@berachain/config 0.1.25 → 0.1.26-beta.0

package/dist/{chunk-OA5M6XYF.cjs → chunk-2JZ7QJEW.cjs}

@@ -76,13 +76,6 @@ var IMAGE_REMOTE_PATTERNS = [
     hostname: "imagedelivery.net",
     port: "",
     pathname: "/qNj7Q3MCke89zoKzav7eDQ/**"
-  },
-  {
-    protocol: "https",
-    hostname: "www.clearstar.xyz",
-    // bend curator logo
-    port: "",
-    pathname: "/logo.png"
   }
 ];
 

package/dist/{chunk-4WAGOEXT.mjs → chunk-AP2XG6GJ.mjs}

@@ -76,13 +76,6 @@ var IMAGE_REMOTE_PATTERNS = [
     hostname: "imagedelivery.net",
     port: "",
     pathname: "/qNj7Q3MCke89zoKzav7eDQ/**"
-  },
-  {
-    protocol: "https",
-    hostname: "www.clearstar.xyz",
-    // bend curator logo
-    port: "",
-    pathname: "/logo.png"
   }
 ];
 

package/dist/internal/header-sources.cjs

@@ -127,6 +127,7 @@ var modules = {
       // /api/honey/* and /api/pol/* (covered by 'self'), not direct browser
       // requests to the upstream URLs.
       config.pol.bribeBoostApi,
+      _chunkYT7WZDGIcjs.getUriFromLink.call(void 0, config.beep),
       _chunkYT7WZDGIcjs.getUriFromLink.call(void 0, config.api),
       _chunkAU3LYJABcjs.jsonRpcUrl,
       _chunkAU3LYJABcjs.publicJsonRpcUrl,
@@ -274,8 +275,8 @@ var modules = {
 var headerSourceModules = modules;
 function getContentSecurityPolicy({
   isDevelopment,
-  nonce,
   cspReporting,
+  dynamicScriptCsp = {},
   modules: enabledModules = {},
   ...args
 }) {
@@ -315,12 +316,21 @@ function getContentSecurityPolicy({
   const mediaSources = dedupeCspSources(
     collect("media").concat(_nullishCoalesce(args.mediaSources, () => ( [])))
   );
+  const scriptSources = dynamicScriptCsp === "disabled" ? dedupeCspSources(collect("script").concat(_nullishCoalesce(args.scriptSources, () => ( [])))) : dedupeCspSources(
+    [
+      "'strict-dynamic'",
+      isDevelopment ? "'unsafe-eval'" : "",
+      "'sha256-k2HGvaYkGyYZxOwKGxgE1mr06tZEDcEXNZ5mdcldK0o='",
+      dynamicScriptCsp.nonce ? `'nonce-${dynamicScriptCsp.nonce}'` : "",
+      ..._nullishCoalesce(dynamicScriptCsp.sha, () => ( []))
+    ].filter((source) => source !== "")
+  );
   let cspHeader = `
     default-src 'self' ${defaultSrc.join(" ")};
     base-uri 'self';
     frame-src 'self' ${frameSources.join(" ")};
     frame-ancestors 'self' https://*.posthog.com;
-    script-src 'self' 'sha256-k2HGvaYkGyYZxOwKGxgE1mr06tZEDcEXNZ5mdcldK0o=' 'nonce-${nonce}' 'strict-dynamic' ${isDevelopment ? "'unsafe-eval'" : ""};
+    script-src 'self' ${scriptSources.join(" ")};
     worker-src 'self' blob: data: ${workerSources.join(" ")};
     font-src 'self' ${fontSources.join(" ")};
     style-src 'self' ${styleSources.join(" ")} 'unsafe-inline';
@@ -353,16 +363,19 @@ function cspMiddleware({
   csp
 }) {
   const sentryCspEndpoint = _optionalChain([getSentryKeys, 'call', _5 => _5(), 'optionalAccess', _6 => _6.cspEndpoint]);
-  const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
+  const nonce = _optionalChain([csp, 'optionalAccess', _7 => _7.dynamicScriptCsp]) !== "disabled" ? _nullishCoalesce(_optionalChain([csp, 'optionalAccess', _8 => _8.dynamicScriptCsp, 'optionalAccess', _9 => _9.nonce]), () => ( Buffer.from(crypto.randomUUID()).toString("base64"))) : void 0;
   const isDevelopment = process.env.NODE_ENV === "development";
   const headers = [
     {
       key: "Content-Security-Policy",
       value: getContentSecurityPolicy({
         ...csp,
+        dynamicScriptCsp: _optionalChain([csp, 'optionalAccess', _10 => _10.dynamicScriptCsp]) === "disabled" ? csp.dynamicScriptCsp : {
+          ..._optionalChain([csp, 'optionalAccess', _11 => _11.dynamicScriptCsp]),
+          nonce
+        },
         isDevelopment,
-        cspReporting: _optionalChain([sentryCspEndpoint, 'optionalAccess', _7 => _7.toString, 'call', _8 => _8()]),
-        nonce
+        cspReporting: _optionalChain([sentryCspEndpoint, 'optionalAccess', _12 => _12.toString, 'call', _13 => _13()])
       })
     },
     {
@@ -389,6 +402,9 @@ function cspMiddleware({
     });
   }
   for (const header of headers) {
+    if (!header.value) {
+      continue;
+    }
     response.headers.set(header.key, header.value);
   }
   return response;

