@analogjs/router 3.0.0-alpha.63 → 3.0.0-alpha.65

package/types/server/src/render.d.ts

@@ -7,6 +7,6 @@ import type { ServerContext } from '../../tokens/src/index.js';
  * @param rootComponent
  * @param config
  * @param platformProviders
- * @returns Promise<string | Reponse>
+ * @returns Promise<string>
  */
-export declare function render(rootComponent: Type<unknown>, config: ApplicationConfig, platformProviders?: Provider[]): (url: string, document: string, serverContext: ServerContext) => Promise<string | Response>;
+export declare function render(rootComponent: Type<unknown>, config: ApplicationConfig, platformProviders?: Provider[]): (url: string, document: string, serverContext: ServerContext) => Promise<string>;

package/types/server/src/server-fn/app-injector.d.ts

@@ -0,0 +1,30 @@
+import { type ApplicationConfig, Injector, type StaticProvider } from '@angular/core';
+/**
+ * Builds the parent injector the server-function dispatch endpoint runs handlers
+ * against, over HTTP.
+ *
+ * A plain `Injector.create({ providers })` resolves explicitly-listed providers
+ * but not tree-shakeable `providedIn: 'root'` services — those attach to a
+ * *bootstrapped* application's root injector, which `Injector.create` is not.
+ * So the in-process SSR leg (whose parent is the app's own bootstrapped
+ * injector) resolved `root` services while the HTTP leg did not — the same
+ * handler could work while rendering and fail when called from the browser.
+ *
+ * Bootstrapping a real application on the server platform closes that gap: the
+ * returned `appRef.injector` is a root environment injector, so both listed
+ * providers and `providedIn: 'root'` services resolve, matching SSR.
+ *
+ * The generated endpoint passes the app's own server `ApplicationConfig` (the
+ * one `main.server.ts` renders with), so a handler sees exactly the DI the app
+ * configured — services, tokens, and interceptors alike — with no second
+ * provider list to keep in sync. No root component is bootstrapped
+ * (`createApplication`, not `bootstrapApplication`), so nothing renders, no
+ * change detection runs, and the router registers but never navigates. It is a
+ * DI container with the app's providers, built once and reused for the process,
+ * with only `REQUEST`/`RESPONSE` rebuilt per call in the child.
+ *
+ * A bare provider array is also accepted (direct callers and tests without an
+ * app config); it is wrapped with `provideServerRendering` so the server tokens
+ * resolve the same way.
+ */
+export declare function createServerFnAppInjector(configOrProviders?: ApplicationConfig | StaticProvider[]): Promise<Injector>;

package/types/server/src/server-fn/dispatch.d.ts

@@ -0,0 +1,56 @@
+import { Injector, type StaticProvider } from '@angular/core';
+import type { H3Event } from 'nitro/h3';
+export interface DispatchResult {
+    status: number;
+    body: unknown;
+    /**
+     * Headers from a returned `Response` (`fail`/`redirect`): Location, … The
+     * value is an array when the header legitimately repeats, which is why
+     * `Set-Cookie` is read separately below — collapsing several cookies into one
+     * comma-joined value corrupts them.
+     */
+    headers?: Record<string, string | string[]>;
+}
+export interface DispatchServerFnOptions {
+    /**
+     * The app's environment injector. The per-request injector is created as its
+     * child, so handlers resolve app services (and `providedIn: 'root'` services,
+     * when this is the app's bootstrapped injector) and registered interceptors
+     * without re-listing them per request.
+     */
+    parent?: Injector;
+    /** Extra per-request providers, for direct callers without an app injector. */
+    providers?: StaticProvider[];
+    /** Request HTTP method; enforced against the function's configured method. */
+    method?: string;
+    /**
+     * Origins permitted beyond same-origin, merged with any registered through DI
+     * (`provideServerFns(withAllowedOrigins([...]))`). The transport is
+     * same-origin by default (cross-origin browser calls are rejected with 403);
+     * `'*'` disables the check entirely. Only consulted for HTTP-transport calls
+     * (those that pass `method`).
+     */
+    allowedOrigins?: string[];
+}
+/**
+ * Server-side dispatch for a server function call.
+ *
+ * 1. reject cross-origin browser calls (403), unless allow-listed — HTTP
+ *    transport only (in-process callers omit `method` and are exempt)
+ * 2. look up the function by id
+ * 3. enforce the configured HTTP method (405 on mismatch)
+ * 4. require a JSON body on input-bearing calls (415 otherwise)
+ * 5. validate `input` against the Standard-Schema (4xx on failure)
+ * 6. build a per-request injector (REQUEST/RESPONSE + app providers)
+ * 7. run the interceptor chain, then the handler, re-entering
+ *    `runInInjectionContext` at every hop so `inject()` works even after an
+ *    interceptor `await`s before calling `next`
+ * 8. a `Response` returned by an interceptor/handler (`fail`/`redirect`)
+ *    short-circuits with its status AND headers
+ *
+ * `options.method` is the request's HTTP method; when provided it is enforced
+ * against the function's configured method AND it turns on the same-origin
+ * guard. Transports (the generated Nitro handler) always pass it; trusted
+ * in-process callers may omit it, which also exempts them from the origin guard.
+ */
+export declare function dispatchServerFn(id: string, rawInput: unknown, event: Pick<H3Event, 'node'>, options?: DispatchServerFnOptions): Promise<DispatchResult>;

