npm - @angular/ssr - Versions diffs - 21.2.0-rc.0 → 21.2.0-rc.1 - Mend

@angular/ssr 21.2.0-rc.0 → 21.2.0-rc.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/fesm2022/_validation-chunk.mjs +137 -0
package/fesm2022/_validation-chunk.mjs.map +1 -0
package/fesm2022/node.mjs +48 -6
package/fesm2022/node.mjs.map +1 -1
package/fesm2022/ssr.mjs +60 -11
package/fesm2022/ssr.mjs.map +1 -1
package/package.json +7 -7
package/types/_app-engine-chunk.d.ts +194 -0
package/types/node.d.ts +32 -5
package/types/ssr.d.ts +7 -154

package/fesm2022/_validation-chunk.mjs ADDED Viewed

@@ -0,0 +1,137 @@
+const HOST_HEADERS_TO_VALIDATE = new Set(['host', 'x-forwarded-host']);
+const VALID_PORT_REGEX = /^\d+$/;
+const VALID_PROTO_REGEX = /^https?$/i;
+const VALID_HOST_REGEX = /^[a-z0-9.:-]+$/i;
+const INVALID_PREFIX_REGEX = /^[/\\]{2}|(?:^|[/\\])\.\.?(?:[/\\]|$)/;
+function getFirstHeaderValue(value) {
+  return value?.toString().split(',', 1)[0]?.trim();
+}
+function validateRequest(request, allowedHosts) {
+  validateHeaders(request);
+  validateUrl(new URL(request.url), allowedHosts);
+}
+function validateUrl(url, allowedHosts) {
+  const {
+    hostname
+  } = url;
+  if (!isHostAllowed(hostname, allowedHosts)) {
+    throw new Error(`URL with hostname "${hostname}" is not allowed.`);
+  }
+}
+function cloneRequestAndPatchHeaders(request, allowedHosts) {
+  let onError;
+  const onErrorPromise = new Promise(resolve => {
+    onError = resolve;
+  });
+  const clonedReq = new Request(request.clone(), {
+    signal: request.signal
+  });
+  const headers = clonedReq.headers;
+  const originalGet = headers.get;
+  headers.get = function (name) {
+    const value = originalGet.call(headers, name);
+    if (!value) {
+      return value;
+    }
+    validateHeader(name, value, allowedHosts, onError);
+    return value;
+  };
+  const originalValues = headers.values;
+  headers.values = function () {
+    for (const name of HOST_HEADERS_TO_VALIDATE) {
+      validateHeader(name, originalGet.call(headers, name), allowedHosts, onError);
+    }
+    return originalValues.call(headers);
+  };
+  const originalEntries = headers.entries;
+  headers.entries = function () {
+    const iterator = originalEntries.call(headers);
+    return {
+      next() {
+        const result = iterator.next();
+        if (!result.done) {
+          const [key, value] = result.value;
+          validateHeader(key, value, allowedHosts, onError);
+        }
+        return result;
+      },
+      [Symbol.iterator]() {
+        return this;
+      }
+    };
+  };
+  headers[Symbol.iterator] = headers.entries;
+  return {
+    request: clonedReq,
+    onError: onErrorPromise
+  };
+}
+function validateHeader(name, value, allowedHosts, onError) {
+  if (!value) {
+    return;
+  }
+  if (!HOST_HEADERS_TO_VALIDATE.has(name.toLowerCase())) {
+    return;
+  }
+  try {
+    verifyHostAllowed(name, value, allowedHosts);
+  } catch (error) {
+    onError(error);
+    throw error;
+  }
+}
+function verifyHostAllowed(headerName, headerValue, allowedHosts) {
+  const value = getFirstHeaderValue(headerValue);
+  if (!value) {
+    return;
+  }
+  const url = `http://${value}`;
+  if (!URL.canParse(url)) {
+    throw new Error(`Header "${headerName}" contains an invalid value and cannot be parsed.`);
+  }
+  const {
+    hostname
+  } = new URL(url);
+  if (!isHostAllowed(hostname, allowedHosts)) {
+    throw new Error(`Header "${headerName}" with value "${value}" is not allowed.`);
+  }
+}
+function isHostAllowed(hostname, allowedHosts) {
+  if (allowedHosts.has(hostname)) {
+    return true;
+  }
+  for (const allowedHost of allowedHosts) {
+    if (!allowedHost.startsWith('*.')) {
+      continue;
+    }
+    const domain = allowedHost.slice(1);
+    if (hostname.endsWith(domain)) {
+      return true;
+    }
+  }
+  return false;
+}
+function validateHeaders(request) {
+  const headers = request.headers;
+  for (const headerName of HOST_HEADERS_TO_VALIDATE) {
+    const headerValue = getFirstHeaderValue(headers.get(headerName));
+    if (headerValue && !VALID_HOST_REGEX.test(headerValue)) {
+      throw new Error(`Header "${headerName}" contains characters that are not allowed.`);
+    }
+  }
+  const xForwardedPort = getFirstHeaderValue(headers.get('x-forwarded-port'));
+  if (xForwardedPort && !VALID_PORT_REGEX.test(xForwardedPort)) {
+    throw new Error('Header "x-forwarded-port" must be a numeric value.');
+  }
+  const xForwardedProto = getFirstHeaderValue(headers.get('x-forwarded-proto'));
+  if (xForwardedProto && !VALID_PROTO_REGEX.test(xForwardedProto)) {
+    throw new Error('Header "x-forwarded-proto" must be either "http" or "https".');
+  }
+  const xForwardedPrefix = getFirstHeaderValue(headers.get('x-forwarded-prefix'));
+  if (xForwardedPrefix && INVALID_PREFIX_REGEX.test(xForwardedPrefix)) {
+    throw new Error('Header "x-forwarded-prefix" must not start with multiple "/" or "\\" or contain ".", ".." path segments.');
+  }
+}
+export { cloneRequestAndPatchHeaders, getFirstHeaderValue, validateRequest, validateUrl };
+//# sourceMappingURL=_validation-chunk.mjs.map

package/fesm2022/_validation-chunk.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"_validation-chunk.mjs","sources":["../../../../../../k8-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/src/utils/validation.ts"],"sourcesContent":["/**\n * @license\n * Copyright Google LLC All Rights Reserved.\n *\n * Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n */\n\n/**\n * The set of headers that should be validated for host header injection attacks.\n */\nconst HOST_HEADERS_TO_VALIDATE: ReadonlySet<string> = new Set(['host', 'x-forwarded-host']);\n\n/**\n * Regular expression to validate that the port is a numeric value.\n */\nconst VALID_PORT_REGEX = /^\\d+$/;\n\n/**\n * Regular expression to validate that the protocol is either http or https (case-insensitive).\n */\nconst VALID_PROTO_REGEX = /^https?$/i;\n\n/**\n * Regular expression to validate that the host is a valid hostname.\n */\nconst VALID_HOST_REGEX = /^[a-z0-9.:-]+$/i;\n\n/**\n * Regular expression to validate that the prefix is valid.\n */\nconst INVALID_PREFIX_REGEX = /^[/\\\\]{2}|(?:^|[/\\\\])\\.\\.?(?:[/\\\\]|$)/;\n\n/**\n * Extracts the first value from a multi-value header string.\n *\n * @param value - A string or an array of strings representing the header values.\n * If it's a string, values are expected to be comma-separated.\n * @returns The first trimmed value from the multi-value header, or `undefined` if the input is invalid or empty.\n *\n * @example\n * ```typescript\n * getFirstHeaderValue(\"value1, value2, value3\"); // \"value1\"\n * getFirstHeaderValue([\"value1\", \"value2\"]); // \"value1\"\n * getFirstHeaderValue(undefined); // undefined\n * ```\n */\nexport function getFirstHeaderValue(\n value: string | string[] | undefined | null,\n): string | undefined {\n return value?.toString().split(',', 1)[0]?.trim();\n}\n\n/**\n * Validates a request.\n *\n * @param request - The incoming `Request` object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if any of the validated headers contain invalid values.\n */\nexport function validateRequest(request: Request, allowedHosts: ReadonlySet<string>): void {\n validateHeaders(request);\n validateUrl(new URL(request.url), allowedHosts);\n}\n\n/**\n * Validates that the hostname of a given URL is allowed.\n *\n * @param url - The URL object to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the hostname is not in the allowlist.\n */\nexport function validateUrl(url: URL, allowedHosts: ReadonlySet<string>): void {\n const { hostname } = url;\n if (!isHostAllowed(hostname, allowedHosts)) {\n throw new Error(`URL with hostname \"${hostname}\" is not allowed.`);\n }\n}\n\n/**\n * Clones a request and patches the `get` method of the request headers to validate the host headers.\n * @param request - The request to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @returns An object containing the cloned request and a promise that resolves to an error\n * if any of the validated headers contain invalid values.\n */\nexport function cloneRequestAndPatchHeaders(\n request: Request,\n allowedHosts: ReadonlySet<string>,\n): { request: Request; onError: Promise<Error> } {\n let onError: (value: Error) => void;\n const onErrorPromise = new Promise<Error>((resolve) => {\n onError = resolve;\n });\n\n const clonedReq = new Request(request.clone(), {\n signal: request.signal,\n });\n\n const headers = clonedReq.headers;\n\n const originalGet = headers.get;\n // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion\n (headers.get as typeof originalGet) = function (name) {\n const value = originalGet.call(headers, name);\n if (!value) {\n return value;\n }\n\n validateHeader(name, value, allowedHosts, onError);\n\n return value;\n };\n\n const originalValues = headers.values;\n // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion\n (headers.values as typeof originalValues) = function () {\n for (const name of HOST_HEADERS_TO_VALIDATE) {\n validateHeader(name, originalGet.call(headers, name), allowedHosts, onError);\n }\n\n return originalValues.call(headers);\n };\n\n const originalEntries = headers.entries;\n // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion\n (headers.entries as typeof originalEntries) = function () {\n const iterator = originalEntries.call(headers);\n\n return {\n next() {\n const result = iterator.next();\n if (!result.done) {\n const [key, value] = result.value;\n validateHeader(key, value, allowedHosts, onError);\n }\n\n return result;\n },\n [Symbol.iterator]() {\n return this;\n },\n };\n };\n\n // Ensure for...of loops use the new patched entries\n (headers[Symbol.iterator] as typeof originalEntries) = headers.entries;\n\n return { request: clonedReq, onError: onErrorPromise };\n}\n\n/**\n * Validates a specific header value against the allowed hosts.\n * @param name - The name of the header to validate.\n * @param value - The value of the header to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @param onError - A callback function to call if the header value is invalid.\n * @throws Error if the header value is invalid.\n */\nfunction validateHeader(\n name: string,\n value: string | null,\n allowedHosts: ReadonlySet<string>,\n onError: (value: Error) => void,\n): void {\n if (!value) {\n return;\n }\n\n if (!HOST_HEADERS_TO_VALIDATE.has(name.toLowerCase())) {\n return;\n }\n\n try {\n verifyHostAllowed(name, value, allowedHosts);\n } catch (error) {\n onError(error as Error);\n\n throw error;\n }\n}\n\n/**\n * Validates a specific host header value against the allowed hosts.\n *\n * @param headerName - The name of the header to validate (e.g., 'host', 'x-forwarded-host').\n * @param headerValue - The value of the header to validate.\n * @param allowedHosts - A set of allowed hostnames.\n * @throws Error if the header value is invalid or the hostname is not in the allowlist.\n */\nfunction verifyHostAllowed(\n headerName: string,\n headerValue: string,\n allowedHosts: ReadonlySet<string>,\n): void {\n const value = getFirstHeaderValue(headerValue);\n if (!value) {\n return;\n }\n\n const url = `http://${value}`;\n if (!URL.canParse(url)) {\n throw new Error(`Header \"${headerName}\" contains an invalid value and cannot be parsed.`);\n }\n\n const { hostname } = new URL(url);\n if (!isHostAllowed(hostname, allowedHosts)) {\n throw new Error(`Header \"${headerName}\" with value \"${value}\" is not allowed.`);\n }\n}\n\n/**\n * Checks if the hostname is allowed.\n * @param hostname - The hostname to check.\n * @param allowedHosts - A set of allowed hostnames.\n * @returns `true` if the hostname is allowed, `false` otherwise.\n */\nfunction isHostAllowed(hostname: string, allowedHosts: ReadonlySet<string>): boolean {\n if (allowedHosts.has(hostname)) {\n return true;\n }\n\n for (const allowedHost of allowedHosts) {\n if (!allowedHost.startsWith('*.')) {\n continue;\n }\n\n const domain = allowedHost.slice(1);\n if (hostname.endsWith(domain)) {\n return true;\n }\n }\n\n return false;\n}\n\n/**\n * Validates the headers of an incoming request.\n *\n * @param request - The incoming `Request` object containing the headers to validate.\n * @throws Error if any of the validated headers contain invalid values.\n */\nfunction validateHeaders(request: Request): void {\n const headers = request.headers;\n for (const headerName of HOST_HEADERS_TO_VALIDATE) {\n const headerValue = getFirstHeaderValue(headers.get(headerName));\n if (headerValue && !VALID_HOST_REGEX.test(headerValue)) {\n throw new Error(`Header \"${headerName}\" contains characters that are not allowed.