {\n          key: \"X-Content-Type-Options\",\n          value: \"nosniff\",\n        },\n        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n        // the suite speaks plain http, and an HSTS pin would force https on every\n        // later request to this host from the same browser profile.\n        ...(env.E2E_BUILD === \"true\"\n          ? []\n          : [\n              {\n                key: \"Strict-Transport-Security\",\n                value: \"max-age=31536000; includeSubDomains\",\n              },\n            ]),\n        // Referrer-Policy - controls referrer information\n        {\n          key: \"Referrer-Policy\",\n          value: \"strict-origin-when-cross-origin\",\n        },\n        // Permissions-Policy - restricts browser features\n        {\n          key: \"Permissions-Policy\",\n          value: `camera=(${camera}), microphone=(), geolocation=()`,\n        },\n      ],\n    },\n  ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, listAppOrigins, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp, listAppOrigins };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n  devOrigins: string[];\n  /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n  services?: CspService[];\n  /** Extra CSP sources per directive, for hosts no named service covers. */\n  csp?: Partial<Record<CspDirective, string[]>>;\n  env?: Record<string, string>;\n  imageMinimumCacheTTL?: number;\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n  mdx?: boolean;\n  serwist?: boolean;\n  securityHeaders?: boolean;\n  authInterrupts?: boolean;\n  reactCompiler?: boolean;\n  rewrites?: NextConfig[\"rewrites\"];\n  extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\n// IMAGE_SOURCES, then the api and corpus origins (they serve every stored object\n// link), without duplicates.\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n  const imageSources = env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((url) => url.trim()) : [];\n  const patterns: RemotePattern[] = [];\n  for (const url of [...imageSources, ...listAppOrigins(env)]) {\n    const { hostname, protocol, port } = new URL(url);\n    const pattern: RemotePattern = {\n      protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n      hostname,\n      port: port || undefined,\n    };\n    const seen = patterns.some(\n      (p) => p.protocol === pattern.protocol && p.hostname === pattern.hostname && p.port === pattern.port,\n    );\n    if (!seen) patterns.push(pattern);\n  }\n  return patterns;\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n  const env = process.env;\n  const reactCompiler = options.reactCompiler === true;\n\n  const config: NextConfig = {\n    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n    // `next dev` server may still be running against the same worktree. `next\n    // build` and `next dev` share `.next`, so a build performed underneath a live\n    // dev server clobbers it and that dev server then 404s every route. Giving\n    // the e2e build its own directory keeps the two independent. E2E_BUILD must\n    // be set for `next build` AND for `next start`, or `start` looks in `.next`\n    // and serves someone else's output.\n    ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n    cacheComponents: true,\n    partialPrefetching: true,\n    reactCompiler,\n    experimental: {\n      serverActions: {\n        bodySizeLimit: \"5mb\",\n      },\n      // Required by `unauthorized()` (next/navigation): without this flag it throws a plain\n      // Error instead of rendering the nearest unauthorized.tsx. The flag is for app code that\n      // calls it; ServerSession.checkPermission does not, it still does `redirect(\"/401\")`.\n      authInterrupts: options.authInterrupts ?? true,\n      turbopackGc: true,\n      // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n      // imported request module unactivated (\"Lazily compiled dynamic import of ...\n      // JsonApiRequest ... was not activated\"), so every client-side read returns\n      // nothing. Seen with the package installed from npm; production builds are unaffected.\n      ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n    },\n    allowedDevOrigins: options.devOrigins,\n    pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n    images: {\n      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n      remotePatterns: parseImageSources(env),\n      dangerouslyAllowLocalIP: true,\n    },\n    poweredByHeader: false,\n    reactStrictMode: false,\n    env: {\n      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n      ...options.env,\n    },\n    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n    // does nothing but append these two entries. Requiring the package here\n    // instead CRASHES production: it is a devDependency, next.config.js is loaded\n    // at RUNTIME by `next start`, and the web-production image installs with\n    // --prod. Do not re-add a require of any devDependency to this file.\n    ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n    // single instance in both modes.\n    turbopack: {\n      resolveAlias: {\n        yjs: \"./node_modules/yjs\",\n      },\n    },\n  };\n\n  if (options.securityHeaders !== false) {\n    config.headers = async () => buildSecurityHeaders(options, process.env);\n  }\n\n  if (options.rewrites) config.rewrites = options.rewrites;\n\n  return options.extend ? options.extend(config) : config;\n}\n"]}

package/dist/next-config/index.mjs

@@ -32,17 +32,31 @@ function listImageSources(env) {
   return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(",").map((s) => s.trim()) : [];
 }
 __name(listImageSources, "listImageSources");
+function listAppOrigins(env) {
+  const origins = [];
+  for (const url of [env.NEXT_PUBLIC_API_URL, env.NEXT_PUBLIC_CORPUS_URL]) {
+    if (!url) continue;
+    try {
+      const { origin } = new URL(url.trim());
+      if (origin !== "null" && !origins.includes(origin)) origins.push(origin);
+    } catch {
+    }
+  }
+  return origins;
+}
+__name(listAppOrigins, "listAppOrigins");
 function buildCsp(options, env) {
   const apiUrl = env.NEXT_PUBLIC_API_URL || "";
   const imageSources = listImageSources(env);
+  const appOrigins = listAppOrigins(env);
   const services = options.services ?? [];
   const fetchDirectives = {
     // Scripts: self, and unsafe-inline/eval for Next.js
     "script-src": { base: ["'self'", "'unsafe-inline'", "'unsafe-eval'"], fromEnv: [] },
     // Styles: self and unsafe-inline for styled-components/emotion
     "style-src": { base: ["'self'", "'unsafe-inline'"], fromEnv: [] },
-    // Images: self, data URIs, blobs, and configured image sources
-    "img-src": { base: ["'self'", "data:", "blob:"], fromEnv: imageSources },
+    // Images: self, data URIs, blobs, configured image sources, and the api/corpus origins
+    "img-src": { base: ["'self'", "data:", "blob:"], fromEnv: [...imageSources, ...appOrigins] },
     // Fonts: self
     "font-src": { base: ["'self'"], fromEnv: [] },
     // Connect: self, API (http + ws for socket.io), and storage (for uploads)
@@ -56,8 +70,8 @@ function buildCsp(options, env) {
         ...imageSources
       ]
     },
-    // Frames: self
-    "frame-src": { base: ["'self'"], fromEnv: [] },
+    // Frames: self, and the api/corpus origins (inline previews of stored objects)
+    "frame-src": { base: ["'self'"], fromEnv: appOrigins },
     // Worker sources: self and blob (for Web Workers with dynamic imports)
     "worker-src": { base: ["'self'", "blob:"], fromEnv: [] }
   };
@@ -149,14 +163,21 @@ __name(buildSecurityHeaders, "buildSecurityHeaders");
 
