@solidjs/start 2.0.0-rc.4 → 2.0.0-rc.5

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # @solidjs/start
 
+## 2.0.0-rc.5
+
+### Minor Changes
+
+- 4c803e5: Add `serialization.plugins` to configure custom Seroval plugins for server functions.
+
+  Values Seroval has no built-in support for (Mongo's `ObjectId`, Prisma's `Decimal`, `Temporal`, and other custom classes) previously threw when returned from or passed to a server function. Point the new option at a module whose default export is an array of plugins:
+
+  ```ts
+  // vite.config.ts
+  solidStart({
+    serialization: {
+      plugins: "src/seroval-plugins.ts",
+    },
+  });
+  ```
+
+  ```ts
+  // src/seroval-plugins.ts
+  import { createPlugin } from "@solidjs/start/serialization";
+  ```
+
+  The module is bundled into both the client and the server so both ends of a server function agree on the format, so it must not import server-only code. SolidStart's built-in plugins keep precedence. Only server-function and action payloads are affected; the SSR hydration payload is serialized by `solid-js/web`.
+
+  Also adds a `@solidjs/start/serialization` entrypoint re-exporting Seroval's `createPlugin`, `OpaqueReference`, and plugin types, so plugin authors stay on the same Seroval version SolidStart serializes with.
+
+### Patch Changes
+
+- e117d91: Route module ids now end in the source extension, so ecosystem plugins apply inside `src/routes`.
+
+  Route files are imported through an id carrying the picked exports in the query (`routes/api.ts?pick=GET`), which left the id ending in the export name. Plugins whose filter is anchored on the file extension (`/\.[cm]?[jt]sx?$/`, the default for `unplugin-auto-import`, `unplugin-macros` and others) silently skipped every route file. The id now ends with a `lang.<ext>` marker, the same convention Vue SFCs use for `?vue&type=script&lang.ts`. Chunk filenames are unchanged.
+
+- d8f1ea8: Apply the configured `nonce` to the two script tags that were still missing it, so a strict `script-src` CSP no longer needs `unsafe-inline`:
+
+  - The client-side redirect that streaming mode emits after the shell has already flushed (`<script>window.location=...</script>`) now carries the nonce.
+  - The SPA entry script tag now carries the nonce, matching the SSR entry script.
+
+- 27fca88: Fix actions returning `json()` or `reload()` leaving no-JS form submissions stranded on the `/_server` endpoint. These responses carry a value rather than a destination, so the redirect issued for progressive-enhancement submissions had no `Location` header. It now falls back to the submitting page, and the response value is unwrapped into the flash cookie so `useSubmission().result` matches the JS path.
+- 75debc3: Scope the built-in `~` alias to the app package, so files in other workspace packages can map `~` to their own root through an importer-aware plugin such as `vite-tsconfig-paths`. In stylesheets and asset URLs (CSS `@import`, `url()`, `new URL(..., import.meta.url)`) `~` still always means the app root, since Vite resolves those without running plugins.
+
 ## 2.0.0-rc.4
 
 ### Patch Changes

package/dist/config/app-root-alias.d.ts

@@ -0,0 +1,7 @@
+import { type Plugin } from "vite";
+/**
+ * Provides SolidStart's `~` app-root alias without claiming module imports made
+ * by other workspace packages. Those packages may map `~` to their own root
+ * through an importer-aware resolver such as vite-tsconfig-paths.
+ */
+export declare function appRootAlias(projectRoot: string, appRoot: string): Plugin;

