@djangocfg/nextjs 2.1.480 → 2.1.482

package/dist/config/index.d.mts

@@ -108,15 +108,43 @@ type CspVendor = keyof typeof CSP_VENDOR_PRESETS;
 /**
  * Vendors applied to every app unless explicitly disabled.
  *
- * Only for origins the DEPLOYMENT PLATFORM injects, which an app therefore
- * cannot discover by reading its own source. Cloudflare's Web Analytics beacon
- * is rewritten into the HTML at the edge, after Next.js has already sent the
- * CSP header — so an opt-in flag here reliably produces a production-only
- * console error that nobody notices until a user reports it. (Observed
- * 2026-07-22: all six DjangoCFG-served hosts were violating their own CSP.)
+ * The rule for this list: an origin belongs here when the app CANNOT DECLARE IT
+ * FROM `next.config.ts`, because whatever turns the script on lives somewhere
+ * the config file cannot read. Leaving such a vendor opt-in does not produce a
+ * build error or a dev warning — it produces a production-only console error
+ * that nobody sees until a user reports a broken page.
  *
- * Do NOT add ordinary third parties here; those belong in `csp.vendors` on the
- * app that actually uses them, so unrelated apps keep the tighter policy.
+ * - `cloudflare` — the Web Analytics beacon is rewritten into the HTML AT THE
+ *   EDGE, after Next.js has already sent the CSP header. Nothing in the source
+ *   tree reveals it. (Observed 2026-07-22: all six DjangoCFG-served hosts were
+ *   violating their own CSP.)
+ *
+ * - `google-analytics` — gtag.js is injected AT RUNTIME by `@djangocfg/layouts`
+ *   (`BaseApp analytics={{ googleTrackingId }}` → the lazy `ga4()` transport).
+ *   That id is an ordinary TS value in the app's `settings.ts`, not an env var,
+ *   so `next.config.ts` — a different module, evaluated in a different process,
+ *   before any of that code runs — has no way to see whether GA is on. The app
+ *   author enables analytics in one file and silently breaks CSP in another.
+ *   (Observed 2026-07-23: cmdop `apps/web` blocked on
+ *   `googletagmanager.com/gtag/js?id=G-YJ0F48S83F`.)
+ *
+ * - `youtube` / `vimeo` — `VideoPlayer` (`@djangocfg/ui-tools`) mounts these
+ *   iframes AT RUNTIME from a URL inside a chat message (see
+ *   `chat/messages/blocks/renderers/VideoBlock.tsx`). The app author enables a
+ *   chat; whether any user ever pastes a YouTube link is not knowable at build
+ *   time, so no `next.config.ts` can declare it honestly.
+ *
+ * Note what these have in common: the script/frame is turned on by the RUNTIME
+ * (the edge, a package, or an end user), never by the app author editing the
+ * config. Stripe is the counter-example and deliberately NOT here — a developer
+ * decides to mount a payment form, knows they did, and can say `vendors:
+ * ['stripe']`; putting it in the baseline would hand `frame-src js.stripe.com`
+ * to marketing sites that never take a payment.
+ *
+ * Do NOT add ordinary third parties here — anything an app knowingly mounts and
+ * can name in its own config belongs in `csp.vendors`, so unrelated apps keep
+ * the tighter policy. The cost of an entry here is that every app permits these
+ * hosts; that is only worth paying when the alternative is silent breakage.
  */
 declare const CSP_BASELINE_VENDORS: CspVendor[];
 /**
@@ -208,18 +236,19 @@ interface BaseNextConfigOptions {
      *   additive; omit a key to leave that directive untouched.
      * - omitted — tightest default (`frame-src 'self'`, etc.), same as today.
      *
-     * **The deployment platform counts as a vendor.** Some origins are injected
-     * into the response by the EDGE, after Next.js has emitted this header —
-     * Cloudflare Web Analytics rewrites `beacon.min.js` into the HTML when the
-     * feature is on for the zone. Nothing in the source tree reveals that, so
-     * any app served through such a zone must name the platform in `vendors`
-     * (e.g. `'cloudflare'`) or it will violate its own CSP in production only.
+     * **Scripts nothing in this file can see are already handled.** Cloudflare
+     * Web Analytics (injected at the edge) and Google Analytics (injected at
+     * runtime by `BaseApp analytics={{ googleTrackingId }}`) are both switched on
+     * outside `next.config.ts`, so their origins are in the baseline and you do
+     * NOT need to list them — see `CSP_BASELINE_VENDORS`. Turn them off with
+     * `baseline: false`.
      *
      * @example
      * ```ts
      * // Declare the third parties this app actually uses — origins come from
      * // the shared registry, so a vendor host change is fixed in one place.
-     * createBaseNextConfig({ csp: { vendors: ['stripe', 'cloudflare'] } })
+     * // (Cloudflare + GA are already in the baseline; no need to list them.)
+     * createBaseNextConfig({ csp: { vendors: ['stripe'] } })
      *
      * // Escape hatch for something not in the registry yet
      * createBaseNextConfig({ csp: { frameSrc: ['https://www.youtube-nocookie.com'] } })
@@ -237,13 +266,18 @@ interface BaseNextConfigOptions {
          */
         vendors?: (CspVendor | (string & {}))[];
         /**
-         * Cloudflare Web Analytics origins are in the baseline (see
-         * `CSP_BASELINE_VENDORS`) because DjangoCFG apps are Cloudflare-served
-         * and the beacon is injected at the edge, where no app can see it.
-         * Set `false` only for an app served off Cloudflare entirely.
+         * Drop the baseline vendors (see `CSP_BASELINE_VENDORS`: Cloudflare Web
+         * Analytics + Google Analytics). They are on by default because each is
+         * switched on somewhere `next.config.ts` cannot read — the Cloudflare
+         * beacon is injected at the edge, and gtag.js is injected at runtime by
+         * `BaseApp analytics={{ googleTrackingId }}` — so an opt-in flag would
+         * only ever be discovered as a production console error.
+         *
+         * Set `false` for an app you know mounts neither, to get back the
+         * tightest `script-src`.
          * @default true
          */
-        cloudflare?: boolean;
+        baseline?: boolean;
         /** Extra `frame-src` origins (iframes this app embeds). */
         frameSrc?: string[];
         /** Extra `script-src` origins (third-party SDK scripts). */

package/dist/config/index.mjs

@@ -14,7 +14,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@djangocfg/nextjs",
-      version: "2.1.480",
+      version: "2.1.482",
       description: "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
       keywords: [
         "nextjs",
@@ -355,7 +355,12 @@ var CSP_VENDOR_PRESETS = {
     imgSrc: ["https://i.vimeocdn.com"]
   }
 };
-var CSP_BASELINE_VENDORS = ["cloudflare"];
+var CSP_BASELINE_VENDORS = [
+  "cloudflare",
+  "google-analytics",
+  "youtube",
+  "vimeo"
+];
 function resolveCspVendors(vendors, warnUnknown = true) {
   const merged = {
     scriptSrc: [],
@@ -1500,7 +1505,7 @@ function createBaseNextConfig(options = {}) {
       const cspDisabled = options.csp === false;
       const cspExtra = typeof options.csp === "object" ? options.csp : void 0;
       const vendorNames = [
-        ...cspExtra?.cloudflare === false ? [] : CSP_BASELINE_VENDORS,
+        ...cspExtra?.baseline === false ? [] : CSP_BASELINE_VENDORS,
         ...options.stripe ? ["stripe"] : [],
         ...cspExtra?.vendors ?? []
       ];