@absolutejs/absolute 0.20.0-beta.172 → 0.20.0-beta.173

package/CHANGELOG.md

@@ -6,6 +6,38 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.20.0-beta.173 — 2026-11-14
+
+### Security
+
+- **Island pages no longer expose server file paths in production**
+  In production, a React page that rendered an <Island> could put absolute paths from the server’s disk (server-rendered pages, server bundles and static HTML pages) into the manifest it embeds for the browser, exposing the server’s file layout. The manifest embedded in island pages now contains only browser URLs, whichever framework renders the page. No code changes are needed; rebuild and redeploy to pick up the fix.
+- **Vue lazy route components no longer reveal the build machine’s file paths**
+  A Vue page that exports `routes` and lazily loads a route component shipped the build machine’s absolute project path to every browser: the lazy component’s file name, and the imports of it in the router page and a shared chunk, read like `vue/client/sources/%2F/home/you/app/src/frontend/vue/components/Lazy.<hash>.js`. Compiled Vue files are now named by their path inside the project, such as `vue/client/sources/src/frontend/vue/components/Lazy.<hash>.js`, in both the browser and the server build. A Vue file outside the project, such as a package in a parent `node_modules` or a sibling workspace, is placed under `_external/` and named only by its path below the folder it shares with the project, or by a hash when that folder is the filesystem root. Rebuild and redeploy to stop serving the old paths.
+
+### Changed
+
+- **React pages stream SuspenseSlot and StreamSlot content without opting in** (`handleReactPageRequest`)
+  A React page that rendered a `<SuspenseSlot>` or `<StreamSlot>` only streamed when its handler passed `collectStreamingSlots: true`. Without it the slot stayed on its fallback forever, and production logged nothing. `handleReactPageRequest` and the React Server Components page handler now collect streaming slots by default, so the shell arrives first and each slot's content streams in when it resolves. A page that renders no slot gets the same bytes and headers as before, with no measurable extra work. Pass `collectStreamingSlots: false` to turn collection off for a route; a slot rendered there logs a warning naming that option, once per render in development and once per process in production. Svelte, Vue and Angular handlers still need `collectStreamingSlots: true`, and their warning about the missing option now shows in production too.
+
+### Fixed
+
+- **Angular `@defer` sections stay on the page after hydration**
+  An Angular page with `@defer` blocks streamed its deferred sections correctly, then lost them once the browser hydrated the page, in dev and in production. The browser logged `ReferenceError: process is not defined` from the defer slot, and dev also logged an NG0100 error. The defer slot no longer runs its server-only streaming setup in the browser, and the NODE_ENV check that streaming slots share no longer throws where there is no `process`, which also protects Svelte and Vue streaming slots that reach the browser. Deferred sections now stay resolved after hydration, with no console errors.
+- **Editing a module server.ts imports updates the dev server again**
+  In dev, editing a server module that server.ts imports, such as the api.ts a create-absolutejs app passes to .use(), updates the running server in place again: the new route responses are served without a restart, and scopedState keeps every visitor’s state. Before, when the project’s folder path contained "angular" (or "ember"), the edit was mistaken for an Angular component and sent to Angular HMR, or silently dropped when Angular was not configured, and the old response kept being served until dev restarted, even after later server.ts edits. A .ts file outside every configured framework directory is now always treated as server or shared code, and a server.ts edit also applies any imported module whose file changed but whose update never arrived.
+- **Dev serves source files whose paths contain spaces**
+  The dev module server now decodes the percent-encoding a browser adds to module URLs. Before, a source file whose path contained a space or another encoded character, such as a project or linked package inside a folder named "Local Documents", was requested as `%20` and answered with a 500, so the page failed to hydrate in `absolute dev`.
+- **absolute doctor reports a busy dev port as in use**
+  absolute doctor could say the dev port was free while another server was listening on it, most visibly on macOS, where its process lookup failed silently and found no listeners. It now checks the port directly: it tries to connect over IPv4 and IPv6 loopback and to bind the IPv4 and IPv6 wildcard addresses separately, so a listener on either family or on both is reported as in use. The port it checks is resolved the same way as absolute dev (ABSOLUTE_PORT, then PORT, then dev.port in absolute.config.ts, then the default), and the check also runs when the config file cannot be loaded.
