feat(build): add GEOLIBRE_NO_EXTERNAL_CDN flag to disable external CDN

apps/geolibre-desktop/src/lib/detection-models.ts

@@ -118,22 +118,24 @@ export interface BuiltinDetectionModel {
   inputSize: number;
 }
 
-export const BUILTIN_DETECTION_MODELS: readonly BuiltinDetectionModel[] = [
-  {
-    id: "yolov8n-coco",
-    label: "YOLOv8n (COCO, 80 classes)",
-    url: "https://cdn.jsdelivr.net/gh/Hyuto/yolov8-onnxruntime-web@fc4a52c466d15ad4519873a0cef22fbc935b93b6/public/model/yolov8n.onnx",
-    classNames: COCO_CLASSES,
-    inputSize: 640,
-  },
-  {
-    id: "yolov5n-coco",
-    label: "YOLOv5n (COCO, 80 classes)",
-    url: "https://cdn.jsdelivr.net/gh/Hyuto/yolov5-onnxruntime-web@203637cc45962e40a81b2a7e78f98813f93971db/public/model/yolov5n.onnx",
-    classNames: COCO_CLASSES,
-    inputSize: 640,
-  },
-];
+export const BUILTIN_DETECTION_MODELS: readonly BuiltinDetectionModel[] = __NO_EXTERNAL_CDN__
+  ? []
+  : [
+      {
+        id: "yolov8n-coco",
+        label: "YOLOv8n (COCO, 80 classes)",
+        url: "https://cdn.jsdelivr.net/gh/Hyuto/yolov8-onnxruntime-web@fc4a52c466d15ad4519873a0cef22fbc935b93b6/public/model/yolov8n.onnx",
+        classNames: COCO_CLASSES,
+        inputSize: 640,
+      },
+      {
+        id: "yolov5n-coco",
+        label: "YOLOv5n (COCO, 80 classes)",
+        url: "https://cdn.jsdelivr.net/gh/Hyuto/yolov5-onnxruntime-web@203637cc45962e40a81b2a7e78f98813f93971db/public/model/yolov5n.onnx",
+        classNames: COCO_CLASSES,
+        inputSize: 640,
+      },
+    ];
 
 /** Cache bucket holding downloaded model files so a model is fetched once. */
 const MODEL_CACHE = "geolibre-detection-models";

apps/geolibre-desktop/src/lib/pyodide/pyodide-config.ts

@@ -9,7 +9,9 @@ import { getRuntimeEnvironment } from "@geolibre/core";
 
 export const PYODIDE_VERSION = "0.27.7";
 
-const DEFAULT_INDEX_URL = `https://cdn.jsdelivr.net/pyodide/v${PYODIDE_VERSION}/full/`;
+const DEFAULT_INDEX_URL = __NO_EXTERNAL_CDN__
+  ? ""
+  : `https://cdn.jsdelivr.net/pyodide/v${PYODIDE_VERSION}/full/`;
 
 /**
  * Resolve the Pyodide indexURL (where pyodide.js, the wasm runtime, the

apps/geolibre-desktop/src/lib/storymap-export.ts

@@ -81,6 +81,15 @@ const BLANK_EXPORT_STYLE: Record<string, unknown> = {
  * @returns A complete HTML document as a string.
  */
 export function buildStoryMapHtml(options: StoryMapExportOptions): string {
+  // The exported standalone HTML loads maplibre-gl, scrollama, and the RTL text
+  // plugin from external CDNs (unpkg.com). When external CDN references are
+  // stripped from the build, the export cannot produce a functioning page.
+  if (__NO_EXTERNAL_CDN__) {
+    throw new Error(
+      "Story map HTML export is unavailable in this build (external CDN resources are disabled).",
+    );
+  }
+
   const {
     storymap,
     basemapStyleUrl,

apps/geolibre-desktop/src/vite-env.d.ts

@@ -21,6 +21,14 @@ declare const __GEOLIBRE_MAS_BUILD__: boolean;
 // vite.config.ts.
 declare const __GEOLIBRE_EMBED_BUILD__: boolean;
 
+// True when the build is configured with GEOLIBRE_NO_EXTERNAL_CDN=1 to strip
+// all references to external CDN origins (unpkg.com, cdn.jsdelivr.net, etc.).
+// Features that depend on externally hosted resources (storymap HTML export,
+// built-in object detection models, ONNX WASM, 3D Tiles decoders, Pyodide) are
+// disabled or degraded. Intended for deployments that cannot load from untrusted
+// CDNs (e.g. Amazon/Harmony). See vite.config.ts.
+declare const __NO_EXTERNAL_CDN__: boolean;
+
 // jsDelivr URLs for the PGlite engine and its PostGIS extension, injected by
 // vite.config.ts. Only the embed (Jupyter wheel) build reads them, from
 // pglite-loader.cdn.ts; web/desktop builds bundle PGlite and never reference

apps/geolibre-desktop/vite.config.ts

@@ -110,6 +110,21 @@ if (!process.env.VITE_GEE_OAUTH_CLIENT_ID) {
 // the service worker from the desktop bundle.
 const IS_TAURI_BUILD = !!process.env.TAURI_ENV_PLATFORM;
 
