@askrjs/askr 0.0.62 → 0.0.65

package/dist/ssg/index.d.ts

@@ -1,26 +1,21 @@
-import { c as RenderableChild, d as DocumentRenderContext, f as DocumentRenderer, s as ComponentFunction, u as DocumentRenderArgs } from "../control-CFIrGbD7.js";
-import { E as RouteOptions, O as RoutePathParams, P as RouteRegistry, b as RouteHandler, k as RoutePolicy } from "../router-lmH-Tmwh.js";
+import { d as DocumentRenderContext, f as DocumentRenderer, u as DocumentRenderArgs } from "../control-CMzFPMjr.js";
+import { D as RoutePathParams, N as RouteRegistry, O as RoutePolicy, T as RouteOptions, y as RouteHandler } from "../router-eRoaj11J.js";
 import { AuthRequirement } from "@askrjs/auth";
 //#region src/ssg/types.d.ts
 type SSGMode = 'full' | 'incremental';
 type RouteRenderStatus = 'success' | 'error' | 'skipped' | 'removed';
 type RouteRenderReason = 'full' | 'changed-key' | 'changed-route' | 'new-route' | 'no-keys' | 'unchanged' | 'deleted' | 'runtime-only';
 type RouteConfigParams<Path extends string> = string extends Path ? Record<string, string> : RoutePathParams<Path>;
-type RouteComponentProps<Path extends string> = RouteConfigParams<Path> & Record<string, unknown>;
-type StaticRouteComponent<Path extends string> = (props: RouteComponentProps<Path>, context?: Parameters<ComponentFunction>[1]) => RenderableChild;
 /**
  * Route config accepted by SSG.
  *
- * `handler` is preferred and matches router/SSR naming.
- * `component` is kept for compatibility and is normalized to `handler`.
+ * The handler is defined by the route registry and matches router/SSR naming.
  */
 interface RouteConfig<Path extends string = string> {
   /** URL path to generate (e.g., "/blog/post-1", "/") */
   path: Path;
   /** Route handler compatible with router/SSR */
-  handler?: RouteHandler;
-  /** Backward-compatible alias for handler */
-  component?: StaticRouteComponent<Path>;
+  handler: RouteHandler;
   /** Optional base props merged with route params during render */
   props?: Record<string, unknown>;
   /** Optional namespace for router compatibility */
@@ -72,13 +67,9 @@ interface SSGAssetSource {
   to?: string;
 }
 /** Options for createStaticGen */
-type SSGOptions<TRoutes extends readonly RouteConfig[] = RouteConfig[]> = SSGBaseOptions & ({
-  /** Routes to generate. Prefer `registry` when routes are already defined through the router DSL. */routes: TRoutes;
-  registry?: never;
-} | {
+type SSGOptions<TRoutes extends readonly RouteConfig[] = RouteConfig[]> = SSGBaseOptions & {
   /** Explicit route registry captured with `createRouteRegistry()`. */registry: RouteRegistry;
-  routes?: never;
-});
+};
 /** Options for a single generation run */
 interface SSGGenerateOptions {
   /** Generation mode */
@@ -190,29 +181,13 @@ interface DiscoveredResources {
 }
 //#endregion
 //#region src/ssg/create-static-gen.d.ts
-type AnyRouteConfig = RouteConfig<string>;
-type StrictRouteConfig<TRoute extends AnyRouteConfig> = Omit<TRoute, 'params' | 'entries'> & {
-  params?: RouteConfig<TRoute['path']>['params'];
-  entries?: RouteConfig<TRoute['path']>['entries'];
-};
-type StrictRouteConfigs<TRoutes extends readonly AnyRouteConfig[]> = { [TIndex in keyof TRoutes]: TRoutes[TIndex] extends AnyRouteConfig ? StrictRouteConfig<TRoutes[TIndex]> : never };
-type StaticGenRouteSource<TRoutes extends readonly AnyRouteConfig[]> = {
-  routes: TRoutes & StrictRouteConfigs<TRoutes>;
-  registry?: never;
-} | {
-  registry: RouteRegistry;
-  routes?: never;
-};
 /**
  * Create a Static Site Generator
  *
  * Usage:
  * ```ts
  * const ssg = createStaticGen({
- *   routes: [
- *     { path: '/', component: HomePage },
- *     { path: '/about', component: AboutPage },
- *   ],
+ *   registry,
  *   outputDir: './dist',
  *   dataOverrides: {
  *     '/api/posts': { posts: [...] }
@@ -223,7 +198,7 @@ type StaticGenRouteSource<TRoutes extends readonly AnyRouteConfig[]> = {
  * console.log(`Generated ${result.successful}/${result.totalRoutes} routes`);
  * ```
  */
-declare function createStaticGen<const TRoutes extends readonly AnyRouteConfig[]>(options: Omit<SSGOptions<TRoutes>, 'routes' | 'registry'> & StaticGenRouteSource<TRoutes>): {
+declare function createStaticGen(options: SSGOptions): {
   /**
    * Generate static HTML for all routes
    * Writes to outputDir with metadata.json

