@carlonicora/nextjs-jsonapi 4.2.3 → 5.0.1

package/dist/features/tokenusage/index.js

@@ -37,7 +37,7 @@ var _chunkKJMMBUOAjs = require('../../chunk-KJMMBUOA.js');
 
 
 
-var _chunk4EGA5UP5js = require('../../chunk-4EGA5UP5.js');
+var _chunkZPXXZRS2js = require('../../chunk-ZPXXZRS2.js');
 require('../../chunk-GPXYQMOZ.js');
 require('../../chunk-G4JR3SFV.js');
 
@@ -82,7 +82,7 @@ function TokenUsageAdminFilterBar({ granularity, companyId, metric, companies, o
   };
   return /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: "flex flex-wrap items-center gap-2", children: [
     /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "max-md:w-full max-md:[&_#date]:w-full", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-      _chunk4EGA5UP5js.DateRangeSelector,
+      _chunkZPXXZRS2js.DateRangeSelector,
       {
         onDateChange: (range) => {
           if (!_optionalChain([range, 'optionalAccess', _ => _.from]) || !_optionalChain([range, 'optionalAccess', _2 => _2.to])) return;
@@ -117,16 +117,16 @@ function TokenUsageAdminFilterBar({ granularity, companyId, metric, companies, o
       }
     ),
     /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, 
-      _chunk4EGA5UP5js.Select,
+      _chunkZPXXZRS2js.Select,
       {
         items: companyItems,
         value: _nullishCoalesce(companyId, () => ( ALL_COMPANIES)),
         onValueChange: (value) => onChange({ companyId: !value || value === ALL_COMPANIES ? void 0 : value }),
         children: [
-          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.SelectTrigger, { className: "w-56", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.SelectValue, { placeholder: t("token_usage.admin.all_companies") }) }),
-          /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.SelectContent, { children: [
-            /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.SelectItem, { value: ALL_COMPANIES, children: t("token_usage.admin.all_companies") }),
-            companies.map((company) => /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.SelectItem, { value: company.id, children: company.label }, company.id))
+          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.SelectTrigger, { className: "w-56", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.SelectValue, { placeholder: t("token_usage.admin.all_companies") }) }),
+          /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.SelectContent, { children: [
+            /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.SelectItem, { value: ALL_COMPANIES, children: t("token_usage.admin.all_companies") }),
+            companies.map((company) => /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.SelectItem, { value: company.id, children: company.label }, company.id))
           ] })
         ]
       }
@@ -149,7 +149,7 @@ function Segmented({
       children: options.map((option) => {
         const selected = option.value === value;
         return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-          _chunk4EGA5UP5js.Button,
+          _chunkZPXXZRS2js.Button,
           {
             type: "button",
             size: "sm",
@@ -231,7 +231,7 @@ var TokenUsageAdminProvider = /* @__PURE__ */ _chunk7QVYU63Ejs.__name.call(void
   pageUrl = TOKEN_USAGE_ADMIN_PAGE_URL
 }) => {
   const t = _nextintl.useTranslations.call(void 0, );
-  const generateUrl = _chunk4EGA5UP5js.usePageUrlGenerator.call(void 0, );
+  const generateUrl = _chunkZPXXZRS2js.usePageUrlGenerator.call(void 0, );
   const [filters, setFilterState] = _react.useState.call(void 0, () => {
     const range = defaultRange();
     return {
@@ -349,7 +349,7 @@ var TokenUsageAdminProvider = /* @__PURE__ */ _chunk7QVYU63Ejs.__name.call(void
       error
     ]
   );
-  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.SharedProvider, { value: { breadcrumbs: breadcrumb(), title: title() }, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageAdminContext.Provider, { value: contextValue, children }) });
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.SharedProvider, { value: { breadcrumbs: breadcrumb(), title: title() }, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageAdminContext.Provider, { value: contextValue, children }) });
 }, "TokenUsageAdminProvider");
 var useTokenUsageAdmin = /* @__PURE__ */ _chunk7QVYU63Ejs.__name.call(void 0, () => {
   const ctx = _react.useContext.call(void 0, TokenUsageAdminContext);
@@ -446,7 +446,7 @@ function LeadTile({
   previousLabel,
   decimal
 }) {
-  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.Card, { "data-testid": testId, children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.CardContent, { className: "grid gap-1", children: [
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.Card, { "data-testid": testId, children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.CardContent, { className: "grid gap-1", children: [
     /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "text-muted-foreground text-xs", children: label }),
     /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "text-primary text-xl font-semibold tabular-nums", children: value }),
     /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "span", { className: "flex items-center gap-1", children: [
@@ -463,7 +463,7 @@ function SupportingTile({
   delta,
   decimal
 }) {
-  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.Card, { "data-testid": testId, size: "sm", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.CardContent, { className: "grid gap-1", children: [
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.Card, { "data-testid": testId, size: "sm", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.CardContent, { className: "grid gap-1", children: [
     /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "text-muted-foreground text-xs", children: label }),
     /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "span", { className: "flex items-center gap-2", children: [
       /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "text-sm font-medium tabular-nums", children: value }),
@@ -560,8 +560,8 @@ function TokenUsageBreakdownTable({ rows, metric }) {
     // The package's <Table> wraps itself in an `overflow-x-clip` container, which
     // would swallow the overflow before this scroller ever saw it — hence the
     // child override. Wide metric tables must scroll, never widen the page.
-    /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "overflow-x-auto [&_[data-slot=table-container]]:overflow-x-visible", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.Table, { children: [
-      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableRow, { children: columns.map((column) => /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableHead, { className: _chunk4ORLPEK7js.cn.call(void 0, column.numeric && "text-end"), children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, 
+    /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "overflow-x-auto [&_[data-slot=table-container]]:overflow-x-visible", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.Table, { children: [
+      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableRow, { children: columns.map((column) => /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableHead, { className: _chunk4ORLPEK7js.cn.call(void 0, column.numeric && "text-end"), children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, 
         "button",
         {
           type: "button",
@@ -576,20 +576,20 @@ function TokenUsageBreakdownTable({ rows, metric }) {
           ]
         }
       ) }, column.key)) }) }),
-      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableBody, { children: sortedRows.map((row) => {
+      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableBody, { children: sortedRows.map((row) => {
         const value = _chunkKJMMBUOAjs.metricValue.call(void 0, row, metric);
         const share = total > 0 ? value / total * 100 : 0;
-        return /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.TableRow, { "data-testid": `breakdown-row-${row.id}`, children: [
-          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableCell, { className: "text-xs", children: row.id === "other" ? t("token_usage.admin.other") : row.label }),
-          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableCell, { className: "text-muted-foreground text-xs", children: _nullishCoalesce(row.sublabel, () => ( "")) }),
-          showActiveUsers && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableCell, { className: "text-end text-xs tabular-nums", children: row.activeUsers === void 0 ? "" : decimal(row.activeUsers, 0) }),
-          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableCell, { className: "text-end text-xs tabular-nums", children: decimal(row.calls, 0) }),
-          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableCell, { className: "text-end text-xs tabular-nums", children: decimal(row.tokensIn, 0) }),
-          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableCell, { className: "text-end text-xs tabular-nums", children: decimal(row.tokensOut, 0) }),
-          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableCell, { className: "text-end text-xs tabular-nums", children: percent(_chunkKJMMBUOAjs.cacheHitPercentage.call(void 0, row.cached, row.tokensIn)) }),
-          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableCell, { className: "text-end text-xs tabular-nums", children: formatValue(row.cost, "cost") }),
-          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableCell, { className: "text-end text-xs tabular-nums", children: formatValue(row.credits, "credits") }),
-          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.TableCell, { className: "text-end text-xs tabular-nums", children: percent(share) })
+        return /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.TableRow, { "data-testid": `breakdown-row-${row.id}`, children: [
+          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableCell, { className: "text-xs", children: row.id === "other" ? t("token_usage.admin.other") : row.label }),
+          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableCell, { className: "text-muted-foreground text-xs", children: _nullishCoalesce(row.sublabel, () => ( "")) }),
+          showActiveUsers && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableCell, { className: "text-end text-xs tabular-nums", children: row.activeUsers === void 0 ? "" : decimal(row.activeUsers, 0) }),
+          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableCell, { className: "text-end text-xs tabular-nums", children: decimal(row.calls, 0) }),
+          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableCell, { className: "text-end text-xs tabular-nums", children: decimal(row.tokensIn, 0) }),
+          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableCell, { className: "text-end text-xs tabular-nums", children: decimal(row.tokensOut, 0) }),
+          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableCell, { className: "text-end text-xs tabular-nums", children: percent(_chunkKJMMBUOAjs.cacheHitPercentage.call(void 0, row.cached, row.tokensIn)) }),
+          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableCell, { className: "text-end text-xs tabular-nums", children: formatValue(row.cost, "cost") }),
+          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableCell, { className: "text-end text-xs tabular-nums", children: formatValue(row.credits, "credits") }),
+          /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.TableCell, { className: "text-end text-xs tabular-nums", children: percent(share) })
         ] }, row.id);
       }) })
     ] }) })
@@ -757,7 +757,7 @@ function TokenUsageTimelineChart({ rows, metric, stackBy, className }) {
     /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className, dir: "ltr", children: [
       /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "sr-only", "data-testid": "timeline-data", children: JSON.stringify(chartData) }),
       /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "sr-only", "data-testid": "timeline-series", children: JSON.stringify(seriesKeys) }),
-      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.ChartContainer, { config: chartConfig, className: "aspect-auto h-72 w-full", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _recharts.BarChart, { accessibilityLayer: true, data: chartData, margin: { top: 8, right: 8, bottom: 0, left: 0 }, children: [
+      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.ChartContainer, { config: chartConfig, className: "aspect-auto h-72 w-full", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _recharts.BarChart, { accessibilityLayer: true, data: chartData, margin: { top: 8, right: 8, bottom: 0, left: 0 }, children: [
         /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _recharts.CartesianGrid, { vertical: false }),
         /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
           _recharts.XAxis,
@@ -781,10 +781,10 @@ function TokenUsageTimelineChart({ rows, metric, stackBy, className }) {
           }
         ),
         /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-          _chunk4EGA5UP5js.ChartTooltip,
+          _chunkZPXXZRS2js.ChartTooltip,
           {
             content: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-              _chunk4EGA5UP5js.ChartTooltipContent,
+              _chunkZPXXZRS2js.ChartTooltipContent,
               {
                 labelFormatter: (value) => bucketDate(String(value), granularity),
                 valueFormatter: (value) => formatValue(Number(value), metric),
@@ -793,7 +793,7 @@ function TokenUsageTimelineChart({ rows, metric, stackBy, className }) {
             )
           }
         ),
-        seriesKeys.length >= 2 ? /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.ChartLegend, { content: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.ChartLegendContent, {}) }) : null,
+        seriesKeys.length >= 2 ? /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.ChartLegend, { content: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.ChartLegendContent, {}) }) : null,
         seriesKeys.map((series, index) => /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
           _recharts.Bar,
           {
@@ -845,19 +845,19 @@ function TokenUsageAdminContainer() {
     [t]
   );
   if (error) {
-    return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.RoundPageContainer, { fullWidth: true, forceHeader: true, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "p-4", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.Card, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "p", { className: "text-destructive text-xs/relaxed", children: error }) }) }) }) });
+    return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.RoundPageContainer, { fullWidth: true, forceHeader: true, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "p-4", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.Card, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "p", { className: "text-destructive text-xs/relaxed", children: error }) }) }) }) });
   }
-  if (isLoading) return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.RoundPageContainer, { fullWidth: true, forceHeader: true });
+  if (isLoading) return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.RoundPageContainer, { fullWidth: true, forceHeader: true });
   const emptyLabel = t("token_usage.admin.no_data");
-  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.RoundPageContainer, { fullWidth: true, forceHeader: true, children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: "flex w-full flex-col gap-4 p-4", children: [
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.RoundPageContainer, { fullWidth: true, forceHeader: true, children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: "flex w-full flex-col gap-4 p-4", children: [
     /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageAdminTiles, { summary, metric: filters.metric, singleCustomerMode: hidePlatform }),
-    /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.Card, { children: [
-      /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.CardHeader, { children: [
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardTitle, { children: t("token_usage.admin.usage_over_time") }),
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardAction, { children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: "flex items-center gap-2", children: [
+    /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.Card, { children: [
+      /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.CardHeader, { children: [
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardTitle, { children: t("token_usage.admin.usage_over_time") }),
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardAction, { children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: "flex items-center gap-2", children: [
           /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "text-muted-foreground text-xs", children: t("token_usage.admin.stack_by") }),
           /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, 
-            _chunk4EGA5UP5js.Select,
+            _chunkZPXXZRS2js.Select,
             {
               items: stackByItems,
               value: filters.stackBy,
@@ -865,29 +865,29 @@ function TokenUsageAdminContainer() {
                 if (value) setFilters({ stackBy: value });
               },
               children: [
-                /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.SelectTrigger, { size: "sm", className: "w-36", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.SelectValue, {}) }),
-                /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.SelectContent, { children: STACK_BY_VALUES.map((value) => /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.SelectItem, { value, children: stackByItems[value] }, value)) })
+                /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.SelectTrigger, { size: "sm", className: "w-36", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.SelectValue, {}) }),
+                /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.SelectContent, { children: STACK_BY_VALUES.map((value) => /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.SelectItem, { value, children: stackByItems[value] }, value)) })
               ]
             }
           )
         ] }) })
       ] }),
-      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageTimelineChart, { rows: timeline, metric: filters.metric, stackBy: filters.stackBy }) })
+      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageTimelineChart, { rows: timeline, metric: filters.metric, stackBy: filters.stackBy }) })
     ] }),
     /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: "grid gap-4 md:grid-cols-2", children: [
-      /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.Card, { children: [
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardTitle, { children: t("token_usage.admin.by_company") }) }),
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageRankedBar, { rows: byCompany, metric: filters.metric, emptyLabel }) })
+      /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.Card, { children: [
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardTitle, { children: t("token_usage.admin.by_company") }) }),
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageRankedBar, { rows: byCompany, metric: filters.metric, emptyLabel }) })
       ] }),
-      /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.Card, { children: [
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardTitle, { children: t("token_usage.admin.by_user") }) }),
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageRankedBar, { rows: byUser, metric: filters.metric, emptyLabel }) })
+      /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.Card, { children: [
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardTitle, { children: t("token_usage.admin.by_user") }) }),
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageRankedBar, { rows: byUser, metric: filters.metric, emptyLabel }) })
       ] })
     ] }),
     /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: _chunk4ORLPEK7js.cn.call(void 0, "grid gap-4", !hidePlatform && "md:grid-cols-2"), children: [
-      /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.Card, { children: [
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardTitle, { children: t("token_usage.admin.customer_by_operation") }) }),
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
+      /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.Card, { children: [
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardTitle, { children: t("token_usage.admin.customer_by_operation") }) }),
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
           TokenUsageRankedBar,
           {
             rows: byCustomerOperation,
@@ -897,9 +897,9 @@ function TokenUsageAdminContainer() {
           }
         ) })
       ] }),
-      !hidePlatform && /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.Card, { children: [
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardTitle, { children: t("token_usage.admin.platform_by_operation") }) }),
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
+      !hidePlatform && /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.Card, { children: [
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardTitle, { children: t("token_usage.admin.platform_by_operation") }) }),
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
           TokenUsageRankedBar,
           {
             rows: byOperation,
@@ -910,9 +910,9 @@ function TokenUsageAdminContainer() {
         ) })
       ] })
     ] }),
-    /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.Card, { children: [
-      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardTitle, { children: t("token_usage.admin.detail") }) }),
-      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageBreakdownTable, { rows: byCompany, metric: filters.metric }) })
+    /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.Card, { children: [
+      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardTitle, { children: t("token_usage.admin.detail") }) }),
+      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageBreakdownTable, { rows: byCompany, metric: filters.metric }) })
     ] })
   ] }) });
 }
@@ -1033,7 +1033,7 @@ var TOKEN_USAGE_REPORT_I18N_KEYS = [
 