+// Strip ALL external CDN references (unpkg.com, cdn.jsdelivr.net, etc.) from the
+// build output. When set, features that depend on external CDN-hosted resources
+// (storymap HTML export, object detection models, ONNX WASM, 3D Tiles decoders,
+// Pyodide, PGlite, CereusDB, GDAL) are either disabled or degraded. Intended for
+// deployments that cannot reference untrusted external CDNs (e.g. Harmony/Amazon).
+// This implicitly forces GEOLIBRE_PGLITE_CDN=0, GEOLIBRE_CEREUS_CDN=0,
+// GEOLIBRE_GDAL_CDN=0, and GEOLIBRE_DUCKDB_WASM_CDN=0.
+const NO_EXTERNAL_CDN = process.env.GEOLIBRE_NO_EXTERNAL_CDN === "1";
+if (NO_EXTERNAL_CDN) {
+  process.env.GEOLIBRE_PGLITE_CDN = "0";
+  process.env.GEOLIBRE_CEREUS_CDN = "0";
+  process.env.GEOLIBRE_GDAL_CDN = "0";
+  process.env.GEOLIBRE_DUCKDB_WASM_CDN = "0";
+}
+
 // PGlite + PostGIS is ~25 MB raw and weighs ~22 MB inside the Tauri binary
 // (postgis.tar is pre-gzipped, so brotli can't shrink it — it was the entire
 // 42 → 63 MB binary regression). By default it is fetched from jsDelivr at
@@ -908,6 +923,7 @@ export default defineConfig({
     __GEOLIBRE_STORE_BUILD__: JSON.stringify(IS_STORE_BUILD),
     __GEOLIBRE_MAS_BUILD__: JSON.stringify(IS_MAS_BUILD),
     __GEOLIBRE_EMBED_BUILD__: JSON.stringify(IS_EMBED),
+    __NO_EXTERNAL_CDN__: JSON.stringify(NO_EXTERNAL_CDN),
     __PGLITE_CDN_URL__: JSON.stringify(PGLITE_CDN_URL),
     __PGLITE_POSTGIS_CDN_URL__: JSON.stringify(PGLITE_POSTGIS_CDN_URL),
     __CEREUS_WASM_CDN_URL__: JSON.stringify(CEREUS_WASM_CDN_URL),

package.json

@@ -34,6 +34,10 @@
     "msix:build": "pwsh -NoProfile -ExecutionPolicy Bypass -File packaging/msix/build-msix.ps1",
     "portable:build": "pwsh -NoProfile -ExecutionPolicy Bypass -File packaging/portable/build-portable.ps1"
   },
+  "dependencies": {
+    "@auth0/auth0-react": "^2.24.0",
+    "@clerk/react": "^6.14.1"
+  },
   "devDependencies": {
     "@axe-core/playwright": "^4.12.1",
     "@playwright/test": "^1.62.1",

packages/plugins/src/plugins/maplibre-3d-tiles.ts

@@ -48,8 +48,12 @@ const THREE_D_TILES_LAYER_ID = "geolibre-3d-tiles";
 // against. Only used as a fallback when the control does not expose its own
 // decoder paths (see getThreeDTilesDecoderOptions).
 const THREE_VERSION = "0.184.0";
-const DEFAULT_DRACO_DECODER_PATH = `https://unpkg.com/three@${THREE_VERSION}/examples/jsm/libs/draco/`;
-const DEFAULT_KTX2_TRANSCODER_PATH = `https://unpkg.com/three@${THREE_VERSION}/examples/jsm/libs/basis/`;
+const DEFAULT_DRACO_DECODER_PATH = __NO_EXTERNAL_CDN__
+  ? ""
+  : `https://unpkg.com/three@${THREE_VERSION}/examples/jsm/libs/draco/`;
+const DEFAULT_KTX2_TRANSCODER_PATH = __NO_EXTERNAL_CDN__
+  ? ""
+  : `https://unpkg.com/three@${THREE_VERSION}/examples/jsm/libs/basis/`;
 const GOOGLE_PHOTOREALISTIC_TILES_URL = "https://tile.googleapis.com/v1/3dtiles/root.json";
 const GOOGLE_PHOTOREALISTIC_TILES_LABEL = "Google Photorealistic 3D Tiles";
 const ARCGIS_I3S_SAMPLE_TILES_URL =

packages/processing/src/ort.ts

@@ -11,7 +11,9 @@
 // (tests/object-detection.test.ts) so a dependency bump that forgets this
 // constant fails CI instead of breaking inference at runtime.
 export const ORT_VERSION = "1.27.0";
-const ORT_WASM_BASE = `https://cdn.jsdelivr.net/npm/onnxruntime-web@${ORT_VERSION}/dist/`;
+const ORT_WASM_BASE = __NO_EXTERNAL_CDN__
+  ? ""
+  : `https://cdn.jsdelivr.net/npm/onnxruntime-web@${ORT_VERSION}/dist/`;
 
 // A promise singleton: the import-and-configure runs exactly once and every
 // caller awaits the same settled promise, so concurrent tool calls cannot race
@@ -30,6 +32,14 @@ let ortPromise: Promise<typeof import("onnxruntime-web/wasm")> | null = null;
  */
 export function loadOrt(): Promise<typeof import("onnxruntime-web/wasm")> {
   if (!ortPromise) {
+    if (__NO_EXTERNAL_CDN__) {
+      ortPromise = Promise.reject(
+        new Error(
+          "ONNX Runtime WASM is unavailable in this build (external CDN resources are disabled).",
+        ),
+      );
+      return ortPromise;
+    }
     ortPromise = import("onnxruntime-web/wasm")
       .then((ort) => {
         ort.env.wasm.numThreads = 1;