Module swagger 

The Swagger UI shell: one HTML page that loads the pinned Swagger UI distribution and points it at /openapi.json. It embeds no specification of its own; what it shows is whatever the server generated from the registry at the moment of the request. The page is rendered once per process and served from memory.

The UI’s own assets are fetched by the browser from the unpkg CDN. That is the one part of the HTTP projection that is not available offline; the OpenAPI document is.

The frame around it is this repository’s, and so is what the frame owes a reader: a <main> landmark and a level-one heading, which the page had neither of until the UI audit was first allowed to look at this surface. The widget itself carries data-mj-foreign, the declaration a page makes when a subtree is a third party’s to answer for: the accessibility engine skips it and the audit’s report says it was skipped and why, rather than reporting a clean page or an unfixable one.

The frame around it is this repository’s. The type stack and the accent come from share/design/tokens.yaml like every other surface, compiled in through tokens.css, so the API viewer reads as part of the same tool rather than as a stock installation of somebody else’s. What is inside the widget — the operation blocks, the schema tables, the try-it form — is Swagger UI’s own stylesheet and is left alone: restyling a third party’s component tree against a pinned version is a maintenance bill this page does not need to take on.

The page pins itself light. Swagger UI 5 ships no dark theme, so a dark frame around a permanently light widget is worse than a light one; class="light" is the escape hatch the generated token block provides for exactly this, and it also stops the browser from rendering dark form controls inside a light panel.

Constants

CHECKOUT_MARKER

Where the page names the checkout that is serving it: page_for puts the line there, and the page rendered once keeps the bare marker, which a browser shows as nothing.

SPEC_PATH

The path the page loads the specification from.

SWAGGER_BUNDLE_SRI

The subresource integrity of the pinned bundle: the browser runs the script only when its bytes hash to this, so a substituted file on the CDN never runs beside the write routes. Computed from https://unpkg.com/swagger-ui-dist@5.17.14/swagger-ui-bundle.js.

SWAGGER_CSS_SRI

The subresource integrity of the pinned stylesheet, for the same reason.

SWAGGER_PATH

The path the page is served at.

SWAGGER_UI_VERSION

The Swagger UI distribution version the page pins.

Functions

csp

The Content-Security-Policy the page is served with: the pinned CDN files (whose integrity the page also names) and the one inline script, by its digest; requests to this server alone; no frame may embed it. The page shares an origin with every write route, so a script it did not ship must not run on it.

offered_by_a_publication

Whether this shell may be offered as a link a reader can follow, in an environment where the surfaces are what crate::web::projection_routes resolved.

page

The page, rendered once.

page_for

The page as one server serves it: the shell, with the line naming the checkout that is serving it where CHECKOUT_MARKER stands. checkout is HTML the caller has escaped — the router renders it from the repository model (crate::web::home::Checkout::line), which names the checkout by its identity and never by where it sits on the host.