package/types/server/src/server-fn/event-handler.d.ts

@@ -0,0 +1,22 @@
+import type { Injector } from '@angular/core';
+import { type EventHandler, type H3Event } from 'nitro/h3';
+/**
+ * The h3 request/response layer for the server-function dispatch route.
+ *
+ * `createServerFnAppInjector` bootstraps the parent injector once; this wraps
+ * that in the `/_analog/fn/:id` handler the Nitro build registers. Kept as a
+ * runtime function (rather than inlined into the generated module) so the
+ * transport behaviour — body decoding, the malformed-body contract, and header
+ * propagation — is unit-tested directly instead of by matching generated source.
+ *
+ * `appInjector` may be a promise: the generated module bootstraps the app at
+ * import time and passes the pending injector, which is awaited on first request
+ * and resolved instantly thereafter.
+ */
+export declare function createServerFnEventHandler(appInjector: Injector | Promise<Injector>): EventHandler;
+/**
+ * Decode a server-function request, dispatch it, and write the result to the
+ * h3 response. Same-origin, method, content-type, validation, and interceptors
+ * are enforced inside `dispatchServerFn`; this owns only the h3 I/O around it.
+ */
+export declare function handleServerFnRequest(event: H3Event, appInjector: Injector | Promise<Injector>): Promise<unknown>;

package/types/server/src/server-fn/interceptors.d.ts

@@ -0,0 +1,30 @@
+import { InjectionToken, type Provider } from '@angular/core';
+import type { ServerFnContext } from '@analogjs/router';
+/** Context threaded through the interceptor chain and handed to the handler. */
+export interface ServerFnInterceptorContext {
+    readonly input: unknown;
+    readonly context: ServerFnContext;
+    /** Return a new context with additional typed fields merged in. */
+    with(patch: Partial<ServerFnContext> & Record<string, unknown>): ServerFnInterceptorContext;
+}
+export type ServerFnNext = (ctx: ServerFnInterceptorContext) => Promise<unknown>;
+/** Functional interceptor, modeled on `HttpInterceptorFn`. */
+export type ServerFnInterceptorFn = (ctx: ServerFnInterceptorContext, next: ServerFnNext) => Promise<unknown> | unknown;
+export declare const SERVER_FN_INTERCEPTORS: InjectionToken<ServerFnInterceptorFn[]>;
+export interface ServerFnsFeature {
+    providers: Provider[];
+}
+/** `withServerFnInterceptors([...])` — registers the chain (DI, ordered). */
+export declare function withServerFnInterceptors(interceptors: ServerFnInterceptorFn[]): ServerFnsFeature;
+/** `provideServerFns(withServerFnInterceptors(...))` — mirrors provideHttpClient. */
+export declare function provideServerFns(...features: ServerFnsFeature[]): Provider[];
+/**
+ * Run the interceptor chain, then the handler, threading the context.
+ *
+ * `runInCtx` re-establishes the DI injection context around each interceptor
+ * and the handler individually. This is what keeps `inject()` working in a
+ * handler even when an upstream interceptor `await`s before calling `next`
+ * (which would otherwise resume outside Angular's synchronous injection
+ * context). It defaults to a pass-through for non-DI callers/tests.
+ */
+export declare function runInterceptors(interceptors: ServerFnInterceptorFn[], input: unknown, handler: (input: unknown, context: ServerFnContext) => Promise<unknown> | unknown, runInCtx?: <T>(fn: () => T) => T): Promise<unknown>;

