@solidjs/start 1.3.1 → 1.3.5

package/config/index.js

@@ -9,6 +9,7 @@ import { config } from "vinxi/plugins/config";
 import solid from "vite-plugin-solid";
 import { SolidStartClientFileRouter, SolidStartServerFileRouter } from "./fs-router.js";
 import { serverComponents } from "./server-components.js";
+import xxHash32 from "./xxhash32.js";
 
 const DEFAULT_EXTENSIONS = ["js", "jsx", "ts", "tsx"];
 
@@ -37,6 +38,10 @@ function solidStartServerFsRouter(config) {
     );
 }
 
+function getFunctionId(id) {
+  return xxHash32(id).toString(16);
+}
+
 const SolidStartServerFnsPlugin = createTanStackServerFnPlugin({
   // This is the ID that will be available to look up and import
   // our server function manifest and resolve its module
@@ -47,7 +52,7 @@ const SolidStartServerFnsPlugin = createTanStackServerFnPlugin({
         fileURLToPath(new URL("../dist/runtime/server-runtime.js", import.meta.url))
       )}"`,
     replacer: opts =>
-      `createServerReference(${() => {}}, '${opts.functionId}', '${opts.extractedFilename}')`
+      `createServerReference(${() => {}}, '${(opts.functionId)}', '${getFunctionId(opts.extractedFilename)}')`
   },
   ssr: {
     getRuntimeCode: () =>
@@ -55,7 +60,7 @@ const SolidStartServerFnsPlugin = createTanStackServerFnPlugin({
         fileURLToPath(new URL("../dist/runtime/server-fns-runtime.js", import.meta.url))
       )}'`,
     replacer: opts =>
-      `createServerReference(${opts.fn}, '${opts.functionId}', '${opts.extractedFilename}')`
+      `createServerReference(${opts.fn}, '${(opts.functionId)}', '${getFunctionId(opts.extractedFilename)}')`
   },
   server: {
     getRuntimeCode: () =>
@@ -63,7 +68,7 @@ const SolidStartServerFnsPlugin = createTanStackServerFnPlugin({
         fileURLToPath(new URL("../dist/runtime/server-fns-runtime.js", import.meta.url))
       )}'`,
     replacer: opts =>
-      `createServerReference(${opts.fn}, '${opts.functionId}', '${opts.extractedFilename}')`
+      `createServerReference(${opts.fn}, '${(opts.functionId)}', '${getFunctionId(opts.extractedFilename)}')`
   }
 });
 

