@solidjs/web 2.0.0-beta.26 → 2.0.0-beta.27

package/server-functions/dist/server.cjs

@@ -10,6 +10,7 @@ function isResponseEnvelope(value) {
 }
 
 seroval.Feature.AggregateError | seroval.Feature.BigIntTypedArray;
+const serializeOnlyDisabledFeatures = () => process.env.NODE_ENV === "development" ? 0 : seroval.Feature.ErrorPrototypeStack;
 const DEFAULT_WEB_PLUGINS = Object.freeze([web.AbortSignalPlugin,
 web.CustomEventPlugin, web.DOMExceptionPlugin, web.EventPlugin,
 web.FormDataPlugin, web.HeadersPlugin, web.ReadableStreamPlugin, web.RequestPlugin, web.ResponsePlugin, web.URLSearchParamsPlugin, web.URLPlugin]);
@@ -35,11 +36,13 @@ function serializeJSON(value, {
   onError,
   ...codecOptions
 }) {
+  const resolved = resolveCodecOptions(codecOptions);
   return seroval.toCrossJSONStream(value, {
     onParse,
     onDone,
     onError,
-    ...resolveCodecOptions(codecOptions)
+    ...resolved,
+    disabledFeatures: resolved.disabledFeatures | serializeOnlyDisabledFeatures()
   });
 }
 function createJSONDeserializer(options) {
@@ -117,6 +120,18 @@ const INSTANCE_HEADER = "X-Server-Function-Instance";
 const BODY_FORMAT_HEADER = "X-Server-Function-Format";
 const SINGLE_FLIGHT_HEADER = "X-Single-Flight";
 const FILE_FORM_KEY = "__server_function_file__";
+const FLASH_COOKIE = "flash";
+const FLASH_MATCHER = new RegExp(`(?:^|;\\s*)${FLASH_COOKIE}=([^;]+)`);
+function hasFlashCookie(cookieHeader) {
+  return !!cookieHeader && FLASH_MATCHER.test(cookieHeader);
+}
+function matchFlashCookie(cookieHeader) {
+  const match = cookieHeader && cookieHeader.match(FLASH_MATCHER);
+  return match ? match[1] : undefined;
+}
+function clearFlashCookie() {
+  return `${FLASH_COOKIE}=; Max-Age=0; Path=/`;
+}
 const BodyFormat = {
   Serialized: "0",
   String: "1",
@@ -329,11 +344,61 @@ async function decodeResponse(response, codecOptions) {
   return await extractBody(response, codecOptions === undefined ? codecConfig.codec : codecOptions);
 }
 
+function encodeInputValue(value) {
+  if (value instanceof FormData) return {
+    $f: [...value.entries()].filter(([, v]) => typeof v === "string")
+  };
+  if (value instanceof URLSearchParams) return {
+    $u: [...value.entries()]
+  };
+  return value;
+}
+function decodeInputValue(value) {
+  if (value && typeof value === "object") {
+    if (Array.isArray(value.$f)) {
+      const form = new FormData();
+      for (const [k, v] of value.$f) form.append(k, v);
+      return form;
+    }
+    if (Array.isArray(value.$u)) return new URLSearchParams(value.$u);
+  }
+  return value;
+}
+function encodeFlashCookie(url, result, input, thrown) {
+  const isError = result instanceof Error;
+  const payload = {
+    url,
+    result: isError ? result.message : result,
+    error: isError,
+    thrown: !!thrown,
+    input: input.map(encodeInputValue)
+  };
+  return `${FLASH_COOKIE}=${encodeURIComponent(JSON.stringify(payload))}; Secure; HttpOnly; Path=/`;
+}
+function decodeFlashCookie(cookieHeader) {
+  const match = matchFlashCookie(cookieHeader);
+  if (!match) return;
+  try {
+    const payload = JSON.parse(decodeURIComponent(match));
+    if (!payload || !payload.result) return;
+    const result = payload.error ? new Error(payload.result) : payload.result;
+    return {
+      input: Array.isArray(payload.input) ? payload.input.map(decodeInputValue) : [],
+      url: payload.url,
+      result: payload.thrown ? undefined : result,
+      error: payload.thrown ? result : undefined
+    };
+  } catch (error) {
+    console.error(error);
+  }
+}
+
 const config = {
   provideEvent: undefined,
   collectFlightData: undefined,
   transformResult: undefined,
   transformDirectResult: undefined,
+  handleNoJS: undefined,
   endpoint: "/_server"
 };
 function configureServerFunctionsServer({
@@ -341,6 +406,7 @@ function configureServerFunctionsServer({
   collectFlightData,
   transformResult,
   transformDirectResult,
+  handleNoJS,
   endpoint,
   codec
 } = {}) {
@@ -348,6 +414,7 @@ function configureServerFunctionsServer({
   if (collectFlightData !== undefined) config.collectFlightData = collectFlightData;
   if (transformResult !== undefined) config.transformResult = transformResult;
   if (transformDirectResult !== undefined) config.transformDirectResult = transformDirectResult;
+  if (handleNoJS !== undefined) config.handleNoJS = handleNoJS;
   if (endpoint !== undefined) config.endpoint = endpoint;
   if (codec !== undefined) configureServerFunctionsCodec(codec);
 }
@@ -473,6 +540,87 @@ async function foldFlightData(hook, event, headers, outcome) {
     data
   };
 }
+function parseSetCookie(setCookie) {
+  const [pair, ...attributes] = setCookie.split(";");
+  const eq = pair.indexOf("=");
+  if (eq < 0) return undefined;
+  const parsed = {
+    name: pair.slice(0, eq).trim(),
+    value: pair.slice(eq + 1).trim()
+  };
+  for (const attribute of attributes) {
+    const attrEq = attribute.indexOf("=");
+    const key = (attrEq < 0 ? attribute : attribute.slice(0, attrEq)).trim().toLowerCase();
+    const value = attrEq < 0 ? "" : attribute.slice(attrEq + 1).trim();
+    if (key === "max-age") parsed.maxAge = Number(value);else if (key === "expires") parsed.expires = new Date(value);
+  }
+  return parsed;
+}
+function foldSetCookies(headers, setCookies) {
+  const folded = new Headers(headers);
+  if (!setCookies.length) return folded;
+  const cookies = {};
+  for (const pair of folded.get("cookie")?.split(";") ?? []) {
+    const eq = pair.indexOf("=");
+    if (eq > -1) cookies[pair.slice(0, eq).trim()] = pair.slice(eq + 1).trim();
+  }
+  for (const setCookie of setCookies) {
+    const parsed = parseSetCookie(setCookie);
+    if (!parsed) continue;
+    if (parsed.maxAge != null && parsed.maxAge <= 0 || parsed.expires != null && parsed.expires.getTime() <= Date.now()) {
+      delete cookies[parsed.name];
+    } else {
+      cookies[parsed.name] = parsed.value;
+    }
+  }
+  folded.delete("cookie");
+  const serialized = Object.entries(cookies).map(([name, value]) => `${name}=${value}`).join("; ");
+  if (serialized) folded.set("cookie", serialized);
+  return folded;
+}
+const validRedirectStatuses = new Set([301, 302, 303, 307, 308]);
+function createNoJSHandler({
+  base = ""
+} = {}) {
+  return function handleNoJS(result, request, args, thrown) {
+    const url = new URL(request.url);
+    let back = new URL(base || "/", url.origin).toString();
+    try {
+      const referer = request.headers.get("referer");
+      if (referer) back = new URL(referer).toString();
+    } catch {}
+    let status = 303;
+    let headers;
+    if (result instanceof Response) {
+      headers = new Headers(result.headers);
+      if (result.headers.has("Location")) {
+        headers.set("Location", new URL(result.headers.get("Location"), url.origin + base).toString());
+        if (validRedirectStatuses.has(result.status)) status = result.status;
+      } else {
+        headers.set("Location", back);
+      }
+      headers.delete("Content-Type");
+      headers.delete("Content-Length");
+    } else {
+      headers = new Headers({
+        Location: back
+      });
+    }
+    if (result && !(result instanceof Response)) {
+      headers.append("Set-Cookie", encodeFlashCookie(url.pathname + url.search, result, args, thrown));
+    }
+    return new Response(null, {
+      status,
+      headers
+    });
+  };
+}
+let defaultNoJSHandler;
+function isFormPost(request) {
+  if (request.method !== "POST" || request.headers.has(BODY_FORMAT_HEADER)) return false;
+  const type = request.headers.get("content-type") || "";
+  return type.startsWith("application/x-www-form-urlencoded") || type.startsWith("multipart/form-data");
+}
 function serializedResponse(value, headers, codec) {
   headers.set(BODY_FORMAT_HEADER, BodyFormat.Serialized);
   headers.set("Content-Type", "text/plain");
@@ -530,6 +678,7 @@ async function handleServerFunctionRequest(request, options = {}) {
   const provide = options.provideEvent || provideEvent;
   const flightHook = options.collectFlightData !== undefined ? options.collectFlightData : config.collectFlightData;
   const transformResult = options.transformResult !== undefined ? options.transformResult : config.transformResult;
+  const handleNoJS = options.handleNoJS !== undefined ? options.handleNoJS : config.handleNoJS !== undefined ? config.handleNoJS : isFormPost(request) ? defaultNoJSHandler || (defaultNoJSHandler = createNoJSHandler()) : undefined;
   const collectsFlight = !!(flightHook && instance && request.headers.has(SINGLE_FLIGHT_HEADER));
   const parsed = await parseArguments(request, url, instance, codec);
   const headers = new Headers();
@@ -553,7 +702,7 @@ async function handleServerFunctionRequest(request, options = {}) {
         response,
         value
       } = result;
-      if (!instance && !options.handleNoJS && response && response.body) {
+      if (!instance && !handleNoJS && response && response.body) {
         return response;
       }
       if (response && response.headers) {
@@ -589,7 +738,7 @@ async function handleServerFunctionRequest(request, options = {}) {
       });
     }
     if (!instance) {
-      if (options.handleNoJS) return options.handleNoJS(result, request, parsed);
+      if (handleNoJS) return handleNoJS(result, request, parsed);
       if (result instanceof Response) return result;
       return encodeResult(result, headers, 200, codec);
     }
@@ -641,13 +790,13 @@ async function handleServerFunctionRequest(request, options = {}) {
       }
       headers.set(ERROR_HEADER, "true");
       if (!instance) {
-        if (options.handleNoJS) return options.handleNoJS(x, request, parsed, true);
+        if (handleNoJS) return handleNoJS(x ?? metadata, request, parsed, true);
         if (x instanceof Response) return x;
       }
       return encodeResult(x, headers, status, codec);
     }
     if (!instance) {
-      if (options.handleNoJS) return options.handleNoJS(x, request, parsed, true);
+      if (handleNoJS) return handleNoJS(x, request, parsed, true);
       const message = x instanceof Error ? x.message : String(x);
       return new Response(process.env.NODE_ENV === "development" ? message : null, {
         status: 500
@@ -660,19 +809,26 @@ async function handleServerFunctionRequest(request, options = {}) {
 }
 
