@askrjs/askr 0.0.62 → 0.0.65

package/README.md

@@ -54,16 +54,16 @@ Startup belongs in `@askrjs/askr/boot`. Routing helpers live in
 
 ```ts
 import { createSPA } from '@askrjs/askr/boot';
-import { getManifest, registerRoutes, route } from '@askrjs/askr/router';
+import { createRouteRegistry, route } from '@askrjs/askr/router';
 
-registerRoutes(() => {
-  route('/', () => <Home />);
-  route('/about', () => <About />);
+const registry = createRouteRegistry(() => {
+  route('/', Home);
+  route('/about', About);
 });
 
 createSPA({
   root: document.body,
-  manifest: getManifest(),
+  registry,
 });
 ```
 

package/dist/actions/index.d.ts

@@ -1,2 +1,2 @@
-import { a as action, i as ActionValidationError, n as ActionForm, o as defineAction, r as ActionStatus, t as ActionDescriptor } from "../index-DaWuMuIc.js";
+import { a as action, i as ActionValidationError, n as ActionForm, o as defineAction, r as ActionStatus, t as ActionDescriptor } from "../index-Bjm0__Rr.js";
 export { ActionDescriptor, ActionForm, ActionStatus, ActionValidationError, action, defineAction };

package/dist/authoring-CXMPffwN.js

@@ -0,0 +1,200 @@
+import { f as getCurrentComponentInstance } from "./component-scope-CC3cojX9.js";
+import { T as getExecutionModel, x as createRouteHandler } from "./deferred-B71c2eio.js";
+import { A as insertRecordSorted, C as getCurrentPathPrefix, I as computeRank, L as normalizeRouteSegmentName, M as pushRegistrationScope, O as hasActivePageScope, R as parseSegments, S as getCurrentPageScope, _ as getCurrentInheritedAuthRequirements, b as getCurrentLayoutChain, f as addRouteToStores, p as assertRouteRegistrationUnlocked, v as getCurrentInheritedMeta, w as getCurrentScopeKind, x as getCurrentPageChain, y as getCurrentInheritedPolicies } from "./route-matching-C93To416.js";
+import { allOf } from "@askrjs/auth";
+//#region src/router/access.ts
+function compileNodePolicies(node) {
+	return node.policies ? [...node.policies] : [];
+}
+//#endregion
+//#region src/router/authoring.ts
+function validateRoutePath(path) {
+	if (!path.startsWith("/")) throw new Error(`Route path must begin with "/". Got: "${path}"`);
+	if (/\/{2,}/.test(path)) throw new Error("Route path cannot contain consecutive slashes.");
+	if (/:([^/{}]+)/.test(path)) {
+		const suggested = path.replace(/:([^/{}]+)/g, "{$1}");
+		throw new Error(`Route parameter syntax uses {name} interpolation, not :name. Use "${suggested}" instead of "${path}".`);
+	}
+	const segments = path.split("/").filter(Boolean);
+	const seenParamNames = /* @__PURE__ */ new Set();
+	for (let index = 0; index < segments.length; index++) {
+		const segment = segments[index];
+		if (segment === "*") continue;
+		const hasOpenBrace = segment.includes("{");
+		const hasCloseBrace = segment.includes("}");
+		if (!hasOpenBrace && !hasCloseBrace) continue;
+		if (!(segment.startsWith("{") && segment.endsWith("}"))) throw new Error("Route parameter segments must use complete {name} interpolation.");
+		const rawParamName = normalizeRouteSegmentName(segment.slice(1, -1));
+		const isSplat = rawParamName.startsWith("*");
+		const paramName = isSplat ? normalizeRouteSegmentName(rawParamName.slice(1)) : rawParamName;
+		if (!paramName) throw new Error(isSplat ? "Route splat parameter name cannot be empty." : "Route parameter name cannot be empty.");
+		if (isSplat && paramName === "*") throw new Error("Route named splat parameter name cannot be \"*\".");
+		if (isSplat && index !== segments.length - 1) throw new Error("Route named splat parameters must be the final segment.");
+		if (seenParamNames.has(paramName)) throw new Error(`Route path cannot reuse duplicate parameter name "${paramName}".`);
+		seenParamNames.add(paramName);
+	}
+}
+function normalizeAbsoluteRoutePath(path) {
+	if (!path || path === "/") return "/";
+	return (path.endsWith("/") ? path.slice(0, -1) : path) || "/";
+}
+function joinRoutePaths(prefix, path) {
+	const normalizedPrefix = normalizeAbsoluteRoutePath(prefix || "/");
+	const normalizedPath = path.replace(/^\/+|\/+$/g, "");
+	if (!normalizedPath) return normalizedPrefix;
+	return normalizedPrefix === "/" ? `/${normalizedPath}` : `${normalizedPrefix}/${normalizedPath}`;
+}
+function resolvePageScopePath(path) {
+	if (!path) throw new Error("page(path, Component, fn) requires a non-empty path.");
+	if (path.startsWith("/")) {
+		validateRoutePath(path);
+		return normalizeAbsoluteRoutePath(path);
+	}
+	return joinRoutePaths(getCurrentPathPrefix(), path);
+}
+function resolveIndexPath() {
+	return normalizeAbsoluteRoutePath(getCurrentPathPrefix() || "/");
+}
+function resolveRouteRegistrationPath(path) {
+	if (path.startsWith("/")) {
+		if (hasActivePageScope()) throw new Error(`Child route paths inside page() must be relative. Use "${path.slice(1)}" instead of "${path}".`);
+		validateRoutePath(path);
+		return normalizeAbsoluteRoutePath(path);
+	}
+	const prefix = getCurrentPathPrefix();
+	if (!prefix) throw new Error(`Route path must begin with "/". Got: "${path}"`);
+	return joinRoutePaths(prefix, path);
+}
+function pushGroupScope(options, fn) {
+	const policies = compileNodePolicies(options);
+	pushRegistrationScope({
+		kind: "group",
+		pathPrefix: getCurrentPathPrefix(),
+		layout: options.layout,
+		auth: options.auth,
+		policies,
+		meta: options.meta
+	}, fn);
+}
+function pushPageScope(path, Component, options, fn) {
+	if (hasActivePageScope()) throw new Error("page() cannot be nested inside another page(). Use route() for child leaves or group() for inherited behavior inside the existing page scope.");
+	const policies = compileNodePolicies(options);
+	pushRegistrationScope({
+		kind: "page",
+		pathPrefix: resolvePageScopePath(path),
+		page: Component,
+		hasIndex: false,
+		auth: options.auth,
+		policies,
+		meta: options.meta
+	}, fn);
+}
+function normalizeRouteOptions(options) {
+	if (!options) return;
+	const loader = options.loader;
+	const preload = options.preload;
+	const policies = compileNodePolicies(options);
+	if (!loader && !preload && !options.entries && policies.length === 0 && !options.title && !options.namespace && !options.search && !options.meta && !options.actions && options.auth === void 0) return;
+	return {
+		...loader ? { loader } : {},
+		...preload ? { preload } : {},
+		...options.entries ? { entries: options.entries } : {},
+		...options.auth !== void 0 ? { auth: options.auth } : {},
+		...policies.length > 0 ? { policies } : {},
+		...options.title ? { title: options.title } : {},
+		...options.namespace ? { namespace: options.namespace } : {},
+		...options.search ? { search: options.search } : {},
+		...options.meta ? { meta: options.meta } : {},
+		...options.actions ? { actions: options.actions } : {}
+	};
+}
+function registerRouteAtResolvedPath(path, Component, options, metadata) {
+	validateRoutePath(path);
+	const chain = getCurrentLayoutChain();
+	const pageChain = getCurrentPageChain();
+	const segments = parseSegments(path);
+	const rank = computeRank(segments);
+	const isFallback = metadata?.isFallback ?? path === "/*";
+	const comp = Component;
+	const normalizedOptions = normalizeRouteOptions(options);
+	const policies = [...getCurrentInheritedPolicies(), ...normalizedOptions?.policies ?? []];
+	const authRequirements = [...getCurrentInheritedAuthRequirements(), ...normalizedOptions?.auth ? [normalizedOptions.auth] : []];
+	const auth = authRequirements.length === 0 ? void 0 : authRequirements.length === 1 ? authRequirements[0] : allOf(...authRequirements);
+	const metaChain = [...getCurrentInheritedMeta(), ...normalizedOptions?.meta ? [normalizedOptions.meta] : []];
+	const handler = createRouteHandler(comp, pageChain, chain);
+	const renderHandler = createRouteHandler(comp, pageChain, chain, true);
+	insertRecordSorted({
+		path,
+		component: comp,
+		segments,
+		rank,
+		layoutChain: chain,
+		pageChain,
+		options: normalizedOptions ? {
+			...normalizedOptions,
+			...auth ? { auth } : {},
+			...policies.length > 0 ? { policies } : {}
+		} : policies.length > 0 ? {
+			policies,
+			...auth ? { auth } : {}
+		} : auth ? { auth } : {},
+		...metaChain.length > 0 ? { metaChain } : {},
+		isFallback,
+		handler,
+		renderHandler,
+		...metadata?.fallbackPrefix ? { fallbackPrefix: metadata.fallbackPrefix } : {}
+	});
+	addRouteToStores({
+		path,
+		handler,
+		namespace: normalizedOptions?.namespace ?? options?.namespace,
+		...metadata?.fallbackPrefix ? { fallbackPrefix: metadata.fallbackPrefix } : {}
+	});
+}
+function group(options, fn) {
+	pushGroupScope(options, fn);
+}
+function page(path, Component, optionsOrFn, maybeFn) {
+	const options = typeof optionsOrFn === "function" ? {} : optionsOrFn;
+	const fn = typeof optionsOrFn === "function" ? optionsOrFn : maybeFn;
+	if (typeof Component !== "function") throw new Error("page(path, Component, fn) requires a component function as the second argument.");
+	if (typeof fn !== "function") throw new Error("page(path, Component, fn) requires a route definition callback as the final argument.");
+	pushPageScope(path, Component, options, fn);
+}
+function index(Component, options) {
+	const pageScope = getCurrentPageScope();
+	if (pageScope?.hasIndex) throw new Error("page() cannot declare multiple index routes.");
+	if (pageScope) pageScope.hasIndex = true;
+	registerRouteAtResolvedPath(resolveIndexPath(), Component, options);
+}
+function fallback(Component) {
+	if (hasActivePageScope()) {
+		if (getCurrentScopeKind() !== "page") throw new Error("fallback() inside page() must be declared directly in the page scope, not inside nested group().");
+		registerRouteAtResolvedPath(`${getCurrentPathPrefix()}/*`, Component, void 0, {
+			isFallback: true,
+			fallbackPrefix: getCurrentPathPrefix()
+		});
+		return;
+	}
+	if (!(getCurrentInheritedPolicies().length === 0 && getCurrentInheritedAuthRequirements().length === 0)) throw new Error("fallback() can only be registered at the root scope. Use route(\"/*\", Component) if you need compatibility behavior.");
+	registerRouteAtResolvedPath("/*", Component, void 0, {
+		isFallback: true,
+		fallbackPrefix: "/"
+	});
+}
+function route(path, Component, options) {
+	if (typeof path === "undefined") throw new Error("route() is only for route registration. Use currentRoute() inside components.");
+	if (getExecutionModel() === "islands") throw new Error("Routes are not supported with islands. Use createSPA (client) or createSSR (server) instead.");
+	const currentInst = getCurrentComponentInstance();
+	if (currentInst && currentInst.ssr) throw new Error("route() cannot be called during SSR rendering. Register routes at module load time instead.");
+	assertRouteRegistrationUnlocked();
+	if (typeof Component !== "function") throw new Error("route(path, Component) requires a component function as the second argument. Passing JSX elements or VNodes directly is not supported.");
+	if (options?.search && options.search.kind !== "object") throw new Error("route search must be an object schema.");
+	registerRouteAtResolvedPath(resolveRouteRegistrationPath(path), Component, options);
+	return Object.freeze({
+		path: resolveRouteRegistrationPath(path),
+		...options?.search ? { searchSchema: options.search } : {}
+	});
+}
+//#endregion
+export { route as a, page as i, group as n, index as r, fallback as t };

