@djangocfg/nextjs 2.1.426 → 2.1.428

package/dist/i18n/request.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/i18n/request.ts","../../src/i18n/routing.ts"],"sourcesContent":["/**\n * i18n Request Configuration for Server Components\n *\n * Provides translations to server components via next-intl's request scope\n *\n * @example\n * ```ts\n * // i18n/request.ts in your app\n * import { createRequestConfig } from '@djangocfg/nextjs/i18n';\n * import { en, ru, ko } from '@djangocfg/i18n';\n * import { leadsI18n } from '@djangocfg/ext-leads';\n *\n * export default createRequestConfig({\n *   locales: { en, ru, ko },\n *   extensions: [leadsI18n],\n * });\n * ```\n */\n\nimport { getRequestConfig } from 'next-intl/server';\n\nimport { en, ko, mergeTranslations, ru } from '@djangocfg/i18n';\n\nimport { routing } from './routing';\n\nimport type { I18nTranslations, LocaleCode } from '@djangocfg/i18n';\nimport type { Messages } from './types';\n// ─────────────────────────────────────────────────────────────────────────────\n// Types\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface RequestConfigOptions {\n  /** Base locale translations from @djangocfg/i18n */\n  locales?: Record<LocaleCode, I18nTranslations>;\n  /** Extension i18n instances to merge */\n  extensions?: Array<{\n    namespace: string;\n    locales: Record<string, Record<string, unknown>>;\n  }>;\n  /** Custom message loader (overrides locales) */\n  loadMessages?: (locale: LocaleCode) => Promise<Messages> | Messages;\n  /** Time zone for date/time formatting */\n  timeZone?: string;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Default Locales\n// ─────────────────────────────────────────────────────────────────────────────\n\nconst DEFAULT_LOCALES: Record<LocaleCode, I18nTranslations> = {\n  en,\n  ru,\n  ko,\n};\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Message Loading\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Load and merge messages for a locale\n */\nfunction loadMessages(\n  locale: LocaleCode,\n  options: RequestConfigOptions\n): Messages {\n  // Get base translations\n  const locales = options.locales ?? DEFAULT_LOCALES;\n  const baseMessages = locales[locale] ?? locales.en ?? en;\n\n  // If no extensions, return base\n  if (!options.extensions?.length) {\n    return baseMessages as Messages;\n  }\n\n  // Merge extension translations\n  let mergedMessages = { ...baseMessages } as Messages;\n\n  for (const extension of options.extensions) {\n    const extMessages = extension.locales[locale] ?? extension.locales.en;\n    if (extMessages) {\n      mergedMessages = mergeTranslations(mergedMessages, {\n        [extension.namespace]: extMessages,\n      }) as Messages;\n    }\n  }\n\n  return mergedMessages;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Request Config Factory\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Create request configuration for next-intl\n *\n * This is used in your app's `i18n/request.ts` file\n *\n * @example\n * ```ts\n * // i18n/request.ts\n * import { createRequestConfig } from '@djangocfg/nextjs/i18n';\n * import { leadsI18n } from '@djangocfg/ext-leads';\n * import { paymentsI18n } from '@djangocfg/ext-payments';\n *\n * export default createRequestConfig({\n *   extensions: [leadsI18n, paymentsI18n],\n * });\n * ```\n */\nexport function createRequestConfig(options: RequestConfigOptions = {}) {\n  return getRequestConfig(async ({ requestLocale }) => {\n    // Get locale from request or default\n    let locale = await requestLocale;\n\n    // Validate and fallback to default\n    if (!locale || !routing.locales.includes(locale as LocaleCode)) {\n      locale = routing.defaultLocale;\n    }\n\n    // Load messages\n    const messages = options.loadMessages\n      ? await options.loadMessages(locale as LocaleCode)\n      : loadMessages(locale as LocaleCode, options);\n\n    return {\n      locale,\n      messages,\n      timeZone: options.timeZone ?? 