@absolutejs/absolute 0.20.0-beta.173 → 0.20.0-beta.175

package/CHANGELOG.md

@@ -6,6 +6,36 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.20.0-beta.175 — 2026-11-14
+
+### Fixed
+
+- **Angular hot updates no longer break the Content Security Policy under secureHeaders()**
+  With `secureHeaders()` on, every Angular hot update in dev (a template, style or component edit) logged "Applying inline style violates the following Content Security Policy directive 'style-src …'", and the browser dropped the updated styles. Angular's browser bootstrap never received the page's CSP nonce, so the `<style>` elements it added after the server render had none. Angular pages and Angular islands now pass the nonce to Angular (`CSP_NONCE`) in the browser, in dev and in production, so hot-updated styles and styles for components rendered only in the browser are allowed.
+- **`absolute dev` no longer restarts the server for a directory change event**
+  The first `absolute dev` boot of a freshly copied project could log `Server file changed: src/backend/assets — restarting...` and restart the server once, because the file watcher reported the `assets` directory itself and a path with no file extension was treated like `.env`. Directory events no longer restart the dev server; changes to the files inside a directory are still handled through their own events.
+- **`absolute dev` logs one `hmr update` per save of a server file**
+  Saving a server file such as `src/backend/api.ts` under `absolute dev` printed `[hmr] hmr update src/backend/api.ts` two or more times, because an editor save reaches the watcher as several events and each one got past the "content unchanged" check before the first had recorded the new content. The edit was applied once; now it is also logged once.
+- **Island pages get HMR in dev: island edits swap in place without a reload**
+  In `absolute dev`, pages that render islands now update like any other page. Editing an island component (a React, Svelte or Vue file listed in your island registry, or a file it imports) rebuilds that island and swaps it into the open page without a reload: the edited island starts over from its props, the page and its other islands keep their state, and island stores keep their values. The next reload renders the edit on the server too, so the hydration-mismatch overlay no longer appears. Before, a React island edit left the browser on the old island bundle (every reload then failed hydration), and a Svelte or Vue island edit changed nothing at all. Editing the React page that hosts the islands, or a component it imports, also updates in place again; before, the update could leave lifeless copies of the islands on screen. This covers islands rendered by React and HTML pages, and the island registry may live outside your framework directories (for example `src/islands/`). Angular islands, and edits to the registry file itself, still reload the page.
+- **Errors thrown by routes are logged for API and fetch requests too, not only page requests**
+  When your app has no `onError` of its own, a route that throws was only logged for page and HTMX requests, and only when the project had an HTML or HTMX `error.html`. The same route called with `fetch` or `curl` (`Accept: */*`) or asking for JSON returned Elysia's generic 500 and wrote nothing to the log, in development and production, so a mistyped `asset()` key in an API route failed silently. Every unhandled route error is now logged once on the server, with the method, path and stack, whatever the request accepts. Responses are unchanged: the error details stay out of the response body, 404s and thrown `status(...)` responses are not logged, and an app that registers its own `onError` still handles (and logs) errors itself.
+- **React Server Components pages named `*RSC.tsx` no longer get a doubled `RSCRSC` manifest key** (`asset`, `BaseBuildConfig`)
+  A React Server Components page whose file name already ends in RSC got the suffix twice: `pages/HomeRSC.tsx` was `asset(manifest, 'HomeRSCRSC')`, so the natural `'HomeRSC'` was missing from the manifest and the route failed only at request time. Such a page is now `asset(manifest, 'HomeRSC')`. The doubled key still works as a deprecated alias for the same bundle and prints a one-time warning in dev naming the new key. If `pages/Home.tsx` and `pages/HomeRSC.tsx` both exist, `Home.tsx` keeps `HomeRSC` (its key is unchanged), `HomeRSC.tsx` stays at `HomeRSCRSC`, and the build warns about the clash.
+- **`@absolutejs/absolute/react/components` can be imported from React Server Components** (`SuspenseSlot`, `StreamSlot`, `Link`)
+  Importing anything from `@absolutejs/absolute/react/components` (for example `SuspenseSlot`) in a React Server Component crashed the page with `TypeError: createContext is not a function`, because the entry also defines `Link`'s context and React's server build has no `createContext`. A server component that imports the entry now gets a server components version of it: `SuspenseSlot`, `StreamSlot`, `Head`, `Image` and `JsonLd` render on the server as before, and `Link` and `usePrefetch` come from a "use client" module, so a server component can render `<Link>` and it hydrates as a client component. Wrapping these in your own 'use client' file is no longer needed. As with any client component, `<Link>` props passed from a server component must be serializable (no event handlers).
+- **HTML and HTMX error and not-found pages load their stylesheets in production**
+  The HTML and HTMX `error.html`, `not-found.html` and `loading.html` pages were copied into the build as written, so a stylesheet or script linked relative to the source (such as `../../styles/indexes/site.css`) returned 404 and the error page showed unstyled. These pages now get the same hashed asset URLs (and font tags) as your other HTML and HTMX pages.
+- **Svelte component style edits now apply in dev without a reload**
+  Editing only the `<style>` block of a Svelte component in dev hot-updated the component, but the page kept the old styles until a full reload: the browser reused the component's previously loaded stylesheet module. Each version of a component's styles now gets its own URL, so style edits apply immediately.
+
+## 0.20.0-beta.174 — 2026-11-14
+
+### Changed
+
+- **Servers start faster: the framework no longer loads TypeScript at import**
+  Importing `@absolutejs/absolute` (and its `build`, `angular`, `angular/server` and `mobile` entry points) loaded the `typescript` package straight away, which takes a few hundred milliseconds of CPU, even though a running server never needs it. TypeScript now loads the first time the framework actually uses it (route scanning, island registries, Angular compilation, config editing), so servers start faster. Nothing you call changed, and those functions stay synchronous.
+
 ## 0.20.0-beta.173 — 2026-11-14
 