package/dist/benchmark.js

@@ -1,10 +1,10 @@
 import { r as flushRuntimeScheduler } from "./access-ePqdQqkV.js";
-import { t as installRendererBridge } from "./renderer-CVr_nktj.js";
+import { t as installRendererBridge } from "./renderer-aUD-acDe.js";
 import { t as state } from "./state-Cc5HumQ0.js";
 import { t as selector } from "./selector-pApF_lGd.js";
 import { jsx, jsxs } from "./jsx-runtime.js";
 import { i as For } from "./control-KVP6LMEQ.js";
-import { t as createIsland } from "./boot-B0mMBddb.js";
+import { t as createIsland } from "./boot-OnYuVVfg.js";
 //#region src/bench/components/benchmark-row.tsx
 function BenchmarkRow({ item, isSelected, onSelect, onRemove }) {
 	return /* @__PURE__ */ jsxs("tr", {
@@ -63,8 +63,8 @@ function BenchmarkTable({ rows, isSelected, onSelect, onRemove }) {
 installRendererBridge();
 const benchmarkMetadata = {
 	packageName: "@askrjs/askr",
-	packageVersion: "0.0.62",
-	buildLabel: "0.0.62-local"
+	packageVersion: "0.0.65",
+	buildLabel: "0.0.65-local"
 };
 function getBenchmarkMetadata() {
 	return { ...benchmarkMetadata };

