@askrjs/askr 0.3.0 → 0.4.0

package/dist/testing/index.d.ts

@@ -77,9 +77,9 @@ declare function mount(
 declare function renderRoute(
   options: RouteRenderOptions
 ): Promise<RenderResult>;
-/** Dispatch the browser click sequence expected by Askr's delegated events. */
+/** Dispatch one bubbling `click` MouseEvent (no pointerdown/mousedown/mouseup sequence). */
 declare function click(element: Element): boolean;
-/** Set a text control's value and emit an input event for each character. */
+/** Append `text` to a text control's value one character at a time, emitting an input event for each. */
 declare function type(
   element: HTMLInputElement | HTMLTextAreaElement,
   text: string
@@ -94,7 +94,9 @@ interface QueryTestRegistry {
   clear(): void;
 }
 /** Create a keyed query fixture registry for a test render runtime. */
-declare function createQueryTestRegistry(): QueryTestRegistry;
+declare function createQueryTestRegistry(
+  runtime?: DataRuntime
+): QueryTestRegistry;
 /** Keyed mutation fixture registry returned by {@link createMutationTestRegistry}. */
 interface MutationTestRegistry {
   readonly runtime: DataRuntime;
@@ -103,7 +105,9 @@ interface MutationTestRegistry {
   clear(): void;
 }
 /** Create a keyed mutation fixture registry for a test render runtime. */
-declare function createMutationTestRegistry(): MutationTestRegistry;
+declare function createMutationTestRegistry(
+  runtime?: DataRuntime
+): MutationTestRegistry;
 /** Initial state for {@link mutationState}; exactly one of `pending`/`error`/`result` may be set. */
 type MutationFixtureInitial<TResult> = {
   pending?: boolean;

package/dist/testing/index.js

@@ -1,10 +1,10 @@
-import { r as flushRuntimeScheduler } from "../access-CEA2pOry.js";
-import { v as recordReadableRead } from "../notify-DxxuDPeY.js";
-import { l as addInvalidationListener, t as createDataRuntime } from "../data-runtime-CxoY98lX.js";
-import { a as loadingQueryState, i as freshQueryState, o as refreshingQueryState, r as errorQueryState, s as staleQueryState } from "../data-2edW0jhF.js";
-import { a as normalizeAsyncDataError, o as notifySource, t as createReadableSource } from "../shared-kU8yvryp.js";
-import { a as cleanupApp, n as createSPA, r as createIsland } from "../boot-BMBMWUGI.js";
-import { r as computeRouteActivityMatches } from "../route-matching-CUzZ31gT.js";
+import { y as flushSync } from "../instance-BAnfmXOR.js";
+import { n as createSource, s as notify, u as readSource } from "../hooks-BimKStr4.js";
+import { v as matchRoute } from "../resolution-Cx82-xjW.js";
+import { a as cleanupApp, n as createSPA, r as createIsland } from "../boot-DaoTYoCw.js";
+import { h as addInvalidationListener, t as createDataRuntime, u as resolveDataRuntimeState } from "../data-runtime-C1bFAlba.js";
+import { a as loadingQueryState, i as freshQueryState, o as refreshingQueryState, r as errorQueryState, s as staleQueryState } from "../data-BCwClJiF.js";
+import { i as normalizeAsyncDataError } from "../shared-O2ZnmYAf.js";
 //#region src/testing/render.ts
 const renderStates = /* @__PURE__ */ new WeakMap();
 const eventConstructorNames = {
@@ -99,7 +99,7 @@ function isEventForTarget(target, value) {
 }
 /** Synchronously flush the runtime's scheduled work (renders, effects). */
 function flush() {
-	flushRuntimeScheduler();
+	flushSync();
 }
 /** Dispatch an event (constructed from a type string, or given directly) on `target`. */
 function dispatch(target, event, init = {}) {
@@ -191,12 +191,12 @@ async function renderRoute(options) {
 }
 //#endregion
 //#region src/testing/interactions.ts
-/** Dispatch the browser click sequence expected by Askr's delegated events. */
+/** Dispatch one bubbling `click` MouseEvent (no pointerdown/mousedown/mouseup sequence). */
 function click(element) {
 	if (!element || typeof element.dispatchEvent !== "function") throw new TypeError("@askrjs/askr/testing click requires an Element.");
 	return dispatch(element, "click");
 }
-/** Set a text control's value and emit an input event for each character. */
+/** Append `text` to a text control's value one character at a time, emitting an input event for each. */
 function type(element, text) {
