@askrjs/askr 0.3.1 → 0.4.1

package/dist/ssg/index.d.ts

@@ -9,8 +9,7 @@ import {
   DocumentRenderArgs,
   RoutePolicy,
 } from '../core.js';
-import { AuthRequirement } from '@askrjs/auth';
-import 'node:fs/promises';
+import { AuthRequirement } from '../peer-types.js';
 /** Whether an SSG run rebuilds every route (`full`) or only changed ones (`incremental`). */
 type SSGMode = 'full' | 'incremental';
 /** Outcome of generating a single route's static HTML. */

package/dist/ssg/index.js

@@ -1,10 +1,8 @@
-import "../access-CEA2pOry.js";
-import { n as createRouteRegistry } from "../manifest-D1P3UNWV.js";
-import { _ as prepareRouteHydrationData, d as _preloadRouteHandler, m as RouteDataLoadError, t as bindResolvedRouteData, u as getRenderHandler } from "../resolution-3DskUkjG.js";
-import { o as addRouteBasePath } from "../route-matching-CUzZ31gT.js";
-import { c as route, n as resolveDeferredValues } from "../deferred-CbgNhf67.js";
-import { n as renderDocument } from "../ssr-EPjwJH5R.js";
-import { n as renderToString } from "../ssr-CiNm6Vzl.js";
+import { ct as encodePathSegment, mt as prepareRouteHydrationData, nt as getRenderHandler, ot as RouteDataLoadError, rt as _preloadRouteHandler, t as bindResolvedRouteData, x as addRouteBasePath } from "../resolution-CF1BqHLm.js";
+import { n as createRouteRegistry } from "../manifest-BNupb86f.js";
+import { c as route, n as resolveDeferredValues } from "../deferred-nGZglpj6.js";
+import { n as renderDocument } from "../ssr-DPfdcq0e.js";
+import { n as renderToString } from "../ssr-9LOx_bEu.js";
 import * as fs$1 from "node:fs/promises";
 import * as os from "node:os";
 import * as pathModule from "node:path";
@@ -130,9 +128,33 @@ function getOutputFilePath(pathStr) {
 	if (pathStr === "/") return "index.html";
 	return `${pathStr.replace(/^\/|\/$/g, "")}/index.html`;
 }
+/** Prefer normalized names while accepting legacy raw template keys. */
+function readRouteParameter(params, key) {
+	const normalized = key.trim();
+	const splat = normalized.startsWith("*");
+	const name = splat ? normalized.slice(1).trim() : normalized;
+	const canonical = params[name];
+	return {
+		name,
+		splat,
+		value: key === name || typeof canonical === "string" || Object.prototype.hasOwnProperty.call(params, name) ? canonical : params[key]
+	};
+}
 function interpolateRoutePath(routePath, params) {
 	if (!params) return routePath;
-	return routePath.replace(/\{([^}]+)\}/g, (_, key) => params[key] ?? "");
+	return routePath.replace(/\{([^}]+)\}/g, (_, key) => {
+		return readRouteParameter(params, key).value ?? "";
+	});
+}
+/** Encode the render URL while retaining the existing concrete output path. */
+function interpolateRouteUrl(routePath, params) {
+	assertSafeRoutePath(interpolateRoutePath(routePath, params));
+	if (!params) return routePath;
+	return routePath.replace(/\{([^}]+)\}/g, (_, key) => {
+		const { splat, value: parameterValue } = readRouteParameter(params, key);
+		const value = parameterValue ?? "";
+		return splat ? value.split("/").map(encodePathSegment).join("/") : encodePathSegment(value);
+	});
 }
 function resolveRouteDescriptor(route) {
 	const path = interpolateRoutePath(route.path, route.params);
@@ -240,9 +262,12 @@ function validateRoutes(routes) {
 		if (seen.has(key)) throw new Error(`duplicate route entry detected for path "${route.path}"`);
 		seen.add(key);
 		if (route.path.includes("{")) {
-			const paramNames = Array.from(route.path.matchAll(/\{([^}]+)\}/g)).map((m) => m[1]);
+			const paramKeys = route.path.split("/").filter((segment) => segment.startsWith("{") && segment.endsWith("}")).map((segment) => segment.slice(1, -1));
 			if (!route.params) throw new Error(`route "${route.path}" uses path parameters and requires params`);
