@solidjs/web 2.0.0-rc.0 → 2.0.0-rc.2

package/types/server-functions/server.d.ts

@@ -28,7 +28,7 @@ export type {
 } from "./shared.js";
 export { decodeFlashCookie, encodeFlashCookie } from "./flash.js";
 export type { FlashSubmission } from "./flash.js";
-import { ServerFunction } from "./shared.js";
+import { ServerFunction, ServerFunctionMetadata } from "./shared.js";
 
 /**
  * The request event a server function call runs under: the base
@@ -197,6 +197,26 @@ export function createNoJSHandler(
   options?: NoJSHandlerOptions
 ): (result: unknown, request: Request, args: unknown[], thrown?: boolean) => Response;
 
+export type ServerFunctionOriginMatcher =
+  | string
+  | readonly string[]
+  | ((origin: string, request: Request) => boolean | Promise<boolean>);
+
+/** Same-origin validation options for server function requests. */
+export interface ServerFunctionCSRFOptions {
+  /**
+   * Expected public origin. Defaults to the incoming request URL's origin.
+   * A function can validate origins dynamically for multi-tenant hosts.
+   */
+  origin?: ServerFunctionOriginMatcher;
+  /**
+   * Allows requests without `Sec-Fetch-Site`, `Origin`, or `Referer`.
+   * Cross-origin metadata is still rejected.
+   * @default false
+   */
+  allowRequestsWithoutOriginCheck?: boolean;
+}
+
 /** Options for `configureServerFunctionsServer`. */
 export interface ServerFunctionsServerConfig {
   /**
@@ -287,6 +307,12 @@ export interface ServerFunctionsServerConfig {
    * @default "/_server"
    */
   endpoint?: string;
+  /**
+   * Same-origin protection for HTTP server function calls. Enabled by
+   * default. Set to `false` only when another trusted layer protects the
+   * endpoint.
+   */
+  csrf?: boolean | ServerFunctionCSRFOptions;
   /**
    * Codec options (extra plugins etc.) for decoding arguments and encoding
    * results — must match the client's. Stored in the shared layer, so
@@ -392,6 +418,36 @@ export function GET<A extends readonly any[], R>(
   fn: (...args: A) => R
 ): ServerFunction<A, Awaited<R>>;
 
+/** Wire-state transitions a live call's iterable can report (client side).
+ * `"closed"` carries the error when a definite rejection (4xx) ended the
+ * call instead of the retry loop. */
+export type LiveSourceStatus = "connected" | "reconnecting" | "closed";
+
+/**
+ * Type-level mirror of the client's live answer shape so isomorphic code
+ * assigning `onstatus` typechecks against either build's declarations. On
+ * the server the hook is inert: in-process calls hand back the source's
+ * own iterable — there is no connection to report on.
+ */
+export type LiveSource<R> = R & {
+  onstatus?: (state: LiveSourceStatus, error?: unknown) => void;
+};
+
+/**
+ * Declares a value-shaped live source: a server function returning an async
+ * iterable whose yields are successive VALUES of one logical query, with
+ * the contract that the source re-yields current state on every invocation.
+ * Writes `live: true` on the metadata channel and brands the resolved
+ * iterable (registered symbol `solid.LiveSource`) so SSR faces meeting the
+ * value in-process can apply live policy (document face: first value, then
+ * client takeover). Dispatch is untouched — over-the-wire calls stream the
+ * raw registered function's result. Declare live outermost:
+ * `live(GET(fn))`.
+ */
+export function live<A extends readonly any[], R>(
+  fn: (...args: A) => R
+): ServerFunction<A, LiveSource<Awaited<R>>>;
+
 /** Identity of the currently executing server function call. */
 export interface ServerFunctionInvocation {
   id: string;
@@ -501,6 +557,11 @@ export interface HandleServerFunctionOptions {
     args: unknown[],
     thrown?: boolean
   ): Response | Promise<Response>;
+  /**
+   * Overrides same-origin protection for this handler. Set to `false` only
+   * when another trusted layer protects the endpoint.
+   */
+  csrf?: boolean | ServerFunctionCSRFOptions;
   /** Overrides the configured codec options for this handler. */
   codec?: JSONCodecOptions;
 }
@@ -515,6 +576,10 @@ export interface HandleServerFunctionOptions {
  * (default `/_server`); platform adapters (h3, express, ...) convert their
  * request shape to a web `Request` around it.
  *
+ * Requests are same-origin by default. The handler accepts browser requests
+ * proven by `Sec-Fetch-Site`, `Origin`, or `Referer`, and rejects requests
+ * without usable metadata unless explicitly configured otherwise.
+ *
  * When the event carries a `response` head stub (`event.response`, see the
  * server entry's `ResponseStub`), the handler folds it onto every outgoing
  * response as the head freezes — its `Set-Cookie` values (cookies appended
@@ -578,6 +643,34 @@ export const GENERIC_SERVER_ERROR_MESSAGE: string;
  */
 export function sanitizeServerError(value: unknown): unknown;
 
