@solidjs/start 2.0.5 → 2.0.6

package/dist/fns/handler.js

@@ -19,13 +19,115 @@ import "solid-start:server-fn-manifest";
 import { getServerFunction, hasServerFunction } from "./registration.js";
 import { applyServerFunctionErrorHandler } from "./error-handler.js";
 import { getExpectedRedirectStatus } from "../server/util.js";
+/**
+ * Server functions are same-origin RPC. A cross-site page must not be able to
+ * invoke one with the visitor's cookies, so reject cross-site requests before
+ * the function runs. This is the token-less origin check used by other
+ * frameworks: trust `Sec-Fetch-Site` when the browser sends it, and fall back
+ * to comparing `Origin` against the request host.
+ *
+ * `same-origin` and `same-site` are allowed, matching the reach of a
+ * `SameSite=Lax`/`Strict` cookie. `none` is a user-initiated navigation
+ * (typed URL, bookmark), not a request made by another site.
+ */
+function isCrossSiteRequest(request, url) {
+    const secFetchSite = request.headers.get("sec-fetch-site");
+    if (secFetchSite) {
+        return secFetchSite === "cross-site";
+    }
+    // Older browsers omit Sec-Fetch-Site. They still send Origin on the
+    // cross-site requests that matter (form and fetch POSTs), so compare it.
+    const origin = request.headers.get("origin");
+    // `null` is an opaque origin (a sandboxed iframe, a cross-origin redirect
+    // chain): the browser declines to name the caller, so it cannot be matched.
+    if (origin === "null") {
+        return true;
+    }
+    if (origin) {
+        try {
+            return new URL(origin).host !== url.host;
+        }
+        catch {
+            return true;
+        }
+    }
+    // No Origin either (a same-origin GET, or a non-browser client): nothing to
+    // reject on.
+    return false;
+}
+const CACHE_CONTROL = "Cache-Control";
+const DEFAULT_CACHE_CONTROL = "no-store";
+/**
+ * A server function answers one caller, so a shared cache must not store the
+ * response unless the function opted in with its own `Cache-Control`, either
+ * on a returned Response or on the event's response headers. A 304 is left
+ * alone: it updates a stored response rather than being one, and `no-store`
+ * on it would drop the entry the conditional request was keeping.
+ *
+ * h3 copies `res.headers` onto a returned Response below 400 and
+ * `res.errHeaders` onto one at or above it, and builds every other return
+ * value from `res`, so those are the headers that reach the wire.
+ */
+function withDefaultCacheControl(h3Event, value) {
+    if (!(value instanceof Response)) {
+        if (h3Event.res.status !== 304 && !h3Event.res.headers.has(CACHE_CONTROL)) {
+            h3Event.res.headers.set(CACHE_CONTROL, DEFAULT_CACHE_CONTROL);
+        }
+        return value;
+    }
+    const eventHeaders = value.status >= 400 ? h3Event.res.errHeaders : h3Event.res.headers;
+    if (value.status === 304 || value.headers.has(CACHE_CONTROL) || eventHeaders.has(CACHE_CONTROL)) {
+        return value;
+    }
+    try {
+        value.headers.set(CACHE_CONTROL, DEFAULT_CACHE_CONTROL);
+        return value;
+    }
+    catch {
+        // a fetch() Response passed through has immutable headers
+        const headers = new Headers(value.headers);
+        headers.set(CACHE_CONTROL, DEFAULT_CACHE_CONTROL);
+        return new Response(value.body, {
+            status: value.status,
+            statusText: value.statusText,
+            headers,
+        });
+    }
+}
+function thrownCacheControl(error) {
+    try {
+        const headers = error?.headers;
+        return headers ? new Headers(headers).has(CACHE_CONTROL) : false;
+    }
+    catch {
+        return false;
+    }
+}
 export async function handleServerFunction(h3Event) {
+    let response;
+    try {
+        response = await runServerFunction(h3Event);
+    }
+    catch (error) {
+        // h3 answers a thrown value itself, with the error's headers and then
+        // `res.errHeaders`
+        if (!thrownCacheControl(error) && !h3Event.res.errHeaders.has(CACHE_CONTROL)) {
+            h3Event.res.errHeaders.set(CACHE_CONTROL, DEFAULT_CACHE_CONTROL);
+        }
+        throw error;
+    }
+    return withDefaultCacheControl(h3Event, response);
+}
+async function runServerFunction(h3Event) {
     const event = getFetchEvent(h3Event);
     const request = event.request;
+    const url = new URL(request.url);
+    if (isCrossSiteRequest(request, url)) {
+        return new Response(import.meta.env.DEV ? "Cross-site server function requests are not allowed" : null, { status: 403 });
+    }
     const serverReference = request.headers.get("X-Server-Id");
     const instance = request.headers.get("X-Server-Instance");
     const singleFlight = request.headers.has("X-Single-Flight");
-    const url = new URL(request.url);
     let functionId;
     if (serverReference) {
         // invariant(typeof serverReference === "string", "Invalid server function");
@@ -199,6 +301,18 @@ function getRefererLocation(request, url) {
     // leaving the browser sitting on the server function endpoint
     return new URL(import.meta.env.BASE_URL, url.origin).toString();
 }
+// The no-JS form path passes the submitted FormData as the last argument, and
+// its entries are echoed back through the flash cookie. Any other no-JS POST
+// (empty body, a non-form content type) leaves a value here that is not a
+// FormData, so guard the entries() call instead of assuming it.
