@inbeat/next 0.7.0

package/CHANGELOG.md

@@ -0,0 +1,90 @@
+# Changelog
+
+## [0.7.0](https://github.com/Genoux/ib-toolkit/compare/next-v0.6.1...next-v0.7.0) (2026-10-01)
+
+
+### ⚠ BREAKING CHANGES
+
+* consumers must drop the @inbeat registry line from .npmrc/bunfig and the NODE_AUTH_TOKEN setup.
+
+### Features
+
+* publish [@inbeat](https://github.com/inbeat) packages publicly on npm ([#27](https://github.com/Genoux/ib-toolkit/issues/27)) ([2bd9f53](https://github.com/Genoux/ib-toolkit/commit/2bd9f53c2d4dd030bdee037b8b1dce1e1bb828b5))
+
+## [0.6.1](https://github.com/Genoux/ib-toolkit/compare/next-v0.6.0...next-v0.6.1) (2026-10-01)
+
+
+### Miscellaneous Chores
+
+* **next:** Synchronize inbeat versions
+
+## [0.6.0](https://github.com/Genoux/ib-toolkit/compare/next-v0.5.0...next-v0.6.0) (2026-10-01)
+
+
+### ⚠ BREAKING CHANGES
+
+* remove app logic and finish the toolkit ([#21](https://github.com/Genoux/ib-toolkit/issues/21))
+
+### Code Refactoring
+
+* remove app logic and finish the toolkit ([#21](https://github.com/Genoux/ib-toolkit/issues/21)) ([cecf25a](https://github.com/Genoux/ib-toolkit/commit/cecf25a670b2177f8b1e8cc3645023a1219a2626))
+
+## [0.5.0](https://github.com/Genoux/ib-toolkit/compare/next-v0.4.0...next-v0.5.0) (2026-10-01)
+
+
+### ⚠ BREAKING CHANGES
+
+* **standards:** `ib add` is removed (use the vendor init CLIs); `ib check` now requires the shared config presets.
+
+### Features
+
+* **standards:** drop add-ons, add ib mcp, enforce shared presets ([#17](https://github.com/Genoux/ib-toolkit/issues/17)) ([9eb8410](https://github.com/Genoux/ib-toolkit/commit/9eb84108432dda5e2a2da312a7bc70299e09c0c9))
+
+## [0.4.0](https://github.com/Genoux/ib-toolkit/compare/next-v0.3.0...next-v0.4.0) (2026-09-30)
+
+
+### ⚠ BREAKING CHANGES
+
+* **standards:** sync skills to .agents/skills only ([#15](https://github.com/Genoux/ib-toolkit/issues/15))
+
+### Features
+
+* **standards:** sync skills to .agents/skills only ([#15](https://github.com/Genoux/ib-toolkit/issues/15)) ([cd3e8a2](https://github.com/Genoux/ib-toolkit/commit/cd3e8a21f028790ad84c26dc1cc832475885c461))
+
+## [0.3.0](https://github.com/Genoux/ib-toolkit/compare/next-v0.2.0...next-v0.3.0) (2026-09-30)
+
+
+### Miscellaneous Chores
+
+* **next:** Synchronize inbeat versions
+
+## [0.2.0](https://github.com/Genoux/ib-toolkit/compare/next-v0.1.2...next-v0.2.0) (2026-09-30)
+
+
+### ⚠ BREAKING CHANGES
+
+* **ui,next:** harden ui peers, csp and rate-limit ip ([#8](https://github.com/Genoux/ib-toolkit/issues/8))
+* make the template a standalone project starter ([#7](https://github.com/Genoux/ib-toolkit/issues/7))
+
+### Features
+
+* make the template a standalone project starter ([#7](https://github.com/Genoux/ib-toolkit/issues/7)) ([98656a0](https://github.com/Genoux/ib-toolkit/commit/98656a0e22e90594f1f10d585aad61ed7de255ea))
+
+
+### Bug Fixes
+
+* **ui,next:** harden ui peers, csp and rate-limit ip ([#8](https://github.com/Genoux/ib-toolkit/issues/8)) ([4ad992c](https://github.com/Genoux/ib-toolkit/commit/4ad992c96181a21c3dbee0bb542d9afe32163deb))
+
+## [0.1.2](https://github.com/Genoux/ib-toolkit/compare/next-v0.1.1...next-v0.1.2) (2026-09-30)
+
+
+### Bug Fixes
+
+* resolve workspace ranges from manifests on publish ([#5](https://github.com/Genoux/ib-toolkit/issues/5)) ([0f4328e](https://github.com/Genoux/ib-toolkit/commit/0f4328eb0897501380880f429a952d9d228563a2))
+
+## [0.1.1](https://github.com/Genoux/ib-toolkit/compare/next-v0.1.0...next-v0.1.1) (2026-09-30)
+
+
+### Bug Fixes
+
+* ship compiled js from core and next ([#3](https://github.com/Genoux/ib-toolkit/issues/3)) ([8fef50a](https://github.com/Genoux/ib-toolkit/commit/8fef50aa87679bcf3c328fe4ca11a351434e2dda))

