@djangocfg/nextjs 2.1.479 → 2.1.481

package/dist/i18n/routing.d.mts

@@ -24,6 +24,7 @@ declare function createRouting(config?: Partial<I18nConfig>): {
     localePrefix?: next_intl_routing.LocalePrefix<string[], "always" | "as-needed" | "never">;
     domains?: never;
     localeCookie?: boolean | {
+        name?: string;
         maxAge?: number | undefined;
         priority?: "low" | "medium" | "high" | undefined;
         domain?: string | undefined;
@@ -31,7 +32,6 @@ declare function createRouting(config?: Partial<I18nConfig>): {
         secure?: boolean | undefined;
         sameSite?: true | false | "lax" | "strict" | "none" | undefined;
         partitioned?: boolean | undefined;
-        name?: string;
     };
     alternateLinks?: boolean;
     localeDetection?: boolean;
@@ -46,6 +46,7 @@ declare const routing: {
     localePrefix?: next_intl_routing.LocalePrefix<string[], "always" | "as-needed" | "never">;
     domains?: never;
     localeCookie?: boolean | {
+        name?: string;
         maxAge?: number | undefined;
         priority?: "low" | "medium" | "high" | undefined;
         domain?: string | undefined;
@@ -53,7 +54,6 @@ declare const routing: {
         secure?: boolean | undefined;
         sameSite?: true | false | "lax" | "strict" | "none" | undefined;
         partitioned?: boolean | undefined;
-        name?: string;
     };
     alternateLinks?: boolean;
     localeDetection?: boolean;

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 export { CreateDjangoSitemapOptions, CreateRobotsOptions, CreateSitemapIndexOptions, SitemapChunkInfo, SitemapEntry, SitemapFeedPage, SitemapIndex, SitemapSourceInfo, StaticRoute, createDjangoSitemap, createRobots, createSitemapIndex, decodeChunkId, encodeChunkId, fetchSitemapFeed, fetchSitemapIndex } from './sitemap/index.mjs';
 export { HealthCheck, HealthConfig, createHealthHandler } from './health/index.mjs';
 export { BreadcrumbItem, MenuGroup, MenuItem, NavGroup, NavGroupWithRoutes, NavigationItem, NavigationSection, RouteDefinition, RouteMetadata, defineRoute, findRoute, findRouteByPattern, getPageTitle, getUnauthenticatedRedirect, groupRoutesByNavGroups, isActive, redirectToAuth, routesToMenuItems } from './navigation/index.mjs';
-export { BaseNextConfigOptions, CompressionPluginOptions, DEFAULT_OPTIMIZE_PACKAGES, DEFAULT_TRANSPILE_PACKAGES, DJANGOCFG_PACKAGES, DJANGO_CFG_BANNER, DevStartupPlugin, DevStartupPluginOptions, InstallOptions, InstallProgress, MissingPackage, OPTIONAL_PACKAGES, PACKAGE_NAME, PEER_DEPENDENCIES, PackageDefinition, PackageVersion, UpdateOptions, addCompressionPlugins, buildInstallCommand, buildSingleInstallCommand, checkAndInstallPackages, checkAndUpdatePackages, checkForUpdate, checkForUpdates, checkPackages, createBaseNextConfig, deepMerge, detectPackageManager, fetchLatestVersion, getApiUrl, getBasePath, getCurrentVersion, getInstalledVersion, getMissingPackages, getOutdatedPackages, getPackagesForContext, getSiteUrl, getUpdateCommand, installPackages, installPackagesWithProgress, isCI, isCompressionAvailable, isDev, isPackageInstalled, isProduction, isStaticBuild, printVersionInfo, resetDevStartupState, resetInstallerPreferences, resetUpdaterPreferences, updatePackagesWithProgress } from './config/index.mjs';
+export { BaseNextConfigOptions, CSP_BASELINE_VENDORS, CSP_VENDOR_PRESETS, CompressionPluginOptions, CspOrigins, CspVendor, DEFAULT_OPTIMIZE_PACKAGES, DEFAULT_TRANSPILE_PACKAGES, DJANGOCFG_PACKAGES, DJANGO_CFG_BANNER, DevStartupPlugin, DevStartupPluginOptions, InstallOptions, InstallProgress, MissingPackage, OPTIONAL_PACKAGES, PACKAGE_NAME, PEER_DEPENDENCIES, PackageDefinition, PackageVersion, UpdateOptions, addCompressionPlugins, buildInstallCommand, buildSingleInstallCommand, checkAndInstallPackages, checkAndUpdatePackages, checkForUpdate, checkForUpdates, checkPackages, createBaseNextConfig, deepMerge, detectPackageManager, fetchLatestVersion, getApiUrl, getBasePath, getCurrentVersion, getInstalledVersion, getMissingPackages, getOutdatedPackages, getPackagesForContext, getSiteUrl, getUpdateCommand, installPackages, installPackagesWithProgress, isCI, isCompressionAvailable, isDev, isPackageInstalled, isProduction, isStaticBuild, printVersionInfo, resetDevStartupState, resetInstallerPreferences, resetUpdaterPreferences, resolveCspVendors, updatePackagesWithProgress } from './config/index.mjs';
 export { A as AI_DOCS_HINT, a as AI_HINT, M as MCP_API_URL, b as MCP_BASE_URL, c as MCP_SERVER_URL } from './constants-BDS8GXHN.mjs';
 export { DjangoCfgDocsClient, McpConfig, SearchOptions, SearchResult, getDocs, getInfo, getMcpConfig, search } from './ai/index.mjs';
 export { C as ChangeFreq, E as ErrorPageConfig, H as HealthResponse, S as SitemapConfig, a as SitemapUrl } from './types-l9x1Rkmf.mjs';

