@carlonicora/nextjs-jsonapi 4.2.3 → 5.0.0

package/dist/next-config/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"sourcesContent":["// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n  \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n *   `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n  services?: CspService[];\n  csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n  stripe: {\n    \"script-src\": [\"https://js.stripe.com\"],\n    \"img-src\": [\"https://*.stripe.com\"],\n    \"connect-src\": [\"https://api.stripe.com\"],\n    \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n  },\n  googleMaps: {\n    \"script-src\": [\"https://maps.googleapis.com\"],\n    \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n    \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n  },\n  turnstile: {\n    \"script-src\": [\"https://challenges.cloudflare.com\"],\n    \"connect-src\": [\"https://challenges.cloudflare.com\"],\n    \"frame-src\": [\"https://challenges.cloudflare.com\"],\n  },\n  discord: {\n    \"img-src\": [\"https://cdn.discordapp.com\"],\n  },\n  googleFonts: {\n    \"style-src\": [\"https://fonts.googleapis.com\"],\n    \"font-src\": [\"https://fonts.gstatic.com\"],\n  },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n/**\n * Origins of the app's own servers, the API and the corpus, from\n * `NEXT_PUBLIC_API_URL` and `NEXT_PUBLIC_CORPUS_URL`. They serve every stored\n * object link, so images and frames must be allowed from them. Unset or invalid\n * URLs are skipped; the result has no duplicates.\n */\nexport function listAppOrigins(env: NodeJS.ProcessEnv): string[] {\n  const origins: string[] = [];\n  for (const url of [env.NEXT_PUBLIC_API_URL, env.NEXT_PUBLIC_CORPUS_URL]) {\n    if (!url) continue;\n    try {\n      const { origin } = new URL(url.trim());\n      if (origin !== \"null\" && !origins.includes(origin)) origins.push(origin);\n    } catch {\n      // Not a URL: nothing to allow.\n    }\n  }\n  return origins;\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n  const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n  const imageSources = listImageSources(env);\n  const appOrigins = listAppOrigins(env);\n  const services = options.services ?? [];\n\n  // Each fetch directive: what Next itself needs, then the named services, then\n  // the app's extras, then the sources derived from the env.\n  const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n    // Scripts: self, and unsafe-inline/eval for Next.js\n    \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n    // Styles: self and unsafe-inline for styled-components/emotion\n    \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n    // Images: self, data URIs, blobs, configured image sources, and the api/corpus origins\n    \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: [...imageSources, ...appOrigins] },\n    // Fonts: self\n    \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n    \"connect-src\": {\n      base: [\"'self'\"],\n      fromEnv: [\n        apiUrl,\n        // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n        apiUrl.replace(/^http/, \"ws\"),\n        env.NEXT_PUBLIC_ADDRESS || \"\",\n        ...imageSources,\n      ],\n    },\n    // Frames: self, and the api/corpus origins (inline previews of stored objects)\n    \"frame-src\": { base: [\"'self'\"], fromEnv: appOrigins },\n    // Worker sources: self and blob (for Web Workers with dynamic imports)\n    \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n  };\n\n  const directive = (name: CspDirective): string => {\n    const { base, fromEnv } = fetchDirectives[name];\n    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n    const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n      (source) => source !== \"\",\n    );\n    return [name, ...new Set(sources)].join(\" \");\n  };\n\n  return [\n    \"default-src 'self'\",\n    directive(\"script-src\"),\n    directive(\"style-src\"),\n    directive(\"img-src\"),\n    directive(\"font-src\"),\n    directive(\"connect-src\"),\n    directive(\"frame-src\"),\n    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n    \"frame-ancestors 'none'\",\n    // Form actions: only self\n    \"form-action 'self'\",\n    // Base URI: only self\n    \"base-uri 'self'\",\n    // Object sources: none (no plugins)\n    \"object-src 'none'\",\n    directive(\"worker-src\"),\n    // Upgrade insecure requests in production.\n    //\n    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n    // and serves it over plain http on a custom hostname. With this directive\n    // the browser rewrites every /_next/static asset to https, which nothing is\n    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n    // never hydrates, and each spec sees only server-rendered markup.\n    env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n  ]\n    .filter(Boolean)\n    .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n  source: string;\n  headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n  const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n  return [\n    {\n      // Apply to all routes\n      source: \"/:path*\",\n      headers: [\n        // Content Security Policy - prevents XSS attacks\n        {\n          key: \"Content-Security-Policy\",\n          value: buildCsp(options, env),\n        },\n        // X-Frame-Options - prevents clickjacking (backup for older browsers)\n        {\n          key: \"X-Frame-Options\",\n          value: \"DENY\",\n        },\n        // X-Content-Type-Options - prevents MIME sniffing\n        {\n          key: \"X-Content-Type-Options\",\n          value: \"nosniff\",\n        },\n        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n        // the suite speaks plain http, and an HSTS pin would force https on every\n        // later request to this host from the same browser profile.\n        ...