package/dist/boot/index.d.ts

@@ -1,41 +1,26 @@
-import { s as ComponentFunction } from "../control-CFIrGbD7.js";
+import { s as ComponentFunction } from "../control-CMzFPMjr.js";
 import { v as DataRuntime } from "../index-Bki2rqcr.js";
-import { P as RouteRegistry, m as RouteAuthOptions, p as Route, x as RouteManifest } from "../router-lmH-Tmwh.js";
+import { N as RouteRegistry, p as RouteAuthOptions } from "../router-eRoaj11J.js";
 import { d as ScrollRestorationOptions } from "../navigate-BVDCzOuB.js";
 
 //#region src/boot/types.d.ts
 type IslandConfig = {
   root: Element | string;
   component: ComponentFunction;
+  cspNonce?: string;
   cleanupStrict?: boolean;
   routes?: never;
 };
 type IslandsConfig = {
   islands: IslandConfig[];
+  cspNonce?: string;
 };
 type BootRouteSource = {
   registry: RouteRegistry;
-  manifest?: RouteManifest;
-  routes?: Route[];
-} | {
-  manifest: RouteManifest;
-  registry?: RouteRegistry;
-  routes?: Route[];
-} | {
-  manifest?: RouteManifest;
-  registry?: RouteRegistry;
-  routes: Route[];
 };
 type SPAConfig = BootRouteSource & {
   root: Element | string;
-  /**
-   * Preferred: pass a route registry built via `createRouteRegistry(() => { ... })`.
-   * ```ts
-   * import { createRouteRegistry } from '@askrjs/askr/router';
-   * const registry = createRouteRegistry(() => { ... });
-   * await createSPA({ root: '#app', registry });
-   * ```
-   */
+  cspNonce?: string; /** Pass a route registry built via `createRouteRegistry(() => { ... })`. */
   auth?: RouteAuthOptions;
   scrollRestoration?: boolean | ScrollRestorationOptions;
   cleanupStrict?: boolean;
@@ -43,7 +28,8 @@ type SPAConfig = BootRouteSource & {
 };
 type HydrateSPAConfig = BootRouteSource & {
   root: Element | string;
-  dataRuntime?: DataRuntime; /** Preferred route input - see `SPAConfig`. */
+  cspNonce?: string;
+  dataRuntime?: DataRuntime; /** Pass the same explicit route registry used for the server render. */
   auth?: RouteAuthOptions;
   scrollRestoration?: boolean | ScrollRestorationOptions;
   cleanupStrict?: boolean;
@@ -71,23 +57,17 @@ declare function createIsland(config: IslandConfig): void;
  */
 declare function createIslands(config: IslandsConfig): void;
 /**
- * createSPA: Initializes router and mounts the app with the provided route manifest or route table.
- *
- * Preferred usage with manifest:
+ * createSPA: Initializes the router and mounts the app with an explicit route registry.
  * ```ts
- * import { getManifest } from '@askrjs/askr/router';
- * await createSPA({ root: '#app', manifest: getManifest() });
+ * import { createRouteRegistry } from '@askrjs/askr/router';
+ * const registry = createRouteRegistry(() => { ... });
+ * await createSPA({ root: '#app', registry });
  * ```
  *
- * Legacy usage with plain routes array (still supported):
- * ```ts
- * await createSPA({ root: '#app', routes: getRoutes() });
- * ```
  */
 declare function createSPA(config: SPAConfig): Promise<void>;
 /**
- * hydrateSPA: Hydrate server-rendered HTML.
- * Accepts either a `manifest` (preferred) or a legacy `routes` array.
+ * hydrateSPA: Hydrate server-rendered HTML with an explicit route registry.
  */
 declare function hydrateSPA(config: HydrateSPAConfig): Promise<void>;
 //#endregion

package/dist/boot/index.js

@@ -1,2 +1,2 @@
-import { a as cleanupApp, i as hydrateSPA, n as createIslands, o as hasApp, r as createSPA, t as createIsland } from "../boot-B0mMBddb.js";
+import { a as cleanupApp, i as hydrateSPA, n as createIslands, o as hasApp, r as createSPA, t as createIsland } from "../boot-OnYuVVfg.js";
 export { cleanupApp, createIsland, createIslands, createSPA, hasApp, hydrateSPA };