package/dist/internal/header-sources.d.ts

@@ -19,10 +19,12 @@ interface HeaderSources {
     worker?: string[];
     /** media-src */
     media?: string[];
+    /** script-src (if csp is not dynamic) */
+    script?: string[];
 }
 declare const modules: {
     readonly berachain: {
-        readonly connect: ["https://*.berachain.com/", "https://*.berachain-staging.com/", "https://raw.githubusercontent.com/berachain/metadata/", "https://imagedelivery.net/qNj7Q3MCke89zoKzav7eDQ/", "https://*.quiknode.pro", "https://api.goldsky.com/api/public/project_clq1h5ct0g4a201x18tfte5iv/subgraphs/", string, string, string, string, string | undefined, "https://api.routescan.io/v2/network/"];
+        readonly connect: ["https://*.berachain.com/", "https://*.berachain-staging.com/", "https://raw.githubusercontent.com/berachain/metadata/", "https://imagedelivery.net/qNj7Q3MCke89zoKzav7eDQ/", "https://*.quiknode.pro", "https://api.goldsky.com/api/public/project_clq1h5ct0g4a201x18tfte5iv/subgraphs/", string, string, string, string, string, string | undefined, "https://api.routescan.io/v2/network/"];
         readonly img: ["https://imagedelivery.net/qNj7Q3MCke89zoKzav7eDQ/", "https://raw.githubusercontent.com/berachain/metadata/"];
     };
     readonly beranames: {
@@ -109,7 +111,18 @@ export type HeaderSourceModule = keyof typeof modules;
 export interface CspOptions {
     /** per-module toggle; all modules default to `true`, set `false` to exclude one from every directive */
     modules?: Partial<Record<HeaderSourceModule, boolean>>;
+    /**
+     * `script-src` strategy. Omit (or pass an object) to keep the `strict-dynamic`
+     * policy — the fixed hash plus an optional per-request `nonce` and extra
+     * `sha` hashes. Pass `"disabled"` to fall back to a host-allowlist built from
+     * the `script` module sources instead.
+     */
+    dynamicScriptCsp?: "disabled" | {
+        sha?: string[];
+        nonce?: string;
+    };
     frameSources?: string[];
+    scriptSources?: string[];
     fontSources?: string[];
     pictureSources?: string[];
     connectionSources?: string[];
@@ -123,9 +136,8 @@ export interface CspOptions {
  * {@link getContentSecurityPolicy} / {@link cspMiddleware}.
  */
 export declare const headerSourceModules: Record<HeaderSourceModule, HeaderSources>;
-export declare function getContentSecurityPolicy({ isDevelopment, nonce, cspReporting, modules: enabledModules, ...args }: CspOptions & {
+export declare function getContentSecurityPolicy({ isDevelopment, cspReporting, dynamicScriptCsp, modules: enabledModules, ...args }: CspOptions & {
     isDevelopment: boolean;
-    nonce: string;
     cspReporting?: string;
 }): string;
 /**

