perf: preconnect to cross-origin hosts on the critical path

[alukach]

Part of #471.

What

Adds two preconnect hints in the root layout. The app currently has no preconnect or dns-prefetch anywhere.

Why

Neither origin is known to the browser until late in the load:

• assets.radiant.earth serves the four Berkeley Mono @font-face URLs declared in src/styles/globals.css. The browser can't discover them until that render-blocking stylesheet parses — 5247 ms into a real-throttled 4G load — so the TCP + TLS handshake starts cold at the worst possible moment.
• Ory session host (/sessions/whoami) is flagged by Lighthouse as a preconnect candidate worth 272 ms of LCP.

Details worth reviewing

crossOrigin is set on the font host only. Fonts are fetched in CORS mode and need an anonymous socket; a preconnect without crossorigin would open the wrong kind of connection and the font would pay for a second handshake. The Ory session request is credentialed, so it needs the normal (non-anonymous) socket — adding crossorigin there would be the same mistake in reverse.

The auth hint is conditional. CONFIG.auth.api.backendUrl is empty in dev, where middleware serves auth pages locally, and <link rel="preconnect" href=""> would resolve to the page's own origin. I used backendUrl rather than frontendUrl because /sessions/whoami is a Ory backend/SDK call. Env is read via CONFIG per the project convention rather than process.env directly.

The href is passed whole — preconnect uses the origin of the given URL, so no parsing is needed even if the value carries a path.

Follow-up

The real fix for the font is self-hosting it via next/font/local, which would put it on the same connection and allow a genuine preload. That's blocked on a licensing decision (Berkeley Mono is commercially licensed and this is a public repo) — tracked in #471. preconnect is the safe interim step.

Verification

• npm run type-check — 14 errors, identical to the count on clean main (all pre-existing, in analytics/ files)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
source-cooperative	Ready	Preview	Aug 3, 2026 4:30pm

[claude]

Claude finished @alukach's task in 1m 14s —— View job

---

✅ No blocking issues — safe to merge.

• src/app/layout.tsx:30-34 — crossOrigin="" on the assets.radiant.earth preconnect correctly maps to crossorigin="anonymous", matching how @font-face fetches are always CORS-mode. Verified the font URLs in src/styles/globals.css do live on assets.radiant.earth.
• src/app/layout.tsx:35-37 — CONFIG.auth.api.backendUrl (from NEXT_PUBLIC_ORY_SDK_URL) is the same base path used by the actual /sessions/whoami request in src/lib/api/page-session.ts:17, so the preconnect target matches the real request host. The conditional guard correctly avoids rendering preconnect with an empty/undefined href in dev.
• No crossorigin on the Ory preconnect is correct — that request is credentialed, not CORS-anonymous.

Nothing to flag — the diff is small, self-contained, and the two hints are each justified by a genuinely cross-origin, render-relevant host.