 exports.ERROR_HEADER = ERROR_HEADER;
+exports.FLASH_COOKIE = FLASH_COOKIE;
 exports.FUNCTION_HEADER = FUNCTION_HEADER;
 exports.GET = GET;
 exports.INSTANCE_HEADER = INSTANCE_HEADER;
 exports.SINGLE_FLIGHT_HEADER = SINGLE_FLIGHT_HEADER;
+exports.clearFlashCookie = clearFlashCookie;
 exports.configureServerFunctionsServer = configureServerFunctionsServer;
+exports.createNoJSHandler = createNoJSHandler;
 exports.createServerReference = createServerReference;
 exports.decodeErrorHeaderValue = decodeErrorHeaderValue;
+exports.decodeFlashCookie = decodeFlashCookie;
 exports.decodeResponse = decodeResponse;
 exports.encodeErrorHeaderValue = encodeErrorHeaderValue;
+exports.encodeFlashCookie = encodeFlashCookie;
+exports.foldSetCookies = foldSetCookies;
 exports.getServerFunction = getServerFunction;
 exports.getServerFunctionMeta = getServerFunctionMeta;
 exports.getServerFunctionMetadata = getServerFunctionMetadata;
 exports.handleServerFunctionRequest = handleServerFunctionRequest;
+exports.hasFlashCookie = hasFlashCookie;
 exports.isServerFunction = isServerFunction;
 exports.registerServerFunction = registerServerFunction;
 exports.registerServerReference = registerServerReference;