package/dist/action.d.ts

@@ -0,0 +1,21 @@
+import { type Result } from "@inbeat/core/result";
+import type { z } from "zod";
+export type ActionConfig<TSchema extends z.ZodType, TViewer, TData> = {
+    name: string;
+    schema: TSchema;
+    /**
+     * Required on purpose: an action cannot exist without an explicit access decision.
+     * Throw `AppError("auth" | "forbidden")` to deny; use `publicAccess` for unauthenticated
+     * actions, which must then be rate limited inside `run`.
+     */
+    authorize: () => Promise<TViewer>;
+    run: (input: z.output<TSchema>, viewer: TViewer) => Promise<Result<TData>>;
+    revalidate?: (input: z.output<TSchema>, data: TData) => string[];
+};
+export declare const publicAccess: () => Promise<null>;
+/**
+ * Server action contract: authorize, validate, run, revalidate, and always resolve to a Result.
+ * Expected failures come back as values; anything thrown is classified, reported and replaced
+ * with safe copy, so no raw error message ever crosses to the client.
+ */
+export declare function action<TSchema extends z.ZodType, TViewer, TData>(config: ActionConfig<TSchema, TViewer, TData>): (input: z.input<TSchema>) => Promise<Result<TData>>;

package/dist/action.js

@@ -0,0 +1,29 @@
+import { fail } from "@inbeat/core/result";
+import { revalidatePath } from "next/cache.js";
+import { unstable_rethrow } from "next/navigation.js";
+import { captureAppError } from "./capture.js";
+export const publicAccess = async () => null;
+/**
+ * Server action contract: authorize, validate, run, revalidate, and always resolve to a Result.
+ * Expected failures come back as values; anything thrown is classified, reported and replaced
+ * with safe copy, so no raw error message ever crosses to the client.
+ */
+export function action(config) {
+    return async (rawInput) => {
+        try {
+            const viewer = await config.authorize();
+            const input = config.schema.parse(rawInput);
+            const result = await config.run(input, viewer);
+            if (result.ok) {
+                for (const path of config.revalidate?.(input, result.data) ?? [])
+                    revalidatePath(path);
+            }
+            return result;
+        }
+        catch (err) {
+            unstable_rethrow(err);
+            const captured = captureAppError(err, { tags: { action: config.name } });
+            return fail(captured.safeMessage, captured.kind, captured.errorId);
+        }
+    };
+}

package/dist/capture.d.ts

@@ -0,0 +1,8 @@
+import { type ClassifiedError } from "@inbeat/core/errors";
+export type CapturedError = ClassifiedError & {
+    errorId?: string;
+};
+export declare function captureAppError(err: unknown, context?: {
+    tags?: Record<string, string>;
+    extra?: Record<string, unknown>;
+}): CapturedError;

package/dist/capture.js

@@ -0,0 +1,25 @@
+import { classifyError } from "@inbeat/core/errors";
+import { createLogger } from "@inbeat/core/logger";
+import * as Sentry from "@sentry/nextjs";
+const logger = createLogger();
+/** Short id shown to users so support can find the Sentry event or the log line. */
+function toErrorId(eventId) {
+    return eventId ? `ERR_${eventId.slice(0, 8).toUpperCase()}` : undefined;
+}
+// Logged as well as reported: an app without a Sentry DSN would otherwise lose these errors.
+export function captureAppError(err, context = {}) {
+    const classified = classifyError(err);
+    if (!classified.reportToSentry)
+        return classified;
+    const exception = classified.original instanceof Error
+        ? classified.original
+        : new Error(String(classified.original));
+    const eventId = Sentry.captureException(exception, {
+        tags: { ...classified.tags, ...context.tags },
+        extra: context.extra,
+        fingerprint: classified.fingerprint,
+    });
+    const errorId = toErrorId(eventId);
+    logger.error("Unexpected error", exception, { errorId, ...context.tags });
+    return { ...classified, errorId };
+}

