René's URL Explorer Experiment

Title: SSR: hydration mismatch detection, suspense streaming, router/store integration, resumability, cross-runtime CI by Copilot · Pull Request #85 · bQuery/bQuery · GitHub

Open Graph Title: SSR: hydration mismatch detection, suspense streaming, router/store integration, resumability, cross-runtime CI by Copilot · Pull Request #85 · bQuery/bQuery

X Title: SSR: hydration mismatch detection, suspense streaming, router/store integration, resumability, cross-runtime CI by Copilot · Pull Request #85 · bQuery/bQuery

Description: Completes the runtime-agnostic SSR roadmap by landing the items that were previously marked out-of-scope: hydration mismatch dev-warnings, out-of-order Suspense streaming, deep router/store integration, resumability hooks, plus a Node 24 / Bun 1.3 / Deno 2 CI matrix and matching example servers. All additions are additive — existing public APIs are byte-compatible. Hydration mismatch detection RenderOptions.annotateHydration emits data-bq-h="" on every directive element from both renderer backends, using a shared cheapHash over the directive signature. verifyHydration(root, opts?) walks [data-bq-h] on the client, recomputes the hash, and reports HydrationMismatch[] (dev-warns by default, silent in production). Suspense streaming renderToStreamSuspense(template, data, opts?) flushes a synchronous shell with defer(...) fallbacks wrapped in … (uses bq-defer="key" markers when present, auto-appends placeholders otherwise), then streams + a tiny CSP-nonce-aware patch script per resolved promise. Honours AbortSignal, escapes resolved HTML, surfaces loader errors via SSRContext.reportError. Slot ID prefix is whitelisted to [A-Za-z][\w-]* as defense-in-depth on top of escapeScriptBody(). Follow-up security hardening from review feedback: the streamed patch script body is now fully static, while per-patch slot/template IDs are passed through escaped data-bq-slot / data-bq-template attributes on the -safe escaping. Cross-runtime CI + examples .github/workflows/ssr-cross-runtime.yml builds the library once with Bun and runs tests/cross-runtime/run.mjs against Node 24, Bun 1.3 and Deno 2. examples/ssr-{bun,deno,node}/serve.ts are minimal HTTP servers sharing examples/shared/app.ts, demonstrating the same resolveSSRRoute → createSSRRouterContext → renderToResponse flow on each runtime. Node adapter hardening from review feedback: malformed Host headers now fall back safely to localhost during URL construction, and createNodeHandler(handler, { maxBodyBytes }) can reject oversized buffered request bodies with HTTP 413. Notes for reviewers The GitHub Advanced Security findings raised during review were addressed: the Suspense patching path no longer constructs inline code from interpolated IDs the hydration tests no longer use an HTML→DOM sink to build fixtures Additional review follow-ups addressed in the latest state: structural Suspense marker wrapping now reuses the SSR HTML parser instead of regex matching Node adapter buffering can now be bounded with an optional byte limit and no longer crashes on malformed Host headers Validation is green on the latest state: bun run lint, bun run lint:types, bun test, bun run build, and CodeQL reports 0 alerts for the updated changes.

Open Graph Description: Completes the runtime-agnostic SSR roadmap by landing the items that were previously marked out-of-scope: hydration mismatch dev-warnings, out-of-order Suspense streaming, deep router/store integra...

X Description: Completes the runtime-agnostic SSR roadmap by landing the items that were previously marked out-of-scope: hydration mismatch dev-warnings, out-of-order Suspense streaming, deep router/store integra...

Opengraph URL: https://github.com/bQuery/bQuery/pull/85

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width