'UTC',\n    };\n  });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Default Export\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Default request config with base @djangocfg/i18n translations\n * Can be used directly if no extensions are needed\n */\nexport default createRequestConfig();\n","/**\n * i18n Routing Configuration\n *\n * Creates routing configuration for next-intl\n * Used by proxy and navigation components\n */\n\nimport { defineRouting } from 'next-intl/routing';\n\nimport type { I18nConfig, LocaleCode } from './types';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Default Configuration\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport const DEFAULT_LOCALES: LocaleCode[] = ['en', 'ru', 'ko', 'ja', 'de', 'fr', 'zh', 'it', 'es', 'nl', 'ar', 'tr', 'pt-BR', 'pl', 'sv', 'no', 'da'];\nexport const DEFAULT_LOCALE: LocaleCode = 'en';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Routing Factory\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Create routing configuration for next-intl\n *\n * @example\n * ```ts\n * // i18n/routing.ts\n * import { createRouting } from '@djangocfg/nextjs/i18n';\n *\n * export const routing = createRouting({\n *   locales: ['en', 'ru', 'ko'],\n *   defaultLocale: 'en',\n * });\n * ```\n */\nexport function createRouting(config?: Partial<I18nConfig>) {\n  const locales = config?.locales ?? DEFAULT_LOCALES;\n  const defaultLocale = config?.defaultLocale ?? DEFAULT_LOCALE;\n  const localePrefix = config?.localePrefix ?? 'as-needed';\n\n  return defineRouting({\n    locales,\n    defaultLocale,\n    localePrefix,\n  });\n}\n\n/**\n * Default routing configuration\n * Can be overridden by app-specific configuration\n */\nexport const routing = createRouting();\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Locale Utilities\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Check if a locale is supported\n */\nexport function isValidLocale(\n  locale: string,\n  supportedLocales: readonly string[] = DEFAULT_LOCALES\n): locale is LocaleCode {\n  return supportedLocales.includes(locale as LocaleCode);\n}\n\n/**\n * Get locale from params (handles async params in Next.js 15+)\n */\nexport async function getLocaleFromParams(\n  params: Promise<{ locale: string }> | { locale: string }\n): Promise<LocaleCode> {\n  const resolved = await params;\n  return resolved.locale as LocaleCode;\n}\n\n/**\n * Generate static params for all locales\n * Use in generateStaticParams for locale pages\n */\nexport function generateLocaleParams(locales: readonly string[] = DEFAULT_LOCALES) {\n  return locales.map((locale) => ({ locale }));\n}\n"],"mappings":";AAmBA,SAAS,wBAAwB;AAEjC,SAAS,IAAI,IAAI,mBAAmB,UAAU;;;ACd9C,SAAS,qBAAqB;AAQvB,IAAM,kBAAgC,CAAC,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,MAAM,MAAM,MAAM,IAAI;AAC9I,IAAM,iBAA6B;AAoBnC,SAAS,cAAc,QAA8B;AAC1D,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,eAAe,QAAQ,gBAAgB;AAE7C,SAAO,cAAc;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAMO,IAAM,UAAU,cAAc;;;ADHrC,IAAMA,mBAAwD;AAAA,EAC5D;AAAA,EACA;AAAA,EACA;AACF;AASA,SAAS,aACP,QACA,SACU;AAEV,QAAM,UAAU,QAAQ,WAAWA;AACnC,QAAM,eAAe,QAAQ,MAAM,KAAK,QAAQ,MAAM;AAGtD,MAAI,CAAC,QAAQ,YAAY,QAAQ;AAC/B,WAAO;AAAA,EACT;AAGA,MAAI,iBAAiB,EAAE,GAAG,aAAa;AAEvC,aAAW,aAAa,QAAQ,YAAY;AAC1C,UAAM,cAAc,UAAU,QAAQ,MAAM,KAAK,UAAU,QAAQ;AACnE,QAAI,aAAa;AACf,uBAAiB,kBAAkB,gBAAgB;AAAA,QACjD,CAAC,UAAU,SAAS,GAAG;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAuBO,SAAS,oBAAoB,UAAgC,CAAC,GAAG;AACtE,SAAO,iBAAiB,OAAO,EAAE,cAAc,MAAM;AAEnD,QAAI,SAAS,MAAM;AAGnB,QAAI,CAAC,UAAU,CAAC,QAAQ,QAAQ,SAAS,MAAoB,GAAG;AAC9D,eAAS,QAAQ;AAAA,IACnB;AAGA,UAAM,WAAW,QAAQ,eACrB,MAAM,QAAQ,aAAa,MAAoB,IAC/C,aAAa,QAAsB,OAAO;AAE9C,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,UAAU,QAAQ,YAAY;AAAA,IAChC;AAAA,EACF,CAAC;AACH;AAUA,IAAO,kBAAQ,oBAAoB;","names":["DEFAULT_LOCALES"]}
+{"version":3,"sources":["../../src/i18n/request.ts","../../src/i18n/routing.ts"],"sourcesContent":["/**\n * i18n Request Configuration for Server Components\n *\n * Provides translations to server components via next-intl's request scope\n *\n * @example\n * ```ts\n * // i18n/request.ts in your app\n * import { createRequestConfig } from '@djangocfg/nextjs/i18n';\n * import { en, ru, ko } from '@djangocfg/i18n';\n *\n * export default createRequestConfig({\n *   locales: { en, ru, ko },\n * });\n * ```\n */\n\nimport { getRequestConfig } from 'next-intl/server';\n\nimport { en, ko, mergeTranslations, ru } from '@djangocfg/i18n';\n\nimport { routing } from './routing';\n\nimport type { I18nTranslations, LocaleCode } from '@djangocfg/i18n';\nimport type { Messages } from './types';\n// ─────────────────────────────────────────────────────────────────────────────\n// Types\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface RequestConfigOptions {\n  /** Base locale translations from @djangocfg/i18n */\n  locales?: Record<LocaleCode, I18nTranslations>;\n  /** Extension i18n instances to merge */\n  extensions?: Array<{\n    namespace: string;\n    locales: Record<string, Record<string, unknown>>;\n  }>;\n  /** Custom message loader (overrides locales) */\n  loadMessages?: (locale: LocaleCode) => Promise<Messages> | Messages;\n  /** Time zone for date/time formatting */\n  timeZone?: string;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Default Locales\n// ─────────────────────────────────────────────────────────────────────────────\n\nconst DEFAULT_LOCALES: Record<LocaleCode, I18nTranslations> = {\n  en,\n  ru,\n  ko,\n};\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Message Loading\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Load and merge messages for a locale\n */\nfunction loadMessages(\n  locale: LocaleCode,\n  options: RequestConfigOptions\n): Messages {\n  // Get base translations\n  const locales = options.locales ?? DEFAULT_LOCALES;\n  const baseMessages = locales[locale] ?? locales.en ?? en;\n\n  // If no extensions, return base\n  if (!options.extensions?.length) {\n    return baseMessages as Messages;\n  }\n\n  // Merge extension translations\n  let mergedMessages = { ...baseMessages } as Messages;\n\n  for (const extension of options.extensions) {\n    const extMessages = extension.locales[locale] ?? extension.locales.en;\n    if (extMessages) {\n      mergedMessages = mergeTranslations(mergedMessages, {\n        [extension.namespace]: extMessages,\n      }) as Messages;\n    }\n  }\n\n  return mergedMessages;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Request Config Factory\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Create request configuration for next-intl\n *\n * This is used in your app's `i18n/request.ts` file\n *\n * @example\n * ```ts\n * // i18n/request.ts\n * import { createRequestConfig } from '@djangocfg/nextjs/i18n';\n *\n * // `extensions` merges extra namespaced translation bundles, each shaped\n * // as `{ namespace: string, locales: Record<LocaleCode, Messages> }`.\n * export default createRequestConfig({\n *   extensions: [myFeatureI18n],\n * });\n * ```\n */\nexport function createRequestConfig(options: RequestConfigOptions = {}) {\n  return getRequestConfig(async ({ requestLocale }) => {\n    // Get locale from request or default\n    let locale = await requestLocale;\n\n    // Validate and fallback to default\n    if (!locale || !routing.locales.includes(locale as LocaleCode)) {\n      locale = routing.defaultLocale;\n    }\n\n    // Load messages\n    const messages = options.loadMessages\n      ? await options.loadMessages(locale as LocaleCode)\n      : loadMessages(locale as LocaleCode, options);\n\n    return {\n      locale,\n      messages,\n      timeZone: options.timeZone ?? 'UTC',\n    };\n  });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Default Export\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Default request config with base @djangocfg/i18n translations\n * Can be used directly if no extensions are needed\n */\nexport default createRequestConfig();\n","/**\n * i18n Routing Configuration\n *\n * Creates routing configuration for next-intl\n * Used by proxy and navigation components\n */\n\nimport { defineRouting } from 'next-intl/routing';\n\nimport type { I18nConfig, LocaleCode } from './types';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Default Configuration\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport const DEFAULT_LOCALES: LocaleCode[] = ['en', 'ru', 'ko', 'ja', 'de', 'fr', 'zh', 'it', 'es', 'nl', 'ar', 'tr', 'pt-BR', 'pl', 'sv', 'no', 'da'];\nexport const DEFAULT_LOCALE: LocaleCode = 'en';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Routing Factory\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Create routing configuration for next-intl\n *\n * @example\n * ```ts\n * // i18n/routing.ts\n * import { createRouting } from '@djangocfg/nextjs/i18n';\n *\n * export const routing = createRouting({\n *   locales: ['en', 'ru', 'ko'],\n *   defaultLocale: 'en',\n * });\n * ```\n */\nexport function createRouting(config?: Partial<I18nConfig>) {\n  const locales = config?.locales ?? DEFAULT_LOCALES;\n  const defaultLocale = config?.defaultLocale ?? DEFAULT_LOCALE;\n  const localePrefix = config?.localePrefix ?? 