[euniceamoni]

Summary

Fixes #54.

Changes

src/routes/docs.ts

• GET /docs is now only registered when NODE_ENV !== 'production'. /openapi.json and /docs/json remain available in all environments.
• Pinned swagger-ui-dist to exact version 5.34.0 (no more floating @5).
• Added integrity="sha384-…" and crossorigin="anonymous" to both the <link> and <script> tags so browsers enforce SRI on CDN assets.
• Included comments with instructions for recomputing hashes on upgrade.

src/app.ts

• Updated the stale comment to reflect that the gate lives inside docsRouter.

src/routes/docs.test.ts

• Added vi.mock so the module-level if-gate evaluates with NODE_ENV="test".
• Four new assertions: CSS integrity attr, JS integrity attr, crossorigin="anonymous" on both assets, pinned semver format.

src/routes/docs.production.test.ts (new)

• Separate file so vi.mock hoists before docs.ts loads with NODE_ENV="production".
• Verifies GET /docs → 404, GET /openapi.json → 200, GET /docs/json → 200.

Tests

12/12 pass across both test files.

Acceptance criteria

• /docs returns 404 when NODE_ENV=production
• The HTML contains an integrity attribute for each asset closes Swagger UI is served in every environment, and its CDN assets are unpinned #54

[vercel]

@euniceamoni is attempting to deploy a commit to the work Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@euniceamoni Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits