@djangocfg/nextjs 2.1.481 → 2.1.483

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/nextjs",
-  "version": "2.1.481",
+  "version": "2.1.483",
   "description": "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
   "keywords": [
     "nextjs",
@@ -144,9 +144,9 @@
     "ai-docs": "tsx src/ai/cli.ts"
   },
   "peerDependencies": {
-    "@djangocfg/devtools": "^2.1.481",
-    "@djangocfg/i18n": "^2.1.481",
-    "@djangocfg/ui-core": "^2.1.481",
+    "@djangocfg/devtools": "^2.1.483",
+    "@djangocfg/i18n": "^2.1.483",
+    "@djangocfg/ui-core": "^2.1.483",
     "next": "^16.2.2"
   },
   "peerDependenciesMeta": {
@@ -168,11 +168,11 @@
     "serwist": "^9.5.11"
   },
   "devDependencies": {
-    "@djangocfg/devtools": "^2.1.481",
-    "@djangocfg/i18n": "^2.1.481",
-    "@djangocfg/layouts": "^2.1.481",
-    "@djangocfg/typescript-config": "^2.1.481",
-    "@djangocfg/ui-core": "^2.1.481",
+    "@djangocfg/devtools": "^2.1.483",
+    "@djangocfg/i18n": "^2.1.483",
+    "@djangocfg/layouts": "^2.1.483",
+    "@djangocfg/typescript-config": "^2.1.483",
+    "@djangocfg/ui-core": "^2.1.483",
     "@types/node": "^25.9.5",
     "@types/react": "19.2.15",
     "@types/react-dom": "19.2.3",

package/src/config/createNextConfig.ts

@@ -94,18 +94,19 @@ export interface BaseNextConfigOptions {
    *   additive; omit a key to leave that directive untouched.
    * - omitted — tightest default (`frame-src 'self'`, etc.), same as today.
    *
-   * **The deployment platform counts as a vendor.** Some origins are injected
-   * into the response by the EDGE, after Next.js has emitted this header —
-   * Cloudflare Web Analytics rewrites `beacon.min.js` into the HTML when the
-   * feature is on for the zone. Nothing in the source tree reveals that, so
-   * any app served through such a zone must name the platform in `vendors`
-   * (e.g. `'cloudflare'`) or it will violate its own CSP in production only.
+   * **Scripts nothing in this file can see are already handled.** Cloudflare
+   * Web Analytics (injected at the edge) and Google Analytics (injected at
+   * runtime by `BaseApp analytics={{ googleTrackingId }}`) are both switched on
+   * outside `next.config.ts`, so their origins are in the baseline and you do
+   * NOT need to list them — see `CSP_BASELINE_VENDORS`. Turn them off with
+   * `baseline: false`.
    *
    * @example
    * ```ts
    * // Declare the third parties this app actually uses — origins come from
    * // the shared registry, so a vendor host change is fixed in one place.
-   * createBaseNextConfig({ csp: { vendors: ['stripe', 'cloudflare'] } })
+   * // (Cloudflare + GA are already in the baseline; no need to list them.)
+   * createBaseNextConfig({ csp: { vendors: ['stripe'] } })
    *
    * // Escape hatch for something not in the registry yet
    * createBaseNextConfig({ csp: { frameSrc: ['https://www.youtube-nocookie.com'] } })
@@ -125,13 +126,18 @@ export interface BaseNextConfigOptions {
          */
         vendors?: (CspVendor | (string & {}))[];
         /**
-         * Cloudflare Web Analytics origins are in the baseline (see
-         * `CSP_BASELINE_VENDORS`) because DjangoCFG apps are Cloudflare-served
-         * and the beacon is injected at the edge, where no app can see it.
-         * Set `false` only for an app served off Cloudflare entirely.
+         * Drop the baseline vendors (see `CSP_BASELINE_VENDORS`: Cloudflare Web
+         * Analytics + Google Analytics). They are on by default because each is
+         * switched on somewhere `next.config.ts` cannot read — the Cloudflare
+         * beacon is injected at the edge, and gtag.js is injected at runtime by
+         * `BaseApp analytics={{ googleTrackingId }}` — so an opt-in flag would
+         * only ever be discovered as a production console error.
+         *
+         * Set `false` for an app you know mounts neither, to get back the
+         * tightest `script-src`.
          * @default true
          */
-        cloudflare?: boolean;
+        baseline?: boolean;
         /** Extra `frame-src` origins (iframes this app embeds). */
         frameSrc?: string[];
         /** Extra `script-src` origins (third-party SDK scripts). */
@@ -287,13 +293,15 @@ export function createBaseNextConfig(
       // "which hosts does Stripe need" is answered in exactly one place. The
       // legacy `stripe: true` flag is just sugar for `vendors: ['stripe']` and
       // resolves through that same registry — no second copy of the origins.
-      // Baseline vendors apply unless explicitly opted out. Cloudflare is in
-      // here rather than per-app because the edge injects its beacon into the
-      // response AFTER this header is emitted — an app cannot detect that from
-      // its own source, so leaving it opt-in guarantees a silent production
-      // breakage in every app that forgets it (which was all of them).
+      // Baseline vendors apply unless explicitly opted out. They are baseline
+      // rather than per-app because each is enabled somewhere this file cannot
+      // read — Cloudflare's beacon is injected by the edge after this header is
+      // emitted, and gtag.js is injected at runtime by `BaseApp analytics={{
+      // googleTrackingId }}` from the app's settings.ts. Leaving either opt-in
+      // guarantees a silent production breakage in every app that forgets it
+      // (which was all of them). See CSP_BASELINE_VENDORS for the full rule.
       const vendorNames = [
-        ...(cspExtra?.cloudflare === false ? [] : CSP_BASELINE_VENDORS),
+        ...(cspExtra?.baseline === false ? [] : CSP_BASELINE_VENDORS),
         ...(options.stripe ? ['stripe'] : []),
         ...(cspExtra?.vendors ?? []),
       ];

