@analogjs/router 3.0.0-alpha.64 → 3.0.0-alpha.65

package/fesm2022/analogjs-router-server.mjs

@@ -1,8 +1,11 @@
-import { BASE_URL, INTERNAL_FETCH, LOCALE, REQUEST, RESPONSE } from "./analogjs-router-tokens.mjs";
-import { APP_ID, InjectionToken, TransferState, assertInInjectionContext, enableProdMode, inject, makeStateKey, reflectComponentType, ɵConsole } from "@angular/core";
-import { bootstrapApplication } from "@angular/platform-browser";
-import { provideServerRendering, renderApplication, ɵSERVER_CONTEXT } from "@angular/platform-server";
-import { json } from "node:stream/consumers";
+import { BASE_URL as BASE_URL$1, INTERNAL_FETCH, LOCALE as LOCALE$1, REQUEST as REQUEST$1, RESPONSE as RESPONSE$1 } from "./analogjs-router-tokens.mjs";
+import { InjectionToken, Injector, enableProdMode, runInInjectionContext } from "@angular/core";
+import { bootstrapApplication, createApplication } from "@angular/platform-browser";
+import { BASE_URL, LOCALE, REQUEST, RESPONSE } from "@analogjs/router/tokens";
+import { eventHandler, getRouterParam, readBody } from "nitro/h3";
+import { INITIAL_CONFIG, platformServer, provideServerRendering, renderApplication, ɵSERVER_CONTEXT, ɵrenderInternal } from "@angular/platform-server";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createServerFnRef } from "@analogjs/router";
 //#region packages/router/server/src/provide-server-context.ts
 function getHeaderValue(value) {
 	return Array.isArray(value) ? value[0] : value;
@@ -22,15 +25,15 @@ function provideServerContext({ req, res, fetch }) {
 			useValue: "ssr-analog"
 		},
 		{
-			provide: REQUEST,
+			provide: REQUEST$1,
 			useValue: req
 		},
 		{
-			provide: RESPONSE,
+			provide: RESPONSE$1,
 			useValue: res
 		},
 		{
-			provide: BASE_URL,
+			provide: BASE_URL$1,
 			useValue: baseUrl
 		},
 		{
@@ -38,7 +41,7 @@ function provideServerContext({ req, res, fetch }) {
 			useValue: fetch
 		},
 		...locale ? [{
-			provide: LOCALE,
+			provide: LOCALE$1,
 			useValue: locale
 		}] : []
 	];
@@ -88,106 +91,7 @@ function parseAcceptLanguage(header) {
 	}).sort((a, b) => b.q - a.q)[0]?.locale || void 0;
 }
 //#endregion
-//#region packages/router/server/src/tokens.ts
-var STATIC_PROPS = new InjectionToken("Static Props");
-function provideStaticProps(props) {
-	return {
-		provide: STATIC_PROPS,
-		useFactory() {
-			return props;
-		}
-	};
-}
-function injectStaticProps() {
-	assertInInjectionContext(injectStaticProps);
-	return inject(STATIC_PROPS);
-}
-function injectStaticOutputs() {
-	const transferState = inject(TransferState);
-	const outputsKey = makeStateKey("_analog_output");
-	return { set(data) {
-		transferState.set(outputsKey, data);
-	} };
-}
-//#endregion
-//#region packages/router/server/src/server-component-render.ts
-function serverComponentRequest(serverContext) {
-	const serverComponentId = serverContext.req?.headers?.["x-analog-component"];
-	if (!serverComponentId && serverContext.req?.url && serverContext.req.url.startsWith("/_analog/components")) return serverContext.req.url.split("/")?.[3];
-	return serverComponentId;
-}
-var components = /* @__PURE__ */ Object.assign({});
-async function renderServerComponent(url, serverContext, config) {
-	const { componentLoader, componentId } = getComponentLoader(serverComponentRequest(serverContext));
-	if (!componentLoader) return new Response(`Server Component Not Found ${componentId}`, { status: 404 });
-	const component = (await componentLoader()).default;
-	if (!component) return new Response(`No default export for ${componentId}`, { status: 422 });
-	const selector = reflectComponentType(component)?.selector.split(",")?.[0] || "server-component";
-	const body = await json(serverContext.req).catch(() => ({})) || {};
-	const appId = `analog-server-${selector.toLowerCase()}-${(/* @__PURE__ */ new Date()).getTime()}`;
-	const bootstrap = (context) => bootstrapApplication(component, { providers: [
-		provideServerRendering(),
-		provideStaticProps(body),
-		{
-			provide: ɵSERVER_CONTEXT,
-			useValue: "analog-server-component"
-		},
-		{
-			provide: APP_ID,
-			useFactory() {
-				return appId;
-			}
-		},
-		...config?.providers || []
-	] }, context);
