@berachain/config 0.1.24-beta.3 → 0.1.24-beta.6

package/dist/internal/header-sources.cjs

@@ -1,27 +1,80 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 
-var _chunkONKAV4AGcjs = require('../chunk-ONKAV4AG.cjs');
+var _chunkB2BTOQVPcjs = require('../chunk-B2BTOQVP.cjs');
 
 
 var _chunkYT7WZDGIcjs = require('../chunk-YT7WZDGI.cjs');
 
 
-var _chunkZG7CKYT4cjs = require('../chunk-ZG7CKYT4.cjs');
+var _chunkSHM2VD4Acjs = require('../chunk-SHM2VD4A.cjs');
 require('../chunk-MQOVN5NH.cjs');
-require('../chunk-EPWUWEWI.cjs');
+require('../chunk-ZJEZCW5Z.cjs');
 
 
 
 
 
 
-var _chunkWRTYGXJMcjs = require('../chunk-WRTYGXJM.cjs');
 
-
-var _chunkADH7F47Tcjs = require('../chunk-ADH7F47T.cjs');
+var _chunkAU3LYJABcjs = require('../chunk-AU3LYJAB.cjs');
 require('../chunk-EYYJ2UZT.cjs');
-require('../chunk-75ZPJI57.cjs');
+
+// src/internal/dedupeCspSources.ts
+function parseSource(raw) {
+  const schemeSplit = raw.indexOf("://");
+  if (schemeSplit === -1) {
+    return void 0;
+  }
+  const scheme = raw.slice(0, schemeSplit).toLowerCase();
+  const rest = raw.slice(schemeSplit + 3);
+  const pathStart = rest.indexOf("/");
+  const host = (pathStart === -1 ? rest : rest.slice(0, pathStart)).toLowerCase();
+  const path = pathStart === -1 ? "/" : rest.slice(pathStart);
+  if (!host) {
+    return void 0;
+  }
+  return { raw, scheme, host, path };
+}
+function hostMatches(patternHost, targetHost) {
+  if (!patternHost.startsWith("*.")) {
+    return patternHost === targetHost;
+  }
+  const suffix = patternHost.slice(1);
+  return targetHost.endsWith(suffix) && targetHost.length > suffix.length;
+}
+function covers(pattern, target) {
+  if (pattern.scheme !== target.scheme) {
+    return false;
+  }
+  if (!hostMatches(pattern.host, target.host)) {
+    return false;
+  }
+  if (pattern.path.endsWith("/")) {
+    return target.path.startsWith(pattern.path);
+  }
+  return target.path === pattern.path;
+}
+function dedupeCspSources(sources) {
+  const parsed = sources.map((raw) => ({ raw, parsed: parseSource(raw) }));
+  return parsed.filter(({ parsed: target }, i) => {
+    if (!target) {
+      return true;
+    }
+    return !parsed.some(({ parsed: pattern }, j) => {
+      if (i === j || !pattern) {
+        return false;
+      }
+      if (!covers(pattern, target)) {
+        return false;
+      }
+      if (covers(target, pattern)) {
+        return j < i;
+      }
+      return true;
+    });
+  }).map(({ raw }) => raw);
+}
 
 // src/internal/sentry/getSentryKeys.ts
 function getSentryKeys({
@@ -47,8 +100,8 @@ function getSentryKeys({
     `https://${org}.ingest.us.sentry.io/api/${projectId}/security/?sentry_key=${key}`
   );
   cspEndpoint.searchParams.set("sentry_key", key);
-  cspEndpoint.searchParams.set("sentry_env", _chunkONKAV4AGcjs.sentryEnvironment);
-  cspEndpoint.searchParams.set("sentry_release", _chunkONKAV4AGcjs.sentryRelease);
+  cspEndpoint.searchParams.set("sentry_env", _chunkB2BTOQVPcjs.sentryEnvironment);
+  cspEndpoint.searchParams.set("sentry_release", _chunkB2BTOQVPcjs.sentryRelease);
   return {
     dsn: match[0],
     projectId,
@@ -60,146 +113,200 @@ function getSentryKeys({
 }
 