package/dist/config/app-root-alias.js

@@ -0,0 +1,58 @@
+import { existsSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { normalizePath } from "vite";
+/**
+ * `~/app.css`, `~/logo.svg`, ... but not `~/lib/api.ts` or `~/components/Counter`.
+ *
+ * CSS `@import`, `url()`, preprocessor imports and `new URL(..., import.meta.url)`
+ * are resolved by internal Vite resolvers that only run the alias plugin, never
+ * user plugins, so those ids can never reach `resolveId` below. Keeping non-module
+ * ids on a plain alias preserves `~` in stylesheets and asset URLs, where it always
+ * means the app root.
+ */
+const NON_MODULE_ID = /^~\/([^?#]*\.(?![cm]?[jt]sx?(?:[?#]|$))[^./?#]+(?:[?#].*)?)$/;
+/**
+ * Provides SolidStart's `~` app-root alias without claiming module imports made
+ * by other workspace packages. Those packages may map `~` to their own root
+ * through an importer-aware resolver such as vite-tsconfig-paths.
+ */
+export function appRootAlias(projectRoot, appRoot) {
+    const appDir = normalizePath(resolve(projectRoot, appRoot));
+    const packageRoots = new Map();
+    /** Nearest directory at or above `directory` that holds a `package.json`. */
+    function packageRoot(directory) {
+        if (!packageRoots.has(directory)) {
+            const parent = dirname(directory);
+            packageRoots.set(directory, existsSync(join(directory, "package.json"))
+                ? directory
+                : parent === directory
+                    ? undefined
+                    : packageRoot(parent));
+        }
+        return packageRoots.get(directory);
+    }
+    const appPackage = packageRoot(appDir);
+    /** True only when the importer demonstrably belongs to another package. */
+    function isForeignImporter(importer) {
+        const file = normalizePath(importer.replace(/[?#].*$/s, ""));
+        if (!isAbsolute(file))
+            return false;
+        const owner = packageRoot(dirname(file));
+        return owner !== undefined && owner !== appPackage;
+    }
+    return {
+        name: "solid-start:app-root-alias",
+        enforce: "pre",
+        config() {
+            return { resolve: { alias: [{ find: NON_MODULE_ID, replacement: `${appDir}/$1` }] } };
+        },
+        async resolveId(id, importer, options) {
+            if (id !== "~" && !id.startsWith("~/"))
+                return null;
+            if (importer && isForeignImporter(importer))
+                return null;
+            const target = join(appDir, id.slice(1));
+            return (await this.resolve(target, importer, { ...options, skipSelf: true })) ?? target;
+        },
+    };
+}

package/dist/config/constants.d.ts

@@ -5,6 +5,7 @@ export declare const VIRTUAL_MODULES: {
     readonly getClientManifest: "solid-start:get-client-manifest";
     readonly getManifest: "solid-start:get-manifest";
     readonly middleware: "solid-start:middleware";
+    readonly serovalPlugins: "solid-start:seroval-plugins";
     readonly serverFnManifest: "solid-start:server-fn-manifest";
     readonly clientEntry: "solid-start:client-entry";
     readonly serverEntry: "solid-start:server-entry";

package/dist/config/constants.js

@@ -5,6 +5,7 @@ export const VIRTUAL_MODULES = {
     getClientManifest: "solid-start:get-client-manifest",
     getManifest: "solid-start:get-manifest",
     middleware: "solid-start:middleware",
+    serovalPlugins: "solid-start:seroval-plugins",
     serverFnManifest: "solid-start:server-fn-manifest",
     clientEntry: "solid-start:client-entry",
     serverEntry: "solid-start:server-entry",

package/dist/config/fs-routes/index.js

@@ -1,6 +1,6 @@
 import { relative } from "node:path";
 import { fileSystemWatcher } from "./fs-watcher.js";
-import { treeShake } from "./tree-shake.js";
+import { toPickId, treeShake } from "./tree-shake.js";
 export const moduleId = "solid-start:routes";
 export function fsRoutes({ routers }) {
     globalThis.ROUTERS = routers;
@@ -24,7 +24,7 @@ export function fsRoutes({ routers }) {
                     if (v === undefined)
                         return undefined;
                     if (k.startsWith("$$")) {
-                        const buildId = `${v.src}?${v.pick.map((p) => `pick=${p}`).join("&")}`;
+                        const buildId = toPickId(v.src, v.pick);
                         /**
                          * @type {{ [key: string]: string }}
                          */
@@ -40,7 +40,7 @@ export function fsRoutes({ routers }) {
                         };
                     }
                     else if (k.startsWith("$")) {
-                        const buildId = `${v.src}?${v.pick.map((p) => `pick=${p}`).join("&")}`;
+                        const buildId = toPickId(v.src, v.pick);
                         return {
                             src: relative(root, buildId),
                             build: isBuild ? `_$() => import('${buildId}')$_` : undefined,

