@solidjs/web 2.0.0-beta.32 → 2.0.0-beta.33

package/server-functions/dist/server.js

@@ -1,5 +1,3 @@
-import { fromCrossJSON, Feature, toCrossJSONStream } from 'seroval';
-import { AbortSignalPlugin, CustomEventPlugin, DOMExceptionPlugin, EventPlugin, FormDataPlugin, HeadersPlugin, ReadableStreamPlugin, RequestPlugin, ResponsePlugin, URLSearchParamsPlugin, URLPlugin } from 'seroval-plugins/web';
 import { sharedConfig } from 'solid-js';
 
 const ENVELOPE = Symbol.for("solid.ResponseEnvelope");
@@ -12,51 +10,70 @@ function isSafeError(value) {
 }
 const REVALIDATE_HEADER = "X-Revalidate";
 
-Feature.AggregateError | Feature.BigIntTypedArray;
-const serializeOnlyDisabledFeatures = () => process.env.NODE_ENV === "development" ? 0 : Feature.ErrorPrototypeStack;
-const DEFAULT_WEB_PLUGINS = Object.freeze([AbortSignalPlugin,
-CustomEventPlugin, DOMExceptionPlugin, EventPlugin,
-FormDataPlugin, HeadersPlugin, ReadableStreamPlugin, RequestPlugin, ResponsePlugin, URLSearchParamsPlugin, URLPlugin]);
-function resolveSerializerPlugins(customPlugins) {
-  return customPlugins ? [...customPlugins, ...DEFAULT_WEB_PLUGINS] : [...DEFAULT_WEB_PLUGINS];
-}
-const JSON_CODEC_DISABLED_FEATURES = Feature.RegExp;
-const JSON_CODEC_DEPTH_LIMIT = 64;
-function resolveCodecOptions({
-  plugins,
-  disabledFeatures,
-  depthLimit
-} = {}) {
-  return {
-    plugins: resolveSerializerPlugins(plugins),
-    disabledFeatures: disabledFeatures === undefined ? JSON_CODEC_DISABLED_FEATURES : disabledFeatures,
-    depthLimit: depthLimit === undefined ? JSON_CODEC_DEPTH_LIMIT : depthLimit
-  };
+const SERVER_FUNCTION_METADATA = Symbol.for("solid.ServerFunctionMetadata");
+function getServerFunctionMetadata(fn) {
+  if (typeof fn !== "function") return undefined;
+  return fn[SERVER_FUNCTION_METADATA] || undefined;
 }
-function serializeJSON(value, {
-  onParse,
-  onDone,
-  onError,
-  ...codecOptions
-}) {
-  const resolved = resolveCodecOptions(codecOptions);
-  return toCrossJSONStream(value, {
-    onParse,
-    onDone,
-    onError,
-    ...resolved,
-    disabledFeatures: resolved.disabledFeatures | serializeOnlyDisabledFeatures()
-  });
+function isServerFunction(fn) {
+  return typeof fn === "function" && !!fn[SERVER_FUNCTION_METADATA];
 }
-function createJSONDeserializer(options) {
-  const refs = new Map();
-  const resolved = resolveCodecOptions(options);
-  return function deserializeJSONChunk(node) {
-    return fromCrossJSON(node, {
-      refs,
-      ...resolved
-    });
-  };
+function withMeta(fn, meta) {
+  const metadata = getServerFunctionMetadata(fn);
+  if (!metadata) {
+    throw new Error("withMeta expects a server function reference");
+  }
+  Object.assign(metadata, meta);
+  return fn;
+}
+const SERVER_FUNCTION_RPC = Symbol.for("solid.ServerFunctionRPC");
+function provideServerFunctionRPC(rpc) {
+  globalThis[SERVER_FUNCTION_RPC] || (globalThis[SERVER_FUNCTION_RPC] = rpc);
+}
+
+function parseCookieHeader(header) {
+  const cookies = {};
+  if (!header) return cookies;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    const name = decodeSafe(part.slice(0, eq).trim());
+    let value = part.slice(eq + 1).trim();
+    if (value.length > 1 && value[0] === '"' && value[value.length - 1] === '"') {
+      value = value.slice(1, -1);
+    }
+    cookies[name] = decodeSafe(value);
+  }
+  return cookies;
+}
+function decodeSafe(text) {
+  try {
+    return decodeURIComponent(text);
+  } catch {
+    return text;
+  }
+}
+function serializeCookie(name, value, options = {}) {
+  let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
+  cookie += `; Path=${options.path === undefined ? "/" : options.path}`;
+  if (options.domain) cookie += `; Domain=${options.domain}`;
+  if (options.maxAge !== undefined) cookie += `; Max-Age=${Math.trunc(options.maxAge)}`;
+  if (options.expires) cookie += `; Expires=${options.expires.toUTCString()}`;
+  if (options.httpOnly) cookie += "; HttpOnly";
+  if (options.secure) cookie += "; Secure";
+  if (options.sameSite) {
+    const sameSite = options.sameSite.toLowerCase();
+    cookie += `; SameSite=${sameSite === "none" ? "None" : sameSite === "strict" ? "Strict" : "Lax"}`;
+  }
+  return cookie;
+}
+const FLASH_COOKIE = "flash";
+const FLASH_MATCHER = new RegExp(`(?:^|;\\s*)${FLASH_COOKIE}=([^;]+)`);
+function hasFlashCookie(cookieHeader) {
+  return !!cookieHeader && FLASH_MATCHER.test(cookieHeader);
+}
+function clearFlashCookie() {
+  return `${FLASH_COOKIE}=; Max-Age=0; Path=/`;
 }
 
