@angular/platform-server 20.3.24 → 20.3.26

package/fesm2022/init.mjs

@@ -1,5 +1,5 @@
 /**
- * @license Angular v20.3.24
+ * @license Angular v20.3.26
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */

package/fesm2022/platform-server.mjs

@@ -1,12 +1,12 @@
 /**
- * @license Angular v20.3.24
+ * @license Angular v20.3.26
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */
 
 import { PLATFORM_SERVER_PROVIDERS, PlatformState, BEFORE_APP_SERIALIZED, parseUrl, platformServer, INITIAL_CONFIG, createScript } from './server.mjs';
 export { ServerModule, DominoAdapter as ɵDominoAdapter, ENABLE_DOM_EMULATION as ɵENABLE_DOM_EMULATION, INTERNAL_SERVER_PLATFORM_PROVIDERS as ɵINTERNAL_SERVER_PLATFORM_PROVIDERS, SERVER_RENDER_PROVIDERS as ɵSERVER_RENDER_PROVIDERS } from './server.mjs';
-import { makeEnvironmentProviders, InjectionToken, ApplicationRef, ɵstartMeasuring as _startMeasuring, ɵstopMeasuring as _stopMeasuring, ɵIS_HYDRATION_DOM_REUSE_ENABLED as _IS_HYDRATION_DOM_REUSE_ENABLED, ɵannotateForHydration as _annotateForHydration, CSP_NONCE, APP_ID, ɵSSR_CONTENT_INTEGRITY_MARKER as _SSR_CONTENT_INTEGRITY_MARKER, Renderer2, Version } from '@angular/core';
+import { makeEnvironmentProviders, InjectionToken, ApplicationRef, ɵstartMeasuring as _startMeasuring, ɵstopMeasuring as _stopMeasuring, ɵRuntimeError as _RuntimeError, ɵIS_HYDRATION_DOM_REUSE_ENABLED as _IS_HYDRATION_DOM_REUSE_ENABLED, ɵannotateForHydration as _annotateForHydration, CSP_NONCE, APP_ID, ɵSSR_CONTENT_INTEGRITY_MARKER as _SSR_CONTENT_INTEGRITY_MARKER, Renderer2, Version } from '@angular/core';
 import '@angular/common';
 import '@angular/platform-browser';
 import '@angular/common/http';
@@ -320,7 +320,9 @@ function validateAllowedHosts(url, allowedHosts) {
             const hostname = parsedUrl.hostname;
             const allowedHostsSet = new Set(allowedHosts);
             if (!isHostAllowed(hostname, allowedHostsSet)) {
-                throw new Error(`Host ${url} is not allowed. You can configure \`allowedHosts\` option.`);
+                throw new _RuntimeError(5706 /* RuntimeErrorCode.HOST_NOT_ALLOWED */, typeof ngDevMode === 'undefined' || ngDevMode
+                    ? `Host ${url} is not allowed. You can configure \`allowedHosts\` option.`
+                    : url);
             }
         }
     }
@@ -357,7 +359,7 @@ function isHostAllowed(hostname, allowedHosts) {
 /**
  * @publicApi
  */
-const VERSION = /* @__PURE__ */ new Version('20.3.24');
+const VERSION = /* @__PURE__ */ new Version('20.3.26');
 
 export { BEFORE_APP_SERIALIZED, INITIAL_CONFIG, PlatformState, VERSION, platformServer, provideServerRendering, renderApplication, renderModule, SERVER_CONTEXT as ɵSERVER_CONTEXT, isHostAllowed as ɵisHostAllowed, renderInternal as ɵrenderInternal };
 //# sourceMappingURL=platform-server.mjs.map

package/fesm2022/platform-server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"platform-server.mjs","sources":["../../../../../darwin_arm64-fastbuild-ST-199a4f3c4e20/bin/packages/platform-server/src/provide_server.ts","../../../../../darwin_arm64-fastbuild-ST-199a4f3c4e20/bin/packages/platform-server/src/utils.ts","../../../../../darwin_arm64-fastbuild-ST-199a4f3c4e20/bin/packages/platform-server/src/version.ts"],"sourcesContent":["/**\n * @license\n * Copyright Google LLC All Rights Reserved.\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n */\n\nimport {EnvironmentProviders, makeEnvironmentProviders} from '@angular/core';\n\nimport {PLATFORM_SERVER_PROVIDERS} from './server';\n\n/**\n * Sets up providers necessary to enable server rendering functionality for the application.\n *\n * @usageNotes\n *\n * Basic example of how you can add server support to your application:\n * ```ts\n * bootstrapApplication(AppComponent, {\n *   providers: [provideServerRendering()]\n * });\n * ```\n *\n * @publicApi\n * @returns A set of providers to setup the server.\n */\nexport function provideServerRendering(): EnvironmentProviders {\n  if (typeof ngServerMode === 'undefined') {\n    globalThis['ngServerMode'] = true;\n  }\n\n  return makeEnvironmentProviders([...PLATFORM_SERVER_PROVIDERS]);\n}\n","/**\n * @license\n * Copyright Google LLC All Rights Reserved.\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n */\n\nimport {\n  APP_ID,\n  ApplicationRef,\n  CSP_NONCE,\n  InjectionToken,\n  PlatformRef,\n  Provider,\n  Renderer2,\n  StaticProvider,\n  Type,\n  ɵannotateForHydration as annotateForHydration,\n  ɵIS_HYDRATION_DOM_REUSE_ENABLED as IS_HYDRATION_DOM_REUSE_ENABLED,\n  ɵSSR_CONTENT_INTEGRITY_MARKER as SSR_CONTENT_INTEGRITY_MARKER,\n  ɵstartMeasuring as startMeasuring,\n  ɵstopMeasuring as stopMeasuring,\n} from '@angular/core';\nimport {BootstrapContext} from '@angular/platform-browser';\n\nimport {platformServer} from './server';\nimport {PlatformState} from './platform_state';\nimport {BEFORE_APP_SERIALIZED, INITIAL_CONFIG, PlatformConfig} from './tokens';\nimport {createScript} from './transfer_state';\nimport {parseUrl} from './url';\n\n/**\n * Event dispatch (JSAction) script is inlined into the HTML by the build\n * process to avoid extra blocking request on a page. The script looks like this:\n * ```html\n * <script type=\"text/javascript\" id=\"ng-event-dispatch-contract\">...</script>\n * ```\n * This const represents the \"id\" attribute value.\n */\nexport const EVENT_DISPATCH_SCRIPT_ID = 'ng-event-dispatch-contract';\n\ninterface PlatformOptions extends Omit<PlatformConfig, 'document'> {\n  document?: string | Document;\n  platformProviders?: Provider[];\n}\n\n/**\n * Creates an instance of a server platform (with or without JIT compiler support\n * depending on the `ngJitMode` global const value), using provided options.\n */\nfunction createServerPlatform(options: PlatformOptions): PlatformRef {\n  const extraProviders = options.platformProviders ?? [];\n  const measuringLabel = 'createServerPlatform';\n  startMeasuring(measuringLabel);\n  const {document, url} = options;\n\n  const platform = platformServer([\n    {\n      provide: INITIAL_CONFIG,\n      useValue: {\n        document,\n        url,\n      },\n    },\n    extraProviders,\n  ]);\n\n  stopMeasuring(measuringLabel);\n  return platform;\n}\n\n/**\n * Finds and returns inlined event dispatch script if it exists.\n * See the `EVENT_DISPATCH_SCRIPT_ID` const docs for additional info.\n */\nfunction findEventDispatchScript(doc: Document) {\n  return doc.getElementById(EVENT_DISPATCH_SCRIPT_ID);\n}\n\n/**\n * Removes inlined event dispatch script if it exists.\n * See the `EVENT_DISPATCH_SCRIPT_ID` const docs for additional info.\n */\nfunction removeEventDispatchScript(doc: Document) {\n  findEventDispatchScript(doc)?.remove();\n}\n\n/**\n * Annotate nodes for hydration and remove event dispatch script when not needed.\n */\nfunction prepareForHydration(platformState: PlatformState, applicationRef: ApplicationRef): void {\n  const measuringLabel = 'prepareForHydration';\n  startMeasuring(measuringLabel);\n  const environmentInjector = applicationRef.injector;\n  const doc = platformState.getDocument();\n\n  if (!environmentInjector.get(IS_HYDRATION_DOM_REUSE_ENABLED, false)) {\n    // Hydration is diabled, remove inlined event dispatch script.\n    // (which was injected by the build process) from the HTML.\n    removeEventDispatchScript(doc);\n\n    return;\n  }\n\n  appendSsrContentIntegrityMarker(doc);\n\n  const eventTypesToReplay = annotateForHydration(applicationRef, doc);\n  if (eventTypesToReplay.regular.size || eventTypesToReplay.capture.size) {\n    insertEventRecordScript(\n      environmentInjector.get(APP_ID),\n      doc,\n      eventTypesToReplay,\n      environmentInjector.get(CSP_NONCE, null),\n    );\n  } else {\n    // No events to replay, we should remove inlined event dispatch script\n    // (which was injected by the build process) from the HTML.