package/dist/ssg/index.js

@@ -1,7 +1,8 @@
 import "../access-ePqdQqkV.js";
-import { a as resolveDeferredValues, b as getRenderHandler, c as bindResolvedRouteData } from "../deferred-BeNnjR4r.js";
+import { S as getRenderHandler, a as resolveDeferredValues, l as createRouteRegistry, u as bindResolvedRouteData } from "../deferred-B71c2eio.js";
+import { a as route } from "../authoring-CXMPffwN.js";
 import { n as renderDocument } from "../ssr-CbQO5xd3.js";
-import { n as renderToString } from "../ssr-5HlhmLhU.js";
+import { n as renderToString } from "../ssr-C0hzqhY8.js";
 import * as fs from "node:fs/promises";
 import * as pathModule from "node:path";
 import * as os from "node:os";
@@ -73,7 +74,7 @@ function isStringRecord(value) {
 }
 function validateRouteShape(route) {
 	if (typeof route.path !== "string" || !route.path.startsWith("/")) throw new Error(`route path must be a string starting with "/", got "${route.path}"`);
-	if (typeof (route.handler ?? route.component) !== "function") throw new Error(`route handler must be a function for path "${route.path}"`);
+	if (typeof route.handler !== "function") throw new Error(`route handler must be a function for path "${route.path}"`);
 	if (route.params !== void 0 && !isStringRecord(route.params)) throw new Error(`route "${route.path}" params must be an object containing only string values`);
 	if (route.invalidationKeys !== void 0) {
 		if (!Array.isArray(route.invalidationKeys)) throw new Error(`route "${route.path}" invalidationKeys must be an array of strings`);
@@ -141,28 +142,25 @@ async function batchRenderRoutes(routes, options = {}) {
 	const results = [];
 	results.length = routes.length;
 	let nextIndex = 0;
-	const renderOne = async (route) => {
+	const sharedRegistry = new Set(routes.map((route) => route.path)).size === routes.length ? createRouteRegistry(() => {
+		for (const route$1 of routes) route(route$1.path, route$1.handler, { namespace: route$1.namespace });
+	}) : void 0;
+	const renderOne = async (route$2) => {
 		const startTime = performance.now();
-		const url = interpolateRoutePath(route.path, route.params);
+		const url = interpolateRoutePath(route$2.path, route$2.params);
 		const requestUrl = new URL(url, "http://localhost");
-		const resolvedData = resolveSsgRouteData(dataMap, route.path, url);
+		const resolvedData = resolveSsgRouteData(dataMap, route$2.path, url);
 		const baseData = resolvedData.hasData ? resolvedData.data : void 0;
 		const resourceCount = resolvedData.hasData && baseData ? Object.keys(baseData).length : 0;
-		const mergedHandler = route.handler ? route.handler : (params, ctx) => {
-			const component = route.component;
-			return component({
-				...route.props,
-				...params
-			}, ctx);
-		};
+		const mergedHandler = route$2.handler;
 		try {
 			let routeData;
 			let hasRouteData = false;
-			if (route.loader) {
+			if (route$2.loader) {
 				const controller = new AbortController();
 				const loadContext = {
 					mode: "ssg",
-					params: route.params ?? {},
+					params: route$2.params ?? {},
 					pathname: requestUrl.pathname,
 					search: requestUrl.search,
 					hash: requestUrl.hash,
@@ -175,7 +173,7 @@ async function batchRenderRoutes(routes, options = {}) {
 					},
 					signal: controller.signal
 				};
-				const loaded = await route.loader({
+				const loaded = await route$2.loader({
 					...loadContext,
 					request: new Request(requestUrl)
 				});
@@ -183,13 +181,12 @@ async function batchRenderRoutes(routes, options = {}) {
 				routeData = loaded;
 				hasRouteData = true;
 			}
+			const renderedHandler = hasRouteData ? bindResolvedRouteData(mergedHandler, routeData) : mergedHandler;
 			const html = renderToString({
 				url,
-				routes: [{
-					path: route.path,
-					handler: hasRouteData ? bindResolvedRouteData(mergedHandler, routeData) : mergedHandler,
-					namespace: route.namespace
-				}],
+				registry: hasRouteData || !sharedRegistry ? createRouteRegistry(() => {
+					route(route$2.path, renderedHandler, { namespace: route$2.namespace });
+				}) : sharedRegistry,
 				seed,
 				data: baseData,
 				document: document === void 0 ? void 0 : ({ appHtml }) => renderDocument(document, {
@@ -200,12 +197,12 @@ async function batchRenderRoutes(routes, options = {}) {
 						pathname: requestUrl.pathname,