(env.E2E_BUILD === \"true\"\n          ? []\n          : [\n              {\n                key: \"Strict-Transport-Security\",\n                value: \"max-age=31536000; includeSubDomains\",\n              },\n            ]),\n        // Referrer-Policy - controls referrer information\n        {\n          key: \"Referrer-Policy\",\n          value: \"strict-origin-when-cross-origin\",\n        },\n        // Permissions-Policy - restricts browser features\n        {\n          key: \"Permissions-Policy\",\n          value: `camera=(${camera}), microphone=(), geolocation=()`,\n        },\n      ],\n    },\n  ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, listAppOrigins, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp, listAppOrigins };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n  devOrigins: string[];\n  /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n  services?: CspService[];\n  /** Extra CSP sources per directive, for hosts no named service covers. */\n  csp?: Partial<Record<CspDirective, string[]>>;\n  env?: Record<string, string>;\n  imageMinimumCacheTTL?: number;\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n  mdx?: boolean;\n  serwist?: boolean;\n  securityHeaders?: boolean;\n  authInterrupts?: boolean;\n  reactCompiler?: boolean;\n  rewrites?: NextConfig[\"rewrites\"];\n  extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\n// IMAGE_SOURCES, then the api and corpus origins (they serve every stored object\n// link), without duplicates.\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n  const imageSources = env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((url) => url.trim()) : [];\n  const patterns: RemotePattern[] = [];\n  for (const url of [...imageSources, ...listAppOrigins(env)]) {\n    const { hostname, protocol, port } = new URL(url);\n    const pattern: RemotePattern = {\n      protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n      hostname,\n      port: port || undefined,\n    };\n    const seen = patterns.some(\n      (p) => p.protocol === pattern.protocol && p.hostname === pattern.hostname && p.port === pattern.port,\n    );\n    if (!seen) patterns.push(pattern);\n  }\n  return patterns;\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n  const env = process.env;\n  const reactCompiler = options.reactCompiler === true;\n\n  const config: NextConfig = {\n    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n    // `next dev` server may still be running against the same worktree. `next\n    // build` and `next dev` share `.next`, so a build performed underneath a live\n    // dev server clobbers it and that dev server then 404s every route. Giving\n    // the e2e build its own directory keeps the two independent. E2E_BUILD must\n    // be set for `next build` AND for `next start`, or `start` looks in `.next`\n    // and serves someone else's output.\n    ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n    cacheComponents: true,\n    partialPrefetching: true,\n    reactCompiler,\n    experimental: {\n      serverActions: {\n        bodySizeLimit: \"5mb\",\n      },\n      // Required by `unauthorized()` (next/navigation): without this flag it throws a plain\n      // Error instead of rendering the nearest unauthorized.tsx. The flag is for app code that\n      // calls it; ServerSession.checkPermission does not, it still does `redirect(\"/401\")`.\n      authInterrupts: options.authInterrupts ?? true,\n      turbopackGc: true,\n      // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n      // imported request module unactivated (\"Lazily compiled dynamic import of ...\n      // JsonApiRequest ... was not activated\"), so every client-side read returns\n      // nothing. Seen with the package installed from npm; production builds are unaffected.\n      ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n    },\n    allowedDevOrigins: options.devOrigins,\n    pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n    images: {\n      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n      remotePatterns: parseImageSources(env),\n      dangerouslyAllowLocalIP: true,\n    },\n    poweredByHeader: false,\n    reactStrictMode: false,\n    env: {\n      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n      ...options.env,\n    },\n    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n    // does nothing but append these two entries. Requiring the package here\n    // instead CRASHES production: it is a devDependency, next.config.js is loaded\n    // at RUNTIME by `next start`, and the web-production image installs with\n    // --prod. Do not re-add a require of any devDependency to this file.\n    ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n    // single instance in both modes.\n    turbopack: {\n      resolveAlias: {\n        yjs: \"./node_modules/yjs\",\n      },\n    },\n  };\n\n  if (options.securityHeaders !== false) {\n    config.headers = async () => buildSecurityHeaders(options, process.env);\n  }\n\n  if (options.rewrites) config.rewrites = options.rewrites;\n\n  return options.extend ? options.extend(config) : config;\n}\n"],"mappings":";;;;;AAwBA,IAAM,kBAA+E;AAAA,EACnF,QAAQ;AAAA,IACN,cAAc,CAAC,uBAAuB;AAAA,IACtC,WAAW,CAAC,sBAAsB;AAAA,IAClC,eAAe,CAAC,wBAAwB;AAAA,IACxC,aAAa,CAAC,yBAAyB,0BAA0B;AAAA,EACnE;AAAA,EACA,YAAY;AAAA,IACV,cAAc,CAAC,6BAA6B;AAAA,IAC5C,WAAW,CAAC,+BAA+B,0BAA0B;AAAA,IACrE,eAAe,CAAC,+BAA+B,+BAA+B;AAAA,EAChF;AAAA,EACA,WAAW;AAAA,IACT,cAAc,CAAC,mCAAmC;AAAA,IAClD,eAAe,CAAC,mCAAmC;AAAA,IACnD,aAAa,CAAC,mCAAmC;AAAA,EACnD;AAAA,EACA,SAAS;AAAA,IACP,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA,aAAa;AAAA,IACX,aAAa,CAAC,8BAA8B;AAAA,IAC5C,YAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF;AAEA,SAAS,iBAAiB,KAAkC;AAC1D,SAAO,IAAI,gBAAgB,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAClF;AAFS;AAUF,SAAS,eAAe,KAAkC;AAC/D,QAAM,UAAoB,CAAC;AAC3B,aAAW,OAAO,CAAC,IAAI,qBAAqB,IAAI,sBAAsB,GAAG;AACvE,QAAI,CAAC,IAAK;AACV,QAAI;AACF,YAAM,EAAE,OAAO,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACrC,UAAI,WAAW,UAAU,CAAC,QAAQ,SAAS,MAAM,EAAG,SAAQ,KAAK,MAAM;AAAA,IACzE,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAZgB;AAiBT,SAAS,SAAS,SAAqB,KAAgC;AAC5E,QAAM,SAAS,IAAI,uBAAuB;AAC1C,QAAM,eAAe,iBAAiB,GAAG;AACzC,QAAM,aAAa,eAAe,GAAG;AACrC,QAAM,WAAW,QAAQ,YAAY,CAAC;AAItC,QAAM,kBAA+E;AAAA;AAAA,IAEnF,cAAc,EAAE,MAAM,CAAC,UAAU,mBAAmB,eAAe,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAElF,aAAa,EAAE,MAAM,CAAC,UAAU,iBAAiB,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAEhE,WAAW,EAAE,MAAM,CAAC,UAAU,SAAS,OAAO,GAAG,SAAS,CAAC,GAAG,cAAc,GAAG,UAAU,EAAE;AAAA;AAAA,IAE3F,YAAY,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE5C,eAAe;AAAA,MACb,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,QACP;AAAA;AAAA,QAEA,OAAO,QAAQ,SAAS,IAAI;AAAA,QAC5B,IAAI,uBAAuB;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF;AAAA;AAAA,IAEA,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,WAAW;AAAA;AAAA,IAErD,cAAc,EAAE,MAAM,CAAC,UAAU,OAAO,GAAG,SAAS,CAAC,EAAE;AAAA,EACzD;AAEA,QAAM,YAAY,wBAAC,SAA+B;AAChD,UAAM,EAAE,MAAM,QAAQ,IAAI,gBAAgB,IAAI;AAC9C,UAAM,eAAe,SAAS,QAAQ,CAAC,YAAY,gBAAgB,OAAO,EAAE,IAAI,KAAK,CAAC,CAAC;AACvF,UAAM,UAAU,CAAC,GAAG,MAAM,GAAG,cAAc,GAAI,QAAQ,MAAM,IAAI,KAAK,CAAC,GAAI,GAAG,OAAO,EAAE;AAAA,MACrF,CAAC,WAAW,WAAW;AAAA,IACzB;AACA,WAAO,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,EAC7C,GAPkB;AASlB,SAAO;AAAA,IACL;AAAA,IACA,UAAU,YAAY;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,UAAU,SAAS;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,UAAU,aAAa;AAAA,IACvB,UAAU,WAAW;AAAA;AAAA,IAErB;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA,IACA,UAAU,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,IAAI,aAAa,gBAAgB,IAAI,cAAc,SAAS,8BAA8B;AAAA,EAC5F,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACd;AAvEgB;;;ACjET,SAAS,qBAAqB,SAAgC,KAAsC;AACzG,QAAM,SAAS,QAAQ,mBAAmB,WAAW,SAAS,KAAK;AAEnE,SAAO;AAAA,IACL;AAAA;AAAA,MAEE,QAAQ;AAAA,MACR,SAAS;AAAA;AAAA,QAEP;AAAA,UACE,KAAK;AAAA,UACL,OAAO,SAAS,SAAS,GAAG;AAAA,QAC9B;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,IAAI,cAAc,SAClB,CAAC,IACD;AAAA,UACE;AAAA,YACE,KAAK;AAAA,YACL,OAAO;AAAA,UACT;AAAA,QACF;AAAA;AAAA,QAEJ;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO,WAAW,MAAM;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;;;ACwBhB,SAAS,kBAAkB,KAAyC;AAClE,QAAM,eAAe,IAAI,gBAAgB,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;AAClG,QAAM,WAA4B,CAAC;AACnC,aAAW,OAAO,CAAC,GAAG,cAAc,GAAG,eAAe,GAAG,CAAC,GAAG;AAC3D,UAAM,EAAE,UAAU,UAAU,KAAK,IAAI,IAAI,IAAI,GAAG;AAChD,UAAM,UAAyB;AAAA,MAC7B,UAAU,SAAS,QAAQ,KAAK,EAAE;AAAA,MAClC;AAAA,MACA,MAAM,QAAQ;AAAA,IAChB;AACA,UAAM,OAAO,SAAS;AAAA,MACpB,CAAC,MAAM,EAAE,aAAa,QAAQ,YAAY,EAAE,aAAa,QAAQ,YAAY,EAAE,SAAS,QAAQ;AAAA,IAClG;AACA,QAAI,CAAC,KAAM,UAAS,KAAK,OAAO;AAAA,EAClC;AACA,SAAO;AACT;AAhBS;AAkBF,SAAS,iBAAiB,SAA2C;AAC1E,QAAM,MAAM,QAAQ;AACpB,QAAM,gBAAgB,QAAQ,kBAAkB;AAEhD,QAAM,SAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,IAAI,cAAc,SAAS,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,IAC3D,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB;AAAA,IACA,cAAc;AAAA,MACZ,eAAe;AAAA,QACb,eAAe;AAAA,MACjB;AAAA;AAAA;AAAA;AAAA,MAIA,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,gBAAgB,EAAE,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC9D;AAAA,IACA,mBAAmB,QAAQ;AAAA,IAC3B,gBAAgB,QAAQ,MAAM,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AAAA,IACjE,QAAQ;AAAA,MACN,iBAAiB,QAAQ,wBAAwB;AAAA,MACjD,gBAAgB,kBAAkB,GAAG;AAAA,MACrC,yBAAyB;AAAA,IAC3B;AAAA,IACA,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,KAAK;AAAA,MACH,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,8BAA8B,IAAI,gCAAgC;AAAA,MAClE,iCAAiC,IAAI,mCAAmC;AAAA,MACxE,GAAG,QAAQ;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,QAAQ,UAAU,EAAE,wBAAwB,CAAC,WAAW,cAAc,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,IAGjF,WAAW;AAAA,MACT,cAAc;AAAA,QACZ,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,oBAAoB,OAAO;AACrC,WAAO,UAAU,YAAY,qBAAqB,SAAS,QAAQ,GAAG;AAAA,EACxE;AAEA,MAAI,QAAQ,SAAU,QAAO,WAAW,QAAQ;AAEhD,SAAO,QAAQ,SAAS,QAAQ,OAAO,MAAM,IAAI;AACnD;AArEgB;","names":[]}
+{"version":3,"sources":["../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"sourcesContent":["// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n  \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n *   `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n  services?: CspService[];\n  csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n  stripe: {\n    \"script-src\": [\"https://js.stripe.com\"],\n    \"img-src\": [\"https://*.stripe.com\"],\n    \"connect-src\": [\"https://api.stripe.com\"],\n    \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n  },\n  googleMaps: {\n    \"script-src\": [\"https://maps.googleapis.com\"],\n    \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n    \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n  },\n  turnstile: {\n    \"script-src\": [\"https://challenges.cloudflare.com\"],\n    \"connect-src\": [\"https://challenges.cloudflare.com\"],\n    \"frame-src\": [\"https://challenges.cloudflare.com\"],\n  },\n  discord: {\n    \"img-src\": [\"https://cdn.discordapp.com\"],\n  },\n  googleFonts: {\n    \"style-src\": [\"https://fonts.googleapis.com\"],\n    \"font-src\": [\"https://fonts.gstatic.com\"],\n  },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n/**\n * Origins of the app's own servers, the API and the corpus, from\n * `NEXT_PUBLIC_API_URL` and `NEXT_PUBLIC_CORPUS_URL`. They serve every stored\n * object link, so images and frames must be allowed from them. Unset or invalid\n * URLs are skipped; the result has no duplicates.\n */\nexport function listAppOrigins(env: NodeJS.ProcessEnv): string[] {\n  const origins: string[] = [];\n  for (const url of [env.NEXT_PUBLIC_API_URL, env.NEXT_PUBLIC_CORPUS_URL]) {\n    if (!url) continue;\n    try {\n      const { origin } = new URL(url.trim());\n      if (origin !== \"null\" && !origins.includes(origin)) origins.push(origin);\n    } catch {\n      // Not a URL: nothing to allow.\n    }\n  }\n  return origins;\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n  const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n  const imageSources = listImageSources(env);\n  const appOrigins = listAppOrigins(env);\n  const services = options.services ?? [];\n\n  // Each fetch directive: what Next itself needs, then the named services, then\n  // the app's extras, then the sources derived from the env.\n  const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n    // Scripts: self, and unsafe-inline/eval for Next.js\n    \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n    // Styles: self and unsafe-inline for styled-components/emotion\n    \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n    // Images: self, data URIs, blobs, configured image sources, and the api/corpus origins\n    \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: [...imageSources, ...appOrigins] },\n    // Fonts: self\n    \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n    \"connect-src\": {\n      base: [\"'self'\"],\n      fromEnv: [\n        apiUrl,\n        // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n        apiUrl.replace(/^http/, \"ws\"),\n        env.NEXT_PUBLIC_ADDRESS || \"\",\n        ...imageSources,\n      ],\n    },\n    // Frames: self, and the api/corpus origins (inline previews of stored objects)\n    \"frame-src\": { base: [\"'self'\"], fromEnv: appOrigins },\n    // Worker sources: self and blob (for Web Workers with dynamic imports)\n    \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n  };\n\n  const directive = (name: CspDirective): string => {\n    const { base, fromEnv } = fetchDirectives[name];\n    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n    const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n      (source) => source !