@getforma/core 0.3.0 → 0.3.1

package/dist/index.d.cts

@@ -924,6 +924,8 @@ interface PersistOptions<T> {
     serialize?: (v: T) => string;
     /** Custom deserializer. Defaults to JSON.parse. */
     deserialize?: (s: string) => T;
+    /** Optional validator — return true if the deserialized value is valid. Rejects corrupt/tampered data. */
+    validate?: (v: unknown) => v is T;
 }
 /**
  * Persist a signal's value to storage.
@@ -940,14 +942,14 @@ interface PersistOptions<T> {
  */
 declare function persist<T>(source: [get: () => T, set: (v: T) => void], key: string, options?: PersistOptions<T>): void;
 
-interface EventBus<T extends Record<string, any>> {
+interface EventBus<T extends Record<string, unknown>> {
     on<K extends keyof T>(event: K, handler: (payload: T[K]) => void): () => void;
     once<K extends keyof T>(event: K, handler: (payload: T[K]) => void): () => void;
     emit<K extends keyof T>(event: K, payload: T[K]): void;
     off<K extends keyof T>(event: K, handler: (payload: T[K]) => void): void;
     clear(): void;
 }
-declare function createBus<T extends Record<string, any> = Record<string, any>>(): EventBus<T>;
+declare function createBus<T extends Record<string, unknown> = Record<string, unknown>>(): EventBus<T>;
 
 declare function delegate<K extends keyof HTMLElementEventMap>(container: HTMLElement | Document, selector: string, event: K, handler: (e: HTMLElementEventMap[K], matchedEl: HTMLElement) => void, options?: AddEventListenerOptions): () => void;
 
@@ -967,7 +969,22 @@ declare function toggleClass(el: HTMLElement, className: string, force?: boolean
 declare function setStyle(el: HTMLElement, styles: Partial<CSSStyleDeclaration>): void;
 declare function setAttr(el: HTMLElement, attrs: Record<string, string | boolean | null>): void;
 declare function setText(el: HTMLElement, text: string): void;
+/**
+ * Set raw HTML on an element. **No sanitization is performed.**
+ *
+ * Prefer `setText()` for user-controlled content. Only use this when you
+ * trust the HTML source (e.g., server-rendered markup you control).
+ *
+ * @deprecated Use `setHTMLUnsafe` instead — renamed to signal risk.
+ */
 declare function setHTML(el: HTMLElement, html: string): void;
+/**
+ * Set raw HTML on an element. **No sanitization is performed.**
+ *
+ * Prefer `setText()` for user-controlled content. Only use this when you
+ * trust the HTML source (e.g., server-rendered markup you control).
+ */
+declare function setHTMLUnsafe(el: HTMLElement, html: string): void;
 
 declare function closest<T extends HTMLElement = HTMLElement>(el: HTMLElement, selector: string): T | null;
 declare function children<T extends HTMLElement = HTMLElement>(el: HTMLElement, selector?: string): T[];
@@ -980,22 +997,26 @@ declare function onResize(el: HTMLElement, handler: (entry: ResizeObserverEntry)
 declare function onIntersect(el: HTMLElement, handler: (entry: IntersectionObserverEntry) => void, options?: IntersectionObserverInit): () => void;
 declare function onMutation(el: HTMLElement, handler: (mutations: MutationRecord[]) => void, options?: MutationObserverInit): () => void;
 