 // src/internal/header-sources.ts
+var config = _chunkSHM2VD4Acjs.chainConfigs[_chunkAU3LYJABcjs.defaultChainId];
+var modules = {
+  berachain: {
+    connect: [
+      "https://*.berachain.com/",
+      "https://*.berachain-staging.com/",
+      "https://raw.githubusercontent.com/berachain/metadata/",
+      `${_chunkAU3LYJABcjs.imageBaseUrl}/`,
+      "https://*.quiknode.pro",
+      _chunkAU3LYJABcjs.goldskyBaseUrl,
+      // Subgraph queries are served by same-origin typed REST endpoints under
+      // /api/honey/* and /api/pol/* (covered by 'self'), not direct browser
+      // requests to the upstream URLs.
+      config.pol.bribeBoostApi,
+      _chunkYT7WZDGIcjs.getUriFromLink.call(void 0, config.api),
+      _chunkAU3LYJABcjs.jsonRpcUrl,
+      _chunkAU3LYJABcjs.publicJsonRpcUrl,
+      _chunkAU3LYJABcjs.alchemyJsonRpcUrl,
+      "https://api.routescan.io/v2/network/"
+    ],
+    img: [
+      // trailing slash so sub-paths (e.g. /bend-curators/x.png/public) match;
+      // CSP path-matches exactly without it
+      `${_chunkAU3LYJABcjs.imageBaseUrl}/`,
+      "https://raw.githubusercontent.com/berachain/metadata/"
+    ]
+  },
+  beranames: {
+    connect: [
+      // avatars
+      "https://beranames-assets-berachain.s3.eu-central-003.backblazeb2.com/"
+    ],
+    img: [
+      "https://beranames-assets-berachain.s3.eu-central-003.backblazeb2.com/"
+    ]
+  },
+  swapAggregators: {
+    connect: [
+      `${config.bex.aggregatorsProxyUrl}/`,
+      "https://open-api.openocean.finance/",
+      "https://api.haiku.trade/",
+      "https://api.fly.trade/",
+      "https://api.enso.finance/"
+    ]
+  },
+  walletConnect: {
+    connect: [
+      "wss://relay.walletconnect.com/",
+      "wss://relay.walletconnect.org/",
+      "https://verify.walletconnect.org/v3/public-key"
+    ],
+    frame: [
+      "https://verify.walletconnect.com/",
+      "https://verify.walletconnect.org/"
+    ]
+  },
+  coinbaseWallet: {
+    connect: [
+      "wss://www.walletlink.org/rpc",
+      "https://www.walletlink.org/events",
+      "https://chain-proxy.wallet.coinbase.com/"
+    ]
+  },
+  metamask: {
+    connect: [
+      "wss://metamask-sdk.api.cx.metamask.io/socket.io/",
+      "https://metamask-sdk.api.cx.metamask.io"
+    ]
+  },
+  thirdweb: {
+    connect: ["https://*.thirdweb.com/"],
+    // export pk iframe
+    frame: ["https://embedded-wallet.thirdweb.com/"]
+  },
+  dynamic: {
+    connect: ["https://app.dynamicauth.com/api"]
+  },
+  porto: {
+    connect: ["https://rpc.porto.sh"],
+    frame: ["https://id.porto.sh"]
+  },
+  binance: {
+    connect: ["https://wallet.binance.com/tonbridge/"]
+  },
+  tron: {
+    connect: ["https://api.trongrid.io/"]
+  },
+  layerZero: {
+    connect: [
+      "https://api-mainnet.layerzero-scan.com/",
+      "https://api-testnet.layerzero-scan.com/"
+    ]
+  },
+  pelagus: {
+    img: ["https://pelaguswallet.io/docs/img"]
+  },
+  externalRpcs: {
+    // non-Berachain chains read by wallets/bridges
+    connect: [
+      "https://api.avax.network/ext/bc/C/rpc",
+      "https://polygon-rpc.com",
+      "https://mainnet.optimism.io/",
