bosia 0.7.6 → 0.7.8

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.7.6",
+	"version": "0.7.8",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing inspired by SvelteKit. No Node.js, no Vite, no adapters.",
 	"keywords": [

package/src/core/hooks.ts

@@ -113,6 +113,19 @@ export type Metadata = {
 
 type MaybePromise<T> = T | Promise<T>;
 
+// ─── Frame-Guard Opt-Out ──────────────────────────────────
+
+/**
+ * Internal response header a `handle` can set to opt a single response out of
+ * the global `X-Frame-Options: SAMEORIGIN` guard. Use when a trusted proxy hub
+ * serves another origin's content that must be embeddable (e.g. an app preview
+ * iframe): the proxy strips the upstream `X-Frame-Options`, but the framework
+ * would otherwise re-add its own. The header is stripped before the response
+ * leaves the process, so it never reaches the client. Other security headers
+ * (`X-Content-Type-Options`, `Referrer-Policy`) are unaffected.
+ */
+export const NO_FRAME_GUARD_HEADER = "x-bosia-no-frame-guard";
+
 // ─── Middleware Composition ────────────────────────────────
 
 /**

package/src/core/plugins/inspector/overlay.ts

@@ -138,12 +138,10 @@ function send(payload,onOk,onErr){
 function closeForm(){if(form){form.remove();form=null}}
 function openForm(loc,el){
   closeForm();
-  var chain=userFrames(el).join(" → ");
   var r=el.getBoundingClientRect();
   form=document.createElement("div");
   form.style.cssText="position:fixed;left:"+r.left+"px;top:"+(r.bottom+6)+"px;background:#fff;color:#111;border:1px solid #d4d4d8;border-radius:8px;box-shadow:0 8px 24px rgba(0,0,0,.18);padding:10px;width:340px;z-index:2147483647;font:13px ui-sans-serif,system-ui,sans-serif";
-  var header='<div style="font-size:11px;color:#71717a;margin-bottom:6px;font-family:ui-monospace,monospace;word-break:break-all">'+chain+'</div>';
-  form.innerHTML=header+
+  form.innerHTML=
     '<textarea placeholder="Describe a fix (Enter to send, Esc to cancel, empty = open in editor)" style="width:100%;min-height:64px;border:1px solid #e4e4e7;border-radius:4px;padding:6px;font:13px ui-sans-serif,system-ui,sans-serif;resize:vertical;box-sizing:border-box;outline:none"></textarea>'+
     '<div style="margin-top:8px;display:flex;gap:6px;justify-content:flex-end">'+
     '<button data-cancel style="padding:4px 10px;border:1px solid #e4e4e7;background:#fff;border-radius:4px;cursor:pointer;font-size:12px">Cancel</button>'+

package/src/core/server.ts

@@ -12,7 +12,7 @@ import type { RouteManifest } from "./types.ts";
 // Pre-compile route patterns into RegExp at startup (shared by renderer.ts via module reference)
 compileRoutes(apiRoutes);
 compileRoutes(serverRoutes);
-import type { Handle, RequestEvent } from "./hooks.ts";
+import { NO_FRAME_GUARD_HEADER, type Handle, type RequestEvent } from "./hooks.ts";
 import { HttpError, Redirect, ActionFailure } from "./errors.ts";
 import { CookieJar } from "./cookies.ts";
 import { safePath } from "./safePath.ts";
@@ -842,7 +842,15 @@ async function handleRequest(request: Request, url: URL): Promise<Response> {
 		const response = userHandle ? await userHandle({ event, resolve }) : await resolve(event);
 
 		const headers = new Headers(response.headers);
-		for (const [k, v] of Object.entries(SECURITY_HEADERS)) headers.set(k, v);
+		// A handle can mark a response (e.g. a proxied embeddable preview) to opt
+		// out of the frame guard. Strip the internal marker so it never ships, and
+		// skip only X-Frame-Options for that response — other security headers stay.
+		const skipFrameGuard = headers.has(NO_FRAME_GUARD_HEADER);
+		headers.delete(NO_FRAME_GUARD_HEADER);
+		for (const [k, v] of Object.entries(SECURITY_HEADERS)) {
+			if (skipFrameGuard && k === "X-Frame-Options") continue;
+			headers.set(k, v);
+		}
 		const cspHeader = buildCspHeader(nonce);
 		if (cspHeader) headers.set("Content-Security-Policy", cspHeader);
 		// Apply CORS headers for allowed origins. `Vary: Origin` is set whenever

package/src/lib/index.ts

@@ -6,7 +6,7 @@
 //   import type { RequestEvent, LoadEvent, Handle, Cookies } from "bosia"
 
 export { cn, getServerTime } from "./utils.ts";
-export { sequence } from "../core/hooks.ts";
+export { sequence, NO_FRAME_GUARD_HEADER } from "../core/hooks.ts";
 export { error, redirect, fail } from "../core/errors.ts";
 // `invalidate` / `invalidateAll` (server response-cache eviction) live in
 // "bosia/server" — they touch server-process state and pulling them into