package/config/xxhash32.js

@@ -0,0 +1,214 @@
+// @ts-nocheck
+/**
+ * Copyright (c) 2019 Jason Dent
+ * https://github.com/Jason3S/xxhash
+ */
+const PRIME32_1 = 2654435761;
+const PRIME32_2 = 2246822519;
+const PRIME32_3 = 3266489917;
+const PRIME32_4 = 668265263;
+const PRIME32_5 = 374761393;
+
+function toUtf8(text) {
+  const bytes = [];
+  for (let i = 0, n = text.length; i < n; ++i) {
+    const c = text.charCodeAt(i);
+    if (c < 0x80) {
+      bytes.push(c);
+    } else if (c < 0x800) {
+      bytes.push(0xc0 | (c >> 6), 0x80 | (c & 0x3f));
+    } else if (c < 0xd800 || c >= 0xe000) {
+      bytes.push(0xe0 | (c >> 12), 0x80 | ((c >> 6) & 0x3f), 0x80 | (c & 0x3f));
+    } else {
+      const cp =
+        0x10000 + (((c & 0x3ff) << 10) | (text.charCodeAt(++i) & 0x3ff));
+      bytes.push(
+        0xf0 | ((cp >> 18) & 0x7),
+        0x80 | ((cp >> 12) & 0x3f),
+        0x80 | ((cp >> 6) & 0x3f),
+        0x80 | (cp & 0x3f),
+      );
+    }
+  }
+  return new Uint8Array(bytes);
+}
+/**
+ *
+ * @param buffer - byte array or string
+ * @param seed - optional seed (32-bit unsigned);
+ */
+export default function xxHash32(
+  buffer,
+  seed = 0,
+) {
+  buffer = typeof buffer === 'string' ? toUtf8(buffer) : buffer;
+  const b = buffer;
+
+  /*
+    Step 1. Initialize internal accumulators
+    Each accumulator gets an initial value based on optional seed input.
+    Since the seed is optional, it can be 0.
+    ```
+      u32 acc1 = seed + PRIME32_1 + PRIME32_2;
+      u32 acc2 = seed + PRIME32_2;
+      u32 acc3 = seed + 0;
+      u32 acc4 = seed - PRIME32_1;
+    ```
+    Special case : input is less than 16 bytes
+    When input is too small (< 16 bytes), the algorithm will not process any stripe.
+    Consequently, it will not make use of parallel accumulators.
+    In which case, a simplified initialization is performed, using a single accumulator :
+    u32 acc  = seed + PRIME32_5;
+    The algorithm then proceeds directly to step 4.
+  */
+
+  let acc = (seed + PRIME32_5) & 0xffffffff;
+  let offset = 0;
+
+  if (b.length >= 16) {
+    const accN = [
+      (seed + PRIME32_1 + PRIME32_2) & 0xffffffff,
+      (seed + PRIME32_2) & 0xffffffff,
+      (seed + 0) & 0xffffffff,
+      (seed - PRIME32_1) & 0xffffffff,
+    ];
+
+    /*
+      Step 2. Process stripes
+      A stripe is a contiguous segment of 16 bytes. It is evenly divided into 4 lanes,
+      of 4 bytes each. The first lane is used to update accumulator 1, the second lane
+      is used to update accumulator 2, and so on. Each lane read its associated 32-bit
+      value using little-endian convention. For each {lane, accumulator}, the update
+      process is called a round, and applies the following formula :
+      ```
+      accN = accN + (laneN * PRIME32_2);
+      accN = accN <<< 13;
+      accN = accN * PRIME32_1;
+      ```
+      This shuffles the bits so that any bit from input lane impacts several bits in
+      output accumulator. All operations are performed modulo 2^32.
+      Input is consumed one full stripe at a time. Step 2 is looped as many times as
+      necessary to consume the whole input, except the last remaining bytes which cannot
+      form a stripe (< 16 bytes). When that happens, move to step 3.
+    */
+
+    const b = buffer;
+    const limit = b.length - 16;
+    let lane = 0;
+    for (offset = 0; (offset & 0xfffffff0) <= limit; offset += 4) {
+      const i = offset;
+      const laneN0 = b[i + 0] + (b[i + 1] << 8);
+      const laneN1 = b[i + 2] + (b[i + 3] << 8);
+      const laneNP = laneN0 * PRIME32_2 + ((laneN1 * PRIME32_2) << 16);
+      let acc = (accN[lane] + laneNP) & 0xffffffff;
+      acc = (acc << 13) | (acc >>> 19);
+      const acc0 = acc & 0xffff;
+      const acc1 = acc >>> 16;
+      accN[lane] = (acc0 * PRIME32_1 + ((acc1 * PRIME32_1) << 16)) & 0xffffffff;
+      lane = (lane + 1) & 0x3;
+    }
+
+    /*
+      Step 3. Accumulator convergence
+      All 4 lane accumulators from previous steps are merged to produce a
+      single remaining accumulator
+      of same width (32-bit). The associated formula is as follows :
+      ```
+      acc = (acc1 <<< 1) + (acc2 <<< 7) + (acc3 <<< 12) + (acc4 <<< 18);
+      ```
+    */
+    acc =
+      (((accN[0] << 1) | (accN[0] >>> 31)) +
+        ((accN[1] << 7) | (accN[1] >>> 25)) +
+        ((accN[2] << 12) | (accN[2] >>> 20)) +
+        ((accN[3] << 18) | (accN[3] >>> 14))) &
+      0xffffffff;
+  }
+
+  /*
+    Step 4. Add input length
+    The input total length is presumed known at this stage.
+    This step is just about adding the length to
+    accumulator, so that it participates to final mixing.
+    ```
+    acc = acc + (u32)inputLength;
+    ```
+  */
+  acc = (acc + buffer.length) & 0xffffffff;
+
+  /*
+    Step 5. Consume remaining input
+    There may be up to 15 bytes remaining to consume from the input.
+    The final stage will digest them according
+    to following pseudo-code :
+    ```
+    while (remainingLength >= 4) {
+        lane = read_32bit_little_endian(input_ptr);
+        acc = acc + lane * PRIME32_3;
+        acc = (acc <<< 17) * PRIME32_4;
+        input_ptr += 4; remainingLength -= 4;
+    }
+    ```
+    This process ensures that all input bytes are present in the final mix.
+  */
+
+  const limit = buffer.length - 4;
+  for (; offset <= limit; offset += 4) {
+    const i = offset;
+    const laneN0 = b[i + 0] + (b[i + 1] << 8);
+    const laneN1 = b[i + 2] + (b[i + 3] << 8);
+    const laneP = laneN0 * PRIME32_3 + ((laneN1 * PRIME32_3) << 16);
+    acc = (acc + laneP) & 0xffffffff;
+    acc = (acc << 17) | (acc >>> 15);
+    acc =
+      ((acc & 0xffff) * PRIME32_4 + (((acc >>> 16) * PRIME32_4) << 16)) &
+      0xffffffff;
+  }
+
+  /*
+        ```
+        while (remainingLength >= 1) {
+            lane = read_byte(input_ptr);
+            acc = acc + lane * PRIME32_5;
+            acc = (acc <<< 11) * PRIME32_1;
+            input_ptr += 1; remainingLength -= 1;
+        }
+        ```
+    */
+
+  for (; offset < b.length; ++offset) {
+    const lane = b[offset];
+    acc += lane * PRIME32_5;
+    acc = (acc << 11) | (acc >>> 21);
+    acc =
+      ((acc & 0xffff) * PRIME32_1 + (((acc >>> 16) * PRIME32_1) << 16)) &
+      0xffffffff;
+  }
+
+  /*
+        Step 6. Final mix (avalanche)
+        The final mix ensures that all input bits have a chance to impact any bit in
+        the output digest, resulting in an unbiased distribution. This is also called
+        avalanche effect.
+        ```
+        acc = acc xor (acc >> 15);
+        acc = acc * PRIME32_2;
+        acc = acc xor (acc >> 13);
+        acc = acc * PRIME32_3;
+        acc = acc xor (acc >> 16);
+        ```
+    */
+
+  acc ^= acc >>> 15;
+  acc =
+    (((acc & 0xffff) * PRIME32_2) & 0xffffffff) +
+    (((acc >>> 16) * PRIME32_2) << 16);
+  acc ^= acc >>> 13;
+  acc =
+    (((acc & 0xffff) * PRIME32_3) & 0xffffffff) +
+    (((acc >>> 16) * PRIME32_3) << 16);
+  acc ^= acc >>> 16;
+
+  // turn any negatives back into a positive number;
+  return acc < 0 ? acc + 4294967296 : acc;
+}

package/dist/runtime/cache-control.d.ts

@@ -0,0 +1,17 @@
+import { type HTTPEvent } from "vinxi/http";
+/**
+ * A server function answers one caller, so a shared cache must not store the
+ * response unless the function opted in with its own `Cache-Control`, either
+ * on a returned Response or on the event's response headers. A 304 is left
+ * alone: it updates a stored response rather than being one, and `no-store`
+ * on it would drop the entry the conditional request was keeping.
+ *
+ * This runs once the handler has finished rather than up front: forwarded
+ * response headers are appended to the event's, so a default already present
+ * would be joined with the function's value instead of being replaced by it.
+ * h3 writes a returned Response's headers over the event's, so the event's
+ * header only reaches the wire when the Response has none of its own.
+ */
+export declare function withDefaultCacheControl<T>(h3Event: HTTPEvent, value: T): T;
+/** h3 answers a thrown value itself, keeping the event's response headers. */
+export declare function setThrownCacheControl(h3Event: HTTPEvent): void;

