@carlonicora/nextjs-jsonapi 4.0.8 → 4.1.1

package/dist/features/tokenusage/index.mjs

@@ -9,7 +9,7 @@ import {
   percentageDelta,
   seriesColor,
   useUsageFormatters
-} from "../../chunk-RDI62FAT.mjs";
+} from "../../chunk-HZVVRIJQ.mjs";
 import {
   Button,
   Card,
@@ -37,8 +37,8 @@ import {
   TableHeader,
   TableRow,
   usePageUrlGenerator
-} from "../../chunk-DJRTJBSZ.mjs";
-import "../../chunk-XTOEN5GN.mjs";
+} from "../../chunk-6ISF5KNQ.mjs";
+import "../../chunk-ZO3QQ5CQ.mjs";
 import "../../chunk-PW42LRSL.mjs";
 import {
   AbstractService,
@@ -57,7 +57,7 @@ import {
   configureTokenUsage,
   getTokenUsageCurrency,
   tokenUsageModules
-} from "../../chunk-Z3226FM6.mjs";
+} from "../../chunk-ZZ6E33FO.mjs";
 import "../../chunk-AUXK7QSA.mjs";
 import "../../chunk-PI56A4DG.mjs";
 import "../../chunk-V5MI7RNB.mjs";

package/dist/index.js

@@ -14,7 +14,7 @@
 
 
 
-var _chunk7ZRQOLSVjs = require('./chunk-7ZRQOLSV.js');
+var _chunkWQ77CUUZjs = require('./chunk-WQ77CUUZ.js');
 
 
 
@@ -248,7 +248,7 @@ var _chunkG4JR3SFVjs = require('./chunk-G4JR3SFV.js');
 
 
 
-var _chunk5PNDDYGLjs = require('./chunk-5PNDDYGL.js');
+var _chunk4BZJ4LABjs = require('./chunk-4BZJ4LAB.js');
 require('./chunk-LXKSUWAV.js');
 require('./chunk-JTPRJNT2.js');
 
@@ -521,5 +521,5 @@ require('./chunk-7QVYU63E.js');
 
 
 