package/dist/config/fs-routes/tree-shake.d.ts

@@ -1,2 +1,29 @@
 import type { Plugin } from "vite";
+/**
+ * Builds the module id used to import a subset of a route file's exports.
+ *
+ * The `pick` list has to live in the query so that the same file can be
+ * instantiated once per export subset (the client picks `default`/`$css`,
+ * the server picks its HTTP handlers). That query would otherwise leave the
+ * id ending in `?pick=GET`, which silently excludes route files from any
+ * plugin whose filter is anchored on the file extension -- a very common
+ * default, e.g. unplugin-macros' `/\.[cm]?[jt]sx?$/`.
+ *
+ * The trailing `lang.<ext>` marker is the same convention Vue SFCs use
+ * (`?vue&type=script&lang.ts`) and puts a real extension back at the end of
+ * the id, so those filters match again.
+ *
+ * @see https://github.com/solidjs/solid-start/issues/1918
+ */
+export declare function toPickId(src: string, pick: string[]): string;
+/**
+ * Rolldown's default chunk name sanitizer, plus a pass that drops the
+ * `?pick=...&lang` tail so route chunks keep the short, stable filenames they
+ * had before the `lang` marker was introduced (`index-<hash>.js`, not
+ * `index.tsx_pick_default_pick__css_lang-<hash>.js`). Client chunk filenames
+ * are public URLs, so this is not purely cosmetic.
+ *
+ * @see https://github.com/rollup/rollup/blob/master/src/utils/sanitizeFileName.ts
+ */
+export declare function sanitizeChunkFileName(name: string): string;
 export declare function treeShake(): Plugin;

package/dist/config/fs-routes/tree-shake.js

@@ -1,7 +1,52 @@
 // All credit for this work goes to the amazing Next.js team.
 // https://github.com/vercel/next.js/blob/canary/packages/next/build/babel/plugins/next-ssg-transform.ts
 // This is adapted to work with routeData functions. It can be run in two modes, one which preserves the routeData and the Component in the same file, and one which creates a
-import { basename } from "pathe";
+import { basename, extname } from "pathe";
+const PICKABLE_EXTENSIONS = ["js", "jsx", "ts", "tsx"];
+/**
+ * Builds the module id used to import a subset of a route file's exports.
+ *
+ * The `pick` list has to live in the query so that the same file can be
+ * instantiated once per export subset (the client picks `default`/`$css`,
+ * the server picks its HTTP handlers). That query would otherwise leave the
+ * id ending in `?pick=GET`, which silently excludes route files from any
+ * plugin whose filter is anchored on the file extension -- a very common
+ * default, e.g. unplugin-macros' `/\.[cm]?[jt]sx?$/`.
+ *
+ * The trailing `lang.<ext>` marker is the same convention Vue SFCs use
+ * (`?vue&type=script&lang.ts`) and puts a real extension back at the end of
+ * the id, so those filters match again.
+ *
+ * @see https://github.com/solidjs/solid-start/issues/1918
+ */
+export function toPickId(src, pick) {
+    const query = pick.map(p => `pick=${p}`).join("&");
+    const ext = extname(src).slice(1);
+    return PICKABLE_EXTENSIONS.includes(ext) ? `${src}?${query}&lang.${ext}` : `${src}?${query}`;
+}
+/**
+ * Matches the tail that {@link toPickId} appends, as it appears in a chunk
+ * name. Rolldown derives a chunk name from the module id by taking the
+ * basename minus its extension, so `index.tsx?pick=default&pick=$css&lang.tsx`
+ * arrives here as `index.tsx?pick=default&pick=$css&lang`.
+ */
+const PICK_CHUNK_NAME_RE = /\.[cm]?[jt]sx?\?pick=[^?]*&lang$/;
+const INVALID_CHAR_RE = /[\u0000-\u001F"#$&*+,:;<=>?[\]^`{|}\u007F]/g;
+const DRIVE_LETTER_RE = /^[a-z]:/i;
+/**
+ * Rolldown's default chunk name sanitizer, plus a pass that drops the
+ * `?pick=...&lang` tail so route chunks keep the short, stable filenames they
+ * had before the `lang` marker was introduced (`index-<hash>.js`, not
+ * `index.tsx_pick_default_pick__css_lang-<hash>.js`). Client chunk filenames
+ * are public URLs, so this is not purely cosmetic.
+ *
+ * @see https://github.com/rollup/rollup/blob/master/src/utils/sanitizeFileName.ts
+ */
+export function sanitizeChunkFileName(name) {
+    const stripped = name.replace(PICK_CHUNK_NAME_RE, "");
+    const driveLetter = DRIVE_LETTER_RE.exec(stripped)?.[0] ?? "";
+    return driveLetter + stripped.slice(driveLetter.length).replace(INVALID_CHAR_RE, "_");
+}
 function treeShakeTransform({ types: t }) {
     function getIdentifier(path) {
         const parentPath = path.parentPath;