-	const html = await renderApplication(bootstrap, {
-		url,
-		document: `<${selector}></${selector}>`,
-		platformProviders: [{
-			provide: ɵConsole,
-			useFactory() {
-				return {
-					warn: () => {},
-					log: () => {}
-				};
-			}
-		}]
-	});
-	const responseData = {
-		html,
-		outputs: retrieveTransferredState(html, appId)
-	};
-	return new Response(JSON.stringify(responseData), { headers: { "X-Analog-Component": "true" } });
-}
-function getComponentLoader(componentReqId) {
-	const _componentId = `/src/server/components/${componentReqId.toLowerCase()}`;
-	let componentLoader = void 0;
-	let componentId = _componentId;
-	if (components[`${_componentId}.ts`]) {
-		componentId = `${_componentId}.ts`;
-		componentLoader = components[componentId];
-	}
-	return {
-		componentLoader,
-		componentId
-	};
-}
-function retrieveTransferredState(html, appId) {
-	const regex = new RegExp(`<script id="${appId}-state" type="application/json">(.*?)<\/script>`);
-	const match = html.match(regex);
-	if (match) {
-		const scriptContent = match[1];
-		if (scriptContent) try {
-			return JSON.parse(scriptContent)._analog_output || {};
-		} catch (e) {
-			console.warn("Exception while parsing static outputs for " + appId, e);
-		}
-		return {};
-	} else return {};
-}
-//#endregion
-//#region packages/router/server/src/render.ts
-enableProdMode();
+//#region packages/router/server/src/utils/reset-component-def-tviews.ts
 /**
 * Nulls `def.tView` on every component definition that Angular has
 * compiled in this process. Angular caches the result of `consts()` on
@@ -206,6 +110,9 @@ function resetComponentDefTViews() {
 	if (!defs) return;
 	for (const def of defs) def.tView = null;
 }
+//#endregion
+//#region packages/router/server/src/render.ts
+enableProdMode();
 /**
 * Returns a function that accepts the navigation URL,
 * the root HTML, and server context.
@@ -213,14 +120,13 @@ function resetComponentDefTViews() {
 * @param rootComponent
 * @param config
 * @param platformProviders
-* @returns Promise<string | Reponse>
+* @returns Promise<string>
 */
 function render(rootComponent, config, platformProviders = []) {
 	function bootstrap(context) {
 		return bootstrapApplication(rootComponent, config, context);
 	}
 	return async function render(url, document, serverContext) {
-		if (serverComponentRequest(serverContext)) return await renderServerComponent(url, serverContext);
 		resetComponentDefTViews();
 		return await renderApplication(bootstrap, {
 			document,
@@ -230,6 +136,672 @@ function render(rootComponent, config, platformProviders = []) {
 	};
 }
 //#endregion
-export { injectStaticOutputs, injectStaticProps, provideServerContext, render, renderServerComponent, serverComponentRequest };
+//#region packages/router/server/src/utils/stream-html.ts
+/**
+* Pure string helpers for slicing a fully rendered SSR document into the parts
+* the streaming renderer flushes: the shell up to `<body>`, the authoritative
+* `<body>` inner HTML for the tail, and the authoritative `<head>` inner HTML
+* for the finalize-time head reconcile. Extracted from `render-stream` so they
+* can be unit tested without driving the platform.
+*/
+/** Byte offset just after the opening `<body>` tag, or 0 if none. */
+function afterBodyOpen(html) {
+	const m = /<body[^>]*>/i.exec(html);
+	return m ? m.index + m[0].length : 0;
+}
+/** Inner HTML of `<body>` from a fully rendered document string. */
+function bodyInner(html) {
+	const start = afterBodyOpen(html);
+	const end = html.lastIndexOf("</body>");
+	return html.slice(start, end > -1 ? end : html.length);
+}
+/** Inner HTML of `<head>` from a fully rendered document string. */
+function headInner(html) {
+	const open = /<head[^>]*>/i.exec(html);
+	if (!open) return "";
+	const start = open.index + open[0].length;
+	const end = html.indexOf("</head>", start);
+	return html.slice(start, end > -1 ? end : start);
+}
+//#endregion
+//#region packages/router/server/src/utils/stream-request.ts
+/**
+* Per-request decisions about whether the streaming renderer should fall back
+* to a buffered render. Extracted from `render-stream` so they can be unit
+* tested without driving the platform.
+*/
+/**
+* User agents that receive a fully buffered render (with a resolved `<head>`)
+* instead of the streamed shell. Streaming flushes the head before the app has
+* set a dynamic title/meta and reconciles it via a finalize script; a crawler
+* that does not run that script would index the shell's static head. Mirrors
+* Nuxt's bot bypass — streaming targets interactive clients, bots get the
+* buffered path whose head is byte-identical to the classic `render()`.
+*/
+var SSR_BOT_RE = /bot|crawl|spider|slurp|mediapartners|facebookexternalhit|embedly|quora link preview|outbrain|pinterest|vkshare|w3c_validator|whatsapp|telegrambot|lighthouse|google-inspectiontool|headlesschrome|bingpreview/i;
+function isLikelyBot(serverContext) {
+	const ua = serverContext?.req?.headers?.["user-agent"];
+	return typeof ua === "string" && SSR_BOT_RE.test(ua);
+}
+/**
+* Whether streaming is disabled for this request by a `streaming: false` route
+* rule. The platform plugin translates that rule into an `x-analog-no-streaming`
+* response header (mirroring how `ssr: false` becomes `x-analog-no-ssr`); when
+* present, `renderStream` produces the buffered `render()` output for this
+* route instead of streaming.
+*/
+function streamingDisabledByRoute(serverContext) {
+	return serverContext?.res?.getHeader?.("x-analog-no-streaming") === "true";
+}
+//#endregion
+//#region packages/router/server/src/defer-reconcile-runtime.ts
+/**
+* Tiny client runtime for progressive streaming SSR — EXPERIMENTAL.
+*
+* `renderStream` streams the document in three parts:
+*   1. the head + this runtime + an empty `<div data-analog-stream>` region;
+*   2. each `@defer` block, as it resolves on the server, as a
+*      `<template data-analog-defer="ID">…</template>` followed by a call to
+*      `window.__analogPaint("ID")` — this runtime paints the block into the
+*      streaming region immediately, so content appears progressively and out
+*      of document order;
+*   3. the authoritative document tail: the app's resolved `<head>` in a
+*      `<template data-analog-head>` and the hydration-annotated body in a
+*      `<template data-analog-authoritative>`, followed by
+*      `window.__analogReconcileHead()` + `window.__analogFinalize()`. The head
+*      is reconciled first (a dynamically-set `<title>`/meta is applied to the
+*      live document, since the streamed shell head was flushed before the app
+*      ran), then the body is swapped to the exact document Angular's
+*      incremental hydration expects.
+*
+* Emitted into the document by `renderStream`. Exported as a string so it can
+* be injected verbatim and unit-tested against a DOM.
+*/
+var DEFER_RECONCILE_RUNTIME = `
+(function () {
+  function region() {
+    return document.querySelector('[data-analog-stream]');
+  }
+  window.__analogPaint = function (id) {
+    var tpl = document.querySelector('template[data-analog-defer="' + id + '"]');
+    var r = region();
+    if (!tpl || !r) return;
+    r.appendChild(tpl.content.cloneNode(true));
+    tpl.remove();
+  };
+  window.__analogReconcileHead = function () {
+    // The shell head was flushed before the app rendered, so any title/meta the
+    // app set during render (Title/Meta services, route meta) is missing from
+    // the live document. Apply the authoritative head here, before hydration —
+    // matching how a buffered render would have produced the head. Idempotent:
+    // tags already present (charset, viewport, stylesheet/preload links) are
+    // matched and left as-is; only changed/added ones are updated.
+    var tpl = document.querySelector('template[data-analog-head]');
+    if (!tpl) return;
+    var frag = tpl.content;
+    var head = document.head;
+    var title = frag.querySelector('title');
+    if (title) document.title = title.textContent || '';
+    function metaKey(m) {
+      if (m.hasAttribute('charset')) return 'charset';
+      var attrs = ['name', 'property', 'http-equiv', 'itemprop'];
+      for (var i = 0; i < attrs.length; i++) {
+        if (m.hasAttribute(attrs[i])) return attrs[i] + '=' + m.getAttribute(attrs[i]);
+      }
+      return null;
+    }
+    var existingMeta = {};
+    var metas = head.querySelectorAll('meta');
+    for (var i = 0; i < metas.length; i++) {
+      var k = metaKey(metas[i]);
+      if (k) existingMeta[k] = metas[i];
+    }
+    frag.querySelectorAll('meta').forEach(function (m) {
+      var key = metaKey(m);
+      if (key == null) return;
+      if (existingMeta[key]) existingMeta[key].replaceWith(m.cloneNode(true));
+      else head.appendChild(m.cloneNode(true));
+    });
+    var existingHref = {};
+    var links = head.querySelectorAll('link[href]');
+    for (var j = 0; j < links.length; j++) {
+      existingHref[links[j].getAttribute('href')] = true;
+    }
+    frag.querySelectorAll('link').forEach(function (l) {
+      var href = l.getAttribute('href');
+      if (href && existingHref[href]) return;
+      head.appendChild(l.cloneNode(true));
+      if (href) existingHref[href] = true;
+    });
+    tpl.remove();
+  };
+  window.__analogFinalize = function () {
+    var auth = document.querySelector('template[data-analog-authoritative]');
+    if (!auth) return;
+    // Replace the entire body — preview region, block templates and runtime
+    // scripts — with just the authoritative body, so the reconciled DOM matches
+    // a buffered render byte-for-byte before hydration boots.