== \"\",\n    );\n    return [name, ...new Set(sources)].join(\" \");\n  };\n\n  return [\n    \"default-src 'self'\",\n    directive(\"script-src\"),\n    directive(\"style-src\"),\n    directive(\"img-src\"),\n    directive(\"font-src\"),\n    directive(\"connect-src\"),\n    directive(\"frame-src\"),\n    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n    \"frame-ancestors 'none'\",\n    // Form actions: only self\n    \"form-action 'self'\",\n    // Base URI: only self\n    \"base-uri 'self'\",\n    // Object sources: none (no plugins)\n    \"object-src 'none'\",\n    directive(\"worker-src\"),\n    // Upgrade insecure requests in production.\n    //\n    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n    // and serves it over plain http on a custom hostname. With this directive\n    // the browser rewrites every /_next/static asset to https, which nothing is\n    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n    // never hydrates, and each spec sees only server-rendered markup.\n    env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n  ]\n    .filter(Boolean)\n    .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n  source: string;\n  headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n  const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n  return [\n    {\n      // Apply to all routes\n      source: \"/:path*\",\n      headers: [\n        // Content Security Policy - prevents XSS attacks\n        {\n          key: \"Content-Security-Policy\",\n          value: buildCsp(options, env),\n        },\n        // X-Frame-Options - prevents clickjacking (backup for older browsers)\n        {\n          key: \"X-Frame-Options\",\n          value: \"DENY\",\n        },\n        // X-Content-Type-Options - prevents MIME sniffing\n        {\n          key: \"X-Content-Type-Options\",\n          value: \"nosniff\",\n        },\n        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n        // the suite speaks plain http, and an HSTS pin would force https on every\n        // later request to this host from the same browser profile.\n        ...(env.E2E_BUILD === \"true\"\n          ? []\n          : [\n              {\n                key: \"Strict-Transport-Security\",\n                value: \"max-age=31536000; includeSubDomains\",\n              },\n            ]),\n        // Referrer-Policy - controls referrer information\n        {\n          key: \"Referrer-Policy\",\n          value: \"strict-origin-when-cross-origin\",\n        },\n        // Permissions-Policy - restricts browser features\n        {\n          key: \"Permissions-Policy\",\n          value: `camera=(${camera}), microphone=(), geolocation=()`,\n        },\n      ],\n    },\n  ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, listAppOrigins, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp, listAppOrigins };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n  devOrigins: string[];\n  /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n  services?: CspService[];\n  /** Extra CSP sources per directive, for hosts no named service covers. */\n  csp?: Partial<Record<CspDirective, string[]>>;\n  env?: Record<string, string>;\n  imageMinimumCacheTTL?: number;\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n  mdx?: boolean;\n  securityHeaders?: boolean;\n  authInterrupts?: boolean;\n  reactCompiler?: boolean;\n  rewrites?: NextConfig[\"rewrites\"];\n  extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\n// IMAGE_SOURCES, then the api and corpus origins (they serve every stored object\n// link), without duplicates.\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n  const imageSources = env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((url) => url.trim()) : [];\n  const patterns: RemotePattern[] = [];\n  for (const url of [...imageSources, ...listAppOrigins(env)]) {\n    const { hostname, protocol, port } = new URL(url);\n    const pattern: RemotePattern = {\n      protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n      hostname,\n      port: port || undefined,\n    };\n    const seen = patterns.some(\n      (p) => p.protocol === pattern.protocol && p.hostname === pattern.hostname && p.port === pattern.port,\n    );\n    if (!seen) patterns.push(pattern);\n  }\n  return patterns;\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n  const env = process.env;\n  const reactCompiler = options.reactCompiler === true;\n\n  const config: NextConfig = {\n    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n    // `next dev` server may still be running against the same worktree. `next\n    // build` and `next dev` share `.next`, so a build performed underneath a live\n    // dev server clobbers it and that dev server then 404s every route. Giving\n    // the e2e build its own directory keeps the two independent. E2E_BUILD must\n    // be set for `next build` AND for `next start`, or `start` looks in `.next`\n    // and serves someone else's output.\n    ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n    cacheComponents: true,\n    partialPrefetching: true,\n    reactCompiler,\n    experimental: {\n      serverActions: {\n        bodySizeLimit: \"5mb\",\n      },\n      // Required by `unauthorized()` (next/navigation): without this flag it throws a plain\n      // Error instead of rendering the nearest unauthorized.tsx. The flag is for app code that\n      // calls it; ServerSession.checkPermission does not, it still does `redirect(\"/401\")`.\n      authInterrupts: options.authInterrupts ?? true,\n      turbopackGc: true,\n      // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n      // imported request module unactivated (\"Lazily compiled dynamic import of ...\n      // JsonApiRequest ... was not activated\"), so every client-side read returns\n      // nothing. Seen with the package installed from npm; production builds are unaffected.