@analogjs/router 2.6.4 → 2.7.0-beta.2

package/fesm2022/analogjs-router-server.mjs

@@ -1,13 +1,316 @@
-import { ɵresetCompiledComponents as _resetCompiledComponents, InjectionToken, assertInInjectionContext, inject, TransferState, makeStateKey, reflectComponentType, APP_ID, ɵConsole as _Console, enableProdMode } from '@angular/core';
-import { ɵSERVER_CONTEXT as _SERVER_CONTEXT, provideServerRendering, renderApplication } from '@angular/platform-server';
+import { InjectionToken, Injector, runInInjectionContext, ɵresetCompiledComponents as _resetCompiledComponents, enableProdMode } from '@angular/core';
+import { ɵSERVER_CONTEXT as _SERVER_CONTEXT, renderApplication, platformServer, INITIAL_CONFIG, ɵrenderInternal as _renderInternal, provideServerRendering } from '@angular/platform-server';
 import { REQUEST, RESPONSE, BASE_URL, LOCALE } from '@analogjs/router/tokens';
-import { bootstrapApplication } from '@angular/platform-browser';
-import { getHeader, createEvent, readBody } from 'h3';
+import { SERVER_FN_DISPATCHER, createServerFnRef } from '@analogjs/router';
+import { HttpErrorResponse } from '@angular/common/http';
+import { bootstrapApplication, createApplication } from '@angular/platform-browser';
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { eventHandler, getRouterParam, readBody } from 'h3';
+
+/**
+ * Server-side registry of server functions, keyed by id. A `.server.ts` module
+ * populates it as a side effect of `serverFn(...)` running at import time; the
+ * Nitro dispatch route imports those modules to fill it, then looks up by id.
+ */
+const serverFnRegistry = new Map();
+
+const SERVER_FN_INTERCEPTORS = new InjectionToken('SERVER_FN_INTERCEPTORS');
+/** `withServerFnInterceptors([...])` — registers the chain (DI, ordered). */
+function withServerFnInterceptors(interceptors) {
+    return {
+        providers: interceptors.map((fn) => ({
+            provide: SERVER_FN_INTERCEPTORS,
+            useValue: fn,
+            multi: true,
+        })),
+    };
+}
+/** `provideServerFns(withServerFnInterceptors(...))` — mirrors provideHttpClient. */
+function provideServerFns(...features) {
+    return features.flatMap((f) => f.providers);
+}
+function makeCtx(input, context) {
+    return {
+        input,
+        context,
+        with(patch) {
+            return makeCtx(input, { ...context, ...patch });
+        },
+    };
+}
+/**
+ * Run the interceptor chain, then the handler, threading the context.
+ *
+ * `runInCtx` re-establishes the DI injection context around each interceptor
+ * and the handler individually. This is what keeps `inject()` working in a
+ * handler even when an upstream interceptor `await`s before calling `next`
+ * (which would otherwise resume outside Angular's synchronous injection
+ * context). It defaults to a pass-through for non-DI callers/tests.
+ */
+async function runInterceptors(interceptors, input, handler, runInCtx = (fn) => fn()) {
+    let i = -1;
+    const dispatch = async (ctx) => {
+        i += 1;
+        if (i < interceptors.length) {
+            return runInCtx(() => interceptors[i](ctx, dispatch));
+        }
+        return runInCtx(() => handler(ctx.input, ctx.context));
+    };
+    return dispatch(makeCtx(input, {}));
+}
+
+/**
+ * Same-origin enforcement for the server-function HTTP transport.
+ *
+ * Server functions are same-origin RPC: a client proxy only ever calls the
+ * relative `/_analog/fn/:id` URL of its own app. A cross-origin page must not be
+ * able to invoke them against a logged-in user (a CSRF-shaped attack), so the
+ * transport rejects browser requests whose origin is not the app's own — out of
+ * the box, with no per-app configuration.
+ *
+ * The signals used (`Sec-Fetch-Site`, `Origin`) are added by the browser and
+ * cannot be forged by a cross-origin page's `fetch`. Non-browser callers (curl,
+ * server-to-server, SSR in-process) send neither, so they are unaffected: the
+ * guard blocks the cross-origin browser attack it is meant to, and nothing else.
+ */
+/**
+ * Origins permitted beyond the app's own, registered through DI:
+ * `provideServerFns(withAllowedOrigins([...]))`. Empty by default — the
+ * transport is same-origin unless an app opts out explicitly.
+ */
+const SERVER_FN_ALLOWED_ORIGINS = new InjectionToken('SERVER_FN_ALLOWED_ORIGINS');
+/**
+ * `withAllowedOrigins([...])` — permit cross-origin browser calls from the
+ * listed origins, or pass `'*'` to disable the same-origin guard entirely.
+ * Server functions are frequently cookie-authenticated, so this is an explicit
+ * opt-out of CSRF protection: allow-list the exact origins you control.
+ */
+function withAllowedOrigins(origins) {
+    return {
+        providers: origins.map((origin) => ({
+            provide: SERVER_FN_ALLOWED_ORIGINS,
+            useValue: origin,
+            multi: true,
+        })),
+    };
+}
+function firstHeader(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+/**
+ * Whether an HTTP request to a server function may proceed.
+ *
+ * Allowed when the request is same-origin, carries no browser-origin signal at
+ * all (a non-browser client, or a same-origin GET that omits `Origin`), or its
+ * `Origin` is listed in `allowedOrigins`. Passing `'*'` in `allowedOrigins`
+ * disables the check — the explicit opt-in to cross-origin access.