package/dist/config/index.d.ts

@@ -86,6 +86,29 @@ export interface SolidStartOptions {
          * @default "json"
          */
         mode?: "js" | "json";
+        /**
+         * Path to a module whose default export is an array of custom Seroval
+         * plugins, used to serialize values Seroval doesn't understand natively
+         * (ORM id types, decimals, `Temporal`, and other custom classes).
+         *
+         * Build plugins with `createPlugin` from `seroval`. The module is bundled
+         * into both the client and the server so that both ends of a server
+         * function agree on the format, so it must not import server-only code.
+         *
+         * SolidStart's built-in plugins take precedence: Seroval uses the first
+         * plugin whose `test()` passes, and these are appended after the built-ins.
+         *
+         * A plugin's `deserialize` rebuilds the value under {@link mode} `"json"`.
+         * `serialize` is only used by `mode: "js"`, where the payload is evaluated
+         * on the client and may therefore reference globals only, not the plugin
+         * module's own imports.
+         *
+         * Only applies to server-function and action payloads. The SSR hydration
+         * payload is serialized by `solid-js/web` and is unaffected.
+         *
+         * @example "src/seroval-plugins.ts"
+         */
+        plugins?: string;
     };
     /**
      * Configures plugin behavior per build environment

package/dist/config/index.js

@@ -3,12 +3,14 @@ import { globSync } from "node:fs";
 import { basename, extname, isAbsolute, join } from "node:path";
 import solid from "vite-plugin-solid";
 import { serverFunctionsPlugin } from "../directives/index.js";
+import { appRootAlias } from "./app-root-alias.js";
 import { boundaryModules } from "./boundary-modules.js";
 import { DEFAULT_EXTENSIONS, VIRTUAL_MODULES, VITE_ENVIRONMENTS } from "./constants.js";
 import { devServer } from "./dev-server.js";
 import { envPlugin } from "./env.js";
 import { SolidStartClientFileRouter, SolidStartServerFileRouter } from "./fs-router.js";
 import { fsRoutes } from "./fs-routes/index.js";
+import { sanitizeChunkFileName, toPickId } from "./fs-routes/tree-shake.js";
 import lazy from "./lazy.js";
 import { manifest } from "./manifest.js";
 import { parseIdQuery } from "./utils.js";
@@ -71,17 +73,23 @@ export function solidStart(options) {
                     for (const route of await clientRouter.getRoutes()) {
                         for (const [key, value] of Object.entries(route)) {
                             if (value && key.startsWith("$") && !key.startsWith("$$")) {
-                                function toRouteId(route) {
-                                    return `${route.src}?${route.pick.map((p) => `pick=${p}`).join("&")}`;
-                                }
-                                clientInput.push(toRouteId(value));
+                                clientInput.push(toPickId(value.src, value.pick));
                             }
                         }
                     }
                 }
                 return {
                     appType: "custom",
-                    build: { assetsDir: "_build/assets" },
+                    build: {
+                        assetsDir: "_build/assets",
+                        rollupOptions: {
+                            output: {
+                                // Keeps route chunks named after their file rather than after
+                                // the `?pick=...` id that addresses them. See toPickId.
+                                sanitizeFileName: sanitizeChunkFileName,
+                            },
+                        },
+                    },
                     optimizeDeps: {
                         // Suppress TS errors from Vite 7 types when configuring Vite 8's Rolldown
                         ...{
@@ -126,7 +134,6 @@ export function solidStart(options) {
                     resolve: {
                         alias: {
                             "@solidjs/start/server/entry": handlers.server,
-                            "~": join(process.cwd(), start.appRoot),
                             ...(!start.ssr
                                 ? {
                                     "@solidjs/start/server": "@solidjs/start/server/spa",
@@ -175,6 +182,7 @@ export function solidStart(options) {
                 };
             },
         },
+        appRootAlias(root, start.appRoot),
         manifest(start),
         fsRoutes({
             routers: {

