@solidjs/web 2.0.0-beta.30 → 2.0.0-beta.32

package/types-cjs/frames/frame-transport.d.cts

@@ -1,3 +1,7 @@
+// EXPERIMENTAL — the frames/server-components surface ships as an
+// experimental preview, excluded from the 2.0 stability guarantee: API
+// shapes and the wire format may change between prereleases (RFC 11).
+// Every export in this module is @experimental.
 import { FrameChunk, FrameHost } from "./frame-client.cjs";
 import { JSONCodecOptions } from "./serializer.cjs";
 
@@ -11,13 +15,20 @@ type FlightConsumer = (data: unknown, context: { response: Response }) => void |
  * Header tagging a Response as a frame stream; its value is the producing
  * frame's id. Frame-owned wire contract — deliberately not a server-function
  * `BodyFormat` entry, since the body is frame chunks, not a serialized value.
+ * @experimental
  */
 export const FRAME_STREAM_HEADER: "X-Frame-Stream";
 
-/** Whether a fetch Response carries a frame stream. */
+/**
+ * Whether a fetch Response carries a frame stream.
+ * @experimental
+ */
 export function isFrameStreamResponse(response: Response): boolean;
 
-/** Options for `applyFrameResponse`. */
+/**
+ * Options for `applyFrameResponse`.
+ * @experimental
+ */
 export interface ApplyFrameResponseOptions {
   /**
    * Remap the producer's root frame id onto a local one — the id your
@@ -36,12 +47,6 @@ export interface ApplyFrameResponseOptions {
    * response.
    */
   version?: number | ((frameId: string) => number);
-  /**
-   * Remap any frame id other than the response's own root onto a local one
-   * — how a consumer resolves the addresses a single-flight response uses
-   * for the regions it refreshed.
-   */
-  route?(id: string): string;
   /**
    * Receives the payload text of each `outcome` chunk — the response-scoped
    * single-flight envelope, the caller's result rather than anything the
@@ -63,6 +68,7 @@ export interface ApplyFrameResponseOptions {
  *   await applyFrameResponse(response, host, { as: "story-pane" });
  * }
  * ```
+ * @experimental
  */
 export function applyFrameResponse(
   response: Response,
@@ -70,39 +76,45 @@ export function applyFrameResponse(
   options?: ApplyFrameResponseOptions
 ): Promise<string>;
 
-/** Brands an inline-rendered server component with its function id. */
+/**
+ * Brands an inline-rendered server component with its function id.
+ * @experimental
+ */
 export const SERVER_COMPONENT: unique symbol;
 
-/** The unwrapped server component behind an inline-render wrap. */
+/**
+ * The unwrapped server component behind an inline-render wrap.
+ * @experimental
+ */
 export const SERVER_COMPONENT_SOURCE: unique symbol;
 
-/** The call's wire address (`frameAddress`), for regions to be emitted under. */
+/**
+ * The call's wire address (`frameAddress`), for regions to be emitted under.
+ * @experimental
+ */
 export const SERVER_COMPONENT_ADDRESS: unique symbol;
 
 /**
- * The handoff contract on components the transport resolves: `{ fnId,
- * frameId, take(prev) }`. A reader whose source resolved a NEW component
- * while a previous one is mounted offers the old one — `take` rebinds the
- * live mount when both are boundaries of the same function (the element and
- * its slot state stay; the incoming stream morphs it), and the reader keeps
- * its previous value instead of remounting. `Symbol.for`, so frameworks can
- * honor it without importing this module.
+ * The binding brand on values the transport resolves: `{ component, address }`
+ * — the identity split (DR-1). `component` is the mount identity, one per
+ * server function; `address` names the call's content store. An equals-gated
+ * reader compares `component` across resolutions: same function means "same
+ * instance, new binding" — keep the mounted instance and deliver the new
+ * address into it; a different function swaps normally. `Symbol.for`, so
+ * frameworks can honor it without importing this module.
+ * @experimental
  */
-export const COMPONENT_HANDOFF: unique symbol;
+export const COMPONENT_BINDING: unique symbol;
 
-/** The value under `COMPONENT_HANDOFF` on a transport-resolved component. */
-export interface ComponentHandoff {
-  /** The server function id both peers derive the boundary's calls from. */
-  fnId: string;
-  /** The frame id this component's fresh mounts register under. */
-  frameId: string;
-  /**
-   * Offer `prev` (the reader's current value) to this component. Returns
-   * true when the reader should KEEP prev — the mounted frame was rebound
-   * to this component's id (or already showed it); false means swap
-   * normally (different function, unbranded prev, or nothing mounted).
