@solidjs/web 2.0.0-beta.25 → 2.0.0-beta.27

package/server-functions/dist/server.js

@@ -8,6 +8,7 @@ function isResponseEnvelope(value) {
 }
 
 Feature.AggregateError | Feature.BigIntTypedArray;
+const serializeOnlyDisabledFeatures = () => process.env.NODE_ENV === "development" ? 0 : Feature.ErrorPrototypeStack;
 const DEFAULT_WEB_PLUGINS = Object.freeze([AbortSignalPlugin,
 CustomEventPlugin, DOMExceptionPlugin, EventPlugin,
 FormDataPlugin, HeadersPlugin, ReadableStreamPlugin, RequestPlugin, ResponsePlugin, URLSearchParamsPlugin, URLPlugin]);
@@ -33,11 +34,13 @@ function serializeJSON(value, {
   onError,
   ...codecOptions
 }) {
+  const resolved = resolveCodecOptions(codecOptions);
   return toCrossJSONStream(value, {
     onParse,
     onDone,
     onError,
-    ...resolveCodecOptions(codecOptions)
+    ...resolved,
+    disabledFeatures: resolved.disabledFeatures | serializeOnlyDisabledFeatures()
   });
 }
 function createJSONDeserializer(options) {
@@ -115,6 +118,18 @@ const INSTANCE_HEADER = "X-Server-Function-Instance";
 const BODY_FORMAT_HEADER = "X-Server-Function-Format";
 const SINGLE_FLIGHT_HEADER = "X-Single-Flight";
 const FILE_FORM_KEY = "__server_function_file__";
+const FLASH_COOKIE = "flash";
+const FLASH_MATCHER = new RegExp(`(?:^|;\\s*)${FLASH_COOKIE}=([^;]+)`);
+function hasFlashCookie(cookieHeader) {
+  return !!cookieHeader && FLASH_MATCHER.test(cookieHeader);
+}
+function matchFlashCookie(cookieHeader) {
+  const match = cookieHeader && cookieHeader.match(FLASH_MATCHER);
+  return match ? match[1] : undefined;
+}
+function clearFlashCookie() {
+  return `${FLASH_COOKIE}=; Max-Age=0; Path=/`;
+}
 const BodyFormat = {
   Serialized: "0",
   String: "1",
@@ -247,15 +262,15 @@ class ChunkReader {
     }
   }
   async next() {
-    if (this.buffer.length === 0) {
+    while (this.buffer.length < 12) {
       if (this.done) {
-        return {
+        if (this.buffer.length === 0) return {
           done: true,
           value: undefined
         };
+        throw new Error("Malformed server function stream.");
       }
       await this.readChunk();
-      return await this.next();
     }
     const head = new TextDecoder().decode(this.buffer.subarray(1, 11));
     const bytes = Number.parseInt(head, 16);
@@ -327,11 +342,61 @@ async function decodeResponse(response, codecOptions) {
   return await extractBody(response, codecOptions === undefined ? codecConfig.codec : codecOptions);
 }
 