 	if (!element || typeof element.dispatchEvent !== "function") throw new TypeError("@askrjs/askr/testing type requires a text control.");
 	for (const character of text) {
@@ -215,40 +215,40 @@ function submit(form) {
 //#endregion
 //#region src/testing/registries.ts
 /** Create a keyed query fixture registry for a test render runtime. */
-function createQueryTestRegistry() {
-	const runtime = createDataRuntime();
+function createQueryTestRegistry(runtime = createDataRuntime()) {
+	const overrides = resolveDataRuntimeState(runtime).queryTestOverrides;
 	return {
 		runtime,
 		set(key, query) {
 			if (typeof key !== "string" || key.length === 0) throw new TypeError("@askrjs/askr/testing query registry keys must be non-empty strings.");
-			runtime.queryTestOverrides.set(key, query);
+			overrides.set(key, query);
 		},
 		delete(key) {
-			runtime.queryTestOverrides.delete(key);
+			overrides.delete(key);
 		},
 		clear() {
-			runtime.queryTestOverrides.clear();
+			overrides.clear();
 		}
 	};
 }
 /** Create a keyed mutation fixture registry for a test render runtime. */
-function createMutationTestRegistry() {
-	const runtime = createDataRuntime();
+function createMutationTestRegistry(runtime = createDataRuntime()) {
+	const overrides = resolveDataRuntimeState(runtime).mutationTestOverrides;
 	return {
 		runtime,
 		set(key, mutation) {
 			if (typeof key !== "string" || key.length === 0) throw new TypeError("@askrjs/askr/testing mutation registry keys must be non-empty strings.");
-			const previous = runtime.mutationTestOverrides.get(key);
+			const previous = overrides.get(key);
 			if (previous && previous !== mutation) previous.reset();
-			runtime.mutationTestOverrides.set(key, mutation);
+			overrides.set(key, mutation);
 		},
 		delete(key) {
-			runtime.mutationTestOverrides.get(key)?.reset();
-			runtime.mutationTestOverrides.delete(key);
+			overrides.get(key)?.reset();
+			overrides.delete(key);
 		},
 		clear() {
-			for (const mutation of runtime.mutationTestOverrides.values()) mutation.reset();
-			runtime.mutationTestOverrides.clear();
+			for (const mutation of overrides.values()) mutation.reset();
+			overrides.clear();
 		}
 	};
 }
@@ -256,7 +256,7 @@ function createMutationTestRegistry() {
 //#region src/testing/mutation-fixtures.ts
 var MutableMutationFixture = class {
 	constructor(initial = {}) {
-		this.source = createReadableSource();
+		this.source = createSource();
 		this.receivedInputs = [];
 		this.active = null;
 		const hasResult = Object.prototype.hasOwnProperty.call(initial, "result");
@@ -281,19 +281,19 @@ var MutableMutationFixture = class {
 		};
 	}
 	get status() {
-		recordReadableRead(this.source);
+		readSource(this.source);
 		return this.state.status;
 	}
 	get pending() {
-		recordReadableRead(this.source);
+		readSource(this.source);
 		return this.state.status === "pending";
 	}
 	get error() {
-		recordReadableRead(this.source);
+		readSource(this.source);
 		return this.state.error;
 	}
 	get result() {
-		recordReadableRead(this.source);
+		readSource(this.source);
 		return this.state.result;
 	}
 	get inputs() {
@@ -357,7 +357,7 @@ var MutableMutationFixture = class {
 	}
 	setState(state) {
 		this.state = state;
-		notifySource(this.source);
+		notify(this.source);
 	}
 };
 function createMutationFixture(initial = {}) {
@@ -458,11 +458,6 @@ function createInvalidationRecorder() {
 }
 //#endregion
 //#region src/testing/routes.ts
-/** Match `path` against a route registry for tests, without mounting the app. */
-function matchRoute(path, options) {
-	if (!options?.registry) throw new TypeError("matchRoute requires options.registry.");
-	return computeRouteActivityMatches(path, { registry: options.registry })[0] ?? null;
-}
 function getRoutePatternRecords(options) {
 	if (!options?.registry) throw new TypeError("getRouteWarnings requires options.registry.");
 	return options.registry.manifest.records.map((record) => ({

package/dist/url-CnbfpX0K.js

@@ -0,0 +1,185 @@
+import { F as logger, I as isDevelopmentEnvironment } from "./instance-BAnfmXOR.js";
+//#region src/common/attr-names.ts
+/**
+* JSX prop name to rendered attribute name, shared by the DOM renderer and SSR.
