@askrjs/askr 0.0.62 → 0.0.64

package/dist/actions/index.d.ts

@@ -1,2 +1,2 @@
-import { a as action, i as ActionValidationError, n as ActionForm, o as defineAction, r as ActionStatus, t as ActionDescriptor } from "../index-DaWuMuIc.js";
+import { a as action, i as ActionValidationError, n as ActionForm, o as defineAction, r as ActionStatus, t as ActionDescriptor } from "../index-Bjm0__Rr.js";
 export { ActionDescriptor, ActionForm, ActionStatus, ActionValidationError, action, defineAction };

package/dist/benchmark.js

@@ -1,10 +1,10 @@
 import { r as flushRuntimeScheduler } from "./access-ePqdQqkV.js";
-import { t as installRendererBridge } from "./renderer-CVr_nktj.js";
+import { t as installRendererBridge } from "./renderer-aUD-acDe.js";
 import { t as state } from "./state-Cc5HumQ0.js";
 import { t as selector } from "./selector-pApF_lGd.js";
 import { jsx, jsxs } from "./jsx-runtime.js";
 import { i as For } from "./control-KVP6LMEQ.js";
-import { t as createIsland } from "./boot-B0mMBddb.js";
+import { t as createIsland } from "./boot-BwqMApN4.js";
 //#region src/bench/components/benchmark-row.tsx
 function BenchmarkRow({ item, isSelected, onSelect, onRemove }) {
 	return /* @__PURE__ */ jsxs("tr", {
@@ -63,8 +63,8 @@ function BenchmarkTable({ rows, isSelected, onSelect, onRemove }) {
 installRendererBridge();
 const benchmarkMetadata = {
 	packageName: "@askrjs/askr",
-	packageVersion: "0.0.62",
-	buildLabel: "0.0.62-local"
+	packageVersion: "0.0.64",
+	buildLabel: "0.0.64-local"
 };
 function getBenchmarkMetadata() {
 	return { ...benchmarkMetadata };

package/dist/boot/index.d.ts

@@ -1,17 +1,19 @@
-import { s as ComponentFunction } from "../control-CFIrGbD7.js";
+import { s as ComponentFunction } from "../control-CMzFPMjr.js";
 import { v as DataRuntime } from "../index-Bki2rqcr.js";
-import { P as RouteRegistry, m as RouteAuthOptions, p as Route, x as RouteManifest } from "../router-lmH-Tmwh.js";
+import { P as RouteRegistry, m as RouteAuthOptions, p as Route, x as RouteManifest } from "../router-Dz7ZoLja.js";
 import { d as ScrollRestorationOptions } from "../navigate-BVDCzOuB.js";
 
 //#region src/boot/types.d.ts
 type IslandConfig = {
   root: Element | string;
   component: ComponentFunction;
+  cspNonce?: string;
   cleanupStrict?: boolean;
   routes?: never;
 };
 type IslandsConfig = {
   islands: IslandConfig[];
+  cspNonce?: string;
 };
 type BootRouteSource = {
   registry: RouteRegistry;
@@ -28,6 +30,7 @@ type BootRouteSource = {
 };
 type SPAConfig = BootRouteSource & {
   root: Element | string;
+  cspNonce?: string;
   /**
    * Preferred: pass a route registry built via `createRouteRegistry(() => { ... })`.
    * ```ts
@@ -43,6 +46,7 @@ type SPAConfig = BootRouteSource & {
 };
 type HydrateSPAConfig = BootRouteSource & {
   root: Element | string;
+  cspNonce?: string;
   dataRuntime?: DataRuntime; /** Preferred route input - see `SPAConfig`. */
   auth?: RouteAuthOptions;
   scrollRestoration?: boolean | ScrollRestorationOptions;

package/dist/boot/index.js

@@ -1,2 +1,2 @@
-import { a as cleanupApp, i as hydrateSPA, n as createIslands, o as hasApp, r as createSPA, t as createIsland } from "../boot-B0mMBddb.js";
+import { a as cleanupApp, i as hydrateSPA, n as createIslands, o as hasApp, r as createSPA, t as createIsland } from "../boot-BwqMApN4.js";
 export { cleanupApp, createIsland, createIslands, createSPA, hasApp, hydrateSPA };