package/dist/{boot-B0mMBddb.js → boot-OnYuVVfg.js}

@@ -2,15 +2,16 @@ import { b as isDevelopmentEnvironment, r as flushRuntimeScheduler, v as logger,
 import { n as Fragment, t as ELEMENT_TYPE } from "./jsx-CUpRxrLH.js";
 import { n as createComponentInstance, r as executeComponent } from "./component-internal-CbALfPGD.js";
 import { h as cleanupComponent, m as isPromiseLike } from "./component-lifecycle-DEMPihoZ.js";
-import { a as withIntrinsicHydrationAdoption, i as registerDeferredHydrationBoundary, n as activateHydrationBoundary$1, o as setStaticChildSlotsCacheEnabled, r as clearDeferredHydrationBoundaries, t as installRendererBridge } from "./renderer-CVr_nktj.js";
+import { a as withIntrinsicHydrationAdoption, i as registerDeferredHydrationBoundary, n as activateHydrationBoundary$1, o as setStaticChildSlotsCacheEnabled, r as clearDeferredHydrationBoundaries, t as installRendererBridge } from "./renderer-aUD-acDe.js";
 import { _ as teardownNodeSubtree, d as removeAllListeners } from "./cleanup-B6KovDZZ.js";
-import { C as assertExecutionModel, S as route, a as resolveRouteMeta, c as registerAppInstance, d as clearRoutes, g as createAppRenderRuntime, h as setServerLocation, i as reconcileRouteMeta, l as unregisterAppInstance, s as configureScrollRestoration, t as initializeNavigation, u as _applyManifest } from "./navigate-DLi79IZr.js";
+import { c as _applyManifest, d as getRouteRenderContext, f as getRouteRenderData, m as resolveRouteRequest, o as reviveDeferredValue, p as hasRouteRenderData, w as assertExecutionModel, y as pageRenderEnvelope } from "./deferred-B71c2eio.js";
 import { a as startHydrationRenderPhase, s as stopHydrationRenderPhase } from "./render-context-Clw3rFiO.js";
 import { a as disposeDefaultPortalScope, t as DefaultPortal } from "./portal-D2tPWNrC.js";
+import { r as validateCspNonce, t as CspNonceScope } from "./csp-nonce-C-8E85El.js";
 import { i as getDefaultDataRuntime } from "./data-runtime-SJ1BSUvk.js";
 import { a as hydrateDataRuntime } from "./query-registry-CQIT4mXr.js";
-import { a as resolveRouteFromRoutes, d as _setActiveRouteAuthOptions, j as lockRouteRegistration, k as hasRegisteredRoutes } from "./route-matching-vJpvLVbX.js";
-import { _ as pageRenderEnvelope, d as hasRouteRenderData, f as resolveRouteRequest, l as getRouteRenderContext, o as reviveDeferredValue, u as getRouteRenderData, x as _preloadRouteHandler } from "./deferred-BeNnjR4r.js";
+import { d as _setActiveRouteAuthOptions, j as lockRouteRegistration, k as hasRegisteredRoutes, m as clearRouteState } from "./route-matching-C93To416.js";
+import { a as resolveRouteMeta, c as registerAppInstance, d as setServerLocation, f as createAppRenderRuntime, i as reconcileRouteMeta, l as unregisterAppInstance, s as configureScrollRestoration, t as initializeNavigation } from "./navigate-DTZ2SM8_.js";
 import "./ssr-CbQO5xd3.js";
 //#region src/boot/hydration.ts
 const DEFERRED_PAYLOAD = "__askr_deferred__";
@@ -259,6 +260,7 @@ function attachCleanupForRoot(rootElement, instance) {
 	} catch {}
 }
 function mountOrUpdate(rootElement, componentFn, options) {
+	const nonce = validateCspNonce(options?.cspNonce);
 	const wrappedFn = (props, ctx) => {
 		const out = componentFn(props, ctx);
 		if (isPromiseLike(out)) throw new Error("Async components are not supported. Components must return synchronously.");
@@ -268,11 +270,15 @@ function mountOrUpdate(rootElement, componentFn, options) {
 			props: { __askrAutoDefaultPortal: true },
 			key: "__default_portal"
 		};
-		return {
+		const root = {
 			$$typeof: ELEMENT_TYPE,
 			type: Fragment,
 			props: { children: out === void 0 || out === null ? [portalVNode] : [out, portalVNode] }
 		};
+		return nonce === void 0 ? root : CspNonceScope({
+			value: nonce,
+			children: root
+		});
 	};
 	Object.defineProperty(wrappedFn, "name", { value: componentFn.name || "Component" });
 	const existingCleanup = rootElement[CLEANUP_SYMBOL];
@@ -298,6 +304,7 @@ function mountOrUpdate(rootElement, componentFn, options) {