 // src/next-config/index.ts
 function parseImageSources(env) {
-  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(",").map((url) => {
-    const { hostname, protocol, port } = new URL(url.trim());
-    return {
+  const imageSources = env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(",").map((url) => url.trim()) : [];
+  const patterns = [];
+  for (const url of [...imageSources, ...listAppOrigins(env)]) {
+    const { hostname, protocol, port } = new URL(url);
+    const pattern = {
       protocol: protocol.replace(":", ""),
       hostname,
       port: port || void 0
     };
-  }) : [];
+    const seen = patterns.some(
+      (p) => p.protocol === pattern.protocol && p.hostname === pattern.hostname && p.port === pattern.port
+    );
+    if (!seen) patterns.push(pattern);
+  }
+  return patterns;
 }
 __name(parseImageSources, "parseImageSources");
 function createNextConfig(options) {
@@ -228,6 +249,7 @@ function createNextConfig(options) {
 __name(createNextConfig, "createNextConfig");
 export {
   buildCsp,
-  createNextConfig
+  createNextConfig,
+  listAppOrigins
 };
 //# sourceMappingURL=index.mjs.map

package/dist/next-config/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"sourcesContent":["// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n  \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n *   `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n  services?: CspService[];\n  csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n  stripe: {\n    \"script-src\": [\"https://js.stripe.com\"],\n    \"img-src\": [\"https://*.stripe.com\"],\n    \"connect-src\": [\"https://api.stripe.com\"],\n    \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n  },\n  googleMaps: {\n    \"script-src\": [\"https://maps.googleapis.com\"],\n    \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n    \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n  },\n  turnstile: {\n    \"script-src\": [\"https://challenges.cloudflare.com\"],\n    \"connect-src\": [\"https://challenges.cloudflare.com\"],\n    \"frame-src\": [\"https://challenges.cloudflare.com\"],\n  },\n  discord: {\n    \"img-src\": [\"https://cdn.discordapp.com\"],\n  },\n  googleFonts: {\n    \"style-src\": [\"https://fonts.googleapis.com\"],\n    \"font-src\": [\"https://fonts.gstatic.com\"],\n  },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n  const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n  const imageSources = listImageSources(env);\n  const services = options.services ?? [];\n\n  // Each fetch directive: what Next itself needs, then the named services, then\n  // the app's extras, then the sources derived from the env.\n  const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n    // Scripts: self, and unsafe-inline/eval for Next.js\n    \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n    // Styles: self and unsafe-inline for styled-components/emotion\n    \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n    // Images: self, data URIs, blobs, and configured image sources\n    \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: imageSources },\n    // Fonts: self\n    \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n    \"connect-src\": {\n      base: [\"'self'\"],\n      fromEnv: [\n        apiUrl,\n        // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n        apiUrl.replace(/^http/, \"ws\"),\n        env.NEXT_PUBLIC_ADDRESS || \"\",\n        ...imageSources,\n      ],\n    },\n    // Frames: self\n    \"frame-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Worker sources: self and blob (for Web Workers with dynamic imports)\n    \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n  };\n\n  const directive = (name: CspDirective): string => {\n    const { base, fromEnv } = fetchDirectives[name];\n    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n    const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n      (source) => source !== \"\",\n    );\n    return [name, ...new Set(sources)].join(\" \");\n  };\n\n  return [\n    \"default-src 'self'\",\n    directive(\"script-src\"),\n    directive(\"style-src\"),\n    directive(\"img-src\"),\n    directive(\"font-src\"),\n    directive(\"connect-src\"),\n    directive(\"frame-src\"),\n    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n    \"frame-ancestors 'none'\",\n    // Form actions: only self\n    \"form-action 'self'\",\n    // Base URI: only self\n    \"base-uri 'self'\",\n    // Object sources: none (no plugins)\n    \"object-src 'none'\",\n    directive(\"worker-src\"),\n    // Upgrade insecure requests in production.\n    //\n    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n    // and serves it over plain http on a custom hostname. With this directive\n    // the browser rewrites every /_next/static asset to https, which nothing is\n    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n    // never hydrates, and each spec sees only server-rendered markup.\n    env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n  ]\n    .filter(Boolean)\n    .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n  source: string;\n  headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n  const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n  return [\n    {\n      // Apply to all routes\n      source: \"/:path*\",\n      headers: [\n        // Content Security Policy - prevents XSS attacks\n        {\n          key: \"Content-Security-Policy\",\n          value: buildCsp(options, env),\n        },\n        // X-Frame-Options - prevents clickjacking (backup for older browsers)\n        {\n          key: \"X-Frame-Options\",\n          value: \"DENY\",\n        },\n        // X-Content-Type-Options - prevents MIME sniffing\n        {\n          key: \"X-Content-Type-Options\",\n          value: \"nosniff\",\n        },\n        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n        // the suite speaks plain http, and an HSTS pin would force https on every\n        // later request to this host from the same browser profile.\n        ...