From 85fbfa5c0ce7201a7ea19255a381c34a65d26416 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 27 Oct 2026 14:22:49 +0000
Subject: [PATCH 1/4] test(service-print): render the print page under the
 console's default CSP on both placements

Claude-Session: https://claude.ai/code/session_01FEkQ5kpFFUuQY5FA7FCdwY
Co-authored-by: Claude <noreply@anthropic.com>
---
 .../service-print/src/chromium-driver.test.ts | 34 +++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/packages/services/service-print/src/chromium-driver.test.ts b/packages/services/service-print/src/chromium-driver.test.ts
index 9bda5c2f4e4..55cef1c03c9 100644
--- a/packages/services/service-print/src/chromium-driver.test.ts
+++ b/packages/services/service-print/src/chromium-driver.test.ts
@@ -39,6 +39,15 @@ import type { PrintSessionCookie } from './principal-session.js';
  * host's CJK font, every code point mapped; with Chromium's fonts narrowed to a
  * Latin-only fontconfig, none did.
  *
+ * ## Under the console's CSP
+ *
+ * The console serves every page with a Content Security Policy whose
+ * `script-src` carries no `'unsafe-eval'` by default (it is added only for the
+ * `kind:'react'` page tier, `consoleContentSecurityPolicy` in
+ * `packages/cli/src/utils/console.ts`). The fixture serves the same print page
+ * under that directive too, so a ready wait that evaluates a string in the page
+ * fails here with the EvalError a default deployment answers.
+ *
  * ## Which Chromium
  *
  * `OS_TEST_PRINT_CHROMIUM_PATH`, else Playwright's provisioned browser
@@ -82,12 +91,17 @@ const COOKIE: PrintSessionCookie = {
 };
 const CJK_TEXT = '发票客户名称上海示例有限公司合计金额';
 const RECORD_PATH = '/_console/apps/showcase/invoice/record/inv_1';
+/** The same record page, served under the console's default CSP. */
+const CSP_RECORD_PATH = '/_console/apps/showcase/invoice/record/inv_csp';
+const CSP_NONCE = 'print-fixture-nonce';
+/** The console's default `script-src` (no `'unsafe-eval'`), with the rest of its policy's script-relevant directives. */
+const CONSOLE_DEFAULT_CSP = `default-src 'self'; script-src 'self' 'nonce-${CSP_NONCE}' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'`;
 
-function printPageHtml(): string {
+function printPageHtml(nonce?: string): string {
   return `<!doctype html><html><head><meta charset="utf-8">
 <style>@media print { @page { size: A4 portrait; margin: 15mm; } nav { display: none; } }</style>
 </head><body><nav>console chrome</nav><div id="root"></div>
-<script>
+<script${nonce ? ` nonce="${nonce}"` : ''}>
   window.__objectui = { idle: false };
   setTimeout(() => {
     document.getElementById('root').innerHTML =
@@ -113,6 +127,11 @@ async function startFixture(): Promise<Fixture> {
     cookieSeen.push(cookie);
     res.setHeader('content-type', 'text/html; charset=utf-8');
     const signedIn = cookie.split(/;\s*/).includes(`${COOKIE.name}=${COOKIE.value}`);
+    if (req.url === CSP_RECORD_PATH && signedIn) {
+      res.setHeader('content-security-policy', CONSOLE_DEFAULT_CSP);
+      res.end(printPageHtml(CSP_NONCE));
+      return;
+    }
     res.end(req.url === RECORD_PATH && signedIn ? printPageHtml() : SIGNED_OUT_HTML);
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
@@ -293,6 +312,17 @@ describe.skipIf(!CHROMIUM)('the Chromium engine on both placements', () => {
         expect(missing, 'Chinese characters printed as empty boxes (no embedded glyph maps to them)').toEqual([]);
       }, 60_000);
 
