@scalar/fastify-api-reference 1.57.5 → 1.59.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @scalar/fastify-api-reference
 
+## 1.59.0
+
+### Minor Changes
+
+- [#9422](https://github.com/scalar/scalar/pull/9422): Add a `nonce` option for Content Security Policy support.
+
+  When you pass a `nonce`, the rendered HTML stamps it onto the inline `<script>` and the CDN `<script>` tag (and Scalar's own `<style>` tags, plus a matching `<meta property="csp-nonce">`). This lets the API Reference run under a strict `script-src` with no `unsafe-inline` and no `unsafe-eval`.
+
+  ```ts
+  ApiReference({
+    url: '/openapi.json',
+    // Match this value in your `script-src` CSP directive.
+    nonce: 'r4nd0m',
+  })
+  ```
+
+  Note: `style-src` still needs `'unsafe-inline'`. The reference renders inline `style="…"` attributes, which a CSP nonce can never authorize (nonces only apply to `<script>`, `<style>` and `<link>` elements), so a nonce-only `style-src` is not possible. The win is a fully strict `script-src`.
+
+## 1.58.0
+
+### Patch Changes
+
+- [#9209](https://github.com/scalar/scalar/pull/9209): Fix intermittent TypeScript error when hook handlers are spread into route options. Annotating the internal `schemaToHideRoute` constant as `FastifySchema` prevents TypeScript from narrowing its type to `{ hide: boolean }`, which caused incompatible hook-handler types with Fastify 5's `NoInfer<SchemaCompiler>`-based route definitions.
+
 ## 1.57.5
 
 ## 1.57.4

package/dist/fastifyApiReference.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fastifyApiReference.d.ts","sourceRoot":"","sources":["../src/fastifyApiReference.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAI9F,OAAO,KAAK,EAA8D,0BAA0B,EAAE,MAAM,SAAS,CAAA;AAiDrH,QAAA,MAAM,mBAAmB,sIAwMxB,CAAA;AAED,eAAe,mBAAmB,CAAA"}
+{"version":3,"file":"fastifyApiReference.d.ts","sourceRoot":"","sources":["../src/fastifyApiReference.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAiB,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAI7G,OAAO,KAAK,EAA8D,0BAA0B,EAAE,MAAM,SAAS,CAAA;AAoDrH,QAAA,MAAM,mBAAmB,sIAyMxB,CAAA;AAED,eAAe,mBAAmB,CAAA"}

package/dist/fastifyApiReference.js

@@ -15,6 +15,9 @@ const RELATIVE_JAVASCRIPT_PATH = 'js/scalar.js';
  *
  * @see https://github.com/fastify/fastify-swagger#hide-a-route
  */
+// Typed as FastifySchema so route inference uses FastifySchema (not the narrow
+// literal { hide: boolean }), keeping hook handler types compatible across
+// Fastify v4 and v5 even when @fastify/swagger augments FastifySchema with `hide`.
 const schemaToHideRoute = {
     hide: true,
 };
@@ -184,12 +187,13 @@ const fastifyApiReference = fp((fastify, options, next) => {
                 };
             }
             // Respond with the HTML document
-            const { cdn, pageTitle, ...config } = configuration;
+            const { cdn, pageTitle, nonce, ...config } = configuration;
             return reply.header('Content-Type', 'text/html; charset=utf-8').send(renderApiReference({
                 config,
                 // We're using the bundled JS here by default, but the user can pass a CDN URL.
                 cdn: cdn ?? RELATIVE_JAVASCRIPT_PATH,
                 pageTitle,
+                nonce,
             }));
         },
     });