@async/framework 0.11.11 → 0.11.13

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 0.11.13 - 2026-06-18
+
+- Validated server proxy arguments, default input payloads, and selected signal
+  values against an explicit JSON transport model before requests leave the
+  caller.
+- Rejected values that `JSON.stringify` would silently corrupt, including
+  `undefined`, non-finite numbers, functions, symbols, sparse arrays, circular
+  structures, class instances, dates, maps, sets, buffers, streams, and web
+  platform request/body objects.
+- Added path-aware regression coverage for invalid transport values and
+  documented the supported server-call JSON model.
+- Bundle size from bundled TypeScript source: `browser.ts` 187,564 B raw /
+  35,332 B gzip -> `browser.min.js` 80,009 B raw / 23,677 B gzip
+  (-107,555 B raw, -11,655 B gzip).
+
+## 0.11.12 - 2026-06-18
+
+- Deferred boundary receiver sequence commits until patch effects complete so
+  failed DOM swaps, scheduler flushes, redirects, or missing capabilities no
+  longer make the same streamed sequence stale.
+- Serialized same-boundary patch application to keep concurrent patches from
+  committing out of order while preserving stale rejection after successful
+  commits.
+- Added regression coverage for retryable DOM, scheduler, redirect, and
+  capability failures plus idempotent partial-effect replay.
+- Bundle size from bundled TypeScript source: `browser.ts` 186,064 B raw /
+  35,039 B gzip -> `browser.min.js` 79,042 B raw / 23,445 B gzip
+  (-107,022 B raw, -11,594 B gzip).
+
 ## 0.11.11 - 2026-06-18
 
 - Serialized rejected async-signal snapshot errors to stable `name`, `message`,

package/README.md

@@ -834,6 +834,14 @@ const server = createServerProxy({
 await server.cart.add("sku-1", 2);
 ```
 
+Proxy requests validate their `args`, default `input`, and selected signal
+values before transport runs. Supported values are `null`, booleans, strings,
+finite numbers, dense arrays, and plain objects composed from those values.
+Values that JSON would silently change or drop, such as `undefined`, functions,
+symbols, `Map`, `Set`, `Date`, sparse arrays, class instances, non-finite
+numbers, circular objects, file-like values, streams, buffers, and typed arrays
+are rejected with a path to the invalid value.
+
 Server responses can include `value`, `signals`, `boundary`, `html`, `redirect`,
 or `error`. Signal patches are applied before boundary swaps and redirects.
 Namespace calls such as `server.cart.add(...)` return the unwrapped `value`.

package/browser.js

@@ -2573,12 +2573,17 @@ const __serverModule = (() => {
     if (!element) {
       return {};
     }
-
-    return {
-      value: "value" in element ? element.value : undefined,
-      checked: "checked" in element ? element.checked : undefined,
-      dataset: element.dataset ? { ...element.dataset } : {}
-    };
+    const input = {};
+    if ("value" in element) {
+      input.value = element.value;
+    }
+    if ("checked" in element) {
+      input.checked = element.checked;
+    }
+    if (element.dataset) {
+      input.dataset = { ...element.dataset };
+    }
+    return input;
   }
 
   function createServerNamespace(run, root = {}, contextProvider = () => ({})) {
@@ -2765,38 +2770,76 @@ const __serverModule = (() => {
     return output;
   }
 
-  function assertJsonTransportable(value, stack = new Set()) {
-    if (typeof value === "bigint") {
-      throw new Error("Server proxy JSON transport does not support BigInt values.");
+  function assertJsonTransportable(value, path = "$", stack = new Set()) {
+    if (value === null) {
+      return;
+    }
+
+    const type = typeof value;
+    if (type === "boolean" || type === "string") {
+      return;
     }
-    if (value == null || typeof value !== "object") {
+    if (type === "number") {
+      if (!Number.isFinite(value)) {
+        throw new Error(`Server proxy JSON transport does not support non-finite numbers at ${path}.`);
+      }
       return;
     }
+    if (type === "bigint") {
+      throw new Error(`Server proxy JSON transport does not support BigInt values at ${path}.`);
+    }
+    if (type === "undefined") {
+      throw new Error(`Server proxy JSON transport does not support undefined values at ${path}.`);
+    }
+    if (type === "function" || type === "symbol") {
+      throw new Error(`Server proxy JSON transport does not support ${type} values at ${path}.`);
+    }
+    if (type !== "object") {
+      throw new Error(`Server proxy JSON transport does not support ${type} values at ${path}.`);
+    }
+
     if (stack.has(value)) {
-      throw new Error("Server proxy JSON transport does not support circular values.");
+      throw new Error(`Server proxy JSON transport does not support circular values at ${path}.`);
     }