\n    removeEventDispatchScript(doc);\n  }\n  stopMeasuring(measuringLabel);\n}\n\n/**\n * Creates a marker comment node and append it into the `<body>`.\n * Some CDNs have mechanisms to remove all comment node from HTML.\n * This behaviour breaks hydration, so we'll detect on the client side if this\n * marker comment is still available or else throw an error\n */\nfunction appendSsrContentIntegrityMarker(doc: Document) {\n  // Adding a ng hydration marker comment\n  const comment = doc.createComment(SSR_CONTENT_INTEGRITY_MARKER);\n  doc.body.firstChild\n    ? doc.body.insertBefore(comment, doc.body.firstChild)\n    : doc.body.append(comment);\n}\n\n/**\n * Adds the `ng-server-context` attribute to host elements of all bootstrapped components\n * within a given application.\n */\nfunction appendServerContextInfo(applicationRef: ApplicationRef) {\n  const injector = applicationRef.injector;\n  let serverContext = sanitizeServerContext(injector.get(SERVER_CONTEXT, DEFAULT_SERVER_CONTEXT));\n  applicationRef.components.forEach((componentRef) => {\n    const renderer = componentRef.injector.get(Renderer2);\n    const element = componentRef.location.nativeElement;\n    if (element) {\n      renderer.setAttribute(element, 'ng-server-context', serverContext);\n    }\n  });\n}\n\nfunction insertEventRecordScript(\n  appId: string,\n  doc: Document,\n  eventTypesToReplay: {regular: Set<string>; capture: Set<string>},\n  nonce: string | null,\n): void {\n  const measuringLabel = 'insertEventRecordScript';\n  startMeasuring(measuringLabel);\n  const {regular, capture} = eventTypesToReplay;\n  const eventDispatchScript = findEventDispatchScript(doc);\n\n  // Note: this is only true when build with the CLI tooling, which inserts the script in the HTML\n  if (eventDispatchScript) {\n    // This is defined in packages/core/primitives/event-dispatch/contract_binary.ts\n    const replayScriptContents =\n      `window.__jsaction_bootstrap(` +\n      `document.body,` +\n      `\"${appId}\",` +\n      `${JSON.stringify(Array.from(regular))},` +\n      `${JSON.stringify(Array.from(capture))}` +\n      `);`;\n\n    const replayScript = createScript(doc, replayScriptContents, nonce);\n\n    // Insert replay script right after inlined event dispatch script, since it\n    // relies on `__jsaction_bootstrap` to be defined in the global scope.\n    eventDispatchScript.after(replayScript);\n  }\n  stopMeasuring(measuringLabel);\n}\n\n/**\n * Renders an Angular application to a string.\n *\n * @private\n *\n * @param platformRef - Reference to the Angular platform.\n * @param applicationRef - Reference to the Angular application.\n * @returns A promise that resolves to the rendered string.\n */\nexport async function renderInternal(\n  platformRef: PlatformRef,\n  applicationRef: ApplicationRef,\n): Promise<string> {\n  const platformState = platformRef.injector.get(PlatformState);\n  prepareForHydration(platformState, applicationRef);\n  appendServerContextInfo(applicationRef);\n\n  // Run any BEFORE_APP_SERIALIZED callbacks just before rendering to string.\n  const environmentInjector = applicationRef.injector;\n  const callbacks = environmentInjector.get(BEFORE_APP_SERIALIZED, null);\n  if (callbacks) {\n    const asyncCallbacks: Promise<void>[] = [];\n    for (const callback of callbacks) {\n      try {\n        const callbackResult = callback();\n        if (callbackResult) {\n          asyncCallbacks.push(callbackResult);\n        }\n      } catch (e) {\n        // Ignore exceptions.\n        console.warn('Ignoring BEFORE_APP_SERIALIZED Exception: ', e);\n      }\n    }\n\n    if (asyncCallbacks.length) {\n      for (const result of await Promise.allSettled(asyncCallbacks)) {\n        if (result.status === 'rejected') {\n          console.warn('Ignoring BEFORE_APP_SERIALIZED Exception: ', result.reason);\n        }\n      }\n    }\n  }\n\n  return platformState.renderToString();\n}\n\n/**\n * Destroy the application in a macrotask, this allows pending promises to be settled and errors\n * to be surfaced to the users.\n */\nfunction asyncDestroyPlatform(platformRef: PlatformRef): Promise<void> {\n  return new Promise<void>((resolve) => {\n    setTimeout(() => {\n      platformRef.destroy();\n      resolve();\n    }, 0);\n  });\n}\n\n/**\n * Specifies the value that should be used if no server context value has been provided.\n */\nconst DEFAULT_SERVER_CONTEXT = 'other';\n\n/**\n * An internal token that allows providing extra information about the server context\n * (e.g. whether SSR or SSG was used). The value is a string and characters other\n * than [a-zA-Z0-9\\-] are removed. See the default value in `DEFAULT_SERVER_CONTEXT` const.\n */\nexport const SERVER_CONTEXT = new InjectionToken<string>('SERVER_CONTEXT');\n\n/**\n * Sanitizes provided server context:\n * - removes all characters other than a-z, A-Z, 0-9 and `-`\n * - returns `other` if nothing is provided or the string is empty after sanitization\n */\nfunction sanitizeServerContext(serverContext: string): string {\n  const context = serverContext.replace(/[^a-zA-Z0-9\\-]/g, '');\n  return context.length > 0 ? context : DEFAULT_SERVER_CONTEXT;\n}\n\n/**\n * Bootstraps an application using provided NgModule and serializes the page content to string.\n *\n * @param moduleType A reference to an NgModule that should be used for bootstrap.\n * @param options Additional configuration for the render operation:\n *  - `document` - the document of the page to render, either as an HTML string or\n *                 as a reference to the `document` instance.\n *  - `url` - the URL for the current render request.\n *  - `extraProviders` - set of platform level providers for the current render request.\n *  - `allowedHosts` - the allowed hosts list for host validation in server-side rendering.\n * @publicApi\n */\nexport async function renderModule<T>(\n  moduleType: Type<T>,\n  options: {\n    document?: string | Document;\n    url?: string;\n    extraProviders?: StaticProvider[];\n    allowedHosts?: Readonly<string>[];\n  },\n): Promise<string> {\n  const {document, url, extraProviders: platformProviders, allowedHosts} = options;\n  validateAllowedHosts(url, allowedHosts);\n  const platformRef = createServerPlatform({document, url, platformProviders});\n  try {\n    const moduleRef = await platformRef.bootstrapModule(moduleType);\n    const applicationRef = moduleRef.injector.get(ApplicationRef);\n\n    const measuringLabel = 'whenStable';\n    startMeasuring(measuringLabel);\n    // Block until application is stable.\n    await applicationRef.whenStable();\n    stopMeasuring(measuringLabel);\n\n    return await renderInternal(platformRef, applicationRef);\n  } finally {\n    await asyncDestroyPlatform(platformRef);\n  }\n}\n\n/**\n * Bootstraps an instance of an Angular application and renders it to a string.\n *\n * @usageNotes\n *\n * ```ts\n * import { BootstrapContext, bootstrapApplication } from '@angular/platform-browser';\n * import { renderApplication } from '@angular/platform-server';\n * import { ApplicationConfig } from '@angular/core';\n * import { AppComponent } from './app.component';\n *\n * const appConfig: ApplicationConfig = { providers: [...] };\n * const bootstrap = (context: BootstrapContext) =>\n *   bootstrapApplication(AppComponent, config, context);\n * const output = await renderApplication(bootstrap);\n * ```\n *\n * @param bootstrap A method that when invoked returns a promise that returns an `ApplicationRef`\n *     instance once resolved. The method is invoked with an `Injector` instance that\n *     provides access to the platform-level dependency injection context.