package/dist/config/manifest.js

@@ -28,6 +28,12 @@ export function manifest(start) {
                     return await this.resolve(start.middleware);
                 return `\0${VIRTUAL_MODULES.middleware}`;
             }
+            if (id === VIRTUAL_MODULES.serovalPlugins) {
+                const plugins = start.serialization?.plugins;
+                if (plugins)
+                    return await this.resolve(plugins);
+                return `\0${VIRTUAL_MODULES.serovalPlugins}`;
+            }
         },
         async load(id) {
             if (id === `\0${VIRTUAL_MODULES.clientViteManifest}`) {
@@ -76,6 +82,8 @@ export function manifest(start) {
             }
             else if (id === `\0${VIRTUAL_MODULES.middleware}`)
                 return "export default {};";
+            else if (id === `\0${VIRTUAL_MODULES.serovalPlugins}`)
+                return "export default [];";
             else if (id.startsWith("/@manifest")) {
                 if (this.environment.mode !== "dev")
                     throw new Error("@manifest queries are only allowed in dev");

package/dist/fns/handler.js

@@ -109,7 +109,7 @@ export async function handleServerFunction(h3Event) {
         }
         // handle no JS success case
         if (!instance)
-            return handleNoJS(result, request, parsed);
+            return await handleNoJS(result, request, parsed);
         const body = getHeadersAndBody(result);
         if (body) {
             return new Response(body.body, {
@@ -146,7 +146,7 @@ export async function handleServerFunction(h3Event) {
             h3Event.res.headers.set("X-Error", toHeaderValue(error));
         }
         else {
-            x = handleNoJS(x, request, parsed, true);
+            x = await handleNoJS(x, request, parsed, true);
         }
         if (instance) {
             const body = getHeadersAndBody(x);
@@ -181,7 +181,20 @@ function toHeaderValue(value) {
         return "true";
     }
 }
-function handleNoJS(result, request, parsed, thrown) {
+function getRefererLocation(request, url) {
+    const referer = request.headers.get("referer");
+    try {
+        if (referer)
+            return new URL(referer).toString();
+    }
+    catch {
+        // fall through to the app root below
+    }
+    // no usable referer (e.g. a no-referrer policy): the app root still beats
+    // leaving the browser sitting on the server function endpoint
+    return new URL(import.meta.env.BASE_URL, url.origin).toString();
+}
+async function handleNoJS(result, request, parsed, thrown) {
     const url = new URL(request.url);
     const isError = result instanceof Error;
     let statusCode = 302;
@@ -192,10 +205,19 @@ function handleNoJS(result, request, parsed, thrown) {
             headers.set(`Location`, new URL(result.headers.get("Location"), url.origin + import.meta.env.BASE_URL).toString());
             statusCode = getExpectedRedirectStatus(result);
         }
+        else {
+            // responses that carry a value rather than a destination (json(), reload())
+            // still have to send the browser back to the page the form came from
+            headers.set("Location", getRefererLocation(request, url));
+        }
+        // the body is dropped from the redirect, so don't advertise its type
+        headers.delete("Content-Type");
+        // mirror the JS path: the flash cookie carries the value, not the Response
+        result = result.customBody ? await result.customBody() : null;
     }
     else
         headers = new Headers({
-            Location: new URL(request.headers.get("referer")).toString(),
+            Location: getRefererLocation(request, url),
         });
     if (result) {
         headers.append("Set-Cookie", `flash=${encodeURIComponent(JSON.stringify({
@@ -203,7 +225,9 @@ function handleNoJS(result, request, parsed, thrown) {
             result: isError ? result.message : result,
             thrown: thrown,
             error: isError,
-            input: [...parsed.slice(0, -1), [...parsed[parsed.length - 1].entries()]],
+            input: parsed.length
+                ? [...parsed.slice(0, -1), [...parsed[parsed.length - 1].entries()]]
+                : [],
         }))}; Secure; HttpOnly;`);
     }
     return new Response(null, {