+function buildFlashInput(parsed) {
+    if (parsed.length === 0) {
+        return [];
+    }
+    const last = parsed[parsed.length - 1];
+    const entries = typeof last?.entries === "function" ? [...last.entries()] : last;
+    return [...parsed.slice(0, -1), entries];
+}
 async function handleNoJS(result, request, parsed, thrown) {
     const url = new URL(request.url);
     const isError = result instanceof Error;
@@ -225,15 +339,19 @@ async function handleNoJS(result, request, parsed, thrown) {
             Location: getRefererLocation(request, url),
         });
     if (result) {
-        headers.append("Set-Cookie", `flash=${encodeURIComponent(JSON.stringify({
-            url: url.pathname + url.search,
-            result: isError ? result.message : result,
-            thrown: thrown,
-            error: isError,
-            input: parsed.length
-                ? [...parsed.slice(0, -1), [...parsed[parsed.length - 1].entries()]]
-                : [],
-        }))}; Secure; HttpOnly;`);
+        try {
+            headers.append("Set-Cookie", `flash=${encodeURIComponent(JSON.stringify({
+                url: url.pathname + url.search,
+                result: isError ? result.message : result,
+                thrown: thrown,
+                error: isError,
+                input: buildFlashInput(parsed),
+            }))}; Secure; HttpOnly;`);
+        }
+        catch {
+            // The flash cookie is best effort. A value that cannot be serialized must
+            // not take down the redirect, which is also this request's error handler.
+        }
     }
     return new Response(null, {
         status: statusCode,

package/dist/fns/serialization.d.ts

@@ -1,11 +1,29 @@
+/**
+ * The largest chunk a server accepts from a client. The header can declare up
+ * to 4GB, and the reader buffers that much before it parses anything.
+ */
+export declare const MAX_REQUEST_CHUNK_SIZE: number;
 export declare function serializeToJSStream(id: string, value: any): ReadableStream<any>;
 export declare function serializeToJSONStream(value: any): ReadableStream<any>;
+export interface SerovalChunkReaderOptions {
+    /** Rejects any chunk larger than this many bytes. */
+    maxChunkSize?: number;
+}
 export declare class SerovalChunkReader {
     reader: ReadableStreamDefaultReader<Uint8Array>;
-    buffer: Uint8Array;
     done: boolean;
-    constructor(stream: ReadableStream<Uint8Array>);
-    readChunk(): Promise<void>;
+    private maxChunkSize;
+    /** Pieces read from the stream and not yet consumed, in order. */
+    private pieces;
+    private length;
+    constructor(stream: ReadableStream<Uint8Array>, options?: SerovalChunkReaderOptions);
+    /** Reads until `size` bytes are buffered or the stream ends. */
+    private fill;
+    /**
+     * Removes the first `size` bytes from the buffer. Pieces are only joined
+     * when the bytes span more than one, so each byte is copied at most once.