package/types/server/src/server-fn/node-context.d.ts

@@ -0,0 +1,14 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { H3Event } from 'nitro/h3';
+type NodeContext = NonNullable<H3Event['node']>;
+type NodeRuntimeContext = NodeContext & {
+    req: IncomingMessage;
+    res: ServerResponse;
+};
+/**
+ * Dispatch provides the Node request and response through `REQUEST` and
+ * `RESPONSE`, which are typed as Node primitives, so server functions only run
+ * on a Node runtime. h3 leaves `node` undefined on other runtimes.
+ */
+export declare function assertNodeContext(event: Pick<H3Event, 'node'>): NodeRuntimeContext;
+export {};

package/types/server/src/server-fn/registry.d.ts

@@ -0,0 +1,7 @@
+import type { ServerFnDef } from '@analogjs/router';
+/**
+ * Server-side registry of server functions, keyed by id. A `.server.ts` module
+ * populates it as a side effect of `serverFn(...)` running at import time; the
+ * Nitro dispatch route imports those modules to fill it, then looks up by id.
+ */
+export declare const serverFnRegistry: Map<string, ServerFnDef>;

package/types/server/src/server-fn/same-origin.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Same-origin enforcement for the server-function HTTP transport.
+ *
+ * Server functions are same-origin RPC: a client proxy only ever calls the
+ * relative `/_analog/fn/:id` URL of its own app. A cross-origin page must not be
+ * able to invoke them against a logged-in user (a CSRF-shaped attack), so the
+ * transport rejects browser requests whose origin is not the app's own — out of
+ * the box, with no per-app configuration.
+ *
+ * The signals used (`Sec-Fetch-Site`, `Origin`) are added by the browser and
+ * cannot be forged by a cross-origin page's `fetch`. Non-browser callers (curl,
+ * server-to-server, SSR in-process) send neither, so they are unaffected: the
+ * guard blocks the cross-origin browser attack it is meant to, and nothing else.
+ */
+import { InjectionToken } from '@angular/core';
+import type { ServerFnsFeature } from './interceptors';
+/** Node/h3 header bag shape (`IncomingHttpHeaders`). */
+export type HeaderBag = Record<string, string | string[] | undefined>;
+/**
+ * Origins permitted beyond the app's own, registered through DI:
+ * `provideServerFns(withAllowedOrigins([...]))`. Empty by default — the
+ * transport is same-origin unless an app opts out explicitly.
+ */
+export declare const SERVER_FN_ALLOWED_ORIGINS: InjectionToken<string[]>;
+/**
+ * `withAllowedOrigins([...])` — permit cross-origin browser calls from the
+ * listed origins, or pass `'*'` to disable the same-origin guard entirely.
+ * Server functions are frequently cookie-authenticated, so this is an explicit
+ * opt-out of CSRF protection: allow-list the exact origins you control.
+ */
+export declare function withAllowedOrigins(origins: string[]): ServerFnsFeature;
+/**
+ * Whether an HTTP request to a server function may proceed.
+ *
+ * Allowed when the request is same-origin, carries no browser-origin signal at
+ * all (a non-browser client, or a same-origin GET that omits `Origin`), or its
+ * `Origin` is listed in `allowedOrigins`. Passing `'*'` in `allowedOrigins`
+ * disables the check — the explicit opt-in to cross-origin access.
+ *
+ * `Sec-Fetch-Site` is the authoritative signal when present: `same-origin` and
+ * `none` (a direct navigation, not a cross-site fetch) pass; `same-site` and
+ * `cross-site` require an explicit `allowedOrigins` entry. When the header is
+ * absent (older browsers, some proxies) the `Origin` host is compared to the
+ * request host as a fallback.
+ */
+export declare function isServerFnOriginAllowed(headers: HeaderBag, allowedOrigins?: readonly string[]): boolean;