 function TokenUsageReportFilterBar({ onChange }) {
   return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { "data-help": "tokenusage.filters", className: "flex flex-wrap items-center gap-2", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-    _chunk4EGA5UP5js.DateRangeSelector,
+    _chunkZPXXZRS2js.DateRangeSelector,
     {
       onDateChange: (range) => {
         if (!_optionalChain([range, 'optionalAccess', _5 => _5.from]) || !_optionalChain([range, 'optionalAccess', _6 => _6.to])) return;
@@ -1066,7 +1066,7 @@ var TokenUsageReportProvider = /* @__PURE__ */ _chunk7QVYU63Ejs.__name.call(void
   pageUrl = TOKEN_USAGE_REPORT_PAGE_URL
 }) => {
   const t = _nextintl.useTranslations.call(void 0, );
-  const generateUrl = _chunk4EGA5UP5js.usePageUrlGenerator.call(void 0, );
+  const generateUrl = _chunkZPXXZRS2js.usePageUrlGenerator.call(void 0, );
   const [filters, setFilterState] = _react.useState.call(void 0, () => {
     const range = defaultRange2();
     return { from: _nullishCoalesce(initialFrom, () => ( range.from)), to: _nullishCoalesce(initialTo, () => ( range.to)) };
@@ -1130,7 +1130,7 @@ var TokenUsageReportProvider = /* @__PURE__ */ _chunk7QVYU63Ejs.__name.call(void
     () => ({ summary, timeline, byOperation, byTarget, targetPanelTitleKey, filters, setFilters, isLoading, error }),
     [summary, timeline, byOperation, byTarget, targetPanelTitleKey, filters, setFilters, isLoading, error]
   );
-  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.SharedProvider, { value: { breadcrumbs: breadcrumb(), title: title() }, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageReportContext.Provider, { value: contextValue, children }) });
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.SharedProvider, { value: { breadcrumbs: breadcrumb(), title: title() }, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageReportContext.Provider, { value: contextValue, children }) });
 }, "TokenUsageReportProvider");
 var useTokenUsageReport = /* @__PURE__ */ _chunk7QVYU63Ejs.__name.call(void 0, () => {
   const ctx = _react.useContext.call(void 0, TokenUsageReportContext);
@@ -1158,7 +1158,7 @@ function TokenUsageReportTiles({ summary, metric, balances }) {
   const monthlyColor = monthlyPercentage > 75 ? "text-success" : monthlyPercentage >= 5 ? "text-warning" : "text-destructive";
   const whole = /* @__PURE__ */ _chunk7QVYU63Ejs.__name.call(void 0, (value) => decimal(Math.max(0, Math.floor(value)), 0), "whole");
   return /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: "grid gap-3", children: [
-    /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.Card, { "data-testid": "tile-used", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.CardContent, { className: "grid gap-1", children: [
+    /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.Card, { "data-testid": "tile-used", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.CardContent, { className: "grid gap-1", children: [
       /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "text-muted-foreground text-xs", children: t("token_usage.report.used_in_period") }),
       /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "text-primary text-xl font-semibold tabular-nums", children: formatValue(_chunkKJMMBUOAjs.metricValue.call(void 0, current, metric), metric) }),
       /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "span", { className: "flex items-center gap-1", children: [
@@ -1174,7 +1174,7 @@ function TokenUsageReportTiles({ summary, metric, balances }) {
       ] })
     ] }) }),
     /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: "grid gap-3 sm:grid-cols-3", children: [
-      balances && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.Card, { "data-testid": "tile-monthly", size: "sm", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.CardContent, { className: "grid gap-1", children: [
+      balances && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.Card, { "data-testid": "tile-monthly", size: "sm", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.CardContent, { className: "grid gap-1", children: [
         /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "text-muted-foreground text-xs", children: t("token_usage.report.monthly_left") }),
         /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "span", { className: "flex items-baseline gap-1", children: [
           /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { "data-testid": "tile-monthly-value", className: _chunk4ORLPEK7js.cn.call(void 0, "text-sm font-medium tabular-nums", monthlyColor), children: whole(balances.availableMonthlyCredits) }),
@@ -1184,11 +1184,11 @@ function TokenUsageReportTiles({ summary, metric, balances }) {
           ] })
         ] })
       ] }) }),
-      balances && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.Card, { "data-testid": "tile-extra", size: "sm", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.CardContent, { className: "grid gap-1", children: [
+      balances && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.Card, { "data-testid": "tile-extra", size: "sm", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.CardContent, { className: "grid gap-1", children: [
         /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "text-muted-foreground text-xs", children: t("token_usage.report.extra_credits") }),
         /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "text-sm font-medium tabular-nums", children: whole(balances.availableExtraCredits) })
       ] }) }),
-      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.Card, { "data-testid": "tile-calls", size: "sm", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.CardContent, { className: "grid gap-1", children: [
+      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.Card, { "data-testid": "tile-calls", size: "sm", children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.CardContent, { className: "grid gap-1", children: [
         /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "text-muted-foreground text-xs", children: t("token_usage.report.calls") }),
         /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "text-sm font-medium tabular-nums", children: decimal(current.calls, 0) })
       ] }) })
@@ -1230,21 +1230,21 @@ function TokenUsageReportContainer({ balances = null }) {
   const t = _nextintl.useTranslations.call(void 0, );
   const { summary, timeline, byOperation, byTarget, isLoading, error, targetPanelTitleKey } = useTokenUsageReport();
   if (error) {
-    return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.RoundPageContainer, { fullWidth: true, forceHeader: true, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "p-4", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.Card, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "p", { className: "text-destructive text-xs/relaxed", children: error }) }) }) }) });
+    return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.RoundPageContainer, { fullWidth: true, forceHeader: true, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "p-4", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.Card, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "p", { className: "text-destructive text-xs/relaxed", children: error }) }) }) }) });
   }
-  if (isLoading) return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.RoundPageContainer, { fullWidth: true, forceHeader: true });
+  if (isLoading) return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.RoundPageContainer, { fullWidth: true, forceHeader: true });
   const emptyLabel = t("token_usage.report.no_data");
   const targetTitle = targetPanelTitleKey && byTarget.length > 0 ? t(targetPanelTitleKey) : void 0;
-  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.RoundPageContainer, { fullWidth: true, forceHeader: true, children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: "flex w-full flex-col gap-4 p-4", children: [
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.RoundPageContainer, { fullWidth: true, forceHeader: true, children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: "flex w-full flex-col gap-4 p-4", children: [
     /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageReportTiles, { summary, metric: "credits", balances }),
-    /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.Card, { children: [
-      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardTitle, { children: t("token_usage.report.usage_over_time") }) }),
-      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageTimelineChart, { rows: timeline, metric: "credits", stackBy: "type" }) })
+    /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.Card, { children: [
+      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardTitle, { children: t("token_usage.report.usage_over_time") }) }),
+      /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageTimelineChart, { rows: timeline, metric: "credits", stackBy: "type" }) })
     ] }),
     /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: _chunk4ORLPEK7js.cn.call(void 0, "grid gap-4", targetTitle && "md:grid-cols-2"), children: [
-      /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.Card, { children: [
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardTitle, { children: t("token_usage.report.by_operation") }) }),
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
+      /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.Card, { children: [
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardTitle, { children: t("token_usage.report.by_operation") }) }),
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
           TokenUsageRankedBar,
           {
             rows: byOperation,
@@ -1254,9 +1254,9 @@ function TokenUsageReportContainer({ balances = null }) {
           }
         ) })
       ] }),
-      targetTitle && /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunk4EGA5UP5js.Card, { children: [
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardTitle, { children: targetTitle }) }),
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4EGA5UP5js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageRankedBar, { rows: byTarget, metric: "credits", emptyLabel }) })
+      targetTitle && /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, _chunkZPXXZRS2js.Card, { children: [
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardHeader, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardTitle, { children: targetTitle }) }),
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkZPXXZRS2js.CardContent, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenUsageRankedBar, { rows: byTarget, metric: "credits", emptyLabel }) })
       ] })
     ] })
   ] }) });