package/dist/fns/plugins.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Re-exports Seroval's plugin authoring API for use with the
+ * `serialization.plugins` option in `vite.config.ts`.
+ *
+ * Importing from here rather than depending on `seroval` directly keeps plugin
+ * authors on the exact Seroval version SolidStart serializes with. A mismatched
+ * version would not fail the build: it would produce plugin nodes the other end
+ * of the wire can't interpret.
+ *
+ * @see https://github.com/solidjs/solid-start/issues/1474
+ *
+ * @example
+ * ```ts
+ * // src/seroval-plugins.ts
+ * import { createPlugin } from "@solidjs/start/serialization";
+ * import { ObjectId } from "mongodb";
+ *
+ * const ObjectIdPlugin = createPlugin<ObjectId, { hex: any }>({
+ *   tag: "app/ObjectId",
+ *   test: value => value instanceof ObjectId,
+ *   parse: {
+ *     sync: (value, ctx) => ({ hex: ctx.parse(value.toHexString()) }),
+ *     async: async (value, ctx) => ({ hex: await ctx.parse(value.toHexString()) }),
+ *     stream: (value, ctx) => ({ hex: ctx.parse(value.toHexString()) }),
+ *   },
+ *   serialize: (node, ctx) => `globalThis.ObjectId(${ctx.serialize(node.hex)})`,
+ *   deserialize: (node, ctx) => new ObjectId(ctx.deserialize(node.hex) as string),
+ * });
+ *
+ * export default [ObjectIdPlugin];
+ * ```
+ */
+export { createPlugin, OpaqueReference } from "seroval";
+export type { AsyncParsePluginContext, DeserializePluginContext, Plugin, PluginData, PluginInfo, SerializePluginContext, SerovalNode, StreamParsePluginContext, SyncParsePluginContext, } from "seroval";

package/dist/fns/plugins.js

@@ -0,0 +1,33 @@
+/**
+ * Re-exports Seroval's plugin authoring API for use with the
+ * `serialization.plugins` option in `vite.config.ts`.
+ *
+ * Importing from here rather than depending on `seroval` directly keeps plugin
+ * authors on the exact Seroval version SolidStart serializes with. A mismatched
+ * version would not fail the build: it would produce plugin nodes the other end
+ * of the wire can't interpret.
+ *
+ * @see https://github.com/solidjs/solid-start/issues/1474
+ *
+ * @example
+ * ```ts
+ * // src/seroval-plugins.ts
+ * import { createPlugin } from "@solidjs/start/serialization";
+ * import { ObjectId } from "mongodb";
+ *
+ * const ObjectIdPlugin = createPlugin<ObjectId, { hex: any }>({
+ *   tag: "app/ObjectId",
+ *   test: value => value instanceof ObjectId,
+ *   parse: {
+ *     sync: (value, ctx) => ({ hex: ctx.parse(value.toHexString()) }),
+ *     async: async (value, ctx) => ({ hex: await ctx.parse(value.toHexString()) }),
+ *     stream: (value, ctx) => ({ hex: ctx.parse(value.toHexString()) }),
+ *   },
+ *   serialize: (node, ctx) => `globalThis.ObjectId(${ctx.serialize(node.hex)})`,
+ *   deserialize: (node, ctx) => new ObjectId(ctx.deserialize(node.hex) as string),
+ * });
+ *
+ * export default [ObjectIdPlugin];
+ * ```
+ */
+export { createPlugin, OpaqueReference } from "seroval";