(env.E2E_BUILD === \"true\"\n          ? []\n          : [\n              {\n                key: \"Strict-Transport-Security\",\n                value: \"max-age=31536000; includeSubDomains\",\n              },\n            ]),\n        // Referrer-Policy - controls referrer information\n        {\n          key: \"Referrer-Policy\",\n          value: \"strict-origin-when-cross-origin\",\n        },\n        // Permissions-Policy - restricts browser features\n        {\n          key: \"Permissions-Policy\",\n          value: `camera=(${camera}), microphone=(), geolocation=()`,\n        },\n      ],\n    },\n  ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n  devOrigins: string[];\n  /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n  services?: CspService[];\n  /** Extra CSP sources per directive, for hosts no named service covers. */\n  csp?: Partial<Record<CspDirective, string[]>>;\n  env?: Record<string, string>;\n  imageMinimumCacheTTL?: number;\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n  mdx?: boolean;\n  serwist?: boolean;\n  securityHeaders?: boolean;\n  authInterrupts?: boolean;\n  reactCompiler?: boolean;\n  rewrites?: NextConfig[\"rewrites\"];\n  extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n  return env.IMAGE_SOURCES\n    ? env.IMAGE_SOURCES.split(\",\").map((url) => {\n        const { hostname, protocol, port } = new URL(url.trim());\n        return {\n          protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n          hostname,\n          port: port || undefined,\n        };\n      })\n    : [];\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n  const env = process.env;\n  const reactCompiler = options.reactCompiler === true;\n\n  const config: NextConfig = {\n    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n    // `next dev` server may still be running against the same worktree. `next\n    // build` and `next dev` share `.next`, so a build performed underneath a live\n    // dev server clobbers it and that dev server then 404s every route. Giving\n    // the e2e build its own directory keeps the two independent. E2E_BUILD must\n    // be set for `next build` AND for `next start`, or `start` looks in `.next`\n    // and serves someone else's output.\n    ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n    cacheComponents: true,\n    partialPrefetching: true,\n    reactCompiler,\n    experimental: {\n      serverActions: {\n        bodySizeLimit: \"5mb\",\n      },\n      // Required by `unauthorized()` (next/navigation): without this flag it throws a plain\n      // Error instead of rendering the nearest unauthorized.tsx. The flag is for app code that\n      // calls it; ServerSession.checkPermission does not, it still does `redirect(\"/401\")`.\n      authInterrupts: options.authInterrupts ?? true,\n      turbopackGc: true,\n      // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n      // imported request module unactivated (\"Lazily compiled dynamic import of ...\n      // JsonApiRequest ... was not activated\"), so every client-side read returns\n      // nothing. Seen with the package installed from npm; production builds are unaffected.\n      ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n    },\n    allowedDevOrigins: options.devOrigins,\n    pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n    images: {\n      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n      remotePatterns: parseImageSources(env),\n      dangerouslyAllowLocalIP: true,\n    },\n    poweredByHeader: false,\n    reactStrictMode: false,\n    env: {\n      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n      ...options.env,\n    },\n    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n    // does nothing but append these two entries. Requiring the package here\n    // instead CRASHES production: it is a devDependency, next.config.js is loaded\n    // at RUNTIME by `next start`, and the web-production image installs with\n    // --prod. Do not re-add a require of any devDependency to this file.\n    ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n    // single instance in both modes.\n    turbopack: {\n      resolveAlias: {\n        yjs: \"./node_modules/yjs\",\n      },\n    },\n  };\n\n  if (options.securityHeaders !== false) {\n    config.headers = async () => buildSecurityHeaders(options, process.env);\n  }\n\n  if (options.rewrites) config.rewrites = options.rewrites;\n\n  return options.extend ? options.extend(config) : config;\n}\n"],"mappings":";;;;;AAwBA,IAAM,kBAA+E;AAAA,EACnF,QAAQ;AAAA,IACN,cAAc,CAAC,uBAAuB;AAAA,IACtC,WAAW,CAAC,sBAAsB;AAAA,IAClC,eAAe,CAAC,wBAAwB;AAAA,IACxC,aAAa,CAAC,yBAAyB,0BAA0B;AAAA,EACnE;AAAA,EACA,YAAY;AAAA,IACV,cAAc,CAAC,6BAA6B;AAAA,IAC5C,WAAW,CAAC,+BAA+B,0BAA0B;AAAA,IACrE,eAAe,CAAC,+BAA+B,+BAA+B;AAAA,EAChF;AAAA,EACA,WAAW;AAAA,IACT,cAAc,CAAC,mCAAmC;AAAA,IAClD,eAAe,CAAC,mCAAmC;AAAA,IACnD,aAAa,CAAC,mCAAmC;AAAA,EACnD;AAAA,EACA,SAAS;AAAA,IACP,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA,aAAa;AAAA,IACX,aAAa,CAAC,8BAA8B;AAAA,IAC5C,YAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF;AAEA,SAAS,iBAAiB,KAAkC;AAC1D,SAAO,IAAI,gBAAgB,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAClF;AAFS;AAOF,SAAS,SAAS,SAAqB,KAAgC;AAC5E,QAAM,SAAS,IAAI,uBAAuB;AAC1C,QAAM,eAAe,iBAAiB,GAAG;AACzC,QAAM,WAAW,QAAQ,YAAY,CAAC;AAItC,QAAM,kBAA+E;AAAA;AAAA,IAEnF,cAAc,EAAE,MAAM,CAAC,UAAU,mBAAmB,eAAe,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAElF,aAAa,EAAE,MAAM,CAAC,UAAU,iBAAiB,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAEhE,WAAW,EAAE,MAAM,CAAC,UAAU,SAAS,OAAO,GAAG,SAAS,aAAa;AAAA;AAAA,IAEvE,YAAY,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE5C,eAAe;AAAA,MACb,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,QACP;AAAA;AAAA,QAEA,OAAO,QAAQ,SAAS,IAAI;AAAA,QAC5B,IAAI,uBAAuB;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF;AAAA;AAAA,IAEA,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE7C,cAAc,EAAE,MAAM,CAAC,UAAU,OAAO,GAAG,SAAS,CAAC,EAAE;AAAA,EACzD;AAEA,QAAM,YAAY,wBAAC,SAA+B;AAChD,UAAM,EAAE,MAAM,QAAQ,IAAI,gBAAgB,IAAI;AAC9C,UAAM,eAAe,SAAS,QAAQ,CAAC,YAAY,gBAAgB,OAAO,EAAE,IAAI,KAAK,CAAC,CAAC;AACvF,UAAM,UAAU,CAAC,GAAG,MAAM,GAAG,cAAc,GAAI,QAAQ,MAAM,IAAI,KAAK,CAAC,GAAI,GAAG,OAAO,EAAE;AAAA,MACrF,CAAC,WAAW,WAAW;AAAA,IACzB;AACA,WAAO,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,EAC7C,GAPkB;AASlB,SAAO;AAAA,IACL;AAAA,IACA,UAAU,YAAY;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,UAAU,SAAS;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,UAAU,aAAa;AAAA,IACvB,UAAU,WAAW;AAAA;AAAA,IAErB;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA,IACA,UAAU,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,IAAI,aAAa,gBAAgB,IAAI,cAAc,SAAS,8BAA8B;AAAA,EAC5F,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACd;AAtEgB;;;AC7CT,SAAS,qBAAqB,SAAgC,KAAsC;AACzG,QAAM,SAAS,QAAQ,mBAAmB,WAAW,SAAS,KAAK;AAEnE,SAAO;AAAA,IACL;AAAA;AAAA,MAEE,QAAQ;AAAA,MACR,SAAS;AAAA;AAAA,QAEP;AAAA,UACE,KAAK;AAAA,UACL,OAAO,SAAS,SAAS,GAAG;AAAA,QAC9B;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,IAAI,cAAc,SAClB,CAAC,IACD;AAAA,UACE;AAAA,YACE,KAAK;AAAA,YACL,OAAO;AAAA,UACT;AAAA,QACF;AAAA;AAAA,QAEJ;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO,WAAW,MAAM;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;;;ACsBhB,SAAS,kBAAkB,KAAyC;AAClE,SAAO,IAAI,gBACP,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,QAAQ;AACxC,UAAM,EAAE,UAAU,UAAU,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACvD,WAAO;AAAA,MACL,UAAU,SAAS,QAAQ,KAAK,EAAE;AAAA,MAClC;AAAA,MACA,MAAM,QAAQ;AAAA,IAChB;AAAA,EACF,CAAC,IACD,CAAC;AACP;AAXS;AAaF,SAAS,iBAAiB,SAA2C;AAC1E,QAAM,MAAM,QAAQ;AACpB,QAAM,gBAAgB,QAAQ,kBAAkB;AAEhD,QAAM,SAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,IAAI,cAAc,SAAS,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,IAC3D,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB;AAAA,IACA,cAAc;AAAA,MACZ,eAAe;AAAA,QACb,eAAe;AAAA,MACjB;AAAA;AAAA;AAAA;AAAA,MAIA,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,gBAAgB,EAAE,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC9D;AAAA,IACA,mBAAmB,QAAQ;AAAA,IAC3B,gBAAgB,QAAQ,MAAM,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AAAA,IACjE,QAAQ;AAAA,MACN,iBAAiB,QAAQ,wBAAwB;AAAA,MACjD,gBAAgB,kBAAkB,GAAG;AAAA,MACrC,yBAAyB;AAAA,IAC3B;AAAA,IACA,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,KAAK;AAAA,MACH,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,8BAA8B,IAAI,gCAAgC;AAAA,MAClE,iCAAiC,IAAI,mCAAmC;AAAA,MACxE,GAAG,QAAQ;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,QAAQ,UAAU,EAAE,wBAAwB,CAAC,WAAW,cAAc,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,IAGjF,WAAW;AAAA,MACT,cAAc;AAAA,QACZ,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,oBAAoB,OAAO;AACrC,WAAO,UAAU,YAAY,qBAAqB,SAAS,QAAQ,GAAG;AAAA,EACxE;AAEA,MAAI,QAAQ,SAAU,QAAO,WAAW,QAAQ;AAEhD,SAAO,QAAQ,SAAS,QAAQ,OAAO,MAAM,IAAI;AACnD;AArEgB;","names":[]}
+{"version":3,"sources":["../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"sourcesContent":["// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n  \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n *   `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n  services?: CspService[];\n  csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n  stripe: {\n    \"script-src\": [\"https://js.stripe.com\"],\n    \"img-src\": [\"https://*.stripe.com\"],\n    \"connect-src\": [\"https://api.stripe.com\"],\n    \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n  },\n  googleMaps: {\n    \"script-src\": [\"https://maps.googleapis.com\"],\n    \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n    \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n  },\n  turnstile: {\n    \"script-src\": [\"https://challenges.cloudflare.com\"],\n    \"connect-src\": [\"https://challenges.cloudflare.com\"],\n    \"frame-src\": [\"https://challenges.cloudflare.com\"],\n  },\n  discord: {\n    \"img-src\": [\"https://cdn.discordapp.com\"],\n  },\n  googleFonts: {\n    \"style-src\": [\"https://fonts.googleapis.com\"],\n    \"font-src\": [\"https://fonts.gstatic.com\"],\n  },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n/**\n * Origins of the app's own servers, the API and the corpus, from\n * `NEXT_PUBLIC_API_URL` and `NEXT_PUBLIC_CORPUS_URL`. They serve every stored\n * object link, so images and frames must be allowed from them. Unset or invalid\n * URLs are skipped; the result has no duplicates.\n */\nexport function listAppOrigins(env: NodeJS.ProcessEnv): string[] {\n  const origins: string[] = [];\n  for (const url of [env.NEXT_PUBLIC_API_URL, env.NEXT_PUBLIC_CORPUS_URL]) {\n    if (!url) continue;\n    try {\n      const { origin } = new URL(url.trim());\n      if (origin !== \"null\" && !origins.includes(origin)) origins.push(origin);\n    } catch {\n      // Not a URL: nothing to allow.\n    }\n  }\n  return origins;\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n  const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n  const imageSources = listImageSources(env);\n  const appOrigins = listAppOrigins(env);\n  const services = options.services ?? [];\n\n  // Each fetch directive: what Next itself needs, then the named services, then\n  // the app's extras, then the sources derived from the env.\n  const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n    // Scripts: self, and unsafe-inline/eval for Next.js\n    \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n    // Styles: self and unsafe-inline for styled-components/emotion\n    \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n    // Images: self, data URIs, blobs, configured image sources, and the api/corpus origins\n    \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: [...imageSources, ...appOrigins] },\n    // Fonts: self\n    \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n    \"connect-src\": {\n      base: [\"'self'\"],\n      fromEnv: [\n        apiUrl,\n        // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n        apiUrl.replace(/^http/, \"ws\"),\n        env.NEXT_PUBLIC_ADDRESS || \"\",\n        ...imageSources,\n      ],\n    },\n    // Frames: self, and the api/corpus origins (inline previews of stored objects)\n    \"frame-src\": { base: [\"'self'\"], fromEnv: appOrigins },\n    // Worker sources: self and blob (for Web Workers with dynamic imports)\n    \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n  };\n\n  const directive = (name: CspDirective): string => {\n    const { base, fromEnv } = fetchDirectives[name];\n    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n    const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n      (source) => source !