@solidjs/vite-plugin 3.0.0-next.28 → 3.0.0-next.30

package/dist/esm/index.mjs

@@ -21,24 +21,54 @@ import { crawlFrameworkPkgs } from 'vitefu';
  * different URL than the one node saw — the dev middlewares use it to
  * restore the configured Vite `base` that the dev/preview base middleware
  * stripped, so the handler always sees production-shaped URLs.
+ *
+ * Handles plain HTTP/1 *and* the HTTP/2 compat API: Vite's dev server uses
+ * `http2.createSecureServer({ allowHTTP1: true })` whenever `server.https`
+ * is set without a proxy, so under https the middlewares receive
+ * `Http2ServerRequest`s. The h2/protocol/abort techniques here are
+ * reimplemented from srvx's Node adapter (github.com/h3js/srvx,
+ * src/adapters/_node) — reference, not copied code.
  */
-function webRequestFromNode(req, urlPath) {
-  const url = new URL(urlPath ?? req.url ?? '/', `http://${req.headers.host || 'localhost'}`);
+function webRequestFromNode(req, urlPath, res) {
+  // TLS sockets (https and h2) expose `encrypted`; a Request whose url says
+  // http: on a TLS connection breaks secure-cookie logic, absolute
+  // redirects, and origin checks in application code.
+  const protocol = req.socket?.encrypted ? 'https' : 'http';
+  // HTTP/2 has no Host header — the authority travels in the `:authority`
+  // pseudo-header instead.
+  const host = req.headers.host ?? req.headers[':authority'] ?? 'localhost';
+  const url = new URL(urlPath ?? req.url ?? '/', `${protocol}://${host}`);
   const headers = new Headers();
   for (const [key, value] of Object.entries(req.headers)) {
     if (value === undefined) continue;
+    // HTTP/2 pseudo-headers (:method, :path, :authority, :scheme) are not
+    // legal field names — Headers#append throws a TypeError on them.
+    if (key[0] === ':') continue;
     if (Array.isArray(value)) {
       for (const item of value) headers.append(key, item);
     } else {
       headers.append(key, value);
     }
   }
+  // Surface client disconnects as the request's AbortSignal so handlers can
+  // cancel work (streamed SSR renders, in-flight fetches). The response's
+  // 'close' fires on normal completion too; `writableEnded` distinguishes a
+  // finished response from a client that went away.
+  let signal;
+  if (res) {
+    const controller = new AbortController();
+    res.once('close', () => {
+      if (!res.writableEnded) controller.abort();
+    });
+    signal = controller.signal;
+  }
   const method = req.method || 'GET';
   const body = method === 'GET' || method === 'HEAD' ? undefined : Readable.toWeb(req);
   return new Request(url, {
     method,
     headers,
     body,
+    signal,
     // undici requires half-duplex for streamed request bodies.
     ...(body ? {
       duplex: 'half'
@@ -53,7 +83,11 @@ async function sendWebResponse(res, response) {
     if (key !== 'set-cookie') res.setHeader(key, value);
   });
   if (cookies && cookies.length) res.setHeader('set-cookie', cookies);
-  if (!response.body) {
+  // HEAD gets the head only — and the body must be *cancelled*, not pumped:
+  // node discards HEAD body writes, so streaming a long (or endless) body
+  // into the void just burns the render. (Technique from srvx.)
+  if (!response.body || res.req?.method === 'HEAD') {
+    response.body?.cancel().catch(() => {});
     res.end();
     return;
   }
@@ -910,7 +944,15 @@ function serverFunctions(options = {}, internal = {}) {
     // the same value (config merges per key), but the handler graph cannot
     // depend on that: in dev, a mutation from an already-open page can be
     // the first request after a server restart.