package/dist/clerk-webhook.d.ts

@@ -0,0 +1,18 @@
+import "server-only";
+import { type WebhookEvent } from "@clerk/nextjs/webhooks";
+type EventOf<TType extends WebhookEvent["type"]> = WebhookEvent extends infer TEvent ? TEvent extends {
+    type: infer TUnion;
+} ? TType extends TUnion ? TEvent & {
+    type: TType;
+} : never : never : never;
+export type ClerkWebhookHandlers = {
+    [TType in WebhookEvent["type"]]?: (event: EventOf<TType>) => Promise<void>;
+};
+/**
+ * Returns 400 only when the signature is invalid. Processing failures return 500 so Svix
+ * retries them instead of silently dropping the event.
+ */
+export declare function createClerkWebhookHandler(handlers: ClerkWebhookHandlers, options?: {
+    signingSecret?: string;
+}): (request: Request) => Promise<Response>;
+export {};

package/dist/clerk-webhook.js

@@ -0,0 +1,29 @@
+import "server-only";
+import { verifyWebhook } from "@clerk/nextjs/webhooks";
+import { captureAppError } from "./capture.js";
+/**
+ * Returns 400 only when the signature is invalid. Processing failures return 500 so Svix
+ * retries them instead of silently dropping the event.
+ */
+export function createClerkWebhookHandler(handlers, options = {}) {
+    return async function POST(request) {
+        let event;
+        try {
+            event = await verifyWebhook(request, options);
+        }
+        catch {
+            return new Response("Invalid signature", { status: 400 });
+        }
+        const handler = handlers[event.type];
+        if (!handler)
+            return new Response(null, { status: 204 });
+        try {
+            await handler(event);
+            return new Response(null, { status: 204 });
+        }
+        catch (err) {
+            captureAppError(err, { tags: { webhook: `clerk.${event.type}` } });
+            return new Response("Processing failed", { status: 500 });
+        }
+    };
+}

package/dist/db.d.ts

@@ -0,0 +1,18 @@
+import "server-only";
+import { neonConfig, Pool, type PoolConfig } from "@neondatabase/serverless";
+import { type NeonDatabase } from "drizzle-orm/neon-serverless";
+export type CreateDbOptions<TSchema extends Record<string, unknown>> = {
+    url: string;
+    schema: TSchema;
+    /** Stable key so dev hot reloads reuse one pool instead of leaking connections. */
+    globalKey: string;
+    pool?: Omit<PoolConfig, "connectionString">;
+    webSocketConstructor?: typeof neonConfig.webSocketConstructor;
+    production?: boolean;
+};
+export declare function createDb<TSchema extends Record<string, unknown>>({ url, schema, globalKey, pool: poolOptions, webSocketConstructor, production, }: CreateDbOptions<TSchema>): {
+    db: NeonDatabase<TSchema>;
+    pool: Pool;
+};
+export type Db<TSchema extends Record<string, unknown>> = NeonDatabase<TSchema>;
+export type DbTransaction<TSchema extends Record<string, unknown>> = Parameters<Parameters<NeonDatabase<TSchema>["transaction"]>[0]>[0];

package/dist/db.js

@@ -0,0 +1,17 @@
+import "server-only";
+import { neonConfig, Pool } from "@neondatabase/serverless";
+import { drizzle } from "drizzle-orm/neon-serverless";
+export function createDb({ url, schema, globalKey, pool: poolOptions, webSocketConstructor, 
+// biome-ignore lint/style/noProcessEnv: NODE_ENV is inlined by the bundler, not app config
+production = process.env.NODE_ENV === "production", }) {
+    if (webSocketConstructor)
+        neonConfig.webSocketConstructor = webSocketConstructor;
+    // Sends the password with the startup message, saving a round trip per new connection.
+    neonConfig.pipelineConnect = "password";
+    const store = globalThis;
+    const pool = (!production && store[globalKey]) ||
+        new Pool({ connectionString: url, max: 10, idleTimeoutMillis: 30_000, ...poolOptions });
+    if (!production)
+        store[globalKey] = pool;
+    return { db: drizzle(pool, { schema }), pool };
+}

package/dist/fonts.d.ts

@@ -0,0 +1 @@
+export declare const fontVariables: string;

package/dist/fonts.js

@@ -0,0 +1,4 @@
+import { GeistMono } from "geist/font/mono";
+import { GeistSans } from "geist/font/sans";
+// Goes on <html>: theme.css resolves --font-sans there, so variables set on <body> fall back to the system font.
+export const fontVariables = `${GeistSans.variable} ${GeistMono.variable}`;

package/dist/maintenance.d.ts

@@ -0,0 +1,5 @@
+export type MaintenanceConfig = {
+    enabled: boolean;
+    bypassEmails: readonly string[];
+};
+export declare function isMaintenanceBlocking(config: MaintenanceConfig, email: string | null): boolean;