-   */
-  take(prev: unknown): boolean;
+/**
+ * The value under `COMPONENT_BINDING` on a transport-resolved binding.
+ * @experimental
+ */
+export interface ComponentBinding<C = unknown> {
+  /** The per-function mount component (the equals-gate identity). */
+  component: C;
+  /** The call's intrinsic (function, arguments) address — its store's key. */
+  address: string;
 }
 
 /**
@@ -111,38 +123,50 @@ export interface ComponentHandoff {
  * placeholder in the hydration serializer, a live-registry lookup by call
  * address in the JSON codec (single-flight envelopes) — its markup never
  * rides as data.
+ * @experimental
  */
 export const ServerComponentPlugin: unknown;
 
+/**
+ * Installs the hydration-serializer registry prefix: given the emitted
+ * script's serializer context, returns the expression the next serialized
+ * reference reads the `_$SC` registry through (the self-bootstrapping form
+ * on a script's first reference, a bare read after). Loaded document-SSR
+ * modules install this (see frame-sink); client bundles never carry the
+ * bootstrap text.
+ * @experimental
+ */
+export function setServerComponentBootstrap(resolve: (ctx: unknown) => string): void;
+
 /**
  * The codec options for a single-flight envelope: `codec` plus
  * `ServerComponentPlugin` (deduped by tag). Injected by the protocol on both
  * legs; exported for integrations composing their own flight carriers.
+ * @experimental
  */
 export function flightCodec(codec?: JSONCodecOptions): JSONCodecOptions;
 
-/** Options for `createServerComponentHandler`. */
+/**
+ * Options for `createServerComponentHandler`.
+ * @experimental
+ */
 export interface ServerComponentHandlerOptions<C = unknown> {
   host: FrameHost;
   /**
-   * Builds the framework's mountable component for a boundary. Invoked once
-   * per boundary and cached; every mount of the returned component is its
-   * own frame instance under the boundary id (multi-mount fans out).
+   * Builds the framework's mount component for a server FUNCTION. Invoked
+   * once per function and cached — this is the equals-gate identity every
+   * call of the function resolves through. The component is CALLED (by the
+   * binding wrapper or a gated reader), receiving its current address as a
+   * second argument (`() => string`); it should (re-)bind its frame's pull
+   * to that address's store. Multi-mount fans out per site.
    */
-  component(frameId: string): C;
+  component(fnId: string): C;
   /**
-   * A new response is about to stream into a boundary: rotate
+   * A new response is about to stream into an address: rotate
    * response-scoped state (codec data tables) here. `version` is the
    * client-owned stream counter the chunks will be stamped with.
    */
-  onStream?(frameId: string, version: number, response: Response): void;
-  /**
-   * Document-SSR adoption: given a boundary id the page already carries
-   * (server-rendered between `frame:<id>` markers), return the component
-   * that adopts that range — or `undefined` to stream normally. Consulted
-   * once per boundary, before any fetch.
-   */
-  documentComponent?(frameId: string): C | undefined;
+  onStream?(address: string, version: number, response: Response): void;
   /**
    * Answer a call SYNCHRONOUSLY before any request is made (t = 0 local
    * answers — e.g. a boundary the document already carries). Returning a
@@ -167,30 +191,32 @@ export interface ServerComponentHandlerOptions<C = unknown> {
 /**
  * The client mirror of `frameTransformResult`, shaped for the server-function
  * client's `responseHandler` seam: frame-stream responses resolve the call
- * with a **stable component** instead of data, so an equals-gated consumer
- * (Solid's `dynamic`) never remounts across refetches — the response streams
- * into the boundary underneath as the only observable effect.
+ * with a **binding** — a callable wrapper branded `COMPONENT_BINDING` — so
+ * an equals-gated consumer (Solid's `dynamic`) never remounts across
+ * refetches or argument changes; the response streams into the address's
+ * resident store as the only observable effect.
  *
- * Boundary identity is derived, never declared: every call keys by its
- * intrinsic (function, arguments) address — the query cache's per-args rule,
- * so cached components and boundaries stay one-to-one. Same-args calls
- * resolve the identical component and morph in place; an args switch swaps
- * boundaries, re-materialized from the host's retained state.