+    document.body.replaceChildren(auth.content.cloneNode(true));
+  };
+})();
+`;
+//#endregion
+//#region packages/router/server/src/render-stream.ts
+/**
+* Progressive streaming SSR renderer — EXPERIMENTAL.
+*
+* Returns a `ReadableStream<Uint8Array>` that flushes bytes DURING the render,
+* not after it:
+*   1. the document head + a client reconcile runtime are flushed immediately,
+*      before the app has finished rendering, so the browser starts fetching
+*      assets right away;
+*   2. each `@defer (hydrate …)` block's content is flushed the moment it
+*      resolves on the server — out of document order — while later blocks are
+*      still pending (proven: a slow block does not hold back an early one);
+*   3. once the app is stable, the authoritative, fully hydration-annotated
+*      document is flushed as the tail. This is byte-identical to a buffered
+*      `renderApplication`, and is what Angular's incremental hydration runs
+*      against on the client.
+*
+* Unlike a buffered renderer, this drives the platform directly
+* (`platformServer` + `bootstrapApplication` + `ɵrenderInternal`) so it can
+* interleave flushes with rendering. Angular's hydration annotation is
+* whole-document (the root's `ngh` index references every `@defer` container),
+* so the authoritative hydration payload is necessarily the tail: RENDERING
+* streams progressively, and hydration begins once the tail arrives.
+*
+* Depends on an upstream Angular per-block resolution hook exposed on two
+* globals (see {@link SsrStreamingGlobals}). When the primitive is absent,
+* `renderStream` degrades to a single buffered chunk so behaviour matches the
+* classic `render()` path, which is unchanged and remains the default.
+*/
+enableProdMode();
+function streamingPrimitiveAvailable() {
+	return typeof globalThis.__analogSsrInternals?.collectNativeNodesInLContainer === "function";
+}
+/**
+* Per-render capture handlers live in async-local storage, not a single shared
+* global slot, so concurrent renders in one process do not clobber each other.
+* `globalThis.__analogSsrDeferCapture` is a stable dispatcher installed once; it
+* routes each resolved `@defer` block to the handler of the render whose async
+* context it fired in. A block that resolves outside any render (no store) is a
+* no-op.
+*/
+var captureStore = new AsyncLocalStorage();
+function installCaptureDispatcher() {
+	const g = globalThis;
+	if (g.__analogSsrDeferCapture?.__analogDispatcher) return;
+	const dispatch = ((ev) => {
+		captureStore.getStore()?.(ev);
+	});
+	dispatch.__analogDispatcher = true;
+	g.__analogSsrDeferCapture = dispatch;
+}
+function warnMissingPrimitiveOnce() {}
+/**
+* Serialize a `@defer` block's live domino subtree to HTML. Called a macrotask
+* after the block resolves, by which point change detection has filled in the
+* block's interpolations.
+*/
+function serializeLContainerHtml(lContainer) {
+	const collect = globalThis.__analogSsrInternals?.collectNativeNodesInLContainer;
+	if (!collect) return "";
+	const nodes = [];
+	collect(lContainer, nodes);
+	let html = "";
+	for (const n of nodes) html += n?.outerHTML ?? n?.data ?? n?.nodeValue ?? "";
+	return html;
+}
+/** Destroy the platform on a macrotask, matching `renderApplication`. */
+function asyncDestroyPlatform(platformRef) {
+	return new Promise((resolve) => {
+		setTimeout(() => {
+			platformRef.destroy();
+			resolve();
+		}, 0);
+	});
+}
+/**
+* Returns a function that renders a URL to a `ReadableStream<Uint8Array>`.