-/**
- * Forma Storage - Local
- *
- * Typed localStorage wrapper with graceful error handling.
- * Zero dependencies — native browser APIs only.
- */
-interface TypedStorage$1<T> {
+interface TypedStorage<T> {
     get(): T | null;
     set(value: T): void;
     remove(): void;
     key: string;
 }
-interface StorageOptions$1<T> {
+interface StorageOptions<T> {
     serialize?: (v: T) => string;
     deserialize?: (s: string) => T;
+    /** Optional validator — return true if the deserialized value is valid. */
+    validate?: (v: unknown) => v is T;
 }
+
+/**
+ * Forma Storage - Local
+ *
+ * Typed localStorage wrapper with graceful error handling.
+ * Zero dependencies — native browser APIs only.
+ */
+
 /**
  * Create a typed localStorage wrapper for the given key.
  *
@@ -1006,7 +1027,7 @@ interface StorageOptions$1<T> {
  * store.remove();
  * ```
  */
-declare function createLocalStorage<T>(key: string, options?: StorageOptions$1<T>): TypedStorage$1<T>;
+declare function createLocalStorage<T>(key: string, options?: StorageOptions<T>): TypedStorage<T>;
 
 /**
  * Forma Storage - Session
@@ -1014,16 +1035,7 @@ declare function createLocalStorage<T>(key: string, options?: StorageOptions$1<T
  * Typed sessionStorage wrapper with graceful error handling.
  * Zero dependencies — native browser APIs only.
  */
-interface TypedStorage<T> {
-    get(): T | null;
-    set(value: T): void;
-    remove(): void;
-    key: string;
-}
-interface StorageOptions<T> {
-    serialize?: (v: T) => string;
-    deserialize?: (s: string) => T;
-}
+
 /**
  * Create a typed sessionStorage wrapper for the given key.
  *
@@ -1106,9 +1118,11 @@ declare function fetchJSON<T>(url: string, options?: RequestInit): Promise<T>;
  * Reactive SSE wrapper with signal integration.
  * Zero dependencies — native browser APIs only.
  */
-interface SSEOptions {
+interface SSEOptions<T = unknown> {
     withCredentials?: boolean;
     headers?: Record<string, string>;
+    /** Custom parser for incoming messages. Defaults to JSON.parse with raw data fallback. */
+    parse?: (data: string) => T;
 }
 interface SSEConnection<T = unknown> {
     data: () => T | null;
@@ -1128,7 +1142,7 @@ interface SSEConnection<T = unknown> {
  * });
  * ```
  */
-declare function createSSE<T = unknown>(url: string, options?: SSEOptions): SSEConnection<T>;
+declare function createSSE<T = unknown>(url: string, options?: SSEOptions<T>): SSEConnection<T>;
 