+*
+* The DOM renderer additionally lowercases the result for non-SVG elements,
+* using the element's real namespace. SSR renders to text and has no element to
+* ask, so every camelCase prop that does not name a real camelCase attribute is
+* mapped explicitly here — otherwise SSR emits `tabIndex` where the DOM renderer
+* writes `tabindex`, or `strokeDasharray`, which browsers ignore. Every mapped
+* name is lowercase in both HTML and SVG, so the mapping is
+* namespace-independent. SVG attributes that really are camelCase (`viewBox`,
+* `gradientUnits`, `preserveAspectRatio`, ...) are not listed and pass through.
+*
+* Custom elements (a tag name containing `-`) define their own attributes, so
+* they only get this base table and never the SVG table below.
+*/
+const PUBLIC_ATTRIBUTE_NAME_MAP = {
+	className: "class",
+	htmlFor: "for",
+	autoComplete: "autocomplete",
+	colSpan: "colspan",
+	contentEditable: "contenteditable",
+	enterKeyHint: "enterkeyhint",
+	inputMode: "inputmode",
+	maxLength: "maxlength",
+	minLength: "minlength",
+	noValidate: "novalidate",
+	readOnly: "readonly",
+	rowSpan: "rowspan",
+	spellCheck: "spellcheck",
+	tabIndex: "tabindex",
+	writingSuggestions: "writingsuggestions",
+	strokeWidth: "stroke-width",
+	strokeLinecap: "stroke-linecap",
+	strokeLinejoin: "stroke-linejoin",
+	fillRule: "fill-rule",
+	clipRule: "clip-rule"
+};
+const SVG_ATTRIBUTE_NAME_MAP = {};
+/**
+* SVG presentation attributes are hyphenated, and the XML-namespaced ones use
+* a prefix; JSX spells both in camelCase (`strokeDasharray`, `xlinkHref`).
+* Listing the rendered names and deriving the prop names keeps this table
+* small in the client bundle.
+*/
+for (const attributeName of "alignment-baseline baseline-shift clip-path clip-rule color-interpolation color-interpolation-filters color-rendering dominant-baseline fill-opacity fill-rule flood-color flood-opacity font-family font-size font-size-adjust font-stretch font-style font-variant font-weight image-rendering letter-spacing lighting-color marker-end marker-mid marker-start mask-type paint-order pointer-events shape-rendering stop-color stop-opacity stroke-dasharray stroke-dashoffset stroke-linecap stroke-linejoin stroke-miterlimit stroke-opacity stroke-width text-anchor text-decoration text-overflow text-rendering transform-origin unicode-bidi vector-effect white-space word-spacing writing-mode xlink:actuate xlink:arcrole xlink:href xlink:role xlink:show xlink:title xlink:type xml:base xml:lang xml:space xmlns:xlink".split(" ")) SVG_ATTRIBUTE_NAME_MAP[attributeName.replace(/[-:]([a-z])/g, (_, char) => char.toUpperCase())] = attributeName;
+function isCustomElementName(tagName) {
+	return tagName.includes("-");
+}
+function getPublicAttributeName(propName, customElement = false) {
+	if (propName.startsWith("attr:")) return propName.slice(5);
+	return PUBLIC_ATTRIBUTE_NAME_MAP[propName] ?? (customElement ? void 0 : SVG_ATTRIBUTE_NAME_MAP[propName]) ?? propName;
+}
+const ATTRIBUTE_PREFIX_NAMESPACES = {
+	xlink: "http://www.w3.org/1999/xlink",
+	xml: "http://www.w3.org/XML/1998/namespace",
+	xmlns: "http://www.w3.org/2000/xmlns/"
+};
+const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
+const MATHML_NAMESPACE = "http://www.w3.org/1998/Math/MathML";
+/**
+* The XML namespace of a prefixed attribute name such as `xlink:href` on an
+* element in `elementNamespace`, or `null` for ordinary attributes. The HTML
+* parser puts these attributes in their namespaces only on SVG and MathML
+* elements when it reads SSR markup; on HTML elements `xml:lang` stays a plain
+* attribute. The DOM renderer must do the same so both sides produce the same
+* element.