package/dist/internal/header-sources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"header-sources.d.ts","sourceRoot":"","sources":["../../src/internal/header-sources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgB7D;;;;GAIG;AACH,UAAU,aAAa;IACrB,kBAAkB;IAClB,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpC,cAAc;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,gBAAgB;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,gBAAgB;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,iBAAiB;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4JqC,CAAC;AAEnD,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,OAAO,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,wGAAwG;IACxG,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,EAAE,aAAa,CACjE,CAAC;AAEV,wBAAgB,wBAAwB,CAAC,EACvC,aAAa,EACb,KAAK,EACL,YAAY,EACZ,OAAO,EAAE,cAAmB,EAC5B,GAAG,IAAI,EACR,EAAE,UAAU,GAAG;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CA8ET;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAWvC,CAAC;AAEH,wBAAgB,aAAa,CAAC,EAC5B,QAAQ,EACR,GAAG,GACJ,EAAE;IACD,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;IACvB,mGAAmG;IACnG,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB,yBA8CA"}
+{"version":3,"file":"header-sources.d.ts","sourceRoot":"","sources":["../../src/internal/header-sources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgB7D;;;;GAIG;AACH,UAAU,aAAa;IACrB,kBAAkB;IAClB,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpC,cAAc;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,gBAAgB;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,gBAAgB;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,iBAAiB;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6JqC,CAAC;AAEnD,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,OAAO,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,wGAAwG;IACxG,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;OAKG;IACH,gBAAgB,CAAC,EACb,UAAU,GACV;QACE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACN,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,EAAE,aAAa,CACjE,CAAC;AAEV,wBAAgB,wBAAwB,CAAC,EACvC,aAAa,EACb,YAAY,EACZ,gBAAqB,EACrB,OAAO,EAAE,cAAmB,EAC5B,GAAG,IAAI,EACR,EAAE,UAAU,GAAG;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CAyFT;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAWvC,CAAC;AAEH,wBAAgB,aAAa,CAAC,EAC5B,QAAQ,EACR,GAAG,GACJ,EAAE;IACD,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;IACvB,mGAAmG;IACnG,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB,yBA2DA"}

package/dist/internal/header-sources.mjs

@@ -127,6 +127,7 @@ var modules = {
       // /api/honey/* and /api/pol/* (covered by 'self'), not direct browser
       // requests to the upstream URLs.
       config.pol.bribeBoostApi,
+      getUriFromLink(config.beep),
       getUriFromLink(config.api),
       jsonRpcUrl,
       publicJsonRpcUrl,
@@ -274,8 +275,8 @@ var modules = {
 var headerSourceModules = modules;
 function getContentSecurityPolicy({
   isDevelopment,
-  nonce,
   cspReporting,
+  dynamicScriptCsp = {},
   modules: enabledModules = {},
   ...args
 }) {
@@ -315,12 +316,21 @@ function getContentSecurityPolicy({
   const mediaSources = dedupeCspSources(
     collect("media").concat(args.mediaSources ?? [])
   );
+  const scriptSources = dynamicScriptCsp === "disabled" ? dedupeCspSources(collect("script").concat(args.scriptSources ?? [])) : dedupeCspSources(
+    [
+      "'strict-dynamic'",
+      isDevelopment ? "'unsafe-eval'" : "",
+      "'sha256-k2HGvaYkGyYZxOwKGxgE1mr06tZEDcEXNZ5mdcldK0o='",
+      dynamicScriptCsp.nonce ? `'nonce-${dynamicScriptCsp.nonce}'` : "",
+      ...dynamicScriptCsp.sha ?? []
+    ].filter((source) => source !== "")
+  );
   let cspHeader = `
     default-src 'self' ${defaultSrc.join(" ")};
     base-uri 'self';
     frame-src 'self' ${frameSources.join(" ")};
     frame-ancestors 'self' https://*.posthog.com;
-    script-src 'self' 'sha256-k2HGvaYkGyYZxOwKGxgE1mr06tZEDcEXNZ5mdcldK0o=' 'nonce-${nonce}' 'strict-dynamic' ${isDevelopment ? "'unsafe-eval'" : ""};
+    script-src 'self' ${scriptSources.join(" ")};
     worker-src 'self' blob: data: ${workerSources.join(" ")};
     font-src 'self' ${fontSources.join(" ")};
     style-src 'self' ${styleSources.join(" ")} 'unsafe-inline';
@@ -353,16 +363,19 @@ function cspMiddleware({
   csp
 }) {
   const sentryCspEndpoint = getSentryKeys()?.cspEndpoint;
-  const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
+  const nonce = csp?.dynamicScriptCsp !== "disabled" ? csp?.dynamicScriptCsp?.nonce ?? Buffer.from(crypto.randomUUID()).toString("base64") : void 0;
   const isDevelopment = process.env.NODE_ENV === "development";
   const headers = [
     {
       key: "Content-Security-Policy",
       value: getContentSecurityPolicy({
         ...csp,
+        dynamicScriptCsp: csp?.dynamicScriptCsp === "disabled" ? csp.dynamicScriptCsp : {
+          ...csp?.dynamicScriptCsp,
+          nonce
+        },
         isDevelopment,
-        cspReporting: sentryCspEndpoint?.toString(),
-        nonce
+        cspReporting: sentryCspEndpoint?.toString()
       })
     },
     {
@@ -389,6 +402,9 @@ function cspMiddleware({
     });
   }
   for (const header of headers) {
+    if (!header.value) {
+      continue;
+    }
     response.headers.set(header.key, header.value);
   }
   return response;