package/types/server/src/server-fn/server-fn.d.ts

@@ -0,0 +1,21 @@
+import type { ServerFn, ServerFnConfig, ServerFnHandler, StandardSchemaV1 } from '@analogjs/router';
+/**
+ * Define a server function. Authored in a `*.server.ts` module.
+ *
+ * Three call shapes, chosen for ergonomics — they all normalize to the same
+ * `(config, handler)` form and the build transform derives the route id for each:
+ *
+ * ```ts
+ * serverFn(() => inject(Svc).list());                  // input-less GET
+ * serverFn(schema, (input) => …);                      // schema ⇒ POST + input
+ * serverFn({ method: 'POST' }, () => …);               // explicit config
+ * ```
+ *
+ * On the server the function self-registers and its handler runs via
+ * `dispatchServerFn`. On the client the build transform replaces the body with a
+ * proxy that calls `/_analog/fn/<id>`; the reference still carries
+ * `id`/`url`/`method` so `injectServerFn`/`ServerFnClient` can dispatch.
+ */
+export declare function serverFn<Out>(handler: ServerFnHandler<void, Out>): ServerFn<void, Out>;
+export declare function serverFn<In, Out>(input: StandardSchemaV1<In>, handler: ServerFnHandler<In, Out>): ServerFn<In, Out>;
+export declare function serverFn<In, Out>(config: ServerFnConfig<In>, handler: ServerFnHandler<In, Out>): ServerFn<In, Out>;

package/types/server/src/server-fn/ssr-dispatcher.d.ts

@@ -0,0 +1,17 @@
+import type { ServerRequest, ServerResponse } from '@analogjs/router/tokens';
+import type { ServerFnDispatcher } from '@analogjs/router';
+/**
+ * The in-process transport used during SSR. `ServerFnClient` picks this up from
+ * DI and calls the handler directly instead of issuing an HTTP request back
+ * into the app — the render and the handler already share a process and a
+ * request, so the round-trip only adds latency (and would need an absolute URL).
+ *
+ * `method` is deliberately not passed to `dispatchServerFn`: this is a trusted
+ * in-process caller, so the HTTP-transport-only checks (same-origin, method
+ * enforcement, content type) do not apply. Validation and the interceptor chain
+ * still run, so an SSR call behaves like a browser call in every other respect.
+ *
+ * A non-2xx result is thrown as an `HttpErrorResponse` so the failure surfaces
+ * on `resource.error()` exactly as it does in the browser.
+ */
+export declare function createServerFnDispatcher(req: ServerRequest, res: ServerResponse): ServerFnDispatcher;

package/types/server/src/utils/reset-component-def-tviews.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Nulls `def.tView` on every component definition that Angular has
+ * compiled in this process. Angular caches the result of `consts()` on
+ * `def.tView` — that factory is where `$localize` tagged templates are
+ * evaluated — so without this reset the first rendered locale would be
+ * frozen into the cache for the process lifetime.
+ *
+ * The set on `globalThis.__ngComponentDefs` is populated by a Vite
+ * transform in `@analogjs/platform` that patches `@angular/core`'s
+ * `getComponentId()` to mirror every compiled component definition to
+ * a global Set, bypassing the `ngServerMode` guard that normally
+ * prevents registration on the server.
+ */
+export declare function resetComponentDefTViews(): void;

package/types/server/src/utils/stream-html.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Pure string helpers for slicing a fully rendered SSR document into the parts
+ * the streaming renderer flushes: the shell up to `<body>`, the authoritative
+ * `<body>` inner HTML for the tail, and the authoritative `<head>` inner HTML
+ * for the finalize-time head reconcile. Extracted from `render-stream` so they
+ * can be unit tested without driving the platform.
+ */
+/** Byte offset just after the opening `<body>` tag, or 0 if none. */
+export declare function afterBodyOpen(html: string): number;
+/** Inner HTML of `<body>` from a fully rendered document string. */
+export declare function bodyInner(html: string): string;
+/** Inner HTML of `<head>` from a fully rendered document string. */
+export declare function headInner(html: string): string;