-exports.ACTION_TYPES = _chunk7ZRQOLSVjs.ACTION_TYPES; exports.AVAILABLE_OAUTH_SCOPES = _chunk5PNDDYGLjs.AVAILABLE_OAUTH_SCOPES; exports.AbstractApiData = _chunk5PNDDYGLjs.AbstractApiData; exports.AbstractService = _chunk5PNDDYGLjs.AbstractService; exports.Action = _chunk5PNDDYGLjs.Action; exports.AiConnection = _chunk5PNDDYGLjs.AiConnection; exports.AiConnectionFields = _chunk5PNDDYGLjs.AiConnectionFields; exports.AiConnectionModule = _chunk5PNDDYGLjs.AiConnectionModule; exports.AiConnectionService = _chunk5PNDDYGLjs.AiConnectionService; exports.Assistant = _chunk5PNDDYGLjs.Assistant; exports.AssistantAction = _chunk5PNDDYGLjs.AssistantAction; exports.AssistantActionModule = _chunk5PNDDYGLjs.AssistantActionModule; exports.AssistantActionService = _chunk5PNDDYGLjs.AssistantActionService; exports.AssistantMessage = _chunk5PNDDYGLjs.AssistantMessage; exports.AssistantMessageModule = _chunk5PNDDYGLjs.AssistantMessageModule; exports.AssistantMessageService = _chunk5PNDDYGLjs.AssistantMessageService; exports.AssistantModule = _chunk5PNDDYGLjs.AssistantModule; exports.AssistantService = _chunk5PNDDYGLjs.AssistantService; exports.AuditLog = _chunk5PNDDYGLjs.AuditLog; exports.AuditLogModule = _chunk5PNDDYGLjs.AuditLogModule; exports.AuditLogService = _chunk5PNDDYGLjs.AuditLogService; exports.Auth = _chunk5PNDDYGLjs.Auth; exports.AuthComponent = _chunk5PNDDYGLjs.AuthComponent; exports.AuthModule = _chunk5PNDDYGLjs.AuthModule; exports.AuthService = _chunk5PNDDYGLjs.AuthService; exports.AuthorModule = _chunk5PNDDYGLjs.AuthorModule; exports.BackupCodeVerify = _chunk5PNDDYGLjs.BackupCodeVerify; exports.BackupCodeVerifyModule = _chunk5PNDDYGLjs.BackupCodeVerifyModule; exports.Billing = _chunk5PNDDYGLjs.Billing; exports.BillingModule = _chunk5PNDDYGLjs.BillingModule; exports.BillingService = _chunk5PNDDYGLjs.BillingService; exports.BlockNoteDiffUtil = _chunk5PNDDYGLjs.BlockNoteDiffUtil; exports.BlockNoteWordDiffRendererUtil = _chunk5PNDDYGLjs.BlockNoteWordDiffRendererUtil; exports.COMPANY_ADMINISTRATOR_ROLE_ID = _chunk7ZRQOLSVjs.COMPANY_ADMINISTRATOR_ROLE_ID; exports.CURRENT_USER_STORAGE_KEY = _chunk5PNDDYGLjs.CURRENT_USER_STORAGE_KEY; exports.Chunk = _chunk5PNDDYGLjs.Chunk; exports.ChunkModule = _chunk5PNDDYGLjs.ChunkModule; exports.ClientAbstractService = _chunk5PNDDYGLjs.ClientAbstractService; exports.ClientHttpMethod = _chunk5PNDDYGLjs.ClientHttpMethod; exports.Company = _chunk5PNDDYGLjs.Company; exports.CompanyFields = _chunk5PNDDYGLjs.CompanyFields; exports.CompanyModule = _chunk5PNDDYGLjs.CompanyModule; exports.CompanyService = _chunk5PNDDYGLjs.CompanyService; exports.Content = _chunk5PNDDYGLjs.Content; exports.ContentFields = _chunk5PNDDYGLjs.ContentFields; exports.ContentModule = _chunk5PNDDYGLjs.ContentModule; exports.ContentService = _chunk5PNDDYGLjs.ContentService; exports.DEFAULT_GRANT_TYPES = _chunk5PNDDYGLjs.DEFAULT_GRANT_TYPES; exports.DataClass = _chunkGHE4VT2Rjs.DataClassRegistry; exports.DataClassRegistry = _chunkGHE4VT2Rjs.DataClassRegistry; exports.ENV = _chunkGHE4VT2Rjs.ENV; exports.EndpointCreator = _chunk5PNDDYGLjs.EndpointCreator; exports.EntityAiStatus = _chunk5PNDDYGLjs.EntityAiStatus; exports.Feature = _chunk5PNDDYGLjs.Feature; exports.FeatureModule = _chunk5PNDDYGLjs.FeatureModule; exports.FeatureService = _chunk5PNDDYGLjs.FeatureService; exports.HandbookPage = _chunk5PNDDYGLjs.HandbookPage; exports.HandbookPageFields = _chunk5PNDDYGLjs.HandbookPageFields; exports.HandbookPageModule = _chunk5PNDDYGLjs.HandbookPageModule; exports.HandbookPageService = _chunk5PNDDYGLjs.HandbookPageService; exports.HandbookSection = _chunk5PNDDYGLjs.HandbookSection; exports.HandbookSectionModule = _chunk5PNDDYGLjs.HandbookSectionModule; exports.HandbookSectionService = _chunk5PNDDYGLjs.HandbookSectionService; exports.HandbookThread = _chunk5PNDDYGLjs.HandbookThread; exports.HandbookThreadMessage = _chunk5PNDDYGLjs.HandbookThreadMessage; exports.HandbookThreadMessageModule = _chunk5PNDDYGLjs.HandbookThreadMessageModule; exports.HandbookThreadMessageService = _chunk5PNDDYGLjs.HandbookThreadMessageService; exports.HandbookThreadModule = _chunk5PNDDYGLjs.HandbookThreadModule; exports.HandbookThreadService = _chunk5PNDDYGLjs.HandbookThreadService; exports.HowTo = _chunk5PNDDYGLjs.HowTo; exports.HowToFields = _chunk5PNDDYGLjs.HowToFields; exports.HowToModule = _chunk5PNDDYGLjs.HowToModule; exports.HowToService = _chunk5PNDDYGLjs.HowToService; exports.HttpMethod = _chunk5PNDDYGLjs.HttpMethod; exports.InvoiceStatus = _chunk5PNDDYGLjs.InvoiceStatus; exports.JsonApiDataFactory = _chunkGHE4VT2Rjs.JsonApiDataFactory; exports.MOBILE_BREAKPOINT = _chunk5PNDDYGLjs.MOBILE_BREAKPOINT; exports.Module = _chunk5PNDDYGLjs.Module; exports.ModuleModule = _chunk5PNDDYGLjs.ModuleModule; exports.ModulePaths = _chunk5PNDDYGLjs.ModulePaths; exports.ModulePathsModule = _chunk5PNDDYGLjs.ModulePathsModule; exports.ModuleRegistrar = _chunk5PNDDYGLjs.ModuleRegistrar; exports.ModuleRegistry = _chunk5PNDDYGLjs.ModuleRegistry; exports.Modules = _chunk5PNDDYGLjs.Modules; exports.Notification = _chunk5PNDDYGLjs.Notification; exports.NotificationFields = _chunk5PNDDYGLjs.NotificationFields; exports.NotificationModule = _chunk5PNDDYGLjs.NotificationModule; exports.NotificationService = _chunk5PNDDYGLjs.NotificationService; exports.OAUTH_SCOPE_DISPLAY = _chunk5PNDDYGLjs.OAUTH_SCOPE_DISPLAY; exports.OAuthClient = _chunk5PNDDYGLjs.OAuthClient; exports.OAuthModule = _chunk5PNDDYGLjs.OAuthModule; exports.OAuthService = _chunk5PNDDYGLjs.OAuthService; exports.Passkey = _chunk5PNDDYGLjs.Passkey; exports.PasskeyAuthenticationOptions = _chunk5PNDDYGLjs.PasskeyAuthenticationOptions; exports.PasskeyAuthenticationOptionsModule = _chunk5PNDDYGLjs.PasskeyAuthenticationOptionsModule; exports.PasskeyModule = _chunk5PNDDYGLjs.PasskeyModule; exports.PasskeyRegistrationOptions = _chunk5PNDDYGLjs.PasskeyRegistrationOptions; exports.PasskeyRegistrationOptionsModule = _chunk5PNDDYGLjs.PasskeyRegistrationOptionsModule; exports.PasskeyRegistrationVerify = _chunk5PNDDYGLjs.PasskeyRegistrationVerify; exports.PasskeyRegistrationVerifyModule = _chunk5PNDDYGLjs.PasskeyRegistrationVerifyModule; exports.PasskeyRename = _chunk5PNDDYGLjs.PasskeyRename; exports.PasskeyRenameModule = _chunk5PNDDYGLjs.PasskeyRenameModule; exports.PasskeyVerifyLogin = _chunk5PNDDYGLjs.PasskeyVerifyLogin; exports.PasskeyVerifyLoginModule = _chunk5PNDDYGLjs.PasskeyVerifyLoginModule; exports.PaymentMethod = _chunk5PNDDYGLjs.PaymentMethod; exports.PermissionMapping = _chunk5PNDDYGLjs.PermissionMapping; exports.PermissionMappingModule = _chunk5PNDDYGLjs.PermissionMappingModule; exports.Push = _chunk5PNDDYGLjs.Push; exports.PushModule = _chunk5PNDDYGLjs.PushModule; exports.PushService = _chunk5PNDDYGLjs.PushService; exports.RbacMatrixModel = _chunk5PNDDYGLjs.RbacMatrixModel; exports.RbacMatrixModule = _chunk5PNDDYGLjs.RbacMatrixModule; exports.RbacService = _chunk7ZRQOLSVjs.RbacService; exports.ReferralModule = _chunk5PNDDYGLjs.ReferralModule; exports.ReferralService = _chunk5PNDDYGLjs.ReferralService; exports.ReferralStats = _chunk5PNDDYGLjs.ReferralStats; exports.ReferralStatsModule = _chunk5PNDDYGLjs.ReferralStatsModule; exports.RehydrationFactory = _chunk5PNDDYGLjs.RehydrationFactory; exports.Role = _chunk5PNDDYGLjs.Role; exports.RoleFields = _chunk5PNDDYGLjs.RoleFields; exports.RoleModule = _chunk5PNDDYGLjs.RoleModule; exports.RoleService = _chunk5PNDDYGLjs.RoleService; exports.S3 = _chunk5PNDDYGLjs.S3; exports.S3Module = _chunk5PNDDYGLjs.S3Module; exports.S3Service = _chunk5PNDDYGLjs.S3Service; exports.StripeCustomer = _chunk5PNDDYGLjs.StripeCustomer; exports.StripeCustomerModule = _chunk5PNDDYGLjs.StripeCustomerModule; exports.StripeCustomerService = _chunk5PNDDYGLjs.StripeCustomerService; exports.StripeInvoice = _chunk5PNDDYGLjs.StripeInvoice; exports.StripeInvoiceModule = _chunk5PNDDYGLjs.StripeInvoiceModule; exports.StripeInvoiceService = _chunk5PNDDYGLjs.StripeInvoiceService; exports.StripePaymentMethodModule = _chunk5PNDDYGLjs.StripePaymentMethodModule; exports.StripePrice = _chunk5PNDDYGLjs.StripePrice; exports.StripePriceFields = _chunk5PNDDYGLjs.StripePriceFields; exports.StripePriceModule = _chunk5PNDDYGLjs.StripePriceModule; exports.StripePriceService = _chunk5PNDDYGLjs.StripePriceService; exports.StripeProduct = _chunk5PNDDYGLjs.StripeProduct; exports.StripeProductFields = _chunk5PNDDYGLjs.StripeProductFields; exports.StripeProductModule = _chunk5PNDDYGLjs.StripeProductModule; exports.StripeProductService = _chunk5PNDDYGLjs.StripeProductService; exports.StripePromotionCode = _chunk5PNDDYGLjs.StripePromotionCode; exports.StripePromotionCodeModule = _chunk5PNDDYGLjs.StripePromotionCodeModule; exports.StripePromotionCodeService = _chunk5PNDDYGLjs.StripePromotionCodeService; exports.StripeSubscription = _chunk5PNDDYGLjs.StripeSubscription; exports.StripeSubscriptionModule = _chunk5PNDDYGLjs.StripeSubscriptionModule; exports.StripeSubscriptionService = _chunk5PNDDYGLjs.StripeSubscriptionService; exports.StripeUsage = _chunk5PNDDYGLjs.StripeUsage; exports.StripeUsageModule = _chunk5PNDDYGLjs.StripeUsageModule; exports.StripeUsageService = _chunk5PNDDYGLjs.StripeUsageService; exports.SubscriptionStatus = _chunk5PNDDYGLjs.SubscriptionStatus; exports.TableOptions = _chunk5PNDDYGLjs.TableOptions; exports.TokenUsageAdminBreakdownModule = _chunk5PNDDYGLjs.TokenUsageAdminBreakdownModule; exports.TokenUsageAdminSummaryModule = _chunk5PNDDYGLjs.TokenUsageAdminSummaryModule; exports.TokenUsageAdminTimelineModule = _chunk5PNDDYGLjs.TokenUsageAdminTimelineModule; exports.TotpAuthenticator = _chunk5PNDDYGLjs.TotpAuthenticator; exports.TotpAuthenticatorModule = _chunk5PNDDYGLjs.TotpAuthenticatorModule; exports.TotpSetup = _chunk5PNDDYGLjs.TotpSetup; exports.TotpSetupModule = _chunk5PNDDYGLjs.TotpSetupModule; exports.TotpVerify = _chunk5PNDDYGLjs.TotpVerify; exports.TotpVerifyLogin = _chunk5PNDDYGLjs.TotpVerifyLogin; exports.TotpVerifyLoginModule = _chunk5PNDDYGLjs.TotpVerifyLoginModule; exports.TotpVerifyModule = _chunk5PNDDYGLjs.TotpVerifyModule; exports.TwoFactorChallenge = _chunk5PNDDYGLjs.TwoFactorChallenge; exports.TwoFactorChallengeModule = _chunk5PNDDYGLjs.TwoFactorChallengeModule; exports.TwoFactorEnable = _chunk5PNDDYGLjs.TwoFactorEnable; exports.TwoFactorEnableModule = _chunk5PNDDYGLjs.TwoFactorEnableModule; exports.TwoFactorService = _chunk5PNDDYGLjs.TwoFactorService; exports.TwoFactorStatus = _chunk5PNDDYGLjs.TwoFactorStatus; exports.TwoFactorStatusModule = _chunk5PNDDYGLjs.TwoFactorStatusModule; exports.User = _chunk5PNDDYGLjs.User; exports.UserFields = _chunk5PNDDYGLjs.UserFields; exports.UserModule = _chunk5PNDDYGLjs.UserModule; exports.UserService = _chunk5PNDDYGLjs.UserService; exports.VIEWPORT_COOKIE_NAME = _chunk5PNDDYGLjs.VIEWPORT_COOKIE_NAME; exports.Waitlist = _chunk5PNDDYGLjs.Waitlist; exports.WaitlistFields = _chunk5PNDDYGLjs.WaitlistFields; exports.WaitlistModule = _chunk5PNDDYGLjs.WaitlistModule; exports.WaitlistService = _chunk5PNDDYGLjs.WaitlistService; exports.WaitlistStats = _chunk5PNDDYGLjs.WaitlistStats; exports.WaitlistStatsModule = _chunk5PNDDYGLjs.WaitlistStatsModule; exports.analyticsModules = _chunk5PNDDYGLjs.analyticsModules; exports.checkPermissions = _chunk5PNDDYGLjs.checkPermissions; exports.checkPermissionsFromServer = _chunk5PNDDYGLjs.checkPermissionsFromServer; exports.clearLastApiMeta = _chunk5PNDDYGLjs.clearLastApiMeta; exports.clearLastApiTotal = _chunk5PNDDYGLjs.clearLastApiTotal; exports.cn = _chunk5PNDDYGLjs.cn; exports.composeRefs = _chunk5PNDDYGLjs.composeRefs; exports.configureAuth = _chunk5PNDDYGLjs.configureAuth; exports.configureI18n = _chunk5PNDDYGLjs.configureI18n; exports.configureJsonApi = _chunk7ZRQOLSVjs.configureJsonApi; exports.configureLogin = _chunk7ZRQOLSVjs.configureLogin; exports.configureReferral = _chunk7ZRQOLSVjs.configureReferral; exports.configureRoles = _chunkG4JR3SFVjs.configureRoles; exports.configureTokenUsage = _chunk5PNDDYGLjs.configureTokenUsage; exports.configureWaitlist = _chunk7ZRQOLSVjs.configureWaitlist; exports.createJsonApiInclusion = _chunk5PNDDYGLjs.createJsonApiInclusion; exports.dismissToast = _chunk5PNDDYGLjs.dismissToast; exports.entityObjectSchema = _chunk5PNDDYGLjs.entityObjectSchema; exports.exists = _chunk5PNDDYGLjs.exists; exports.formatCodiceFiscale = _chunk5PNDDYGLjs.formatCodiceFiscale; exports.formatDate = _chunk5PNDDYGLjs.formatDate; exports.formatLocalDate = _chunk5PNDDYGLjs.formatLocalDate; exports.formatPartitaIva = _chunk5PNDDYGLjs.formatPartitaIva; exports.getApiUrl = _chunk7ZRQOLSVjs.getApiUrl; exports.getAppUrl = _chunk7ZRQOLSVjs.getAppUrl; exports.getBootstrapper = _chunkGHE4VT2Rjs.getBootstrapper; exports.getClientGlobalErrorHandler = _chunk5PNDDYGLjs.getClientGlobalErrorHandler; exports.getGlobalErrorHandler = _chunk5PNDDYGLjs.getGlobalErrorHandler; exports.getIcon = _chunk5PNDDYGLjs.getIcon; exports.getIconByModule = _chunk5PNDDYGLjs.getIconByModule; exports.getIconByModuleName = _chunk5PNDDYGLjs.getIconByModuleName; exports.getInitials = _chunk5PNDDYGLjs.getInitials; exports.getLastApiMeta = _chunk5PNDDYGLjs.getLastApiMeta; exports.getLastApiTotal = _chunk5PNDDYGLjs.getLastApiTotal; exports.getLucideIcon = _chunk5PNDDYGLjs.getLucideIcon; exports.getLucideIconByModule = _chunk5PNDDYGLjs.getLucideIconByModule; exports.getLucideIconByModuleName = _chunk5PNDDYGLjs.getLucideIconByModuleName; exports.getPublicApiUrl = _chunk7ZRQOLSVjs.getPublicApiUrl; exports.getReferralConfig = _chunk7ZRQOLSVjs.getReferralConfig; exports.getRoleId = _chunkG4JR3SFVjs.getRoleId; exports.getStripePublishableKey = _chunk7ZRQOLSVjs.getStripePublishableKey; exports.getTableComponents = _chunk5PNDDYGLjs.getTableComponents; exports.getTableOptions = _chunk5PNDDYGLjs.getTableOptions; exports.getTokenHandler = _chunk5PNDDYGLjs.getTokenHandler; exports.getTokenUsageCurrency = _chunk5PNDDYGLjs.getTokenUsageCurrency; exports.getTrackablePages = _chunk7ZRQOLSVjs.getTrackablePages; exports.getValueFromPath = _chunk5PNDDYGLjs.getValueFromPath; exports.getWaitlistConfig = _chunk7ZRQOLSVjs.getWaitlistConfig; exports.handbookPageContent = _chunk5PNDDYGLjs.handbookPageContent; exports.handbookPageSummary = _chunk5PNDDYGLjs.handbookPageSummary; exports.handbookPageTitle = _chunk5PNDDYGLjs.handbookPageTitle; exports.handbookSectionSummary = _chunk5PNDDYGLjs.handbookSectionSummary; exports.handbookSectionTitle = _chunk5PNDDYGLjs.handbookSectionTitle; exports.hasBootstrapper = _chunkGHE4VT2Rjs.hasBootstrapper; exports.isReferralEnabled = _chunk7ZRQOLSVjs.isReferralEnabled; exports.isRemoteImageSrc = _chunk5PNDDYGLjs.isRemoteImageSrc; exports.isRolesConfigured = _chunkG4JR3SFVjs.isRolesConfigured; exports.rehydrate = _chunk5PNDDYGLjs.rehydrate; exports.rehydrateList = _chunk5PNDDYGLjs.rehydrateList; exports.resetBootstrapStore = _chunkGHE4VT2Rjs.resetBootstrapStore; exports.setBootstrapper = _chunkGHE4VT2Rjs.setBootstrapper; exports.setClientGlobalErrorHandler = _chunk5PNDDYGLjs.setClientGlobalErrorHandler; exports.setGlobalErrorHandler = _chunk5PNDDYGLjs.setGlobalErrorHandler; exports.showCustomToast = _chunk5PNDDYGLjs.showCustomToast; exports.showError = _chunk5PNDDYGLjs.showError; exports.showToast = _chunk5PNDDYGLjs.showToast; exports.tokenUsageModules = _chunk5PNDDYGLjs.tokenUsageModules; exports.translateData = _chunkGHE4VT2Rjs.translateData; exports.translateResponse = _chunkGHE4VT2Rjs.translateResponse; exports.tryBootstrap = _chunkGHE4VT2Rjs.tryBootstrap; exports.useComposedRefs = _chunk5PNDDYGLjs.useComposedRefs; exports.useIsMobile = _chunk5PNDDYGLjs.useIsMobile; exports.userObjectSchema = _chunk5PNDDYGLjs.userObjectSchema; exports.validateCodiceFiscale = _chunk5PNDDYGLjs.validateCodiceFiscale; exports.validateItalianTaxCode = _chunk5PNDDYGLjs.validateItalianTaxCode; exports.validatePartitaIva = _chunk5PNDDYGLjs.validatePartitaIva;
+exports.ACTION_TYPES = _chunkWQ77CUUZjs.ACTION_TYPES; exports.AVAILABLE_OAUTH_SCOPES = _chunk4BZJ4LABjs.AVAILABLE_OAUTH_SCOPES; exports.AbstractApiData = _chunk4BZJ4LABjs.AbstractApiData; exports.AbstractService = _chunk4BZJ4LABjs.AbstractService; exports.Action = _chunk4BZJ4LABjs.Action; exports.AiConnection = _chunk4BZJ4LABjs.AiConnection; exports.AiConnectionFields = _chunk4BZJ4LABjs.AiConnectionFields; exports.AiConnectionModule = _chunk4BZJ4LABjs.AiConnectionModule; exports.AiConnectionService = _chunk4BZJ4LABjs.AiConnectionService; exports.Assistant = _chunk4BZJ4LABjs.Assistant; exports.AssistantAction = _chunk4BZJ4LABjs.AssistantAction; exports.AssistantActionModule = _chunk4BZJ4LABjs.AssistantActionModule; exports.AssistantActionService = _chunk4BZJ4LABjs.AssistantActionService; exports.AssistantMessage = _chunk4BZJ4LABjs.AssistantMessage; exports.AssistantMessageModule = _chunk4BZJ4LABjs.AssistantMessageModule; exports.AssistantMessageService = _chunk4BZJ4LABjs.AssistantMessageService; exports.AssistantModule = _chunk4BZJ4LABjs.AssistantModule; exports.AssistantService = _chunk4BZJ4LABjs.AssistantService; exports.AuditLog = _chunk4BZJ4LABjs.AuditLog; exports.AuditLogModule = _chunk4BZJ4LABjs.AuditLogModule; exports.AuditLogService = _chunk4BZJ4LABjs.AuditLogService; exports.Auth = _chunk4BZJ4LABjs.Auth; exports.AuthComponent = _chunk4BZJ4LABjs.AuthComponent; exports.AuthModule = _chunk4BZJ4LABjs.AuthModule; exports.AuthService = _chunk4BZJ4LABjs.AuthService; exports.AuthorModule = _chunk4BZJ4LABjs.AuthorModule; exports.BackupCodeVerify = _chunk4BZJ4LABjs.BackupCodeVerify; exports.BackupCodeVerifyModule = _chunk4BZJ4LABjs.BackupCodeVerifyModule; exports.Billing = _chunk4BZJ4LABjs.Billing; exports.BillingModule = _chunk4BZJ4LABjs.BillingModule; exports.BillingService = _chunk4BZJ4LABjs.BillingService; exports.BlockNoteDiffUtil = _chunk4BZJ4LABjs.BlockNoteDiffUtil; exports.BlockNoteWordDiffRendererUtil = _chunk4BZJ4LABjs.BlockNoteWordDiffRendererUtil; exports.COMPANY_ADMINISTRATOR_ROLE_ID = _chunkWQ77CUUZjs.COMPANY_ADMINISTRATOR_ROLE_ID; exports.CURRENT_USER_STORAGE_KEY = _chunk4BZJ4LABjs.CURRENT_USER_STORAGE_KEY; exports.Chunk = _chunk4BZJ4LABjs.Chunk; exports.ChunkModule = _chunk4BZJ4LABjs.ChunkModule; exports.ClientAbstractService = _chunk4BZJ4LABjs.ClientAbstractService; exports.ClientHttpMethod = _chunk4BZJ4LABjs.ClientHttpMethod; exports.Company = _chunk4BZJ4LABjs.Company; exports.CompanyFields = _chunk4BZJ4LABjs.CompanyFields; exports.CompanyModule = _chunk4BZJ4LABjs.CompanyModule; exports.CompanyService = _chunk4BZJ4LABjs.CompanyService; exports.Content = _chunk4BZJ4LABjs.Content; exports.ContentFields = _chunk4BZJ4LABjs.ContentFields; exports.ContentModule = _chunk4BZJ4LABjs.ContentModule; exports.ContentService = _chunk4BZJ4LABjs.ContentService; exports.DEFAULT_GRANT_TYPES = _chunk4BZJ4LABjs.DEFAULT_GRANT_TYPES; exports.DataClass = _chunkGHE4VT2Rjs.DataClassRegistry; exports.DataClassRegistry = _chunkGHE4VT2Rjs.DataClassRegistry; exports.ENV = _chunkGHE4VT2Rjs.ENV; exports.EndpointCreator = _chunk4BZJ4LABjs.EndpointCreator; exports.EntityAiStatus = _chunk4BZJ4LABjs.EntityAiStatus; exports.Feature = _chunk4BZJ4LABjs.Feature; exports.FeatureModule = _chunk4BZJ4LABjs.FeatureModule; exports.FeatureService = _chunk4BZJ4LABjs.FeatureService; exports.HandbookPage = _chunk4BZJ4LABjs.HandbookPage; exports.HandbookPageFields = _chunk4BZJ4LABjs.HandbookPageFields; exports.HandbookPageModule = _chunk4BZJ4LABjs.HandbookPageModule; exports.HandbookPageService = _chunk4BZJ4LABjs.HandbookPageService; exports.HandbookSection = _chunk4BZJ4LABjs.HandbookSection; exports.HandbookSectionModule = _chunk4BZJ4LABjs.HandbookSectionModule; exports.HandbookSectionService = _chunk4BZJ4LABjs.HandbookSectionService; exports.HandbookThread = _chunk4BZJ4LABjs.HandbookThread; exports.HandbookThreadMessage = _chunk4BZJ4LABjs.HandbookThreadMessage; exports.HandbookThreadMessageModule = _chunk4BZJ4LABjs.HandbookThreadMessageModule; exports.HandbookThreadMessageService = _chunk4BZJ4LABjs.HandbookThreadMessageService; exports.HandbookThreadModule = _chunk4BZJ4LABjs.HandbookThreadModule; exports.HandbookThreadService = _chunk4BZJ4LABjs.HandbookThreadService; exports.HowTo = _chunk4BZJ4LABjs.HowTo; exports.HowToFields = _chunk4BZJ4LABjs.HowToFields; exports.HowToModule = _chunk4BZJ4LABjs.HowToModule; exports.HowToService = _chunk4BZJ4LABjs.HowToService; exports.HttpMethod = _chunk4BZJ4LABjs.HttpMethod; exports.InvoiceStatus = _chunk4BZJ4LABjs.InvoiceStatus; exports.JsonApiDataFactory = _chunkGHE4VT2Rjs.JsonApiDataFactory; exports.MOBILE_BREAKPOINT = _chunk4BZJ4LABjs.MOBILE_BREAKPOINT; exports.Module = _chunk4BZJ4LABjs.Module; exports.ModuleModule = _chunk4BZJ4LABjs.ModuleModule; exports.ModulePaths = _chunk4BZJ4LABjs.ModulePaths; exports.ModulePathsModule = _chunk4BZJ4LABjs.ModulePathsModule; exports.ModuleRegistrar = _chunk4BZJ4LABjs.ModuleRegistrar; exports.ModuleRegistry = _chunk4BZJ4LABjs.ModuleRegistry; exports.Modules = _chunk4BZJ4LABjs.Modules; exports.Notification = _chunk4BZJ4LABjs.Notification; exports.NotificationFields = _chunk4BZJ4LABjs.NotificationFields; exports.NotificationModule = _chunk4BZJ4LABjs.NotificationModule; exports.NotificationService = _chunk4BZJ4LABjs.NotificationService; exports.OAUTH_SCOPE_DISPLAY = _chunk4BZJ4LABjs.OAUTH_SCOPE_DISPLAY; exports.OAuthClient = _chunk4BZJ4LABjs.OAuthClient; exports.OAuthModule = _chunk4BZJ4LABjs.OAuthModule; exports.OAuthService = _chunk4BZJ4LABjs.OAuthService; exports.Passkey = _chunk4BZJ4LABjs.Passkey; exports.PasskeyAuthenticationOptions = _chunk4BZJ4LABjs.PasskeyAuthenticationOptions; exports.PasskeyAuthenticationOptionsModule = _chunk4BZJ4LABjs.PasskeyAuthenticationOptionsModule; exports.PasskeyModule = _chunk4BZJ4LABjs.PasskeyModule; exports.PasskeyRegistrationOptions = _chunk4BZJ4LABjs.PasskeyRegistrationOptions; exports.PasskeyRegistrationOptionsModule = _chunk4BZJ4LABjs.PasskeyRegistrationOptionsModule; exports.PasskeyRegistrationVerify = _chunk4BZJ4LABjs.PasskeyRegistrationVerify; exports.PasskeyRegistrationVerifyModule = _chunk4BZJ4LABjs.PasskeyRegistrationVerifyModule; exports.PasskeyRename = _chunk4BZJ4LABjs.PasskeyRename; exports.PasskeyRenameModule = _chunk4BZJ4LABjs.PasskeyRenameModule; exports.PasskeyVerifyLogin = _chunk4BZJ4LABjs.PasskeyVerifyLogin; exports.PasskeyVerifyLoginModule = _chunk4BZJ4LABjs.PasskeyVerifyLoginModule; exports.PaymentMethod = _chunk4BZJ4LABjs.PaymentMethod; exports.PermissionMapping = _chunk4BZJ4LABjs.PermissionMapping; exports.PermissionMappingModule = _chunk4BZJ4LABjs.PermissionMappingModule; exports.Push = _chunk4BZJ4LABjs.Push; exports.PushModule = _chunk4BZJ4LABjs.PushModule; exports.PushService = _chunk4BZJ4LABjs.PushService; exports.RbacMatrixModel = _chunk4BZJ4LABjs.RbacMatrixModel; exports.RbacMatrixModule = _chunk4BZJ4LABjs.RbacMatrixModule; exports.RbacService = _chunkWQ77CUUZjs.RbacService; exports.ReferralModule = _chunk4BZJ4LABjs.ReferralModule; exports.ReferralService = _chunk4BZJ4LABjs.ReferralService; exports.ReferralStats = _chunk4BZJ4LABjs.ReferralStats; exports.ReferralStatsModule = _chunk4BZJ4LABjs.ReferralStatsModule; exports.RehydrationFactory = _chunk4BZJ4LABjs.RehydrationFactory; exports.Role = _chunk4BZJ4LABjs.Role; exports.RoleFields = _chunk4BZJ4LABjs.RoleFields; exports.RoleModule = _chunk4BZJ4LABjs.RoleModule; exports.RoleService = _chunk4BZJ4LABjs.RoleService; exports.S3 = _chunk4BZJ4LABjs.S3; exports.S3Module = _chunk4BZJ4LABjs.S3Module; exports.S3Service = _chunk4BZJ4LABjs.S3Service; exports.StripeCustomer = _chunk4BZJ4LABjs.StripeCustomer; exports.StripeCustomerModule = _chunk4BZJ4LABjs.StripeCustomerModule; exports.StripeCustomerService = _chunk4BZJ4LABjs.StripeCustomerService; exports.StripeInvoice = _chunk4BZJ4LABjs.StripeInvoice; exports.StripeInvoiceModule = _chunk4BZJ4LABjs.StripeInvoiceModule; exports.StripeInvoiceService = _chunk4BZJ4LABjs.StripeInvoiceService; exports.StripePaymentMethodModule = _chunk4BZJ4LABjs.StripePaymentMethodModule; exports.StripePrice = _chunk4BZJ4LABjs.StripePrice; exports.StripePriceFields = _chunk4BZJ4LABjs.StripePriceFields; exports.StripePriceModule = _chunk4BZJ4LABjs.StripePriceModule; exports.StripePriceService = _chunk4BZJ4LABjs.StripePriceService; exports.StripeProduct = _chunk4BZJ4LABjs.StripeProduct; exports.StripeProductFields = _chunk4BZJ4LABjs.StripeProductFields; exports.StripeProductModule = _chunk4BZJ4LABjs.StripeProductModule; exports.StripeProductService = _chunk4BZJ4LABjs.StripeProductService; exports.StripePromotionCode = _chunk4BZJ4LABjs.StripePromotionCode; exports.StripePromotionCodeModule = _chunk4BZJ4LABjs.StripePromotionCodeModule; exports.StripePromotionCodeService = _chunk4BZJ4LABjs.StripePromotionCodeService; exports.StripeSubscription = _chunk4BZJ4LABjs.StripeSubscription; exports.StripeSubscriptionModule = _chunk4BZJ4LABjs.StripeSubscriptionModule; exports.StripeSubscriptionService = _chunk4BZJ4LABjs.StripeSubscriptionService; exports.StripeUsage = _chunk4BZJ4LABjs.StripeUsage; exports.StripeUsageModule = _chunk4BZJ4LABjs.StripeUsageModule; exports.StripeUsageService = _chunk4BZJ4LABjs.StripeUsageService; exports.SubscriptionStatus = _chunk4BZJ4LABjs.SubscriptionStatus; exports.TableOptions = _chunk4BZJ4LABjs.TableOptions; exports.TokenUsageAdminBreakdownModule = _chunk4BZJ4LABjs.TokenUsageAdminBreakdownModule; exports.TokenUsageAdminSummaryModule = _chunk4BZJ4LABjs.TokenUsageAdminSummaryModule; exports.TokenUsageAdminTimelineModule = _chunk4BZJ4LABjs.TokenUsageAdminTimelineModule; exports.TotpAuthenticator = _chunk4BZJ4LABjs.TotpAuthenticator; exports.TotpAuthenticatorModule = _chunk4BZJ4LABjs.TotpAuthenticatorModule; exports.TotpSetup = _chunk4BZJ4LABjs.TotpSetup; exports.TotpSetupModule = _chunk4BZJ4LABjs.TotpSetupModule; exports.TotpVerify = _chunk4BZJ4LABjs.TotpVerify; exports.TotpVerifyLogin = _chunk4BZJ4LABjs.TotpVerifyLogin; exports.TotpVerifyLoginModule = _chunk4BZJ4LABjs.TotpVerifyLoginModule; exports.TotpVerifyModule = _chunk4BZJ4LABjs.TotpVerifyModule; exports.TwoFactorChallenge = _chunk4BZJ4LABjs.TwoFactorChallenge; exports.TwoFactorChallengeModule = _chunk4BZJ4LABjs.TwoFactorChallengeModule; exports.TwoFactorEnable = _chunk4BZJ4LABjs.TwoFactorEnable; exports.TwoFactorEnableModule = _chunk4BZJ4LABjs.TwoFactorEnableModule; exports.TwoFactorService = _chunk4BZJ4LABjs.TwoFactorService; exports.TwoFactorStatus = _chunk4BZJ4LABjs.TwoFactorStatus; exports.TwoFactorStatusModule = _chunk4BZJ4LABjs.TwoFactorStatusModule; exports.User = _chunk4BZJ4LABjs.User; exports.UserFields = _chunk4BZJ4LABjs.UserFields; exports.UserModule = _chunk4BZJ4LABjs.UserModule; exports.UserService = _chunk4BZJ4LABjs.UserService; exports.VIEWPORT_COOKIE_NAME = _chunk4BZJ4LABjs.VIEWPORT_COOKIE_NAME; exports.Waitlist = _chunk4BZJ4LABjs.Waitlist; exports.WaitlistFields = _chunk4BZJ4LABjs.WaitlistFields; exports.WaitlistModule = _chunk4BZJ4LABjs.WaitlistModule; exports.WaitlistService = _chunk4BZJ4LABjs.WaitlistService; exports.WaitlistStats = _chunk4BZJ4LABjs.WaitlistStats; exports.WaitlistStatsModule = _chunk4BZJ4LABjs.WaitlistStatsModule; exports.analyticsModules = _chunk4BZJ4LABjs.analyticsModules; exports.checkPermissions = _chunk4BZJ4LABjs.checkPermissions; exports.checkPermissionsFromServer = _chunk4BZJ4LABjs.checkPermissionsFromServer; exports.clearLastApiMeta = _chunk4BZJ4LABjs.clearLastApiMeta; exports.clearLastApiTotal = _chunk4BZJ4LABjs.clearLastApiTotal; exports.cn = _chunk4BZJ4LABjs.cn; exports.composeRefs = _chunk4BZJ4LABjs.composeRefs; exports.configureAuth = _chunk4BZJ4LABjs.configureAuth; exports.configureI18n = _chunk4BZJ4LABjs.configureI18n; exports.configureJsonApi = _chunkWQ77CUUZjs.configureJsonApi; exports.configureLogin = _chunkWQ77CUUZjs.configureLogin; exports.configureReferral = _chunkWQ77CUUZjs.configureReferral; exports.configureRoles = _chunkG4JR3SFVjs.configureRoles; exports.configureTokenUsage = _chunk4BZJ4LABjs.configureTokenUsage; exports.configureWaitlist = _chunkWQ77CUUZjs.configureWaitlist; exports.createJsonApiInclusion = _chunk4BZJ4LABjs.createJsonApiInclusion; exports.dismissToast = _chunk4BZJ4LABjs.dismissToast; exports.entityObjectSchema = _chunk4BZJ4LABjs.entityObjectSchema; exports.exists = _chunk4BZJ4LABjs.exists; exports.formatCodiceFiscale = _chunk4BZJ4LABjs.formatCodiceFiscale; exports.formatDate = _chunk4BZJ4LABjs.formatDate; exports.formatLocalDate = _chunk4BZJ4LABjs.formatLocalDate; exports.formatPartitaIva = _chunk4BZJ4LABjs.formatPartitaIva; exports.getApiUrl = _chunkWQ77CUUZjs.getApiUrl; exports.getAppUrl = _chunkWQ77CUUZjs.getAppUrl; exports.getBootstrapper = _chunkGHE4VT2Rjs.getBootstrapper; exports.getClientGlobalErrorHandler = _chunk4BZJ4LABjs.getClientGlobalErrorHandler; exports.getGlobalErrorHandler = _chunk4BZJ4LABjs.getGlobalErrorHandler; exports.getIcon = _chunk4BZJ4LABjs.getIcon; exports.getIconByModule = _chunk4BZJ4LABjs.getIconByModule; exports.getIconByModuleName = _chunk4BZJ4LABjs.getIconByModuleName; exports.getInitials = _chunk4BZJ4LABjs.getInitials; exports.getLastApiMeta = _chunk4BZJ4LABjs.getLastApiMeta; exports.getLastApiTotal = _chunk4BZJ4LABjs.getLastApiTotal; exports.getLucideIcon = _chunk4BZJ4LABjs.getLucideIcon; exports.getLucideIconByModule = _chunk4BZJ4LABjs.getLucideIconByModule; exports.getLucideIconByModuleName = _chunk4BZJ4LABjs.getLucideIconByModuleName; exports.getPublicApiUrl = _chunkWQ77CUUZjs.getPublicApiUrl; exports.getReferralConfig = _chunkWQ77CUUZjs.getReferralConfig; exports.getRoleId = _chunkG4JR3SFVjs.getRoleId; exports.getStripePublishableKey = _chunkWQ77CUUZjs.getStripePublishableKey; exports.getTableComponents = _chunk4BZJ4LABjs.getTableComponents; exports.getTableOptions = _chunk4BZJ4LABjs.getTableOptions; exports.getTokenHandler = _chunk4BZJ4LABjs.getTokenHandler; exports.getTokenUsageCurrency = _chunk4BZJ4LABjs.getTokenUsageCurrency; exports.getTrackablePages = _chunkWQ77CUUZjs.getTrackablePages; exports.getValueFromPath = _chunk4BZJ4LABjs.getValueFromPath; exports.getWaitlistConfig = _chunkWQ77CUUZjs.getWaitlistConfig; exports.handbookPageContent = _chunk4BZJ4LABjs.handbookPageContent; exports.handbookPageSummary = _chunk4BZJ4LABjs.handbookPageSummary; exports.handbookPageTitle = _chunk4BZJ4LABjs.handbookPageTitle; exports.handbookSectionSummary = _chunk4BZJ4LABjs.handbookSectionSummary; exports.handbookSectionTitle = _chunk4BZJ4LABjs.handbookSectionTitle; exports.hasBootstrapper = _chunkGHE4VT2Rjs.hasBootstrapper; exports.isReferralEnabled = _chunkWQ77CUUZjs.isReferralEnabled; exports.isRemoteImageSrc = _chunk4BZJ4LABjs.isRemoteImageSrc; exports.isRolesConfigured = _chunkG4JR3SFVjs.isRolesConfigured; exports.rehydrate = _chunk4BZJ4LABjs.rehydrate; exports.rehydrateList = _chunk4BZJ4LABjs.rehydrateList; exports.resetBootstrapStore = _chunkGHE4VT2Rjs.resetBootstrapStore; exports.setBootstrapper = _chunkGHE4VT2Rjs.setBootstrapper; exports.setClientGlobalErrorHandler = _chunk4BZJ4LABjs.setClientGlobalErrorHandler; exports.setGlobalErrorHandler = _chunk4BZJ4LABjs.setGlobalErrorHandler; exports.showCustomToast = _chunk4BZJ4LABjs.showCustomToast; exports.showError = _chunk4BZJ4LABjs.showError; exports.showToast = _chunk4BZJ4LABjs.showToast; exports.tokenUsageModules = _chunk4BZJ4LABjs.tokenUsageModules; exports.translateData = _chunkGHE4VT2Rjs.translateData; exports.translateResponse = _chunkGHE4VT2Rjs.translateResponse; exports.tryBootstrap = _chunkGHE4VT2Rjs.tryBootstrap; exports.useComposedRefs = _chunk4BZJ4LABjs.useComposedRefs; exports.useIsMobile = _chunk4BZJ4LABjs.useIsMobile; exports.userObjectSchema = _chunk4BZJ4LABjs.userObjectSchema; exports.validateCodiceFiscale = _chunk4BZJ4LABjs.validateCodiceFiscale; exports.validateItalianTaxCode = _chunk4BZJ4LABjs.validateItalianTaxCode; exports.validatePartitaIva = _chunk4BZJ4LABjs.validatePartitaIva;
 //# sourceMappingURL=index.js.map