+function encodeInputValue(value) {
+  if (value instanceof FormData) return {
+    $f: [...value.entries()].filter(([, v]) => typeof v === "string")
+  };
+  if (value instanceof URLSearchParams) return {
+    $u: [...value.entries()]
+  };
+  return value;
+}
+function decodeInputValue(value) {
+  if (value && typeof value === "object") {
+    if (Array.isArray(value.$f)) {
+      const form = new FormData();
+      for (const [k, v] of value.$f) form.append(k, v);
+      return form;
+    }
+    if (Array.isArray(value.$u)) return new URLSearchParams(value.$u);
+  }
+  return value;
+}
+function encodeFlashCookie(url, result, input, thrown) {
+  const isError = result instanceof Error;
+  const payload = {
+    url,
+    result: isError ? result.message : result,
+    error: isError,
+    thrown: !!thrown,
+    input: input.map(encodeInputValue)
+  };
+  return `${FLASH_COOKIE}=${encodeURIComponent(JSON.stringify(payload))}; Secure; HttpOnly; Path=/`;
+}
+function decodeFlashCookie(cookieHeader) {
+  const match = matchFlashCookie(cookieHeader);
+  if (!match) return;
+  try {
+    const payload = JSON.parse(decodeURIComponent(match));
+    if (!payload || !payload.result) return;
+    const result = payload.error ? new Error(payload.result) : payload.result;
+    return {
+      input: Array.isArray(payload.input) ? payload.input.map(decodeInputValue) : [],
+      url: payload.url,
+      result: payload.thrown ? undefined : result,
+      error: payload.thrown ? result : undefined
+    };
+  } catch (error) {
+    console.error(error);
+  }
+}
+
 const config = {
   provideEvent: undefined,
   collectFlightData: undefined,
   transformResult: undefined,
   transformDirectResult: undefined,
+  handleNoJS: undefined,
   endpoint: "/_server"
 };
 function configureServerFunctionsServer({
@@ -339,6 +404,7 @@ function configureServerFunctionsServer({
   collectFlightData,
   transformResult,
   transformDirectResult,
+  handleNoJS,
   endpoint,
   codec
 } = {}) {
@@ -346,6 +412,7 @@ function configureServerFunctionsServer({
   if (collectFlightData !== undefined) config.collectFlightData = collectFlightData;
   if (transformResult !== undefined) config.transformResult = transformResult;
   if (transformDirectResult !== undefined) config.transformDirectResult = transformDirectResult;
+  if (handleNoJS !== undefined) config.handleNoJS = handleNoJS;
   if (endpoint !== undefined) config.endpoint = endpoint;
   if (codec !== undefined) configureServerFunctionsCodec(codec);
 }
@@ -471,6 +538,87 @@ async function foldFlightData(hook, event, headers, outcome) {
     data
   };
 }
+function parseSetCookie(setCookie) {
+  const [pair, ...attributes] = setCookie.split(";");
+  const eq = pair.indexOf("=");
+  if (eq < 0) return undefined;
+  const parsed = {
+    name: pair.slice(0, eq).trim(),
+    value: pair.slice(eq + 1).trim()
+  };
+  for (const attribute of attributes) {
+    const attrEq = attribute.indexOf("=");
+    const key = (attrEq < 0 ? attribute : attribute.slice(0, attrEq)).trim().toLowerCase();
+    const value = attrEq < 0 ? "" : attribute.slice(attrEq + 1).trim();
+    if (key === "max-age") parsed.maxAge = Number(value);else if (key === "expires") parsed.expires = new Date(value);
+  }
+  return parsed;
+}
+function foldSetCookies(headers, setCookies) {
+  const folded = new Headers(headers);
+  if (!setCookies.length) return folded;
+  const cookies = {};
+  for (const pair of folded.get("cookie")?.split(";") ?? []) {
+    const eq = pair.indexOf("=");
+    if (eq > -1) cookies[pair.slice(0, eq).trim()] = pair.slice(eq + 1).trim();
+  }
+  for (const setCookie of setCookies) {
+    const parsed = parseSetCookie(setCookie);
+    if (!parsed) continue;
+    if (parsed.maxAge != null && parsed.maxAge <= 0 || parsed.expires != null && parsed.expires.getTime() <= Date.now()) {
+      delete cookies[parsed.name];
+    } else {
+      cookies[parsed.name] = parsed.value;
+    }
+  }
+  folded.delete("cookie");
+  const serialized = Object.entries(cookies).map(([name, value]) => `${name}=${value}`).join("; ");
+  if (serialized) folded.set("cookie", serialized);
+  return folded;
+}