+ *
+ * `Sec-Fetch-Site` is the authoritative signal when present: `same-origin` and
+ * `none` (a direct navigation, not a cross-site fetch) pass; `same-site` and
+ * `cross-site` require an explicit `allowedOrigins` entry. When the header is
+ * absent (older browsers, some proxies) the `Origin` host is compared to the
+ * request host as a fallback.
+ */
+function isServerFnOriginAllowed(headers, allowedOrigins = []) {
+    if (allowedOrigins.includes('*')) {
+        return true;
+    }
+    const origin = firstHeader(headers['origin']);
+    const originAllowlisted = origin !== undefined && allowedOrigins.includes(origin);
+    const site = firstHeader(headers['sec-fetch-site']);
+    if (site) {
+        if (site === 'same-origin' || site === 'none') {
+            return true;
+        }
+        // same-site / cross-site: only when the origin is explicitly permitted.
+        return originAllowlisted;
+    }
+    // No `Sec-Fetch-Site`: fall back to comparing the `Origin` host to the host.
+    if (!origin) {
+        // Non-browser client, or a same-origin GET with no `Origin` — not the
+        // cross-origin browser request this guard exists to reject.
+        return true;
+    }
+    if (originAllowlisted) {
+        return true;
+    }
+    const host = firstHeader(headers['x-forwarded-host']) ?? firstHeader(headers['host']);
+    if (!host) {
+        return false;
+    }
+    try {
+        return new URL(origin).host === host;
+    }
+    catch {
+        return false;
+    }
+}
+
+/**
+ * Server-side dispatch for a server function call.
+ *
+ * 1. reject cross-origin browser calls (403), unless allow-listed — HTTP
+ *    transport only (in-process callers omit `method` and are exempt)
+ * 2. look up the function by id
+ * 3. enforce the configured HTTP method (405 on mismatch)
+ * 4. require a JSON body on input-bearing calls (415 otherwise)
+ * 5. validate `input` against the Standard-Schema (4xx on failure)
+ * 6. build a per-request injector (REQUEST/RESPONSE + app providers)
+ * 7. run the interceptor chain, then the handler, re-entering
+ *    `runInInjectionContext` at every hop so `inject()` works even after an
+ *    interceptor `await`s before calling `next`
+ * 8. a `Response` returned by an interceptor/handler (`fail`/`redirect`)
+ *    short-circuits with its status AND headers
+ *
+ * `options.method` is the request's HTTP method; when provided it is enforced
+ * against the function's configured method AND it turns on the same-origin
+ * guard. Transports (the generated Nitro handler) always pass it; trusted
+ * in-process callers may omit it, which also exempts them from the origin guard.
+ */
+async function dispatchServerFn(id, rawInput, event, options = {}) {
+    const { parent, providers = [], method, allowedOrigins = [] } = options;
+    const headers = (event.node.req.headers ?? {});
+    // Same-origin guard runs first — before we even confirm the function exists —
+    // so a cross-origin page cannot probe which ids are registered. Gated on
+    // `method` so only HTTP-transport calls are checked; in-process callers omit
+    // it. The signals (`Origin`/`Sec-Fetch-Site`) are browser-set and unforgeable.
+    if (method) {
+        const allowed = [
+            ...allowedOrigins,
+            ...(parent?.get(SERVER_FN_ALLOWED_ORIGINS, []) ?? []),
+        ];
+        if (!isServerFnOriginAllowed(headers, allowed)) {
+            return {
+                status: 403,
+                body: { message: 'Cross-origin server function call rejected' },
+            };
+        }
+    }
+    const def = serverFnRegistry.get(id);
+    if (!def) {
+        return { status: 404, body: { message: `Unknown server function: ${id}` } };
+    }
+    // Enforce the transport method: a GET-only read must not be POSTable, and an
+    // input-bearing POST must not be reachable via GET.
+    if (method && method.toUpperCase() !== def.method) {
+        return {
+            status: 405,
+            body: { message: `Method ${method} not allowed for ${id}` },
+            headers: { Allow: def.method },
+        };
+    }
+    // Input travels as a JSON body. Reject anything else before decoding, so a
+    // form post from a cross-origin page (which cannot set a JSON content type
+    // without a CORS preflight) never reaches a handler. HTTP transport only.
+    if (method && def.method === 'POST' && !isJsonContentType(headers)) {
+        return {
+            status: 415,
+            body: { message: 'Server functions accept an application/json body' },
+        };
+    }
+    let input = rawInput;
+    if (def.config.input) {
+        const result = await def.config.input['~standard'].validate(rawInput);
+        if ('issues' in result && result.issues) {
+            return { status: 400, body: { errors: result.issues } };
+        }
+        input = result.value;
+    }
+    // Child of the app injector: only the request tokens are per-request; app
+    // services + interceptors resolve up the parent chain. All four are provided
+    // here so a handler resolves them the same way it would inside a component
+    // during SSR, whether it was reached over HTTP or in-process.
+    const req = event.node.req;
+    const locale = detectLocale(req);
+    const injector = Injector.create({
+        parent,
+        providers: [
+            { provide: REQUEST, useValue: event.node.req },
+            { provide: RESPONSE, useValue: event.node.res },
+            { provide: BASE_URL, useValue: getBaseUrl(req) },
+            ...(locale ? [{ provide: LOCALE, useValue: locale }] : []),
+            ...providers,
+        ],
+    });
+    // Re-enter the injection context at each hop rather than wrapping the whole
+    // chain once: an interceptor that awaits before `next` would otherwise run the
+    // handler outside the context and break `inject()`.
