dommy 0.9.0 → 0.10.0

data/lib/dommy/fetch.rb

@@ -38,6 +38,11 @@ module Dommy
       # URL (no per-handler resolution).
       url = @window.__internal_resolve_url__(args[0].to_s)
       init = normalize_init(args[1] || {})
+      # A cross-origin request always carries an Origin header (even for GET,
+      # which normalize_init omits it for same-origin GETs).
+      if cross_origin?(url) && !header?(init["headers"], "origin")
+        init["headers"]["Origin"] = request_origin
+      end
 
       # `js_eval`'s JS installer increments these globals; mirror so
       # specs that probe `__fetch_count__` / `__last_url__` / etc.
@@ -48,6 +53,18 @@ module Dommy
       @window.globals["__last_body__"] = init["body"] if init.is_a?(Hash)
 
       promise = PromiseValue.new(@window)
+      # `mode: "same-origin"` forbids a cross-origin request — it is a network
+      # error before any fetch happens.
+      if (init["mode"] || "cors").to_s == "same-origin" && cross_origin?(url)
+        deliver_task { promise.reject(fetch_type_error) }
+        return promise
+      end
+      # A non-simple cross-origin cors request is preceded by a CORS preflight
+      # (OPTIONS); a failed preflight is a network error before the real request.
+      if needs_preflight?(url, init) && !preflight_ok?(url, init)
+        deliver_task { promise.reject(fetch_type_error) }
+        return promise
+      end
       result = resolve_entry(url, init)
       # A handler may answer asynchronously (live network off-thread): it returns
       # a deferred whose response arrives later and is applied on the page thread
@@ -56,13 +73,185 @@ module Dommy
       if result.respond_to?(:on_complete)
         result.on_complete { |entry| fulfill_from_entry(promise, entry, url, init) }
       else
-        fulfill_from_entry(promise, result, url, init)
+        settle_with_redirects(promise, url, init, result)
       end
       promise
     end
 