+     */
+    private take;
     next(): Promise<{
         done: true;
         value: undefined;
@@ -13,9 +31,12 @@ export declare class SerovalChunkReader {
         done: false;
         value: string;
     }>;
+    /** Stops reading and releases the stream, such as after a parse error. */
+    cancel(reason?: unknown): Promise<void>;
+    /** Interprets every remaining chunk. On an error, the stream is cancelled. */
     drain(interpret: (chunk: string) => void): Promise<void>;
 }
 export declare function serializeToJSONString(value: any): Promise<string>;
 export declare function deserializeFromJSONString(json: string): Promise<unknown>;
-export declare function deserializeJSONStream(response: Response | Request): Promise<unknown>;
+export declare function deserializeJSONStream(response: Response | Request, options?: SerovalChunkReaderOptions): Promise<unknown>;
 export declare function deserializeJSStream(id: string, response: Request | Response): Promise<unknown>;

package/dist/fns/serialization.js

@@ -1,4 +1,4 @@
-import { crossSerializeStream, deserialize, Feature, fromCrossJSON, getCrossReferenceHeader, toCrossJSONStream, } from "seroval";
+import { crossSerializeStream, deserialize, Feature, fromCrossJSON, getCrossReferenceHeader, isStream, toCrossJSONStream, } from "seroval";
 import { AbortSignalPlugin, CustomEventPlugin, DOMExceptionPlugin, EventPlugin, FormDataPlugin, HeadersPlugin, ReadableStreamPlugin, RequestPlugin, ResponsePlugin, URLPlugin, URLSearchParamsPlugin, } from "seroval-plugins/web";
 import userPlugins from "solid-start:seroval-plugins";
 const DEFAULT_PLUGINS = [
@@ -60,16 +60,37 @@ const JS_SERIALIZE_DISABLED_FEATURES = import.meta.env.PROD ? Feature.ErrorProto
  * The format is as follows:
  * ;0xFFFFFFFF;<string data>
  */
-function createChunk(data) {
-    const encodeData = new TextEncoder().encode(data);
-    const bytes = encodeData.length;
-    const baseHex = bytes.toString(16);
-    const totalHex = "00000000".substring(0, 8 - baseHex.length) + baseHex; // 32-bit
-    const head = new TextEncoder().encode(`;0x${totalHex};`);
-    const chunk = new Uint8Array(12 + bytes);
-    chunk.set(head);
-    chunk.set(encodeData, 12);
-    return chunk;
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const HEADER_SIZE = 12;
+const SEMICOLON = 0x3b;
+const ZERO = 0x30;
+const LOWER_X = 0x78;
+/**
+ * The largest chunk a server accepts from a client. The header can declare up
+ * to 4GB, and the reader buffers that much before it parses anything.
+ */
+export const MAX_REQUEST_CHUNK_SIZE = 64 * 1024 * 1024;
+function createChunkHeader(bytes) {
+    const hex = bytes.toString(16).padStart(8, "0");
+    const head = new Uint8Array(HEADER_SIZE);
+    head[0] = SEMICOLON;
+    head[1] = ZERO;
+    head[2] = LOWER_X;
+    for (let i = 0; i < 8; i++) {
+        head[3 + i] = hex.charCodeAt(i);
+    }
+    head[11] = SEMICOLON;
+    return head;
+}
+/**
+ * The header and the data are sent as separate pieces, so the encoded data is
+ * not copied into a second buffer.
+ */
+function enqueueChunk(controller, data) {
+    const encoded = encoder.encode(data);
+    controller.enqueue(createChunkHeader(encoded.length));
+    controller.enqueue(encoded);
 }
 export function serializeToJSStream(id, value) {
     return new ReadableStream({
@@ -79,7 +100,7 @@ export function serializeToJSStream(id, value) {
                 disabledFeatures: JS_SERIALIZE_DISABLED_FEATURES,
                 plugins: PLUGINS,
                 onSerialize(data, initial) {
-                    controller.enqueue(createChunk(initial ? `(${getCrossReferenceHeader(id)},${data})` : data));
+                    enqueueChunk(controller, initial ? `(${getCrossReferenceHeader(id)},${data})` : data);
                 },
                 onDone() {
                     controller.close();
@@ -99,7 +120,7 @@ export function serializeToJSONStream(value) {
                 depthLimit: MAX_SERIALIZATION_DEPTH_LIMIT,
                 plugins: PLUGINS,
                 onParse(node) {
-                    controller.enqueue(createChunk(JSON.stringify(node)));
+                    enqueueChunk(controller, JSON.stringify(node));
                 },
                 onDone() {
                     controller.close();
@@ -111,88 +132,196 @@ export function serializeToJSONStream(value) {
         },
     });
 }
+function hexValue(code) {
+    if (code >= 0x30 && code <= 0x39)
+        return code - 0x30;
+    if (code >= 0x61 && code <= 0x66)
+        return code - 0x61 + 10;
+    if (code >= 0x41 && code <= 0x46)
+        return code - 0x41 + 10;
+    return -1;
+}
+/** Returns the data size the header declares, or -1 when it is malformed. */
+function parseChunkHeader(head) {
+    if (head[0] !== SEMICOLON || head[1] !== ZERO || head[2] !== LOWER_X || head[11] !== SEMICOLON) {
+        return -1;
+    }
+    let size = 0;
+    for (let i = 3; i < 11; i++) {
+        const digit = hexValue(head[i]);
+        if (digit === -1) {
+            return -1;
+        }