-    `configureServerFunctionsServer({ provideEvent: provideRequestEvent, endpoint: ${JSON.stringify(resolvedEndpoint)}${components ? ', transformResult: frameTransformResult, transformFlightResult: frameTransformFlightResult, transformDirectResult: frameTransformDirectResult' : ''} });`, `export const endpoint = ${JSON.stringify(resolvedEndpoint)};`, `export function handleServerFunctionRequest(request, options) {`, `  return handle(request, { provideEvent: provideRequestEvent, ...options });`, `}`].join('\n');
+    `configureServerFunctionsServer({ provideEvent: provideRequestEvent, endpoint: ${JSON.stringify(resolvedEndpoint)}${components ? ', transformResult: frameTransformResult, transformFlightResult: frameTransformFlightResult, transformDirectResult: frameTransformDirectResult' : ''} });`, `export const endpoint = ${JSON.stringify(resolvedEndpoint)};`,
+    // `options.event` is the same wrapper->event extension seam the SSR
+    // handler's handleRequest carries (conventionally `nativeEvent`, the
+    // platform's raw request object). The runtime's standalone handler
+    // creates its own event (`{ request, locals }`) with no init
+    // parameter, so the extension threads through its existing
+    // `createEvent` option instead — spread before `...options` so an
+    // explicit host-provided createEvent still wins.
+    `export function handleServerFunctionRequest(request, options) {`, `  const { event: eventInit, ...rest } = options || {};`, `  return handle(request, {`, `    provideEvent: provideRequestEvent,`, `    ...(eventInit ? { createEvent: (req) => ({ request: req, locals: {}, ...eventInit }) } : {}),`, `    ...rest,`, `  });`, `}`].join('\n');
   }
 
   // Function IDs are `xxHash32(root-relative path)-<count>` (see compile.ts),
@@ -994,7 +1036,15 @@ function serverFunctions(options = {}, internal = {}) {
             // middleware chain and one stub-backed request event front the
             // endpoint exactly as they front page SSR.
             const handler = await server.ssrLoadModule(internal.ssrHandler ?? HANDLER_ID$1);
-            const response = internal.ssrHandler ? await handler.handleRequest(webRequestFromNode(req, dispatchUrl)) : await handler.handleServerFunctionRequest(webRequestFromNode(req, dispatchUrl));
+            // Both dispatch shapes carry the raw Node request on the event
+            // (the `options.event` seam), matching the SSR dev middleware
+            // and what a production Node entry passes.
+            const dispatchOptions = {
+              event: {
+                nativeEvent: req
+              }
+            };
+            const response = internal.ssrHandler ? await handler.handleRequest(webRequestFromNode(req, dispatchUrl, res), dispatchOptions) : await handler.handleServerFunctionRequest(webRequestFromNode(req, dispatchUrl, res), dispatchOptions);
             await sendWebResponse(res, response);
           })().catch(error => {
             if (error instanceof Error) server.ssrFixStacktrace(error);
@@ -1566,7 +1616,14 @@ function startServe(options, internal = {}) {
     // The runtime's response-head lifecycle: commit at shell flush,
     // pre-flush Location as a real redirect, post-flush Location as the
     // script fallback; the transform injects the doctype/head pieces.
-    `  return createSSRResponse(result, event, {`, `    responseInit: options.responseInit,`, `    nonce: options.nonce,`, `    transformChunk: createHtmlChunkTransform(clientEntry, options.devHead),`, `  });`, `}`, ``, `export async function handleRequest(request, options = {}) {`, `  const event = createRequestEvent(request);`,
+    `  return createSSRResponse(result, event, {`, `    responseInit: options.responseInit,`, `    nonce: options.nonce,`, `    transformChunk: createHtmlChunkTransform(clientEntry, options.devHead),`, `  });`, `}`, ``, `export async function handleRequest(request, options = {}) {`,
+    // `options.event` is the public wrapper->event extension seam: extra
+    // fields (conventionally `nativeEvent`, the platform's raw request
+    // object) spread over the event's defaults at creation, so hosts and
+    // custom server entries can extend what getRequestEvent() answers
+    // with — no new convention beyond createRequestEvent's own init
+    // parameter (spreading undefined is a no-op).
+    `  const event = createRequestEvent(request, options.event);`,
     // Middleware runs inside the request scope, after event creation —
     // getRequestEvent() answers in middleware exactly as in app code, and
     // nothing reaches the wire until the outermost middleware returns.
@@ -1781,7 +1838,14 @@ function startServe(options, internal = {}) {
             // server-function endpoint) and hands the URL to application
             // code, so restore the base — the deployed production handler
             // receives base-prefixed URLs and preview must match it.
-            const response = await handler.handleRequest(webRequestFromNode(req, joinBase(base, req.url || '/')));
+            const response = await handler.handleRequest(webRequestFromNode(req, joinBase(base, req.url || '/'), res),
+            // Same event extension the dev middleware and a production
+            // Node entry pass: the raw Node request as `nativeEvent`.