+ * The identity split (DR-1): stores are keyed per-ADDRESS — the call's
+ * intrinsic (function, arguments) name, one-to-one with a query cache's
+ * per-args entries — while mounts are per-SITE, rendering the per-function
+ * component and following delivered addresses. An address nothing is bound
+ * to warms its store (preload isolation is the default, not a rule).
+ * @experimental
  */
 export function createServerComponentHandler<C>(options: ServerComponentHandlerOptions<C>): {
-  intercept?(info: { id: string; meta: unknown; args: unknown[] }): C | undefined;
+  intercept?(info: { id: string; meta: unknown; args: unknown[] }): unknown;
   handle(
     response: Response,
     ctx: { id: string; meta: unknown; args: unknown[]; context: unknown }
-  ): C | undefined;
+  ): unknown;
   /**
    * Declares that the document is showing a call: hydration-data references
    * carry their call's address (`_$SC.r(id, address)`) but never travel
-   * through the transport, so the integration forwards those records here —
-   * they are how a post-load call for the same (function, arguments) finds
-   * its way back to the adopted boundary. `component` must be the exact
-   * reference the integration's cache holds for the call (the per-function
-   * placeholder), or readers' equals-gates fail into remounts.
+   * through the transport, so the integration forwards those records here.
+   * Mints the call's binding (a post-load refetch then resolves a value
+   * whose component matches what the document mounted) and brands the
+   * per-function component so cache-seeded readers deliver instead of
+   * remounting when their site later switches calls.
    */
-  showing(address: string, functionId: string, component: C): void;
+  showing(address: string, functionId: string): void;
 };

package/types-cjs/frames/serializer.d.cts

@@ -1,23 +1,142 @@
-import { Plugin, Serializer, SerovalNode } from "seroval";
+// Serialization surface (published as `@solidjs/web/serialization`): the
+// runtime's Seroval machinery, exposed for the runtime's own entries and
+// for integrations building transports on the same codec. This is
+// INTEGRATION-FACING plumbing, not application API — it is exempt from the
+// 2.0 stability guarantee and may change between releases. Application and
+// router code should configure `codec` on the server-function entries
+// instead of importing from here.
+import { Serializer, SerovalNode } from "seroval";
 
 /**
  * Seroval's node shape — the intermediate representation `serializeJSON`
  * emits and `createJSONDeserializer` consumes. Safe to `JSON.stringify`.
+ *
+ * Integration-facing; may change (see the entry banner).
  */
 export type { SerovalNode };
 
+// ---- Plugin authoring ----
+//
+// Unlike the rest of this entry, plugin authoring is APPLICATION-FACING —
+// it is the supported way to feed the serializers' `plugins` options and
+// the server-function entries' `codec.plugins`. The values re-export
+// seroval's own (`createPlugin`, `OpaqueReference` — see serializer.js);
+// the TYPES are declared here by hand, like everything else in this file,
+// because seroval's published d.ts use extensionless ESM-relative imports
+// that `moduleResolution: "nodenext"` cannot follow — a bare type
+// re-export would silently degrade the whole authoring surface to `any`
+// under skipLibCheck. The declarations mirror seroval ~1.5 exactly; the
+// `~` pin is what makes mirroring safe.
+
+/** Per-plugin bookkeeping seroval hands each plugin callback. */
+export interface PluginData {
+  id: number;
+}
+
+/**
+ * The shape of a plugin's parsed payload: a map of `SerovalNode`s produced
+ * by the parse contexts, consumed by `serialize`/`deserialize`.
+ */
+export type PluginInfo = { [key: string]: SerovalNode };
+
+/** Parse context for `parse.sync`: turns child values into nodes. */
+export interface SyncParsePluginContext {
+  parse<T>(current: T): SerovalNode;
+}
+
+/** Parse context for `parse.async`: like sync, but child parses await. */
+export interface AsyncParsePluginContext {
+  parse<T>(current: T): Promise<SerovalNode>;
+}
+
+/**
+ * Parse context for `parse.stream`: sync parsing plus the streaming
+ * lifecycle (pending-state tracking, late node emission, cleanup).
+ */
+export interface StreamParsePluginContext {
+  parse<T>(current: T): SerovalNode;
+  parseWithError<T>(current: T): SerovalNode | undefined;
+  isAlive(): boolean;
+  pushPendingState(): void;
+  popPendingState(): void;
+  onParse(node: SerovalNode): void;
+  onError(error: unknown): void;
+  addCleanup(callback: () => void): void;
+}
+
+/** Serialize context: renders child nodes to JS source. */
+export interface SerializePluginContext {
+  serialize(node: SerovalNode): string;
+}
+
+/** Deserialize context: revives child nodes to runtime values. */
+export interface DeserializePluginContext {
+  deserialize<T>(node: SerovalNode): T;
+}
+
 /**
  * A Seroval plugin usable with the web serializers — teaches the codec how
- * to encode/decode a custom value type. Supply matching plugins on both
- * peers of a transport.