+- **Builds that import react/router without react-router installed explain why, and point to a Link that needs no router**
+  Importing `<Link>` from `@absolutejs/absolute/react/router` in a project without the optional `react-router` package failed the build with a bare `Could not resolve: "react-router"`. That entry also exports `<UniversalRouter>`, which is built on react-router, so it does need the package. The build now says so, tells you to install react-router for `<UniversalRouter>`, and points to `import { Link } from '@absolutejs/absolute/react/components'`: the same `<Link>`, with no react-router dependency, whose clicks `enableNavigation()` turns into soft page navigations. A react-router import in your own code without the package installed gets the same advice.
+
+### Internal
+
+- **DeferSlotComponent’s declaration gains a private member** (`DeferSlotComponent`)
+  The published type declaration of `DeferSlotComponent` lists a new private member, used to tell the server render from the browser. Nothing about how the component is used in templates changed.
+
 ## 0.20.0-beta.172 — 2026-11-13
 
 ### Changed

package/README.md

@@ -165,8 +165,9 @@ the dynamic slots are rendered and streamed into it:
 />
 ```
 
-In Svelte, use the `dynamic` prop or `<!-- absolute:stream dynamic -->`. The
-page needs `collectStreamingSlots: true`. The shell's page props are captured
+In Svelte, use the `dynamic` prop or `<!-- absolute:stream dynamic -->`. Svelte
+pages need `collectStreamingSlots: true`; React pages collect streaming slots
+by default (pass `collectStreamingSlots: false` to turn it off). The shell's page props are captured
 at build time, so per-user data belongs in dynamic slots. Works for React
 and Svelte pages today. See `docs/PARTIAL_PRERENDERING_PLAN.md`.
 

package/changelog.json

@@ -2,6 +2,63 @@
 	"contract": 1,
 	"name": "@absolutejs/absolute",
 	"releases": [
+		{
+			"changes": [
+				{
+					"detail": "An Angular page with `@defer` blocks streamed its deferred sections correctly, then lost them once the browser hydrated the page, in dev and in production. The browser logged `ReferenceError: process is not defined` from the defer slot, and dev also logged an NG0100 error. The defer slot no longer runs its server-only streaming setup in the browser, and the NODE_ENV check that streaming slots share no longer throws where there is no `process`, which also protects Svelte and Vue streaming slots that reach the browser. Deferred sections now stay resolved after hydration, with no console errors.",
+					"kind": "fixed",
+					"summary": "Angular `@defer` sections stay on the page after hydration"
+				},
+				{
+					"detail": "In dev, editing a server module that server.ts imports, such as the api.ts a create-absolutejs app passes to .use(), updates the running server in place again: the new route responses are served without a restart, and scopedState keeps every visitor’s state. Before, when the project’s folder path contained \"angular\" (or \"ember\"), the edit was mistaken for an Angular component and sent to Angular HMR, or silently dropped when Angular was not configured, and the old response kept being served until dev restarted, even after later server.ts edits. A .ts file outside every configured framework directory is now always treated as server or shared code, and a server.ts edit also applies any imported module whose file changed but whose update never arrived.",
+					"kind": "fixed",
+					"summary": "Editing a module server.ts imports updates the dev server again"
+				},
+				{
+					"detail": "The published type declaration of `DeferSlotComponent` lists a new private member, used to tell the server render from the browser. Nothing about how the component is used in templates changed.",