package/dist/index.mjs

@@ -14,7 +14,7 @@ import {
   getTrackablePages,
   getWaitlistConfig,
   isReferralEnabled
-} from "./chunk-XTOEN5GN.mjs";
+} from "./chunk-ZO3QQ5CQ.mjs";
 import {
   configureRoles,
   getRoleId,
@@ -248,7 +248,7 @@ import {
   validateCodiceFiscale,
   validateItalianTaxCode,
   validatePartitaIva
-} from "./chunk-Z3226FM6.mjs";
+} from "./chunk-ZZ6E33FO.mjs";
 import "./chunk-AUXK7QSA.mjs";
 import "./chunk-PI56A4DG.mjs";
 import {

package/dist/next-config/index.d.mts

@@ -17,6 +17,13 @@ interface CspOptions {
     services?: CspService[];
     csp?: Partial<Record<CspDirective, string[]>>;
 }
+/**
+ * Origins of the app's own servers, the API and the corpus, from
+ * `NEXT_PUBLIC_API_URL` and `NEXT_PUBLIC_CORPUS_URL`. They serve every stored
+ * object link, so images and frames must be allowed from them. Unset or invalid
+ * URLs are skipped; the result has no duplicates.
+ */
+declare function listAppOrigins(env: NodeJS.ProcessEnv): string[];
 declare function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string;
 
 interface NjaNextConfigOptions {
@@ -40,4 +47,4 @@ interface NjaNextConfigOptions {
 }
 declare function createNextConfig(options: NjaNextConfigOptions): NextConfig;
 
-export { type CspDirective, type CspService, type NjaNextConfigOptions, buildCsp, createNextConfig };
+export { type CspDirective, type CspService, type NjaNextConfigOptions, buildCsp, createNextConfig, listAppOrigins };

package/dist/next-config/index.d.ts

@@ -17,6 +17,13 @@ interface CspOptions {
     services?: CspService[];
     csp?: Partial<Record<CspDirective, string[]>>;
 }
+/**
+ * Origins of the app's own servers, the API and the corpus, from
+ * `NEXT_PUBLIC_API_URL` and `NEXT_PUBLIC_CORPUS_URL`. They serve every stored
+ * object link, so images and frames must be allowed from them. Unset or invalid
+ * URLs are skipped; the result has no duplicates.
+ */
+declare function listAppOrigins(env: NodeJS.ProcessEnv): string[];
 declare function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string;
 
 interface NjaNextConfigOptions {
@@ -40,4 +47,4 @@ interface NjaNextConfigOptions {
 }
 declare function createNextConfig(options: NjaNextConfigOptions): NextConfig;
 
-export { type CspDirective, type CspService, type NjaNextConfigOptions, buildCsp, createNextConfig };
+export { type CspDirective, type CspService, type NjaNextConfigOptions, buildCsp, createNextConfig, listAppOrigins };

package/dist/next-config/index.js

@@ -32,17 +32,31 @@ function listImageSources(env) {
   return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(",").map((s) => s.trim()) : [];
 }
 _chunk7QVYU63Ejs.__name.call(void 0, listImageSources, "listImageSources");
+function listAppOrigins(env) {
+  const origins = [];
+  for (const url of [env.NEXT_PUBLIC_API_URL, env.NEXT_PUBLIC_CORPUS_URL]) {
+    if (!url) continue;
+    try {
+      const { origin } = new URL(url.trim());
+      if (origin !== "null" && !origins.includes(origin)) origins.push(origin);
+    } catch (e) {
+    }
+  }
+  return origins;
+}
+_chunk7QVYU63Ejs.__name.call(void 0, listAppOrigins, "listAppOrigins");
 function buildCsp(options, env) {
   const apiUrl = env.NEXT_PUBLIC_API_URL || "";
   const imageSources = listImageSources(env);
+  const appOrigins = listAppOrigins(env);
   const services = _nullishCoalesce(options.services, () => ( []));
   const fetchDirectives = {
     // Scripts: self, and unsafe-inline/eval for Next.js
     "script-src": { base: ["'self'", "'unsafe-inline'", "'unsafe-eval'"], fromEnv: [] },
     // Styles: self and unsafe-inline for styled-components/emotion
     "style-src": { base: ["'self'", "'unsafe-inline'"], fromEnv: [] },
-    // Images: self, data URIs, blobs, and configured image sources
-    "img-src": { base: ["'self'", "data:", "blob:"], fromEnv: imageSources },
+    // Images: self, data URIs, blobs, configured image sources, and the api/corpus origins
+    "img-src": { base: ["'self'", "data:", "blob:"], fromEnv: [...imageSources, ...appOrigins] },
     // Fonts: self
     "font-src": { base: ["'self'"], fromEnv: [] },
     // Connect: self, API (http + ws for socket.io), and storage (for uploads)
@@ -56,8 +70,8 @@ function buildCsp(options, env) {
         ...imageSources
       ]
     },
-    // Frames: self
-    "frame-src": { base: ["'self'"], fromEnv: [] },
+    // Frames: self, and the api/corpus origins (inline previews of stored objects)
+    "frame-src": { base: ["'self'"], fromEnv: appOrigins },
     // Worker sources: self and blob (for Web Workers with dynamic imports)
     "worker-src": { base: ["'self'", "blob:"], fromEnv: [] }
   };
@@ -149,14 +163,21 @@ _chunk7QVYU63Ejs.__name.call(void 0, buildSecurityHeaders, "buildSecurityHeaders
 
 // src/next-config/index.ts
 function parseImageSources(env) {
-  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(",").map((url) => {
-    const { hostname, protocol, port } = new URL(url.trim());
-    return {
+  const imageSources = env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(",").map((url) => url.trim()) : [];
+  const patterns = [];
+  for (const url of [...imageSources, ...listAppOrigins(env)]) {
+    const { hostname, protocol, port } = new URL(url);
+    const pattern = {
       protocol: protocol.replace(":", ""),
       hostname,
       port: port || void 0
     };
-  }) : [];
+    const seen = patterns.some(
+      (p) => p.protocol === pattern.protocol && p.hostname === pattern.hostname && p.port === pattern.port
+    );
+    if (!seen) patterns.push(pattern);
+  }
+  return patterns;
 }
 _chunk7QVYU63Ejs.__name.call(void 0, parseImageSources, "parseImageSources");
 function createNextConfig(options) {
@@ -229,5 +250,6 @@ _chunk7QVYU63Ejs.__name.call(void 0, createNextConfig, "createNextConfig");
 
 
 
-exports.buildCsp = buildCsp; exports.createNextConfig = createNextConfig;
+
+exports.buildCsp = buildCsp; exports.createNextConfig = createNextConfig; exports.listAppOrigins = listAppOrigins;
 //# sourceMappingURL=index.js.map