+        size = size * 16 + digit;
+    }
+    return size;
+}
+function malformed() {
+    return new Error("Malformed server function stream.");
+}
 export class SerovalChunkReader {
     reader;
-    buffer;
-    done;
-    constructor(stream) {
+    done = false;
+    maxChunkSize;
+    /** Pieces read from the stream and not yet consumed, in order. */
+    pieces = [];
+    length = 0;
+    constructor(stream, options = {}) {
         this.reader = stream.getReader();
-        this.buffer = new Uint8Array(0);
-        this.done = false;
+        this.maxChunkSize = options.maxChunkSize ?? Infinity;
     }
-    async readChunk() {
-        // if there's no chunk, read again
-        const chunk = await this.reader.read();
-        if (!chunk.done) {
-            // repopulate the buffer
-            const newBuffer = new Uint8Array(this.buffer.length + chunk.value.length);
-            newBuffer.set(this.buffer);
-            newBuffer.set(chunk.value, this.buffer.length);
-            this.buffer = newBuffer;
-        }
-        else {
-            this.done = true;
+    /** Reads until `size` bytes are buffered or the stream ends. */
+    async fill(size) {
+        while (this.length < size && !this.done) {
+            const chunk = await this.reader.read();
+            if (chunk.done) {
+                this.done = true;
+            }
+            else if (chunk.value.length > 0) {
+                this.pieces.push(chunk.value);
+                this.length += chunk.value.length;
+            }
         }
     }
-    async next() {
-        // Check if the buffer is empty or incomplete
-        if (this.buffer.length < 12) {
-            // if we are already done...
-            if (this.done) {
-                // incomplete stream
-                if (this.buffer.length !== 0) {
-                    throw new Error("Malformed server function stream.");
-                }
-                return {
-                    done: true,
-                    value: undefined,
-                };
+    /**
+     * Removes the first `size` bytes from the buffer. Pieces are only joined
+     * when the bytes span more than one, so each byte is copied at most once.
+     */
+    take(size) {
+        const first = this.pieces[0];
+        if (first && first.length >= size) {
+            if (first.length === size) {
+                this.pieces.shift();
             }
-            // Otherwise, read a new chunk
-            await this.readChunk();
-            return await this.next();
-        }
-        // Read the "byte header"
-        // The byte header tells us how big the expected data is
-        // so we know how much data we should wait before we
-        // deserialize the data
-        const head = new TextDecoder().decode(this.buffer.subarray(1, 11));
-        const bytes = Number.parseInt(head, 16); // ;0x00000000;
-        if (Number.isNaN(bytes)) {
-            throw new Error("Malformed server function stream.");
-        }
-        // Check if the buffer has enough bytes to be parsed
-        while (bytes > this.buffer.length - 12) {
-            // If it's not enough, and the reader is done
-            // then the chunk is invalid.
-            if (this.done) {
-                throw new Error("Malformed server function stream.");
+            else {
+                this.pieces[0] = first.subarray(size);
             }
-            // Otherwise, we read more chunks
-            await this.readChunk();
-        }
-        // Extract the exact chunk as defined by the byte header
-        const partial = new TextDecoder().decode(this.buffer.subarray(12, 12 + bytes));
-        // The rest goes to the buffer
-        this.buffer = this.buffer.subarray(12 + bytes);
-        // Deserialize the chunk
-        return {
-            done: false,
-            value: partial,
-        };
-    }
-    async drain(interpret) {
-        while (true) {
-            const result = await this.next();
-            if (result.done) {
-                break;
+            this.length -= size;
+            return first.subarray(0, size);
+        }
+        const result = new Uint8Array(size);
+        let offset = 0;
+        while (offset < size) {
+            const piece = this.pieces[0];
+            const count = Math.min(piece.length, size - offset);
+            result.set(piece.subarray(0, count), offset);
+            offset += count;
+            if (count === piece.length) {
+                this.pieces.shift();
             }
             else {
+                this.pieces[0] = piece.subarray(count);
+            }
+        }
+        this.length -= size;
+        return result;
+    }
+    async next() {
+        await this.fill(HEADER_SIZE);
+        if (this.length === 0) {
+            return { done: true, value: undefined };
+        }
+        if (this.length < HEADER_SIZE) {
+            throw malformed();
+        }
+        // The header gives the size of the data, so we know how much to wait for
+        // before decoding it.