package/src/config/csp.ts

@@ -116,17 +116,50 @@ export type CspVendor = keyof typeof CSP_VENDOR_PRESETS;
 /**
  * Vendors applied to every app unless explicitly disabled.
  *
- * Only for origins the DEPLOYMENT PLATFORM injects, which an app therefore
- * cannot discover by reading its own source. Cloudflare's Web Analytics beacon
- * is rewritten into the HTML at the edge, after Next.js has already sent the
- * CSP header — so an opt-in flag here reliably produces a production-only
- * console error that nobody notices until a user reports it. (Observed
- * 2026-07-22: all six DjangoCFG-served hosts were violating their own CSP.)
+ * The rule for this list: an origin belongs here when the app CANNOT DECLARE IT
+ * FROM `next.config.ts`, because whatever turns the script on lives somewhere
+ * the config file cannot read. Leaving such a vendor opt-in does not produce a
+ * build error or a dev warning — it produces a production-only console error
+ * that nobody sees until a user reports a broken page.
  *
- * Do NOT add ordinary third parties here; those belong in `csp.vendors` on the
- * app that actually uses them, so unrelated apps keep the tighter policy.
+ * - `cloudflare` — the Web Analytics beacon is rewritten into the HTML AT THE
+ *   EDGE, after Next.js has already sent the CSP header. Nothing in the source
+ *   tree reveals it. (Observed 2026-07-22: all six DjangoCFG-served hosts were
+ *   violating their own CSP.)
+ *
+ * - `google-analytics` — gtag.js is injected AT RUNTIME by `@djangocfg/layouts`
+ *   (`BaseApp analytics={{ googleTrackingId }}` → the lazy `ga4()` transport).
+ *   That id is an ordinary TS value in the app's `settings.ts`, not an env var,
+ *   so `next.config.ts` — a different module, evaluated in a different process,
+ *   before any of that code runs — has no way to see whether GA is on. The app
+ *   author enables analytics in one file and silently breaks CSP in another.
+ *   (Observed 2026-07-23: cmdop `apps/web` blocked on
+ *   `googletagmanager.com/gtag/js?id=G-YJ0F48S83F`.)
+ *
+ * - `youtube` / `vimeo` — `VideoPlayer` (`@djangocfg/ui-tools`) mounts these
+ *   iframes AT RUNTIME from a URL inside a chat message (see
+ *   `chat/messages/blocks/renderers/VideoBlock.tsx`). The app author enables a
+ *   chat; whether any user ever pastes a YouTube link is not knowable at build
+ *   time, so no `next.config.ts` can declare it honestly.
+ *
+ * Note what these have in common: the script/frame is turned on by the RUNTIME
+ * (the edge, a package, or an end user), never by the app author editing the
+ * config. Stripe is the counter-example and deliberately NOT here — a developer
+ * decides to mount a payment form, knows they did, and can say `vendors:
+ * ['stripe']`; putting it in the baseline would hand `frame-src js.stripe.com`
+ * to marketing sites that never take a payment.
+ *
+ * Do NOT add ordinary third parties here — anything an app knowingly mounts and
+ * can name in its own config belongs in `csp.vendors`, so unrelated apps keep
+ * the tighter policy. The cost of an entry here is that every app permits these
+ * hosts; that is only worth paying when the alternative is silent breakage.
  */
-export const CSP_BASELINE_VENDORS: CspVendor[] = ['cloudflare'];
+export const CSP_BASELINE_VENDORS: CspVendor[] = [
+  'cloudflare',
+  'google-analytics',
+  'youtube',
+  'vimeo',
+];
 
 /**
  * Merge the named vendor presets into a single set of extra origins.