\n      ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n    },\n    allowedDevOrigins: options.devOrigins,\n    pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n    images: {\n      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n      remotePatterns: parseImageSources(env),\n      dangerouslyAllowLocalIP: true,\n    },\n    poweredByHeader: false,\n    reactStrictMode: false,\n    env: {\n      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n      ...options.env,\n    },\n    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n    // single instance in both modes.\n    turbopack: {\n      resolveAlias: {\n        yjs: \"./node_modules/yjs\",\n      },\n    },\n  };\n\n  if (options.securityHeaders !== false) {\n    config.headers = async () => buildSecurityHeaders(options, process.env);\n  }\n\n  if (options.rewrites) config.rewrites = options.rewrites;\n\n  return options.extend ? options.extend(config) : config;\n}\n"],"mappings":";;;;;AAwBA,IAAM,kBAA+E;AAAA,EACnF,QAAQ;AAAA,IACN,cAAc,CAAC,uBAAuB;AAAA,IACtC,WAAW,CAAC,sBAAsB;AAAA,IAClC,eAAe,CAAC,wBAAwB;AAAA,IACxC,aAAa,CAAC,yBAAyB,0BAA0B;AAAA,EACnE;AAAA,EACA,YAAY;AAAA,IACV,cAAc,CAAC,6BAA6B;AAAA,IAC5C,WAAW,CAAC,+BAA+B,0BAA0B;AAAA,IACrE,eAAe,CAAC,+BAA+B,+BAA+B;AAAA,EAChF;AAAA,EACA,WAAW;AAAA,IACT,cAAc,CAAC,mCAAmC;AAAA,IAClD,eAAe,CAAC,mCAAmC;AAAA,IACnD,aAAa,CAAC,mCAAmC;AAAA,EACnD;AAAA,EACA,SAAS;AAAA,IACP,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA,aAAa;AAAA,IACX,aAAa,CAAC,8BAA8B;AAAA,IAC5C,YAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF;AAEA,SAAS,iBAAiB,KAAkC;AAC1D,SAAO,IAAI,gBAAgB,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAClF;AAFS;AAUF,SAAS,eAAe,KAAkC;AAC/D,QAAM,UAAoB,CAAC;AAC3B,aAAW,OAAO,CAAC,IAAI,qBAAqB,IAAI,sBAAsB,GAAG;AACvE,QAAI,CAAC,IAAK;AACV,QAAI;AACF,YAAM,EAAE,OAAO,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACrC,UAAI,WAAW,UAAU,CAAC,QAAQ,SAAS,MAAM,EAAG,SAAQ,KAAK,MAAM;AAAA,IACzE,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAZgB;AAiBT,SAAS,SAAS,SAAqB,KAAgC;AAC5E,QAAM,SAAS,IAAI,uBAAuB;AAC1C,QAAM,eAAe,iBAAiB,GAAG;AACzC,QAAM,aAAa,eAAe,GAAG;AACrC,QAAM,WAAW,QAAQ,YAAY,CAAC;AAItC,QAAM,kBAA+E;AAAA;AAAA,IAEnF,cAAc,EAAE,MAAM,CAAC,UAAU,mBAAmB,eAAe,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAElF,aAAa,EAAE,MAAM,CAAC,UAAU,iBAAiB,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAEhE,WAAW,EAAE,MAAM,CAAC,UAAU,SAAS,OAAO,GAAG,SAAS,CAAC,GAAG,cAAc,GAAG,UAAU,EAAE;AAAA;AAAA,IAE3F,YAAY,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE;AAAA;AAAA,IAE5C,eAAe;AAAA,MACb,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,QACP;AAAA;AAAA,QAEA,OAAO,QAAQ,SAAS,IAAI;AAAA,QAC5B,IAAI,uBAAuB;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF;AAAA;AAAA,IAEA,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,WAAW;AAAA;AAAA,IAErD,cAAc,EAAE,MAAM,CAAC,UAAU,OAAO,GAAG,SAAS,CAAC,EAAE;AAAA,EACzD;AAEA,QAAM,YAAY,wBAAC,SAA+B;AAChD,UAAM,EAAE,MAAM,QAAQ,IAAI,gBAAgB,IAAI;AAC9C,UAAM,eAAe,SAAS,QAAQ,CAAC,YAAY,gBAAgB,OAAO,EAAE,IAAI,KAAK,CAAC,CAAC;AACvF,UAAM,UAAU,CAAC,GAAG,MAAM,GAAG,cAAc,GAAI,QAAQ,MAAM,IAAI,KAAK,CAAC,GAAI,GAAG,OAAO,EAAE;AAAA,MACrF,CAAC,WAAW,WAAW;AAAA,IACzB;AACA,WAAO,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,EAC7C,GAPkB;AASlB,SAAO;AAAA,IACL;AAAA,IACA,UAAU,YAAY;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,UAAU,SAAS;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,UAAU,aAAa;AAAA,IACvB,UAAU,WAAW;AAAA;AAAA,IAErB;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA,IACA,UAAU,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,IAAI,aAAa,gBAAgB,IAAI,cAAc,SAAS,8BAA8B;AAAA,EAC5F,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACd;AAvEgB;;;ACjET,SAAS,qBAAqB,SAAgC,KAAsC;AACzG,QAAM,SAAS,QAAQ,mBAAmB,WAAW,SAAS,KAAK;AAEnE,SAAO;AAAA,IACL;AAAA;AAAA,MAEE,QAAQ;AAAA,MACR,SAAS;AAAA;AAAA,QAEP;AAAA,UACE,KAAK;AAAA,UACL,OAAO,SAAS,SAAS,GAAG;AAAA,QAC9B;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,IAAI,cAAc,SAClB,CAAC,IACD;AAAA,UACE;AAAA,YACE,KAAK;AAAA,YACL,OAAO;AAAA,UACT;AAAA,QACF;AAAA;AAAA,QAEJ;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,QACT;AAAA;AAAA,QAEA;AAAA,UACE,KAAK;AAAA,UACL,OAAO,WAAW,MAAM;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;;;ACuBhB,SAAS,kBAAkB,KAAyC;AAClE,QAAM,eAAe,IAAI,gBAAgB,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;AAClG,QAAM,WAA4B,CAAC;AACnC,aAAW,OAAO,CAAC,GAAG,cAAc,GAAG,eAAe,GAAG,CAAC,GAAG;AAC3D,UAAM,EAAE,UAAU,UAAU,KAAK,IAAI,IAAI,IAAI,GAAG;AAChD,UAAM,UAAyB;AAAA,MAC7B,UAAU,SAAS,QAAQ,KAAK,EAAE;AAAA,MAClC;AAAA,MACA,MAAM,QAAQ;AAAA,IAChB;AACA,UAAM,OAAO,SAAS;AAAA,MACpB,CAAC,MAAM,EAAE,aAAa,QAAQ,YAAY,EAAE,aAAa,QAAQ,YAAY,EAAE,SAAS,QAAQ;AAAA,IAClG;AACA,QAAI,CAAC,KAAM,UAAS,KAAK,OAAO;AAAA,EAClC;AACA,SAAO;AACT;AAhBS;AAkBF,SAAS,iBAAiB,SAA2C;AAC1E,QAAM,MAAM,QAAQ;AACpB,QAAM,gBAAgB,QAAQ,kBAAkB;AAEhD,QAAM,SAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,IAAI,cAAc,SAAS,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,IAC3D,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB;AAAA,IACA,cAAc;AAAA,MACZ,eAAe;AAAA,QACb,eAAe;AAAA,MACjB;AAAA;AAAA;AAAA;AAAA,MAIA,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,gBAAgB,EAAE,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC9D;AAAA,IACA,mBAAmB,QAAQ;AAAA,IAC3B,gBAAgB,QAAQ,MAAM,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AAAA,IACjE,QAAQ;AAAA,MACN,iBAAiB,QAAQ,wBAAwB;AAAA,MACjD,gBAAgB,kBAAkB,GAAG;AAAA,MACrC,yBAAyB;AAAA,IAC3B;AAAA,IACA,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,KAAK;AAAA,MACH,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,8BAA8B,IAAI,gCAAgC;AAAA,MAClE,iCAAiC,IAAI,mCAAmC;AAAA,MACxE,GAAG,QAAQ;AAAA,IACb;AAAA;AAAA;AAAA,IAGA,WAAW;AAAA,MACT,cAAc;AAAA,QACZ,KAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,oBAAoB,OAAO;AACrC,WAAO,UAAU,YAAY,qBAAqB,SAAS,QAAQ,GAAG;AAAA,EACxE;AAEA,MAAI,QAAQ,SAAU,QAAO,WAAW,QAAQ;AAEhD,SAAO,QAAQ,SAAS,QAAQ,OAAO,MAAM,IAAI;AACnD;AA/DgB;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carlonicora/nextjs-jsonapi",
-  "version": "4.2.3",
+  "version": "5.0.0",
   "description": "Next.js JSON:API client with server/client support and caching",
   "author": "Carlo Nicora",
   "license": "GPL-3.0-or-later",
@@ -88,7 +88,8 @@
       "types": "./dist/next-config/index.d.ts",
       "import": "./dist/next-config/index.mjs",
       "require": "./dist/next-config/index.js"
-    }
+    },
+    "./pwa/*": "./pwa/*"
   },
   "scripts": {
     "build": "rm -rf dist && NODE_OPTIONS='--max-old-space-size=8192' tsup && tsc -p scripts/generate-web-module/tsconfig.json",
@@ -108,6 +109,7 @@
     "dist",
     "src",
     "scripts",
+    "pwa",
     "README.md"
   ],
   "peerDependencies": {