+export interface ServerFunctionRequestCall {
+  type: "request";
+  id: string;
+  instance: string;
+  request: Request;
+  meta: ServerFunctionMetadata | undefined;
+  time: number;
+}
+
+export interface ServerFunctionResponseCall {
+  type: "response";
+  id: string;
+  instance: string;
+  response: Response;
+  meta: ServerFunctionMetadata | undefined;
+  time: number;
+}
+
+export type ServerFunctionCall = ServerFunctionRequestCall | ServerFunctionResponseCall;
+
+/**
+ * Client-only inspection seam. A no-op on this entry so isomorphic
+ * `@solidjs/web/server-functions` imports resolve.
+ */
+export function observeServerFunctionCalls(
+  observer: (call: ServerFunctionCall) => void
+): () => void;
+
 /**
  * Overrides the build-variant dev flag for this module instance — the seam
  * for test harnesses and hand-rolled bundles whose packaging cannot replace

package/types/server-mock.d.ts

@@ -39,6 +39,15 @@ export type AssetResolver = {
 };
 /** Bare-function shorthand for `AssetResolver` (no sync fast path). */
 export type AssetResolverFn = (key: string) => ResolvedAssets | null | undefined | Promise<ResolvedAssets | null | undefined>;
+/**
+ * CSP nonce for the tags a server render emits. A string applies to both
+ * nonce-aware destinations; a `{ script, style }` pair routes each tag to
+ * its destination's nonce, with `false` leaving that destination un-nonced.
+ */
+export type CSPNonce = string | {
+    script: string | false;
+    style: string | false;
+};
 /**
  * Renders a component tree synchronously to an HTML string. Async reads inside
  * `<Loading>` boundaries emit their `fallback` content; for full-graph
@@ -55,7 +64,7 @@ export type AssetResolverFn = (key: string) => ResolvedAssets | null | undefined
  * ```
  */
 export declare function renderToString<T>(fn: () => T, options?: {
-    nonce?: string;
+    nonce?: CSPNonce;
     renderId?: string;
     noScripts?: boolean;
     plugins?: any[];
@@ -100,7 +109,7 @@ export declare function renderToString<T>(fn: () => T, options?: {
  * ```
  */
 export declare function renderToStream<T>(fn: () => T, options?: {
-    nonce?: string;
+    nonce?: CSPNonce;
     renderId?: string;
     noScripts?: boolean;
     plugins?: any[];

package/types/server.d.ts

@@ -57,10 +57,31 @@ export type AssetResolverFn = (
   key: string
 ) => ResolvedAssets | null | undefined | Promise<ResolvedAssets | null | undefined>;
 
+/**
+ * CSP nonce for the tags a server render emits. A string applies to both
+ * nonce-aware destinations. A `{ script, style }` pair routes each tag to
+ * the directive governing its fetch (`script-src-elem` / `style-src-elem`,
+ * falling back to `script-src` / `style-src` then `default-src`). Both
+ * keys are required; `false` leaves that destination un-nonced. Worker
+ * destinations take the script nonce, which only applies when their own
+ * fallback reaches `script-src`. A nonce on a `useHead` tag's own props
+ * always wins.
+ *
+ * Only `renderToString` / `renderToStream` take this shape. Surfaces that
+ * emit one script (`HydrationScript`, `generateHydrationScript`,
+ * `createSSRResponse`) take a string — project with `scriptNonce`.
+ */
+export type CSPNonce = string | { script: string | false; style: string | false };
+
+/** The script-destination half of a render `nonce`. */
+export function scriptNonce(nonce?: CSPNonce): string | undefined;
+/** The style-destination half of a render `nonce`. */
+export function styleNonce(nonce?: CSPNonce): string | undefined;
+
 export function renderToString<T>(
   fn: () => T,
   options?: {
-    nonce?: string;
+    nonce?: CSPNonce;
     renderId?: string;
     noScripts?: boolean;
     plugins?: SerializerPlugin[];
@@ -82,7 +103,7 @@ export function renderToString<T>(
 export function renderToStream<T>(
   fn: () => T,
   options?: {
-    nonce?: string;
+    nonce?: CSPNonce;
     renderId?: string;
     noScripts?: boolean;
     plugins?: SerializerPlugin[];

