@solidjs/start 2.0.0-rc.4 → 2.0.0-rc.6

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # @solidjs/start
 
+## 2.0.0-rc.6
+
+### Minor Changes
+
+- bac24b2: Add a `serverFunctions.onError` option naming a module that observes and replaces what a server function threw, before it is serialized into the response
+
+### Patch Changes
+
+- 27c2877: Remove leftover debug `console.log` calls from the server functions inspector, which logged on every server function request in dev.
+- f15724b: Declare `@solidjs/router` as an optional peer dependency constrained to `>=0.16.0 <2.0.0-0`. Router v2 is expected to target Solid v2, so installing it alongside `@solidjs/start` v2 now surfaces a peer warning instead of silently producing an incompatible pairing. The peer is marked optional, so apps that do not use the router are unaffected.
+- 5c8612f: Apply cookies set on a returned or thrown response during single flight mutations. `redirect(to, { headers: { "Set-Cookie": ... } })` previously only reached the browser: the single flight re-render of the redirect target still ran with the old request cookies, so queries reading that cookie saw stale values. Those cookies are now merged into the request the re-render sees, matching what a browser round trip would have sent.
+- 83122ed: Reject server function calls when the response is a 5xx without an X-Error header, instead of resolving with the parsed error body
+
+## 2.0.0-rc.5
+
+### Minor Changes
+
+- 4c803e5: Add `serialization.plugins` to configure custom Seroval plugins for server functions.
+
+  Values Seroval has no built-in support for (Mongo's `ObjectId`, Prisma's `Decimal`, `Temporal`, and other custom classes) previously threw when returned from or passed to a server function. Point the new option at a module whose default export is an array of plugins:
+
+  ```ts
+  // vite.config.ts
+  solidStart({
+    serialization: {
+      plugins: "src/seroval-plugins.ts",
+    },
+  });
+  ```
+
+  ```ts
+  // src/seroval-plugins.ts
+  import { createPlugin } from "@solidjs/start/serialization";
+  ```
+
+  The module is bundled into both the client and the server so both ends of a server function agree on the format, so it must not import server-only code. SolidStart's built-in plugins keep precedence. Only server-function and action payloads are affected; the SSR hydration payload is serialized by `solid-js/web`.
+
+  Also adds a `@solidjs/start/serialization` entrypoint re-exporting Seroval's `createPlugin`, `OpaqueReference`, and plugin types, so plugin authors stay on the same Seroval version SolidStart serializes with.
+
+### Patch Changes
+
+- e117d91: Route module ids now end in the source extension, so ecosystem plugins apply inside `src/routes`.
+
+  Route files are imported through an id carrying the picked exports in the query (`routes/api.ts?pick=GET`), which left the id ending in the export name. Plugins whose filter is anchored on the file extension (`/\.[cm]?[jt]sx?$/`, the default for `unplugin-auto-import`, `unplugin-macros` and others) silently skipped every route file. The id now ends with a `lang.<ext>` marker, the same convention Vue SFCs use for `?vue&type=script&lang.ts`. Chunk filenames are unchanged.
+
+- d8f1ea8: Apply the configured `nonce` to the two script tags that were still missing it, so a strict `script-src` CSP no longer needs `unsafe-inline`:
+
+  - The client-side redirect that streaming mode emits after the shell has already flushed (`<script>window.location=...</script>`) now carries the nonce.
+  - The SPA entry script tag now carries the nonce, matching the SSR entry script.
+
+- 27fca88: Fix actions returning `json()` or `reload()` leaving no-JS form submissions stranded on the `/_server` endpoint. These responses carry a value rather than a destination, so the redirect issued for progressive-enhancement submissions had no `Location` header. It now falls back to the submitting page, and the response value is unwrapped into the flash cookie so `useSubmission().result` matches the JS path.
+- 75debc3: Scope the built-in `~` alias to the app package, so files in other workspace packages can map `~` to their own root through an importer-aware plugin such as `vite-tsconfig-paths`. In stylesheets and asset URLs (CSS `@import`, `url()`, `new URL(..., import.meta.url)`) `~` still always means the app root, since Vite resolves those without running plugins.
+
 ## 2.0.0-rc.4
 