package/dist/{boot-B0mMBddb.js → boot-BwqMApN4.js}

@@ -2,15 +2,16 @@ import { b as isDevelopmentEnvironment, r as flushRuntimeScheduler, v as logger,
 import { n as Fragment, t as ELEMENT_TYPE } from "./jsx-CUpRxrLH.js";
 import { n as createComponentInstance, r as executeComponent } from "./component-internal-CbALfPGD.js";
 import { h as cleanupComponent, m as isPromiseLike } from "./component-lifecycle-DEMPihoZ.js";
-import { a as withIntrinsicHydrationAdoption, i as registerDeferredHydrationBoundary, n as activateHydrationBoundary$1, o as setStaticChildSlotsCacheEnabled, r as clearDeferredHydrationBoundaries, t as installRendererBridge } from "./renderer-CVr_nktj.js";
+import { a as withIntrinsicHydrationAdoption, i as registerDeferredHydrationBoundary, n as activateHydrationBoundary$1, o as setStaticChildSlotsCacheEnabled, r as clearDeferredHydrationBoundaries, t as installRendererBridge } from "./renderer-aUD-acDe.js";
 import { _ as teardownNodeSubtree, d as removeAllListeners } from "./cleanup-B6KovDZZ.js";
-import { C as assertExecutionModel, S as route, a as resolveRouteMeta, c as registerAppInstance, d as clearRoutes, g as createAppRenderRuntime, h as setServerLocation, i as reconcileRouteMeta, l as unregisterAppInstance, s as configureScrollRestoration, t as initializeNavigation, u as _applyManifest } from "./navigate-DLi79IZr.js";
+import { C as assertExecutionModel, S as route, a as resolveRouteMeta, c as registerAppInstance, d as clearRoutes, g as createAppRenderRuntime, h as setServerLocation, i as reconcileRouteMeta, l as unregisterAppInstance, s as configureScrollRestoration, t as initializeNavigation, u as _applyManifest } from "./navigate-CaFA0DdW.js";
 import { a as startHydrationRenderPhase, s as stopHydrationRenderPhase } from "./render-context-Clw3rFiO.js";
 import { a as disposeDefaultPortalScope, t as DefaultPortal } from "./portal-D2tPWNrC.js";
+import { r as validateCspNonce, t as CspNonceScope } from "./csp-nonce-C-8E85El.js";
 import { i as getDefaultDataRuntime } from "./data-runtime-SJ1BSUvk.js";
 import { a as hydrateDataRuntime } from "./query-registry-CQIT4mXr.js";
 import { a as resolveRouteFromRoutes, d as _setActiveRouteAuthOptions, j as lockRouteRegistration, k as hasRegisteredRoutes } from "./route-matching-vJpvLVbX.js";
-import { _ as pageRenderEnvelope, d as hasRouteRenderData, f as resolveRouteRequest, l as getRouteRenderContext, o as reviveDeferredValue, u as getRouteRenderData, x as _preloadRouteHandler } from "./deferred-BeNnjR4r.js";
+import { _ as pageRenderEnvelope, d as hasRouteRenderData, f as resolveRouteRequest, l as getRouteRenderContext, o as reviveDeferredValue, u as getRouteRenderData, x as _preloadRouteHandler } from "./deferred-vBQJwHl5.js";
 import "./ssr-CbQO5xd3.js";
 //#region src/boot/hydration.ts
 const DEFERRED_PAYLOAD = "__askr_deferred__";
@@ -259,6 +260,7 @@ function attachCleanupForRoot(rootElement, instance) {
 	} catch {}
 }
 function mountOrUpdate(rootElement, componentFn, options) {
+	const nonce = validateCspNonce(options?.cspNonce);
 	const wrappedFn = (props, ctx) => {
 		const out = componentFn(props, ctx);
 		if (isPromiseLike(out)) throw new Error("Async components are not supported. Components must return synchronously.");
@@ -268,11 +270,15 @@ function mountOrUpdate(rootElement, componentFn, options) {
 			props: { __askrAutoDefaultPortal: true },
 			key: "__default_portal"
 		};
-		return {
+		const root = {
 			$$typeof: ELEMENT_TYPE,
 			type: Fragment,
 			props: { children: out === void 0 || out === null ? [portalVNode] : [out, portalVNode] }
 		};
+		return nonce === void 0 ? root : CspNonceScope({
+			value: nonce,
+			children: root
+		});
 	};
 	Object.defineProperty(wrappedFn, "name", { value: componentFn.name || "Component" });
 	const existingCleanup = rootElement[CLEANUP_SYMBOL];
@@ -298,6 +304,7 @@ function mountOrUpdate(rootElement, componentFn, options) {
 		instance.isRoot = true;
 		instance.portalScope = instance;
 		instance._appRenderRuntime = options?.appRuntime;
+		instance._cspNonce = nonce;
 		if (shouldResetHookState) {
 			instance.stateValues = [];
 			instance.hasPendingUpdate = false;
@@ -323,6 +330,7 @@ function mountOrUpdate(rootElement, componentFn, options) {
 		instance._rootComponentFn = componentFn;
 		instance.portalScope = instance;
 		instance._appRenderRuntime = options?.appRuntime;
+		instance._cspNonce = nonce;
 		if (options && typeof options.cleanupStrict === "boolean") instance.cleanupStrict = options.cleanupStrict;
 	}
 	attachCleanupForRoot(rootElement, instance);
@@ -440,11 +448,15 @@ function createIsland(config) {
 	assertExecutionModel("islands");
 	if (!config || typeof config !== "object") throw new Error("createIsland requires a config object");
 	if (typeof config.component !== "function") throw new Error("createIsland: component must be a function");
+	validateCspNonce(config.cspNonce);
 	const rootElement = resolveRootElement(config.root);
 	if (!rootElement) throw new Error(`Root element not found: ${config.root}`);
 	if ("routes" in config) throw new Error("createIsland does not accept routes; use createSPA for routed apps");
 	if (hasRegisteredRoutes()) throw new Error("Routes are not supported with islands. Use createSPA (client) or createSSR (server) instead.");
-	mountOrUpdate(rootElement, config.component, { cleanupStrict: config.cleanupStrict });
+	mountOrUpdate(rootElement, config.component, {
+		cleanupStrict: config.cleanupStrict,
+		cspNonce: config.cspNonce
+	});
 }
 /**
 * createIslands: Enhances one or more existing DOM roots (no router).
@@ -453,8 +465,12 @@ function createIsland(config) {
 function createIslands(config) {
 	assertExecutionModel("islands");
 	if (!config || typeof config !== "object") throw new Error("createIslands requires a config object");
+	validateCspNonce(config.cspNonce);
 	if (!Array.isArray(config.islands) || config.islands.length === 0) throw new Error("createIslands requires a non-empty islands array");
-	for (const island of config.islands) createIsland(island);
+	for (const island of config.islands) createIsland({
+		...island,
+		cspNonce: island.cspNonce ?? config.cspNonce
+	});
 }
 /**
 * createSPA: Initializes router and mounts the app with the provided route manifest or route table.
@@ -473,6 +489,7 @@ function createIslands(config) {
 async function createSPA(config) {
 	assertExecutionModel("spa");
 	if (!config || typeof config !== "object") throw new Error("createSPA requires a config object");
+	validateCspNonce(config.cspNonce);
 	const manifest = config.manifest ?? config.registry?.manifest;
 	const routeTable = config.routes ?? config.registry?.routes;
 	const hasManifest = manifest != null && manifest.records.length > 0;
@@ -507,7 +524,8 @@ async function createSPA(config) {
 			children: []
 		}), {
 			cleanupStrict: config.cleanupStrict,
-			appRuntime
+			appRuntime,
+			cspNonce: config.cspNonce
 		});
 		await registerAppNavigation(rootElement, path, { ...appRouteSource });
 		return;
@@ -518,7 +536,8 @@ async function createSPA(config) {
 			children: []
 		}), {
 			cleanupStrict: config.cleanupStrict,
-			appRuntime
+			appRuntime,
+			cspNonce: config.cspNonce
 		});
 		await registerAppNavigation(rootElement, path, { ...appRouteSource });
 		return;
@@ -529,7 +548,8 @@ async function createSPA(config) {
 		params: resolved.params
 	}), {
 		cleanupStrict: config.cleanupStrict,
-		appRuntime
+		appRuntime,
+		cspNonce: config.cspNonce
 	});
 	await registerAppNavigation(rootElement, path, { ...appRouteSource });
 }
@@ -540,6 +560,7 @@ async function createSPA(config) {
 async function hydrateSPA(config) {
 	assertExecutionModel("spa");
 	if (!config || typeof config !== "object") throw new Error("hydrateSPA requires a config object");
+	validateCspNonce(config.cspNonce);
 	const manifest = config.manifest ?? config.registry?.manifest;
 	const routeTable = config.routes ?? config.registry?.routes;
 	const hasManifest = manifest != null && manifest.records.length > 0;
@@ -586,7 +607,10 @@ async function hydrateSPA(config) {
 		handler: resolved.handler,
 		params: resolved.params
 	};
-	const mountHydratedRoot = (...args) => withIntrinsicHydrationAdoption(() => mountOrUpdate(...args));
+	const mountHydratedRoot = (...args) => withIntrinsicHydrationAdoption(() => mountOrUpdate(args[0], args[1], {
+		...args[2],
+		cspNonce: config.cspNonce
+	}));
 	if (shouldVerifyHydrationMarkup(config)) {
 		const legacyRouteTable = hasManifest ? manifest.records.map((r) => ({
 			...r,
@@ -594,7 +618,7 @@ async function hydrateSPA(config) {
 			handler: r.handler,
 			namespace: r.options.namespace
 		})) : routeTable;
-		const { verifyHydrationSyncForUrl } = await import("./verify-hydration-13f0FOPd.js");
+		const { verifyHydrationSyncForUrl } = await import("./verify-hydration-DfsBcGSf.js");
 		if (!verifyHydrationSyncForUrl({
 			root: rootElement,
 			url: currentUrl,
@@ -603,7 +627,8 @@ async function hydrateSPA(config) {
 			options: {
 				data: hydrationRenderDataForApp?.resources,
 				dataRuntime: config.dataRuntime ?? getDefaultDataRuntime(),
-				envelope: hydrationRenderDataForApp ?? void 0
+				envelope: hydrationRenderDataForApp ?? void 0,
+				cspNonce: config.cspNonce
 			}
 		})) throw new Error("[Askr] Hydration mismatch detected. Server HTML does not match expected server-render output.");
 	}

package/dist/components/index.d.ts

@@ -1,4 +1,4 @@
-import { l as VNode } from "../control-CFIrGbD7.js";
+import { l as VNode } from "../control-CMzFPMjr.js";
 import { r as JSXElement, s as Props } from "../jsx-Dvr2SGRG.js";
 
 //#region src/common/error-boundary.d.ts

package/dist/control/index.d.ts

@@ -1,2 +1,2 @@
-import { a as Show, c as ForProps, i as MatchProps, n as CaseProps, o as ShowProps, r as Match, s as For, t as Case } from "../index-DlvpxdSz.js";
+import { a as Show, c as ForProps, i as MatchProps, n as CaseProps, o as ShowProps, r as Match, s as For, t as Case } from "../index-Byqjltu2.js";
 export { Case, type CaseProps, For, type ForProps, Match, type MatchProps, Show, type ShowProps };

package/dist/{control-CFIrGbD7.d.ts → control-CMzFPMjr.d.ts}

@@ -70,6 +70,7 @@ interface DocumentRenderContext {
   data?: SSRData;
   seed: number;
   route: DocumentRenderRoute;
+  cspNonce?: string;
 }
 interface DocumentRenderArgs {
   appHtml: string;
@@ -170,6 +171,8 @@ interface ComponentInstance {
   _rootComponentFn?: ComponentFunction;
   /** @internal Browser-owned hydration and route state for this app root. */
   _appRenderRuntime?: AppRenderRuntime;
+  /** @internal CSP nonce retained across browser route navigation. */
+  _cspNonce?: string;
   _vnodeOwner?: object;
   _vnodeParent?: ComponentInstance | null;
   _vnodeParentGeneration?: object;