package/dist/features/tokenusage/index.mjs

@@ -37,7 +37,7 @@ import {
   TableHeader,
   TableRow,
   usePageUrlGenerator
-} from "../../chunk-NCWCC56Q.mjs";
+} from "../../chunk-7F5Q3QQV.mjs";
 import "../../chunk-MQDR6MEE.mjs";
 import "../../chunk-PW42LRSL.mjs";
 import {

package/dist/next-config/index.d.mts

@@ -38,7 +38,6 @@ interface NjaNextConfigOptions {
         camera?: "none" | "self";
     };
     mdx?: boolean;
-    serwist?: boolean;
     securityHeaders?: boolean;
     authInterrupts?: boolean;
     reactCompiler?: boolean;

package/dist/next-config/index.d.ts

@@ -38,7 +38,6 @@ interface NjaNextConfigOptions {
         camera?: "none" | "self";
     };
     mdx?: boolean;
-    serwist?: boolean;
     securityHeaders?: boolean;
     authInterrupts?: boolean;
     reactCompiler?: boolean;

package/dist/next-config/index.js

@@ -226,12 +226,6 @@ function createNextConfig(options) {
       NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: _nullishCoalesce(env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY, () => ( "")),
       ...options.env
     },
-    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which
-    // does nothing but append these two entries. Requiring the package here
-    // instead CRASHES production: it is a devDependency, next.config.js is loaded
-    // at RUNTIME by `next start`, and the web-production image installs with
-    // --prod. Do not re-add a require of any devDependency to this file.
-    ...options.serwist ? { serverExternalPackages: ["esbuild", "esbuild-wasm"] } : {},
     // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a
     // single instance in both modes.
     turbopack: {