+*
+* Usage in main.server.ts:
+* ```ts
+* import { renderStream } from '@analogjs/router/server';
+* export default renderStream(App, config);
+* ```
+*/
+function renderStream(rootComponent, config, platformProviders = []) {
+	function bootstrap(context) {
+		return bootstrapApplication(rootComponent, config, context);
+	}
+	return async function renderStream(url, document, serverContext) {
+		resetComponentDefTViews();
+		const primitiveAvailable = streamingPrimitiveAvailable();
+		const bot = isLikelyBot(serverContext);
+		const routeDisabled = streamingDisabledByRoute(serverContext);
+		if (bot || routeDisabled || !primitiveAvailable) {
+			if (!bot && !routeDisabled && !primitiveAvailable) warnMissingPrimitiveOnce();
+			const html = await renderApplication((context) => bootstrapApplication(rootComponent, config, context), {
+				document,
+				url,
+				platformProviders: [provideServerContext(serverContext), platformProviders]
+			});
+			return new ReadableStream({ start(controller) {
+				controller.enqueue(new TextEncoder().encode(html));
+				controller.close();
+			} });
+		}
+		installCaptureDispatcher();
+		const encoder = new TextEncoder();
+		return new ReadableStream({ async start(controller) {
+			const enqueue = (s) => controller.enqueue(encoder.encode(s));
+			let blockIndex = 0;
+			let capturing = true;
+			const seen = /* @__PURE__ */ new Set();
+			const pendingFlushes = [];
+			const onBlockResolved = (ev) => {
+				if (!capturing || seen.has(ev.lContainer)) return;
+				seen.add(ev.lContainer);
+				const id = `s${blockIndex++}`;
+				pendingFlushes.push(new Promise((resolve) => {
+					setTimeout(() => {
+						enqueue(`<template data-analog-defer="${id}">${serializeLContainerHtml(ev.lContainer)}</template><script>window.__analogPaint&&window.__analogPaint(${JSON.stringify(id)})<\/script>`);
+						resolve();
+					}, 0);
+				}));
+			};
+			await captureStore.run(onBlockResolved, async () => {
+				const platformRef = platformServer([
+					{
+						provide: INITIAL_CONFIG,
+						useValue: {
+							document,
+							url
+						}
+					},
+					provideServerContext(serverContext),
+					platformProviders
+				]);
+				enqueue(document.slice(0, afterBodyOpen(document)) + `<script>${DEFER_RECONCILE_RUNTIME}<\/script><div data-analog-stream></div>`);
+				let appRef;
+				let errored = false;
+				try {
+					appRef = await bootstrap({ platformRef });
+					await appRef.whenStable();
+					await Promise.all(pendingFlushes);
+					capturing = false;
+					const authoritative = await ɵrenderInternal(platformRef, appRef);
+					enqueue(`<template data-analog-head>${headInner(authoritative)}</template><template data-analog-authoritative>${bodyInner(authoritative)}</template><script>window.__analogReconcileHead&&window.__analogReconcileHead();window.__analogFinalize&&window.__analogFinalize()<\/script></body></html>`);
+				} catch (err) {
+					errored = true;
+					console.error(`[@analogjs/router] renderStream failed for ${url} after ${blockIndex} block(s); response truncated.`, err);
+					controller.error(err);
+				} finally {
+					await asyncDestroyPlatform(platformRef);
+					if (!errored) controller.close();
+				}
+			});
+		} });
+	};
+}
+//#endregion
+//#region packages/router/server/src/server-fn/registry.ts
+/**
+* Server-side registry of server functions, keyed by id. A `.server.ts` module
+* populates it as a side effect of `serverFn(...)` running at import time; the
+* Nitro dispatch route imports those modules to fill it, then looks up by id.
+*/
+var serverFnRegistry = /* @__PURE__ */ new Map();
+//#endregion
+//#region packages/router/server/src/server-fn/server-fn.ts
+function serverFn(arg1, arg2) {
+	const { config, handler } = normalizeArgs(arg1, arg2);
+	if (config.method === "GET" && config.input) throw new Error("[analog] a serverFn with `input` must use POST; GET is reserved for input-less reads.");
+	const ref = createServerFnRef(config);
+	serverFnRegistry.set(ref.id, {
+		id: ref.id,
+		method: ref.method,
+		config,
+		handler
+	});
+	return ref;
+}
+function normalizeArgs(arg1, arg2) {
+	if (typeof arg1 === "function") return {
+		config: {},
+		handler: arg1
+	};
+	if (isStandardSchema(arg1)) return {
+		config: { input: arg1 },
+		handler: arg2
+	};
+	return {
+		config: arg1 ?? {},
+		handler: arg2
+	};
+}
+function isStandardSchema(value) {
+	return typeof value === "object" && value !== null && "~standard" in value;
+}
+//#endregion
+//#region packages/router/server/src/server-fn/app-injector.ts
+/**
+* Builds the parent injector the server-function dispatch endpoint runs handlers
+* against, over HTTP.