 /**
  * Forma HTTP - WebSocket
@@ -1137,11 +1151,13 @@ declare function createSSE<T = unknown>(url: string, options?: SSEOptions): SSEC
  * Zero dependencies — native browser APIs only.
  */
 type WSStatus = 'connecting' | 'open' | 'closed' | 'error';
-interface WSOptions {
+interface WSOptions<TReceive = unknown> {
     protocols?: string | string[];
     reconnect?: boolean;
     reconnectInterval?: number;
     maxReconnects?: number;
+    /** Custom parser for incoming messages. Defaults to JSON.parse with raw data fallback. */
+    parse?: (data: string) => TReceive;
 }
 interface WSConnection<TSend = unknown, TReceive = unknown> {
     data: () => TReceive | null;
@@ -1162,7 +1178,7 @@ interface WSConnection<TSend = unknown, TReceive = unknown> {
  * });
  * ```
  */
-declare function createWebSocket<TSend = unknown, TReceive = unknown>(url: string, options?: WSOptions): WSConnection<TSend, TReceive>;
+declare function createWebSocket<TSend = unknown, TReceive = unknown>(url: string, options?: WSOptions<TReceive>): WSConnection<TSend, TReceive>;
 
 /**
  * FormaJS Server - Action
@@ -1327,7 +1343,7 @@ declare function withRevalidation<T>(data: T, revalidate: Record<string, unknown
  * @param endpoint - The RPC endpoint path (e.g. "/rpc/createTodo_a1b2c3")
  * @returns An async function that sends args to the server and returns the result
  */
-declare function $$serverFunction<T extends (...args: any[]) => Promise<any>>(endpoint: string): T;
+declare function $$serverFunction<T extends (...args: unknown[]) => Promise<unknown>>(endpoint: string): T;
 
 /**
  * FormaJS Server - RPC Handler
@@ -1391,4 +1407,4 @@ declare function renderLocal(slotsJson: string): Promise<string>;
 /** Fragment render (single island) via WASM. */
 declare function renderIsland(slotsJson: string, islandId: number): Promise<string>;
 
-export { $, $$, $$serverFunction, type Action, type ActionOptions, Fragment, type IslandHydrateFn, type MutationResponse, type RPCRequest, type RPCResponse, activateIslands, addClass, applyRevalidation, batch, children, cleanup, closest, createAction, createBus, createComputed, createContext, createEffect, createErrorBoundary, createFetch, createHistory, createIndexedDB, createList, createLocalStorage, createMemo, createPortal, createRPCMiddleware, createReducer, createRef, createResource, createRoot, createSSE, createSessionStorage, createShow, createStore, createSuspense, createSwitch, createText, createWebSocket, defineComponent, delegate, disposeComponent, enableAutoRevalidation, fetchJSON, fragment, getRegisteredEndpoints, getServerFunction, h, handleRPC, hydrateIsland, inject, longestIncreasingSubsequence, mount, nextSibling, on, onCleanup, onError, onIntersect, onKey, onMount, onMutation, onResize, onUnmount, parent, persist, prevSibling, provide, reconcileList, registerResource, registerServerFunction, removeClass, renderIsland, renderLocal, setAttr, setHTML, setStyle, setText, siblings, toggleClass, trackDisposer, unprovide, unregisterResource, untrack, withRevalidation };
+export { $, $$, $$serverFunction, type Action, type ActionOptions, Fragment, type IslandHydrateFn, type MutationResponse, type RPCRequest, type RPCResponse, activateIslands, addClass, applyRevalidation, batch, children, cleanup, closest, createAction, createBus, createComputed, createContext, createEffect, createErrorBoundary, createFetch, createHistory, createIndexedDB, createList, createLocalStorage, createMemo, createPortal, createRPCMiddleware, createReducer, createRef, createResource, createRoot, createSSE, createSessionStorage, createShow, createStore, createSuspense, createSwitch, createText, createWebSocket, defineComponent, delegate, disposeComponent, enableAutoRevalidation, fetchJSON, fragment, getRegisteredEndpoints, getServerFunction, h, handleRPC, hydrateIsland, inject, longestIncreasingSubsequence, mount, nextSibling, on, onCleanup, onError, onIntersect, onKey, onMount, onMutation, onResize, onUnmount, parent, persist, prevSibling, provide, reconcileList, registerResource, registerServerFunction, removeClass, renderIsland, renderLocal, setAttr, setHTML, setHTMLUnsafe, setStyle, setText, siblings, toggleClass, trackDisposer, unprovide, unregisterResource, untrack, withRevalidation };