package/dist/next-config/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"names":[],"mappings":"AAAA;AACE;AACF,uDAA6B;AAC7B;AACA;ACoBA,IAAM,gBAAA,EAA+E;AAAA,EACnF,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,CAAC,uBAAuB,CAAA;AAAA,IACtC,SAAA,EAAW,CAAC,sBAAsB,CAAA;AAAA,IAClC,aAAA,EAAe,CAAC,wBAAwB,CAAA;AAAA,IACxC,WAAA,EAAa,CAAC,uBAAA,EAAyB,0BAA0B;AAAA,EACnE,CAAA;AAAA,EACA,UAAA,EAAY;AAAA,IACV,YAAA,EAAc,CAAC,6BAA6B,CAAA;AAAA,IAC5C,SAAA,EAAW,CAAC,6BAAA,EAA+B,0BAA0B,CAAA;AAAA,IACrE,aAAA,EAAe,CAAC,6BAAA,EAA+B,+BAA+B;AAAA,EAChF,CAAA;AAAA,EACA,SAAA,EAAW;AAAA,IACT,YAAA,EAAc,CAAC,mCAAmC,CAAA;AAAA,IAClD,aAAA,EAAe,CAAC,mCAAmC,CAAA;AAAA,IACnD,WAAA,EAAa,CAAC,mCAAmC;AAAA,EACnD,CAAA;AAAA,EACA,OAAA,EAAS;AAAA,IACP,SAAA,EAAW,CAAC,4BAA4B;AAAA,EAC1C,CAAA;AAAA,EACA,WAAA,EAAa;AAAA,IACX,WAAA,EAAa,CAAC,8BAA8B,CAAA;AAAA,IAC5C,UAAA,EAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF,CAAA;AAEA,SAAS,gBAAA,CAAiB,GAAA,EAAkC;AAC1D,EAAA,OAAO,GAAA,CAAI,cAAA,EAAgB,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,EAAA,GAAM,CAAA,CAAE,IAAA,CAAK,CAAC,EAAA,EAAI,CAAC,CAAA;AAClF;AAFS,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AAUF,SAAS,cAAA,CAAe,GAAA,EAAkC;AAC/D,EAAA,MAAM,QAAA,EAAoB,CAAC,CAAA;AAC3B,EAAA,IAAA,CAAA,MAAW,IAAA,GAAO,CAAC,GAAA,CAAI,mBAAA,EAAqB,GAAA,CAAI,sBAAsB,CAAA,EAAG;AACvE,IAAA,GAAA,CAAI,CAAC,GAAA,EAAK,QAAA;AACV,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,OAAO,EAAA,EAAI,IAAI,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AACrC,MAAA,GAAA,CAAI,OAAA,IAAW,OAAA,GAAU,CAAC,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,EAAG,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA;AAAA,IACzE,EAAA,UAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAZgB,qCAAA,cAAA,EAAA,gBAAA,CAAA;AAiBT,SAAS,QAAA,CAAS,OAAA,EAAqB,GAAA,EAAgC;AAC5E,EAAA,MAAM,OAAA,EAAS,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAC1C,EAAA,MAAM,aAAA,EAAe,gBAAA,CAAiB,GAAG,CAAA;AACzC,EAAA,MAAM,WAAA,EAAa,cAAA,CAAe,GAAG,CAAA;AACrC,EAAA,MAAM,SAAA,mBAAW,OAAA,CAAQ,QAAA,UAAY,CAAC,GAAA;AAItC,EAAA,MAAM,gBAAA,EAA+E;AAAA;AAAA,IAEnF,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAA,EAAmB,eAAe,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAElF,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAiB,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAEhE,SAAA,EAAW,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAA,EAAS,OAAO,CAAA,EAAG,OAAA,EAAS,CAAC,GAAG,YAAA,EAAc,GAAG,UAAU,EAAE,CAAA;AAAA;AAAA,IAE3F,UAAA,EAAY,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAE5C,aAAA,EAAe;AAAA,MACb,IAAA,EAAM,CAAC,QAAQ,CAAA;AAAA,MACf,OAAA,EAAS;AAAA,QACP,MAAA;AAAA;AAAA,QAEA,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,QAC5B,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF,CAAA;AAAA;AAAA,IAEA,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,WAAW,CAAA;AAAA;AAAA,IAErD,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAO,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE;AAAA,EACzD,CAAA;AAEA,EAAA,MAAM,UAAA,kBAAY,qCAAA,CAAC,IAAA,EAAA,GAA+B;AAChD,IAAA,MAAM,EAAE,IAAA,EAAM,QAAQ,EAAA,EAAI,eAAA,CAAgB,IAAI,CAAA;AAC9C,IAAA,MAAM,aAAA,EAAe,QAAA,CAAS,OAAA,CAAQ,CAAC,OAAA,EAAA,oBAAY,eAAA,CAAgB,OAAO,CAAA,CAAE,IAAI,CAAA,UAAK,CAAC,GAAC,CAAA;AACvF,IAAA,MAAM,QAAA,EAAU,CAAC,GAAG,IAAA,EAAM,GAAG,YAAA,EAAc,oCAAI,OAAA,mBAAQ,GAAA,4BAAA,CAAM,IAAI,GAAA,UAAK,CAAC,GAAA,EAAI,GAAG,OAAO,CAAA,CAAE,MAAA;AAAA,MACrF,CAAC,MAAA,EAAA,GAAW,OAAA,IAAW;AAAA,IACzB,CAAA;AACA,IAAA,OAAO,CAAC,IAAA,EAAM,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7C,CAAA,EAPkB,WAAA,CAAA;AASlB,EAAA,OAAO;AAAA,IACL,oBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA,IACtB,SAAA,CAAU,WAAW,CAAA;AAAA,IACrB,SAAA,CAAU,SAAS,CAAA;AAAA,IACnB,SAAA,CAAU,UAAU,CAAA;AAAA,IACpB,SAAA,CAAU,aAAa,CAAA;AAAA,IACvB,SAAA,CAAU,WAAW,CAAA;AAAA;AAAA,IAErB,wBAAA;AAAA;AAAA,IAEA,oBAAA;AAAA;AAAA,IAEA,iBAAA;AAAA;AAAA,IAEA,mBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,GAAA,CAAI,SAAA,IAAa,aAAA,GAAgB,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,4BAAA,EAA8B;AAAA,EAC5F,CAAA,CACG,MAAA,CAAO,OAAO,CAAA,CACd,IAAA,CAAK,IAAI,CAAA;AACd;AAvEgB,qCAAA,QAAA,EAAA,UAAA,CAAA;ADoChB;AACA;AEtGO,SAAS,oBAAA,CAAqB,OAAA,EAAgC,GAAA,EAAsC;AACzG,EAAA,MAAM,OAAA,kBAAS,OAAA,qBAAQ,iBAAA,6BAAmB,SAAA,IAAW,OAAA,EAAS,GAAA,EAAK,MAAA;AAEnE,EAAA,OAAO;AAAA,IACL;AAAA;AAAA,MAEE,MAAA,EAAQ,SAAA;AAAA,MACR,OAAA,EAAS;AAAA;AAAA,QAEP;AAAA,UACE,GAAA,EAAK,yBAAA;AAAA,UACL,KAAA,EAAO,QAAA,CAAS,OAAA,EAAS,GAAG;AAAA,QAC9B,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,wBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAClB,CAAC,EAAA,EACD;AAAA,UACE;AAAA,YACE,GAAA,EAAK,2BAAA;AAAA,YACL,KAAA,EAAO;AAAA,UACT;AAAA,QACF,CAAA;AAAA;AAAA,QAEJ;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,oBAAA;AAAA,UACL,KAAA,EAAO,CAAA,QAAA,EAAW,MAAM,CAAA,gCAAA;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAhDgB,qCAAA,oBAAA,EAAA,sBAAA,CAAA;AFsJhB;AACA;AG/HA,SAAS,iBAAA,CAAkB,GAAA,EAAyC;AAClE,EAAA,MAAM,aAAA,EAAe,GAAA,CAAI,cAAA,EAAgB,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,GAAA,EAAA,GAAQ,GAAA,CAAI,IAAA,CAAK,CAAC,EAAA,EAAI,CAAC,CAAA;AAClG,EAAA,MAAM,SAAA,EAA4B,CAAC,CAAA;AACnC,EAAA,IAAA,CAAA,MAAW,IAAA,GAAO,CAAC,GAAG,YAAA,EAAc,GAAG,cAAA,CAAe,GAAG,CAAC,CAAA,EAAG;AAC3D,IAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAU,KAAK,EAAA,EAAI,IAAI,GAAA,CAAI,GAAG,CAAA;AAChD,IAAA,MAAM,QAAA,EAAyB;AAAA,MAC7B,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,MAClC,QAAA;AAAA,MACA,IAAA,EAAM,KAAA,GAAQ,KAAA;AAAA,IAChB,CAAA;AACA,IAAA,MAAM,KAAA,EAAO,QAAA,CAAS,IAAA;AAAA,MACpB,CAAC,CAAA,EAAA,GAAM,CAAA,CAAE,SAAA,IAAa,OAAA,CAAQ,SAAA,GAAY,CAAA,CAAE,SAAA,IAAa,OAAA,CAAQ,SAAA,GAAY,CAAA,CAAE,KAAA,IAAS,OAAA,CAAQ;AAAA,IAClG,CAAA;AACA,IAAA,GAAA,CAAI,CAAC,IAAA,EAAM,QAAA,CAAS,IAAA,CAAK,OAAO,CAAA;AAAA,EAClC;AACA,EAAA,OAAO,QAAA;AACT;AAhBS,qCAAA,iBAAA,EAAA,mBAAA,CAAA;AAkBF,SAAS,gBAAA,CAAiB,OAAA,EAA2C;AAC1E,EAAA,MAAM,IAAA,EAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,cAAA,EAAgB,OAAA,CAAQ,cAAA,IAAkB,IAAA;AAEhD,EAAA,MAAM,OAAA,EAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,EAAE,OAAA,EAAS,YAAY,EAAA,EAAI,CAAC,CAAA;AAAA,IAC3D,eAAA,EAAiB,IAAA;AAAA,IACjB,kBAAA,EAAoB,IAAA;AAAA,IACpB,aAAA;AAAA,IACA,YAAA,EAAc;AAAA,MACZ,aAAA,EAAe;AAAA,QACb,aAAA,EAAe;AAAA,MACjB,CAAA;AAAA;AAAA;AAAA;AAAA,MAIA,cAAA,mBAAgB,OAAA,CAAQ,cAAA,UAAkB,MAAA;AAAA,MAC1C,WAAA,EAAa,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,cAAA,EAAgB,EAAE,0BAAA,EAA4B,KAAK,EAAA,EAAI,CAAC;AAAA,IAC9D,CAAA;AAAA,IACA,iBAAA,EAAmB,OAAA,CAAQ,UAAA;AAAA,IAC3B,cAAA,EAAgB,OAAA,CAAQ,IAAA,EAAM,CAAC,IAAA,EAAM,KAAA,EAAO,KAAK,EAAA,EAAI,CAAC,IAAA,EAAM,KAAK,CAAA;AAAA,IACjE,MAAA,EAAQ;AAAA,MACN,eAAA,mBAAiB,OAAA,CAAQ,oBAAA,UAAwB,IAAA;AAAA,MACjD,cAAA,EAAgB,iBAAA,CAAkB,GAAG,CAAA;AAAA,MACrC,uBAAA,EAAyB;AAAA,IAC3B,CAAA;AAAA,IACA,eAAA,EAAiB,KAAA;AAAA,IACjB,eAAA,EAAiB,KAAA;AAAA,IACjB,GAAA,EAAK;AAAA,MACH,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,4BAAA,mBAA8B,GAAA,CAAI,4BAAA,UAAgC,IAAA;AAAA,MAClE,+BAAA,mBAAiC,GAAA,CAAI,+BAAA,UAAmC,IAAA;AAAA,MACxE,GAAG,OAAA,CAAQ;AAAA,IACb,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,GAAI,OAAA,CAAQ,QAAA,EAAU,EAAE,sBAAA,EAAwB,CAAC,SAAA,EAAW,cAAc,EAAE,EAAA,EAAI,CAAC,CAAA;AAAA;AAAA;AAAA,IAGjF,SAAA,EAAW;AAAA,MACT,YAAA,EAAc;AAAA,QACZ,GAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,KAAA,EAAO;AACrC,IAAA,MAAA,CAAO,QAAA,EAAU,MAAA,CAAA,EAAA,GAAY,oBAAA,CAAqB,OAAA,EAAS,OAAA,CAAQ,GAAG,CAAA;AAAA,EACxE;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,QAAA;AAEhD,EAAA,OAAO,OAAA,CAAQ,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,MAAM,EAAA,EAAI,MAAA;AACnD;AArEgB,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AHmMhB;AACE;AACA;AACA;AACF,kHAAC","file":"/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","sourcesContent":[null,"// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n  \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n *   `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n  services?: CspService[];\n  csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n  stripe: {\n    \"script-src\": [\"https://js.stripe.com\"],\n    \"img-src\": [\"https://*.stripe.com\"],\n    \"connect-src\": [\"https://api.stripe.com\"],\n    \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n  },\n  googleMaps: {\n    \"script-src\": [\"https://maps.googleapis.com\"],\n    \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n    \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n  },\n  turnstile: {\n    \"script-src\": [\"https://challenges.cloudflare.com\"],\n    \"connect-src\": [\"https://challenges.cloudflare.com\"],\n    \"frame-src\": [\"https://challenges.cloudflare.com\"],\n  },\n  discord: {\n    \"img-src\": [\"https://cdn.discordapp.com\"],\n  },\n  googleFonts: {\n    \"style-src\": [\"https://fonts.googleapis.com\"],\n    \"font-src\": [\"https://fonts.gstatic.com\"],\n  },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n/**\n * Origins of the app's own servers, the API and the corpus, from\n * `NEXT_PUBLIC_API_URL` and `NEXT_PUBLIC_CORPUS_URL`. They serve every stored\n * object link, so images and frames must be allowed from them. Unset or invalid\n * URLs are skipped; the result has no duplicates.