+ * to encode/decode a custom value type (`Value` is the value it matches,
+ * `Info` its parsed payload). Supply matching plugins on both peers of a
+ * transport. Bare `SerializerPlugin` (both parameters defaulted to `any`)
+ * is the list-element type every `plugins` option accepts.
+ *
+ * Integration-facing; may change (see the entry banner).
  */
-export type SerializerPlugin = Plugin<any, any>;
+export interface SerializerPlugin<Value = any, Info extends PluginInfo = any> {
+  /** A unique string identifying the plugin — namespace it (`"app/Thing"`). */
+  tag: string;
+  /** Dependency plugins, resolved ahead of this one. */
+  extends?: SerializerPlugin[];
+  /** Whether `value` is this plugin's to encode. */
+  test(value: unknown): boolean;
+  /** Parsing modes — provide the ones the transports you target use. */
+  parse: {
+    sync?: (value: Value, ctx: SyncParsePluginContext, data: PluginData) => Info;
+    async?: (value: Value, ctx: AsyncParsePluginContext, data: PluginData) => Promise<Info>;
+    stream?: (value: Value, ctx: StreamParsePluginContext, data: PluginData) => Info;
+  };
+  /** Renders the parsed payload as JS source (script-injection form). */
+  serialize(node: Info, ctx: SerializePluginContext, data: PluginData): string;
+  /** Revives the parsed payload back into the runtime value. */
+  deserialize(node: Info, ctx: DeserializePluginContext, data: PluginData): Value;
+}
+
+/**
+ * Builds a `SerializerPlugin` — seroval's `createPlugin`, re-exported so
+ * plugin authors stay on the exact seroval instance/version the runtime
+ * serializes with. Import it from HERE, not from your own `seroval`
+ * dependency: a plugin built against a different copy/version would not
+ * fail the build — it would emit nodes the other peer can't interpret.
+ *
+ * Application-facing (see the plugin-authoring banner above).
+ */
+export function createPlugin<Value, Info extends PluginInfo>(
+  plugin: SerializerPlugin<Value, Info>
+): SerializerPlugin<Value, Info>;
+
+/**
+ * Seroval's `OpaqueReference`, re-exported from the runtime's own instance
+ * (an `OpaqueReference` from another seroval copy fails the serializer's
+ * instanceof check and serializes as a plain value): wraps a value so it
+ * crosses the wire as its `replacement` (default `undefined`) while
+ * staying readable in-process through `.value`.
+ *
+ * Application-facing (see the plugin-authoring banner above).
+ */
+export class OpaqueReference<V, R = undefined> {
+  readonly value: V;
+  readonly replacement?: R;
+  constructor(value: V, replacement?: R);
+}
 
 /**
  * Baseline plugin set for serializing web-platform values (AbortSignal,
  * Event, FormData, Headers, ReadableStream, Request, Response, URL, ...).
  * Applied by every serializer in this module; custom plugins compose ahead
  * of it via `resolveSerializerPlugins`.
+ *
+ * Integration-facing; may change (see the entry banner).
  */
 export const DEFAULT_WEB_PLUGINS: readonly SerializerPlugin[];
 
@@ -26,10 +145,16 @@ export const DEFAULT_WEB_PLUGINS: readonly SerializerPlugin[];
  * first so they can shadow a default for values both would match. Returns a
  * fresh array; the defaults are never mutated. Useful when handing a full
  * plugin list to another serialization layer.
+ *
+ * Integration-facing; may change (see the entry banner).
  */
 export function resolveSerializerPlugins(customPlugins?: SerializerPlugin[]): SerializerPlugin[];
 
-/** Options for `createSerializer`. */
+/**
+ * Options for `createSerializer`.
+ *
+ * Integration-facing; may change (see the entry banner).
+ */
 export interface WebSerializerOptions {
   /** Name of the global object the emitted scripts write resolved values into. */
   globalIdentifier: string;
@@ -58,6 +183,8 @@ export interface WebSerializerOptions {
  * evaluated — the script-injection form of serialization renderers build
  * on. For a JSON-based wire codec (no eval on the receiving side), use
  * `serializeJSON` / `createJSONDeserializer` instead.