     private
 
+    REDIRECT_STATUSES = [301, 302, 303, 307, 308].freeze
+    MAX_REDIRECTS = 20
+
+    # Follow redirects on the SYNCHRONOUS resolve path (endpoints / stubs resolve
+    # inline). Honors the request's redirect mode: "follow" chases a 3xx that
+    # carries a valid http(s) Location — up to MAX_REDIRECTS, marking the result
+    # `redirected` — "manual" yields an opaqueredirect, "error" rejects. A 3xx
+    # with no Location, or any non-3xx, is the final response.
+    def settle_with_redirects(promise, url, init, entry)
+      mode = (init["redirect"] || "follow").to_s
+      current = url
+      redirected = false
+      hops = 0
+      loop do
+        status = (entry.is_a?(Hash) ? entry["status"] : nil).to_i
+        unless REDIRECT_STATUSES.include?(status)
+          return deliver_final(promise, mark_redirected(entry, redirected), current, init)
+        end
+
+        case mode
+        when "manual" then return deliver_task { promise.fulfill(opaqueredirect_response) }
+        when "error" then return deliver_task { promise.reject(fetch_type_error) }
+        end
+
+        location = header_value(entry["headers"], "location")
+        # A 3xx with no Location is not a redirect to follow — it is the response.
+        return deliver_final(promise, mark_redirected(entry, redirected), current, init) if location.nil?
+
+        hops += 1
+        return deliver_task { promise.reject(fetch_type_error) } if hops > MAX_REDIRECTS
+
+        target = redirect_target(current, location)
+        return deliver_task { promise.reject(fetch_type_error) } if target.nil?
+        # A same-origin request may not be redirected across origins.
+        if (init["mode"] || "cors").to_s == "same-origin" && cross_origin?(target)
+          return deliver_task { promise.reject(fetch_type_error) }
+        end
+
+        current = target
+        redirected = true
+        init = redirect_init(init, status)
+        entry = resolve_entry(current, init)
+        if entry.respond_to?(:on_complete)
+          captured = current
+          captured_init = init
+          return entry.on_complete { |e| fulfill_from_entry(promise, mark_redirected(e, true), captured, captured_init) }
+        end
+      end
+    end
+
+    # Deliver the final response, applying the CORS filtering a cross-origin
+    # fetch requires by request mode: "no-cors" yields an opaque response;
+    # "cors" (the default) demands the response allow the origin via
+    # Access-Control-Allow-Origin (else a network error) and tags it a cors
+    # response; a same-origin response passes through as basic.
+    # Marks an entry that came from a test stub / data: URL — exempt from the
+    # cross-origin CORS filtering that only models a real network + server.
+    CORS_EXEMPT = "__cors_exempt"
+
+    def deliver_final(promise, entry, url, init, redirected = false)
+      mode = (init["mode"] || "cors").to_s
+      if entry.is_a?(Hash) && !entry[CORS_EXEMPT] && cross_origin?(url)
+        case mode
+        when "no-cors"
+          return deliver_task { promise.fulfill(opaque_response) }
+        when "cors"
+          credentialed = credentialed?(init)
+          acao = header_value(entry["headers"], "access-control-allow-origin")
+          acac = header_value(entry["headers"], "access-control-allow-credentials")
+          ok = if credentialed
+            # A credentialed response must name the exact origin (never `*`) and
+            # grant credentials.
+            acao == request_origin && acac == "true"
+          else
+            acao == "*" || acao == request_origin
+          end
+          return deliver_task { promise.reject(fetch_type_error) } unless ok
+
+          entry = entry.merge("type" => "cors", "headers" => cors_filter_headers(entry["headers"], credentialed))
+        end
+      end
+      fulfill_from_entry(promise, mark_redirected(entry, redirected), url, init)
+    end
+
+    # CORS-safelisted response header names — always exposed on a cors response.
+    CORS_SAFELISTED_RESPONSE_HEADERS =
+      %w[cache-control content-language content-length content-type expires last-modified pragma].freeze
+
+    # Filter a cors response's headers to what CORS exposes: the safelisted
+    # response headers plus any named in Access-Control-Expose-Headers (`*`
+    # exposes everything). The CORS protocol headers themselves are dropped.
+    def cors_filter_headers(headers, credentialed = false)
+      return {} unless headers.is_a?(Hash)
+
+      exposed = (header_value(headers, "access-control-expose-headers") || "").split(",").map { |h| h.strip.downcase }
+      # The `*` wildcard does not apply to a credentialed response.
+      wildcard = !credentialed && exposed.include?("*")
+      headers.select do |name, _|
+        n = name.to_s.downcase
+        wildcard || CORS_SAFELISTED_RESPONSE_HEADERS.include?(n) || exposed.include?(n)
+      end
+    end
+
+    def credentialed?(init)
+      (init["credentials"] || "same-origin").to_s == "include"
+    end
+
+    # An opaque response for a no-cors cross-origin fetch: status 0, no headers
+    # or body exposed, type "opaque".
+    def opaque_response
+      Response.new(@window, body: "", status: 0, status_text: "", headers: {},
+        url: "", redirected: false, type: "opaque", has_body: false)
+    end
+
+    def header_value(headers, name)
+      return nil unless headers.is_a?(Hash)
+
+      headers.find { |k, _| k.to_s.casecmp?(name) }&.last
+    end
+
+    def mark_redirected(entry, redirected)
+      return entry unless redirected && entry.is_a?(Hash)
+
+      entry.merge("redirected" => true)
+    end
+
+    # A redirect target resolved against the current URL, or nil when it is not a
+    # fetchable http(s) URL — an invalid URL, or a data:/other scheme (following a
+    # redirect to those is a network error).
+    def redirect_target(current, location)
+      # An empty Location value is a network error (not a self-redirect).
+      return nil if location.to_s.strip.empty?
+
+      target = URI.join(current, location).to_s
+      scheme = URI.parse(target).scheme&.downcase
+      %w[http https].include?(scheme) ? target : nil
+    rescue URI::Error
+      nil
+    end
+
+    # Per Fetch: a 303 (and a 301/302 on POST) switches the method to GET and
+    # drops the body; 307/308 preserve them.
+    def redirect_init(init, status)
+      method = (init["method"] || "GET").to_s.upcase
+      return init unless status == 303 || ([301, 302].include?(status) && method == "POST")
+
+      init.merge("method" => "GET").tap { |h| h.delete("body") }
+    end
+
+    def opaqueredirect_response
+      Response.new(@window, body: "", status: 0, status_text: "", headers: {},
+        url: "", redirected: false, type: "opaqueredirect", has_body: false)
+    end
+
+    # A Bridge::TypeError (not a plain ErrorValue) so the rejection reason crosses
+    # as a real JS `TypeError` — `promise_rejects_js`/`assert_throws_js` check
+    # `instanceof TypeError`, which a flattened {name,message} object would fail.
+    def fetch_type_error
+      Bridge::TypeError.new("Failed to fetch")
+    end
+
+    # Run work as a networking task on the event loop, matching fulfill_from_entry
+    # (so a fetch settles after the initiating script's microtask checkpoint).
+    def deliver_task(&blk)
+      if (sched = @window.respond_to?(:scheduler) ? @window.scheduler : nil)
+        sched.set_timeout(proc(&blk), 0)
+      else
+        blk.call
+      end
+      nil
+    end
+
     # Resolve `promise` from a response entry (nil -> 404), honoring a simulated
     # `delay`. Used both for a synchronous entry and for an async one delivered
     # later on the page thread.
@@ -105,7 +294,7 @@ module Dommy
       else
         promise.fulfill(
           Response.new(@window, body: body, status: status, status_text: status_text,
-            headers: headers, url: response_url, redirected: redirected, type: "basic")
+            headers: headers, url: response_url, redirected: redirected, type: entry["type"] || "basic")
         )
       end
     end
@@ -120,7 +309,7 @@ module Dommy
     def resolve_entry(url, init)
       if (decoded = DataUri.parse(url))
         return {"body" => decoded[:body], "status" => 200, "statusText" => "OK",
-                "contentType" => decoded[:content_type]}
+                "contentType" => decoded[:content_type], CORS_EXEMPT => true}
       end
 