package/dist/next-config/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"names":[],"mappings":"AAAA;AACE;AACF,uDAA6B;AAC7B;AACA;ACoBA,IAAM,gBAAA,EAA+E;AAAA,EACnF,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,CAAC,uBAAuB,CAAA;AAAA,IACtC,SAAA,EAAW,CAAC,sBAAsB,CAAA;AAAA,IAClC,aAAA,EAAe,CAAC,wBAAwB,CAAA;AAAA,IACxC,WAAA,EAAa,CAAC,uBAAA,EAAyB,0BAA0B;AAAA,EACnE,CAAA;AAAA,EACA,UAAA,EAAY;AAAA,IACV,YAAA,EAAc,CAAC,6BAA6B,CAAA;AAAA,IAC5C,SAAA,EAAW,CAAC,6BAAA,EAA+B,0BAA0B,CAAA;AAAA,IACrE,aAAA,EAAe,CAAC,6BAAA,EAA+B,+BAA+B;AAAA,EAChF,CAAA;AAAA,EACA,SAAA,EAAW;AAAA,IACT,YAAA,EAAc,CAAC,mCAAmC,CAAA;AAAA,IAClD,aAAA,EAAe,CAAC,mCAAmC,CAAA;AAAA,IACnD,WAAA,EAAa,CAAC,mCAAmC;AAAA,EACnD,CAAA;AAAA,EACA,OAAA,EAAS;AAAA,IACP,SAAA,EAAW,CAAC,4BAA4B;AAAA,EAC1C,CAAA;AAAA,EACA,WAAA,EAAa;AAAA,IACX,WAAA,EAAa,CAAC,8BAA8B,CAAA;AAAA,IAC5C,UAAA,EAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF,CAAA;AAEA,SAAS,gBAAA,CAAiB,GAAA,EAAkC;AAC1D,EAAA,OAAO,GAAA,CAAI,cAAA,EAAgB,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,EAAA,GAAM,CAAA,CAAE,IAAA,CAAK,CAAC,EAAA,EAAI,CAAC,CAAA;AAClF;AAFS,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AAOF,SAAS,QAAA,CAAS,OAAA,EAAqB,GAAA,EAAgC;AAC5E,EAAA,MAAM,OAAA,EAAS,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAC1C,EAAA,MAAM,aAAA,EAAe,gBAAA,CAAiB,GAAG,CAAA;AACzC,EAAA,MAAM,SAAA,mBAAW,OAAA,CAAQ,QAAA,UAAY,CAAC,GAAA;AAItC,EAAA,MAAM,gBAAA,EAA+E;AAAA;AAAA,IAEnF,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAA,EAAmB,eAAe,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAElF,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAiB,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAEhE,SAAA,EAAW,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAA,EAAS,OAAO,CAAA,EAAG,OAAA,EAAS,aAAa,CAAA;AAAA;AAAA,IAEvE,UAAA,EAAY,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAE5C,aAAA,EAAe;AAAA,MACb,IAAA,EAAM,CAAC,QAAQ,CAAA;AAAA,MACf,OAAA,EAAS;AAAA,QACP,MAAA;AAAA;AAAA,QAEA,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,QAC5B,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF,CAAA;AAAA;AAAA,IAEA,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAE7C,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAO,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE;AAAA,EACzD,CAAA;AAEA,EAAA,MAAM,UAAA,kBAAY,qCAAA,CAAC,IAAA,EAAA,GAA+B;AAChD,IAAA,MAAM,EAAE,IAAA,EAAM,QAAQ,EAAA,EAAI,eAAA,CAAgB,IAAI,CAAA;AAC9C,IAAA,MAAM,aAAA,EAAe,QAAA,CAAS,OAAA,CAAQ,CAAC,OAAA,EAAA,oBAAY,eAAA,CAAgB,OAAO,CAAA,CAAE,IAAI,CAAA,UAAK,CAAC,GAAC,CAAA;AACvF,IAAA,MAAM,QAAA,EAAU,CAAC,GAAG,IAAA,EAAM,GAAG,YAAA,EAAc,oCAAI,OAAA,mBAAQ,GAAA,4BAAA,CAAM,IAAI,GAAA,UAAK,CAAC,GAAA,EAAI,GAAG,OAAO,CAAA,CAAE,MAAA;AAAA,MACrF,CAAC,MAAA,EAAA,GAAW,OAAA,IAAW;AAAA,IACzB,CAAA;AACA,IAAA,OAAO,CAAC,IAAA,EAAM,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7C,CAAA,EAPkB,WAAA,CAAA;AASlB,EAAA,OAAO;AAAA,IACL,oBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA,IACtB,SAAA,CAAU,WAAW,CAAA;AAAA,IACrB,SAAA,CAAU,SAAS,CAAA;AAAA,IACnB,SAAA,CAAU,UAAU,CAAA;AAAA,IACpB,SAAA,CAAU,aAAa,CAAA;AAAA,IACvB,SAAA,CAAU,WAAW,CAAA;AAAA;AAAA,IAErB,wBAAA;AAAA;AAAA,IAEA,oBAAA;AAAA;AAAA,IAEA,iBAAA;AAAA;AAAA,IAEA,mBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,GAAA,CAAI,SAAA,IAAa,aAAA,GAAgB,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,4BAAA,EAA8B;AAAA,EAC5F,CAAA,CACG,MAAA,CAAO,OAAO,CAAA,CACd,IAAA,CAAK,IAAI,CAAA;AACd;AAtEgB,qCAAA,QAAA,EAAA,UAAA,CAAA;AD0ChB;AACA;AExFO,SAAS,oBAAA,CAAqB,OAAA,EAAgC,GAAA,EAAsC;AACzG,EAAA,MAAM,OAAA,kBAAS,OAAA,qBAAQ,iBAAA,6BAAmB,SAAA,IAAW,OAAA,EAAS,GAAA,EAAK,MAAA;AAEnE,EAAA,OAAO;AAAA,IACL;AAAA;AAAA,MAEE,MAAA,EAAQ,SAAA;AAAA,MACR,OAAA,EAAS;AAAA;AAAA,QAEP;AAAA,UACE,GAAA,EAAK,yBAAA;AAAA,UACL,KAAA,EAAO,QAAA,CAAS,OAAA,EAAS,GAAG;AAAA,QAC9B,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,wBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAClB,CAAC,EAAA,EACD;AAAA,UACE;AAAA,YACE,GAAA,EAAK,2BAAA;AAAA,YACL,KAAA,EAAO;AAAA,UACT;AAAA,QACF,CAAA;AAAA;AAAA,QAEJ;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,oBAAA;AAAA,UACL,KAAA,EAAO,CAAA,QAAA,EAAW,MAAM,CAAA,gCAAA;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAhDgB,qCAAA,oBAAA,EAAA,sBAAA,CAAA;AFwIhB;AACA;AGnHA,SAAS,iBAAA,CAAkB,GAAA,EAAyC;AAClE,EAAA,OAAO,GAAA,CAAI,cAAA,EACP,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,GAAA,EAAA,GAAQ;AACxC,IAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAU,KAAK,EAAA,EAAI,IAAI,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AACvD,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,MAClC,QAAA;AAAA,MACA,IAAA,EAAM,KAAA,GAAQ,KAAA;AAAA,IAChB,CAAA;AAAA,EACF,CAAC,EAAA,EACD,CAAC,CAAA;AACP;AAXS,qCAAA,iBAAA,EAAA,mBAAA,CAAA;AAaF,SAAS,gBAAA,CAAiB,OAAA,EAA2C;AAC1E,EAAA,MAAM,IAAA,EAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,cAAA,EAAgB,OAAA,CAAQ,cAAA,IAAkB,IAAA;AAEhD,EAAA,MAAM,OAAA,EAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,EAAE,OAAA,EAAS,YAAY,EAAA,EAAI,CAAC,CAAA;AAAA,IAC3D,eAAA,EAAiB,IAAA;AAAA,IACjB,kBAAA,EAAoB,IAAA;AAAA,IACpB,aAAA;AAAA,IACA,YAAA,EAAc;AAAA,MACZ,aAAA,EAAe;AAAA,QACb,aAAA,EAAe;AAAA,MACjB,CAAA;AAAA;AAAA;AAAA;AAAA,MAIA,cAAA,mBAAgB,OAAA,CAAQ,cAAA,UAAkB,MAAA;AAAA,MAC1C,WAAA,EAAa,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,cAAA,EAAgB,EAAE,0BAAA,EAA4B,KAAK,EAAA,EAAI,CAAC;AAAA,IAC9D,CAAA;AAAA,IACA,iBAAA,EAAmB,OAAA,CAAQ,UAAA;AAAA,IAC3B,cAAA,EAAgB,OAAA,CAAQ,IAAA,EAAM,CAAC,IAAA,EAAM,KAAA,EAAO,KAAK,EAAA,EAAI,CAAC,IAAA,EAAM,KAAK,CAAA;AAAA,IACjE,MAAA,EAAQ;AAAA,MACN,eAAA,mBAAiB,OAAA,CAAQ,oBAAA,UAAwB,IAAA;AAAA,MACjD,cAAA,EAAgB,iBAAA,CAAkB,GAAG,CAAA;AAAA,MACrC,uBAAA,EAAyB;AAAA,IAC3B,CAAA;AAAA,IACA,eAAA,EAAiB,KAAA;AAAA,IACjB,eAAA,EAAiB,KAAA;AAAA,IACjB,GAAA,EAAK;AAAA,MACH,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,4BAAA,mBAA8B,GAAA,CAAI,4BAAA,UAAgC,IAAA;AAAA,MAClE,+BAAA,mBAAiC,GAAA,CAAI,+BAAA,UAAmC,IAAA;AAAA,MACxE,GAAG,OAAA,CAAQ;AAAA,IACb,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,OAAA,CAAQ,QAAA,EAAU,EAAE,sBAAA,EAAwB,CAAC,SAAA,EAAW,cAAc,EAAE,EAAA,EAAI,CAAC,CAAA;AAAA;AAAA;AAAA,IAGjF,SAAA,EAAW;AAAA,MACT,YAAA,EAAc;AAAA,QACZ,GAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,KAAA,EAAO;AACrC,IAAA,MAAA,CAAO,QAAA,EAAU,MAAA,CAAA,EAAA,GAAY,oBAAA,CAAqB,OAAA,EAAS,OAAA,CAAQ,GAAG,CAAA;AAAA,EACxE;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,QAAA;AAEhD,EAAA,OAAO,OAAA,CAAQ,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,MAAM,EAAA,EAAI,MAAA;AACnD;AArEgB,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AHqLhB;AACE;AACA;AACF,yEAAC","file":"/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","sourcesContent":[null,"// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n  \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n *   `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n  services?: CspService[];\n  csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n  stripe: {\n    \"script-src\": [\"https://js.stripe.com\"],\n    \"img-src\": [\"https://*.stripe.com\"],\n    \"connect-src\": [\"https://api.stripe.com\"],\n    \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n  },\n  googleMaps: {\n    \"script-src\": [\"https://maps.googleapis.com\"],\n    \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n    \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n  },\n  turnstile: {\n    \"script-src\": [\"https://challenges.cloudflare.com\"],\n    \"connect-src\": [\"https://challenges.cloudflare.com\"],\n    \"frame-src\": [\"https://challenges.cloudflare.com\"],\n  },\n  discord: {\n    \"img-src\": [\"https://cdn.discordapp.com\"],\n  },\n  googleFonts: {\n    \"style-src\": [\"https://fonts.googleapis.com\"],\n    \"font-src\": [\"https://fonts.gstatic.com\"],\n  },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n  const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n  const imageSources = listImageSources(env);\n  const services = options.services ?? [];\n\n  // Each fetch directive: what Next itself needs, then the named services, then\n  // the app's extras, then the sources derived from the env.\n  const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n    // Scripts: self, and unsafe-inline/eval for Next.js\n    \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n    // Styles: self and unsafe-inline for styled-components/emotion\n    \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n    // Images: self, data URIs, blobs, and configured image sources\n    \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: imageSources },\n    // Fonts: self\n    \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n    \"connect-src\": {\n      base: [\"'self'\"],\n      fromEnv: [\n        apiUrl,\n        // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n        apiUrl.replace(/^http/, \"ws\"),\n        env.NEXT_PUBLIC_ADDRESS || \"\",\n        ...imageSources,\n      ],\n    },\n    // Frames: self\n    \"frame-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Worker sources: self and blob (for Web Workers with dynamic imports)\n    \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n  };\n\n  const directive = (name: CspDirective): string => {\n    const { base, fromEnv } = fetchDirectives[name];\n    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n    const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n      (source) => source !== \"\",\n    );\n    return [name, ...new Set(sources)].join(\" \");\n  };\n\n  return [\n    \"default-src 'self'\",\n    directive(\"script-src\"),\n    directive(\"style-src\"),\n    directive(\"img-src\"),\n    directive(\"font-src\"),\n    directive(\"connect-src\"),\n    directive(\"frame-src\"),\n    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n    \"frame-ancestors 'none'\",\n    // Form actions: only self\n    \"form-action 'self'\",\n    // Base URI: only self\n    \"base-uri 'self'\",\n    // Object sources: none (no plugins)\n    \"object-src 'none'\",\n    directive(\"worker-src\"),\n    // Upgrade insecure requests in production.\n    //\n    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n    // and serves it over plain http on a custom hostname. With this directive\n    // the browser rewrites every /_next/static asset to https, which nothing is\n    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n    // never hydrates, and each spec sees only server-rendered markup.\n    env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n  ]\n    .filter(Boolean)\n    .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n  source: string;\n  headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n  const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n  return [\n    {\n      // Apply to all routes\n      source: \"/:path*\",\n      headers: [\n        // Content Security Policy - prevents XSS attacks\n        {\n          key: \"Content-Security-Policy\",\n          value: buildCsp(options, env),\n        },\n        // X-Frame-Options - prevents clickjacking (backup for older browsers)\n        {\n          key: \"X-Frame-Options\",\n          value: \"DENY\",\n        },\n        // X-Content-Type-Options - prevents MIME sniffing\n        {\n          key: \"X-Content-Type-Options\",\n          value: \"nosniff\",\n        },\n        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n        // the suite speaks plain http, and an HSTS pin would force https on every\n        // later request to this host from the same browser profile.\n        ...(env.E2E_BUILD === \"true\"\n          ? []\n          : [\n              {\n                key: \"Strict-Transport-Security\",\n                value: \"max-age=31536000; includeSubDomains\",\n              },\n            ]),\n        // Referrer-Policy - controls referrer information\n        {\n          key: \"Referrer-Policy\",\n          value: \"strict-origin-when-cross-origin\",\n        },\n        // Permissions-Policy - restricts browser features\n        {\n          key: \"Permissions-Policy\",\n          value: `camera=(${camera}), microphone=(), geolocation=()`,\n        },\n      ],\n    },\n  ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n  devOrigins: string[];\n  /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n  services?: CspService[];\n  /** Extra CSP sources per directive, for hosts no named service covers. */\n  csp?: Partial<Record<CspDirective, string[]>>;\n  env?: Record<string, string>;\n  imageMinimumCacheTTL?: number;\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n  mdx?: boolean;\n  serwist?: boolean;\n  securityHeaders?: boolean;\n  authInterrupts?: boolean;\n  reactCompiler?: boolean;\n  rewrites?: NextConfig[\"rewrites\"];\n  extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n  return env.IMAGE_SOURCES\n    ? env.IMAGE_SOURCES.split(\",\").map((url) => {\n        const { hostname, protocol, port } = new URL(url.trim());\n        return {\n          protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n          hostname,\n          port: port || undefined,\n        };\n      })\n    : [];\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n  const env = process.env;\n  const reactCompiler = options.reactCompiler === true;\n\n  const config: NextConfig = {\n    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n    // `next dev` server may still be running against the same worktree. `next\n    // build` and `next dev` share `.next`, so a build performed underneath a live\n    // dev server clobbers it and that dev server then 404s every route. Giving\n    // the e2e build its own directory keeps the two independent. E2E_BUILD must\n    // be set for `next build` AND for `next start`, or `start` looks in `.next`\n    // and serves someone else's output.\n    ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n    cacheComponents: true,\n    partialPrefetching: true,\n    reactCompiler,\n    experimental: {\n      serverActions: {\n        bodySizeLimit: \"5mb\",\n      },\n      // Required by `unauthorized()` (next/navigation): without this flag it throws a plain\n      // Error instead of rendering the nearest unauthorized.tsx. The flag is for app code that\n      // calls it; ServerSession.checkPermission does not, it still does `redirect(\"/401\")`.\n      authInterrupts: options.authInterrupts ?? true,\n      turbopackGc: true,\n      // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n      // imported request module unactivated (\"Lazily compiled dynamic import of ...\n      // JsonApiRequest ... was not activated\"), so every client-side read returns\n      // nothing. Seen with the package installed from npm; production builds are unaffected.\n      ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n    },\n    allowedDevOrigins: options.devOrigins,\n    pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n    images: {\n      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n      remotePatterns: parseImageSources(env),\n      dangerouslyAllowLocalIP: true,\n    },\n    poweredByHeader: false,\n    reactStrictMode: false,\n    env: {\n      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n      ...options.env,\n    },\n    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n    // does nothing but append these two entries. Requiring the package here\n    // instead CRASHES production: it is a devDependency, next.config.js is loaded\n    // at RUNTIME by `next start`, and the web-production image installs with\n    // --prod. Do not re-add a require of any devDependency to this file.\n    ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n    // single instance in both modes.\n    turbopack: {\n      resolveAlias: {\n        yjs: \"./node_modules/yjs\",\n      },\n    },\n  };\n\n  if (options.securityHeaders !== false) {\n    config.headers = async () => buildSecurityHeaders(options, process.env);\n  }\n\n  if (options.rewrites) config.rewrites = options.rewrites;\n\n  return options.extend ? options.extend(config) : config;\n}\n"]}
+{"version":3,"sources":["/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"names":[],"mappings":"AAAA;AACE;AACF,uDAA6B;AAC7B;AACA;ACoBA,IAAM,gBAAA,EAA+E;AAAA,EACnF,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,CAAC,uBAAuB,CAAA;AAAA,IACtC,SAAA,EAAW,CAAC,sBAAsB,CAAA;AAAA,IAClC,aAAA,EAAe,CAAC,wBAAwB,CAAA;AAAA,IACxC,WAAA,EAAa,CAAC,uBAAA,EAAyB,0BAA0B;AAAA,EACnE,CAAA;AAAA,EACA,UAAA,EAAY;AAAA,IACV,YAAA,EAAc,CAAC,6BAA6B,CAAA;AAAA,IAC5C,SAAA,EAAW,CAAC,6BAAA,EAA+B,0BAA0B,CAAA;AAAA,IACrE,aAAA,EAAe,CAAC,6BAAA,EAA+B,+BAA+B;AAAA,EAChF,CAAA;AAAA,EACA,SAAA,EAAW;AAAA,IACT,YAAA,EAAc,CAAC,mCAAmC,CAAA;AAAA,IAClD,aAAA,EAAe,CAAC,mCAAmC,CAAA;AAAA,IACnD,WAAA,EAAa,CAAC,mCAAmC;AAAA,EACnD,CAAA;AAAA,EACA,OAAA,EAAS;AAAA,IACP,SAAA,EAAW,CAAC,4BAA4B;AAAA,EAC1C,CAAA;AAAA,EACA,WAAA,EAAa;AAAA,IACX,WAAA,EAAa,CAAC,8BAA8B,CAAA;AAAA,IAC5C,UAAA,EAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF,CAAA;AAEA,SAAS,gBAAA,CAAiB,GAAA,EAAkC;AAC1D,EAAA,OAAO,GAAA,CAAI,cAAA,EAAgB,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,EAAA,GAAM,CAAA,CAAE,IAAA,CAAK,CAAC,EAAA,EAAI,CAAC,CAAA;AAClF;AAFS,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AAUF,SAAS,cAAA,CAAe,GAAA,EAAkC;AAC/D,EAAA,MAAM,QAAA,EAAoB,CAAC,CAAA;AAC3B,EAAA,IAAA,CAAA,MAAW,IAAA,GAAO,CAAC,GAAA,CAAI,mBAAA,EAAqB,GAAA,CAAI,sBAAsB,CAAA,EAAG;AACvE,IAAA,GAAA,CAAI,CAAC,GAAA,EAAK,QAAA;AACV,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,OAAO,EAAA,EAAI,IAAI,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AACrC,MAAA,GAAA,CAAI,OAAA,IAAW,OAAA,GAAU,CAAC,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,EAAG,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA;AAAA,IACzE,EAAA,UAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAZgB,qCAAA,cAAA,EAAA,gBAAA,CAAA;AAiBT,SAAS,QAAA,CAAS,OAAA,EAAqB,GAAA,EAAgC;AAC5E,EAAA,MAAM,OAAA,EAAS,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAC1C,EAAA,MAAM,aAAA,EAAe,gBAAA,CAAiB,GAAG,CAAA;AACzC,EAAA,MAAM,WAAA,EAAa,cAAA,CAAe,GAAG,CAAA;AACrC,EAAA,MAAM,SAAA,mBAAW,OAAA,CAAQ,QAAA,UAAY,CAAC,GAAA;AAItC,EAAA,MAAM,gBAAA,EAA+E;AAAA;AAAA,IAEnF,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAA,EAAmB,eAAe,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAElF,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAiB,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAEhE,SAAA,EAAW,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAA,EAAS,OAAO,CAAA,EAAG,OAAA,EAAS,CAAC,GAAG,YAAA,EAAc,GAAG,UAAU,EAAE,CAAA;AAAA;AAAA,IAE3F,UAAA,EAAY,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAE5C,aAAA,EAAe;AAAA,MACb,IAAA,EAAM,CAAC,QAAQ,CAAA;AAAA,MACf,OAAA,EAAS;AAAA,QACP,MAAA;AAAA;AAAA,QAEA,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,QAC5B,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF,CAAA;AAAA;AAAA,IAEA,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,WAAW,CAAA;AAAA;AAAA,IAErD,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAO,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE;AAAA,EACzD,CAAA;AAEA,EAAA,MAAM,UAAA,kBAAY,qCAAA,CAAC,IAAA,EAAA,GAA+B;AAChD,IAAA,MAAM,EAAE,IAAA,EAAM,QAAQ,EAAA,EAAI,eAAA,CAAgB,IAAI,CAAA;AAC9C,IAAA,MAAM,aAAA,EAAe,QAAA,CAAS,OAAA,CAAQ,CAAC,OAAA,EAAA,oBAAY,eAAA,CAAgB,OAAO,CAAA,CAAE,IAAI,CAAA,UAAK,CAAC,GAAC,CAAA;AACvF,IAAA,MAAM,QAAA,EAAU,CAAC,GAAG,IAAA,EAAM,GAAG,YAAA,EAAc,oCAAI,OAAA,mBAAQ,GAAA,4BAAA,CAAM,IAAI,GAAA,UAAK,CAAC,GAAA,EAAI,GAAG,OAAO,CAAA,CAAE,MAAA;AAAA,MACrF,CAAC,MAAA,EAAA,GAAW,OAAA,IAAW;AAAA,IACzB,CAAA;AACA,IAAA,OAAO,CAAC,IAAA,EAAM,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7C,CAAA,EAPkB,WAAA,CAAA;AASlB,EAAA,OAAO;AAAA,IACL,oBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA,IACtB,SAAA,CAAU,WAAW,CAAA;AAAA,IACrB,SAAA,CAAU,SAAS,CAAA;AAAA,IACnB,SAAA,CAAU,UAAU,CAAA;AAAA,IACpB,SAAA,CAAU,aAAa,CAAA;AAAA,IACvB,SAAA,CAAU,WAAW,CAAA;AAAA;AAAA,IAErB,wBAAA;AAAA;AAAA,IAEA,oBAAA;AAAA;AAAA,IAEA,iBAAA;AAAA;AAAA,IAEA,mBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,GAAA,CAAI,SAAA,IAAa,aAAA,GAAgB,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,4BAAA,EAA8B;AAAA,EAC5F,CAAA,CACG,MAAA,CAAO,OAAO,CAAA,CACd,IAAA,CAAK,IAAI,CAAA;AACd;AAvEgB,qCAAA,QAAA,EAAA,UAAA,CAAA;ADoChB;AACA;AEtGO,SAAS,oBAAA,CAAqB,OAAA,EAAgC,GAAA,EAAsC;AACzG,EAAA,MAAM,OAAA,kBAAS,OAAA,qBAAQ,iBAAA,6BAAmB,SAAA,IAAW,OAAA,EAAS,GAAA,EAAK,MAAA;AAEnE,EAAA,OAAO;AAAA,IACL;AAAA;AAAA,MAEE,MAAA,EAAQ,SAAA;AAAA,MACR,OAAA,EAAS;AAAA;AAAA,QAEP;AAAA,UACE,GAAA,EAAK,yBAAA;AAAA,UACL,KAAA,EAAO,QAAA,CAAS,OAAA,EAAS,GAAG;AAAA,QAC9B,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,wBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAClB,CAAC,EAAA,EACD;AAAA,UACE;AAAA,YACE,GAAA,EAAK,2BAAA;AAAA,YACL,KAAA,EAAO;AAAA,UACT;AAAA,QACF,CAAA;AAAA;AAAA,QAEJ;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,oBAAA;AAAA,UACL,KAAA,EAAO,CAAA,QAAA,EAAW,MAAM,CAAA,gCAAA;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAhDgB,qCAAA,oBAAA,EAAA,sBAAA,CAAA;AFsJhB;AACA;AG/HA,SAAS,iBAAA,CAAkB,GAAA,EAAyC;AAClE,EAAA,MAAM,aAAA,EAAe,GAAA,CAAI,cAAA,EAAgB,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,GAAA,EAAA,GAAQ,GAAA,CAAI,IAAA,CAAK,CAAC,EAAA,EAAI,CAAC,CAAA;AAClG,EAAA,MAAM,SAAA,EAA4B,CAAC,CAAA;AACnC,EAAA,IAAA,CAAA,MAAW,IAAA,GAAO,CAAC,GAAG,YAAA,EAAc,GAAG,cAAA,CAAe,GAAG,CAAC,CAAA,EAAG;AAC3D,IAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAU,KAAK,EAAA,EAAI,IAAI,GAAA,CAAI,GAAG,CAAA;AAChD,IAAA,MAAM,QAAA,EAAyB;AAAA,MAC7B,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,MAClC,QAAA;AAAA,MACA,IAAA,EAAM,KAAA,GAAQ,KAAA;AAAA,IAChB,CAAA;AACA,IAAA,MAAM,KAAA,EAAO,QAAA,CAAS,IAAA;AAAA,MACpB,CAAC,CAAA,EAAA,GAAM,CAAA,CAAE,SAAA,IAAa,OAAA,CAAQ,SAAA,GAAY,CAAA,CAAE,SAAA,IAAa,OAAA,CAAQ,SAAA,GAAY,CAAA,CAAE,KAAA,IAAS,OAAA,CAAQ;AAAA,IAClG,CAAA;AACA,IAAA,GAAA,CAAI,CAAC,IAAA,EAAM,QAAA,CAAS,IAAA,CAAK,OAAO,CAAA;AAAA,EAClC;AACA,EAAA,OAAO,QAAA;AACT;AAhBS,qCAAA,iBAAA,EAAA,mBAAA,CAAA;AAkBF,SAAS,gBAAA,CAAiB,OAAA,EAA2C;AAC1E,EAAA,MAAM,IAAA,EAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,cAAA,EAAgB,OAAA,CAAQ,cAAA,IAAkB,IAAA;AAEhD,EAAA,MAAM,OAAA,EAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,EAAE,OAAA,EAAS,YAAY,EAAA,EAAI,CAAC,CAAA;AAAA,IAC3D,eAAA,EAAiB,IAAA;AAAA,IACjB,kBAAA,EAAoB,IAAA;AAAA,IACpB,aAAA;AAAA,IACA,YAAA,EAAc;AAAA,MACZ,aAAA,EAAe;AAAA,QACb,aAAA,EAAe;AAAA,MACjB,CAAA;AAAA;AAAA;AAAA;AAAA,MAIA,cAAA,mBAAgB,OAAA,CAAQ,cAAA,UAAkB,MAAA;AAAA,MAC1C,WAAA,EAAa,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,cAAA,EAAgB,EAAE,0BAAA,EAA4B,KAAK,EAAA,EAAI,CAAC;AAAA,IAC9D,CAAA;AAAA,IACA,iBAAA,EAAmB,OAAA,CAAQ,UAAA;AAAA,IAC3B,cAAA,EAAgB,OAAA,CAAQ,IAAA,EAAM,CAAC,IAAA,EAAM,KAAA,EAAO,KAAK,EAAA,EAAI,CAAC,IAAA,EAAM,KAAK,CAAA;AAAA,IACjE,MAAA,EAAQ;AAAA,MACN,eAAA,mBAAiB,OAAA,CAAQ,oBAAA,UAAwB,IAAA;AAAA,MACjD,cAAA,EAAgB,iBAAA,CAAkB,GAAG,CAAA;AAAA,MACrC,uBAAA,EAAyB;AAAA,IAC3B,CAAA;AAAA,IACA,eAAA,EAAiB,KAAA;AAAA,IACjB,eAAA,EAAiB,KAAA;AAAA,IACjB,GAAA,EAAK;AAAA,MACH,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,4BAAA,mBAA8B,GAAA,CAAI,4BAAA,UAAgC,IAAA;AAAA,MAClE,+BAAA,mBAAiC,GAAA,CAAI,+BAAA,UAAmC,IAAA;AAAA,MACxE,GAAG,OAAA,CAAQ;AAAA,IACb,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,OAAA,CAAQ,QAAA,EAAU,EAAE,sBAAA,EAAwB,CAAC,SAAA,EAAW,cAAc,EAAE,EAAA,EAAI,CAAC,CAAA;AAAA;AAAA;AAAA,IAGjF,SAAA,EAAW;AAAA,MACT,YAAA,EAAc;AAAA,QACZ,GAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,KAAA,EAAO;AACrC,IAAA,MAAA,CAAO,QAAA,EAAU,MAAA,CAAA,EAAA,GAAY,oBAAA,CAAqB,OAAA,EAAS,OAAA,CAAQ,GAAG,CAAA;AAAA,EACxE;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,QAAA;AAEhD,EAAA,OAAO,OAAA,CAAQ,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,MAAM,EAAA,EAAI,MAAA;AACnD;AArEgB,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AHmMhB;AACE;AACA;AACA;AACF,kHAAC","file":"/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","sourcesContent":[null,"// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n  \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n *   `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n  services?: CspService[];\n  csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n  stripe: {\n    \"script-src\": [\"https://js.stripe.com\"],\n    \"img-src\": [\"https://*.stripe.com\"],\n    \"connect-src\": [\"https://api.stripe.com\"],\n    \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n  },\n  googleMaps: {\n    \"script-src\": [\"https://maps.googleapis.com\"],\n    \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n    \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n  },\n  turnstile: {\n    \"script-src\": [\"https://challenges.cloudflare.com\"],\n    \"connect-src\": [\"https://challenges.cloudflare.com\"],\n    \"frame-src\": [\"https://challenges.cloudflare.com\"],\n  },\n  discord: {\n    \"img-src\": [\"https://cdn.discordapp.com\"],\n  },\n  googleFonts: {\n    \"style-src\": [\"https://fonts.googleapis.com\"],\n    \"font-src\": [\"https://fonts.gstatic.com\"],\n  },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n/**\n * Origins of the app's own servers, the API and the corpus, from\n * `NEXT_PUBLIC_API_URL` and `NEXT_PUBLIC_CORPUS_URL`. They serve every stored\n * object link, so images and frames must be allowed from them. Unset or invalid\n * URLs are skipped; the result has no duplicates.\n */\nexport function listAppOrigins(env: NodeJS.ProcessEnv): string[] {\n  const origins: string[] = [];\n  for (const url of [env.NEXT_PUBLIC_API_URL, env.NEXT_PUBLIC_CORPUS_URL]) {\n    if (!url) continue;\n    try {\n      const { origin } = new URL(url.trim());\n      if (origin !== \"null\" && !origins.includes(origin)) origins.push(origin);\n    } catch {\n      // Not a URL: nothing to allow.\n    }\n  }\n  return origins;\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n  const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n  const imageSources = listImageSources(env);\n  const appOrigins = listAppOrigins(env);\n  const services = options.services ?? [];\n\n  // Each fetch directive: what Next itself needs, then the named services, then\n  // the app's extras, then the sources derived from the env.\n  const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n    // Scripts: self, and unsafe-inline/eval for Next.js\n    \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n    // Styles: self and unsafe-inline for styled-components/emotion\n    \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n    // Images: self, data URIs, blobs, configured image sources, and the api/corpus origins\n    \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: [...imageSources, ...appOrigins] },\n    // Fonts: self\n    \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n    \"connect-src\": {\n      base: [\"'self'\"],\n      fromEnv: [\n        apiUrl,\n        // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n        apiUrl.replace(/^http/, \"ws\"),\n        env.NEXT_PUBLIC_ADDRESS || \"\",\n        ...imageSources,\n      ],\n    },\n    // Frames: self, and the api/corpus origins (inline previews of stored objects)\n    \"frame-src\": { base: [\"'self'\"], fromEnv: appOrigins },\n    // Worker sources: self and blob (for Web Workers with dynamic imports)\n    \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n  };\n\n  const directive = (name: CspDirective): string => {\n    const { base, fromEnv } = fetchDirectives[name];\n    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n    const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n      (source) => source !== \"\",\n    );\n    return [name, ...new Set(sources)].join(\" \");\n  };\n\n  return [\n    \"default-src 'self'\",\n    directive(\"script-src\"),\n    directive(\"style-src\"),\n    directive(\"img-src\"),\n    directive(\"font-src\"),\n    directive(\"connect-src\"),\n    directive(\"frame-src\"),\n    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n    \"frame-ancestors 'none'\",\n    // Form actions: only self\n    \"form-action 'self'\",\n    // Base URI: only self\n    \"base-uri 'self'\",\n    // Object sources: none (no plugins)\n    \"object-src 'none'\",\n    directive(\"worker-src\"),\n    // Upgrade insecure requests in production.\n    //\n    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n    // and serves it over plain http on a custom hostname. With this directive\n    // the browser rewrites every /_next/static asset to https, which nothing is\n    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n    // never hydrates, and each spec sees only server-rendered markup.\n    env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n  ]\n    .filter(Boolean)\n    .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n  source: string;\n  headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n  const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n  return [\n    {\n      // Apply to all routes\n      source: \"/:path*\",\n      headers: [\n        // Content Security Policy - prevents XSS attacks\n        {\n          key: \"Content-Security-Policy\",\n          value: buildCsp(options, env),\n        },\n        // X-Frame-Options - prevents clickjacking (backup for older browsers)\n        {\n          key: \"X-Frame-Options\",\n          value: \"DENY\",\n        },\n        // X-Content-Type-Options - prevents MIME sniffing\n        {\n          key: \"X-Content-Type-Options\",\n          value: \"nosniff\",\n        },\n        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n        // the suite speaks plain http, and an HSTS pin would force https on every\n        // later request to this host from the same browser profile.\n        ...(env.E2E_BUILD === \"true\"\n          ? []\n          : [\n              {\n                key: \"Strict-Transport-Security\",\n                value: \"max-age=31536000; includeSubDomains\",\n              },\n            ]),\n        // Referrer-Policy - controls referrer information\n        {\n          key: \"Referrer-Policy\",\n          value: \"strict-origin-when-cross-origin\",\n        },\n        // Permissions-Policy - restricts browser features\n        {\n          key: \"Permissions-Policy\",\n          value: `camera=(${camera}), microphone=(), geolocation=()`,\n        },\n      ],\n    },\n  ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, listAppOrigins, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp, listAppOrigins };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n  devOrigins: string[];\n  /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n  services?: CspService[];\n  /** Extra CSP sources per directive, for hosts no named service covers. */\n  csp?: Partial<Record<CspDirective, string[]>>;\n  env?: Record<string, string>;\n  imageMinimumCacheTTL?: number;\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n  mdx?: boolean;\n  serwist?: boolean;\n  securityHeaders?: boolean;\n  authInterrupts?: boolean;\n  reactCompiler?: boolean;\n  rewrites?: NextConfig[\"rewrites\"];\n  extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\n// IMAGE_SOURCES, then the api and corpus origins (they serve every stored object\n// link), without duplicates.\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n  const imageSources = env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((url) => url.trim()) : [];\n  const patterns: RemotePattern[] = [];\n  for (const url of [...imageSources, ...listAppOrigins(env)]) {\n    const { hostname, protocol, port } = new URL(url);\n    const pattern: RemotePattern = {\n      protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n      hostname,\n      port: port || undefined,\n    };\n    const seen = patterns.some(\n      (p) => p.protocol === pattern.protocol && p.hostname === pattern.hostname && p.port === pattern.port,\n    );\n    if (!seen) patterns.push(pattern);\n  }\n  return patterns;\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n  const env = process.env;\n  const reactCompiler = options.reactCompiler === true;\n\n  const config: NextConfig = {\n    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n    // `next dev` server may still be running against the same worktree. `next\n    // build` and `next dev` share `.next`, so a build performed underneath a live\n    // dev server clobbers it and that dev server then 404s every route. Giving\n    // the e2e build its own directory keeps the two independent. E2E_BUILD must\n    // be set for `next build` AND for `next start`, or `start` looks in `.next`\n    // and serves someone else's output.\n    ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n    cacheComponents: true,\n    partialPrefetching: true,\n    reactCompiler,\n    experimental: {\n      serverActions: {\n        bodySizeLimit: \"5mb\",\n      },\n      // Required by `unauthorized()` (next/navigation): without this flag it throws a plain\n      // Error instead of rendering the nearest unauthorized.tsx. The flag is for app code that\n      // calls it; ServerSession.checkPermission does not, it still does `redirect(\"/401\")`.\n      authInterrupts: options.authInterrupts ?? true,\n      turbopackGc: true,\n      // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n      // imported request module unactivated (\"Lazily compiled dynamic import of ...\n      // JsonApiRequest ... was not activated\"), so every client-side read returns\n      // nothing. Seen with the package installed from npm; production builds are unaffected.\n      ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n    },\n    allowedDevOrigins: options.devOrigins,\n    pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n    images: {\n      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n      remotePatterns: parseImageSources(env),\n      dangerouslyAllowLocalIP: true,\n    },\n    poweredByHeader: false,\n    reactStrictMode: false,\n    env: {\n      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n      ...options.env,\n    },\n    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n    // does nothing but append these two entries. Requiring the package here\n    // instead CRASHES production: it is a devDependency, next.config.js is loaded\n    // at RUNTIME by `next start`, and the web-production image installs with\n    // --prod. Do not re-add a require of any devDependency to this file.\n    ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n    // single instance in both modes.\n    turbopack: {\n      resolveAlias: {\n        yjs: \"./node_modules/yjs\",\n      },\n    },\n  };\n\n  if (options.securityHeaders !== false) {\n    config.headers = async () => buildSecurityHeaders(options, process.env);\n  }\n\n  if (options.rewrites) config.rewrites = options.rewrites;\n\n  return options.extend ? options.extend(config) : config;\n}\n"]}