package/dist/maintenance.js

@@ -0,0 +1,9 @@
+import { normalizeEmail } from "@inbeat/core/email";
+export function isMaintenanceBlocking(config, email) {
+    if (!config.enabled)
+        return false;
+    if (!email)
+        return true;
+    const normalized = normalizeEmail(email);
+    return !config.bypassEmails.some((bypass) => normalizeEmail(bypass) === normalized);
+}

package/dist/rate-limit.d.ts

@@ -0,0 +1,38 @@
+import { type Duration } from "@upstash/ratelimit";
+export type RateLimitPolicy = {
+    limit: number;
+    window: Duration;
+};
+export type RateLimitOutcome = {
+    success: boolean;
+    remaining: number;
+    reset: number;
+};
+export type RateLimiter = {
+    check: (key: string, policy: RateLimitPolicy) => Promise<RateLimitOutcome>;
+    /** Throws `AppError("rate_limited")` so actions and routes answer 429 with safe copy. */
+    enforce: (key: string, policy: RateLimitPolicy) => Promise<void>;
+    backend: "upstash" | "memory";
+};
+export type RateLimiterOptions = {
+    prefix: string;
+    upstash?: {
+        url?: string;
+        token?: string;
+    };
+    onMemoryFallback?: () => void;
+};
+export declare function createRateLimiter({ prefix, upstash, onMemoryFallback, }: RateLimiterOptions): RateLimiter;
+export type ClientIpOptions = {
+    /** Proxies you operate in front of the app; takes that many entries from the right of `x-forwarded-for`. */
+    trustedProxyHops?: number;
+    env?: Record<string, string | undefined>;
+};
+/**
+ * Client IP for rate-limit keys, `"unknown"` when it cannot be trusted. Proxy headers are trusted
+ * only on Vercel, which sets them itself (https://vercel.com/docs/headers/request-headers);
+ * anywhere else they are client-controlled, so they are ignored unless `trustedProxyHops` says
+ * how many proxies of yours sit in front. IPv6 collapses to its /64 so a client cannot rotate
+ * addresses inside its own prefix.
+ */
+export declare function clientIp(headers: Pick<Headers, "get">, { trustedProxyHops, env, }?: ClientIpOptions): string;