 ### Security

package/changelog.json

@@ -2,6 +2,77 @@
 	"contract": 1,
 	"name": "@absolutejs/absolute",
 	"releases": [
+		{
+			"changes": [
+				{
+					"detail": "With `secureHeaders()` on, every Angular hot update in dev (a template, style or component edit) logged \"Applying inline style violates the following Content Security Policy directive 'style-src …'\", and the browser dropped the updated styles. Angular's browser bootstrap never received the page's CSP nonce, so the `<style>` elements it added after the server render had none. Angular pages and Angular islands now pass the nonce to Angular (`CSP_NONCE`) in the browser, in dev and in production, so hot-updated styles and styles for components rendered only in the browser are allowed.",
+					"kind": "fixed",
+					"summary": "Angular hot updates no longer break the Content Security Policy under secureHeaders()"
+				},
+				{
+					"detail": "The first `absolute dev` boot of a freshly copied project could log `Server file changed: src/backend/assets — restarting...` and restart the server once, because the file watcher reported the `assets` directory itself and a path with no file extension was treated like `.env`. Directory events no longer restart the dev server; changes to the files inside a directory are still handled through their own events.",
+					"kind": "fixed",
+					"summary": "`absolute dev` no longer restarts the server for a directory change event"
+				},
+				{
+					"detail": "Saving a server file such as `src/backend/api.ts` under `absolute dev` printed `[hmr] hmr update src/backend/api.ts` two or more times, because an editor save reaches the watcher as several events and each one got past the \"content unchanged\" check before the first had recorded the new content. The edit was applied once; now it is also logged once.",
+					"kind": "fixed",
+					"summary": "`absolute dev` logs one `hmr update` per save of a server file"
+				},
+				{
+					"detail": "In `absolute dev`, pages that render islands now update like any other page. Editing an island component (a React, Svelte or Vue file listed in your island registry, or a file it imports) rebuilds that island and swaps it into the open page without a reload: the edited island starts over from its props, the page and its other islands keep their state, and island stores keep their values. The next reload renders the edit on the server too, so the hydration-mismatch overlay no longer appears. Before, a React island edit left the browser on the old island bundle (every reload then failed hydration), and a Svelte or Vue island edit changed nothing at all. Editing the React page that hosts the islands, or a component it imports, also updates in place again; before, the update could leave lifeless copies of the islands on screen. This covers islands rendered by React and HTML pages, and the island registry may live outside your framework directories (for example `src/islands/`). Angular islands, and edits to the registry file itself, still reload the page.",
+					"kind": "fixed",
+					"summary": "Island pages get HMR in dev: island edits swap in place without a reload"
+				},
+				{
+					"detail": "When your app has no `onError` of its own, a route that throws was only logged for page and HTMX requests, and only when the project had an HTML or HTMX `error.html`. The same route called with `fetch` or `curl` (`Accept: */*`) or asking for JSON returned Elysia's generic 500 and wrote nothing to the log, in development and production, so a mistyped `asset()` key in an API route failed silently. Every unhandled route error is now logged once on the server, with the method, path and stack, whatever the request accepts. Responses are unchanged: the error details stay out of the response body, 404s and thrown `status(...)` responses are not logged, and an app that registers its own `onError` still handles (and logs) errors itself.",
+					"kind": "fixed",
+					"summary": "Errors thrown by routes are logged for API and fetch requests too, not only page requests"
+				},
+				{
+					"detail": "A React Server Components page whose file name already ends in RSC got the suffix twice: `pages/HomeRSC.tsx` was `asset(manifest, 'HomeRSCRSC')`, so the natural `'HomeRSC'` was missing from the manifest and the route failed only at request time. Such a page is now `asset(manifest, 'HomeRSC')`. The doubled key still works as a deprecated alias for the same bundle and prints a one-time warning in dev naming the new key. If `pages/Home.tsx` and `pages/HomeRSC.tsx` both exist, `Home.tsx` keeps `HomeRSC` (its key is unchanged), `HomeRSC.tsx` stays at `HomeRSCRSC`, and the build warns about the clash.",
+					"kind": "fixed",
+					"summary": "React Server Components pages named `*RSC.tsx` no longer get a doubled `RSCRSC` manifest key",
+					"symbols": [
+						"asset",
+						"BaseBuildConfig"
+					]
+				},
+				{
+					"detail": "Importing anything from `@absolutejs/absolute/react/components` (for example `SuspenseSlot`) in a React Server Component crashed the page with `TypeError: createContext is not a function`, because the entry also defines `Link`'s context and React's server build has no `createContext`. A server component that imports the entry now gets a server components version of it: `SuspenseSlot`, `StreamSlot`, `Head`, `Image` and `JsonLd` render on the server as before, and `Link` and `usePrefetch` come from a \"use client\" module, so a server component can render `<Link>` and it hydrates as a client component. Wrapping these in your own 'use client' file is no longer needed. As with any client component, `<Link>` props passed from a server component must be serializable (no event handlers).",
+					"kind": "fixed",
+					"summary": "`@absolutejs/absolute/react/components` can be imported from React Server Components",
+					"symbols": [
+						"SuspenseSlot",
+						"StreamSlot",
+						"Link"
+					]
+				},
+				{
+					"detail": "The HTML and HTMX `error.html`, `not-found.html` and `loading.html` pages were copied into the build as written, so a stylesheet or script linked relative to the source (such as `../../styles/indexes/site.css`) returned 404 and the error page showed unstyled. These pages now get the same hashed asset URLs (and font tags) as your other HTML and HTMX pages.",
+					"kind": "fixed",
+					"summary": "HTML and HTMX error and not-found pages load their stylesheets in production"
+				},
+				{
+					"detail": "Editing only the `<style>` block of a Svelte component in dev hot-updated the component, but the page kept the old styles until a full reload: the browser reused the component's previously loaded stylesheet module. Each version of a component's styles now gets its own URL, so style edits apply immediately.",
+					"kind": "fixed",
+					"summary": "Svelte component style edits now apply in dev without a reload"
+				}
+			],
+			"date": "2026-11-14",
+			"version": "0.20.0-beta.175"
+		},
+		{
+			"changes": [
+				{
+					"detail": "Importing `@absolutejs/absolute` (and its `build`, `angular`, `angular/server` and `mobile` entry points) loaded the `typescript` package straight away, which takes a few hundred milliseconds of CPU, even though a running server never needs it. TypeScript now loads the first time the framework actually uses it (route scanning, island registries, Angular compilation, config editing), so servers start faster. Nothing you call changed, and those functions stay synchronous.",
+					"kind": "changed",
+					"summary": "Servers start faster: the framework no longer loads TypeScript at import"
+				}
+			],
+			"date": "2026-11-14",
+			"version": "0.20.0-beta.174"
+		},
 		{
 			"changes": [
 				{