+    const runInCtx = (fn) => runInInjectionContext(injector, fn);
+    const interceptors = injector.get(SERVER_FN_INTERCEPTORS, []);
+    const outcome = await runInterceptors(interceptors, input, def.handler, runInCtx);
+    if (outcome instanceof Response) {
+        const text = await outcome.text();
+        const body = text ? safeJson(text) : null;
+        const headers = {};
+        outcome.headers.forEach((value, key) => {
+            if (key.toLowerCase() !== 'set-cookie') {
+                headers[key] = value;
+            }
+        });
+        // `Headers.forEach` yields cookies comma-joined into a single value, which
+        // is not a valid way to send more than one; `getSetCookie` keeps them apart.
+        const setCookie = outcome.headers.getSetCookie?.() ?? [];
+        if (setCookie.length) {
+            headers['set-cookie'] = setCookie;
+        }
+        return {
+            status: outcome.status,
+            body,
+            headers: Object.keys(headers).length ? headers : undefined,
+        };
+    }
+    return { status: 200, body: outcome };
+}
+function isJsonContentType(headers) {
+    const contentType = headers['content-type'];
+    const value = Array.isArray(contentType) ? contentType[0] : contentType;
+    if (!value) {
+        return false;
+    }
+    const mediaType = value.split(';')[0].trim().toLowerCase();
+    return mediaType === 'application/json' || mediaType.endsWith('+json');
+}
+function safeJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+
+/**
+ * The in-process transport used during SSR. `ServerFnClient` picks this up from
+ * DI and calls the handler directly instead of issuing an HTTP request back
+ * into the app — the render and the handler already share a process and a
+ * request, so the round-trip only adds latency (and would need an absolute URL).
+ *
+ * `method` is deliberately not passed to `dispatchServerFn`: this is a trusted
+ * in-process caller, so the HTTP-transport-only checks (same-origin, method
+ * enforcement, content type) do not apply. Validation and the interceptor chain
+ * still run, so an SSR call behaves like a browser call in every other respect.
+ *
+ * A non-2xx result is thrown as an `HttpErrorResponse` so the failure surfaces
+ * on `resource.error()` exactly as it does in the browser.
+ */
+function createServerFnDispatcher(req, res) {
+    const event = { node: { req, res } };
+    return async (fn, input, injector) => {
+        const { status, body } = await dispatchServerFn(fn.id, input, event, {
+            parent: injector,
+        });
+        if (status < 200 || status > 299) {
+            throw new HttpErrorResponse({ status, error: body, url: fn.url });
+        }
+        return body;
+    };
+}
 
 function provideServerContext({ req, res, }) {
     const baseUrl = getBaseUrl(req);
     const locale = detectLocale(req);
-    if (import.meta.env.DEV) {
+    // Optional chaining: a Nitro-bundled caller has no `import.meta.env` at all.
+    if (import.meta.env?.DEV) {
         _resetCompiledComponents();
     }
     return [
@@ -15,6 +318,11 @@ function provideServerContext({ req, res, }) {
         { provide: REQUEST, useValue: req },
         { provide: RESPONSE, useValue: res },
         { provide: BASE_URL, useValue: baseUrl },
+        // Server functions called while rendering run in-process, in this injector.
+        {
+            provide: SERVER_FN_DISPATCHER,
+            useValue: createServerFnDispatcher(req, res),
+        },
         ...(locale ? [{ provide: LOCALE, useValue: locale }] : []),
     ];
 }
@@ -67,7 +375,10 @@ function parseAcceptLanguage(header) {
 }
 function getBaseUrl(req) {
     const protocol = getRequestProtocol(req);
-    const { originalUrl, headers } = req;
+    const { headers } = req;
+    // Node's `IncomingMessage` has no `originalUrl`, and a server function
+    // endpoint is reached with a plain request, so fall back before dereferencing.