       handler = @window.globals["__fetch_handler__"]
@@ -135,26 +324,181 @@ module Dommy
       return nil unless stub_map.is_a?(Hash)
 
       # The URL is now absolute; a stub keyed by a path ("/api") still matches
-      # its resolved form ("http://host/api").
-      stub_map[url] || stub_map[@window.__internal_url_path__(url)]
+      # its resolved form ("http://host/api"). A stub / data: response is the
+      # test's explicit intent, so it is exempt from cross-origin CORS filtering
+      # (which only models what a real network + server enforce, per the
+      # __fetch_handler__ path).
+      entry = stub_map[url] || stub_map[@window.__internal_url_path__(url)]
+      entry && entry.merge(CORS_EXEMPT => true)
     end
 
     # Coerce `init` into a Hash with string keys so the rest of the
     # pipeline (and the `__last_init__` globals) sees a uniform shape.
     # When the body is a Blob/File, fill in `Content-Type` from the
     # blob's type unless the caller already provided a header for it.
+    # A default User-Agent — real browsers always send one; tests assert its
+    # presence, not its value.
+    USER_AGENT = "Mozilla/5.0 (Dommy)"
+
     def normalize_init(init)
-      return init unless init.is_a?(Hash)
+      h = init.is_a?(Hash) ? init.transform_keys(&:to_s) : {}
+      method = (h["method"] || "GET").to_s.upcase
+      h["headers"] = request_headers(h["headers"], h["body"], method)
+      h
+    end
 
-      h = init.transform_keys(&:to_s)
-      body = h["body"]
-      return h unless body.is_a?(Blob)
+    # The request's header set as a plain Hash (case preserved): the caller's
+    # headers (record / sequence of pairs / Headers) plus the defaults a browser
+    # adds — Accept, Accept-Language, User-Agent, and, for a body-bearing method,
+    # Origin and Content-Length; a Content-Type is derived from an extractable
+    # body when the caller set none. So a resolver / endpoint (and the
+    # __last_init__ diagnostic) sees the actual request headers. Names are
+    # case-insensitive, so a default is added only when absent under any casing.
+    def request_headers(raw, body, method)
+      headers = normalize_header_record(raw)
+      bytes, default_ct = body.nil? ? ["", nil] : Response.extract_body(body)
+      headers["Accept"] = "*/*" unless header?(headers, "accept")
+      headers["Accept-Language"] = "en-US,en;q=0.9" unless header?(headers, "accept-language")
+      headers["User-Agent"] = USER_AGENT unless header?(headers, "user-agent")
+      headers["Content-Type"] = default_ct if default_ct && !header?(headers, "content-type")
+      # Fetch adds Origin + Content-Length for methods that carry a body (i.e.
+      # anything but GET/HEAD); a bodyless such request still sends Content-Length: 0.
+      unless %w[GET HEAD].include?(method)
+        headers["Origin"] = request_origin unless header?(headers, "origin")
+        # Content-Length: the body's byte length; a null body still sends 0, but
+        # only for POST/PUT (not arbitrary methods), per Fetch's "extract body".
+        unless header?(headers, "content-length")
+          if !body.nil?
+            headers["Content-Length"] = bytes.bytesize.to_s
+          elsif %w[POST PUT].include?(method)
+            headers["Content-Length"] = "0"
+          end
+        end
+      end
+      headers
+    end
 