 const codecConfig = {
@@ -72,22 +89,6 @@ function subscribeFlightData(consumer) {
   return () => {
   };
 }
-const SERVER_FUNCTION_METADATA = Symbol.for("solid.ServerFunctionMetadata");
-function getServerFunctionMetadata(fn) {
-  if (typeof fn !== "function") return undefined;
-  return fn[SERVER_FUNCTION_METADATA] || undefined;
-}
-function isServerFunction(fn) {
-  return typeof fn === "function" && !!fn[SERVER_FUNCTION_METADATA];
-}
-function withMeta(fn, meta) {
-  const metadata = getServerFunctionMetadata(fn);
-  if (!metadata) {
-    throw new Error("withMeta expects a server function reference");
-  }
-  Object.assign(metadata, meta);
-  return fn;
-}
 const FUNCTION_HEADER = "X-Server-Function-Id";
 const ERROR_HEADER = "X-Server-Function-Error";
 const ERROR_HEADER_MARKER = "=?1?";
@@ -118,14 +119,6 @@ const INSTANCE_HEADER = "X-Server-Function-Instance";
 const BODY_FORMAT_HEADER = "X-Server-Function-Format";
 const SINGLE_FLIGHT_HEADER = "X-Single-Flight";
 const FILE_FORM_KEY = "__server_function_file__";
-const FLASH_COOKIE = "flash";
-const FLASH_MATCHER = new RegExp(`(?:^|;\\s*)${FLASH_COOKIE}=([^;]+)`);
-function hasFlashCookie(cookieHeader) {
-  return !!cookieHeader && FLASH_MATCHER.test(cookieHeader);
-}
-function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Max-Age=0; Path=/`;
-}
 const BodyFormat = {
   Serialized: "0",
   String: "1",
@@ -137,6 +130,38 @@ const BodyFormat = {
   Uint8Array: "7",
   Json: "8"
 };
+const JSON_SAFE_DEPTH_LIMIT = 10000;
+const EXIT = {};
+function isJSONSafe(value) {
+  const stack = [value];
+  const ancestors = new Set();
+  while (stack.length) {
+    const v = stack.pop();
+    if (v === EXIT) {
+      ancestors.delete(stack.pop());
+      continue;
+    }
+    if (v === null) continue;
+    const t = typeof v;
+    if (t === "string" || t === "boolean") continue;
+    if (t === "number") {
+      if (!Number.isFinite(v)) return false;
+      continue;
+    }
+    if (t !== "object") return false;
+    if (ancestors.has(v) || ancestors.size >= JSON_SAFE_DEPTH_LIMIT) return false;
+    ancestors.add(v);
+    stack.push(v, EXIT);
+    if (Array.isArray(v)) {
+      for (let i = 0; i < v.length; i++) stack.push(v[i]);
+    } else {
+      const proto = Object.getPrototypeOf(v);
+      if (proto !== Object.prototype && proto !== null) return false;
+      for (const k in v) stack.push(v[k]);
+    }
+  }
+  return true;
+}
 function getHeadersAndBody(body) {
   switch (true) {
     case typeof body === "string":
@@ -296,7 +321,10 @@ class ChunkReader {
 }
 function serializeStream(value, codecOptions) {
   return new ReadableStream({
-    start(controller) {
+    async start(controller) {
+      const {
+        serializeJSON
+      } = await import('@solidjs/web/serialization');
       serializeJSON(value, {
         ...codecOptions,
         onParse(node) {
@@ -319,6 +347,9 @@ async function deserializeStream(source, codecOptions) {
   const reader = new ChunkReader(source.body);
   const result = await reader.next();
   if (!result.done) {
+    const {
+      createJSONDeserializer
+    } = await import('@solidjs/web/serialization/decode');
     const deserializeChunk = createJSONDeserializer(codecOptions);
     function interpretChunk(chunk) {
       return deserializeChunk(JSON.parse(chunk));
@@ -348,43 +379,6 @@ async function decodeResponsePayload(response, codecOptions) {
   };
 }
 
