@solidjs/web 2.0.0-beta.26 → 2.0.0-beta.27

package/types/server-functions/server.d.ts

@@ -4,13 +4,16 @@ import { RequestEvent } from "../server.js";
 
 export {
   ERROR_HEADER,
+  FLASH_COOKIE,
   FUNCTION_HEADER,
   INSTANCE_HEADER,
   SINGLE_FLIGHT_HEADER,
+  clearFlashCookie,
   decodeErrorHeaderValue,
   decodeResponse,
   encodeErrorHeaderValue,
   getServerFunctionMetadata,
+  hasFlashCookie,
   isServerFunction,
   subscribeFlightData,
   withMeta
@@ -22,6 +25,8 @@ export type {
   ServerFunctionMetadata,
   SingleFlightPayload
 } from "./shared.js";
+export { decodeFlashCookie, encodeFlashCookie } from "./flash.js";
+export type { FlashSubmission } from "./flash.js";
 import { ServerFunction } from "./shared.js";
 
 /**
@@ -85,6 +90,57 @@ export type CollectFlightDataHook = (
   outcome: ServerFunctionOutcome
 ) => unknown | Promise<unknown>;
 
+/**
+ * Request headers with `setCookies` folded into the `Cookie` header, as the
+ * browser would have applied them before its next request. Later entries
+ * win on conflict, and deletions are honored (`Max-Age` at or below zero,
+ * `Expires` in the past). The input headers are not modified.
+ *
+ * For work re-run on the server after a mutation — a
+ * `CollectFlightDataHook` gathering fresh data, typically. That pass starts
+ * from the request that triggered the mutation, whose cookies are
+ * pre-mutation by definition, so a read depending on a session the mutation
+ * just established would otherwise see the old state. Which responses
+ * contribute their `Set-Cookie`s, and in what order, is the caller's
+ * decision.
+ *
+ * @example
+ * ```ts
+ * const headers = foldSetCookies(event.request.headers, [
+ *   ...(event.response?.headers?.getSetCookie() ?? []),
+ *   ...(outcome.response?.headers?.getSetCookie() ?? [])
+ * ]);
+ * ```
+ */
+export function foldSetCookies(headers: Headers, setCookies: readonly string[]): Headers;
+
+/** Options for `createNoJSHandler`. */
+export interface NoJSHandlerOptions {
+  /** The app's mount path, for resolving a relative redirect `Location`. */
+  base?: string;
+}
+
+/**
+ * Builds the `handleNoJS` implementation for the no-JS form convention: a
+ * form posted without the client runtime has no way to receive a value, so
+ * the call redirects back to the referring page (or to the result's own
+ * `Location`, resolved against `base`) with the outcome riding a one-shot
+ * flash cookie. `303 See Other` turns the POST into a GET unless the result
+ * names a redirect status of its own. A result that is already a `Response`
+ * carries its meaning in its metadata and is not flashed.
+ *
+ * The render that follows reads the cookie with `decodeFlashCookie` and
+ * surfaces the outcome however it likes — that half is the integration's.
+ *
+ * The handler applies to every call it receives. `handleServerFunctionRequest`
+ * already uses it for browser form posts, so wire it explicitly only to set
+ * a `base`, or to extend the convention to direct HTTP calls by registering
+ * it through `configureServerFunctionsServer`.
+ */
+export function createNoJSHandler(
+  options?: NoJSHandlerOptions
+): (result: unknown, request: Request, args: unknown[], thrown?: boolean) => Response;
+
 /** Options for `configureServerFunctionsServer`. */
 export interface ServerFunctionsServerConfig {
   /**
@@ -119,6 +175,23 @@ export interface ServerFunctionsServerConfig {
    * calls during document SSR — e.g. frames' `frameTransformDirectResult`.
    */
   transformDirectResult?(value: unknown, options: { id: string }): unknown;
+  /**
+   * Server-wide response builder for calls made without the client runtime
+   * (see `handleNoJS` in `HandleServerFunctionRequestOptions`); a
+   * per-request option overrides it. Set it to `createNoJSHandler({ base })`
+   * to apply the convention to every non-scripted call rather than only to
+   * browser form posts, to a handler of your own to replace it, or to
+   * `null` to disable the built-in convention and answer form posts with
+   * the plain serialized response.
+   */
+  handleNoJS?:
+    | ((
+        result: unknown,
+        request: Request,
+        args: unknown[],
+        thrown?: boolean
+      ) => Response | Promise<Response>)
+    | null;
   /**
    * Endpoint the HTTP handler is mounted on, used for the `url` of SSR'd
    * references (e.g. form actions) — must match the client configuration.
@@ -285,11 +358,13 @@ export interface HandleServerFunctionOptions {
   collectFlightData?: CollectFlightDataHook;
   /**
    * Builds the response for calls made without the client runtime (no
-   * instance header — no-JS form posts, direct HTTP) — the extension
-   * point for conventions like redirect-with-flash-cookie. Receives the
+   * instance header — no-JS form posts, direct HTTP). Receives the
    * (transformed) result, the request, and the decoded arguments; `thrown`
-   * is set when the result was thrown rather than returned. Defaults to
-   * the normal serialized response.
+   * is set when the result was thrown rather than returned.
+   *
+   * Overrides the configured hook, which in turn overrides the built-in
+   * `createNoJSHandler()` applied to browser form posts. Other
+   * no-instance callers get the normal serialized response.
    */
   handleNoJS?(
     result: unknown,

