@ubean/routes 0.5.1 → 0.6.0-beta.1

package/dist/index.d.ts

@@ -697,9 +697,25 @@ interface OpenAPIGenerationOptions {
   description?: string;
   baseURL?: string;
 }
-export declare function registerOpenAPIRoutes(app: Hono<UbeanEnv$1>, options?: OpenAPIGenerationOptions & {
+/**
+ * Scalar 文档页加载脚本的来源（jsdelivr）。
+ *
+ * 页面自己写死了这个 `<script src>`，因此它的来源也必须能被 CSP 声明 —— 由调用方（`@ubean/app`）
+ * 从生效的 CSP 上追加该来源后，作为 {@link ScalarDocumentationOptions.contentSecurityPolicy}
+ * 回传，避免「框架内置页面被框架自己的默认 CSP 拦掉」（2026-09-17 实测：默认 `script-src 'self'`
+ * 让 DevTools 的 API Docs 面板整页空白）。
+ */
+export declare const SCALAR_SCRIPT_ORIGIN = "https://cdn.jsdelivr.net";
+interface ScalarDocumentationOptions {
   scalarPath?: string;
   openAPIPath?: string;
-}): void;
+  /**
+   * Scalar 页面专用 CSP（来自调用方对生效 CSP 追加 {@link SCALAR_SCRIPT_ORIGIN} 的结果）。
+   *
+   * 省略（CSP 被关闭时）则不设头 —— 不会给「用户主动关掉 CSP」的应用重新加上 CSP。
+   */
+  contentSecurityPolicy?: string;
+}
+export declare function registerOpenAPIRoutes(app: Hono<UbeanEnv$1>, options?: OpenAPIGenerationOptions & ScalarDocumentationOptions): void;
 //#endregion
-export { ACTION_BRAND, type ActionContext, type ActionContextStorage, ActionError, type ActionFailure, type ActionHandler, type ActionId, type ActionResult, type ActionSchema, type CompiledLayout, type CompiledMiddleware, type CompiledPage, type CompiledRoute, type CompiledRouteRule, type ComposedHandler, type DefineActionOptions, type GenericSchema, type Input, type InternalFetchOptions, type IsrCacheEntry, type IsrCacheEntryInternal, type IsrCacheStore, type IsrRule, type IsrServeOptions, type OpenAPIGenerationOptions, type RegisterOptions, type ResolveSelectSsrInput, type ResolvedSelectSsr, type RouteMeta, type RouteRegistrar, type RouteRule, type RouteRulesMiddlewareOptions, type SelectSsrMode, type SelectSsrValue, type ServerAction, type Span, type SpanAttributes, type SpanContext, type SpanEndOptions, type SpanEvent, type SpanOptions, type SpanStatus, type UbeanBindings, type UbeanContext, type UbeanEnv, type UbeanHandler, type UbeanMiddleware, type UbeanVariables, fail, invokeServerFn, isActionFailure, isServerAction, unwrapActionResult, unwrapServerFnResult };
+export { ACTION_BRAND, type ActionContext, type ActionContextStorage, ActionError, type ActionFailure, type ActionHandler, type ActionId, type ActionResult, type ActionSchema, type CompiledLayout, type CompiledMiddleware, type CompiledPage, type CompiledRoute, type CompiledRouteRule, type ComposedHandler, type DefineActionOptions, type GenericSchema, type Input, type InternalFetchOptions, type IsrCacheEntry, type IsrCacheEntryInternal, type IsrCacheStore, type IsrRule, type IsrServeOptions, type OpenAPIGenerationOptions, type RegisterOptions, type ResolveSelectSsrInput, type ResolvedSelectSsr, type RouteMeta, type RouteRegistrar, type RouteRule, type RouteRulesMiddlewareOptions, type ScalarDocumentationOptions, type SelectSsrMode, type SelectSsrValue, type ServerAction, type Span, type SpanAttributes, type SpanContext, type SpanEndOptions, type SpanEvent, type SpanOptions, type SpanStatus, type UbeanBindings, type UbeanContext, type UbeanEnv, type UbeanHandler, type UbeanMiddleware, type UbeanVariables, fail, invokeServerFn, isActionFailure, isServerAction, unwrapActionResult, unwrapServerFnResult };