-      headers = (h["headers"] || {}).dup
-      content_type_set = headers.any? { |k, _| k.to_s.downcase == "content-type" }
-      headers["Content-Type"] = body.type if !content_type_set && !body.type.empty?
-      h["headers"] = headers
-      h
+    def request_origin
+      @window.location.__js_get__("origin").to_s
+    rescue StandardError
+      ""
+    end
+
+    CORS_SAFELISTED_METHODS = %w[GET HEAD POST].freeze
+    CORS_SAFELISTED_HEADERS = %w[accept accept-language content-language].freeze
+    # Browser-controlled request headers that never count toward the preflight's
+    # Access-Control-Request-Headers.
+    CORS_BROWSER_HEADERS = %w[user-agent origin content-length host connection referer accept-encoding].freeze
+    CORS_SAFE_CONTENT_TYPES = ["application/x-www-form-urlencoded", "multipart/form-data", "text/plain"].freeze
+
+    # A cross-origin cors request needs a preflight when it uses a non-safelisted
+    # method or carries a non-safelisted header.
+    def needs_preflight?(url, init)
+      return false unless (init["mode"] || "cors").to_s == "cors" && cross_origin?(url)
+
+      method = (init["method"] || "GET").to_s.upcase
+      !CORS_SAFELISTED_METHODS.include?(method) || !cors_unsafe_headers(init["headers"]).empty?
+    end
+
+    # Sorted, lowercased names of the request headers a preflight must ask
+    # permission for (everything not CORS-safelisted or browser-controlled;
+    # Content-Type only when its value is not safelisted).
+    def cors_unsafe_headers(headers)
+      (headers || {}).filter_map do |name, value|
+        n = name.to_s.downcase
+        if n == "content-type"
+          safe_content_type?(value) ? nil : n
+        elsif CORS_SAFELISTED_HEADERS.include?(n) || CORS_BROWSER_HEADERS.include?(n)
+          nil
+        else
+          n
+        end
+      end.uniq.sort
+    end
+
+    def safe_content_type?(value)
+      CORS_SAFE_CONTENT_TYPES.include?(value.to_s.split(";").first.to_s.strip.downcase)
+    end
+
+    # Run the CORS preflight (an OPTIONS carrying Access-Control-Request-Method /
+    # -Headers) and check the response grants the method and each requested
+    # header for the origin. Returns whether the real request may proceed.
+    def preflight_ok?(url, init)
+      method = (init["method"] || "GET").to_s.upcase
+      acrh = cors_unsafe_headers(init["headers"])
+      options_headers = {
+        "Accept" => "*/*", "Origin" => request_origin,
+        "Access-Control-Request-Method" => method,
+      }
+      options_headers["Access-Control-Request-Headers"] = acrh.join(",") unless acrh.empty?
+
+      entry = resolve_entry(url, {"method" => "OPTIONS", "headers" => options_headers})
+      return false unless entry.is_a?(Hash) && (200..299).cover?((entry["status"] || 200).to_i)
+
+      credentialed = credentialed?(init)
+      acao = header_value(entry["headers"], "access-control-allow-origin")
+      if credentialed
+        return false unless acao == request_origin
+        return false unless header_value(entry["headers"], "access-control-allow-credentials") == "true"
+      else
+        return false unless acao == "*" || acao == request_origin
+      end
+      return false unless cors_method_allowed?(entry, method, credentialed)
+
+      cors_headers_allowed?(entry, acrh, credentialed)
+    end
+
+    def cors_method_allowed?(entry, method, credentialed)
+      return true if CORS_SAFELISTED_METHODS.include?(method)
+
+      allowed = (header_value(entry["headers"], "access-control-allow-methods") || "").split(",").map { |m| m.strip.upcase }
+      # `*` does not apply to a credentialed request.
+      allowed.include?(method) || (!credentialed && allowed.include?("*"))
+    end
+
+    def cors_headers_allowed?(entry, acrh, credentialed)
+      return true if acrh.empty?
+
+      allowed = (header_value(entry["headers"], "access-control-allow-headers") || "").split(",").map { |h| h.strip.downcase }
+      # `*` covers all header names except `authorization`, and not at all for a
+      # credentialed request.
+      wildcard = !credentialed && allowed.include?("*")
+      acrh.all? { |h| allowed.include?(h) || (wildcard && h != "authorization") }
+    end
+
+    # Whether `url`'s origin differs from the document's. A non-absolute URL (no
+
+    # Whether `url`'s origin differs from the document's. A non-absolute URL (no
+    # scheme/host) is same-origin (already resolved against the document base).
+    def cross_origin?(url)
+      other = origin_of(url)
+      !other.nil? && other != request_origin
+    end
+
+    def origin_of(url)
+      u = URI.parse(url.to_s)
+      return nil unless u.scheme && u.host
+
+      default = u.scheme == "https" ? 443 : 80
+      port = u.port && u.port != default ? ":#{u.port}" : ""
+      "#{u.scheme}://#{u.host}#{port}"
+    rescue URI::Error
+      nil
+    end
+
+    # A header record from a Hash, a sequence of [name, value] pairs, or a
+    # Headers, as a plain Hash with string keys (original case preserved).
+    def normalize_header_record(raw)
+      case raw
+      when Headers then raw.to_h
+      when Array then raw.each_with_object({}) { |pair, h| h[pair[0].to_s] = pair[1].to_s if pair.is_a?(Array) }
+      when Hash then raw.transform_keys(&:to_s)
+      else {}
+      end
+    end
+
+    def header?(headers, name)
+      headers.keys.any? { |k| k.to_s.casecmp?(name) }
     end
 
