Pinscope open-source core

Agentic schematic validation: datasheet extraction via Claude Console Skills, netlist/BOM design graph, per-IC direct datasheet review with page citations, capacitor derating, Next.js report UI. Extracted from the Pinscope cloud codebase. Auth and billing live in the private gateway repo behind stable seams (billing_hook.py, adapter files listed in CLAUDE.md).
2026-07-16 21:29:45 -07:00
commit 6672d2be57
254 changed files with 56662 additions and 0 deletions
@@ -0,0 +1,52 @@
+import type { NextConfig } from "next";
+import {
+  CSP_CONNECT_HOSTS,
+  CSP_FRAME_HOSTS,
+  CSP_SCRIPT_HOSTS,
+} from "./src/lib/csp-hosts";
+
+const extra = (hosts: string[]) => (hosts.length ? ` ${hosts.join(" ")}` : "");
+
+const nextConfig: NextConfig = {
+  serverExternalPackages: ["pdfjs-dist"],
+  turbopack: {
+    resolveAlias: {
+      canvas: { browser: "" },
+    },
+  },
+  async headers() {
+    return [
+      {
+        source: "/(.*)",
+        headers: [
+          { key: "X-Content-Type-Options", value: "nosniff" },
+          { key: "X-Frame-Options", value: "DENY" },
+          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+          {
+            key: "Strict-Transport-Security",
+            value: "max-age=31536000; includeSubDomains",
+          },
+          {
+            key: "Content-Security-Policy",
+            value: [
+              "default-src 'self'",
+              "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://unpkg.com https://vercel.live" +
+                extra(CSP_SCRIPT_HOSTS),
+              "style-src 'self' 'unsafe-inline' https://vercel.live https://fonts.googleapis.com",
+              "img-src 'self' data: https: blob:",
+              "font-src 'self' data: https://vercel.live https://assets.vercel.com https://fonts.gstatic.com",
+              "connect-src 'self' blob: https://storage.googleapis.com https://vercel.live wss://ws-us3.pusher.com" +
+                extra(CSP_CONNECT_HOSTS) +
+                " " +
+                (process.env.NEXT_PUBLIC_API_URL?.trim() || "http://localhost:8000"),
+              "frame-src 'self' https://vercel.live" + extra(CSP_FRAME_HOSTS),
+              "worker-src 'self' blob:",
+            ].join("; "),
+          },
+        ],
+      },
+    ];
+  },
+};
+
+export default nextConfig;