package/dist/index.mjs

@@ -14,7 +14,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@djangocfg/nextjs",
-      version: "2.1.479",
+      version: "2.1.481",
       description: "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
       keywords: [
         "nextjs",
@@ -560,6 +560,106 @@ var DEFAULT_OPTIMIZE_PACKAGES = [
   "recharts"
 ];
 
+// src/config/csp.ts
+var CSP_VENDOR_PRESETS = {
+  /**
+   * Stripe.js / Checkout / Elements.
+   *
+   * `js.stripe.com` serves the SDK and also hosts the Elements iframes;
+   * `checkout.stripe.com` is the hosted Checkout iframe; `api.stripe.com`
+   * takes the tokenization/confirm XHR. Without all three the payment form
+   * silently fails to render.
+   */
+  stripe: {
+    scriptSrc: ["https://js.stripe.com"],
+    frameSrc: ["https://js.stripe.com", "https://checkout.stripe.com"],
+    connectSrc: ["https://api.stripe.com"]
+  },
+  /**
+   * Cloudflare Web Analytics (the RUM beacon).
+   *
+   * IMPORTANT: this script is NOT in the app's own HTML — when Web Analytics
+   * is enabled on the zone, Cloudflare INJECTS `beacon.min.js` into the
+   * response at the edge, after Next.js has already emitted the CSP header.
+   * So any app served through a Cloudflare zone with that feature on will
+   * violate its own CSP unless this preset is enabled, no matter what the
+   * source tree contains. The beacon also POSTs its payload back to
+   * `cloudflareinsights.com`, hence the `connect-src` entry.
+   */
+  cloudflare: {
+    scriptSrc: ["https://static.cloudflareinsights.com"],
+    connectSrc: ["https://cloudflareinsights.com", "https://static.cloudflareinsights.com"]
+  },
+  /** Google Analytics 4 / gtag.js. */
+  "google-analytics": {
+    scriptSrc: ["https://www.googletagmanager.com", "https://www.google-analytics.com"],
+    connectSrc: [
+      "https://www.google-analytics.com",
+      "https://analytics.google.com",
+      "https://region1.google-analytics.com"
+    ],
+    imgSrc: ["https://www.google-analytics.com", "https://www.googletagmanager.com"]
+  },
+  /** Google Tag Manager (the container itself; tags it loads may need more). */
+  "google-tag-manager": {
+    scriptSrc: ["https://www.googletagmanager.com"],
+    connectSrc: ["https://www.googletagmanager.com"],
+    imgSrc: ["https://www.googletagmanager.com"],
+    frameSrc: ["https://www.googletagmanager.com"]
+  },
+  /** Google Fonts (stylesheet host + the font files themselves). */
+  "google-fonts": {
+    fontSrc: ["https://fonts.gstatic.com"]
+  },
+  /** Sentry browser SDK — errors/traces are POSTed to the ingest host. */
+  sentry: {
+    connectSrc: ["https://*.ingest.sentry.io", "https://*.sentry.io"]
+  },
+  /** YouTube embeds (privacy-enhanced host included). */
+  youtube: {
+    frameSrc: ["https://www.youtube.com", "https://www.youtube-nocookie.com"],
+    imgSrc: ["https://i.ytimg.com"]
+  },
+  /** Vimeo embeds. */
+  vimeo: {
+    frameSrc: ["https://player.vimeo.com"],
+    imgSrc: ["https://i.vimeocdn.com"]
+  }
+};
+var CSP_BASELINE_VENDORS = ["cloudflare"];
+function resolveCspVendors(vendors, warnUnknown = true) {
+  const merged = {
+    scriptSrc: [],
+    frameSrc: [],
+    connectSrc: [],
+    imgSrc: [],
+    fontSrc: []
+  };
+  if (!vendors?.length) return merged;
+  const unknown = [];
+  for (const name of vendors) {
+    const preset = CSP_VENDOR_PRESETS[name];
+    if (!preset) {
+      unknown.push(name);
+      continue;
+    }
+    for (const key of Object.keys(merged)) {
+      const origins = preset[key];
+      if (origins) merged[key].push(...origins);
+    }
+  }
+  if (unknown.length && warnUnknown) {
+    const known = Object.keys(CSP_VENDOR_PRESETS).join(", ");
+    console.warn(
+      `[djangocfg] Unknown CSP vendor(s): ${unknown.join(", ")}. Known vendors: ${known}`
+    );
+  }
+  for (const key of Object.keys(merged)) {
+    merged[key] = [...new Set(merged[key])];
+  }