package/dist/next-config/index.mjs

@@ -32,17 +32,31 @@ function listImageSources(env) {
   return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(",").map((s) => s.trim()) : [];
 }
 __name(listImageSources, "listImageSources");
+function listAppOrigins(env) {
+  const origins = [];
+  for (const url of [env.NEXT_PUBLIC_API_URL, env.NEXT_PUBLIC_CORPUS_URL]) {
+    if (!url) continue;
+    try {
+      const { origin } = new URL(url.trim());
+      if (origin !== "null" && !origins.includes(origin)) origins.push(origin);
+    } catch {
+    }
+  }
+  return origins;
+}
+__name(listAppOrigins, "listAppOrigins");
 function buildCsp(options, env) {
   const apiUrl = env.NEXT_PUBLIC_API_URL || "";
   const imageSources = listImageSources(env);
+  const appOrigins = listAppOrigins(env);
   const services = options.services ?? [];
   const fetchDirectives = {
     // Scripts: self, and unsafe-inline/eval for Next.js
     "script-src": { base: ["'self'", "'unsafe-inline'", "'unsafe-eval'"], fromEnv: [] },
     // Styles: self and unsafe-inline for styled-components/emotion
     "style-src": { base: ["'self'", "'unsafe-inline'"], fromEnv: [] },
-    // Images: self, data URIs, blobs, and configured image sources
-    "img-src": { base: ["'self'", "data:", "blob:"], fromEnv: imageSources },
+    // Images: self, data URIs, blobs, configured image sources, and the api/corpus origins
+    "img-src": { base: ["'self'", "data:", "blob:"], fromEnv: [...imageSources, ...appOrigins] },
     // Fonts: self
     "font-src": { base: ["'self'"], fromEnv: [] },
     // Connect: self, API (http + ws for socket.io), and storage (for uploads)
@@ -56,8 +70,8 @@ function buildCsp(options, env) {
         ...imageSources
       ]
     },
-    // Frames: self
-    "frame-src": { base: ["'self'"], fromEnv: [] },
+    // Frames: self, and the api/corpus origins (inline previews of stored objects)
+    "frame-src": { base: ["'self'"], fromEnv: appOrigins },
     // Worker sources: self and blob (for Web Workers with dynamic imports)
     "worker-src": { base: ["'self'", "blob:"], fromEnv: [] }
   };
@@ -149,14 +163,21 @@ __name(buildSecurityHeaders, "buildSecurityHeaders");
 
 // src/next-config/index.ts
 function parseImageSources(env) {
-  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(",").map((url) => {
-    const { hostname, protocol, port } = new URL(url.trim());
-    return {
+  const imageSources = env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(",").map((url) => url.trim()) : [];
+  const patterns = [];
+  for (const url of [...imageSources, ...listAppOrigins(env)]) {
+    const { hostname, protocol, port } = new URL(url);
+    const pattern = {
       protocol: protocol.replace(":", ""),
       hostname,
       port: port || void 0
     };
-  }) : [];
+    const seen = patterns.some(
+      (p) => p.protocol === pattern.protocol && p.hostname === pattern.hostname && p.port === pattern.port
+    );
+    if (!seen) patterns.push(pattern);
+  }
+  return patterns;
 }
 __name(parseImageSources, "parseImageSources");
 function createNextConfig(options) {
@@ -228,6 +249,7 @@ function createNextConfig(options) {
 __name(createNextConfig, "createNextConfig");
 export {
   buildCsp,
-  createNextConfig
+  createNextConfig,
+  listAppOrigins
 };
 //# sourceMappingURL=index.mjs.map