package/dist/angular/browser.js

@@ -9599,6 +9599,8 @@ var isMatchingIslandElement = (element, props) => {
   const attributes = getIslandMarkerAttributes(props);
   return element.dataset.island === "true" && element.dataset.component === attributes["data-component"] && element.dataset.framework === attributes["data-framework"] && (element.dataset.hydrate ?? "load") === attributes["data-hydrate"] && (element.dataset.props ?? "{}") === attributes["data-props"];
 };
+var RUNTIME_ISLAND_ATTRIBUTES = new Set(["data-error", "data-hydrated"]);
+var readMarkerAttributes = (element) => Object.fromEntries(element.getAttributeNames().filter((name) => !RUNTIME_ISLAND_ATTRIBUTES.has(name)).map((name) => [name, element.getAttribute(name) ?? ""]));
 var preserveIslandMarkup = (props) => {
   if (typeof document === "undefined") {
     return {
@@ -9620,10 +9622,19 @@ var preserveIslandMarkup = (props) => {
     };
   }
   return {
-    attributes: Object.fromEntries(liveCandidate.getAttributeNames().map((name) => [name, liveCandidate.getAttribute(name) ?? ""])),
+    attributes: readMarkerAttributes(liveCandidate),
     innerHTML: liveCandidate.innerHTML
   };
 };
+var innerHtmlObjects = new Map;
+var getStableInnerHtml = (html) => {
+  const existing = innerHtmlObjects.get(html);
+  if (existing)
+    return existing;
+  const created = { __html: html };
+  innerHtmlObjects.set(html, created);
+  return created;
+};
 
 // src/angular/Island.browser.ts
 init_islandMarkupAttributes();
@@ -10357,5 +10368,5 @@ export {
   withPendingTask
 };
 
-//# debugId=51CF21EE181EB84C64756E2164756E21
+//# debugId=A24A0224D61EBADD64756E2164756E21
 //# sourceMappingURL=browser.js.map