`);\n }\n }\n\n const xForwardedPort = getFirstHeaderValue(headers.get('x-forwarded-port'));\n if (xForwardedPort && !VALID_PORT_REGEX.test(xForwardedPort)) {\n throw new Error('Header \"x-forwarded-port\" must be a numeric value.');\n }\n\n const xForwardedProto = getFirstHeaderValue(headers.get('x-forwarded-proto'));\n if (xForwardedProto && !VALID_PROTO_REGEX.test(xForwardedProto)) {\n throw new Error('Header \"x-forwarded-proto\" must be either \"http\" or \"https\".');\n }\n\n const xForwardedPrefix = getFirstHeaderValue(headers.get('x-forwarded-prefix'));\n if (xForwardedPrefix && INVALID_PREFIX_REGEX.test(xForwardedPrefix)) {\n throw new Error(\n 'Header \"x-forwarded-prefix\" must not start with multiple \"/\" or \"\\\\\" or contain \".\", \"..\" path segments.',\n );\n }\n}\n"],"names":["HOST_HEADERS_TO_VALIDATE","Set","VALID_PORT_REGEX","VALID_PROTO_REGEX","VALID_HOST_REGEX","INVALID_PREFIX_REGEX","getFirstHeaderValue","value","toString","split","trim","validateRequest","request","allowedHosts","validateHeaders","validateUrl","URL","url","hostname","isHostAllowed","Error","cloneRequestAndPatchHeaders","onError","onErrorPromise","Promise","resolve","clonedReq","Request","clone","signal","headers","originalGet","get","name","call","validateHeader","originalValues","values","originalEntries","entries","iterator","next","result","done","key","Symbol","has","toLowerCase","verifyHostAllowed","error","headerName","headerValue","canParse","allowedHost","startsWith","domain","slice","endsWith","test","xForwardedPort","xForwardedProto","xForwardedPrefix"],"mappings":"AAWA,MAAMA,wBAAwB,GAAwB,IAAIC,GAAG,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAK3F,MAAMC,gBAAgB,GAAG,OAAO;AAKhC,MAAMC,iBAAiB,GAAG,WAAW;AAKrC,MAAMC,gBAAgB,GAAG,iBAAiB;AAK1C,MAAMC,oBAAoB,GAAG,uCAAuC;AAgB9D,SAAUC,mBAAmBA,CACjCC,KAA2C,EAAA;AAE3C,EAAA,OAAOA,KAAK,EAAEC,QAAQ,EAAE,CAACC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,EAAE;AACnD;AASgB,SAAAC,eAAeA,CAACC,OAAgB,EAAEC,YAAiC,EAAA;EACjFC,eAAe,CAACF,OAAO,CAAC;EACxBG,WAAW,CAAC,IAAIC,GAAG,CAACJ,OAAO,CAACK,GAAG,CAAC,EAAEJ,YAAY,CAAC;AACjD;AASgB,SAAAE,WAAWA,CAACE,GAAQ,EAAEJ,YAAiC,EAAA;EACrE,MAAM;AAAEK,IAAAA;AAAU,GAAA,GAAGD,GAAG;AACxB,EAAA,IAAI,CAACE,aAAa,CAACD,QAAQ,EAAEL,YAAY,CAAC,EAAE;AAC1C,IAAA,MAAM,IAAIO,KAAK,CAAC,CAAsBF,mBAAAA,EAAAA,QAAQ,mBAAmB,CAAC;AACpE;AACF;AASgB,SAAAG,2BAA2BA,CACzCT,OAAgB,EAChBC,YAAiC,EAAA;AAEjC,EAAA,IAAIS,OAA+B;AACnC,EAAA,MAAMC,cAAc,GAAG,IAAIC,OAAO,CAASC,OAAO,IAAI;AACpDH,IAAAA,OAAO,GAAGG,OAAO;AACnB,GAAC,CAAC;EAEF,MAAMC,SAAS,GAAG,IAAIC,OAAO,CAACf,OAAO,CAACgB,KAAK,EAAE,EAAE;IAC7CC,MAAM,EAAEjB,OAAO,CAACiB;AACjB,GAAA,CAAC;AAEF,EAAA,MAAMC,OAAO,GAAGJ,SAAS,CAACI,OAAO;AAEjC,EAAA,MAAMC,WAAW,GAAGD,OAAO,CAACE,GAAG;AAE9BF,EAAAA,OAAO,CAACE,GAA0B,GAAG,UAAUC,IAAI,EAAA;IAClD,MAAM1B,KAAK,GAAGwB,WAAW,CAACG,IAAI,CAACJ,OAAO,EAAEG,IAAI,CAAC;IAC7C,IAAI,CAAC1B,KAAK,EAAE;AACV,MAAA,OAAOA,KAAK;AACd;IAEA4B,cAAc,CAACF,IAAI,EAAE1B,KAAK,EAAEM,YAAY,EAAES,OAAO,CAAC;AAElD,IAAA,OAAOf,KAAK;GACb;AAED,EAAA,MAAM6B,cAAc,GAAGN,OAAO,CAACO,MAAM;EAEpCP,OAAO,CAACO,MAAgC,GAAG,YAAA;AAC1C,IAAA,KAAK,MAAMJ,IAAI,IAAIjC,wBAAwB,EAAE;AAC3CmC,MAAAA,cAAc,CAACF,IAAI,EAAEF,WAAW,CAACG,IAAI,CAACJ,OAAO,EAAEG,IAAI,CAAC,EAAEpB,YAAY,EAAES,OAAO,CAAC;AAC9E;AAEA,IAAA,OAAOc,cAAc,CAACF,IAAI,CAACJ,OAAO,CAAC;GACpC;AAED,EAAA,MAAMQ,eAAe,GAAGR,OAAO,CAACS,OAAO;EAEtCT,OAAO,CAACS,OAAkC,GAAG,YAAA;AAC5C,IAAA,MAAMC,QAAQ,GAAGF,eAAe,CAACJ,IAAI,CAACJ,OAAO,CAAC;IAE9C,OAAO;AACLW,MAAAA,IAAIA,GAAA;AACF,QAAA,MAAMC,MAAM,GAAGF,QAAQ,CAACC,IAAI,EAAE;AAC9B,QAAA,IAAI,CAACC,MAAM,CAACC,IAAI,EAAE;UAChB,MAAM,CAACC,GAAG,EAAErC,KAAK,CAAC,GAAGmC,MAAM,CAACnC,KAAK;UACjC4B,cAAc,CAACS,GAAG,EAAErC,KAAK,EAAEM,YAAY,EAAES,OAAO,CAAC;AACnD;AAEA,QAAA,OAAOoB,MAAM;OACd;MACD,CAACG,MAAM,CAACL,QAAQ,CAAC,GAAA;AACf,QAAA,OAAO,IAAI;AACb;KACD;GACF;EAGAV,OAAO,CAACe,MAAM,CAACL,QAAQ,CAA4B,GAAGV,OAAO,CAACS,OAAO;EAEtE,OAAO;AAAE3B,IAAAA,OAAO,EAAEc,SAAS;AAAEJ,IAAAA,OAAO,EAAEC;GAAgB;AACxD;AAUA,SAASY,cAAcA,CACrBF,IAAY,EACZ1B,KAAoB,EACpBM,YAAiC,EACjCS,OAA+B,EAAA;EAE/B,IAAI,CAACf,KAAK,EAAE;AACV,IAAA;AACF;EAEA,IAAI,CAACP,wBAAwB,CAAC8C,GAAG,CAACb,IAAI,CAACc,WAAW,EAAE,CAAC,EAAE;AACrD,IAAA;AACF;EAEA,IAAI;AACFC,IAAAA,iBAAiB,CAACf,IAAI,EAAE1B,KAAK,EAAEM,YAAY,CAAC;GAC9C,CAAE,OAAOoC,KAAK,EAAE;IACd3B,OAAO,CAAC2B,KAAc,CAAC;AAEvB,IAAA,MAAMA,KAAK;AACb;AACF;AAUA,SAASD,iBAAiBA,CACxBE,UAAkB,EAClBC,WAAmB,EACnBtC,YAAiC,EAAA;AAEjC,EAAA,MAAMN,KAAK,GAAGD,mBAAmB,CAAC6C,WAAW,CAAC;EAC9C,IAAI,CAAC5C,KAAK,EAAE;AACV,IAAA;AACF;AAEA,EAAA,MAAMU,GAAG,GAAG,CAAUV,OAAAA,EAAAA,KAAK,CAAE,CAAA;AAC7B,EAAA,IAAI,CAACS,GAAG,CAACoC,QAAQ,CAACnC,GAAG,CAAC,EAAE;AACtB,IAAA,MAAM,IAAIG,KAAK,CAAC,CAAW8B,QAAAA,EAAAA,UAAU,mDAAmD,CAAC;AAC3F;EAEA,MAAM;AAAEhC,IAAAA;AAAU,GAAA,GAAG,IAAIF,GAAG,CAACC,GAAG,CAAC;AACjC,EAAA,IAAI,CAACE,aAAa,CAACD,QAAQ,EAAEL,YAAY,CAAC,EAAE;IAC1C,MAAM,IAAIO,KAAK,CAAC,CAAA,QAAA,EAAW8B,UAAU,CAAiB3C,cAAAA,EAAAA,KAAK,mBAAmB,CAAC;AACjF;AACF;AAQA,SAASY,aAAaA,CAACD,QAAgB,EAAEL,YAAiC,EAAA;AACxE,EAAA,IAAIA,YAAY,CAACiC,GAAG,CAAC5B,QAAQ,CAAC,EAAE;AAC9B,IAAA,OAAO,IAAI;AACb;AAEA,EAAA,KAAK,MAAMmC,WAAW,IAAIxC,YAAY,EAAE;AACtC,IAAA,IAAI,CAACwC,WAAW,CAACC,UAAU,CAAC,IAAI,CAAC,EAAE;AACjC,MAAA;AACF;AAEA,IAAA,MAAMC,MAAM,GAAGF,WAAW,CAACG,KAAK,CAAC,CAAC,CAAC;AACnC,IAAA,IAAItC,QAAQ,CAACuC,QAAQ,CAACF,MAAM,CAAC,EAAE;AAC7B,MAAA,OAAO,IAAI;AACb;AACF;AAEA,EAAA,OAAO,KAAK;AACd;AAQA,SAASzC,eAAeA,CAACF,OAAgB,EAAA;AACvC,EAAA,MAAMkB,OAAO,GAAGlB,OAAO,CAACkB,OAAO;AAC/B,EAAA,KAAK,MAAMoB,UAAU,IAAIlD,wBAAwB,EAAE;IACjD,MAAMmD,WAAW,GAAG7C,mBAAmB,CAACwB,OAAO,CAACE,GAAG,CAACkB,UAAU,CAAC,CAAC;IAChE,IAAIC,WAAW,IAAI,CAAC/C,gBAAgB,CAACsD,IAAI,CAACP,WAAW,CAAC,EAAE;AACtD,MAAA,MAAM,IAAI/B,KAAK,CAAC,CAAW8B,QAAAA,EAAAA,UAAU,6CAA6C,CAAC;AACrF;AACF;EAEA,MAAMS,cAAc,GAAGrD,mBAAmB,CAACwB,OAAO,CAACE,GAAG,CAAC,kBAAkB,CAAC,CAAC;EAC3E,IAAI2B,cAAc,IAAI,CAACzD,gBAAgB,CAACwD,IAAI,CAACC,cAAc,CAAC,EAAE;AAC5D,IAAA,MAAM,IAAIvC,KAAK,CAAC,oDAAoD,CAAC;AACvE;EAEA,MAAMwC,eAAe,GAAGtD,mBAAmB,CAACwB,OAAO,CAACE,GAAG,CAAC,mBAAmB,CAAC,CAAC;EAC7E,IAAI4B,eAAe,IAAI,CAACzD,iBAAiB,CAACuD,IAAI,CAACE,eAAe,CAAC,EAAE;AAC/D,IAAA,MAAM,IAAIxC,KAAK,CAAC,8DAA8D,CAAC;AACjF;EAEA,MAAMyC,gBAAgB,GAAGvD,mBAAmB,CAACwB,OAAO,CAACE,GAAG,CAAC,oBAAoB,CAAC,CAAC;EAC/E,IAAI6B,gBAAgB,IAAIxD,oBAAoB,CAACqD,IAAI,CAACG,gBAAgB,CAAC,EAAE;AACnE,IAAA,MAAM,IAAIzC,KAAK,CACb,0GAA0G,CAC3G;AACH;AACF;;;;"}

package/fesm2022/node.mjs CHANGED Viewed

@@ -2,10 +2,27 @@ import { renderApplication, renderModule, ɵSERVER_CONTEXT as _SERVER_CONTEXT }
 import * as fs from 'node:fs';
 import { dirname, join, normalize, resolve } from 'node:path';
 import { URL as URL$1, fileURLToPath } from 'node:url';
+import { validateUrl, getFirstHeaderValue } from './_validation-chunk.mjs';
 import { ɵInlineCriticalCssProcessor as _InlineCriticalCssProcessor, AngularAppEngine } from '@angular/ssr';
 import { readFile } from 'node:fs/promises';
 import { argv } from 'node:process';
+function getAllowedHostsFromEnv() {
+  const allowedHosts = [];
+  const envNgAllowedHosts = process.env['NG_ALLOWED_HOSTS'];
+  if (!envNgAllowedHosts) {
+    return allowedHosts;
+  }
+  const hosts = envNgAllowedHosts.split(',');
+  for (const host of hosts) {
+    const trimmed = host.trim();
+    if (trimmed.length > 0) {
+      allowedHosts.push(trimmed);
+    }
+  }
+  return allowedHosts;
+}
 function attachNodeGlobalErrorHandlers() {
   if (typeof Zone !== 'undefined') {
     return;
@@ -82,11 +99,35 @@ class CommonEngine {
   templateCache = new Map();
   inlineCriticalCssProcessor = new CommonEngineInlineCriticalCssProcessor();
   pageIsSSG = new Map();
+  allowedHosts;
   constructor(options) {
     this.options = options;
+    this.allowedHosts = new Set([...getAllowedHostsFromEnv(), ...(this.options?.allowedHosts ?? [])]);
     attachNodeGlobalErrorHandlers();
   }
   async render(opts) {
+    const {
+      url
+    } = opts;
+    if (url && URL$1.canParse(url)) {
+      const urlObj = new URL$1(url);
+      try {
+        validateUrl(urlObj, this.allowedHosts);
+      } catch (error) {
+        const isAllowedHostConfigured = this.allowedHosts.size > 0;
+        console.error(`ERROR: ${error.message}` + 'Please provide a list of allowed hosts in the "allowedHosts" option in the "CommonEngine" constructor.', isAllowedHostConfigured ? '' : '\nFalling back to client side rendering. This will become a 400 Bad Request in a future major version.');
+        if (!isAllowedHostConfigured) {
+          let document = opts.document;
+          if (!document && opts.documentFilePath) {
+            document = opts.document ?? (await this.getDocument(opts.documentFilePath));
+          }
+          if (document) {
+            return document;
+          }
+        }
+        throw error;
+      }
+    }
     const enablePerformanceProfiler = this.options?.enablePerformanceProfiler;
     const runMethod = enablePerformanceProfiler ? runMethodAndMeasurePerf : noopRunMethodAndMeasurePerf;
     let html = await runMethod('Retrieve SSG Page', () => this.retrieveSSGPage(opts));
@@ -233,17 +274,18 @@ function createRequestUrl(nodeRequest) {
   }
   return new URL(`${protocol}://${hostnameWithPort}${originalUrl ?? url}`);
 }
-function getFirstHeaderValue(value) {
-  return value?.toString().split(',', 1)[0]?.trim();
-}
 class AngularNodeAppEngine {
-  angularAppEngine = new AngularAppEngine();
-  constructor() {
+  angularAppEngine;
+  constructor(options) {
+    this.angularAppEngine = new AngularAppEngine({
+      ...options,
+      allowedHosts: [...getAllowedHostsFromEnv(), ...(options?.allowedHosts ?? [])]
+    });
     attachNodeGlobalErrorHandlers();
   }
   async handle(request, requestContext) {
-    const webRequest = createWebRequestFromNodeRequest(request);
+    const webRequest = request instanceof Request ? request : createWebRequestFromNodeRequest(request);
     return this.angularAppEngine.handle(webRequest, requestContext);
   }
 }

package/fesm2022/node.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"node.mjs","sources":["../../../../../../darwin_arm64-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/errors.ts","../../../../../../darwin_arm64-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/common-engine/inline-css-processor.ts","../../../../../../darwin_arm64-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/common-engine/peformance-profiler.ts","../../../../../../darwin_arm64-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/common-engine/common-engine.ts","../../../../../../darwin_arm64-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/request.ts","../../../../../../darwin_arm64-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/app-engine.ts","../../../../../../darwin_arm64-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/handler.ts","../../../../../../darwin_arm64-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/response.ts","../../../../../../darwin_arm64-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/module.ts"],"sourcesContent":["/*\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\n/\n Attaches listeners to the Node.js process to capture and handle unhandled rejections and uncaught exceptions.\n * Captured errors are logged to the console. This function logs errors to the console, preventing unhandled errors\n * from crashing the server. It is particularly useful for Zoneless apps, ensuring error handling without relying on Zone.js.\n \n @remarks\n * This function is a no-op if zone.js is available.\n * For Zone-based apps, similar functionality is provided by Zone.js itself. See the Zone.js implementation here:\n * https://github.com/angular/angular/blob/4a8d0b79001ec09bcd6f2d6b15117aa6aac1932c/packages/zone.js/lib/node/node.ts#L94%7C\n \n @internal\n /\nexport function attachNodeGlobalErrorHandlers(): void {\n if (typeof Zone !== 'undefined') {\n return;\n }\n\n // Ensure that the listeners are registered only once.\n // Otherwise, multiple instances may be registered during edit/refresh.