 ### Patch Changes

package/dist/config/app-root-alias.d.ts

@@ -0,0 +1,7 @@
+import { type Plugin } from "vite";
+/**
+ * Provides SolidStart's `~` app-root alias without claiming module imports made
+ * by other workspace packages. Those packages may map `~` to their own root
+ * through an importer-aware resolver such as vite-tsconfig-paths.
+ */
+export declare function appRootAlias(projectRoot: string, appRoot: string): Plugin;

package/dist/config/app-root-alias.js

@@ -0,0 +1,58 @@
+import { existsSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { normalizePath } from "vite";
+/**
+ * `~/app.css`, `~/logo.svg`, ... but not `~/lib/api.ts` or `~/components/Counter`.
+ *
+ * CSS `@import`, `url()`, preprocessor imports and `new URL(..., import.meta.url)`
+ * are resolved by internal Vite resolvers that only run the alias plugin, never
+ * user plugins, so those ids can never reach `resolveId` below. Keeping non-module
+ * ids on a plain alias preserves `~` in stylesheets and asset URLs, where it always
+ * means the app root.
+ */
+const NON_MODULE_ID = /^~\/([^?#]*\.(?![cm]?[jt]sx?(?:[?#]|$))[^./?#]+(?:[?#].*)?)$/;
+/**
+ * Provides SolidStart's `~` app-root alias without claiming module imports made
+ * by other workspace packages. Those packages may map `~` to their own root
+ * through an importer-aware resolver such as vite-tsconfig-paths.
+ */
+export function appRootAlias(projectRoot, appRoot) {
+    const appDir = normalizePath(resolve(projectRoot, appRoot));
+    const packageRoots = new Map();
+    /** Nearest directory at or above `directory` that holds a `package.json`. */
+    function packageRoot(directory) {
+        if (!packageRoots.has(directory)) {
+            const parent = dirname(directory);
+            packageRoots.set(directory, existsSync(join(directory, "package.json"))
+                ? directory
+                : parent === directory
+                    ? undefined
+                    : packageRoot(parent));
+        }
+        return packageRoots.get(directory);
+    }
+    const appPackage = packageRoot(appDir);
+    /** True only when the importer demonstrably belongs to another package. */
+    function isForeignImporter(importer) {
+        const file = normalizePath(importer.replace(/[?#].*$/s, ""));
+        if (!isAbsolute(file))
+            return false;
+        const owner = packageRoot(dirname(file));
+        return owner !== undefined && owner !== appPackage;
+    }
+    return {
+        name: "solid-start:app-root-alias",
+        enforce: "pre",
+        config() {
+            return { resolve: { alias: [{ find: NON_MODULE_ID, replacement: `${appDir}/$1` }] } };
+        },
+        async resolveId(id, importer, options) {
+            if (id !== "~" && !id.startsWith("~/"))
+                return null;
+            if (importer && isForeignImporter(importer))
+                return null;
+            const target = join(appDir, id.slice(1));
+            return (await this.resolve(target, importer, { ...options, skipSelf: true })) ?? target;
+        },
+    };
+}

package/dist/config/constants.d.ts

@@ -5,7 +5,9 @@ export declare const VIRTUAL_MODULES: {
     readonly getClientManifest: "solid-start:get-client-manifest";
     readonly getManifest: "solid-start:get-manifest";
     readonly middleware: "solid-start:middleware";
+    readonly serovalPlugins: "solid-start:seroval-plugins";
     readonly serverFnManifest: "solid-start:server-fn-manifest";
+    readonly serverFnErrorHandler: "solid-start:server-fn-error-handler";
     readonly clientEntry: "solid-start:client-entry";
     readonly serverEntry: "solid-start:server-entry";
     readonly app: "solid-start:app";

package/dist/config/constants.js

@@ -5,7 +5,9 @@ export const VIRTUAL_MODULES = {
     getClientManifest: "solid-start:get-client-manifest",
     getManifest: "solid-start:get-manifest",
     middleware: "solid-start:middleware",
+    serovalPlugins: "solid-start:seroval-plugins",
     serverFnManifest: "solid-start:server-fn-manifest",
+    serverFnErrorHandler: "solid-start:server-fn-error-handler",
     clientEntry: "solid-start:client-entry",
     serverEntry: "solid-start:server-entry",
     app: "solid-start:app",

package/dist/config/fs-routes/index.js

@@ -1,6 +1,6 @@
 import { relative } from "node:path";
 import { fileSystemWatcher } from "./fs-watcher.js";
-import { treeShake } from "./tree-shake.js";
+import { toPickId, treeShake } from "./tree-shake.js";
 export const moduleId = "solid-start:routes";
 export function fsRoutes({ routers }) {
     globalThis.ROUTERS = routers;
@@ -24,7 +24,7 @@ export function fsRoutes({ routers }) {
                     if (v === undefined)
                         return undefined;
                     if (k.startsWith("$$")) {
-                        const buildId = `${v.src}?${v.pick.map((p) => `pick=${p}`).join("&")}`;
+                        const buildId = toPickId(v.src, v.pick);
                         /**
                          * @type {{ [key: string]: string }}
                          */
@@ -40,7 +40,7 @@ export function fsRoutes({ routers }) {
                         };
                     }
                     else if (k.startsWith("$")) {
-                        const buildId = `${v.src}?${v.pick.map((p) => `pick=${p}`).join("&")}`;
+                        const buildId = toPickId(v.src, v.pick);
                         return {
                             src: relative(root, buildId),
                             build: isBuild ? `_$() => import('${buildId}')$_` : undefined,