package/dist/csp-nonce-C-8E85El.js

@@ -0,0 +1,33 @@
+import { l as defineScope, m as readScope } from "./component-internal-CbALfPGD.js";
+//#region src/common/router-internal.ts
+const ROUTE_ROOT_COMPONENT = Symbol.for("askr.route-root-component");
+//#endregion
+//#region src/csp-nonce.ts
+const CspNonceScope = defineScope(void 0);
+function cspNonce() {
+	try {
+		return readScope(CspNonceScope);
+	} catch (error) {
+		if (error instanceof Error && error.message.startsWith("readScope() can only be called during component render")) return;
+		throw error;
+	}
+}
+function validateCspNonce(value) {
+	if (value === void 0) return void 0;
+	const invalid = () => {
+		throw new TypeError("CSP nonce must be valid base64 or base64url encoding at least 16 bytes.");
+	};
+	if (value.length === 0 || !/^[A-Za-z0-9+/_-]+={0,2}$/.test(value) || value.length % 4 === 1 || /=/.test(value.slice(0, -2))) invalid();
+	const unpadded = value.replace(/-/g, "+").replace(/_/g, "/").replace(/=+$/, "");
+	const padded = unpadded.padEnd(Math.ceil(unpadded.length / 4) * 4, "=");
+	let decoded = "";
+	try {
+		decoded = atob(padded);
+	} catch {
+		invalid();
+	}
+	if (decoded.length < 16) invalid();
+	return value;
+}
+//#endregion
+export { ROUTE_ROOT_COMPONENT as i, cspNonce as n, validateCspNonce as r, CspNonceScope as t };

package/dist/{deferred-BeNnjR4r.js → deferred-vBQJwHl5.js}

@@ -4,7 +4,7 @@ import { d as getCurrentAppRenderRuntime } from "./component-scope-CC3cojX9.js";
 import { m as isPromiseLike } from "./component-lifecycle-DEMPihoZ.js";
 import { n as getActiveRenderContext, r as getCurrentRenderData } from "./render-context-Clw3rFiO.js";
 import { t as resource } from "./resource-operation-Dz2Nxi1q.js";
-import { t as ROUTE_ROOT_COMPONENT } from "./router-internal-BC0w1_xk.js";
+import { i as ROUTE_ROOT_COMPONENT } from "./csp-nonce-C-8E85El.js";
 import { c as withTelemetry, t as createQueryPrefetchContext } from "./query-registry-CQIT4mXr.js";
 import { E as getRouteRecords, h as getActiveRouteAuthOptions, i as getMatchingRouteRecord, o as buildRouteContext, s as buildRouteContextBase } from "./route-matching-vJpvLVbX.js";
 //#region src/router/lazy.ts

package/dist/foundations/index.d.ts

@@ -1,3 +1,3 @@
 import { r as JSXElement } from "../jsx-Dvr2SGRG.js";
-import { _ as definePortal, c as Presence, d as SlotProps, f as LayoutComponent, g as PortalProps, h as Portal, l as PresenceProps, m as DefaultPortal, p as layout, u as Slot } from "../index-Bce-RQg-.js";
+import { _ as definePortal, c as Presence, d as SlotProps, f as LayoutComponent, g as PortalProps, h as Portal, l as PresenceProps, m as DefaultPortal, p as layout, u as Slot } from "../index-PgRn5wmg.js";
 export { DefaultPortal, type JSXElement, type LayoutComponent, Portal, type PortalProps, Presence, type PresenceProps, Slot, type SlotProps, definePortal, layout };

package/dist/foundations/state/index.d.ts

@@ -1,4 +1,4 @@
-import { m as State } from "../../control-CFIrGbD7.js";
+import { m as State } from "../../control-CMzFPMjr.js";
 
 //#region src/foundations/state/controllable.d.ts
 declare function isControlled<T>(value: T | undefined): value is T;

package/dist/foundations/structures/index.d.ts

@@ -1,3 +1,3 @@
 import { r as JSXElement } from "../../jsx-Dvr2SGRG.js";
-import { _ as definePortal, a as Collection, c as Presence, d as SlotProps, f as LayoutComponent, g as PortalProps, h as Portal, i as createLayer, l as PresenceProps, m as DefaultPortal, n as LayerManager, o as CollectionItem, p as layout, r as LayerOptions, s as createCollection, t as Layer, u as Slot } from "../../index-Bce-RQg-.js";
+import { _ as definePortal, a as Collection, c as Presence, d as SlotProps, f as LayoutComponent, g as PortalProps, h as Portal, i as createLayer, l as PresenceProps, m as DefaultPortal, n as LayerManager, o as CollectionItem, p as layout, r as LayerOptions, s as createCollection, t as Layer, u as Slot } from "../../index-PgRn5wmg.js";
 export { type Collection, type CollectionItem, DefaultPortal, type JSXElement, type Layer, type LayerManager, type LayerOptions, type LayoutComponent, Portal, type PortalProps, Presence, type PresenceProps, Slot, type SlotProps, createCollection, createLayer, definePortal, layout };

package/dist/{index-DaWuMuIc.d.ts → index-Bjm0__Rr.d.ts}

@@ -1,4 +1,4 @@
-import { c as RenderableChild, g as StateTuple } from "./control-CFIrGbD7.js";
+import { c as RenderableChild, g as StateTuple } from "./control-CMzFPMjr.js";
 import { r as JSXElement } from "./jsx-Dvr2SGRG.js";
 import { ObjectSchema } from "@askrjs/schema";
 

package/dist/{index-DlvpxdSz.d.ts → index-Byqjltu2.d.ts}

@@ -1,4 +1,4 @@
-import { c as RenderableChild, l as VNode, t as ForEachSource } from "./control-CFIrGbD7.js";
+import { c as RenderableChild, l as VNode, t as ForEachSource } from "./control-CMzFPMjr.js";
 import { r as JSXElement } from "./jsx-Dvr2SGRG.js";
 
 //#region src/control/shared.d.ts

package/dist/{index-CRck4XVe.d.ts → index-NKPpdRh9.d.ts}

@@ -1,4 +1,4 @@
-import { n as ReadableSource, r as ComponentInstance } from "./control-CFIrGbD7.js";
+import { i as Scope, n as ReadableSource, r as ComponentInstance } from "./control-CMzFPMjr.js";
 import { t as Scheduler } from "./scheduler-CmLO4Dfm.js";
 //#region src/runtime/runtime.d.ts
 interface RuntimeKeyedReorderDecision {
@@ -62,4 +62,8 @@ type SelectorEquals<T> = {
 }['bivarianceHack'];
 declare function selector<T>(source: () => T, equals?: SelectorEquals<T>): Selector<T>;
 //#endregion
-export { AskrRuntime as a, RuntimeRendererHost as c, derive as i, createRuntime as l, selector as n, AskrRuntimeOptions as o, Derived as r, RuntimeKeyedReorderDecision as s, Selector as t, getDefaultRuntime as u };
+//#region src/csp-nonce.d.ts
+declare const CspNonceScope: Scope<string | undefined>;
+declare function cspNonce(): string | undefined;
+//#endregion
+export { Derived as a, AskrRuntimeOptions as c, createRuntime as d, getDefaultRuntime as f, selector as i, RuntimeKeyedReorderDecision as l, cspNonce as n, derive as o, Selector as r, AskrRuntime as s, CspNonceScope as t, RuntimeRendererHost as u };

package/dist/{index-Bce-RQg-.d.ts → index-PgRn5wmg.d.ts}

@@ -1,4 +1,4 @@
-import { c as RenderableChild } from "./control-CFIrGbD7.js";
+import { c as RenderableChild } from "./control-CMzFPMjr.js";
 import { r as JSXElement } from "./jsx-Dvr2SGRG.js";
 //#region src/runtime/portal.d.ts
 interface Portal<T extends RenderableChild = RenderableChild> {