package/dist/rate-limit.js

@@ -0,0 +1,109 @@
+import { isIP } from "node:net";
+import { AppError } from "@inbeat/core/errors";
+import { Ratelimit } from "@upstash/ratelimit";
+import { Redis } from "@upstash/redis";
+const UNIT_MS = { ms: 1, s: 1_000, m: 60_000, h: 3_600_000, d: 86_400_000 };
+function durationMs(window) {
+    const [amount, unit] = window.split(" ");
+    return Number(amount) * (UNIT_MS[unit] ?? 1_000);
+}
+/**
+ * Per-instance fixed window. Only correct on a single process (local dev, tests):
+ * on Vercel every instance keeps its own counters.
+ */
+function memoryCheck() {
+    const buckets = new Map();
+    return async (key, policy) => {
+        const now = Date.now();
+        if (buckets.size > 10_000) {
+            for (const [k, b] of buckets)
+                if (b.resetAt <= now)
+                    buckets.delete(k);
+        }
+        const bucket = buckets.get(key);
+        const active = bucket && bucket.resetAt > now
+            ? bucket
+            : { count: 0, resetAt: now + durationMs(policy.window) };
+        active.count++;
+        buckets.set(key, active);
+        return {
+            success: active.count <= policy.limit,
+            remaining: Math.max(0, policy.limit - active.count),
+            reset: active.resetAt,
+        };
+    };
+}
+function upstashCheck(redis, prefix) {
+    const limiters = new Map();
+    return async (key, policy) => {
+        const id = `${policy.limit}:${policy.window}`;
+        let limiter = limiters.get(id);
+        if (!limiter) {
+            limiter = new Ratelimit({
+                redis,
+                prefix: `${prefix}:${id}`,
+                limiter: Ratelimit.slidingWindow(policy.limit, policy.window),
+            });
+            limiters.set(id, limiter);
+        }
+        const { success, remaining, reset } = await limiter.limit(key);
+        return { success, remaining, reset };
+    };
+}
+export function createRateLimiter({ prefix, upstash, onMemoryFallback, }) {
+    const hasUpstash = Boolean(upstash?.url && upstash?.token);
+    if (!hasUpstash)
+        onMemoryFallback?.();
+    const check = hasUpstash
+        ? upstashCheck(new Redis({ url: upstash?.url, token: upstash?.token }), prefix)
+        : memoryCheck();
+    return {
+        backend: hasUpstash ? "upstash" : "memory",
+        check,
+        enforce: async (key, policy) => {
+            const outcome = await check(key, policy);
+            if (!outcome.success) {
+                throw new AppError("rate_limited", `Rate limit hit for ${key.split(":")[0]}`);
+            }
+        },
+    };
+}
+function normalizeIp(candidate) {
+    const ip = candidate?.trim().split("%")[0];
+    if (!ip)
+        return null;
+    const kind = isIP(ip);
+    if (kind === 4)
+        return ip;
+    if (kind !== 6)
+        return null;
+    const mapped = ip.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i)?.[1];
+    if (mapped)
+        return mapped;
+    const [head = "", tail = ""] = ip.split("::");
+    const headGroups = head ? head.split(":") : [];
+    const tailGroups = tail ? tail.split(":") : [];
+    const zeros = ip.includes("::") ? Array(8 - headGroups.length - tailGroups.length).fill("0") : [];
+    const prefix = [...headGroups, ...zeros, ...tailGroups]
+        .slice(0, 4)
+        .map((group) => Number.parseInt(group, 16).toString(16));
+    return `${prefix.join(":")}::/64`;
+}
+/**
+ * Client IP for rate-limit keys, `"unknown"` when it cannot be trusted. Proxy headers are trusted
+ * only on Vercel, which sets them itself (https://vercel.com/docs/headers/request-headers);
+ * anywhere else they are client-controlled, so they are ignored unless `trustedProxyHops` says
+ * how many proxies of yours sit in front. IPv6 collapses to its /64 so a client cannot rotate
+ * addresses inside its own prefix.
+ */
+export function clientIp(headers, { trustedProxyHops, 
+// biome-ignore lint/style/noProcessEnv: VERCEL is platform-provided and read at call time
+env = process.env, } = {}) {
+    const forwardedFor = headers.get("x-forwarded-for")?.split(",") ?? [];
+    const candidate = env.VERCEL
+        ? (headers.get("x-vercel-forwarded-for")?.split(",")[0] ?? forwardedFor[0])
+        : trustedProxyHops
+            ? forwardedFor[forwardedFor.length - trustedProxyHops]
+            : undefined;
+    return normalizeIp(candidate) ?? "unknown";
+}

package/dist/route.d.ts

@@ -0,0 +1,29 @@
+import type { z } from "zod";
+export type RouteErrorBody = {
+    error: string;
+    code: string;
+    errorId?: string;
+};
+type RouteContext<TParams> = {
+    params: Promise<TParams>;
+};
+export type RouteConfig<TViewer, TParams extends Record<string, string | string[]>, TQuery extends z.ZodType | undefined, TBody extends z.ZodType | undefined> = {
+    name: string;
+    /** Same rule as `action()`: every handler states its access decision. */
+    authorize: (request: Request) => Promise<TViewer>;
+    query?: TQuery;
+    body?: TBody;
+    handler: (args: {
+        request: Request;
+        viewer: TViewer;
+        params: TParams;
+        query: TQuery extends z.ZodType ? z.output<TQuery> : undefined;
+        body: TBody extends z.ZodType ? z.output<TBody> : undefined;
+    }) => Promise<Response | unknown>;
+};
+/**
+ * Route handler contract. Returns JSON with a real HTTP status, and errors as
+ * `{ error, code, errorId? }` so every client can branch on `code`.
+ */
+export declare function route<TViewer, TParams extends Record<string, string | string[]> = Record<string, never>, TQuery extends z.ZodType | undefined = undefined, TBody extends z.ZodType | undefined = undefined>(config: RouteConfig<TViewer, TParams, TQuery, TBody>): (request: Request, context: RouteContext<TParams>) => Promise<Response>;
+export {};

