@strata-sc/analog@0.12.0

Minor Changes

• ec8fb08: Add opt-in request correlation. registerControllers(router, controllers, { requestCorrelation: true }) generates one random crypto.randomUUID() per Strata controller invocation, exposes it as request.correlationId to guards, interceptors, the controller factory and the handler, and as correlationId on the onRequestSettled observation. It is disabled by default (no identifier, no new observation field), never derived from request data, never added to a response, and is not an identity or authorization value.

@strata-sc/server-components@0.13.0

Minor Changes

• 4f7fff8: Make client reference validation fail closed. buildClientReferenceRegistry now reads descriptors as own data properties without invoking consumer getters, toString or valueOf, requires expectedSelector to be a custom-element name, and turns throwing accessors, hostile proxies, corrupt Angular component metadata and non-array registries into a classified reference refusal that never echoes consumer values. Plain component-type arrays and generated descriptors are unchanged.

@strata-sc/server-components@0.12.0

Minor Changes

• 750bad0: Validate client reference identity at runtime. Generated surrogates now carry the build-authorized selector of each client component, and provideClientReferences accepts { type, expectedSelector } descriptors beside plain component types (existing arrays stay valid). A host whose references are not Angular components, whose actual selector differs from the authorized one, or where two distinct components claim one selector, refuses all its boundaries as a reference failure before any island is created, instead of silently keeping the last component for a selector.

@strata-sc/server-components@0.10.0

Minor Changes

• 9544e7a: Add an opt-in, privacy-safe observer for per-host client island commit outcomes.

@strata-sc/analog@0.11.0

Minor Changes

• 814998e: Reject ambiguous Strata route templates during router registration preflight, including parameter-name conflicts that Nitro shares across HTTP methods.

@strata-sc/server-components@0.9.0

Minor Changes

• 20f8464: Enforce the server-only assertion inside Vite's dependency optimizer. A package module that imports @strata-sc/server-components/server-only, directly, through a package re-export or through a dynamic import, is now refused when the dev server pre-bundles it for the browser (Vite 8 pre-bundles with Rolldown, which resolved the assertion without the plugin ever seeing it, so the forbidden implementation was served). The refusal produces no chunk and names the module and the importers the optimizer reports. A [strata] dev error no longer carries the failing module's code frame or source in its HTTP and overlay payload. The plugin adds a public optimizeDeps.rolldownOptions.plugins entry only; there is no new option.

@strata-sc/analog@0.10.0

Minor Changes

• 1bd573a: Add opt-in request.readValidatedForm(schema) for bounded Standard Schema v1 validation of URL-encoded request bodies.

@strata-sc/server-components@0.8.0

Minor Changes

• f11c43e: Add an opt-in application build identity so a browser can tell that the Server Component document it received and the script it runs come from different deployments, and an opt-in, bounded recovery for that one case. The boundary protocol numbers (1/2) are unchanged and cannot say whether the application contract is: a client component's inputs or implementation can change while the protocol stays the same.

  strataServerComponents({ buildId }) takes a consumer-chosen label (1–64 characters of A-Za-z0-9._:+-, public, never a secret) and compiles it into every environment of that build as one constant. Each server-rendered client boundary then carries data-strata-build, and before any ComponentRef is created the browser compares it with its own. Without the option nothing is stamped or enforced and existing v1/v2 applications behave exactly as before; an older browser script ignores the attribute (it cannot detect a mismatch it predates).

  StrataBoundaryError now has a stable category (serialization, metadata, protocol, props, reference, inputs, build-identity, build-mismatch), and StrataBoundaryError and the new StrataBuildMismatchError (with browserBuildId, serverBuildId and recovery) are exported. Only two well-formed, different identities are a build-mismatch; a missing or malformed identity is build-identity and is never treated as a deployment. Per-host all-or-nothing preflight, sibling isolation, rollback and the untouched server-rendered DOM are unchanged, and the error still reaches the application's ErrorHandler.

  provideSkewRecovery({ reload, maxReloads, windowSeconds, onMismatch }) adds the opt-in policy: onMismatch receives the two public build ids, and reload: true reloads the current document at most once per tab and five-minute window by default (1–3 / 30–3600 s), counted in sessionStorage before the reload and read back. Blocked or forgetful storage, or an implausible record, means no reload. No other failure (protocol, props, selector, input, constructor, missing or malformed identity) ever reloads.

  Qualified with pnpm test:server-component-deployment-skew: independently built releases of an external consumer installed from the packed tarball, a document of one served with the script of another, on Nitro Node and local workerd (not a deployed Pages project). The first deployment of this feature cannot repair clients that already run an older script.

@strata-sc/analog@0.9.0

Minor Changes

• ebb969b: Add request.validateHeaders(schema): opt-in Standard Schema v1 validation of a frozen, lowercase, string-valued header snapshot, with inferred output types. Invalid input answers the existing safe 400 with source: "headers", follows cleanup-first precedence and is observed as input-rejected. Exports the StrataAnalogHeaders type.

@strata-sc/analog@0.8.0

Minor Changes

• 15080f5: Add onRequestSettled, an opt-in observer of each Strata controller invocation, so an application can log, count or export how a request ended without Strata becoming a logging or telemetry system. It is a registerControllers() option and changes nothing when absent.

  The observer is called exactly once per invocation with a frozen, structured StrataAnalogRequestObservation: the registered route (method, route template, controller and handler names, never the request URL), a finite outcome (completed, guard-denied, input-rejected, application-error, failed, cleanup-failed, stream-completed, stream-failed, stream-cancelled), the phase it ended in, whether it was streaming, whether cleanup completed, a status only where Strata itself produced it (guard denial, rejected input, StrataAnalogHttpError; otherwise undefined, never a guessed 500), and two monotonic durations: invocationMs (guards, interceptors and handler, before cleanup; for a stream, until the stream was returned) and elapsedMs (until the observation, after cleanup; for a stream, the full observed body lifetime). It never carries request values, headers, bodies, error messages, causes, stacks, validation issues or response content.

  It is emitted after the invocation's cleanups have settled, and a cleanup failure is cleanup-failed, never a success. For an owned streamResponse() it is emitted when the body completes, fails or is cancelled and its cleanups have settled, not when the handler returns; an interceptor that replaces the stream produces an ordinary completed observation, and a stream the transport never reads or cancels is never reported (Strata does not observe client disconnects and will not invent a timeout). A derived HEAD over a stream is reported as stream-cancelled.

  The callback is synchronous and isolated: its return value is ignored and never awaited, and anything it throws or rejects with is discarded, so it cannot change the response, the original error or a cleanup AggregateError. Native Nitro routes, the API boundary's own 404/405 answers and Analog server functions are not observed. Qualified with pnpm test:analog-observability on Nitro Node, the Vite dev server and local workerd (not a deployed Pages project), and from an externally installed packed tarball.