-function parseCookieHeader(header) {
-  const cookies = {};
-  if (!header) return cookies;
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq < 0) continue;
-    const name = decodeSafe(part.slice(0, eq).trim());
-    let value = part.slice(eq + 1).trim();
-    if (value.length > 1 && value[0] === '"' && value[value.length - 1] === '"') {
-      value = value.slice(1, -1);
-    }
-    cookies[name] = decodeSafe(value);
-  }
-  return cookies;
-}
-function decodeSafe(text) {
-  try {
-    return decodeURIComponent(text);
-  } catch {
-    return text;
-  }
-}
-function serializeCookie(name, value, options = {}) {
-  let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
-  cookie += `; Path=${options.path === undefined ? "/" : options.path}`;
-  if (options.domain) cookie += `; Domain=${options.domain}`;
-  if (options.maxAge !== undefined) cookie += `; Max-Age=${Math.trunc(options.maxAge)}`;
-  if (options.expires) cookie += `; Expires=${options.expires.toUTCString()}`;
-  if (options.httpOnly) cookie += "; HttpOnly";
-  if (options.secure) cookie += "; Secure";
-  if (options.sameSite) {
-    const sameSite = options.sameSite.toLowerCase();
-    cookie += `; SameSite=${sameSite === "none" ? "None" : sameSite === "strict" ? "Strict" : "Lax"}`;
-  }
-  return cookie;
-}
-
 const RequestContext = Symbol.for("solid.RequestContext");
 function getRequestEvent() {
   return globalThis[RequestContext] ? globalThis[RequestContext].getStore() || sharedConfig.context && sharedConfig.context.event || console.warn("RequestEvent is missing. This is most likely due to accessing `getRequestEvent` non-managed async scope in a partially polyfilled environment. Try moving it above all `await` calls.") : undefined;
@@ -548,7 +542,17 @@ function provideEvent(event, fn) {
 const REGISTRATIONS = new Map();
 const METHODS = new Map();
 const INVOCATIONS = new WeakMap();
+let rpcProvided = false;
+function provideRPC() {
+  if (rpcProvided) return;
+  rpcProvided = true;
+  provideServerFunctionRPC({
+    GET,
+    decodeResponse
+  });
+}
 function registerServerFunction(id, callback) {
+  provideRPC();
   REGISTRATIONS.set(id, callback);
   return callback;
 }
@@ -573,6 +577,7 @@ function createServerReference({
   name
 }) {
   if (typeof fn !== "function") throw new Error("Export from a 'use server' module must be a function");
+  provideRPC();
   const metadata = name === undefined ? {} : {
     name
   };
@@ -684,7 +689,9 @@ async function foldFlightData(hook, event, headers, outcome, context = {}) {
       return transformed;
     }
   }
-  return {
+  return outcome.value === undefined ? {
+    data
+  } : {
     value: outcome.value,
     data
   };
@@ -816,6 +823,23 @@ function encodeResult(value, headers, status, codec) {
       headers
     });
   }
+  if (value === undefined) {
+    return new Response(null, {
+      status,
+      headers
+    });
+  }
+  try {
+    if (isJSONSafe(value)) {
+      headers.set(BODY_FORMAT_HEADER, BodyFormat.Json);
+      headers.set("Content-Type", "application/json");
+      return new Response(JSON.stringify(value), {
+        status,
+        headers
+      });
+    }
+  } catch {
+  }
   const response = serializedResponse(value, headers, codec);
   return status === 200 ? response : new Response(response.body, {
     status,