+      "https://arb1.arbitrum.io/rpc",
+      "https://mainnet.base.org/",
+      "https://eth.merkle.io"
+    ]
+  },
+  tokenIcons: {
+    img: [
+      "https://assets.coingecko.com/coins/images/",
+      "https://coin-images.coingecko.com/coins/images/",
+      "https://icons.llama.fi/",
+      "https://icons.llamao.fi/",
+      "https://static.debank.com/",
+      "https://raw.githubusercontent.com/trustwallet/assets/"
+    ]
+  },
+  bend: {
+    connect: [
+      // used to fetch tokens
+      "https://cdn.whisk.so/"
+    ],
+    img: ["https://cdn.whisk.so/", "https://cdn.morpho.org/"]
+  },
+  pyth: {
+    connect: ["https://hermes.pyth.network/v2/"]
+  },
+  fonts: {
+    font: [
+      "https://cdn.jsdelivr.net/npm/@fontsource/",
+      // collected by sentry (needed by browser extensions)
+      "https://fonts.gstatic.com",
+      "https://use.typekit.net/"
+    ]
+  },
+  sentry: {
+    // csp reporting
+    connect: ["https://*.sentry.io/"]
+  },
+  posthog: {
+    // toolbar + heatmaps
+    connect: ["https://*.posthog.com"],
+    img: ["https://*.posthog.com"],
+    frame: ["https://*.posthog.com"],
+    font: ["https://*.posthog.com"],
+    style: ["https://*.posthog.com"]
+  },
+  vercel: {
+    // toolbar + live comments
+    connect: ["https://vercel.live", "wss://ws-us3.pusher.com"],
+    img: ["https://vercel.live", "https://vercel.com"],
+    frame: ["https://vercel.live/"],
+    font: ["https://vercel.live", "https://assets.vercel.com"],
+    style: ["https://vercel.live"]
+  }
+};
+var headerSourceModules = modules;
 function getContentSecurityPolicy({
   isDevelopment,
   nonce,
   cspReporting,
+  modules: enabledModules = {},
   ...args
 }) {
   const defaultSrc = [];
-  const config = _chunkZG7CKYT4cjs.chainConfigs[_chunkADH7F47Tcjs.defaultChainId];
-  const connectionSources = [
-    // csp reporting
-    "https://*.sentry.io/",
-    "https://*.berachain.com/",
-    "https://*.berachain-staging.com/",
-    "wss://www.walletlink.org/rpc",
-    "https://*.thirdweb.com/",
-    "https://raw.githubusercontent.com/berachain/metadata/",
-    _chunkWRTYGXJMcjs.imageBaseUrl,
-    // QUICKNODE RPCs
-    "https://*.quiknode.pro",
-    // Beranames avatar
-    "https://beranames-assets-berachain.s3.eu-central-003.backblazeb2.com/",
-    _chunkWRTYGXJMcjs.goldskyBaseUrl,
-    // Subgraph queries are served by same-origin typed REST endpoints under
-    // /api/honey/* and /api/pol/* (covered by 'self'), not direct browser
-    // requests to the upstream URLs.
-    config.pol.bribeBoostApi,
-    _chunkYT7WZDGIcjs.getUriFromLink.call(void 0, config.api),
-    _chunkWRTYGXJMcjs.jsonRpcUrl,
-    _chunkWRTYGXJMcjs.publicJsonRpcUrl,
-    _chunkWRTYGXJMcjs.alchemyJsonRpcUrl,
-    "https://open-api.openocean.finance/",
-    "https://api.haiku.trade/",
-    "https://api.fly.trade/",
-    `${config.bex.aggregatorsProxyUrl}/`,
-    "wss://relay.walletconnect.com/",
-    "wss://relay.walletconnect.org/",
-    "https://verify.walletconnect.org/v3/public-key",
-    "https://api.routescan.io/v2/network/",
-    "wss://metamask-sdk.api.cx.metamask.io/socket.io/",