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { _ as state, a as defineScope, g as StateTuple, h as StateSetter, i as Scope, m as State, o as readScope } from "./control-CFIrGbD7.js";
+import { _ as state, a as defineScope, g as StateTuple, h as StateSetter, i as Scope, m as State, o as readScope } from "./control-CMzFPMjr.js";
 import { s as Props, t as Fragment } from "./jsx-Dvr2SGRG.js";
 import { t as getSignal } from "./component-scope-CvPba6O6.js";
-import { a as AskrRuntime, c as RuntimeRendererHost, i as derive, l as createRuntime, n as selector, o as AskrRuntimeOptions, r as Derived, s as RuntimeKeyedReorderDecision, t as Selector, u as getDefaultRuntime } from "./index-CRck4XVe.js";
-import { a as Show, c as ForProps, i as MatchProps, n as CaseProps, o as ShowProps, r as Match, s as For, t as Case } from "./index-DlvpxdSz.js";
+import { a as Derived, c as AskrRuntimeOptions, d as createRuntime, f as getDefaultRuntime, i as selector, l as RuntimeKeyedReorderDecision, n as cspNonce, o as derive, r as Selector, s as AskrRuntime, t as CspNonceScope, u as RuntimeRendererHost } from "./index-NKPpdRh9.js";
+import { a as Show, c as ForProps, i as MatchProps, n as CaseProps, o as ShowProps, r as Match, s as For, t as Case } from "./index-Byqjltu2.js";
 import { i as jsxs, n as jsx } from "./jsx-runtime-iTU73uwP.js";
 import { A as ServerQueryHandler, D as QueryPrefetchContext, T as QueryDefinition, a as defineServerQueries, c as prefetchQuery, g as createQuery, i as defineQuery, l as serveQuery, o as dehydrateDataRuntime, s as hydrateDataRuntime, v as DataRuntime } from "./index-Bki2rqcr.js";
-export { AskrRuntime, type AskrRuntimeOptions, Case, type CaseProps, type DataRuntime, type Derived, For, type ForProps, Fragment, Match, type MatchProps, type Props, type QueryDefinition, type QueryPrefetchContext, type RuntimeKeyedReorderDecision, type RuntimeRendererHost, type Scope, type Selector, type ServerQueryHandler, Show, type ShowProps, type State, type StateSetter, type StateTuple, createQuery, createRuntime, defineQuery, defineScope, defineServerQueries, dehydrateDataRuntime, derive, getDefaultRuntime, getSignal, hydrateDataRuntime, jsx, jsxs, prefetchQuery, readScope, selector, serveQuery, state };
+export { AskrRuntime, type AskrRuntimeOptions, Case, type CaseProps, CspNonceScope, type DataRuntime, type Derived, For, type ForProps, Fragment, Match, type MatchProps, type Props, type QueryDefinition, type QueryPrefetchContext, type RuntimeKeyedReorderDecision, type RuntimeRendererHost, type Scope, type Selector, type ServerQueryHandler, Show, type ShowProps, type State, type StateSetter, type StateTuple, createQuery, createRuntime, cspNonce, defineQuery, defineScope, defineServerQueries, dehydrateDataRuntime, derive, getDefaultRuntime, getSignal, hydrateDataRuntime, jsx, jsxs, prefetchQuery, readScope, selector, serveQuery, state };

package/dist/index.js

@@ -4,10 +4,11 @@ import { n as Fragment } from "./jsx-CUpRxrLH.js";
 import { l as defineScope, m as readScope } from "./component-internal-CbALfPGD.js";
 import { g as getSignal, i as claimHookIndex, p as getCurrentInstance } from "./component-scope-CC3cojX9.js";
 import { n as isSnapshotSource } from "./snapshot-source-BB42xgwb.js";
-import { t as installRendererBridge } from "./renderer-CVr_nktj.js";
+import { t as installRendererBridge } from "./renderer-aUD-acDe.js";
 import { t as state } from "./state-Cc5HumQ0.js";
 import { t as selector } from "./selector-pApF_lGd.js";
 import { jsx, jsxs } from "./jsx-runtime.js";
+import { n as cspNonce, t as CspNonceScope } from "./csp-nonce-C-8E85El.js";
 import { i as For, n as Match, r as Show, t as Case } from "./control-KVP6LMEQ.js";
 import { t as createQuery } from "./data-DvYo_dHd.js";
 import { a as hydrateDataRuntime, i as dehydrateDataRuntime, n as defineQuery, o as prefetchQuery, r as defineServerQueries, s as serveQuery } from "./query-registry-CQIT4mXr.js";
@@ -156,4 +157,4 @@ function derive(source, map) {
 */
 installRendererBridge();
 //#endregion
-export { AskrRuntime, Case, For, Fragment, Match, Show, createQuery, createRuntime, defineQuery, defineScope, defineServerQueries, dehydrateDataRuntime, derive, getDefaultRuntime, getSignal, hydrateDataRuntime, jsx, jsxs, prefetchQuery, readScope, selector, serveQuery, state };
+export { AskrRuntime, Case, CspNonceScope, For, Fragment, Match, Show, createQuery, createRuntime, cspNonce, defineQuery, defineScope, defineServerQueries, dehydrateDataRuntime, derive, getDefaultRuntime, getSignal, hydrateDataRuntime, jsx, jsxs, prefetchQuery, readScope, selector, serveQuery, state };