+ *
+ * Integration-facing; may change (see the entry banner).
  */
 export function createSerializer(options: WebSerializerOptions): Serializer;
 
@@ -96,6 +223,8 @@ export function getLocalHeaderScript(id?: string): string;
  * on the serializing and deserializing peer or payloads will not
  * round-trip — for server functions, set them once through the
  * client/server `codec` config option.
+ *
+ * Integration-facing; may change (see the entry banner).
  */
 export interface JSONCodecOptions {
   /** Extra plugins, composed ahead of `DEFAULT_WEB_PLUGINS`. Must match on both peers. */
@@ -113,7 +242,11 @@ export interface JSONCodecOptions {
   depthLimit?: number;
 }
 
-/** Options for `serializeJSON`. */
+/**
+ * Options for `serializeJSON`.
+ *
+ * Integration-facing; may change (see the entry banner).
+ */
 export interface JSONSerializeOptions extends JSONCodecOptions {
   /**
    * Receives each serialized node; `initial` is true for the first chunk
@@ -132,6 +265,8 @@ export interface JSONSerializeOptions extends JSONCodecOptions {
  * the deserializing peer needs no script evaluation, so CSP-safe). Wire
  * framing of the nodes is the transport's concern. Returns a cancel
  * function that aborts pending async serialization.
+ *
+ * Integration-facing; may change (see the entry banner).
  */
 export function serializeJSON(value: unknown, options: JSONSerializeOptions): () => void;
 
@@ -141,14 +276,46 @@ export function serializeJSON(value: unknown, options: JSONSerializeOptions): ()
  * from one stream must go through the same deserializer instance. The first
  * chunk's return value is the decoded source value; feeding later chunks
  * settles the async values referenced inside it.
+ *
+ * Integration-facing; may change (see the entry banner).
  */
 export function createJSONDeserializer(options?: JSONCodecOptions): <T>(node: SerovalNode) => T;
 
+/** Options for `createJSONSerializer`. */
+export interface JSONSerializerOptions extends JSONCodecOptions {
+  /**
+   * Receives each keyed record — `initial` is true for a key's first node
+   * (the written value itself); async values patch through later records
+   * under the same key. The decoding peer is `createJSONDataTable`.
+   */
+  onData: (record: { key: string; node: SerovalNode; initial: boolean }) => void;
+  onError?: (error: unknown) => void;
+  /** Fires once `flush()` has been called and every pending value settled. */
+  onDone?: () => void;
+}
+
+/**
+ * The keyed, streaming encoder of the eval-free JSON codec — the render
+ * stream's data serializer (frames default to it). Each `write(key, value)`
+ * shares one reference space, so cross-record identity holds; `flush()`
+ * marks the write set complete (writes after it are dropped, mirroring the
+ * hydration serializer); `close()` aborts pending async serialization.
+ */
+export function createJSONSerializer(options: JSONSerializerOptions): {
+  write(key: string, value: unknown): void;
+  flush(): void;
+  close(): void;
+};
+
 /**
  * A resident, response-scoped decode table over the keyed JSON codec: apply
  * each frame `data` chunk with `apply`, resolve `{ $ref }` slot args with
  * `resolve`. The frames client host wires one per response
  * (`applyData: c => table.apply(c)`).
+ *
+ * Integration-facing; may change (see the entry banner). This serialization
+ * entry is the single home of the data table — the frames client consumes
+ * it internally rather than re-exporting it.
  */
 export interface JSONDataTable {
   apply(chunk: { key?: string; node?: unknown; initial?: boolean }): void;

package/types-cjs/frames/server.d.cts

@@ -22,9 +22,31 @@ import type { Element as SolidElement } from "solid-js";
  * re-creates everything. It is occurrence identity, not client data: it is
  * stripped before the client component sees its props. Positional identity is
  * the right default; `$key` matters when a live list reorders.
+ * @experimental
  */
 export type Slot<P = {}> = (props: P & {
     $key?: string | number;
 }) => SolidElement;
+/**
+ * Types an async value crossing the slot border (DR-2, value tier). What you
+ * pass is what ships — the promise / async iterable itself rides the data
+ * channel — but the client's prop READ settles: it suspends into the covering
+ * boundary until first arrival (a promise's resolution, an iterable's first
+ * yield), then reads as the settled value, updating per yield for iterables.
+ *
+ * `asyncArg` is the type-level statement of that contract: identity at
+ * runtime, settled type at the border, so `Slot<P>` keeps the fill's props
+ * truthful to what its reads actually return.