package/dist/runtime/cache-control.js

@@ -0,0 +1,38 @@
+import { getResponseHeader, getResponseStatus, setResponseHeader } from "vinxi/http";
+const CACHE_CONTROL = "Cache-Control";
+const DEFAULT_CACHE_CONTROL = "no-store";
+function hasEventCacheControl(h3Event) {
+    return getResponseHeader(h3Event, CACHE_CONTROL) !== undefined;
+}
+/**
+ * A server function answers one caller, so a shared cache must not store the
+ * response unless the function opted in with its own `Cache-Control`, either
+ * on a returned Response or on the event's response headers. A 304 is left
+ * alone: it updates a stored response rather than being one, and `no-store`
+ * on it would drop the entry the conditional request was keeping.
+ *
+ * This runs once the handler has finished rather than up front: forwarded
+ * response headers are appended to the event's, so a default already present
+ * would be joined with the function's value instead of being replaced by it.
+ * h3 writes a returned Response's headers over the event's, so the event's
+ * header only reaches the wire when the Response has none of its own.
+ */
+export function withDefaultCacheControl(h3Event, value) {
+    if (value instanceof Response) {
+        if (value.status === 304 || value.headers.has(CACHE_CONTROL))
+            return value;
+    }
+    else if (getResponseStatus(h3Event) === 304) {
+        return value;
+    }
+    if (!hasEventCacheControl(h3Event)) {
+        setResponseHeader(h3Event, CACHE_CONTROL, DEFAULT_CACHE_CONTROL);
+    }
+    return value;
+}
+/** h3 answers a thrown value itself, keeping the event's response headers. */
+export function setThrownCacheControl(h3Event) {
+    if (!hasEventCacheControl(h3Event)) {
+        setResponseHeader(h3Event, CACHE_CONTROL, DEFAULT_CACHE_CONTROL);
+    }
+}

package/dist/runtime/cross-site.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Server functions are same-origin RPC: a page on another site must not be
+ * able to invoke one with the visitor's cookies. Trust `Sec-Fetch-Site` when
+ * the browser sends it, and fall back to comparing `Origin` against the
+ * request host.
+ *
+ * `same-origin` and `same-site` are allowed, matching the reach of a
+ * `SameSite=Lax`/`Strict` cookie. `none` is a user-initiated navigation
+ * (typed URL, bookmark), not a request issued by another site.
+ */
+export declare function isCrossSiteRequest(request: Request, url: URL): boolean;

package/dist/runtime/cross-site.js

@@ -0,0 +1,35 @@
+/**
+ * Server functions are same-origin RPC: a page on another site must not be
+ * able to invoke one with the visitor's cookies. Trust `Sec-Fetch-Site` when
+ * the browser sends it, and fall back to comparing `Origin` against the
+ * request host.
+ *
+ * `same-origin` and `same-site` are allowed, matching the reach of a
+ * `SameSite=Lax`/`Strict` cookie. `none` is a user-initiated navigation
+ * (typed URL, bookmark), not a request issued by another site.
+ */
+export function isCrossSiteRequest(request, url) {
+    const secFetchSite = request.headers.get("sec-fetch-site");
+    if (secFetchSite) {
+        return secFetchSite === "cross-site";
+    }
+    // Older browsers omit Sec-Fetch-Site. They still send Origin on the
+    // cross-site requests that matter (form and fetch POSTs), so compare it.
+    const origin = request.headers.get("origin");
+    // `null` is an opaque origin (a sandboxed iframe, a cross-origin redirect
+    // chain): the browser declines to name the caller, so it cannot be matched.
+    if (origin === "null") {
+        return true;
+    }
+    if (origin) {
+        try {
+            return new URL(origin).host !== url.host;
+        }
+        catch {
+            return true;
+        }
+    }
+    // No Origin either (a same-origin GET, or a non-browser client): nothing to
+    // reject on.
+    return false;
+}

package/dist/runtime/cross-site.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/runtime/cross-site.test.js

@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+import { isCrossSiteRequest } from "./cross-site";
+const URL_STRING = "http://localhost:3000/_server";
+function check(headers) {
+    const request = new Request(URL_STRING, { method: "POST", headers });
+    return isCrossSiteRequest(request, new URL(request.url));
+}
+describe("isCrossSiteRequest", () => {
+    describe("with Sec-Fetch-Site", () => {
+        it("rejects cross-site", () => {
+            expect(check({ "sec-fetch-site": "cross-site" })).toBe(true);
+        });
+        it("allows same-origin", () => {
+            expect(check({ "sec-fetch-site": "same-origin" })).toBe(false);
+        });
+        it("allows same-site", () => {
+            expect(check({ "sec-fetch-site": "same-site" })).toBe(false);
+        });
+        it("allows none (a user-initiated navigation)", () => {
+            expect(check({ "sec-fetch-site": "none" })).toBe(false);
+        });
+        it("takes precedence over a mismatched Origin", () => {
+            expect(check({ "sec-fetch-site": "same-origin", origin: "https://other.example" })).toBe(false);
+        });
+        it("takes precedence over a matching Origin", () => {
+            expect(check({ "sec-fetch-site": "cross-site", origin: "http://localhost:3000" })).toBe(true);
+        });
+        it("takes precedence over Origin: null", () => {
+            expect(check({ "sec-fetch-site": "same-origin", origin: "null" })).toBe(false);
+        });
+    });
+    describe("without Sec-Fetch-Site", () => {
+        it("allows an Origin matching the request host", () => {
+            expect(check({ origin: "http://localhost:3000" })).toBe(false);
+        });
+        it("rejects an Origin on another host", () => {
+            expect(check({ origin: "https://other.example" })).toBe(true);
+        });
+        it("rejects an Origin on the same hostname but another port", () => {
+            expect(check({ origin: "http://localhost:4000" })).toBe(true);
+        });
+        it("rejects an opaque Origin (null)", () => {
+            expect(check({ origin: "null" })).toBe(true);
+        });
+        it("rejects an Origin that cannot be parsed", () => {
+            expect(check({ origin: "not a url" })).toBe(true);
+        });
+        it("allows a request with neither header", () => {
+            expect(check({})).toBe(false);
+        });
+    });
+});

package/dist/runtime/serialization.d.ts

@@ -1,6 +1,13 @@
 export declare function serializeToJSStream(id: string, value: any): ReadableStream<any>;
 export declare function serializeToJSONStream(value: any): ReadableStream<any>;
 export declare function serializeToJSONString(value: any): Promise<string>;
+/**
+ * Decodes the body written by `serializeToJSONString`. The body is the whole
+ * payload, so once it is decoded nothing can settle a promise or stream it
+ * left open; those are failed rather than left waiting. The cross deserializer
+ * is used because it exposes its refs, and it reads the same nodes `toJSONAsync`
+ * emits.
+ */
 export declare function deserializeFromJSONString(json: string): Promise<unknown>;
 export declare function deserializeJSONStream(response: Response | Request): Promise<unknown>;
 export declare function deserializeJSStream(id: string, response: Response): Promise<unknown>;