+      it('renders a page served under the console’s default CSP (no unsafe-eval): the ready wait evaluates no string in the page', async () => {
+        const pdf = await pick().driver.renderPdf({
+          url: `${fixture.origin}${CSP_RECORD_PATH}`,
+          cookie: COOKIE,
+          timeoutMs: 30_000,
+        });
+        expect(pdf.subarray(0, 5).toString('latin1')).toBe('%PDF-');
+        const targets = toUnicodeTargets(pdf);
+        expect([...CJK_TEXT].filter((ch) => !targets.has(ch.codePointAt(0)!))).toEqual([]);
+      }, 60_000);
+
       it('a page that never shows a print root is refused TIMEOUT / 504, not printed', async () => {
         const r = await refusalOf(
           pick().driver.renderPdf({

From 6bf31122fa8e9f402d2acb5957083faa3b5b7932 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 27 Oct 2026 14:31:52 +0000
Subject: [PATCH 2/4] test(service-print): pin that the ready wait hands the
 page a function with the stable-poll count

Claude-Session: https://claude.ai/code/session_01FEkQ5kpFFUuQY5FA7FCdwY
Co-authored-by: Claude <noreply@anthropic.com>
---
 .../src/chromium-driver.unit.test.ts          | 62 ++++++++++++++++++-
 1 file changed, 61 insertions(+), 1 deletion(-)

diff --git a/packages/services/service-print/src/chromium-driver.unit.test.ts b/packages/services/service-print/src/chromium-driver.unit.test.ts
index b525bf9b66f..c480d892015 100644
--- a/packages/services/service-print/src/chromium-driver.unit.test.ts
+++ b/packages/services/service-print/src/chromium-driver.unit.test.ts
@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 import { describe, expect, it, vi } from 'vitest';
-import { createChromiumDriver, type ChromiumLauncher } from './chromium-driver.js';
+import { createChromiumDriver, STABLE_POLLS, type ChromiumLauncher } from './chromium-driver.js';
 import type { PrintSessionCookie } from './principal-session.js';
 
 /**
@@ -202,3 +202,63 @@ describe('the cleanup after the deadline is bounded, and nothing opened late is
     expect(browser.newContext).not.toHaveBeenCalled();
   });
 });
+
+describe('the ready wait hands the page a function, never a string', () => {
+  /**
+   * playwright-core evaluates a string predicate with `eval` in the page on
+   * EVERY poll, from a timer the page's CSP governs: under the console's
+   * default `script-src` (no `'unsafe-eval'`) the second poll throws EvalError
+   * and every print fails. CI has no Chromium for the render tests, so this is
+   * the guard it runs.
+   */
+  async function readyWait() {
+    const { launcher, page } = stagedLauncher({});
+    const driver = createChromiumDriver({ placement: 'remote', target: 'ws://127.0.0.1:9222/x', consoleUrl: 'x' }, launcher);
+    await driver.renderPdf({ url: URL_, cookie: COOKIE, timeoutMs: 5_000 });
+    expect(page.waitForFunction).toHaveBeenCalledTimes(1);
+    const [predicate, arg, options] = page.waitForFunction.mock.calls[0] as unknown as [unknown, unknown, { timeout: number; polling: number }];
+    return { predicate, arg, options };
+  }
+
+  it('waitForFunction receives a function and the stable-poll count as its argument, polling every 100 ms within the budget', async () => {
+    const { predicate, arg, options } = await readyWait();
+    expect(typeof predicate).toBe('function');
+    expect(arg).toBe(STABLE_POLLS);
+    expect(options.polling).toBe(100);
+    expect(options.timeout).toBeGreaterThan(0);
+    expect(options.timeout).toBeLessThanOrEqual(5_000);
+  });
+
+  it('the function means what the wait meant: a data-print-page root AND an idle console, held for STABLE_POLLS polls in a row', async () => {
+    const { predicate, arg } = await readyWait();
+    const poll = predicate as (stablePolls: unknown) => boolean;
+    const g = globalThis as unknown as Record<string, unknown>;
+    const saved = { document: g.document, __objectui: g.__objectui, stable: g.__objectstackPrintStable };
+    let root: unknown = null;
+    g.document = { querySelector: (selector: string) => (selector === '[data-print-page]' ? root : null) };
+    try {
+      // No console yet, then a console that is idle before any print root exists.
+      expect(poll(arg)).toBe(false);
+      g.__objectui = { idle: true };
+      expect(poll(arg)).toBe(false);
+      // The root appears, but a request is in flight.
+      root = {};
+      g.__objectui = { idle: false };
+      expect(poll(arg)).toBe(false);
+      g.__objectui = { idle: true };
+      const run = Array.from({ length: STABLE_POLLS }, () => poll(arg));
+      expect(run).toEqual([...Array(STABLE_POLLS - 1).fill(false), true]);
+      // A not-ready poll resets the run.
+      g.__objectui = { idle: false };
+      expect(poll(arg)).toBe(false);
+      g.__objectui = { idle: true };
+      expect(Array.from({ length: STABLE_POLLS }, () => poll(arg)).at(-1)).toBe(true);
+      expect(poll(arg)).toBe(true);
+    } finally {
+      for (const [key, value] of [['document', saved.document], ['__objectui', saved.__objectui], ['__objectstackPrintStable', saved.stable]] as const) {
+        if (value === undefined) delete g[key];
+        else g[key] = value;
+      }
+    }
+  });
+});