 		instance.isRoot = true;
 		instance.portalScope = instance;
 		instance._appRenderRuntime = options?.appRuntime;
+		instance._cspNonce = nonce;
 		if (shouldResetHookState) {
 			instance.stateValues = [];
 			instance.hasPendingUpdate = false;
@@ -323,6 +330,7 @@ function mountOrUpdate(rootElement, componentFn, options) {
 		instance._rootComponentFn = componentFn;
 		instance.portalScope = instance;
 		instance._appRenderRuntime = options?.appRuntime;
+		instance._cspNonce = nonce;
 		if (options && typeof options.cleanupStrict === "boolean") instance.cleanupStrict = options.cleanupStrict;
 	}
 	attachCleanupForRoot(rootElement, instance);
@@ -356,7 +364,7 @@ function cleanupApp(root) {
 		const wasRoutedRoot = routedRoots.delete(rootElement);
 		instancesByRoot.delete(rootElement);
 		clearRootCleanupCallbacks(rootElement);
-		if (wasRoutedRoot && routedRoots.size === 0) clearRoutes();
+		if (wasRoutedRoot && routedRoots.size === 0) clearRouteState();
 		try {
 			delete rootElement[CLEANUP_SYMBOL];
 		} catch {}
@@ -400,21 +408,11 @@ async function resolveInitialRoute(auth, source) {
 	for (let redirects = 0; redirects <= MAX_INITIAL_ROUTE_REDIRECTS; redirects++) {
 		if (visited.has(href)) throw new Error(`[Askr] Route redirect cycle detected at ${href}.`);
 		visited.add(href);
-		const resolved = source?.manifest ? await resolveRouteRequest(href, {
-			manifest: source.manifest,
+		const resolved = source?.registry ? await resolveRouteRequest(href, {
+			manifest: source.registry.manifest,
 			auth,
 			load: source.load
-		}) : source?.routes ? await (() => {
-			const match = resolveRouteFromRoutes(path, source.routes);
-			if (!match) return null;
-			const lazyImport = _preloadRouteHandler(match.handler);
-			const result = {
-				kind: "render",
-				handler: match.handler,
-				params: match.params
-			};
-			return lazyImport ? lazyImport.then(() => result) : result;
-		})() : await resolveRouteRequest(href, { auth });
+		}) : await resolveRouteRequest(href, { auth });
 		if (typeof window === "undefined" || !resolved || resolved.kind !== "redirect") return {
 			path,
 			href,
@@ -440,11 +438,15 @@ function createIsland(config) {
 	assertExecutionModel("islands");
 	if (!config || typeof config !== "object") throw new Error("createIsland requires a config object");
 	if (typeof config.component !== "function") throw new Error("createIsland: component must be a function");
+	validateCspNonce(config.cspNonce);
 	const rootElement = resolveRootElement(config.root);
 	if (!rootElement) throw new Error(`Root element not found: ${config.root}`);
 	if ("routes" in config) throw new Error("createIsland does not accept routes; use createSPA for routed apps");
 	if (hasRegisteredRoutes()) throw new Error("Routes are not supported with islands. Use createSPA (client) or createSSR (server) instead.");
-	mountOrUpdate(rootElement, config.component, { cleanupStrict: config.cleanupStrict });
+	mountOrUpdate(rootElement, config.component, {
+		cleanupStrict: config.cleanupStrict,
+		cspNonce: config.cspNonce
+	});
 }
 /**
 * createIslands: Enhances one or more existing DOM roots (no router).
@@ -453,50 +455,42 @@ function createIsland(config) {
 function createIslands(config) {
 	assertExecutionModel("islands");
 	if (!config || typeof config !== "object") throw new Error("createIslands requires a config object");
+	validateCspNonce(config.cspNonce);
 	if (!Array.isArray(config.islands) || config.islands.length === 0) throw new Error("createIslands requires a non-empty islands array");
-	for (const island of config.islands) createIsland(island);
+	for (const island of config.islands) createIsland({
+		...island,
+		cspNonce: island.cspNonce ?? config.cspNonce
+	});
 }
 /**
-* createSPA: Initializes router and mounts the app with the provided route manifest or route table.
-*
-* Preferred usage with manifest:
+* createSPA: Initializes the router and mounts the app with an explicit route registry.
 * ```ts
-* import { getManifest } from '@askrjs/askr/router';
