@solidjs/start 2.0.0-beta.9 → 2.0.0-rc.10

package/CHANGELOG.md

@@ -1,5 +1,154 @@
 # @solidjs/start
 
+## 2.0.0-rc.10
+
+### Minor Changes
+
+- 3f2b7a7: The file filter logic used for CSS crawling in development can now be configured with the vite plugin option `css.filter` analog to `serverFunctions.filter`:
+
+  ```ts
+  solidStart({
+    css: {
+      filter: {
+        // Exclude all node_modules except "my-dependency" with a flat node_modules layout
+        exclude: "node_modules/!(my-dependency)/**/*",
+      },
+    },
+  });
+  ```
+
+### Patch Changes
+
+- 6581877: Fixed shared chunk css not being server rendered in production (Vite 8 regression).
+- 37d4488: Migrate the built-in Vite configuration from the deprecated `rollupOptions` alias to `rolldownOptions`.
+- 3f2b7a7: Fixed css from files with url sensitive characters such as `+` not being server-rendered.
+
+## 2.0.0-rc.9
+
+### Patch Changes
+
+- 8eef552: Remove type-only import remnants from client server-function transforms so they do not retain server-only dependency chains.
+
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 3573985: Await asynchronous `serverFunctions.onError` handlers before serializing server function errors.
+  Preserve the original error if the handler throws or rejects.
+
+## 2.0.0-rc.7
+
+### Patch Changes
+
+- 87d73e1: chore: bump seroval to v1.6.0
+
+## 2.0.0-rc.6
+
+### Minor Changes
+
+- bac24b2: Add a `serverFunctions.onError` option naming a module that observes and replaces what a server function threw, before it is serialized into the response
+
+### Patch Changes
+
+- 27c2877: Remove leftover debug `console.log` calls from the server functions inspector, which logged on every server function request in dev.
+- f15724b: Declare `@solidjs/router` as an optional peer dependency constrained to `>=0.16.0 <2.0.0-0`. Router v2 is expected to target Solid v2, so installing it alongside `@solidjs/start` v2 now surfaces a peer warning instead of silently producing an incompatible pairing. The peer is marked optional, so apps that do not use the router are unaffected.
+- 5c8612f: Apply cookies set on a returned or thrown response during single flight mutations. `redirect(to, { headers: { "Set-Cookie": ... } })` previously only reached the browser: the single flight re-render of the redirect target still ran with the old request cookies, so queries reading that cookie saw stale values. Those cookies are now merged into the request the re-render sees, matching what a browser round trip would have sent.
+- 83122ed: Reject server function calls when the response is a 5xx without an X-Error header, instead of resolving with the parsed error body
+
+## 2.0.0-rc.5
+
+### Minor Changes
+
+- 4c803e5: Add `serialization.plugins` to configure custom Seroval plugins for server functions.
+
+  Values Seroval has no built-in support for (Mongo's `ObjectId`, Prisma's `Decimal`, `Temporal`, and other custom classes) previously threw when returned from or passed to a server function. Point the new option at a module whose default export is an array of plugins:
+
+  ```ts
+  // vite.config.ts
+  solidStart({
+    serialization: {
+      plugins: "src/seroval-plugins.ts",
+    },
+  });
+  ```
+
+  ```ts
+  // src/seroval-plugins.ts
+  import { createPlugin } from "@solidjs/start/serialization";
+  ```
+
+  The module is bundled into both the client and the server so both ends of a server function agree on the format, so it must not import server-only code. SolidStart's built-in plugins keep precedence. Only server-function and action payloads are affected; the SSR hydration payload is serialized by `solid-js/web`.
+
+  Also adds a `@solidjs/start/serialization` entrypoint re-exporting Seroval's `createPlugin`, `OpaqueReference`, and plugin types, so plugin authors stay on the same Seroval version SolidStart serializes with.
+
+### Patch Changes
+
+- e117d91: Route module ids now end in the source extension, so ecosystem plugins apply inside `src/routes`.
+
+  Route files are imported through an id carrying the picked exports in the query (`routes/api.ts?pick=GET`), which left the id ending in the export name. Plugins whose filter is anchored on the file extension (`/\.[cm]?[jt]sx?$/`, the default for `unplugin-auto-import`, `unplugin-macros` and others) silently skipped every route file. The id now ends with a `lang.<ext>` marker, the same convention Vue SFCs use for `?vue&type=script&lang.ts`. Chunk filenames are unchanged.
+