+            {
+              event: {
+                nativeEvent: req
+              }
+            });
             // Preview's compression middleware buffers whole responses;
             // opting HTML out keeps SSR streaming observable, matching
             // production behavior.
@@ -1831,9 +1895,16 @@ function startServe(options, internal = {}) {
             // the configured `base` from req.url; restore it so the app
             // sees the same URLs in dev as in production (where the
             // deployed handler receives base-prefixed requests).
-            const response = await handler.handleRequest(webRequestFromNode(req, joinBase(base, req.url || '/')), {
+            const response = await handler.handleRequest(webRequestFromNode(req, joinBase(base, req.url || '/'), res), {
               devHead,
-              pageRequest
+              pageRequest,
+              // The raw Node request on the event, matching what a
+              // production Node server entry passes through the
+              // `options.event` seam — getRequestEvent().nativeEvent
+              // answers the same in dev as deployed.
+              event: {
+                nativeEvent: req
+              }
             });
             // A non-page request the chain never handled: the terminal
             // dispatch answered with the marked 404 — hand it back to
@@ -1914,6 +1985,11 @@ function startServe(options, internal = {}) {
 // time work, secrets rotate without a rebuild, and no secret value exists
 // in any dist artifact. Build-time server-value failures downgrade to a
 // warning (boot enforces); dev failures stay hard errors — dev IS runtime.
+// Boot validation is synchronous by design: the generated server module
+// contains no top-level await (a TLA chunk forces esnext on downstream
+// bundlers — Nitro's node-server preset rejects it), which is why async
+// validators are rejected for `server` keys (client keys may stay async;
+// they are awaited at build time where the values are baked).
 //
 // A failed validation fails the build; in dev it renders Vite's error
 // overlay with the per-key report (the virtual modules throw it on load)
@@ -2184,7 +2260,23 @@ function startEnv(option) {
     for (const side of ['server', 'client']) {
       for (const [key, validator] of Object.entries(schema[side] ?? {})) {
         let result = validator['~standard'].validate(raw[key]);
-        if (result instanceof Promise) result = await result;
+        if (result instanceof Promise) {
+          // Async validation is fine for `client` keys — their values are
+          // baked right here at build time, where awaiting costs nothing.
+          // `server` keys validate process.env at boot through generated
+          // code that is deliberately synchronous (a top-level await in the
+          // server env chunk forces esnext on every downstream bundle
+          // target — Nitro's node-server preset rejects it outright), so a
+          // Promise-returning server validator could only ever fail at
+          // deploy boot. Async-ness is a property of the schema, not the
+          // value, so fail fast here with the fix in the message. Boot
+          // still backstops (schemas whose sync prefix short-circuits at
+          // build time can go async on real values).
+          if (side === 'server') {
+            throw new Error(`[@solidjs/vite-plugin] server env var "${key}" in ${envFile} uses an async ` + `validator (validate() returned a Promise). Server env is validated ` + `synchronously at boot — the generated module contains no top-level ` + `await, so server bundles work on non-esnext targets — which async ` + `validators cannot do. Make the validator synchronous (drop async ` + `refinements/transforms), or run the async check in application code.`);
+          }
+          result = await result;
+        }
         if (result.issues && result.issues.length) {
           for (const issue of result.issues) {
             const at = (issue.path ?? []).map(segment => typeof segment === 'object' && segment !== null && 'key' in segment ? String(segment.key) : String(segment)).join('.');
@@ -2261,6 +2353,16 @@ function startEnv(option) {
   // means. Platform-injected vars that don't exist at build time work,
   // secrets rotate without a rebuild, and no secret value exists in any
   // dist artifact.
+  //
+  // The generated code is deliberately free of top-level await. Module
+  // init is the only point where "validated and frozen before any
+  // importer's body runs" can be guaranteed — user server modules read
+  // `env.KEY` at their own top level — and the only async thing here is
+  // Standard Schema's option to return a Promise from validate(). A TLA
+  // chunk breaks every downstream bundler with a non-esnext target
+  // (Nitro's node-server preset in practice), so validation runs
+  // synchronously and a Promise-returning server validator is itself a
+  // boot issue (build/config time rejects it earlier when detectable).