package/server-functions/dist/server.js

@@ -8,6 +8,7 @@ function isResponseEnvelope(value) {
 }
 
 Feature.AggregateError | Feature.BigIntTypedArray;
+const serializeOnlyDisabledFeatures = () => process.env.NODE_ENV === "development" ? 0 : Feature.ErrorPrototypeStack;
 const DEFAULT_WEB_PLUGINS = Object.freeze([AbortSignalPlugin,
 CustomEventPlugin, DOMExceptionPlugin, EventPlugin,
 FormDataPlugin, HeadersPlugin, ReadableStreamPlugin, RequestPlugin, ResponsePlugin, URLSearchParamsPlugin, URLPlugin]);
@@ -33,11 +34,13 @@ function serializeJSON(value, {
   onError,
   ...codecOptions
 }) {
+  const resolved = resolveCodecOptions(codecOptions);
   return toCrossJSONStream(value, {
     onParse,
     onDone,
     onError,
-    ...resolveCodecOptions(codecOptions)
+    ...resolved,
+    disabledFeatures: resolved.disabledFeatures | serializeOnlyDisabledFeatures()
   });
 }
 function createJSONDeserializer(options) {
@@ -115,6 +118,18 @@ const INSTANCE_HEADER = "X-Server-Function-Instance";
 const BODY_FORMAT_HEADER = "X-Server-Function-Format";
 const SINGLE_FLIGHT_HEADER = "X-Single-Flight";
 const FILE_FORM_KEY = "__server_function_file__";
+const FLASH_COOKIE = "flash";
+const FLASH_MATCHER = new RegExp(`(?:^|;\\s*)${FLASH_COOKIE}=([^;]+)`);
+function hasFlashCookie(cookieHeader) {
+  return !!cookieHeader && FLASH_MATCHER.test(cookieHeader);
+}
+function matchFlashCookie(cookieHeader) {
+  const match = cookieHeader && cookieHeader.match(FLASH_MATCHER);
+  return match ? match[1] : undefined;
+}
+function clearFlashCookie() {
+  return `${FLASH_COOKIE}=; Max-Age=0; Path=/`;
+}
 const BodyFormat = {
   Serialized: "0",
   String: "1",
@@ -327,11 +342,61 @@ async function decodeResponse(response, codecOptions) {
   return await extractBody(response, codecOptions === undefined ? codecConfig.codec : codecOptions);
 }
 
