From 1ae7699d38c7842f0f3900d4bc027c2746919364 Mon Sep 17 00:00:00 2001
From: "svelte-docs-bot[bot]"
 <196124396+svelte-docs-bot[bot]@users.noreply.github.com>
Date: Fri, 12 Dec 2025 21:00:02 +0000
Subject: [PATCH] sync svelte docs

---
 .../docs/svelte/06-runtime/05-hydratable.md   | 58 +++++++++++++++++++
 .../98-reference/.generated/server-errors.md  |  6 ++
 .../svelte/98-reference/21-svelte-server.md   |  2 +
 .../svelte/98-reference/30-runtime-errors.md  |  6 ++
 4 files changed, 72 insertions(+)

diff --git a/apps/svelte.dev/content/docs/svelte/06-runtime/05-hydratable.md b/apps/svelte.dev/content/docs/svelte/06-runtime/05-hydratable.md
index ad8a4ed08e..ecfc88a45e 100644
--- a/apps/svelte.dev/content/docs/svelte/06-runtime/05-hydratable.md
+++ b/apps/svelte.dev/content/docs/svelte/06-runtime/05-hydratable.md
@@ -64,3 +64,61 @@ All data returned from a `hydratable` function must be serializable. But this do
 {await promises.one}
 {await promises.two}
 ```
+
+## CSP
+
+`hydratable` adds an inline `<script>` block to the `head` returned from `render`. If you're using [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) (CSP), this script will likely fail to run. You can provide a `nonce` to `render`:
+
+```js
+/// file: server.js
+import { render } from 'svelte/server';
+import App from './App.svelte';
+// ---cut---
+const nonce = crypto.randomUUID();
+
+const { head, body } = await render(App, {
+	csp: { nonce }
+});
+```
+
+This will add the `nonce` to the script block, on the assumption that you will later add the same nonce to the CSP header of the document that contains it:
+
+```js
+/// file: server.js
+let response = new Response();
+let nonce = 'xyz123';
+// ---cut---
+response.headers.set(
+  'Content-Security-Policy',
+  `script-src 'nonce-${nonce}'`
+ );
+```
+
+It's essential that a `nonce` — which, British slang definition aside, means 'number used once' — is only used when dynamically server rendering an individual response.
+
+If instead you are generating static HTML ahead of time, you must use hashes instead:
+
+```js
+/// file: server.js
+import { render } from 'svelte/server';
+import App from './App.svelte';
+// ---cut---
+const { head, body, hashes } = await render(App, {
+	csp: { hash: true }
+});
+```
+
+`hashes.script` will be an array of strings like `["sha256-abcd123"]`. As with `nonce`, the hashes should be used in your CSP header:
+
+```js
+/// file: server.js
+let response = new Response();
+let hashes = { script: ['sha256-xyz123'] };
+// ---cut---
+response.headers.set(
+  'Content-Security-Policy',
+  `script-src ${hashes.script.map((hash) => `'${hash}'`).join(' ')}`
+ );
+```
+
+We recommend using `nonce` over hash if you can, as `hash` will interfere with streaming SSR in the future.
diff --git a/apps/svelte.dev/content/docs/svelte/98-reference/.generated/server-errors.md b/apps/svelte.dev/content/docs/svelte/98-reference/.generated/server-errors.md
index 4d05e04207..c98756afec 100644
--- a/apps/svelte.dev/content/docs/svelte/98-reference/.generated/server-errors.md
+++ b/apps/svelte.dev/content/docs/svelte/98-reference/.generated/server-errors.md
@@ -55,6 +55,12 @@ Cause:
 %stack%
 ```
 
+### invalid_csp
+
+```
+`csp.nonce` was set while `csp.hash` was `true`. These options cannot be used simultaneously.
+```
+
 ### lifecycle_function_unavailable
 
 ```
diff --git a/apps/svelte.dev/content/docs/svelte/98-reference/21-svelte-server.md b/apps/svelte.dev/content/docs/svelte/98-reference/21-svelte-server.md
index 747b4387b0..02c56738f3 100644
--- a/apps/svelte.dev/content/docs/svelte/98-reference/21-svelte-server.md
+++ b/apps/svelte.dev/content/docs/svelte/98-reference/21-svelte-server.md
@@ -31,6 +31,7 @@ function render<
 					props?: Omit<Props, '$$slots' | '$$events'>;
 					context?: Map<any, any>;
 					idPrefix?: string;
+					csp?: Csp;
 				}
 			]
 		: [
@@ -41,6 +42,7 @@ function render<
 					props: Omit<Props, '$$slots' | '$$events'>;
 					context?: Map<any, any>;
 					idPrefix?: string;
+					csp?: Csp;
 				}
 			]
 ): RenderOutput;
diff --git a/apps/svelte.dev/content/docs/svelte/98-reference/30-runtime-errors.md b/apps/svelte.dev/content/docs/svelte/98-reference/30-runtime-errors.md
index ab60a1baef..1d89392832 100644
--- a/apps/svelte.dev/content/docs/svelte/98-reference/30-runtime-errors.md
+++ b/apps/svelte.dev/content/docs/svelte/98-reference/30-runtime-errors.md
@@ -357,6 +357,12 @@ Cause:
 %stack%
 ```
 
+### invalid_csp
+
+```
+`csp.nonce` was set while `csp.hash` was `true`. These options cannot be used simultaneously.
+```
+
 ### lifecycle_function_unavailable
 
 ```