@djangocfg/nextjs 2.1.540 → 2.1.542

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/README.md +3 -2
  2. package/dist/config/index.d.mts +10 -7
  3. package/dist/config/index.mjs +18 -5
  4. package/dist/config/index.mjs.map +1 -1
  5. package/dist/i18n/routing.d.mts +2 -2
  6. package/dist/index.mjs +18 -5
  7. package/dist/index.mjs.map +1 -1
  8. package/package.json +9 -9
  9. package/src/config/constants.ts +21 -4
  10. package/src/config/createNextConfig.ts +2 -2
  11. package/src/config/csp.ts +8 -5
package/README.md CHANGED
@@ -122,8 +122,9 @@ the box — no setup required:
122
122
  - `Content-Security-Policy` — a pragmatic baseline that blocks the high-value
123
123
  injection vectors (`object-src 'none'`, `base-uri 'self'`, `form-action 'self'`,
124
124
  `frame-ancestors`) while keeping the inline/eval scripts a Next.js app needs.
125
- **Dev-aware:** `connect-src`/`img-src` allow `http:`/`ws:` in development (local
126
- Django/Centrifugo) and tighten to `https:`/`wss:` only in production.
125
+ **Dev-aware:** `connect-src`/`img-src` allow `http:`/`ws:` in development (a
126
+ local Django, plus any WebSocket transport the app brings itself) and tighten
127
+ to `https:`/`wss:` only in production.
127
128
  - `X-Content-Type-Options: nosniff`, `Referrer-Policy: strict-origin-when-cross-origin`
128
129
  - `X-Frame-Options: DENY` (or `SAMEORIGIN` when `allowIframeFrom` is set)
129
130
 
package/dist/config/index.d.mts CHANGED
@@ -128,11 +128,14 @@ type CspVendor = keyof typeof CSP_VENDOR_PRESETS;
128
128
  * (Observed 2026-07-23: cmdop `apps/web` blocked on
129
129
  * `googletagmanager.com/gtag/js?id=G-YJ0F48S83F`.)
130
130
  *
131
- * - `youtube` / `vimeo` — `VideoPlayer` (`@djangocfg/ui-tools`) mounts these
132
- * iframes AT RUNTIME from a URL inside a chat message (see
133
- * `chat/messages/blocks/renderers/VideoBlock.tsx`). The app author enables a
134
- * chat; whether any user ever pastes a YouTube link is not knowable at build
135
- * time, so no `next.config.ts` can declare it honestly.
131
+ * - `youtube` / `vimeo` — these existed for `VideoPlayer`
132
+ * (`@djangocfg/ui-tools`), which mounted the iframes AT RUNTIME from a URL
133
+ * inside a chat message. That player was retired with `ui-tools`;
134
+ * `@djangocfg/widget-player` embeds no third-party frames, so **nothing in
135
+ * this repo needs these presets today**. They are kept because the shape of
136
+ * the problem outlives the component: an app author enables a chat, and
137
+ * whether a user ever pastes a YouTube link is not knowable at build time,
138
+ * so no `next.config.ts` can declare it honestly.
136
139
  *
137
140
  * Note what these have in common: the script/frame is turned on by the RUNTIME
138
141
  * (the edge, a package, or an end user), never by the app author editing the
@@ -342,8 +345,8 @@ declare function createBaseNextConfig(options?: BaseNextConfigOptions): NextConf
342
345
  */
343
346
  declare const PACKAGE_NAME = "@djangocfg/nextjs";
344
347
  declare const DJANGO_CFG_BANNER = "\n\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557 \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557\n\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D \u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557 \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\n\u2588\u2588\u2551 \u2588\u2588\u2551 \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2551 \u2588\u2588\u2588\u2557\u2588\u2588\u2551 \u2588\u2588\u2551 \u2588\u2588\u2551 \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2551 \u2588\u2588\u2588\u2557\n\u2588\u2588\u2551 \u2588\u2588\u2551\u2588\u2588 \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551 \u2588\u2588\u2551\u2588\u2588\u2551 \u2588\u2588\u2551 \u2588\u2588\u2551 \u2588\u2588\u2554\u2550\u2550\u255D \u2588\u2588\u2551 \u2588\u2588\u2551\n\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u255A\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551 \u2588\u2588\u2551\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D \u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\n\u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D \u255A\u2550\u255D\u255A\u2550\u255D \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D\n";
345
- declare const DJANGOCFG_PACKAGES: readonly ["@djangocfg/ui-core", "@djangocfg/layouts", "@djangocfg/nextjs", "@djangocfg/api", "@djangocfg/centrifugo", "@djangocfg/eslint-config", "@djangocfg/typescript-config"];
346
- declare const DEFAULT_TRANSPILE_PACKAGES: readonly ["@djangocfg/i18n", "@djangocfg/ui-core", "@djangocfg/layouts", "@djangocfg/ui-tools", "@djangocfg/api", "@djangocfg/analytics", "@djangocfg/centrifugo", "@djangocfg/devtools", "@djangocfg/payments"];
348
+ declare const DJANGOCFG_PACKAGES: readonly ["@djangocfg/ui-core", "@djangocfg/layouts", "@djangocfg/nextjs", "@djangocfg/api", "@djangocfg/eslint-config", "@djangocfg/typescript-config"];
349
+ declare const DEFAULT_TRANSPILE_PACKAGES: readonly ["@djangocfg/i18n", "@djangocfg/ui-core", "@djangocfg/layouts", "@djangocfg/api", "@djangocfg/analytics", "@djangocfg/devtools", "@djangocfg/payments", "@djangocfg/widget-agent", "@djangocfg/widget-avatar", "@djangocfg/widget-charts", "@djangocfg/widget-chat", "@djangocfg/widget-code", "@djangocfg/widget-data", "@djangocfg/widget-diagram", "@djangocfg/widget-editor", "@djangocfg/widget-forms", "@djangocfg/widget-kit", "@djangocfg/widget-map", "@djangocfg/widget-media", "@djangocfg/widget-ogimage", "@djangocfg/widget-overlay", "@djangocfg/widget-player", "@djangocfg/widget-visual"];
347
350
  declare const DEFAULT_OPTIMIZE_PACKAGES: readonly ["@djangocfg/ui-core", "@djangocfg/layouts", "lucide-react", "recharts"];
348
351
 