-			for (const name of paramNames) if (!(name in route.params)) throw new Error(`route "${route.path}" missing required param "${name}"`);
+			for (const paramKey of paramKeys) {
+				const { name, value } = readRouteParameter(route.params, paramKey);
+				if (typeof value !== "string") throw new Error(`route "${route.path}" missing required param "${name}"`);
+			}
 		}
 	}
 }
@@ -268,10 +293,11 @@ async function batchRenderRoutes(routes, options = {}) {
 	}, { basePath: sharedBasePath }) : void 0;
 	const renderOne = async (route$2) => {
 		const startTime = performance.now();
-		const url = interpolateRoutePath(route$2.path, route$2.params);
+		const path = interpolateRoutePath(route$2.path, route$2.params);
+		const url = interpolateRouteUrl(route$2.path, route$2.params);
 		const publicUrl = addRouteBasePath(url, route$2.basePath ?? "");
 		const requestUrl = new URL(url, "http://localhost");
-		const resolvedData = resolveSsgRouteData(dataMap, route$2.path, url);
+		const resolvedData = resolveSsgRouteData(dataMap, route$2.path, path);
 		const baseData = resolvedData.hasData ? resolvedData.data : void 0;
 		const resourceCount = resolvedData.hasData && baseData ? Object.keys(baseData).length : 0;
 		const mergedHandler = route$2.handler;
@@ -344,8 +370,8 @@ async function batchRenderRoutes(routes, options = {}) {
 			});
 			const duration = performance.now() - startTime;
 			return {
-				path: url,
-				filePath: getOutputFilePath(url),
+				path,
+				filePath: getOutputFilePath(path),
 				html,
 				fileSize: Buffer.byteLength(html, "utf8"),
 				renderDuration: Math.round(duration),
@@ -357,8 +383,8 @@ async function batchRenderRoutes(routes, options = {}) {
 		} catch (error) {
 			const duration = performance.now() - startTime;
 			return {
-				path: url,
-				filePath: getOutputFilePath(url),
+				path,
+				filePath: getOutputFilePath(path),
 				html: "",
 				fileSize: 0,
 				renderDuration: Math.round(duration),
@@ -771,8 +797,6 @@ function routeRegistryToRouteConfigs(registry) {
 		routeConfigs.push({
 			path: record.path,
 			handler: getRenderHandler(record),
-			params: options.params,
-			props: options.props,
 			invalidationKeys: options.invalidationKeys ? [...options.invalidationKeys] : void 0,
 			namespace: options.namespace,
 			auth: options.auth,
@@ -873,9 +897,7 @@ function assembleRouteResults({ selected, renderedByRouteId, routeResultsById, d
 async function publishGeneration({ routeResults, nextManifestRoutes, effectiveMode, seed, concurrency, outputDir, assets, metadata }) {
 	const targetOutputDir = effectiveMode === "full" ? await createStagingDirectory(outputDir) : outputDir;
 	try {
-		const writeStartTime = performance.now();
 		await writeStaticFiles(routeResults, targetOutputDir, { concurrency });
-		performance.now() - writeStartTime;
 		await writeMetadata(metadata, targetOutputDir);
 		await writeIncrementalManifest({
 			schemaVersion: 1,
@@ -933,10 +955,10 @@ function createStaticGen(options) {
 				for (let index = 0; index < eligibleDescriptors.length; index += 1) {
 					const descriptor = eligibleDescriptors[index];
 					const entry = selectRouteForGeneration(descriptor, previousEntries.get(descriptor.routeId) ?? null, effectiveMode, changedKeys, changedRoutes);
+					if (entry.reason === "unchanged" && !outputFileExists(options.outputDir, descriptor.filePath)) entry.reason = "new-route";
 					selected.push(entry);
 					if (entry.reason !== "unchanged") routesToRender.push(entry);
 				}
-				const renderStartTime = performance.now();
 				const renderedResults = routesToRender.length > 0 ? await batchRenderRoutes(getRoutesToRender(routesToRender), {
 					seed,
 					dataMap,
@@ -944,7 +966,6 @@ function createStaticGen(options) {
 					document: options.document,
 					styleRegistrationValidation: options.styleRegistrationValidation