package/dist/fns/serialization.js

@@ -1,6 +1,6 @@
 import { crossSerializeStream, deserialize, Feature, fromCrossJSON, getCrossReferenceHeader, toCrossJSONStream, } from "seroval";
 import { AbortSignalPlugin, CustomEventPlugin, DOMExceptionPlugin, EventPlugin, FormDataPlugin, HeadersPlugin, ReadableStreamPlugin, RequestPlugin, ResponsePlugin, URLPlugin, URLSearchParamsPlugin, } from "seroval-plugins/web";
-// TODO(Alexis): if we can, allow providing an option to extend these.
+import userPlugins from "solid-start:seroval-plugins";
 const DEFAULT_PLUGINS = [
     AbortSignalPlugin,
     CustomEventPlugin,
@@ -14,6 +14,16 @@ const DEFAULT_PLUGINS = [
     URLSearchParamsPlugin,
     URLPlugin,
 ];
+/**
+ * Plugins from `serialization.plugins` are appended rather than prepended:
+ * seroval picks the first plugin whose `test()` passes, so the built-ins win
+ * and a loose user `test()` can't take over `Request`/`FormData`/`URL`.
+ *
+ * The same list has to be used on both ends of a server function, which is why
+ * this comes from a virtual module bundled into the client and the server
+ * rather than a runtime option.
+ */
+const PLUGINS = [...DEFAULT_PLUGINS, ...userPlugins];
 const MAX_SERIALIZATION_DEPTH_LIMIT = 64;
 const DISABLED_FEATURES = Feature.RegExp;
 /**
@@ -67,7 +77,7 @@ export function serializeToJSStream(id, value) {
             crossSerializeStream(value, {
                 scopeId: id,
                 disabledFeatures: JS_SERIALIZE_DISABLED_FEATURES,
-                plugins: DEFAULT_PLUGINS,
+                plugins: PLUGINS,
                 onSerialize(data, initial) {
                     controller.enqueue(createChunk(initial ? `(${getCrossReferenceHeader(id)},${data})` : data));
                 },
@@ -87,7 +97,7 @@ export function serializeToJSONStream(value) {
             toCrossJSONStream(value, {
                 disabledFeatures: SERIALIZE_DISABLED_FEATURES,
                 depthLimit: MAX_SERIALIZATION_DEPTH_LIMIT,
-                plugins: DEFAULT_PLUGINS,
+                plugins: PLUGINS,
                 onParse(node) {
                     controller.enqueue(createChunk(JSON.stringify(node)));
                 },
@@ -200,7 +210,7 @@ export async function deserializeJSONStream(response) {
                 refs,
                 disabledFeatures: DISABLED_FEATURES,
                 depthLimit: MAX_SERIALIZATION_DEPTH_LIMIT,
-                plugins: DEFAULT_PLUGINS,
+                plugins: PLUGINS,
             });
             return value;
         }

package/dist/server/handler.js

@@ -171,9 +171,17 @@ function handleStreamCompleteRedirect(context) {
     return ({ write }) => {
         context.complete = true;
         const to = context.response && context.response.headers.get("Location");
-        to && write(`<script>window.location=${JSON.stringify(to).replace(/</g, "\\u003c")}</script>`);
+        if (!to)
+            return;
+        // The shell has already flushed, so the redirect has to happen client side.
+        // Carry the nonce so a strict `script-src` CSP doesn't block it.
+        const nonce = context.nonce ? ` nonce="${escapeAttribute(context.nonce)}"` : "";
+        write(`<script${nonce}>window.location=${JSON.stringify(to).replace(/</g, "\\u003c")}</script>`);
     };
 }
+function escapeAttribute(value) {
+    return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+}
 function stripBaseUrl(path) {
     const base = import.meta.env.SERVER_BASE_URL || import.meta.env.BASE_URL || "/";
     return stripPathBase(path, base);

package/dist/server/spa/StartServer.jsx

@@ -18,7 +18,7 @@ export function StartServer(props) {
       <TopErrorBoundary>
         <props.document scripts={<>
               <PatchVirtualDevStyles nonce={nonce}/>
-              <script type="module" src={getSsrManifest("client").path(import.meta.env.START_CLIENT_ENTRY_URL)}/>
+              <script type="module" nonce={nonce} src={getSsrManifest("client").path(import.meta.env.START_CLIENT_ENTRY_URL)}/>
             </>}/>
       </TopErrorBoundary>
     </NoHydration>);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/start",
-  "version": "2.0.0-rc.4",
+  "version": "2.0.0-rc.5",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/solidjs/solid-start.git",
@@ -24,7 +24,8 @@
     "./http": "./dist/http/index.js",
     "./env": "./env.d.ts",
     "./fns/server": "./dist/fns/server.js",
-    "./fns/client": "./dist/fns/client.js"
+    "./fns/client": "./dist/fns/client.js",
+    "./serialization": "./dist/fns/plugins.js"
   },
   "publishConfig": {
     "access": "public"