\n const gThis: typeof globalThis & { ngAttachNodeGlobalErrorHandlersCalled?: boolean } = globalThis;\n if (gThis.ngAttachNodeGlobalErrorHandlersCalled) {\n return;\n }\n\n gThis.ngAttachNodeGlobalErrorHandlersCalled = true;\n\n process\n // eslint-disable-next-line no-console\n .on('unhandledRejection', (error) => console.error('unhandledRejection', error))\n // eslint-disable-next-line no-console\n .on('uncaughtException', (error) => console.error('uncaughtException', error));\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport { ɵInlineCriticalCssProcessor as InlineCriticalCssProcessor } from '@angular/ssr';\nimport { readFile } from 'node:fs/promises';\n\nexport class CommonEngineInlineCriticalCssProcessor {\n private readonly resourceCache = new Map<string, string>();\n\n async process(html: string, outputPath: string \| undefined): Promise<string> {\n const beasties = new InlineCriticalCssProcessor(async (path) => {\n let resourceContent = this.resourceCache.get(path);\n if (resourceContent === undefined) {\n resourceContent = await readFile(path, 'utf-8');\n this.resourceCache.set(path, resourceContent);\n }\n\n return resourceContent;\n }, outputPath);\n\n return beasties.process(html);\n }\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nconst PERFORMANCE_MARK_PREFIX = '🅰️';\n\nexport function printPerformanceLogs(): void {\n let maxWordLength = 0;\n const benchmarks: [step: string, value: string][] = [];\n\n for (const { name, duration } of performance.getEntriesByType('measure')) {\n if (!name.startsWith(PERFORMANCE_MARK_PREFIX)) {\n continue;\n }\n\n // `🅰️:Retrieve SSG Page` -> `Retrieve SSG Page:`\n const step = name.slice(PERFORMANCE_MARK_PREFIX.length + 1) + ':';\n if (step.length > maxWordLength) {\n maxWordLength = step.length;\n }\n\n benchmarks.push([step, `${duration.toFixed(1)}ms`]);\n performance.clearMeasures(name);\n }\n\n / eslint-disable no-console /\n console.log('******* Performance results ******');\n for (const [step, value] of benchmarks) {\n const spaces = maxWordLength - step.length + 5;\n console.log(step + ' '.repeat(spaces) + value);\n }\n console.log('**************************************');\n / eslint-enable no-console /\n}\n\nexport async function runMethodAndMeasurePerf<T>(\n label: string,\n asyncMethod: () => Promise<T>,\n): Promise<T> {\n const labelName = `${PERFORMANCE_MARK_PREFIX}:${label}`;\n const startLabel = `start:${labelName}`;\n const endLabel = `end:${labelName}`;\n\n try {\n performance.mark(startLabel);\n\n return await asyncMethod();\n } finally {\n performance.mark(endLabel);\n performance.measure(labelName, startLabel, endLabel);\n performance.clearMarks(startLabel);\n performance.clearMarks(endLabel);\n }\n}\n\nexport function noopRunMethodAndMeasurePerf<T>(\n label: string,\n asyncMethod: () => Promise<T>,\n): Promise<T> {\n return asyncMethod();\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport { ApplicationRef, StaticProvider, Type } from '@angular/core';\nimport { BootstrapContext } from '@angular/platform-browser';\nimport { renderApplication, renderModule, ɵSERVER_CONTEXT } from '@angular/platform-server';\nimport as fs from 'node:fs';\nimport { dirname, join, normalize, resolve } from 'node:path';\nimport { URL } from 'node:url';\nimport { attachNodeGlobalErrorHandlers } from '../errors';\nimport { CommonEngineInlineCriticalCssProcessor } from './inline-css-processor';\nimport {\n noopRunMethodAndMeasurePerf,\n printPerformanceLogs,\n runMethodAndMeasurePerf,\n} from './peformance-profiler';\n\nconst SSG_MARKER_REGEXP = /ng-server-context=[\"']\\w\\\|?ssg\\\|?\\w[\"']/;\n\nexport interface CommonEngineOptions {\n /** A method that when invoked returns a promise that returns an `ApplicationRef` instance once resolved or an NgModule. /\n bootstrap?: Type<{}> \| ((context: BootstrapContext) => Promise<ApplicationRef>);\n\n /* A set of platform level providers for all requests. /\n providers?: StaticProvider[];\n\n /* Enable request performance profiling data collection and printing the results in the server console. /\n enablePerformanceProfiler?: boolean;\n}\n\nexport interface CommonEngineRenderOptions {\n /* A method that when invoked returns a promise that returns an `ApplicationRef` instance once resolved or an NgModule. /\n bootstrap?: Type<{}> \| ((context: BootstrapContext) => Promise<ApplicationRef>);\n\n /* A set of platform level providers for the current request. /\n providers?: StaticProvider[];\n url?: string;\n document?: string;\n documentFilePath?: string;\n\n /\n Reduce render blocking requests by inlining critical CSS.\n * Defaults to true.\n /\n inlineCriticalCss?: boolean;\n\n /\n Base path location of index file.\n * Defaults to the 'documentFilePath' dirname when not provided.\n /\n publicPath?: string;\n}\n\n/\n A common engine to use to server render an application.\n /\n\nexport class CommonEngine {\n private readonly templateCache = new Map<string, string>();\n private readonly inlineCriticalCssProcessor = new CommonEngineInlineCriticalCssProcessor();\n private readonly pageIsSSG = new Map<string, boolean>();\n\n constructor(private options?: CommonEngineOptions \| undefined) {\n attachNodeGlobalErrorHandlers();\n }\n\n /\n Render an HTML document for a specific URL with specified\n * render options\n /\n async render(opts: CommonEngineRenderOptions): Promise<string> {\n const enablePerformanceProfiler = this.options?.enablePerformanceProfiler;\n\n const runMethod = enablePerformanceProfiler\n ? runMethodAndMeasurePerf\n : noopRunMethodAndMeasurePerf;\n\n let html = await runMethod('Retrieve SSG Page', () => this.retrieveSSGPage(opts));\n\n if (html === undefined) {\n html = await runMethod('Render Page', () => this.renderApplication(opts));\n\n if (opts.inlineCriticalCss !== false) {\n const content = await runMethod('Inline Critical CSS', () =>\n // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n this.inlineCriticalCss(html!, opts),\n );\n\n html = content;\n }\n }\n\n if (enablePerformanceProfiler) {\n printPerformanceLogs();\n }\n\n return html;\n }\n\n private inlineCriticalCss(html: string, opts: CommonEngineRenderOptions): Promise<string> {\n const outputPath =\n opts.publicPath ?? (opts.documentFilePath ? dirname(opts.documentFilePath) : '');\n\n return this.inlineCriticalCssProcessor.process(html, outputPath);\n }\n\n private async retrieveSSGPage(opts: CommonEngineRenderOptions): Promise<string \| undefined> {\n const { publicPath, documentFilePath, url } = opts;\n if (!publicPath \|\| !documentFilePath \|\| url === undefined) {\n return undefined;\n }\n\n const { pathname } = new URL(url, 'resolve://');\n // Do not use `resolve` here as otherwise it can lead to path traversal vulnerability.\n // See: https://portswigger.net/web-security/file-path-traversal\n const pagePath = join(publicPath, pathname, 'index.html');\n\n if (this.pageIsSSG.get(pagePath)) {\n // Serve pre-rendered page.\n return fs.promises.readFile(pagePath, 'utf-8');\n }\n\n if (!pagePath.startsWith(normalize(publicPath))) {\n // Potential path traversal detected.\n return undefined;\n }\n\n if (pagePath === resolve(documentFilePath) \|\| !(await exists(pagePath))) {\n // View matches with prerender path or file does not exist.\n this.pageIsSSG.set(pagePath, false);\n\n return undefined;\n }\n\n // Static file exists.\n const content = await fs.promises.readFile(pagePath, 'utf-8');\n const isSSG = SSG_MARKER_REGEXP.test(content);\n this.pageIsSSG.set(pagePath, isSSG);\n\n return isSSG ? content : undefined;\n }\n\n private async renderApplication(opts: CommonEngineRenderOptions): Promise<string> {\n const moduleOrFactory = this.options?.bootstrap ?? opts.bootstrap;\n if (!moduleOrFactory) {\n throw new Error('A module or bootstrap option must be provided.');\n }\n\n const extraProviders: StaticProvider[] = [\n { provide: ɵSERVER_CONTEXT, useValue: 'ssr' },\n ...(opts.providers ?? []),\n ...(this.options?.providers ?? []),\n ];\n\n let document = opts.document;\n if (!document && opts.documentFilePath) {\n document = await this.getDocument(opts.documentFilePath);\n }\n\n const commonRenderingOptions = {\n url: opts.url,\n document,\n };\n\n return isBootstrapFn(moduleOrFactory)\n ? renderApplication(moduleOrFactory, {\n platformProviders: extraProviders,\n ...commonRenderingOptions,\n })\n : renderModule(moduleOrFactory, { extraProviders, ...commonRenderingOptions });\n }\n\n /* Retrieve the document from the cache or the filesystem /\n private async getDocument(filePath: string): Promise<string> {\n let doc = this.templateCache.get(filePath);\n\n if (!doc) {\n doc = await fs.promises.readFile(filePath, 'utf-8');\n this.templateCache.set(filePath, doc);\n }\n\n return doc;\n }\n}\n\nasync function exists(path: fs.PathLike): Promise<boolean> {\n try {\n await fs.promises.access(path, fs.constants.F_OK);\n\n return true;\n } catch {\n return false;\n }\n}\n\nfunction isBootstrapFn(\n value: unknown,\n): value is (context: BootstrapContext) => Promise<ApplicationRef> {\n // We can differentiate between a module and a bootstrap function by reading compiler-generated `ɵmod` static property:\n return typeof value === 'function' && !('ɵmod' in value);\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport type { IncomingHttpHeaders, IncomingMessage } from 'node:http';\nimport type { Http2ServerRequest } from 'node:http2';\n\n/\n A set containing all the pseudo-headers defined in the HTTP/2 specification.\n \n This set can be used to filter out pseudo-headers from a list of headers,\n * as they are not allowed to be set directly using the `Node.js` Undici API or\n * the web `Headers` API.\n /\nconst HTTP2_PSEUDO_HEADERS = new Set([':method', ':scheme', ':authority', ':path', ':status']);\n\n/\n Converts a Node.js `IncomingMessage` or `Http2ServerRequest` into a\n * Web Standard `Request` object.\n \n This function adapts the Node.js request objects to a format that can\n * be used by web platform APIs.\n \n @param nodeRequest - The Node.js request object (`IncomingMessage` or `Http2ServerRequest`) to convert.\n * @returns A Web Standard `Request` object.\n /\nexport function createWebRequestFromNodeRequest(\n nodeRequest: IncomingMessage \| Http2ServerRequest,\n): Request {\n const { headers, method = 'GET' } = nodeRequest;\n const withBody = method !== 'GET' && method !== 'HEAD';\n const referrer = headers.referer && URL.canParse(headers.referer) ? headers.referer : undefined;\n\n return new Request(createRequestUrl(nodeRequest), {\n method,\n headers: createRequestHeaders(headers),\n body: withBody ? nodeRequest : undefined,\n duplex: withBody ? 'half' : undefined,\n referrer,\n });\n}\n\n/\n Creates a `Headers` object from Node.js `IncomingHttpHeaders`.\n \n @param nodeHeaders - The Node.js `IncomingHttpHeaders` object to convert.\n * @returns A `Headers` object containing the converted headers.\n /\nfunction createRequestHeaders(nodeHeaders: IncomingHttpHeaders): Headers {\n const headers = new Headers();\n\n for (const [name, value] of Object.entries(nodeHeaders)) {\n if (HTTP2_PSEUDO_HEADERS.has(name)) {\n continue;\n }\n\n if (typeof value === 'string') {\n headers.append(name, value);\n } else if (Array.isArray(value)) {\n for (const item of value) {\n headers.append(name, item);\n }\n }\n }\n\n return headers;\n}\n\n/\n Creates a `URL` object from a Node.js `IncomingMessage`, taking into account the protocol, host, and port.\n \n @param nodeRequest - The Node.js `IncomingMessage` or `Http2ServerRequest` object to extract URL information from.\n * @returns A `URL` object representing the request URL.\n /\nexport function createRequestUrl(nodeRequest: IncomingMessage \| Http2ServerRequest): URL {\n const {\n headers,\n socket,\n url = '',\n originalUrl,\n } = nodeRequest as IncomingMessage & { originalUrl?: string };\n const protocol =\n getFirstHeaderValue(headers['x-forwarded-proto']) ??\n ('encrypted' in socket && socket.encrypted ? 'https' : 'http');\n const hostname =\n getFirstHeaderValue(headers['x-forwarded-host']) ?? headers.host ?? headers[':authority'];\n\n if (Array.isArray(hostname)) {\n throw new Error('host value cannot be an array.');\n }\n\n let hostnameWithPort = hostname;\n if (!hostname?.includes(':')) {\n const port = getFirstHeaderValue(headers['x-forwarded-port']);\n if (port) {\n hostnameWithPort += `:${port}`;\n }\n }\n\n return new URL(`${protocol}://${hostnameWithPort}${originalUrl ?? url}`);\n}\n\n/\n Extracts the first value from a multi-value header string.\n \n @param value - A string or an array of strings representing the header values.\n * If it's a string, values are expected to be comma-separated.\n * @returns The first trimmed value from the multi-value header, or `undefined` if the input is invalid or empty.\n \n @example\n * ```typescript\n * getFirstHeaderValue(\"value1, value2, value3\"); // \"value1\"\n * getFirstHeaderValue([\"value1\", \"value2\"]); // \"value1\"\n * getFirstHeaderValue(undefined); // undefined\n * ```\n /\nfunction getFirstHeaderValue(value: string \| string[] \| undefined): string \| undefined {\n return value?.toString().split(',', 1)[0]?.trim();\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport { AngularAppEngine } from '@angular/ssr';\nimport type { IncomingMessage } from 'node:http';\nimport type { Http2ServerRequest } from 'node:http2';\nimport { attachNodeGlobalErrorHandlers } from './errors';\nimport { createWebRequestFromNodeRequest } from './request';\n\n/\n Angular server application engine.\n * Manages Angular server applications (including localized ones), handles rendering requests,\n * and optionally transforms index HTML before rendering.\n \n @remarks This class should be instantiated once and used as a singleton across the server-side\n * application to ensure consistent handling of rendering requests and resource management.