+const validRedirectStatuses = new Set([301, 302, 303, 307, 308]);
+function createNoJSHandler({
+  base = ""
+} = {}) {
+  return function handleNoJS(result, request, args, thrown) {
+    const url = new URL(request.url);
+    let back = new URL(base || "/", url.origin).toString();
+    try {
+      const referer = request.headers.get("referer");
+      if (referer) back = new URL(referer).toString();
+    } catch {}
+    let status = 303;
+    let headers;
+    if (result instanceof Response) {
+      headers = new Headers(result.headers);
+      if (result.headers.has("Location")) {
+        headers.set("Location", new URL(result.headers.get("Location"), url.origin + base).toString());
+        if (validRedirectStatuses.has(result.status)) status = result.status;
+      } else {
+        headers.set("Location", back);
+      }
+      headers.delete("Content-Type");
+      headers.delete("Content-Length");
+    } else {
+      headers = new Headers({
+        Location: back
+      });
+    }
+    if (result && !(result instanceof Response)) {
+      headers.append("Set-Cookie", encodeFlashCookie(url.pathname + url.search, result, args, thrown));
+    }
+    return new Response(null, {
+      status,
+      headers
+    });
+  };
+}
+let defaultNoJSHandler;
+function isFormPost(request) {
+  if (request.method !== "POST" || request.headers.has(BODY_FORMAT_HEADER)) return false;
+  const type = request.headers.get("content-type") || "";
+  return type.startsWith("application/x-www-form-urlencoded") || type.startsWith("multipart/form-data");
+}
 function serializedResponse(value, headers, codec) {
   headers.set(BODY_FORMAT_HEADER, BodyFormat.Serialized);
   headers.set("Content-Type", "text/plain");
@@ -528,6 +676,7 @@ async function handleServerFunctionRequest(request, options = {}) {
   const provide = options.provideEvent || provideEvent;
   const flightHook = options.collectFlightData !== undefined ? options.collectFlightData : config.collectFlightData;
   const transformResult = options.transformResult !== undefined ? options.transformResult : config.transformResult;
+  const handleNoJS = options.handleNoJS !== undefined ? options.handleNoJS : config.handleNoJS !== undefined ? config.handleNoJS : isFormPost(request) ? defaultNoJSHandler || (defaultNoJSHandler = createNoJSHandler()) : undefined;
   const collectsFlight = !!(flightHook && instance && request.headers.has(SINGLE_FLIGHT_HEADER));
   const parsed = await parseArguments(request, url, instance, codec);
   const headers = new Headers();
@@ -551,7 +700,7 @@ async function handleServerFunctionRequest(request, options = {}) {
         response,
         value
       } = result;
-      if (!instance && !options.handleNoJS && response && response.body) {
+      if (!instance && !handleNoJS && response && response.body) {
         return response;
       }
       if (response && response.headers) {
@@ -587,7 +736,7 @@ async function handleServerFunctionRequest(request, options = {}) {
       });
     }
     if (!instance) {
-      if (options.handleNoJS) return options.handleNoJS(result, request, parsed);
+      if (handleNoJS) return handleNoJS(result, request, parsed);
       if (result instanceof Response) return result;
       return encodeResult(result, headers, 200, codec);
     }
@@ -639,13 +788,13 @@ async function handleServerFunctionRequest(request, options = {}) {
       }
       headers.set(ERROR_HEADER, "true");
       if (!instance) {
-        if (options.handleNoJS) return options.handleNoJS(x, request, parsed, true);
+        if (handleNoJS) return handleNoJS(x ?? metadata, request, parsed, true);
         if (x instanceof Response) return x;
       }
       return encodeResult(x, headers, status, codec);
     }
     if (!instance) {
-      if (options.handleNoJS) return options.handleNoJS(x, request, parsed, true);
+      if (handleNoJS) return handleNoJS(x, request, parsed, true);
       const message = x instanceof Error ? x.message : String(x);
       return new Response(process.env.NODE_ENV === "development" ? message : null, {
         status: 500
@@ -657,4 +806,4 @@ async function handleServerFunctionRequest(request, options = {}) {
   }
 }
 