From 81166b569dc4742e1d6b1b1af96d29c92d0cd2b1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 27 Oct 2026 14:47:52 +0000
Subject: [PATCH 3/4] fix(service-print): wait for the print page with a
 function predicate, so a print runs under the console's default CSP

playwright-core evaluates a string predicate with eval on every poll, from a page
timer the page's CSP governs; without 'unsafe-eval' the second poll threw EvalError
and every server print failed. A function predicate is evaluated once, inside the
DevTools call that starts the wait, and each poll calls it. Same predicate, same
timeout and polling; the stable-poll count is now its argument.

Claude-Session: https://claude.ai/code/session_01FEkQ5kpFFUuQY5FA7FCdwY
Co-authored-by: Claude <noreply@anthropic.com>
---
 .../service-print/src/chromium-driver.ts      | 34 +++++++++++++------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/packages/services/service-print/src/chromium-driver.ts b/packages/services/service-print/src/chromium-driver.ts
index 84907ccbc2e..449098aff1c 100644
--- a/packages/services/service-print/src/chromium-driver.ts
+++ b/packages/services/service-print/src/chromium-driver.ts
@@ -98,7 +98,7 @@ interface ContextHandle {
 }
 interface PageHandle {
   goto(url: string, options: { waitUntil: 'load'; timeout: number }): Promise<unknown>;
-  waitForFunction(fn: string, arg: undefined, options: { timeout: number; polling: number }): Promise<unknown>;
+  waitForFunction(fn: (stablePolls: number) => boolean, arg: number, options: { timeout: number; polling: number }): Promise<unknown>;
   evaluate(fn: string): Promise<unknown>;
   pdf(options: { preferCSSPageSize: boolean; printBackground: boolean }): Promise<Buffer>;
 }
@@ -141,15 +141,29 @@ interface OpenBrowser {
 }
 
 /**
- * The ready predicate, evaluated in the page. A string, not a function, so the
- * page sees exactly this text and nothing from this module's scope.
+ * The ready predicate, run in the page on every poll. A function, never a
+ * string, because of how playwright-core polls: it evaluates the predicate's
+ * text with `eval` in the page. A string is evaluated again on every poll, from
+ * a page timer, where the page's own CSP applies, so under the console's
+ * default `script-src` (no `'unsafe-eval'`) the second poll throws EvalError
+ * and every print fails. A function's text is evaluated once, inside the
+ * DevTools call that starts the wait, which a page's CSP does not govern; each
+ * poll then calls the function that evaluation produced.
+ *
+ * The page receives the function's text only, so it reads nothing from this
+ * module's scope: the poll count arrives as its argument.
  */
-const PRINT_READY_PREDICATE = `(() => {
-  const ready = document.querySelector('[data-print-page]') !== null
-    && window.__objectui !== undefined && window.__objectui.idle === true;
-  window.__objectstackPrintStable = ready ? (window.__objectstackPrintStable || 0) + 1 : 0;
-  return window.__objectstackPrintStable >= ${STABLE_POLLS};
-})()`;
+function printReady(stablePolls: number): boolean {
+  const page = globalThis as unknown as {
+    document: { querySelector(selector: string): unknown };
+    __objectui?: { idle?: unknown };
+    __objectstackPrintStable?: number;
+  };
+  const ready = page.document.querySelector('[data-print-page]') !== null
+    && page.__objectui !== undefined && page.__objectui.idle === true;
+  page.__objectstackPrintStable = ready ? (page.__objectstackPrintStable || 0) + 1 : 0;
+  return page.__objectstackPrintStable >= stablePolls;
+}
 
 const FONTS_READY = `document.fonts.ready.then(() => true)`;
 