+  return merged;
+}
+
 // src/config/packages/checker.ts
 import { createRequire } from "module";
 import { join } from "path";
@@ -1673,29 +1773,36 @@ function createBaseNextConfig(options = {}) {
       const frameAncestors = hasIframeAllowlist ? options.allowIframeFrom.includes("*") ? "*" : `'self' ${options.allowIframeFrom.join(" ")}` : "'none'";
       const cspDisabled = options.csp === false;
       const cspExtra = typeof options.csp === "object" ? options.csp : void 0;
-      const stripeScript = options.stripe ? " https://js.stripe.com" : "";
-      const stripeConnect = options.stripe ? " https://api.stripe.com" : "";
-      const stripeFrame = options.stripe ? " https://js.stripe.com https://checkout.stripe.com" : "";
-      const extraScript = cspExtra?.scriptSrc?.length ? " " + cspExtra.scriptSrc.join(" ") : "";
-      const extraConnect = cspExtra?.connectSrc?.length ? " " + cspExtra.connectSrc.join(" ") : "";
-      const extraFrame = cspExtra?.frameSrc?.length ? " " + cspExtra.frameSrc.join(" ") : "";
-      const extraImg = cspExtra?.imgSrc?.length ? " " + cspExtra.imgSrc.join(" ") : "";
-      const extraFont = cspExtra?.fontSrc?.length ? " " + cspExtra.fontSrc.join(" ") : "";
-      const connectSrc = isDev ? `connect-src 'self' http: https: ws: wss:${stripeConnect}${extraConnect}` : `connect-src 'self' https: wss:${stripeConnect}${extraConnect}`;
+      const vendorNames = [
+        ...cspExtra?.cloudflare === false ? [] : CSP_BASELINE_VENDORS,
+        ...options.stripe ? ["stripe"] : [],
+        ...cspExtra?.vendors ?? []
+      ];
+      const vendor = resolveCspVendors(vendorNames);
+      const join3 = (...groups) => {
+        const all = [...new Set(groups.flatMap((g) => g ?? []))];
+        return all.length ? " " + all.join(" ") : "";
+      };
+      const extraScript = join3(vendor.scriptSrc, cspExtra?.scriptSrc);
+      const extraConnect = join3(vendor.connectSrc, cspExtra?.connectSrc);
+      const extraFrame = join3(vendor.frameSrc, cspExtra?.frameSrc);
+      const extraImg = join3(vendor.imgSrc, cspExtra?.imgSrc);
+      const extraFont = join3(vendor.fontSrc, cspExtra?.fontSrc);
+      const connectSrc = isDev ? `connect-src 'self' http: https: ws: wss:${extraConnect}` : `connect-src 'self' https: wss:${extraConnect}`;
       const imgSrc = isDev ? `img-src 'self' data: blob: http: https:${extraImg}` : `img-src 'self' data: blob: https:${extraImg}`;
       if (!cspDisabled) {
         const cspDirectives = [
           "default-src 'self'",
           // Next.js requires inline + eval for its runtime/HMR. Tighten to nonces later.
-          `script-src 'self' 'unsafe-inline' 'unsafe-eval'${stripeScript}${extraScript}`,
+          `script-src 'self' 'unsafe-inline' 'unsafe-eval'${extraScript}`,
           "style-src 'self' 'unsafe-inline'",
           imgSrc,
           `font-src 'self' data:${extraFont}`,
           // API/websocket calls go cross-origin to Django/Centrifugo.
           connectSrc,
-          // Stripe Elements/Checkout and any app-declared trusted origins
-          // (options.csp.frameSrc) mount iframes; add their hosts when enabled.
-          `frame-src 'self'${stripeFrame}${extraFrame}`,
+          // Declared vendors (Stripe Elements/Checkout, video embeds…) and any
+          // app-declared trusted origins mount iframes; add their hosts here.
+          `frame-src 'self'${extraFrame}`,
           "object-src 'none'",
           "base-uri 'self'",
           "form-action 'self'",
@@ -1948,6 +2055,8 @@ function getMcpConfig() {
 export {
   AI_DOCS_HINT,
   AI_HINT,
+  CSP_BASELINE_VENDORS,
+  CSP_VENDOR_PRESETS,
   DEFAULT_OPTIMIZE_PACKAGES,
   DEFAULT_TRANSPILE_PACKAGES,
   DJANGOCFG_PACKAGES,
@@ -2012,6 +2121,7 @@ export {
   resetDevStartupState,
   resetInstallerPreferences,
   resetUpdaterPreferences,
+  resolveCspVendors,
   routesToMenuItems,
   search,
   updatePackagesWithProgress