package/dist/runtime/serialization.js

@@ -1,4 +1,4 @@
-import { crossSerializeStream, deserialize, Feature, fromCrossJSON, fromJSON, getCrossReferenceHeader, toCrossJSONStream, toJSONAsync, } from "seroval";
+import { crossSerializeStream, deserialize, Feature, fromCrossJSON, getCrossReferenceHeader, isStream, toCrossJSONStream, toJSONAsync, } from "seroval";
 import { AbortSignalPlugin, CustomEventPlugin, DOMExceptionPlugin, EventPlugin, FormDataPlugin, HeadersPlugin, ReadableStreamPlugin, RequestPlugin, ResponsePlugin, URLPlugin, URLSearchParamsPlugin, } from "seroval-plugins/web";
 // TODO(Alexis): if we can, allow providing an option to extend these.
 const DEFAULT_PLUGINS = [
@@ -105,10 +105,14 @@ class SerovalChunkReader {
         }
     }
     async next() {
-        // Check if the buffer is empty
-        if (this.buffer.length === 0) {
+        // Check if the buffer is empty or incomplete
+        if (this.buffer.length < 12) {
             // if we are already done...
             if (this.done) {
+                // incomplete stream
+                if (this.buffer.length !== 0) {
+                    throw new Error("Malformed server function stream.");
+                }
                 return {
                     done: true,
                     value: undefined,
@@ -124,6 +128,9 @@ class SerovalChunkReader {
         // deserialize the data
         const head = new TextDecoder().decode(this.buffer.subarray(1, 11));
         const bytes = Number.parseInt(head, 16); // ;0x00000000;
+        if (Number.isNaN(bytes)) {
+            throw new Error("Malformed server function stream header.");
+        }
         // Check if the buffer has enough bytes to be parsed
         while (bytes > this.buffer.length - 12) {
             // If it's not enough, and the reader is done
@@ -165,11 +172,81 @@ export async function serializeToJSONString(value) {
         disabledFeatures: DISABLED_FEATURES,
     }));
 }
+const ignoreRejection = () => { };
+/**
+ * A decoded payload is the peer's bytes, so a promise it decodes to can reject
+ * with nobody holding it: an argument the function never awaits. Seroval
+ * stores every promise it decodes in the refs map, including ones that reject
+ * synchronously inside `fromCrossJSON`, so claim them as they are stored. Code
+ * that awaits the promise still sees the rejection.
+ */
+class DecodedRefs extends Map {
+    set(id, value) {
+        if (value instanceof Promise)
+            value.catch(ignoreRejection);
+        return super.set(id, value);
+    }
+}
+/**
+ * Fails every value still waiting on a node that will not arrive. Seroval
+ * keeps these in the refs: open streams (`isStream`) and pending-promise
+ * resolvers (`{ p, s, f }`). Throwing into a closed stream and
+ * rejecting a settled promise are no-ops, so this is safe to run after a body
+ * that decoded completely.
+ *
+ * A ref can be any value a plugin decoded, so nothing is read off it unguarded.
+ */
+function settlePendingRefs(refs, error) {
+    for (const value of refs) {
+        if (value === null || typeof value !== "object")
+            continue;
+        try {
+            if (isStream(value)) {
+                value.throw(error);
+                continue;
+            }
+            const ref = value;
+            if (typeof ref.s === "function" &&
+                typeof ref.f === "function" &&
+                ref.p instanceof Promise) {
+                // seroval stores the resolver before its promise, so a failed second
+                // store leaves a promise that `DecodedRefs` never saw
+                ref.p.catch(ignoreRejection);
+                ref.f(error);
+            }
+        }
+        catch {
+            // a stream listener threw, or a plugin value refused the read
+        }
+    }
+}
+function createEndOfStreamError() {
+    return new Error("Server function stream ended unexpectedly.");
+}
+/**
+ * Decodes the body written by `serializeToJSONString`. The body is the whole
+ * payload, so once it is decoded nothing can settle a promise or stream it
+ * left open; those are failed rather than left waiting. The cross deserializer
+ * is used because it exposes its refs, and it reads the same nodes `toJSONAsync`
+ * emits.
+ */
 export async function deserializeFromJSONString(json) {
-    return fromJSON(JSON.parse(json), {
-        plugins: DEFAULT_PLUGINS,
-        disabledFeatures: DISABLED_FEATURES,
-    });
+    const source = JSON.parse(json);
+    const refs = new DecodedRefs();
+    let value;
+    try {
+        value = fromCrossJSON(source.t, {
+            refs,
+            plugins: DEFAULT_PLUGINS,
+            disabledFeatures: DISABLED_FEATURES,
+        });
+    }
+    catch (error) {
+        settlePendingRefs(refs.values(), error);
+        throw error;
+    }
+    settlePendingRefs(refs.values(), createEndOfStreamError());
+    return value;
 }
 export async function deserializeJSONStream(response) {
     if (!response.body) {

package/dist/runtime/serialization.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/runtime/serialization.test.js