 						search: requestUrl.search,
 						hash: requestUrl.hash,
-						params: route.params ?? {},
+						params: route$2.params ?? {},
 						data: baseData,
 						seed,
 						route: {
-							path: route.path,
-							namespace: route.namespace
+							path: route$2.path,
+							namespace: route$2.namespace
 						}
 					}
 				}, "createStaticGen()")
@@ -579,21 +576,24 @@ async function splitStaticRoutes(routes) {
 	};
 }
 function normalizeStaticRoutes(options) {
-	if (options.registry) return routeRegistryToRouteConfigs(options.registry);
-	return [...options.routes ?? []];
+	return routeRegistryToRouteConfigs(options.registry);
 }
 function routeRegistryToRouteConfigs(registry) {
 	const routeConfigs = [];
 	for (const record of registry.manifest.records) {
 		if (record.isFallback) continue;
+		const options = record.options;
 		routeConfigs.push({
 			path: record.path,
 			handler: getRenderHandler(record),
-			namespace: record.options.namespace,
-			auth: record.options.auth,
-			policies: record.options.policies,
-			entries: record.options.entries,
-			loader: record.options.loader
+			params: options.params,
+			props: options.props,
+			invalidationKeys: options.invalidationKeys ? [...options.invalidationKeys] : void 0,
+			namespace: options.namespace,
+			auth: options.auth,
+			policies: options.policies,
+			entries: options.entries,
+			loader: options.loader
 		});
 	}
 	return routeConfigs;
@@ -672,10 +672,7 @@ async function replaceOutputDirectory(stagingDir, outputDir, fileOperations = fs
 * Usage:
 * ```ts
 * const ssg = createStaticGen({
-*   routes: [
-*     { path: '/', component: HomePage },
-*     { path: '/about', component: AboutPage },
-*   ],
+*   registry,
 *   outputDir: './dist',
 *   dataOverrides: {
 *     '/api/posts': { posts: [...] }
@@ -688,11 +685,12 @@ async function replaceOutputDirectory(stagingDir, outputDir, fileOperations = fs
 */
 function createStaticGen(options) {
 	let result = null;
+	if (!options || !("registry" in options) || !options.registry) throw new Error("route registry is required");
 	const configuredRoutes = normalizeStaticRoutes(options);
 	const seed = options.seed ?? 12345;
 	const resolvedParallelism = resolveParallelism(options.parallelism);
 	const resolvedConcurrency = Math.max(1, options.concurrency ?? resolvedParallelism);
-	if (configuredRoutes.length === 0) throw new Error("routes array or route registry is required");
+	if (configuredRoutes.length === 0) throw new Error("route registry is required");
 	if (!options.outputDir || options.outputDir.trim().length === 0) throw new Error("outputDir is required");
 	return {
 		/**

package/dist/ssr/index.d.ts

@@ -1,7 +1,7 @@
-import { c as RenderableChild, d as DocumentRenderContext, f as DocumentRenderer, p as SSRData, u as DocumentRenderArgs } from "../control-CFIrGbD7.js";
+import { c as RenderableChild, d as DocumentRenderContext, f as DocumentRenderer, p as SSRData, u as DocumentRenderArgs } from "../control-CMzFPMjr.js";
 import { r as JSXElement, s as Props } from "../jsx-Dvr2SGRG.js";
 import { D as QueryPrefetchContext, n as ServerQueryRegistry, u as CoreTelemetry, v as DataRuntime } from "../index-Bki2rqcr.js";
-import { L as RouteRequestResult, P as RouteRegistry, a as AccessRedirectDecision, b as RouteHandler, j as RouteRecord, m as RouteAuthOptions, p as Route, r as AccessDenyDecision, x as RouteManifest } from "../router-lmH-Tmwh.js";
+import { A as RouteRecord, L as RouteRequestResult, N as RouteRegistry, a as AccessRedirectDecision, f as Route, p as RouteAuthOptions, r as AccessDenyDecision, y as RouteHandler } from "../router-eRoaj11J.js";
 import { AuthContext } from "@askrjs/auth";
 
 //#region src/common/page-render-envelope.d.ts
@@ -50,6 +50,7 @@ interface RenderContext {
   renderData: PageRenderEnvelope | null;
   hydrationData: PageRenderEnvelope | null;
   deferredBoundaries: DeferredBoundaryRegistration[];
+  cspNonce?: string;
 }
 declare function createRenderContext(seed?: number, opts?: {
   url?: string;
@@ -63,6 +64,7 @@ declare function createRenderContext(seed?: number, opts?: {
   queryPrefetch?: QueryPrefetchContext;
   framework?: Readonly<Record<string, unknown>>;
   envelope?: PageRenderEnvelope;
+  cspNonce?: string;
 }): RenderContext;
 /**
  * Run a function with the given render context.