-    "https://metamask-sdk.api.cx.metamask.io",
-    "https://app.dynamicauth.com/api",
-    "https://www.walletlink.org/events",
-    "https://api.trongrid.io/",
-    "https://api-mainnet.layerzero-scan.com/",
-    "https://api-testnet.layerzero-scan.com/",
-    "https://chain-proxy.wallet.coinbase.com/",
-    "https://wallet.binance.com/tonbridge/",
-    "https://*.thirdweb.com/",
-    "https://eth.merkle.io/",
-    "https://cdn.whisk.so/",
-    // use to fetch tokens
-    // POSTHOG TOOLBAR
-    "https://*.posthog.com",
-    // VERCEL TOOLBAR
-    "https://vercel.live",
-    "wss://ws-us3.pusher.com",
-    // PYTH
-    "https://hermes.pyth.network/v2/",
-    // PORTO WALLET
-    "https://rpc.porto.sh",
-    // external rpc urls
-    "https://api.avax.network/ext/bc/C/rpc",
-    "https://polygon-rpc.com",
-    "https://mainnet.optimism.io/",
-    "https://arb1.arbitrum.io/rpc",
-    "wss://www.walletlink.org/rpc",
-    "https://eth.merkle.io",
-    "https://mainnet.base.org/",
-    // enso api
-    "https://api.enso.finance/",
-    "wss://www.walletlink.org/rpc"
-  ].concat(_nullishCoalesce(args.connectionSources, () => ( []))).filter((link) => {
-    if (!link) {
-      return false;
-    }
-    const url = _chunkYT7WZDGIcjs.getUriFromLink.call(void 0, link);
-    if (!url || url.trim() === "") {
-      return false;
-    }
-    if (url.startsWith(_chunkWRTYGXJMcjs.goldskyBaseUrl) && url !== _chunkWRTYGXJMcjs.goldskyBaseUrl) {
-      return false;
-    }
-    return true;
-  });
-  const pictureSources = [
-    _chunkWRTYGXJMcjs.imageBaseUrl,
-    "https://raw.githubusercontent.com/berachain/metadata/",
-    "https://assets.coingecko.com/coins/images/",
-    "https://coin-images.coingecko.com/coins/images/",
-    "https://beranames-assets-berachain.s3.eu-central-003.backblazeb2.com/",
-    "https://icons.llama.fi/",
-    "https://icons.llamao.fi/",
-    "https://static.debank.com/",
-    "https://cdn.whisk.so/",
-    // bend
-    "https://cdn.morpho.org/",
-    // bend
-    "https://raw.githubusercontent.com/trustwallet/assets/",
-    // bend
-    "https://pelaguswallet.io/docs/img",
-    // POSTHOG TOOLBAR
-    "https://*.posthog.com",
-    // VERCEL TOOLBAR
-    "https://vercel.live",
-    "https://vercel.com"
-  ].concat(_nullishCoalesce(args.pictureSources, () => ( []))).filter((url) => {
-    if (!url || url.trim() === "") {
-      return false;
-    }
-    return true;
-  });
-  const frameSources = [
-    "https://verify.walletconnect.com/",
-    "https://verify.walletconnect.org/",
-    // thirdweb export pk iframe
-    "https://embedded-wallet.thirdweb.com/",
-    // POSTHOG TOOLBAR
-    "https://*.posthog.com",
-    // VERCEL TOOLBAR
-    "https://vercel.live/",
-    // PORTO WALLET
-    "https://id.porto.sh"
-  ].concat(_nullishCoalesce(args.frameSources, () => ( [])));
-  const fontSources = [
-    "https://cdn.jsdelivr.net/npm/@fontsource/",
-    // POSTHOG TOOLBAR
-    "https://*.posthog.com",
-    // VERCEL TOOLBAR
-    "https://vercel.live",
-    "https://assets.vercel.com",
-    // collected by sentry (need by browsers extensions)
-    "https://fonts.gstatic.com",