package/dist/index.d.ts

@@ -924,6 +924,8 @@ interface PersistOptions<T> {
     serialize?: (v: T) => string;
     /** Custom deserializer. Defaults to JSON.parse. */
     deserialize?: (s: string) => T;
+    /** Optional validator — return true if the deserialized value is valid. Rejects corrupt/tampered data. */
+    validate?: (v: unknown) => v is T;
 }
 /**
  * Persist a signal's value to storage.
@@ -940,14 +942,14 @@ interface PersistOptions<T> {
  */
 declare function persist<T>(source: [get: () => T, set: (v: T) => void], key: string, options?: PersistOptions<T>): void;
 
-interface EventBus<T extends Record<string, any>> {
+interface EventBus<T extends Record<string, unknown>> {
     on<K extends keyof T>(event: K, handler: (payload: T[K]) => void): () => void;
     once<K extends keyof T>(event: K, handler: (payload: T[K]) => void): () => void;
     emit<K extends keyof T>(event: K, payload: T[K]): void;
     off<K extends keyof T>(event: K, handler: (payload: T[K]) => void): void;
     clear(): void;
 }
-declare function createBus<T extends Record<string, any> = Record<string, any>>(): EventBus<T>;
+declare function createBus<T extends Record<string, unknown> = Record<string, unknown>>(): EventBus<T>;
 
 declare function delegate<K extends keyof HTMLElementEventMap>(container: HTMLElement | Document, selector: string, event: K, handler: (e: HTMLElementEventMap[K], matchedEl: HTMLElement) => void, options?: AddEventListenerOptions): () => void;
 
@@ -967,7 +969,22 @@ declare function toggleClass(el: HTMLElement, className: string, force?: boolean
 declare function setStyle(el: HTMLElement, styles: Partial<CSSStyleDeclaration>): void;
 declare function setAttr(el: HTMLElement, attrs: Record<string, string | boolean | null>): void;
 declare function setText(el: HTMLElement, text: string): void;
+/**
+ * Set raw HTML on an element. **No sanitization is performed.**
+ *
+ * Prefer `setText()` for user-controlled content. Only use this when you
+ * trust the HTML source (e.g., server-rendered markup you control).
+ *
+ * @deprecated Use `setHTMLUnsafe` instead — renamed to signal risk.
+ */
 declare function setHTML(el: HTMLElement, html: string): void;
+/**
+ * Set raw HTML on an element. **No sanitization is performed.**
+ *
+ * Prefer `setText()` for user-controlled content. Only use this when you
+ * trust the HTML source (e.g., server-rendered markup you control).
+ */
+declare function setHTMLUnsafe(el: HTMLElement, html: string): void;
 
 declare function closest<T extends HTMLElement = HTMLElement>(el: HTMLElement, selector: string): T | null;
 declare function children<T extends HTMLElement = HTMLElement>(el: HTMLElement, selector?: string): T[];
@@ -980,22 +997,26 @@ declare function onResize(el: HTMLElement, handler: (entry: ResizeObserverEntry)
 declare function onIntersect(el: HTMLElement, handler: (entry: IntersectionObserverEntry) => void, options?: IntersectionObserverInit): () => void;
 declare function onMutation(el: HTMLElement, handler: (mutations: MutationRecord[]) => void, options?: MutationObserverInit): () => void;
 
-/**
- * Forma Storage - Local
- *
- * Typed localStorage wrapper with graceful error handling.
- * Zero dependencies — native browser APIs only.
- */
-interface TypedStorage$1<T> {
+interface TypedStorage<T> {
     get(): T | null;
     set(value: T): void;
     remove(): void;
     key: string;
 }
-interface StorageOptions$1<T> {
+interface StorageOptions<T> {
     serialize?: (v: T) => string;
     deserialize?: (s: string) => T;
+    /** Optional validator — return true if the deserialized value is valid. */
+    validate?: (v: unknown) => v is T;
 }
+
+/**
+ * Forma Storage - Local
+ *
+ * Typed localStorage wrapper with graceful error handling.
+ * Zero dependencies — native browser APIs only.
+ */
+
 /**
  * Create a typed localStorage wrapper for the given key.
  *
@@ -1006,7 +1027,7 @@ interface StorageOptions$1<T> {
  * store.remove();
  * ```
  */
-declare function createLocalStorage<T>(key: string, options?: StorageOptions$1<T>): TypedStorage$1<T>;
+declare function createLocalStorage<T>(key: string, options?: StorageOptions<T>): TypedStorage<T>;
 