\n * @param options Additional configuration for the render operation:\n *  - `document` - the document of the page to render, either as an HTML string or\n *                 as a reference to the `document` instance.\n *  - `url` - the URL for the current render request.\n *  - `platformProviders` - the platform level providers for the current render request.\n *  - `allowedHosts` - the allowed hosts list for host validation in server-side rendering.\n *\n * @returns A Promise, that returns serialized (to a string) rendered page, once resolved.\n *\n * @publicApi\n */\nexport async function renderApplication(\n  bootstrap: (context: BootstrapContext) => Promise<ApplicationRef>,\n  options: {\n    document?: string | Document;\n    url?: string;\n    platformProviders?: Provider[];\n    allowedHosts?: Readonly<string>[];\n  },\n): Promise<string> {\n  const renderAppLabel = 'renderApplication';\n  const bootstrapLabel = 'bootstrap';\n  const _renderLabel = '_render';\n  const {url, allowedHosts} = options;\n\n  validateAllowedHosts(url, allowedHosts);\n\n  startMeasuring(renderAppLabel);\n  const platformRef = createServerPlatform(options);\n  try {\n    startMeasuring(bootstrapLabel);\n    const applicationRef = await bootstrap({platformRef});\n    stopMeasuring(bootstrapLabel);\n\n    startMeasuring(_renderLabel);\n\n    const measuringLabel = 'whenStable';\n    startMeasuring(measuringLabel);\n    // Block until application is stable.\n    await applicationRef.whenStable();\n    stopMeasuring(measuringLabel);\n\n    const rendered = await renderInternal(platformRef, applicationRef);\n    stopMeasuring(_renderLabel);\n    return rendered;\n  } finally {\n    await asyncDestroyPlatform(platformRef);\n    stopMeasuring(renderAppLabel);\n  }\n}\n\nfunction validateAllowedHosts(url: string | undefined, allowedHosts: string[] | undefined) {\n  if (typeof url === 'string') {\n    const parsedUrl = parseUrl(url);\n    if (parsedUrl !== null) {\n      const hostname = parsedUrl.hostname;\n      const allowedHostsSet: ReadonlySet<string> = new Set(allowedHosts);\n      if (!isHostAllowed(hostname, allowedHostsSet)) {\n        throw new Error(`Host ${url} is not allowed. You can configure \\`allowedHosts\\` option.`);\n      }\n    }\n  }\n}\n\n/**\n * Checks if the hostname is allowed.\n * @param hostname - The hostname to check.\n * @param allowedHosts - A set of allowed hostnames.\n * @returns `true` if the hostname is allowed, `false` otherwise.\n * @note Used also in `@angular/ssr`.\n * @private\n */\nexport function isHostAllowed(hostname: string, allowedHosts: ReadonlySet<string>): boolean {\n  if (allowedHosts.has('*') || allowedHosts.has(hostname)) {\n    return true;\n  }\n\n  for (const allowedHost of allowedHosts) {\n    if (!allowedHost.startsWith('*.')) {\n      continue;\n    }\n\n    const domain = allowedHost.slice(1);\n    if (hostname.endsWith(domain)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n","/**\n * @license\n * Copyright Google LLC All Rights Reserved.\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n */\n\n/**\n * @module\n * @description\n * Entry point for all public APIs of the platform-server package.\n */\n\nimport {Version} from '@angular/core';\n\n/**\n * @publicApi\n */\nexport const VERSION = /* @__PURE__ */ new Version('20.3.24');\n"],"names":["startMeasuring","stopMeasuring","IS_HYDRATION_DOM_REUSE_ENABLED","annotateForHydration","SSR_CONTENT_INTEGRITY_MARKER"],"mappings":";;;;;;;;;;;;;;AAYA;;;;;;;;;;;;;;AAcG;SACa,sBAAsB,GAAA;AACpC,IAAA,IAAI,OAAO,YAAY,KAAK,WAAW,EAAE;AACvC,QAAA,UAAU,CAAC,cAAc,CAAC,GAAG,IAAI;;AAGnC,IAAA,OAAO,wBAAwB,CAAC,CAAC,GAAG,yBAAyB,CAAC,CAAC;AACjE;;ACDA;;;;;;;AAOG;AACI,MAAM,wBAAwB,GAAG,4BAA4B;AAOpE;;;AAGG;AACH,SAAS,oBAAoB,CAAC,OAAwB,EAAA;AACpD,IAAA,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE;IACtD,MAAM,cAAc,GAAG,sBAAsB;IAC7CA,eAAc,CAAC,cAAc,CAAC;AAC9B,IAAA,MAAM,EAAC,QAAQ,EAAE,GAAG,EAAC,GAAG,OAAO;IAE/B,MAAM,QAAQ,GAAG,cAAc,CAAC;AAC9B,QAAA;AACE,YAAA,OAAO,EAAE,cAAc;AACvB,YAAA,QAAQ,EAAE;gBACR,QAAQ;gBACR,GAAG;AACJ,aAAA;AACF,SAAA;QACD,cAAc;AACf,KAAA,CAAC;IAEFC,cAAa,CAAC,cAAc,CAAC;AAC7B,IAAA,OAAO,QAAQ;AACjB;AAEA;;;AAGG;AACH,SAAS,uBAAuB,CAAC,GAAa,EAAA;AAC5C,IAAA,OAAO,GAAG,CAAC,cAAc,CAAC,wBAAwB,CAAC;AACrD;AAEA;;;AAGG;AACH,SAAS,yBAAyB,CAAC,GAAa,EAAA;AAC9C,IAAA,uBAAuB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE;AACxC;AAEA;;AAEG;AACH,SAAS,mBAAmB,CAAC,aAA4B,EAAE,cAA8B,EAAA;IACvF,MAAM,cAAc,GAAG,qBAAqB;IAC5CD,eAAc,CAAC,cAAc,CAAC;AAC9B,IAAA,MAAM,mBAAmB,GAAG,cAAc,CAAC,QAAQ;AACnD,IAAA,MAAM,GAAG,GAAG,aAAa,CAAC,WAAW,EAAE;IAEvC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAACE,+BAA8B,EAAE,KAAK,CAAC,EAAE;;;QAGnE,yBAAyB,CAAC,GAAG,CAAC;QAE9B;;IAGF,+BAA+B,CAAC,GAAG,CAAC;IAEpC,MAAM,kBAAkB,GAAGC,qBAAoB,CAAC,cAAc,EAAE,GAAG,CAAC;AACpE,IAAA,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE;QACtE,uBAAuB,CACrB,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAC/B,GAAG,EACH,kBAAkB,EAClB,mBAAmB,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CACzC;;SACI;;;QAGL,yBAAyB,CAAC,GAAG,CAAC;;IAEhCF,cAAa,CAAC,cAAc,CAAC;AAC/B;AAEA;;;;;AAKG;AACH,SAAS,+BAA+B,CAAC,GAAa,EAAA;;IAEpD,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAACG,6BAA4B,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC;AACP,UAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU;UAClD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9B;AAEA;;;AAGG;AACH,SAAS,uBAAuB,CAAC,cAA8B,EAAA;AAC7D,IAAA,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ;AACxC,IAAA,IAAI,aAAa,GAAG,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IAC/F,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,YAAY,KAAI;QACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;AACrD,QAAA,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,aAAa;QACnD,IAAI,OAAO,EAAE;YACX,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,aAAa,CAAC;;AAEtE,KAAC,CAAC;AACJ;AAEA,SAAS,uBAAuB,CAC9B,KAAa,EACb,GAAa,EACb,kBAAgE,EAChE,KAAoB,EAAA;IAEpB,MAAM,cAAc,GAAG,yBAAyB;IAChDJ,eAAc,CAAC,cAAc,CAAC;AAC9B,IAAA,MAAM,EAAC,OAAO,EAAE,OAAO,EAAC,GAAG,kBAAkB;AAC7C,IAAA,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,GAAG,CAAC;;IAGxD,IAAI,mBAAmB,EAAE;;QAEvB,MAAM,oBAAoB,GACxB,CAA8B,4BAAA,CAAA;YAC9B,CAAgB,cAAA,CAAA;AAChB,YAAA,CAAA,CAAA,EAAI,KAAK,CAAI,EAAA,CAAA;YACb,CAAG,EAAA,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAG,CAAA,CAAA;YACzC,CAAG,EAAA,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAA;AACxC,YAAA,CAAA,EAAA,CAAI;QAEN,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,CAAC;;;AAInE,QAAA,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC;;IAEzCC,cAAa,CAAC,cAAc,CAAC;AAC/B;AAEA;;;;;;;;AAQG;AACI,eAAe,cAAc,CAClC,WAAwB,EACxB,cAA8B,EAAA;IAE9B,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC;AAC7D,IAAA,mBAAmB,CAAC,aAAa,EAAE,cAAc,CAAC;IAClD,uBAAuB,CAAC,cAAc,CAAC;;AAGvC,IAAA,MAAM,mBAAmB,GAAG,cAAc,CAAC,QAAQ;IACnD,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC;IACtE,IAAI,SAAS,EAAE;QACb,MAAM,cAAc,GAAoB,EAAE;AAC1C,QAAA,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE;AAChC,YAAA,IAAI;AACF,gBAAA,MAAM,cAAc,GAAG,QAAQ,EAAE;gBACjC,IAAI,cAAc,EAAE;AAClB,oBAAA,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC;;;YAErC,OAAO,CAAC,EAAE;;AAEV,gBAAA,OAAO,CAAC,IAAI,CAAC,4CAA4C,EAAE,CAAC,CAAC;;;AAIjE,QAAA,IAAI,cAAc,CAAC,MAAM,EAAE;YACzB,KAAK,MAAM,MAAM,IAAI,MAAM,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE;AAC7D,gBAAA,