\n /\nexport class AngularNodeAppEngine {\n private readonly angularAppEngine = new AngularAppEngine();\n\n constructor() {\n attachNodeGlobalErrorHandlers();\n }\n\n /\n Handles an incoming HTTP request by serving prerendered content, performing server-side rendering,\n * or delivering a static file for client-side rendered routes based on the `RenderMode` setting.\n \n This method adapts Node.js's `IncomingMessage` or `Http2ServerRequest`\n * to a format compatible with the `AngularAppEngine` and delegates the handling logic to it.\n \n @param request - The incoming HTTP request (`IncomingMessage` or `Http2ServerRequest`).\n * @param requestContext - Optional context for rendering, such as metadata associated with the request.\n * @returns A promise that resolves to the resulting HTTP response object, or `null` if no matching Angular route is found.\n \n @remarks A request to `https://www.example.com/page/index.html` will serve or render the Angular route\n * corresponding to `https://www.example.com/page`.\n /\n async handle(\n request: IncomingMessage \| Http2ServerRequest,\n requestContext?: unknown,\n ): Promise<Response \| null> {\n const webRequest = createWebRequestFromNodeRequest(request);\n\n return this.angularAppEngine.handle(webRequest, requestContext);\n }\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport type { IncomingMessage, ServerResponse } from 'node:http';\n\n/\n Represents a middleware function for handling HTTP requests in a Node.js environment.\n \n @param req - The incoming HTTP request object.\n * @param res - The outgoing HTTP response object.\n * @param next - A callback function that signals the completion of the middleware or forwards the error if provided.\n \n @returns A Promise that resolves to void or simply void. The handler can be asynchronous.\n /\nexport type NodeRequestHandlerFunction = (\n req: IncomingMessage,\n res: ServerResponse,\n next: (err?: unknown) => void,\n) => Promise<void> \| void;\n\n/\n Attaches metadata to the handler function to mark it as a special handler for Node.js environments.\n \n @typeParam T - The type of the handler function.\n * @param handler - The handler function to be defined and annotated.\n * @returns The same handler function passed as an argument, with metadata attached.\n \n @example\n * Usage in an Express application:\n * ```ts\n * const app = express();\n * export default createNodeRequestHandler(app);\n * ```\n \n @example\n * Usage in a Hono application:\n * ```ts\n * const app = new Hono();\n * export default createNodeRequestHandler(async (req, res, next) => {\n * try {\n * const webRes = await app.fetch(createWebRequestFromNodeRequest(req));\n * if (webRes) {\n * await writeResponseToNodeResponse(webRes, res);\n * } else {\n * next();\n * }\n * } catch (error) {\n * next(error);\n * }\n * });\n * ```\n \n @example\n * Usage in a Fastify application:\n * ```ts\n * const app = Fastify();\n * export default createNodeRequestHandler(async (req, res) => {\n * await app.ready();\n * app.server.emit('request', req, res);\n * });\n * ```\n /\nexport function createNodeRequestHandler<T extends NodeRequestHandlerFunction>(handler: T): T {\n (handler as T & { __ng_node_request_handler__?: boolean })['__ng_node_request_handler__'] = true;\n\n return handler;\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport type { ServerResponse } from 'node:http';\nimport type { Http2ServerResponse } from 'node:http2';\n\n/\n Streams a web-standard `Response` into a Node.js `ServerResponse`\n * or `Http2ServerResponse`.\n \n This function adapts the web `Response` object to write its content\n * to a Node.js response object, handling both HTTP/1.1 and HTTP/2.\n \n @param source - The web-standard `Response` object to stream from.\n * @param destination - The Node.js response object (`ServerResponse` or `Http2ServerResponse`) to stream into.\n * @returns A promise that resolves once the streaming operation is complete.\n /\nexport async function writeResponseToNodeResponse(\n source: Response,\n destination: ServerResponse \| Http2ServerResponse,\n): Promise<void> {\n const { status, headers, body } = source;\n destination.statusCode = status;\n\n let cookieHeaderSet = false;\n for (const [name, value] of headers.entries()) {\n if (name === 'set-cookie') {\n if (cookieHeaderSet) {\n continue;\n }\n\n // Sets the 'set-cookie' header only once to ensure it is correctly applied.\n // Concatenating 'set-cookie' values can lead to incorrect behavior, so we use a single value from `headers.getSetCookie()`.\n destination.setHeader(name, headers.getSetCookie());\n cookieHeaderSet = true;\n } else {\n destination.setHeader(name, value);\n }\n }\n\n if ('flushHeaders' in destination) {\n destination.flushHeaders();\n }\n\n if (!body) {\n destination.end();\n\n return;\n }\n\n try {\n const reader = body.getReader();\n\n destination.on('close', () => {\n reader.cancel().catch((error) => {\n // eslint-disable-next-line no-console\n console.error(\n `An error occurred while writing the response body for: ${destination.req.url}.`,\n error,\n );\n });\n });\n\n // eslint-disable-next-line no-constant-condition\n while (true) {\n const { done, value } = await reader.read();\n if (done) {\n destination.end();\n break;\n }\n\n const canContinue = (destination as ServerResponse).write(value);\n if (canContinue === false) {\n // Explicitly check for `false`, as AWS may return `undefined` even though this is not valid.\n // See: https://github.com/CodeGenieApp/serverless-express/issues/683\n await new Promise<void>((resolve) => destination.once('drain', resolve));\n }\n }\n } catch {\n destination.end('Internal server error.');\n }\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport { argv } from 'node:process';\nimport { fileURLToPath } from 'node:url';\n\n/\n Determines whether the provided URL represents the main entry point module.\n \n This function checks if the provided URL corresponds to the main ESM module being executed directly.\n * It's useful for conditionally executing code that should only run when a module is the entry point,\n * such as starting a server or initializing an application.\n \n It performs two key checks:\n * 1. Verifies if the URL starts with 'file:', ensuring it is a local file.\n * 2. Compares the URL's resolved file path with the first command-line argument (`process.argv[1]`),\n * which points to the file being executed.\n \n @param url The URL of the module to check. This should typically be `import.meta.url`.\n * @returns `true` if the provided URL represents the main entry point, otherwise `false`.\n */\nexport function isMainModule(url: string): boolean {\n return url.startsWith('file:') && argv[1] === fileURLToPath(url);\n}\n"],"names":["attachNodeGlobalErrorHandlers","Zone","gThis","globalThis","ngAttachNodeGlobalErrorHandlersCalled","process","on","error","console","CommonEngineInlineCriticalCssProcessor","resourceCache","Map","html","outputPath","beasties","InlineCriticalCssProcessor","path","resourceContent","get","undefined","readFile","set","PERFORMANCE_MARK_PREFIX","printPerformanceLogs","maxWordLength","benchmarks","name","duration","performance","getEntriesByType","startsWith","step","slice","length","push","toFixed","clearMeasures","log","value","spaces","repeat","runMethodAndMeasurePerf","label","asyncMethod","labelName","startLabel","endLabel","mark","measure","clearMarks","noopRunMethodAndMeasurePerf","SSG_MARKER_REGEXP","CommonEngine","options","templateCache","inlineCriticalCssProcessor","pageIsSSG","constructor","render","opts","enablePerformanceProfiler","runMethod","retrieveSSGPage","renderApplication","inlineCriticalCss","content","publicPath","documentFilePath","dirname","url","pathname","URL","pagePath","join","fs","promises","normalize","resolve","exists","isSSG","test","moduleOrFactory","bootstrap","Error","extraProviders","provide","ɵSERVER_CONTEXT","useValue","providers","document","getDocument","commonRenderingOptions","isBootstrapFn","platformProviders","renderModule","filePath","doc","access","constants","F_OK","HTTP2_PSEUDO_HEADERS","Set","createWebRequestFromNodeRequest","nodeRequest","headers","method","withBody","referrer","referer","canParse","Request","createRequestUrl","createRequestHeaders","body","duplex","nodeHeaders","Headers","Object","entries","has","append","Array","isArray","item","socket","originalUrl","protocol","getFirstHeaderValue","encrypted","hostname","host","hostnameWithPort","includes","port","toString","split","trim","AngularNodeAppEngine","angularAppEngine","AngularAppEngine","handle","request","requestContext","webRequest","createNodeRequestHandler","handler","writeResponseToNodeResponse","source","destination","status","statusCode","cookieHeaderSet","setHeader","getSetCookie","flushHeaders","end","reader","getReader","cancel","catch","req","done","read","canContinue","write","Promise","once","isMainModule","argv","fileURLToPath"],"mappings":";;;;;;;;SAoBgBA,6BAA6BA,GAAA;AAC3C,EAAA,IAAI,OAAOC,IAAI,KAAK,WAAW,EAAE;AAC/B,IAAA;AACF;EAIA,MAAMC,KAAK,GAA4EC,UAAU;EACjG,IAAID,KAAK,CAACE,qCAAqC,EAAE;AAC/C,IAAA;AACF;EAEAF,KAAK,CAACE,qCAAqC,GAAG,IAAI;AAElDC,EAAAA,OAAO,CAEJC,EAAE,CAAC,oBAAoB,EAAGC,KAAK,IAAKC,OAAO,CAACD,KAAK,CAAC,oBAAoB,EAAEA,KAAK,CAAC,CAAA,CAE9ED,EAAE,CAAC,mBAAmB,EAAGC,KAAK,IAAKC,OAAO,CAACD,KAAK,CAAC,mBAAmB,EAAEA,KAAK,CAAC,CAAC;AAClF;;MC5BaE,sCAAsC,CAAA;AAChCC,EAAAA,aAAa,GAAG,IAAIC,GAAG,EAAkB;AAE1D,EAAA,MAAMN,OAAOA,CAACO,IAAY,EAAEC,UAA8B,EAAA;AACxD,IAAA,MAAMC,QAAQ,GAAG,IAAIC,2BAA0B,CAAC,MAAOC,IAAI,IAAI;MAC7D,IAAIC,eAAe,GAAG,IAAI,CAACP,aAAa,CAACQ,GAAG,CAACF,IAAI,CAAC;MAClD,IAAIC,eAAe,KAAKE,SAAS,EAAE;AACjCF,QAAAA,eAAe,GAAG,MAAMG,QAAQ,CAACJ,IAAI,EAAE,OAAO,CAAC;QAC/C,IAAI,CAACN,aAAa,CAACW,GAAG,CAACL,IAAI,EAAEC,eAAe,CAAC;AAC/C;AAEA,MAAA,OAAOA,eAAe;KACvB,EAAEJ,UAAU,CAAC;AAEd,IAAA,OAAOC,QAAQ,CAACT,OAAO,CAACO,IAAI,CAAC;AAC/B;AACD;;ACnBD,MAAMU,uBAAuB,GAAG,KAAK;SAErBC,oBAAoBA,GAAA;EAClC,IAAIC,aAAa,GAAG,CAAC;EACrB,MAAMC,UAAU,GAAoC,EAAE;AAEtD,EAAA,KAAK,MAAM;IAAEC,IAAI;AAAEC,IAAAA;AAAU,GAAA,IAAIC,WAAW,CAACC,gBAAgB,CAAC,SAAS,CAAC,EAAE;AACxE,IAAA,IAAI,CAACH,IAAI,CAACI,UAAU,CAACR,uBAAuB,CAAC,EAAE;AAC7C,MAAA;AACF;AAGA,IAAA,MAAMS,IAAI,GAAGL,IAAI,CAACM,KAAK,CAACV,uBAAuB,CAACW,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG;AACjE,IAAA,IAAIF,IAAI,CAACE,MAAM,GAAGT,aAAa,EAAE;MAC/BA,aAAa,GAAGO,IAAI,CAACE,MAAM;AAC7B;AAEAR,IAAAA,UAAU,CAACS,IAAI,CAAC,CAACH,IAAI,EAAE,CAAA,EAAGJ,QAAQ,CAACQ,OAAO,CAAC,CAAC,CAAC,CAAA,EAAA,CAAI,CAAC,CAAC;AACnDP,IAAAA,WAAW,CAACQ,aAAa,CAACV,IAAI,CAAC;AACjC;AAGAlB,EAAAA,OAAO,CAAC6B,GAAG,CAAC,2CAA2C,CAAC;EACxD,KAAK,MAAM,CAACN,IAAI,EAAEO,KAAK,CAAC,IAAIb,UAAU,EAAE;IACtC,MAAMc,MAAM,GAAGf,aAAa,GAAGO,IAAI,CAACE,MAAM,GAAG,CAAC;AAC9CzB,IAAAA,OAAO,CAAC6B,GAAG,CAACN,IAAI,GAAG,GAAG,CAACS,MAAM,CAACD,MAAM,CAAC,GAAGD,KAAK,CAAC;AAChD;AACA9B,EAAAA,OAAO,CAAC6B,GAAG,CAAC,2CAA2C,CAAC;AAE1D;AAEO,eAAeI,uBAAuBA,CAC3CC,KAAa,EACbC,WAA6B,EAAA;AAE7B,EAAA,MAAMC,SAAS,GAAG,CAAA,EAAGtB,uBAAuB,CAAA,CAAA,EAAIoB,KAAK,CAAE,CAAA;AACvD,EAAA,MAAMG,UAAU,GAAG,CAASD,MAAAA,EAAAA,SAAS,CAAE,CAAA;AACvC,EAAA,MAAME,QAAQ,GAAG,CAAOF,IAAAA,EAAAA,SAAS,CAAE,CAAA;EAEnC,IAAI;AACFhB,IAAAA,WAAW,CAACmB,IAAI,CAACF,UAAU,CAAC;IAE5B,OAAO,MAAMF,WAAW,EAAE;AAC5B,GAAA,SAAU;AACRf,IAAAA,WAAW,CAACmB,IAAI,CAACD,QAAQ,CAAC;IAC1BlB,WAAW,CAACoB,OAAO,CAACJ,SAAS,EAAEC,UAAU,EAAEC,QAAQ,CAAC;AACpDlB,IAAAA,WAAW,CAACqB,UAAU,CAACJ,UAAU,CAAC;AAClCjB,IAAAA,WAAW,CAACqB,UAAU,CAACH,QAAQ,CAAC;AAClC;AACF;AAEgB,SAAAI,2BAA2BA,CACzCR,KAAa,EACbC,WAA6B,EAAA;EAE7B,OAAOA,WAAW,EAAE;AACtB;;AC1CA,MAAMQ,iBAAiB,GAAG,2CAA2C;MAwCxDC,YAAY,CAAA;EAKHC,OAAA;AAJHC,EAAAA,aAAa,GAAG,IAAI3C,GAAG,EAAkB;AACzC4C,EAAAA,0BAA0B,GAAG,IAAI9C,sCAAsC,EAAE;AACzE+C,EAAAA,SAAS,GAAG,IAAI7C,GAAG,EAAmB;EAEvD8C,WAAAA,CAAoBJ,OAAyC,EAAA;IAAzC,IAAO,CAAAA,OAAA,GAAPA,OAAO;AACzBrD,IAAAA,6BAA6B,EAAE;AACjC;EAMA,MAAM0D,MAAMA,CAACC,IAA+B,EAAA;AAC1C,IAAA,MAAMC,yBAAyB,GAAG,IAAI,CAACP,OAAO,EAAEO,yBAAyB;AAEzE,IAAA,MAAMC,SAAS,GAAGD,yBAAyB,GACvCnB,uBAAuB,GACvBS,2BAA2B;AAE/B,IAAA,IAAItC,IAAI,GAAG,MAAMiD,SAAS,CAAC,mBAAmB,EAAE,MAAM,IAAI,CAACC,eAAe,CAACH,IAAI,CAAC,CAAC;IAEjF,IAAI/C,IAAI,KAAKO,SAAS,EAAE;AACtBP,MAAAA,IAAI,GAAG,MAAMiD,SAAS,CAAC,aAAa,EAAE,MAAM,IAAI,CAACE,iBAAiB,CAACJ,IAAI,CAAC,CAAC;AAEzE,MAAA,IAAIA,IAAI,CAACK,iBAAiB,KAAK,KAAK,EAAE;AACpC,QAAA,MAAMC,OAAO,GAAG,MAAMJ,SAAS,CAAC,qBAAqB,EAAE,MAErD,IAAI,CAACG,iBAAiB,CAACpD,IAAK,EAAE+C,IAAI,CAAC,CACpC;AAED/C,QAAAA,IAAI,GAAGqD,OAAO;AAChB;AACF;AAEA,IAAA,IAAIL,yBAAyB,EAAE;AAC7BrC,MAAAA,oBAAoB,EAAE;AACxB;AAEA,IAAA,OAAOX,IAAI;AACb;AAEQoD,EAAAA,iBAAiBA,CAACpD,IAAY,EAAE+C,IAA+B,EAAA;AACrE,IAAA,MAAM9C,UAAU,GACd8C,IAAI,CAACO,UAAU,KAAKP,IAAI,CAACQ,gBAAgB,GAAGC,OAAO,CAACT,IAAI,CAACQ,gBAAgB,CAAC,GAAG,EAAE,CAAC;IAElF,OAAO,IAAI,CAACZ,0BAA0B,CAAClD,OAAO,CAACO,IAAI,EAAEC,UAAU,CAAC;AAClE;EAEQ,MAAMiD,eAAeA,CAACH,IAA+B,EAAA;IAC3D,MAAM;MAAEO,UAAU;MAAEC,gBAAgB;AAAEE,MAAAA;AAAG,KAAE,GAAGV,IAAI;IAClD,IAAI,CAACO,UAAU,IAAI,CAACC,gBAAgB,IAAIE,GAAG,KAAKlD,SAAS,EAAE;AACzD,MAAA,OAAOA,SAAS;AAClB;IAEA,MAAM;AAAEmD,MAAAA;AAAQ,KAAE,GAAG,IAAIC,