'as-needed';\n\n  return defineRouting({\n    locales,\n    defaultLocale,\n    localePrefix,\n  });\n}\n\n/**\n * Default routing configuration\n * Can be overridden by app-specific configuration\n */\nexport const routing = createRouting();\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Locale Utilities\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Check if a locale is supported\n */\nexport function isValidLocale(\n  locale: string,\n  supportedLocales: readonly string[] = DEFAULT_LOCALES\n): locale is LocaleCode {\n  return supportedLocales.includes(locale as LocaleCode);\n}\n\n/**\n * Get locale from params (handles async params in Next.js 15+)\n */\nexport async function getLocaleFromParams(\n  params: Promise<{ locale: string }> | { locale: string }\n): Promise<LocaleCode> {\n  const resolved = await params;\n  return resolved.locale as LocaleCode;\n}\n\n/**\n * Generate static params for all locales\n * Use in generateStaticParams for locale pages\n */\nexport function generateLocaleParams(locales: readonly string[] = DEFAULT_LOCALES) {\n  return locales.map((locale) => ({ locale }));\n}\n"],"mappings":";AAiBA,SAAS,wBAAwB;AAEjC,SAAS,IAAI,IAAI,mBAAmB,UAAU;;;ACZ9C,SAAS,qBAAqB;AAQvB,IAAM,kBAAgC,CAAC,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,MAAM,MAAM,MAAM,IAAI;AAC9I,IAAM,iBAA6B;AAoBnC,SAAS,cAAc,QAA8B;AAC1D,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,eAAe,QAAQ,gBAAgB;AAE7C,SAAO,cAAc;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAMO,IAAM,UAAU,cAAc;;;ADLrC,IAAMA,mBAAwD;AAAA,EAC5D;AAAA,EACA;AAAA,EACA;AACF;AASA,SAAS,aACP,QACA,SACU;AAEV,QAAM,UAAU,QAAQ,WAAWA;AACnC,QAAM,eAAe,QAAQ,MAAM,KAAK,QAAQ,MAAM;AAGtD,MAAI,CAAC,QAAQ,YAAY,QAAQ;AAC/B,WAAO;AAAA,EACT;AAGA,MAAI,iBAAiB,EAAE,GAAG,aAAa;AAEvC,aAAW,aAAa,QAAQ,YAAY;AAC1C,UAAM,cAAc,UAAU,QAAQ,MAAM,KAAK,UAAU,QAAQ;AACnE,QAAI,aAAa;AACf,uBAAiB,kBAAkB,gBAAgB;AAAA,QACjD,CAAC,UAAU,SAAS,GAAG;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAuBO,SAAS,oBAAoB,UAAgC,CAAC,GAAG;AACtE,SAAO,iBAAiB,OAAO,EAAE,cAAc,MAAM;AAEnD,QAAI,SAAS,MAAM;AAGnB,QAAI,CAAC,UAAU,CAAC,QAAQ,QAAQ,SAAS,MAAoB,GAAG;AAC9D,eAAS,QAAQ;AAAA,IACnB;AAGA,UAAM,WAAW,QAAQ,eACrB,MAAM,QAAQ,aAAa,MAAoB,IAC/C,aAAa,QAAsB,OAAO;AAE9C,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,UAAU,QAAQ,YAAY;AAAA,IAChC;AAAA,EACF,CAAC;AACH;AAUA,IAAO,kBAAQ,oBAAoB;","names":["DEFAULT_LOCALES"]}

package/dist/index.mjs

@@ -14,7 +14,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@djangocfg/nextjs",
-      version: "2.1.426",
+      version: "2.1.428",
       description: "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
       keywords: [
         "nextjs",
@@ -534,7 +534,6 @@ var DJANGO_CFG_BANNER = `
 `;
 var DJANGOCFG_PACKAGES = [
   "@djangocfg/ui-core",
-  "@djangocfg/ui-nextjs",
   "@djangocfg/layouts",
   "@djangocfg/nextjs",
   "@djangocfg/api",
@@ -545,20 +544,15 @@ var DJANGOCFG_PACKAGES = [
 var DEFAULT_TRANSPILE_PACKAGES = [
   "@djangocfg/i18n",
   "@djangocfg/ui-core",
-  "@djangocfg/ui-nextjs",
   "@djangocfg/layouts",
   "@djangocfg/ui-tools",
   "@djangocfg/api",
   "@djangocfg/centrifugo",
   "@djangocfg/debuger",
-  "@djangocfg/monitor",
-  // Extensions (for source imports without build)
-  "@djangocfg/ext-support",
-  "@djangocfg/ext-payments"
+  "@djangocfg/monitor"
 ];
 var DEFAULT_OPTIMIZE_PACKAGES = [
   "@djangocfg/ui-core",
-  "@djangocfg/ui-nextjs",
   "@djangocfg/layouts",
   "lucide-react",
   "recharts"
@@ -1627,6 +1621,10 @@ function createBaseNextConfig(options = {}) {
   const baseConfig = {
     reactStrictMode: true,
     trailingSlash: true,
+    // Dev indicator position — set explicitly so it's managed from one place
+    // across every @djangocfg app. Apps can override via `devIndicators` in
+    // their options (deep-merged over this). Kept bottom-left for now.