package/dist/{navigate-DLi79IZr.js → navigate-CaFA0DdW.js}

@@ -8,8 +8,9 @@ import { _ as teardownNodeSubtree } from "./cleanup-B6KovDZZ.js";
 import { n as getActiveRenderContext } from "./render-context-Clw3rFiO.js";
 import { n as syncRouteActivitySnapshot } from "./route-activity-CNJfpwx-.js";
 import { r as clearDefaultPortalForInstance, t as DefaultPortal } from "./portal-D2tPWNrC.js";
+import { t as CspNonceScope } from "./csp-nonce-C-8E85El.js";
 import { A as insertRecordSorted, C as getCurrentPathPrefix, D as getRoutes, E as getRouteRecords, F as snapshotRouteState, I as computeRank, L as normalizeRouteSegmentName, M as pushRegistrationScope, N as restoreRouteState, O as hasActivePageScope, P as setDefaultRouteAuthOptions, R as parseSegments, S as getCurrentPageScope, T as getDefaultRouteAuthOptions, _ as getCurrentInheritedAuthRequirements, a as resolveRouteFromRoutes, b as getCurrentLayoutChain, c as deepFreeze, f as addRouteToStores, g as getActiveRoutes, j as lockRouteRegistration, l as makeQuery, m as clearRouteState, n as computeMatchesFromRoutes, p as assertRouteRegistrationUnlocked, r as computeRouteActivityMatches, u as parseLocation, v as getCurrentInheritedMeta, w as getCurrentScopeKind, x as getCurrentPageChain, y as getCurrentInheritedPolicies } from "./route-matching-vJpvLVbX.js";
-import { d as hasRouteRenderData, f as resolveRouteRequest, l as getRouteRenderContext, u as getRouteRenderData, x as _preloadRouteHandler, y as createRouteHandler } from "./deferred-BeNnjR4r.js";
+import { d as hasRouteRenderData, f as resolveRouteRequest, l as getRouteRenderContext, u as getRouteRenderData, x as _preloadRouteHandler, y as createRouteHandler } from "./deferred-vBQJwHl5.js";
 import { allOf } from "@askrjs/auth";
 //#region src/runtime/execution-model.ts
 const EXECUTION_MODEL_KEY = Symbol.for("__ASKR_EXECUTION_MODEL__");
@@ -589,12 +590,61 @@ async function resolveRouteMeta(record, context) {
 /** Replace only Askr-owned head nodes after a successful client navigation. */
 function reconcileRouteMeta(meta, target = document) {
 	for (const node of Array.from(target.head.querySelectorAll("[data-askr-head]"))) node.remove();
-	const template = target.createElement("template");
-	template.innerHTML = serializeRouteMeta(meta);
-	target.head.append(template.content);
+	const own = (element) => {
+		element.setAttribute("data-askr-head", "");
+		return element;
+	};
+	const appendMeta = (attribute, name, content) => {
+		const element = own(target.createElement("meta"));
+		element.setAttribute(attribute, name);
+		element.setAttribute("content", content);
+		target.head.append(element);
+	};
+	if (meta.title !== void 0) {
+		const element = own(target.createElement("title"));
+		element.textContent = meta.title;
+		target.head.append(element);
+	}
+	if (meta.description !== void 0) appendMeta("name", "description", meta.description);
+	if (meta.canonical !== void 0) {
+		const element = own(target.createElement("link"));
+		element.setAttribute("rel", "canonical");
+		element.setAttribute("href", meta.canonical);
+		target.head.append(element);
+	}
+	if (meta.robots !== void 0) appendMeta("name", "robots", meta.robots);
+	for (const [property, content] of Object.entries(meta.openGraph ?? {})) appendMeta("property", property.startsWith("og:") ? property : `og:${property}`, content);
+	for (const link of meta.links ?? []) {
+		const element = own(target.createElement("link"));
+		for (const [name, value] of Object.entries(link)) if (LINK_ATTRIBUTES.has(name.toLowerCase())) element.setAttribute(name.toLowerCase(), value);
+		target.head.append(element);
+	}
+	if (meta.jsonLd !== void 0) {
+		const values = Array.isArray(meta.jsonLd) ? meta.jsonLd : [meta.jsonLd];
+		for (const value of values) {
+			const element = own(target.createElement("script"));
+			element.setAttribute("type", "application/ld+json");
+			element.textContent = JSON.stringify(value);
+			target.head.append(element);
+		}
+	}
 	if (meta.html?.lang) target.documentElement.setAttribute("lang", meta.html.lang);
 	if (meta.html?.dir) target.documentElement.setAttribute("dir", meta.html.dir);
 }
+const LINK_ATTRIBUTES = /* @__PURE__ */ new Set([
+	"rel",
+	"href",
+	"as",
+	"crossorigin",
+	"fetchpriority",
+	"hreflang",
+	"imagesizes",
+	"imagesrcset",
+	"media",
+	"referrerpolicy",
+	"sizes",
+	"type"
+]);
 function escapeAttribute(value) {
 	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
@@ -605,7 +655,7 @@ function ownedAttribute() {
 	return " data-askr-head=\"\"";
 }
 function serializeLink(link) {
-	const entries = Object.entries(link).filter(([name]) => /^[a-zA-Z][a-zA-Z0-9:_-]*$/.test(name)).sort(([left], [right]) => {
+	const entries = Object.entries(link).map(([name, value]) => [name.toLowerCase(), value]).filter(([name]) => LINK_ATTRIBUTES.has(name)).sort(([left], [right]) => {
 		const order = (name) => name === "rel" ? 0 : name === "href" ? 1 : 2;
 		return order(left) - order(right) || left.localeCompare(right);
 	});
@@ -706,7 +756,7 @@ function createDeniedResolvedRoute(status) {
 function bindResolvedRouteHandler(resolved) {
 	return () => resolved.handler(resolved.params);
 }
-function wrapRootRouteHandler(componentFn) {
+function wrapRootRouteHandler(componentFn, cspNonce) {
 	const wrappedFn = (props, ctx) => {
 		const out = componentFn(props, ctx);
 		if (isPromiseLike(out)) throw new Error("Async components are not supported. Components must return synchronously.");
@@ -716,11 +766,15 @@ function wrapRootRouteHandler(componentFn) {
 			props: { __askrAutoDefaultPortal: true },
 			key: "__default_portal"
 		};
-		return {
+		const root = {
 			$$typeof: ELEMENT_TYPE,
 			type: Fragment,
 			props: { children: out === void 0 || out === null ? [portalVNode] : [out, portalVNode] }
 		};
+		return cspNonce === void 0 ? root : CspNonceScope({
+			value: cspNonce,
+			children: root
+		});
 	};
 	Object.defineProperty(wrappedFn, "name", { value: componentFn.name || "Component" });
 	return wrappedFn;
@@ -957,7 +1011,7 @@ function cleanupDeferredRouteInstance(deferred) {
 function remountResolvedRoute(instance, resolved, pathname, href, existingSnapshot) {
 	const deferredCleanup = existingSnapshot ?? captureDeferredRouteCleanup(instance);
 	clearDefaultPortalForInstance(instance);
-	instance.fn = wrapRootRouteHandler(bindResolvedRouteHandler(resolved));
+	instance.fn = wrapRootRouteHandler(bindResolvedRouteHandler(resolved), instance._cspNonce);
 	instance.props = {};
 	instance._ownershipGeneration = {};
 	instance.stateValues = [];

package/dist/{renderer-CVr_nktj.js → renderer-aUD-acDe.js}

@@ -10,7 +10,7 @@ import { _ as createChildScope, a as registerForStateTransaction, c as captureFo
 import { n as createOwnedFineGrainedEffect, r as markFineGrainedEffectsDirtySource, t as createFineGrainedEffect } from "./effect-D_4zf_wy.js";
 import { C as getDelegatedHandlersForElement, D as updateDelegatedListener, E as removeDelegatedListener, S as getDelegatedHandlerForElement, T as isEventDelegationEnabled, _ as teardownNodeSubtree, a as elementReactivePropsCleanup, b as addFreshDelegatedListener, c as forEachElementReactivePropCleanup, d as removeAllListeners, f as removeElementReactiveProps, g as setFreshElementReactivePropCleanup, h as setDirectElementReactivePropCleanup, i as elementListeners, l as getElementReactivePropCleanupSize, m as replaceElementRefBookkeeping, n as cleanupInstanceIfPresent, o as elementRefs, p as removeElementRef, r as cleanupInstancesUnder, s as forEachDescendantNode, t as REACTIVE_CHILDREN_KEY, u as getElementReactivePropsCleanupMap, v as updateElementRef, w as isDelegatedEvent, x as clearDelegatedHandlersForElement, y as addDelegatedListener } from "./cleanup-B6KovDZZ.js";
 import { t as getPublicAttributeName } from "./attr-names-CjhzmHOn.js";
-import { t as ROUTE_ROOT_COMPONENT } from "./router-internal-BC0w1_xk.js";
+import { i as ROUTE_ROOT_COMPONENT } from "./csp-nonce-C-8E85El.js";
 //#region src/runtime/error-boundary.ts
 function createBoundaryReset(instance) {
 	return () => {

package/dist/router/index.d.ts

@@ -1,6 +1,6 @@
-import { c as RenderableChild } from "../control-CFIrGbD7.js";
+import { c as RenderableChild } from "../control-CMzFPMjr.js";
 import { r as JSXElement, s as Props } from "../jsx-Dvr2SGRG.js";
-import { A as RouteQuery, B as RouteSnapshot, C as RouteMeta, D as RouteParams, E as RouteOptions, F as RouteRenderResult, I as RouteRequestOptions, L as RouteRequestResult, M as RouteRef, N as RouteRefSearch, O as RoutePathParams, P as RouteRegistry, R as RouteSearch, S as RouteMatch, T as RouteMode, _ as RouteContext, a as AccessRedirectDecision, b as RouteHandler, c as LayoutScopeRecord, d as ParsedSegment, f as RegisterRoutesOptions, g as RouteComponent, h as RouteAuthResolver, i as AccessDenyStatus, j as RouteRecord, k as RoutePolicy, l as PageHelperOptions, m as RouteAuthOptions, n as AccessDecision, o as AccessRedirectStatus, p as Route, r as AccessDenyDecision, s as GroupHelperOptions, t as AccessAllowDecision, u as PageScopeRecord, v as RouteDefinition, w as RouteMetaSource, x as RouteManifest, y as RouteDestination, z as RouteSearchValue } from "../router-lmH-Tmwh.js";
+import { A as RouteQuery, B as RouteSnapshot, C as RouteMeta, D as RouteParams, E as RouteOptions, F as RouteRenderResult, I as RouteRequestOptions, L as RouteRequestResult, M as RouteRef, N as RouteRefSearch, O as RoutePathParams, P as RouteRegistry, R as RouteSearch, S as RouteMatch, T as RouteMode, _ as RouteContext, a as AccessRedirectDecision, b as RouteHandler, c as LayoutScopeRecord, d as ParsedSegment, f as RegisterRoutesOptions, g as RouteComponent, h as RouteAuthResolver, i as AccessDenyStatus, j as RouteRecord, k as RoutePolicy, l as PageHelperOptions, m as RouteAuthOptions, n as AccessDecision, o as AccessRedirectStatus, p as Route, r as AccessDenyDecision, s as GroupHelperOptions, t as AccessAllowDecision, u as PageScopeRecord, v as RouteDefinition, w as RouteMetaSource, x as RouteManifest, y as RouteDestination, z as RouteSearchValue } from "../router-Dz7ZoLja.js";
 import { a as RouteQueryUpdates, c as NavigateOptions, d as ScrollRestorationOptions, i as RouteQueryUpdater, l as HistoryScrollBehavior, n as RouteQueryParamInput, o as UpdateRouteQueryOptions, r as RouteQueryParamValue, s as updateRouteQuery, t as navigate, u as NavigationScrollBehavior } from "../navigate-BVDCzOuB.js";
 import { AuthContext, AuthContext as AuthContext$1, AuthRequirement, AuthRequirement as AuthRequirement$1 } from "@askrjs/auth";
 import { ObjectSchema } from "@askrjs/schema";