   function serverEnvModuleCode(loaded) {
     const serverKeys = Object.keys(loaded.schema.server ?? {});
     const baked = `const __env = ${JSON.stringify(loaded.client)};`;
@@ -2271,7 +2373,7 @@ function startEnv(option) {
       };
     }
     return {
-      code: [`// Generated by @solidjs/vite-plugin (start.env) — server env.`, `// Server values are read from process.env and validated at boot;`, `// client (public) values are baked at build time.`, `import __schema from ${JSON.stringify(envFileAbs)};`, baked, `const __issues = [];`, `for (const __key of ${JSON.stringify(serverKeys)}) {`, `  let __result = __schema.server[__key]['~standard'].validate(process.env[__key]);`, `  if (__result instanceof Promise) __result = await __result;`, `  if (__result.issues && __result.issues.length) {`, `    for (const __issue of __result.issues) __issues.push('  \\u2717 ' + __key + ': ' + __issue.message);`, `  } else {`, `    __env[__key] = __result.value;`, `  }`, `}`, `if (__issues.length) {`, `  throw new Error(`, `    '[@solidjs/vite-plugin] server env validation failed at boot (' + __issues.length +`, `    ' issue' + (__issues.length === 1 ? '' : 's') + ') \\u2014 schema: ' + ${JSON.stringify(envFile)} +`, `    '\\n\\n' + __issues.join('\\n') +`, `    '\\n\\nServer env is read from process.env at boot, not baked at build time: set the ' +`, `    'variables in the server process environment.'`, `  );`, `}`, `export const env = Object.freeze(__env);`, `export default env;`].join('\n'),
+      code: [`// Generated by @solidjs/vite-plugin (start.env) — server env.`, `// Server values are read from process.env and validated at boot;`, `// client (public) values are baked at build time. Boot validation is`, `// synchronous on purpose: a top-level await here would force esnext`, `// on every downstream bundle target (Nitro's node-server preset and`, `// anything else below esnext rejects a TLA chunk outright).`, `import __schema from ${JSON.stringify(envFileAbs)};`, baked, `const __issues = [];`, `for (const __key of ${JSON.stringify(serverKeys)}) {`, `  const __result = __schema.server[__key]['~standard'].validate(process.env[__key]);`, `  if (__result && typeof __result.then === 'function') {`, `    __issues.push('  \\u2717 ' + __key + ': validator returned a Promise \\u2014 async validators are not supported for server keys (boot validation is synchronous so the server bundle carries no top-level await); make this validator synchronous');`, `  } else if (__result.issues && __result.issues.length) {`, `    for (const __issue of __result.issues) __issues.push('  \\u2717 ' + __key + ': ' + __issue.message);`, `  } else {`, `    __env[__key] = __result.value;`, `  }`, `}`, `if (__issues.length) {`, `  throw new Error(`, `    '[@solidjs/vite-plugin] server env validation failed at boot (' + __issues.length +`, `    ' issue' + (__issues.length === 1 ? '' : 's') + ') \\u2014 schema: ' + ${JSON.stringify(envFile)} +`, `    '\\n\\n' + __issues.join('\\n') +`, `    '\\n\\nServer env is read from process.env at boot, not baked at build time: set the ' +`, `    'variables in the server process environment.'`, `  );`, `}`, `export const env = Object.freeze(__env);`, `export default env;`].join('\n'),
       moduleType: 'js'
     };
   }
@@ -2947,12 +3049,19 @@ function solidPlugin(options = {}) {
           exclude: solidPkgsConfig.optimizeDeps.exclude,
           // Vite 8+ uses Rolldown for dependency scanning. Rolldown defaults to
           // React's automatic JSX runtime for .tsx files, injecting a
-          // react/jsx-dev-runtime import. Tell it to preserve JSX as-is since
-          // this plugin handles JSX transformation via babel-preset-solid.
+          // react/jsx-dev-runtime import that fails to resolve and aborts the
+          // scan. 'preserve' is no fix: the scanner re-parses the transformed
+          // output as plain JS, so any preserved JSX is a hard parse error
+          // (issue #262). The classic runtime is the only scan-safe lowering:
+          // it emits bare `React.createElement` calls without injecting any
+          // import, and the scan output is never executed — it only exists so
+          // rolldown can walk the import graph.
           ...(isVite8 ? {
             rolldownOptions: {
               transform: {
-                jsx: 'preserve'
+                jsx: {
+                  runtime: 'classic'
+                }
               }
             }
           } : {})