\n */\nexport function listAppOrigins(env: NodeJS.ProcessEnv): string[] {\n  const origins: string[] = [];\n  for (const url of [env.NEXT_PUBLIC_API_URL, env.NEXT_PUBLIC_CORPUS_URL]) {\n    if (!url) continue;\n    try {\n      const { origin } = new URL(url.trim());\n      if (origin !== \"null\" && !origins.includes(origin)) origins.push(origin);\n    } catch {\n      // Not a URL: nothing to allow.\n    }\n  }\n  return origins;\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n  const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n  const imageSources = listImageSources(env);\n  const appOrigins = listAppOrigins(env);\n  const services = options.services ?? [];\n\n  // Each fetch directive: what Next itself needs, then the named services, then\n  // the app's extras, then the sources derived from the env.\n  const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n    // Scripts: self, and unsafe-inline/eval for Next.js\n    \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n    // Styles: self and unsafe-inline for styled-components/emotion\n    \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n    // Images: self, data URIs, blobs, configured image sources, and the api/corpus origins\n    \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: [...imageSources, ...appOrigins] },\n    // Fonts: self\n    \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n    \"connect-src\": {\n      base: [\"'self'\"],\n      fromEnv: [\n        apiUrl,\n        // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n        apiUrl.replace(/^http/, \"ws\"),\n        env.NEXT_PUBLIC_ADDRESS || \"\",\n        ...imageSources,\n      ],\n    },\n    // Frames: self, and the api/corpus origins (inline previews of stored objects)\n    \"frame-src\": { base: [\"'self'\"], fromEnv: appOrigins },\n    // Worker sources: self and blob (for Web Workers with dynamic imports)\n    \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n  };\n\n  const directive = (name: CspDirective): string => {\n    const { base, fromEnv } = fetchDirectives[name];\n    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n    const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n      (source) => source !== \"\",\n    );\n    return [name, ...new Set(sources)].join(\" \");\n  };\n\n  return [\n    \"default-src 'self'\",\n    directive(\"script-src\"),\n    directive(\"style-src\"),\n    directive(\"img-src\"),\n    directive(\"font-src\"),\n    directive(\"connect-src\"),\n    directive(\"frame-src\"),\n    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n    \"frame-ancestors 'none'\",\n    // Form actions: only self\n    \"form-action 'self'\",\n    // Base URI: only self\n    \"base-uri 'self'\",\n    // Object sources: none (no plugins)\n    \"object-src 'none'\",\n    directive(\"worker-src\"),\n    // Upgrade insecure requests in production.\n    //\n    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n    // and serves it over plain http on a custom hostname. With this directive\n    // the browser rewrites every /_next/static asset to https, which nothing is\n    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n    // never hydrates, and each spec sees only server-rendered markup.\n    env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n  ]\n    .filter(Boolean)\n    .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n  source: string;\n  headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n  const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n  return [\n    {\n      // Apply to all routes\n      source: \"/:path*\",\n      headers: [\n        // Content Security Policy - prevents XSS attacks\n        {\n          key: \"Content-Security-Policy\",\n          value: buildCsp(options, env),\n        },\n        // X-Frame-Options - prevents clickjacking (backup for older browsers)\n        {\n          key: \"X-Frame-Options\",\n          value: \"DENY\",\n        },\n        // X-Content-Type-Options - prevents MIME sniffing\n        {\n          key: \"X-Content-Type-Options\",\n          value: \"nosniff\",\n        },\n        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n        // the suite speaks plain http, and an HSTS pin would force https on every\n        // later request to this host from the same browser profile.\n        ...(env.E2E_BUILD === \"true\"\n          ? []\n          : [\n              {\n                key: \"Strict-Transport-Security\",\n                value: \"max-age=31536000; includeSubDomains\",\n              },\n            ]),\n        // Referrer-Policy - controls referrer information\n        {\n          key: \"Referrer-Policy\",\n          value: \"strict-origin-when-cross-origin\",\n        },\n        // Permissions-Policy - restricts browser features\n        {\n          key: \"Permissions-Policy\",\n          value: `camera=(${camera}), microphone=(), geolocation=()`,\n        },\n      ],\n    },\n  ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx, serwist or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, listAppOrigins, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp, listAppOrigins };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n  devOrigins: string[];\n  /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n  services?: CspService[];\n  /** Extra CSP sources per directive, for hosts no named service covers. */\n  csp?: Partial<Record<CspDirective, string[]>>;\n  env?: Record<string, string>;\n  imageMinimumCacheTTL?: number;\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n  mdx?: boolean;\n  serwist?: boolean;\n  securityHeaders?: boolean;\n  authInterrupts?: boolean;\n  reactCompiler?: boolean;\n  rewrites?: NextConfig[\"rewrites\"];\n  extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\n// IMAGE_SOURCES, then the api and corpus origins (they serve every stored object\n// link), without duplicates.\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n  const imageSources = env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((url) => url.trim()) : [];\n  const patterns: RemotePattern[] = [];\n  for (const url of [...imageSources, ...listAppOrigins(env)]) {\n    const { hostname, protocol, port } = new URL(url);\n    const pattern: RemotePattern = {\n      protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n      hostname,\n      port: port || undefined,\n    };\n    const seen = patterns.some(\n      (p) => p.protocol === pattern.protocol && p.hostname === pattern.hostname && p.port === pattern.port,\n    );\n    if (!seen) patterns.push(pattern);\n  }\n  return patterns;\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n  const env = process.env;\n  const reactCompiler = options.reactCompiler === true;\n\n  const config: NextConfig = {\n    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n    // `next dev` server may still be running against the same worktree. `next\n    // build` and `next dev` share `.next`, so a build performed underneath a live\n    // dev server clobbers it and that dev server then 404s every route. Giving\n    // the e2e build its own directory keeps the two independent. E2E_BUILD must\n    // be set for `next build` AND for `next start`, or `start` looks in `.next`\n    // and serves someone else's output.