package/dist/router/index.js

@@ -1,7 +1,7 @@
-import { S as route, _ as fallback, a as resolveRouteMeta, b as page, d as clearRoutes, f as createRouteRegistry, i as reconcileRouteMeta, m as currentRoute, n as navigate, o as serializeRouteMeta, p as getManifest, r as updateRouteQuery, v as group, x as registerRoutes, y as index } from "../navigate-DLi79IZr.js";
+import { S as route, _ as fallback, a as resolveRouteMeta, b as page, d as clearRoutes, f as createRouteRegistry, i as reconcileRouteMeta, m as currentRoute, n as navigate, o as serializeRouteMeta, p as getManifest, r as updateRouteQuery, v as group, x as registerRoutes, y as index } from "../navigate-CaFA0DdW.js";
 import { jsx } from "../jsx-runtime.js";
 import { D as getRoutes } from "../route-matching-vJpvLVbX.js";
-import { S as lazy, a as resolveDeferredValues, f as resolveRouteRequest, i as isDeferred, n as Resolve, p as currentAuth, r as defer, s as routeData, v as Outlet } from "../deferred-BeNnjR4r.js";
+import { S as lazy, a as resolveDeferredValues, f as resolveRouteRequest, i as isDeferred, n as Resolve, p as currentAuth, r as defer, s as routeData, v as Outlet } from "../deferred-vBQJwHl5.js";
 import { o as mergeProps } from "../compose-ref-Cc_YkUpM.js";
 import { t as applyInteractionPolicy } from "../interactions-w7gQN4ha.js";
 //#region src/router/policy.ts

package/dist/{router-lmH-Tmwh.d.ts → router-Dz7ZoLja.d.ts}

@@ -1,6 +1,6 @@
-import { c as RenderableChild } from "./control-CFIrGbD7.js";
+import { c as RenderableChild } from "./control-CMzFPMjr.js";
 import { D as QueryPrefetchContext, u as CoreTelemetry } from "./index-Bki2rqcr.js";
-import { t as ActionDescriptor } from "./index-DaWuMuIc.js";
+import { t as ActionDescriptor } from "./index-Bjm0__Rr.js";
 import { AuthContext, AuthRequirement } from "@askrjs/auth";
 import { InferSchema, ObjectSchema } from "@askrjs/schema";
 

package/dist/ssg/index.d.ts

@@ -1,5 +1,5 @@
-import { c as RenderableChild, d as DocumentRenderContext, f as DocumentRenderer, s as ComponentFunction, u as DocumentRenderArgs } from "../control-CFIrGbD7.js";
-import { E as RouteOptions, O as RoutePathParams, P as RouteRegistry, b as RouteHandler, k as RoutePolicy } from "../router-lmH-Tmwh.js";
+import { c as RenderableChild, d as DocumentRenderContext, f as DocumentRenderer, s as ComponentFunction, u as DocumentRenderArgs } from "../control-CMzFPMjr.js";
+import { E as RouteOptions, O as RoutePathParams, P as RouteRegistry, b as RouteHandler, k as RoutePolicy } from "../router-Dz7ZoLja.js";
 import { AuthRequirement } from "@askrjs/auth";
 //#region src/ssg/types.d.ts
 type SSGMode = 'full' | 'incremental';

package/dist/ssg/index.js

@@ -1,7 +1,7 @@
 import "../access-ePqdQqkV.js";
-import { a as resolveDeferredValues, b as getRenderHandler, c as bindResolvedRouteData } from "../deferred-BeNnjR4r.js";
+import { a as resolveDeferredValues, b as getRenderHandler, c as bindResolvedRouteData } from "../deferred-vBQJwHl5.js";
 import { n as renderDocument } from "../ssr-CbQO5xd3.js";
-import { n as renderToString } from "../ssr-5HlhmLhU.js";
+import { n as renderToString } from "../ssr-CAYo-kNy.js";
 import * as fs from "node:fs/promises";
 import * as pathModule from "node:path";
 import * as os from "node:os";

package/dist/ssr/index.d.ts

@@ -1,7 +1,7 @@
-import { c as RenderableChild, d as DocumentRenderContext, f as DocumentRenderer, p as SSRData, u as DocumentRenderArgs } from "../control-CFIrGbD7.js";
+import { c as RenderableChild, d as DocumentRenderContext, f as DocumentRenderer, p as SSRData, u as DocumentRenderArgs } from "../control-CMzFPMjr.js";
 import { r as JSXElement, s as Props } from "../jsx-Dvr2SGRG.js";
 import { D as QueryPrefetchContext, n as ServerQueryRegistry, u as CoreTelemetry, v as DataRuntime } from "../index-Bki2rqcr.js";
-import { L as RouteRequestResult, P as RouteRegistry, a as AccessRedirectDecision, b as RouteHandler, j as RouteRecord, m as RouteAuthOptions, p as Route, r as AccessDenyDecision, x as RouteManifest } from "../router-lmH-Tmwh.js";
+import { L as RouteRequestResult, P as RouteRegistry, a as AccessRedirectDecision, b as RouteHandler, j as RouteRecord, m as RouteAuthOptions, p as Route, r as AccessDenyDecision, x as RouteManifest } from "../router-Dz7ZoLja.js";
 import { AuthContext } from "@askrjs/auth";
 
 //#region src/common/page-render-envelope.d.ts
@@ -50,6 +50,7 @@ interface RenderContext {
   renderData: PageRenderEnvelope | null;
   hydrationData: PageRenderEnvelope | null;
   deferredBoundaries: DeferredBoundaryRegistration[];
+  cspNonce?: string;
 }
 declare function createRenderContext(seed?: number, opts?: {
   url?: string;
@@ -63,6 +64,7 @@ declare function createRenderContext(seed?: number, opts?: {
   queryPrefetch?: QueryPrefetchContext;
   framework?: Readonly<Record<string, unknown>>;
   envelope?: PageRenderEnvelope;
+  cspNonce?: string;
 }): RenderContext;
 /**
  * Run a function with the given render context.
@@ -99,6 +101,7 @@ type RouteRenderOptions = SSRRouteSource & {
   queryPrefetch?: QueryPrefetchContext;
   telemetry?: Pick<CoreTelemetry, 'ssrRender'>; /** @internal Precomposed page state used by hydration verification. */
   envelope?: PageRenderEnvelope;
+  cspNonce?: string;
 };
 type RouteStreamOptions = RouteRenderOptions & {
   onChunk(html: string): void;
@@ -167,6 +170,7 @@ declare function renderToStringSync(component: (props?: Record<string, unknown>)
   seed?: number;
   data?: SSRData; /** @internal A composed page render envelope. */
   envelope?: PageRenderEnvelope;
+  cspNonce?: string;
 }): string;
 //#endregion
 //#region src/ssr/render-resolved.d.ts
@@ -184,6 +188,7 @@ declare function renderResolvedToStringSync(opts: {
     data?: SSRData;
     dataRuntime?: DataRuntime;
     envelope?: PageRenderEnvelope;
+    cspNonce?: string;
   };
 }): string;
 //#endregion
@@ -204,6 +209,7 @@ interface RenderRouteRequestOptions {
   queryPrefetch?: QueryPrefetchContext;
   queryRegistry?: ServerQueryRegistry;
   telemetry?: CoreTelemetry;
+  cspNonce?: string;
 }
 type RenderRouteRequestResult = {
   kind: 'render';

