feat(release): publish minimal self-contained Magent source

frontend/proxy.ts

@@ -0,0 +1,57 @@
+import { NextRequest, NextResponse } from 'next/server'
+
+function hasExplicitHttpOrigin(): boolean {
+  // Allow initial managed setup on a private LAN before the operator claims its
+  // origin. The entrypoint owns this flag; it is never derived from the request.
+  // Otherwise only an operator-provided origin may opt into HTTP for a private LAN.
+  // Never derive this decision from caller-controlled Host/forwarded headers.
+  const configured = (process.env.MAGENT_APPLICATION_URL || '').trim()
+  if (!configured && process.env.MAGENT_RUNTIME_MANAGED === '1') return true
+  if (!/^http:\/\//i.test(configured) || /[\s\\]/.test(configured)) return false
+  try {
+    const url = new URL(configured)
+    return url.protocol === 'http:' && !!url.hostname && !url.username && !url.password
+      && url.pathname === '/' && !url.search && !url.hash
+  } catch {
+    return false
+  }
+}
+
+export function proxy(request: NextRequest) {
+  const nonce = Buffer.from(crypto.randomUUID()).toString('base64')
+  const developmentEval = process.env.NODE_ENV === 'development' ? " 'unsafe-eval'" : ''
+  const csp = [
+    "default-src 'self'",
+    "base-uri 'self'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "form-action 'self'",
+    `script-src 'self' 'nonce-${nonce}' 'strict-dynamic'${developmentEval}`,
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data: blob: https:",
+    "font-src 'self' data:",
+    "connect-src 'self'",
+    "worker-src 'self' blob:",
+    "manifest-src 'self'",
+    ...(hasExplicitHttpOrigin() ? [] : ['upgrade-insecure-requests']),
+  ].join('; ')
+
+  const requestHeaders = new Headers(request.headers)
+  requestHeaders.set('x-nonce', nonce)
+  requestHeaders.set('Content-Security-Policy', csp)
+  const response = NextResponse.next({ request: { headers: requestHeaders } })
+  response.headers.set('Content-Security-Policy', csp)
+  return response
+}
+
+export const config = {
+  matcher: [
+    {
+      source: '/((?!api|_next/static|_next/image|favicon.ico|branding/).*)',
+      missing: [
+        { type: 'header', key: 'next-router-prefetch' },
+        { type: 'header', key: 'purpose', value: 'prefetch' },
+      ],
+    },
+  ],
+}