package/types/server/src/utils/stream-request.d.ts

@@ -0,0 +1,24 @@
+import type { ServerContext } from '@analogjs/router/tokens';
+/**
+ * Per-request decisions about whether the streaming renderer should fall back
+ * to a buffered render. Extracted from `render-stream` so they can be unit
+ * tested without driving the platform.
+ */
+/**
+ * User agents that receive a fully buffered render (with a resolved `<head>`)
+ * instead of the streamed shell. Streaming flushes the head before the app has
+ * set a dynamic title/meta and reconciles it via a finalize script; a crawler
+ * that does not run that script would index the shell's static head. Mirrors
+ * Nuxt's bot bypass — streaming targets interactive clients, bots get the
+ * buffered path whose head is byte-identical to the classic `render()`.
+ */
+export declare const SSR_BOT_RE: RegExp;
+export declare function isLikelyBot(serverContext: ServerContext): boolean;
+/**
+ * Whether streaming is disabled for this request by a `streaming: false` route
+ * rule. The platform plugin translates that rule into an `x-analog-no-streaming`
+ * response header (mirroring how `ssr: false` becomes `x-analog-no-ssr`); when
+ * present, `renderStream` produces the buffered `render()` output for this
+ * route instead of streaming.
+ */
+export declare function streamingDisabledByRoute(serverContext: ServerContext): boolean;

package/types/src/index.d.ts

@@ -14,10 +14,13 @@ export { FormAction } from './lib/form-action.directive';
 export type { FormActionState } from './lib/form-action.directive';
 export { injectDebugRoutes } from './lib/debug/routes';
 export { withDebugRoutes } from './lib/debug';
-export { ServerOnly } from './lib/server.component';
 export type { AnalogJsonLdDocument } from './lib/json-ld';
 export { issuesToFieldErrors, issuesToFormErrors, issuePathToFieldName, } from './lib/validation-errors';
 export type { ValidationFieldErrors } from './lib/validation-errors';
+export { injectServerFn, injectServerFnMutation, provideServerFnClient, ServerFnClient, } from './lib/server-fn/inject-server-fn';
+export { createServerFnRef, type ServerFnRefConfig, } from './lib/server-fn/server-fn-ref';
+export { SERVER_FN_DISPATCHER, type ServerFnDispatcher, } from './lib/server-fn/dispatcher';
+export type { ServerFn, ServerFnConfig, ServerFnContext, ServerFnDef, ServerFnHandler, ServerFnMethod, StandardSchemaV1, } from './lib/server-fn/types';
 export type { AnalogRouteTable, AnalogRoutePath, RoutePathOptions, RoutePathArgs, RoutePathOptionsBase, RouteParamsOutput, RouteQueryOutput, RouteLinkResult, } from './lib/route-path';
 export { routePath } from './lib/route-path';
 export { injectNavigate } from './lib/inject-navigate';

package/types/src/lib/server-fn/dispatcher.d.ts

@@ -0,0 +1,23 @@
+import { InjectionToken, type Injector } from '@angular/core';
+import type { ServerFn } from './types';
+/**
+ * In-process transport for a server function call.
+ *
+ * Provided on the server by `provideServerContext`, so during SSR a server
+ * function runs in the same process — and the same request injector — as the
+ * render instead of making an HTTP request back into the app. Absent in the
+ * browser, where `ServerFnClient` falls back to `HttpClient`.
+ *
+ * `injector` is the **app environment injector** — `ServerFnClient` is
+ * `providedIn: 'root'`, and SSR bootstraps a fresh application per request, so
+ * its injector is both per-request and the right scope for a handler to resolve
+ * from. It is passed rather than captured from the token because
+ * `provideServerContext` is applied as *platform* providers, which sit above
+ * the app's `providedIn: 'root'` services.
+ *
+ * Deliberately not a component's node injector: a handler resolves app-level
+ * services, and making that depend on which component happened to call it would
+ * be surprising and unportable.
+ */
+export type ServerFnDispatcher = <In, Out>(fn: ServerFn<In, Out>, input: In, injector: Injector) => Promise<Out>;
+export declare const SERVER_FN_DISPATCHER: InjectionToken<ServerFnDispatcher>;