+- d8f1ea8: Apply the configured `nonce` to the two script tags that were still missing it, so a strict `script-src` CSP no longer needs `unsafe-inline`:
+  - The client-side redirect that streaming mode emits after the shell has already flushed (`<script>window.location=...</script>`) now carries the nonce.
+  - The SPA entry script tag now carries the nonce, matching the SSR entry script.
+
+- 27fca88: Fix actions returning `json()` or `reload()` leaving no-JS form submissions stranded on the `/_server` endpoint. These responses carry a value rather than a destination, so the redirect issued for progressive-enhancement submissions had no `Location` header. It now falls back to the submitting page, and the response value is unwrapped into the flash cookie so `useSubmission().result` matches the JS path.
+- 75debc3: Scope the built-in `~` alias to the app package, so files in other workspace packages can map `~` to their own root through an importer-aware plugin such as `vite-tsconfig-paths`. In stylesheets and asset URLs (CSS `@import`, `url()`, `new URL(..., import.meta.url)`) `~` still always means the app root, since Vite resolves those without running plugins.
+
+## 2.0.0-rc.4
+
+### Patch Changes
+
+- b6dfaac: Updated dependencies, including `cookie-es` to 3, `shiki` to 4, `srvx` to 0.12.4, `oxc-parser` to 0.141 and `seroval` to 1.5.6. `parseSetCookie` now returns `undefined` for cookies with a forbidden name or an empty name and value, and those cookies are no longer forwarded to nested server function requests.
+- 02cd41e: Stop the dev toolbar from reporting benign `ResizeObserver loop` notifications as application errors. Browsers dispatch these as window `error` events carrying no error object, so the toolbar was capturing the raw `ErrorEvent` and force-opening the error panel over the app on every resize.
+- d3c2af2: Don't send server error stack traces to the client in production builds. When a server function throws, the error is serialized and rethrown on the client, and seroval included `Error.prototype.stack` by default, leaking server file paths and internal function names. Stacks are still serialized in development.
+
+## 2.0.0-rc.3
+
+### Patch Changes
+
+- d9018d6: fix(types): add missing properties to `SolidStartOptions` and expose them via Vite plugin configuration
+- e26cef0: Fix TS2883/TS2742 when emitting declarations for `entry-server.tsx`. `createHandler` now returns `StartHandler`, a type owned by `@solidjs/start`, instead of h3's `H3`, so the inferred type of `export default createHandler(...)` no longer has to be named through a nested `node_modules/@solidjs/start/node_modules/h3` path.
+- 7c8dbe6: keep TypeScript namespace members in route files during production builds
+- b3c7aaf: Update `h3` to `2.0.1-rc.26`.
+- b3c7aaf: Fixed event response status and headers set during server-side rendering with deferred async resources, not being applied on the outgoing response.
+
+## 2.0.0-rc.2
+
+### Minor Changes
+
+- eeff49a: add new dev toolbar
+
+### Patch Changes
+
+- bd8cb01: Update srvx to version 0.12.0.
+- 4e98ac0: Restore the optional `routerLoad` third argument to `createHandler`, which primes custom routers (e.g. TanStack Router) on the server before SSR rendering. It was accidentally dropped in the v2 rewrite.
+
+## 2.0.0-rc.1
+
+### Minor Changes
+
+- 02e561e: Expose experimental `decorateHandler` and `decorateMiddleware` helpers from
+  `@solidjs/start/server` for providing Solid's request context to custom h3 handlers and
+  middleware.
+
+### Patch Changes
+
+- f66b5a9: fix: keep non-picked route exports that picked exports reference instead of deleting their bindings, so API handlers can call helpers exported from the same file (#2100); also fixes picked exports declared via `export { ... }` specifiers being dropped (#1659)
+- 1763296: fix: run `onBeforeResponse` middleware in declared order (#2131)
+
+  Applications that reversed their `onBeforeResponse` arrays as a workaround should restore the intended declaration order.
+
+- cd98e7d: Fix API route matching when `server.baseURL` is configured.
+
+## 2.0.0-beta.10
+
+### Patch Changes
+
+- 8af6304: Support for Vite 8.1 Experimental Bundled Dev Mode
+- 9d91484: fix: don't crash when a server function throws an error whose message contains non-latin1 characters.
+- 068b64c: Return a cancellation-safe web `ReadableStream` for streaming SSR in development. Returning Solid's
+  raw stream only rendered on Node; Bun and Deno coerced it to `[object Object]`.
+
 ## 2.0.0-beta.9
 