package/dist/index.js

@@ -1433,6 +1433,15 @@ function createInternalAdapter(c, options) {
 }
 //#endregion
 //#region src/openapi.ts
+/**
+* Scalar 文档页加载脚本的来源（jsdelivr）。
+*
+* 页面自己写死了这个 `<script src>`，因此它的来源也必须能被 CSP 声明 —— 由调用方（`@ubean/app`）
+* 从生效的 CSP 上追加该来源后，作为 {@link ScalarDocumentationOptions.contentSecurityPolicy}
+* 回传，避免「框架内置页面被框架自己的默认 CSP 拦掉」（2026-09-17 实测：默认 `script-src 'self'`
+* 让 DevTools 的 API Docs 面板整页空白）。
+*/
+const SCALAR_SCRIPT_ORIGIN = "https://cdn.jsdelivr.net";
 function registerOpenAPIRoutes(app, options = {}) {
 	const { scalarPath = "/_scalar", openAPIPath = "/_openapi.json", title = "API Reference" } = options;
 	const documentation = {
@@ -1455,6 +1464,7 @@ function registerOpenAPIRoutes(app, options = {}) {
 		});
 	});
 	app.get(scalarPath, (c) => {
+		if (options.contentSecurityPolicy) c.header("Content-Security-Policy", options.contentSecurityPolicy);
 		const scalarHTML = `<!doctype html>
 <html>
 <head>
@@ -1475,14 +1485,15 @@ function registerOpenAPIRoutes(app, options = {}) {
       "theme": "purple",
       "layout": "modern",
       "hideClientButton": false,
-      "defaultHttpClient": { "targetKey": "shell", "clientKey": "curl" }
+      "defaultHttpClient": { "targetKey": "shell", "clientKey": "curl" },
+      "withDefaultFonts": false
     }'
   ><\/script>
-  <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"><\/script>
+  <script src="${SCALAR_SCRIPT_ORIGIN}/npm/@scalar/api-reference"><\/script>
 </body>
 </html>`;
 		return c.html(scalarHTML);
 	});
 }
 //#endregion
-export { ACTIONS_ENDPOINT, ACTION_BRAND, ACTION_RESPONSE_HEADER, ActionError, UbeanRouter, applyPathTransform, bindActionContextStorage, buildActionContext, buildFormActionUrl, buildIsrCacheKey, clearActions, clearInternalFetcher, compileRouteRules, convertUbeanRoutePath, createActionId, createActionsMiddleware, createDetachedActionContext, createInternalAdapter, createRouteLoader, createRouteRulesMiddleware, createServerRouter, defineAction, defineHandler, defineHandlerMeta, defineMiddleware, defineServerFn, describeActionsOpenApi, dispatchAction, extractRouteMeta, fail, getAction, getActionContext, getInternalFetcher, getIsrCache, getIsrRuleFromContext, getStaleIsrCache, hasAction, hasFormAction, invalidateIsrCache, invalidateIsrCachePattern, invokeServerFn, isActionFailure, isActionResponse, isActionsRequest, isBotUserAgent, isHandlerChain, isIsrEntryStale, isServerAction, isValidActionId, listActions, matchRouteRules, normalizeActionResult, normalizeIsrRule, parseActionInput, parseFormActionName, registerAction, registerActions, registerApiRoutes, registerOpenAPIRoutes, registerPageRoutes, registerRoutes, resolveSelectSsr, runAction, runPageAction, runWithActionContext, serveIsr, setInternalFetcher, setIsrCache, sortPagesForRegistration, ssrModeHeader, unwrapActionResult, unwrapServerFnResult, useRouter, validateActionInput };
+export { ACTIONS_ENDPOINT, ACTION_BRAND, ACTION_RESPONSE_HEADER, ActionError, SCALAR_SCRIPT_ORIGIN, UbeanRouter, applyPathTransform, bindActionContextStorage, buildActionContext, buildFormActionUrl, buildIsrCacheKey, clearActions, clearInternalFetcher, compileRouteRules, convertUbeanRoutePath, createActionId, createActionsMiddleware, createDetachedActionContext, createInternalAdapter, createRouteLoader, createRouteRulesMiddleware, createServerRouter, defineAction, defineHandler, defineHandlerMeta, defineMiddleware, defineServerFn, describeActionsOpenApi, dispatchAction, extractRouteMeta, fail, getAction, getActionContext, getInternalFetcher, getIsrCache, getIsrRuleFromContext, getStaleIsrCache, hasAction, hasFormAction, invalidateIsrCache, invalidateIsrCachePattern, invokeServerFn, isActionFailure, isActionResponse, isActionsRequest, isBotUserAgent, isHandlerChain, isIsrEntryStale, isServerAction, isValidActionId, listActions, matchRouteRules, normalizeActionResult, normalizeIsrRule, parseActionInput, parseFormActionName, registerAction, registerActions, registerApiRoutes, registerOpenAPIRoutes, registerPageRoutes, registerRoutes, resolveSelectSsr, runAction, runPageAction, runWithActionContext, serveIsr, setInternalFetcher, setIsrCache, sortPagesForRegistration, ssrModeHeader, unwrapActionResult, unwrapServerFnResult, useRouter, validateActionInput };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ubean/routes",
-  "version": "0.5.1",
+  "version": "0.6.0-beta.1",
   "description": "Server routes runtime for ubean (defineHandler, defineMiddleware, registerRoutes, Server Actions, rou3 server router, route rules, ISR, internal-fetch, OpenAPI)",
   "files": [
     "dist"
@@ -24,23 +24,23 @@
     "@soybeanjs/fetch": "^0.1.0",
     "@standard-community/standard-json": "^0.3.6",
     "@standard-community/standard-openapi": "^0.2.10",
-    "@ubean/i18n": "0.5.1",
-    "@ubean/shared": "0.5.1",
+    "@ubean/i18n": "0.6.0-beta.1",
+    "@ubean/shared": "0.6.0-beta.1",
     "hono": "4.13.7",
     "hono-openapi": "^1.3.3",
     "rou3": "^0.9.2"
   },
   "devDependencies": {
     "@types/node": "^26.5.0",
-    "@ubean/pages": "0.5.1",
-    "@ubean/scan": "0.5.1",
+    "@ubean/pages": "0.6.0-beta.1",
+    "@ubean/scan": "0.6.0-beta.1",
     "typescript": "npm:typescript-native-bridge@latest",
     "vite-plus": "0.3.1",
     "vue": "^3.5.42"
   },
   "peerDependencies": {
-    "@ubean/pages": "0.5.1",
-    "@ubean/scan": "0.5.1",
+    "@ubean/pages": "0.6.0-beta.1",
+    "@ubean/scan": "0.6.0-beta.1",
     "vue": "^3.0.0"
   },
   "peerDependenciesMeta": {