@@ -84,10 +86,6 @@ type SSRRoute = {
 };
 type SSRRouteSource = {
   registry: RouteRegistry;
-  routes?: readonly SSRRoute[];
-} | {
-  registry?: RouteRegistry;
-  routes: readonly SSRRoute[];
 };
 type RouteRenderOptions = SSRRouteSource & {
   url: string;
@@ -99,6 +97,7 @@ type RouteRenderOptions = SSRRouteSource & {
   queryPrefetch?: QueryPrefetchContext;
   telemetry?: Pick<CoreTelemetry, 'ssrRender'>; /** @internal Precomposed page state used by hydration verification. */
   envelope?: PageRenderEnvelope;
+  cspNonce?: string;
 };
 type RouteStreamOptions = RouteRenderOptions & {
   onChunk(html: string): void;
@@ -107,38 +106,6 @@ type RouteStreamOptions = RouteRenderOptions & {
 declare function resolveRequest(opts: {
   url: string;
   registry: RouteRegistry;
-  manifest?: RouteManifest;
-  routes?: Array<{
-    path: string;
-    handler: RouteHandler;
-    namespace?: string;
-  }>;
-  auth?: RouteAuthOptions;
-  authContext?: AuthContext;
-  request?: Request;
-  signal?: AbortSignal;
-} | {
-  url: string;
-  manifest: RouteManifest;
-  registry?: RouteRegistry;
-  routes?: Array<{
-    path: string;
-    handler: RouteHandler;
-    namespace?: string;
-  }>;
-  auth?: RouteAuthOptions;
-  authContext?: AuthContext;
-  request?: Request;
-  signal?: AbortSignal;
-} | {
-  url: string;
-  manifest?: RouteManifest;
-  registry?: RouteRegistry;
-  routes: Array<{
-    path: string;
-    handler: RouteHandler;
-    namespace?: string;
-  }>;
   auth?: RouteAuthOptions;
   authContext?: AuthContext;
   request?: Request;
@@ -167,16 +134,13 @@ declare function renderToStringSync(component: (props?: Record<string, unknown>)
   seed?: number;
   data?: SSRData; /** @internal A composed page render envelope. */
   envelope?: PageRenderEnvelope;
+  cspNonce?: string;
 }): string;
 //#endregion
 //#region src/ssr/render-resolved.d.ts
 declare function renderResolvedToStringSync(opts: {
   url: string;
-  routes: ReadonlyArray<{
-    path: string;
-    handler: RouteHandler;
-    namespace?: string;
-  }>;
+  registry: RouteRegistry;
   handler: RouteHandler;
   params?: Record<string, string>;
   options?: {
@@ -184,14 +148,14 @@ declare function renderResolvedToStringSync(opts: {
     data?: SSRData;
     dataRuntime?: DataRuntime;
     envelope?: PageRenderEnvelope;
+    cspNonce?: string;
   };
 }): string;
 //#endregion
 //#region src/ssr/route-request-render.d.ts
 interface RenderRouteRequestOptions {
   url: string;
-  manifest?: RouteManifest;
-  registry?: RouteRegistry;
+  registry: RouteRegistry;
   auth?: RouteAuthOptions;
   authContext?: AuthContext;
   request?: Request;
@@ -204,6 +168,7 @@ interface RenderRouteRequestOptions {
   queryPrefetch?: QueryPrefetchContext;
   queryRegistry?: ServerQueryRegistry;
   telemetry?: CoreTelemetry;
+  cspNonce?: string;
 }
 type RenderRouteRequestResult = {
   kind: 'render';

package/dist/ssr/index.js

@@ -1,3 +1,3 @@
 import { u as SSRDataMissingError } from "../render-context-Clw3rFiO.js";
-import { a as renderResolvedToStringSync, c as createRenderContext, d as withRenderContextAsync, i as renderRouteRequestToString, l as getRenderContext, n as renderToString, o as renderToStringSync, r as renderRouteRequest, s as resolveRequest, t as renderToStream, u as withRenderContext } from "../ssr-5HlhmLhU.js";
+import { a as renderResolvedToStringSync, c as createRenderContext, d as withRenderContextAsync, i as renderRouteRequestToString, l as getRenderContext, n as renderToString, o as renderToStringSync, r as renderRouteRequest, s as resolveRequest, t as renderToStream, u as withRenderContext } from "../ssr-C0hzqhY8.js";