\n    ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n    cacheComponents: true,\n    partialPrefetching: true,\n    reactCompiler,\n    experimental: {\n      serverActions: {\n        bodySizeLimit: \"5mb\",\n      },\n      // Required by `unauthorized()` (next/navigation): without this flag it throws a plain\n      // Error instead of rendering the nearest unauthorized.tsx. The flag is for app code that\n      // calls it; ServerSession.checkPermission does not, it still does `redirect(\"/401\")`.\n      authInterrupts: options.authInterrupts ?? true,\n      turbopackGc: true,\n      // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n      // imported request module unactivated (\"Lazily compiled dynamic import of ...\n      // JsonApiRequest ... was not activated\"), so every client-side read returns\n      // nothing. Seen with the package installed from npm; production builds are unaffected.\n      ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n    },\n    allowedDevOrigins: options.devOrigins,\n    pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n    images: {\n      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n      remotePatterns: parseImageSources(env),\n      dangerouslyAllowLocalIP: true,\n    },\n    poweredByHeader: false,\n    reactStrictMode: false,\n    env: {\n      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n      ...options.env,\n    },\n    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which\n    // does nothing but append these two entries. Requiring the package here\n    // instead CRASHES production: it is a devDependency, next.config.js is loaded\n    // at RUNTIME by `next start`, and the web-production image installs with\n    // --prod. Do not re-add a require of any devDependency to this file.\n    ...(options.serwist ? { serverExternalPackages: [\"esbuild\", \"esbuild-wasm\"] } : {}),\n    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n    // single instance in both modes.\n    turbopack: {\n      resolveAlias: {\n        yjs: \"./node_modules/yjs\",\n      },\n    },\n  };\n\n  if (options.securityHeaders !== false) {\n    config.headers = async () => buildSecurityHeaders(options, process.env);\n  }\n\n  if (options.rewrites) config.rewrites = options.rewrites;\n\n  return options.extend ? options.extend(config) : config;\n}\n"]}
+{"version":3,"sources":["/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","../../src/next-config/csp.ts","../../src/next-config/headers.ts","../../src/next-config/index.ts"],"names":[],"mappings":"AAAA;AACE;AACF,uDAA6B;AAC7B;AACA;ACoBA,IAAM,gBAAA,EAA+E;AAAA,EACnF,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,CAAC,uBAAuB,CAAA;AAAA,IACtC,SAAA,EAAW,CAAC,sBAAsB,CAAA;AAAA,IAClC,aAAA,EAAe,CAAC,wBAAwB,CAAA;AAAA,IACxC,WAAA,EAAa,CAAC,uBAAA,EAAyB,0BAA0B;AAAA,EACnE,CAAA;AAAA,EACA,UAAA,EAAY;AAAA,IACV,YAAA,EAAc,CAAC,6BAA6B,CAAA;AAAA,IAC5C,SAAA,EAAW,CAAC,6BAAA,EAA+B,0BAA0B,CAAA;AAAA,IACrE,aAAA,EAAe,CAAC,6BAAA,EAA+B,+BAA+B;AAAA,EAChF,CAAA;AAAA,EACA,SAAA,EAAW;AAAA,IACT,YAAA,EAAc,CAAC,mCAAmC,CAAA;AAAA,IAClD,aAAA,EAAe,CAAC,mCAAmC,CAAA;AAAA,IACnD,WAAA,EAAa,CAAC,mCAAmC;AAAA,EACnD,CAAA;AAAA,EACA,OAAA,EAAS;AAAA,IACP,SAAA,EAAW,CAAC,4BAA4B;AAAA,EAC1C,CAAA;AAAA,EACA,WAAA,EAAa;AAAA,IACX,WAAA,EAAa,CAAC,8BAA8B,CAAA;AAAA,IAC5C,UAAA,EAAY,CAAC,2BAA2B;AAAA,EAC1C;AACF,CAAA;AAEA,SAAS,gBAAA,CAAiB,GAAA,EAAkC;AAC1D,EAAA,OAAO,GAAA,CAAI,cAAA,EAAgB,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,EAAA,GAAM,CAAA,CAAE,IAAA,CAAK,CAAC,EAAA,EAAI,CAAC,CAAA;AAClF;AAFS,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AAUF,SAAS,cAAA,CAAe,GAAA,EAAkC;AAC/D,EAAA,MAAM,QAAA,EAAoB,CAAC,CAAA;AAC3B,EAAA,IAAA,CAAA,MAAW,IAAA,GAAO,CAAC,GAAA,CAAI,mBAAA,EAAqB,GAAA,CAAI,sBAAsB,CAAA,EAAG;AACvE,IAAA,GAAA,CAAI,CAAC,GAAA,EAAK,QAAA;AACV,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,OAAO,EAAA,EAAI,IAAI,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AACrC,MAAA,GAAA,CAAI,OAAA,IAAW,OAAA,GAAU,CAAC,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,EAAG,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA;AAAA,IACzE,EAAA,UAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAZgB,qCAAA,cAAA,EAAA,gBAAA,CAAA;AAiBT,SAAS,QAAA,CAAS,OAAA,EAAqB,GAAA,EAAgC;AAC5E,EAAA,MAAM,OAAA,EAAS,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAC1C,EAAA,MAAM,aAAA,EAAe,gBAAA,CAAiB,GAAG,CAAA;AACzC,EAAA,MAAM,WAAA,EAAa,cAAA,CAAe,GAAG,CAAA;AACrC,EAAA,MAAM,SAAA,mBAAW,OAAA,CAAQ,QAAA,UAAY,CAAC,GAAA;AAItC,EAAA,MAAM,gBAAA,EAA+E;AAAA;AAAA,IAEnF,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAA,EAAmB,eAAe,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAElF,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,iBAAiB,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAEhE,SAAA,EAAW,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAA,EAAS,OAAO,CAAA,EAAG,OAAA,EAAS,CAAC,GAAG,YAAA,EAAc,GAAG,UAAU,EAAE,CAAA;AAAA;AAAA,IAE3F,UAAA,EAAY,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE,CAAA;AAAA;AAAA,IAE5C,aAAA,EAAe;AAAA,MACb,IAAA,EAAM,CAAC,QAAQ,CAAA;AAAA,MACf,OAAA,EAAS;AAAA,QACP,MAAA;AAAA;AAAA,QAEA,MAAA,CAAO,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,QAC5B,GAAA,CAAI,oBAAA,GAAuB,EAAA;AAAA,QAC3B,GAAG;AAAA,MACL;AAAA,IACF,CAAA;AAAA;AAAA,IAEA,WAAA,EAAa,EAAE,IAAA,EAAM,CAAC,QAAQ,CAAA,EAAG,OAAA,EAAS,WAAW,CAAA;AAAA;AAAA,IAErD,YAAA,EAAc,EAAE,IAAA,EAAM,CAAC,QAAA,EAAU,OAAO,CAAA,EAAG,OAAA,EAAS,CAAC,EAAE;AAAA,EACzD,CAAA;AAEA,EAAA,MAAM,UAAA,kBAAY,qCAAA,CAAC,IAAA,EAAA,GAA+B;AAChD,IAAA,MAAM,EAAE,IAAA,EAAM,QAAQ,EAAA,EAAI,eAAA,CAAgB,IAAI,CAAA;AAC9C,IAAA,MAAM,aAAA,EAAe,QAAA,CAAS,OAAA,CAAQ,CAAC,OAAA,EAAA,oBAAY,eAAA,CAAgB,OAAO,CAAA,CAAE,IAAI,CAAA,UAAK,CAAC,GAAC,CAAA;AACvF,IAAA,MAAM,QAAA,EAAU,CAAC,GAAG,IAAA,EAAM,GAAG,YAAA,EAAc,oCAAI,OAAA,mBAAQ,GAAA,4BAAA,CAAM,IAAI,GAAA,UAAK,CAAC,GAAA,EAAI,GAAG,OAAO,CAAA,CAAE,MAAA;AAAA,MACrF,CAAC,MAAA,EAAA,GAAW,OAAA,IAAW;AAAA,IACzB,CAAA;AACA,IAAA,OAAO,CAAC,IAAA,EAAM,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7C,CAAA,EAPkB,WAAA,CAAA;AASlB,EAAA,OAAO;AAAA,IACL,oBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA,IACtB,SAAA,CAAU,WAAW,CAAA;AAAA,IACrB,SAAA,CAAU,SAAS,CAAA;AAAA,IACnB,SAAA,CAAU,UAAU,CAAA;AAAA,IACpB,SAAA,CAAU,aAAa,CAAA;AAAA,IACvB,SAAA,CAAU,WAAW,CAAA;AAAA;AAAA,IAErB,wBAAA;AAAA;AAAA,IAEA,oBAAA;AAAA;AAAA,IAEA,iBAAA;AAAA;AAAA,IAEA,mBAAA;AAAA,IACA,SAAA,CAAU,YAAY,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtB,GAAA,CAAI,SAAA,IAAa,aAAA,GAAgB,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,4BAAA,EAA8B;AAAA,EAC5F,CAAA,CACG,MAAA,CAAO,OAAO,CAAA,CACd,IAAA,CAAK,IAAI,CAAA;AACd;AAvEgB,qCAAA,QAAA,EAAA,UAAA,CAAA;ADoChB;AACA;AEtGO,SAAS,oBAAA,CAAqB,OAAA,EAAgC,GAAA,EAAsC;AACzG,EAAA,MAAM,OAAA,kBAAS,OAAA,qBAAQ,iBAAA,6BAAmB,SAAA,IAAW,OAAA,EAAS,GAAA,EAAK,MAAA;AAEnE,EAAA,OAAO;AAAA,IACL;AAAA;AAAA,MAEE,MAAA,EAAQ,SAAA;AAAA,MACR,OAAA,EAAS;AAAA;AAAA,QAEP;AAAA,UACE,GAAA,EAAK,yBAAA;AAAA,UACL,KAAA,EAAO,QAAA,CAAS,OAAA,EAAS,GAAG;AAAA,QAC9B,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,wBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAClB,CAAC,EAAA,EACD;AAAA,UACE;AAAA,YACE,GAAA,EAAK,2BAAA;AAAA,YACL,KAAA,EAAO;AAAA,UACT;AAAA,QACF,CAAA;AAAA;AAAA,QAEJ;AAAA,UACE,GAAA,EAAK,iBAAA;AAAA,UACL,KAAA,EAAO;AAAA,QACT,CAAA;AAAA;AAAA,QAEA;AAAA,UACE,GAAA,EAAK,oBAAA;AAAA,UACL,KAAA,EAAO,CAAA,QAAA,EAAW,MAAM,CAAA,gCAAA;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAhDgB,qCAAA,oBAAA,EAAA,sBAAA,CAAA;AFsJhB;AACA;AGhIA,SAAS,iBAAA,CAAkB,GAAA,EAAyC;AAClE,EAAA,MAAM,aAAA,EAAe,GAAA,CAAI,cAAA,EAAgB,GAAA,CAAI,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,GAAA,EAAA,GAAQ,GAAA,CAAI,IAAA,CAAK,CAAC,EAAA,EAAI,CAAC,CAAA;AAClG,EAAA,MAAM,SAAA,EAA4B,CAAC,CAAA;AACnC,EAAA,IAAA,CAAA,MAAW,IAAA,GAAO,CAAC,GAAG,YAAA,EAAc,GAAG,cAAA,CAAe,GAAG,CAAC,CAAA,EAAG;AAC3D,IAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAU,KAAK,EAAA,EAAI,IAAI,GAAA,CAAI,GAAG,CAAA;AAChD,IAAA,MAAM,QAAA,EAAyB;AAAA,MAC7B,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,MAClC,QAAA;AAAA,MACA,IAAA,EAAM,KAAA,GAAQ,KAAA;AAAA,IAChB,CAAA;AACA,IAAA,MAAM,KAAA,EAAO,QAAA,CAAS,IAAA;AAAA,MACpB,CAAC,CAAA,EAAA,GAAM,CAAA,CAAE,SAAA,IAAa,OAAA,CAAQ,SAAA,GAAY,CAAA,CAAE,SAAA,IAAa,OAAA,CAAQ,SAAA,GAAY,CAAA,CAAE,KAAA,IAAS,OAAA,CAAQ;AAAA,IAClG,CAAA;AACA,IAAA,GAAA,CAAI,CAAC,IAAA,EAAM,QAAA,CAAS,IAAA,CAAK,OAAO,CAAA;AAAA,EAClC;AACA,EAAA,OAAO,QAAA;AACT;AAhBS,qCAAA,iBAAA,EAAA,mBAAA,CAAA;AAkBF,SAAS,gBAAA,CAAiB,OAAA,EAA2C;AAC1