package/dist/ssr/index.js

@@ -1,3 +1,3 @@
 import { u as SSRDataMissingError } from "../render-context-Clw3rFiO.js";
-import { a as renderResolvedToStringSync, c as createRenderContext, d as withRenderContextAsync, i as renderRouteRequestToString, l as getRenderContext, n as renderToString, o as renderToStringSync, r as renderRouteRequest, s as resolveRequest, t as renderToStream, u as withRenderContext } from "../ssr-5HlhmLhU.js";
+import { a as renderResolvedToStringSync, c as createRenderContext, d as withRenderContextAsync, i as renderRouteRequestToString, l as getRenderContext, n as renderToString, o as renderToStringSync, r as renderRouteRequest, s as resolveRequest, t as renderToStream, u as withRenderContext } from "../ssr-CAYo-kNy.js";
 export { SSRDataMissingError, createRenderContext, getRenderContext, renderResolvedToStringSync, renderRouteRequest, renderRouteRequestToString, renderToStream, renderToString, renderToStringSync, resolveRequest, withRenderContext, withRenderContextAsync };

package/dist/{ssr-5HlhmLhU.js → ssr-CAYo-kNy.js}

@@ -9,10 +9,11 @@ import { g as evaluateShowState, h as evaluateCaseState, i as evaluateForState,
 import { c as stopRenderPhase$1, o as startRenderPhase$1, t as configureRenderContextProvider, u as SSRDataMissingError } from "./render-context-Clw3rFiO.js";
 import { a as disposeDefaultPortalScope, t as DefaultPortal } from "./portal-D2tPWNrC.js";
 import { t as getPublicAttributeName } from "./attr-names-CjhzmHOn.js";
+import { r as validateCspNonce, t as CspNonceScope } from "./csp-nonce-C-8E85El.js";
 import { t as createDataRuntime } from "./data-runtime-SJ1BSUvk.js";
 import { c as withTelemetry, i as dehydrateDataRuntime, t as createQueryPrefetchContext } from "./query-registry-CQIT4mXr.js";
 import { a as resolveRouteFromRoutes, t as _resolveRouteMatchFromRoutes } from "./route-matching-vJpvLVbX.js";
-import { f as resolveRouteRequest, g as isPageRenderEnvelope, h as isEmptyPageRenderEnvelope, i as isDeferred, m as createPageRenderEnvelope, t as DEFERRED_BOUNDARY, x as _preloadRouteHandler } from "./deferred-BeNnjR4r.js";
+import { f as resolveRouteRequest, g as isPageRenderEnvelope, h as isEmptyPageRenderEnvelope, i as isDeferred, m as createPageRenderEnvelope, t as DEFERRED_BOUNDARY, x as _preloadRouteHandler } from "./deferred-vBQJwHl5.js";
 import { n as renderDocument, t as SSR_RENDER_DATA_ATTR } from "./ssr-CbQO5xd3.js";
 //#region src/ssr/escape.ts
 /**
@@ -260,7 +261,8 @@ function createRenderContext(seed = 12345, opts = {}) {
 		keyCounter: 0,
 		renderData: envelope,
 		hydrationData: envelope,
-		deferredBoundaries: []
+		deferredBoundaries: [],
+		cspNonce: opts.cspNonce
 	};
 }
 /**
@@ -520,6 +522,7 @@ function resolveSSRRouteSource(source) {
 }
 function resolveSSRRouteRender(opts) {
 	const { seed = 12345, data, document } = opts;
+	const cspNonce = validateCspNonce(opts.cspNonce);
 	const routeTable = resolveSSRRouteSource(opts);
 	const resolvedRoute = resolvePolicyAwareSSRRoute(opts, routeTable);
 	const requestUrl = new URL(resolvedRoute.url, "http://localhost");
@@ -530,7 +533,8 @@ function resolveSSRRouteRender(opts) {
 		routes: routeTable,
 		dataRuntime: opts.dataRuntime,
 		queryPrefetch: opts.queryPrefetch,
-		envelope: opts.envelope
+		envelope: opts.envelope,
+		cspNonce
 	});
 	return {
 		url: resolvedRoute.url,
@@ -540,7 +544,8 @@ function resolveSSRRouteRender(opts) {
 		seed,
 		data,
 		ctx,
-		document
+		document,
+		cspNonce
 	};
 }
 function buildDocumentRenderArgs(resolved, appHtml) {
@@ -558,7 +563,8 @@ function buildDocumentRenderArgs(resolved, appHtml) {
 			route: {
 				path: resolved.route.path,
 				namespace: resolved.route.namespace
-			}
+			},
+			cspNonce: resolved.cspNonce
 		}
 	};
 }
@@ -800,7 +806,10 @@ function withControlBoundaryChildren(node, render) {
 const ESCAPED_ATTR_VALUE_CACHE_LIMIT = 512;
 const escapedAttrValueCache = /* @__PURE__ */ new Map();
 function isEventHandler(key) {
-	return key.length >= 3 && key.charCodeAt(0) === 111 && key.charCodeAt(1) === 110 && key.charCodeAt(2) >= 65 && key.charCodeAt(2) <= 90;
+	return key.length >= 2 && key.slice(0, 2).toLowerCase() === "on";
+}
+function assertAttributeName(name) {
+	if (!/^[A-Za-z_:][A-Za-z0-9_.:-]*$/.test(name)) throw new TypeError(`Invalid SSR attribute name: ${JSON.stringify(name)}`);
 }
 function getEscapedAttrValue(value) {
 	if (value.length > 64) return escapeAttr(value);
@@ -825,6 +834,7 @@ function renderAttrsDirect(props, sink) {
 		if (isEventHandler(key)) continue;
 		if (key.charCodeAt(0) === 95) continue;
 		const attrName = getPublicAttributeName(key);
+		assertAttributeName(attrName);
 		if (attrName === "style") {
 			const css = typeof value === "string" ? value : styleObjToCss(value);
 			if (!css) continue;
@@ -864,6 +874,7 @@ function renderAttrs(props, opts) {
 		if (isEventHandler(key)) continue;
 		if (key.charCodeAt(0) === 95) continue;
 		const attrName = key === "class" ? "class" : getPublicAttributeName(key);
+		assertAttributeName(attrName);
 		if (attrName === "style") {
 			const css = typeof value === "string" ? value : styleObjToCss(value);
 			if (css === null || css === "") continue;
@@ -1066,6 +1077,7 @@ function renderNodeSync(node, ctx) {
 		throw new Error(`renderNodeSync: unsupported VNode symbol type: ${String(type)}`);
 	}
 	const typeStr = type;
+	assertElementName(typeStr);
 	if (VOID_ELEMENTS.has(typeStr)) return `<${typeStr}${renderAttrs(props)} />`;
 	const maybeDangerous = props?.dangerouslySetInnerHTML;
 	if (maybeDangerous !== void 0 && maybeDangerous !== null) {
@@ -1118,6 +1130,7 @@ function renderNodeSyncToSink(node, sink, ctx) {
 		throw new Error(`renderNodeSyncToSink: unsupported VNode symbol type: ${String(type)}`);
 	}
 	const typeStr = type;
+	assertElementName(typeStr);
 	if (VOID_ELEMENTS.has(typeStr)) {
 		sinkWrite2(sink, "<", typeStr);
 		renderAttrsDirect(props, sink);
@@ -1171,14 +1184,19 @@ function renderNodeSyncToSink(node, sink, ctx) {
 	sinkWrite3(sink, "</", typeStr, ">");
 }
 function renderToStringSync(component, props, options) {
-	const ctx = createRenderContext(options?.seed ?? 12345, {
+	const seed = options?.seed ?? 12345;
+	const nonce = validateCspNonce(options?.cspNonce);
+	const ctx = createRenderContext(seed, {
 		data: options?.data,
 		envelope: options?.envelope
 	});
 	return withRenderContext(ctx, () => {
 		startRenderPhase(ctx.renderData);
 		try {
-			const node = renderSyncComponentRoot(component, props || {}, ctx);
+			const node = renderSyncComponentRoot(nonce === void 0 ? component : () => CspNonceScope({
+				value: nonce,
+				children: () => component(props)
+			}), props || {}, ctx);