 /**
  * Forma Storage - Session
@@ -1014,16 +1035,7 @@ declare function createLocalStorage<T>(key: string, options?: StorageOptions$1<T
  * Typed sessionStorage wrapper with graceful error handling.
  * Zero dependencies — native browser APIs only.
  */
-interface TypedStorage<T> {
-    get(): T | null;
-    set(value: T): void;
-    remove(): void;
-    key: string;
-}
-interface StorageOptions<T> {
-    serialize?: (v: T) => string;
-    deserialize?: (s: string) => T;
-}
+
 /**
  * Create a typed sessionStorage wrapper for the given key.
  *
@@ -1106,9 +1118,11 @@ declare function fetchJSON<T>(url: string, options?: RequestInit): Promise<T>;
  * Reactive SSE wrapper with signal integration.
  * Zero dependencies — native browser APIs only.
  */
-interface SSEOptions {
+interface SSEOptions<T = unknown> {
     withCredentials?: boolean;
     headers?: Record<string, string>;
+    /** Custom parser for incoming messages. Defaults to JSON.parse with raw data fallback. */
+    parse?: (data: string) => T;
 }
 interface SSEConnection<T = unknown> {
     data: () => T | null;
@@ -1128,7 +1142,7 @@ interface SSEConnection<T = unknown> {
  * });
  * ```
  */
-declare function createSSE<T = unknown>(url: string, options?: SSEOptions): SSEConnection<T>;
+declare function createSSE<T = unknown>(url: string, options?: SSEOptions<T>): SSEConnection<T>;
 
 /**
  * Forma HTTP - WebSocket
@@ -1137,11 +1151,13 @@ declare function createSSE<T = unknown>(url: string, options?: SSEOptions): SSEC
  * Zero dependencies — native browser APIs only.
  */
 type WSStatus = 'connecting' | 'open' | 'closed' | 'error';
-interface WSOptions {
+interface WSOptions<TReceive = unknown> {
     protocols?: string | string[];
     reconnect?: boolean;
     reconnectInterval?: number;
     maxReconnects?: number;
+    /** Custom parser for incoming messages. Defaults to JSON.parse with raw data fallback. */
+    parse?: (data: string) => TReceive;
 }
 interface WSConnection<TSend = unknown, TReceive = unknown> {
     data: () => TReceive | null;
@@ -1162,7 +1178,7 @@ interface WSConnection<TSend = unknown, TReceive = unknown> {
  * });
  * ```
  */
-declare function createWebSocket<TSend = unknown, TReceive = unknown>(url: string, options?: WSOptions): WSConnection<TSend, TReceive>;
+declare function createWebSocket<TSend = unknown, TReceive = unknown>(url: string, options?: WSOptions<TReceive>): WSConnection<TSend, TReceive>;
 