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE;oBAChC,OAAO,CAAC,IAAI,CAAC,4CAA4C,EAAE,MAAM,CAAC,MAAM,CAAC;;;;;AAMjF,IAAA,OAAO,aAAa,CAAC,cAAc,EAAE;AACvC;AAEA;;;AAGG;AACH,SAAS,oBAAoB,CAAC,WAAwB,EAAA;AACpD,IAAA,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,KAAI;QACnC,UAAU,CAAC,MAAK;YACd,WAAW,CAAC,OAAO,EAAE;AACrB,YAAA,OAAO,EAAE;SACV,EAAE,CAAC,CAAC;AACP,KAAC,CAAC;AACJ;AAEA;;AAEG;AACH,MAAM,sBAAsB,GAAG,OAAO;AAEtC;;;;AAIG;MACU,cAAc,GAAG,IAAI,cAAc,CAAS,gBAAgB;AAEzE;;;;AAIG;AACH,SAAS,qBAAqB,CAAC,aAAqB,EAAA;IAClD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;AAC5D,IAAA,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,GAAG,sBAAsB;AAC9D;AAEA;;;;;;;;;;;AAWG;AACI,eAAe,YAAY,CAChC,UAAmB,EACnB,OAKC,EAAA;AAED,IAAA,MAAM,EAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAC,GAAG,OAAO;AAChF,IAAA,oBAAoB,CAAC,GAAG,EAAE,YAAY,CAAC;AACvC,IAAA,MAAM,WAAW,GAAG,oBAAoB,CAAC,EAAC,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAC,CAAC;AAC5E,IAAA,IAAI;QACF,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC;QAC/D,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC;QAE7D,MAAM,cAAc,GAAG,YAAY;QACnCD,eAAc,CAAC,cAAc,CAAC;;AAE9B,QAAA,MAAM,cAAc,CAAC,UAAU,EAAE;QACjCC,cAAa,CAAC,cAAc,CAAC;AAE7B,QAAA,OAAO,MAAM,cAAc,CAAC,WAAW,EAAE,cAAc,CAAC;;YAChD;AACR,QAAA,MAAM,oBAAoB,CAAC,WAAW,CAAC;;AAE3C;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BG;AACI,eAAe,iBAAiB,CACrC,SAAiE,EACjE,OAKC,EAAA;IAED,MAAM,cAAc,GAAG,mBAAmB;IAC1C,MAAM,cAAc,GAAG,WAAW;IAClC,MAAM,YAAY,GAAG,SAAS;AAC9B,IAAA,MAAM,EAAC,GAAG,EAAE,YAAY,EAAC,GAAG,OAAO;AAEnC,IAAA,oBAAoB,CAAC,GAAG,EAAE,YAAY,CAAC;IAEvCD,eAAc,CAAC,cAAc,CAAC;AAC9B,IAAA,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC;AACjD,IAAA,IAAI;QACFA,eAAc,CAAC,cAAc,CAAC;QAC9B,MAAM,cAAc,GAAG,MAAM,SAAS,CAAC,EAAC,WAAW,EAAC,CAAC;QACrDC,cAAa,CAAC,cAAc,CAAC;QAE7BD,eAAc,CAAC,YAAY,CAAC;QAE5B,MAAM,cAAc,GAAG,YAAY;QACnCA,eAAc,CAAC,cAAc,CAAC;;AAE9B,QAAA,MAAM,cAAc,CAAC,UAAU,EAAE;QACjCC,cAAa,CAAC,cAAc,CAAC;QAE7B,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,cAAc,CAAC;QAClEA,cAAa,CAAC,YAAY,CAAC;AAC3B,QAAA,OAAO,QAAQ;;YACP;AACR,QAAA,MAAM,oBAAoB,CAAC,WAAW,CAAC;QACvCA,cAAa,CAAC,cAAc,CAAC;;AAEjC;AAEA,SAAS,oBAAoB,CAAC,GAAuB,EAAE,YAAkC,EAAA;AACvF,IAAA,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;AAC3B,QAAA,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC;AAC/B,QAAA,IAAI,SAAS,KAAK,IAAI,EAAE;AACtB,YAAA,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ;AACnC,YAAA,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,YAAY,CAAC;YAClE,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE;AAC7C,gBAAA,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAA,2DAAA,CAA6D,CAAC;;;;AAIjG;AAEA;;;;;;;AAOG;AACa,SAAA,aAAa,CAAC,QAAgB,EAAE,YAAiC,EAAA;AAC/E,IAAA,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;AACvD,QAAA,OAAO,IAAI;;AAGb,IAAA,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE;QACtC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YACjC;;QAGF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AACnC,QAAA,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;AAC7B,YAAA,OAAO,IAAI;;;AAIf,IAAA,OAAO,KAAK;AACd;;ACtZA;;;;AAIG;AAIH;;AAEG;AACU,MAAA,OAAO,mBAAmB,IAAI,OAAO,CAAC,mBAAmB;;;;"}
+{"version":3,"file":"platform-server.mjs","sources":["../../../../../darwin_arm64-fastbuild-ST-199a4f3c4e20/bin/packages/platform-server/src/provide_server.ts","../../../../../darwin_arm64-fastbuild-ST-199a4f3c4e20/bin/packages/platform-server/src/utils.ts","../../../../../darwin_arm64-fastbuild-ST-199a4f3c4e20/bin/packages/platform-server/src/version.ts"],"sourcesContent":["/**\n * @license\n * Copyright Google LLC All Rights Reserved.\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n */\n\nimport {EnvironmentProviders, makeEnvironmentProviders} from '@angular/core';\n\nimport {PLATFORM_SERVER_PROVIDERS} from './server';\n\n/**\n * Sets up providers necessary to enable server rendering functionality for the application.\n *\n * @usageNotes\n *\n * Basic example of how you can add server support to your application:\n * ```ts\n * bootstrapApplication(AppComponent, {\n *   providers: [provideServerRendering()]\n * });\n * ```\n *\n * @publicApi\n * @returns A set of providers to setup the server.\n */\nexport function provideServerRendering(): EnvironmentProviders {\n  if (typeof ngServerMode === 'undefined') {\n    globalThis['ngServerMode'] = true;\n  }\n\n  return makeEnvironmentProviders([...PLATFORM_SERVER_PROVIDERS]);\n}\n","/**\n * @license\n * Copyright Google LLC All Rights Reserved.\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n */\n\nimport {\n  APP_ID,\n  ApplicationRef,\n  CSP_NONCE,\n  InjectionToken,\n  PlatformRef,\n  Provider,\n  Renderer2,\n  StaticProvider,\n  Type,\n  ɵannotateForHydration as annotateForHydration,\n  ɵIS_HYDRATION_DOM_REUSE_ENABLED as IS_HYDRATION_DOM_REUSE_ENABLED,\n  ɵSSR_CONTENT_INTEGRITY_MARKER as SSR_CONTENT_INTEGRITY_MARKER,\n  ɵstartMeasuring as startMeasuring,\n  ɵstopMeasuring as stopMeasuring,\n  ɵRuntimeError as RuntimeError,\n} from '@angular/core';\nimport {BootstrapContext} from '@angular/platform-browser';\n\nimport {RuntimeErrorCode} from './errors';\nimport {platformServer} from './server';\nimport {PlatformState} from './platform_state';\nimport {BEFORE_APP_SERIALIZED, INITIAL_CONFIG, PlatformConfig} from './tokens';\nimport {createScript} from './transfer_state';\nimport {parseUrl} from './url';\n\n/**\n * Event dispatch (JSAction) script is inlined into the HTML by the build\n * process to avoid extra blocking request on a page. The script looks like this:\n * ```html\n * <script type=\"text/javascript\" id=\"ng-event-dispatch-contract\">...</script>\n * ```\n * This const represents the \"id\" attribute value.\n */\nexport const EVENT_DISPATCH_SCRIPT_ID = 'ng-event-dispatch-contract';\n\ninterface PlatformOptions extends Omit<PlatformConfig, 'document'> {\n  document?: string | Document;\n  platformProviders?: Provider[];\n}\n\n/**\n * Creates an instance of a server platform (with or without JIT compiler support\n * depending on the `ngJitMode` global const value), using provided options.\n */\nfunction createServerPlatform(options: PlatformOptions): PlatformRef {\n  const extraProviders = options.platformProviders ?? [];\n  const measuringLabel = 'createServerPlatform';\n  startMeasuring(measuringLabel);\n  const {document, url} = options;\n\n  const platform = platformServer([\n    {\n      provide: INITIAL_CONFIG,\n      useValue: {\n        document,\n        url,\n      },\n    },\n    extraProviders,\n  ]);\n\n  stopMeasuring(measuringLabel);\n  return platform;\n}\n\n/**\n * Finds and returns inlined event dispatch script if it exists.\n * See the `EVENT_DISPATCH_SCRIPT_ID` const docs for additional info.\n */\nfunction findEventDispatchScript(doc: Document) {\n  return doc.getElementById(EVENT_DISPATCH_SCRIPT_ID);\n}\n\n/**\n * Removes inlined event dispatch script if it exists.\n * See the `EVENT_DISPATCH_SCRIPT_ID` const docs for additional info.\n */\nfunction removeEventDispatchScript(doc: Document) {\n  findEventDispatchScript(doc)?.remove();\n}\n\n/**\n * Annotate nodes for hydration and remove event dispatch script when not needed.\n */\nfunction prepareForHydration(platformState: PlatformState, applicationRef: ApplicationRef): void {\n  const measuringLabel = 'prepareForHydration';\n  startMeasuring(measuringLabel);\n  const environmentInjector = applicationRef.injector;\n  const doc = platformState.getDocument();\n\n  if (!environmentInjector.get(IS_HYDRATION_DOM_REUSE_ENABLED, false)) {\n    // Hydration is diabled, remove inlined event dispatch script.\n    // (which was injected by the build process) from the HTML.