package/dist/internal/nextjs/const.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"const.d.ts","sourceRoot":"","sources":["../../../src/internal/nextjs/const.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAEvC,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAC7C,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAiFpD,CAAC"}
+{"version":3,"file":"const.d.ts","sourceRoot":"","sources":["../../../src/internal/nextjs/const.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAEvC,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAC7C,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CA2EpD,CAAC"}

package/dist/internal/nextjs/index.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
-var _chunkOA5M6XYFcjs = require('../../chunk-OA5M6XYF.cjs');
+var _chunk2JZ7QJEWcjs = require('../../chunk-2JZ7QJEW.cjs');
 
 
 var _chunkSHM2VD4Acjs = require('../../chunk-SHM2VD4A.cjs');
@@ -53,7 +53,7 @@ function withBeraConfig(config, {
     ...config,
     images: {
       ...config.images,
-      remotePatterns: [..._chunkOA5M6XYFcjs.IMAGE_REMOTE_PATTERNS]
+      remotePatterns: [..._chunk2JZ7QJEWcjs.IMAGE_REMOTE_PATTERNS]
     },
     async rewrites() {
       if (!withPostHogReverseProxy) {

package/dist/internal/nextjs/index.mjs

@@ -1,6 +1,6 @@
 import {
   IMAGE_REMOTE_PATTERNS
-} from "../../chunk-4WAGOEXT.mjs";
+} from "../../chunk-AP2XG6GJ.mjs";
 import {
   appConfig
 } from "../../chunk-IGYS2XEK.mjs";

package/dist/internal/nextjs/utils/index.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkOA5M6XYFcjs = require('../../../chunk-OA5M6XYF.cjs');
+var _chunk2JZ7QJEWcjs = require('../../../chunk-2JZ7QJEW.cjs');
 
 // src/internal/nextjs/utils/index.ts
 function globToRegExp(glob) {
@@ -19,7 +19,7 @@ function isAllowedImageUrl(urlString) {
   try {
     if (!urlString) return false;
     const url = new URL(urlString);
-    for (const pattern of _chunkOA5M6XYFcjs.IMAGE_REMOTE_PATTERNS) {
+    for (const pattern of _chunk2JZ7QJEWcjs.IMAGE_REMOTE_PATTERNS) {
       if (pattern.protocol && url.protocol.replace(":", "") !== pattern.protocol)
         continue;
       if (normalizeHostname(url.hostname) !== normalizeHostname(pattern.hostname))

package/dist/internal/nextjs/utils/index.mjs

@@ -1,6 +1,6 @@
 import {
   IMAGE_REMOTE_PATTERNS
-} from "../../../chunk-4WAGOEXT.mjs";
+} from "../../../chunk-AP2XG6GJ.mjs";
 
 // src/internal/nextjs/utils/index.ts
 function globToRegExp(glob) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@berachain/config",
-  "version": "0.1.25",
+  "version": "0.1.26-beta.0",
   "type": "module",
   "files": [
     "dist",