+function encodeInputValue(value) {
+  if (value instanceof FormData) return {
+    $f: [...value.entries()].filter(([, v]) => typeof v === "string")
+  };
+  if (value instanceof URLSearchParams) return {
+    $u: [...value.entries()]
+  };
+  return value;
+}
+function decodeInputValue(value) {
+  if (value && typeof value === "object") {
+    if (Array.isArray(value.$f)) {
+      const form = new FormData();
+      for (const [k, v] of value.$f) form.append(k, v);
+      return form;
+    }
+    if (Array.isArray(value.$u)) return new URLSearchParams(value.$u);
+  }
+  return value;
+}
+function encodeFlashCookie(url, result, input, thrown) {
+  const isError = result instanceof Error;
+  const payload = {
+    url,
+    result: isError ? result.message : result,
+    error: isError,
+    thrown: !!thrown,
+    input: input.map(encodeInputValue)
+  };
+  return `${FLASH_COOKIE}=${encodeURIComponent(JSON.stringify(payload))}; Secure; HttpOnly; Path=/`;
+}
+function decodeFlashCookie(cookieHeader) {
+  const match = matchFlashCookie(cookieHeader);
+  if (!match) return;
+  try {
+    const payload = JSON.parse(decodeURIComponent(match));
+    if (!payload || !payload.result) return;
+    const result = payload.error ? new Error(payload.result) : payload.result;
+    return {
+      input: Array.isArray(payload.input) ? payload.input.map(decodeInputValue) : [],
+      url: payload.url,
+      result: payload.thrown ? undefined : result,
+      error: payload.thrown ? result : undefined
+    };
+  } catch (error) {
+    console.error(error);
+  }
+}
+
 const config = {
   provideEvent: undefined,
   collectFlightData: undefined,
   transformResult: undefined,
   transformDirectResult: undefined,
+  handleNoJS: undefined,
   endpoint: "/_server"
 };
 function configureServerFunctionsServer({
@@ -339,6 +404,7 @@ function configureServerFunctionsServer({
   collectFlightData,
   transformResult,
   transformDirectResult,
+  handleNoJS,
   endpoint,
   codec
 } = {}) {
@@ -346,6 +412,7 @@ function configureServerFunctionsServer({
   if (collectFlightData !== undefined) config.collectFlightData = collectFlightData;
   if (transformResult !== undefined) config.transformResult = transformResult;
   if (transformDirectResult !== undefined) config.transformDirectResult = transformDirectResult;
+  if (handleNoJS !== undefined) config.handleNoJS = handleNoJS;
   if (endpoint !== undefined) config.endpoint = endpoint;
   if (codec !== undefined) configureServerFunctionsCodec(codec);
 }
@@ -471,6 +538,87 @@ async function foldFlightData(hook, event, headers, outcome) {
     data
   };
 }
+function parseSetCookie(setCookie) {
+  const [pair, ...attributes] = setCookie.split(";");
+  const eq = pair.indexOf("=");
+  if (eq < 0) return undefined;
+  const parsed = {
+    name: pair.slice(0, eq).trim(),
+    value: pair.slice(eq + 1).trim()
+  };
+  for (const attribute of attributes) {
+    const attrEq = attribute.indexOf("=");
+    const key = (attrEq < 0 ? attribute : attribute.slice(0, attrEq)).trim().toLowerCase();
+    const value = attrEq < 0 ? "" : attribute.slice(attrEq + 1).trim();
+    if (key === "max-age") parsed.maxAge = Number(value);else if (key === "expires") parsed.expires = new Date(value);
+  }
+  return parsed;
+}
+function foldSetCookies(headers, setCookies) {
+  const folded = new Headers(headers);
+  if (!setCookies.length) return folded;
+  const cookies = {};
+  for (const pair of folded.get("cookie")?.split(";") ?? []) {
+    const eq = pair.indexOf("=");
+    if (eq > -1) cookies[pair.slice(0, eq).trim()] = pair.slice(eq + 1).trim();
+  }
+  for (const setCookie of setCookies) {
+    const parsed = parseSetCookie(setCookie);
+    if (!parsed) continue;
+    if (parsed.maxAge != null && parsed.maxAge <= 0 || parsed.expires != null && parsed.expires.getTime() <= Date.now()) {
+      delete cookies[parsed.name];
+    } else {
+      cookies[parsed.name] = parsed.value;
+    }
+  }
+  folded.delete("cookie");
+  const serialized = Object.entries(cookies).map(([name, value]) => `${name}=${value}`).join("; ");
+  if (serialized) folded.set("cookie", serialized);
+  return folded;
+}