-    "https://use.typekit.net/"
-  ].concat(_nullishCoalesce(args.fontSources, () => ( [])));
-  const styleSources = [
-    // POSTHOG TOOLBAR
-    "https://*.posthog.com",
-    // VERCEL TOOLBAR
-    "https://vercel.live"
-  ].concat(_nullishCoalesce(args.styleSources, () => ( [])));
+  function collect(directive) {
+    return Object.entries(headerSourceModules).filter(
+      ([module]) => enabledModules[module] !== false
+    ).flatMap(([, sources]) => _nullishCoalesce(sources[directive], () => ( []))).filter((url) => Boolean(_optionalChain([url, 'optionalAccess', _3 => _3.trim, 'call', _4 => _4()])));
+  }
+  const connectionSources = dedupeCspSources(
+    collect("connect").concat(_nullishCoalesce(args.connectionSources, () => ( []))).filter((link) => {
+      const url = _chunkYT7WZDGIcjs.getUriFromLink.call(void 0, link);
+      if (!url || url.trim() === "") {
+        return false;
+      }
+      if (url.startsWith(_chunkAU3LYJABcjs.goldskyBaseUrl) && url !== _chunkAU3LYJABcjs.goldskyBaseUrl) {
+        return false;
+      }
+      return true;
+    })
+  );
+  const pictureSources = dedupeCspSources(
+    collect("img").concat(_nullishCoalesce(args.pictureSources, () => ( [])))
+  );
+  const frameSources = dedupeCspSources(
+    collect("frame").concat(_nullishCoalesce(args.frameSources, () => ( [])))
+  );
+  const fontSources = dedupeCspSources(
+    collect("font").concat(_nullishCoalesce(args.fontSources, () => ( [])))
+  );
+  const styleSources = dedupeCspSources(
+    collect("style").concat(_nullishCoalesce(args.styleSources, () => ( [])))
+  );
   let cspHeader = `
     default-src 'self' ${defaultSrc.join(" ")};
     base-uri 'self';
@@ -223,7 +330,7 @@ function getContentSecurityPolicy({
 }
 var staticPictureSources = [
   // Only add image delivery URL if it exists and can be processed
-  _chunkWRTYGXJMcjs.imageBaseUrl,
+  `${_chunkAU3LYJABcjs.imageBaseUrl}/`,
   "https://raw.githubusercontent.com/berachain/metadata/",
   "https://assets.coingecko.com/coins/images/",
   "https://berachain.ghost.io/content/images/"
@@ -234,9 +341,10 @@ var staticPictureSources = [
   return true;
 });
 function cspMiddleware({
-  response
+  response,
+  modules: modules2
 }) {
-  const sentryCspEndpoint = _optionalChain([getSentryKeys, 'call', _3 => _3(), 'optionalAccess', _4 => _4.cspEndpoint]);
+  const sentryCspEndpoint = _optionalChain([getSentryKeys, 'call', _5 => _5(), 'optionalAccess', _6 => _6.cspEndpoint]);
   const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
   const isDevelopment = process.env.NODE_ENV === "development";
   const headers = [
@@ -244,8 +352,9 @@ function cspMiddleware({
       key: "Content-Security-Policy",
       value: getContentSecurityPolicy({
         isDevelopment,
-        cspReporting: _optionalChain([sentryCspEndpoint, 'optionalAccess', _5 => _5.toString, 'call', _6 => _6()]),
-        nonce
+        cspReporting: _optionalChain([sentryCspEndpoint, 'optionalAccess', _7 => _7.toString, 'call', _8 => _8()]),
+        nonce,
+        modules: modules2
       })
     },
     {
@@ -280,4 +389,5 @@ function cspMiddleware({
 