 export { SSRDataMissingError, createRenderContext, getRenderContext, renderResolvedToStringSync, renderRouteRequest, renderRouteRequestToString, renderToStream, renderToString, renderToStringSync, resolveRequest, withRenderContext, withRenderContextAsync };

package/dist/{ssr-5HlhmLhU.js → ssr-C0hzqhY8.js}

@@ -6,13 +6,15 @@ import { c as callWithContext, d as getExecutionContextFrame, f as getVNodeConte
 import { f as getCurrentComponentInstance, w as setCurrentComponentInstance } from "./component-scope-CC3cojX9.js";
 import { h as cleanupComponent, m as isPromiseLike } from "./component-lifecycle-DEMPihoZ.js";
 import { g as evaluateShowState, h as evaluateCaseState, i as evaluateForState, o as rollbackForStateTransaction, r as commitForStateTransaction } from "./for-internal-B2rBq6yB.js";
+import { _ as isEmptyPageRenderEnvelope, g as createPageRenderEnvelope, i as isDeferred, l as createRouteRegistry, m as resolveRouteRequest, t as DEFERRED_BOUNDARY, v as isPageRenderEnvelope } from "./deferred-B71c2eio.js";
 import { c as stopRenderPhase$1, o as startRenderPhase$1, t as configureRenderContextProvider, u as SSRDataMissingError } from "./render-context-Clw3rFiO.js";
 import { a as disposeDefaultPortalScope, t as DefaultPortal } from "./portal-D2tPWNrC.js";
 import { t as getPublicAttributeName } from "./attr-names-CjhzmHOn.js";
+import { r as validateCspNonce, t as CspNonceScope } from "./csp-nonce-C-8E85El.js";
 import { t as createDataRuntime } from "./data-runtime-SJ1BSUvk.js";
 import { c as withTelemetry, i as dehydrateDataRuntime, t as createQueryPrefetchContext } from "./query-registry-CQIT4mXr.js";
-import { a as resolveRouteFromRoutes, t as _resolveRouteMatchFromRoutes } from "./route-matching-vJpvLVbX.js";
-import { f as resolveRouteRequest, g as isPageRenderEnvelope, h as isEmptyPageRenderEnvelope, i as isDeferred, m as createPageRenderEnvelope, t as DEFERRED_BOUNDARY, x as _preloadRouteHandler } from "./deferred-BeNnjR4r.js";
+import { a as resolveRouteFromRoutes, t as _resolveRouteMatchFromRoutes } from "./route-matching-C93To416.js";
+import { a as route } from "./authoring-CXMPffwN.js";
 import { n as renderDocument, t as SSR_RENDER_DATA_ATTR } from "./ssr-CbQO5xd3.js";
 //#region src/ssr/escape.ts
 /**
@@ -260,7 +262,8 @@ function createRenderContext(seed = 12345, opts = {}) {
 		keyCounter: 0,
 		renderData: envelope,
 		hydrationData: envelope,
-		deferredBoundaries: []
+		deferredBoundaries: [],
+		cspNonce: opts.cspNonce
 	};
 }
 /**
@@ -487,31 +490,20 @@ var StreamSink = class {
 //#endregion
 //#region src/ssr/route-render.ts
 async function resolveRequest(opts) {
+	if (!opts?.registry) throw new TypeError("resolveRequest requires opts.registry.");
 	const { url, auth, authContext, request, signal } = opts;
-	const manifest = opts.manifest ?? opts.registry?.manifest;
-	const routes = opts.routes ?? opts.registry?.routes;
-	if (manifest) return await resolveRouteRequest(url, {
-		manifest,
+	return await resolveRouteRequest(url, {
+		manifest: opts.registry.manifest,
 		mode: "ssr",
 		auth,
 		authContext,
 		request,
 		signal
 	});
-	if (!routes) throw new Error("resolveRequest requires a route manifest or route table.");
-	const resolved = resolveRouteFromRoutes(new URL(url, "http://localhost").pathname, routes);
-	if (!resolved) return null;
-	await _preloadRouteHandler(resolved.handler);
-	return {
-		kind: "render",
-		handler: resolved.handler,
-		params: resolved.params
-	};
 }
 function resolveSSRRouteSource(source) {
-	const routes = source.routes ?? source.registry?.routes;
-	if (!routes || routes.length === 0) throw new Error("SSR requires a route registry or route table.");
-	return routes.map((route) => ({
