refactor(config): restrict platform nextConfig overrides

Assisted-by: Codex 5.3

Author: cursoragent

apps/site/next.config.mjs

@@ -21,6 +21,16 @@ const { default: platform } = DEPLOY_TARGET
   ? await import(`@node-core/platform-${DEPLOY_TARGET}/next.platform.config`)
   : await import('./next.platform.config.mjs');
 
+/**
+ * Apply only an explicit allowlist of Next.js config keys from platform
+ * packages so critical core config (e.g. `webpack`, `turbopack`) cannot be
+ * overridden accidentally.
+ */
+const platformNextConfigOverrides = {
+  env: platform.nextConfig?.env,
+  deploymentId: platform.nextConfig?.deploymentId,
+};
+
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   // Full Support of React 18 SSR and Streaming
@@ -96,7 +106,7 @@ const nextConfig = {
     ...config,
     resolve: { ...resolve, alias: { ...resolve.alias, ...platform.aliases } },
   }),
-  ...platform.nextConfig,
+  ...platformNextConfigOverrides,
 };
 
 const withNextIntl = createNextIntlPlugin('./i18n.tsx');

packages/platform-cloudflare/next.platform.config.d.ts

@@ -0,0 +1,22 @@
+import type { NextConfig } from 'next';
+
+type PlatformMdxConfig = {
+  wasm?: boolean;
+  twoslash?: boolean;
+};
+
+type PlatformNextConfig = {
+  deploymentId?: string;
+  env?: NextConfig['env'];
+};
+
+export type PlatformConfig = {
+  aliases?: Record<string, string>;
+  images?: NextConfig['images'];
+  mdx?: PlatformMdxConfig;
+  nextConfig?: PlatformNextConfig;
+};
+
+declare const config: PlatformConfig;
+
+export default config;

packages/platform-vercel/next.platform.config.d.ts

@@ -0,0 +1,22 @@
+import type { NextConfig } from 'next';
+
+type PlatformMdxConfig = {
+  wasm?: boolean;
+  twoslash?: boolean;
+};
+
+type PlatformNextConfig = {
+  deploymentId?: string;
+  env?: NextConfig['env'];
+};
+
+export type PlatformConfig = {
+  aliases?: Record<string, string>;
+  images?: NextConfig['images'];
+  mdx?: PlatformMdxConfig;
+  nextConfig?: PlatformNextConfig;
+};
+
+declare const config: PlatformConfig;
+
+export default config;