+const validRedirectStatuses = new Set([301, 302, 303, 307, 308]);
+function createNoJSHandler({
+  base = ""
+} = {}) {
+  return function handleNoJS(result, request, args, thrown) {
+    const url = new URL(request.url);
+    let back = new URL(base || "/", url.origin).toString();
+    try {
+      const referer = request.headers.get("referer");
+      if (referer) back = new URL(referer).toString();
+    } catch {}
+    let status = 303;
+    let headers;
+    if (result instanceof Response) {
+      headers = new Headers(result.headers);
+      if (result.headers.has("Location")) {
+        headers.set("Location", new URL(result.headers.get("Location"), url.origin + base).toString());
+        if (validRedirectStatuses.has(result.status)) status = result.status;
+      } else {
+        headers.set("Location", back);
+      }
+      headers.delete("Content-Type");
+      headers.delete("Content-Length");
+    } else {
+      headers = new Headers({
+        Location: back
+      });
+    }
+    if (result && !(result instanceof Response)) {
+      headers.append("Set-Cookie", encodeFlashCookie(url.pathname + url.search, result, args, thrown));
+    }
+    return new Response(null, {
+      status,
+      headers
+    });
+  };
+}
+let defaultNoJSHandler;
+function isFormPost(request) {
+  if (request.method !== "POST" || request.headers.has(BODY_FORMAT_HEADER)) return false;
+  const type = request.headers.get("content-type") || "";
+  return type.startsWith("application/x-www-form-urlencoded") || type.startsWith("multipart/form-data");
+}
 function serializedResponse(value, headers, codec) {
   headers.set(BODY_FORMAT_HEADER, BodyFormat.Serialized);
   headers.set("Content-Type", "text/plain");
@@ -528,6 +676,7 @@ async function handleServerFunctionRequest(request, options = {}) {
   const provide = options.provideEvent || provideEvent;
   const flightHook = options.collectFlightData !== undefined ? options.collectFlightData : config.collectFlightData;
   const transformResult = options.transformResult !== undefined ? options.transformResult : config.transformResult;
+  const handleNoJS = options.handleNoJS !== undefined ? options.handleNoJS : config.handleNoJS !== undefined ? config.handleNoJS : isFormPost(request) ? defaultNoJSHandler || (defaultNoJSHandler = createNoJSHandler()) : undefined;
   const collectsFlight = !!(flightHook && instance && request.headers.has(SINGLE_FLIGHT_HEADER));
   const parsed = await parseArguments(request, url, instance, codec);
   const headers = new Headers();
@@ -551,7 +700,7 @@ async function handleServerFunctionRequest(request, options = {}) {
         response,
         value
       } = result;
-      if (!instance && !options.handleNoJS && response && response.body) {
+      if (!instance && !handleNoJS && response && response.body) {
         return response;
       }
       if (response && response.headers) {
@@ -587,7 +736,7 @@ async function handleServerFunctionRequest(request, options = {}) {
       });
     }
     if (!instance) {
-      if (options.handleNoJS) return options.handleNoJS(result, request, parsed);
+      if (handleNoJS) return handleNoJS(result, request, parsed);
       if (result instanceof Response) return result;
       return encodeResult(result, headers, 200, codec);
     }
@@ -639,13 +788,13 @@ async function handleServerFunctionRequest(request, options = {}) {
       }
       headers.set(ERROR_HEADER, "true");
       if (!instance) {
-        if (options.handleNoJS) return options.handleNoJS(x, request, parsed, true);
+        if (handleNoJS) return handleNoJS(x ?? metadata, request, parsed, true);
         if (x instanceof Response) return x;
       }
       return encodeResult(x, headers, status, codec);
     }
     if (!instance) {
-      if (options.handleNoJS) return options.handleNoJS(x, request, parsed, true);
+      if (handleNoJS) return handleNoJS(x, request, parsed, true);
       const message = x instanceof Error ? x.message : String(x);
       return new Response(process.env.NODE_ENV === "development" ? message : null, {
         status: 500
@@ -657,4 +806,4 @@ async function handleServerFunctionRequest(request, options = {}) {
   }
 }
 