package/types-cjs/core.d.cts

@@ -4,3 +4,6 @@ export declare const memo: (fn: any) => import("solid-js").SourceAccessor<any>;
 export declare const runWithHydrationScope: (id: any, fn: any) => unknown;
 export declare const ssrAsyncValue: (value: any) => import("solid-js").SourceAccessor<any>;
 export declare const waitAsset: (promise: any) => void;
+export declare const driveList: undefined;
+export declare const patchableRaw: undefined;
+export declare const registerPatch: undefined;

package/types-cjs/frames/frame-client.d.cts

@@ -245,6 +245,15 @@ export interface FrameHostOptions {
    * identity only.
    */
   isContainer?(value: unknown): boolean;
+  /**
+   * Arms event types for behavior claims: the `_bnd` sweep collects the
+   * event names it finds and hands them here so delegated dispatch can
+   * reach them. Platform glue passes its `delegateEvents` — the option
+   * exists (rather than client.js importing the event system) so
+   * tree-shaken subsets without events pay nothing. Frames registered
+   * with this host inherit it unless they pass their own `delegate`.
+   */
+  delegate?(eventNames: Iterable<string>): void;
 }
 
 /** @experimental */
@@ -260,6 +269,13 @@ export interface FrameOptions {
   id?: string;
   /** Client content keyed by prop name (occurrences resolve by prop). */
   slots?: Record<string, Slot>;
+  /**
+   * Raw client props for behavior-claim resolution: server elements carrying
+   * `_bnd="pos=prop"` markers (compiled under the `serverComponents` option)
+   * resolve ref/event positions by name through this object — read live at
+   * dispatch/materialize time, so compiled prop getters stay latest-value.
+   */
+  props?: Record<string, unknown>;
   /**
    * Adopt existing server-rendered DOM: the first apply morphs against it,
    * and slots sync immediately (hydration attach) — a document-SSR boot
@@ -277,6 +293,8 @@ export interface FrameOptions {
    * streamed chunks).
    */
   ownerScope?<T>(fn: () => T): T;
+  /** Per-frame override of the host's `delegate` (see FrameHostOptions). */
+  delegate?(eventNames: Iterable<string>): void;
   /**
    * Boundary-driven segment reveal. When present, `#revealSegment` hands the
    * placeholder seam to this hook instead of swapping imperatively: the binding

