@ubean/app 0.5.2 → 0.6.0-beta.2

package/dist/index.d.ts

@@ -401,10 +401,10 @@ interface UbeanAppOptions {
   dataCache?: boolean | DataCacheMiddlewareOptions;
   /**
    * HTTP / ISR cache store. Default is in-process memory (not shared
-   * across instances). Pass `createFsCacheStore(dir)` for a Node fs backend.
+   * across instances). Pass `loadFsCacheStore(dir)`（Node fs 后端，动态加载）for a Node backend.
    */
   cacheStore?: CacheStore;
-  /** Declarative cache backend. `store: 'fs'` uses `createFsCacheStore`. */
+  /** Declarative cache backend. `store: 'fs'` 走 `loadFsCacheStore()`（Node-only，动态加载）。 */
   cache?: {
     store?: 'memory' | 'fs';
     dir?: string;
@@ -442,6 +442,13 @@ export declare class UbeanApp {
   readonly plugins: UbeanAppPlugin[];
   readonly options: UbeanAppOptions;
   private _ready;
+  /**
+   * Scalar 文档页（`/_scalar`）专用的 CSP：生效 CSP + `{@link SCALAR_SCRIPT_ORIGIN}`。
+   *
+   * 该页面从 CDN 取脚本，而 CSP 是全局的一份 —— 只在这一条响应上追加它需要的来源，不放宽应用
+   * 其余部分的策略。CSP 被关闭时为 `undefined`（不重加头）。构造期算好，`init()` 注册路由时用。
+   */
+  private _scalarCsp;
   constructor(options?: UbeanAppOptions);
   private _setupBaseMiddleware;
   init(): Promise<this>;