 				}) : [];
-				performance.now() - renderStartTime;
 				const renderedByRouteId = /* @__PURE__ */ new Map();
 				for (let index = 0; index < renderedResults.length; index += 1) renderedByRouteId.set(routesToRender[index].descriptor.routeId, renderedResults[index]);
 				const { cacheHits, nextManifestRoutes } = assembleRouteResults({

package/dist/ssr/index.d.ts

@@ -11,7 +11,6 @@ import {
   DocumentRenderArgs,
   Route,
   RouteRecord,
-  RouteRequestResult,
   ServerQueryRegistry,
   CoreTelemetry,
   AccessDenyDecision,
@@ -21,7 +20,7 @@ import {
   AccessRedirectDecision,
 } from '../core.js';
 import { JSXElement, Props } from '../elements.js';
-import { AuthContext } from '@askrjs/auth';
+import { AuthContext } from '../peer-types.js';
 declare const PAGE_RENDER_ENVELOPE_VERSION: 1;
 interface PageRenderEnvelope {
   readonly version: typeof PAGE_RENDER_ENVELOPE_VERSION;
@@ -36,6 +35,17 @@ declare class SSRDataMissingError extends Error {
   readonly code = 'SSR_DATA_MISSING';
   constructor(message?: string);
 }
+/**
+ * Thrown by synchronous route SSR (`renderToString()`/`renderToStream()`) when
+ * route auth or a policy redirects or denies the request. Nothing is rendered;
+ * send `decision` as the HTTP response (for example a 302 to `decision.to`, or
+ * `decision.status`).
+ */
+declare class SSRAccessDecisionError extends Error {
+  readonly code = 'SSR_ACCESS_DECISION';
+  readonly decision: AccessRedirectDecision | AccessDenyDecision;
+  constructor(decision: AccessRedirectDecision | AccessDenyDecision);
+}
 interface RenderContext {
   url: string;
   seed: number;
@@ -126,15 +136,6 @@ type RouteStreamOptions = RouteRenderOptions & {
   onChunk(html: string): void;
   onComplete(): void;
 };
-/** Resolve a URL against a route registry for SSR, applying auth/policies before render. */
-declare function resolveRequest(opts: {
-  url: string;
-  registry: RouteRegistry;
-  auth?: RouteAuthOptions;
-  authContext?: AuthContext;
-  request?: Request;
-  signal?: AbortSignal;
-}): Promise<RouteRequestResult>;
 /** VNode representation for SSR rendering */
 type VNode = {
   type: string | SSRComponent | symbol;
@@ -166,25 +167,11 @@ declare function renderToStringSync(
     envelope?: PageRenderEnvelope;
     cspNonce?: string;
     /** @internal Request-local authentication for deferred SSR passes. */
-    authContext?: import('@askrjs/auth').AuthContext;
+    authContext?: AuthContext;
     /** @internal Capture request-local registrations produced by this pass. */
     onContext?: (ctx: RenderContext) => void;
   }
 ): string;
-/** Synchronously render an already-resolved route handler to an HTML string. */
-declare function renderResolvedToStringSync(opts: {
-  url: string;
-  registry: RouteRegistry;
-  handler: RouteHandler;
-  params?: Record<string, string>;
-  options?: {
-    seed?: number;
-    data?: SSRData;
-    dataRuntime?: DataRuntime;
-    envelope?: PageRenderEnvelope;
-    cspNonce?: string;
-  };
-}): string;
 /** Options for {@link renderRouteRequest} and {@link renderRouteRequestToString}. */
 interface RenderRouteRequestOptions {
   url: string;
@@ -235,6 +222,17 @@ declare function renderToString(
   ) => VNode | JSXElement | string | number | null
 ): string;
 declare function renderToString(opts: RouteRenderOptions): string;
+/**
+ * Escape a string for interpolation into a hand-written HTML document template,
+ * either as text content or inside a quoted attribute value. Replaces `&`, `<`,
+ * `>`, `"` and `'` with character references. Use it for every request-derived
+ * value a `document` renderer interpolates, such as `context.pathname`,
+ * `context.params` or loader data. Do not use it for `appHtml`, which is
+ * already rendered markup, or inside `<script>`/`<style>` raw text.