package/dist/route.js

@@ -0,0 +1,48 @@
+import { APP_ERROR_STATUS, AppError } from "@inbeat/core/errors";
+import { NextResponse } from "next/server.js";
+import { captureAppError } from "./capture.js";
+function errorResponse(err, name) {
+    const captured = captureAppError(err, { tags: { route: name } });
+    return NextResponse.json({
+        error: captured.safeMessage,
+        code: captured.kind,
+        ...(captured.errorId ? { errorId: captured.errorId } : {}),
+    }, { status: APP_ERROR_STATUS[captured.kind] });
+}
+async function readJson(request) {
+    try {
+        return await request.json();
+    }
+    catch {
+        throw new AppError("validation", "Request body is not valid JSON", {
+            safeMessage: "The request body is not valid JSON.",
+        });
+    }
+}
+/**
+ * Route handler contract. Returns JSON with a real HTTP status, and errors as
+ * `{ error, code, errorId? }` so every client can branch on `code`.
+ */
+export function route(config) {
+    return async (request, context) => {
+        try {
+            const viewer = await config.authorize(request);
+            const params = (await context?.params) ?? {};
+            const query = config.query
+                ? config.query.parse(Object.fromEntries(new URL(request.url).searchParams))
+                : undefined;
+            const body = config.body ? config.body.parse(await readJson(request)) : undefined;
+            const output = await config.handler({
+                request,
+                viewer,
+                params,
+                query: query,
+                body: body,
+            });
+            return output instanceof Response ? output : NextResponse.json(output ?? null);
+        }
+        catch (err) {
+            return errorResponse(err, config.name);
+        }
+    };
+}

package/dist/safe-redirect.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Accepts only same-origin relative paths. Rejects protocol-relative (`//evil.com`),
+ * backslash tricks (`/\evil.com`) and absolute URLs so `?redirect_url=` can't bounce users out.
+ */
+export declare function safeRedirectPath(candidate: string | null | undefined, fallback: string): string;

package/dist/safe-redirect.js

@@ -0,0 +1,19 @@
+/**
+ * Accepts only same-origin relative paths. Rejects protocol-relative (`//evil.com`),
+ * backslash tricks (`/\evil.com`) and absolute URLs so `?redirect_url=` can't bounce users out.
+ */
+export function safeRedirectPath(candidate, fallback) {
+    if (!candidate?.startsWith("/") || candidate.startsWith("//"))
+        return fallback;
+    if (candidate.includes("\\"))
+        return fallback;
+    try {
+        const url = new URL(candidate, "https://placeholder.invalid");
+        return url.origin === "https://placeholder.invalid"
+            ? `${url.pathname}${url.search}${url.hash}`
+            : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}

package/dist/security-headers.d.ts

@@ -0,0 +1,31 @@
+export type CspSources = {
+    script?: string[];
+    style?: string[];
+    img?: string[];
+    font?: string[];
+    connect?: string[];
+    media?: string[];
+    frame?: string[];
+    worker?: string[];
+};
+export type SecurityHeadersOptions = {
+    /** Frontend API host, see `clerkFrontendApi()`. */
+    clerkFrontendApi?: string;
+    sources?: CspSources;
+    /** Ship CSP as report-only first; enforce once a week of traffic shows no violations. */
+    cspReportOnly?: boolean;
+    cspReportUri?: string;
+    dev?: boolean;
+};
+export type NextHeader = {
+    key: string;
+    value: string;
+};
+/** Decodes the host baked into a Clerk publishable key (`pk_<env>_<base64(host$)>`). */
+export declare function clerkFrontendApi(publishableKey: string | undefined): string | undefined;
+export declare function contentSecurityPolicy({ clerkFrontendApi: clerk, sources, cspReportUri, dev, }?: SecurityHeadersOptions): string;
+/**
+ * Use from `next.config.ts`: `headers: async () => [{ source: "/(.*)", headers: securityHeaders(…) }]`.
+ * X-Frame-Options stays even with CSP because browsers ignore `frame-ancestors` in report-only mode.
+ */
+export declare function securityHeaders(options?: SecurityHeadersOptions): NextHeader[];