package/dist/config/fs-routes/tree-shake.d.ts

@@ -1,2 +1,29 @@
 import type { Plugin } from "vite";
+/**
+ * Builds the module id used to import a subset of a route file's exports.
+ *
+ * The `pick` list has to live in the query so that the same file can be
+ * instantiated once per export subset (the client picks `default`/`$css`,
+ * the server picks its HTTP handlers). That query would otherwise leave the
+ * id ending in `?pick=GET`, which silently excludes route files from any
+ * plugin whose filter is anchored on the file extension -- a very common
+ * default, e.g. unplugin-macros' `/\.[cm]?[jt]sx?$/`.
+ *
+ * The trailing `lang.<ext>` marker is the same convention Vue SFCs use
+ * (`?vue&type=script&lang.ts`) and puts a real extension back at the end of
+ * the id, so those filters match again.
+ *
+ * @see https://github.com/solidjs/solid-start/issues/1918
+ */
+export declare function toPickId(src: string, pick: string[]): string;
+/**
+ * Rolldown's default chunk name sanitizer, plus a pass that drops the
+ * `?pick=...&lang` tail so route chunks keep the short, stable filenames they
+ * had before the `lang` marker was introduced (`index-<hash>.js`, not
+ * `index.tsx_pick_default_pick__css_lang-<hash>.js`). Client chunk filenames
+ * are public URLs, so this is not purely cosmetic.
+ *
+ * @see https://github.com/rollup/rollup/blob/master/src/utils/sanitizeFileName.ts
+ */
+export declare function sanitizeChunkFileName(name: string): string;
 export declare function treeShake(): Plugin;

package/dist/config/fs-routes/tree-shake.js

@@ -1,7 +1,52 @@
 // All credit for this work goes to the amazing Next.js team.
 // https://github.com/vercel/next.js/blob/canary/packages/next/build/babel/plugins/next-ssg-transform.ts
 // This is adapted to work with routeData functions. It can be run in two modes, one which preserves the routeData and the Component in the same file, and one which creates a
-import { basename } from "pathe";
+import { basename, extname } from "pathe";
+const PICKABLE_EXTENSIONS = ["js", "jsx", "ts", "tsx"];
+/**
+ * Builds the module id used to import a subset of a route file's exports.
+ *
+ * The `pick` list has to live in the query so that the same file can be
+ * instantiated once per export subset (the client picks `default`/`$css`,
+ * the server picks its HTTP handlers). That query would otherwise leave the
+ * id ending in `?pick=GET`, which silently excludes route files from any
+ * plugin whose filter is anchored on the file extension -- a very common
+ * default, e.g. unplugin-macros' `/\.[cm]?[jt]sx?$/`.
+ *
+ * The trailing `lang.<ext>` marker is the same convention Vue SFCs use
+ * (`?vue&type=script&lang.ts`) and puts a real extension back at the end of
+ * the id, so those filters match again.
+ *
+ * @see https://github.com/solidjs/solid-start/issues/1918
+ */
+export function toPickId(src, pick) {
+    const query = pick.map(p => `pick=${p}`).join("&");
+    const ext = extname(src).slice(1);
+    return PICKABLE_EXTENSIONS.includes(ext) ? `${src}?${query}&lang.${ext}` : `${src}?${query}`;
+}
+/**
+ * Matches the tail that {@link toPickId} appends, as it appears in a chunk
+ * name. Rolldown derives a chunk name from the module id by taking the
+ * basename minus its extension, so `index.tsx?pick=default&pick=$css&lang.tsx`
+ * arrives here as `index.tsx?pick=default&pick=$css&lang`.
+ */
+const PICK_CHUNK_NAME_RE = /\.[cm]?[jt]sx?\?pick=[^?]*&lang$/;
+const INVALID_CHAR_RE = /[\u0000-\u001F"#$&*+,:;<=>?[\]^`{|}\u007F]/g;
+const DRIVE_LETTER_RE = /^[a-z]:/i;
+/**
+ * Rolldown's default chunk name sanitizer, plus a pass that drops the
+ * `?pick=...&lang` tail so route chunks keep the short, stable filenames they
+ * had before the `lang` marker was introduced (`index-<hash>.js`, not
+ * `index.tsx_pick_default_pick__css_lang-<hash>.js`). Client chunk filenames
+ * are public URLs, so this is not purely cosmetic.
+ *
+ * @see https://github.com/rollup/rollup/blob/master/src/utils/sanitizeFileName.ts
+ */
+export function sanitizeChunkFileName(name) {
+    const stripped = name.replace(PICK_CHUNK_NAME_RE, "");
+    const driveLetter = DRIVE_LETTER_RE.exec(stripped)?.[0] ?? "";
+    return driveLetter + stripped.slice(driveLetter.length).replace(INVALID_CHAR_RE, "_");
+}
 function treeShakeTransform({ types: t }) {
     function getIdentifier(path) {
         const parentPath = path.parentPath;