package/dist/index.js

@@ -1,14 +1,12 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-import { existsSync } from "node:fs";
 import { createI18nMiddleware, ensureLocaleMessages } from "@ubean/i18n";
 import { SERVER_COMPONENT_ENDPOINT, createServerComponentMiddleware } from "@ubean/islands/server";
-import { ACTIONS_ENDPOINT, bindActionContextStorage, buildActionContext, createActionsMiddleware, createRouteRulesMiddleware, registerOpenAPIRoutes, registerRoutes, setInternalFetcher } from "@ubean/routes";
-import { createCacheMiddleware, createFsCacheStore, createMemoryStore, resolveRouteCacheRules, useCacheStore } from "@ubean/server/cache";
+import { ACTIONS_ENDPOINT, SCALAR_SCRIPT_ORIGIN, bindActionContextStorage, buildActionContext, createActionsMiddleware, createRouteRulesMiddleware, registerOpenAPIRoutes, registerRoutes, setInternalFetcher } from "@ubean/routes";
+import { createCacheMiddleware, createLazyCacheStore, createMemoryStore, loadFsCacheStore, resolveRouteCacheRules, useCacheStore } from "@ubean/server/cache";
 import { createDataCacheMiddleware } from "@ubean/server/middleware";
 import { createWebSocketMiddleware } from "@ubean/server/realtime";
-import { createCsrfMiddleware, createSecurityHeadersMiddleware, mergeSecurityHeadersOptions } from "@ubean/server/security";
-import { serveStatic } from "@ubean/server/static";
-import { UbeanError, errorToResponse, isUbeanError } from "@ubean/shared";
+import { createCsrfMiddleware, createSecurityHeadersMiddleware, extendCspScriptSrc, mergeSecurityHeadersOptions, serializeCsp } from "@ubean/server/security";
+import { UbeanError, errorToResponse, isNodeRuntime, isUbeanError } from "@ubean/shared";
 import { Hono } from "hono";
 import { requestId } from "hono/request-id";
 import { createHooks } from "hookable";
@@ -269,6 +267,13 @@ var UbeanApp = class {
 	plugins;
 	options;
 	_ready = false;
+	/**
+	* Scalar 文档页（`/_scalar`）专用的 CSP：生效 CSP + `{@link SCALAR_SCRIPT_ORIGIN}`。
+	*
+	* 该页面从 CDN 取脚本，而 CSP 是全局的一份 —— 只在这一条响应上追加它需要的来源，不放宽应用
+	* 其余部分的策略。CSP 被关闭时为 `undefined`（不重加头）。构造期算好，`init()` 注册路由时用。
+	*/
+	_scalarCsp;
 	constructor(options = {}) {
 		this.options = options;
 		this.hono = new Hono({ strict: false });
@@ -286,7 +291,12 @@ var UbeanApp = class {
 			await actionContextAls.run(buildActionContext(c), () => next());
 		});
 		const securityHeaders = resolveToggle(this.options.securityHeaders, true);
-		if (securityHeaders !== false) this.hono.use("*", createSecurityHeadersMiddleware(mergeSecurityHeadersOptions(DEFAULT_SECURITY_HEADERS, securityHeaders)));
+		if (securityHeaders !== false) {
+			const mergedSecurity = mergeSecurityHeadersOptions(DEFAULT_SECURITY_HEADERS, securityHeaders);
+			this.hono.use("*", createSecurityHeadersMiddleware(mergedSecurity));
+			const effectiveCsp = mergedSecurity.contentSecurityPolicy;
+			if (effectiveCsp && typeof effectiveCsp === "object") this._scalarCsp = serializeCsp(extendCspScriptSrc(effectiveCsp, [SCALAR_SCRIPT_ORIGIN]));
+		}
 		const csrf = resolveToggle(this.options.csrf, true);
 		if (csrf !== false) this.hono.use("*", createCsrfMiddleware({
 			mode: "origin",
@@ -296,7 +306,10 @@ var UbeanApp = class {
 		const dataCache = resolveToggle(this.options.dataCache, true);
 		if (dataCache !== false) this.hono.use("*", createDataCacheMiddleware(dataCache));
 		if (this.options.cacheStore) useCacheStore(this.options.cacheStore);
-		else if (this.options.cache?.store === "fs") useCacheStore(createFsCacheStore(this.options.cache.dir || ".ubean/cache"));
+		else if (this.options.cache?.store === "fs") {
+			const fsDir = this.options.cache.dir || ".ubean/cache";
+			useCacheStore(createLazyCacheStore(() => loadFsCacheStore(fsDir)));
+		}
 		const i18nCfg = this.options.i18nConfig;
 		if (i18nCfg?.enabled !== false && (i18nCfg?.locales?.length ?? 0) > 0 && i18nCfg) {
 			const locales = (i18nCfg.locales || []).map((l) => typeof l === "string" ? l : l.code);
@@ -345,8 +358,10 @@ var UbeanApp = class {
 		await this.hooks.callHook("app:created", this.hono);
 		for (const plugin of this.plugins) if (plugin.setup) await plugin.setup(this);
 		await this.hooks.callHook("app:before:register", this.hono);
-		if (this.options.publicDir) {
+		if (this.options.publicDir && isNodeRuntime()) {
+			const { existsSync } = await import("node:fs");
 			const publicDir = isAbsolute(this.options.publicDir) ? this.options.publicDir : this.options.rootDir ? join(this.options.rootDir, this.options.publicDir) : this.options.publicDir;
+			const { serveStatic } = await import("@ubean/server/static");
 			if (existsSync(publicDir)) this.hono.use("/*", serveStatic({ publicDir }));
 		}
 		const registerOpts = {
@@ -373,15 +388,18 @@ var UbeanApp = class {
 			colorModeScript: this.options.colorModeScript,
 			cacheStore: this.options.routeRules && Object.keys(this.options.routeRules).length > 0 ? useCacheStore() : void 0
 		};
+		if (this.options.openAPI) {
+			const openAPIOpts = typeof this.options.openAPI === "object" ? this.options.openAPI : {};
+			registerOpenAPIRoutes(this.hono, {
+				...openAPIOpts,
+				contentSecurityPolicy: this._scalarCsp
+			});
+		}
 		await registerRoutes(this, registerOpts);
 		if (this.options.ipxHandler) this.hono.get("/_ipx/*", this.options.ipxHandler);
 		await this._registerSeoConventions();
 		this.hono.on("POST", ACTIONS_ENDPOINT, createActionsMiddleware());
 		this.hono.on("POST", SERVER_COMPONENT_ENDPOINT, createServerComponentMiddleware());
-		if (this.options.openAPI) {
-			const openAPIOpts = typeof this.options.openAPI === "object" ? this.options.openAPI : {};
-			registerOpenAPIRoutes(this.hono, openAPIOpts);
-		}
 		await this.hooks.callHook("app:after:register", this.hono);
 		setInternalFetcher((req) => applyHandleFetchHook(req, (r) => Promise.resolve(this.hono.fetch(r))));
 		for (const plugin of this.plugins) if (plugin.ready) await plugin.ready(this);
@@ -390,6 +408,7 @@ var UbeanApp = class {
 	}
 	async _registerSeoConventions() {
 		if (this.options.seoConventions === false) return;
+		if (!this.options.seoConventionModules && !isNodeRuntime()) return;
 		const srcDir = (typeof this.options.seoConventions === "object" ? this.options.seoConventions : {}).srcDir ?? (this.options.rootDir ? join(this.options.rootDir, "src") : void 0);
 		try {
 			const mod = await import("@ubean/seo/conventions");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ubean/app",
-  "version": "0.5.2",
+  "version": "0.6.0-beta.2",
   "description": "Hono app factory and server config for ubean (createUbeanApp, defineServer)",
   "files": [
     "dist"
@@ -16,26 +16,26 @@
     }
   },
   "dependencies": {
-    "@ubean/i18n": "0.5.2",
-    "@ubean/islands": "0.5.2",
-    "@ubean/routes": "0.5.2",
-    "@ubean/scan": "0.5.2",
-    "@ubean/server": "0.5.2",
-    "@ubean/shared": "0.5.2",
-    "hono": "4.13.7",
-    "hookable": "^6.1.1",
+    "@ubean/i18n": "0.6.0-beta.2",
+    "@ubean/islands": "0.6.0-beta.2",
+    "@ubean/routes": "0.6.0-beta.2",
+    "@ubean/scan": "0.6.0-beta.2",
+    "@ubean/server": "0.6.0-beta.2",
+    "@ubean/shared": "0.6.0-beta.2",
+    "hono": "4.13.8",
+    "hookable": "^6.1.2",
     "pathe": "^2.0.3"
   },
   "devDependencies": {
-    "@types/node": "^26.5.0",
-    "@ubean/pages": "0.5.2",
-    "@ubean/seo": "0.5.2",
+    "@types/node": "^26.6.1",
+    "@ubean/pages": "0.6.0-beta.2",
+    "@ubean/seo": "0.6.0-beta.2",
     "typescript": "npm:typescript-native-bridge@latest",
-    "vite-plus": "0.3.1"
+    "vite-plus": "0.3.3"
   },
   "peerDependencies": {
-    "@ubean/pages": "0.5.2",
-    "@ubean/seo": "0.5.2"
+    "@ubean/pages": "0.6.0-beta.2",
+    "@ubean/seo": "0.6.0-beta.2"
   },
   "peerDependenciesMeta": {
     "@ubean/pages": {