package/dist/security-headers.js

@@ -0,0 +1,75 @@
+/** Decodes the host baked into a Clerk publishable key (`pk_<env>_<base64(host$)>`). */
+export function clerkFrontendApi(publishableKey) {
+    const encoded = publishableKey?.split("_")[2];
+    if (!encoded)
+        return undefined;
+    try {
+        return atob(encoded).replace(/\$$/, "") || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function directive(name, values) {
+    return [name, ...new Set(values.filter(Boolean))].join(" ");
+}
+export function contentSecurityPolicy({ clerkFrontendApi: clerk, sources = {}, cspReportUri, dev = false, } = {}) {
+    const clerkOrigin = clerk && `https://${clerk}`;
+    const clerkImages = clerk && "https://img.clerk.com";
+    const turnstile = clerk && "https://challenges.cloudflare.com";
+    return [
+        directive("default-src", ["'self'"]),
+        directive("script-src", [
+            "'self'",
+            // Next injects inline bootstrap scripts; nonces would force every page dynamic.
+            "'unsafe-inline'",
+            dev && "'unsafe-eval'",
+            clerkOrigin,
+            turnstile,
+            ...(sources.script ?? []),
+        ]),
+        directive("style-src", ["'self'", "'unsafe-inline'", ...(sources.style ?? [])]),
+        directive("img-src", ["'self'", "data:", "blob:", clerkImages, ...(sources.img ?? [])]),
+        directive("font-src", ["'self'", "data:", ...(sources.font ?? [])]),
+        directive("connect-src", ["'self'", clerkOrigin, dev && "ws:", ...(sources.connect ?? [])]),
+        directive("media-src", ["'self'", "blob:", ...(sources.media ?? [])]),
+        directive("frame-src", ["'self'", turnstile, ...(sources.frame ?? [])]),
+        directive("worker-src", ["'self'", "blob:", ...(sources.worker ?? [])]),
+        directive("object-src", ["'none'"]),
+        directive("base-uri", ["'self'"]),
+        directive("form-action", ["'self'"]),
+        directive("frame-ancestors", ["'none'"]),
+        cspReportUri ? directive("report-uri", [cspReportUri]) : undefined,
+    ]
+        .filter(Boolean)
+        .join("; ");
+}
+/**
+ * Use from `next.config.ts`: `headers: async () => [{ source: "/(.*)", headers: securityHeaders(…) }]`.
+ * X-Frame-Options stays even with CSP because browsers ignore `frame-ancestors` in report-only mode.
+ */
+export function securityHeaders(options = {}) {
+    const { cspReportOnly = true, dev = false } = options;
+    return [
+        {
+            key: cspReportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy",
+            value: contentSecurityPolicy(options),
+        },
+        ...(dev
+            ? []
+            : [
+                {
+                    key: "Strict-Transport-Security",
+                    value: "max-age=63072000; includeSubDomains; preload",
+                },
+            ]),
+        { key: "X-Frame-Options", value: "DENY" },
+        { key: "X-Content-Type-Options", value: "nosniff" },
+        { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+        {
+            key: "Permissions-Policy",
+            value: "camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()",
+        },
+        { key: "Cross-Origin-Opener-Policy", value: "same-origin-allow-popups" },
+    ];
+}

package/dist/sentry-client.d.ts

@@ -0,0 +1,4 @@
+import { type SentryInitOptions, type SentryPresetOptions } from "./sentry.js";
+export declare function sentryClientOptions(options: SentryPresetOptions & {
+    replaysOnErrorSampleRate?: number;
+}): SentryInitOptions;

package/dist/sentry-client.js

@@ -0,0 +1,17 @@
+import * as Sentry from "@sentry/nextjs";
+import { sentryServerOptions } from "./sentry.js";
+export function sentryClientOptions(options) {
+    return {
+        ...sentryServerOptions(options),
+        integrations: [
+            Sentry.replayIntegration({
+                maskAllText: true,
+                maskAllInputs: true,
+                blockAllMedia: true,
+                unmask: ["[data-sentry-unmask]"],
+            }),
+        ],
+        replaysSessionSampleRate: 0,
+        replaysOnErrorSampleRate: options.replaysOnErrorSampleRate ?? 1,
+    };
+}

package/dist/sentry.d.ts

@@ -0,0 +1,26 @@
+import type * as Sentry from "@sentry/nextjs";
+type ErrorEvent = Sentry.ErrorEvent;
+type EventHint = Sentry.EventHint;
+export type SentryInitOptions = NonNullable<Parameters<typeof Sentry.init>[0]>;
+export type SentryPresetOptions = {
+    dsn: string | undefined;
+    enabled: boolean;
+    environment?: string;
+    tracesSampleRate?: number;
+    /** Extra drop rule, e.g. errors the app already turned into user-facing copy. */
+    ignore?: (hint: EventHint) => boolean;
+};
+/**
+ * Server and edge options. Browser options live in `@inbeat/next/sentry-client`: Replay only
+ * exists in the browser build of `@sentry/nextjs`, and Turbopack fails the edge bundle on it.
+ */
+export declare function sentryServerOptions({ dsn, enabled, environment, tracesSampleRate, ignore, }: SentryPresetOptions): {
+    dsn: string | undefined;
+    enabled: boolean;
+    environment: string | undefined;
+    tracesSampleRate: number;
+    sendDefaultPii: false;
+    enableLogs: true;
+    beforeSend: (event: ErrorEvent, hint: EventHint) => ErrorEvent | null;
+};
+export {};