-export { ERROR_HEADER, FUNCTION_HEADER, GET, INSTANCE_HEADER, SINGLE_FLIGHT_HEADER, configureServerFunctionsServer, createServerReference, decodeErrorHeaderValue, decodeResponse, encodeErrorHeaderValue, getServerFunction, getServerFunctionMeta, getServerFunctionMetadata, handleServerFunctionRequest, isServerFunction, registerServerFunction, registerServerReference, subscribeFlightData, withMeta };
+export { ERROR_HEADER, FLASH_COOKIE, FUNCTION_HEADER, GET, INSTANCE_HEADER, SINGLE_FLIGHT_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeResponse, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getServerFunction, getServerFunctionMeta, getServerFunctionMetadata, handleServerFunctionRequest, hasFlashCookie, isServerFunction, registerServerFunction, registerServerReference, subscribeFlightData, withMeta };

package/types/client.d.ts

@@ -109,9 +109,9 @@ export function style(
 export function getOwner(): unknown;
 export function mergeProps(...sources: unknown[]): unknown;
 export function dynamicProperty(props: unknown, key: string): unknown;
-export function applyRef(
-  r: ((element: Element) => void) | ((element: Element) => void)[],
-  element: Element
+export function applyRef<T extends Element = Element>(
+  r: ((element: NoInfer<T>) => void) | ((element: NoInfer<T>) => void)[],
+  element: T
 ): void;
 export function ref(
   fn: () => ((element: Element) => void) | ((element: Element) => void)[],

package/types/frames/client.d.ts

@@ -1,4 +1,4 @@
-export { createFrame, createFrameHost, createFrameInsertable, FRAME_APPLIED_EVENT } from "./frame-client.js";
+export { createFrame, createFrameHost, createFrameElement, FRAME_APPLIED_EVENT } from "./frame-client.js";
 export { FRAME_STREAM_HEADER, applyFrameResponse, isFrameStreamResponse, createServerComponentHandler } from "./frame-transport.js";
 export { createJSONDataTable } from "./serializer.js";
 export declare function getFrameHost(): any;

package/types/frames/frame-client.d.ts

@@ -41,15 +41,6 @@ export type FrameChunk =
       inlineStyles?: { id: string; content?: string; attrs?: Record<string, string> }[];
     }
   | { type: "slot"; id: string; version: number; key: string; args: Record<string, unknown> }
-  | { type: "template"; id: string; version: number; key: string; html: string; fields: string[] }
-  | {
-      type: "block";
-      id: string;
-      version: number;
-      key: string;
-      template: string;
-      values: unknown[];
-    }
   | { type: "complete"; id: string; version: number }
   | { type: "error"; id: string; version: number; key?: string; error: unknown };
 
@@ -170,7 +161,7 @@ export interface FrameHostOptions {
 
 export function createFrameHost(options?: FrameHostOptions): FrameHost;
 
-/** Options for `createFrame` / `createFrameInsertable`. */
+/** Options for `createFrame` / `createFrameElement`. */
 export interface FrameOptions {
   /** Register with this host under `id`, receiving routed/buffered chunks. */
   host?: FrameHost;
@@ -194,29 +185,44 @@ export interface FrameOptions {
    * streamed chunks).
    */
   ownerScope?<T>(fn: () => T): T;
+  /**
+   * Boundary-driven segment reveal. When present, `#revealSegment` hands the
+   * placeholder seam to this hook instead of swapping imperatively: the binding
+   * reconstructs a client `<Loading>` there — `fallback` is the placeholder's
+   * own template content (shown while holding), `content()` materializes the
+   * segment and renders its client fills INSIDE the boundary so their readiness
+   * gates the reveal — and inserts it before `before`. An unboundaried async
+   * fill suspends up to that boundary and is covered instead of orphaned; one
+   * boundary per revealed segment, i.e. per author-placed `<Loading>`. Omit it
+   * for the framework-agnostic imperative swap (no reactive reveal).
+   */
+  reveal?(seam: { before: Node; fallback: Node[]; content: () => Node | DocumentFragment }): void;
 }
 
-/** A frame rendering into an element boundary. */
+/**
+ * A frame rendering into an EXISTING element boundary. Pass `adopt: true` for
+ * the document-SSR path: the element already holds server-rendered content,
+ * so the first apply morphs against it and slots sync immediately (hydration
+ * attach), claiming their server-rendered DOM — a document boot needs no
+ * chunk.
+ */
 export function createFrame(boundary: Element, options?: FrameOptions): Frame;
 