@@ -0,0 +1,313 @@
+import { describe, expect, it, beforeEach, afterEach } from "vitest";
+import { deserializeFromJSONString, deserializeJSONStream, deserializeJSStream, serializeToJSONString, } from "./serialization";
+const encoder = new TextEncoder();
+function makeChunk(dataStr, declaredBytes) {
+    const data = encoder.encode(dataStr);
+    const bytes = declaredBytes ?? data.length;
+    const baseHex = bytes.toString(16).padStart(8, "0");
+    const head = encoder.encode(`;0x${baseHex};`);
+    const chunk = new Uint8Array(head.length + data.length);
+    chunk.set(head);
+    chunk.set(data, head.length);
+    return chunk;
+}
+function streamFromChunks(chunks) {
+    return new ReadableStream({
+        start(controller) {
+            for (const c of chunks)
+                controller.enqueue(c);
+            controller.close();
+        },
+    });
+}
+function responseWithChunks(chunks) {
+    if (chunks === null)
+        return new Response(null);
+    return new Response(streamFromChunks(chunks));
+}
+const cases = [
+    { name: "deserializeJSONStream", call: (r) => deserializeJSONStream(r) },
+    { name: "deserializeJSStream", call: (r) => deserializeJSStream("server-fn:0", r) },
+];
+describe("Serialization negative testing (unhappy paths)", () => {
+    // TODO: Serialization drains remaining chunks in the background for performance and 
+    // its async errors aren't propagated to a designated error boundary.
+    // This is a temporary catch-all to avoid unhandled rejections in this test suite until 
+    // we have a better solution for handling async errors in serialization.
+    const _unhandledRejectionHandler = (reason, promise) => {
+        // eslint-disable-next-line no-console
+        console.error("Unhandled rejection (ignored) in serialization.test:", reason, promise);
+    };
+    // Install immediately and retain for the duration of this test file.
+    beforeEach(() => {
+        process.on("unhandledRejection", _unhandledRejectionHandler);
+    });
+    afterEach(async () => {
+        // Wait for any pending microtasks to allow background processes to complete
+        await new Promise(resolve => setTimeout(resolve, 0));
+        process.off("unhandledRejection", _unhandledRejectionHandler);
+    });
+    for (const fn of cases) {
+        it(`${fn.name} throws on missing body`, async () => {
+            await expect(fn.call(responseWithChunks(null))).rejects.toThrow("missing body");
+        });
+        it(`${fn.name} throws on plain XML response`, async () => {
+            const xml = '<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message></Error>';
+            const chunk = encoder.encode(xml);
+            const resp = new Response(new ReadableStream({
+                start(controller) {
+                    controller.enqueue(chunk);
+                    controller.close();
+                },
+            }));
+            await expect(fn.call(resp)).rejects.toThrow();
+        });
+        it(`${fn.name} throws Malformed server function stream when header larger than provided bytes`, async () => {
+            const chunk = makeChunk("bad", 16); // declare more than actual
+            await expect(fn.call(responseWithChunks([chunk]))).rejects.toThrow("Malformed server function stream.");
+        });
+        it(`${fn.name} throws Malformed server function stream when header smaller than provided bytes`, async () => {
+            const chunk = makeChunk("bad", 2); // declare less than actual
+            await expect(fn.call(responseWithChunks([chunk]))).rejects.toThrow();
+        });
+        it(`${fn.name} throws on valid header but invalid JSON body`, async () => {
+            const chunk = makeChunk("not-a-json");
+            await expect(fn.call(responseWithChunks([chunk]))).rejects.toThrow();
+        });
+    }
+});
+const roundTrip = async (value) => (await deserializeFromJSONString(await serializeToJSONString(value)));
+const ENDED = "Server function stream ended unexpectedly.";
+/** Fails the test instead of hanging when a decoded value never settles. */
+const settleWithin = (promise, ms = 200) => Promise.race([
+    promise,
+    new Promise((_, reject) => setTimeout(() => reject(new Error("still pending")), ms)),
+]);
+async function readAll(stream) {
+    const reader = stream.getReader();
+    const chunks = [];
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            return chunks;
+        chunks.push(value);
+    }
+}
+// PromiseSuccess, PromiseFailure, StreamThrow, StreamReturn
+const SETTLING_NODES = new Set([23, 24, 33, 34]);
+/** Drops the nodes that settle promises and end streams, as if the body was cut short. */
+function withoutSettlingNodes(json) {
+    return JSON.stringify(JSON.parse(json), (_key, value) => Array.isArray(value)
+        ? value.filter(node => !(node && SETTLING_NODES.has(node.t)))
+        : value);
+}
+describe("deserializeFromJSONString", () => {
+    describe("round-trips argument payloads", () => {
+        it("plain values, collections and shared references", async () => {
+            const shared = { x: 1 };
+            const cyclic = { name: "cyclic" };
+            cyclic.self = cyclic;
+            const [value] = await roundTrip([
+                {
+                    string: "text",
+                    number: 1.5,
+                    bigint: 10n,
+                    nan: NaN,
+                    negativeZero: -0,
+                    infinity: -Infinity,
+                    nil: null,
+                    undef: undefined,
+                    bool: true,
+                    date: new Date(0),
+                    map: new Map([["k", shared]]),
+                    set: new Set([1, 2]),
+                    array: [shared, shared],
+                    bytes: new Uint8Array([1, 2, 3]),
+                    cyclic,
+                },
+            ]);
+            expect(value.string).toBe("text");
+            expect(value.number).toBe(1.5);
+            expect(value.bigint).toBe(10n);
+            expect(value.nan).toBeNaN();
+            expect(Object.is(value.negativeZero, -0)).toBe(true);
+            expect(value.infinity).toBe(-Infinity);
+            expect(value.nil).toBeNull();
+            expect("undef" in value && value.undef === undefined).toBe(true);
+            expect(value.bool).toBe(true);
+            expect(value.date).toEqual(new Date(0));
+            expect(value.map.get("k")).toEqual({ x: 1 });
+            expect([...value.set]).toEqual([1, 2]);
+            expect(value.array[0]).toBe(value.array[1]);
+            expect(value.map.get("k")).toBe(value.array[0]);
+            expect([...value.bytes]).toEqual([1, 2, 3]);
+            expect(value.cyclic.self).toBe(value.cyclic);
+        });
+        it("resolved and rejected promises", async () => {
+            const [resolved, rejected] = await roundTrip([
+                Promise.resolve(42),
+                Promise.reject(new TypeError("boom")),
+            ]);
+            await expect(resolved).resolves.toBe(42);
+            await expect(rejected).rejects.toThrow(TypeError);
+            await expect(rejected).rejects.toThrow("boom");
+        });
+        it("errors", async () => {
+            const [error, aggregate] = await roundTrip([
+                new RangeError("out of range"),