+    const originalUrl = req.originalUrl || req.url || '/';
     const parsedUrl = new URL('', `${protocol}://${headers.host}${originalUrl.endsWith('/')
         ? originalUrl.substring(0, originalUrl.length - 1)
         : originalUrl}`);
@@ -82,135 +393,6 @@ function getRequestProtocol(req, opts = {}) {
     return req.connection?.encrypted ? 'https' : 'http';
 }
 
-const STATIC_PROPS = new InjectionToken('Static Props');
-function provideStaticProps(props) {
-    return {
-        provide: STATIC_PROPS,
-        useFactory() {
-            return props;
-        },
-    };
-}
-function injectStaticProps() {
-    assertInInjectionContext(injectStaticProps);
-    return inject(STATIC_PROPS);
-}
-function injectStaticOutputs() {
-    const transferState = inject(TransferState);
-    const outputsKey = makeStateKey('_analog_output');
-    return {
-        set(data) {
-            transferState.set(outputsKey, data);
-        },
-    };
-}
-
-function serverComponentRequest(serverContext) {
-    const serverComponentId = getHeader(createEvent(serverContext.req, serverContext.res), 'X-Analog-Component');
-    if (!serverComponentId &&
-        serverContext.req.url &&
-        serverContext.req.url.startsWith('/_analog/components')) {
-        const componentId = serverContext.req.url.split('/')?.[3];
-        return componentId;
-    }
-    return serverComponentId;
-}
-const components = import.meta.glob([
-    '/src/server/components/**/*.{ts,analog,ag}',
-]);
-async function renderServerComponent(url, serverContext, config) {
-    const componentReqId = serverComponentRequest(serverContext);
-    const { componentLoader, componentId } = getComponentLoader(componentReqId);
-    if (!componentLoader) {
-        return new Response(`Server Component Not Found ${componentId}`, {
-            status: 404,
-        });
-    }
-    const component = (await componentLoader())['default'];
-    if (!component) {
-        return new Response(`No default export for ${componentId}`, {
-            status: 422,
-        });
-    }
-    const mirror = reflectComponentType(component);
-    const selector = mirror?.selector.split(',')?.[0] || 'server-component';
-    const event = createEvent(serverContext.req, serverContext.res);
-    const body = (await readBody(event)) || {};
-    const appId = `analog-server-${selector.toLowerCase()}-${new Date().getTime()}`;
-    const bootstrap = (context) => bootstrapApplication(component, {
-        providers: [
-            provideServerRendering(),
-            provideStaticProps(body),
-            { provide: _SERVER_CONTEXT, useValue: 'analog-server-component' },
-            {
-                provide: APP_ID,
-                useFactory() {
-                    return appId;
-                },
-            },
-            ...(config?.providers || []),
-        ],
-    }, context);
-    const html = await renderApplication(bootstrap, {
-        url,
-        document: `<${selector}></${selector}>`,
-        platformProviders: [
-            {
-                provide: _Console,
-                useFactory() {
-                    return {
-                        warn: () => { },
-                        log: () => { },
-                    };
-                },
-            },
-        ],
-    });
-    const outputs = retrieveTransferredState(html, appId);
-    const responseData = {
-        html,
-        outputs,
-    };
-    return new Response(JSON.stringify(responseData), {
-        headers: {
-            'X-Analog-Component': 'true',
-        },
-    });
-}
-function getComponentLoader(componentReqId) {
-    let _componentId = `/src/server/components/${componentReqId.toLowerCase()}`;
-    let componentLoader = undefined;
-    let componentId = _componentId;
-    if (components[`${_componentId}.ts`]) {
-        componentId = `${_componentId}.ts`;
-        componentLoader = components[componentId];
-    }
-    return { componentLoader, componentId };
-}
-function retrieveTransferredState(html, appId) {
-    const regex = new RegExp(`<script id="${appId}-state" type="application/json">(.*?)<\/script>`);
-    const match = html.match(regex);
-    if (match) {
-        const scriptContent = match[1];
-        if (scriptContent) {
-            try {
-                const parsedContent = JSON.parse(scriptContent);
-                return parsedContent._analog_output || {};
-            }
-            catch (e) {
-                console.warn('Exception while parsing static outputs for ' + appId, e);
-            }
-        }
-        return {};
-    }
-    else {
-        return {};
-    }
-}
-
-if (import.meta.env.PROD) {
-    enableProdMode();
-}
 /**
  * Nulls `def.tView` on every component definition that Angular has
  * compiled in this process. Angular caches the result of `consts()` on
@@ -232,6 +414,12 @@ function resetComponentDefTViews() {
         def.tView = null;
     }
 }
+
+// Optional chaining: the server-function dispatch endpoint imports this entry
+// from a Nitro bundle, where `import.meta.env` is not defined at all.
+if (import.meta.env?.PROD) {
+    enableProdMode();
+}
 /**
  * Returns a function that accepts the navigation URL,
  * the root HTML, and server context.
@@ -246,9 +434,6 @@ function render(rootComponent, config, platformProviders = []) {
         return bootstrapApplication(rootComponent, config, context);
     }
     return async function render(url, document, serverContext) {
-        if (serverComponentRequest(serverContext)) {
-            return await renderServerComponent(url, serverContext);
-        }
         resetComponentDefTViews();
         const html = await renderApplication(bootstrap, {
             document,
@@ -262,9 +447,517 @@ function render(rootComponent, config, platformProviders = []) {
     };
 }
 
+/**
+ * Pure string helpers for slicing a fully rendered SSR document into the parts
+ * the streaming renderer flushes: the shell up to `<body>`, the authoritative
+ * `<body>` inner HTML for the tail, and the authoritative `<head>` inner HTML
+ * for the finalize-time head reconcile. Extracted from `render-stream` so they
+ * can be unit tested without driving the platform.
+ */
+/** Byte offset just after the opening `<body>` tag, or 0 if none. */
+function afterBodyOpen(html) {
+    const m = /<body[^>]*>/i.exec(html);
+    return m ? m.index + m[0].length : 0;
+}
+/** Inner HTML of `<body>` from a fully rendered document string. */
+function bodyInner(html) {
+    const start = afterBodyOpen(html);
+    const end = html.lastIndexOf('</body>');
+    return html.slice(start, end > -1 ? end : html.length);
+}
+/** Inner HTML of `<head>` from a fully rendered document string. */
+function headInner(html) {
+    const open = /<head[^>]*>/i.exec(html);
+    if (!open)
+        return '';
+    const start = open.index + open[0].length;
+    const end = html.indexOf('</head>', start);
+    return html.slice(start, end > -1 ? end : start);
+}
+
+/**
+ * Per-request decisions about whether the streaming renderer should fall back
+ * to a buffered render. Extracted from `render-stream` so they can be unit
+ * tested without driving the platform.
