@solidjs/web 2.0.0-beta.31 → 2.0.0-beta.33

package/types/serializer-decode.d.ts

@@ -0,0 +1,182 @@
+// The DECODE half of the serialization surface (published as
+// `@solidjs/web/serialization/decode`): what reading a serialized payload
+// needs — `fromCrossJSON`-backed deserializers and the shared plugin set —
+// with none of the encode machinery. Lazy client consumers (the frames
+// data tables, `deserializeStream`) load this module so the encode half
+// never ships to a browser that only reads. The full serializer.d.ts
+// re-exports everything here; see its banner for the stability contract
+// (integration-facing, exempt from the 2.0 stability guarantee).
+// ---- Plugin types ----
+//
+// Declared here by hand (seroval's published d.ts use extensionless
+// ESM-relative imports that `moduleResolution: "nodenext"` cannot follow —
+// a bare type re-export would silently degrade the surface to `any` under
+// skipLibCheck, and an import would make every entry whose types reach
+// this module — the MAIN client entry included, via the server-function
+// seam's `JSONCodecOptions` — unimportable from a strict Node16 CJS
+// consumer). The declarations mirror seroval ~1.5 exactly; the `~` pin is
+// what makes mirroring safe. Plugin AUTHORING (`createPlugin`,
+// `OpaqueReference`) lives on the full serialization entry.
+
+/**
+ * Seroval's node shape — the intermediate representation `serializeJSON`
+ * emits and `createJSONDeserializer` consumes. Safe to `JSON.stringify`.
+ * Declared by hand like the plugin types below (same rationale): the
+ * observable envelope — a numeric type tag, an optional reference id —
+ * with the rest owned by the codec. Real seroval nodes satisfy it; treat
+ * it as an opaque token.
+ *
+ * Integration-facing; may change (see the entry banner).
+ */
+export interface SerovalNode {
+  /** Node type tag (seroval-internal enum). */
+  t: number;
+  /** Reference id, when the node participates in cross-referencing. */
+  i?: number | undefined;
+  [key: string]: unknown;
+}
+
+/** Per-plugin bookkeeping seroval hands each plugin callback. */
+export interface PluginData {
+  id: number;
+}
+
+/**
+ * The shape of a plugin's parsed payload: a map of `SerovalNode`s produced
+ * by the parse contexts, consumed by `serialize`/`deserialize`.
+ */
+export type PluginInfo = { [key: string]: SerovalNode };
+
+/** Parse context for `parse.sync`: turns child values into nodes. */
+export interface SyncParsePluginContext {
+  parse<T>(current: T): SerovalNode;
+}
+
+/** Parse context for `parse.async`: like sync, but child parses await. */
+export interface AsyncParsePluginContext {
+  parse<T>(current: T): Promise<SerovalNode>;
+}
+
+/**
+ * Parse context for `parse.stream`: sync parsing plus the streaming
+ * lifecycle (pending-state tracking, late node emission, cleanup).
+ */
+export interface StreamParsePluginContext {
+  parse<T>(current: T): SerovalNode;
+  parseWithError<T>(current: T): SerovalNode | undefined;
+  isAlive(): boolean;
+  pushPendingState(): void;
+  popPendingState(): void;
+  onParse(node: SerovalNode): void;
+  onError(error: unknown): void;
+  addCleanup(callback: () => void): void;
+}
+
+/** Serialize context: renders child nodes to JS source. */
+export interface SerializePluginContext {
+  serialize(node: SerovalNode): string;
+}
+
+/** Deserialize context: revives child nodes to runtime values. */
+export interface DeserializePluginContext {
+  deserialize<T>(node: SerovalNode): T;
+}
+
+/**
+ * A Seroval plugin usable with the web serializers — teaches the codec how
+ * to encode/decode a custom value type (`Value` is the value it matches,
+ * `Info` its parsed payload). Supply matching plugins on both peers of a
+ * transport. Bare `SerializerPlugin` (both parameters defaulted to `any`)
+ * is the list-element type every `plugins` option accepts.
+ *
+ * Integration-facing; may change (see the entry banner).
+ */
+export interface SerializerPlugin<Value = any, Info extends PluginInfo = any> {