349
352
  /**
package/dist/config/index.mjs CHANGED
@@ -38,7 +38,6 @@ var DJANGOCFG_PACKAGES = [
38
38
  "@djangocfg/layouts",
39
39
  "@djangocfg/nextjs",
40
40
  "@djangocfg/api",
41
- "@djangocfg/centrifugo",
42
41
  "@djangocfg/eslint-config",
43
42
  "@djangocfg/typescript-config"
44
43
  ];
@@ -46,12 +45,26 @@ var DEFAULT_TRANSPILE_PACKAGES = [
46
45
  "@djangocfg/i18n",
47
46
  "@djangocfg/ui-core",
48
47
  "@djangocfg/layouts",
49
- "@djangocfg/ui-tools",
50
48
  "@djangocfg/api",
51
49
  "@djangocfg/analytics",
52
- "@djangocfg/centrifugo",
53
50
  "@djangocfg/devtools",
54
- "@djangocfg/payments"
51
+ "@djangocfg/payments",
52
+ "@djangocfg/widget-agent",
53
+ "@djangocfg/widget-avatar",
54
+ "@djangocfg/widget-charts",
55
+ "@djangocfg/widget-chat",
56
+ "@djangocfg/widget-code",
57
+ "@djangocfg/widget-data",
58
+ "@djangocfg/widget-diagram",
59
+ "@djangocfg/widget-editor",
60
+ "@djangocfg/widget-forms",
61
+ "@djangocfg/widget-kit",
62
+ "@djangocfg/widget-map",
63
+ "@djangocfg/widget-media",
64
+ "@djangocfg/widget-ogimage",
65
+ "@djangocfg/widget-overlay",
66
+ "@djangocfg/widget-player",
67
+ "@djangocfg/widget-visual"
55
68
  ];
56
69
  var DEFAULT_OPTIMIZE_PACKAGES = [
57
70
  "@djangocfg/ui-core",
@@ -1316,7 +1329,7 @@ function createBaseNextConfig(options = {}) {
1316
1329
  "style-src 'self' 'unsafe-inline'",
1317
1330
  imgSrc,
1318
1331
  `font-src 'self' data:${extraFont}`,
1319
- // API/websocket calls go cross-origin to Django/Centrifugo.
1332
+ // API calls go cross-origin to Django.
1320
1333
  connectSrc,
1321
1334
  // Declared vendors (Stripe Elements/Checkout, video embeds…) and any
1322
1335
  // app-declared trusted origins mount iframes; add their hosts here.