package/dist/config/index.d.ts

@@ -86,6 +86,29 @@ export interface SolidStartOptions {
          * @default "json"
          */
         mode?: "js" | "json";
+        /**
+         * Path to a module whose default export is an array of custom Seroval
+         * plugins, used to serialize values Seroval doesn't understand natively
+         * (ORM id types, decimals, `Temporal`, and other custom classes).
+         *
+         * Build plugins with `createPlugin` from `seroval`. The module is bundled
+         * into both the client and the server so that both ends of a server
+         * function agree on the format, so it must not import server-only code.
+         *
+         * SolidStart's built-in plugins take precedence: Seroval uses the first
+         * plugin whose `test()` passes, and these are appended after the built-ins.
+         *
+         * A plugin's `deserialize` rebuilds the value under {@link mode} `"json"`.
+         * `serialize` is only used by `mode: "js"`, where the payload is evaluated
+         * on the client and may therefore reference globals only, not the plugin
+         * module's own imports.
+         *
+         * Only applies to server-function and action payloads. The SSR hydration
+         * payload is serialized by `solid-js/web` and is unaffected.
+         *
+         * @example "src/seroval-plugins.ts"
+         */
+        plugins?: string;
     };
     /**
      * Configures plugin behavior per build environment
@@ -95,6 +118,23 @@ export interface SolidStartOptions {
      * Options controlling which files are processed as server functions
      * (inclusion / exclusion filters for the `"use server"` transform).
      */
-    serverFunctions?: Pick<ServerFunctionsOptions, "filter">;
+    serverFunctions?: Pick<ServerFunctionsOptions, "filter"> & {
+        /**
+         * Path to a module whose default export is called with whatever a server
+         * function threw, before it is serialized into the response. Return a
+         * value to send it in place of what was thrown, or `undefined` to send the
+         * original.
+         *
+         * Naming the module here rather than registering a handler at runtime
+         * keeps the app in sole control of it: no dependency can reach into the
+         * running server and take over reporting.
+         *
+         * The module is bundled into the server only, so it may import server-only
+         * code such as a monitoring SDK.
+         *
+         * @example "src/server-fn-error.ts"
+         */
+        onError?: string;
+    };
 }
 export declare function solidStart(options?: SolidStartOptions): Array<PluginOption>;

package/dist/config/index.js

@@ -3,12 +3,14 @@ import { globSync } from "node:fs";
 import { basename, extname, isAbsolute, join } from "node:path";
 import solid from "vite-plugin-solid";
 import { serverFunctionsPlugin } from "../directives/index.js";
+import { appRootAlias } from "./app-root-alias.js";
 import { boundaryModules } from "./boundary-modules.js";
 import { DEFAULT_EXTENSIONS, VIRTUAL_MODULES, VITE_ENVIRONMENTS } from "./constants.js";
 import { devServer } from "./dev-server.js";
 import { envPlugin } from "./env.js";
 import { SolidStartClientFileRouter, SolidStartServerFileRouter } from "./fs-router.js";
 import { fsRoutes } from "./fs-routes/index.js";
+import { sanitizeChunkFileName, toPickId } from "./fs-routes/tree-shake.js";
 import lazy from "./lazy.js";
 import { manifest } from "./manifest.js";
 import { parseIdQuery } from "./utils.js";
@@ -71,17 +73,23 @@ export function solidStart(options) {
                     for (const route of await clientRouter.getRoutes()) {
                         for (const [key, value] of Object.entries(route)) {
                             if (value && key.startsWith("$") && !key.startsWith("$$")) {
-                                function toRouteId(route) {
-                                    return `${route.src}?${route.pick.map((p) => `pick=${p}`).join("&")}`;
-                                }
-                                clientInput.push(toRouteId(value));
+                                clientInput.push(toPickId(value.src, value.pick));
                             }
                         }
                     }
                 }
                 return {
                     appType: "custom",
-                    build: { assetsDir: "_build/assets" },
+                    build: {
+                        assetsDir: "_build/assets",
+                        rollupOptions: {
+                            output: {
+                                // Keeps route chunks named after their file rather than after
+                                // the `?pick=...` id that addresses them. See toPickId.
+                                sanitizeFileName: sanitizeChunkFileName,
+                            },
+                        },
+                    },
                     optimizeDeps: {
                         // Suppress TS errors from Vite 7 types when configuring Vite 8's Rolldown
                         ...{
@@ -126,7 +134,6 @@ export function solidStart(options) {
                     resolve: {
                         alias: {
                             "@solidjs/start/server/entry": handlers.server,
-                            "~": join(process.cwd(), start.appRoot),
                             ...(!start.ssr
                                 ? {
                                     "@solidjs/start/server": "@solidjs/start/server/spa",
@@ -175,6 +182,7 @@ export function solidStart(options) {
                 };
             },
         },
+        appRootAlias(root, start.appRoot),
         manifest(start),
         fsRoutes({
             routers: {