+  /** A unique string identifying the plugin — namespace it (`"app/Thing"`). */
+  tag: string;
+  /** Dependency plugins, resolved ahead of this one. */
+  extends?: SerializerPlugin[];
+  /** Whether `value` is this plugin's to encode. */
+  test(value: unknown): boolean;
+  /** Parsing modes — provide the ones the transports you target use. */
+  parse: {
+    sync?: (value: Value, ctx: SyncParsePluginContext, data: PluginData) => Info;
+    async?: (value: Value, ctx: AsyncParsePluginContext, data: PluginData) => Promise<Info>;
+    stream?: (value: Value, ctx: StreamParsePluginContext, data: PluginData) => Info;
+  };
+  /** Renders the parsed payload as JS source (script-injection form). */
+  serialize(node: Info, ctx: SerializePluginContext, data: PluginData): string;
+  /** Revives the parsed payload back into the runtime value. */
+  deserialize(node: Info, ctx: DeserializePluginContext, data: PluginData): Value;
+}
+
+/**
+ * Baseline plugin set for serializing web-platform values (AbortSignal,
+ * Event, FormData, Headers, ReadableStream, Request, Response, URL, ...).
+ * Applied by every serializer in this module; custom plugins compose ahead
+ * of it via `resolveSerializerPlugins`.
+ *
+ * Integration-facing; may change (see the entry banner).
+ */
+export const DEFAULT_WEB_PLUGINS: readonly SerializerPlugin[];
+
+/**
+ * Composes custom plugins with `DEFAULT_WEB_PLUGINS`. Custom plugins come
+ * first so they can shadow a default for values both would match. Returns a
+ * fresh array; the defaults are never mutated. Useful when handing a full
+ * plugin list to another serialization layer.
+ *
+ * Integration-facing; may change (see the entry banner).
+ */
+export function resolveSerializerPlugins(customPlugins?: SerializerPlugin[]): SerializerPlugin[];
+
+/**
+ * Options shared by both halves of the JSON codec. All of them must match
+ * on the serializing and deserializing peer or payloads will not
+ * round-trip — for server functions, set them once through the
+ * client/server `codec` config option.
+ *
+ * Integration-facing; may change (see the entry banner).
+ */
+export interface JSONCodecOptions {
+  /** Extra plugins, composed ahead of `DEFAULT_WEB_PLUGINS`. Must match on both peers. */
+  plugins?: SerializerPlugin[];
+  /**
+   * Seroval feature bitflags to exclude. Defaults to disabling `RegExp`
+   * (payloads may come from an untrusted peer). Must match on both peers.
+   * Outside development, the encoding side additionally strips
+   * `Error.prototype.stack` on top of any override — serialized stacks leak
+   * server paths to the client. Decoding stays permissive, so payloads from
+   * a development peer still round-trip.
+   */
+  disabledFeatures?: number;
+  /** Maximum parse/deserialize depth. Defaults to 64. Must match on both peers. */
+  depthLimit?: number;
+}
+
+/**
+ * Creates the decoding counterpart of `serializeJSON`. Cross-references
+ * between chunks resolve through state shared across calls, so all chunks
+ * from one stream must go through the same deserializer instance. The first
+ * chunk's return value is the decoded source value; feeding later chunks
+ * settles the async values referenced inside it.
+ *
+ * Integration-facing; may change (see the entry banner).
+ */
+export function createJSONDeserializer(options?: JSONCodecOptions): <T>(node: SerovalNode) => T;
+
+/**
+ * A resident, response-scoped decode table over the keyed JSON codec: apply
+ * each frame `data` chunk with `apply`, resolve `{ $ref }` slot args with
+ * `resolve`. The frames client host wires one per response
+ * (`applyData: c => table.apply(c)`).
+ *
+ * Integration-facing; may change (see the entry banner). This serialization
+ * entry is the single home of the data table — the frames client consumes
+ * it internally rather than re-exporting it.
+ */
+export interface JSONDataTable {
+  apply(chunk: { key?: string; node?: unknown; initial?: boolean }): void;
+  resolve<T = unknown>(ref: { $ref: string }): T;
+}
+export function createJSONDataTable(options?: JSONCodecOptions): JSONDataTable;