package/types/server-functions/shared.d.ts

@@ -136,6 +136,41 @@ export type FlightDataConsumer<D = unknown> = (
  */
 export function subscribeFlightData<D = unknown>(consumer: FlightDataConsumer<D>): () => void;
 
+/**
+ * Name of the cookie carrying the outcome of a call made without the client
+ * runtime (`"flash"`). A no-JS form post has no way to receive a value —
+ * the browser follows the redirect and renders the next page — so the
+ * handler stashes the outcome here for the render after it to pick up,
+ * which is how a form submitted without JavaScript still shows its result.
+ *
+ * The name, detection and clearing are isomorphic (integrations read the
+ * cookie from code that also ships to the browser); the codec that fills it
+ * is server-only and lives behind the server entry.
+ */
+export const FLASH_COOKIE: string;
+
+/**
+ * Whether a Cookie header carries a flash cookie, readable or not. Cheap
+ * enough to call on every render so the clear can be queued before the
+ * response headers flush.
+ */
+export function hasFlashCookie(cookieHeader: string | null): boolean;
+
+/**
+ * The `Set-Cookie` value clearing the flash cookie. The outcome is
+ * one-shot: append this as soon as the cookie is detected, whether or not
+ * it decodes, so a stale outcome cannot resurface on a later request.
+ */
+export function clearFlashCookie(): string;
+
+/**
+ * The raw encoded flash payload out of a Cookie header, if present — the
+ * codec's own accessor.
+ *
+ * @internal
+ */
+export function matchFlashCookie(cookieHeader: string | null): string | undefined;
+
 /**
  * The currently registered single-flight consumer.
  *

package/types-cjs/client.d.cts

@@ -109,9 +109,9 @@ export function style(
 export function getOwner(): unknown;
 export function mergeProps(...sources: unknown[]): unknown;
 export function dynamicProperty(props: unknown, key: string): unknown;
-export function applyRef(
-  r: ((element: Element) => void) | ((element: Element) => void)[],
-  element: Element
+export function applyRef<T extends Element = Element>(
+  r: ((element: NoInfer<T>) => void) | ((element: NoInfer<T>) => void)[],
+  element: T
 ): void;
 export function ref(
   fn: () => ((element: Element) => void) | ((element: Element) => void)[],