-export { ERROR_HEADER, FUNCTION_HEADER, GET, INSTANCE_HEADER, SINGLE_FLIGHT_HEADER, configureServerFunctionsServer, createServerReference, decodeErrorHeaderValue, decodeResponse, encodeErrorHeaderValue, getServerFunction, getServerFunctionMeta, getServerFunctionMetadata, handleServerFunctionRequest, isServerFunction, registerServerFunction, registerServerReference, subscribeFlightData, withMeta };
+export { ERROR_HEADER, FLASH_COOKIE, FUNCTION_HEADER, GET, INSTANCE_HEADER, SINGLE_FLIGHT_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeResponse, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getServerFunction, getServerFunctionMeta, getServerFunctionMetadata, handleServerFunctionRequest, hasFlashCookie, isServerFunction, registerServerFunction, registerServerReference, subscribeFlightData, withMeta };

package/types/client.d.ts

@@ -109,9 +109,9 @@ export function style(
 export function getOwner(): unknown;
 export function mergeProps(...sources: unknown[]): unknown;
 export function dynamicProperty(props: unknown, key: string): unknown;
-export function applyRef(
-  r: ((element: Element) => void) | ((element: Element) => void)[],
-  element: Element
+export function applyRef<T extends Element = Element>(
+  r: ((element: NoInfer<T>) => void) | ((element: NoInfer<T>) => void)[],
+  element: T
 ): void;
 export function ref(
   fn: () => ((element: Element) => void) | ((element: Element) => void)[],

package/types/frames/serializer.d.ts

@@ -37,7 +37,9 @@ export interface WebSerializerOptions {
   scopeId?: string;
   /**
    * Seroval feature bitflags to exclude from output. Defaults to disabling
-   * post-ES2017 features (AggregateError, BigInt typed arrays).
+   * post-ES2017 features (AggregateError, BigInt typed arrays). Outside
+   * development, `Error.prototype.stack` is additionally stripped on top of
+   * any override — serialized stacks leak server paths to the client.
    */
   disabledFeatures?: number;
   /** Extra plugins, composed ahead of `DEFAULT_WEB_PLUGINS`. */
@@ -101,6 +103,10 @@ export interface JSONCodecOptions {
   /**
    * Seroval feature bitflags to exclude. Defaults to disabling `RegExp`
    * (payloads may come from an untrusted peer). Must match on both peers.
+   * Outside development, the encoding side additionally strips
+   * `Error.prototype.stack` on top of any override — serialized stacks leak
+   * server paths to the client. Decoding stays permissive, so payloads from
+   * a development peer still round-trip.
    */
   disabledFeatures?: number;
   /** Maximum parse/deserialize depth. Defaults to 64. Must match on both peers. */

package/types/jsx.d.ts

@@ -240,7 +240,7 @@ export namespace JSX {
   }
 
   type RefCallback<T> = (el: T) => void;
-  type Ref<T> = T | RefCallback<T> | (RefCallback<T> | Ref<T>)[];
+  type Ref<T> = T | RefCallback<T> | Ref<T>[];
 
   interface IntrinsicAttributes {
     ref?: Ref<unknown> | undefined;

package/types/response.d.ts

@@ -49,6 +49,16 @@ export interface Href {
  */
 export function isHref(value: unknown): value is Href;
 