 
 
-exports.cspMiddleware = cspMiddleware; exports.getContentSecurityPolicy = getContentSecurityPolicy; exports.staticPictureSources = staticPictureSources;
+
+exports.cspMiddleware = cspMiddleware; exports.getContentSecurityPolicy = getContentSecurityPolicy; exports.headerSourceModules = headerSourceModules; exports.staticPictureSources = staticPictureSources;

package/dist/internal/header-sources.d.ts

@@ -1,7 +1,110 @@
 import type { NextRequest, NextResponse } from "next/server";
-export declare function getContentSecurityPolicy({ isDevelopment, nonce, cspReporting, ...args }: {
+/**
+ * CSP allowlists contributed by one integration, keyed by directive.
+ */
+interface HeaderSources {
+    /** connect-src */
+    connect?: Array<string | undefined>;
+    /** img-src */
+    img?: string[];
+    /** frame-src */
+    frame?: string[];
+    /** font-src */
+    font?: string[];
+    /** style-src */
+    style?: string[];
+}
+declare const modules: {
+    readonly berachain: {
+        readonly connect: ["https://*.berachain.com/", "https://*.berachain-staging.com/", "https://raw.githubusercontent.com/berachain/metadata/", "https://imagedelivery.net/qNj7Q3MCke89zoKzav7eDQ/", "https://*.quiknode.pro", "https://api.goldsky.com/api/public/project_clq1h5ct0g4a201x18tfte5iv/subgraphs/", string, string, string, string, string | undefined, "https://api.routescan.io/v2/network/"];
+        readonly img: ["https://imagedelivery.net/qNj7Q3MCke89zoKzav7eDQ/", "https://raw.githubusercontent.com/berachain/metadata/"];
+    };
+    readonly beranames: {
+        readonly connect: ["https://beranames-assets-berachain.s3.eu-central-003.backblazeb2.com/"];
+        readonly img: ["https://beranames-assets-berachain.s3.eu-central-003.backblazeb2.com/"];
+    };
+    readonly swapAggregators: {
+        readonly connect: [`${string}/`, "https://open-api.openocean.finance/", "https://api.haiku.trade/", "https://api.fly.trade/", "https://api.enso.finance/"];
+    };
+    readonly walletConnect: {
+        readonly connect: ["wss://relay.walletconnect.com/", "wss://relay.walletconnect.org/", "https://verify.walletconnect.org/v3/public-key"];
+        readonly frame: ["https://verify.walletconnect.com/", "https://verify.walletconnect.org/"];
+    };
+    readonly coinbaseWallet: {
+        readonly connect: ["wss://www.walletlink.org/rpc", "https://www.walletlink.org/events", "https://chain-proxy.wallet.coinbase.com/"];
+    };
+    readonly metamask: {
+        readonly connect: ["wss://metamask-sdk.api.cx.metamask.io/socket.io/", "https://metamask-sdk.api.cx.metamask.io"];
+    };
+    readonly thirdweb: {
+        readonly connect: ["https://*.thirdweb.com/"];
+        readonly frame: ["https://embedded-wallet.thirdweb.com/"];
+    };
+    readonly dynamic: {
+        readonly connect: ["https://app.dynamicauth.com/api"];
+    };
+    readonly porto: {
+        readonly connect: ["https://rpc.porto.sh"];
+        readonly frame: ["https://id.porto.sh"];
+    };
+    readonly binance: {
+        readonly connect: ["https://wallet.binance.com/tonbridge/"];
+    };
+    readonly tron: {
+        readonly connect: ["https://api.trongrid.io/"];
+    };
+    readonly layerZero: {
+        readonly connect: ["https://api-mainnet.layerzero-scan.com/", "https://api-testnet.layerzero-scan.com/"];
+    };
+    readonly pelagus: {
+        readonly img: ["https://pelaguswallet.io/docs/img"];
+    };
+    readonly externalRpcs: {
+        readonly connect: ["https://api.avax.network/ext/bc/C/rpc", "https://polygon-rpc.com", "https://mainnet.optimism.io/", "https://arb1.arbitrum.io/rpc", "https://mainnet.base.org/", "https://eth.merkle.io"];
+    };
+    readonly tokenIcons: {
+        readonly img: ["https://assets.coingecko.com/coins/images/", "https://coin-images.coingecko.com/coins/images/", "https://icons.llama.fi/", "https://icons.llamao.fi/", "https://static.debank.com/", "https://raw.githubusercontent.com/trustwallet/assets/"];
+    };
+    readonly bend: {
+        readonly connect: ["https://cdn.whisk.so/"];
+        readonly img: ["https://cdn.whisk.so/", "https://cdn.morpho.org/"];
+    };
+    readonly pyth: {
+        readonly connect: ["https://hermes.pyth.network/v2/"];
+    };
+    readonly fonts: {
+        readonly font: ["https://cdn.jsdelivr.net/npm/@fontsource/", "https://fonts.gstatic.com", "https://use.typekit.net/"];
+    };
+    readonly sentry: {
+        readonly connect: ["https://*.sentry.io/"];
+    };
+    readonly posthog: {
+        readonly connect: ["https://*.posthog.com"];
+        readonly img: ["https://*.posthog.com"];
+        readonly frame: ["https://*.posthog.com"];
+        readonly font: ["https://*.posthog.com"];
+        readonly style: ["https://*.posthog.com"];
+    };
+    readonly vercel: {
+        readonly connect: ["https://vercel.live", "wss://ws-us3.pusher.com"];
+        readonly img: ["https://vercel.live", "https://vercel.com"];
+        readonly frame: ["https://vercel.live/"];
+        readonly font: ["https://vercel.live", "https://assets.vercel.com"];
+        readonly style: ["https://vercel.live"];
+    };
+};
+export type HeaderSourceModule = keyof typeof modules;
+/**
+ * CSP sources grouped by the integration that needs them. All modules are
+ * enabled by default; consumers opt out per module via `modules` on
+ * {@link getContentSecurityPolicy} / {@link cspMiddleware}.
+ */
+export declare const headerSourceModules: Record<HeaderSourceModule, HeaderSources>;
+export declare function getContentSecurityPolicy({ isDevelopment, nonce, cspReporting, modules: enabledModules, ...args }: {
     isDevelopment: boolean;
     nonce: string;
+    /** per-module toggle; all modules default to `true`, set `false` to exclude one from every directive */
+    modules?: Partial<Record<HeaderSourceModule, boolean>>;
     frameSources?: string[];
     fontSources?: string[];
     pictureSources?: string[];
@@ -13,8 +116,11 @@ export declare function getContentSecurityPolicy({ isDevelopment, nonce, cspRepo
  * Static picture sources that are used in static-monobera.
  */
 export declare const staticPictureSources: string[];
-export declare function cspMiddleware({ response, }: {
+export declare function cspMiddleware({ response, modules, }: {
     request: NextRequest;
     response: NextResponse;
+    /** per-module toggle; all modules default to `true`, set `false` to exclude one from the CSP */
+    modules?: Partial<Record<HeaderSourceModule, boolean>>;
 }): NextResponse<unknown>;
+export {};
 //# sourceMappingURL=header-sources.d.ts.map