+ * `null` and `undefined` render as an empty string; other values are
+ * converted with `String()`.
+ */
+declare function escapeHtml(value: unknown): string;
 /** Stream a route request's rendered HTML to the response sink described by `opts`. */
 declare function renderToStream(opts: RouteStreamOptions): void;
 export {
@@ -243,6 +241,7 @@ export {
   type DocumentRenderer,
   type RenderRouteRequestOptions,
   type RenderRouteRequestResult,
+  SSRAccessDecisionError,
   type SSRComponent,
   SSRDataMissingError,
   type SSRRoute,
@@ -250,14 +249,13 @@ export {
   type SSRStyleRegistrationValidation,
   type VNode,
   createRenderContext,
+  escapeHtml,
   getRenderContext,
-  renderResolvedToStringSync,
   renderRouteRequest,
   renderRouteRequestToString,
   renderToStream,
   renderToString,
   renderToStringSync,
-  resolveRequest,
   withRenderContext,
   withRenderContextAsync,
 };

package/dist/ssr/index.js

@@ -1,4 +1,4 @@
-import { C as SSRDataMissingError } from "../render-context-B7ohlh6t.js";
-import { c as createRenderContext, d as withRenderContext, f as withRenderContextAsync, i as renderToStringSync, l as getRenderContext, n as renderResolvedToStringSync } from "../render-resolved-BC0W7_5b.js";
-import { a as resolveRequest, i as renderRouteRequestToString, n as renderToString, r as renderRouteRequest, t as renderToStream } from "../ssr-CiNm6Vzl.js";
-export { SSRDataMissingError, createRenderContext, getRenderContext, renderResolvedToStringSync, renderRouteRequest, renderRouteRequestToString, renderToStream, renderToString, renderToStringSync, resolveRequest, withRenderContext, withRenderContextAsync };
+import { T as SSRDataMissingError } from "../render-context-DGHnEveC.js";
+import { a as SSRAccessDecisionError, i as renderRouteRequestToString, n as renderToString, r as renderRouteRequest, t as renderToStream } from "../ssr-9LOx_bEu.js";
+import { c as getRenderContext, d as escapeHtml, l as withRenderContext, n as renderToStringSync, s as createRenderContext, u as withRenderContextAsync } from "../render-sync-CUxvoVab.js";
+export { SSRAccessDecisionError, SSRDataMissingError, createRenderContext, escapeHtml, getRenderContext, renderRouteRequest, renderRouteRequestToString, renderToStream, renderToString, renderToStringSync, withRenderContext, withRenderContextAsync };

package/dist/{ssr-CiNm6Vzl.js → ssr-9LOx_bEu.js}

@@ -1,87 +1,64 @@
-import { P as isPromiseLike } from "./instance-VAFYVJOa.js";
-import { r as validateCspNonce } from "./csp-nonce-BfFWcd0w.js";
-import { t as createDataRuntime } from "./data-runtime-CxoY98lX.js";
-import { c as withTelemetry, t as createQueryPrefetchContext } from "./query-registry-LrYpQsDJ.js";
-import { a as resolveRouteRequest, n as getRouteRenderContext, o as resolvedRouteHasLoader } from "./resolution-3DskUkjG.js";
-import { c as removeRouteBasePath, s as normalizeRouteBasePath, t as _resolveRouteMatchFromRoutes } from "./route-matching-CUzZ31gT.js";
-import { n as renderDocument } from "./ssr-EPjwJH5R.js";
-import { a as serializeHydrationRenderData, c as createRenderContext, f as withRenderContextAsync, i as renderToStringSync, o as StreamSink, r as renderSSRRouteAppToSink, s as StringSink, u as throwSSRDataMissing } from "./render-resolved-BC0W7_5b.js";
+import { r as validateCspNonce } from "./csp-nonce-D-XM_uuJ.js";
+import { T as SSRDataMissingError, n as getActiveRenderContext, u as setDeferredBoundaryParent } from "./render-context-DGHnEveC.js";
+import { n as isPromiseLike } from "./promise-Dz8iIHAm.js";
+import { c as withTelemetry, i as dehydrateDataRuntime, t as createQueryPrefetchContext } from "./query-registry-tzSiVrV_.js";
+import { C as removeRouteBasePath, S as normalizeRouteBasePath, _ as getMatchingRouteRecord, a as resolveRouteRequest, n as getRouteRenderContext } from "./resolution-CF1BqHLm.js";
+import { t as createDataRuntime } from "./data-runtime-i-RD0Ffm.js";
+import { n as renderDocument } from "./ssr-DPfdcq0e.js";
+import { a as serializeHydrationRenderData, i as StringSink, n as renderToStringSync, o as withHydratedAuth, r as StreamSink, s as createRenderContext, t as renderSSRRouteAppToSink, u as withRenderContextAsync } from "./render-sync-CUxvoVab.js";
+//#region src/ssr/errors.ts
+/**
+* Thrown by synchronous route SSR (`renderToString()`/`renderToStream()`) when
+* route auth or a policy redirects or denies the request. Nothing is rendered;
+* send `decision` as the HTTP response (for example a 302 to `decision.to`, or
+* `decision.status`).