package/types/src/lib/server-fn/inject-server-fn.d.ts

@@ -0,0 +1,44 @@
+import { type ResourceRef, type StateKey } from '@angular/core';
+import type { ServerFn } from './types';
+import * as i0 from "@angular/core";
+/**
+ * Client transport for server functions. In the browser it goes through Angular
+ * `HttpClient`, so client `HttpInterceptorFn`s apply. During SSR the dispatcher
+ * token is provided, and the call short-circuits the HTTP round-trip: the
+ * handler runs in-process in the current request injector. Lives in the client
+ * entry (client-safe).
+ */
+export declare class ServerFnClient {
+    private readonly http;
+    private readonly transferState;
+    private readonly injector;
+    private readonly dispatcher;
+    /** True while rendering on the server (the in-process dispatcher is provided). */
+    get isServer(): boolean;
+    call<In, Out>(fn: ServerFn<In, Out>, input: In): Promise<Out>;
+    /** Key a read's value for TransferState hydration (fn id + input). */
+    stateKey<Out>(fn: ServerFn<unknown, Out>, input: unknown): StateKey<Out>;
+    readSeed<Out>(fn: ServerFn<unknown, Out>, input: unknown): Out | undefined;
+    writeSeed<Out>(fn: ServerFn<unknown, Out>, input: unknown, value: Out): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ServerFnClient, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<ServerFnClient>;
+}
+/** No-op provider hook; ServerFnClient is `providedIn: 'root'`. */
+export declare function provideServerFnClient(): readonly [];
+/**
+ * Reactive read of a server function as an Angular `resource()`.
+ *
+ * `args` is optional: omit it for an input-less read (the resource loads once);
+ * provide it for an input-bearing read (returning `undefined` from `args` leaves
+ * the resource idle until inputs are ready, the standard resource pattern). For
+ * imperative calls (mutations, event handlers) use `injectServerFnMutation`.
+ */
+export declare function injectServerFn<Out>(fn: ServerFn<void, Out>): ResourceRef<Out | undefined>;
+export declare function injectServerFn<In, Out>(fn: ServerFn<In, Out>, args: () => In | undefined): ResourceRef<Out | undefined>;
+/**
+ * Imperative binding of a server function: returns a callable that dispatches
+ * the call through `HttpClient` (so client interceptors apply) and resolves the
+ * result. Use for mutations and event-driven calls; use `injectServerFn` for
+ * reactive reads.
+ */
+export declare function injectServerFnMutation<In, Out>(fn: ServerFn<In, Out>): (input: In) => Promise<Out>;

package/types/src/lib/server-fn/server-fn-ref.d.ts

@@ -0,0 +1,24 @@
+import type { ServerFn, ServerFnMethod } from './types';
+export interface ServerFnRefConfig {
+    id?: string;
+    method?: ServerFnMethod;
+    /**
+     * Only its presence matters here: when `method` is omitted, a config with an
+     * `input` schema defaults to `POST`, otherwise `GET`. The schema itself is
+     * never used to build the ref — validation happens server-side.
+     */
+    input?: unknown;
+}
+/**
+ * Builds a server-function reference: the client-safe `{ __serverFn, id, url,
+ * method }` metadata that `injectServerFn`/`ServerFnClient` dispatch through.
+ *
+ * Shared by both sides so they produce identical refs: the server `serverFn`
+ * wraps this with registration + the handler, and the client build's scrub
+ * transform emits a call to this factory in place of the server module so the
+ * browser bundle carries only the ref, never the handler or its server imports.
+ *
+ * The returned value is callable-typed but throws if invoked directly — it is
+ * always dispatched via `injectServerFn`/`ServerFnClient`, never called.
+ */
+export declare function createServerFnRef<In, Out>(config: ServerFnRefConfig): ServerFn<In, Out>;