     stack.add(value);
 
     const tag = Object.prototype.toString.call(value);
     if (tag === "[object File]" || tag === "[object Blob]" || tag === "[object FormData]") {
-      throw new Error("Server proxy JSON transport does not support File, Blob, or FormData values yet.");
+      throw new Error(`Server proxy JSON transport does not support File, Blob, or FormData values yet at ${path}.`);
     }
     if (isUnsupportedJsonTransportObject(value, tag)) {
-      throw new Error("Server proxy JSON transport does not support URLSearchParams, Headers, Request, Response, ReadableStream, ArrayBuffer, or typed array values yet.");
+      throw new Error(`Server proxy JSON transport does not support URLSearchParams, Headers, Request, Response, ReadableStream, ArrayBuffer, or typed array values yet at ${path}.`);
     }
     if (Array.isArray(value)) {
-      for (const item of value) {
-        assertJsonTransportable(item, stack);
+      for (let index = 0; index < value.length; index += 1) {
+        if (!Object.hasOwn(value, index)) {
+          throw new Error(`Server proxy JSON transport does not support sparse arrays at ${path}[${index}].`);
+        }
+        assertJsonTransportable(value[index], `${path}[${index}]`, stack);
       }
       stack.delete(value);
       return;
     }
-    for (const item of Object.values(value)) {
-      assertJsonTransportable(item, stack);
+
+    if (!isPlainJsonObject(value)) {
+      throw new Error(`Server proxy JSON transport only supports plain objects at ${path}.`);
+    }
+
+    for (const [key, item] of Object.entries(value)) {
+      assertJsonTransportable(item, propertyPath(path, key), stack);
     }
     stack.delete(value);
   }
 
+  function isPlainJsonObject(value) {
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+  }
+
+  function propertyPath(path, key) {
+    return /^[A-Za-z_$][\w$]*$/.test(key) ? `${path}.${key}` : `${path}[${JSON.stringify(key)}]`;
+  }
+
   function isUnsupportedJsonTransportObject(value, tag = Object.prototype.toString.call(value)) {
     return tag === "[object URLSearchParams]"
       || tag === "[object Headers]"
@@ -5815,101 +5858,25 @@ const __boundaryReceiverModule = (() => {
 
         const normalized = validatePatch(patch);
         const record = boundaryRecord(normalized.boundary);
-        if (normalized.seq <= record.lastSeq) {
-          const result = {
-            status: "ignored-stale",
-            boundary: normalized.boundary,
-            seq: normalized.seq,
-            lastSeq: record.lastSeq
-          };
-          record.ignored += 1;
-          record.lastStatus = result.status;
-          remember(result);
-          onIgnore?.(result, patch);
-          return result;
-        }
-
-        if (normalized.parentScope !== undefined && isScopeDestroyed(normalized.parentScope)) {
-          const result = {
-            status: "ignored-destroyed",
-            boundary: normalized.boundary,
-            seq: normalized.seq,
-            parentScope: normalized.parentScope
-          };
-          record.ignored += 1;
-          record.lastStatus = result.status;
-          remember(result);
-          onIgnore?.(result, patch);
-          return result;
-        }
-
-        record.lastSeq = normalized.seq;
-
-        if (Object.hasOwn(normalized, "error")) {
-          const error = toStableError(normalized.error);
-          const result = {
-            status: "errored",
-            boundary: normalized.boundary,
-            seq: normalized.seq,
-            error
-          };
-          record.errored += 1;
-          record.lastStatus = result.status;
-          remember(result);
-          onError?.(error, result, patch);
-          if (throwOnError) {
-            throw error;
-          }
-          return result;
-        }
+        let releasePending;
+        const previousPending = record.pending ?? Promise.resolve();
+        const pending = new Promise((resolve) => {
+          releasePending = resolve;
+        });
+        record.pending = pending;
 
-        if (normalized.signals) {
-          if (!signals || typeof signals.set !== "function") {
-            throw new Error("Boundary patch includes signals, but no signal registry is available.");
-          }
-          for (const [path, value] of Object.entries(normalized.signals)) {
-            signals.set(path, value);
+        try {
+          await previousPending;
+          if (destroyed) {
+            throw new Error("Boundary receiver has been destroyed.");
           }
-        }
-
-        if (normalized.cache?.browser) {
-          if (!cache || typeof cache.restore !== "function") {
-            throw new Error("Boundary patch includes browser cache, but no cache registry is available.");
+          return await applyBoundaryPatch(record, normalized, patch);