+                new AggregateError([new Error("inner")], "outer"),
+            ]);
+            expect(error).toBeInstanceOf(RangeError);
+            expect(error.message).toBe("out of range");
+            expect(aggregate).toBeInstanceOf(AggregateError);
+            expect(aggregate.errors[0].message).toBe("inner");
+        });
+        it("async iterators", async () => {
+            async function* numbers() {
+                yield 1;
+                yield 2;
+            }
+            const [iterable] = await roundTrip([numbers()]);
+            const values = [];
+            for await (const value of iterable)
+                values.push(value);
+            expect(values).toEqual([1, 2]);
+        });
+        it("readable streams", async () => {
+            const source = new ReadableStream({
+                start(controller) {
+                    controller.enqueue("a");
+                    controller.enqueue("b");
+                    controller.close();
+                },
+            });
+            const [stream] = await roundTrip([source]);
+            expect(stream).toBeInstanceOf(ReadableStream);
+            expect(await settleWithin(readAll(stream))).toEqual(["a", "b"]);
+        });
+        it("form data", async () => {
+            const form = new FormData();
+            form.append("name", "value");
+            form.append("name", "second");
+            form.append("other", "x");
+            const [value] = await roundTrip([form]);
+            expect(value).toBeInstanceOf(FormData);
+            expect(value.getAll("name")).toEqual(["value", "second"]);
+            expect(value.get("other")).toBe("x");
+        });
+        it("requests and responses", async () => {
+            const [request, response] = await roundTrip([
+                new Request("http://localhost/path?q=1", {
+                    method: "POST",
+                    headers: { "x-test": "1" },
+                    body: "request body",
+                }),
+                new Response("response body", { status: 201, headers: { "x-test": "2" } }),
+            ]);
+            expect(request).toBeInstanceOf(Request);
+            expect(request.method).toBe("POST");
+            expect(request.url).toBe("http://localhost/path?q=1");
+            expect(request.headers.get("x-test")).toBe("1");
+            expect(await request.text()).toBe("request body");
+            expect(response).toBeInstanceOf(Response);
+            expect(response.status).toBe(201);
+            expect(response.headers.get("x-test")).toBe("2");
+            expect(await response.text()).toBe("response body");
+        });
+        it("headers, URLs and search params", async () => {
+            const [headers, url, params] = await roundTrip([
+                new Headers({ a: "1" }),
+                new URL("http://localhost/a?b=c"),
+                new URLSearchParams("x=1&x=2"),
+            ]);
+            expect(headers).toBeInstanceOf(Headers);
+            expect(headers.get("a")).toBe("1");
+            expect(url).toBeInstanceOf(URL);
+            expect(url.href).toBe("http://localhost/a?b=c");
+            expect(params).toBeInstanceOf(URLSearchParams);
+            expect(params.getAll("x")).toEqual(["1", "2"]);
+        });
+        it("abort signals, events and DOM exceptions", async () => {
+            const [signal, event, custom, exception] = await roundTrip([
+                AbortSignal.abort("reason"),
+                new Event("ping"),
+                new CustomEvent("custom", { detail: { a: 1 } }),
+                new DOMException("message", "AbortError"),
+            ]);
+            expect(signal).toBeInstanceOf(AbortSignal);
+            expect(signal.aborted).toBe(true);
+            expect(signal.reason).toBe("reason");
+            expect(event).toBeInstanceOf(Event);
+            expect(event.type).toBe("ping");
+            expect(custom).toBeInstanceOf(CustomEvent);
+            expect(custom.detail).toEqual({ a: 1 });
+            expect(exception).toBeInstanceOf(DOMException);
+            expect(exception.name).toBe("AbortError");
+        });
+    });
+    describe("values left pending when the body ends", () => {
+        it("rejects a promise that the body never settles", async () => {
+            const [promise] = (await deserializeFromJSONString(JSON.stringify({ t: { t: 9, i: 0, a: [{ t: 22, i: 1, s: 2 }], o: 0 }, f: 31, m: [] })));
+            await expect(settleWithin(promise)).rejects.toThrow(ENDED);
+        });
+        it("keeps a promise that the body settles", async () => {
+            const [promise] = (await deserializeFromJSONString(JSON.stringify({
+                t: {
+                    t: 9,
+                    i: 0,
+                    a: [
+                        { t: 22, i: 1, s: 2 },
+                        { t: 23, i: 2, a: [{ t: 2, s: 1 }, { t: 0, s: 7 }] },
+                    ],
+                    o: 0,
+                },
+                f: 31,
+                m: [],
+            })));
+            await expect(settleWithin(promise)).resolves.toBe(7);
+        });
+        it("errors a readable stream that the body never ends", async () => {
+            const source = new ReadableStream({
+                start(controller) {
+                    controller.enqueue("a");
+                    controller.close();
+                },
+            });
+            const json = withoutSettlingNodes(await serializeToJSONString([source]));
+            const [stream] = (await deserializeFromJSONString(json));
+            // erroring a ReadableStream discards the chunks still queued in it
+            await expect(settleWithin(readAll(stream))).rejects.toThrow(ENDED);
+        });
+        it("errors an async iterator that the body never ends", async () => {
+            async function* numbers() {
+                yield 1;
+            }
+            const json = withoutSettlingNodes(await serializeToJSONString([numbers()]));
+            const [iterable] = (await deserializeFromJSONString(json));
+            const values = [];
+            const consume = async () => {
+                for await (const value of iterable)
+                    values.push(value);
+            };
+            await expect(settleWithin(consume())).rejects.toThrow(ENDED);
+            expect(values).toEqual([1]);
+        });
+        it("does not report rejections for decoded promises nobody awaits", async () => {
+            const unhandled = [];
+            const record = (reason) => unhandled.push(reason);
+            process.on("unhandledRejection", record);
+            try {
+                await deserializeFromJSONString(JSON.stringify({ t: { t: 9, i: 0, a: [{ t: 22, i: 1, s: 2 }], o: 0 }, f: 31, m: [] }));
+                await roundTrip([Promise.reject(new Error("never awaited"))]);
+                await new Promise(resolve => setTimeout(resolve, 10));
+            }
+            finally {
+                process.off("unhandledRejection", record);
+            }
+            expect(unhandled).toEqual([]);
+        });
+        it("throws when a node is malformed", async () => {
+            await expect(deserializeFromJSONString(JSON.stringify({ t: { t: 9, i: 0, a: [{ t: 22, i: 1, s: 2 }, { t: 999 }], o: 0 }, f: 31, m: [] }))).rejects.toThrow();
+        });
+    });
+});