package/types/serializer.d.ts

@@ -1,35 +1,67 @@
-import { Plugin, Serializer, SerovalNode } from "seroval";
+// Serialization surface (published as `@solidjs/web/serialization`): the
+// runtime's Seroval machinery, exposed for the runtime's own entries and
+// for integrations building transports on the same codec. This is
+// INTEGRATION-FACING plumbing, not application API — it is exempt from the
+// 2.0 stability guarantee and may change between releases. Application and
+// router code should configure `codec` on the server-function entries
+// instead of importing from here.
+import type { Serializer } from "seroval";
+import {
+  JSONCodecOptions,
+  PluginInfo,
+  SerializerPlugin,
+  SerovalNode
+} from "./serializer-decode.js";
 
-/**
- * Seroval's node shape — the intermediate representation `serializeJSON`
- * emits and `createJSONDeserializer` consumes. Safe to `JSON.stringify`.
- */
-export type { SerovalNode };
+// The decode half — `SerovalNode`, the plugin TYPES, `DEFAULT_WEB_PLUGINS`,
+// `resolveSerializerPlugins`, `JSONCodecOptions`, `createJSONDeserializer`,
+// `createJSONDataTable` — is declared in serializer-decode.d.ts (published
+// as `@solidjs/web/serialization/decode`, the module lazy client consumers
+// load) and re-exported here so this remains the full surface.
+export * from "./serializer-decode.js";
+
+// ---- Plugin authoring ----
+//
+// Unlike the rest of this entry, plugin authoring is APPLICATION-FACING —
+// it is the supported way to feed the serializers' `plugins` options and
+// the server-function entries' `codec.plugins`. The values re-export
+// seroval's own (`createPlugin`, `OpaqueReference` — see serializer.js);
+// the plugin TYPES live in serializer-decode.d.ts (hand-declared there —
+// see its banner for why).
 
 /**
- * A Seroval plugin usable with the web serializers — teaches the codec how
- * to encode/decode a custom value type. Supply matching plugins on both
- * peers of a transport.
+ * Builds a `SerializerPlugin` — seroval's `createPlugin`, re-exported so
+ * plugin authors stay on the exact seroval instance/version the runtime
+ * serializes with. Import it from HERE, not from your own `seroval`
+ * dependency: a plugin built against a different copy/version would not
+ * fail the build — it would emit nodes the other peer can't interpret.
+ *
+ * Application-facing (see the plugin-authoring banner above).
  */
-export type SerializerPlugin = Plugin<any, any>;
+export function createPlugin<Value, Info extends PluginInfo>(
+  plugin: SerializerPlugin<Value, Info>
+): SerializerPlugin<Value, Info>;
 
 /**
- * Baseline plugin set for serializing web-platform values (AbortSignal,
- * Event, FormData, Headers, ReadableStream, Request, Response, URL, ...).
- * Applied by every serializer in this module; custom plugins compose ahead
- * of it via `resolveSerializerPlugins`.
+ * Seroval's `OpaqueReference`, re-exported from the runtime's own instance
+ * (an `OpaqueReference` from another seroval copy fails the serializer's
+ * instanceof check and serializes as a plain value): wraps a value so it
+ * crosses the wire as its `replacement` (default `undefined`) while
+ * staying readable in-process through `.value`.
+ *
+ * Application-facing (see the plugin-authoring banner above).
  */
-export const DEFAULT_WEB_PLUGINS: readonly SerializerPlugin[];
+export class OpaqueReference<V, R = undefined> {
+  readonly value: V;
+  readonly replacement?: R;
+  constructor(value: V, replacement?: R);
+}
 
