@djangocfg/nextjs 2.1.541 → 2.1.543

package/README.md

@@ -122,8 +122,9 @@ the box — no setup required:
 - `Content-Security-Policy` — a pragmatic baseline that blocks the high-value
   injection vectors (`object-src 'none'`, `base-uri 'self'`, `form-action 'self'`,
   `frame-ancestors`) while keeping the inline/eval scripts a Next.js app needs.
-  **Dev-aware:** `connect-src`/`img-src` allow `http:`/`ws:` in development (local
-  Django/Centrifugo) and tighten to `https:`/`wss:` only in production.
+  **Dev-aware:** `connect-src`/`img-src` allow `http:`/`ws:` in development (a
+  local Django, plus any WebSocket transport the app brings itself) and tighten
+  to `https:`/`wss:` only in production.
 - `X-Content-Type-Options: nosniff`, `Referrer-Policy: strict-origin-when-cross-origin`
 - `X-Frame-Options: DENY` (or `SAMEORIGIN` when `allowIframeFrom` is set)
 

package/dist/config/index.d.mts

@@ -128,11 +128,14 @@ type CspVendor = keyof typeof CSP_VENDOR_PRESETS;
  *   (Observed 2026-07-23: cmdop `apps/web` blocked on
  *   `googletagmanager.com/gtag/js?id=G-YJ0F48S83F`.)
  *
- * - `youtube` / `vimeo` — `VideoPlayer` (`@djangocfg/ui-tools`) mounts these
- *   iframes AT RUNTIME from a URL inside a chat message (see
- *   `chat/messages/blocks/renderers/VideoBlock.tsx`). The app author enables a
- *   chat; whether any user ever pastes a YouTube link is not knowable at build
- *   time, so no `next.config.ts` can declare it honestly.
+ * - `youtube` / `vimeo` — these existed for `VideoPlayer`
+ *   (`@djangocfg/ui-tools`), which mounted the iframes AT RUNTIME from a URL
+ *   inside a chat message. That player was retired with `ui-tools`;
+ *   `@djangocfg/widget-player` embeds no third-party frames, so **nothing in
+ *   this repo needs these presets today**. They are kept because the shape of
+ *   the problem outlives the component: an app author enables a chat, and
+ *   whether a user ever pastes a YouTube link is not knowable at build time,
+ *   so no `next.config.ts` can declare it honestly.
  *
  * Note what these have in common: the script/frame is turned on by the RUNTIME
  * (the edge, a package, or an end user), never by the app author editing the
@@ -179,7 +182,17 @@ declare function resolveCspVendors(vendors: readonly string[] | undefined, warnU
  * ```
  */
 
-interface BaseNextConfigOptions {
+/**
+ * Second argument Next.js passes to the `webpack` hook. Derived from Next's own
+ * signature rather than re-declared, so it tracks upstream.
+ */
+type WebpackContext = Parameters<NonNullable<NextConfig['webpack']>>[1];
+/**
+ * DjangoCFG-specific options. Every other Next.js option passes through via the
+ * `NextConfig` half of `BaseNextConfigOptions`; the keys redeclared here are
+ * omitted from it because this package narrows or re-purposes them.
+ */
+interface DjangoCfgNextOptions {
     /** Static build path (used when NEXT_PUBLIC_STATIC_BUILD=true) */
     isDefaultCfgAdmin?: boolean;
     /** Additional transpile packages (merged with defaults) */
@@ -311,11 +324,7 @@ interface BaseNextConfigOptions {
     /** Turbopack configuration (Next.js 16+ default bundler) */
     turbopack?: NextConfig['turbopack'];
     /** Custom webpack configuration function (called after base webpack logic) */
-    webpack?: (config: Configuration, options: {
-        isServer: boolean;
-        dev: boolean;
-        [key: string]: any;
-    }) => Configuration | void;
+    webpack?: (config: Configuration, options: WebpackContext) => Configuration | void;
     /** Custom experimental options (merged with defaults) */
     experimental?: NextConfig['experimental'];
     /** Custom env variables (merged with defaults) */
@@ -326,9 +335,11 @@ interface BaseNextConfigOptions {
     headers?: NextConfig['headers'];
     /** Additional rewrites */
     rewrites?: NextConfig['rewrites'];
-    /** Override any Next.js config option */
-    [key: string]: any;
 }
+/**
+ * DjangoCFG options plus every remaining Next.js config option.