+*/
+function attributeNamespace(elementNamespace, attributeName) {
+	if (elementNamespace !== SVG_NAMESPACE && elementNamespace !== MATHML_NAMESPACE) return null;
+	const colon = attributeName.indexOf(":");
+	if (colon === -1) return null;
+	return ATTRIBUTE_PREFIX_NAMESPACES[attributeName.slice(0, colon)] ?? null;
+}
+//#endregion
+//#region src/common/url.ts
+const SAFE_URL_SCHEMES = /* @__PURE__ */ new Set([
+	"http",
+	"https",
+	"mailto",
+	"sms",
+	"tel"
+]);
+const SCRIPT_URL_SCHEMES = /* @__PURE__ */ new Set(["javascript", "vbscript"]);
+const URL_SCHEME_RE = /^([a-z][a-z0-9+.-]*):/i;
+function urlScheme(value) {
+	const compact = value.trim().replace(/[\u0000-\u0020\u007f-\u009f]/g, "");
+	return URL_SCHEME_RE.exec(compact)?.[1]?.toLowerCase();
+}
+const EXPLICIT_HTTP_URL_RE = /^[\u0000-\u0020]*https?:/i;
+const NAVIGATION_BASE = "http://askr.invalid/";
+/**
+* Resolve a navigation or redirect target against `base`. Only a target
+* written with an explicit `http:`/`https:` scheme may leave the base origin.
+* A path-like string that URL parsing resolves to another host
+* (`//evil.example`, `/\\evil.example`, `\\\\evil.example`) throws a
+* `TypeError`, so an app path can never become an open redirect. So does a
+* same-origin URL whose pathname starts with `//` (`/.//evil.example`,
+* `/%2e//evil.example`): its root-relative form `//evil.example` would name
+* another host. No window is needed: the check holds for any base origin.
+*/
+function resolveNavigationUrl(target, base = NAVIGATION_BASE) {
+	const url = new URL(target, base);
+	const sameOrigin = url.origin === new URL(base).origin;
+	if (!sameOrigin && !EXPLICIT_HTTP_URL_RE.test(target) || sameOrigin && url.pathname.startsWith("//")) throw new TypeError(`Navigation target ${JSON.stringify(target)} resolves to another origin without an explicit http: or https: scheme.`);
+	return url;
+}
+/**
+* The public form of a navigation target: root-relative for the base origin,
+* absolute for an explicit URL on another origin.
+*/
+function formatNavigationUrl(url, base = NAVIGATION_BASE) {
+	return url.origin === new URL(base).origin ? `${url.pathname}${url.search}${url.hash}` : url.href;
+}
+/**
+* Reject a scheme-less href (`/\\evil.example`, `//evil.example`) that the
+* browser would follow to another origin. Hrefs with a scheme are checked by
+* {@link isSafeHref}.
+*/
+function assertPathHrefStaysOnOrigin(value) {
+	const scheme = urlScheme(value);
+	if (scheme === void 0 || scheme === "http" || scheme === "https") resolveNavigationUrl(value);
+}
+function isSafeHref(value) {
+	const scheme = urlScheme(value);
+	return scheme === void 0 || SAFE_URL_SCHEMES.has(scheme);
+}
+/** Whether a resource URL avoids script-executing schemes; data:, blob: and custom schemes stay allowed. */
+function isSafeResourceUrl(value) {
+	const scheme = urlScheme(value);
+	return scheme === void 0 || !SCRIPT_URL_SCHEMES.has(scheme);
+}
+/**
+* Attribute names (lowercased) that can carry a browser-navigable/executable
+* URL and must be checked against isSafeHref. Shared between the client
+* renderer (renderer/attributes.ts) and SSR (ssr/attrs.ts) so their unsafe-
+* URL handling can't drift.