+*
+* A plain `Injector.create({ providers })` resolves explicitly-listed providers
+* but not tree-shakeable `providedIn: 'root'` services — those attach to a
+* *bootstrapped* application's root injector, which `Injector.create` is not.
+* So the in-process SSR leg (whose parent is the app's own bootstrapped
+* injector) resolved `root` services while the HTTP leg did not — the same
+* handler could work while rendering and fail when called from the browser.
+*
+* Bootstrapping a real application on the server platform closes that gap: the
+* returned `appRef.injector` is a root environment injector, so both listed
+* providers and `providedIn: 'root'` services resolve, matching SSR.
+*
+* The generated endpoint passes the app's own server `ApplicationConfig` (the
+* one `main.server.ts` renders with), so a handler sees exactly the DI the app
+* configured — services, tokens, and interceptors alike — with no second
+* provider list to keep in sync. No root component is bootstrapped
+* (`createApplication`, not `bootstrapApplication`), so nothing renders, no
+* change detection runs, and the router registers but never navigates. It is a
+* DI container with the app's providers, built once and reused for the process,
+* with only `REQUEST`/`RESPONSE` rebuilt per call in the child.
+*
+* A bare provider array is also accepted (direct callers and tests without an
+* app config); it is wrapped with `provideServerRendering` so the server tokens
+* resolve the same way.
+*/
+async function createServerFnAppInjector(configOrProviders = []) {
+	return (await createApplication(Array.isArray(configOrProviders) ? { providers: [provideServerRendering(), ...configOrProviders] } : configOrProviders, { platformRef: platformServer() })).injector;
+}
+//#endregion
+//#region packages/router/server/src/server-fn/node-context.ts
+/**
+* Dispatch provides the Node request and response through `REQUEST` and
+* `RESPONSE`, which are typed as Node primitives, so server functions only run
+* on a Node runtime. h3 leaves `node` undefined on other runtimes.
+*/
+function assertNodeContext(event) {
+	const node = event.node;
+	if (!node?.req || !node.res) throw new Error("@analogjs/router: server functions require a Node runtime.");
+	return node;
+}
+//#endregion
+//#region packages/router/server/src/server-fn/interceptors.ts
+var SERVER_FN_INTERCEPTORS = new InjectionToken("SERVER_FN_INTERCEPTORS");
+/** `withServerFnInterceptors([...])` — registers the chain (DI, ordered). */
+function withServerFnInterceptors(interceptors) {
+	return { providers: interceptors.map((fn) => ({
+		provide: SERVER_FN_INTERCEPTORS,
+		useValue: fn,
+		multi: true
+	})) };
+}
+/** `provideServerFns(withServerFnInterceptors(...))` — mirrors provideHttpClient. */
+function provideServerFns(...features) {
+	return features.flatMap((f) => f.providers);
+}
+function makeCtx(input, context) {
+	return {
+		input,
+		context,
+		with(patch) {
+			return makeCtx(input, {
+				...context,
+				...patch
+			});
+		}
+	};
+}
+/**
+* Run the interceptor chain, then the handler, threading the context.
+*
+* `runInCtx` re-establishes the DI injection context around each interceptor
+* and the handler individually. This is what keeps `inject()` working in a
+* handler even when an upstream interceptor `await`s before calling `next`
+* (which would otherwise resume outside Angular's synchronous injection
+* context). It defaults to a pass-through for non-DI callers/tests.
+*/
+async function runInterceptors(interceptors, input, handler, runInCtx = (fn) => fn()) {
+	let i = -1;
+	const dispatch = async (ctx) => {
+		i += 1;
+		if (i < interceptors.length) return runInCtx(() => interceptors[i](ctx, dispatch));
+		return runInCtx(() => handler(ctx.input, ctx.context));
+	};
+	return dispatch(makeCtx(input, {}));
+}
+//#endregion
+//#region packages/router/server/src/server-fn/same-origin.ts
+/**
+* Same-origin enforcement for the server-function HTTP transport.
+*
+* Server functions are same-origin RPC: a client proxy only ever calls the
+* relative `/_analog/fn/:id` URL of its own app. A cross-origin page must not be
+* able to invoke them against a logged-in user (a CSRF-shaped attack), so the
+* transport rejects browser requests whose origin is not the app's own — out of
+* the box, with no per-app configuration.