package/types/client.d.ts

@@ -289,7 +289,7 @@ export interface ResponseStub {
  * share ONE interface identity and a single augmentation reaches every
  * `locals`, whichever entry typed the event.
  */
-export type { RequestEventLocals } from "./server.js";
+export { RequestEventLocals } from "./server.js";
 export interface RequestEvent {
   request: Request;
   locals: RequestEventLocals;
@@ -311,5 +311,27 @@ export function getRequestEvent(): RequestEvent | undefined;
  */
 export { parseCookieHeader, serializeCookie } from "./cookies.js";
 export type { CookieOptions } from "./cookies.js";
+/**
+ * The flash cookie's isomorphic half (name/detection/clearing — cookie
+ * utilities living beside the cookie codec) and the codec-free
+ * server-function layer (reference detection + the late-bound RPC seam).
+ * On the core entries so integrations consuming them eagerly (routers)
+ * never import the server-functions entry — whose client half is the
+ * transport + codec — from their eager graph. Declared through
+ * server-functions/shared.d.ts, the declaration home published-types
+ * layouts ship.
+ */
+export {
+  clearFlashCookie,
+  getServerFunctionMetadata,
+  getServerFunctionRPC,
+  hasFlashCookie,
+  isServerFunction
+} from "./server-functions/shared.js";
+export type {
+  ServerFunction,
+  ServerFunctionMetadata,
+  ServerFunctionRPC
+} from "./server-functions/shared.js";
 /** Hydration-walk primitive; not for hand-written code. @internal */
 export function runHydrationEvents(): void;

package/types/cookies.d.ts

@@ -0,0 +1,93 @@
+// Cookie wire format: the platform-gap primitives, and ALL of core's
+// cookie surface — core owns the exchange (the request's headers in, the
+// response stub's headers out) and the codec, nothing ambient. Blessed
+// patterns:
+//
+//   parseCookieHeader(event.request.headers.get("cookie"))
+//   event.response.headers.append("set-cookie", serializeCookie(name, value, options))
+//
+// Dependency-free and isomorphic (exported from both entries — real
+// implementation, never a stub); integrity/confidentiality layers
+// (sessions) belong to the caller, on top of these primitives.
+
+/**
+ * Attributes for a `Set-Cookie` header, mirroring RFC 6265. `path`
+ * defaults to `/`; nothing else is defaulted.
+ */
+export interface CookieOptions {
+  /** Cookie `Path` attribute. Defaults to `/`. */
+  path?: string;
+  /** Cookie `Domain` attribute. Emitted only when provided. */
+  domain?: string;
+  /** Cookie `Max-Age` attribute, in seconds (truncated to an integer). */
+  maxAge?: number;
+  /** Cookie `Expires` attribute. */
+  expires?: Date;
+  /** Emit the `HttpOnly` attribute. */
+  httpOnly?: boolean;
+  /** Emit the `Secure` attribute. */
+  secure?: boolean;
+  /** Cookie `SameSite` attribute, any case. */
+  sameSite?: "lax" | "strict" | "none" | "Lax" | "Strict" | "None";
+}
+
+/**
+ * Parses a `Cookie` request header into a name → value map. Names and
+ * values are `decodeURIComponent`-decoded (falling back to the raw text
+ * when decoding throws); a quoted value keeps its content. `null`/empty
+ * input parses to an empty map.
+ *
+ * The read half of the platform gap — the blessed request-cookie read is
+ * `parseCookieHeader(event.request.headers.get("cookie"))`.
+ */
+export function parseCookieHeader(header: string | null | undefined): Record<string, string>;
+
+/**
+ * Serializes a cookie to a `Set-Cookie` header value. The name and value
+ * are `encodeURIComponent`-encoded (the parser decodes symmetrically);
+ * `path` defaults to `/` and every other attribute is emitted exactly
+ * when the caller asked for it.
+ *
+ * The write half of the platform gap — the blessed response-cookie write
+ * is `event.response.headers.append("set-cookie", serializeCookie(name,
+ * value, options))`, which every head materialization path carries to the
+ * wire entry-by-entry.
+ */
+export function serializeCookie(name: string, value: string, options?: CookieOptions): string;
+
+/**
+ * Name of the cookie carrying the outcome of a server function call made
+ * without the client runtime (`"flash"`). A no-JS form post has no way to
+ * receive a value — the browser follows the redirect and renders the next
+ * page — so the handler stashes the outcome here for the render after it
+ * to pick up, which is how a form submitted without JavaScript still shows
+ * its result.
+ *
+ * The name, detection and clearing are cookie utilities and isomorphic
+ * (integrations read the cookie from code that also ships to the browser);
+ * the codec that fills and decodes it is server-only and lives behind the
+ * server-functions server entry.
+ */
+export const FLASH_COOKIE: string;
+
+/**
+ * Whether a Cookie header carries a flash cookie, readable or not. Cheap
+ * enough to call on every render so the clear can be queued before the
+ * response headers flush.
+ */
+export function hasFlashCookie(cookieHeader: string | null): boolean;
+
+/**
+ * The `Set-Cookie` value clearing the flash cookie. The outcome is
+ * one-shot: append this as soon as the cookie is detected, whether or not
+ * it decodes, so a stale outcome cannot resurface on a later request.
+ */
+export function clearFlashCookie(): string;
+
+/**
+ * The raw encoded flash payload out of a Cookie header, if present — the
+ * codec's own accessor.
+ *
+ * @internal
+ */
+export function matchFlashCookie(cookieHeader: string | null): string | undefined;