package/types-cjs/frames/serializer.d.cts

@@ -37,7 +37,9 @@ export interface WebSerializerOptions {
   scopeId?: string;
   /**
    * Seroval feature bitflags to exclude from output. Defaults to disabling
-   * post-ES2017 features (AggregateError, BigInt typed arrays).
+   * post-ES2017 features (AggregateError, BigInt typed arrays). Outside
+   * development, `Error.prototype.stack` is additionally stripped on top of
+   * any override — serialized stacks leak server paths to the client.
    */
   disabledFeatures?: number;
   /** Extra plugins, composed ahead of `DEFAULT_WEB_PLUGINS`. */
@@ -101,6 +103,10 @@ export interface JSONCodecOptions {
   /**
    * Seroval feature bitflags to exclude. Defaults to disabling `RegExp`
    * (payloads may come from an untrusted peer). Must match on both peers.
+   * Outside development, the encoding side additionally strips
+   * `Error.prototype.stack` on top of any override — serialized stacks leak
+   * server paths to the client. Decoding stays permissive, so payloads from
+   * a development peer still round-trip.
    */
   disabledFeatures?: number;
   /** Maximum parse/deserialize depth. Defaults to 64. Must match on both peers. */

package/types-cjs/jsx.d.cts

@@ -240,7 +240,7 @@ export namespace JSX {
   }
 
   type RefCallback<T> = (el: T) => void;
-  type Ref<T> = T | RefCallback<T> | (RefCallback<T> | Ref<T>)[];
+  type Ref<T> = T | RefCallback<T> | Ref<T>[];
 
   interface IntrinsicAttributes {
     ref?: Ref<unknown> | undefined;

package/types-cjs/response.d.cts

@@ -49,6 +49,16 @@ export interface Href {
  */
 export function isHref(value: unknown): value is Href;
 
+/**
+ * Response header naming the cache keys a mutation invalidated
+ * (`"X-Revalidate"`), comma separated. The response helpers below set it
+ * from their `revalidate` option; the client transport treats its presence
+ * as control flow, and integrations read it to invalidate their own cache.
+ * Core never inspects the keys, so how they are matched (prefixes, exact
+ * names, namespaces) is the integration's business.
+ */
+export const REVALIDATE_HEADER: string;
+
 /** `ResponseInit` accepted by the response helpers, plus `revalidate`. */
 export interface ResponseHelperInit extends ResponseInit {
   /**

package/types-cjs/serializer.d.cts

@@ -37,7 +37,9 @@ export interface WebSerializerOptions {
   scopeId?: string;
   /**
    * Seroval feature bitflags to exclude from output. Defaults to disabling
-   * post-ES2017 features (AggregateError, BigInt typed arrays).
+   * post-ES2017 features (AggregateError, BigInt typed arrays). Outside
+   * development, `Error.prototype.stack` is additionally stripped on top of
+   * any override — serialized stacks leak server paths to the client.
    */
   disabledFeatures?: number;
   /** Extra plugins, composed ahead of `DEFAULT_WEB_PLUGINS`. */
@@ -101,6 +103,10 @@ export interface JSONCodecOptions {
   /**
    * Seroval feature bitflags to exclude. Defaults to disabling `RegExp`
    * (payloads may come from an untrusted peer). Must match on both peers.
+   * Outside development, the encoding side additionally strips
+   * `Error.prototype.stack` on top of any override — serialized stacks leak
+   * server paths to the client. Decoding stays permissive, so payloads from
+   * a development peer still round-trip.
    */
   disabledFeatures?: number;
   /** Maximum parse/deserialize depth. Defaults to 64. Must match on both peers. */

package/types-cjs/server-functions/client.d.cts

@@ -3,13 +3,16 @@ import { ServerFunction, ServerFunctionMetadata } from "./shared.cjs";
 
 export {
   ERROR_HEADER,
+  FLASH_COOKIE,
   FUNCTION_HEADER,
   INSTANCE_HEADER,
   SINGLE_FLIGHT_HEADER,
+  clearFlashCookie,
   decodeErrorHeaderValue,
   decodeResponse,
   encodeErrorHeaderValue,
   getServerFunctionMetadata,
+  hasFlashCookie,
   isServerFunction,
   subscribeFlightData,
   withMeta