package/dist/next-config/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"sourcesContent":["// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n  \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n *   `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n  services?: CspService[];\n  csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n  stripe: {\n    \"script-src\": [\"https://js.stripe.com\"],\n    \"img-src\": [\"https://*.stripe.com\"],\n    \"connect-src\": [\"https://api.stripe.com\"],\n    \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n  },\n  googleMaps: {\n    \"script-src\": [\"https://maps.googleapis.com\"],\n    \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n    \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n  },\n  turnstile: {\n    \"script-src\": [\"https://challenges.cloudflare.com\"],\n    \"connect-src\": [\"https://challenges.cloudflare.com\"],\n    \"frame-src\": [\"https://challenges.cloudflare.com\"],\n  },\n  discord: {\n    \"img-src\": [\"https://cdn.discordapp.com\"],\n  },\n  googleFonts: {\n    \"style-src\": [\"https://fonts.googleapis.com\"],\n    \"font-src\": [\"https://fonts.gstatic.com\"],\n  },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n  const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n  const imageSources = listImageSources(env);\n  const services = options.services ?? [];\n\n  // Each fetch directive: what Next itself needs, then the named services, then\n  // the app's extras, then the sources derived from the env.\n  const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n    // Scripts: self, and unsafe-inline/eval for Next.js\n    \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n    // Styles: self and unsafe-inline for styled-components/emotion\n    \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n    // Images: self, data URIs, blobs, and configured image sources\n    \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: imageSources },\n    // Fonts: self\n    \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n    \"connect-src\": {\n      base: [\"'self'\"],\n      fromEnv: [\n        apiUrl,\n        // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n        apiUrl.replace(/^http/, \"ws\"),\n        env.NEXT_PUBLIC_ADDRESS || \"\",\n        ...imageSources,\n      ],\n    },\n    // Frames: self\n    \"frame-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Worker sources: self and blob (for Web Workers with dynamic imports)\n    \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n  };\n\n  const directive = (name: CspDirective): string => {\n    const { base, fromEnv } = fetchDirectives[name];\n    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n    const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n      (source) => source !== \"\",\n    );\n    return [name, ...new Set(sources)].join(\" \");\n  };\n\n  return [\n    \"default-src 'self'\",\n    directive(\"script-src\"),\n    directive(\"style-src\"),\n    directive(\"img-src\"),\n    directive(\"font-src\"),\n    directive(\"connect-src\"),\n    directive(\"frame-src\"),\n    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n    \"frame-ancestors 'none'\",\n    // Form actions: only self\n    \"form-action 'self'\",\n    // Base URI: only self\n    \"base-uri 'self'\",\n    // Object sources: none (no plugins)\n    \"object-src 'none'\",\n    directive(\"worker-src\"),\n    // Upgrade insecure requests in production.\n    //\n    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n    // and serves it over plain http on a custom hostname. With this directive\n    // the browser rewrites every /_next/static asset to https, which nothing is\n    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n    // never hydrates, and each spec sees only server-rendered markup.\n    env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n  ]\n    .filter(Boolean)\n    .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n  source: string;\n  headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n  const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n  return [\n    {\n      // Apply to all routes\n      source: \"/:path*\",\n      headers: [\n        // Content Security Policy - prevents XSS attacks\n        {\n          key: \"Content-Security-Policy\",\n          value: buildCsp(options, env),\n        },\n        // X-Frame-Options - prevents clickjacking (backup for older browsers)\n        {\n          key: \"X-Frame-Options\",\n          value: \"DENY\",\n        },\n        // X-Content-Type-Options - prevents MIME sniffing\n        {\n          key: \"X-Content-Type-Options\",\n          value: \"nosniff\",\n        },\n        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n        // the suite speaks plain http, and an HSTS pin would force https on every\n        // later request to this host from the same browser profile.\n        ...(env.E2E_BUILD === \"true\"\n          ? []\n          : [\n              {\n                key: \"Strict-Transport-Security\",\n                value: \"max-age=31536000; includeSubDomains\",\n              },\n            ]),\n        // Referrer-Policy - controls referrer information\n        {\n          key: \"Referrer-Policy\",\n          value: \"strict-origin-when-cross-origin\",\n        },\n        // Permissions-Policy - restricts browser features\n        {\n          key: \"Permissions-Policy\",\n          value: `camera=(${camera}), microphone=(), geolocation=()`,\n        },\n      ],\n    },\n  ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n  devOrigins: string[];\n  /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n  services?: CspService[];\n  /** Extra CSP sources per directive, for hosts no named service covers. */\n  csp?: Partial<Record<CspDirective, string[]>>;\n  env?: Record<string, string>;\n  imageMinimumCacheTTL?: number;\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n  mdx?: boolean;\n  serwist?: boolean;\n  securityHeaders?: boolean;\n  authInterrupts?: boolean;\n  reactCompiler?: boolean;\n  rewrites?: NextConfig[\"rewrites\"];\n  extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n  return env.IMAGE_SOURCES\n    ? env.IMAGE_SOURCES.split(\",\").map((url) => {\n        const { hostname, protocol, port } = new URL(url.trim());\n        return {\n          protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n          hostname,\n          port: port || undefined,\n        };\n      })\n    : [];\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n  const env = process.env;\n  const reactCompiler = options.reactCompiler === true;\n\n  const config: NextConfig = {\n    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n    // `next dev` server may still be running against the same worktree. `next\n    // build` and `next dev` share `.next`, so a build performed underneath a live\n    // dev server clobbers it and that dev server then 404s every route. Giving\n    // the e2e build its own directory keeps the two independent. E2E_BUILD must\n    // be set for `next build` AND for `next start`, or `start` looks in `.next`\n    // and serves someone else's output.\n    ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n    cacheComponents: true,\n    partialPrefetching: true,\n    reactCompiler,\n    experimental: {\n      serverActions: {\n        bodySizeLimit: \"5mb\",\n      },\n      // Required by `unauthorized()` (next/navigation): without this flag it throws a plain\n      // Error instead of rendering the nearest unauthorized.tsx. The flag is for app code that\n      // calls it; ServerSession.checkPermission does not, it still does `redirect(\"/401\")`.\n      authInterrupts: options.authInterrupts ?? true,\n      turbopackGc: true,\n      // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n      // imported request module unactivated (\"Lazily compiled dynamic import of ...\n      // JsonApiRequest ... was not activated\"), so every client-side read returns\n      // nothing. Seen with the package installed from npm; production builds are unaffected.\n      ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n    },\n    allowedDevOrigins: options.devOrigins,\n    pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n    images: {\n      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n      remotePatterns: parseImageSources(env),\n      dangerouslyAllowLocalIP: true,\n    },\n    poweredByHeader: false,\n    reactStrictMode: false,\n    env: {\n      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n      ...options.env,\n    },\n    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n    // does nothing but append these two entries. Requiring the package here\n    // instead CRASHES production: it is a devDependency, next.config.js is loaded\n    // at RUNTIME by `next start`, and the web-production image installs with\n    // --prod. Do not re-add a require of any devDependency to this file.\n    ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n    // single instance in both modes.\n    turbopack: {\n      resolveAlias: {\n        yjs: \"./node_modules/yjs\",\n      },\n    },\n  };\n\n  if (options.securityHeaders !== false) {\n    config.headers = async () => buildSecurityHeaders(options, process.env);\n  }\n\n  if (options.rewrites) config.rewrites = options.rewrites;\n\n  return options.extend ? options.extend(config) : config;\n}\n"],"mappings":";;;;;AAwBA,IAAM,kBAA+E;AAAA,EACnF,QAAQ;AAAA,IACN,cAAc,CAAC,uBAAuB;AAAA,IACtC,WAAW,CAAC,sBAAsB;AAAA,IAClC,eAAe,CAAC,wBAAwB;AAAA,IACxC,aAAa,CAAC,yBAAyB,0BAA0B;AAAA,EACnE;AAAA,EACA,YAAY;AAAA,IACV,cAAc,CAAC,6BAA6B;AAAA,IAC5C,WAAW,CAAC,+BAA+B,0BAA0B;AAAA,IACrE,eAAe,CAAC,+BAA+B,+BAA+B;AAAA,EAChF;AAAA,EACA,WAAW;AAAA,IACT,cAAc,CAAC,mCAAmC;AAAA,IAClD,eAAe,CAAC,mCAAmC;AAAA,IACnD,aAAa,CAAC,mCAAmC;AAAA,EACnD;AAAA,EACA,SAAS;AAAA,IACP,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA,aAAa;AAAA,IACX,aAAa,CAAC,8BAA8B;AAAA,IAC5C,YAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF;AAEA,SAAS,iBAAiB,KAAkC;AAC1D,SAAO,IAAI,gBAAgB,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAClF;AAFS;AAOF,SAAS,SAAS,SAAqB,KAAgC;AAC5E,QAAM,SAAS,IAAI,uBAAuB;AAC1C,QAAM,eAAe,iBAAiB,GAAG;AACzC,QAAM,WAAW,QAAQ,YAAY,CAAC;AAItC,QAAM,kBAA+E;AAAA;AAAA,IAEnF,cAAc,EAAE,MAAM,CAAC,UAAU,mBAAmB,eAAe,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAElF,aAAa,EAAE,MAAM,CAAC,UAAU,iBAAiB,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAEhE,WAAW,EAAE,MAAM,CAAC,UAAU,SAAS,OAAO,GAAG,SAAS,aAAa;AAAA;AAAA,IAEvE,YAAY,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE5C,eAAe;AAAA,MACb,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,QACP;AAAA;AAAA,QAEA,OAAO,QAAQ,SAAS,IAAI;AAAA,QAC5B,IAAI,uBAAuB;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF;AAAA;AAAA,IAEA,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE7C,cAAc,EAAE,MAAM,CAAC,UAAU,OAAO,GAAG,SAAS,CAAC,EAAE;AAAA,EACzD;AAEA,QAAM,YAAY,wBAAC,SAA+B;AAChD,UAAM,EAAE,MAAM,QAAQ,IAAI,gBAAgB,IAAI;AAC9C,UAAM,eAAe,SAAS,QAAQ,CAAC,YAAY,gBAAgB,OAAO,EAAE,IAAI,KAAK,CAAC,CAAC;AACvF,UAAM,UAAU,CAAC,GAAG,MAAM,GAAG,cAAc,GAAI,QAAQ,MAAM,IAAI,KAAK,CAAC,GAAI,GAAG,OAAO,EAAE;AAAA,MACrF,CAAC,WAAW,WAAW;AAAA,IACzB;AACA,WAAO,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,EAC7C,GAPkB;AASlB,SAAO;AAAA,IACL;AAAA,IACA,UAAU,YAAY;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,UAAU,SAAS;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,UAAU,aAAa;AAAA,IACvB,UAAU,WAAW;AAAA;AAAA,IAErB;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA,IACA,UAAU,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,IAAI,aAAa,gBAAgB,IAAI,cAAc,SAAS,8BAA8B;AAAA,EAC5F,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACd;AAtEgB;;;AC7CT,SAAS,qBAAqB,SAAgC,KAAsC;AACzG,QAAM,SAAS,QAAQ,mBAAmB,WAAW,SAAS,KAAK;AAEnE,SAAO;AAAA,IACL;AAAA;AAAA,MAEE,QAAQ;AAAA,MACR,SAAS;AAAA;AAAA,QAEP;AAAA,UACE,KAAK;AAAA,UACL,OAAO,SAAS,SAAS,GAAG;AAAA,QAC9B;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,IAAI,cAAc,SAClB,CAAC,IACD;AAAA,UACE;AAAA,YACE,KAAK;AAAA,YACL,OAAO;AAAA,UACT;AAAA,QACF;AAAA;AAAA,QAEJ;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO,WAAW,MAAM;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;;;ACsBhB,SAAS,kBAAkB,KAAyC;AAClE,SAAO,IAAI,gBACP,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,QAAQ;AACxC,UAAM,EAAE,UAAU,UAAU,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACvD,WAAO;AAAA,MACL,UAAU,SAAS,QAAQ,KAAK,EAAE;AAAA,MAClC;AAAA,MACA,MAAM,QAAQ;AAAA,IAChB;AAAA,EACF,CAAC,IACD,CAAC;AACP;AAXS;AAaF,SAAS,iBAAiB,SAA2C;AAC1E,QAAM,MAAM,QAAQ;AACpB,QAAM,gBAAgB,QAAQ,kBAAkB;AAEhD,QAAM,SAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,IAAI,cAAc,SAAS,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,IAC3D,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB;AAAA,IACA,cAAc;AAAA,MACZ,eAAe;AAAA,QACb,eAAe;AAAA,MACjB;AAAA;AAAA;AAAA;AAAA,MAIA,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,gBAAgB,EAAE,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC9D;AAAA,IACA,mBAAmB,QAAQ;AAAA,IAC3B,gBAAgB,QAAQ,MAAM,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AAAA,IACjE,QAAQ;AAAA,MACN,iBAAiB,QAAQ,wBAAwB;AAAA,MACjD,gBAAgB,kBAAkB,GAAG;AAAA,MACrC,yBAAyB;AAAA,IAC3B;AAAA,IACA,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,KAAK;AAAA,MACH,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,8BAA8B,IAAI,gCAAgC;AAAA,MAClE,iCAAiC,IAAI,mCAAmC;AAAA,MACxE,GAAG,QAAQ;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,QAAQ,UAAU,EAAE,wBAAwB,CAAC,WAAW,cAAc,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,IAGjF,WAAW;AAAA,MACT,cAAc;AAAA,QACZ,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,oBAAoB,OAAO;AACrC,WAAO,UAAU,YAAY,qBAAqB,SAAS,QAAQ,GAAG;AAAA,EACxE;AAEA,MAAI,QAAQ,SAAU,QAAO,WAAW,QAAQ;AAEhD,SAAO,QAAQ,SAAS,QAAQ,OAAO,MAAM,IAAI;AACnD;AArEgB;","names":[]}
+{"version":3,"sources":["../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"sourcesContent":["// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n  \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n *   `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n  services?: CspService[];\n  csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n  stripe: {\n    \"script-src\": [\"https://js.stripe.com\"],\n    \"img-src\": [\"https://*.stripe.com\"],\n    \"connect-src\": [\"https://api.stripe.com\"],\n    \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n  },\n  googleMaps: {\n    \"script-src\": [\"https://maps.googleapis.com\"],\n    \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n    \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n  },\n  turnstile: {\n    \"script-src\": [\"https://challenges.cloudflare.com\"],\n    \"connect-src\": [\"https://challenges.cloudflare.com\"],\n    \"frame-src\": [\"https://challenges.cloudflare.com\"],\n  },\n  discord: {\n    \"img-src\": [\"https://cdn.discordapp.com\"],\n  },\n  googleFonts: {\n    \"style-src\": [\"https://fonts.googleapis.com\"],\n    \"font-src\": [\"https://fonts.gstatic.com\"],\n  },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n/**\n * Origins of the app's own servers, the API and the corpus, from\n * `NEXT_PUBLIC_API_URL` and `NEXT_PUBLIC_CORPUS_URL`. They serve every stored\n * object link, so images and frames must be allowed from them. Unset or invalid\n * URLs are skipped; the result has no duplicates.\n */\nexport function listAppOrigins(env: NodeJS.ProcessEnv): string[] {\n  const origins: string[] = [];\n  for (const url of [env.NEXT_PUBLIC_API_URL, env.NEXT_PUBLIC_CORPUS_URL]) {\n    if (!url) continue;\n    try {\n      const { origin } = new URL(url.trim());\n      if (origin !== \"null\" && !origins.includes(origin)) origins.push(origin);\n    } catch {\n      // Not a URL: nothing to allow.\n    }\n  }\n  return origins;\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n  const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n  const imageSources = listImageSources(env);\n  const appOrigins = listAppOrigins(env);\n  const services = options.services ?? [];\n\n  // Each fetch directive: what Next itself needs, then the named services, then\n  // the app's extras, then the sources derived from the env.\n  const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n    // Scripts: self, and unsafe-inline/eval for Next.js\n    \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n    // Styles: self and unsafe-inline for styled-components/emotion\n    \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n    // Images: self, data URIs, blobs, configured image sources, and the api/corpus origins\n    \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: [...imageSources, ...appOrigins] },\n    // Fonts: self\n    \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n    \"connect-src\": {\n      base: [\"'self'\"],\n      fromEnv: [\n        apiUrl,\n        // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n        apiUrl.replace(/^http/, \"ws\"),\n        env.NEXT_PUBLIC_ADDRESS || \"\",\n        ...imageSources,\n      ],\n    },\n    // Frames: self, and the api/corpus origins (inline previews of stored objects)\n    \"frame-src\": { base: [\"'self'\"], fromEnv: appOrigins },\n    // Worker sources: self and blob (for Web Workers with dynamic imports)\n    \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n  };\n\n  const directive = (name: CspDirective): string => {\n    const { base, fromEnv } = fetchDirectives[name];\n    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n    const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n      (source) => source !== \"\",\n    );\n    return [name, ...new Set(sources)].join(\" \");\n  };\n\n  return [\n    \"default-src 'self'\",\n    directive(\"script-src\"),\n    directive(\"style-src\"),\n    directive(\"img-src\"),\n    directive(\"font-src\"),\n    directive(\"connect-src\"),\n    directive(\"frame-src\"),\n    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n    \"frame-ancestors 'none'\",\n    // Form actions: only self\n    \"form-action 'self'\",\n    // Base URI: only self\n    \"base-uri 'self'\",\n    // Object sources: none (no plugins)\n    \"object-src 'none'\",\n    directive(\"worker-src\"),\n    // Upgrade insecure requests in production.\n    //\n    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n    // and serves it over plain http on a custom hostname. With this directive\n    // the browser rewrites every /_next/static asset to https, which nothing is\n    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n    // never hydrates, and each spec sees only server-rendered markup.\n    env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n  ]\n    .filter(Boolean)\n    .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n  source: string;\n  headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n  const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n  return [\n    {\n      // Apply to all routes\n      source: \"/:path*\",\n      headers: [\n        // Content Security Policy - prevents XSS attacks\n        {\n          key: \"Content-Security-Policy\",\n          value: buildCsp(options, env),\n        },\n        // X-Frame-Options - prevents clickjacking (backup for older browsers)\n        {\n          key: \"X-Frame-Options\",\n          value: \"DENY\",\n        },\n        // X-Content-Type-Options - prevents MIME sniffing\n        {\n          key: \"X-Content-Type-Options\",\n          value: \"nosniff\",\n        },\n        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n        // the suite speaks plain http, and an HSTS pin would force https on every\n        // later request to this host from the same browser profile.\n        ...(env.E2E_BUILD === \"true\"\n          ? []\n          : [\n              {\n                key: \"Strict-Transport-Security\",\n                value: \"max-age=31536000; includeSubDomains\",\n              },\n            ]),\n        // Referrer-Policy - controls referrer information\n        {\n          key: \"Referrer-Policy\",\n          value: \"strict-origin-when-cross-origin\",\n        },\n        // Permissions-Policy - restricts browser features\n        {\n          key: \"Permissions-Policy\",\n          value: `camera=(${camera}), microphone=(), geolocation=()`,\n        },\n      ],\n    },\n  ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, listAppOrigins, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp, listAppOrigins };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n  devOrigins: string[];\n  /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n  services?: CspService[];\n  /** Extra CSP sources per directive, for hosts no named service covers. */\n  csp?: Partial<Record<CspDirective, string[]>>;\n  env?: Record<string, string>;\n  imageMinimumCacheTTL?: number;\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n  mdx?: boolean;\n  serwist?: boolean;\n  securityHeaders?: boolean;\n  authInterrupts?: boolean;\n  reactCompiler?: boolean;\n  rewrites?: NextConfig[\"rewrites\"];\n  extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\n// IMAGE_SOURCES, then the api and corpus origins (they serve every stored object\n// link), without duplicates.\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n  const imageSources = env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((url) => url.trim()) : [];\n  const patterns: RemotePattern[] = [];\n  for (const url of [...imageSources, ...listAppOrigins(env)]) {\n    const { hostname, protocol, port } = new URL(url);\n    const pattern: RemotePattern = {\n      protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n      hostname,\n      port: port || undefined,\n    };\n    const seen = patterns.some(\n      (p) => p.protocol === pattern.protocol && p.hostname === pattern.hostname && p.port === pattern.port,\n    );\n    if (!seen) patterns.push(pattern);\n  }\n  return patterns;\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n  const env = process.env;\n  const reactCompiler = options.reactCompiler === true;\n\n  const config: NextConfig = {\n    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n    // `next dev` server may still be running against the same worktree. `next\n    // build` and `next dev` share `.next`, so a build performed underneath a live\n    // dev server clobbers it and that dev server then 404s every route. Giving\n    // the e2e build its own directory keeps the two independent. E2E_BUILD must\n    // be set for `next build` AND for `next start`, or `start` looks in `.next`\n    // and serves someone else's output.\n    ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n    cacheComponents: true,\n    partialPrefetching: true,\n    reactCompiler,\n    experimental: {\n      serverActions: {\n        bodySizeLimit: \"5mb\",\n      },\n      // Required by `unauthorized()` (next/navigation): without this flag it throws a plain\n      // Error instead of rendering the nearest unauthorized.tsx. The flag is for app code that\n      // calls it; ServerSession.checkPermission does not, it still does `redirect(\"/401\")`.\n      authInterrupts: options.authInterrupts ?? true,\n      turbopackGc: true,\n      // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n      // imported request module unactivated (\"Lazily compiled dynamic import of ...\n      // JsonApiRequest ... was not activated\"), so every client-side read returns\n      // nothing. Seen with the package installed from npm; production builds are unaffected.\n      ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n    },\n    allowedDevOrigins: options.devOrigins,\n    pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n    images: {\n      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n      remotePatterns: parseImageSources(env),\n      dangerouslyAllowLocalIP: true,\n    },\n    poweredByHeader: false,\n    reactStrictMode: false,\n    env: {\n      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n      ...options.env,\n    },\n    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n    // does nothing but append these two entries. Requiring the package here\n    // instead CRASHES production: it is a devDependency, next.config.js is loaded\n    // at RUNTIME by `next start`, and the web-production image installs with\n    // --prod. Do not re-add a require of any devDependency to this file.\n    ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n    // single instance in both modes.\n    turbopack: {\n      resolveAlias: {\n        yjs: \"./node_modules/yjs\",\n      },\n    },\n  };\n\n  if (options.securityHeaders !== false) {\n    config.headers = async () => buildSecurityHeaders(options, process.env);\n  }\n\n  if (options.rewrites) config.rewrites = options.rewrites;\n\n  return options.extend ? options.extend(config) : config;\n}\n"],"mappings":";;;;;AAwBA,IAAM,kBAA+E;AAAA,EACnF,QAAQ;AAAA,IACN,cAAc,CAAC,uBAAuB;AAAA,IACtC,WAAW,CAAC,sBAAsB;AAAA,IAClC,eAAe,CAAC,wBAAwB;AAAA,IACxC,aAAa,CAAC,yBAAyB,0BAA0B;AAAA,EACnE;AAAA,EACA,YAAY;AAAA,IACV,cAAc,CAAC,6BAA6B;AAAA,IAC5C,WAAW,CAAC,+BAA+B,0BAA0B;AAAA,IACrE,eAAe,CAAC,+BAA+B,+BAA+B;AAAA,EAChF;AAAA,EACA,WAAW;AAAA,IACT,cAAc,CAAC,mCAAmC;AAAA,IAClD,eAAe,CAAC,mCAAmC;AAAA,IACnD,aAAa,CAAC,mCAAmC;AAAA,EACnD;AAAA,EACA,SAAS;AAAA,IACP,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA,aAAa;AAAA,IACX,aAAa,CAAC,8BAA8B;AAAA,IAC5C,YAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF;AAEA,SAAS,iBAAiB,KAAkC;AAC1D,SAAO,IAAI,gBAAgB,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAClF;AAFS;AAUF,SAAS,eAAe,KAAkC;AAC/D,QAAM,UAAoB,CAAC;AAC3B,aAAW,OAAO,CAAC,IAAI,qBAAqB,IAAI,sBAAsB,GAAG;AACvE,QAAI,CAAC,IAAK;AACV,QAAI;AACF,YAAM,EAAE,OAAO,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACrC,UAAI,WAAW,UAAU,CAAC,QAAQ,SAAS,MAAM,EAAG,SAAQ,KAAK,MAAM;AAAA,IACzE,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAZgB;AAiBT,SAAS,SAAS,SAAqB,KAAgC;AAC5E,QAAM,SAAS,IAAI,uBAAuB;AAC1C,QAAM,eAAe,iBAAiB,GAAG;AACzC,QAAM,aAAa,eAAe,GAAG;AACrC,QAAM,WAAW,QAAQ,YAAY,CAAC;AAItC,QAAM,kBAA+E;AAAA;AAAA,IAEnF,cAAc,EAAE,MAAM,CAAC,UAAU,mBAAmB,eAAe,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAElF,aAAa,EAAE,MAAM,CAAC,UAAU,iBAAiB,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAEhE,WAAW,EAAE,MAAM,CAAC,UAAU,SAAS,OAAO,GAAG,SAAS,CAAC,GAAG,cAAc,GAAG,UAAU,EAAE;AAAA;AAAA,IAE3F,YAAY,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE5C,eAAe;AAAA,MACb,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,QACP;AAAA;AAAA,QAEA,OAAO,QAAQ,SAAS,IAAI;AAAA,QAC5B,IAAI,uBAAuB;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF;AAAA;AAAA,IAEA,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,WAAW;AAAA;AAAA,IAErD,cAAc,EAAE,MAAM,CAAC,UAAU,OAAO,GAAG,SAAS,CAAC,EAAE;AAAA,EACzD;AAEA,QAAM,YAAY,wBAAC,SAA+B;AAChD,UAAM,EAAE,MAAM,QAAQ,IAAI,gBAAgB,IAAI;AAC9C,UAAM,eAAe,SAAS,QAAQ,CAAC,YAAY,gBAAgB,OAAO,EAAE,IAAI,KAAK,CAAC,CAAC;AACvF,UAAM,UAAU,CAAC,GAAG,MAAM,GAAG,cAAc,GAAI,QAAQ,MAAM,IAAI,KAAK,CAAC,GAAI,GAAG,OAAO,EAAE;AAAA,MACrF,CAAC,WAAW,WAAW;AAAA,IACzB;AACA,WAAO,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,EAC7C,GAPkB;AASlB,SAAO;AAAA,IACL;AAAA,IACA,UAAU,YAAY;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,UAAU,SAAS;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,UAAU,aAAa;AAAA,IACvB,UAAU,WAAW;AAAA;AAAA,IAErB;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA,IACA,UAAU,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,IAAI,aAAa,gBAAgB,IAAI,cAAc,SAAS,8BAA8B;AAAA,EAC5F,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACd;AAvEgB;;;ACjET,SAAS,qBAAqB,SAAgC,KAAsC;AACzG,QAAM,SAAS,QAAQ,mBAAmB,WAAW,SAAS,KAAK;AAEnE,SAAO;AAAA,IACL;AAAA;AAAA,MAEE,QAAQ;AAAA,MACR,SAAS;AAAA;AAAA,QAEP;AAAA,UACE,KAAK;AAAA,UACL,OAAO,SAAS,SAAS,GAAG;AAAA,QAC9B;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,IAAI,cAAc,SAClB,CAAC,IACD;AAAA,UACE;AAAA,YACE,KAAK;AAAA,YACL,OAAO;AAAA,UACT;AAAA,QACF;AAAA;AAAA,QAEJ;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO,WAAW,MAAM;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;;;ACwBhB,SAAS,kBAAkB,KAAyC;AAClE,QAAM,eAAe,IAAI,gBAAgB,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;AAClG,QAAM,WAA4B,CAAC;AACnC,aAAW,OAAO,CAAC,GAAG,cAAc,GAAG,eAAe,GAAG,CAAC,GAAG;AAC3D,UAAM,EAAE,UAAU,UAAU,KAAK,IAAI,IAAI,IAAI,GAAG;AAChD,UAAM,UAAyB;AAAA,MAC7B,UAAU,SAAS,QAAQ,KAAK,EAAE;AAAA,MAClC;AAAA,MACA,MAAM,QAAQ;AAAA,IAChB;AACA,UAAM,OAAO,SAAS;AAAA,MACpB,CAAC,MAAM,EAAE,aAAa,QAAQ,YAAY,EAAE,aAAa,QAAQ,YAAY,EAAE,SAAS,QAAQ;AAAA,IAClG;AACA,QAAI,CAAC,KAAM,UAAS,KAAK,OAAO;AAAA,EAClC;AACA,SAAO;AACT;AAhBS;AAkBF,SAAS,iBAAiB,SAA2C;AAC1E,QAAM,MAAM,QAAQ;AACpB,QAAM,gBAAgB,QAAQ,kBAAkB;AAEhD,QAAM,SAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,IAAI,cAAc,SAAS,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,IAC3D,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB;AAAA,IACA,cAAc;AAAA,MACZ,eAAe;AAAA,QACb,eAAe;AAAA,MACjB;AAAA;AAAA;AAAA;AAAA,MAIA,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,gBAAgB,EAAE,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC9D;AAAA,IACA,mBAAmB,QAAQ;AAAA,IAC3B,gBAAgB,QAAQ,MAAM,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AAAA,IACjE,QAAQ;AAAA,MACN,iBAAiB,QAAQ,wBAAwB;AAAA,MACjD,gBAAgB,kBAAkB,GAAG;AAAA,MACrC,yBAAyB;AAAA,IAC3B;AAAA,IACA,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,KAAK;AAAA,MACH,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,8BAA8B,IAAI,gCAAgC;AAAA,MAClE,iCAAiC,IAAI,mCAAmC;AAAA,MACxE,GAAG,QAAQ;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,QAAQ,UAAU,EAAE,wBAAwB,CAAC,WAAW,cAAc,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,IAGjF,WAAW;AAAA,MACT,cAAc;AAAA,QACZ,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,oBAAoB,OAAO;AACrC,WAAO,UAAU,YAAY,qBAAqB,SAAS,QAAQ,GAAG;AAAA,EACxE;AAEA,MAAI,QAAQ,SAAU,QAAO,WAAW,QAAQ;AAEhD,SAAO,QAAQ,SAAS,QAAQ,OAAO,MAAM,IAAI;AACnD;AArEgB;","names":[]}