 /**
- * Composes custom plugins with `DEFAULT_WEB_PLUGINS`. Custom plugins come
- * first so they can shadow a default for values both would match. Returns a
- * fresh array; the defaults are never mutated. Useful when handing a full
- * plugin list to another serialization layer.
+ * Options for `createSerializer`.
+ *
+ * Integration-facing; may change (see the entry banner).
  */
-export function resolveSerializerPlugins(customPlugins?: SerializerPlugin[]): SerializerPlugin[];
-
-/** Options for `createSerializer`. */
 export interface WebSerializerOptions {
   /** Name of the global object the emitted scripts write resolved values into. */
   globalIdentifier: string;
@@ -58,6 +90,8 @@ export interface WebSerializerOptions {
  * evaluated — the script-injection form of serialization renderers build
  * on. For a JSON-based wire codec (no eval on the receiving side), use
  * `serializeJSON` / `createJSONDeserializer` instead.
+ *
+ * Integration-facing; may change (see the entry banner).
  */
 export function createSerializer(options: WebSerializerOptions): Serializer;
 
@@ -90,30 +124,14 @@ export function createHydrationSerializer(options: HydrationSerializerOptions):
 export function getLocalHeaderScript(id?: string): string;
 
 // ---- JSON codec (server function transports) ----
+// (`JSONCodecOptions` and the decode half are declared in
+// serializer-decode.d.ts and re-exported above.)
 
 /**
- * Options shared by both halves of the JSON codec. All of them must match
- * on the serializing and deserializing peer or payloads will not
- * round-trip — for server functions, set them once through the
- * client/server `codec` config option.
+ * Options for `serializeJSON`.
+ *
+ * Integration-facing; may change (see the entry banner).
  */
-export interface JSONCodecOptions {
-  /** Extra plugins, composed ahead of `DEFAULT_WEB_PLUGINS`. Must match on both peers. */
-  plugins?: SerializerPlugin[];
-  /**
-   * Seroval feature bitflags to exclude. Defaults to disabling `RegExp`
-   * (payloads may come from an untrusted peer). Must match on both peers.
-   * Outside development, the encoding side additionally strips
-   * `Error.prototype.stack` on top of any override — serialized stacks leak
-   * server paths to the client. Decoding stays permissive, so payloads from
-   * a development peer still round-trip.
-   */
-  disabledFeatures?: number;
-  /** Maximum parse/deserialize depth. Defaults to 64. Must match on both peers. */
-  depthLimit?: number;
-}
-
-/** Options for `serializeJSON`. */
 export interface JSONSerializeOptions extends JSONCodecOptions {
   /**
    * Receives each serialized node; `initial` is true for the first chunk
@@ -132,26 +150,33 @@ export interface JSONSerializeOptions extends JSONCodecOptions {
  * the deserializing peer needs no script evaluation, so CSP-safe). Wire
  * framing of the nodes is the transport's concern. Returns a cancel
  * function that aborts pending async serialization.
+ *
+ * Integration-facing; may change (see the entry banner).
  */
 export function serializeJSON(value: unknown, options: JSONSerializeOptions): () => void;
 
-/**
- * Creates the decoding counterpart of `serializeJSON`. Cross-references
- * between chunks resolve through state shared across calls, so all chunks
- * from one stream must go through the same deserializer instance. The first
- * chunk's return value is the decoded source value; feeding later chunks
- * settles the async values referenced inside it.
- */
-export function createJSONDeserializer(options?: JSONCodecOptions): <T>(node: SerovalNode) => T;
+/** Options for `createJSONSerializer`. */
+export interface JSONSerializerOptions extends JSONCodecOptions {
+  /**
+   * Receives each keyed record — `initial` is true for a key's first node
+   * (the written value itself); async values patch through later records
+   * under the same key. The decoding peer is `createJSONDataTable`.
+   */
+  onData: (record: { key: string; node: SerovalNode; initial: boolean }) => void;
+  onError?: (error: unknown) => void;
+  /** Fires once `flush()` has been called and every pending value settled. */
+  onDone?: () => void;
+}
 