package/dist/config/manifest.js

@@ -28,6 +28,18 @@ export function manifest(start) {
                     return await this.resolve(start.middleware);
                 return `\0${VIRTUAL_MODULES.middleware}`;
             }
+            if (id === VIRTUAL_MODULES.serovalPlugins) {
+                const plugins = start.serialization?.plugins;
+                if (plugins)
+                    return await this.resolve(plugins);
+                return `\0${VIRTUAL_MODULES.serovalPlugins}`;
+            }
+            if (id === VIRTUAL_MODULES.serverFnErrorHandler) {
+                const onError = start.serverFunctions?.onError;
+                if (onError)
+                    return await this.resolve(onError);
+                return `\0${VIRTUAL_MODULES.serverFnErrorHandler}`;
+            }
         },
         async load(id) {
             if (id === `\0${VIRTUAL_MODULES.clientViteManifest}`) {
@@ -76,6 +88,10 @@ export function manifest(start) {
             }
             else if (id === `\0${VIRTUAL_MODULES.middleware}`)
                 return "export default {};";
+            else if (id === `\0${VIRTUAL_MODULES.serovalPlugins}`)
+                return "export default [];";
+            else if (id === `\0${VIRTUAL_MODULES.serverFnErrorHandler}`)
+                return "export default undefined;";
             else if (id.startsWith("/@manifest")) {
                 if (this.environment.mode !== "dev")
                     throw new Error("@manifest queries are only allowed in dev");

package/dist/fns/client.js

@@ -15,7 +15,6 @@ async function createRequest(base, id, instance, options) {
         },
     });
     if (import.meta.env.DEV) {
-        console.log(pushRequest);
         pushRequest(id, instance, request.clone());
     }
     const response = await fetch(request);
@@ -73,8 +72,8 @@ async function fetchServerFunction(base, id, options, args) {
         return response;
     }
     const result = await extractBody(instance, true, response.clone());
-    if (response.headers.has("X-Error")) {
-        throw result;
+    if (response.headers.has("X-Error") || response.status >= 500) {
+        throw result ?? new Error(`Server function call failed with status ${response.status}`);
     }
     return result;
 }

package/dist/fns/error-handler.d.ts

@@ -0,0 +1,3 @@
+export type ServerFunctionErrorHandler = (thrown: unknown) => unknown;
+/** @internal */
+export declare function applyServerFunctionErrorHandler(thrown: unknown): unknown;

package/dist/fns/error-handler.js

@@ -0,0 +1,5 @@
+import onServerFunctionError from "solid-start:server-fn-error-handler";
+/** @internal */
+export function applyServerFunctionErrorHandler(thrown) {
+    return onServerFunctionError?.(thrown) ?? thrown;
+}

package/dist/fns/handler.d.ts

@@ -2,4 +2,4 @@ import { type H3Event } from "h3";
 import "solid-start:server-fn-manifest";
 import type { FetchEvent } from "../server/types.ts";
 export declare function handleServerFunction(h3Event: H3Event): Promise<unknown>;
-export declare function createSingleFlightHeaders(sourceEvent: FetchEvent): Headers;
+export declare function createSingleFlightHeaders(sourceEvent: FetchEvent, result?: unknown): Headers;