+*/
+var SSRAccessDecisionError = class SSRAccessDecisionError extends Error {
+	constructor(decision) {
+		super(decision.kind === "redirect" ? `SSR: route access redirected to ${decision.to}.` : `SSR: route access denied with status ${decision.status}.`);
+		this.code = "SSR_ACCESS_DECISION";
+		this.name = "SSRAccessDecisionError";
+		this.decision = decision;
+		Object.setPrototypeOf(this, SSRAccessDecisionError.prototype);
+	}
+};
+//#endregion
 //#region src/ssr/route-policy-resolution.ts
-const MAX_SSR_REDIRECTS = 20;
-function getRouteRequestResultSync(result) {
-	if (isPromiseLike(result)) throwSSRDataMissing();
+function getRouteRequestResultSync(result, href) {
+	if (isPromiseLike(result)) {
+		Promise.resolve(result).catch(() => void 0);
+		throw new SSRDataMissingError(`SSR: route resolution for ${href} is asynchronous (async auth, policy, lazy route, or preload). renderToString()/renderToStream() only resolve routes synchronously; use renderRouteRequest() to await route resolution.`);
+	}
 	return result;
 }
-function buildDeniedRoute(route, status) {
+function resolvePolicyAwareSSRRoute(opts, routeTable) {
+	const href = opts.url;
+	const logicalHref = removeRouteBasePath(href, normalizeRouteBasePath(opts.registry.manifest.basePath));
+	if (logicalHref === void 0) throw new Error(`SSR: no route found for url: ${href}`);
+	const matched = getMatchingRouteRecord(logicalHref, opts.registry.manifest.records);
+	const route = matched && routeTable.find((entry) => entry.handler === matched.record.handler);
+	if (!matched || !route) throw new Error(`SSR: no route found for url: ${href}`);
+	const { record } = matched;
+	if (typeof record.options.loader === "function") throw new SSRDataMissingError(`SSR: route ${record.path} declares a loader, which renderToString()/renderToStream() do not run. Use renderRouteRequest() to await route loaders before rendering.`);
+	const resolved = getRouteRequestResultSync(resolveRouteRequest(href, {
+		registry: opts.registry,
+		mode: "ssr",
+		auth: opts.auth,
+		authContext: opts.authContext,
+		request: opts.request,
+		signal: opts.signal,
+		load: false
+	}), href);
+	if (resolved === null) throw new Error(`SSR: no route found for url: ${href}`);
+	if (resolved.kind === "redirect" || resolved.kind === "deny") throw new SSRAccessDecisionError(resolved);
 	return {
-		...route,
-		handler: () => ({
-			type: "div",
-			props: { "data-route-denied": String(status) },
-			children: [String(status)]
-		})
+		route,
+		params: matched.params,
+		authContext: getRouteRenderContext(resolved)?.auth
 	};
 }
-function resolvePolicyAwareSSRRoute(opts, routeTable) {
-	const manifest = opts.registry.manifest;
-	let href = opts.url;
-	const visited = /* @__PURE__ */ new Set();
-	for (let redirects = 0; redirects <= MAX_SSR_REDIRECTS; redirects += 1) {
-		const logicalHref = removeRouteBasePath(href, normalizeRouteBasePath(manifest.basePath));
-		if (logicalHref === void 0) throw new Error(`SSR: no route found for url: ${href}`);
-		const logicalUrl = new URL(logicalHref, "http://localhost");
-		const matched = _resolveRouteMatchFromRoutes(logicalUrl.pathname, routeTable);
-		if (!matched) throw new Error(`SSR: no route found for url: ${href}`);
-		const resolved = getRouteRequestResultSync(resolveRouteRequest(href, {
-			registry: opts.registry,
-			mode: "ssr",
-			auth: opts.auth,
-			authContext: opts.authContext,
-			request: opts.request,
-			signal: opts.signal
-		}));
-		if (resolved === null) throw new Error(`SSR: no route found for url: ${href}`);