+	if (source.registry.routes.length === 0) throw new Error("SSR requires a non-empty route registry.");
+	return source.registry.routes.map((route) => ({
 		...route,
 		path: route.path,
 		handler: route.handler,
@@ -520,6 +512,7 @@ function resolveSSRRouteSource(source) {
 }
 function resolveSSRRouteRender(opts) {
 	const { seed = 12345, data, document } = opts;
+	const cspNonce = validateCspNonce(opts.cspNonce);
 	const routeTable = resolveSSRRouteSource(opts);
 	const resolvedRoute = resolvePolicyAwareSSRRoute(opts, routeTable);
 	const requestUrl = new URL(resolvedRoute.url, "http://localhost");
@@ -530,7 +523,8 @@ function resolveSSRRouteRender(opts) {
 		routes: routeTable,
 		dataRuntime: opts.dataRuntime,
 		queryPrefetch: opts.queryPrefetch,
-		envelope: opts.envelope
+		envelope: opts.envelope,
+		cspNonce
 	});
 	return {
 		url: resolvedRoute.url,
@@ -540,7 +534,8 @@ function resolveSSRRouteRender(opts) {
 		seed,
 		data,
 		ctx,
-		document
+		document,
+		cspNonce
 	};
 }
 function buildDocumentRenderArgs(resolved, appHtml) {
@@ -558,7 +553,8 @@ function buildDocumentRenderArgs(resolved, appHtml) {
 			route: {
 				path: resolved.route.path,
 				namespace: resolved.route.namespace
-			}
+			},
+			cspNonce: resolved.cspNonce
 		}
 	};
 }
@@ -800,7 +796,10 @@ function withControlBoundaryChildren(node, render) {
 const ESCAPED_ATTR_VALUE_CACHE_LIMIT = 512;
 const escapedAttrValueCache = /* @__PURE__ */ new Map();
 function isEventHandler(key) {
-	return key.length >= 3 && key.charCodeAt(0) === 111 && key.charCodeAt(1) === 110 && key.charCodeAt(2) >= 65 && key.charCodeAt(2) <= 90;
+	return key.length >= 2 && key.slice(0, 2).toLowerCase() === "on";
+}
+function assertAttributeName(name) {
+	if (!/^[A-Za-z_:][A-Za-z0-9_.:-]*$/.test(name)) throw new TypeError(`Invalid SSR attribute name: ${JSON.stringify(name)}`);
 }
 function getEscapedAttrValue(value) {
 	if (value.length > 64) return escapeAttr(value);
@@ -825,6 +824,7 @@ function renderAttrsDirect(props, sink) {
 		if (isEventHandler(key)) continue;
 		if (key.charCodeAt(0) === 95) continue;
 		const attrName = getPublicAttributeName(key);
+		assertAttributeName(attrName);
 		if (attrName === "style") {
 			const css = typeof value === "string" ? value : styleObjToCss(value);
 			if (!css) continue;
@@ -864,6 +864,7 @@ function renderAttrs(props, opts) {
 		if (isEventHandler(key)) continue;
 		if (key.charCodeAt(0) === 95) continue;
 		const attrName = key === "class" ? "class" : getPublicAttributeName(key);
+		assertAttributeName(attrName);
 		if (attrName === "style") {
 			const css = typeof value === "string" ? value : styleObjToCss(value);
 			if (css === null || css === "") continue;
@@ -1066,6 +1067,7 @@ function renderNodeSync(node, ctx) {
 		throw new Error(`renderNodeSync: unsupported VNode symbol type: ${String(type)}`);
 	}
 	const typeStr = type;
+	assertElementName(typeStr);
 	if (VOID_ELEMENTS.has(typeStr)) return `<${typeStr}${renderAttrs(props)} />`;
 	const maybeDangerous = props?.dangerouslySetInnerHTML;
 	if (maybeDangerous !== void 0 && maybeDangerous !== null) {
@@ -1118,6 +1120,7 @@ function renderNodeSyncToSink(node, sink, ctx) {
 		throw new Error(`renderNodeSyncToSink: unsupported VNode symbol type: ${String(type)}`);
 	}
 	const typeStr = type;
+	assertElementName(typeStr);
 	if (VOID_ELEMENTS.has(typeStr)) {
 		sinkWrite2(sink, "<", typeStr);
 		renderAttrsDirect(props, sink);
@@ -1171,14 +1174,19 @@ function renderNodeSyncToSink(node, sink, ctx) {
 	sinkWrite3(sink, "</", typeStr, ">");
 }
 function renderToStringSync(component, props, options) {
-	const ctx = createRenderContext(options?.seed ?? 12345, {