+/** The default boundary/region element tag and its id attribute — the DOM
+ *  contract the producer emits at t=0 and the consumer creates/adopts. */
+export const FRAME_TAG: "dx-frame";
+export const FRAME_ID_ATTR: "data-fid";
+
 /**
- * A branded frame-insertable value: the client runtime's `insert` recognizes
- * it (registered `$$FRAME` symbol) and calls the mount handler the value
- * carries — a comment range is established at the insertion point and a
- * host-registered frame binds to it. One static mount per value; lifecycle
- * belongs to the creator via `dispose()` (register it with your owner's
- * cleanup).
+ * Create a boundary/region ELEMENT and bind a host-registered frame to it.
+ * The frame mounts INTO the element (server content is its children, morphed
+ * in place). Because the boundary is a real node, `insert` places the
+ * returned `element` in any position — single, array, or fragment — with no
+ * special-casing. One frame per element; lifecycle belongs to the creator via
+ * `dispose()` (register it with your owner's cleanup).
  */
-export function createFrameInsertable(options: FrameOptions): {
-  readonly frame: Frame | null;
+export function createFrameElement(options: FrameOptions): {
+  readonly element: Element;
+  readonly frame: Frame;
   dispose(): void;
 };
-
-/**
- * Binds a frame to an EXISTING marker range — the document-SSR adoption
- * path: the page already holds the server-rendered boundary between
- * `frame:<id>:start`/`:end` comments; the frame constructed over it treats
- * that content as its own (first stream morphs rather than materializes)
- * and slots sync immediately, claiming their server-rendered DOM.
- */
-export function adoptFrameRange(start: Comment, end: Comment, options?: FrameOptions): Frame;

package/types/frames/serializer.d.ts

@@ -37,7 +37,9 @@ export interface WebSerializerOptions {
   scopeId?: string;
   /**
    * Seroval feature bitflags to exclude from output. Defaults to disabling
-   * post-ES2017 features (AggregateError, BigInt typed arrays).
+   * post-ES2017 features (AggregateError, BigInt typed arrays). Outside
+   * development, `Error.prototype.stack` is additionally stripped on top of
+   * any override — serialized stacks leak server paths to the client.
    */
   disabledFeatures?: number;
   /** Extra plugins, composed ahead of `DEFAULT_WEB_PLUGINS`. */
@@ -101,6 +103,10 @@ export interface JSONCodecOptions {
   /**
    * Seroval feature bitflags to exclude. Defaults to disabling `RegExp`
    * (payloads may come from an untrusted peer). Must match on both peers.
+   * Outside development, the encoding side additionally strips
+   * `Error.prototype.stack` on top of any override — serialized stacks leak
+   * server paths to the client. Decoding stays permissive, so payloads from
+   * a development peer still round-trip.
    */
   disabledFeatures?: number;
   /** Maximum parse/deserialize depth. Defaults to 64. Must match on both peers. */

package/types/jsx.d.ts

@@ -240,7 +240,7 @@ export namespace JSX {
   }
 
   type RefCallback<T> = (el: T) => void;
-  type Ref<T> = T | RefCallback<T> | (RefCallback<T> | Ref<T>)[];
+  type Ref<T> = T | RefCallback<T> | Ref<T>[];
 
   interface IntrinsicAttributes {
     ref?: Ref<unknown> | undefined;

package/types/response.d.ts

@@ -49,6 +49,16 @@ export interface Href {
  */
 export function isHref(value: unknown): value is Href;
 
+/**
+ * Response header naming the cache keys a mutation invalidated
+ * (`"X-Revalidate"`), comma separated. The response helpers below set it
+ * from their `revalidate` option; the client transport treats its presence
+ * as control flow, and integrations read it to invalidate their own cache.
+ * Core never inspects the keys, so how they are matched (prefixes, exact
+ * names, namespaces) is the integration's business.
+ */
+export const REVALIDATE_HEADER: string;
+
 /** `ResponseInit` accepted by the response helpers, plus `revalidate`. */
 export interface ResponseHelperInit extends ResponseInit {
   /**