+ */
+/**
+ * User agents that receive a fully buffered render (with a resolved `<head>`)
+ * instead of the streamed shell. Streaming flushes the head before the app has
+ * set a dynamic title/meta and reconciles it via a finalize script; a crawler
+ * that does not run that script would index the shell's static head. Mirrors
+ * Nuxt's bot bypass — streaming targets interactive clients, bots get the
+ * buffered path whose head is byte-identical to the classic `render()`.
+ */
+const SSR_BOT_RE = /bot|crawl|spider|slurp|mediapartners|facebookexternalhit|embedly|quora link preview|outbrain|pinterest|vkshare|w3c_validator|whatsapp|telegrambot|lighthouse|google-inspectiontool|headlesschrome|bingpreview/i;
+function isLikelyBot(serverContext) {
+    const ua = serverContext?.req?.headers?.['user-agent'];
+    return typeof ua === 'string' && SSR_BOT_RE.test(ua);
+}
+/**
+ * Whether streaming is disabled for this request by a `streaming: false` route
+ * rule. The platform plugin translates that rule into an `x-analog-no-streaming`
+ * response header (mirroring how `ssr: false` becomes `x-analog-no-ssr`); when
+ * present, `renderStream` produces the buffered `render()` output for this
+ * route instead of streaming.
+ */
+function streamingDisabledByRoute(serverContext) {
+    return serverContext?.res?.getHeader?.('x-analog-no-streaming') === 'true';
+}
+
+/**
+ * Tiny client runtime for progressive streaming SSR — EXPERIMENTAL.
+ *
+ * `renderStream` streams the document in three parts:
+ *   1. the head + this runtime + an empty `<div data-analog-stream>` region;
+ *   2. each `@defer` block, as it resolves on the server, as a
+ *      `<template data-analog-defer="ID">…</template>` followed by a call to
+ *      `window.__analogPaint("ID")` — this runtime paints the block into the
+ *      streaming region immediately, so content appears progressively and out
+ *      of document order;
+ *   3. the authoritative document tail: the app's resolved `<head>` in a
+ *      `<template data-analog-head>` and the hydration-annotated body in a
+ *      `<template data-analog-authoritative>`, followed by
+ *      `window.__analogReconcileHead()` + `window.__analogFinalize()`. The head
+ *      is reconciled first (a dynamically-set `<title>`/meta is applied to the
+ *      live document, since the streamed shell head was flushed before the app
+ *      ran), then the body is swapped to the exact document Angular's
+ *      incremental hydration expects.
+ *
+ * Emitted into the document by `renderStream`. Exported as a string so it can
+ * be injected verbatim and unit-tested against a DOM.
+ */
+const DEFER_RECONCILE_RUNTIME = /* js */ `
+(function () {
+  function region() {
+    return document.querySelector('[data-analog-stream]');
+  }
+  window.__analogPaint = function (id) {
+    var tpl = document.querySelector('template[data-analog-defer="' + id + '"]');
+    var r = region();
+    if (!tpl || !r) return;
+    r.appendChild(tpl.content.cloneNode(true));
+    tpl.remove();
+  };
+  window.__analogReconcileHead = function () {
+    // The shell head was flushed before the app rendered, so any title/meta the
+    // app set during render (Title/Meta services, route meta) is missing from
+    // the live document. Apply the authoritative head here, before hydration —
+    // matching how a buffered render would have produced the head. Idempotent:
+    // tags already present (charset, viewport, stylesheet/preload links) are
+    // matched and left as-is; only changed/added ones are updated.
+    var tpl = document.querySelector('template[data-analog-head]');
+    if (!tpl) return;
+    var frag = tpl.content;
+    var head = document.head;
+    var title = frag.querySelector('title');
+    if (title) document.title = title.textContent || '';
+    function metaKey(m) {
+      if (m.hasAttribute('charset')) return 'charset';
+      var attrs = ['name', 'property', 'http-equiv', 'itemprop'];
+      for (var i = 0; i < attrs.length; i++) {
+        if (m.hasAttribute(attrs[i])) return attrs[i] + '=' + m.getAttribute(attrs[i]);
+      }
+      return null;
+    }
+    var existingMeta = {};
+    var metas = head.querySelectorAll('meta');
+    for (var i = 0; i < metas.length; i++) {
+      var k = metaKey(metas[i]);
+      if (k) existingMeta[k] = metas[i];
+    }
+    frag.querySelectorAll('meta').forEach(function (m) {
+      var key = metaKey(m);
+      if (key == null) return;
+      if (existingMeta[key]) existingMeta[key].replaceWith(m.cloneNode(true));
+      else head.appendChild(m.cloneNode(true));
+    });
+    var existingHref = {};
+    var links = head.querySelectorAll('link[href]');
+    for (var j = 0; j < links.length; j++) {
+      existingHref[links[j].getAttribute('href')] = true;
+    }
+    frag.querySelectorAll('link').forEach(function (l) {
+      var href = l.getAttribute('href');
+      if (href && existingHref[href]) return;
+      head.appendChild(l.cloneNode(true));
+      if (href) existingHref[href] = true;
+    });
+    tpl.remove();
+  };
+  window.__analogFinalize = function () {
+    var auth = document.querySelector('template[data-analog-authoritative]');
+    if (!auth) return;
+    // Replace the entire body — preview region, block templates and runtime
+    // scripts — with just the authoritative body, so the reconciled DOM matches
+    // a buffered render byte-for-byte before hydration boots.