\n    removeEventDispatchScript(doc);\n\n    return;\n  }\n\n  appendSsrContentIntegrityMarker(doc);\n\n  const eventTypesToReplay = annotateForHydration(applicationRef, doc);\n  if (eventTypesToReplay.regular.size || eventTypesToReplay.capture.size) {\n    insertEventRecordScript(\n      environmentInjector.get(APP_ID),\n      doc,\n      eventTypesToReplay,\n      environmentInjector.get(CSP_NONCE, null),\n    );\n  } else {\n    // No events to replay, we should remove inlined event dispatch script\n    // (which was injected by the build process) from the HTML.\n    removeEventDispatchScript(doc);\n  }\n  stopMeasuring(measuringLabel);\n}\n\n/**\n * Creates a marker comment node and append it into the `<body>`.\n * Some CDNs have mechanisms to remove all comment node from HTML.\n * This behaviour breaks hydration, so we'll detect on the client side if this\n * marker comment is still available or else throw an error\n */\nfunction appendSsrContentIntegrityMarker(doc: Document) {\n  // Adding a ng hydration marker comment\n  const comment = doc.createComment(SSR_CONTENT_INTEGRITY_MARKER);\n  doc.body.firstChild\n    ? doc.body.insertBefore(comment, doc.body.firstChild)\n    : doc.body.append(comment);\n}\n\n/**\n * Adds the `ng-server-context` attribute to host elements of all bootstrapped components\n * within a given application.\n */\nfunction appendServerContextInfo(applicationRef: ApplicationRef) {\n  const injector = applicationRef.injector;\n  let serverContext = sanitizeServerContext(injector.get(SERVER_CONTEXT, DEFAULT_SERVER_CONTEXT));\n  applicationRef.components.forEach((componentRef) => {\n    const renderer = componentRef.injector.get(Renderer2);\n    const element = componentRef.location.nativeElement;\n    if (element) {\n      renderer.setAttribute(element, 'ng-server-context', serverContext);\n    }\n  });\n}\n\nfunction insertEventRecordScript(\n  appId: string,\n  doc: Document,\n  eventTypesToReplay: {regular: Set<string>; capture: Set<string>},\n  nonce: string | null,\n): void {\n  const measuringLabel = 'insertEventRecordScript';\n  startMeasuring(measuringLabel);\n  const {regular, capture} = eventTypesToReplay;\n  const eventDispatchScript = findEventDispatchScript(doc);\n\n  // Note: this is only true when build with the CLI tooling, which inserts the script in the HTML\n  if (eventDispatchScript) {\n    // This is defined in packages/core/primitives/event-dispatch/contract_binary.ts\n    const replayScriptContents =\n      `window.__jsaction_bootstrap(` +\n      `document.body,` +\n      `\"${appId}\",` +\n      `${JSON.stringify(Array.from(regular))},` +\n      `${JSON.stringify(Array.from(capture))}` +\n      `);`;\n\n    const replayScript = createScript(doc, replayScriptContents, nonce);\n\n    // Insert replay script right after inlined event dispatch script, since it\n    // relies on `__jsaction_bootstrap` to be defined in the global scope.\n    eventDispatchScript.after(replayScript);\n  }\n  stopMeasuring(measuringLabel);\n}\n\n/**\n * Renders an Angular application to a string.\n *\n * @private\n *\n * @param platformRef - Reference to the Angular platform.\n * @param applicationRef - Reference to the Angular application.\n * @returns A promise that resolves to the rendered string.\n */\nexport async function renderInternal(\n  platformRef: PlatformRef,\n  applicationRef: ApplicationRef,\n): Promise<string> {\n  const platformState = platformRef.injector.get(PlatformState);\n  prepareForHydration(platformState, applicationRef);\n  appendServerContextInfo(applicationRef);\n\n  // Run any BEFORE_APP_SERIALIZED callbacks just before rendering to string.\n  const environmentInjector = applicationRef.injector;\n  const callbacks = environmentInjector.get(BEFORE_APP_SERIALIZED, null);\n  if (callbacks) {\n    const asyncCallbacks: Promise<void>[] = [];\n    for (const callback of callbacks) {\n      try {\n        const callbackResult = callback();\n        if (callbackResult) {\n          asyncCallbacks.push(callbackResult);\n        }\n      } catch (e) {\n        // Ignore exceptions.\n        console.warn('Ignoring BEFORE_APP_SERIALIZED Exception: ', e);\n      }\n    }\n\n    if (asyncCallbacks.length) {\n      for (const result of await Promise.allSettled(asyncCallbacks)) {\n        if (result.status === 'rejected') {\n          console.warn('Ignoring BEFORE_APP_SERIALIZED Exception: ', result.reason);\n        }\n      }\n    }\n  }\n\n  return platformState.renderToString();\n}\n\n/**\n * Destroy the application in a macrotask, this allows pending promises to be settled and errors\n * to be surfaced to the users.\n */\nfunction asyncDestroyPlatform(platformRef: PlatformRef): Promise<void> {\n  return new Promise<void>((resolve) => {\n    setTimeout(() => {\n      platformRef.destroy();\n      resolve();\n    }, 0);\n  });\n}\n\n/**\n * Specifies the value that should be used if no server context value has been provided.\n */\nconst DEFAULT_SERVER_CONTEXT = 'other';\n\n/**\n * An internal token that allows providing extra information about the server context\n * (e.g. whether SSR or SSG was used). The value is a string and characters other\n * than [a-zA-Z0-9\\-] are removed. See the default value in `DEFAULT_SERVER_CONTEXT` const.\n */\nexport const SERVER_CONTEXT = new InjectionToken<string>('SERVER_CONTEXT');\n\n/**\n * Sanitizes provided server context:\n * - removes all characters other than a-z, A-Z, 0-9 and `-`\n * - returns `other` if nothing is provided or the string is empty after sanitization\n */\nfunction sanitizeServerContext(serverContext: string): string {\n  const context = serverContext.replace(/[^a-zA-Z0-9\\-]/g, '');\n  return context.length > 0 ? context : DEFAULT_SERVER_CONTEXT;\n}\n\n/**\n * Bootstraps an application using provided NgModule and serializes the page content to string.\n *\n * @param moduleType A reference to an NgModule that should be used for bootstrap.\n * @param options Additional configuration for the render operation:\n *  - `document` - the document of the page to render, either as an HTML string or\n *                 as a reference to the `document` instance.\n *  - `url` - the URL for the current render request.\n *  - `extraProviders` - set of platform level providers for the current render request.\n *  - `allowedHosts` - the allowed hosts list for host validation in server-side rendering.\n * @publicApi\n */\nexport async function renderModule<T>(\n  moduleType: Type<T>,\n  options: {\n    document?: string | Document;\n    url?: string;\n    extraProviders?: StaticProvider[];\n    allowedHosts?: Readonly<string>[];\n  },\n): Promise<string> {\n  const {document, url, extraProviders: platformProviders, allowedHosts} = options;\n  validateAllowedHosts(url, allowedHosts);\n  const platformRef = createServerPlatform({document, url, platformProviders});\n  try {\n    const moduleRef = await platformRef.bootstrapModule(moduleType);\n    const applicationRef = moduleRef.injector.get(ApplicationRef);\n\n    const measuringLabel = 'whenStable';\n    startMeasuring(measuringLabel);\n    // Block until application is stable.\n    await applicationRef.whenStable();\n    stopMeasuring(measuringLabel);\n\n    return await renderInternal(platformRef, applicationRef);\n  } finally {\n    await asyncDestroyPlatform(platformRef);\n  }\n}\n\n/**\n * Bootstraps an instance of an Angular application and renders it to a string.