@beignet/next 0.0.44 → 0.0.46

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @beignet/next
 
+## 0.0.46
+
+### Patch Changes
+
+- @beignet/web@0.0.46
+
+## 0.0.45
+
+### Patch Changes
+
+- b9df150: Declare client-component boundaries for hook entrypoints and document Swagger UI deployment constraints.
+  - @beignet/web@0.0.45
+
 ## 0.0.44
 
 ### Patch Changes

package/README.md

@@ -575,6 +575,15 @@ export const GET = createSwaggerUIHandler({
 });
 ```
 
+The built-in HTML loads version-pinned Swagger UI assets from `unpkg.com` with
+subresource-integrity checks. Apps with a strict Content Security Policy or no
+public CDN access should serve a custom, self-hosted documentation UI instead
+of this convenience handler. Using the built-in page requires policy allowances
+for the pinned asset host and its emitted inline script and style blocks;
+allowing `unpkg.com` alone is not sufficient.
+Protect the OpenAPI and documentation routes with app-owned authorization when
+enumerating the route surface is sensitive.
+
 ## Public storage routes
 
 Use `createStorageRoute` to serve public objects from a `StoragePort` in a
@@ -1184,6 +1193,11 @@ by the runtime without booting providers during route-module import.
 ### `createSwaggerUIHandler(options?): (req: Request) => Response`
 
 Creates a Next.js route handler that serves Swagger UI for an OpenAPI endpoint.
+Its generated HTML loads version-pinned assets from `unpkg.com` with
+subresource-integrity checks and emits inline script and style blocks.
+Strict-CSP or network-isolated deployments should self-host a custom
+CSP-compatible UI. Allowing the asset host alone does not make the convenience
+handler compatible with a strict policy.
 
 ### `createWebhookRoute(options): { POST }`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beignet/next",
-  "version": "0.0.44",
+  "version": "0.0.46",
   "type": "module",
   "description": "Next.js server-side handlers for Beignet",
   "main": "./dist/index.js",
@@ -61,7 +61,7 @@
     "next": "^14.0.0 || ^15.0.0 || ^16.0.0"
   },
   "dependencies": {
-    "@beignet/web": "^0.0.44",
+    "@beignet/web": "^0.0.46",
     "@standard-schema/spec": "^1.0.0"
   },
   "devDependencies": {

package/skills/routes-server/SKILL.md

@@ -130,6 +130,13 @@ Prefer adapter helpers for focused surfaces when the package provides them:
 `createWebhookRoute(...)`, `createPaymentWebhookRoute(...)`,
 `createScheduleRoute(...)`, and `createOutboxDrainRoute(...)`.
 
+OpenAPI documents enumerate protected routes as well as public ones, so add
+app-owned authorization to spec and docs endpoints when that surface is
+sensitive. `createSwaggerUIHandler(...)` loads version-pinned assets from
+`unpkg.com` and emits inline script and style blocks; strict-CSP or
+network-isolated deployments should use a custom self-hosted CSP-compatible UI.
+Allowing the asset host alone is not sufficient.
+
 For Next.js 15.1 and newer, apps may also use
 `createNextOutboxDrainTrigger(...)` with `after()` and replace their database
 Unit of Work from `server/providers.ts` with a