package/dist/runtime/server-handler.js

@@ -10,14 +10,32 @@ import { getExpectedRedirectStatus } from "../server/handler";
 import { createPageEvent } from "../server/pageEvent";
 // @ts-ignore
 import serverFnManifest from "solidstart:server-fn-manifest";
+import { setThrownCacheControl, withDefaultCacheControl } from "./cache-control";
+import { isCrossSiteRequest } from "./cross-site";
 import { deserializeFromJSONString, serializeToJSONStream, serializeToJSStream } from "./serialization";
 async function handleServerFunction(h3Event) {
+    let response;
+    try {
+        response = await runServerFunction(h3Event);
+    }
+    catch (error) {
+        setThrownCacheControl(h3Event);
+        throw error;
+    }
+    return withDefaultCacheControl(h3Event, response);
+}
+async function runServerFunction(h3Event) {
     const event = getFetchEvent(h3Event);
     const request = event.request;
+    const url = new URL(request.url);
+    if (isCrossSiteRequest(request, url)) {
+        return process.env.NODE_ENV === "development"
+            ? new Response("Cross-site server function requests are not allowed", { status: 403 })
+            : new Response(null, { status: 403 });
+    }
     const serverReference = request.headers.get("X-Server-Id");
     const instance = request.headers.get("X-Server-Instance");
     const singleFlight = request.headers.has("X-Single-Flight");
-    const url = new URL(request.url);
     let functionId, name;
     if (serverReference) {
         invariant(typeof serverReference === "string", "Invalid server function");
@@ -133,6 +151,10 @@ async function handleServerFunction(h3Event) {
             setHeader(h3Event, "content-type", "text/javascript");
             return serializeToJSStream(instance, result);
         }
+        // Explicitly set the Content-Type to avoid runtimes (e.g., AWS Lambda)
+        // that default to `application/json`, which can break serialization
+        // when the SEROVAL output is not valid JSON.
+        setHeader(h3Event, "content-type", "text/plain");
         return serializeToJSONStream(result);
     }
     catch (x) {
@@ -166,6 +188,10 @@ async function handleServerFunction(h3Event) {
                 setHeader(h3Event, "content-type", "text/javascript");
                 return serializeToJSStream(instance, x);
             }
+            // Explicitly set the Content-Type to avoid runtimes (e.g., AWS Lambda)
+            // that default to `application/json`, which can break serialization
+            // when the SEROVAL output is not valid JSON.
+            setHeader(h3Event, "content-type", "text/plain");
             return serializeToJSONStream(x);
         }
         return x;

package/dist/runtime/server-handler.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/runtime/server-handler.test.js