 /**
- * A resident, response-scoped decode table over the keyed JSON codec: apply
- * each frame `data` chunk with `apply`, resolve `{ $ref }` slot args with
- * `resolve`. The frames client host wires one per response
- * (`applyData: c => table.apply(c)`).
+ * The keyed, streaming encoder of the eval-free JSON codec — the render
+ * stream's data serializer (frames default to it). Each `write(key, value)`
+ * shares one reference space, so cross-record identity holds; `flush()`
+ * marks the write set complete (writes after it are dropped, mirroring the
+ * hydration serializer); `close()` aborts pending async serialization.
  */
-export interface JSONDataTable {
-  apply(chunk: { key?: string; node?: unknown; initial?: boolean }): void;
-  resolve<T = unknown>(ref: { $ref: string }): T;
-}
-export function createJSONDataTable(options?: JSONCodecOptions): JSONDataTable;
+export function createJSONSerializer(options: JSONSerializerOptions): {
+  write(key: string, value: unknown): void;
+  flush(): void;
+  close(): void;
+};

package/types/server-functions/client.d.ts

@@ -1,4 +1,4 @@
-import { JSONCodecOptions } from "../serializer.js";
+import { JSONCodecOptions } from "../serializer-decode.js";
 import { ServerFunction, ServerFunctionMetadata } from "./shared.js";
 
 export {
@@ -21,6 +21,7 @@ export {
   getServerFunctionsCodec,
   hasFlashCookie,
   isServerFunction,
+  serializeString,
   subscribeFlightData,
   withMeta
 } from "./shared.js";

package/types/server-functions/rich-args.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Opt-in codec encoding for server-function ARGUMENTS. By default the client
+ * sends argument lists as plain JSON (no serializer in the bundle) and
+ * throws on values JSON can't carry faithfully. Call once at startup to
+ * send Dates, Maps, Sets, typed arrays, cyclic structures, etc. through the
+ * codec — at the cost of the serializer's write half (~5 KB gz on top of
+ * the decode half responses already need). The handler accepts both
+ * encodings unconditionally.
+ */
+export function enableRichArguments(): void;

package/types/server-functions/server.d.ts

@@ -1,5 +1,5 @@
 import { ResponseEnvelope } from "../response.js";
-import { JSONCodecOptions } from "../serializer.js";
+import { JSONCodecOptions } from "../serializer-decode.js";
 import { RequestEvent } from "../server.js";
 
 export {
@@ -119,6 +119,33 @@ export type CollectFlightDataHook = (
   outcome: ServerFunctionOutcome
 ) => unknown | Promise<unknown>;
 
