fix: allow Jam uploads in CSP and drop ignored sendDefaultPii

PR #15 added https://*.jam.dev to script-src and frame-src, so the recorder
loads in production, but connect-src was never updated. The recorder had no
route to upload a capture. Add the origin to connect-src in both vercel.json
and nginx.conf, which the config test already requires to stay identical.

Sentry ignores sendDefaultPii entirely whenever dataCollection is set, so the
line read as a PII control that does nothing. Remove it and leave the
dataCollection block as the single source of truth. queryParams is correct at
the pinned @sentry/core 10.65.0; urlQueryParams does not exist until 10.68.

Both fixes get an assertion that fails without them.

Author: Programcode

nginx.conf

@@ -8,7 +8,7 @@ server {
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
 
     # Security headers
-    add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self' https://*.jam.dev; worker-src 'self' blob:; frame-src 'self' https://accounts.google.com https://*.jam.dev; connect-src 'self' https://uziwdtkzofptihahfooo.supabase.co https://*.supabase.co https://api.openai.com https://api.anthropic.com https://generativelanguage.googleapis.com https://r.jina.ai https://s.jina.ai https://oauth2.googleapis.com https://www.googleapis.com https://*.ingest.sentry.io https://*.sentry.io https://eu.i.posthog.com https://*.posthog.com;" always;
+    add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self' https://*.jam.dev; worker-src 'self' blob:; frame-src 'self' https://accounts.google.com https://*.jam.dev; connect-src 'self' https://*.jam.dev https://uziwdtkzofptihahfooo.supabase.co https://*.supabase.co https://api.openai.com https://api.anthropic.com https://generativelanguage.googleapis.com https://r.jina.ai https://s.jina.ai https://oauth2.googleapis.com https://www.googleapis.com https://*.ingest.sentry.io https://*.sentry.io https://eu.i.posthog.com https://*.posthog.com;" always;
     add_header X-Frame-Options "SAMEORIGIN" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;

src/lib/observability.ts

@@ -102,7 +102,8 @@ export function initializeObservability(): void {
       dsn: sentryDsn,
       environment: import.meta.env.MODE,
       ignoreErrors: [/^Synthetic observability verification$/],
-      sendDefaultPii: false,
+      // No sendDefaultPii: deprecated, and Sentry ignores it whenever
+      // dataCollection is set. The block below is the only PII control.
       beforeBreadcrumb: filterObservabilityBreadcrumb,
       dataCollection: {
         userInfo: false,

src/test/observability.test.ts

@@ -210,7 +210,6 @@ describe("observability primitives", () => {
     expect(sentryInitMock).toHaveBeenCalledWith(expect.objectContaining({
       dsn: "https://public-test@sentry.example/1",
       ignoreErrors: [/^Synthetic observability verification$/],
-      sendDefaultPii: false,
       beforeBreadcrumb: filterObservabilityBreadcrumb,
       dataCollection: {
         userInfo: false,
@@ -228,6 +227,9 @@ describe("observability primitives", () => {
       replaysSessionSampleRate: 0,
       replaysOnErrorSampleRate: 1,
     }));
+    // Deprecated and ignored whenever dataCollection is set: passing it would
+    // read as a PII control that does nothing.
+    expect(sentryInitMock.mock.calls[0][0]).not.toHaveProperty("sendDefaultPii");
     expect(browserTracingIntegrationMock).toHaveBeenCalledOnce();
     expect(replayIntegrationMock).toHaveBeenCalledWith({
       maskAllText: true,

src/test/vercel-deployment-config.test.ts

@@ -99,6 +99,8 @@ describe("Vercel frontend deployment configuration", () => {
 
     expect(csp).toContain("script-src 'self' https://*.jam.dev");
     expect(csp).toContain("frame-src 'self' https://accounts.google.com https://*.jam.dev");
+    // Loading the recorder is useless if it cannot upload the capture.
+    expect(csp).toContain("connect-src 'self' https://*.jam.dev");
     expect(nginxCsp).toBe(csp);
     expect(indexHtml).toContain('<script src="/src/bootstrap.ts" type="module"></script>');
     expect(indexHtml).not.toContain('<script type="module" src="/src/main.tsx"></script>');

vercel.json

@@ -15,7 +15,7 @@
       "headers": [
         {
           "key": "Content-Security-Policy",
-          "value": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self' https://*.jam.dev; worker-src 'self' blob:; frame-src 'self' https://accounts.google.com https://*.jam.dev; connect-src 'self' https://uziwdtkzofptihahfooo.supabase.co https://*.supabase.co https://api.openai.com https://api.anthropic.com https://generativelanguage.googleapis.com https://r.jina.ai https://s.jina.ai https://oauth2.googleapis.com https://www.googleapis.com https://*.ingest.sentry.io https://*.sentry.io https://eu.i.posthog.com https://*.posthog.com;"
+          "value": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self' https://*.jam.dev; worker-src 'self' blob:; frame-src 'self' https://accounts.google.com https://*.jam.dev; connect-src 'self' https://*.jam.dev https://uziwdtkzofptihahfooo.supabase.co https://*.supabase.co https://api.openai.com https://api.anthropic.com https://generativelanguage.googleapis.com https://r.jina.ai https://s.jina.ai https://oauth2.googleapis.com https://www.googleapis.com https://*.ingest.sentry.io https://*.sentry.io https://eu.i.posthog.com https://*.posthog.com;"
         },
         {
           "key": "X-Frame-Options",