\n *\n * @usageNotes\n *\n * ```ts\n * import { BootstrapContext, bootstrapApplication } from '@angular/platform-browser';\n * import { renderApplication } from '@angular/platform-server';\n * import { ApplicationConfig } from '@angular/core';\n * import { AppComponent } from './app.component';\n *\n * const appConfig: ApplicationConfig = { providers: [...] };\n * const bootstrap = (context: BootstrapContext) =>\n *   bootstrapApplication(AppComponent, config, context);\n * const output = await renderApplication(bootstrap);\n * ```\n *\n * @param bootstrap A method that when invoked returns a promise that returns an `ApplicationRef`\n *     instance once resolved. The method is invoked with an `Injector` instance that\n *     provides access to the platform-level dependency injection context.\n * @param options Additional configuration for the render operation:\n *  - `document` - the document of the page to render, either as an HTML string or\n *                 as a reference to the `document` instance.\n *  - `url` - the URL for the current render request.\n *  - `platformProviders` - the platform level providers for the current render request.\n *  - `allowedHosts` - the allowed hosts list for host validation in server-side rendering.\n *\n * @returns A Promise, that returns serialized (to a string) rendered page, once resolved.\n *\n * @publicApi\n */\nexport async function renderApplication(\n  bootstrap: (context: BootstrapContext) => Promise<ApplicationRef>,\n  options: {\n    document?: string | Document;\n    url?: string;\n    platformProviders?: Provider[];\n    allowedHosts?: Readonly<string>[];\n  },\n): Promise<string> {\n  const renderAppLabel = 'renderApplication';\n  const bootstrapLabel = 'bootstrap';\n  const _renderLabel = '_render';\n  const {url, allowedHosts} = options;\n\n  validateAllowedHosts(url, allowedHosts);\n\n  startMeasuring(renderAppLabel);\n  const platformRef = createServerPlatform(options);\n  try {\n    startMeasuring(bootstrapLabel);\n    const applicationRef = await bootstrap({platformRef});\n    stopMeasuring(bootstrapLabel);\n\n    startMeasuring(_renderLabel);\n\n    const measuringLabel = 'whenStable';\n    startMeasuring(measuringLabel);\n    // Block until application is stable.\n    await applicationRef.whenStable();\n    stopMeasuring(measuringLabel);\n\n    const rendered = await renderInternal(platformRef, applicationRef);\n    stopMeasuring(_renderLabel);\n    return rendered;\n  } finally {\n    await asyncDestroyPlatform(platformRef);\n    stopMeasuring(renderAppLabel);\n  }\n}\n\nfunction validateAllowedHosts(url: string | undefined, allowedHosts: string[] | undefined) {\n  if (typeof url === 'string') {\n    const parsedUrl = parseUrl(url);\n    if (parsedUrl !== null) {\n      const hostname = parsedUrl.hostname;\n      const allowedHostsSet: ReadonlySet<string> = new Set(allowedHosts);\n      if (!isHostAllowed(hostname, allowedHostsSet)) {\n        throw new RuntimeError(\n          RuntimeErrorCode.HOST_NOT_ALLOWED,\n          typeof ngDevMode === 'undefined' || ngDevMode\n            ? `Host ${url} is not allowed. You can configure \\`allowedHosts\\` option.`\n            : url,\n        );\n      }\n    }\n  }\n}\n\n/**\n * Checks if the hostname is allowed.\n * @param hostname - The hostname to check.\n * @param allowedHosts - A set of allowed hostnames.\n * @returns `true` if the hostname is allowed, `false` otherwise.\n * @note Used also in `@angular/ssr`.\n * @private\n */\nexport function isHostAllowed(hostname: string, allowedHosts: ReadonlySet<string>): boolean {\n  if (allowedHosts.has('*') || allowedHosts.has(hostname)) {\n    return true;\n  }\n\n  for (const allowedHost of allowedHosts) {\n    if (!allowedHost.startsWith('*.')) {\n      continue;\n    }\n\n    const domain = allowedHost.slice(1);\n    if (hostname.endsWith(domain)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n","/**\n * @license\n * Copyright Google LLC All Rights Reserved.\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n */\n\n/**\n * @module\n * @description\n * Entry point for all public APIs of the platform-server package.\n */\n\nimport {Version} from '@angular/core';\n\n/**\n * @publicApi\n */\nexport const VERSION = /* @__PURE__ */ new Version('20.3.26');\n"],"names":["startMeasuring","stopMeasuring","IS_HYDRATION_DOM_REUSE_ENABLED","annotateForHydration","SSR_CONTENT_INTEGRITY_MARKER","RuntimeError"],"mappings":";;;;;;;;;;;;;;AAYA;;;;;;;;;;;;;;AAcG;SACa,sBAAsB,GAAA;AACpC,IAAA,IAAI,OAAO,YAAY,KAAK,WAAW,EAAE;AACvC,QAAA,UAAU,CAAC,cAAc,CAAC,GAAG,IAAI;;AAGnC,IAAA,OAAO,wBAAwB,CAAC,CAAC,GAAG,yBAAyB,CAAC,CAAC;AACjE;;ACCA;;;;;;;AAOG;AACI,MAAM,wBAAwB,GAAG,4BAA4B;AAOpE;;;AAGG;AACH,SAAS,oBAAoB,CAAC,OAAwB,EAAA;AACpD,IAAA,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE;IACtD,MAAM,cAAc,GAAG,sBAAsB;IAC7CA,eAAc,CAAC,cAAc,CAAC;AAC9B,IAAA,MAAM,EAAC,QAAQ,EAAE,GAAG,EAAC,GAAG,OAAO;IAE/B,MAAM,QAAQ,GAAG,cAAc,CAAC;AAC9B,QAAA;AACE,YAAA,OAAO,EAAE,cAAc;AACvB,YAAA,QAAQ,EAAE;gBACR,QAAQ;gBACR,GAAG;AACJ,aAAA;AACF,SAAA;QACD,cAAc;AACf,KAAA,CAAC;IAEFC,cAAa,CAAC,cAAc,CAAC;AAC7B,IAAA,OAAO,QAAQ;AACjB;AAEA;;;AAGG;AACH,SAAS,uBAAuB,CAAC,GAAa,EAAA;AAC5C,IAAA,OAAO,GAAG,CAAC,cAAc,CAAC,wBAAwB,CAAC;AACrD;AAEA;;;AAGG;AACH,SAAS,yBAAyB,CAAC,GAAa,EAAA;AAC9C,IAAA,uBAAuB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE;AACxC;AAEA;;AAEG;AACH,SAAS,mBAAmB,CAAC,aAA4B,EAAE,cAA8B,EAAA;IACvF,MAAM,cAAc,GAAG,qBAAqB;IAC5CD,eAAc,CAAC,cAAc,CAAC;AAC9B,IAAA,MAAM,mBAAmB,GAAG,cAAc,CAAC,QAAQ;AACnD,IAAA,MAAM,GAAG,GAAG,aAAa,CAAC,WAAW,EAAE;IAEvC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAACE,+BAA8B,EAAE,KAAK,CAAC,EAAE;;;QAGnE,yBAAyB,CAAC,GAAG,CAAC;QAE9B;;IAGF,+BAA+B,CAAC,GAAG,CAAC;IAEpC,MAAM,kBAAkB,GAAGC,qBAAoB,CAAC,cAAc,EAAE,GAAG,CAAC;AACpE,IAAA,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE;QACtE,uBAAuB,CACrB,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAC/B,GAAG,EACH,kBAAkB,EAClB,mBAAmB,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CACzC;;SACI;;;QAGL,yBAAyB,CAAC,GAAG,CAAC;;IAEhCF,cAAa,CAAC,cAAc,CAAC;AAC/B;AAEA;;;;;AAKG;AACH,SAAS,+BAA+B,CAAC,GAAa,EAAA;;IAEpD,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAACG,6BAA4B,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC;AACP,UAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU;UAClD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9B;AAEA;;;AAGG;AACH,SAAS,uBAAuB,CAAC,cAA8B,EAAA;AAC7D,IAAA,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ;AACxC,IAAA,IAAI,aAAa,GAAG,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IAC/F,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,YAAY,KAAI;QACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;AACrD,QAAA,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,aAAa;QACnD,IAAI,OAAO,EAAE;YACX,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,aAAa,CAAC;;AAEtE,KAAC,CAAC;AACJ;AAEA,SAAS,uBAAuB,CAC9B,KAAa,EACb,GAAa,EACb,kBAAgE,EAChE,KAAoB,EAAA;IAEpB,MAAM,cAAc,GAAG,yBAAyB;IAChDJ,eAAc,CAAC,cAAc,CAAC;AAC9B,IAAA,MAAM,EAAC,OAAO,EAAE,OAAO,EAAC,GAAG,kBAAkB;AAC7C,IAAA,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,GAAG,CAAC;;IAGxD,IAAI,mBAAmB,EAAE;;QAEvB,MAAM,oBAAoB,GACxB,CAA8B,4BAAA,CAAA;YAC9B,CAAgB,cAAA,CAAA;AAChB,YAAA,CAAA,CAAA,EAAI,KAAK,CAAI,EAAA,CAAA;YACb,CAAG,EAAA,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAG,CAAA,CAAA;YACzC,CAAG,EAAA,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAA;AACxC,YAAA,CAAA,EAAA,CAAI;QAEN,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,CAAC;;;AAInE,QAAA,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC;;IAEzCC,cAAa,CAAC,cAAc,CAAC;AAC/B;AAEA;;;;;;;;AAQG;AACI,eAAe,cAAc,CAClC,WAAwB,EACxB,cAA8B,EAAA;IAE9B,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC;AAC7D,IAAA,mBAAmB,CAAC,aAAa,EAAE,cAAc,CAAC;IAClD,uBAAuB,CAAC,cAAc,CAAC;;AAGvC,IAAA,MAAM,mBAAmB,GAAG,cAAc,CAAC,QAAQ;IACnD,