+*/
+const UNSAFE_URL_SCHEME_ATTRIBUTES = /* @__PURE__ */ new Set([
+	"href",
+	"formaction",
+	"action",
+	"xlink:href"
+]);
+/**
+* Resource attributes (lowercased) that execute script-scheme URLs, such as
+* `<iframe src>` and `<object data>`. They legitimately carry data:, blob: and
+* other non-navigable URLs, so only script schemes are rejected, not the
+* navigation allowlist.
+*/
+const SCRIPT_URL_RESOURCE_ATTRIBUTES = /* @__PURE__ */ new Set(["src", "data"]);
+/** Accepts the JSX prop name (`xlinkHref`) or the rendered attribute name. */
+function isUnsafeUrlAttribute(key, value) {
+	const name = getPublicAttributeName(key).toLowerCase();
+	if (UNSAFE_URL_SCHEME_ATTRIBUTES.has(name)) return !isSafeHref(String(value));
+	if (SCRIPT_URL_RESOURCE_ATTRIBUTES.has(name)) return !isSafeResourceUrl(String(value));
+	return false;
+}
+const WARNED_URL_PREVIEW_LENGTH = 80;
+const WARNED_URL_LIMIT = 256;
+const warnedUrls = /* @__PURE__ */ new Set();
+const MISLEADING_PREVIEW_CHARS_RE = /[\u202A-\u202E\u2066-\u2069\u2028\u2029]/g;
+function warnUnsafeUrl(name, text) {
+	const key = `${name}=${text}`;
+	if (warnedUrls.has(key)) return;
+	if (warnedUrls.size >= WARNED_URL_LIMIT) warnedUrls.clear();
+	warnedUrls.add(key);
+	const preview = (text.length > WARNED_URL_PREVIEW_LENGTH ? `${text.slice(0, WARNED_URL_PREVIEW_LENGTH)}...` : text).replace(MISLEADING_PREVIEW_CHARS_RE, "?");
+	const allowed = SCRIPT_URL_RESOURCE_ATTRIBUTES.has(name) ? "script-executing schemes are never rendered" : `only relative URLs and ${[...SAFE_URL_SCHEMES].join(", ")} are allowed`;
+	logger.warn(`[Askr] Omitted ${name}=${JSON.stringify(preview)}: the "${urlScheme(text)}:" scheme is blocked (${allowed}).`);
+}
+/**
+* {@link isUnsafeUrlAttribute} for a value about to be rendered: in
+* development, a blocked value logs a warning naming the attribute and scheme,
+* once per attribute and value, so a stripped custom-scheme link (`vscode:`,
+* `slack:`) is not silent.
+*/
+function rejectUnsafeUrlAttribute(key, value) {
+	if (!isUnsafeUrlAttribute(key, value)) return false;
+	if (isDevelopmentEnvironment()) warnUnsafeUrl(getPublicAttributeName(key).toLowerCase(), String(value));
+	return true;
+}
+//#endregion
+export { isSafeHref as a, resolveNavigationUrl as c, isCustomElementName as d, formatNavigationUrl as i, attributeNamespace as l, UNSAFE_URL_SCHEME_ATTRIBUTES as n, isUnsafeUrlAttribute as o, assertPathHrefStaysOnOrigin as r, rejectUnsafeUrlAttribute as s, SCRIPT_URL_RESOURCE_ATTRIBUTES as t, getPublicAttributeName as u };

package/dist/utilities.d.ts

@@ -63,14 +63,59 @@ declare function composeHandlers<A extends readonly unknown[]>(
   second?: (...args: A) => void,
   options?: ComposeHandlersOptions
 ): (...args: A) => void;
+type IsAny<T> = 0 extends 1 & T ? true : false;
+type HasIndexSignature<T> = string extends keyof T
+  ? true
+  : number extends keyof T
+    ? true
+    : false;
+type RequiredKeys<T> = {
+  [K in keyof T]-?: {} extends Pick<T, K> ? never : K;
+}[keyof T];
+
+/** A base value, or the injected one where the base may be `undefined`. */
+type MergedValue<TBase, TInjected> =
+  IsAny<TBase> extends true
+    ? TBase
+    : [TBase] extends [undefined]
+      ? TInjected
+      : undefined extends TBase
+        ? Exclude<TBase, undefined> | TInjected
+        : TBase;
+
+/**
+ * The props {@link mergeProps} returns: base keys win unless `undefined`, and
+ * a base key is required when the injected props always supply it. Props
+ * with an index signature fall back to the intersection of both sides.