E,EAAA,MAAM,IAAA,EAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,cAAA,EAAgB,OAAA,CAAQ,cAAA,IAAkB,IAAA;AAEhD,EAAA,MAAM,OAAA,EAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAI,GAAA,CAAI,UAAA,IAAc,OAAA,EAAS,EAAE,OAAA,EAAS,YAAY,EAAA,EAAI,CAAC,CAAA;AAAA,IAC3D,eAAA,EAAiB,IAAA;AAAA,IACjB,kBAAA,EAAoB,IAAA;AAAA,IACpB,aAAA;AAAA,IACA,YAAA,EAAc;AAAA,MACZ,aAAA,EAAe;AAAA,QACb,aAAA,EAAe;AAAA,MACjB,CAAA;AAAA;AAAA;AAAA;AAAA,MAIA,cAAA,mBAAgB,OAAA,CAAQ,cAAA,UAAkB,MAAA;AAAA,MAC1C,WAAA,EAAa,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,GAAI,cAAA,EAAgB,EAAE,0BAAA,EAA4B,KAAK,EAAA,EAAI,CAAC;AAAA,IAC9D,CAAA;AAAA,IACA,iBAAA,EAAmB,OAAA,CAAQ,UAAA;AAAA,IAC3B,cAAA,EAAgB,OAAA,CAAQ,IAAA,EAAM,CAAC,IAAA,EAAM,KAAA,EAAO,KAAK,EAAA,EAAI,CAAC,IAAA,EAAM,KAAK,CAAA;AAAA,IACjE,MAAA,EAAQ;AAAA,MACN,eAAA,mBAAiB,OAAA,CAAQ,oBAAA,UAAwB,IAAA;AAAA,MACjD,cAAA,EAAgB,iBAAA,CAAkB,GAAG,CAAA;AAAA,MACrC,uBAAA,EAAyB;AAAA,IAC3B,CAAA;AAAA,IACA,eAAA,EAAiB,KAAA;AAAA,IACjB,eAAA,EAAiB,KAAA;AAAA,IACjB,GAAA,EAAK;AAAA,MACH,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,mBAAA,mBAAqB,GAAA,CAAI,mBAAA,UAAuB,IAAA;AAAA,MAChD,4BAAA,mBAA8B,GAAA,CAAI,4BAAA,UAAgC,IAAA;AAAA,MAClE,+BAAA,mBAAiC,GAAA,CAAI,+BAAA,UAAmC,IAAA;AAAA,MACxE,GAAG,OAAA,CAAQ;AAAA,IACb,CAAA;AAAA;AAAA;AAAA,IAGA,SAAA,EAAW;AAAA,MACT,YAAA,EAAc;AAAA,QACZ,GAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,KAAA,EAAO;AACrC,IAAA,MAAA,CAAO,QAAA,EAAU,MAAA,CAAA,EAAA,GAAY,oBAAA,CAAqB,OAAA,EAAS,OAAA,CAAQ,GAAG,CAAA;AAAA,EACxE;AAEA,EAAA,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,QAAA;AAEhD,EAAA,OAAO,OAAA,CAAQ,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,MAAM,EAAA,EAAI,MAAA;AACnD;AA/DgB,qCAAA,gBAAA,EAAA,kBAAA,CAAA;AH8LhB;AACE;AACA;AACA;AACF,kHAAC","file":"/home/runner/work/nextjs-jsonapi/nextjs-jsonapi/dist/next-config/index.js","sourcesContent":[null,"// Runtime imports: none. next.config.js loads this at RUNTIME under `next start`\n// in an image installed with --prod, so it may import only Node built-ins.\n\nexport type CspDirective =\n  \"script-src\" | \"style-src\" | \"img-src\" | \"font-src\" | \"connect-src\" | \"frame-src\" | \"worker-src\";\n\n/**\n * Third-party services an app may load. Each one adds its hosts to the\n * directives it needs; nothing is allowed unless the app names it.\n *\n * - `stripe`: the billing feature (`@carlonicora/nextjs-jsonapi/billing`).\n * - `googleMaps`: `FormPlaceAutocomplete` (Places API) and Maps JS/static tiles.\n * - `turnstile`: Cloudflare Turnstile widgets (contact and waitlist forms).\n * - `discord`: Discord avatars shown for users who log in with Discord.\n * - `googleFonts`: fonts linked at runtime from Google Fonts. Not needed for\n *   `next/font/google`, which self-hosts at build time.\n */\nexport type CspService = \"stripe\" | \"googleMaps\" | \"turnstile\" | \"discord\" | \"googleFonts\";\n\nexport interface CspOptions {\n  services?: CspService[];\n  csp?: Partial<Record<CspDirective, string[]>>;\n}\n\nconst SERVICE_SOURCES: Record<CspService, Partial<Record<CspDirective, string[]>>> = {\n  stripe: {\n    \"script-src\": [\"https://js.stripe.com\"],\n    \"img-src\": [\"https://*.stripe.com\"],\n    \"connect-src\": [\"https://api.stripe.com\"],\n    \"frame-src\": [\"https://js.stripe.com\", \"https://hooks.stripe.com\"],\n  },\n  googleMaps: {\n    \"script-src\": [\"https://maps.googleapis.com\"],\n    \"img-src\": [\"https://maps.googleapis.com\", \"https://maps.gstatic.com\"],\n    \"connect-src\": [\"https://maps.googleapis.com\", \"https://places.googleapis.com\"],\n  },\n  turnstile: {\n    \"script-src\": [\"https://challenges.cloudflare.com\"],\n    \"connect-src\": [\"https://challenges.cloudflare.com\"],\n    \"frame-src\": [\"https://challenges.cloudflare.com\"],\n  },\n  discord: {\n    \"img-src\": [\"https://cdn.discordapp.com\"],\n  },\n  googleFonts: {\n    \"style-src\": [\"https://fonts.googleapis.com\"],\n    \"font-src\": [\"https://fonts.gstatic.com\"],\n  },\n};\n\nfunction listImageSources(env: NodeJS.ProcessEnv): string[] {\n  return env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((s) => s.trim()) : [];\n}\n\n/**\n * Origins of the app's own servers, the API and the corpus, from\n * `NEXT_PUBLIC_API_URL` and `NEXT_PUBLIC_CORPUS_URL`. They serve every stored\n * object link, so images and frames must be allowed from them. Unset or invalid\n * URLs are skipped; the result has no duplicates.\n */\nexport function listAppOrigins(env: NodeJS.ProcessEnv): string[] {\n  const origins: string[] = [];\n  for (const url of [env.NEXT_PUBLIC_API_URL, env.NEXT_PUBLIC_CORPUS_URL]) {\n    if (!url) continue;\n    try {\n      const { origin } = new URL(url.trim());\n      if (origin !== \"null\" && !origins.includes(origin)) origins.push(origin);\n    } catch {\n      // Not a URL: nothing to allow.\n    }\n  }\n  return origins;\n}\n\n// Build CSP directives\n// Note: 'unsafe-inline' and 'unsafe-eval' needed for Next.js dev mode and some runtime features\n// In production, consider using nonces for stricter CSP\nexport function buildCsp(options: CspOptions, env: NodeJS.ProcessEnv): string {\n  const apiUrl = env.NEXT_PUBLIC_API_URL || \"\";\n  const imageSources = listImageSources(env);\n  const appOrigins = listAppOrigins(env);\n  const services = options.services ?? [];\n\n  // Each fetch directive: what Next itself needs, then the named services, then\n  // the app's extras, then the sources derived from the env.\n  const fetchDirectives: Record<CspDirective, { base: string[]; fromEnv: string[] }> = {\n    // Scripts: self, and unsafe-inline/eval for Next.js\n    \"script-src\": { base: [\"'self'\", \"'unsafe-inline'\", \"'unsafe-eval'\"], fromEnv: [] },\n    // Styles: self and unsafe-inline for styled-components/emotion\n    \"style-src\": { base: [\"'self'\", \"'unsafe-inline'\"], fromEnv: [] },\n    // Images: self, data URIs, blobs, configured image sources, and the api/corpus origins\n    \"img-src\": { base: [\"'self'\", \"data:\", \"blob:\"], fromEnv: [...imageSources, ...appOrigins] },\n    // Fonts: self\n    \"font-src\": { base: [\"'self'\"], fromEnv: [] },\n    // Connect: self, API (http + ws for socket.io), and storage (for uploads)\n    \"connect-src\": {\n      base: [\"'self'\"],\n      fromEnv: [\n        apiUrl,\n        // Add WebSocket URL for socket.io (convert http->ws, https->wss)\n        apiUrl.replace(/^http/, \"ws\"),\n        env.NEXT_PUBLIC_ADDRESS || \"\",\n        ...imageSources,\n      ],\n    },\n    // Frames: self, and the api/corpus origins (inline previews of stored objects)\n    \"frame-src\": { base: [\"'self'\"], fromEnv: appOrigins },\n    // Worker sources: self and blob (for Web Workers with dynamic imports)\n    \"worker-src\": { base: [\"'self'\", \"blob:\"], fromEnv: [] },\n  };\n\n  const directive = (name: CspDirective): string => {\n    const { base, fromEnv } = fetchDirectives[name];\n    const fromServices = services.flatMap((service) => SERVICE_SOURCES[service][name] ?? []);\n    const sources = [...base, ...fromServices, ...(options.csp?.[name] ?? []), ...fromEnv].filter(\n      (source) => source !== \"\",\n    );\n    return [name, ...new Set(sources)].join(\" \");\n  };\n\n  return [\n    \"default-src 'self'\",\n    directive(\"script-src\"),\n    directive(\"style-src\"),\n    directive(\"img-src\"),\n    directive(\"font-src\"),\n    directive(\"connect-src\"),\n    directive(\"frame-src\"),\n    // Frame ancestors: deny embedding (equivalent to X-Frame-Options: DENY)\n    \"frame-ancestors 'none'\",\n    // Form actions: only self\n    \"form-action 'self'\",\n    // Base URI: only self\n    \"base-uri 'self'\",\n    // Object sources: none (no plugins)\n    \"object-src 'none'\",\n    directive(\"worker-src\"),\n    // Upgrade insecure requests in production.\n    //\n    // NOT under E2E_BUILD: the e2e harness runs a PRODUCTION build (for speed)\n    // and serves it over plain http on a custom hostname. With this directive\n    // the browser rewrites every /_next/static asset to https, which nothing is\n    // listening on — every chunk fails with ERR_SSL_PROTOCOL_ERROR, the page\n    // never hydrates, and each spec sees only server-rendered markup.\n    env.NODE_ENV === \"production\" && env.E2E_BUILD !