package/dist/fns/handler.js

@@ -17,6 +17,7 @@ import { deserializeFromJSONString, serializeToJSONStream, serializeToJSStream,
 import { BODY_FORMAT_KEY, BodyFormat, extractBody, getHeadersAndBody } from "./shared.js";
 import "solid-start:server-fn-manifest";
 import { getServerFunction, hasServerFunction } from "./registration.js";
+import { applyServerFunctionErrorHandler } from "./error-handler.js";
 import { getExpectedRedirectStatus } from "../server/util.js";
 export async function handleServerFunction(h3Event) {
     const event = getFetchEvent(h3Event);
@@ -109,7 +110,7 @@ export async function handleServerFunction(h3Event) {
         }
         // handle no JS success case
         if (!instance)
-            return handleNoJS(result, request, parsed);
+            return await handleNoJS(result, request, parsed);
         const body = getHeadersAndBody(result);
         if (body) {
             return new Response(body.body, {
@@ -124,6 +125,7 @@ export async function handleServerFunction(h3Event) {
         return serializeToJSONStream(result);
     }
     catch (x) {
+        x = applyServerFunctionErrorHandler(x);
         if (x instanceof Response) {
             if (singleFlight && instance) {
                 x = await handleSingleFlight(event, x);
@@ -146,7 +148,7 @@ export async function handleServerFunction(h3Event) {
             h3Event.res.headers.set("X-Error", toHeaderValue(error));
         }
         else {
-            x = handleNoJS(x, request, parsed, true);
+            x = await handleNoJS(x, request, parsed, true);
         }
         if (instance) {
             const body = getHeadersAndBody(x);
@@ -181,7 +183,20 @@ function toHeaderValue(value) {
         return "true";
     }
 }
-function handleNoJS(result, request, parsed, thrown) {
+function getRefererLocation(request, url) {
+    const referer = request.headers.get("referer");
+    try {
+        if (referer)
+            return new URL(referer).toString();
+    }
+    catch {
+        // fall through to the app root below
+    }
+    // no usable referer (e.g. a no-referrer policy): the app root still beats
+    // leaving the browser sitting on the server function endpoint
+    return new URL(import.meta.env.BASE_URL, url.origin).toString();
+}
+async function handleNoJS(result, request, parsed, thrown) {
     const url = new URL(request.url);
     const isError = result instanceof Error;
     let statusCode = 302;
@@ -192,10 +207,19 @@ function handleNoJS(result, request, parsed, thrown) {
             headers.set(`Location`, new URL(result.headers.get("Location"), url.origin + import.meta.env.BASE_URL).toString());
             statusCode = getExpectedRedirectStatus(result);
         }
+        else {
+            // responses that carry a value rather than a destination (json(), reload())
+            // still have to send the browser back to the page the form came from
+            headers.set("Location", getRefererLocation(request, url));
+        }
+        // the body is dropped from the redirect, so don't advertise its type
+        headers.delete("Content-Type");
+        // mirror the JS path: the flash cookie carries the value, not the Response
+        result = result.customBody ? await result.customBody() : null;
     }
     else
         headers = new Headers({
-            Location: new URL(request.headers.get("referer")).toString(),
+            Location: getRefererLocation(request, url),
         });
     if (result) {
         headers.append("Set-Cookie", `flash=${encodeURIComponent(JSON.stringify({
@@ -203,7 +227,9 @@ function handleNoJS(result, request, parsed, thrown) {
             result: isError ? result.message : result,
             thrown: thrown,
             error: isError,
-            input: [...parsed.slice(0, -1), [...parsed[parsed.length - 1].entries()]],
+            input: parsed.length
+                ? [...parsed.slice(0, -1), [...parsed[parsed.length - 1].entries()]]
+                : [],
         }))}; Secure; HttpOnly;`);
     }
     return new Response(null, {
@@ -212,13 +238,19 @@ function handleNoJS(result, request, parsed, thrown) {
     });
 }
 let App;
-export function createSingleFlightHeaders(sourceEvent) {
+export function createSingleFlightHeaders(sourceEvent, result) {
     // cookie handling logic is pretty simplistic so this might be imperfect
     // unclear if h3 internals are available on all platforms but we need a way to
     // update request headers on the underlying H3 event.
     const headers = new Headers(sourceEvent.request.headers);
     const cookies = parseCookies(sourceEvent.nativeEvent);
     const SetCookies = sourceEvent.response.headers.getSetCookie();
+    // cookies attached to the returned/thrown response (eg. `redirect(to, { headers })`)
+    // haven't been merged onto the event response yet, but a browser round trip would
+    // have sent them back with the next request, so apply them here too. They come after
+    // the ones on the event response, so they win on conflict.
+    if (result instanceof Response)
+        SetCookies.push(...result.headers.getSetCookie());
     headers.delete("cookie");
     // let useH3Internals = false;
     // if (sourceEvent.nativeEvent.node?.req) {
@@ -262,7 +294,7 @@ async function handleSingleFlight(sourceEvent, result) {
     }
     const event = { ...sourceEvent };
     event.request = new Request(url, {
-        headers: createSingleFlightHeaders(sourceEvent),
+        headers: createSingleFlightHeaders(sourceEvent, result),
     });
     return await provideRequestEvent(event, async () => {
         await createPageEvent(event);