+*
+* The signals used (`Sec-Fetch-Site`, `Origin`) are added by the browser and
+* cannot be forged by a cross-origin page's `fetch`. Non-browser callers (curl,
+* server-to-server, SSR in-process) send neither, so they are unaffected: the
+* guard blocks the cross-origin browser attack it is meant to, and nothing else.
+*/
+/**
+* Origins permitted beyond the app's own, registered through DI:
+* `provideServerFns(withAllowedOrigins([...]))`. Empty by default — the
+* transport is same-origin unless an app opts out explicitly.
+*/
+var SERVER_FN_ALLOWED_ORIGINS = new InjectionToken("SERVER_FN_ALLOWED_ORIGINS");
+/**
+* `withAllowedOrigins([...])` — permit cross-origin browser calls from the
+* listed origins, or pass `'*'` to disable the same-origin guard entirely.
+* Server functions are frequently cookie-authenticated, so this is an explicit
+* opt-out of CSRF protection: allow-list the exact origins you control.
+*/
+function withAllowedOrigins(origins) {
+	return { providers: origins.map((origin) => ({
+		provide: SERVER_FN_ALLOWED_ORIGINS,
+		useValue: origin,
+		multi: true
+	})) };
+}
+function firstHeader(value) {
+	return Array.isArray(value) ? value[0] : value;
+}
+/**
+* Whether an HTTP request to a server function may proceed.
+*
+* Allowed when the request is same-origin, carries no browser-origin signal at
+* all (a non-browser client, or a same-origin GET that omits `Origin`), or its
+* `Origin` is listed in `allowedOrigins`. Passing `'*'` in `allowedOrigins`
+* disables the check — the explicit opt-in to cross-origin access.
+*
+* `Sec-Fetch-Site` is the authoritative signal when present: `same-origin` and
+* `none` (a direct navigation, not a cross-site fetch) pass; `same-site` and
+* `cross-site` require an explicit `allowedOrigins` entry. When the header is
+* absent (older browsers, some proxies) the `Origin` host is compared to the
+* request host as a fallback.
+*/
+function isServerFnOriginAllowed(headers, allowedOrigins = []) {
+	if (allowedOrigins.includes("*")) return true;
+	const origin = firstHeader(headers["origin"]);
+	const originAllowlisted = origin !== void 0 && allowedOrigins.includes(origin);
+	const site = firstHeader(headers["sec-fetch-site"]);
+	if (site) {
+		if (site === "same-origin" || site === "none") return true;
+		return originAllowlisted;
+	}
+	if (!origin) return true;
+	if (originAllowlisted) return true;
+	const host = firstHeader(headers["x-forwarded-host"]) ?? firstHeader(headers["host"]);
+	if (!host) return false;
+	try {
+		return new URL(origin).host === host;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region packages/router/server/src/server-fn/dispatch.ts
+/**
+* Server-side dispatch for a server function call.
+*
+* 1. reject cross-origin browser calls (403), unless allow-listed — HTTP
+*    transport only (in-process callers omit `method` and are exempt)
+* 2. look up the function by id
+* 3. enforce the configured HTTP method (405 on mismatch)
+* 4. require a JSON body on input-bearing calls (415 otherwise)
+* 5. validate `input` against the Standard-Schema (4xx on failure)
+* 6. build a per-request injector (REQUEST/RESPONSE + app providers)
+* 7. run the interceptor chain, then the handler, re-entering
+*    `runInInjectionContext` at every hop so `inject()` works even after an
+*    interceptor `await`s before calling `next`
+* 8. a `Response` returned by an interceptor/handler (`fail`/`redirect`)
+*    short-circuits with its status AND headers
+*
+* `options.method` is the request's HTTP method; when provided it is enforced
+* against the function's configured method AND it turns on the same-origin
+* guard. Transports (the generated Nitro handler) always pass it; trusted
+* in-process callers may omit it, which also exempts them from the origin guard.