+ *
+ * Slots render as JSX — the compiler wraps each prop in a getter so the read
+ * defers to the slot border, where the runtime owns it. A call form
+ * (`props.status({ … })`) evaluates its args eagerly in the component body —
+ * a top-level read, an error in most cases.
+ *
+ * ```tsx
+ * <props.status progress={asyncArg(gen.progress)} stats={asyncArg(gen.stats)} />
+ * ```
+ */
+export declare function asyncArg<T>(value: PromiseLike<T> | AsyncIterable<T>): T;
 export { renderToFrameStream, renderServerComponent, serverComponentResponse, frameTransformResult, frameTransformFlightResult, createFrameSink, frameTransformDirectResult, ServerComponentPlugin, SERVER_COMPONENT_BOOTSTRAP } from "./frame-sink.cjs";
 export { FRAME_STREAM_HEADER, isFrameStreamResponse } from "./frame-transport.cjs";

package/types-cjs/index.d.cts

@@ -96,9 +96,8 @@ export declare function render(code: () => JSX.Element, element: MountableElemen
  * and reactive bindings without reconstructing the DOM. Returns a `dispose`
  * function that tears down reactive scopes (DOM nodes are left in place).
  *
- * Use this when the page HTML was produced by `renderToString`,
- * `renderToStringAsync`, or `renderToStream`. For client-only apps, use
- * `render` instead.
+ * Use this when the page HTML was produced by `renderToString` or
+ * `renderToStream`. For client-only apps, use `render` instead.
  *
  * Pass `options.renderId` to hydrate one of multiple roots emitted by a
  * server render that used the same id.

package/types-cjs/jsx.d.cts

@@ -240,13 +240,13 @@ export namespace JSX {
   }
 
   type RefCallback<T> = (el: T) => void;
-  type Ref<T> = T | RefCallback<T> | Ref<T>[];
+  type Ref<T> = T | RefCallback<T> | undefined | Ref<T>[];
 
   interface IntrinsicAttributes {
-    ref?: Ref<unknown> | undefined;
+    ref?: Ref<unknown>;
   }
   interface CustomAttributes<T> {
-    ref?: Ref<T> | undefined;
+    ref?: Ref<T>;
     children?: Element | undefined;
     $ServerOnly?: boolean | undefined;
   }

package/types-cjs/response.d.cts

@@ -49,6 +49,51 @@ export interface Href {
  */
 export function isHref(value: unknown): value is Href;
 
+/**
+ * Registered-symbol brand (`Symbol.for("solid.SafeError")`) marking a thrown
+ * value as safe to serialize to the client verbatim. Declared `unique
+ * symbol` type-side; the runtime value is the registered symbol, so
+ * separately bundled copies agree on identity.
+ */
+export declare const SAFE_ERROR: unique symbol;
+
+/**
+ * Marks `error` as safe to serialize to the client verbatim, opting it out
+ * of the server-function handler's production error sanitization.
+ *
+ * By default a plain `Error` thrown from a server function is sanitized to a
+ * generic `Error` outside the dev build (the `development` export condition
+ * selects the full-fidelity copy; every other resolution sanitizes):
+ * its `message`, `stack`, and own-properties are dropped so a driver/ORM
+ * error can't leak a failing query or connection string over the wire.
+ * Dev builds keep full fidelity. This is the escape hatch for errors whose
+ * content is *intentional* client-facing information — brand them and their
+ * message/properties travel intact in every environment.
+ *
+ * The brand is a non-enumerable, symbol-keyed property, so it never itself
+ * serializes as an own-property. Sets the brand and returns the same value.
+ *
+ * @example
+ * ```ts
+ * import { markSafeError } from "@solidjs/web";
+ *
+ * async function transfer(amount: number) {
+ *   "use server";
+ *   if (amount > balance) {
+ *     // The user must see this message; opt out of sanitization.
+ *     throw markSafeError(new Error("Insufficient funds"));
+ *   }
+ * }
+ * ```
+ */
+export function markSafeError<E>(error: E): E;
+
+/**
+ * Whether `value` is branded safe to serialize (via `markSafeError`).
+ * Registered-symbol check, correct across duplicated module instances.
+ */
+export function isSafeError(value: unknown): value is Error;
+
 /**
  * Response header naming the cache keys a mutation invalidated
  * (`"X-Revalidate"`), comma separated. The response helpers below set it