 /**
  * FormaJS Server - Action
@@ -1327,7 +1343,7 @@ declare function withRevalidation<T>(data: T, revalidate: Record<string, unknown
  * @param endpoint - The RPC endpoint path (e.g. "/rpc/createTodo_a1b2c3")
  * @returns An async function that sends args to the server and returns the result
  */
-declare function $$serverFunction<T extends (...args: any[]) => Promise<any>>(endpoint: string): T;
+declare function $$serverFunction<T extends (...args: unknown[]) => Promise<unknown>>(endpoint: string): T;
 
 /**
  * FormaJS Server - RPC Handler
@@ -1391,4 +1407,4 @@ declare function renderLocal(slotsJson: string): Promise<string>;
 /** Fragment render (single island) via WASM. */
 declare function renderIsland(slotsJson: string, islandId: number): Promise<string>;
 
-export { $, $$, $$serverFunction, type Action, type ActionOptions, Fragment, type IslandHydrateFn, type MutationResponse, type RPCRequest, type RPCResponse, activateIslands, addClass, applyRevalidation, batch, children, cleanup, closest, createAction, createBus, createComputed, createContext, createEffect, createErrorBoundary, createFetch, createHistory, createIndexedDB, createList, createLocalStorage, createMemo, createPortal, createRPCMiddleware, createReducer, createRef, createResource, createRoot, createSSE, createSessionStorage, createShow, createStore, createSuspense, createSwitch, createText, createWebSocket, defineComponent, delegate, disposeComponent, enableAutoRevalidation, fetchJSON, fragment, getRegisteredEndpoints, getServerFunction, h, handleRPC, hydrateIsland, inject, longestIncreasingSubsequence, mount, nextSibling, on, onCleanup, onError, onIntersect, onKey, onMount, onMutation, onResize, onUnmount, parent, persist, prevSibling, provide, reconcileList, registerResource, registerServerFunction, removeClass, renderIsland, renderLocal, setAttr, setHTML, setStyle, setText, siblings, toggleClass, trackDisposer, unprovide, unregisterResource, untrack, withRevalidation };
+export { $, $$, $$serverFunction, type Action, type ActionOptions, Fragment, type IslandHydrateFn, type MutationResponse, type RPCRequest, type RPCResponse, activateIslands, addClass, applyRevalidation, batch, children, cleanup, closest, createAction, createBus, createComputed, createContext, createEffect, createErrorBoundary, createFetch, createHistory, createIndexedDB, createList, createLocalStorage, createMemo, createPortal, createRPCMiddleware, createReducer, createRef, createResource, createRoot, createSSE, createSessionStorage, createShow, createStore, createSuspense, createSwitch, createText, createWebSocket, defineComponent, delegate, disposeComponent, enableAutoRevalidation, fetchJSON, fragment, getRegisteredEndpoints, getServerFunction, h, handleRPC, hydrateIsland, inject, longestIncreasingSubsequence, mount, nextSibling, on, onCleanup, onError, onIntersect, onKey, onMount, onMutation, onResize, onUnmount, parent, persist, prevSibling, provide, reconcileList, registerResource, registerServerFunction, removeClass, renderIsland, renderLocal, setAttr, setHTML, setHTMLUnsafe, setStyle, setText, siblings, toggleClass, trackDisposer, unprovide, unregisterResource, untrack, withRevalidation };

package/dist/index.js

@@ -1,5 +1,5 @@
-import { internalEffect, createRoot, hydrateIsland, untrack, createEffect, pushSuspenseContext, popSuspenseContext, batch } from './chunk-VKKPX4YU.js';
-export { Fragment, batch, cleanup, createEffect, createList, createMemo, createReducer, createRef, createResource, createRoot, createShow, fragment, h, hydrateIsland, longestIncreasingSubsequence, on, onCleanup, onError, reconcileList, untrack } from './chunk-VKKPX4YU.js';
+import { internalEffect, createRoot, hydrateIsland, untrack, createEffect, pushSuspenseContext, popSuspenseContext, __DEV__, batch } from './chunk-5H52PKGF.js';
+export { Fragment, batch, cleanup, createEffect, createList, createMemo, createReducer, createRef, createResource, createRoot, createShow, fragment, h, hydrateIsland, longestIncreasingSubsequence, on, onCleanup, onError, reconcileList, untrack } from './chunk-5H52PKGF.js';
 import { createSignal, createValueSignal } from './chunk-KX5WRZH7.js';
 export { createComputed, createSignal } from './chunk-KX5WRZH7.js';
 