package/dist/sentry.js

@@ -0,0 +1,33 @@
+import { isTransientUncaughtException } from "@inbeat/core/errors";
+const EXTENSION_FRAME = /(extension:\/\/|\.safariextension|^safari-extension|^moz-extension|^chrome-extension)/;
+function hasExtensionFrame(event) {
+    return (event.exception?.values?.some((value) => value.stacktrace?.frames?.some((frame) => EXTENSION_FRAME.test(frame.filename ?? ""))) ?? false);
+}
+function createBeforeSend(ignore) {
+    return (event, hint) => {
+        if (ignore?.(hint))
+            return null;
+        if (isTransientUncaughtException(event.exception?.values?.[0]?.mechanism?.type, hint.originalException)) {
+            return null;
+        }
+        if (hasExtensionFrame(event))
+            return null;
+        return event;
+    };
+}
+/**
+ * Server and edge options. Browser options live in `@inbeat/next/sentry-client`: Replay only
+ * exists in the browser build of `@sentry/nextjs`, and Turbopack fails the edge bundle on it.
+ */
+export function sentryServerOptions({ dsn, enabled, environment, tracesSampleRate = 0.1, ignore, }) {
+    return {
+        dsn,
+        enabled: enabled && Boolean(dsn),
+        environment,
+        tracesSampleRate,
+        // Creator and client PII (names, emails, rates) must not leave for a third party by default.
+        sendDefaultPii: false,
+        enableLogs: true,
+        beforeSend: createBeforeSend(ignore),
+    };
+}

package/package.json

@@ -0,0 +1,117 @@
+{
+  "name": "@inbeat/next",
+  "version": "0.7.0",
+  "description": "Next.js App Router building blocks for inBeat apps: actions, routes, security, observability",
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "CHANGELOG.md",
+    "dist"
+  ],
+  "exports": {
+    "./action": {
+      "types": "./dist/action.d.ts",
+      "default": "./dist/action.js"
+    },
+    "./route": {
+      "types": "./dist/route.d.ts",
+      "default": "./dist/route.js"
+    },
+    "./capture": {
+      "types": "./dist/capture.d.ts",
+      "default": "./dist/capture.js"
+    },
+    "./clerk-webhook": {
+      "types": "./dist/clerk-webhook.d.ts",
+      "default": "./dist/clerk-webhook.js"
+    },
+    "./db": {
+      "types": "./dist/db.d.ts",
+      "default": "./dist/db.js"
+    },
+    "./maintenance": {
+      "types": "./dist/maintenance.d.ts",
+      "default": "./dist/maintenance.js"
+    },
+    "./rate-limit": {
+      "types": "./dist/rate-limit.d.ts",
+      "default": "./dist/rate-limit.js"
+    },
+    "./security-headers": {
+      "types": "./dist/security-headers.d.ts",
+      "default": "./dist/security-headers.js"
+    },
+    "./sentry": {
+      "types": "./dist/sentry.d.ts",
+      "default": "./dist/sentry.js"
+    },
+    "./sentry-client": {
+      "types": "./dist/sentry-client.d.ts",
+      "default": "./dist/sentry-client.js"
+    },
+    "./safe-redirect": {
+      "types": "./dist/safe-redirect.d.ts",
+      "default": "./dist/safe-redirect.js"
+    },
+    "./fonts": {
+      "types": "./dist/fonts.d.ts",
+      "default": "./dist/fonts.js"
+    }
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "dev": "tsc -p tsconfig.build.json --watch --preserveWatchOutput",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@inbeat/core": "^0.7.0",
+    "@upstash/ratelimit": "^2.0.6",
+    "@upstash/redis": "^1.35.3",
+    "server-only": "^0.0.1"
+  },
+  "peerDependencies": {
+    "@clerk/nextjs": "^7",
+    "@neondatabase/serverless": "^1",
+    "@sentry/nextjs": "^10",
+    "drizzle-orm": ">=0.44",
+    "geist": "^1",
+    "next": ">=16",
+    "react": "^19",
+    "zod": "^4"
+  },
+  "peerDependenciesMeta": {
+    "@clerk/nextjs": {
+      "optional": true
+    },
+    "@neondatabase/serverless": {
+      "optional": true
+    },
+    "drizzle-orm": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@clerk/nextjs": "^7.0.6",
+    "@inbeat/config": "^0.7.0",
+    "@neondatabase/serverless": "^1.0.2",
+    "@sentry/nextjs": "^10",
+    "@types/react": "^19",
+    "drizzle-orm": "^0.45.1",
+    "geist": "^1.7.2",
+    "next": "16.3.8",
+    "react": "19.2.3",
+    "react-dom": "19.2.3",
+    "vitest": "^4.1.1",
+    "zod": "^4.3.6"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Genoux/ib-toolkit.git",
+    "directory": "packages/next"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "UNLICENSED"
+}