package/pwa/offline.template.html

@@ -0,0 +1,138 @@
+<!doctype html>
+<!--
+  Offline fallback served by the service worker (sw.js) when a page navigation
+  fails. It is deliberately self-contained: inline styles, inline icons, no
+  build assets, no external script, stylesheet or font, because the build's
+  chunks are not available offline and change on every deploy.
+
+  This is a template. Each app copies it to public/offline.html and fills the
+  placeholders by hand: the app name, the theme blocks (one root block of the
+  six tokens, then one class block per non-light theme), the default-locale
+  strings, and the config object read by the script below.
+-->
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>{{APP_NAME}}</title>
+    <style>
+      /*{{THEME_CSS}}*/
+      * {
+        box-sizing: border-box;
+        margin: 0;
+      }
+      body {
+        min-height: 100dvh;
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        justify-content: center;
+        padding: 1rem;
+        background: var(--background);
+        color: var(--foreground);
+        font-family: ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
+        -webkit-font-smoothing: antialiased;
+        text-align: center;
+      }
+      .icon-circle {
+        width: 4rem;
+        height: 4rem;
+        margin: 0 auto 1.5rem;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        border-radius: 9999px;
+        background: var(--muted);
+        color: var(--muted-foreground);
+      }
+      h1 {
+        margin-bottom: 0.5rem;
+        font-size: 1.5rem;
+        line-height: 2rem;
+        font-weight: 700;
+      }
+      p {
+        max-width: 28rem;
+        margin-bottom: 1.5rem;
+        color: var(--muted-foreground);
+        line-height: 1.5rem;
+      }
+      button {
+        display: inline-flex;
+        align-items: center;
+        gap: 0.5rem;
+        height: 1.75rem;
+        padding: 0 0.5rem;
+        border: 1px solid transparent;
+        border-radius: 0.375rem;
+        background: var(--primary);
+        color: var(--primary-foreground);
+        font: inherit;
+        font-size: 0.75rem;
+        font-weight: 500;
+        cursor: pointer;
+      }
+      button:hover {
+        background: color-mix(in oklch, var(--primary) 80%, transparent);
+      }
+    </style>
+  </head>
+  <body>
+    <div>
+      <div class="icon-circle">
+        <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+          <path d="M12 20h.01" />
+          <path d="M8.5 16.429a5 5 0 0 1 7 0" />
+          <path d="M5 12.859a10 10 0 0 1 5.17-2.69" />
+          <path d="M19 12.859a10 10 0 0 0-2.007-1.523" />
+          <path d="M2 8.82a15 15 0 0 1 4.177-2.643" />
+          <path d="M22 8.82a15 15 0 0 0-11.288-3.764" />
+          <path d="m2 2 20 20" />
+        </svg>
+      </div>
+      <h1 id="title">{{TITLE}}</h1>
+      <p id="description">{{DESCRIPTION}}</p>
+      <button type="button" onclick="window.location.reload()">
+        <svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+          <path d="M3 12a9 9 0 0 1 9-9 9.75 9.75 0 0 1 6.74 2.74L21 8" />
+          <path d="M21 3v5h-5" />
+          <path d="M21 12a9 9 0 0 1-9 9 9.75 9.75 0 0 1-6.74-2.74L3 16" />
+          <path d="M8 16H3v5" />
+        </svg>
+        <span id="retry">{{RETRY}}</span>
+      </button>
+    </div>
+    <script>
+      (function () {
+        var config = {{OFFLINE_CONFIG}};
+        var html = document.documentElement;
+        var theme = null;
+        try { theme = localStorage.getItem("theme"); } catch (e) { theme = null; }
+        theme = theme || config.defaultTheme;
+        if (theme === "system") {
+          theme = config.enableSystem
+            ? (matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light")
+            : config.defaultTheme;
+        }
+        if (theme !== "light" && config.themes.indexOf(theme) !== -1) html.classList.add(theme);
+        var fromPath = location.pathname.split("/")[1];
+        var cookieMatch = document.cookie.match(/(?:^|; )NEXT_LOCALE=([^;]*)/);
+        var fromCookie = cookieMatch ? decodeURIComponent(cookieMatch[1]) : null;
+        var fromBrowser = (navigator.languages || []).map(function (l) { return l.toLowerCase().split("-")[0]; });
+        var candidates = [fromPath, fromCookie].concat(fromBrowser);
+        var locale = config.defaultLocale;
+        for (var i = 0; i < candidates.length; i++) {
+          if (candidates[i] && config.locales.indexOf(candidates[i]) !== -1) { locale = candidates[i]; break; }
+        }
+        html.lang = locale;
+        html.dir = config.rtl.indexOf(locale) !== -1 ? "rtl" : "ltr";
+        var strings = config.strings[locale];
+        if (strings) {
+          document.getElementById("title").textContent = strings.title;
+          document.getElementById("description").textContent = strings.description;
+          document.getElementById("retry").textContent = strings.retry;
+        }
+      })();
+    </script>
+  </body>
+</html>