-* await createSPA({ root: '#app', manifest: getManifest() });
+* import { createRouteRegistry } from '@askrjs/askr/router';
+* const registry = createRouteRegistry(() => { ... });
+* await createSPA({ root: '#app', registry });
 * ```
 *
-* Legacy usage with plain routes array (still supported):
-* ```ts
-* await createSPA({ root: '#app', routes: getRoutes() });
-* ```
 */
 async function createSPA(config) {
 	assertExecutionModel("spa");
 	if (!config || typeof config !== "object") throw new Error("createSPA requires a config object");
-	const manifest = config.manifest ?? config.registry?.manifest;
-	const routeTable = config.routes ?? config.registry?.routes;
-	const hasManifest = manifest != null && manifest.records.length > 0;
-	const hasRoutes = Array.isArray(routeTable) && routeTable.length > 0;
-	if (!hasManifest && !hasRoutes) throw new Error("createSPA requires a route manifest or route table. Pass `manifest: getManifest()` or `routes: getRoutes()`. If you are enhancing existing HTML, use createIsland instead.");
+	validateCspNonce(config.cspNonce);
+	if (!config.registry) throw new Error("createSPA requires a route registry.");
+	const { manifest } = config.registry;
+	if (manifest.records.length === 0) throw new Error("createSPA requires a route registry with at least one route. If you are enhancing existing HTML, use createIsland instead.");
 	const rootElement = resolveRootElement(config.root);
 	if (!rootElement) throw new Error(`Root element not found: ${config.root}`);
 	configureScrollRestoration(config.scrollRestoration);
-	clearRoutes();
-	if (hasManifest) _applyManifest(manifest);
-	else for (const r of routeTable) route(r.path, r.handler);
-	const routeAuth = config.auth ?? manifest?.auth;
-	const activeManifest = hasManifest ? manifest : void 0;
+	clearRouteState();
+	_applyManifest(manifest);
+	const routeAuth = config.auth ?? manifest.auth;
 	const appRouteSource = {
-		manifest: activeManifest,
-		routes: hasManifest ? void 0 : routeTable,
+		registry: config.registry,
 		auth: routeAuth
 	};
 	_setActiveRouteAuthOptions(routeAuth);
 	if (isProductionEnvironment()) lockRouteRegistration();
-	const { path, resolved } = await resolveInitialRoute(routeAuth, {
-		manifest: activeManifest,
-		routes: hasManifest ? void 0 : routeTable
-	});
+	const { path, resolved } = await resolveInitialRoute(routeAuth, { registry: config.registry });
 	const appRuntime = createAppRenderRuntime(resolved?.kind === "render" && hasRouteRenderData(resolved) ? {
 		route: getRouteRenderData(resolved),
 		hasRoute: true
@@ -507,7 +501,8 @@ async function createSPA(config) {
 			children: []
 		}), {
 			cleanupStrict: config.cleanupStrict,
-			appRuntime
+			appRuntime,
+			cspNonce: config.cspNonce
 		});
 		await registerAppNavigation(rootElement, path, { ...appRouteSource });
 		return;
@@ -518,7 +513,8 @@ async function createSPA(config) {
 			children: []
 		}), {
 			cleanupStrict: config.cleanupStrict,
-			appRuntime
+			appRuntime,
+			cspNonce: config.cspNonce
 		});
 		await registerAppNavigation(rootElement, path, { ...appRouteSource });
 		return;
@@ -529,22 +525,21 @@ async function createSPA(config) {
 		params: resolved.params
 	}), {
 		cleanupStrict: config.cleanupStrict,
-		appRuntime
+		appRuntime,
+		cspNonce: config.cspNonce
 	});
 	await registerAppNavigation(rootElement, path, { ...appRouteSource });
 }
 /**
-* hydrateSPA: Hydrate server-rendered HTML.
-* Accepts either a `manifest` (preferred) or a legacy `routes` array.
+* hydrateSPA: Hydrate server-rendered HTML with an explicit route registry.
 */
 async function hydrateSPA(config) {
 	assertExecutionModel("spa");
 	if (!config || typeof config !== "object") throw new Error("hydrateSPA requires a config object");
-	const manifest = config.manifest ?? config.registry?.manifest;
-	const routeTable = config.routes ?? config.registry?.routes;
-	const hasManifest = manifest != null && manifest.records.length > 0;
-	const hasRoutes = Array.isArray(routeTable) && routeTable.length > 0;