package/types/core.d.ts

@@ -1,4 +1,4 @@
-export { getOwner, runWithOwner, createComponent, createRoot as root, sharedConfig, untrack, merge as mergeProps, flatten, ssrHandleError, ssrScope, NoHydration, Hydration, runInServerComponentScope } from "solid-js";
+export { getOwner, runWithOwner, createComponent, createRoot as root, sharedConfig, untrack, merge as mergeProps, flatten, ssrHandleError, ssrScope, NoHydration, Hydration, runInServerComponentScope, creationStamp, inServerComponentScope } from "solid-js";
 export declare const effect: (fn: any, effectFn: any, options?: any) => void;
 export declare const memo: (fn: any) => import("solid-js").SourceAccessor<any>;
 export declare const runWithHydrationScope: (id: any, fn: any) => unknown;

package/types/frames/frame-client.d.ts

@@ -186,6 +186,10 @@ export interface FrameHost {
   serialize(value: unknown): { $ref: string };
   /** `frameId` is the resolving frame's id — route to its stream's table. */
   resolve(ref: { $ref: string }, frameId?: string): unknown;
+  /** See FrameHostOptions.revive. */
+  revive?(value: unknown): unknown;
+  /** See FrameHostOptions.isContainer. */
+  isContainer?(value: unknown): boolean;
 }
 
 /**
@@ -219,6 +223,28 @@ export interface FrameHostOptions {
    * `applyData: c => table.apply(c)` (see `createJSONDataTable`).
    */
   applyData?(chunk: Extract<FrameChunk, { type: "data" }>): void;
+  /**
+   * A lazily-loaded deserializer's load, awaited by the transport before it
+   * delivers a `data` chunk — `applyData`/`resolve` can assume the codec is
+   * resident once data has arrived. Keeps codec weight out of the eager
+   * client graph for responses that never carry serialized data.
+   */
+  prepareData?(): Promise<unknown>;
+  /**
+   * Revive protocol markers inside LITERAL slot args (values that are
+   * neither `{$ref}` nor `{$frame}`) at arg-resolution time. Document-face
+   * container traces ride this way — inline in the record, revived by the
+   * integration (`reviveContainerTraces`) into live local containers.
+   */
+  revive?(value: unknown): unknown;
+  /**
+   * Whether a resolved arg value is a LIVE CONTAINER (a materialized trace —
+   * see `isMaterializedContainer`). The record-dedupe compare must know: a
+   * pending container's property reads throw not-ready, so async probes and
+   * serialization compares would detonate it. Containers compare by
+   * identity only.
+   */
+  isContainer?(value: unknown): boolean;
 }
 
 /** @experimental */

package/types/frames/frame-transport.d.ts

@@ -3,7 +3,7 @@
 // shapes and the wire format may change between prereleases (RFC 11).
 // Every export in this module is @experimental.
 import { FrameChunk, FrameHost } from "./frame-client.js";
-import { JSONCodecOptions } from "./serializer.js";
+import { JSONCodecOptions } from "./serializer-decode.js";
 
 // Structural mirror of server-functions/shared.js's FlightDataConsumer:
 // this file may only reference siblings that ship with it when integrations