+*/
+async function dispatchServerFn(id, rawInput, event, options = {}) {
+	const { parent, providers = [], method, allowedOrigins = [] } = options;
+	const node = assertNodeContext(event);
+	const headers = node.req.headers ?? {};
+	if (method) {
+		if (!isServerFnOriginAllowed(headers, [...allowedOrigins, ...parent?.get(SERVER_FN_ALLOWED_ORIGINS, []) ?? []])) return {
+			status: 403,
+			body: { message: "Cross-origin server function call rejected" }
+		};
+	}
+	const def = serverFnRegistry.get(id);
+	if (!def) return {
+		status: 404,
+		body: { message: `Unknown server function: ${id}` }
+	};
+	if (method && method.toUpperCase() !== def.method) return {
+		status: 405,
+		body: { message: `Method ${method} not allowed for ${id}` },
+		headers: { Allow: def.method }
+	};
+	if (method && def.method === "POST" && !isJsonContentType(headers)) return {
+		status: 415,
+		body: { message: "Server functions accept an application/json body" }
+	};
+	let input = rawInput;
+	if (def.config.input) {
+		const result = await def.config.input["~standard"].validate(rawInput);
+		if ("issues" in result && result.issues) return {
+			status: 400,
+			body: { errors: result.issues }
+		};
+		input = result.value;
+	}
+	const req = node.req;
+	const locale = detectLocale(req);
+	const injector = Injector.create({
+		parent,
+		providers: [
+			{
+				provide: REQUEST,
+				useValue: node.req
+			},
+			{
+				provide: RESPONSE,
+				useValue: node.res
+			},
+			{
+				provide: BASE_URL,
+				useValue: getBaseUrl(req)
+			},
+			...locale ? [{
+				provide: LOCALE,
+				useValue: locale
+			}] : [],
+			...providers
+		]
+	});
+	const runInCtx = (fn) => runInInjectionContext(injector, fn);
+	const outcome = await runInterceptors(injector.get(SERVER_FN_INTERCEPTORS, []), input, def.handler, runInCtx);
+	if (outcome instanceof Response) {
+		const text = await outcome.text();
+		const body = text ? safeJson(text) : null;
+		const headers = {};
+		outcome.headers.forEach((value, key) => {
+			if (key.toLowerCase() !== "set-cookie") headers[key] = value;
+		});
+		const setCookie = outcome.headers.getSetCookie?.() ?? [];
+		if (setCookie.length) headers["set-cookie"] = setCookie;
+		return {
+			status: outcome.status,
+			body,
+			headers: Object.keys(headers).length ? headers : void 0
+		};
+	}
+	return {
+		status: 200,
+		body: outcome
+	};
+}
+function isJsonContentType(headers) {
+	const contentType = headers["content-type"];
+	const value = Array.isArray(contentType) ? contentType[0] : contentType;
+	if (!value) return false;
+	const mediaType = value.split(";")[0].trim().toLowerCase();
+	return mediaType === "application/json" || mediaType.endsWith("+json");
+}
+function safeJson(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return text;
+	}
+}
+//#endregion
+//#region packages/router/server/src/server-fn/event-handler.ts
+/**
+* The h3 request/response layer for the server-function dispatch route.
+*
+* `createServerFnAppInjector` bootstraps the parent injector once; this wraps
+* that in the `/_analog/fn/:id` handler the Nitro build registers. Kept as a
+* runtime function (rather than inlined into the generated module) so the
+* transport behaviour — body decoding, the malformed-body contract, and header
+* propagation — is unit-tested directly instead of by matching generated source.
+*
+* `appInjector` may be a promise: the generated module bootstraps the app at
+* import time and passes the pending injector, which is awaited on first request
+* and resolved instantly thereafter.
+*/
+function createServerFnEventHandler(appInjector) {
+	return eventHandler((event) => handleServerFnRequest(event, appInjector));
+}
+/**
+* Decode a server-function request, dispatch it, and write the result to the
+* h3 response. Same-origin, method, content-type, validation, and interceptors
+* are enforced inside `dispatchServerFn`; this owns only the h3 I/O around it.
+*/
+async function handleServerFnRequest(event, appInjector) {
+	const node = assertNodeContext(event);
+	const id = getRouterParam(event, "id") ?? "";
+	let input;
+	if (event.method !== "GET") try {
+		input = await readBody(event);
+	} catch {
+		node.res.statusCode = 400;
+		return { message: "Malformed request body" };
+	}
+	const { status, body, headers } = await dispatchServerFn(id, input, event, {
+		parent: await appInjector,
+		method: event.method
+	});
+	node.res.statusCode = status;
+	if (headers) for (const [key, value] of Object.entries(headers)) node.res.setHeader(key, value);
+	return body;
+}
+//#endregion
+export { SERVER_FN_ALLOWED_ORIGINS, SERVER_FN_INTERCEPTORS, createServerFnAppInjector, createServerFnEventHandler, dispatchServerFn, handleServerFnRequest, isServerFnOriginAllowed, provideServerContext, provideServerFns, render, renderStream, runInterceptors, serverFn, serverFnRegistry, withAllowedOrigins, withServerFnInterceptors };
 
 //# sourceMappingURL=analogjs-router-server.mjs.map