-	if (!hasManifest && !hasRoutes) throw new Error("hydrateSPA requires a route manifest or route table. Pass `manifest: getManifest()` or `routes: getRoutes()`. If you are enhancing existing HTML, use createIsland instead.");
+	validateCspNonce(config.cspNonce);
+	if (!config.registry) throw new Error("hydrateSPA requires a route registry.");
+	const { manifest } = config.registry;
+	if (manifest.records.length === 0) throw new Error("hydrateSPA requires a route registry with at least one route. If you are enhancing existing HTML, use createIsland instead.");
 	const rootElement = resolveRootElement(config.root);
 	if (!rootElement) throw new Error(`Root element not found: ${config.root}`);
 	applyDeferredStreamPatches(rootElement);
@@ -553,14 +548,11 @@ async function hydrateSPA(config) {
 	if (hydrationQueryCache) hydrateDataRuntime(config.dataRuntime ?? getDefaultDataRuntime(), hydrationQueryCache);
 	const hydrationRenderDataForApp = hydrationRenderData;
 	configureScrollRestoration(config.scrollRestoration);
-	clearRoutes();
-	if (hasManifest) _applyManifest(manifest);
-	else for (const r of routeTable) route(r.path, r.handler);
-	const routeAuth = config.auth ?? manifest?.auth;
-	const activeManifest = hasManifest ? manifest : void 0;
+	clearRouteState();
+	_applyManifest(manifest);
+	const routeAuth = config.auth ?? manifest.auth;
 	const appRouteSource = {
-		manifest: activeManifest,
-		routes: hasManifest ? void 0 : routeTable,
+		registry: config.registry,
 		auth: routeAuth,
 		runtime: createAppRenderRuntime({
 			framework: hydrationRenderData?.framework,
@@ -570,8 +562,7 @@ async function hydrateSPA(config) {
 	};
 	_setActiveRouteAuthOptions(routeAuth);
 	const { path, href: currentUrl, resolved } = await resolveInitialRoute(routeAuth, {
-		manifest: activeManifest,
-		routes: hasManifest ? void 0 : routeTable,
+		registry: config.registry,
 		load: false
 	});
 	setServerLocation(currentUrl);
@@ -586,24 +577,22 @@ async function hydrateSPA(config) {
 		handler: resolved.handler,
 		params: resolved.params
 	};
-	const mountHydratedRoot = (...args) => withIntrinsicHydrationAdoption(() => mountOrUpdate(...args));
+	const mountHydratedRoot = (...args) => withIntrinsicHydrationAdoption(() => mountOrUpdate(args[0], args[1], {
+		...args[2],
+		cspNonce: config.cspNonce
+	}));
 	if (shouldVerifyHydrationMarkup(config)) {
-		const legacyRouteTable = hasManifest ? manifest.records.map((r) => ({
-			...r,
-			path: r.path,
-			handler: r.handler,
-			namespace: r.options.namespace
-		})) : routeTable;
-		const { verifyHydrationSyncForUrl } = await import("./verify-hydration-13f0FOPd.js");
+		const { verifyHydrationSyncForUrl } = await import("./verify-hydration-BdKE9Hi8.js");
 		if (!verifyHydrationSyncForUrl({
 			root: rootElement,
 			url: currentUrl,
-			routes: legacyRouteTable,
+			registry: config.registry,
 			resolved: hydrationResolved,
 			options: {
 				data: hydrationRenderDataForApp?.resources,
 				dataRuntime: config.dataRuntime ?? getDefaultDataRuntime(),
-				envelope: hydrationRenderDataForApp ?? void 0
+				envelope: hydrationRenderDataForApp ?? void 0,
+				cspNonce: config.cspNonce
 			}
 		})) throw new Error("[Askr] Hydration mismatch detected. Server HTML does not match expected server-render output.");
 	}

package/dist/components/index.d.ts

@@ -1,4 +1,4 @@
-import { l as VNode } from "../control-CFIrGbD7.js";
+import { l as VNode } from "../control-CMzFPMjr.js";
 import { r as JSXElement, s as Props } from "../jsx-Dvr2SGRG.js";
 
 //#region src/common/error-boundary.d.ts

package/dist/control/index.d.ts

@@ -1,2 +1,2 @@
-import { a as Show, c as ForProps, i as MatchProps, n as CaseProps, o as ShowProps, r as Match, s as For, t as Case } from "../index-DlvpxdSz.js";
+import { a as Show, c as ForProps, i as MatchProps, n as CaseProps, o as ShowProps, r as Match, s as For, t as Case } from "../index-Byqjltu2.js";
 export { Case, type CaseProps, For, type ForProps, Match, type MatchProps, Show, type ShowProps };