package/dist/server/index.js

@@ -12,7 +12,7 @@
 
 
 
-var _chunkDYTKNSHYjs = require('../chunk-DYTKNSHY.js');
+var _chunkKS6WZP2Ejs = require('../chunk-KS6WZP2E.js');
 
 
 var _chunkYUO55Q5Ajs = require('../chunk-YUO55Q5A.js');
@@ -33,7 +33,7 @@ require('../chunk-G4JR3SFV.js');
 
 
 
-var _chunk5PNDDYGLjs = require('../chunk-5PNDDYGL.js');
+var _chunk4BZJ4LABjs = require('../chunk-4BZJ4LAB.js');
 require('../chunk-LXKSUWAV.js');
 require('../chunk-JTPRJNT2.js');
 require('../chunk-GHE4VT2R.js');
@@ -64,5 +64,5 @@ require('../chunk-7QVYU63E.js');
 
 
 
-exports.CACHE_PROFILES = _chunkIK65TDQHjs.CACHE_PROFILES; exports.ServerAuthService = _chunk5PNDDYGLjs.AuthService; exports.ServerCompanyService = _chunk5PNDDYGLjs.CompanyService; exports.ServerContentService = _chunk5PNDDYGLjs.ContentService; exports.ServerFeatureService = _chunk5PNDDYGLjs.FeatureService; exports.ServerJsonApiDelete = _chunkDYTKNSHYjs.ServerJsonApiDelete; exports.ServerJsonApiGet = _chunkDYTKNSHYjs.ServerJsonApiGet; exports.ServerJsonApiPatch = _chunkDYTKNSHYjs.ServerJsonApiPatch; exports.ServerJsonApiPost = _chunkDYTKNSHYjs.ServerJsonApiPost; exports.ServerJsonApiPut = _chunkDYTKNSHYjs.ServerJsonApiPut; exports.ServerNotificationService = _chunk5PNDDYGLjs.NotificationService; exports.ServerPushService = _chunk5PNDDYGLjs.PushService; exports.ServerRoleService = _chunk5PNDDYGLjs.RoleService; exports.ServerS3Service = _chunk5PNDDYGLjs.S3Service; exports.ServerSession = _chunkDYTKNSHYjs.ServerSession; exports.ServerUserService = _chunk5PNDDYGLjs.UserService; exports.configureServerJsonApi = _chunkDYTKNSHYjs.configureServerJsonApi; exports.getServerApiUrl = _chunkDYTKNSHYjs.getServerApiUrl; exports.getServerAppUrl = _chunkDYTKNSHYjs.getServerAppUrl; exports.getServerToken = _chunkYUO55Q5Ajs.getServerToken; exports.getServerTrackablePages = _chunkDYTKNSHYjs.getServerTrackablePages; exports.invalidateCacheTag = _chunkDYTKNSHYjs.invalidateCacheTag; exports.invalidateCacheTags = _chunkDYTKNSHYjs.invalidateCacheTags; exports.serverRequest = _chunk6TUB7Y6Tjs.serverRequest; exports.updateCacheTag = _chunkDYTKNSHYjs.updateCacheTag;
+exports.CACHE_PROFILES = _chunkIK65TDQHjs.CACHE_PROFILES; exports.ServerAuthService = _chunk4BZJ4LABjs.AuthService; exports.ServerCompanyService = _chunk4BZJ4LABjs.CompanyService; exports.ServerContentService = _chunk4BZJ4LABjs.ContentService; exports.ServerFeatureService = _chunk4BZJ4LABjs.FeatureService; exports.ServerJsonApiDelete = _chunkKS6WZP2Ejs.ServerJsonApiDelete; exports.ServerJsonApiGet = _chunkKS6WZP2Ejs.ServerJsonApiGet; exports.ServerJsonApiPatch = _chunkKS6WZP2Ejs.ServerJsonApiPatch; exports.ServerJsonApiPost = _chunkKS6WZP2Ejs.ServerJsonApiPost; exports.ServerJsonApiPut = _chunkKS6WZP2Ejs.ServerJsonApiPut; exports.ServerNotificationService = _chunk4BZJ4LABjs.NotificationService; exports.ServerPushService = _chunk4BZJ4LABjs.PushService; exports.ServerRoleService = _chunk4BZJ4LABjs.RoleService; exports.ServerS3Service = _chunk4BZJ4LABjs.S3Service; exports.ServerSession = _chunkKS6WZP2Ejs.ServerSession; exports.ServerUserService = _chunk4BZJ4LABjs.UserService; exports.configureServerJsonApi = _chunkKS6WZP2Ejs.configureServerJsonApi; exports.getServerApiUrl = _chunkKS6WZP2Ejs.getServerApiUrl; exports.getServerAppUrl = _chunkKS6WZP2Ejs.getServerAppUrl; exports.getServerToken = _chunkYUO55Q5Ajs.getServerToken; exports.getServerTrackablePages = _chunkKS6WZP2Ejs.getServerTrackablePages; exports.invalidateCacheTag = _chunkKS6WZP2Ejs.invalidateCacheTag; exports.invalidateCacheTags = _chunkKS6WZP2Ejs.invalidateCacheTags; exports.serverRequest = _chunk6TUB7Y6Tjs.serverRequest; exports.updateCacheTag = _chunkKS6WZP2Ejs.updateCacheTag;
 //# sourceMappingURL=index.js.map

package/dist/server/index.mjs

@@ -12,7 +12,7 @@ import {
   invalidateCacheTag,
   invalidateCacheTags,
   updateCacheTag
-} from "../chunk-IOG22OAO.mjs";
+} from "../chunk-46S3KPLU.mjs";
 import {
   getServerToken
 } from "../chunk-F5UNXZ3J.mjs";
@@ -33,7 +33,7 @@ import {
   RoleService,
   S3Service,
   UserService
-} from "../chunk-Z3226FM6.mjs";
+} from "../chunk-ZZ6E33FO.mjs";
 import "../chunk-AUXK7QSA.mjs";
 import "../chunk-PI56A4DG.mjs";
 import "../chunk-V5MI7RNB.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carlonicora/nextjs-jsonapi",
-  "version": "4.0.8",
+  "version": "4.1.1",
   "description": "Next.js JSON:API client with server/client support and caching",
   "author": "Carlo Nicora",
   "license": "GPL-3.0-or-later",