@@ -238,13 +238,13 @@ function activateIslands(registry2) {
     const componentName = root.getAttribute("data-forma-component");
     const hydrateFn = registry2[componentName];
     if (!hydrateFn) {
-      console.warn(`[forma] No hydrate function for island "${componentName}" (id=${id})`);
+      if (__DEV__) console.warn(`[forma] No hydrate function for island "${componentName}" (id=${id})`);
       root.setAttribute("data-forma-status", "error");
       continue;
     }
     const trigger = root.getAttribute("data-forma-hydrate") || "load";
     if (trigger === "interaction" || trigger === "idle") {
-      console.warn(`[forma] Trigger "${trigger}" not yet implemented for island "${componentName}" (id=${id}), falling back to load`);
+      if (__DEV__) console.warn(`[forma] Trigger "${trigger}" not yet implemented for island "${componentName}" (id=${id}), falling back to load`);
     }
     if (trigger === "visible") {
       const observer = new IntersectionObserver(
@@ -274,7 +274,7 @@ function hydrateIslandRoot(root, id, componentName, hydrateFn, sharedProps) {
     });
     activeRoot.setAttribute("data-forma-status", "active");
   } catch (err) {
-    console.error(`[forma] Island "${componentName}" (id=${id}) failed:`, err);
+    if (__DEV__) console.error(`[forma] Island "${componentName}" (id=${id}) failed:`, err);
     root.setAttribute("data-forma-status", "error");
   }
 }
@@ -685,11 +685,14 @@ function persist(source, key, options) {
   const storage = options?.storage ?? globalThis.localStorage;
   const serialize = options?.serialize ?? JSON.stringify;
   const deserialize = options?.deserialize ?? JSON.parse;
+  const validate = options?.validate;
   try {
     const stored = storage.getItem(key);
     if (stored !== null) {
       const value = deserialize(stored);
-      sourceSet(value);
+      if (!validate || validate(value)) {
+        sourceSet(value);
+      }
     }
   } catch {
   }
@@ -870,6 +873,9 @@ function setText(el, text) {
 function setHTML(el, html) {
   el.innerHTML = html;
 }
+function setHTMLUnsafe(el, html) {
+  el.innerHTML = html;
+}
 
 // src/dom-utils/traverse.ts
 function closest(el, selector) {
@@ -953,20 +959,26 @@ function onMutation(el, handler, options) {
 function createLocalStorage(key, options) {
   const serialize = options?.serialize ?? JSON.stringify;
   const deserialize = options?.deserialize ?? JSON.parse;
+  const validate = options?.validate;
   return {
     key,
     get() {
       try {
         const raw = localStorage.getItem(key);
         if (raw === null) return null;
-        return deserialize(raw);
+        const value = deserialize(raw);
+        if (validate && !validate(value)) return null;
+        return value;
       } catch {
         return null;
       }
     },
     set(value) {
-      const serialized = serialize(value);
-      localStorage.setItem(key, serialized);
+      try {
+        const serialized = serialize(value);
+        localStorage.setItem(key, serialized);
+      } catch {
+      }
     },
     remove() {
       localStorage.removeItem(key);
@@ -978,20 +990,26 @@ function createLocalStorage(key, options) {
 function createSessionStorage(key, options) {
   const serialize = options?.serialize ?? JSON.stringify;
   const deserialize = options?.deserialize ?? JSON.parse;
+  const validate = options?.validate;
   return {
     key,
     get() {
       try {
         const raw = sessionStorage.getItem(key);
         if (raw === null) return null;
-        return deserialize(raw);
+        const value = deserialize(raw);
+        if (validate && !validate(value)) return null;
+        return value;
       } catch {
         return null;
       }
     },
     set(value) {
-      const serialized = serialize(value);
-      sessionStorage.setItem(key, serialized);
+      try {
+        const serialized = serialize(value);
+        sessionStorage.setItem(key, serialized);
+      } catch {
+      }
     },
     remove() {
       sessionStorage.removeItem(key);
@@ -1122,7 +1140,7 @@ function createFetch(url, options) {
       const transformed = transform ? transform(json) : json;
       setData(transformed);
     } catch (err) {
-      if (err?.name === "AbortError") {
+      if (err instanceof Error && err.name === "AbortError") {
         return;
       }
       setError(err instanceof Error ? err : new Error(String(err)));
@@ -1174,13 +1192,15 @@ function createSSE(url, options) {
     setConnected(true);
     setError(null);
   };
-  source.onmessage = (event) => {
+  const parseMessage = options?.parse ?? ((raw) => {
     try {
-      const parsed = JSON.parse(event.data);
-      setData(parsed);
+      return JSON.parse(raw);
     } catch {
-      setData(event.data);
+      return raw;
     }
+  });
+  source.onmessage = (event) => {
+    setData(parseMessage(event.data));
   };
   source.onerror = (event) => {
     setError(event);
@@ -1195,12 +1215,15 @@ function createSSE(url, options) {
       setConnected(false);
     },
     on(event, handler) {
-      const listener = (e) => {
+      const parseEvent = options?.parse ?? ((raw) => {
         try {
-          handler(JSON.parse(e.data));
+          return JSON.parse(raw);
         } catch {
-          handler(e.data);
+          return raw;
         }
+      });
+      const listener = (e) => {
+        handler(parseEvent(e.data));
       };
       source.addEventListener(event, listener);
       return () => {
@@ -1230,13 +1253,15 @@ function createWebSocket(url, options) {
       setStatus("open");
       reconnectCount = 0;
     };
-    socket.onmessage = (event) => {
-      let parsed;
+    const parseMessage = options?.parse ?? ((raw) => {
       try {
-        parsed = JSON.parse(event.data);
+        return JSON.parse(raw);
       } catch {
-        parsed = event.data;
+        return raw;
       }
+    });
+    socket.onmessage = (event) => {
+      const parsed = parseMessage(event.data);
       setData(parsed);
       for (const handler of handlers) {
         handler(parsed);
@@ -1349,6 +1374,10 @@ function applyRevalidation(revalidateData) {
   }
 }
 function enableAutoRevalidation() {
+  if (typeof window === "undefined") {
+    return () => {
+    };
+  }
   const handler = (event) => {
     const detail = event.detail;
     if (detail && typeof detail === "object") {
@@ -1417,9 +1446,10 @@ async function handleRPC(endpoint, body, revalidateData) {
     if (revalidateData) {
       return { data: result, __revalidate: revalidateData };
     }
-    return result;
+    return { data: result };
   } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
+    const isDev = typeof process !== "undefined" && process.env?.NODE_ENV === "development";
+    const message = isDev && err instanceof Error ? err.message : "Internal server error";
     return { error: message };
   }
 }
@@ -1477,6 +1507,6 @@ async function renderIsland(slotsJson, islandId) {
   return wasm.render_island(ir, slotsJson, islandId);
 }
 