== \"\",\n    );\n    return [name, ...new Set(sources)].join(\" \");\n  };\n\n  return [\n    \"default-src 'self'\",\n    directive(\"script-src\"),\n    directive(\"style-src\"),\n    directive(\"img-src\"),\n    directive(\"font-src\"),\n    directive(\"connect-src\"),\n    directive(\"frame-src\"),\n    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n    \"frame-ancestors 'none'\",\n    // Form actions: only self\n    \"form-action 'self'\",\n    // Base URI: only self\n    \"base-uri 'self'\",\n    // Object sources: none (no plugins)\n    \"object-src 'none'\",\n    directive(\"worker-src\"),\n    // Upgrade insecure requests in production.\n    //\n    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n    // and serves it over plain http on a custom hostname. With this directive\n    // the browser rewrites every /_next/static asset to https, which nothing is\n    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n    // never hydrates, and each spec sees only server-rendered markup.\n    env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n  ]\n    .filter(Boolean)\n    .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n  source: string;\n  headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n  const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n  return [\n    {\n      // Apply to all routes\n      source: \"/:path*\",\n      headers: [\n        // Content Security Policy - prevents XSS attacks\n        {\n          key: \"Content-Security-Policy\",\n          value: buildCsp(options, env),\n        },\n        // X-Frame-Options - prevents clickjacking (backup for older browsers)\n        {\n          key: \"X-Frame-Options\",\n          value: \"DENY\",\n        },\n        // X-Content-Type-Options - prevents MIME sniffing\n        {\n          key: \"X-Content-Type-Options\",\n          value: \"nosniff\",\n        },\n        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n        // the suite speaks plain http, and an HSTS pin would force https on every\n        // later request to this host from the same browser profile.\n        ...(env.E2E_BUILD === \"true\"\n          ? []\n          : [\n              {\n                key: \"Strict-Transport-Security\",\n                value: \"max-age=31536000; includeSubDomains\",\n              },\n            ]),\n        // Referrer-Policy - controls referrer information\n        {\n          key: \"Referrer-Policy\",\n          value: \"strict-origin-when-cross-origin\",\n        },\n        // Permissions-Policy - restricts browser features\n        {\n          key: \"Permissions-Policy\",\n          value: `camera=(${camera}), microphone=(), geolocation=()`,\n        },\n      ],\n    },\n  ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, listAppOrigins, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp, listAppOrigins };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n  devOrigins: string[];\n  /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n  services?: CspService[];\n  /** Extra CSP sources per directive, for hosts no named service covers. */\n  csp?: Partial<Record<CspDirective, string[]>>;\n  env?: Record<string, string>;\n  imageMinimumCacheTTL?: number;\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n  mdx?: boolean;\n  serwist?: boolean;\n  securityHeaders?: boolean;\n  authInterrupts?: boolean;\n  reactCompiler?: boolean;\n  rewrites?: NextConfig[\"rewrites\"];\n  extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\n// IMAGE_SOURCES, then the api and corpus origins (they serve every stored object\n// link), without duplicates.\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n  const imageSources = env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((url) => url.trim()) : [];\n  const patterns: RemotePattern[] = [];\n  for (const url of [...imageSources, ...listAppOrigins(env)]) {\n    const { hostname, protocol, port } = new URL(url);\n    const pattern: RemotePattern = {\n      protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n      hostname,\n      port: port || undefined,\n    };\n    const seen = patterns.some(\n      (p) => p.protocol === pattern.protocol && p.hostname === pattern.hostname && p.port === pattern.port,\n    );\n    if (!seen) patterns.push(pattern);\n  }\n  return patterns;\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n  const env = process.env;\n  const reactCompiler = options.reactCompiler === true;\n\n  const config: NextConfig = {\n    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n    // `next dev` server may still be running against the same worktree. `next\n    // build` and `next dev` share `.next`, so a build performed underneath a live\n    // dev server clobbers it and that dev server then 404s every route. Giving\n    // the e2e build its own directory keeps the two independent. E2E_BUILD must\n    // be set for `next build` AND for `next start`, or `start` looks in `.next`\n    // and serves someone else's output.\n    ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n    cacheComponents: true,\n    partialPrefetching: true,\n    reactCompiler,\n    experimental: {\n      serverActions: {\n        bodySizeLimit: \"5mb\",\n      },\n      // Required by `unauthorized()` (next/navigation): without this flag it throws a plain\n      // Error instead of rendering the nearest unauthorized.tsx. The flag is for app code that\n      // calls it; ServerSession.checkPermission does not, it still does `redirect(\"/401\")`.\n      authInterrupts: options.authInterrupts ?? true,\n      turbopackGc: true,\n      // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n      // imported request module unactivated (\"Lazily compiled dynamic import of ...\n      // JsonApiRequest ... was not activated\"), so every client-side read returns\n      // nothing. Seen with the package installed from npm; production builds are unaffected.