package/dist/fns/plugins.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Re-exports Seroval's plugin authoring API for use with the
+ * `serialization.plugins` option in `vite.config.ts`.
+ *
+ * Importing from here rather than depending on `seroval` directly keeps plugin
+ * authors on the exact Seroval version SolidStart serializes with. A mismatched
+ * version would not fail the build: it would produce plugin nodes the other end
+ * of the wire can't interpret.
+ *
+ * @see https://github.com/solidjs/solid-start/issues/1474
+ *
+ * @example
+ * ```ts
+ * // src/seroval-plugins.ts
+ * import { createPlugin } from "@solidjs/start/serialization";
+ * import { ObjectId } from "mongodb";
+ *
+ * const ObjectIdPlugin = createPlugin<ObjectId, { hex: any }>({
+ *   tag: "app/ObjectId",
+ *   test: value => value instanceof ObjectId,
+ *   parse: {
+ *     sync: (value, ctx) => ({ hex: ctx.parse(value.toHexString()) }),
+ *     async: async (value, ctx) => ({ hex: await ctx.parse(value.toHexString()) }),
+ *     stream: (value, ctx) => ({ hex: ctx.parse(value.toHexString()) }),
+ *   },
+ *   serialize: (node, ctx) => `globalThis.ObjectId(${ctx.serialize(node.hex)})`,
+ *   deserialize: (node, ctx) => new ObjectId(ctx.deserialize(node.hex) as string),
+ * });
+ *
+ * export default [ObjectIdPlugin];
+ * ```
+ */
+export { createPlugin, OpaqueReference } from "seroval";
+export type { AsyncParsePluginContext, DeserializePluginContext, Plugin, PluginData, PluginInfo, SerializePluginContext, SerovalNode, StreamParsePluginContext, SyncParsePluginContext, } from "seroval";

package/dist/fns/plugins.js

@@ -0,0 +1,33 @@
+/**
+ * Re-exports Seroval's plugin authoring API for use with the
+ * `serialization.plugins` option in `vite.config.ts`.
+ *
+ * Importing from here rather than depending on `seroval` directly keeps plugin
+ * authors on the exact Seroval version SolidStart serializes with. A mismatched
+ * version would not fail the build: it would produce plugin nodes the other end
+ * of the wire can't interpret.
+ *
+ * @see https://github.com/solidjs/solid-start/issues/1474
+ *
+ * @example
+ * ```ts
+ * // src/seroval-plugins.ts
+ * import { createPlugin } from "@solidjs/start/serialization";
+ * import { ObjectId } from "mongodb";
+ *
+ * const ObjectIdPlugin = createPlugin<ObjectId, { hex: any }>({
+ *   tag: "app/ObjectId",
+ *   test: value => value instanceof ObjectId,
+ *   parse: {
+ *     sync: (value, ctx) => ({ hex: ctx.parse(value.toHexString()) }),
+ *     async: async (value, ctx) => ({ hex: await ctx.parse(value.toHexString()) }),
+ *     stream: (value, ctx) => ({ hex: ctx.parse(value.toHexString()) }),
+ *   },
+ *   serialize: (node, ctx) => `globalThis.ObjectId(${ctx.serialize(node.hex)})`,
+ *   deserialize: (node, ctx) => new ObjectId(ctx.deserialize(node.hex) as string),
+ * });
+ *
+ * export default [ObjectIdPlugin];
+ * ```
+ */
+export { createPlugin, OpaqueReference } from "seroval";

package/dist/fns/serialization.js

@@ -1,6 +1,6 @@
 import { crossSerializeStream, deserialize, Feature, fromCrossJSON, getCrossReferenceHeader, toCrossJSONStream, } from "seroval";
 import { AbortSignalPlugin, CustomEventPlugin, DOMExceptionPlugin, EventPlugin, FormDataPlugin, HeadersPlugin, ReadableStreamPlugin, RequestPlugin, ResponsePlugin, URLPlugin, URLSearchParamsPlugin, } from "seroval-plugins/web";
-// TODO(Alexis): if we can, allow providing an option to extend these.
+import userPlugins from "solid-start:seroval-plugins";
 const DEFAULT_PLUGINS = [
     AbortSignalPlugin,
     CustomEventPlugin,
@@ -14,6 +14,16 @@ const DEFAULT_PLUGINS = [
     URLSearchParamsPlugin,
     URLPlugin,
 ];
+/**
+ * Plugins from `serialization.plugins` are appended rather than prepended:
+ * seroval picks the first plugin whose `test()` passes, so the built-ins win
+ * and a loose user `test()` can't take over `Request`/`FormData`/`URL`.
+ *
+ * The same list has to be used on both ends of a server function, which is why
+ * this comes from a virtual module bundled into the client and the server
+ * rather than a runtime option.
+ */
+const PLUGINS = [...DEFAULT_PLUGINS, ...userPlugins];
 const MAX_SERIALIZATION_DEPTH_LIMIT = 64;
 const DISABLED_FEATURES = Feature.RegExp;
 /**
@@ -67,7 +77,7 @@ export function serializeToJSStream(id, value) {
             crossSerializeStream(value, {
                 scopeId: id,
                 disabledFeatures: JS_SERIALIZE_DISABLED_FEATURES,
-                plugins: DEFAULT_PLUGINS,
+                plugins: PLUGINS,
                 onSerialize(data, initial) {
                     controller.enqueue(createChunk(initial ? `(${getCrossReferenceHeader(id)},${data})` : data));
                 },
@@ -87,7 +97,7 @@ export function serializeToJSONStream(value) {
             toCrossJSONStream(value, {
                 disabledFeatures: SERIALIZE_DISABLED_FEATURES,
                 depthLimit: MAX_SERIALIZATION_DEPTH_LIMIT,
-                plugins: DEFAULT_PLUGINS,
+                plugins: PLUGINS,
                 onParse(node) {
                     controller.enqueue(createChunk(JSON.stringify(node)));
                 },
@@ -200,7 +210,7 @@ export async function deserializeJSONStream(response) {
                 refs,
                 disabledFeatures: DISABLED_FEATURES,
                 depthLimit: MAX_SERIALIZATION_DEPTH_LIMIT,
-                plugins: DEFAULT_PLUGINS,
+                plugins: PLUGINS,
             });
             return value;
         }