-		if (resolved.kind === "redirect") {
-			const redirectTarget = new URL(resolved.to, "http://localhost");
-			const redirectHref = `${redirectTarget.pathname}${redirectTarget.search}${redirectTarget.hash}`;
-			if (redirectHref === href || visited.has(redirectHref)) throw new Error(`[Askr] SSR redirect cycle detected at ${redirectHref}.`);
-			if (redirects >= MAX_SSR_REDIRECTS) throw new Error(`[Askr] SSR redirect limit exceeded (${MAX_SSR_REDIRECTS}).`);
-			visited.add(redirectHref);
-			href = redirectHref;
-			continue;
-		}
-		if (resolved.kind === "deny") return {
-			url: href,
-			route: buildDeniedRoute(matched.route, resolved.status),
-			params: matched.params
-		};
-		return {
-			url: href,
-			route: {
-				...matched.route,
-				handler: resolvedRouteHasLoader(resolved) ? resolved.handler : matched.route.handler
-			},
-			params: matched.params,
-			authContext: getRouteRenderContext(resolved)?.auth
-		};
-	}
-	throw new Error(`[Askr] SSR redirect limit exceeded (${MAX_SSR_REDIRECTS}).`);
-}
 //#endregion
 //#region src/ssr/route-render.ts
-/** Resolve a URL against a route registry for SSR, applying auth/policies before render. */
-async function resolveRequest(opts) {
-	if (!opts?.registry) throw new TypeError("resolveRequest requires opts.registry.");
-	const { url, auth, authContext, request, signal } = opts;
-	return await resolveRouteRequest(url, {
-		registry: opts.registry,
-		mode: "ssr",
-		auth,
-		authContext,
-		request,
-		signal
-	});
-}
 function resolveSSRRouteSource(source) {
 	if (source.registry.routes.length === 0) throw new Error("SSR requires a non-empty route registry.");
 	return source.registry.routes.map((route) => ({
@@ -96,9 +73,9 @@ function resolveSSRRouteRender(opts) {
 	const cspNonce = validateCspNonce(opts.cspNonce);
 	const routeTable = resolveSSRRouteSource(opts);
 	const resolvedRoute = resolvePolicyAwareSSRRoute(opts, routeTable);
-	const requestUrl = new URL(resolvedRoute.url, "http://localhost");
+	const requestUrl = new URL(opts.url, "http://localhost");
 	const ctx = createRenderContext(seed, {
-		url: resolvedRoute.url,
+		url: opts.url,
 		basePath: opts.registry.manifest.basePath,
 		data,
 		params: resolvedRoute.params,
@@ -111,8 +88,9 @@ function resolveSSRRouteRender(opts) {
 		envelope: opts.envelope,
 		cspNonce
 	});
+	if (!opts.envelope && ctx.hydrationData) ctx.hydrationData = withHydratedAuth(ctx.hydrationData, opts.auth ?? opts.registry.manifest.auth, resolvedRoute.authContext);
 	return {
-		url: resolvedRoute.url,
+		url: opts.url,
 		requestUrl,
 		route: resolvedRoute.route,
 		params: resolvedRoute.params,
@@ -209,17 +187,27 @@ function settleWithSignal(promise, signal) {
 function stripHydrationPayload(html) {
 	return html.replace(/<script type="application\/json" data-askr-render-data="true">[\s\S]*?<\/script>$/, "");
 }
-function renderBoundary(boundary, state, payload, seed, data, cspNonce, authContext) {
+function renderBoundary(boundary, state, payload, pass) {
 	const styles = [];
+	const boundaries = [];
 	return {
-		html: stripHydrationPayload(renderToStringSync(() => state === "fulfilled" ? boundary.fulfilled(payload) : boundary.rejected(payload), {}, {
-			seed,
-			envelope: data ?? void 0,
-			cspNonce,
-			authContext,
-			onContext: (context) => styles.push(...context.ssrStyles.values())
+		html: stripHydrationPayload(renderToStringSync(() => {
+			const context = getActiveRenderContext();
+			if (context) setDeferredBoundaryParent(context, boundary.id);
+			return state === "fulfilled" ? boundary.fulfilled(payload) : boundary.rejected(payload);