package/pwa/sw.js

@@ -0,0 +1,175 @@
+// Standard service worker for every nja app.
+//
+// This file is copied verbatim into every app's public/sw.js. Each app's guard
+// spec compares the bytes of public/sw.js against this file, so never edit an
+// app's copy: change this file, release the library, and copy it again.
+//
+// Per-app values (appId, offlineRevision, notificationIcon) come from the app's
+// own public/sw-config.js, which sets self.NJA_SW_CONFIG.
+
+importScripts("/sw-config.js");
+
+const OFFLINE_URL = "/offline.html";
+const CACHE_NAME = `${self.NJA_SW_CONFIG.appId}-offline-${self.NJA_SW_CONFIG.offlineRevision}`;
+
+// Served when a navigation fails and the cached offline page is missing too
+// (evicted or cleared). Never answer a navigation with a bare network error.
+const OFFLINE_FALLBACK_HTML = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>You are offline</title>
+    <style>
+      body {
+        margin: 0;
+        min-height: 100vh;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+        background: #ffffff;
+        color: #111111;
+        text-align: center;
+        padding: 16px;
+      }
+      @media (prefers-color-scheme: dark) {
+        body {
+          background: #111111;
+          color: #f5f5f5;
+        }
+      }
+      button {
+        margin-top: 16px;
+        padding: 8px 16px;
+        font: inherit;
+        cursor: pointer;
+      }
+    </style>
+  </head>
+  <body>
+    <main>
+      <h1>You are offline</h1>
+      <p>Check your connection and try again.</p>
+      <button type="button" onclick="location.reload()">Retry</button>
+    </main>
+  </body>
+</html>`;
+
+self.addEventListener("install", function (event) {
+  event.waitUntil(
+    caches.open(CACHE_NAME).then(function (cache) {
+      // cache.add rejects on a network error or a non-2xx response, so the
+      // install fails and the previous worker stays in charge.
+      return cache.add(new Request(OFFLINE_URL, { cache: "reload" }));
+    }),
+  );
+});
+
+self.addEventListener("activate", function (event) {
+  event.waitUntil(
+    (async function () {
+      const keys = await caches.keys();
+      await Promise.all(
+        keys
+          .filter(function (key) {
+            return key !== CACHE_NAME;
+          })
+          .map(function (key) {
+            return caches.delete(key);
+          }),
+      );
+      if (self.registration.navigationPreload) {
+        await self.registration.navigationPreload.enable();
+      }
+      await self.clients.claim();
+    })(),
+  );
+});
+
+self.addEventListener("fetch", function (event) {
+  // Only navigations are intercepted. Everything else goes straight to the
+  // network without respondWith.
+  if (event.request.mode !== "navigate") return;
+
+  event.respondWith(
+    (async function () {
+      try {
+        const preload = await event.preloadResponse;
+        if (preload) return preload;
+        // A 4xx/5xx or an opaque redirect is passed through as is.
+        return await fetch(event.request);
+      } catch (error) {
+        const cache = await caches.open(CACHE_NAME);
+        const cached = await cache.match(OFFLINE_URL);
+        if (cached) return cached;
+        return new Response(OFFLINE_FALLBACK_HTML, {
+          status: 200,
+          headers: { "content-type": "text/html; charset=utf-8" },
+        });
+      }
+    })(),
+  );
+});
+
+self.addEventListener("message", function (event) {
+  if (event.data && event.data.type === "SKIP_WAITING") self.skipWaiting();
+});
+
+self.addEventListener("push", function (event) {
+  const data = event.data ? event.data.json() : {};
+  const title = data.title || "Notification";
+  const options = {
+    body: data.message || "You have a new notification",
+    icon: self.NJA_SW_CONFIG.notificationIcon,
+    data: data.url,
+  };
+
+  event.waitUntil(self.registration.showNotification(title, options));
+});
+
+self.addEventListener("notificationclick", function (event) {
+  event.notification.close();
+  event.waitUntil(
+    (async function () {
+      const clientList = await self.clients.matchAll({ type: "window", includeUncontrolled: true });
+      for (const windowClient of clientList) {
+        if (windowClient.url === event.notification.data && "focus" in windowClient) {
+          return windowClient.focus();
+        }
+      }
+      if (self.clients.openWindow && event.notification.data) {
+        return self.clients.openWindow(event.notification.data);
+      }
+    })(),
+  );
+});
+
+// FCM rotates/expires subscriptions periodically. When it does, re-subscribe
+// with the old application server key and hand the new subscription to ONE open
+// client (a visible one if there is one), which re-registers it against the API
+// with the user's auth. If no client is open, the next page load's
+// usePushNotifications re-registers.
+self.addEventListener("pushsubscriptionchange", function (event) {
+  event.waitUntil(
+    (async function () {
+      const applicationServerKey = event.oldSubscription && event.oldSubscription.options.applicationServerKey;
+      if (!applicationServerKey) return;
+
+      const subscription = await self.registration.pushManager.subscribe({
+        userVisibleOnly: true,
+        applicationServerKey,
+      });
+
+      const plainSubscription = { endpoint: subscription.endpoint, keys: subscription.toJSON().keys };
+      const clientList = await self.clients.matchAll({ type: "window", includeUncontrolled: true });
+      const target =
+        clientList.find(function (windowClient) {
+          return windowClient.visibilityState === "visible";
+        }) || clientList[0];
+      if (target) {
+        target.postMessage({ type: "PUSH_RESUBSCRIBED", subscription: plainSubscription });
+      }
+    })(),
+  );
+});

package/src/features/notification/components/notifications/PushNotificationProvider.tsx

@@ -1,9 +1,13 @@
 "use client";
 
 import { ReactNode, type JSX } from "react";
+import { useCurrentUserContext } from "../../../../contexts";
 import usePushNotifications from "../../../../hooks/usePushNotifications";
+import { getRoleId } from "../../../../roles";
+import { UserInterface } from "../../../user/data";
 
 export function PushNotificationProvider({ children }: { children: ReactNode }): JSX.Element {
-  usePushNotifications();
+  const { currentUser, hasRole } = useCurrentUserContext<UserInterface>();
+  usePushNotifications({ currentUser: currentUser ?? undefined, canSubscribe: !hasRole(getRoleId().Administrator) });
   return <>{children}</>;
 }

package/src/features/notification/components/notifications/__tests__/PushNotificationProvider.spec.tsx

@@ -0,0 +1,51 @@
+import { render, screen } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { PushNotificationProvider } from "../PushNotificationProvider";
+
+// Hoisted so the vi.mock factories below can read it (Vitest hoists factories
+// above module-scope consts).
+const mocks = vi.hoisted(() => ({
+  hook: vi.fn(),
+  context: {
+    currentUser: { id: "u1" } as { id: string } | undefined,
+    hasRole: (() => false) as (roleId: string) => boolean,
+  },
+}));
+
+vi.mock("../../../../../hooks/usePushNotifications", () => ({ default: mocks.hook }));
+
+vi.mock("../../../../../contexts", () => ({
+  useCurrentUserContext: () => mocks.context,
+}));
+
+vi.mock("../../../../../roles", () => ({
+  getRoleId: () => ({ Administrator: "administrator" }),
+}));
+
+describe("PushNotificationProvider", () => {
+  beforeEach(() => {
+    mocks.hook.mockReset();
+    mocks.context.currentUser = { id: "u1" };
+    mocks.context.hasRole = () => false;
+  });
+
+  it("passes the current user and canSubscribe=true for a non-administrator", () => {
+    render(<PushNotificationProvider>child</PushNotificationProvider>);
+    expect(mocks.hook).toHaveBeenCalledWith({ currentUser: { id: "u1" }, canSubscribe: true });
+  });
+
+  it("passes canSubscribe=false for an administrator", () => {
+    mocks.context.hasRole = (roleId: string) => roleId === "administrator";
+    render(<PushNotificationProvider>child</PushNotificationProvider>);
+    expect(mocks.hook).toHaveBeenCalledWith({ currentUser: { id: "u1" }, canSubscribe: false });
+  });
+
+  it("renders its children", () => {
+    render(
+      <PushNotificationProvider>
+        <span>inside the provider</span>
+      </PushNotificationProvider>,
+    );
+    expect(screen.getByText("inside the provider")).toBeInTheDocument();
+  });
+});

package/src/hooks/__tests__/usePushNotifications.spec.tsx

@@ -1,53 +1,56 @@
-import { render, waitFor } from "@testing-library/react";
+import { act, render, waitFor } from "@testing-library/react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { UserInterface } from "../../features/user/data";
 import usePushNotifications from "../usePushNotifications";
 
