diff --git a/package-lock.json b/package-lock.json
index 506b01a..de1ad8d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,18 +1,18 @@
 {
   "name": "@askrjs/testing",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@askrjs/testing",
-      "version": "0.2.1",
+      "version": "0.3.0",
       "license": "Apache-2.0",
       "dependencies": {
         "tough-cookie": "^6.0.2"
       },
       "devDependencies": {
-        "@askrjs/server": ">=0.2.1 <0.3.0",
+        "@askrjs/server": ">=0.3.0 <0.4.0",
         "@vitest/coverage-v8": "^4.1.11",
         "publint": "^0.3.24",
         "typescript": "^7.0.2",
@@ -24,24 +24,24 @@
       }
     },
     "node_modules/@askrjs/auth": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/@askrjs/auth/-/auth-0.2.1.tgz",
-      "integrity": "sha512-kGFIqQi0KTe1sv2KCiLaiQpISWNpxfvZcmmqsB3nyRUim4sEKuNW1vUrWR6ItDqKmwsaWPycjPU7yQ2ha9lPZg==",
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@askrjs/auth/-/auth-0.3.0.tgz",
+      "integrity": "sha512-1w88+zlOvwY8n7fQrQtOPH5WYoSSQHQpPpInkwlOihMDCOIBlAAo913vv1Qs+kXOKCMQLtc3BqMoL2YzpxnQrw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@xmldom/xmldom": "0.9.10",
+        "@xmldom/xmldom": "0.9.12",
         "xml-crypto": "6.1.2",
-        "xml-encryption": "5.0.0"
+        "xml-encryption": "6.0.1"
       },
       "engines": {
         "node": ">=24.0.0"
       }
     },
     "node_modules/@askrjs/schema": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/@askrjs/schema/-/schema-0.2.1.tgz",
-      "integrity": "sha512-2pd+CBpJomTYHQWajEyF5kVH3U9PrqtoEh1YsoGA0bBoDfERpYISdnrojX7OY5ue9cn2T2/33RnbLnvTv8AGvw==",
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@askrjs/schema/-/schema-0.3.0.tgz",
+      "integrity": "sha512-l7oVbZBQE91wPbQTPZU5wISnw8uIrms9OeZDEVdTlZg3JuTvxPuxB7D2WZt8kVj9d35jBLJcXRQkozsLPztR1Q==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -49,20 +49,20 @@
       }
     },
     "node_modules/@askrjs/server": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/@askrjs/server/-/server-0.2.1.tgz",
-      "integrity": "sha512-Gk0nvYdm2OgbjvNFMZ2ooMUAvekqKfDhZ/RqBCWY0goalL5hd7V/yBdVw1uCssn7TLpCXgDowKv73HyONGV2hQ==",
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@askrjs/server/-/server-0.3.0.tgz",
+      "integrity": "sha512-Bk5ZmANnW45pgeHBgrWnGBz6xXkMQxtOgwGQXdzdCufed1w5IUQCvRvjNDkPQ2Rv/z3NofTF5IYqE/vQL+XPoQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@askrjs/auth": ">=0.2.0 <0.3.0",
-        "@askrjs/schema": ">=0.2.0 <0.3.0"
+        "@askrjs/auth": ">=0.3.0 <0.4.0",
+        "@askrjs/schema": ">=0.3.0 <0.4.0"
       },
       "engines": {
         "node": ">=24.0.0"
       },
       "peerDependencies": {
-        "@askrjs/askr": ">=0.2.0 <0.3.0"
+        "@askrjs/askr": ">=0.3.0 <0.4.0"
       },
       "peerDependenciesMeta": {
         "@askrjs/askr": {
@@ -2068,10 +2068,9 @@
       }
     },
     "node_modules/@xmldom/xmldom": {
-      "version": "0.9.10",
-      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.10.tgz",
-      "integrity": "sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==",
-      "deprecated": "this version has critical issues, please update to the latest version",
+      "version": "0.9.12",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.12.tgz",
+      "integrity": "sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3945,15 +3944,14 @@
       }
     },
     "node_modules/xml-encryption": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/xml-encryption/-/xml-encryption-5.0.0.tgz",
-      "integrity": "sha512-9XUEdUcXiim15WsQ37P+z0CD3uTytLoWoGL/PhRqA5ZqmDhKMtiyMJcn1pT1+kBBtCTSqBaiPs+ILdiD7nQuQA==",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/xml-encryption/-/xml-encryption-6.0.1.tgz",
+      "integrity": "sha512-hQSkWsiOKXxYB8FbSJhe/BRwobEt/lVcxzV699CdH7KLNv2nLEtNvkGkw5UTxYUkPQ3XQs65BvXtRfujJ/1OFA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@xmldom/xmldom": "^0.8.13",
-        "escape-html": "^1.0.3",
-        "xpath": "0.0.32"
+        "escape-html": "^1.0.3"
       }
     },
     "node_modules/xml-encryption/node_modules/@xmldom/xmldom": {
@@ -3966,16 +3964,6 @@
         "node": ">=10.0.0"
       }
     },
-    "node_modules/xml-encryption/node_modules/xpath": {
-      "version": "0.0.32",
-      "resolved": "https://registry.npmjs.org/xpath/-/xpath-0.0.32.tgz",
-      "integrity": "sha512-rxMJhSIoiO8vXcWvSifKqhvV96GjiD5wYb8/QHdoRyQvraTpp4IEv944nhGausZZ3u7dhQXteZuZbaqfpB7uYw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.6.0"
-      }
-    },
     "node_modules/xpath": {
       "version": "0.0.33",
       "resolved": "https://registry.npmjs.org/xpath/-/xpath-0.0.33.tgz",
diff --git a/package.json b/package.json
index 549ae98..482bea1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@askrjs/testing",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Transport-neutral request injection and HTTP testing utilities for Askr applications.",
   "keywords": [
     "askr",
@@ -59,7 +59,7 @@
     "tough-cookie": "^6.0.2"
   },
   "devDependencies": {
-    "@askrjs/server": ">=0.2.1 <0.3.0",
+    "@askrjs/server": ">=0.3.0 <0.4.0",
     "@vitest/coverage-v8": "^4.1.11",
     "publint": "^0.3.24",
     "typescript": "^7.0.2",
diff --git a/tests/testing.test.ts b/tests/testing.test.ts
index eb9edfb..9ca87c6 100644
--- a/tests/testing.test.ts
+++ b/tests/testing.test.ts
@@ -1,4 +1,4 @@
-import { createServerApp, json } from "@askrjs/server";
+import { createRouter, createServerApp, json } from "@askrjs/server";
 import { describe, expect, it } from "vitest";
 import {
   createTestClient,
@@ -21,15 +21,11 @@ const echo: RequestTarget = {
 
 describe("native injection", () => {
   it("should exercise real Askr routes and return the exact Response", async () => {
-    const app = createServerApp({
-      routes: [
-        {
-          method: "POST",
-          path: "/items/{id}",
-          handler: async ({ bind, params }) => json({ id: params.id, input: await bind() }),
-        },
-      ],
-    });
+    const router = createRouter();
+    router.post("/items/{id}", async ({ bind, params }) =>
+      json({ id: params.id, input: await bind() }),
+    );
+    const app = createServerApp({ router });
     expect(
       await (await inject(app, "/items/42", { method: "POST", json: { active: true } })).json(),
     ).toEqual({ id: "42", input: { id: "42", active: true } });