\n      ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n    },\n    allowedDevOrigins: options.devOrigins,\n    pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n    images: {\n      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n      remotePatterns: parseImageSources(env),\n      dangerouslyAllowLocalIP: true,\n    },\n    poweredByHeader: false,\n    reactStrictMode: false,\n    env: {\n      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n      ...options.env,\n    },\n    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n    // does nothing but append these two entries. Requiring the package here\n    // instead CRASHES production: it is a devDependency, next.config.js is loaded\n    // at RUNTIME by `next start`, and the web-production image installs with\n    // --prod. Do not re-add a require of any devDependency to this file.\n    ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n    // single instance in both modes.\n    turbopack: {\n      resolveAlias: {\n        yjs: \"./node_modules/yjs\",\n      },\n    },\n  };\n\n  if (options.securityHeaders !== false) {\n    config.headers = async () => buildSecurityHeaders(options, process.env);\n  }\n\n  if (options.rewrites) config.rewrites = options.rewrites;\n\n  return options.extend ? options.extend(config) : config;\n}\n"],"mappings":";;;;;AAwBA,IAAM,kBAA+E;AAAA,EACnF,QAAQ;AAAA,IACN,cAAc,CAAC,uBAAuB;AAAA,IACtC,WAAW,CAAC,sBAAsB;AAAA,IAClC,eAAe,CAAC,wBAAwB;AAAA,IACxC,aAAa,CAAC,yBAAyB,0BAA0B;AAAA,EACnE;AAAA,EACA,YAAY;AAAA,IACV,cAAc,CAAC,6BAA6B;AAAA,IAC5C,WAAW,CAAC,+BAA+B,0BAA0B;AAAA,IACrE,eAAe,CAAC,+BAA+B,+BAA+B;AAAA,EAChF;AAAA,EACA,WAAW;AAAA,IACT,cAAc,CAAC,mCAAmC;AAAA,IAClD,eAAe,CAAC,mCAAmC;AAAA,IACnD,aAAa,CAAC,mCAAmC;AAAA,EACnD;AAAA,EACA,SAAS;AAAA,IACP,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA,aAAa;AAAA,IACX,aAAa,CAAC,8BAA8B;AAAA,IAC5C,YAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF;AAEA,SAAS,iBAAiB,KAAkC;AAC1D,SAAO,IAAI,gBAAgB,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAClF;AAFS;AAUF,SAAS,eAAe,KAAkC;AAC/D,QAAM,UAAoB,CAAC;AAC3B,aAAW,OAAO,CAAC,IAAI,qBAAqB,IAAI,sBAAsB,GAAG;AACvE,QAAI,CAAC,IAAK;AACV,QAAI;AACF,YAAM,EAAE,OAAO,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACrC,UAAI,WAAW,UAAU,CAAC,QAAQ,SAAS,MAAM,EAAG,SAAQ,KAAK,MAAM;AAAA,IACzE,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAZgB;AAiBT,SAAS,SAAS,SAAqB,KAAgC;AAC5E,QAAM,SAAS,IAAI,uBAAuB;AAC1C,QAAM,eAAe,iBAAiB,GAAG;AACzC,QAAM,aAAa,eAAe,GAAG;AACrC,QAAM,WAAW,QAAQ,YAAY,CAAC;AAItC,QAAM,kBAA+E;AAAA;AAAA,IAEnF,cAAc,EAAE,MAAM,CAAC,UAAU,mBAAmB,eAAe,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAElF,aAAa,EAAE,MAAM,CAAC,UAAU,iBAAiB,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAEhE,WAAW,EAAE,MAAM,CAAC,UAAU,SAAS,OAAO,GAAG,SAAS,CAAC,GAAG,cAAc,GAAG,UAAU,EAAE;AAAA;AAAA,IAE3F,YAAY,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE5C,eAAe;AAAA,MACb,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,QACP;AAAA;AAAA,QAEA,OAAO,QAAQ,SAAS,IAAI;AAAA,QAC5B,IAAI,uBAAuB;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF;AAAA;AAAA,IAEA,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,WAAW;AAAA;AAAA,IAErD,cAAc,EAAE,MAAM,CAAC,UAAU,OAAO,GAAG,SAAS,CAAC,EAAE;AAAA,EACzD;AAEA,QAAM,YAAY,wBAAC,SAA+B;AAChD,UAAM,EAAE,MAAM,QAAQ,IAAI,gBAAgB,IAAI;AAC9C,UAAM,eAAe,SAAS,QAAQ,CAAC,YAAY,gBAAgB,OAAO,EAAE,IAAI,KAAK,CAAC,CAAC;AACvF,UAAM,UAAU,CAAC,GAAG,MAAM,GAAG,cAAc,GAAI,QAAQ,MAAM,IAAI,KAAK,CAAC,GAAI,GAAG,OAAO,EAAE;AAAA,MACrF,CAAC,WAAW,WAAW;AAAA,IACzB;AACA,WAAO,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,EAC7C,GAPkB;AASlB,SAAO;AAAA,IACL;AAAA,IACA,UAAU,YAAY;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,UAAU,SAAS;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,UAAU,aAAa;AAAA,IACvB,UAAU,WAAW;AAAA;AAAA,IAErB;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA,IACA,UAAU,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,IAAI,aAAa,gBAAgB,IAAI,cAAc,SAAS,8BAA8B;AAAA,EAC5F,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACd;AAvEgB;;;ACjET,SAAS,qBAAqB,SAAgC,KAAsC;AACzG,QAAM,SAAS,QAAQ,mBAAmB,WAAW,SAAS,KAAK;AAEnE,SAAO;AAAA,IACL;AAAA;AAAA,MAEE,QAAQ;AAAA,MACR,SAAS;AAAA;AAAA,QAEP;AAAA,UACE,KAAK;AAAA,UACL,OAAO,SAAS,SAAS,GAAG;AAAA,QAC9B;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,IAAI,cAAc,SAClB,CAAC,IACD;AAAA,UACE;AAAA,YACE,KAAK;AAAA,YACL,OAAO;AAAA,UACT;AAAA,QACF;AAAA;AAAA,QAEJ;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO,WAAW,MAAM;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;;;ACwBhB,SAAS,kBAAkB,KAAyC;AAClE,QAAM,eAAe,IAAI,gBAAgB,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;AAClG,QAAM,WAA4B,CAAC;AACnC,aAAW,OAAO,CAAC,GAAG,cAAc,GAAG,eAAe,GAAG,CAAC,GAAG;AAC3D,UAAM,EAAE,UAAU,UAAU,KAAK,IAAI,IAAI,IAAI,GAAG;AAChD,UAAM,UAAyB;AAAA,MAC7B,UAAU,SAAS,QAAQ,KAAK,EAAE;AAAA,MAClC;AAAA,MACA,MAAM,QAAQ;AAAA,IAChB;AACA,UAAM,OAAO,SAAS;AAAA,MACpB,CAAC,MAAM,EAAE,aAAa,QAAQ,YAAY,EAAE,aAAa,QAAQ,YAAY,EAAE,SAAS,QAAQ;AAAA,IAClG;AACA,QAAI,CAAC,KAAM,UAAS,KAAK,OAAO;AAAA,EAClC;AACA,SAAO;AACT;AAhBS;AAkBF,SAAS,iBAAiB,SAA2C;AAC1E,QAAM,MAAM,QAAQ;AACpB,QAAM,gBAAgB,QAAQ,kBAAkB;AAEhD,QAAM,SAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,IAAI,cAAc,SAAS,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,IAC3D,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB;AAAA,IACA,cAAc;AAAA,MACZ,eAAe;AAAA,QACb,eAAe;AAAA,MACjB;AAAA;AAAA;AAAA;AAAA,MAIA,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,gBAAgB,EAAE,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC9D;AAAA,IACA,mBAAmB,QAAQ;AAAA,IAC3B,gBAAgB,QAAQ,MAAM,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AAAA,IACjE,QAAQ;AAAA,MACN,iBAAiB,QAAQ,wBAAwB;AAAA,MACjD,gBAAgB,kBAAkB,GAAG;AAAA,MACrC,yBAAyB;AAAA,IAC3B;AAAA,IACA,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,KAAK;AAAA,MACH,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,8BAA8B,IAAI,gCAAgC;AAAA,MAClE,iCAAiC,IAAI,mCAAmC;AAAA,MACxE,GAAG,QAAQ;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,QAAQ,UAAU,EAAE,wBAAwB,CAAC,WAAW,cAAc,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,IAGjF,WAAW;AAAA,MACT,cAAc;AAAA,QACZ,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,oBAAoB,OAAO;AACrC,WAAO,UAAU,YAAY,qBAAqB,SAAS,QAAQ,GAAG;AAAA,EACxE;AAEA,MAAI,QAAQ,SAAU,QAAO,WAAW,QAAQ;AAEhD,SAAO,QAAQ,SAAS,QAAQ,OAAO,MAAM,IAAI;AACnD;AArEgB;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carlonicora/nextjs-jsonapi",
-  "version": "4.0.8",
+  "version": "4.1.0",
   "description": "Next.js JSON:API client with server/client support and caching",
   "author": "Carlo Nicora",
   "license": "GPL-3.0-or-later",

