feat: remove Bellecour, update DataProtector to beta.27, fix unusable lockfile

[raorla]

Summary

Two independent problems, plus one drive-by fix needed to get a green build.

1. Bellecour removed from the chain selector

The bellecour chain definition is gone, so the selector now offers Arbitrum Sepolia and Arbitrum One only.

Because Bellecour was also the default chain, a replacement was needed. This PR uses Arbitrum Sepolia: it was already next in supportedChains, and a testnet default means nobody spends real funds just trying the starter. Consequences:

• defaultChain → arbitrumSepolia
• normalizeChainId fell back to 134 in two places; it now falls back to 421614 through a named DEFAULT_CHAIN_ID constant rather than a bare magic number
• chain 134 dropped from explorerSlugs and from the Web3Mail iApp address map

Note: Arbitrum Sepolia has no Web3Mail iApp address, so the "Use Web3Mail Whitelist address for current chain" button is hidden on the default chain. That behaviour already existed (the map is guarded by || ""), it is just now visible by default.

README: Bellecour references removed. That includes the whole Compatible Wallets section — its restriction ("Other wallets may not work with iExec SDKs on Bellecour") was specific to Bellecour, and keeping a "compatible wallets" list would misinform now that the starter targets Arbitrum, where the iExec SDKs work with standard EVM wallets.

2. Lockfile was unusable — a fresh clone could not install

npm error 404 Not Found - GET https://registry.npmjs.org/@ensdomains/buffer/-/buffer-0.1.1.tgz

@ensdomains/buffer@0.1.1 has been unpublished from npm; only 0.1.0 and 0.1.3 remain. The lockfile pinned the missing tarball, so npm install and npm ci both died. It is a transitive dependency:

@iexec/dataprotector -> iexec -> @ensdomains/ens-contracts -> @ensdomains/buffer@^0.1.1

The declared range ^0.1.1 already accepts 0.1.3, so only the lockfile entry needed updating — no package.json change.

3. Drive-by: tsc build was already broken on main

npm run build fails on main, independently of this PR (verified by building a clean checkout):

src/context/ContextProvider.tsx(7,46): error TS2322:
  The types of 'appearance.theme' are incompatible between these types.
    Type 'string' is not assignable to type '"light" | `#${string}` | "dark" | undefined'.

privyConfig had no type annotation, so theme: 'light' widened to string. Annotating the export with PrivyClientConfig fixes it and gets the whole config checked against Privy's own types — which surfaced a second issue: accentColor: 'red' as \#${string}`was a cast asserting something false, since'red' is not a hex colour. It is now a real hex (#EF4444`, the same red).

Happy to split this third commit out if you would rather keep it separate — without it the PR cannot build.

Verification

• npm ci → exit 0 (confirms the lockfile fix; @ensdomains/buffer@0.1.3 installed)
• npm run build → exit 0
• npm run lint → exit 0
• Rendered the production build in headless Chrome: app mounts, no page errors
• "iExec Sidechain" no longer appears anywhere in the built bundle, so it cannot reach the selector

Remaining bellecour strings in the bundle come from the iexec SDK's own internal chain table and service URLs, which is out of scope here.

🤖 Generated with Claude Code

---

Added after review started: @iexec/dataprotector → 2.0.0-beta.27

Bumped from 2.0.0-beta.19 to 2.0.0-beta.27 (current latest). This turns out to matter a lot for the Bellecour removal above, because beta.27 drops Bellecour from the SDK itself:

// @iexec/dataprotector 2.0.0-beta.27 — src/config/config.js
const CHAIN_CONFIG = {
  421614: { name: 'arbitrum-sepolia-testnet', ... },  // Arbitrum Sepolia
  42161:  { name: 'arbitrum-mainnet', ... },          // Arbitrum One
};

Chain 134 is gone, so getChainConfig(134) now returns {}. Keeping Bellecour selectable would fail at runtime on this SDK version — the removal is a requirement, not a cleanup.

The other breaking changes in beta.27 were checked and need no source changes here:

Breaking change	Impact
ethProvider required in the constructor	Already satisfied — passed as the first positional argument
AddressOrENS dropped for Address	Type-compatible: Address is an alias for string
getWeb3Provider host now positional	Not used by this starter
voucher params removed from processProtectedData / processBulkRequest	Not used by this starter
dataprotector-sharing module removed (beta.24)	Not used — the starter uses dataProtector.core

Two side effects worth flagging to reviewers:

• The @ensdomains/buffer lockfile fix is now superseded. Dropping ENS support removed @ensdomains/ens-contracts, and with it @ensdomains/buffer — the package whose unpublished 0.1.1 broke installs. There is no longer an @ensdomains/* package anywhere in the tree. The lockfile commit is kept deliberately, so the fix survives if the bump commit is reverted.
• allowExperimentalNetworks: true is now a no-op. Neither remaining chain is flagged isExperimental in beta.27. Left in place as harmless; removing it would be a separate cleanup.

The lockfile diff is large, as expected for a bump that prunes the whole ENS subtree.

Not verified

protectData and grantAccess were not exercised end to end. Both sit behind a wallet connection and emit real on-chain transactions, so they need a funded wallet on Arbitrum Sepolia. What is verified is install, type-check, build, and that the app mounts and renders without page errors. Functional testing of those two buttons is still outstanding.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​iexec/​dataprotector@​2.0.0-beta.19 ⏵ 2.0.0-beta.27	-1			-1

View full report