package/types/src/lib/server-fn/types.d.ts

@@ -0,0 +1,55 @@
+/** Minimal Standard Schema shape (valibot/zod/arktype conform). */
+export interface StandardSchemaV1<In = unknown> {
+    readonly '~standard': {
+        readonly version: 1;
+        readonly vendor: string;
+        validate: (value: unknown) => {
+            value: In;
+            issues?: undefined;
+        } | {
+            issues: ReadonlyArray<{
+                message: string;
+            }>;
+        } | Promise<{
+            value: In;
+            issues?: undefined;
+        } | {
+            issues: ReadonlyArray<{
+                message: string;
+            }>;
+        }>;
+    };
+}
+export type ServerFnMethod = 'GET' | 'POST';
+export interface ServerFnConfig<In> {
+    /**
+     * Opaque route id `/_analog/fn/<id>`. **Build-injected, not author-supplied:**
+     * the Analog transform derives `hash(fileId + exportName)` and stamps it into
+     * both the server registration and the client proxy, so authors never choose a
+     * route. Absent at runtime means the transform did not run — `serverFn` throws.
+     */
+    id?: string;
+    /** Defaults to 'POST' when `input` is present, otherwise 'GET'. */
+    method?: ServerFnMethod;
+    input?: StandardSchemaV1<In>;
+}
+/**
+ * Interceptor-accumulated context, delivered to the handler as its second
+ * argument. Apps extend this by declaration merging.
+ */
+export interface ServerFnContext {
+}
+/** A server function reference: callable type on both sides; real impl only on the server. */
+export type ServerFn<In, Out> = ((input: In) => Promise<Out>) & {
+    readonly __serverFn: true;
+    readonly id: string;
+    readonly url: string;
+    readonly method: ServerFnMethod;
+};
+export type ServerFnHandler<In, Out> = (input: In, context: ServerFnContext) => Promise<Out> | Out;
+export interface ServerFnDef {
+    id: string;
+    method: ServerFnMethod;
+    config: ServerFnConfig<unknown>;
+    handler: ServerFnHandler<unknown, unknown>;
+}

package/types/server/src/server-component-render.d.ts

@@ -1,4 +0,0 @@
-import { ApplicationConfig } from '@angular/core';
-import type { ServerContext } from '../../tokens/src/index.js';
-export declare function serverComponentRequest(serverContext: ServerContext): string | undefined;
-export declare function renderServerComponent(url: string, serverContext: ServerContext, config?: ApplicationConfig): Promise<Response>;

package/types/server/src/tokens.d.ts

@@ -1,7 +0,0 @@
-import { InjectionToken, Provider } from '@angular/core';
-export declare const STATIC_PROPS: InjectionToken<Record<string, any>>;
-export declare function provideStaticProps<T = Record<string, any>>(props: T): Provider;
-export declare function injectStaticProps(): Record<string, any>;
-export declare function injectStaticOutputs<T>(): {
-    set(data: T): void;
-};

package/types/src/lib/server.component.d.ts

@@ -1,33 +0,0 @@
-import { InputSignal, OutputEmitterRef, WritableSignal } from '@angular/core';
-import { SafeHtml } from '@angular/platform-browser';
-import * as i0 from "@angular/core";
-type ServerProps = Record<string, any>;
-type ServerOutputs = Record<string, any>;
-/**
- * @description
- * Component that defines the bridge between the client and server-only
- * components. The component passes the component ID and props to the server
- * and retrieves the rendered HTML and outputs from the server-only component.
- *
- * Status: experimental
- */
-export declare class ServerOnly {
-    component: InputSignal<string>;
-    props: InputSignal<ServerProps | undefined>;
-    outputs: OutputEmitterRef<ServerOutputs>;
-    private http;
-    private sanitizer;
-    protected content: WritableSignal<SafeHtml>;
-    private route;
-    private baseURL;
-    private transferState;
-    constructor();
-    updateContent(content: {
-        html: string;
-        outputs: ServerOutputs;
-    }): void;
-    getComponentUrl(componentId: string): string;
-    static ɵfac: i0.ɵɵFactoryDeclaration<ServerOnly, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<ServerOnly, "server-only,ServerOnly,Server", never, { "component": { "alias": "component"; "required": true; "isSignal": true; }; "props": { "alias": "props"; "required": false; "isSignal": true; }; }, { "outputs": "outputs"; }, never, never, true, never>;
-}
-export {};