-export { $, $$, $$serverFunction, activateIslands, addClass, applyRevalidation, children, closest, createAction, createBus, createContext, createErrorBoundary, createFetch, createHistory, createIndexedDB, createLocalStorage, createPortal, createRPCMiddleware, createSSE, createSessionStorage, createStore, createSuspense, createSwitch, createText, createWebSocket, defineComponent, delegate, disposeComponent, enableAutoRevalidation, fetchJSON, getRegisteredEndpoints, getServerFunction, handleRPC, inject, mount, nextSibling, onIntersect, onKey, onMount, onMutation, onResize, onUnmount, parent, persist, prevSibling, provide, registerResource, registerServerFunction, removeClass, renderIsland, renderLocal, setAttr, setHTML, setStyle, setText, siblings, toggleClass, trackDisposer, unprovide, unregisterResource, withRevalidation };
+export { $, $$, $$serverFunction, activateIslands, addClass, applyRevalidation, children, closest, createAction, createBus, createContext, createErrorBoundary, createFetch, createHistory, createIndexedDB, createLocalStorage, createPortal, createRPCMiddleware, createSSE, createSessionStorage, createStore, createSuspense, createSwitch, createText, createWebSocket, defineComponent, delegate, disposeComponent, enableAutoRevalidation, fetchJSON, getRegisteredEndpoints, getServerFunction, handleRPC, inject, mount, nextSibling, onIntersect, onKey, onMount, onMutation, onResize, onUnmount, parent, persist, prevSibling, provide, registerResource, registerServerFunction, removeClass, renderIsland, renderLocal, setAttr, setHTML, setHTMLUnsafe, setStyle, setText, siblings, toggleClass, trackDisposer, unprovide, unregisterResource, withRevalidation };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map