@@ -0,0 +1,207 @@
+import { getRequestEvent } from "solid-js/web";
+import { createApp, toWebHandler } from "vinxi/http";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+const serverFn = vi.hoisted(() => ({
+    calls: 0,
+    current: (..._args) => undefined
+}));
+vi.mock("solidstart:server-fn-manifest", () => ({
+    default: {
+        fn: {
+            functionName: "fn",
+            importer: async () => ({
+                fn: (...args) => {
+                    serverFn.calls++;
+                    return serverFn.current(...args);
+                }
+            })
+        }
+    }
+}));
+vi.mock("../server/handler", () => ({ getExpectedRedirectStatus: () => 302 }));
+vi.mock("../server/pageEvent", () => ({ createPageEvent: async () => { } }));
+const { default: serverHandler } = await import("./server-handler");
+const handle = toWebHandler(createApp().use(serverHandler));
+const SERVER_URL = "http://localhost:3000/_server";
+function call(init = {}) {
+    const { method = "POST", headers = {}, body, search = "" } = init;
+    return handle(new Request(SERVER_URL + search, {
+        method,
+        headers: { "x-server-id": "fn#fn", "x-server-instance": "server-fn:0", ...headers },
+        body
+    }));
+}
+const responseHeaders = () => getRequestEvent().response.headers;
+beforeEach(() => {
+    serverFn.calls = 0;
+    serverFn.current = () => "result";
+});
+describe("cross-site requests", () => {
+    it("rejects a cross-site POST with 403 before the function runs", async () => {
+        const response = await call({ headers: { "sec-fetch-site": "cross-site" } });
+        expect(response.status).toBe(403);
+        expect(serverFn.calls).toBe(0);
+    });
+    it("rejects a cross-site GET with 403 before the function runs", async () => {
+        const response = await call({
+            method: "GET",
+            headers: { origin: "https://other.example" }
+        });
+        expect(response.status).toBe(403);
+        expect(serverFn.calls).toBe(0);
+    });
+    it("rejects Origin: null without Sec-Fetch-Site", async () => {
+        const response = await call({ headers: { origin: "null" } });
+        expect(response.status).toBe(403);
+        expect(serverFn.calls).toBe(0);
+    });
+    it("rejects before decoding the arguments", async () => {
+        const response = await call({
+            headers: { "sec-fetch-site": "cross-site", "x-serialized": "true" },
+            body: "not json"
+        });
+        expect(response.status).toBe(403);
+    });
+    it("omits the message outside development", async () => {
+        const response = await call({ headers: { "sec-fetch-site": "cross-site" } });
+        expect(await response.text()).toBe("");
+    });
+    it.each([
+        { "sec-fetch-site": "same-origin" },
+        { "sec-fetch-site": "same-site" },
+        { "sec-fetch-site": "none" },
+        { origin: "http://localhost:3000" },
+        {}
+    ])("allows %o", async (headers) => {
+        const response = await call({ headers });
+        expect(response.status).toBe(200);
+        expect(serverFn.calls).toBe(1);
+    });
+});
+describe("Cache-Control", () => {
+    it("defaults a result to no-store", async () => {
+        const response = await call();
+        expect(response.status).toBe(200);
+        expect(response.headers.get("cache-control")).toBe("no-store");
+    });
+    it("defaults a GET result to no-store", async () => {
+        const response = await call({ method: "GET" });
+        expect(serverFn.calls).toBe(1);
+        expect(response.headers.get("cache-control")).toBe("no-store");
+    });
+    it("defaults a thrown error to no-store", async () => {
+        serverFn.current = () => {
+            throw new Error("failed");
+        };
+        const response = await call();
+        expect(response.headers.get("x-error")).toBe("failed");
+        expect(response.headers.get("cache-control")).toBe("no-store");
+    });
+    it("defaults a 403 refusal to no-store", async () => {
+        const response = await call({ headers: { "sec-fetch-site": "cross-site" } });
+        expect(response.headers.get("cache-control")).toBe("no-store");
+    });
+    it("defaults a 404 for an unknown function to no-store", async () => {
+        const response = await call({ headers: { "x-server-id": "missing#fn" } });
+        expect(response.status).toBe(404);
+        expect(response.headers.get("cache-control")).toBe("no-store");
+    });
+    it("defaults an error that escapes the handler to no-store", async () => {
+        const logged = vi.spyOn(console, "error").mockImplementation(() => { });
+        try {
+            const response = await call({ headers: { "x-serialized": "true" }, body: "not json" });
+            expect(response.status).toBe(500);
+            expect(response.headers.get("cache-control")).toBe("no-store");
+        }
+        finally {
+            logged.mockRestore();
+        }
+    });
+    it("defaults a no-JS redirect to no-store", async () => {
+        const form = new FormData();
+        form.append("field", "value");
+        serverFn.current = () => undefined;
+        const response = await call({
+            headers: { "x-server-instance": "", referer: "http://localhost:3000/page" },
+            search: "?id=fn&name=fn",
+            body: form
+        });
+        expect(response.status).toBe(302);
+        expect(response.headers.get("cache-control")).toBe("no-store");
+    });
+    it("keeps a value set on the event's response headers", async () => {
+        serverFn.current = () => {
+            responseHeaders().set("Cache-Control", "max-age=60");
+            return "result";
+        };
+        const response = await call();
+        expect(response.headers.get("cache-control")).toBe("max-age=60");
+    });
+    it("keeps a value appended to the event's response headers without joining the default", async () => {
+        serverFn.current = () => {
+            responseHeaders().append("Cache-Control", "max-age=60");
+            return "result";
+        };
+        const response = await call();
+        expect(response.headers.get("cache-control")).toBe("max-age=60");
+    });
+    it("keeps a value on a returned Response without joining the default", async () => {
+        serverFn.current = () => new Response(null, { headers: { "Cache-Control": "private, max-age=60" } });
+        const response = await call();
+        expect(response.headers.get("cache-control")).toBe("private, max-age=60");
+    });
+    it("keeps a value on a thrown Response", async () => {
+        serverFn.current = () => {
+            throw new Response(null, { status: 400, headers: { "Cache-Control": "max-age=5" } });
+        };
+        const response = await call();
+        expect(response.status).toBe(400);
+        expect(response.headers.get("cache-control")).toBe("max-age=5");
+    });
+    it("defaults a returned Response without its own value to no-store", async () => {
+        serverFn.current = () => new Response(null, { headers: { "x-other": "1" } });
+        const response = await call();
+        expect(response.headers.get("x-other")).toBe("1");
+        expect(response.headers.get("cache-control")).toBe("no-store");
+    });
+    it("keeps a value on a raw Response passthrough", async () => {
+        serverFn.current = () => new Response("raw", { headers: { "X-Content-Raw": "true", "Cache-Control": "max-age=60" } });
+        const response = await call();
+        expect(await response.text()).toBe("raw");
+        expect(response.headers.get("cache-control")).toBe("max-age=60");
+    });
+    it("defaults a raw Response passthrough without its own value to no-store", async () => {
+        serverFn.current = () => new Response("raw", { headers: { "X-Content-Raw": "true" } });
+        const response = await call();
+        expect(response.headers.get("cache-control")).toBe("no-store");
+    });
+    it("does not set a value on a 304 Response", async () => {
+        serverFn.current = () => new Response(null, { status: 304, headers: { "X-Content-Raw": "true" } });
+        const response = await call();
+        expect(response.status).toBe(304);
+        expect(response.headers.has("cache-control")).toBe(false);
+    });
+    it("does not set a value when the function answers 304 on the event", async () => {
+        serverFn.current = () => {
+            getRequestEvent().response.status = 304;
+            return null;
+        };
+        const response = await call();
+        expect(response.status).toBe(304);
+        expect(response.headers.has("cache-control")).toBe(false);
+    });
+});
+describe("serialized arguments", () => {
+    it("answers with an error when an awaited argument is still pending at the end of the body", async () => {
+        serverFn.current = async (arg) => await arg;
+        const outcome = await Promise.race([
+            call({
+                headers: { "x-serialized": "true", "content-type": "text/plain" },
+                body: JSON.stringify({ t: { t: 9, i: 0, a: [{ t: 22, i: 1, s: 2 }], o: 0 }, f: 31, m: [] })
+            }),
+            new Promise(resolve => setTimeout(() => resolve("still waiting"), 200))
+        ]);
+        expect(outcome).not.toBe("still waiting");
+        expect(outcome.headers.get("x-error")).toMatch(/ended unexpectedly/);
+    });
+});

package/dist/runtime/server-runtime.js

@@ -55,13 +55,7 @@ async function fetchServerFunction(base, id, options, args) {
     const contentType = response.headers.get("Content-Type");
     const cloned = response.clone();
     let result;
-    if (contentType && contentType.startsWith("text/plain")) {
-        result = await cloned.text();
-    }
-    else if (contentType && contentType.startsWith("application/json")) {
-        result = await cloned.json();
-    }
-    else if (response.headers.get("x-serialized")) {
+    if (response.headers.get("x-serialized")) {
         if (import.meta.env.SEROVAL_MODE === "js") {
             result = await deserializeJSStream(instance, cloned);
         }
@@ -69,8 +63,14 @@ async function fetchServerFunction(base, id, options, args) {
             result = await deserializeJSONStream(cloned);
         }
     }
-    if (response.headers.has("X-Error")) {
-        throw result;
+    else if (contentType && contentType.startsWith("text/plain")) {
+        result = await cloned.text();
+    }
+    else if (contentType && contentType.startsWith("application/json")) {
+        result = await cloned.json();
+    }
+    if (response.headers.has("X-Error") || response.status >= 500) {
+        throw result ?? new Error(`Server function call failed with status ${response.status}`);
     }
     return result;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/start",
-  "version": "1.3.1",
+  "version": "1.3.5",
   "type": "module",
   "author": "Ryan Carniato",
   "license": "MIT",
@@ -68,8 +68,8 @@
     "error-stack-parser": "^2.1.4",
     "html-to-image": "^1.11.11",
     "radix3": "^1.1.0",
-    "seroval": "^1.5.0",
-    "seroval-plugins": "^1.5.0",
+    "seroval": "^1.6.8",
+    "seroval-plugins": "^1.6.8",
     "shiki": "^1.26.1",
     "source-map-js": "^1.0.2",
     "terracotta": "^1.0.4",