+ */
+type MergedProps<TBase extends object, TInjected extends object> =
+  HasIndexSignature<TBase> extends true
+    ? TInjected & TBase
+    : HasIndexSignature<TInjected> extends true
+      ? TInjected & TBase
+      : Omit<TInjected, keyof TBase> & {
+          [
+            K in keyof TBase as K extends RequiredKeys<TInjected> ? K : never
+          ]-?: MergedValue<TBase[K], TInjected[K & keyof TInjected]>;
+        } & {
+          [
+            K in keyof TBase as K extends RequiredKeys<TInjected> ? never : K
+          ]: MergedValue<
+            TBase[K],
+            K extends keyof TInjected ? TInjected[K] : undefined
+          >;
+        };
+
 /**
  * Merge `base` props over `injected` props: non-handler keys in `base` win,
- * and matching event handlers are composed (`injected` runs first).
+ * and matching event handlers are composed (`injected` runs first). `base`
+ * values that are `undefined` are treated as absent and never overwrite an
+ * injected value; use `null` to clear one explicitly.
  */
 declare function mergeProps<TBase extends object, TInjected extends object>(
   base: TBase,
   injected: TInjected
-): TInjected & TBase;
+): MergedProps<TBase, TInjected>;
 /**
  * Tiny aria helpers
  */
@@ -124,6 +169,7 @@ export {
   DefaultPreventable,
   formatId,
   mergeProps,
+  MergedProps,
   PropagationStoppable,
   ariaDisabled,
   ComposeHandlersOptions,

package/dist/verify-hydration-DpVaDnqz.js

@@ -0,0 +1,152 @@
+import { r as validateCspNonce } from "./csp-nonce-DwGw1A6Q.js";
+import { g as withHydrationVerificationRender, v as getHydrationRenderUrl } from "./render-context-DGHnEveC.js";
+import { C as removeRouteBasePath, S as normalizeRouteBasePath, f as currentAuth, n as getRouteRenderContext, y as resolveRouteFromRoutes } from "./resolution-Cx82-xjW.js";
+import { t as SSR_RENDER_DATA_ATTR } from "./ssr-DoV-vJ-5.js";
+import { i as StringSink, s as createRenderContext, t as renderSSRRouteAppToSink } from "./render-sync-IC5lMFpq.js";
+//#region src/ssr/render-resolved.ts
+function sameRouteParams(left, right) {
+	if (!left || !right) return !left && !right;
+	const leftKeys = Object.keys(left);
+	const rightKeys = Object.keys(right);
+	if (leftKeys.length !== rightKeys.length) return false;
+	for (const key of leftKeys) if (left[key] !== right[key]) return false;
+	return true;
+}
+/** @internal Render a resolved route handler, with the request-local auth context used by hydration verification. */
+function renderResolvedForHydrationSync(opts, authContext) {
+	const { url, registry, handler, params, options } = opts;
+	const routes = registry.routes;
+	const requestUrl = new URL(url, "http://localhost");
+	const logicalTarget = removeRouteBasePath(`${requestUrl.pathname}${requestUrl.search}${requestUrl.hash}`, normalizeRouteBasePath(registry.manifest.basePath));
+	const matchedIndex = routes.findIndex((route) => {
+		if (logicalTarget === void 0) return false;
+		const resolved = resolveRouteFromRoutes(new URL(logicalTarget, "http://localhost").pathname, [route]);
+		return resolved !== null && resolved.handler === route.handler && sameRouteParams(resolved.params, params ?? {});
+	});
+	if (matchedIndex < 0) throw new Error(`renderResolvedForHydrationSync: no route found for url: ${url}`);
+	const effectiveRoutes = routes.map((route, index) => index === matchedIndex ? {
+		...route,
+		handler
+	} : route);
+	const matchedRoute = routes[matchedIndex];
+	const cspNonce = validateCspNonce(options?.cspNonce);
+	const ctx = createRenderContext(options?.seed, {