+/**
+ * Response header naming the cache keys a mutation invalidated
+ * (`"X-Revalidate"`), comma separated. The response helpers below set it
+ * from their `revalidate` option; the client transport treats its presence
+ * as control flow, and integrations read it to invalidate their own cache.
+ * Core never inspects the keys, so how they are matched (prefixes, exact
+ * names, namespaces) is the integration's business.
+ */
+export const REVALIDATE_HEADER: string;
+
 /** `ResponseInit` accepted by the response helpers, plus `revalidate`. */
 export interface ResponseHelperInit extends ResponseInit {
   /**

package/types/serializer.d.ts

@@ -37,7 +37,9 @@ export interface WebSerializerOptions {
   scopeId?: string;
   /**
    * Seroval feature bitflags to exclude from output. Defaults to disabling
-   * post-ES2017 features (AggregateError, BigInt typed arrays).
+   * post-ES2017 features (AggregateError, BigInt typed arrays). Outside
+   * development, `Error.prototype.stack` is additionally stripped on top of
+   * any override — serialized stacks leak server paths to the client.
    */
   disabledFeatures?: number;
   /** Extra plugins, composed ahead of `DEFAULT_WEB_PLUGINS`. */
@@ -101,6 +103,10 @@ export interface JSONCodecOptions {
   /**
    * Seroval feature bitflags to exclude. Defaults to disabling `RegExp`
    * (payloads may come from an untrusted peer). Must match on both peers.
+   * Outside development, the encoding side additionally strips
+   * `Error.prototype.stack` on top of any override — serialized stacks leak
+   * server paths to the client. Decoding stays permissive, so payloads from
+   * a development peer still round-trip.
    */
   disabledFeatures?: number;
   /** Maximum parse/deserialize depth. Defaults to 64. Must match on both peers. */

package/types/server-functions/client.d.ts

@@ -3,13 +3,16 @@ import { ServerFunction, ServerFunctionMetadata } from "./shared.js";
 
 export {
   ERROR_HEADER,
+  FLASH_COOKIE,
   FUNCTION_HEADER,
   INSTANCE_HEADER,
   SINGLE_FLIGHT_HEADER,
+  clearFlashCookie,
   decodeErrorHeaderValue,
   decodeResponse,
   encodeErrorHeaderValue,
   getServerFunctionMetadata,
+  hasFlashCookie,
   isServerFunction,
   subscribeFlightData,
   withMeta

package/types/server-functions/flash.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The outcome of a call made without the client runtime, as it rides the
+ * flash cookie: what was submitted, where, and what came back. `result` and
+ * `error` are mutually exclusive — a thrown outcome fills `error`, a
+ * returned one fills `result` — mirroring the split a scripted call sees.
+ */
+export interface FlashSubmission {
+  /** The arguments the call was made with (files are dropped). */
+  input: any[];
+  /** The call's url: pathname + search of the server function request. */
+  url: string;
+  /** The returned value, when the call returned. */
+  result?: any;
+  /** The thrown value, when the call threw. */
+  error?: any;
+}
+
+/**
+ * Encodes the outcome of a no-JS call as a `Set-Cookie` value, for the
+ * handler to send with its redirect. `url` identifies which submission the
+ * outcome belongs to; pass `thrown` when the call threw rather than
+ * returned.
+ *
+ * The payload is JSON inside the cookie: `FormData` and `URLSearchParams`
+ * arguments are captured as entry pairs and revived on decode, and `File`
+ * entries are dropped (they cannot ride a cookie). Keep in mind the 4 KB
+ * cookie budget — outcomes larger than that will not survive the round
+ * trip.
+ */
+export function encodeFlashCookie(url: string, result: any, input: any[], thrown?: boolean): string;
+
+/**
+ * Decodes the flash cookie out of a request's `Cookie` header, for the
+ * render that follows the redirect. Returns undefined when the cookie is
+ * absent or unreadable — a malformed cookie never takes down the render,
+ * and `clearFlashCookie` should be appended regardless.
+ */
+export function decodeFlashCookie(cookieHeader: string | null): FlashSubmission | undefined;