@djangocfg/nextjs 2.1.541 → 2.1.542

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/nextjs",
-  "version": "2.1.541",
+  "version": "2.1.542",
   "description": "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
   "keywords": [
     "nextjs",
@@ -149,9 +149,9 @@
     "ai-docs": "tsx src/ai/cli.ts"
   },
   "peerDependencies": {
-    "@djangocfg/devtools": "^2.1.541",
-    "@djangocfg/i18n": "^2.1.541",
-    "@djangocfg/ui-core": "^2.1.541",
+    "@djangocfg/devtools": "^2.1.542",
+    "@djangocfg/i18n": "^2.1.542",
+    "@djangocfg/ui-core": "^2.1.542",
     "next": "^16.2.2"
   },
   "peerDependenciesMeta": {
@@ -170,11 +170,11 @@
     "semver": "^7.8.5"
   },
   "devDependencies": {
-    "@djangocfg/devtools": "^2.1.541",
-    "@djangocfg/i18n": "^2.1.541",
-    "@djangocfg/layouts": "^2.1.541",
-    "@djangocfg/typescript-config": "^2.1.541",
-    "@djangocfg/ui-core": "^2.1.541",
+    "@djangocfg/devtools": "^2.1.542",
+    "@djangocfg/i18n": "^2.1.542",
+    "@djangocfg/layouts": "^2.1.542",
+    "@djangocfg/typescript-config": "^2.1.542",
+    "@djangocfg/ui-core": "^2.1.542",
     "@types/node": "^25.9.5",
     "@types/react": "19.2.15",
     "@types/react-dom": "19.2.3",

package/src/config/constants.ts

@@ -24,23 +24,40 @@ export const DJANGOCFG_PACKAGES = [
   '@djangocfg/layouts',
   '@djangocfg/nextjs',
   '@djangocfg/api',
-  '@djangocfg/centrifugo',
   '@djangocfg/eslint-config',
   '@djangocfg/typescript-config',
 ] as const;
 
 // Default packages to transpile
-// Required for proper RSC (React Server Components) handling
+// Required for proper RSC (React Server Components) handling.
+//
+// Every widget is here because widgets ship SOURCE — `main` points at
+// `./src/index.ts`, there is no build step, and an untranspiled `.ts` in
+// node_modules is a syntax error at the app's first import, not a warning.
 export const DEFAULT_TRANSPILE_PACKAGES = [
   '@djangocfg/i18n',
   '@djangocfg/ui-core',
   '@djangocfg/layouts',
-  '@djangocfg/ui-tools',
   '@djangocfg/api',
   '@djangocfg/analytics',
-  '@djangocfg/centrifugo',
   '@djangocfg/devtools',
   '@djangocfg/payments',
+  '@djangocfg/widget-agent',
+  '@djangocfg/widget-avatar',
+  '@djangocfg/widget-charts',
+  '@djangocfg/widget-chat',
+  '@djangocfg/widget-code',
+  '@djangocfg/widget-data',
+  '@djangocfg/widget-diagram',
+  '@djangocfg/widget-editor',
+  '@djangocfg/widget-forms',
+  '@djangocfg/widget-kit',
+  '@djangocfg/widget-map',
+  '@djangocfg/widget-media',
+  '@djangocfg/widget-ogimage',
+  '@djangocfg/widget-overlay',
+  '@djangocfg/widget-player',
+  '@djangocfg/widget-visual',
 ] as const;
 
 // Default packages to optimize imports

package/src/config/createNextConfig.ts

@@ -293,7 +293,7 @@ export function createBaseNextConfig(
       const cspDisabled = options.csp === false;
       const cspExtra = typeof options.csp === 'object' ? options.csp : undefined;
 
-      // In dev the backend (Django, Centrifugo) is plain http/ws on localhost,
+      // In dev the backend (Django) is plain http/ws on localhost,
       // so connect/img must allow http:/ws:. Production stays strict (https/wss
       // only) to forbid downgrade/cleartext exfiltration.
       //
@@ -343,7 +343,7 @@ export function createBaseNextConfig(
           "style-src 'self' 'unsafe-inline'",
           imgSrc,
           `font-src 'self' data:${extraFont}`,
-          // API/websocket calls go cross-origin to Django/Centrifugo.
+          // API calls go cross-origin to Django.
           connectSrc,
           // Declared vendors (Stripe Elements/Checkout, video embeds…) and any
           // app-declared trusted origins mount iframes; add their hosts here.

package/src/config/csp.ts

@@ -136,11 +136,14 @@ export type CspVendor = keyof typeof CSP_VENDOR_PRESETS;
  *   (Observed 2026-07-23: cmdop `apps/web` blocked on
  *   `googletagmanager.com/gtag/js?id=G-YJ0F48S83F`.)
  *
- * - `youtube` / `vimeo` — `VideoPlayer` (`@djangocfg/ui-tools`) mounts these
- *   iframes AT RUNTIME from a URL inside a chat message (see
- *   `chat/messages/blocks/renderers/VideoBlock.tsx`). The app author enables a
- *   chat; whether any user ever pastes a YouTube link is not knowable at build
- *   time, so no `next.config.ts` can declare it honestly.
+ * - `youtube` / `vimeo` — these existed for `VideoPlayer`
+ *   (`@djangocfg/ui-tools`), which mounted the iframes AT RUNTIME from a URL
+ *   inside a chat message. That player was retired with `ui-tools`;
+ *   `@djangocfg/widget-player` embeds no third-party frames, so **nothing in
+ *   this repo needs these presets today**. They are kept because the shape of
+ *   the problem outlives the component: an app author enables a chat, and
+ *   whether a user ever pastes a YouTube link is not knowable at build time,
+ *   so no `next.config.ts` can declare it honestly.
  *
  * Note what these have in common: the script/frame is turned on by the RUNTIME
  * (the edge, a package, or an end user), never by the app author editing the