+    document.body.replaceChildren(auth.content.cloneNode(true));
+  };
+})();
+`;
+
+/**
+ * Progressive streaming SSR renderer — EXPERIMENTAL.
+ *
+ * Returns a `ReadableStream<Uint8Array>` that flushes bytes DURING the render,
+ * not after it:
+ *   1. the document head + a client reconcile runtime are flushed immediately,
+ *      before the app has finished rendering, so the browser starts fetching
+ *      assets right away;
+ *   2. each `@defer (hydrate …)` block's content is flushed the moment it
+ *      resolves on the server — out of document order — while later blocks are
+ *      still pending (proven: a slow block does not hold back an early one);
+ *   3. once the app is stable, the authoritative, fully hydration-annotated
+ *      document is flushed as the tail. This is byte-identical to a buffered
+ *      `renderApplication`, and is what Angular's incremental hydration runs
+ *      against on the client.
+ *
+ * Unlike a buffered renderer, this drives the platform directly
+ * (`platformServer` + `bootstrapApplication` + `ɵrenderInternal`) so it can
+ * interleave flushes with rendering. Angular's hydration annotation is
+ * whole-document (the root's `ngh` index references every `@defer` container),
+ * so the authoritative hydration payload is necessarily the tail: RENDERING
+ * streams progressively, and hydration begins once the tail arrives.
+ *
+ * Depends on an upstream Angular per-block resolution hook exposed on two
+ * globals (see {@link SsrStreamingGlobals}). When the primitive is absent,
+ * `renderStream` degrades to a single buffered chunk so behaviour matches the
+ * classic `render()` path, which is unchanged and remains the default.
+ */
+if (import.meta.env.PROD) {
+    enableProdMode();
+}
+function streamingPrimitiveAvailable() {
+    const g = globalThis;
+    return (typeof g.__analogSsrInternals?.collectNativeNodesInLContainer === 'function');
+}
+/**
+ * Per-render capture handlers live in async-local storage, not a single shared
+ * global slot, so concurrent renders in one process do not clobber each other.
+ * `globalThis.__analogSsrDeferCapture` is a stable dispatcher installed once; it
+ * routes each resolved `@defer` block to the handler of the render whose async
+ * context it fired in. A block that resolves outside any render (no store) is a
+ * no-op.
+ */
+const captureStore = new AsyncLocalStorage();
+function installCaptureDispatcher() {
+    const g = globalThis;
+    if (g.__analogSsrDeferCapture?.__analogDispatcher)
+        return;
+    const dispatch = ((ev) => {
+        captureStore.getStore()?.(ev);
+    });
+    dispatch.__analogDispatcher = true;
+    g.__analogSsrDeferCapture = dispatch;
+}
+let warnedMissingPrimitive = false;
+function warnMissingPrimitiveOnce() {
+    if (warnedMissingPrimitive || !import.meta.env.DEV)
+        return;
+    warnedMissingPrimitive = true;
+    console.warn('[@analogjs/router] renderStream: the streaming hook was not found on ' +
+        '@angular/core, so rendering falls back to buffered. Enable ' +
+        '`experimental.streaming` in your Analog config; if it already is, your ' +
+        'installed Angular version may be incompatible with the streaming patch.');
+}
+/**
+ * Serialize a `@defer` block's live domino subtree to HTML. Called a macrotask
+ * after the block resolves, by which point change detection has filled in the
+ * block's interpolations.
+ */
+function serializeLContainerHtml(lContainer) {
+    const g = globalThis;
+    const collect = g.__analogSsrInternals?.collectNativeNodesInLContainer;
+    if (!collect)
+        return '';
+    const nodes = [];
+    collect(lContainer, nodes);
+    let html = '';
+    for (const n of nodes)
+        html += n?.outerHTML ?? n?.data ?? n?.nodeValue ?? '';
+    return html;
+}
+/** Destroy the platform on a macrotask, matching `renderApplication`. */
+function asyncDestroyPlatform(platformRef) {
+    return new Promise((resolve) => {
+        setTimeout(() => {
+            platformRef.destroy();
+            resolve();
+        }, 0);
+    });
+}
+/**
+ * Returns a function that renders a URL to a `ReadableStream<Uint8Array>`.
+ *
+ * Usage in main.server.ts:
+ * ```ts
+ * import { renderStream } from '@analogjs/router/server';
+ * export default renderStream(App, config);
+ * ```
+ */
+function renderStream(rootComponent, config, platformProviders = []) {
+    function bootstrap(context) {
+        return bootstrapApplication(rootComponent, config, context);
+    }
+    return async function renderStream(url, document, serverContext) {
+        // Reset before every render — both the buffered fallback below and the
+        // streaming path — so a prior render's locale/consts are not frozen for the
+        // process lifetime (parity with render.ts).
+        resetComponentDefTViews();
+        // Fall back to a single buffered chunk so output matches the classic path
+        // for:
+        //   - crawlers, which may not run the finalize script that reconciles a
+        //     dynamic <head>, so they get a buffered render with a resolved head;
+        //   - routes with a `streaming: false` rule (opt out per route);
+        //   - a missing streaming primitive.