 			if (!node) throw new Error("renderToStringSync: wrapped component returned empty");
 			const sink = new StringSink();
 			renderNodeSyncToSink(node, sink, ctx);
@@ -1199,7 +1217,10 @@ function renderSSRRouteAppToSink(input) {
 	withRenderContext(ctx, () => {
 		startRenderPhase(ctx.renderData);
 		try {
-			renderRenderableSyncToSink(executeComponentSync(route.handler, params, ctx), sink, ctx);
+			renderRenderableSyncToSink(executeComponentSync(ctx.cspNonce === void 0 ? route.handler : () => CspNonceScope({
+				value: ctx.cspNonce,
+				children: () => route.handler(params)
+			}), params, ctx), sink, ctx);
 			if (ctx.deferredBoundaries.length === 0) sink.write(serializeHydrationRenderData(ctx.hydrationData ?? data, ctx.dataRuntime));
 		} finally {
 			try {
@@ -1210,6 +1231,9 @@ function renderSSRRouteAppToSink(input) {
 		}
 	});
 }
+function assertElementName(name) {
+	if (!/^[A-Za-z][A-Za-z0-9._:-]*$/.test(name)) throw new TypeError(`Invalid SSR element name: ${JSON.stringify(name)}`);
+}
 //#endregion
 //#region src/ssr/render-resolved.ts
 function sameRouteParams(left, right) {
@@ -1237,7 +1261,8 @@ function renderResolvedToStringSync(opts) {
 		seed: options?.seed,
 		data: options?.data,
 		dataRuntime: options?.dataRuntime,
-		envelope: options?.envelope
+		envelope: options?.envelope,
+		cspNonce: options?.cspNonce
 	});
 }
 //#endregion
@@ -1264,17 +1289,18 @@ function settleWithSignal(promise, signal) {
 function stripHydrationPayload(html) {
 	return html.replace(/<script type="application\/json" data-askr-render-data="true">[\s\S]*?<\/script>$/, "");
 }
-function renderBoundary(boundary, state, payload, seed, data) {
+function renderBoundary(boundary, state, payload, seed, data, cspNonce) {
 	return stripHydrationPayload(renderToStringSync(() => state === "fulfilled" ? boundary.fulfilled(payload) : boundary.rejected(payload), {}, {
 		seed,
-		envelope: data ?? void 0
+		envelope: data ?? void 0,
+		cspNonce
 	}));
 }
-function patchChunk(id, html) {
+function patchChunk(id, html, cspNonce) {
 	const selector = `askr-resolve[data-askr-deferred=${JSON.stringify(id)}]`;
-	return `<template data-askr-deferred-patch="${id}">${html}</template><script data-askr-deferred-apply="${id}">(function(s){var t=s.previousElementSibling;var b=document.querySelector(${JSON.stringify(selector)});if(b&&t){b.replaceWith(t.content.cloneNode(true));}if(t)t.remove();s.remove();})(document.currentScript)<\/script>`;
+	return `<template data-askr-deferred-patch="${id}">${html}</template><script${cspNonce ? ` nonce="${cspNonce}"` : ""} data-askr-deferred-apply="${id}">(function(s){var t=s.previousElementSibling;var b=document.querySelector(${JSON.stringify(selector)});if(b&&t){b.replaceWith(t.content.cloneNode(true));}if(t)t.remove();s.remove();})(document.currentScript)<\/script>`;
 }
-function createDeferredRenderStream(initialHtml, boundaries, signal, seed, data, runtime) {
+function createDeferredRenderStream(initialHtml, boundaries, signal, seed, data, runtime, cspNonce) {
 	const encoder = new TextEncoder();
 	const local = new AbortController();
 	let cancelled = false;
@@ -1310,13 +1336,13 @@ function createDeferredRenderStream(initialHtml, boundaries, signal, seed, data,
 				boundaryIndex += 1;
 				try {
 					const value = await settleWithSignal(boundary.promise, local.signal);
-					if (!cancelled && !closed) controller.enqueue(encoder.encode(patchChunk(boundary.id, renderBoundary(boundary, "fulfilled", value, seed, data))));
+					if (!cancelled && !closed) controller.enqueue(encoder.encode(patchChunk(boundary.id, renderBoundary(boundary, "fulfilled", value, seed, data, cspNonce), cspNonce)));
 				} catch (error) {
 					if (local.signal.aborted) {
 						if (!cancelled && !closed) close(controller);
 						return;
 					}
-					if (!cancelled && !closed) controller.enqueue(encoder.encode(patchChunk(boundary.id, renderBoundary(boundary, "rejected", error, seed, data))));
+					if (!cancelled && !closed) controller.enqueue(encoder.encode(patchChunk(boundary.id, renderBoundary(boundary, "rejected", error, seed, data, cspNonce), cspNonce)));
 				}
 				return;
 			}
@@ -1344,6 +1370,7 @@ async function renderRouteRequestToString(options) {
 	};
 }
 async function renderRouteRequestInternal(options) {
+	const cspNonce = validateCspNonce(options.cspNonce);
 	const manifest = options.manifest ?? options.registry?.manifest;
 	if (!manifest) throw new Error("renderRouteRequestToString requires a route manifest or registry.");
 	const signal = options.signal ?? options.request?.signal ?? new AbortController().signal;
@@ -1364,7 +1391,8 @@ async function renderRouteRequestInternal(options) {
 		signal,
 		dataRuntime: runtime,
 		queryPrefetch: prefetch,
-		mode: "ssr"
+		mode: "ssr",
+		cspNonce
 	});
 	return withTelemetry(options.telemetry?.ssrRender, {}, () => withRenderContextAsync(context, async () => {
 		const resolved = await resolveRouteRequest(options.url, {
@@ -1395,7 +1423,7 @@ async function renderRouteRequestInternal(options) {
 		const result = {
 			kind: "render",
 			html,
-			...boundaries.length > 0 ? { stream: createDeferredRenderStream(html, boundaries, signal, options.seed, context.hydrationData, runtime) } : {},
+			...boundaries.length > 0 ? { stream: createDeferredRenderStream(html, boundaries, signal, options.seed, context.hydrationData, runtime, cspNonce) } : {},
 			params: resolved.params
 		};
 		if (resolved.record) Object.defineProperty(result, "record", {

package/dist/testing/index.d.ts

@@ -1,5 +1,5 @@
 import { C as Query, k as QueryStaleReason } from "../index-Bki2rqcr.js";
-import { S as RouteMatch, p as Route, x as RouteManifest } from "../router-lmH-Tmwh.js";
+import { S as RouteMatch, p as Route, x as RouteManifest } from "../router-Dz7ZoLja.js";
 
 //#region src/testing/index.d.ts
 type MockRefresh = () => void | Promise<void>;

package/dist/{verify-hydration-13f0FOPd.js → verify-hydration-DfsBcGSf.js}

@@ -1,5 +1,5 @@
 import { t as SSR_RENDER_DATA_ATTR } from "./ssr-CbQO5xd3.js";
-import { a as renderResolvedToStringSync } from "./ssr-5HlhmLhU.js";
+import { a as renderResolvedToStringSync } from "./ssr-CAYo-kNy.js";
 //#region src/ssr/verify-hydration.ts
 function normalizeHydrationHtml(html) {
 	const template = document.createElement("template");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askrjs/askr",
-  "version": "0.0.62",
+  "version": "0.0.64",
   "description": "Actor-backed deterministic UI framework",
   "keywords": [
     "askr",

package/dist/router-internal-BC0w1_xk.js

@@ -1,4 +0,0 @@
-//#region src/common/router-internal.ts
-const ROUTE_ROOT_COMPONENT = Symbol.for("askr.route-root-component");
-//#endregion
-export { ROUTE_ROOT_COMPONENT as t };