 ### Minor Changes
@@ -118,7 +267,6 @@
 - 8256190: Rework `@solidjs/start/env`
 - 6cbba24: Fix multiple Set-Cookie headers being lost on redirect responses
 - d4cc548: ## Bump Seroval
-
   - version `1.4.1`
 
 - dd40610: Handle base url in api routes

package/dist/config/app-root-alias.d.ts

@@ -0,0 +1,7 @@
+import { type Plugin } from "vite";
+/**
+ * Provides SolidStart's `~` app-root alias without claiming module imports made
+ * by other workspace packages. Those packages may map `~` to their own root
+ * through an importer-aware resolver such as vite-tsconfig-paths.
+ */
+export declare function appRootAlias(projectRoot: string, appRoot: string): Plugin;

package/dist/config/app-root-alias.js

@@ -0,0 +1,58 @@
+import { existsSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { normalizePath } from "vite";
+/**
+ * `~/app.css`, `~/logo.svg`, ... but not `~/lib/api.ts` or `~/components/Counter`.
+ *
+ * CSS `@import`, `url()`, preprocessor imports and `new URL(..., import.meta.url)`
+ * are resolved by internal Vite resolvers that only run the alias plugin, never
+ * user plugins, so those ids can never reach `resolveId` below. Keeping non-module
+ * ids on a plain alias preserves `~` in stylesheets and asset URLs, where it always
+ * means the app root.
+ */
+const NON_MODULE_ID = /^~\/([^?#]*\.(?![cm]?[jt]sx?(?:[?#]|$))[^./?#]+(?:[?#].*)?)$/;
+/**
+ * Provides SolidStart's `~` app-root alias without claiming module imports made
+ * by other workspace packages. Those packages may map `~` to their own root
+ * through an importer-aware resolver such as vite-tsconfig-paths.
+ */
+export function appRootAlias(projectRoot, appRoot) {
+    const appDir = normalizePath(resolve(projectRoot, appRoot));
+    const packageRoots = new Map();
+    /** Nearest directory at or above `directory` that holds a `package.json`. */
+    function packageRoot(directory) {
+        if (!packageRoots.has(directory)) {
+            const parent = dirname(directory);
+            packageRoots.set(directory, existsSync(join(directory, "package.json"))
+                ? directory
+                : parent === directory
+                    ? undefined
+                    : packageRoot(parent));
+        }
+        return packageRoots.get(directory);
+    }
+    const appPackage = packageRoot(appDir);
+    /** True only when the importer demonstrably belongs to another package. */
+    function isForeignImporter(importer) {
+        const file = normalizePath(importer.replace(/[?#].*$/s, ""));
+        if (!isAbsolute(file))
+            return false;
+        const owner = packageRoot(dirname(file));
+        return owner !== undefined && owner !== appPackage;
+    }
+    return {
+        name: "solid-start:app-root-alias",
+        enforce: "pre",
+        config() {
+            return { resolve: { alias: [{ find: NON_MODULE_ID, replacement: `${appDir}/$1` }] } };
+        },
+        async resolveId(id, importer, options) {
+            if (id !== "~" && !id.startsWith("~/"))
+                return null;
+            if (importer && isForeignImporter(importer))
+                return null;
+            const target = join(appDir, id.slice(1));
+            return (await this.resolve(target, importer, { ...options, skipSelf: true })) ?? target;
+        },
+    };
+}

package/dist/config/constants.d.ts

@@ -5,7 +5,9 @@ export declare const VIRTUAL_MODULES: {
     readonly getClientManifest: "solid-start:get-client-manifest";
     readonly getManifest: "solid-start:get-manifest";
     readonly middleware: "solid-start:middleware";
+    readonly serovalPlugins: "solid-start:seroval-plugins";
     readonly serverFnManifest: "solid-start:server-fn-manifest";
+    readonly serverFnErrorHandler: "solid-start:server-fn-error-handler";
     readonly clientEntry: "solid-start:client-entry";
     readonly serverEntry: "solid-start:server-entry";
     readonly app: "solid-start:app";

package/dist/config/constants.js

@@ -5,7 +5,9 @@ export const VIRTUAL_MODULES = {
     getClientManifest: "solid-start:get-client-manifest",
     getManifest: "solid-start:get-manifest",
     middleware: "solid-start:middleware",
+    serovalPlugins: "solid-start:seroval-plugins",
     serverFnManifest: "solid-start:server-fn-manifest",
+    serverFnErrorHandler: "solid-start:server-fn-error-handler",
     clientEntry: "solid-start:client-entry",
     serverEntry: "solid-start:server-entry",
     app: "solid-start:app",