+		}, {}, {
+			seed: pass.seed,
+			envelope: pass.data ?? void 0,
+			cspNonce: pass.cspNonce,
+			authContext: pass.authContext,
+			route: pass.route,
+			onContext: (context) => {
+				styles.push(...context.ssrStyles.values());
+				boundaries.push(...context.deferredBoundaries);
+			}
 		})),
-		styles
+		styles,
+		boundaries
 	};
 }
 function escapeHtmlAttribute(value) {
@@ -232,13 +220,18 @@ function patchChunk(id, html, styles, cspNonce) {
 	const selector = `askr-resolve[data-askr-deferred=${JSON.stringify(id)}]`;
 	return `${styles.length === 0 ? "" : `<style data-askr-style-registry="true" data-askr-deferred-style="true"${cspNonce ? ` nonce="${escapeHtmlAttribute(cspNonce)}"` : ""}>${escapeStyleRawText(styles.map((style) => style.cssText).join("\n"))}\n</style>`}<template data-askr-deferred-patch="${escapeHtmlAttribute(id)}">${html}</template><script${cspNonce ? ` nonce="${escapeHtmlAttribute(cspNonce)}"` : ""} data-askr-deferred-apply="${escapeHtmlAttribute(id)}">(function(s){var t=s.previousElementSibling;var c=t&&t.previousElementSibling;var r=document.querySelector('style[data-askr-style-registry="true"]:not([data-askr-deferred-style])');if(c&&c.tagName==='STYLE'&&r&&r!==c){r.append(c.textContent||'');c.remove();}else if(c&&c.tagName==='STYLE'){c.removeAttribute('data-askr-deferred-style');}var b=document.querySelector(${JSON.stringify(selector)});if(b&&t){b.replaceWith(t.content.cloneNode(true));}if(t)t.remove();s.remove();})(document.currentScript)<\/script>`;
 }
-function createDeferredRenderStream(initialHtml, boundaries, signal, seed, data, runtime, cspNonce, authContext) {
+/**
+* Stream the shell, then one patch per boundary in the order boundaries
+* settle. A boundary whose content renders another pending `Resolve` queues
+* that nested boundary with the same request state; hydration data follows
+* once every boundary, nested ones included, has been patched.
+*/
+function createDeferredRenderStream(initialHtml, boundaries, signal, pass, runtime) {
 	const encoder = new TextEncoder();
 	const local = new AbortController();
 	let cancelled = false;
 	let closed = false;
-	let initialPending = true;
-	let boundaryIndex = 0;
+	let unsettled = 0;
 	let controllerRef;
 	const cleanup = () => signal.removeEventListener("abort", abort);
 	const close = (controller) => {
@@ -247,46 +240,51 @@ function createDeferredRenderStream(initialHtml, boundaries, signal, seed, data,
 		cleanup();
 		controller.close();
 	};
+	const fail = (controller, error) => {
+		if (closed) return;
+		closed = true;
+		cleanup();
+		local.abort(error);
+		controller.error(error);
+	};
 	const abort = () => {
 		local.abort(signal.reason);
 		if (controllerRef) close(controllerRef);
 	};
 	signal.addEventListener("abort", abort, { once: true });
+	const streamBoundary = (controller, boundary) => {
+		unsettled += 1;
+		settleWithSignal(boundary.promise, local.signal).then((value) => ({
+			state: "fulfilled",
+			payload: value
+		}), (error) => ({
+			state: "rejected",
+			payload: error
+		})).then(({ state, payload }) => {
+			if (cancelled || closed || local.signal.aborted) return;
+			try {
+				const rendered = renderBoundary(boundary, state, payload, pass);
+				controller.enqueue(encoder.encode(patchChunk(boundary.id, rendered.html, rendered.styles, pass.cspNonce)));
+				for (const nested of rendered.boundaries) streamBoundary(controller, nested);
+				unsettled -= 1;
+				if (unsettled > 0) return;
+				const hydration = serializeHydrationRenderData(pass.data ?? void 0, runtime);