@@ -300,7 +314,7 @@ class PlaywrightChromiumDriver implements ChromiumDriver {
       await held.context.addCookies([cookieFor(input.url, input.cookie)]);
       const page = await held.context.newPage();
       await page.goto(input.url, { waitUntil: 'load', timeout: remaining() });
-      await page.waitForFunction(PRINT_READY_PREDICATE, undefined, { timeout: remaining(), polling: POLL_INTERVAL_MS });
+      await page.waitForFunction(printReady, STABLE_POLLS, { timeout: remaining(), polling: POLL_INTERVAL_MS });
       await page.evaluate(FONTS_READY);
       return page.pdf({ preferCSSPageSize: true, printBackground: true });
     })();

From dfd3fc087575ed9e16be6e1678acca0ab21e561d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 27 Oct 2026 14:51:00 +0000
Subject: [PATCH 4/4] chore(service-print): patch changeset for the print under
 the default CSP; keep the unit test inside the package's lib

Claude-Session: https://claude.ai/code/session_01FEkQ5kpFFUuQY5FA7FCdwY
Co-authored-by: Claude <noreply@anthropic.com>
---
 .changeset/26664-print-under-default-csp.md          | 12 ++++++++++++
 .../service-print/src/chromium-driver.unit.test.ts   |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/26664-print-under-default-csp.md

diff --git a/.changeset/26664-print-under-default-csp.md b/.changeset/26664-print-under-default-csp.md
new file mode 100644
index 00000000000..92101118420
--- /dev/null
+++ b/.changeset/26664-print-under-default-csp.md
@@ -0,0 +1,12 @@
+---
+'@objectstack/service-print': patch
+---
+
+fix(service-print): a server print works under the console's default Content Security Policy
+
+Clause-②: no
+Metadata-protocol: none
+
+Every server print (`POST /api/v1/print/records`, `printRecordToFile`) failed on a deployment that keeps the console's default CSP, answering "The print engine failed … page.waitForFunction: EvalError: Evaluating a string as JavaScript violates the following Content Security Policy directive". The Chromium driver waited for the print page with a string predicate, which playwright-core evaluates with `eval` in the page on every poll; the console's `script-src` carries no `'unsafe-eval'` unless `OS_PAGE_REACT_ENABLED` is on, so the second poll was refused.
+
+The driver now hands the wait a function predicate. playwright-core evaluates a function's text once, inside the DevTools call that starts the wait, which the page's CSP does not govern, and each poll calls the function it produced. The wait means exactly what it meant: a root carrying `data-print-page` and an idle console (`window.__objectui.idle`), held for three polls in a row, polled every 100 ms within the render's one budget. The console CSP is unchanged.
diff --git a/packages/services/service-print/src/chromium-driver.unit.test.ts b/packages/services/service-print/src/chromium-driver.unit.test.ts
index c480d892015..b4bcc7e71e9 100644
--- a/packages/services/service-print/src/chromium-driver.unit.test.ts
+++ b/packages/services/service-print/src/chromium-driver.unit.test.ts
@@ -252,7 +252,7 @@ describe('the ready wait hands the page a function, never a string', () => {
       g.__objectui = { idle: false };
       expect(poll(arg)).toBe(false);
       g.__objectui = { idle: true };
-      expect(Array.from({ length: STABLE_POLLS }, () => poll(arg)).at(-1)).toBe(true);
+      expect(Array.from({ length: STABLE_POLLS }, () => poll(arg))[STABLE_POLLS - 1]).toBe(true);
       expect(poll(arg)).toBe(true);
     } finally {
       for (const [key, value] of [['document', saved.document], ['__objectui', saved.__objectui], ['__objectstackPrintStable', saved.stable]] as const) {