+					"kind": "internal",
+					"summary": "DeferSlotComponent’s declaration gains a private member",
+					"symbols": [
+						"DeferSlotComponent"
+					]
+				},
+				{
+					"detail": "The dev module server now decodes the percent-encoding a browser adds to module URLs. Before, a source file whose path contained a space or another encoded character, such as a project or linked package inside a folder named \"Local Documents\", was requested as `%20` and answered with a 500, so the page failed to hydrate in `absolute dev`.",
+					"kind": "fixed",
+					"summary": "Dev serves source files whose paths contain spaces"
+				},
+				{
+					"detail": "absolute doctor could say the dev port was free while another server was listening on it, most visibly on macOS, where its process lookup failed silently and found no listeners. It now checks the port directly: it tries to connect over IPv4 and IPv6 loopback and to bind the IPv4 and IPv6 wildcard addresses separately, so a listener on either family or on both is reported as in use. The port it checks is resolved the same way as absolute dev (ABSOLUTE_PORT, then PORT, then dev.port in absolute.config.ts, then the default), and the check also runs when the config file cannot be loaded.",
+					"kind": "fixed",
+					"summary": "absolute doctor reports a busy dev port as in use"
+				},
+				{
+					"detail": "In production, a React page that rendered an <Island> could put absolute paths from the server’s disk (server-rendered pages, server bundles and static HTML pages) into the manifest it embeds for the browser, exposing the server’s file layout. The manifest embedded in island pages now contains only browser URLs, whichever framework renders the page. No code changes are needed; rebuild and redeploy to pick up the fix.",
+					"kind": "security",
+					"summary": "Island pages no longer expose server file paths in production"
+				},
+				{
+					"detail": "Importing `<Link>` from `@absolutejs/absolute/react/router` in a project without the optional `react-router` package failed the build with a bare `Could not resolve: \"react-router\"`. That entry also exports `<UniversalRouter>`, which is built on react-router, so it does need the package. The build now says so, tells you to install react-router for `<UniversalRouter>`, and points to `import { Link } from '@absolutejs/absolute/react/components'`: the same `<Link>`, with no react-router dependency, whose clicks `enableNavigation()` turns into soft page navigations. A react-router import in your own code without the package installed gets the same advice.",
+					"kind": "fixed",
+					"summary": "Builds that import react/router without react-router installed explain why, and point to a Link that needs no router"
+				},
+				{
+					"detail": "A React page that rendered a `<SuspenseSlot>` or `<StreamSlot>` only streamed when its handler passed `collectStreamingSlots: true`. Without it the slot stayed on its fallback forever, and production logged nothing. `handleReactPageRequest` and the React Server Components page handler now collect streaming slots by default, so the shell arrives first and each slot's content streams in when it resolves. A page that renders no slot gets the same bytes and headers as before, with no measurable extra work. Pass `collectStreamingSlots: false` to turn collection off for a route; a slot rendered there logs a warning naming that option, once per render in development and once per process in production. Svelte, Vue and Angular handlers still need `collectStreamingSlots: true`, and their warning about the missing option now shows in production too.",
+					"kind": "changed",