+/**
+ * Wraps a server function execution — the per-invocation seam for
+ * framework policies (per-function middleware, auth, logging, error
+ * mapping). Called inside the call's event scope with the invocation
+ * identity already established: `getServerFunctionInvocation()` answers
+ * before, during and after `run()`. Must return (or resolve to) `run()`'s
+ * result — replacing it replaces the function's result; throwing routes
+ * through the handler's normal error encoding.
+ *
+ * The context carries the call's identity (`id`, parsed `args`), its
+ * `event`, and how it arrived: `direct` is `true` for in-process SSR calls
+ * (where `request` is absent) and `false` for HTTP dispatch. On the direct
+ * path the wrapper must stay transparent for synchronous functions —
+ * return `run()`'s value, not an unconditional promise, unless it needs to
+ * be async.
+ */
+export type WrapInvocationHook = (
+  run: () => unknown,
+  context: {
+    id: string;
+    args: unknown[];
+    event: ServerFunctionEvent;
+    request?: Request;
+    direct: boolean;
+  }
+) => unknown;
+
 /**
  * Request headers with `setCookies` folded into the `Cookie` header, as the
  * browser would have applied them before its next request. Later entries
@@ -180,6 +207,14 @@ export interface ServerFunctionsServerConfig {
    * an established request scope parks on the global.
    */
   provideEvent?: <T>(event: ServerFunctionEvent, fn: () => T) => T;
+  /**
+   * Wraps every server function execution — HTTP dispatch and direct SSR
+   * calls alike — with the invocation identity already established (see
+   * `WrapInvocationHook`). The per-invocation seam for framework policies:
+   * per-function middleware, auth, logging, error mapping. A per-request
+   * option overrides it for HTTP dispatch.
+   */
+  wrapInvocation?: WrapInvocationHook;
   /**
    * The single-flight hook: produces the data payload folded into
    * responses of calls that opted in (see `CollectFlightDataHook`).
@@ -402,6 +437,13 @@ export interface HandleServerFunctionOptions {
    * contract as the `provideEvent` config option.
    */
   provideEvent?<T>(event: ServerFunctionEvent, fn: () => T): T;
+  /**
+   * Overrides the configured per-invocation wrap for this handler — same
+   * contract as the `wrapInvocation` config option (see
+   * `WrapInvocationHook`), except it only applies to HTTP dispatch (a
+   * per-request option can't see direct SSR calls).
+   */
+  wrapInvocation?: WrapInvocationHook;
   /**
    * Observes or replaces the function's result before encoding — the
    * extension point for response metadata policies (headers, statuses,
@@ -473,6 +515,41 @@ export interface HandleServerFunctionOptions {
  * (default `/_server`); platform adapters (h3, express, ...) convert their
  * request shape to a web `Request` around it.
  *
+ * When the event carries a `response` head stub (`event.response`, see the
+ * server entry's `ResponseStub`), the handler folds it onto every outgoing
+ * response as the head freezes — its `Set-Cookie` values (cookies appended
+ * during the call) append cookie-by-cookie alongside the result's own,
+ * other stub headers fill gaps (the call's response metadata wins; the
+ * protocol-owned family — the error/format/single-flight tags, `Location`,
+ * `X-Revalidate` — never fills, and neither does `Content-Type`/`Content-
+ * Length` onto a bodiless response) — and marks the stub `committed`, so
+ * later cookie/header writes report instead of silently missing the wire.
+ *
+ * ## Thrown-error sanitization (security default)
+ *
+ * A thrown `Response`/envelope (`redirect`/`reload`/`respond`) is intentional
+ * control flow and is forwarded untouched. A *plain* thrown value (a bare
+ * `Error`, string, or object) is different: serialized verbatim it would ship
+ * its `message` and every own-property to the client — a driver/ORM error's
+ * failing query, connection string, or bound parameters included. So outside
+ * the dev build a plain thrown value is replaced with a generic `Error`
+ * before serialization; the client still receives *an* `Error` (the shape
+ * `submission.error` etc. expect), just with no leaked content. The dev
+ * build keeps full fidelity (message, stack, own-props) for DX and the dev
+ * toolbar inspector. Dev/prod is the BUILD VARIANT, not `NODE_ENV`:
+ * `@solidjs/web` publishes a dev copy of this entry behind the
+ * `development` export condition (what Vite dev resolves) and the default
+ * resolution sanitizes — as does importing the runtime source directly with
+ * no bundler signal (fail-safe).
+ *
+ * Escape hatch: brand the value with `markSafeError` (`Symbol.for(
+ * "solid.SafeError")`) to send its content intact in every environment.
+ * A `wrapInvocation`/`transformResult` override that maps errors expresses
+ * intent the same way — throw a `Response`/envelope, or brand the mapped
+ * error safe; an unbranded plain error it lets propagate is sanitized like
+ * any other, so a framework onError policy must brand its result to keep a
+ * custom client-facing message in production.
+ *
  * @example
  * ```ts
  * import { handleServerFunctionRequest } from "@solidjs/web/server-functions";
@@ -488,3 +565,24 @@ export function handleServerFunctionRequest(
   request: Request,
   options?: HandleServerFunctionOptions
 ): Promise<Response>;
+
+/** Message a sanitized (production) server error carries on the wire. */
+export const GENERIC_SERVER_ERROR_MESSAGE: string;
+
+/**
+ * The production error-sanitization policy `handleServerFunctionRequest`
+ * applies to a plain thrown value before serialization. Returns `value`
+ * unchanged in the dev build or when it is branded safe (`markSafeError`);
+ * otherwise returns a generic `Error` carrying `GENERIC_SERVER_ERROR_MESSAGE`.
+ * Exposed for frameworks composing their own dispatch around the same policy.
+ */
+export function sanitizeServerError(value: unknown): unknown;
+
+/**
+ * Overrides the build-variant dev flag for this module instance — the seam
+ * for test harnesses and hand-rolled bundles whose packaging cannot replace
+ * `_DX_DEV_`. Applications never call this; select the dev build through
+ * the `development` export condition instead.
+ * @internal
+ */
+export function setServerFunctionsDev(dev: boolean): void;