package/dist/server/handler.js

@@ -171,9 +171,17 @@ function handleStreamCompleteRedirect(context) {
     return ({ write }) => {
         context.complete = true;
         const to = context.response && context.response.headers.get("Location");
-        to && write(`<script>window.location=${JSON.stringify(to).replace(/</g, "\\u003c")}</script>`);
+        if (!to)
+            return;
+        // The shell has already flushed, so the redirect has to happen client side.
+        // Carry the nonce so a strict `script-src` CSP doesn't block it.
+        const nonce = context.nonce ? ` nonce="${escapeAttribute(context.nonce)}"` : "";
+        write(`<script${nonce}>window.location=${JSON.stringify(to).replace(/</g, "\\u003c")}</script>`);
     };
 }
+function escapeAttribute(value) {
+    return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+}
 function stripBaseUrl(path) {
     const base = import.meta.env.SERVER_BASE_URL || import.meta.env.BASE_URL || "/";
     return stripPathBase(path, base);

package/dist/server/index.d.ts

@@ -3,6 +3,7 @@ export { getServerFunctionMeta } from "../shared/serverFunction.ts";
 export { StartServer } from "./StartServer.tsx";
 export { decorateHandler, decorateMiddleware } from "./fetchEvent.ts";
 export { createHandler } from "./handler.ts";
+export type { ServerFunctionErrorHandler } from "../fns/error-handler.ts";
 export type { APIEvent, APIHandler, Asset, ContextMatches, DocumentComponentProps, FetchEvent, HandlerOptions, PageEvent, ResponseStub, ServerFunctionMeta, StartHandler, } from "./types.ts";
 /**
  * Checks if user has set a redirect status in the response.

package/dist/server/spa/StartServer.jsx

@@ -18,7 +18,7 @@ export function StartServer(props) {
       <TopErrorBoundary>
         <props.document scripts={<>
               <PatchVirtualDevStyles nonce={nonce}/>
-              <script type="module" src={getSsrManifest("client").path(import.meta.env.START_CLIENT_ENTRY_URL)}/>
+              <script type="module" nonce={nonce} src={getSsrManifest("client").path(import.meta.env.START_CLIENT_ENTRY_URL)}/>
             </>}/>
       </TopErrorBoundary>
     </NoHydration>);

package/dist/shared/dev-toolbar/index.jsx

@@ -121,7 +121,6 @@ export function DevToolbar(props) {
     });
     createEffect(() => {
         onCleanup(captureServerFunctionCall(call => {
-            console.log(call);
             if (call.type === "request") {
                 setStore("instances", call.instance, value => {
                     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/start",
-  "version": "2.0.0-rc.4",
+  "version": "2.0.0-rc.6",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/solidjs/solid-start.git",
@@ -24,7 +24,8 @@
     "./http": "./dist/http/index.js",
     "./env": "./env.d.ts",
     "./fns/server": "./dist/fns/server.js",
-    "./fns/client": "./dist/fns/client.js"
+    "./fns/client": "./dist/fns/client.js",
+    "./serialization": "./dist/fns/plugins.js"
   },
   "publishConfig": {
     "access": "public"
@@ -63,8 +64,14 @@
     "vitest": "^4.1.10"
   },
   "peerDependencies": {
+    "@solidjs/router": ">=0.16.0 <2.0.0-0",
     "vite": "^8 || ^9"
   },
+  "peerDependenciesMeta": {
+    "@solidjs/router": {
+      "optional": true
+    }
+  },
   "engines": {
     "node": ">=24"
   },