+ */
+type BaseNextConfigOptions = DjangoCfgNextOptions & Omit<NextConfig, keyof DjangoCfgNextOptions>;
 /**
  * Create base Next.js configuration with standard DjangoCFG settings
  *
@@ -342,8 +353,8 @@ declare function createBaseNextConfig(options?: BaseNextConfigOptions): NextConf
  */
 declare const PACKAGE_NAME = "@djangocfg/nextjs";
 declare const DJANGO_CFG_BANNER = "\n\u2588\u2588\u2588\u2588\u2588\u2588\u2557      \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557   \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2557      \u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557\n\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557     \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D \u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557    \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\n\u2588\u2588\u2551  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2588\u2557\u2588\u2588\u2551   \u2588\u2588\u2551    \u2588\u2588\u2551     \u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551  \u2588\u2588\u2588\u2557\n\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588   \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551    \u2588\u2588\u2551     \u2588\u2588\u2554\u2550\u2550\u255D  \u2588\u2588\u2551   \u2588\u2588\u2551\n\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u255A\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D    \u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551     \u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\n\u255A\u2550\u2550\u2550\u2550\u2550\u255D  \u255A\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D  \u255A\u2550\u2550\u2550\u2550\u2550\u255D      \u255A\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u255D      \u255A\u2550\u2550\u2550\u2550\u2550\u255D\n";
-declare const DJANGOCFG_PACKAGES: readonly ["@djangocfg/ui-core", "@djangocfg/layouts", "@djangocfg/nextjs", "@djangocfg/api", "@djangocfg/centrifugo", "@djangocfg/eslint-config", "@djangocfg/typescript-config"];
-declare const DEFAULT_TRANSPILE_PACKAGES: readonly ["@djangocfg/i18n", "@djangocfg/ui-core", "@djangocfg/layouts", "@djangocfg/ui-tools", "@djangocfg/api", "@djangocfg/analytics", "@djangocfg/centrifugo", "@djangocfg/devtools", "@djangocfg/payments"];
+declare const DJANGOCFG_PACKAGES: readonly ["@djangocfg/ui-core", "@djangocfg/layouts", "@djangocfg/nextjs", "@djangocfg/api", "@djangocfg/eslint-config", "@djangocfg/typescript-config"];
+declare const DEFAULT_TRANSPILE_PACKAGES: readonly ["@djangocfg/i18n", "@djangocfg/ui-core", "@djangocfg/layouts", "@djangocfg/api", "@djangocfg/analytics", "@djangocfg/devtools", "@djangocfg/payments", "@djangocfg/widget-agent", "@djangocfg/widget-avatar", "@djangocfg/widget-charts", "@djangocfg/widget-chat", "@djangocfg/widget-code", "@djangocfg/widget-data", "@djangocfg/widget-diagram", "@djangocfg/widget-editor", "@djangocfg/widget-forms", "@djangocfg/widget-kit", "@djangocfg/widget-map", "@djangocfg/widget-media", "@djangocfg/widget-ogimage", "@djangocfg/widget-overlay", "@djangocfg/widget-player", "@djangocfg/widget-visual"];
 declare const DEFAULT_OPTIMIZE_PACKAGES: readonly ["@djangocfg/ui-core", "@djangocfg/layouts", "lucide-react", "recharts"];
 
 /**
@@ -351,7 +362,12 @@ declare const DEFAULT_OPTIMIZE_PACKAGES: readonly ["@djangocfg/ui-core", "@djang
  *
  * Recursively merges objects, replacing arrays instead of merging them.
  */
-declare function deepMerge<T extends Record<string, any>>(target: T, source: Partial<T>): T;
+/**
+ * `T extends object` rather than `Record<string, unknown>`: call sites pass
+ * Next.js config interfaces, which have declared keys and no index signature —
+ * they are not assignable to `Record<string, unknown>`.
+ */
+declare function deepMerge<T extends object>(target: T, source: Partial<T>): T;
 
 /**
  * Environment Variable Utilities

package/dist/config/index.mjs

@@ -38,7 +38,6 @@ var DJANGOCFG_PACKAGES = [
   "@djangocfg/layouts",
   "@djangocfg/nextjs",
   "@djangocfg/api",
-  "@djangocfg/centrifugo",
   "@djangocfg/eslint-config",
   "@djangocfg/typescript-config"
 ];
@@ -46,12 +45,26 @@ var DEFAULT_TRANSPILE_PACKAGES = [
   "@djangocfg/i18n",
   "@djangocfg/ui-core",
   "@djangocfg/layouts",
-  "@djangocfg/ui-tools",
   "@djangocfg/api",
   "@djangocfg/analytics",
-  "@djangocfg/centrifugo",
   "@djangocfg/devtools",
-  "@djangocfg/payments"
+  "@djangocfg/payments",
+  "@djangocfg/widget-agent",
+  "@djangocfg/widget-avatar",
+  "@djangocfg/widget-charts",
+  "@djangocfg/widget-chat",
+  "@djangocfg/widget-code",
+  "@djangocfg/widget-data",
+  "@djangocfg/widget-diagram",
+  "@djangocfg/widget-editor",
+  "@djangocfg/widget-forms",
+  "@djangocfg/widget-kit",
+  "@djangocfg/widget-map",