KAAG,CAACF,GAAG,EAAE,YAAY,CAAC;IAG/C,MAAMG,QAAQ,GAAGC,IAAI,CAACP,UAAU,EAAEI,QAAQ,EAAE,YAAY,CAAC;IAEzD,IAAI,IAAI,CAACd,SAAS,CAACtC,GAAG,CAACsD,QAAQ,CAAC,EAAE;MAEhC,OAAOE,EAAE,CAACC,QAAQ,CAACvD,QAAQ,CAACoD,QAAQ,EAAE,OAAO,CAAC;AAChD;IAEA,IAAI,CAACA,QAAQ,CAAC1C,UAAU,CAAC8C,SAAS,CAACV,UAAU,CAAC,CAAC,EAAE;AAE/C,MAAA,OAAO/C,SAAS;AAClB;AAEA,IAAA,IAAIqD,QAAQ,KAAKK,OAAO,CAACV,gBAAgB,CAAC,IAAI,EAAE,MAAMW,MAAM,CAACN,QAAQ,CAAC,CAAC,EAAE;MAEvE,IAAI,CAAChB,SAAS,CAACnC,GAAG,CAACmD,QAAQ,EAAE,KAAK,CAAC;AAEnC,MAAA,OAAOrD,SAAS;AAClB;AAGA,IAAA,MAAM8C,OAAO,GAAG,MAAMS,EAAE,CAACC,QAAQ,CAACvD,QAAQ,CAACoD,QAAQ,EAAE,OAAO,CAAC;AAC7D,IAAA,MAAMO,KAAK,GAAG5B,iBAAiB,CAAC6B,IAAI,CAACf,OAAO,CAAC;IAC7C,IAAI,CAACT,SAAS,CAACnC,GAAG,CAACmD,QAAQ,EAAEO,KAAK,CAAC;AAEnC,IAAA,OAAOA,KAAK,GAAGd,OAAO,GAAG9C,SAAS;AACpC;EAEQ,MAAM4C,iBAAiBA,CAACJ,IAA+B,EAAA;IAC7D,MAAMsB,eAAe,GAAG,IAAI,CAAC5B,OAAO,EAAE6B,SAAS,IAAIvB,IAAI,CAACuB,SAAS;IACjE,IAAI,CAACD,eAAe,EAAE;AACpB,MAAA,MAAM,IAAIE,KAAK,CAAC,gDAAgD,CAAC;AACnE;IAEA,MAAMC,cAAc,GAAqB,CACvC;AAAEC,MAAAA,OAAO,EAAEC,eAAe;AAAEC,MAAAA,QAAQ,EAAE;AAAO,KAAA,EAC7C,IAAI5B,IAAI,CAAC6B,SAAS,IAAI,EAAE,CAAC,EACzB,IAAI,IAAI,CAACnC,OAAO,EAAEmC,SAAS,IAAI,EAAE,CAAC,CACnC;AAED,IAAA,IAAIC,QAAQ,GAAG9B,IAAI,CAAC8B,QAAQ;AAC5B,IAAA,IAAI,CAACA,QAAQ,IAAI9B,IAAI,CAACQ,gBAAgB,EAAE;MACtCsB,QAAQ,GAAG,MAAM,IAAI,CAACC,WAAW,CAAC/B,IAAI,CAACQ,gBAAgB,CAAC;AAC1D;AAEA,IAAA,MAAMwB,sBAAsB,GAAG;MAC7BtB,GAAG,EAAEV,IAAI,CAACU,GAAG;AACboB,MAAAA;KACD;IAED,OAAOG,aAAa,CAACX,eAAe,CAAA,GAChClB,iBAAiB,CAACkB,eAAe,EAAE;AACjCY,MAAAA,iBAAiB,EAAET,cAAc;MACjC,GAAGO;KACJ,CAAA,GACDG,YAAY,CAACb,eAAe,EAAE;MAAEG,cAAc;MAAE,GAAGO;AAAwB,KAAA,CAAC;AAClF;EAGQ,MAAMD,WAAWA,CAACK,QAAgB,EAAA;IACxC,IAAIC,GAAG,GAAG,IAAI,CAAC1C,aAAa,CAACpC,GAAG,CAAC6E,QAAQ,CAAC;IAE1C,IAAI,CAACC,GAAG,EAAE;MACRA,GAAG,GAAG,MAAMtB,EAAE,CAACC,QAAQ,CAACvD,QAAQ,CAAC2E,QAAQ,EAAE,OAAO,CAAC;MACnD,IAAI,CAACzC,aAAa,CAACjC,GAAG,CAAC0E,QAAQ,EAAEC,GAAG,CAAC;AACvC;AAEA,IAAA,OAAOA,GAAG;AACZ;AACD;AAED,eAAelB,MAAMA,CAAC9D,IAAiB,EAAA;EACrC,IAAI;AACF,IAAA,MAAM0D,EAAE,CAACC,QAAQ,CAACsB,MAAM,CAACjF,IAAI,EAAE0D,EAAE,CAACwB,SAAS,CAACC,IAAI,CAAC;AAEjD,IAAA,OAAO,IAAI;AACb,GAAA,CAAE,MAAM;AACN,IAAA,OAAO,KAAK;AACd;AACF;AAEA,SAASP,aAAaA,CACpBtD,KAAc,EAAA;EAGd,OAAO,OAAOA,KAAK,KAAK,UAAU,IAAI,EAAE,MAAM,IAAIA,KAAK,CAAC;AAC1D;;AC3LA,MAAM8D,oBAAoB,GAAG,IAAIC,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAYxF,SAAUC,+BAA+BA,CAC7CC,WAAiD,EAAA;EAEjD,MAAM;IAAEC,OAAO;AAAEC,IAAAA,MAAM,GAAG;AAAK,GAAE,GAAGF,WAAW;EAC/C,MAAMG,QAAQ,GAAGD,MAAM,KAAK,KAAK,IAAIA,MAAM,KAAK,MAAM;AACtD,EAAA,MAAME,QAAQ,GAAGH,OAAO,CAACI,OAAO,IAAIrC,GAAG,CAACsC,QAAQ,CAACL,OAAO,CAACI,OAAO,CAAC,GAAGJ,OAAO,CAACI,OAAO,GAAGzF,SAAS;AAE/F,EAAA,OAAO,IAAI2F,OAAO,CAACC,gBAAgB,CAACR,WAAW,CAAC,EAAE;IAChDE,MAAM;AACND,IAAAA,OAAO,EAAEQ,oBAAoB,CAACR,OAAO,CAAC;AACtCS,IAAAA,IAAI,EAAEP,QAAQ,GAAGH,WAAW,GAAGpF,SAAS;AACxC+F,IAAAA,MAAM,EAAER,QAAQ,GAAG,MAAM,GAAGvF,SAAS;AACrCwF,IAAAA;AACD,GAAA,CAAC;AACJ;AAQA,SAASK,oBAAoBA,CAACG,WAAgC,EAAA;AAC5D,EAAA,MAAMX,OAAO,GAAG,IAAIY,OAAO,EAAE;AAE7B,EAAA,KAAK,MAAM,CAAC1F,IAAI,EAAEY,KAAK,CAAC,IAAI+E,MAAM,CAACC,OAAO,CAACH,WAAW,CAAC,EAAE;AACvD,IAAA,IAAIf,oBAAoB,CAACmB,GAAG,CAAC7F,IAAI,CAAC,EAAE;AAClC,MAAA;AACF;AAEA,IAAA,IAAI,OAAOY,KAAK,KAAK,QAAQ,EAAE;AAC7BkE,MAAAA,OAAO,CAACgB,MAAM,CAAC9F,IAAI,EAAEY,KAAK,CAAC;KAC7B,MAAO,IAAImF,KAAK,CAACC,OAAO,CAACpF,KAAK,CAAC,EAAE;AAC/B,MAAA,KAAK,MAAMqF,IAAI,IAAIrF,KAAK,EAAE;AACxBkE,QAAAA,OAAO,CAACgB,MAAM,CAAC9F,IAAI,EAAEiG,IAAI,CAAC;AAC5B;AACF;AACF;AAEA,EAAA,OAAOnB,OAAO;AAChB;AAQM,SAAUO,gBAAgBA,CAACR,WAAiD,EAAA;EAChF,MAAM;IACJC,OAAO;IACPoB,MAAM;AACNvD,IAAAA,GAAG,GAAG,EAAE;AACRwD,IAAAA;AACD,GAAA,GAAGtB,WAAyD;EAC7D,MAAMuB,QAAQ,GACZC,mBAAmB,CAACvB,OAAO,CAAC,mBAAmB,CAAC,CAAC,KAChD,WAAW,IAAIoB,MAAM,IAAIA,MAAM,CAACI,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;AAChE,EAAA,MAAMC,QAAQ,GACZF,mBAAmB,CAACvB,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAIA,OAAO,CAAC0B,IAAI,IAAI1B,OAAO,CAAC,YAAY,CAAC;AAE3F,EAAA,IAAIiB,KAAK,CAACC,OAAO,CAACO,QAAQ,CAAC,EAAE;AAC3B,IAAA,MAAM,IAAI9C,KAAK,CAAC,gCAAgC,CAAC;AACnD;EAEA,IAAIgD,gBAAgB,GAAGF,QAAQ;AAC/B,EAAA,IAAI,CAACA,QAAQ,EAAEG,QAAQ,CAAC,GAAG,CAAC,EAAE;IAC5B,MAAMC,IAAI,GAAGN,mBAAmB,CAACvB,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAC7D,IAAA,IAAI6B,IAAI,EAAE;MACRF,gBAAgB,IAAI,CAAIE,CAAAA,EAAAA,IAAI,CAAE,CAAA;AAChC;AACF;AAEA,EAAA,OAAO,IAAI9D,GAAG,CAAC,CAAA,EAAGuD,QAAQ,CAAA,GAAA,EAAMK,gBAAgB,CAAA,EAAGN,WAAW,IAAIxD,GAAG,CAAA,CAAE,CAAC;AAC1E;AAgBA,SAAS0D,mBAAmBA,CAACzF,KAAoC,EAAA;AAC/D,EAAA,OAAOA,KAAK,EAAEgG,QAAQ,EAAE,CAACC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,EAAE;AACnD;;MCpGaC,oBAAoB,CAAA;AACdC,EAAAA,gBAAgB,GAAG,IAAIC,gBAAgB,EAAE;AAE1DlF,EAAAA,WAAAA,GAAA;AACEzD,IAAAA,6BAA6B,EAAE;AACjC;AAgBA,EAAA,MAAM4I,MAAMA,CACVC,OAA6C,EAC7CC,cAAwB,EAAA;AAExB,IAAA,MAAMC,UAAU,GAAGzC,+BAA+B,CAACuC,OAAO,CAAC;IAE3D,OAAO,IAAI,CAACH,gBAAgB,CAACE,MAAM,CAACG,UAAU,EAAED,cAAc,CAAC;AACjE;AACD;;ACgBK,SAAUE,wBAAwBA,CAAuCC,OAAU,EAAA;AACtFA,EAAAA,OAAyD,CAAC,6BAA6B,CAAC,GAAG,IAAI;AAEhG,EAAA,OAAOA,OAAO;AAChB;;ACjDO,eAAeC,2BAA2BA,CAC/CC,MAAgB,EAChBC,WAAiD,EAAA;EAEjD,MAAM;IAAEC,MAAM;IAAE7C,OAAO;AAAES,IAAAA;AAAI,GAAE,GAAGkC,MAAM;EACxCC,WAAW,CAACE,UAAU,GAAGD,MAAM;EAE/B,IAAIE,eAAe,GAAG,KAAK;AAC3B,EAAA,KAAK,MAAM,CAAC7H,IAAI,EAAEY,KAAK,CAAC,IAAIkE,OAAO,CAACc,OAAO,EAAE,EAAE;IAC7C,IAAI5F,IAAI,KAAK,YAAY,EAAE;AACzB,MAAA,IAAI6H,eAAe,EAAE;AACnB,QAAA;AACF;MAIAH,WAAW,CAACI,SAAS,CAAC9H,IAAI,EAAE8E,OAAO,CAACiD,YAAY,EAAE,CAAC;AACnDF,MAAAA,eAAe,GAAG,IAAI;AACxB,KAAA,MAAO;AACLH,MAAAA,WAAW,CAACI,SAAS,CAAC9H,IAAI,EAAEY,KAAK,CAAC;AACpC;AACF;EAEA,IAAI,cAAc,IAAI8G,WAAW,EAAE;IACjCA,WAAW,CAACM,YAAY,EAAE;AAC5B;EAEA,IAAI,CAACzC,IAAI,EAAE;IACTmC,WAAW,CAACO,GAAG,EAAE;AAEjB,IAAA;AACF;EAEA,IAAI;AACF,IAAA,MAAMC,MAAM,GAAG3C,IAAI,CAAC4C,SAAS,EAAE;AAE/BT,IAAAA,WAAW,CAAC9I,EAAE,CAAC,OAAO,EAAE,MAAK;MAC3BsJ,MAAM,CAACE,MAAM,EAAE,CAACC,KAAK,CAAExJ,KAAK,IAAI;AAE9BC,QAAAA,OAAO,CAACD,KAAK,CACX,CAAA,uDAAA,EAA0D6I,WAAW,CAACY,GAAG,CAAC3F,GAAG,CAAA,CAAA,CAAG,EAChF9D,KAAK,CACN;AACH,OAAC,CAAC;AACJ,KAAC,CAAC;AAGF,IAAA,OAAO,IAAI,EAAE;MACX,MAAM;QAAE0J,IAAI;AAAE3H,QAAAA;AAAK,OAAE,GAAG,MAAMsH,MAAM,CAACM,IAAI,EAAE;AAC3C,MAAA,IAAID,IAAI,EAAE;QACRb,WAAW,CAACO,GAAG,EAAE;AACjB,QAAA;AACF;AAEA,MAAA,MAAMQ,WAAW,GAAIf,WAA8B,CAACgB,KAAK,CAAC9H,KAAK,CAAC;MAChE,IAAI6H,WAAW,KAAK,KAAK,EAAE;AAGzB,QAAA,MAAM,IAAIE,OAAO,CAAQxF,OAAO,IAAKuE,WAAW,CAACkB,IAAI,CAAC,OAAO,EAAEzF,OAAO,CAAC,CAAC;AAC1E;AACF;AACF,GAAA,CAAE,MAAM;AACNuE,IAAAA,WAAW,CAACO,GAAG,CAAC,wBAAwB,CAAC;AAC3C;AACF;;AC5DM,SAAUY,YAAYA,CAAClG,GAAW,EAAA;AACtC,EAAA,OAAOA,GAAG,CAACvC,UAAU,CAAC,OAAO,CAAC,IAAI0I,IAAI,CAAC,CAAC,CAAC,KAAKC,aAAa,CAACpG,GAAG,CAAC;AAClE;;;;"}
1	+ {"version":3,"file":"node.mjs","sources":["../../../../../../k8-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/environment-options.ts","../../../../../../k8-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/errors.ts","../../../../../../k8-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/common-engine/inline-css-processor.ts","../../../../../../k8-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/common-engine/peformance-profiler.ts","../../../../../../k8-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/common-engine/common-engine.ts","../../../../../../k8-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/request.ts","../../../../../../k8-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/app-engine.ts","../../../../../../k8-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/handler.ts","../../../../../../k8-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/response.ts","../../../../../../k8-fastbuild-ST-fdfa778d11ba/bin/packages/angular/ssr/node/src/module.ts"],"sourcesContent":["/*\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\n/\n Retrieves the list of allowed hosts from the environment variable `NG_ALLOWED_HOSTS`.\n * @returns An array of allowed hosts.\n /\nexport function getAllowedHostsFromEnv(): ReadonlyArray<string> {\n const allowedHosts: string[] = [];\n const envNgAllowedHosts = process.env['NG_ALLOWED_HOSTS'];\n if (!envNgAllowedHosts) {\n return allowedHosts;\n }\n\n const hosts = envNgAllowedHosts.split(',');\n for (const host of hosts) {\n const trimmed = host.trim();\n if (trimmed.length > 0) {\n allowedHosts.push(trimmed);\n }\n }\n\n return allowedHosts;\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\n/\n Attaches listeners to the Node.js process to capture and handle unhandled rejections and uncaught exceptions.\n * Captured errors are logged to the console. This function logs errors to the console, preventing unhandled errors\n * from crashing the server. It is particularly useful for Zoneless apps, ensuring error handling without relying on Zone.js.\n \n @remarks\n * This function is a no-op if zone.js is available.\n * For Zone-based apps, similar functionality is provided by Zone.js itself. See the Zone.js implementation here:\n * https://github.com/angular/angular/blob/4a8d0b79001ec09bcd6f2d6b15117aa6aac1932c/packages/zone.js/lib/node/node.ts#L94%7C\n \n @internal\n /\nexport function attachNodeGlobalErrorHandlers(): void {\n if (typeof Zone !== 'undefined') {\n return;\n }\n\n // Ensure that the listeners are registered only once.\n // Otherwise, multiple instances may be registered during edit/refresh.\n const gThis: typeof globalThis & { ngAttachNodeGlobalErrorHandlersCalled?: boolean } = globalThis;\n if (gThis.ngAttachNodeGlobalErrorHandlersCalled) {\n return;\n }\n\n gThis.ngAttachNodeGlobalErrorHandlersCalled = true;\n\n process\n // eslint-disable-next-line no-console\n .on('unhandledRejection', (error) => console.error('unhandledRejection', error))\n // eslint-disable-next-line no-console\n .on('uncaughtException', (error) => console.error('uncaughtException', error));\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport { ɵInlineCriticalCssProcessor as InlineCriticalCssProcessor } from '@angular/ssr';\nimport { readFile } from 'node:fs/promises';\n\nexport class CommonEngineInlineCriticalCssProcessor {\n private readonly resourceCache = new Map<string, string>();\n\n async process(html: string, outputPath: string \| undefined): Promise<string> {\n const beasties = new InlineCriticalCssProcessor(async (path) => {\n let resourceContent = this.resourceCache.get(path);\n if (resourceContent === undefined) {\n resourceContent = await readFile(path, 'utf-8');\n this.resourceCache.set(path, resourceContent);\n }\n\n return resourceContent;\n }, outputPath);\n\n return beasties.process(html);\n }\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nconst PERFORMANCE_MARK_PREFIX = '🅰️';\n\nexport function printPerformanceLogs(): void {\n let maxWordLength = 0;\n const benchmarks: [step: string, value: string][] = [];\n\n for (const { name, duration } of performance.getEntriesByType('measure')) {\n if (!name.startsWith(PERFORMANCE_MARK_PREFIX)) {\n continue;\n }\n\n // `🅰️:Retrieve SSG Page` -> `Retrieve SSG Page:`\n const step = name.slice(PERFORMANCE_MARK_PREFIX.length + 1) + ':';\n if (step.length > maxWordLength) {\n maxWordLength = step.length;\n }\n\n benchmarks.push([step, `${duration.toFixed(1)}ms`]);\n performance.clearMeasures(name);\n }\n\n / eslint-disable no-console /\n console.log('******* Performance results ******');\n for (const [step, value] of benchmarks) {\n const spaces = maxWordLength - step.length + 5;\n console.log(step + ' '.repeat(spaces) + value);\n }\n console.log('**************************************');\n / eslint-enable no-console /\n}\n\nexport async function runMethodAndMeasurePerf<T>(\n label: string,\n asyncMethod: () => Promise<T>,\n): Promise<T> {\n const labelName = `${PERFORMANCE_MARK_PREFIX}:${label}`;\n const startLabel = `start:${labelName}`;\n const endLabel = `end:${labelName}`;\n\n try {\n performance.mark(startLabel);\n\n return await asyncMethod();\n } finally {\n performance.mark(endLabel);\n performance.measure(labelName, startLabel, endLabel);\n performance.clearMarks(startLabel);\n performance.clearMarks(endLabel);\n }\n}\n\nexport function noopRunMethodAndMeasurePerf<T>(\n label: string,\n asyncMethod: () => Promise<T>,\n): Promise<T> {\n return asyncMethod();\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport { ApplicationRef, StaticProvider, Type } from '@angular/core';\nimport { BootstrapContext } from '@angular/platform-browser';\nimport { renderApplication, renderModule, ɵSERVER_CONTEXT } from '@angular/platform-server';\nimport as fs from 'node:fs';\nimport { dirname, join, normalize, resolve } from 'node:path';\nimport { URL } from 'node:url';\nimport { validateUrl } from '../../../src/utils/validation';\nimport { getAllowedHostsFromEnv } from '../environment-options';\nimport { attachNodeGlobalErrorHandlers } from '../errors';\nimport { CommonEngineInlineCriticalCssProcessor } from './inline-css-processor';\nimport {\n noopRunMethodAndMeasurePerf,\n printPerformanceLogs,\n runMethodAndMeasurePerf,\n} from './peformance-profiler';\n\nconst SSG_MARKER_REGEXP = /ng-server-context=[\"']\\w\\\|?ssg\\\|?