     # Diagnostic only (DOMMY_FETCH_DEBUG=<file>): append a record of what the
@@ -222,13 +566,25 @@ module Dommy
   class Request
     attr_reader :url, :method, :body
 
-    def initialize(url, init = nil)
+    def initialize(url, init = nil, window = nil)
       opts = init.is_a?(Hash) ? init : {}
+      @window = window
       @url = url.to_s
       @method = (opts["method"] || opts[:method] || "GET").to_s.upcase
       @body = opts["body"] || opts[:body]
       raw_headers = opts["headers"] || opts[:headers] || {}
       @headers = Headers.new(raw_headers)
+      # WHATWG "extract a body": normalize the body source to a byte string once
+      # (shared with Response), so the Body consume methods (text/arrayBuffer/…)
+      # read from it. A default Content-Type from the extraction is applied only
+      # when the caller supplied none.
+      unless @body.nil?
+        @body_bytes, default_ct = Response.extract_body(@body)
+        if default_ct && !@headers.__js_call__("has", ["content-type"])
+          @headers.__js_call__("set", ["content-type", default_ct])
+        end
+      end
+      @body_bytes ||= ""
       @credentials = (opts["credentials"] || opts[:credentials] || "same-origin").to_s
       @mode = (opts["mode"] || opts[:mode] || "cors").to_s
       @cache = (opts["cache"] || opts[:cache] || "default").to_s
@@ -270,23 +626,62 @@ module Dommy
     end
 
     include Bridge::Methods
-    js_methods %w[clone]
+    js_methods %w[clone text json arrayBuffer blob bytes]
     def __js_call__(method, _args)
       case method
       when "clone"
         Request.new(
           @url,
-          "method" => @method,
-          "body" => @body,
-          "headers" => @headers.to_h,
-          "credentials" => @credentials,
-          "mode" => @mode,
-          "cache" => @cache,
-          "redirect" => @redirect,
-          "signal" => @signal
+          {
+            "method" => @method,
+            "body" => @body,
+            "headers" => @headers.to_h,
+            "credentials" => @credentials,
+            "mode" => @mode,
+            "cache" => @cache,
+            "redirect" => @redirect,
+            "signal" => @signal
+          },
+          @window
         )
+      when "text"
+        consume_body { immediate(Response.utf8_decode(@body_bytes)) }
+      when "json"
+        consume_body do
+          immediate(JSON.parse(Response.utf8_decode(@body_bytes)))
+        rescue JSON::ParserError => e
+          rejected(ErrorValue.new("JSON parse: #{e.message}"))
+        end
+      when "arrayBuffer"
+        consume_body { immediate(Bridge::ArrayBuffer.new(@body_bytes.bytes)) }
+      when "bytes"
+        consume_body { immediate(Bridge::Bytes.new(@body_bytes.bytes)) }
+      when "blob"
+        ct = @headers.__js_call__("get", ["content-type"]) || ""
+        consume_body { immediate(Blob.new([@body_bytes], {"type" => ct}, @window)) }
       end
     end
+
+    private
+
+    # WHATWG Body: the body can be consumed once. A second consume rejects rather
+    # than throwing synchronously.
+    def consume_body
+      if @body_used
+        return rejected(ErrorValue.new("Failed to read body: body stream already read", name: "TypeError"))
+      end
+
+      @body_used = true
+      yield
+    end
+
+    def immediate(value)
+      @window ? PromiseValue.resolve(@window, value) : value
+    end
+
+    def rejected(value)
+      @window ? PromiseValue.reject(@window, value) : value
+    end
   end
 