+					"summary": "React pages stream SuspenseSlot and StreamSlot content without opting in",
+					"symbols": [
+						"handleReactPageRequest"
+					]
+				},
+				{
+					"detail": "A Vue page that exports `routes` and lazily loads a route component shipped the build machine’s absolute project path to every browser: the lazy component’s file name, and the imports of it in the router page and a shared chunk, read like `vue/client/sources/%2F/home/you/app/src/frontend/vue/components/Lazy.<hash>.js`. Compiled Vue files are now named by their path inside the project, such as `vue/client/sources/src/frontend/vue/components/Lazy.<hash>.js`, in both the browser and the server build. A Vue file outside the project, such as a package in a parent `node_modules` or a sibling workspace, is placed under `_external/` and named only by its path below the folder it shares with the project, or by a hash when that folder is the filesystem root. Rebuild and redeploy to stop serving the old paths.",
+					"kind": "security",
+					"summary": "Vue lazy route components no longer reveal the build machine’s file paths"
+				}
+			],
+			"date": "2026-11-14",
+			"version": "0.20.0-beta.173"
+		},
 		{
 			"changes": [
 				{

package/dist/angular/browser.js

@@ -9088,9 +9088,6 @@ var require_cjs = __commonJS(function(exports) {
   } });
 });
 
-// src/utils/runtimeMode.ts
-var ENV_VAR = "NODE_ENV", getNodeEnv = () => process.env[ENV_VAR], isDevelopmentRuntime = () => process.env[ENV_VAR] === "development", isProductionRuntime = () => process.env[ENV_VAR] === "production";
-
 // src/constants.ts
 var ANGULAR_INIT_TIMEOUT_MS = 500, ANSI_ESCAPE_CODE = 27, ANSI_ESCAPE_LENGTH = 3, ASCII_SPACE = 32, BASE_36_RADIX = 36, BUN_BUILD_WARNING_SUPPRESSION = "wildcard sideEffects are not supported yet", TAILWIND_BUN_CSS_WARNING_PATTERN, BODY_SLICE_LENGTH = 2000, BYTES_PER_KILOBYTE = 1024, CLI_ARGS_OFFSET = 3, CSS_ERROR_RESOLVE_DELAY_MS = 50, CSS_MAX_CHECK_ATTEMPTS = 10, CSS_MAX_PARSE_TIMEOUT_MS = 500, CSS_RELOAD_BACKOFF_BASE_MS = 1000, CSS_RELOAD_BACKOFF_MAX_MS = 60000, CSS_SHEET_READY_TIMEOUT_MS = 100, DEFAULT_CHUNK_SIZE = 16384, DEFAULT_DEBOUNCE_MS = 15, DEFAULT_PORT = 3000, DEV_SERVER_RESTART_DEBOUNCE_MS = 100, DOM_UPDATE_DELAY_MS = 50, FILE_PROTOCOL_PREFIX_LENGTH = 7, FOCUS_ID_PREFIX_LENGTH = 3, FOCUS_IDX_PREFIX_LENGTH = 4, FOCUS_NAME_PREFIX_LENGTH = 5, ESLINT_STUDIO_DEFAULT_HOST = "eslint.absolute.localhost", ESLINT_STUDIO_DEFAULT_PORT = 4099, CONFIG_DEFAULT_HOST = "config.absolute.localhost", CONFIG_DEFAULT_PORT = 4099, HMR_UPDATE_TIMEOUT_MS = 2000, HOOK_SIGNATURE_LENGTH = 12, EXCLUDE_LAST_OFFSET = -1, HTTP_STATUS_OK = 200, HTTP_STATUS_BAD_REQUEST = 400, HTTP_STATUS_NOT_FOUND = 404, HTTP_STATUS_GONE = 410, HTTP_STATUS_INTERNAL_SERVER_ERROR = 500, HOURS_IN_DAY = 24, HOURS_IN_HALF_DAY = 12, IMAGE_DEFAULT_DEVICE_SIZES, IMAGE_DEFAULT_IMAGE_SIZES, IMAGE_DEFAULT_QUALITY = 75, IMAGE_GLOB_SUFFIX_LENGTH = 2, INSTANCE_PROBE_TIMEOUT_MS = 250, MAX_ERROR_LENGTH = 200, MAX_RECONNECT_ATTEMPTS = 60, MILLISECONDS_IN_A_SECOND = 1000, MINUTES_IN_AN_HOUR = 60, SECONDS_IN_A_MINUTE = 60, MILLISECONDS_IN_A_MINUTE, MILLISECONDS_IN_A_DAY, OVERLAY_FADE_DURATION_MS = 150, PING_INTERVAL_MS = 30000, LIST_LOG_TAIL_MAX_BYTES = 65536, LIST_TUI_COLUMN_GAP = 2, LIST_TUI_DEFAULT_HEIGHT = 28, LIST_TUI_DEFAULT_WIDTH = 100, LIST_TUI_ESCAPE_SEQUENCE_TIMEOUT_MS = 30, LIST_TUI_FOOTER_LINE_COUNT = 2, LIST_TUI_MARKER_WIDTH = 2, LIST_TUI_MIN_LOG_HEIGHT = 3, LIST_TUI_MIN_URL_WIDTH = 16, LIST_TUI_RENDER_DEBOUNCE_MS = 16, LIST_TUI_STATUS_MESSAGE_TIMEOUT_MS = 4000, LIST_WATCH_REFRESH_MS = 1000, RAF_BATCH_COUNT = 3, RANDOM_ID_END_INDEX = 11, REBUILD_BATCH_DELAY_MS = 10, REBUILD_RELOAD_DELAY_MS = 200, RECONNECT_INITIAL_DELAY_MS = 