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC;IACtE,IAAI,SAAS,EAAE;QACb,MAAM,cAAc,GAAoB,EAAE;AAC1C,QAAA,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE;AAChC,YAAA,IAAI;AACF,gBAAA,MAAM,cAAc,GAAG,QAAQ,EAAE;gBACjC,IAAI,cAAc,EAAE;AAClB,oBAAA,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC;;;YAErC,OAAO,CAAC,EAAE;;AAEV,gBAAA,OAAO,CAAC,IAAI,CAAC,4CAA4C,EAAE,CAAC,CAAC;;;AAIjE,QAAA,IAAI,cAAc,CAAC,MAAM,EAAE;YACzB,KAAK,MAAM,MAAM,IAAI,MAAM,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE;AAC7D,gBAAA,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE;oBAChC,OAAO,CAAC,IAAI,CAAC,4CAA4C,EAAE,MAAM,CAAC,MAAM,CAAC;;;;;AAMjF,IAAA,OAAO,aAAa,CAAC,cAAc,EAAE;AACvC;AAEA;;;AAGG;AACH,SAAS,oBAAoB,CAAC,WAAwB,EAAA;AACpD,IAAA,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,KAAI;QACnC,UAAU,CAAC,MAAK;YACd,WAAW,CAAC,OAAO,EAAE;AACrB,YAAA,OAAO,EAAE;SACV,EAAE,CAAC,CAAC;AACP,KAAC,CAAC;AACJ;AAEA;;AAEG;AACH,MAAM,sBAAsB,GAAG,OAAO;AAEtC;;;;AAIG;MACU,cAAc,GAAG,IAAI,cAAc,CAAS,gBAAgB;AAEzE;;;;AAIG;AACH,SAAS,qBAAqB,CAAC,aAAqB,EAAA;IAClD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;AAC5D,IAAA,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,GAAG,sBAAsB;AAC9D;AAEA;;;;;;;;;;;AAWG;AACI,eAAe,YAAY,CAChC,UAAmB,EACnB,OAKC,EAAA;AAED,IAAA,MAAM,EAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAC,GAAG,OAAO;AAChF,IAAA,oBAAoB,CAAC,GAAG,EAAE,YAAY,CAAC;AACvC,IAAA,MAAM,WAAW,GAAG,oBAAoB,CAAC,EAAC,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAC,CAAC;AAC5E,IAAA,IAAI;QACF,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC;QAC/D,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC;QAE7D,MAAM,cAAc,GAAG,YAAY;QACnCD,eAAc,CAAC,cAAc,CAAC;;AAE9B,QAAA,MAAM,cAAc,CAAC,UAAU,EAAE;QACjCC,cAAa,CAAC,cAAc,CAAC;AAE7B,QAAA,OAAO,MAAM,cAAc,CAAC,WAAW,EAAE,cAAc,CAAC;;YAChD;AACR,QAAA,MAAM,oBAAoB,CAAC,WAAW,CAAC;;AAE3C;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BG;AACI,eAAe,iBAAiB,CACrC,SAAiE,EACjE,OAKC,EAAA;IAED,MAAM,cAAc,GAAG,mBAAmB;IAC1C,MAAM,cAAc,GAAG,WAAW;IAClC,MAAM,YAAY,GAAG,SAAS;AAC9B,IAAA,MAAM,EAAC,GAAG,EAAE,YAAY,EAAC,GAAG,OAAO;AAEnC,IAAA,oBAAoB,CAAC,GAAG,EAAE,YAAY,CAAC;IAEvCD,eAAc,CAAC,cAAc,CAAC;AAC9B,IAAA,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC;AACjD,IAAA,IAAI;QACFA,eAAc,CAAC,cAAc,CAAC;QAC9B,MAAM,cAAc,GAAG,MAAM,SAAS,CAAC,EAAC,WAAW,EAAC,CAAC;QACrDC,cAAa,CAAC,cAAc,CAAC;QAE7BD,eAAc,CAAC,YAAY,CAAC;QAE5B,MAAM,cAAc,GAAG,YAAY;QACnCA,eAAc,CAAC,cAAc,CAAC;;AAE9B,QAAA,MAAM,cAAc,CAAC,UAAU,EAAE;QACjCC,cAAa,CAAC,cAAc,CAAC;QAE7B,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,cAAc,CAAC;QAClEA,cAAa,CAAC,YAAY,CAAC;AAC3B,QAAA,OAAO,QAAQ;;YACP;AACR,QAAA,MAAM,oBAAoB,CAAC,WAAW,CAAC;QACvCA,cAAa,CAAC,cAAc,CAAC;;AAEjC;AAEA,SAAS,oBAAoB,CAAC,GAAuB,EAAE,YAAkC,EAAA;AACvF,IAAA,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;AAC3B,QAAA,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC;AAC/B,QAAA,IAAI,SAAS,KAAK,IAAI,EAAE;AACtB,YAAA,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ;AACnC,YAAA,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,YAAY,CAAC;YAClE,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE;gBAC7C,MAAM,IAAII,aAAY,CAEpB,IAAA,0CAAA,OAAO,SAAS,KAAK,WAAW,IAAI;sBAChC,CAAQ,KAAA,EAAA,GAAG,CAA6D,2DAAA;sBACxE,GAAG,CACR;;;;AAIT;AAEA;;;;;;;AAOG;AACa,SAAA,aAAa,CAAC,QAAgB,EAAE,YAAiC,EAAA;AAC/E,IAAA,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;AACvD,QAAA,OAAO,IAAI;;AAGb,IAAA,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE;QACtC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YACjC;;QAGF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AACnC,QAAA,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;AAC7B,YAAA,OAAO,IAAI;;;AAIf,IAAA,OAAO,KAAK;AACd;;AC7ZA;;;;AAIG;AAIH;;AAEG;AACU,MAAA,OAAO,mBAAmB,IAAI,OAAO,CAAC,mBAAmB;;;;"}

package/fesm2022/server.mjs

@@ -1,12 +1,12 @@
 /**
- * @license Angular v20.3.24
+ * @license Angular v20.3.26
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */
 
 import { ɵsetRootDomAdapter as _setRootDomAdapter, DOCUMENT, XhrFactory, PlatformLocation, ɵgetDOM as _getDOM, ɵPLATFORM_SERVER_ID as _PLATFORM_SERVER_ID, ViewportScroller, ɵNullViewportScroller as _NullViewportScroller } from '@angular/common';
 import * as i0 from '@angular/core';
-import { InjectionToken, inject, Injector, ɵstartMeasuring as _startMeasuring, ɵstopMeasuring as _stopMeasuring, Injectable, Inject, Optional, APP_ID, TransferState, PLATFORM_ID, PLATFORM_INITIALIZER, NgModule, ɵsetDocument as _setDocument, createPlatformFactory, platformCore, Testability, ɵTESTABILITY as _TESTABILITY } from '@angular/core';
+import { ɵRuntimeError as _RuntimeError, InjectionToken, inject, Injector, ɵstartMeasuring as _startMeasuring, ɵstopMeasuring as _stopMeasuring, Injectable, Inject, Optional, APP_ID, TransferState, PLATFORM_ID, PLATFORM_INITIALIZER, NgModule, ɵsetDocument as _setDocument, createPlatformFactory, platformCore, Testability, ɵTESTABILITY as _TESTABILITY } from '@angular/core';
 import { ɵBrowserDomAdapter as _BrowserDomAdapter, EventManagerPlugin, EVENT_MANAGER_PLUGINS, BrowserModule } from '@angular/platform-browser';
 import { ɵHTTP_ROOT_INTERCEPTOR_FNS as _HTTP_ROOT_INTERCEPTOR_FNS } from '@angular/common/http';
 import { Subject } from 'rxjs';
@@ -17184,7 +17184,7 @@ class DominoAdapter extends _BrowserDomAdapter {
         return 'Fake user agent';
     }
     getCookie(name) {
-        throw new Error('getCookie has not been implemented');
+        throw new _RuntimeError(5700 /* RuntimeErrorCode.GET_COOKIE_NOT_IMPLEMENTED */, (typeof ngDevMode === 'undefined' || ngDevMode) && 'getCookie has not been implemented');
     }
 }
 
@@ -17220,7 +17220,8 @@ class PlatformState {
      */
     renderToString() {
         if (ngDevMode && !this._enableDomEmulation && !window?.document) {
-            throw new Error('Disabled DOM emulation should only run in browser environments');
+            throw new _RuntimeError(5704 /* RuntimeErrorCode.DISABLED_DOM_EMULATION_IN_NON_BROWSER */, (typeof ngDevMode === 'undefined' || ngDevMode) &&
+                'Disabled DOM emulation should only run in browser environments');
         }
         const measuringLabel = 'renderToString';
         _startMeasuring(measuringLabel);
@@ -17237,10 +17238,10 @@ class PlatformState {
     getDocument() {
         return this._doc;
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: PlatformState, deps: [{ token: DOCUMENT }], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: PlatformState });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: PlatformState, deps: [{ token: DOCUMENT }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: PlatformState });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: PlatformState, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: PlatformState, decorators: [{
             type: Injectable
         }], ctorParameters: () => [{ type: undefined, decorators: [{
                     type: Inject,
@@ -17266,8 +17267,9 @@ function parseUrl(urlStr, origin, options = {}) {
         resolved = new URL(urlStr);
     }
     catch { }
+    const { allowProtocolRelative = false, allowOriginChange = true } = options;
     if (resolved) {
-        if (originUrl && !isSafeOriginChange(resolved, originUrl, urlStr)) {
+        if (originUrl && !isSafeOriginChange(resolved, originUrl, urlStr, allowOriginChange)) {
             throwSuspiciousUrlError(urlStr);
         }
         return resolved;
@@ -17278,22 +17280,23 @@ function parseUrl(urlStr, origin, options = {}) {
     // absolute URL. Since it is malformed, the native URL constructor will throw a validation
     // error. Standard relative/protocol-relative paths parse successfully, allowing the flow to continue.