 // Hoisted so the vi.mock factories below can read it (Vitest hoists factories
 // above module-scope consts).
-const state = vi.hoisted(() => ({ isProduction: false }));
+const mocks = vi.hoisted(() => ({ register: vi.fn() }));
 
 vi.mock("../../core/env", () => ({
   ENV: {
-    get IS_PRODUCTION() {
-      return state.isProduction;
-    },
     VAPID_PUBLIC_KEY: "",
   },
 }));
 
-vi.mock("../../contexts", () => ({
-  useCurrentUserContext: () => ({
-    currentUser: { id: "user-1" },
-    hasRole: () => false,
-  }),
-}));
-
 vi.mock("../../features/push/data/push.service", () => ({
-  PushService: { register: vi.fn() },
-}));
-
-vi.mock("../../roles", () => ({
-  getRoleId: () => ({ Administrator: "administrator" }),
+  PushService: { register: mocks.register },
 }));
 
-vi.mock("../../client/config", () => ({
-  getAppUrl: () => "http://app.test",
-}));
+// The hook reads only `id` from the user; the fixture is typed as the real
+// input so a signature change fails here first.
+const user = { id: "user-1" } as UserInterface;
 
-function Probe() {
-  usePushNotifications();
+function Probe(props: Parameters<typeof usePushNotifications>[0]) {
+  usePushNotifications(props);
   return null;
 }
 
-describe("usePushNotifications worker URL", () => {
+const subscription = { endpoint: "e1", keys: { p256dh: "a", auth: "b" } };
+
+describe("usePushNotifications", () => {
   const register = vi.fn().mockResolvedValue({ pushManager: { getSubscription: vi.fn() } });
+  const addEventListener = vi.fn();
+  const removeEventListener = vi.fn();
+
+  function messageListener(): (event: MessageEvent) => void {
+    const call = addEventListener.mock.calls.find(([type]) => type === "message");
+    if (!call) throw new Error("no message listener registered");
+    return call[1];
+  }
 
   beforeEach(() => {
     register.mockClear();
-    vi.stubGlobal("navigator", { serviceWorker: { register, ready: Promise.resolve() } });
+    addEventListener.mockClear();
+    removeEventListener.mockClear();
+    mocks.register.mockReset();
+    mocks.register.mockResolvedValue(undefined);
+    vi.stubGlobal("navigator", {
+      serviceWorker: { register, ready: Promise.resolve(), addEventListener, removeEventListener },
+    });
     vi.stubGlobal("PushManager", function PushManager() {});
-    // "denied" makes the hook return right after registering, so this spec
-    // proves only the URL choice and nothing about subscription handling.
+    // "denied" makes the registration effect return right after registering, so
+    // these specs prove the URL choice and the rotation flow, not subscription handling.
     vi.stubGlobal("Notification", { permission: "denied", requestPermission: vi.fn() });
     sessionStorage.clear();
   });
@@ -56,15 +59,65 @@ describe("usePushNotifications worker URL", () => {
     vi.unstubAllGlobals();
   });
 
-  it("registers the push-only dev worker outside production", async () => {
-    state.isProduction = false;
-    render(<Probe />);
-    await waitFor(() => expect(register).toHaveBeenCalledWith("http://app.test/sw-dev.js"));
+  it("registers /sw.js with updateViaCache none for a user who can subscribe", async () => {
+    render(<Probe currentUser={user} canSubscribe={true} />);
+    await waitFor(() => expect(register).toHaveBeenCalledWith("/sw.js", { updateViaCache: "none" }));
+  });
+
+  it("does not register without a user", async () => {
+    render(<Probe canSubscribe={true} />);
+    await act(async () => {});
+    expect(register).not.toHaveBeenCalled();
+    expect(addEventListener).not.toHaveBeenCalled();
+  });
+
+  it("does not register when the user cannot subscribe", async () => {
+    render(<Probe currentUser={user} canSubscribe={false} />);
+    await act(async () => {});
+    expect(register).not.toHaveBeenCalled();
+  });
+
+  it("re-registers a rotated subscription once per tab", async () => {
+    render(<Probe currentUser={user} canSubscribe={true} />);
+    const onMessage = messageListener();
+    const event = { data: { type: "PUSH_RESUBSCRIBED", subscription } } as MessageEvent;
+
+    act(() => onMessage(event));
+    await waitFor(() =>
+      expect(sessionStorage.getItem("push_registered_user-1")).toBe(btoa(JSON.stringify(subscription))),
+    );
+
+    act(() => onMessage(event));
+    await act(async () => {});
+
+    expect(mocks.register).toHaveBeenCalledTimes(1);
+    expect(mocks.register).toHaveBeenCalledWith({ data: subscription });
+  });
+
+  it("ignores other message types and a PUSH_RESUBSCRIBED without a subscription", async () => {
+    render(<Probe currentUser={user} canSubscribe={true} />);
+    const onMessage = messageListener();
+
+    act(() => onMessage({ data: { type: "SOMETHING_ELSE", subscription } } as MessageEvent));
+    act(() => onMessage({ data: { type: "PUSH_RESUBSCRIBED" } } as MessageEvent));
+    act(() => onMessage({ data: undefined } as MessageEvent));
+    await act(async () => {});
+
+    expect(mocks.register).not.toHaveBeenCalled();
+    expect(sessionStorage.getItem("push_registered_user-1")).toBeNull();
+  });
+
+  it("does not re-register a rotation when the user cannot subscribe", async () => {
+    render(<Probe currentUser={user} canSubscribe={false} />);
+    await act(async () => {});
+    expect(addEventListener).not.toHaveBeenCalledWith("message", expect.any(Function));
+    expect(mocks.register).not.toHaveBeenCalled();
   });
 
-  it("registers the full worker in production", async () => {
-    state.isProduction = true;
-    render(<Probe />);
-    await waitFor(() => expect(register).toHaveBeenCalledWith("http://app.test/sw.js"));
+  it("removes the message listener on unmount", () => {
+    const { unmount } = render(<Probe currentUser={user} canSubscribe={true} />);
+    const onMessage = messageListener();
+    unmount();
+    expect(removeEventListener).toHaveBeenCalledWith("message", onMessage);
   });
 });