+		url,
+		basePath: registry.manifest.basePath,
+		data: options?.data,
+		params,
+		routes: effectiveRoutes,
+		routeAuth: registry.manifest.auth,
+		authContext,
+		dataRuntime: options?.dataRuntime,
+		envelope: options?.envelope,
+		cspNonce
+	});
+	const sink = new StringSink();
+	renderSSRRouteAppToSink({
+		route: {
+			...matchedRoute,
+			handler
+		},
+		params: params ?? {},
+		data: options?.data,
+		ctx,
+		sink
+	});
+	sink.end();
+	return sink.toString();
+}
+//#endregion
+//#region src/ssr/verify-hydration.ts
+const SSR_STYLE_REGISTRY_SELECTOR = "style[data-askr-style-registry]";
+const RENDERER_BOOKKEEPING_ATTRS = [
+	"data-skip-hydrate",
+	"data-key",
+	"data-askr-key-kind"
+];
+/**
+* Parsed declarations in a canonical order. Each parsed longhand is unique, so
+* order carries no meaning here, but the DOM renderer may reorder properties
+* it rewrites.
+*/
+function normalizeStyleDeclarations(style) {
+	const declarations = [];
+	for (let index = 0; index < style.length; index += 1) {
+		const name = style.item(index);
+		const priority = style.getPropertyPriority(name);
+		declarations.push(`${name}: ${style.getPropertyValue(name)}${priority ? ` !${priority}` : ""};`);
+	}
+	return declarations.sort().join(" ");
+}
+/**
+* Serialize markup in a form that is stable across the SSR serializer and the
+* DOM renderer: transport carriers, comments (range anchors) and the
+* key and `data-skip-hydrate` bookkeeping the renderers add are dropped, and style
+* attributes are re-serialized through the CSSOM so `color:red;` and the
+* DOM's `color: red;` compare equal.
+*/
+function normalizeHydrationHtml(html) {
+	const template = document.createElement("template");
+	template.innerHTML = html;
+	for (const carrier of Array.from(template.content.querySelectorAll(`script[${SSR_RENDER_DATA_ATTR}],${SSR_STYLE_REGISTRY_SELECTOR}`))) carrier.remove();
+	for (const name of RENDERER_BOOKKEEPING_ATTRS) for (const element of Array.from(template.content.querySelectorAll(`[${name}]`))) element.removeAttribute(name);
+	for (const element of Array.from(template.content.querySelectorAll("[style]"))) {
+		const style = element.style;
+		if (!style) continue;
+		const cssText = normalizeStyleDeclarations(style);
+		if (cssText) element.setAttribute("style", cssText);
+		else element.removeAttribute("style");
+	}
+	const comments = document.createTreeWalker(template.content, NodeFilter.SHOW_COMMENT);
+	const found = [];
+	while (comments.nextNode()) found.push(comments.currentNode);
+	for (const comment of found) comment.parentNode?.removeChild(comment);
+	return template.innerHTML;
+}
+/**
+* Whether the client renders the same URL the server markup was rendered
+* for. A static page opened with a client-only query or hash is verified
+* against its queryless render URL, then hydration applies the browser URL on
+* purpose, so its client output legitimately differs.
+*/
+function clientRendersServerUrl(url, envelope) {
+	const live = new URL(url, "http://localhost");
+	const renderUrl = getHydrationRenderUrl(envelope);
+	const rendered = new URL(renderUrl ?? live.pathname, "http://localhost");
+	return rendered.search === live.search && rendered.hash === live.hash;
+}
+/**
+* Capture the server markup under `root` before the client renderer touches
+* it, normalized for {@link verifyClientHydrationMarkup}. Returns `null` when
+* the client output is not expected to reproduce it because the page is
+* hydrated at a different URL than it was rendered for.