package/src/features/company/components/details/CompanyContent.tsx

@@ -7,7 +7,7 @@ import { ReactNode } from "react";
 import { AttributeElement } from "../../../../components";
 import { SectionHeader, MicroLabel } from "../../../../components/typography";
 import { FiscalDataDisplay } from "../../../../components/fiscal/FiscalDataDisplay";
-import { cn } from "../../../../utils";
+import { cn, isRemoteImageSrc } from "../../../../utils";
 import { CompanyInterface } from "../../data";
 
 type CompanyContentProps = {
@@ -44,7 +44,14 @@ export function CompanyContent({ company, actions }: CompanyContentProps) {
       {/* Hero Section */}
       <div className="flex items-start gap-x-6">
         {company.logo && (
-          <Image src={company.logo} alt={company.name} width={150} height={150} className="rounded-md" />
+          <Image
+            src={company.logo}
+            alt={company.name}
+            width={150}
+            height={150}
+            className="rounded-md"
+            unoptimized={isRemoteImageSrc(company.logo)}
+          />
         )}
         <div className="flex flex-col gap-y-2">
           {company.legal_address && (

package/src/features/company/components/forms/CompanyEditor.tsx

@@ -26,6 +26,7 @@ import { Modules } from "../../../../core";
 import { useI18nRouter } from "../../../../i18n";
 import { getRoleId } from "../../../../roles";
 import { ScrollArea } from "../../../../shadcnui";
+import { isRemoteImageSrc } from "../../../../utils";
 import { FeatureInterface } from "../../../feature";
 import { FeatureService } from "../../../feature/data/feature.service";
 import { S3Interface } from "../../../s3";
@@ -232,6 +233,7 @@ function CompanyEditorInternal({
                       alt="Company Logo"
                       width={200}
                       height={200}
+                      unoptimized={isRemoteImageSrc(file ? undefined : company?.logo)}
                     />
                   ) : (
                     <>

package/src/next-config/__tests__/createNextConfig.test.ts

@@ -9,12 +9,12 @@ const FIXED_ENV = vi.hoisted(() => {
     NEXT_PUBLIC_API_URL: "https://api.test",
     NEXT_PUBLIC_ADDRESS: "https://app.test",
     IMAGE_SOURCES: "https://img.test",
+    NEXT_PUBLIC_CORPUS_URL: "https://corpus.test",
     APP_URL: "https://app.test",
   };
   for (const key of [
     "NEXT_PUBLIC_VAPID_PUBLIC_KEY",
     "NEXT_PUBLIC_GOOGLE_MAPS_API_KEY",
-    "NEXT_PUBLIC_CORPUS_URL",
     "NEXT_PUBLIC_GTM_ID",
     "E2E_BUILD",
   ])
@@ -139,7 +139,11 @@ describe("createNextConfig: behaviour", () => {
     expect(plain.allowedDevOrigins).toEqual(["example.test"]);
     expect(plain.images).toEqual({
       minimumCacheTTL: 60,
-      remotePatterns: [{ protocol: "https", hostname: "img.test" }],
+      remotePatterns: [
+        { protocol: "https", hostname: "img.test" },
+        { protocol: "https", hostname: "api.test" },
+        { protocol: "https", hostname: "corpus.test" },
+      ],
       dangerouslyAllowLocalIP: true,
     });
 
@@ -166,6 +170,16 @@ describe("createNextConfig: behaviour", () => {
     expect(production.distDir).toBeUndefined();
   });
 
+  it("lets the optimizer fetch from the api and corpus origins, skipping unset and duplicate ones", () => {
+    vi.stubEnv("NEXT_PUBLIC_CORPUS_URL", undefined);
+    vi.stubEnv("IMAGE_SOURCES", "https://img.test,https://api.test");
+    const config = createNextConfig(base) as { images: { remotePatterns: unknown[] } };
+    expect(config.images.remotePatterns).toEqual([
+      { protocol: "https", hostname: "img.test" },
+      { protocol: "https", hostname: "api.test" },
+    ]);
+  });
+
   it("reactCompiler option sets both reactCompiler and turbopackRustReactCompiler", () => {
     const on = createNextConfig({ ...base, reactCompiler: true });
     expect(on.reactCompiler).toBe(true);
@@ -197,7 +211,7 @@ describe("buildCsp", () => {
     expect(csp["script-src"]).toEqual(["'self'", "'unsafe-eval'", "'unsafe-inline'"]);
     expect(csp["style-src"]).toEqual(["'self'", "'unsafe-inline'"]);
     expect(csp["font-src"]).toEqual(["'self'"]);
-    expect(csp["frame-src"]).toEqual(["'self'"]);
+    expect(csp["frame-src"]).toEqual(["'self'", "https://api.test", "https://corpus.test"]);
     expect(csp["worker-src"]).toEqual(["'self'", "blob:"]);
     expect(buildCsp({}, env)).not.toMatch(/stripe|google|cloudflare|discord/);
   });
@@ -246,6 +260,8 @@ describe("buildCsp", () => {
     const csp = parseCsp(buildCsp({ services: ["stripe"], csp: { "frame-src": ["https://docs.google.com/"] } }, env));
     expect(csp["frame-src"]).toEqual([
       "'self'",
+      "https://api.test",
+      "https://corpus.test",
       "https://docs.google.com/",
       "https://hooks.stripe.com",
       "https://js.stripe.com",
@@ -260,6 +276,32 @@ describe("buildCsp", () => {
     expect(csp["img-src"]).toContain("https://img.test");
   });
 