package/types-cjs/server-functions/flash.d.cts

@@ -0,0 +1,38 @@
+/**
+ * The outcome of a call made without the client runtime, as it rides the
+ * flash cookie: what was submitted, where, and what came back. `result` and
+ * `error` are mutually exclusive — a thrown outcome fills `error`, a
+ * returned one fills `result` — mirroring the split a scripted call sees.
+ */
+export interface FlashSubmission {
+  /** The arguments the call was made with (files are dropped). */
+  input: any[];
+  /** The call's url: pathname + search of the server function request. */
+  url: string;
+  /** The returned value, when the call returned. */
+  result?: any;
+  /** The thrown value, when the call threw. */
+  error?: any;
+}
+
+/**
+ * Encodes the outcome of a no-JS call as a `Set-Cookie` value, for the
+ * handler to send with its redirect. `url` identifies which submission the
+ * outcome belongs to; pass `thrown` when the call threw rather than
+ * returned.
+ *
+ * The payload is JSON inside the cookie: `FormData` and `URLSearchParams`
+ * arguments are captured as entry pairs and revived on decode, and `File`
+ * entries are dropped (they cannot ride a cookie). Keep in mind the 4 KB
+ * cookie budget — outcomes larger than that will not survive the round
+ * trip.
+ */
+export function encodeFlashCookie(url: string, result: any, input: any[], thrown?: boolean): string;
+
+/**
+ * Decodes the flash cookie out of a request's `Cookie` header, for the
+ * render that follows the redirect. Returns undefined when the cookie is
+ * absent or unreadable — a malformed cookie never takes down the render,
+ * and `clearFlashCookie` should be appended regardless.
+ */
+export function decodeFlashCookie(cookieHeader: string | null): FlashSubmission | undefined;

package/types-cjs/server-functions/server.d.cts

@@ -4,13 +4,16 @@ import { RequestEvent } from "../server.cjs";
 
 export {
   ERROR_HEADER,
+  FLASH_COOKIE,
   FUNCTION_HEADER,
   INSTANCE_HEADER,
   SINGLE_FLIGHT_HEADER,
+  clearFlashCookie,
   decodeErrorHeaderValue,
   decodeResponse,
   encodeErrorHeaderValue,
   getServerFunctionMetadata,
+  hasFlashCookie,
   isServerFunction,
   subscribeFlightData,
   withMeta
@@ -22,6 +25,8 @@ export type {
   ServerFunctionMetadata,
   SingleFlightPayload
 } from "./shared.cjs";
+export { decodeFlashCookie, encodeFlashCookie } from "./flash.cjs";
+export type { FlashSubmission } from "./flash.cjs";
 import { ServerFunction } from "./shared.cjs";
 
 /**
@@ -85,6 +90,57 @@ export type CollectFlightDataHook = (
   outcome: ServerFunctionOutcome
 ) => unknown | Promise<unknown>;
 
