fix: constrain PWA caching and extend font CSP

packages/styles/src/config.ts

@@ -514,7 +514,8 @@ export async function loadAppConfig(appRoot: string, profile?: string): Promise<
 
 /**
  * Auto-extend the CSP so configured Google Fonts load under the default policy
- * (their CSS host into `style-src`, the static host into `font-src`). No-op when
+ * (their CSS host into `style-src`, the static host into `font-src`, and the
+ * static host into `connect-src` for service-worker fetch interception). No-op when
  * the app disabled CSP (`security.contentSecurityPolicy: false`) or uses no
  * Google Fonts. Local (self-hosted) fonts are served from `'self'` and need nothing.
  */
@@ -532,7 +533,10 @@ function applyFontCsp(config: AppConfig): void {
     dirs[name] = Array.from(new Set([...cur, ...adds]));
   };
   if (add.style.length) extend("style-src", ["'self'", "'unsafe-inline'"], add.style);
-  if (add.font.length) extend("font-src", ["'self'", "data:"], add.font);
+  if (add.font.length) {
+    extend("font-src", ["'self'", "data:"], add.font);
+    extend("connect-src", ["'self'", "ws:", "wss:"], add.font);
+  }
 }
 
 /**

packages/styles/test/config.test.ts

@@ -196,6 +196,38 @@ test("loadAppConfig loads env before evaluating the config module", async () =>
   }
 });
 
+test("Google Fonts CSP supports direct fonts and service-worker fetches", async () => {
+  const dir = mkdtempSync(join(tmpdir(), "wrnexus-font-csp-"));
+  try {
+    writeFileSync(
+      join(dir, "wrnexus.config.ts"),
+      `export default {
+        fonts: { google: [{ family: "Inter" }] },
+        security: {
+          contentSecurityPolicy: {
+            directives: { "connect-src": ["'self'", "https://api.example.com"] }
+          }
+        }
+      };\n`,
+    );
+
+    const config = await loadAppConfig(dir, "production");
+    const directives =
+      config.security?.contentSecurityPolicy === false
+        ? undefined
+        : config.security?.contentSecurityPolicy?.directives;
+    expect(directives?.["style-src"]).toContain("https://fonts.googleapis.com");
+    expect(directives?.["font-src"]).toContain("https://fonts.gstatic.com");
+    expect(directives?.["connect-src"]).toEqual([
+      "'self'",
+      "https://api.example.com",
+      "https://fonts.gstatic.com",
+    ]);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 test("package-aware styles add relative imports and Tailwind scan sources", async () => {
   const root = mkdtempSync(join(tmpdir(), "wrnexus-styles-"));
   try {