@berachain/config 0.1.23 → 0.1.24-beta.0

package/dist/internal/header-sources.cjs

@@ -208,7 +208,7 @@ function getContentSecurityPolicy({
     base-uri 'self';
     frame-src 'self' ${frameSources.join(" ")};
     frame-ancestors 'self' https://*.posthog.com;
-    script-src 'self' 'sha256-k2HGvaYkGyYZxOwKGxgE1mr06tZEDcEXNZ5mdcldK0o=' 'nonce-${nonce}' https://*.posthog.com 'strict-dynamic' ${isDevelopment ? "'unsafe-eval'" : ""};
+    script-src 'self' 'sha256-k2HGvaYkGyYZxOwKGxgE1mr06tZEDcEXNZ5mdcldK0o=' ${nonce ? `'nonce-${nonce}'` : ""} https://*.posthog.com 'strict-dynamic' ${isDevelopment ? "'unsafe-eval'" : ""};
     worker-src 'self' blob: data:;
     font-src 'self' ${fontSources.join(" ")};
     style-src 'self' ${styleSources.join(" ")} 'unsafe-inline';
@@ -237,10 +237,11 @@ var staticPictureSources = [
   return true;
 });
 function cspMiddleware({
+  useDynamicCsp = true,
   response
 }) {
   const sentryCspEndpoint = _optionalChain([getSentryKeys, 'call', _3 => _3(), 'optionalAccess', _4 => _4.cspEndpoint]);
-  const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
+  const nonce = useDynamicCsp ? Buffer.from(crypto.randomUUID()).toString("base64") : void 0;
   const isDevelopment = process.env.NODE_ENV === "development";
   const headers = [
     {
@@ -259,10 +260,7 @@ function cspMiddleware({
       key: "X-Content-Type-Options",
       value: "nosniff"
     },
-    {
-      key: "X-Nonce",
-      value: nonce
-    }
+    ...nonce ? [{ key: "X-Nonce", value: nonce }] : []
   ];
   if (sentryCspEndpoint) {
     headers.push({

package/dist/internal/header-sources.d.ts

@@ -1,7 +1,14 @@
 import type { NextRequest, NextResponse } from "next/server";
+/** Builds the Content-Security-Policy header value. */
 export declare function getContentSecurityPolicy({ isDevelopment, nonce, cspReporting, ...args }: {
     isDevelopment: boolean;
-    nonce: string;
+    /**
+     * Per-request nonce for `script-src`. Required for dynamic CSP; omit it for
+     * static CSP (no per-request header), in which case the `'nonce-...'` token
+     * is dropped and scripts are gated by `'strict-dynamic'` plus the inlined
+     * sha256 hash instead.
+     */
+    nonce?: string;
     frameSources?: string[];
     fontSources?: string[];
     pictureSources?: string[];
@@ -13,7 +20,8 @@ export declare function getContentSecurityPolicy({ isDevelopment, nonce, cspRepo
  * Static picture sources that are used in static-monobera.
  */
 export declare const staticPictureSources: string[];
-export declare function cspMiddleware({ response, }: {
+export declare function cspMiddleware({ useDynamicCsp, response, }: {
+    useDynamicCsp?: boolean;
     request: NextRequest;
     response: NextResponse;
 }): NextResponse<unknown>;

package/dist/internal/header-sources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"header-sources.d.ts","sourceRoot":"","sources":["../../src/internal/header-sources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAa7D,wBAAgB,wBAAwB,CAAC,EACvC,aAAa,EACb,KAAK,EACL,YAAY,EACZ,GAAG,IAAI,EACR,EAAE;IACD,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CAyLT;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAWvC,CAAC;AAEH,wBAAgB,aAAa,CAAC,EAC5B,QAAQ,GACT,EAAE;IACD,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;CACxB,yBA6CA"}
+{"version":3,"file":"header-sources.d.ts","sourceRoot":"","sources":["../../src/internal/header-sources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAa7D,uDAAuD;AACvD,wBAAgB,wBAAwB,CAAC,EACvC,aAAa,EACb,KAAK,EACL,YAAY,EACZ,GAAG,IAAI,EACR,EAAE;IACD,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CA2LT;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAWvC,CAAC;AAEH,wBAAgB,aAAa,CAAC,EAC5B,aAAoB,EACpB,QAAQ,GACT,EAAE;IACD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;CACxB,yBA4CA"}

package/dist/internal/header-sources.mjs

@@ -208,7 +208,7 @@ function getContentSecurityPolicy({
     base-uri 'self';
     frame-src 'self' ${frameSources.join(" ")};
     frame-ancestors 'self' https://*.posthog.com;
-    script-src 'self' 'sha256-k2HGvaYkGyYZxOwKGxgE1mr06tZEDcEXNZ5mdcldK0o=' 'nonce-${nonce}' https://*.posthog.com 'strict-dynamic' ${isDevelopment ? "'unsafe-eval'" : ""};
+    script-src 'self' 'sha256-k2HGvaYkGyYZxOwKGxgE1mr06tZEDcEXNZ5mdcldK0o=' ${nonce ? `'nonce-${nonce}'` : ""} https://*.posthog.com 'strict-dynamic' ${isDevelopment ? "'unsafe-eval'" : ""};
     worker-src 'self' blob: data:;
     font-src 'self' ${fontSources.join(" ")};
     style-src 'self' ${styleSources.join(" ")} 'unsafe-inline';
@@ -237,10 +237,11 @@ var staticPictureSources = [
   return true;
 });
 function cspMiddleware({
+  useDynamicCsp = true,
   response
 }) {
   const sentryCspEndpoint = getSentryKeys()?.cspEndpoint;
-  const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
+  const nonce = useDynamicCsp ? Buffer.from(crypto.randomUUID()).toString("base64") : void 0;
   const isDevelopment = process.env.NODE_ENV === "development";
   const headers = [
     {
@@ -259,10 +260,7 @@ function cspMiddleware({
       key: "X-Content-Type-Options",
       value: "nosniff"
     },
-    {
-      key: "X-Nonce",
-      value: nonce
-    }
+    ...nonce ? [{ key: "X-Nonce", value: nonce }] : []
   ];
   if (sentryCspEndpoint) {
     headers.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@berachain/config",
-  "version": "0.1.23",
+  "version": "0.1.24-beta.0",
   "type": "module",
   "files": [
     "dist",