+/**
+ * Request headers with `setCookies` folded into the `Cookie` header, as the
+ * browser would have applied them before its next request. Later entries
+ * win on conflict, and deletions are honored (`Max-Age` at or below zero,
+ * `Expires` in the past). The input headers are not modified.
+ *
+ * For work re-run on the server after a mutation — a
+ * `CollectFlightDataHook` gathering fresh data, typically. That pass starts
+ * from the request that triggered the mutation, whose cookies are
+ * pre-mutation by definition, so a read depending on a session the mutation
+ * just established would otherwise see the old state. Which responses
+ * contribute their `Set-Cookie`s, and in what order, is the caller's
+ * decision.
+ *
+ * @example
+ * ```ts
+ * const headers = foldSetCookies(event.request.headers, [
+ *   ...(event.response?.headers?.getSetCookie() ?? []),
+ *   ...(outcome.response?.headers?.getSetCookie() ?? [])
+ * ]);
+ * ```
+ */
+export function foldSetCookies(headers: Headers, setCookies: readonly string[]): Headers;
+
+/** Options for `createNoJSHandler`. */
+export interface NoJSHandlerOptions {
+  /** The app's mount path, for resolving a relative redirect `Location`. */
+  base?: string;
+}
+
+/**
+ * Builds the `handleNoJS` implementation for the no-JS form convention: a
+ * form posted without the client runtime has no way to receive a value, so
+ * the call redirects back to the referring page (or to the result's own
+ * `Location`, resolved against `base`) with the outcome riding a one-shot
+ * flash cookie. `303 See Other` turns the POST into a GET unless the result
+ * names a redirect status of its own. A result that is already a `Response`
+ * carries its meaning in its metadata and is not flashed.
+ *
+ * The render that follows reads the cookie with `decodeFlashCookie` and
+ * surfaces the outcome however it likes — that half is the integration's.
+ *
+ * The handler applies to every call it receives. `handleServerFunctionRequest`
+ * already uses it for browser form posts, so wire it explicitly only to set
+ * a `base`, or to extend the convention to direct HTTP calls by registering
+ * it through `configureServerFunctionsServer`.
+ */
+export function createNoJSHandler(
+  options?: NoJSHandlerOptions
+): (result: unknown, request: Request, args: unknown[], thrown?: boolean) => Response;
+
 /** Options for `configureServerFunctionsServer`. */
 export interface ServerFunctionsServerConfig {
   /**
@@ -119,6 +175,23 @@ export interface ServerFunctionsServerConfig {
    * calls during document SSR — e.g. frames' `frameTransformDirectResult`.
    */
   transformDirectResult?(value: unknown, options: { id: string }): unknown;
+  /**
+   * Server-wide response builder for calls made without the client runtime
+   * (see `handleNoJS` in `HandleServerFunctionRequestOptions`); a
+   * per-request option overrides it. Set it to `createNoJSHandler({ base })`
+   * to apply the convention to every non-scripted call rather than only to
+   * browser form posts, to a handler of your own to replace it, or to
+   * `null` to disable the built-in convention and answer form posts with
+   * the plain serialized response.
+   */
+  handleNoJS?:
+    | ((
+        result: unknown,
+        request: Request,
+        args: unknown[],
+        thrown?: boolean
+      ) => Response | Promise<Response>)
+    | null;
   /**
    * Endpoint the HTTP handler is mounted on, used for the `url` of SSR'd
    * references (e.g. form actions) — must match the client configuration.
@@ -285,11 +358,13 @@ export interface HandleServerFunctionOptions {
   collectFlightData?: CollectFlightDataHook;
   /**
    * Builds the response for calls made without the client runtime (no
-   * instance header — no-JS form posts, direct HTTP) — the extension
-   * point for conventions like redirect-with-flash-cookie. Receives the
+   * instance header — no-JS form posts, direct HTTP). Receives the
    * (transformed) result, the request, and the decoded arguments; `thrown`
-   * is set when the result was thrown rather than returned. Defaults to
-   * the normal serialized response.
+   * is set when the result was thrown rather than returned.
+   *
+   * Overrides the configured hook, which in turn overrides the built-in
+   * `createNoJSHandler()` applied to browser form posts. Other
+   * no-instance callers get the normal serialized response.
    */
   handleNoJS?(
     result: unknown,

package/types-cjs/server-functions/shared.d.cts

@@ -136,6 +136,41 @@ export type FlightDataConsumer<D = unknown> = (
  */
 export function subscribeFlightData<D = unknown>(consumer: FlightDataConsumer<D>): () => void;
 
+/**
+ * Name of the cookie carrying the outcome of a call made without the client
+ * runtime (`"flash"`). A no-JS form post has no way to receive a value —
+ * the browser follows the redirect and renders the next page — so the
+ * handler stashes the outcome here for the render after it to pick up,
+ * which is how a form submitted without JavaScript still shows its result.
+ *
+ * The name, detection and clearing are isomorphic (integrations read the
+ * cookie from code that also ships to the browser); the codec that fills it
+ * is server-only and lives behind the server entry.
+ */
+export const FLASH_COOKIE: string;
+
+/**
+ * Whether a Cookie header carries a flash cookie, readable or not. Cheap
+ * enough to call on every render so the clear can be queued before the
+ * response headers flush.
+ */
+export function hasFlashCookie(cookieHeader: string | null): boolean;
+
+/**
+ * The `Set-Cookie` value clearing the flash cookie. The outcome is
+ * one-shot: append this as soon as the cookie is detected, whether or not
+ * it decodes, so a stale outcome cannot resurface on a later request.
+ */
+export function clearFlashCookie(): string;
+
+/**
+ * The raw encoded flash payload out of a Cookie header, if present — the
+ * codec's own accessor.
+ *
+ * @internal
+ */
+export function matchFlashCookie(cookieHeader: string | null): string | undefined;
+
 /**
  * The currently registered single-flight consumer.
  *