+        } finally {
+          releasePending();
+          if (record.pending === pending) {
+            record.pending = undefined;
           }
-          cache.restore(normalized.cache.browser);
         }
-
-        if (normalized.html != null) {
-          loader.swap(normalized.boundary, normalized.html);
-        }
-
-        await flushScheduler(scheduler, normalized.scope);
-
-        if (normalized.redirect) {
-          await followRedirect(normalized.redirect, router, loader);
-          const result = {
-            status: "redirected",
-            boundary: normalized.boundary,
-            seq: normalized.seq,
-            redirect: normalized.redirect
-          };
-          record.applied += 1;
-          record.lastStatus = result.status;
-          remember(result);
-          onApply?.(result, patch);
-          return result;
-        }
-
-        const result = {
-          status: "applied",
-          boundary: normalized.boundary,
-          seq: normalized.seq
-        };
-        record.applied += 1;
-        record.lastStatus = result.status;
-        remember(result);
-        onApply?.(result, patch);
-        return result;
       },
 
       inspect() {
@@ -5957,6 +5924,105 @@ const __boundaryReceiverModule = (() => {
 
     return receiver;
 
+    async function applyBoundaryPatch(record, normalized, patch) {
+      if (normalized.seq <= record.lastSeq) {
+        const result = {
+          status: "ignored-stale",
+          boundary: normalized.boundary,
+          seq: normalized.seq,
+          lastSeq: record.lastSeq
+        };
+        record.ignored += 1;
+        record.lastStatus = result.status;
+        remember(result);
+        onIgnore?.(result, patch);
+        return result;
+      }
+
+      if (normalized.parentScope !== undefined && isScopeDestroyed(normalized.parentScope)) {
+        const result = {
+          status: "ignored-destroyed",
+          boundary: normalized.boundary,
+          seq: normalized.seq,
+          parentScope: normalized.parentScope
+        };
+        record.ignored += 1;
+        record.lastStatus = result.status;
+        remember(result);
+        onIgnore?.(result, patch);
+        return result;
+      }
+
+      if (Object.hasOwn(normalized, "error")) {
+        const error = toStableError(normalized.error);
+        const result = {
+          status: "errored",
+          boundary: normalized.boundary,
+          seq: normalized.seq,
+          error
+        };
+        record.lastSeq = normalized.seq;
+        record.errored += 1;
+        record.lastStatus = result.status;
+        remember(result);
+        onError?.(error, result, patch);
+        if (throwOnError) {
+          throw error;
+        }
+        return result;
+      }
+
+      if (normalized.signals) {
+        if (!signals || typeof signals.set !== "function") {
+          throw new Error("Boundary patch includes signals, but no signal registry is available.");
+        }
+        for (const [path, value] of Object.entries(normalized.signals)) {
+          signals.set(path, value);
+        }
+      }
+
+      if (normalized.cache?.browser) {
+        if (!cache || typeof cache.restore !== "function") {
+          throw new Error("Boundary patch includes browser cache, but no cache registry is available.");
+        }
+        cache.restore(normalized.cache.browser);
+      }
+
+      if (normalized.html != null) {
+        loader.swap(normalized.boundary, normalized.html);
+      }
+
+      await flushScheduler(scheduler, normalized.scope);
+
+      if (normalized.redirect) {
+        const result = {
+          status: "redirected",
+          boundary: normalized.boundary,
+          seq: normalized.seq,
+          redirect: normalized.redirect
+        };
+        await followRedirect(normalized.redirect, router, loader);
+        record.applied += 1;
+        record.lastSeq = normalized.seq;
+        record.lastStatus = result.status;
+        remember(result);
+        onApply?.(result, patch);
+        return result;
+      }
+
+      const result = {
+        status: "applied",
+        boundary: normalized.boundary,
+        seq: normalized.seq
+      };
+      record.applied += 1;
+      record.lastSeq = normalized.seq;
+      record.lastStatus = result.status;
+      remember(result);
+      onApply?.(result, patch);
+      return result;
+    }
+
     function boundaryRecord(boundary) {
       if (!boundaries.has(boundary)) {
         boundaries.set(boundary, {
@@ -5964,7 +6030,8 @@ const __boundaryReceiverModule = (() => {
           applied: 0,
           ignored: 0,
           errored: 0,
-          lastStatus: undefined
+          lastStatus: undefined,
+          pending: undefined
         });
       }
       return boundaries.get(boundary);