\\w[\"']/;\n\nexport interface CommonEngineOptions {\n /** A method that when invoked returns a promise that returns an `ApplicationRef` instance once resolved or an NgModule. /\n bootstrap?: Type<{}> \| ((context: BootstrapContext) => Promise<ApplicationRef>);\n\n /* A set of platform level providers for all requests. /\n providers?: StaticProvider[];\n\n /* Enable request performance profiling data collection and printing the results in the server console. /\n enablePerformanceProfiler?: boolean;\n\n /* A set of hostnames that are allowed to access the server. /\n allowedHosts?: readonly string[];\n}\n\nexport interface CommonEngineRenderOptions {\n /* A method that when invoked returns a promise that returns an `ApplicationRef` instance once resolved or an NgModule. /\n bootstrap?: Type<{}> \| ((context: BootstrapContext) => Promise<ApplicationRef>);\n\n /* A set of platform level providers for the current request. /\n providers?: StaticProvider[];\n url?: string;\n document?: string;\n documentFilePath?: string;\n\n /\n Reduce render blocking requests by inlining critical CSS.\n * Defaults to true.\n /\n inlineCriticalCss?: boolean;\n\n /\n Base path location of index file.\n * Defaults to the 'documentFilePath' dirname when not provided.\n /\n publicPath?: string;\n}\n\n/\n A common engine to use to server render an application.\n /\n\nexport class CommonEngine {\n private readonly templateCache = new Map<string, string>();\n private readonly inlineCriticalCssProcessor = new CommonEngineInlineCriticalCssProcessor();\n private readonly pageIsSSG = new Map<string, boolean>();\n private readonly allowedHosts: ReadonlySet<string>;\n\n constructor(private options?: CommonEngineOptions) {\n this.allowedHosts = new Set([\n ...getAllowedHostsFromEnv(),\n ...(this.options?.allowedHosts ?? []),\n ]);\n\n attachNodeGlobalErrorHandlers();\n }\n\n /\n Render an HTML document for a specific URL with specified\n * render options\n /\n async render(opts: CommonEngineRenderOptions): Promise<string> {\n const { url } = opts;\n\n if (url && URL.canParse(url)) {\n const urlObj = new URL(url);\n try {\n validateUrl(urlObj, this.allowedHosts);\n } catch (error) {\n const isAllowedHostConfigured = this.allowedHosts.size > 0;\n // eslint-disable-next-line no-console\n console.error(\n `ERROR: ${(error as Error).message}` +\n 'Please provide a list of allowed hosts in the \"allowedHosts\" option in the \"CommonEngine\" constructor.',\n isAllowedHostConfigured\n ? ''\n : '\\nFalling back to client side rendering. This will become a 400 Bad Request in a future major version.',\n );\n\n if (!isAllowedHostConfigured) {\n // Fallback to CSR to avoid a breaking change.\n // TODO(alanagius): Return a 400 and remove this fallback in the next major version (v22).\n let document = opts.document;\n if (!document && opts.documentFilePath) {\n document = opts.document ?? (await this.getDocument(opts.documentFilePath));\n }\n\n if (document) {\n return document;\n }\n }\n\n throw error;\n }\n }\n\n const enablePerformanceProfiler = this.options?.enablePerformanceProfiler;\n\n const runMethod = enablePerformanceProfiler\n ? runMethodAndMeasurePerf\n : noopRunMethodAndMeasurePerf;\n\n let html = await runMethod('Retrieve SSG Page', () => this.retrieveSSGPage(opts));\n\n if (html === undefined) {\n html = await runMethod('Render Page', () => this.renderApplication(opts));\n\n if (opts.inlineCriticalCss !== false) {\n const content = await runMethod('Inline Critical CSS', () =>\n // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n this.inlineCriticalCss(html!, opts),\n );\n\n html = content;\n }\n }\n\n if (enablePerformanceProfiler) {\n printPerformanceLogs();\n }\n\n return html;\n }\n\n private inlineCriticalCss(html: string, opts: CommonEngineRenderOptions): Promise<string> {\n const outputPath =\n opts.publicPath ?? (opts.documentFilePath ? dirname(opts.documentFilePath) : '');\n\n return this.inlineCriticalCssProcessor.process(html, outputPath);\n }\n\n private async retrieveSSGPage(opts: CommonEngineRenderOptions): Promise<string \| undefined> {\n const { publicPath, documentFilePath, url } = opts;\n if (!publicPath \|\| !documentFilePath \|\| url === undefined) {\n return undefined;\n }\n\n const { pathname } = new URL(url, 'resolve://');\n // Do not use `resolve` here as otherwise it can lead to path traversal vulnerability.\n // See: https://portswigger.net/web-security/file-path-traversal\n const pagePath = join(publicPath, pathname, 'index.html');\n\n if (this.pageIsSSG.get(pagePath)) {\n // Serve pre-rendered page.\n return fs.promises.readFile(pagePath, 'utf-8');\n }\n\n if (!pagePath.startsWith(normalize(publicPath))) {\n // Potential path traversal detected.\n return undefined;\n }\n\n if (pagePath === resolve(documentFilePath) \|\| !(await exists(pagePath))) {\n // View matches with prerender path or file does not exist.\n this.pageIsSSG.set(pagePath, false);\n\n return undefined;\n }\n\n // Static file exists.\n const content = await fs.promises.readFile(pagePath, 'utf-8');\n const isSSG = SSG_MARKER_REGEXP.test(content);\n this.pageIsSSG.set(pagePath, isSSG);\n\n return isSSG ? content : undefined;\n }\n\n private async renderApplication(opts: CommonEngineRenderOptions): Promise<string> {\n const moduleOrFactory = this.options?.bootstrap ?? opts.bootstrap;\n if (!moduleOrFactory) {\n throw new Error('A module or bootstrap option must be provided.');\n }\n\n const extraProviders: StaticProvider[] = [\n { provide: ɵSERVER_CONTEXT, useValue: 'ssr' },\n ...(opts.providers ?? []),\n ...(this.options?.providers ?? []),\n ];\n\n let document = opts.document;\n if (!document && opts.documentFilePath) {\n document = await this.getDocument(opts.documentFilePath);\n }\n\n const commonRenderingOptions = {\n url: opts.url,\n document,\n };\n\n return isBootstrapFn(moduleOrFactory)\n ? renderApplication(moduleOrFactory, {\n platformProviders: extraProviders,\n ...commonRenderingOptions,\n })\n : renderModule(moduleOrFactory, { extraProviders, ...commonRenderingOptions });\n }\n\n /* Retrieve the document from the cache or the filesystem /\n private async getDocument(filePath: string): Promise<string> {\n let doc = this.templateCache.get(filePath);\n\n if (!doc) {\n doc = await fs.promises.readFile(filePath, 'utf-8');\n this.templateCache.set(filePath, doc);\n }\n\n return doc;\n }\n}\n\nasync function exists(path: fs.PathLike): Promise<boolean> {\n try {\n await fs.promises.access(path, fs.constants.F_OK);\n\n return true;\n } catch {\n return false;\n }\n}\n\nfunction isBootstrapFn(\n value: unknown,\n): value is (context: BootstrapContext) => Promise<ApplicationRef> {\n // We can differentiate between a module and a bootstrap function by reading compiler-generated `ɵmod` static property:\n return typeof value === 'function' && !('ɵmod' in value);\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport type { IncomingHttpHeaders, IncomingMessage } from 'node:http';\nimport type { Http2ServerRequest } from 'node:http2';\nimport { getFirstHeaderValue } from '../../src/utils/validation';\n\n/\n A set containing all the pseudo-headers defined in the HTTP/2 specification.\n \n This set can be used to filter out pseudo-headers from a list of headers,\n * as they are not allowed to be set directly using the `Node.js` Undici API or\n * the web `Headers` API.\n /\nconst HTTP2_PSEUDO_HEADERS = new Set([':method', ':scheme', ':authority', ':path', ':status']);\n\n/\n Converts a Node.js `IncomingMessage` or `Http2ServerRequest` into a\n * Web Standard `Request` object.\n \n This function adapts the Node.js request objects to a format that can\n * be used by web platform APIs.\n \n @param nodeRequest - The Node.js request object (`IncomingMessage` or `Http2ServerRequest`) to convert.\n * @returns A Web Standard `Request` object.\n /\nexport function createWebRequestFromNodeRequest(\n nodeRequest: IncomingMessage \| Http2ServerRequest,\n): Request {\n const { headers, method = 'GET' } = nodeRequest;\n const withBody = method !== 'GET' && method !== 'HEAD';\n const referrer = headers.referer && URL.canParse(headers.referer) ? headers.referer : undefined;\n\n return new Request(createRequestUrl(nodeRequest), {\n method,\n headers: createRequestHeaders(headers),\n body: withBody ? nodeRequest : undefined,\n duplex: withBody ? 'half' : undefined,\n referrer,\n });\n}\n\n/\n Creates a `Headers` object from Node.js `IncomingHttpHeaders`.\n \n @param nodeHeaders - The Node.js `IncomingHttpHeaders` object to convert.\n * @returns A `Headers` object containing the converted headers.\n /\nfunction createRequestHeaders(nodeHeaders: IncomingHttpHeaders): Headers {\n const headers = new Headers();\n\n for (const [name, value] of Object.entries(nodeHeaders)) {\n if (HTTP2_PSEUDO_HEADERS.has(name)) {\n continue;\n }\n\n if (typeof value === 'string') {\n headers.append(name, value);\n } else if (Array.isArray(value)) {\n for (const item of value) {\n headers.append(name, item);\n }\n }\n }\n\n return headers;\n}\n\n/\n Creates a `URL` object from a Node.js `IncomingMessage`, taking into account the protocol, host, and port.\n \n @param nodeRequest - The Node.js `IncomingMessage` or `Http2ServerRequest` object to extract URL information from.\n * @returns A `URL` object representing the request URL.\n /\nexport function createRequestUrl(nodeRequest: IncomingMessage \| Http2ServerRequest): URL {\n const {\n headers,\n socket,\n url = '',\n originalUrl,\n } = nodeRequest as IncomingMessage & { originalUrl?: string };\n const protocol =\n getFirstHeaderValue(headers['x-forwarded-proto']) ??\n ('encrypted' in socket && socket.encrypted ? 'https' : 'http');\n const hostname =\n getFirstHeaderValue(headers['x-forwarded-host']) ?? headers.host ?? headers[':authority'];\n\n if (Array.isArray(hostname)) {\n throw new Error('host value cannot be an array.');\n }\n\n let hostnameWithPort = hostname;\n if (!hostname?.includes(':')) {\n const port = getFirstHeaderValue(headers['x-forwarded-port']);\n if (port) {\n hostnameWithPort += `:${port}`;\n }\n }\n\n return new URL(`${protocol}://${hostnameWithPort}${originalUrl ?? url}`);\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport { AngularAppEngine } from '@angular/ssr';\nimport type { IncomingMessage } from 'node:http';\nimport type { Http2ServerRequest } from 'node:http2';\nimport { AngularAppEngineOptions } from '../../src/app-engine';\nimport { getAllowedHostsFromEnv } from './environment-options';\nimport { attachNodeGlobalErrorHandlers } from './errors';\nimport { createWebRequestFromNodeRequest } from './request';\n\n/\n Options for the Angular Node.js server application engine.\n /\nexport interface AngularNodeAppEngineOptions extends AngularAppEngineOptions {}\n\n/\n Angular server application engine.\n * Manages Angular server applications (including localized ones), handles rendering requests,\n * and optionally transforms index HTML before rendering.\n \n @remarks This class should be instantiated once and used as a singleton across the server-side\n * application to ensure consistent handling of rendering requests and resource management.\n /\nexport class AngularNodeAppEngine {\n private readonly angularAppEngine: AngularAppEngine;\n\n /\n Creates a new instance of the Angular Node.js server application engine.\n * @param options Options for the Angular Node.js server application engine.\n /\n constructor(options?: AngularNodeAppEngineOptions) {\n this.angularAppEngine = new AngularAppEngine({\n ...options,\n allowedHosts: [...getAllowedHostsFromEnv(), ...(options?.allowedHosts ?? [])],\n });\n\n attachNodeGlobalErrorHandlers();\n }\n\n /\n Handles an incoming HTTP request by serving prerendered content, performing server-side rendering,\n * or delivering a static file for client-side rendered routes based on the `RenderMode` setting.\n \n This method adapts Node.js's `IncomingMessage`, `Http2ServerRequest` or `Request`\n * to a format compatible with the `AngularAppEngine` and delegates the handling logic to it.\n \n @param request - The incoming HTTP request (`IncomingMessage`, `Http2ServerRequest` or `Request`).\n * @param requestContext - Optional context for rendering, such as metadata associated with the request.\n * @returns A promise that resolves to the resulting HTTP response object, or `null` if no matching Angular route is found.\n \n @remarks A request to `https://www.example.com/page/index.html` will serve or render the Angular route\n * corresponding to `https://www.example.com/page`.\n \n @remarks\n * To prevent potential Server-Side Request Forgery (SSRF), this function verifies the hostname\n * of the `request.url` against a list of authorized hosts.