+  "@djangocfg/widget-media",
+  "@djangocfg/widget-ogimage",
+  "@djangocfg/widget-overlay",
+  "@djangocfg/widget-player",
+  "@djangocfg/widget-visual"
 ];
 var DEFAULT_OPTIMIZE_PACKAGES = [
   "@djangocfg/ui-core",
@@ -336,7 +349,7 @@ function addCompressionPlugins(config, options = {}) {
       );
     }
     return true;
-  } catch (error) {
+  } catch {
     return false;
   }
 }
@@ -544,7 +557,7 @@ async function installSinglePackage(pkg, pm, index, total) {
   const spinner = createSpinner(`${chalk.dim(progress)} Installing ${chalk.cyan(pkg.name)}...`);
   spinner.start();
   return new Promise((resolve) => {
-    const [cmd, ...args] = command.split(" ");
+    const [cmd = pm, ...args] = command.split(" ");
     const proc = spawn(cmd, args, {
       shell: true,
       cwd: process.cwd(),
@@ -580,13 +593,13 @@ async function installPackagesWithProgress(packages) {
   console.log(chalk.bold(`  Installing ${total} package${total > 1 ? "s" : ""}...`));
   console.log("");
   let successCount = 0;
-  let failedPackages = [];
-  for (let i = 0; i < packages.length; i++) {
-    const success = await installSinglePackage(packages[i], pm, i, total);
+  const failedPackages = [];
+  for (const [i, pkg] of packages.entries()) {
+    const success = await installSinglePackage(pkg, pm, i, total);
     if (success) {
       successCount++;
     } else {
-      failedPackages.push(packages[i].name);
+      failedPackages.push(pkg.name);
     }
   }
   console.log("");
@@ -951,12 +964,12 @@ async function updatePackagesWithProgress(packages) {
   console.log("");
   let successCount = 0;
   const failedPackages = [];
-  for (let i = 0; i < packages.length; i++) {
-    const success = await updateSinglePackage(packages[i], pm, i, total);
+  for (const [i, pkg] of packages.entries()) {
+    const success = await updateSinglePackage(pkg, pm, i, total);
     if (success) {
       successCount++;
     } else {
-      failedPackages.push(packages[i].name);
+      failedPackages.push(pkg.name);
     }
   }
   console.log("");
@@ -1212,22 +1225,17 @@ function resetDevStartupState() {
 }
 
 // src/config/utils/deepMerge.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function deepMerge(target, source) {
   const output = { ...target };
-  for (const key in source) {
-    if (source[key] === void 0) continue;
-    if (Array.isArray(source[key])) {
-      output[key] = source[key];
-    } else if (source[key] && typeof source[key] === "object" && !Array.isArray(source[key])) {
-      const targetValue = output[key];
-      if (targetValue && typeof targetValue === "object" && !Array.isArray(targetValue)) {
-        output[key] = deepMerge(targetValue, source[key]);
-      } else {
-        output[key] = source[key];
-      }
-    } else {
-      output[key] = source[key];
-    }
+  for (const key of Object.keys(source)) {
+    const sourceValue = source[key];
+    if (sourceValue === void 0) continue;
+    const targetValue = output[key];
+    const merged = isPlainObject(sourceValue) && isPlainObject(targetValue) ? deepMerge(targetValue, sourceValue) : sourceValue;
+    output[key] = merged;
   }
   return output;
 }
@@ -1316,7 +1324,7 @@ function createBaseNextConfig(options = {}) {
           "style-src 'self' 'unsafe-inline'",
           imgSrc,
           `font-src 'self' data:${extraFont}`,
-          // API/websocket calls go cross-origin to Django/Centrifugo.
+          // API calls go cross-origin to Django.
           connectSrc,
           // Declared vendors (Stripe Elements/Checkout, video embeds…) and any
           // app-declared trusted origins mount iframes; add their hosts here.
@@ -1437,23 +1445,28 @@ function createBaseNextConfig(options = {}) {
       return config;
     }
   };
-  const {
-    i18n: i18nOptions,
-    pwa: pwaOptions,
-    transpilePackages,
-    optimizePackageImports,
-    isDefaultCfgAdmin,
-    checkUpdates,
-    autoUpdate,
-    forceCheckWorkspace,
-    checkPackages: checkPackages2,
-    autoInstall,
-    allowIframeFrom,
-    dpop,
-    stripe,
-    csp,
-    ...nextConfigOptions
-  } = options;
+  const { i18n: i18nOptions, pwa: pwaOptions } = options;
+  const DJANGOCFG_ONLY_KEYS = [
+    "i18n",
+    "pwa",
+    "transpilePackages",
+    "optimizePackageImports",
+    "isDefaultCfgAdmin",
+    "checkUpdates",
+    "autoUpdate",
+    "forceCheckWorkspace",
+    "checkPackages",
+    "autoInstall",
+    "allowIframeFrom",
+    "dpop",
+    "stripe",
+    "csp"
+  ];
+  const nextConfigOptions = Object.fromEntries(
+    Object.entries(options).filter(
+      ([key]) => !DJANGOCFG_ONLY_KEYS.includes(key)
+    )
+  );
   let finalConfig = deepMerge(baseConfig, nextConfigOptions);
   if (pwaOptions) {
     finalConfig = withPWA(finalConfig, pwaOptions);