+        const primitiveAvailable = streamingPrimitiveAvailable();
+        const bot = isLikelyBot(serverContext);
+        const routeDisabled = streamingDisabledByRoute(serverContext);
+        if (bot || routeDisabled || !primitiveAvailable) {
+            // Warn only when the primitive is genuinely absent — the bot and
+            // route-opt-out paths fall back to buffered by design, not by degradation.
+            if (!bot && !routeDisabled && !primitiveAvailable) {
+                warnMissingPrimitiveOnce();
+            }
+            const html = await renderApplication((context) => bootstrapApplication(rootComponent, config, context), {
+                document,
+                url,
+                platformProviders: [
+                    provideServerContext(serverContext),
+                    platformProviders,
+                ],
+            });
+            return new ReadableStream({
+                start(controller) {
+                    controller.enqueue(new TextEncoder().encode(html));
+                    controller.close();
+                },
+            });
+        }
+        installCaptureDispatcher();
+        const encoder = new TextEncoder();
+        // The stream is returned immediately; `start` fills it as the render
+        // progresses, so the consumer receives the head, then each @defer block the
+        // moment it resolves, then the authoritative tail — true streaming.
+        return new ReadableStream({
+            async start(controller) {
+                const enqueue = (s) => controller.enqueue(encoder.encode(s));
+                // The capture handler fires once per @defer block as it resolves. The
+                // block's DOM is not filled until the next change-detection tick, so we
+                // serialize + flush it a macrotask later — flushing DURING the render.
+                // It is scoped to this render via async-local storage (see
+                // installCaptureDispatcher) so concurrent renders never cross-talk.
+                let blockIndex = 0;
+                let capturing = true;
+                const seen = new Set();
+                const pendingFlushes = [];
+                const onBlockResolved = (ev) => {
+                    // A block can reach `Complete` more than once during a render; only
+                    // stream each container once. Also ignore any resolution that fires
+                    // after the render has moved on to serializing the authoritative tail.
+                    if (!capturing || seen.has(ev.lContainer))
+                        return;
+                    seen.add(ev.lContainer);
+                    const id = `s${blockIndex++}`;
+                    pendingFlushes.push(new Promise((resolve) => {
+                        setTimeout(() => {
+                            const html = serializeLContainerHtml(ev.lContainer);
+                            enqueue(`<template data-analog-defer="${id}">${html}</template>` +
+                                `<script>window.__analogPaint&&window.__analogPaint(${JSON.stringify(id)})</script>`);
+                            resolve();
+                        }, 0);
+                    }));
+                };
+                // Run the whole render inside the async-local context so every
+                // change-detection tick and @defer resolution it schedules routes back
+                // to THIS render's handler.
+                await captureStore.run(onBlockResolved, async () => {
+                    const platformRef = platformServer([
+                        { provide: INITIAL_CONFIG, useValue: { document, url } },
+                        provideServerContext(serverContext),
+                        platformProviders,
+                    ]);
+                    // 1. Flush the head + reconcile runtime immediately (before the app is
+                    //    rendered), then open the live streaming region.
+                    enqueue(document.slice(0, afterBodyOpen(document)) +
+                        `<script>${DEFER_RECONCILE_RUNTIME}</script>` +
+                        `<div data-analog-stream></div>`);
+                    let appRef;
+                    let errored = false;
+                    try {
+                        // 2. Bootstrap + render. Blocks resolve out of order during this
+                        //    phase and flush via the capture handler above.
+                        appRef = await bootstrap({ platformRef });
+                        await appRef.whenStable();
+                        await Promise.all(pendingFlushes);
+                        // Stop capturing before serializing the tail so late resolutions
+                        // triggered by the hydration pass are not streamed as extra blocks.
+                        capturing = false;
+                        // 3. Flush the authoritative, fully hydration-annotated document as
+                        //    the tail. Carried in <template>s (their inert `ng-state`
+                        //    script survives). The app's resolved <head> ships alongside so
+                        //    a dynamically-set title/meta — set during render, after the
+                        //    shell head was already flushed — is reconciled onto the live
+                        //    document before the runtime swaps in the body and hydration
+                        //    boots.
+                        const authoritative = await _renderInternal(platformRef, appRef);
+                        enqueue(`<template data-analog-head>${headInner(authoritative)}</template>` +
+                            `<template data-analog-authoritative>${bodyInner(authoritative)}</template>` +
+                            `<script>window.__analogReconcileHead&&window.__analogReconcileHead();` +
+                            `window.__analogFinalize&&window.__analogFinalize()</script>` +
+                            `</body></html>`);
+                    }
+                    catch (err) {
+                        // The head + runtime were already flushed, so the status/headers are
+                        // committed; error the stream (a no-op silent close would hand the
+                        // client a truncated, non-hydratable 200) and log with block context.
+                        errored = true;
+                        console.error(`[@analogjs/router] renderStream failed for ${url} after ` +
+                            `${blockIndex} block(s); response truncated.`, err);
+                        controller.error(err);
+                    }
+                    finally {
+                        await asyncDestroyPlatform(platformRef);
+                        if (!errored)
+                            controller.close();
+                    }
+                });
+            },
+        });
+    };
+}
+
+function serverFn(arg1, arg2) {
+    const { config, handler } = normalizeArgs(arg1, arg2);
+    // GET is reserved for input-less reads; an input schema requires POST (the
+    // input travels in the body, not the query). Build transforms reject this too.