+				if (hydration) controller.enqueue(encoder.encode(hydration));
+				close(controller);
+			} catch (error) {
+				fail(controller, error);
+			}
+		});
+	};
 	return new ReadableStream({
 		start(controller) {
 			controllerRef = controller;
-		},
-		async pull(controller) {
-			if (cancelled || closed) return;
-			if (initialPending) {
-				initialPending = false;
-				controller.enqueue(encoder.encode(stripHydrationPayload(initialHtml)));
+			if (signal.aborted) {
+				abort();
 				return;
 			}
-			const boundary = boundaries[boundaryIndex];
-			if (boundary) {
-				boundaryIndex += 1;
-				try {
-					const value = await settleWithSignal(boundary.promise, local.signal);
-					if (!cancelled && !closed) {
-						const rendered = renderBoundary(boundary, "fulfilled", value, seed, data, cspNonce, authContext);
-						controller.enqueue(encoder.encode(patchChunk(boundary.id, rendered.html, rendered.styles, cspNonce)));
-					}
-				} catch (error) {
-					if (local.signal.aborted) {
-						if (!cancelled && !closed) close(controller);
-						return;
-					}
-					if (!cancelled && !closed) {
-						const rendered = renderBoundary(boundary, "rejected", error, seed, data, cspNonce, authContext);
-						controller.enqueue(encoder.encode(patchChunk(boundary.id, rendered.html, rendered.styles, cspNonce)));
-					}
-				}
-				return;
-			}
-			const hydration = serializeHydrationRenderData(data ?? void 0, runtime);
-			if (hydration) controller.enqueue(encoder.encode(hydration));
-			close(controller);
+			controller.enqueue(encoder.encode(stripHydrationPayload(initialHtml)));
+			for (const boundary of boundaries) streamBoundary(controller, boundary);
 		},
 		cancel(reason) {
 			cancelled = true;
@@ -350,6 +348,7 @@ async function renderRouteRequestInternal(options) {
 		if (!resolved) return { kind: "no-match" };
 		if (resolved.kind !== "render") return resolved;
 		context.params = resolved.params;
+		if (context.hydrationData) context.hydrationData = withHydratedAuth(context.hydrationData, options.auth ?? manifest.auth, context.authContext);
 		const sink = new StringSink();
 		renderSSRRouteAppToSink({
 			route: {
@@ -364,11 +363,23 @@ async function renderRouteRequestInternal(options) {
 		sink.end();
 		const html = sink.toString();
 		const boundaries = [...context.deferredBoundaries];
+		if (boundaries.length > 0) dehydrateDataRuntime(runtime);
 		const result = {
 			kind: "render",
 			html,
 			styles: Array.from(context.ssrStyles.values()),
-			...boundaries.length > 0 ? { stream: createDeferredRenderStream(html, boundaries, signal, options.seed, context.hydrationData, runtime, cspNonce, context.authContext) } : {},
+			...boundaries.length > 0 ? { stream: createDeferredRenderStream(html, boundaries, signal, {
+				seed: options.seed,
+				data: context.hydrationData,
+				cspNonce,
+				authContext: context.authContext,
+				route: {
+					url: context.url,
+					routes: context.routes,
+					basePath: context.basePath,
+					params: context.params
+				}
+			}, runtime) } : {},
 			params: resolved.params
 		};
 		if (resolved.record) Object.defineProperty(result, "record", {
@@ -390,4 +401,4 @@ function renderToStream(opts) {
 	renderRouteToStream(opts, routeRenderHost);
 }
 //#endregion
-export { resolveRequest as a, renderRouteRequestToString as i, renderToString as n, renderRouteRequest as r, renderToStream as t };
+export { SSRAccessDecisionError as a, renderRouteRequestToString as i, renderToString as n, renderRouteRequest as r, renderToStream as t };