+*/
+function captureServerHydrationMarkup(root, url, envelope) {
+	const html = root.innerHTML;
+	if (!clientRendersServerUrl(url, envelope)) return null;
+	return normalizeHydrationHtml(html);
+}
+/**
+* Whether client markup left by hydration (`clientHtml`) matches the server
+* markup captured before it ran. Hydration reconciles the server DOM in place,
+* so an SSR/client renderer divergence shows up here even when a fresh server
+* render reproduces the server HTML exactly.
+*/
+function verifyClientHydrationMarkup(clientHtml, serverMarkup) {
+	return normalizeHydrationHtml(clientHtml) === serverMarkup;
+}
+function verifyHydrationSyncForUrl(opts) {
+	const { root, url, registry, resolved, options } = opts;
+	const verificationUrl = getHydrationRenderUrl(options?.envelope) ?? new URL(url, "http://localhost").pathname;
+	const authContext = getRouteRenderContext(resolved)?.auth ?? currentAuth();
+	const expected = withHydrationVerificationRender(() => renderResolvedForHydrationSync({
+		url: verificationUrl,
+		registry,
+		handler: resolved.handler,
+		params: resolved.params,
+		options
+	}, authContext));
+	return normalizeHydrationHtml(root.innerHTML) === normalizeHydrationHtml(expected);
+}
+//#endregion
+export { captureServerHydrationMarkup, verifyClientHydrationMarkup, verifyHydrationSyncForUrl };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@askrjs/askr",
-  "version": "0.3.0",
-  "description": "Lane-scheduled deterministic UI framework",
+  "version": "0.4.0",
+  "description": "A TypeScript UI runtime with getter-based state, fine-grained bindings, transactional commits with rollback, and one route graph for SPA, SSR, and SSG.",
   "keywords": [
     "askr",
     "framework",
@@ -128,7 +128,7 @@
     "dev": "vp dev",
     "fmt": "vp fmt .",
     "lint": "vp lint src tests test-utils benches && npm run typecheck",
-    "typecheck": "tsc --noEmit --pretty false",
+    "typecheck": "tsc --noEmit --pretty false && tsc --noEmit --pretty false -p test-utils && tsc --noEmit --pretty false -p benches && tsc --noEmit --pretty false -p tests",
     "test": "npm run test:unit && npm run test:checks && npm run test:jsdom && npm run test:browser",
     "test:browser": "vp test run -c vitest.test.browser.config.ts tests/browser",
     "test:checks": "vp test run -c vitest.test.checks.config.ts",
@@ -146,22 +146,32 @@
     "prepack": "npm run build",
     "prepublishOnly": "npm run check"
   },
-  "dependencies": {
-    "@askrjs/auth": ">=0.3.0 <0.4.0",
-    "@askrjs/schema": ">=0.3.0 <0.4.0"
-  },
   "devDependencies": {
-    "@types/node": "^26.4.1",
+    "@askrjs/auth": ">=0.4.0 <0.5.0",
+    "@askrjs/schema": ">=0.4.0 <0.5.0",
+    "@types/node": "^26.6.2",
     "@typescript/typescript6": "^6.0.2",
     "@vitest/browser-playwright": "4.1.11",
     "cross-env": "^10.1.0",
-    "jsdom": "^30.0.1",
+    "jsdom": "^30.1.1",
     "playwright": "^1.63.0",
     "publint": "^0.3.24",
     "tsd": "^0.33.0",
     "typescript": "^7.0.2",
     "vite-plus": "^0.3.1"
   },
+  "peerDependencies": {
+    "@askrjs/auth": ">=0.4.0 <0.5.0",
+    "@askrjs/schema": ">=0.4.0 <0.5.0"
+  },
+  "peerDependenciesMeta": {
+    "@askrjs/auth": {
+      "optional": true
+    },
+    "@askrjs/schema": {
+      "optional": true
+    }
+  },
   "tsd": {
     "compilerOptions": {
       "composite": false,