package/types/serializer.d.ts

@@ -37,7 +37,9 @@ export interface WebSerializerOptions {
   scopeId?: string;
   /**
    * Seroval feature bitflags to exclude from output. Defaults to disabling
-   * post-ES2017 features (AggregateError, BigInt typed arrays).
+   * post-ES2017 features (AggregateError, BigInt typed arrays). Outside
+   * development, `Error.prototype.stack` is additionally stripped on top of
+   * any override — serialized stacks leak server paths to the client.
    */
   disabledFeatures?: number;
   /** Extra plugins, composed ahead of `DEFAULT_WEB_PLUGINS`. */
@@ -101,6 +103,10 @@ export interface JSONCodecOptions {
   /**
    * Seroval feature bitflags to exclude. Defaults to disabling `RegExp`
    * (payloads may come from an untrusted peer). Must match on both peers.
+   * Outside development, the encoding side additionally strips
+   * `Error.prototype.stack` on top of any override — serialized stacks leak
+   * server paths to the client. Decoding stays permissive, so payloads from
+   * a development peer still round-trip.
    */
   disabledFeatures?: number;
   /** Maximum parse/deserialize depth. Defaults to 64. Must match on both peers. */

package/types/server-functions/client.d.ts

@@ -3,13 +3,16 @@ import { ServerFunction, ServerFunctionMetadata } from "./shared.js";
 
 export {
   ERROR_HEADER,
+  FLASH_COOKIE,
   FUNCTION_HEADER,
   INSTANCE_HEADER,
   SINGLE_FLIGHT_HEADER,
+  clearFlashCookie,
   decodeErrorHeaderValue,
   decodeResponse,
   encodeErrorHeaderValue,
   getServerFunctionMetadata,
+  hasFlashCookie,
   isServerFunction,
   subscribeFlightData,
   withMeta

package/types/server-functions/flash.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The outcome of a call made without the client runtime, as it rides the
+ * flash cookie: what was submitted, where, and what came back. `result` and
+ * `error` are mutually exclusive — a thrown outcome fills `error`, a
+ * returned one fills `result` — mirroring the split a scripted call sees.
+ */
+export interface FlashSubmission {
+  /** The arguments the call was made with (files are dropped). */
+  input: any[];
+  /** The call's url: pathname + search of the server function request. */
+  url: string;
+  /** The returned value, when the call returned. */
+  result?: any;
+  /** The thrown value, when the call threw. */
+  error?: any;
+}
+
+/**
+ * Encodes the outcome of a no-JS call as a `Set-Cookie` value, for the
+ * handler to send with its redirect. `url` identifies which submission the
+ * outcome belongs to; pass `thrown` when the call threw rather than
+ * returned.
+ *
+ * The payload is JSON inside the cookie: `FormData` and `URLSearchParams`
+ * arguments are captured as entry pairs and revived on decode, and `File`
+ * entries are dropped (they cannot ride a cookie). Keep in mind the 4 KB
+ * cookie budget — outcomes larger than that will not survive the round
+ * trip.
+ */
+export function encodeFlashCookie(url: string, result: any, input: any[], thrown?: boolean): string;
+
+/**
+ * Decodes the flash cookie out of a request's `Cookie` header, for the
+ * render that follows the redirect. Returns undefined when the cookie is
+ * absent or unreadable — a malformed cookie never takes down the render,
+ * and `clearFlashCookie` should be appended regardless.
+ */
+export function decodeFlashCookie(cookieHeader: string | null): FlashSubmission | undefined;

package/types/server-functions/server.d.ts

@@ -4,13 +4,16 @@ import { RequestEvent } from "../server.js";
 
 export {
   ERROR_HEADER,
+  FLASH_COOKIE,
   FUNCTION_HEADER,
   INSTANCE_HEADER,
   SINGLE_FLIGHT_HEADER,
+  clearFlashCookie,
   decodeErrorHeaderValue,
   decodeResponse,
   encodeErrorHeaderValue,
   getServerFunctionMetadata,
+  hasFlashCookie,
   isServerFunction,
   subscribeFlightData,
   withMeta
@@ -22,6 +25,8 @@ export type {
   ServerFunctionMetadata,
   SingleFlightPayload
 } from "./shared.js";
+export { decodeFlashCookie, encodeFlashCookie } from "./flash.js";
+export type { FlashSubmission } from "./flash.js";
 import { ServerFunction } from "./shared.js";
 
 /**
@@ -85,6 +90,57 @@ export type CollectFlightDataHook = (
   outcome: ServerFunctionOutcome
 ) => unknown | Promise<unknown>;
 