     if (!URL.canParse(urlStr, 'http://fake')) {
-        throw new Error(`Invalid URL: ${urlStr}`);
+        throw new _RuntimeError(5701 /* RuntimeErrorCode.INVALID_URL */, typeof ngDevMode === 'undefined' || ngDevMode ? `Invalid URL: ${urlStr}` : urlStr);
     }
     if (!originUrl) {
         return null;
     }
-    const { allowProtocolRelative = false } = options;
     // Check if we have a legitimate protocol-relative URL (starts with '//' and not a duplicate/backslash bypass)
     // and we are configured to allow and preserve standard cross-origin protocol-relative requests.
     if (urlStr.startsWith('//')) {
         if (!allowProtocolRelative) {
-            throw new Error(`Protocol relative URLs are not allowed in this context. URL: ${urlStr}`);
+            throw new _RuntimeError(5702 /* RuntimeErrorCode.PROTOCOL_RELATIVE_URL_NOT_ALLOWED */, typeof ngDevMode === 'undefined' || ngDevMode
+                ? `Protocol relative URLs are not allowed in this context. URL: ${urlStr}`
+                : urlStr);
         }
         return new URL(urlStr, origin);
     }
     resolved = new URL(urlStr, origin);
-    if (!isSafeOriginChange(resolved, originUrl, urlStr)) {
+    if (!isSafeOriginChange(resolved, originUrl, urlStr, allowOriginChange)) {
         throwSuspiciousUrlError(urlStr);
     }
     return resolved;
@@ -17302,7 +17305,9 @@ function parseUrl(urlStr, origin, options = {}) {
  * Throws a suspicious URL error indicating a security bypass attempt.
  */
 function throwSuspiciousUrlError(urlStr) {
-    throw new Error(`URL ${urlStr} changed origin unexpectedly. This is suspicious and may indicate a security bypass attempt.`);
+    throw new _RuntimeError(5703 /* RuntimeErrorCode.SUSPICIOUS_URL_CHANGE_ORIGIN */, typeof ngDevMode === 'undefined' || ngDevMode
+        ? `URL ${urlStr} changed origin unexpectedly. This is suspicious and may indicate a security bypass attempt.`
+        : urlStr);
 }
 /**
  * Checks if the origin has changed in a safe way.
@@ -17310,12 +17315,25 @@ function throwSuspiciousUrlError(urlStr) {
  * @param resolved The resolved URL.
  * @param origin The origin URL.
  * @param urlStr The URL string.
+ * @param allowOriginChange Whether to allow origin changes.
  * @returns True if the origin has changed in a safe way, false otherwise.
  */
-function isSafeOriginChange(resolved, origin, urlStr) {
-    return origin.origin === resolved.origin || HTTP_OR_HTTPS_PROTOCOL_REGEX.test(urlStr);
+function isSafeOriginChange(resolved, origin, urlStr, allowOriginChange) {
+    if (origin.origin === resolved.origin) {
+        return true;
+    }
+    if (!allowOriginChange) {
+        return false;
+    }
+    return HTTP_OR_HTTPS_PROTOCOL_REGEX.test(urlStr);
 }
 
+/**
+ * @deprecated Use the HttpClient fetch backend (by enabling `withFetch()`) instead.
+ * XHR support in `@angular/platform-server` is deprecated because the underlying `xhr2`
+ * library does not safely handle redirects (e.g. it can forward `Authorization` headers
+ * on cross-origin redirects and is susceptible to denial-of-service (DoS) via redirect loops).
+ */
 class ServerXhr {
     xhrImpl;
     // The `xhr2` dependency has a side-effect of accessing and modifying a
@@ -17324,6 +17342,13 @@ class ServerXhr {
     // server platform (via shims, etc).
     async ɵloadImpl() {
         if (!this.xhrImpl) {
+            if (typeof ngDevMode === 'undefined' || ngDevMode) {
+                console.warn('XHR support in `@angular/platform-server` is deprecated and will be removed ' +
+                    'in a future version of Angular. It has known security and performance issues in server ' +
+                    'environments, such as forwarding `Authorization` headers on cross-origin ' +
+                    'redirects and susceptibility to denial-of-service (DoS) via redirect loops. ' +
+                    'Please enable the HttpClient fetch backend instead by using `withFetch()`.');
+            }
             const { default: xhr } = await import('xhr2');
             this.xhrImpl = xhr;
         }
@@ -17331,14 +17356,15 @@ class ServerXhr {
     build() {
         const impl = this.xhrImpl;
         if (!impl) {
-            throw new Error('Unexpected state in ServerXhr: XHR implementation is not loaded.');
+            throw new _RuntimeError(5705 /* RuntimeErrorCode.XHR_NOT_LOADED */, (typeof ngDevMode === 'undefined' || ngDevMode) &&
+                'Unexpected state in ServerXhr: XHR implementation is not loaded.');
         }
         return new impl.XMLHttpRequest();
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: ServerXhr, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: ServerXhr });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: ServerXhr, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: ServerXhr });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: ServerXhr, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: ServerXhr, decorators: [{
             type: Injectable
         }] });
 /**
@@ -17390,14 +17416,13 @@ class ServerPlatformLocation {
     search = '';
     hash = '';
     _hashUpdate = new Subject();
+    origin;
     constructor(_doc, _config) {
         this._doc = _doc;
+        let origin = this._doc.location.origin;
         const config = _config;
-        if (!config) {
-            return;
-        }
-        if (config.url) {
-            const { protocol, hostname, port, pathname, search, hash, href } = parseUrl(config.url, this._doc.location.origin);
+        if (config && config.url) {
+            const { protocol, hostname, port, pathname, search, hash, href, origin: parsedOrigin, } = parseUrl(config.url, origin);
             this.protocol = protocol;
             this.hostname = hostname;
             this.port = port;
@@ -17405,7 +17430,9 @@ class ServerPlatformLocation {
             this.search = search;
             this.hash = hash;
             this.href = href;
+            origin = parsedOrigin;
         }
+        this.origin = origin;
     }
     getBaseHrefFromDOM() {
         return _getDOM().getBaseHref(this._doc);
@@ -17438,7 +17465,9 @@ class ServerPlatformLocation {
     }
     replaceState(state, title, newUrl) {
         const oldUrl = this.url;
-        const { pathname, search, hash, href, protocol } = parseUrl(newUrl, this._doc.location.origin);
+        const { pathname, search, hash, href, protocol } = parseUrl(newUrl, this.origin, {
+            allowOriginChange: false,
+        });
         const writableThis = this;
         writableThis.pathname = pathname;
         writableThis.search = search;
@@ -17459,10 +17488,10 @@ class ServerPlatformLocation {
     getState() {
         return undefined;
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: ServerPlatformLocation, deps: [{ token: DOCUMENT }, { token: INITIAL_CONFIG, optional: true }], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: ServerPlatformLocation });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: ServerPlatformLocation, deps: [{ token: DOCUMENT }, { token: INITIAL_CONFIG, optional: true }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: ServerPlatformLocation });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: ServerPlatformLocation, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: ServerPlatformLocation, decorators: [{
             type: Injectable
         }], ctorParameters: () => [{ type: undefined, decorators: [{
                     type: Inject,
@@ -17487,10 +17516,10 @@ class ServerEventManagerPlugin extends EventManagerPlugin {
     addEventListener(element, eventName, handler, options) {
         return _getDOM().onAndCancel(element, eventName, handler, options);
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: ServerEventManagerPlugin, deps: [{ token: DOCUMENT }], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: ServerEventManagerPlugin });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: ServerEventManagerPlugin, deps: [{ token: DOCUMENT }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: ServerEventManagerPlugin });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: ServerEventManagerPlugin, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: ServerEventManagerPlugin, decorators: [{
             type: Injectable
         }], ctorParameters: () => [{ type: undefined, decorators: [{
                     type: Inject,
@@ -17603,11 +17632,11 @@ const PLATFORM_SERVER_PROVIDERS = [
  * @publicApi
  */
 class ServerModule {
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: ServerModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule });
-    static ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "20.3.24", ngImport: i0, type: ServerModule, exports: [BrowserModule] });
-    static ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: ServerModule, providers: PLATFORM_SERVER_PROVIDERS, imports: [BrowserModule] });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: ServerModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule });
+    static ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "20.3.26", ngImport: i0, type: ServerModule, exports: [BrowserModule] });
+    static ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: ServerModule, providers: PLATFORM_SERVER_PROVIDERS, imports: [BrowserModule] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.24", ngImport: i0, type: ServerModule, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.26", ngImport: i0, type: ServerModule, decorators: [{
             type: NgModule,
             args: [{
                     exports: [BrowserModule],