package/dist/config/env.js

@@ -1,4 +1,5 @@
 import { loadEnv } from "vite";
+import { parseIdQuery } from "./utils.js";
 const LOADERS = {
     node: `export default key => process.env[key];`,
     "cloudflare-workers": `import { env } from 'cloudflare:workers';export default key => env[key];`,
@@ -39,38 +40,40 @@ export function envPlugin(options) {
             env = config.mode !== "production" ? "development" : "production";
         },
         resolveId(id) {
-            if (id === SERVER_ENV ||
-                id === CLIENT_ENV ||
-                id === SERVER_RUNTIME_ENV ||
-                id === SERVER_RUNTIME_LOADER) {
+            const { filename } = parseIdQuery(id);
+            if (filename === SERVER_ENV ||
+                filename === CLIENT_ENV ||
+                filename === SERVER_RUNTIME_ENV ||
+                filename === SERVER_RUNTIME_LOADER) {
                 return id;
             }
             return undefined;
         },
         load(id) {
+            const { filename } = parseIdQuery(id);
             const isServer = this.environment.config.consumer === "server";
-            if (id === SERVER_ENV) {
+            if (filename === SERVER_ENV) {
                 if (!isServer) {
                     return SERVER_ONLY_MODULE;
                 }
                 const vars = currentOptions.server?.load
                     ? currentOptions.server.load(env)
-                    : loadEnv(env, '.', serverPrefix);
+                    : loadEnv(env, ".", serverPrefix);
                 return convertObjectToModule(vars);
             }
-            if (id === CLIENT_ENV) {
+            if (filename === CLIENT_ENV) {
                 const vars = currentOptions.client?.load
                     ? currentOptions.client.load(env)
-                    : loadEnv(env, '.', clientPrefix);
+                    : loadEnv(env, ".", clientPrefix);
                 return convertObjectToModule(vars);
             }
-            if (id === SERVER_RUNTIME_LOADER) {
+            if (filename === SERVER_RUNTIME_LOADER) {
                 if (!isServer) {
                     return SERVER_ONLY_MODULE;
                 }
                 return runtimeCode;
             }
-            if (id === SERVER_RUNTIME_ENV) {
+            if (filename === SERVER_RUNTIME_ENV) {
                 if (!isServer) {
                     return SERVER_ONLY_MODULE;
                 }

package/dist/config/fs-routes/index.js

@@ -1,6 +1,6 @@
 import { relative } from "node:path";
 import { fileSystemWatcher } from "./fs-watcher.js";
-import { treeShake } from "./tree-shake.js";
+import { toPickId, treeShake } from "./tree-shake.js";
 export const moduleId = "solid-start:routes";
 export function fsRoutes({ routers }) {
     globalThis.ROUTERS = routers;
@@ -24,7 +24,7 @@ export function fsRoutes({ routers }) {
                     if (v === undefined)
                         return undefined;
                     if (k.startsWith("$$")) {
-                        const buildId = `${v.src}?${v.pick.map((p) => `pick=${p}`).join("&")}`;
+                        const buildId = toPickId(v.src, v.pick);
                         /**
                          * @type {{ [key: string]: string }}
                          */
@@ -40,7 +40,7 @@ export function fsRoutes({ routers }) {
                         };
                     }
                     else if (k.startsWith("$")) {
-                        const buildId = `${v.src}?${v.pick.map((p) => `pick=${p}`).join("&")}`;
+                        const buildId = toPickId(v.src, v.pick);
                         return {
                             src: relative(root, buildId),
                             build: isBuild ? `_$() => import('${buildId}')$_` : undefined,

package/dist/config/fs-routes/tree-shake.d.ts

@@ -1,2 +1,29 @@
 import type { Plugin } from "vite";
+/**
+ * Builds the module id used to import a subset of a route file's exports.
+ *
+ * The `pick` list has to live in the query so that the same file can be
+ * instantiated once per export subset (the client picks `default`/`$css`,
+ * the server picks its HTTP handlers). That query would otherwise leave the
+ * id ending in `?pick=GET`, which silently excludes route files from any
+ * plugin whose filter is anchored on the file extension -- a very common
+ * default, e.g. unplugin-macros' `/\.[cm]?[jt]sx?$/`.
+ *
+ * The trailing `lang.<ext>` marker is the same convention Vue SFCs use
+ * (`?vue&type=script&lang.ts`) and puts a real extension back at the end of
+ * the id, so those filters match again.
+ *
+ * @see https://github.com/solidjs/solid-start/issues/1918
+ */
+export declare function toPickId(src: string, pick: string[]): string;
+/**
+ * Rolldown's default chunk name sanitizer, plus a pass that drops the
+ * `?pick=...&lang` tail so route chunks keep the short, stable filenames they
+ * had before the `lang` marker was introduced (`index-<hash>.js`, not
+ * `index.tsx_pick_default_pick__css_lang-<hash>.js`). Client chunk filenames
+ * are public URLs, so this is not purely cosmetic.
+ *
+ * @see https://github.com/rollup/rollup/blob/master/src/utils/sanitizeFileName.ts
+ */
+export declare function sanitizeChunkFileName(name: string): string;
 export declare function treeShake(): Plugin;