package/dist/internal/header-sources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"header-sources.d.ts","sourceRoot":"","sources":["../../src/internal/header-sources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAa7D,wBAAgB,wBAAwB,CAAC,EACvC,aAAa,EACb,KAAK,EACL,YAAY,EACZ,GAAG,IAAI,EACR,EAAE;IACD,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CAsLT;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAWvC,CAAC;AAEH,wBAAgB,aAAa,CAAC,EAC5B,QAAQ,GACT,EAAE;IACD,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;CACxB,yBA6CA"}
+{"version":3,"file":"header-sources.d.ts","sourceRoot":"","sources":["../../src/internal/header-sources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgB7D;;GAEG;AACH,UAAU,aAAa;IACrB,kBAAkB;IAClB,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpC,cAAc;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,gBAAgB;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,gBAAgB;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0JqC,CAAC;AAEnD,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,OAAO,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,EAAE,aAAa,CACjE,CAAC;AAEV,wBAAgB,wBAAwB,CAAC,EACvC,aAAa,EACb,KAAK,EACL,YAAY,EACZ,OAAO,EAAE,cAAmB,EAC5B,GAAG,IAAI,EACR,EAAE;IACD,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,wGAAwG;IACxG,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CAwET;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAWvC,CAAC;AAEH,wBAAgB,aAAa,CAAC,EAC5B,QAAQ,EACR,OAAO,GACR,EAAE;IACD,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;IACvB,gGAAgG;IAChG,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD,yBA8CA"}