+        const size = parseChunkHeader(this.take(HEADER_SIZE));
+        if (size === -1) {
+            throw malformed();
+        }
+        if (size > this.maxChunkSize) {
+            throw new Error(`Server function stream chunk of ${size} bytes is larger than the limit of ${this.maxChunkSize} bytes.`);
+        }
+        await this.fill(size);
+        if (this.length < size) {
+            throw malformed();
+        }
+        return { done: false, value: decoder.decode(this.take(size)) };
+    }
+    /** Stops reading and releases the stream, such as after a parse error. */
+    async cancel(reason) {
+        this.pieces = [];
+        this.length = 0;
+        this.done = true;
+        await this.reader.cancel(reason).catch(() => { });
+    }
+    /** Interprets every remaining chunk. On an error, the stream is cancelled. */
+    async drain(interpret) {
+        try {
+            while (true) {
+                const result = await this.next();
+                if (result.done) {
+                    break;
+                }
                 interpret(result.value);
             }
         }
+        catch (error) {
+            await this.cancel(error);
+            throw error;
+        }
     }
 }
+function reportDrainError(error) {
+    console.error("[solid-start] failed to read the rest of a server function stream:", error);
+}
+const ignoreRejection = () => { };
+/**
+ * A decoded payload is the peer's bytes, so a promise it decodes to can reject
+ * with nobody holding it: an argument the function never awaits, a field of a
+ * result the caller ignores. Seroval stores every promise it decodes in the
+ * refs map, including ones that reject synchronously inside `fromCrossJSON`,
+ * so claim them as they are stored. Code that awaits the promise still sees
+ * the rejection.
+ */
+class DecodedRefs extends Map {
+    set(id, value) {
+        if (value instanceof Promise)
+            value.catch(ignoreRejection);
+        return super.set(id, value);
+    }
+}
+/**
+ * Fails every value still waiting on a frame that will not arrive. Seroval
+ * keeps these in the refs between frames: open streams and pending-promise
+ * resolvers (`{ p, s, f }`). `fromCrossJSON` builds streams from seroval's
+ * internal `Stream` class, which only `isStream` recognizes; the eval-based
+ * `deserialize` rebuilds them as plain `__SEROVAL_STREAM__` objects. Throwing
+ * into a closed stream and rejecting a settled promise are no-ops, so this is
+ * safe to run after a body that ended normally.
+ *
+ * A ref can be any value a plugin decoded, so nothing is read off it unguarded.
+ */
+function settlePendingRefs(refs, error) {
+    for (const value of refs) {
+        if (value === null || typeof value !== "object")
+            continue;
+        try {
+            const ref = value;
+            if (isStream(ref)) {
+                ref.throw(error);
+            }
+            else if (ref.__SEROVAL_STREAM__ === true && typeof ref.throw === "function") {
+                ref.throw(error);
+            }
+            else if (typeof ref.s === "function" &&
+                typeof ref.f === "function" &&
+                ref.p instanceof Promise) {
+                // seroval stores the resolver before its promise, so a failed second
+                // store leaves a promise that `DecodedRefs` never saw
+                ref.p.catch(ignoreRejection);
+                ref.f(error);
+            }
+        }
+        catch {
+            // a stream listener threw, or a plugin value refused the read
+        }
+    }
+}
+function createEndOfStreamError() {
+    return new Error("Server function stream ended unexpectedly.");
+}
 export async function serializeToJSONString(value) {
     const response = new Response(serializeToJSONStream(value));
     return await response.text();
@@ -201,14 +330,17 @@ export async function deserializeFromJSONString(json) {
     const blob = new Response(json);
     return await deserializeJSONStream(blob);
 }
-export async function deserializeJSONStream(response) {
+export async function deserializeJSONStream(response, options) {
     if (!response.body) {
         throw new Error("missing body");
     }
-    const reader = new SerovalChunkReader(response.body);
-    const result = await reader.next();
+    const reader = new SerovalChunkReader(response.body, options);
+    const result = await reader.next().catch(async (error) => {
+        await reader.cancel(error);
+        throw error;
+    });
     if (!result.done) {
-        const refs = new Map();
+        const refs = new DecodedRefs();
         function interpretChunk(chunk) {
             const value = fromCrossJSON(JSON.parse(chunk), {
                 refs,
@@ -218,25 +350,58 @@ export async function deserializeJSONStream(response) {
             });
             return value;
         }
-        void reader.drain(interpretChunk);
-        return interpretChunk(result.value);
+        let value;
+        try {
+            value = interpretChunk(result.value);
+        }
+        catch (error) {
+            await reader.cancel(error);
+            throw error;
+        }
+        // Later chunks settle the promises and streams inside `value`. Once the
+        // body is done, whether it ended or failed (a malformed chunk, a dropped
+        // connection), nothing can settle what is still waiting on it. A bad chunk
+        // is reported here, because nothing else awaits this.