+    if (config.method === 'GET' && config.input) {
+        throw new Error('[analog] a serverFn with `input` must use POST; GET is reserved for input-less reads.');
+    }
+    // `createServerFnRef` throws if the build-derived id is missing, so `ref.id`
+    // is the authoritative route key here.
+    const ref = createServerFnRef(config);
+    serverFnRegistry.set(ref.id, {
+        id: ref.id,
+        method: ref.method,
+        config,
+        handler,
+    });
+    return ref;
+}
+function normalizeArgs(arg1, arg2) {
+    // serverFn(handler) — input-less GET.
+    if (typeof arg1 === 'function') {
+        return {
+            config: {},
+            handler: arg1,
+        };
+    }
+    // serverFn(schema, handler) — a Standard Schema ⇒ POST + input.
+    if (isStandardSchema(arg1)) {
+        return {
+            config: { input: arg1 },
+            handler: arg2,
+        };
+    }
+    // serverFn(config, handler) — explicit config object.
+    return {
+        config: arg1 ?? {},
+        handler: arg2,
+    };
+}
+function isStandardSchema(value) {
+    return typeof value === 'object' && value !== null && '~standard' in value;
+}
+
+/**
+ * Builds the parent injector the server-function dispatch endpoint runs handlers
+ * against, over HTTP.
+ *
+ * A plain `Injector.create({ providers })` resolves explicitly-listed providers
+ * but not tree-shakeable `providedIn: 'root'` services — those attach to a
+ * *bootstrapped* application's root injector, which `Injector.create` is not.
+ * So the in-process SSR leg (whose parent is the app's own bootstrapped
+ * injector) resolved `root` services while the HTTP leg did not — the same
+ * handler could work while rendering and fail when called from the browser.
+ *
+ * Bootstrapping a real application on the server platform closes that gap: the
+ * returned `appRef.injector` is a root environment injector, so both listed
+ * providers and `providedIn: 'root'` services resolve, matching SSR.
+ *
+ * The generated endpoint passes the app's own server `ApplicationConfig` (the
+ * one `main.server.ts` renders with), so a handler sees exactly the DI the app
+ * configured — services, tokens, and interceptors alike — with no second
+ * provider list to keep in sync. No root component is bootstrapped
+ * (`createApplication`, not `bootstrapApplication`), so nothing renders, no
+ * change detection runs, and the router registers but never navigates. It is a
+ * DI container with the app's providers, built once and reused for the process,
+ * with only `REQUEST`/`RESPONSE` rebuilt per call in the child.
+ *
+ * A bare provider array is also accepted (direct callers and tests without an
+ * app config); it is wrapped with `provideServerRendering` so the server tokens
+ * resolve the same way.
+ */
+async function createServerFnAppInjector(configOrProviders = []) {
+    const config = Array.isArray(configOrProviders)
+        ? { providers: [provideServerRendering(), ...configOrProviders] }
+        : configOrProviders;
+    const appRef = await createApplication(config, {
+        platformRef: platformServer(),
+    });
+    return appRef.injector;
+}
+
+/**
+ * The h3 request/response layer for the server-function dispatch route.
+ *
+ * `createServerFnAppInjector` bootstraps the parent injector once; this wraps
+ * that in the `/_analog/fn/:id` handler the Nitro build registers. Kept as a
+ * runtime function (rather than inlined into the generated module) so the
+ * transport behaviour — body decoding, the malformed-body contract, and header
+ * propagation — is unit-tested directly instead of by matching generated source.
+ *
+ * `appInjector` may be a promise: the generated module bootstraps the app at
+ * import time and passes the pending injector, which is awaited on first request
+ * and resolved instantly thereafter.
+ */
+function createServerFnEventHandler(appInjector) {
+    return eventHandler((event) => handleServerFnRequest(event, appInjector));
+}
+/**
+ * Decode a server-function request, dispatch it, and write the result to the
+ * h3 response. Same-origin, method, content-type, validation, and interceptors
+ * are enforced inside `dispatchServerFn`; this owns only the h3 I/O around it.
+ */
+async function handleServerFnRequest(event, appInjector) {
+    const id = getRouterParam(event, 'id') ?? '';
+    // h3 parses the body before dispatch gets a say, and its parse error is an
+    // HTML/500-shaped response rather than the JSON contract callers expect.
+    let input;
+    if (event.method !== 'GET') {
+        try {
+            input = await readBody(event);
+        }
+        catch {
+            event.node.res.statusCode = 400;
+            return { message: 'Malformed request body' };
+        }
+    }
+    const { status, body, headers } = await dispatchServerFn(id, input, event, {
+        parent: await appInjector,
+        method: event.method,
+    });
+    event.node.res.statusCode = status;
+    if (headers) {
+        for (const [key, value] of Object.entries(headers)) {
+            event.node.res.setHeader(key, value);
+        }
+    }
+    return body;
+}
+
 /**
  * Generated bundle index. Do not edit.
  */
 
-export { injectStaticOutputs, injectStaticProps, provideServerContext, render, renderServerComponent, serverComponentRequest };
+export { SERVER_FN_ALLOWED_ORIGINS, SERVER_FN_INTERCEPTORS, createServerFnAppInjector, createServerFnEventHandler, dispatchServerFn, handleServerFnRequest, isServerFnOriginAllowed, provideServerContext, provideServerFns, render, renderStream, runInterceptors, serverFn, serverFnRegistry, withAllowedOrigins, withServerFnInterceptors };
 //# sourceMappingURL=analogjs-router-server.mjs.map