\n * If the hostname is not recognized and `allowedHosts` is not empty, a Client-Side Rendered (CSR) version of the\n * page is returned otherwise a 400 Bad Request is returned.\n \n Resolution:\n * Authorize your hostname by configuring `allowedHosts` in `angular.json` in:\n * `projects.[project-name].architect.build.options.security.allowedHosts`.\n * Alternatively, you can define the allowed hostname via the environment variable `process.env['NG_ALLOWED_HOSTS']`\n * or pass it directly through the configuration options of `AngularNodeAppEngine`.\n \n For more information see: https://angular.dev/best-practices/security#preventing-server-side-request-forgery-ssrf\n /\n async handle(\n request: IncomingMessage \| Http2ServerRequest \| Request,\n requestContext?: unknown,\n ): Promise<Response \| null> {\n const webRequest =\n request instanceof Request ? request : createWebRequestFromNodeRequest(request);\n\n return this.angularAppEngine.handle(webRequest, requestContext);\n }\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport type { IncomingMessage, ServerResponse } from 'node:http';\n\n/\n Represents a middleware function for handling HTTP requests in a Node.js environment.\n \n @param req - The incoming HTTP request object.\n * @param res - The outgoing HTTP response object.\n * @param next - A callback function that signals the completion of the middleware or forwards the error if provided.\n \n @returns A Promise that resolves to void or simply void. The handler can be asynchronous.\n /\nexport type NodeRequestHandlerFunction = (\n req: IncomingMessage,\n res: ServerResponse,\n next: (err?: unknown) => void,\n) => Promise<void> \| void;\n\n/\n Attaches metadata to the handler function to mark it as a special handler for Node.js environments.\n \n @typeParam T - The type of the handler function.\n * @param handler - The handler function to be defined and annotated.\n * @returns The same handler function passed as an argument, with metadata attached.\n \n @example\n * Usage in an Express application:\n * ```ts\n * const app = express();\n * export default createNodeRequestHandler(app);\n * ```\n \n @example\n * Usage in a Hono application:\n * ```ts\n * const app = new Hono();\n * export default createNodeRequestHandler(async (req, res, next) => {\n * try {\n * const webRes = await app.fetch(createWebRequestFromNodeRequest(req));\n * if (webRes) {\n * await writeResponseToNodeResponse(webRes, res);\n * } else {\n * next();\n * }\n * } catch (error) {\n * next(error);\n * }\n * });\n * ```\n \n @example\n * Usage in a Fastify application:\n * ```ts\n * const app = Fastify();\n * export default createNodeRequestHandler(async (req, res) => {\n * await app.ready();\n * app.server.emit('request', req, res);\n * });\n * ```\n /\nexport function createNodeRequestHandler<T extends NodeRequestHandlerFunction>(handler: T): T {\n (handler as T & { __ng_node_request_handler__?: boolean })['__ng_node_request_handler__'] = true;\n\n return handler;\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport type { ServerResponse } from 'node:http';\nimport type { Http2ServerResponse } from 'node:http2';\n\n/\n Streams a web-standard `Response` into a Node.js `ServerResponse`\n * or `Http2ServerResponse`.\n \n This function adapts the web `Response` object to write its content\n * to a Node.js response object, handling both HTTP/1.1 and HTTP/2.\n \n @param source - The web-standard `Response` object to stream from.\n * @param destination - The Node.js response object (`ServerResponse` or `Http2ServerResponse`) to stream into.\n * @returns A promise that resolves once the streaming operation is complete.\n /\nexport async function writeResponseToNodeResponse(\n source: Response,\n destination: ServerResponse \| Http2ServerResponse,\n): Promise<void> {\n const { status, headers, body } = source;\n destination.statusCode = status;\n\n let cookieHeaderSet = false;\n for (const [name, value] of headers.entries()) {\n if (name === 'set-cookie') {\n if (cookieHeaderSet) {\n continue;\n }\n\n // Sets the 'set-cookie' header only once to ensure it is correctly applied.\n // Concatenating 'set-cookie' values can lead to incorrect behavior, so we use a single value from `headers.getSetCookie()`.\n destination.setHeader(name, headers.getSetCookie());\n cookieHeaderSet = true;\n } else {\n destination.setHeader(name, value);\n }\n }\n\n if ('flushHeaders' in destination) {\n destination.flushHeaders();\n }\n\n if (!body) {\n destination.end();\n\n return;\n }\n\n try {\n const reader = body.getReader();\n\n destination.on('close', () => {\n reader.cancel().catch((error) => {\n // eslint-disable-next-line no-console\n console.error(\n `An error occurred while writing the response body for: ${destination.req.url}.`,\n error,\n );\n });\n });\n\n // eslint-disable-next-line no-constant-condition\n while (true) {\n const { done, value } = await reader.read();\n if (done) {\n destination.end();\n break;\n }\n\n const canContinue = (destination as ServerResponse).write(value);\n if (canContinue === false) {\n // Explicitly check for `false`, as AWS may return `undefined` even though this is not valid.\n // See: https://github.com/CodeGenieApp/serverless-express/issues/683\n await new Promise<void>((resolve) => destination.once('drain', resolve));\n }\n }\n } catch {\n destination.end('Internal server error.');\n }\n}\n","/\n @license\n * Copyright Google LLC All Rights Reserved.\n \n Use of this source code is governed by an MIT-style license that can be\n * found in the LICENSE file at https://angular.dev/license\n /\n\nimport { argv } from 'node:process';\nimport { fileURLToPath } from 'node:url';\n\n/\n Determines whether the provided URL represents the main entry point module.\n \n This function checks if the provided URL corresponds to the main ESM module being executed directly.\n * It's useful for conditionally executing code that should only run when a module is the entry point,\n * such as starting a server or initializing an application.\n \n It performs two key checks:\n * 1. Verifies if the URL starts with 'file:', ensuring it is a local file.\n * 2. Compares the URL's resolved file path with the first command-line argument (`process.argv[1]`),\n * which points to the file being executed.\n \n @param url The URL of the module to check. This should typically be `import.meta.url`.\n * @returns `true` if the provided URL represents the main entry point, otherwise `false`.\n */\nexport function isMainModule(url: string): boolean {\n return url.startsWith('file:') && argv[1] === fileURLToPath(url);\n}\n"],"names":["getAllowedHostsFromEnv","allowedHosts","envNgAllowedHosts","process","env","hosts","split","host","trimmed","trim","length","push","attachNodeGlobalErrorHandlers","Zone","gThis","globalThis","ngAttachNodeGlobalErrorHandlersCalled","on","error","console","CommonEngineInlineCriticalCssProcessor","resourceCache","Map","html","outputPath","beasties","InlineCriticalCssProcessor","path","resourceContent","get","undefined","readFile","set","PERFORMANCE_MARK_PREFIX","printPerformanceLogs","maxWordLength","benchmarks","name","duration","performance","getEntriesByType","startsWith","step","slice","toFixed","clearMeasures","log","value","spaces","repeat","runMethodAndMeasurePerf","label","asyncMethod","labelName","startLabel","endLabel","mark","measure","clearMarks","noopRunMethodAndMeasurePerf","SSG_MARKER_REGEXP","CommonEngine","options","templateCache","inlineCriticalCssProcessor","pageIsSSG","constructor","Set","render","opts","url","URL","canParse","urlObj","validateUrl","isAllowedHostConfigured","size","message","document","documentFilePath","getDocument","enablePerformanceProfiler","runMethod","retrieveSSGPage","renderApplication","inlineCriticalCss","content","publicPath","dirname","pathname","pagePath","join","fs","promises","normalize","resolve","exists","isSSG","test","moduleOrFactory","bootstrap","Error","extraProviders","provide","ɵSERVER_CONTEXT","useValue","providers","commonRenderingOptions","isBootstrapFn","platformProviders","renderModule","filePath","doc","access","constants","F_OK","HTTP2_PSEUDO_HEADERS","createWebRequestFromNodeRequest","nodeRequest","headers","method","withBody","referrer","referer","Request","createRequestUrl","createRequestHeaders","body","duplex","nodeHeaders","Headers","Object","entries","has","append","Array","isArray","item","socket","originalUrl","protocol","getFirstHeaderValue","encrypted","hostname","hostnameWithPort","includes","port","AngularNodeAppEngine","angularAppEngine","AngularAppEngine","handle","request","requestContext","webRequest","createNodeRequestHandler","handler","writeResponseToNodeResponse","source","destination","status","statusCode","cookieHeaderSet","setHeader","getSetCookie","flushHeaders","end","reader","getReader","cancel","catch","req","done","read","canContinue","write","Promise","once","isMainModule","argv","fileURLToPath"],"mappings":";;;;;;;;;SAYgBA,sBAAsBA,GAAA;EACpC,MAAMC,YAAY,GAAa,EAAE;AACjC,EAAA,MAAMC,iBAAiB,GAAGC,OAAO,CAACC,GAAG,CAAC,kBAAkB,CAAC;EACzD,IAAI,CAACF,iBAAiB,EAAE;AACtB,IAAA,OAAOD,YAAY;AACrB;AAEA,EAAA,MAAMI,KAAK,GAAGH,iBAAiB,CAACI,KAAK,CAAC,GAAG,CAAC;AAC1C,EAAA,KAAK,MAAMC,IAAI,IAAIF,KAAK,EAAE;AACxB,IAAA,MAAMG,OAAO,GAAGD,IAAI,CAACE,IAAI,EAAE;AAC3B,IAAA,IAAID,OAAO,CAACE,MAAM,GAAG,CAAC,EAAE;AACtBT,MAAAA,YAAY,CAACU,IAAI,CAACH,OAAO,CAAC;AAC5B;AACF;AAEA,EAAA,OAAOP,YAAY;AACrB;;SCRgBW,6BAA6BA,GAAA;AAC3C,EAAA,IAAI,OAAOC,IAAI,KAAK,WAAW,EAAE;AAC/B,IAAA;AACF;EAIA,MAAMC,KAAK,GAA4EC,UAAU;EACjG,IAAID,KAAK,CAACE,qCAAqC,EAAE;AAC/C,IAAA;AACF;EAEAF,KAAK,CAACE,qCAAqC,GAAG,IAAI;AAElDb,EAAAA,OAAO,CAEJc,EAAE,CAAC,oBAAoB,EAAGC,KAAK,IAAKC,OAAO,CAACD,KAAK,CAAC,oBAAoB,EAAEA,KAAK,CAAC,CAAA,CAE9ED,EAAE,CAAC,mBAAmB,EAAGC,KAAK,IAAKC,OAAO,CAACD,KAAK,CAAC,mBAAmB,EAAEA,KAAK,CAAC,CAAC;AAClF;;MC5BaE,sCAAsC,CAAA;AAChCC,EAAAA,aAAa,GAAG,IAAIC,GAAG,EAAkB;AAE1D,EAAA,MAAMnB,OAAOA,CAACoB,IAAY,EAAEC,UAA8B,EAAA;AACxD,IAAA,MAAMC,QAAQ,GAAG,IAAIC,2BAA0B,CAAC,MAAOC,IAAI,IAAI;MAC7D,IAAIC,eAAe,GAAG,IAAI,CAACP,aAAa,CAACQ,GAAG,CAACF,IAAI,CAAC;MAClD,IAAIC,eAAe,KAAKE,SAAS,EAAE;AACjCF,QAAAA,eAAe,GAAG,MAAMG,QAAQ,CAACJ,IAAI,EAAE,OAAO,CAAC;QAC/C,IAAI,CAACN,aAAa,CAACW,GAAG,CAACL,IAAI,EAAEC,eAAe,CAAC;AAC/C;AAEA,MAAA,OAAOA,eAAe;KACvB,EAAEJ,UAAU,CAAC;AAEd,IAAA,OAAOC,QAAQ,CAACtB,OAAO,CAACoB,IAAI,CAAC;AAC/B;AACD;;ACnBD,MAAMU,uBAAuB,GAAG,KAAK;SAErBC,oBAAoBA,GAAA;EAClC,IAAIC,aAAa,GAAG,CAAC;EACrB,MAAMC,UAAU,GAAoC,EAAE;AAEtD,EAAA,KAAK,MAAM;IAAEC,IAAI;AAAEC,IAAAA;AAAU,GAAA,IAAIC,WAAW,CAACC,gBAAgB,CAAC,SAAS,CAAC,EAAE;AACxE,IAAA,IAAI,CAACH,IAAI,CAACI,UAAU,CAACR,uBAAuB,CAAC,EAAE;AAC7C,MAAA;AACF;AAGA,IAAA,MAAMS,IAAI,GAAGL,IAAI,CAACM,KAAK,CAACV,uBAAuB,CAACvB,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG;AACjE,IAAA,IAAIgC,IAAI,CAAChC,MAAM,GAAGyB,aAAa,EAAE;MAC/BA,aAAa,GAAGO,IAAI,CAAChC,MAAM;AAC7B;AAEA0B,IAAAA,UAAU,CAACzB,IAAI,CAAC,CAAC+B,IAAI,EAAE,CAAA,EAAGJ,QAAQ,CAACM,OAAO,CAAC,CAAC,CAAC,CAAA,EAAA,CAAI,CAAC,CAAC;AACnDL,IAAAA,WAAW,CAACM,aAAa,CAACR,IAAI,CAAC;AACjC;AAGAlB,EAAAA,OAAO,CAAC2B,GAAG,CAAC,2CAA2C,CAAC;EACxD,KAAK,MAAM,CAACJ,IAAI,EAAEK,KAAK,CAAC,IAAIX,UAAU,EAAE;IACtC,MAAMY,MAAM,GAAGb,aAAa,GAAGO,IAAI,CAAChC,MAAM,GAAG,CAAC;AAC9CS,IAAAA,OAAO,CAAC2B,GAAG,CAACJ,IAAI,GAAG,GAAG,CAACO,MAAM,CAACD,MAAM,CAAC,GAAGD,KAAK,CAAC;AAChD;AACA5B,EAAAA,OAAO,CAAC2B,GAAG,CAAC,2CAA2C,CAAC;AAE1D;AAEO,eAAeI,uBAAuBA,CAC3CC,KAAa,EACbC,WAA6B,EAAA;AAE7B,EAAA,MAAMC,SAAS,GAAG,CAAA,EAAGpB,uBAAuB,CAAA,CAAA,EAAIkB,KAAK,CAAE,CAAA;AACvD,EAAA,MAAMG,UAAU,GAAG,CAASD,MAAAA,EAAAA,SAAS,CAAE,CAAA;AACvC,EAAA,MAAME,QAAQ,GAAG,CAAOF,IAAAA,EAAAA,SAAS,CAAE,CAAA;EAEnC,IAAI;AACFd,IAAAA,WAAW,CAACiB,IAAI,CAACF,UAAU,CAAC;IAE5B,OAAO,MAAMF,WAAW,EAAE;AAC5B,GAAA,SAAU;AACRb,IAAAA,WAAW,CAACiB,IAAI,CAACD,QAAQ,CAAC;IAC1BhB,WAAW,CAACkB,OAAO,CAACJ,SAAS,EAAEC,UAAU,EAAEC,QAAQ,CAAC;AACpDhB,IAAAA,WAAW,CAACmB,UAAU,CAACJ,UAAU,CAAC;AAClCf,IAAAA,WAAW,CAACmB,UAAU,CAACH,QAAQ,CAAC;AAClC;AACF;AAEgB,SAAAI,2BAA2BA,CACzCR,KAAa,EACbC,WAA6B,EAAA;EAE7B,OAAOA,WAAW,EAAE;AACtB;;ACxCA,MAAMQ,iBAAiB,GAAG,2CAA2C;MA2CxDC,YAAY,CAAA;EAMHC,OAAA;AALHC,EAAAA,aAAa,GAAG,IAAIzC,GAAG,EAAkB;AACzC0C,EAAAA,0BAA0B,GAAG,IAAI5C,sCAAsC,EAAE;AACzE6C,EAAAA,SAAS,GAAG,IAAI3C,GAAG,EAAmB;EACtCrB,YAAY;EAE7BiE,WAAAA,CAAoBJ,OAA6B,EAAA;IAA7B,IAAO,CAAAA,OAAA,GAAPA,OAAO;IACzB,IAAI,CAAC7D,YAAY,GAAG,IAAIkE,GAAG,CAAC,CAC1B,GAAGnE,sBAAsB,EAAE,EAC3B,IAAI,IAAI,CAAC8D,OAAO,EAAE7D,YAAY,IAAI,EAAE,CAAC,CACtC,CAAC;AAEFW,IAAAA,6BAA6B,EAAE;AACjC;EAMA,MAAMwD,MAAMA,CAACC,IAA+B,EAAA;IAC1C,MAAM;AAAEC,MAAAA;AAAK,KAAA,GAAGD,IAAI;IAEpB,IAAIC,GAAG,IAAIC,KAAG,CAACC,QAAQ,CAACF,GAAG,CAAC,EAAE;AAC5B,MAAA,MAAMG,MAAM,GAAG,IAAIF,KAAG,CAACD,GAAG,CAAC;MAC3B,IAAI;AACFI,QAAAA,WAAW,CAACD,MAAM,EAAE,IAAI,CAACxE,YAAY,CAAC;OACxC,CAAE,OAAOiB,KAAK,EAAE;QACd,MAAMyD,uBAAuB,GAAG,IAAI,CAAC1E,YAAY,CAAC2E,IAAI,GAAG,CAAC;AAE1DzD,QAAAA,OAAO,CAACD,KAAK,CACX,CAAWA,OAAAA,EAAAA,KAAe,CAAC2D,OAAO,CAAA,CAAE,GAClC,wGAAwG,EAC1GF,uBAAuB,GACnB,EAAE,GACF,wGAAwG,CAC7G;QAED,IAAI,CAACA,uBAAuB,EAAE;AAG5B,UAAA,IAAIG,QAAQ,GAAGT,IAAI,CAACS,QAAQ;AAC5B,UAAA,IAAI,CAACA,QAAQ,IAAIT,IAAI,CAACU,gBAAgB,EAAE;AACtCD,YAAAA,QAAQ,GAAGT,IAAI,CAACS,QAAQ,KAAK,MAAM,IAAI,CAACE,WAAW,CAACX,IAAI,CAACU,gBAAgB,CAAC,CAAC;AAC7E;AAEA,UAAA,IAAID,QAAQ,EAAE;AACZ,YAAA,OAAOA,QAAQ;AACjB;AACF;AAEA,QAAA,MAAM5D,KAAK;AACb;AACF;AAEA,IAAA,MAAM+D,yBAAyB,GAAG,IAAI,CAACnB,OAAO,EAAEmB,yBAAyB;AAEzE,IAAA,MAAMC,SAAS,GAAGD,yBAAyB,GACvC/B,uBAAuB,GACvBS,2BAA2B;AAE/B,IAAA,IAAIpC,IAAI,GAAG,MAAM2D,SAAS,CAAC,mBAAmB,EAAE,MAAM,IAAI,CAACC,eAAe,CAACd,IAAI,CAAC,CAAC;IAEjF,IAAI9C,IAAI,KAAKO,SAAS,EAAE;AACtBP,MAAAA,IAAI,GAAG,MAAM2D,SAAS,CAAC,aAAa,EAAE,MAAM,IAAI,CAACE,iBAAiB,CAACf,IAAI,CAAC,CAAC;AAEzE,MAAA,IAAIA,IAAI,CAACgB,iBAAiB,KAAK,KAAK,EAAE;AACpC,QAAA,MAAMC,OAAO,GAAG,MAAMJ,SAAS,CAAC,qBAAqB,EAAE,MAErD,IAAI,CAACG,iBAAiB,CAAC9D,IAAK,EAAE8C,IAAI,CAAC,CACpC;AAED9C,QAAAA,IAAI,GAAG+D,OAAO;AAChB;AACF;AAEA,IAAA,IAAIL,yBAAyB,EAAE;AAC7B/C,MAAAA,oBAAoB,EAAE;AACxB;AAEA,IAAA,OAAOX,IAAI;AACb;AAEQ8D,EAAAA,iBAAiBA,CAAC9D,IAAY,EAAE8C,IAA+B,EAAA;AACrE,IAAA,MAAM7C,UAAU,GACd6C,IAAI,CAACkB,UAAU,KAAKlB,IAAI,CAACU,gBAAgB,GAAGS,OAAO,CAACnB,IAAI,CAACU,gBAAgB,CAAC,GAAG,EAAE,CAAC;IAElF,OAAO,IAAI,CAACf,0BAA0B,CAAC7D,OAAO,CAACoB,IAAI,EAAEC,UAAU,CAAC;AAClE;EAEQ,MAAM2D,eAAeA,CAACd,IAA+B,EAAA;IAC3D,MAAM;MAAEkB,UAAU;MAAER,gBAAgB;AAAET,MAAAA;AAAG,KAAE,GAAGD,IAAI;IAClD,IAAI,CAACkB,UAAU,IAAI,CAACR,gBAAgB,IAAIT,GAAG,KAAKxC,SAAS,EAAE;AACzD,MAAA,OAAOA,SAAS;AAClB;IAEA,MAAM;AAAE2D,MAAAA;AAAQ,KAAE,GAAG,IAAIlB,KAAG,CAACD,GAAG,EAAE,YAAY,CAAC;IAG/C,MAAMoB,QAAQ,GAAGC,IAAI,CAACJ,UAAU,EAAEE,QAAQ,EAAE,YAAY,CAAC;IAEzD,IAAI,IAAI,CAACxB,SAAS,CAACpC,GAAG,CAAC6D,QAAQ,CAAC,EAAE;MAEhC,OAAOE,EAAE,CAACC,QAAQ,CAAC9D,QAAQ,CAAC2D,QAAQ,EAAE,OAAO,CAAC;AAChD;IAEA,IAAI,CAACA,QAAQ,CAACjD,UAAU,CAACqD,SAAS,CAACP,UAAU,CAAC,CAAC,EAAE;AAE/C,MAAA,OAAOzD,SAAS;AAClB;AAEA,IAAA,IAAI4D,QAAQ,KAAKK,OAAO,CAAChB,gBAAgB,CAAC,IAAI,EAAE,MAAMiB,MAAM,CAACN,QAAQ,CAAC,CAAC,EAAE;MAEvE,IAAI,CAACzB,SAAS,CAACjC,GAAG,CAAC0D,QAAQ,EAAE,KAAK,CAAC;AAEnC,MAAA,OAAO5D,SAAS;AAClB;AAGA,IAAA,MAAMwD,OAAO,GAAG,MAAMM,EAAE,CAACC,QAAQ,CAAC9D,QAAQ,CAAC2D,QAAQ,EAAE,OAAO,CAAC;AAC7D,IAAA,MAAMO,KAAK,GAAGrC,iBAAiB,CAACsC,IAAI,CAACZ,OAAO,CAAC;IAC7C,IAAI,CAACrB,SAAS,CAACjC,GAAG,CAAC0D,QAAQ,EAAEO,KAAK,CAAC;AAEnC,IAAA,OAAOA,KAAK,GAAGX,OAAO,GAAGxD,SAAS;AACpC;EAEQ,MAAMsD,iBAAiBA,CAACf,IAA+B,EAAA;IAC7D,MAAM8B,eAAe,GAAG,IAAI,CAACrC,OAAO,EAAEsC,SAAS,IAAI/B,IAAI,CAAC+B,SAAS;IACjE,IAAI,CAACD,eAAe,EAAE;AACpB,MAAA,MAAM,IAAIE,KAAK,CAAC,gDAAgD,CAAC;AACnE;IAEA,MAAMC,cAAc,GAAqB,CACvC;AAAEC,MAAAA,OAAO,EAAEC,eAAe;AAAEC,MAAAA,QAAQ,EAAE;AAAO,KAAA,EAC7C,IAAIpC,IAAI,CAACqC,SAAS,IAAI,EAAE,CAAC,EACzB,IAAI,IAAI,CAAC5C,OAAO,EAAE4C,SAAS,IAAI,EAAE,CAAC,CACnC;AAED,IAAA,IAAI5B,QAAQ,GAAGT,IAAI,CAACS,QAAQ;AAC5B,IAAA,IAAI,CAACA,QAAQ,IAAIT,IAAI,CAACU,gBAAgB,EAAE;MACtCD,QAAQ,GAAG,MAAM,IAAI,CAACE,WAAW,CAACX,IAAI,CAACU,gBAAgB,CAAC;AAC1D;AAEA,IAAA,MAAM4B,sBAAsB,GAAG;MAC7BrC,GAAG,EAAED,IAAI,CAACC,GAAG;AACbQ,MAAAA;KACD;IAED,OAAO8B,aAAa,CAACT,eAAe,CAAA,GAChCf,iBAAiB,CAACe,eAAe,EAAE;AACjCU,MAAAA,iBAAiB,EAAEP,cAAc;MACjC,GAAGK;KACJ,CAAA,GACDG,YAAY,CAACX,eAAe,EAAE;MAAEG,cAAc;MAAE,GAAGK;AAAwB,KAAA,CAAC;AAClF;EAGQ,MAAM3B,WAAWA,CAAC+B,QAAgB,EAAA;IACxC,IAAIC,GAAG,GAAG,IAAI,CAACjD,aAAa,CAAClC,GAAG,CAACkF,QAAQ,CAAC;IAE1C,IAAI,CAACC,GAAG,EAAE;MACRA,GAAG,GAAG,MAAMpB,EAAE,CAACC,QAAQ,CAAC9D,QAAQ,CAACgF,QAAQ,EAAE,OAAO,CAAC;MACnD,IAAI,CAAChD,aAAa,CAAC/B,GAAG,CAAC+E,QAAQ,EAAEC,GAAG,CAAC;AACvC;AAEA,IAAA,OAAOA,GAAG;AACZ;AACD;AAED,eAAehB,MAAMA,CAACrE,IAAiB,EAAA;EACrC,IAAI;AACF,IAAA,MAAMiE,EAAE,CAACC,QAAQ,CAACoB,MAAM,CAACtF,IAAI,EAAEiE,EAAE,CAACsB,SAAS,CAACC,IAAI,CAAC;AAEjD,IAAA,OAAO,IAAI;AACb,GAAA,CAAE,MAAM;AACN,IAAA,OAAO,KAAK;AACd;AACF;AAEA,SAASP,aAAaA,CACpB7D,KAAc,EAAA;EAGd,OAAO,OAAOA,KAAK,KAAK,UAAU,IAAI,EAAE,MAAM,IAAIA,KAAK,CAAC;AAC1D;;ACvOA,MAAMqE,oBAAoB,GAAG,IAAIjD,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAYxF,SAAUkD,+BAA+BA,CAC7CC,WAAiD,EAAA;EAEjD,MAAM;IAAEC,OAAO;AAAEC,IAAAA,MAAM,GAAG;AAAK,GAAE,GAAGF,WAAW;EAC/C,MAAMG,QAAQ,GAAGD,MAAM,KAAK,KAAK,IAAIA,MAAM,KAAK,MAAM;AACtD,EAAA,MAAME,QAAQ,GAAGH,OAAO,CAACI,OAAO,IAAIpD,GAAG,CAACC,QAAQ,CAAC+C,OAAO,CAACI,OAAO,CAAC,GAAGJ,OAAO,CAACI,OAAO,GAAG7F,SAAS;AAE/F,EAAA,OAAO,IAAI8F,OAAO,CAACC,gBAAgB,CAACP,WAAW,CAAC,EAAE;IAChDE,MAAM;AACND,IAAAA,OAAO,EAAEO,oBAAoB,CAACP,OAAO,CAAC;AACtCQ,IAAAA,IAAI,EAAEN,QAAQ,GAAGH,WAAW,GAAGxF,SAAS;AACxCkG,IAAAA,MAAM,EAAEP,QAAQ,GAAG,MAAM,GAAG3F,SAAS;AACrC4F,IAAAA;AACD,GAAA,CAAC;AACJ;AAQA,SAASI,oBAAoBA,CAACG,WAAgC,EAAA;AAC5D,EAAA,MAAMV,OAAO,GAAG,IAAIW,OAAO,EAAE;AAE7B,EAAA,KAAK,MAAM,CAAC7F,IAAI,EAAEU,KAAK,CAAC,IAAIoF,MAAM,CAACC,OAAO,CAACH,WAAW,CAAC,EAAE;AACvD,IAAA,IAAIb,oBAAoB,CAACiB,GAAG,CAAChG,IAAI,CAAC,EAAE;AAClC,MAAA;AACF;AAEA,IAAA,IAAI,OAAOU,KAAK,KAAK,QAAQ,EAAE;AAC7BwE,MAAAA,OAAO,CAACe,MAAM,CAACjG,IAAI,EAAEU,KAAK,CAAC;KAC7B,MAAO,IAAIwF,KAAK,CAACC,OAAO,CAACzF,KAAK,CAAC,EAAE;AAC/B,MAAA,KAAK,MAAM0F,IAAI,IAAI1F,KAAK,EAAE;AACxBwE,QAAAA,OAAO,CAACe,MAAM,CAACjG,IAAI,EAAEoG,IAAI,CAAC;AAC5B;AACF;AACF;AAEA,EAAA,OAAOlB,OAAO;AAChB;AAQM,SAAUM,gBAAgBA,CAACP,WAAiD,EAAA;EAChF,MAAM;IACJC,OAAO;IACPmB,MAAM;AACNpE,IAAAA,GAAG,GAAG,EAAE;AACRqE,IAAAA;AACD,GAAA,GAAGrB,WAAyD;EAC7D,MAAMsB,QAAQ,GACZC,mBAAmB,CAACtB,OAAO,CAAC,mBAAmB,CAAC,CAAC,KAChD,WAAW,IAAImB,MAAM,IAAIA,MAAM,CAACI,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;AAChE,EAAA,MAAMC,QAAQ,GACZF,mBAAmB,CAACtB,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAIA,OAAO,CAAChH,IAAI,IAAIgH,OAAO,CAAC,YAAY,CAAC;AAE3F,EAAA,IAAIgB,KAAK,CAACC,OAAO,CAACO,QAAQ,CAAC,EAAE;AAC3B,IAAA,MAAM,IAAI1C,KAAK,CAAC,gCAAgC,CAAC;AACnD;EAEA,IAAI2C,gBAAgB,GAAGD,QAAQ;AAC/B,EAAA,IAAI,CAACA,QAAQ,EAAEE,QAAQ,CAAC,GAAG,CAAC,EAAE;IAC5B,MAAMC,IAAI,GAAGL,mBAAmB,CAACtB,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAC7D,IAAA,IAAI2B,IAAI,EAAE;MACRF,gBAAgB,IAAI,CAAIE,CAAAA,EAAAA,IAAI,CAAE,CAAA;AAChC;AACF;AAEA,EAAA,OAAO,IAAI3E,GAAG,CAAC,CAAA,EAAGqE,QAAQ,CAAA,GAAA,EAAMI,gBAAgB,CAAA,EAAGL,WAAW,IAAIrE,GAAG,CAAA,CAAE,CAAC;AAC1E;;MC5Ea6E,oBAAoB,CAAA;EACdC,gBAAgB;EAMjClF,WAAAA,CAAYJ,OAAqC,EAAA;AAC/C,IAAA,IAAI,CAACsF,gBAAgB,GAAG,IAAIC,gBAAgB,CAAC;AAC3C,MAAA,GAAGvF,OAAO;AACV7D,MAAAA,YAAY,EAAE,CAAC,GAAGD,sBAAsB,EAAE,EAAE,IAAI8D,OAAO,EAAE7D,YAAY,IAAI,EAAE,CAAC;AAC7E,KAAA,CAAC;AAEFW,IAAAA,6BAA6B,EAAE;AACjC;AA8BA,EAAA,MAAM0I,MAAMA,CACVC,OAAuD,EACvDC,cAAwB,EAAA;IAExB,MAAMC,UAAU,GACdF,OAAO,YAAY3B,OAAO,GAAG2B,OAAO,GAAGlC,+BAA+B,CAACkC,OAAO,CAAC;IAEjF,OAAO,IAAI,CAACH,gBAAgB,CAACE,MAAM,CAACG,UAAU,EAAED,cAAc,CAAC;AACjE;AACD;;ACfK,SAAUE,wBAAwBA,CAAuCC,OAAU,EAAA;AACtFA,EAAAA,OAAyD,CAAC,6BAA6B,CAAC,GAAG,IAAI;AAEhG,EAAA,OAAOA,OAAO;AAChB;;ACjDO,eAAeC,2BAA2BA,CAC/CC,MAAgB,EAChBC,WAAiD,EAAA;EAEjD,MAAM;IAAEC,MAAM;IAAExC,OAAO;AAAEQ,IAAAA;AAAI,GAAE,GAAG8B,MAAM;EACxCC,WAAW,CAACE,UAAU,GAAGD,MAAM;EAE/B,IAAIE,eAAe,GAAG,KAAK;AAC3B,EAAA,KAAK,MAAM,CAAC5H,IAAI,EAAEU,KAAK,CAAC,IAAIwE,OAAO,CAACa,OAAO,EAAE,EAAE;IAC7C,IAAI/F,IAAI,KAAK,YAAY,EAAE;AACzB,MAAA,IAAI4H,eAAe,EAAE;AACnB,QAAA;AACF;MAIAH,WAAW,CAACI,SAAS,CAAC7H,IAAI,EAAEkF,OAAO,CAAC4C,YAAY,EAAE,CAAC;AACnDF,MAAAA,eAAe,GAAG,IAAI;AACxB,KAAA,MAAO;AACLH,MAAAA,WAAW,CAACI,SAAS,CAAC7H,IAAI,EAAEU,KAAK,CAAC;AACpC;AACF;EAEA,IAAI,cAAc,IAAI+G,WAAW,EAAE;IACjCA,WAAW,CAACM,YAAY,EAAE;AAC5B;EAEA,IAAI,CAACrC,IAAI,EAAE;IACT+B,WAAW,CAACO,GAAG,EAAE;AAEjB,IAAA;AACF;EAEA,IAAI;AACF,IAAA,MAAMC,MAAM,GAAGvC,IAAI,CAACwC,SAAS,EAAE;AAE/BT,IAAAA,WAAW,CAAC7I,EAAE,CAAC,OAAO,EAAE,MAAK;MAC3BqJ,MAAM,CAACE,MAAM,EAAE,CAACC,KAAK,CAAEvJ,KAAK,IAAI;AAE9BC,QAAAA,OAAO,CAACD,KAAK,CACX,CAAA,uDAAA,EAA0D4I,WAAW,CAACY,GAAG,CAACpG,GAAG,CAAA,CAAA,CAAG,EAChFpD,KAAK,CACN;AACH,OAAC,CAAC;AACJ,KAAC,CAAC;AAGF,IAAA,OAAO,IAAI,EAAE;MACX,MAAM;QAAEyJ,IAAI;AAAE5H,QAAAA;AAAK,OAAE,GAAG,MAAMuH,MAAM,CAACM,IAAI,EAAE;AAC3C,MAAA,IAAID,IAAI,EAAE;QACRb,WAAW,CAACO,GAAG,EAAE;AACjB,QAAA;AACF;AAEA,MAAA,MAAMQ,WAAW,GAAIf,WAA8B,CAACgB,KAAK,CAAC/H,KAAK,CAAC;MAChE,IAAI8H,WAAW,KAAK,KAAK,EAAE;AAGzB,QAAA,MAAM,IAAIE,OAAO,CAAQhF,OAAO,IAAK+D,WAAW,CAACkB,IAAI,CAAC,OAAO,EAAEjF,OAAO,CAAC,CAAC;AAC1E;AACF;AACF,GAAA,CAAE,MAAM;AACN+D,IAAAA,WAAW,CAACO,GAAG,CAAC,wBAAwB,CAAC;AAC3C;AACF;;AC5DM,SAAUY,YAAYA,CAAC3G,GAAW,EAAA;AACtC,EAAA,OAAOA,GAAG,CAAC7B,UAAU,CAAC,OAAO,CAAC,IAAIyI,IAAI,CAAC,CAAC,CAAC,KAAKC,aAAa,CAAC7G,GAAG,CAAC;AAClE;;;;"}

package/fesm2022/ssr.mjs CHANGED Viewed

@@ -1,3 +1,4 @@
+import { validateRequest, cloneRequestAndPatchHeaders } from './_validation-chunk.mjs';
 import { ɵConsole as _Console, ApplicationRef, REQUEST, InjectionToken, provideEnvironmentInitializer, inject, makeEnvironmentProviders, ɵENABLE_ROOT_COMPONENT_BOOTSTRAP as _ENABLE_ROOT_COMPONENT_BOOTSTRAP, Compiler, createEnvironmentInjector, EnvironmentInjector, runInInjectionContext, ɵresetCompiledComponents as _resetCompiledComponents, REQUEST_CONTEXT, RESPONSE_INIT, LOCALE_ID } from '@angular/core';
 import { platformServer, INITIAL_CONFIG, ɵSERVER_CONTEXT as _SERVER_CONTEXT, ɵrenderInternal as _renderInternal, provideServerRendering as provideServerRendering$1 } from '@angular/platform-server';
 import { ActivatedRoute, Router, ROUTES, ɵloadChildren as _loadChildren } from '@angular/router';
@@ -67,23 +68,24 @@ function addTrailingSlash(url) {
   return url.at(-1) === '/' ? url : `${url}/`;
 }
 function joinUrlParts(...parts) {
-  const normalizeParts = [];
+  const normalizedParts = [];
   for (const part of parts) {
     if (part === '') {
       continue;
     }
-    let normalizedPart = part;
-    if (part[0] === '/') {
-      normalizedPart = normalizedPart.slice(1);
+    let start = 0;
+    let end = part.length;
+    while (start < end && part[start] === '/') {
+      start++;
     }
-    if (part.at(-1) === '/') {
-      normalizedPart = normalizedPart.slice(0, -1);
+    while (end > start && part[end - 1] === '/') {
+      end--;
     }
-    if (normalizedPart !== '') {
-      normalizeParts.push(normalizedPart);
+    if (start < end) {
+      normalizedParts.push(part.slice(start, end));
     }
   }
-  return addLeadingSlash(normalizeParts.join('/'));
+  return addLeadingSlash(normalizedParts.join('/'));
 }
 function stripIndexHtmlFromURL(url) {
   if (url.pathname.endsWith('/index.html')) {
@@ -1352,6 +1354,23 @@ class AngularServerApp {
     }
     return html;
   }
+  async serveClientSidePage() {
+    const {
+      manifest: {
+        locale
+      },
+      assets
+    } = this;
+    const html = await assets.getServerAsset('index.csr.html').text();
+    return new Response(html, {
+      headers: new Headers({
+        'Content-Type': 'text/html;charset=UTF-8',
+        ...(locale !== undefined ? {
+          'Content-Language': locale
+        } : {})
+      })
+    });
+  }
 }
 let angularServerApp;
 function getOrCreateAngularServerApp(options) {
@@ -1450,12 +1469,26 @@ class AngularAppEngine {
   static ɵallowStaticRouteRender = false;
   static ɵhooks = new Hooks();
   manifest = getAngularAppEngineManifest();
+  allowedHosts;
   supportedLocales = Object.keys(this.manifest.supportedLocales);
   entryPointsCache = new Map();
+  constructor(options) {
+    this.allowedHosts = new Set([...(options?.allowedHosts ?? []), ...this.manifest.allowedHosts]);
+  }
   async handle(request, requestContext) {
-    const serverApp = await this.getAngularServerAppForRequest(request);
+    const allowedHost = this.allowedHosts;
+    try {
+      validateRequest(request, allowedHost);
+    } catch (error) {
+      return this.handleValidationError(error, request);
+    }
+    const {
+      request: securedRequest,
+      onError: onHeaderValidationError
+    } = cloneRequestAndPatchHeaders(request, allowedHost);
+    const serverApp = await this.getAngularServerAppForRequest(securedRequest);
     if (serverApp) {
-      return serverApp.handle(request, requestContext);
+      return Promise.race([onHeaderValidationError.then(error => this.handleValidationError(error, securedRequest)), serverApp.handle(securedRequest, requestContext)]);
     }
     if (this.supportedLocales.length > 1) {
       return this.redirectBasedOnAcceptLanguage(request);
@@ -1528,6 +1561,22 @@ class AngularAppEngine {
     const potentialLocale = getPotentialLocaleIdFromUrl(url, basePath);
     return this.getEntryPointExports(potentialLocale) ?? this.getEntryPointExports('');
   }
+  async handleValidationError(error, request) {
+    const isAllowedHostConfigured = this.allowedHosts.size > 0;
+    const errorMessage = error.message;
+    console.error(`ERROR: Bad Request ("${request.url}").\n` + errorMessage + (isAllowedHostConfigured ? '' : '\nFalling back to client side rendering. This will become a 400 Bad Request in a future major version.') + '\n\nFor more information, see https://angular.dev/best-practices/security#preventing-server-side-request-forgery-ssrf');
+    if (isAllowedHostConfigured) {
+      return new Response(errorMessage, {
+        status: 400,
+        statusText: 'Bad Request',
+        headers: {
+          'Content-Type': 'text/plain'
+        }
+      });
+    }
+    const serverApp = await this.getAngularServerAppForRequest(request);
+    return serverApp?.serveClientSidePage() ?? null;
+  }
 }
 function createRequestHandler(handler) {