+	const seed = options?.seed ?? 12345;
+	const nonce = validateCspNonce(options?.cspNonce);
+	const ctx = createRenderContext(seed, {
 		data: options?.data,
 		envelope: options?.envelope
 	});
 	return withRenderContext(ctx, () => {
 		startRenderPhase(ctx.renderData);
 		try {
-			const node = renderSyncComponentRoot(component, props || {}, ctx);
+			const node = renderSyncComponentRoot(nonce === void 0 ? component : () => CspNonceScope({
+				value: nonce,
+				children: () => component(props)
+			}), props || {}, ctx);
 			if (!node) throw new Error("renderToStringSync: wrapped component returned empty");
 			const sink = new StringSink();
 			renderNodeSyncToSink(node, sink, ctx);
@@ -1199,7 +1207,10 @@ function renderSSRRouteAppToSink(input) {
 	withRenderContext(ctx, () => {
 		startRenderPhase(ctx.renderData);
 		try {
-			renderRenderableSyncToSink(executeComponentSync(route.handler, params, ctx), sink, ctx);
+			renderRenderableSyncToSink(executeComponentSync(ctx.cspNonce === void 0 ? route.handler : () => CspNonceScope({
+				value: ctx.cspNonce,
+				children: () => route.handler(params)
+			}), params, ctx), sink, ctx);
 			if (ctx.deferredBoundaries.length === 0) sink.write(serializeHydrationRenderData(ctx.hydrationData ?? data, ctx.dataRuntime));
 		} finally {
 			try {
@@ -1210,6 +1221,9 @@ function renderSSRRouteAppToSink(input) {
 		}
 	});
 }
+function assertElementName(name) {
+	if (!/^[A-Za-z][A-Za-z0-9._:-]*$/.test(name)) throw new TypeError(`Invalid SSR element name: ${JSON.stringify(name)}`);
+}
 //#endregion
 //#region src/ssr/render-resolved.ts
 function sameRouteParams(left, right) {
@@ -1221,23 +1235,28 @@ function sameRouteParams(left, right) {
 	return true;
 }
 function renderResolvedToStringSync(opts) {
-	const { url, routes, handler, params, options } = opts;
+	const { url, registry, handler, params, options } = opts;
+	const routes = registry.routes;
 	const requestUrl = new URL(url, "http://localhost");
 	const matchedIndex = routes.findIndex((route) => {
 		const resolved = resolveRouteFromRoutes(requestUrl.pathname, [route]);
 		return resolved !== null && resolved.handler === route.handler && sameRouteParams(resolved.params, params);
 	});
 	if (matchedIndex < 0) throw new Error(`renderResolvedToStringSync: no route found for url: ${url}`);
+	const effectiveRoutes = routes.map((route, index) => index === matchedIndex ? {
+		...route,
+		handler
+	} : route);
 	return renderToString({
 		url,
-		routes: routes.map((route, index) => index === matchedIndex ? {
-			...route,
-			handler
-		} : route),
+		registry: createRouteRegistry(() => {
+			for (const route$1 of effectiveRoutes) route(route$1.path, route$1.handler, { namespace: route$1.namespace });
+		}),
 		seed: options?.seed,
 		data: options?.data,
 		dataRuntime: options?.dataRuntime,
-		envelope: options?.envelope
+		envelope: options?.envelope,
+		cspNonce: options?.cspNonce
 	});
 }
 //#endregion
@@ -1264,17 +1283,18 @@ function settleWithSignal(promise, signal) {
 function stripHydrationPayload(html) {
 	return html.replace(/<script type="application\/json" data-askr-render-data="true">[\s\S]*?<\/script>$/, "");
 }
-function renderBoundary(boundary, state, payload, seed, data) {
+function renderBoundary(boundary, state, payload, seed, data, cspNonce) {
 	return stripHydrationPayload(renderToStringSync(() => state === "fulfilled" ? boundary.fulfilled(payload) : boundary.rejected(payload), {}, {
 		seed,
-		envelope: data ?? void 0
+		envelope: data ?? void 0,
+		cspNonce
 	}));
 }
-function patchChunk(id, html) {
+function patchChunk(id, html, cspNonce) {
 	const selector = `askr-resolve[data-askr-deferred=${JSON.stringify(id)}]`;