== \"true\" ? \"upgrade-insecure-requests\" : \"\",\n  ]\n    .filter(Boolean)\n    .join(\"; \");\n}\n","// Runtime imports: relative only. See csp.ts.\nimport { buildCsp, type CspOptions } from \"./csp\";\n\nexport interface SecurityHeaderOptions extends CspOptions {\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n}\n\nexport interface HeaderRule {\n  source: string;\n  headers: { key: string; value: string }[];\n}\n\nexport function buildSecurityHeaders(options: SecurityHeaderOptions, env: NodeJS.ProcessEnv): HeaderRule[] {\n  const camera = options.permissionsPolicy?.camera === \"none\" ? \"\" : \"self\";\n\n  return [\n    {\n      // Apply to all routes\n      source: \"/:path*\",\n      headers: [\n        // Content Security Policy - prevents XSS attacks\n        {\n          key: \"Content-Security-Policy\",\n          value: buildCsp(options, env),\n        },\n        // X-Frame-Options - prevents clickjacking (backup for older browsers)\n        {\n          key: \"X-Frame-Options\",\n          value: \"DENY\",\n        },\n        // X-Content-Type-Options - prevents MIME sniffing\n        {\n          key: \"X-Content-Type-Options\",\n          value: \"nosniff\",\n        },\n        // Strict-Transport-Security - enforces HTTPS (1 year, include subdomains).\n        // Omitted under E2E_BUILD for the same reason as upgrade-insecure-requests:\n        // the suite speaks plain http, and an HSTS pin would force https on every\n        // later request to this host from the same browser profile.\n        ...(env.E2E_BUILD === \"true\"\n          ? []\n          : [\n              {\n                key: \"Strict-Transport-Security\",\n                value: \"max-age=31536000; includeSubDomains\",\n              },\n            ]),\n        // Referrer-Policy - controls referrer information\n        {\n          key: \"Referrer-Policy\",\n          value: \"strict-origin-when-cross-origin\",\n        },\n        // Permissions-Policy - restricts browser features\n        {\n          key: \"Permissions-Policy\",\n          value: `camera=(${camera}), microphone=(), geolocation=()`,\n        },\n      ],\n    },\n  ];\n}\n","// Shared next.config for the nja fleet. Apps wrap the result with their own\n// plugins: `withNextIntl(withMDX(createNextConfig({...})))`.\n//\n// next.config.js is loaded at RUNTIME by `next start`, and the production image\n// installs with --prod. This entry may therefore import only Node built-ins at\n// runtime: never next-intl, @next/mdx or any devDependency. `next` is\n// imported for its types only.\nimport type { NextConfig } from \"next\";\nimport { buildCsp, listAppOrigins, type CspDirective, type CspService } from \"./csp\";\nimport { buildSecurityHeaders } from \"./headers\";\n\nexport { buildCsp, listAppOrigins };\nexport type { CspDirective, CspService };\n\nexport interface NjaNextConfigOptions {\n  devOrigins: string[];\n  /** Third-party services the app loads; each adds its own hosts to the CSP. Nothing is allowed by default. */\n  services?: CspService[];\n  /** Extra CSP sources per directive, for hosts no named service covers. */\n  csp?: Partial<Record<CspDirective, string[]>>;\n  env?: Record<string, string>;\n  imageMinimumCacheTTL?: number;\n  permissionsPolicy?: { camera?: \"none\" | \"self\" };\n  mdx?: boolean;\n  securityHeaders?: boolean;\n  authInterrupts?: boolean;\n  reactCompiler?: boolean;\n  rewrites?: NextConfig[\"rewrites\"];\n  extend?: (config: NextConfig) => NextConfig;\n}\n\ntype RemotePattern = { protocol: \"http\" | \"https\"; hostname: string; port?: string };\n\n// IMAGE_SOURCES, then the api and corpus origins (they serve every stored object\n// link), without duplicates.\nfunction parseImageSources(env: NodeJS.ProcessEnv): RemotePattern[] {\n  const imageSources = env.IMAGE_SOURCES ? env.IMAGE_SOURCES.split(\",\").map((url) => url.trim()) : [];\n  const patterns: RemotePattern[] = [];\n  for (const url of [...imageSources, ...listAppOrigins(env)]) {\n    const { hostname, protocol, port } = new URL(url);\n    const pattern: RemotePattern = {\n      protocol: protocol.replace(\":\", \"\") as RemotePattern[\"protocol\"],\n      hostname,\n      port: port || undefined,\n    };\n    const seen = patterns.some(\n      (p) => p.protocol === pattern.protocol && p.hostname === pattern.hostname && p.port === pattern.port,\n    );\n    if (!seen) patterns.push(pattern);\n  }\n  return patterns;\n}\n\nexport function createNextConfig(options: NjaNextConfigOptions): NextConfig {\n  const env = process.env;\n  const reactCompiler = options.reactCompiler === true;\n\n  const config: NextConfig = {\n    // The e2e stack (scripts/e2e.sh) runs a PRODUCTION build of this app while a\n    // `next dev` server may still be running against the same worktree. `next\n    // build` and `next dev` share `.next`, so a build performed underneath a live\n    // dev server clobbers it and that dev server then 404s every route. Giving\n    // the e2e build its own directory keeps the two independent. E2E_BUILD must\n    // be set for `next build` AND for `next start`, or `start` looks in `.next`\n    // and serves someone else's output.\n    ...(env.E2E_BUILD === \"true\" ? { distDir: \".next-e2e\" } : {}),\n    cacheComponents: true,\n    partialPrefetching: true,\n    reactCompiler,\n    experimental: {\n      serverActions: {\n        bodySizeLimit: \"5mb\",\n      },\n      // Required by `unauthorized()` (next/navigation): without this flag it throws a plain\n      // Error instead of rendering the nearest unauthorized.tsx. The flag is for app code that\n      // calls it; ServerSession.checkPermission does not, it still does `redirect(\"/401\")`.\n      authInterrupts: options.authInterrupts ?? true,\n      turbopackGc: true,\n      // No turbopackLazyDynamicImports: in `next dev` it leaves this package's lazily\n      // imported request module unactivated (\"Lazily compiled dynamic import of ...\n      // JsonApiRequest ... was not activated\"), so every client-side read returns\n      // nothing. Seen with the package installed from npm; production builds are unaffected.\n      ...(reactCompiler ? { turbopackRustReactCompiler: true } : {}),\n    },\n    allowedDevOrigins: options.devOrigins,\n    pageExtensions: options.mdx ? [\"ts\", \"tsx\", \"mdx\"] : [\"ts\", \"tsx\"],\n    images: {\n      minimumCacheTTL: options.imageMinimumCacheTTL ?? 60,\n      remotePatterns: parseImageSources(env),\n      dangerouslyAllowLocalIP: true,\n    },\n    poweredByHeader: false,\n    reactStrictMode: false,\n    env: {\n      NEXT_PUBLIC_API_URL: env.NEXT_PUBLIC_API_URL ?? \"\",\n      NEXT_PUBLIC_ADDRESS: env.NEXT_PUBLIC_ADDRESS ?? \"\",\n      NEXT_PUBLIC_VAPID_PUBLIC_KEY: env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ?? \"\",\n      NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? \"\",\n      ...options.env,\n    },\n    // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a\n    // single instance in both modes.\n    turbopack: {\n      resolveAlias: {\n        yjs: \"./node_modules/yjs\",\n      },\n    },\n  };\n\n  if (options.securityHeaders !== false) {\n    config.headers = async () => buildSecurityHeaders(options, process.env);\n  }\n\n  if (options.rewrites) config.rewrites = options.rewrites;\n\n  return options.extend ? options.extend(config) : config;\n}\n"]}

package/dist/next-config/index.mjs

@@ -226,12 +226,6 @@ function createNextConfig(options) {
       NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY ?? "",
       ...options.env
     },
-    // Inlined replacement for @serwist/turbopack's withSerwist wrapper, which
-    // does nothing but append these two entries. Requiring the package here
-    // instead CRASHES production: it is a devDependency, next.config.js is loaded
-    // at RUNTIME by `next start`, and the web-production image installs with
-    // --prod. Do not re-add a require of any devDependency to this file.
-    ...options.serwist ? { serverExternalPackages: ["esbuild", "esbuild-wasm"] } : {},
     // Next 16 builds AND serves dev with Turbopack, so this is what pins yjs to a
     // single instance in both modes.
     turbopack: {