+    devIndicators: { position: "bottom-left" },
     // Static export configuration
     ...isStaticBuild && {
       output: "export",
@@ -1646,6 +1644,9 @@ function createBaseNextConfig(options = {}) {
       NEXT_PUBLIC_BASE_PATH: basePath,
       NEXT_PUBLIC_API_URL: apiUrl,
       NEXT_PUBLIC_SITE_URL: siteUrl,
+      // DPoP toggle for the generated auth client (RFC 9449). Only inlined when
+      // explicitly enabled, so non-DPoP apps stay on the plain Bearer path.
+      ...options.dpop ? { NEXT_PUBLIC_DPOP_ENABLED: "true" } : {},
       // Disable Next.js telemetry (Next.js 15+ uses env var instead of config option)
       NEXT_TELEMETRY_DISABLED: "1",
       ...options.env
@@ -1666,19 +1667,35 @@ function createBaseNextConfig(options = {}) {
           ]
         }
       ];
-      if (options.allowIframeFrom && options.allowIframeFrom.length > 0) {
-        const frameAncestors = options.allowIframeFrom.includes("*") ? "*" : `'self' ${options.allowIframeFrom.join(" ")}`;
-        headers.push({
-          source: "/:path*",
-          headers: [
-            // Content-Security-Policy frame-ancestors directive
-            { key: "Content-Security-Policy", value: `frame-ancestors ${frameAncestors}` },
-            // X-Frame-Options for older browsers (ALLOW-FROM is deprecated, use CSP instead)
-            // Only set SAMEORIGIN if allowing all, otherwise browsers will use CSP
-            ...options.allowIframeFrom.includes("*") ? [] : [{ key: "X-Frame-Options", value: "SAMEORIGIN" }]
-          ]
-        });
-      }
+      const hasIframeAllowlist = !!options.allowIframeFrom && options.allowIframeFrom.length > 0;
+      const frameAncestors = hasIframeAllowlist ? options.allowIframeFrom.includes("*") ? "*" : `'self' ${options.allowIframeFrom.join(" ")}` : "'none'";
+      const connectSrc = isDev ? "connect-src 'self' http: https: ws: wss:" : "connect-src 'self' https: wss:";
+      const imgSrc = isDev ? "img-src 'self' data: blob: http: https:" : "img-src 'self' data: blob: https:";
+      const cspDirectives = [
+        "default-src 'self'",
+        // Next.js requires inline + eval for its runtime/HMR. Tighten to nonces later.
+        "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
+        "style-src 'self' 'unsafe-inline'",
+        imgSrc,
+        "font-src 'self' data:",
+        // API/websocket calls go cross-origin to Django/Centrifugo.
+        connectSrc,
+        "object-src 'none'",
+        "base-uri 'self'",
+        "form-action 'self'",
+        `frame-ancestors ${frameAncestors}`
+      ];
+      headers.push({
+        source: "/:path*",
+        headers: [
+          { key: "X-Content-Type-Options", value: "nosniff" },
+          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+          { key: "Content-Security-Policy", value: cspDirectives.join("; ") },
+          // X-Frame-Options for older browsers. Omitted when a wildcard iframe
+          // allowlist is set (browsers then rely on CSP frame-ancestors).
+          ...hasIframeAllowlist && options.allowIframeFrom.includes("*") ? [] : [{ key: "X-Frame-Options", value: hasIframeAllowlist ? "SAMEORIGIN" : "DENY" }]
+        ]
+      });
       const userHeaders = options.headers ? await options.headers() : [];
       return [...headers, ...userHeaders];
     },
@@ -1780,6 +1797,7 @@ function createBaseNextConfig(options = {}) {
     checkPackages: checkPackages2,
     autoInstall,
     allowIframeFrom,
+    dpop,
     ...nextConfigOptions
   } = options;
   let finalConfig = deepMerge(baseConfig, nextConfigOptions);