ATlast — you'll never need to find your favorites on another platform again. Find your favs in the ATmosphere.
atproto
1[build]
2 base = "/"
3 command = "pnpm run build"
4 functions = "packages/functions/src"
5 publish = "packages/web/dist"
6
7[dev]
8 framework = "#custom"
9 command = "npm run --prefix packages/web dev:full"
10 targetPort = 5175
11 port = 8888
12 functionsPort = 9999
13 autoLaunch = true
14
15[[redirects]]
16 from = "/oauth-client-metadata.json"
17 to = "/.netlify/functions/client-metadata"
18 status = 200
19
20[[redirects]]
21 from = "/oauth/callback"
22 to = "/.netlify/functions/oauth-callback"
23 status = 200
24
25[[headers]]
26 for = "/oauth-client-metadata.json"
27 [headers.values]
28 Access-Control-Allow-Origin = "*"
29 Cache-Control = "public, max-age=3600"
30
31[[headers]]
32 for = "/.well-known/*"
33 [headers.values]
34 Access-Control-Allow-Origin = "*"
35
36[[headers]]
37 for = "/*"
38 [headers.values]
39 X-Frame-Options = "DENY"
40 X-Content-Type-Options = "nosniff"
41 X-XSS-Protection = "1; mode=block"
42 Referrer-Policy = "strict-origin-when-cross-origin"
43 Permissions-Policy = "geolocation=(), microphone=(), camera=()"
44 # CSP relaxed for dev mode - script-src includes 'unsafe-eval' for Vite HMR
45 # In production, Netlify will use build context to apply stricter CSP
46 Content-Security-Policy = "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' ws: wss: http://localhost:* http://127.0.0.1:* https://*.bsky.app https://*.bsky.network https://public.api.bsky.app; frame-ancestors 'none'; base-uri 'self'; form-action 'self';"