   # `Response` polyfill — just enough surface for Fetchy:
@@ -457,6 +852,17 @@ module Dommy
       end
     end
 
+    # WHATWG "UTF-8 decode" for a body's text(): interpret the raw bytes as
+    # UTF-8, replacing any ill-formed sequence with U+FFFD, and drop a single
+    # leading byte-order mark (U+FEFF). Well-formed UTF-8 (the common case) is
+    # returned unchanged. Used by both Request and Response text().
+    def self.utf8_decode(bytes)
+      s = bytes.to_s.dup.force_encoding(Encoding::UTF_8)
+      s = s.scrub("\u{FFFD}") unless s.valid_encoding?
+      s = s[1..] if s.start_with?("\u{FEFF}")
+      s
+    end
+
     # WHATWG "extract a body": map a body source to `[byte_string,
     # default_content_type_or_nil]`. The default Content-Type is applied only
     # when the caller supplied none.
@@ -544,7 +950,7 @@ module Dommy
     def __js_call__(method, _args)
       case method
       when "text"
-        consume_body { immediate(@body) }
+        consume_body { immediate(Response.utf8_decode(@body)) }
       when "json"
         consume_body do
           immediate(JSON.parse(scrub_lone_surrogates(@body)))

data/lib/dommy/history.rb

@@ -9,6 +9,10 @@ module Dommy
     def initialize(window, location)
       @window = window
       @location = location
+      # Host (embedding session) seam: called with (:push | :replace |
+      # :traverse, url) after each history operation, so a session can keep
+      # its own navigation history and current URL in step with the page's
+      # same-document entries (Turbo Drive's pushState navigations).
       # Each entry records the full href it navigated to, so back/forward can
       # restore Location to it (and fire popstate) — a restoration that
       # framework routers like Turbo's depend on to swap the cached snapshot.
@@ -46,6 +50,17 @@ module Dommy
 
     include Bridge::Methods
     js_methods %w[pushState replaceState back forward go]
+    attr_accessor :__internal_on_change__
+
+    # The current entry index / traversal API for the host session, used to
+    # mirror joint back/forward. go_to targets an absolute entry index (a
+    # previously observed __internal_index__); already there is a no-op, so
+    # no spurious popstate fires.
+    def __internal_index__ = @cursor
+    def __internal_go_to__(index)
+      go(index - @cursor) unless index == @cursor
+    end
+
     def __js_call__(method, args)
       case method
       when "pushState"
@@ -66,18 +81,21 @@ module Dommy
     def push(state, url)
       resolved = resolve_url!(url)
       @stack = @stack[0..@cursor]
-      @location.__internal_set_url__(resolved) if resolved
+      # pushState never fires hashchange, even when only the fragment changes.
+      @location.__internal_set_url__(resolved, fire_hash: false) if resolved
       # WHATWG: pushState serializes the state via structured-clone
       # so subsequent caller-side mutation of the original cannot
       # affect history.state.
       @stack << {state: Dommy.structured_clone(state), url: @location.href}
       @cursor = @stack.size - 1
+      __internal_on_change__&.call(:push, @location.href)
     end
 
     def replace(state, url)
       resolved = resolve_url!(url)
-      @location.__internal_set_url__(resolved) if resolved
+      @location.__internal_set_url__(resolved, fire_hash: false) if resolved
       @stack[@cursor] = {state: Dommy.structured_clone(state), url: @location.href}
+      __internal_on_change__&.call(:replace, @location.href)
     end
 
     # WHATWG "URL and history update steps": resolve the given URL against the
@@ -111,8 +129,11 @@ module Dommy
       entry = @stack[@cursor]
       # Restore Location to the target entry's URL BEFORE firing popstate, so a
       # listener that reads `location` (Turbo's restoration visit, the WHATWG
-      # traversal steps) sees the destination, not the page we came from.
+      # traversal steps) sees the destination, not the page we came from. The
+      # host is notified before popstate too, so a handler's requests resolve
+      # against the destination URL.
       @location.__internal_set_url__(entry[:url]) if entry[:url]
+      __internal_on_change__&.call(:traverse, entry[:url])
       @window.fire_popstate(entry[:state])
     end
   end