+  it("allows images and frames from the api and corpus origins", () => {
+    const csp = parseCsp(buildCsp({}, env));
+    for (const directive of ["img-src", "frame-src"]) {
+      expect(csp[directive]).toEqual(expect.arrayContaining(["https://api.test", "https://corpus.test"]));
+    }
+  });
+
+  it("lists the api and corpus origins once, and nothing for an unset corpus", () => {
+    const value = buildCsp({}, {
+      NODE_ENV: "production",
+      NEXT_PUBLIC_API_URL: "https://api.test/",
+      IMAGE_SOURCES: "https://api.test",
+    } as unknown as NodeJS.ProcessEnv);
+    for (const directive of ["img-src", "frame-src"]) {
+      const sources = value
+        .split(";")
+        .map((part) => part.trim().split(/\s+/))
+        .find(([name]) => name === directive)!
+        .slice(1);
+      expect(sources.filter((source) => source === "https://api.test")).toHaveLength(1);
+      expect(sources.join(" ")).not.toContain("corpus");
+      expect(sources).not.toContain("");
+    }
+    expect(value).not.toMatch(/\s{2,}/);
+  });
+
   it("drops empty sources when env values are missing", () => {
     const value = buildCsp({ csp: { "img-src": [""] } }, { NODE_ENV: "development" } as unknown as NodeJS.ProcessEnv);
     expect(value).not.toMatch(/\s{2,}/);

package/src/next-config/csp.ts

@@ -52,12 +52,33 @@ function listImageSources(env: NodeJS.ProcessEnv): string[] {
   return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(",").map((s) => s.trim()) : [];
 }
 
+/**
+ * Origins of the app's own servers, the API and the corpus, from
+ * `NEXT_PUBLIC_API_URL` and `NEXT_PUBLIC_CORPUS_URL`. They serve every stored
+ * object link, so images and frames must be allowed from them. Unset or invalid
+ * URLs are skipped; the result has no duplicates.
+ */
+export function listAppOrigins(env: NodeJS.ProcessEnv): string[] {
+  const origins: string[] = [];
+  for (const url of [env.NEXT_PUBLIC_API_URL, env.NEXT_PUBLIC_CORPUS_URL]) {
+    if (!url) continue;
+    try {
+      const { origin } = new URL(url.trim());
+      if (origin !== "null" && !origins.includes(origin)) origins.push(origin);
+    } catch {
+      // Not a URL: nothing to allow.
+    }
+  }
+  return origins;
+}
+
 // Build CSP directives
 // Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features
 // In production, consider using nonces for stricter CSP
 export function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {
   const apiUrl = env.NEXT_PUBLIC_API_URL || "";
   const imageSources = listImageSources(env);
+  const appOrigins = listAppOrigins(env);
   const services = options.services ?? [];
 
   // Each fetch directive: what Next itself needs, then the named services, then
@@ -67,8 +88,8 @@ export function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {
     "script-src": { base: ["'self'", "'unsafe-inline'", "'unsafe-eval'"], fromEnv: [] },
     // Styles: self and unsafe-inline for styled-components/emotion
     "style-src": { base: ["'self'", "'unsafe-inline'"], fromEnv: [] },
-    // Images: self, data URIs, blobs, and configured image sources
-    "img-src": { base: ["'self'", "data:", "blob:"], fromEnv: imageSources },
+    // Images: self, data URIs, blobs, configured image sources, and the api/corpus origins
+    "img-src": { base: ["'self'", "data:", "blob:"], fromEnv: [...imageSources, ...appOrigins] },
     // Fonts: self
     "font-src": { base: ["'self'"], fromEnv: [] },
     // Connect: self, API (http + ws for socket.io), and storage (for uploads)
@@ -82,8 +103,8 @@ export function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {
         ...imageSources,
       ],
     },
-    // Frames: self
-    "frame-src": { base: ["'self'"], fromEnv: [] },
+    // Frames: self, and the api/corpus origins (inline previews of stored objects)
+    "frame-src": { base: ["'self'"], fromEnv: appOrigins },
     // Worker sources: self and blob (for Web Workers with dynamic imports)
     "worker-src": { base: ["'self'", "blob:"], fromEnv: [] },
   };

package/src/next-config/index.ts

@@ -6,10 +6,10 @@
 // runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is
 // imported for its types only.
 import type { NextConfig } from "next";
-import { buildCsp, type CspDirective, type CspService } from "./csp";
+import { buildCsp, listAppOrigins, type CspDirective, type CspService } from "./csp";
 import { buildSecurityHeaders } from "./headers";
 
-export { buildCsp };
+export { buildCsp, listAppOrigins };
 export type { CspDirective, CspService };
 
 export interface NjaNextConfigOptions {
@@ -32,17 +32,24 @@ export interface NjaNextConfigOptions {
 
 type RemotePattern = { protocol: "http" | "https"; hostname: string; port?: string };
 
+// IMAGE_SOURCES, then the api and corpus origins (they serve every stored object
+// link), without duplicates.
 function parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {
-  return env.IMAGE_SOURCES
-    ? env.IMAGE_SOURCES.split(",").map((url) => {
-        const { hostname, protocol, port } = new URL(url.trim());
-        return {
-          protocol: protocol.replace(":", "") as RemotePattern["protocol"],
-          hostname,
-          port: port || undefined,
-        };
-      })
-    : [];
+  const imageSources = env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(",").map((url) => url.trim()) : [];
+  const patterns: RemotePattern[] = [];
+  for (const url of [...imageSources, ...listAppOrigins(env)]) {
+    const { hostname, protocol, port } = new URL(url);
+    const pattern: RemotePattern = {
+      protocol: protocol.replace(":", "") as RemotePattern["protocol"],
+      hostname,
+      port: port || undefined,
+    };
+    const seen = patterns.some(
+      (p) => p.protocol === pattern.protocol && p.hostname === pattern.hostname && p.port === pattern.port,
+    );
+    if (!seen) patterns.push(pattern);
+  }
+  return patterns;
 }
 
 export function createNextConfig(options: NjaNextConfigOptions): NextConfig {