+/**
+ * Request headers with `setCookies` folded into the `Cookie` header, as the
+ * browser would have applied them before its next request. Later entries
+ * win on conflict, and deletions are honored (`Max-Age` at or below zero,
+ * `Expires` in the past). The input headers are not modified.
+ *
+ * For work re-run on the server after a mutation — a
+ * `CollectFlightDataHook` gathering fresh data, typically. That pass starts
+ * from the request that triggered the mutation, whose cookies are
+ * pre-mutation by definition, so a read depending on a session the mutation
+ * just established would otherwise see the old state. Which responses
+ * contribute their `Set-Cookie`s, and in what order, is the caller's
+ * decision.
+ *
+ * @example
+ * ```ts
+ * const headers = foldSetCookies(event.request.headers, [
+ *   ...(event.response?.headers?.getSetCookie() ?? []),
+ *   ...(outcome.response?.headers?.getSetCookie() ?? [])
+ * ]);
+ * ```
+ */
+export function foldSetCookies(headers: Headers, setCookies: readonly string[]): Headers;
+
+/** Options for `createNoJSHandler`. */
+export interface NoJSHandlerOptions {
+  /** The app's mount path, for resolving a relative redirect `Location`. */
+  base?: string;
+}
+
+/**
+ * Builds the `handleNoJS` implementation for the no-JS form convention: a
+ * form posted without the client runtime has no way to receive a value, so
+ * the call redirects back to the referring page (or to the result's own
+ * `Location`, resolved against `base`) with the outcome riding a one-shot
+ * flash cookie. `303 See Other` turns the POST into a GET unless the result
+ * names a redirect status of its own. A result that is already a `Response`
+ * carries its meaning in its metadata and is not flashed.
+ *
+ * The render that follows reads the cookie with `decodeFlashCookie` and
+ * surfaces the outcome however it likes — that half is the integration's.
+ *
+ * The handler applies to every call it receives. `handleServerFunctionRequest`
+ * already uses it for browser form posts, so wire it explicitly only to set
+ * a `base`, or to extend the convention to direct HTTP calls by registering
+ * it through `configureServerFunctionsServer`.
+ */
+export function createNoJSHandler(
+  options?: NoJSHandlerOptions
+): (result: unknown, request: Request, args: unknown[], thrown?: boolean) => Response;
+
 /** Options for `configureServerFunctionsServer`. */
 export interface ServerFunctionsServerConfig {
   /**
@@ -119,6 +175,23 @@ export interface ServerFunctionsServerConfig {
    * calls during document SSR — e.g. frames' `frameTransformDirectResult`.
    */
   transformDirectResult?(value: unknown, options: { id: string }): unknown;
+  /**
+   * Server-wide response builder for calls made without the client runtime
+   * (see `handleNoJS` in `HandleServerFunctionRequestOptions`); a
+   * per-request option overrides it. Set it to `createNoJSHandler({ base })`
+   * to apply the convention to every non-scripted call rather than only to
+   * browser form posts, to a handler of your own to replace it, or to
+   * `null` to disable the built-in convention and answer form posts with
+   * the plain serialized response.
+   */
+  handleNoJS?:
+    | ((
+        result: unknown,
+        request: Request,
+        args: unknown[],
+        thrown?: boolean
+      ) => Response | Promise<Response>)
+    | null;
   /**
    * Endpoint the HTTP handler is mounted on, used for the `url` of SSR'd
    * references (e.g. form actions) — must match the client configuration.
@@ -285,11 +358,13 @@ export interface HandleServerFunctionOptions {
   collectFlightData?: CollectFlightDataHook;
   /**
    * Builds the response for calls made without the client runtime (no
-   * instance header — no-JS form posts, direct HTTP) — the extension
-   * point for conventions like redirect-with-flash-cookie. Receives the
+   * instance header — no-JS form posts, direct HTTP). Receives the
    * (transformed) result, the request, and the decoded arguments; `thrown`
-   * is set when the result was thrown rather than returned. Defaults to
-   * the normal serialized response.
+   * is set when the result was thrown rather than returned.
+   *
+   * Overrides the configured hook, which in turn overrides the built-in
+   * `createNoJSHandler()` applied to browser form posts. Other
+   * no-instance callers get the normal serialized response.
    */
   handleNoJS?(
     result: unknown,