500, RECONNECT_POLL_INTERVAL_MS = 300, REACT_STREAM_SLOT_FAST_DELAY_MS = 5, REACT_STREAM_SLOT_SLOW_DELAY_MS = 20, SIGINT_EXIT_CODE = 130, SIGTERM_EXIT_CODE = 143, SVELTE_CSS_LOAD_TIMEOUT_MS = 500, TIME_PRECISION = 2, TWO_THIRDS, UNFOUND_INDEX = -1, WEBSOCKET_NORMAL_CLOSURE = 1000, DEFAULT_WEBSOCKET_IDLE_TIMEOUT_SECONDS = 240, DEFAULT_HTTP_IDLE_TIMEOUT_SECONDS = 240, MAX_HTTP_IDLE_TIMEOUT_SECONDS = 255, WORKSPACE_COMMAND_ARGS_OFFSET = 3, WORKSPACE_FAILURE_LOG_PRINT_LIMIT = 30, WORKSPACE_FAILURE_RECENT_LOG_LIMIT = 60, WORKSPACE_READY_ATTEMPT_TIMEOUT_MS = 5000, WORKSPACE_READY_PROBE_INTERVAL_MS = 250, WORKSPACE_READY_TIMEOUT_MS = 30000, WORKSPACE_SHUTDOWN_TIMEOUT_MS = 1e4, WORKSPACE_TUI_DEFAULT_HEIGHT = 28, WORKSPACE_TUI_DEFAULT_WIDTH = 100, WORKSPACE_TUI_ESCAPE_SEQUENCE_TIMEOUT_MS = 30, WORKSPACE_TUI_FOOTER_LINE_COUNT = 3, WORKSPACE_TUI_MIN_LOG_HEIGHT = 3, WORKSPACE_TUI_MIN_SERVICE_NAME_WIDTH = 7, WORKSPACE_TUI_MIN_TARGET_WIDTH = 8, WORKSPACE_TUI_MIN_WRAP_WIDTH = 12, WORKSPACE_TUI_PROMPT_CURSOR_OFFSET = 3, WORKSPACE_TUI_RECENT_LOG_LIMIT = 40, WORKSPACE_TUI_RENDER_DEBOUNCE_MS = 16, WORKSPACE_TUI_STATUS_WIDTH = 10, WORKSPACE_TUI_TARGET_PADDING_WIDTH = 6, WORKSPACE_TUI_VISIBILITY_WIDTH = 8;
 var init_constants = __esm(() => {
@@ -9832,9 +9829,10 @@ import {
   ContentChild,
   Input as Input2,
   inject as inject8,
+  PLATFORM_ID,
   signal as signal2
 } from "@angular/core";
-import { NgTemplateOutlet } from "@angular/common";
+import { isPlatformServer, NgTemplateOutlet } from "@angular/common";
 
 // src/core/streamingSlotRegistrar.ts
 var STREAMING_SLOT_REGISTRAR_KEY = Symbol.for("absolutejs.streamingSlotRegistrar");
@@ -9877,7 +9875,7 @@ var setStreamingSlotWarningController = (controller) => {
   Reflect.set(globalThis, STREAMING_SLOT_WARNING_STORAGE_KEY, controller);
 };
 var warnMissingStreamingSlotCollector = (primitiveName) => {
-  if (isProductionRuntime() || isStreamingSlotCollectionActive()) {
+  if (isStreamingSlotCollectionActive()) {
     return;
   }
   getWarningController()?.maybeWarn(primitiveName);
@@ -9936,6 +9934,7 @@ DeferResolvedTemplateDirective = __legacyDecorateClassTS([
 class DeferSlotComponent {
   constructor() {
     this.cdr = inject8(ChangeDetectorRef2);
+    this.isServer = isPlatformServer(inject8(PLATFORM_ID));
     this.runtimeReady = signal2(false);
     this.serverSlotRegistered = false;
     this.id = "";
@@ -9962,7 +9961,8 @@ class DeferSlotComponent {
     const { id } = this;
     if (!id)
       return;
-    if (this.registerServerSlot()) {
+    if (this.isServer) {
+      this.registerServerSlot();
       return;
     }
     const absoluteWindow = window;
@@ -9975,10 +9975,10 @@ class DeferSlotComponent {
     };
   }
   ngAfterViewInit() {
-    if (this.registerServerSlot())
-      return;
-    if (typeof window === "undefined")
+    if (this.isServer) {
+      this.registerServerSlot();
       return;
+    }
     requestAnimationFrame(() => {
       this.runtimeReady.set(true);
       this.cdr.markForCheck();
@@ -9987,7 +9987,7 @@ class DeferSlotComponent {
     });
   }
   ngOnDestroy() {
-    if (typeof window === "undefined")
+    if (this.isServer)
       return;
     const { id } = this;
     if (!id)
@@ -10261,8 +10261,8 @@ class StreamSlotComponent {
       });
       return;
     }
-    warnMissingStreamingSlotCollector("StreamSlot");
     if (typeof window === "undefined") {
+      warnMissingStreamingSlotCollector("StreamSlot");
       this.currentHtml.set(this.sanitizer.bypassSecurityTrustHtml(this.fallbackHtml));
       return;
     }
@@ -10357,5 +10357,5 @@ export {
   withPendingTask
 };
 
-//# debugId=244693C5959A9FB164756E2164756E21
+//# debugId=51CF21EE181EB84C64756E2164756E21
 //# sourceMappingURL=browser.js.map