+        reader.drain(interpretChunk).then(() => settlePendingRefs(refs.values(), createEndOfStreamError()), error => {
+            reportDrainError(error);
+            settlePendingRefs(refs.values(), error);
+        });
+        return value;
     }
     return undefined;
 }
+function releaseJSScope(id, error) {
+    const scopes = globalThis.$R;
+    const refs = scopes?.[id];
+    if (!refs)
+        return;
+    delete scopes[id];
+    settlePendingRefs(refs, error);
+}
 export async function deserializeJSStream(id, response) {
     if (!response.body) {
         throw new Error("missing body");
     }
     const reader = new SerovalChunkReader(response.body);
-    const result = await reader.next();
+    const result = await reader.next().catch(async (error) => {
+        await reader.cancel(error);
+        throw error;
+    });
     if (!result.done) {
-        reader.drain(deserialize).then(() => {
-            // @ts-ignore
-            delete $R[id];
-        }, () => {
-            // no-op
+        let value;
+        try {
+            value = deserialize(result.value);
+        }
+        catch (error) {
+            await reader.cancel(error);
+            releaseJSScope(id, error);
+            throw error;
+        }
+        reader.drain(deserialize).then(() => releaseJSScope(id, createEndOfStreamError()), error => {
+            reportDrainError(error);
+            releaseJSScope(id, error);
         });
-        return deserialize(result.value);
+        return value;
     }
     return undefined;
 }

package/dist/fns/shared.js

@@ -1,4 +1,4 @@
-import { deserializeJSONStream, deserializeJSStream } from "./serialization.js";
+import { deserializeJSONStream, deserializeJSStream, MAX_REQUEST_CHUNK_SIZE, } from "./serialization.js";
 export const BODY_FORMAT_KEY = "X-Start-Type";
 export const BODY_FORMAL_FILE = "__START__";
 export var BodyFormat;
@@ -81,7 +81,8 @@ export async function extractBody(instance, client, source) {
             if (client && import.meta.env.SEROVAL_MODE === "js") {
                 return await deserializeJSStream(instance, clone);
             }
-            return await deserializeJSONStream(clone);
+            // A server reads chunks sent by any client, so their size is limited.
+            return await deserializeJSONStream(clone, client ? undefined : { maxChunkSize: MAX_REQUEST_CHUNK_SIZE });
         case startType === BodyFormat.String:
             return await clone.text();
         case startType === BodyFormat.File: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/start",
-  "version": "2.0.5",
+  "version": "2.0.6",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/solidjs/solid-start.git",
@@ -49,8 +49,8 @@
     "path-to-regexp": "^8.4.2",
     "pathe": "^2.0.3",
     "radix3": "^1.1.2",
-    "seroval": "^1.6.0",
-    "seroval-plugins": "^1.6.0",
+    "seroval": "^1.6.8",
+    "seroval-plugins": "^1.6.8",
     "shiki": "^4.3.1",
     "solid-js": "^1.9.15",
     "srvx": "^0.12.4",

package/dist/directives/get-descriptive-name.d.ts

@@ -1,2 +0,0 @@
-import type { NodePath } from "@babel/core";
-export declare function getDescriptiveName(path: NodePath, defaultName: string): string;