-	return `<template data-askr-deferred-patch="${id}">${html}</template><script data-askr-deferred-apply="${id}">(function(s){var t=s.previousElementSibling;var b=document.querySelector(${JSON.stringify(selector)});if(b&&t){b.replaceWith(t.content.cloneNode(true));}if(t)t.remove();s.remove();})(document.currentScript)<\/script>`;
+	return `<template data-askr-deferred-patch="${id}">${html}</template><script${cspNonce ? ` nonce="${cspNonce}"` : ""} data-askr-deferred-apply="${id}">(function(s){var t=s.previousElementSibling;var b=document.querySelector(${JSON.stringify(selector)});if(b&&t){b.replaceWith(t.content.cloneNode(true));}if(t)t.remove();s.remove();})(document.currentScript)<\/script>`;
 }
-function createDeferredRenderStream(initialHtml, boundaries, signal, seed, data, runtime) {
+function createDeferredRenderStream(initialHtml, boundaries, signal, seed, data, runtime, cspNonce) {
 	const encoder = new TextEncoder();
 	const local = new AbortController();
 	let cancelled = false;
@@ -1310,13 +1330,13 @@ function createDeferredRenderStream(initialHtml, boundaries, signal, seed, data,
 				boundaryIndex += 1;
 				try {
 					const value = await settleWithSignal(boundary.promise, local.signal);
-					if (!cancelled && !closed) controller.enqueue(encoder.encode(patchChunk(boundary.id, renderBoundary(boundary, "fulfilled", value, seed, data))));
+					if (!cancelled && !closed) controller.enqueue(encoder.encode(patchChunk(boundary.id, renderBoundary(boundary, "fulfilled", value, seed, data, cspNonce), cspNonce)));
 				} catch (error) {
 					if (local.signal.aborted) {
 						if (!cancelled && !closed) close(controller);
 						return;
 					}
-					if (!cancelled && !closed) controller.enqueue(encoder.encode(patchChunk(boundary.id, renderBoundary(boundary, "rejected", error, seed, data))));
+					if (!cancelled && !closed) controller.enqueue(encoder.encode(patchChunk(boundary.id, renderBoundary(boundary, "rejected", error, seed, data, cspNonce), cspNonce)));
 				}
 				return;
 			}
@@ -1344,8 +1364,9 @@ async function renderRouteRequestToString(options) {
 	};
 }
 async function renderRouteRequestInternal(options) {
-	const manifest = options.manifest ?? options.registry?.manifest;
-	if (!manifest) throw new Error("renderRouteRequestToString requires a route manifest or registry.");
+	if (!options?.registry) throw new TypeError("renderRouteRequest requires options.registry.");
+	const cspNonce = validateCspNonce(options.cspNonce);
+	const manifest = options.registry.manifest;
 	const signal = options.signal ?? options.request?.signal ?? new AbortController().signal;
 	const request = options.request ?? new Request(new URL(options.url, "http://localhost"));
 	const runtime = options.dataRuntime ?? createDataRuntime();
@@ -1364,7 +1385,8 @@ async function renderRouteRequestInternal(options) {
 		signal,
 		dataRuntime: runtime,
 		queryPrefetch: prefetch,
-		mode: "ssr"
+		mode: "ssr",
+		cspNonce
 	});
 	return withTelemetry(options.telemetry?.ssrRender, {}, () => withRenderContextAsync(context, async () => {
 		const resolved = await resolveRouteRequest(options.url, {
@@ -1395,7 +1417,7 @@ async function renderRouteRequestInternal(options) {
 		const result = {
 			kind: "render",
 			html,
-			...boundaries.length > 0 ? { stream: createDeferredRenderStream(html, boundaries, signal, options.seed, context.hydrationData, runtime) } : {},
+			...boundaries.length > 0 ? { stream: createDeferredRenderStream(html, boundaries, signal, options.seed, context.hydrationData, runtime, cspNonce) } : {},
 			params: resolved.params
 		};
 		if (resolved.record) Object.defineProperty(result, "record", {