package/types-cjs/index.d.cts

@@ -102,6 +102,12 @@ export declare function render(code: () => JSX.Element, element: MountableElemen
  * Pass `options.renderId` to hydrate one of multiple roots emitted by a
  * server render that used the same id.
  *
+ * When the server renders a full document but the client hydrates only the
+ * app subtree, the server must give that subtree its own id namespace: wrap
+ * the document shell in `<NoHydration>` and re-enter with `<Hydration>`
+ * around the app. Otherwise the app's hydration ids are allocated under the
+ * document component's owner tree and this walk can never claim them.
+ *
  * @example
  * ```tsx
  * import { hydrate } from "@solidjs/web";
@@ -170,7 +176,8 @@ export declare function Dynamic<T extends ValidComponent>(props: DynamicProps<T>
  *
  * By default the import starts as soon as `clientOnly` is called (module
  * load); pass `{ lazy: true }` to defer the import to the component's first
- * render.
+ * render. Pass `{ export: "Name" }` to use a named export of the resolved
+ * module instead of its default (mirrors `lazy()`'s option).
  *
  * @example
  * ```tsx
@@ -178,11 +185,18 @@ export declare function Dynamic<T extends ValidComponent>(props: DynamicProps<T>
  * // <Chart fallback={<div>Loading chart…</div>} data={data()} />
  * ```
  */
+export declare function clientOnly<M extends Record<string, any>, K extends keyof M & string>(fn: () => Promise<M>, options: {
+    lazy?: boolean;
+    export: K;
+}, moduleUrl?: string): Component<ComponentProps<M[K]> & {
+    fallback?: JSX.Element;
+}>;
 export declare function clientOnly<T extends Component<any>>(fn: () => Promise<{
     default: T;
 }>, options?: {
     lazy?: boolean;
-}, _moduleUrl?: string): Component<ComponentProps<T> & {
+    export?: string;
+}, moduleUrl?: string): Component<ComponentProps<T> & {
     fallback?: JSX.Element;
 }>;
 /**

package/types-cjs/jsx.d.cts

@@ -249,6 +249,15 @@ export namespace JSX {
     ref?: Ref<T>;
     children?: Element | undefined;
     $ServerOnly?: boolean | undefined;
+    /**
+     * Entity identity for server markup (SSR-only): compiles to the `_key`
+     * attribute the frame morph matches keyed elements by, so live element
+     * state (form values, `open`, focus) follows the entity across
+     * reordering morphs. Sibling-scoped, like client keyed rendering.
+     * Stripped from DOM compiles; on components, `$key` is slot occurrence
+     * identity instead.
+     */
+    $key?: string | number | undefined;
   }
   interface ExplicitProperties {}
   type PropAttributes = {

package/types-cjs/server-functions/client.d.cts

@@ -127,6 +127,36 @@ export interface ServerFunctionsClientConfig {
  */
 export function configureServerFunctionsClient(config?: ServerFunctionsClientConfig): void;
 
+export interface ServerFunctionRequestCall {
+  type: "request";
+  id: string;
+  instance: string;
+  request: Request;
+  meta: ServerFunctionMetadata | undefined;
+  time: number;
+}
+
+export interface ServerFunctionResponseCall {
+  type: "response";
+  id: string;
+  instance: string;
+  response: Response;
+  meta: ServerFunctionMetadata | undefined;
+  time: number;
+}
+
+export type ServerFunctionCall = ServerFunctionRequestCall | ServerFunctionResponseCall;
+
+/**
+ * Observes cloned requests and responses without handling them. Subscribe
+ * from devtools; do not use this to replace `prepareRequest` /
+ * `responseHandler`. The server entry exports a no-op of the same name so
+ * isomorphic `@solidjs/web/server-functions` imports resolve.
+ */
+export function observeServerFunctionCalls(
+  observer: (call: ServerFunctionCall) => void
+): () => void;
+
 /**
  * Declares a server function callable over HTTP GET: calls to the returned
  * reference go out as GET requests with the arguments codec-encoded in the
@@ -156,6 +186,37 @@ export function GET<A extends readonly any[], R>(
   fn: (...args: A) => R
 ): ServerFunction<A, Awaited<R>>;
 
+/** Wire-state transitions a live call's iterable can report. */
+export type LiveSourceStatus = "connected" | "reconnecting" | "closed";
+
+/**
+ * A live call's answer: the source's iterable, plus an optional `onstatus`
+ * side channel for the wire facts the reconnect loop erases from the value
+ * stream — `"connected"` on each successful (re)connect, `"reconnecting"`
+ * (with the error) on each transient post-connect death, `"closed"` when
+ * the source completes or the consumer ends it — with the error when the
+ * end was a definite rejection (4xx) failing fast instead of retrying.
+ */
+export type LiveSource<R> = R & {
+  onstatus?: (state: LiveSourceStatus, error?: unknown) => void;
+};
+
+/**
+ * Declares a value-shaped live source: a server function returning an async
+ * iterable whose yields are successive VALUES of one logical query, with the
+ * contract that the source re-yields current state on every invocation.
+ * Calls to the returned reference produce an iterable that survives the
+ * connection — post-connect deaths re-invoke with exponential backoff
+ * (reset per healthy value, woken early by connectivity returning),
+ * first-connect failures reject like a normal call, and `break` aborts the
+ * in-flight request. Live calls are reads and never opt into single-flight
+ * enveloping. Wire state, if wanted, rides the returned iterable's
+ * `onstatus` hook. Compose with `GET` inside-out: `live(GET(fn))`.
+ */
+export function live<A extends readonly any[], R>(
+  fn: (...args: A) => R
+): ServerFunction<A, LiveSource<Awaited<R>>>;
+
 /**
  * Compiler ABI — emitted by compiled `"use server"` client output where a
  * server function was referenced; produces the fetch-backed callable for

package/types-cjs/server-functions/server.d.cts

@@ -28,7 +28,7 @@ export type {
 } from "./shared.cjs";
 export { decodeFlashCookie, encodeFlashCookie } from "./flash.cjs";
 export type { FlashSubmission } from "./flash.cjs";
-import { ServerFunction } from "./shared.cjs";
+import { ServerFunction, ServerFunctionMetadata } from "./shared.cjs";
 
 /**
  * The request event a server function call runs under: the base
@@ -197,6 +197,26 @@ export function createNoJSHandler(
   options?: NoJSHandlerOptions
 ): (result: unknown, request: Request, args: unknown[], thrown?: boolean) => Response;
 
+export type ServerFunctionOriginMatcher =
+  | string
+  | readonly string[]
+  | ((origin: string, request: Request) => boolean | Promise<boolean>);
+
+/** Same-origin validation options for server function requests. */
+export interface ServerFunctionCSRFOptions {
+  /**
+   * Expected public origin. Defaults to the incoming request URL's origin.
+   * A function can validate origins dynamically for multi-tenant hosts.
+   */
+  origin?: ServerFunctionOriginMatcher;
+  /**
+   * Allows requests without `Sec-Fetch-Site`, `Origin`, or `Referer`.
+   * Cross-origin metadata is still rejected.
+   * @default false
+   */
+  allowRequestsWithoutOriginCheck?: boolean;
+}
+
 /** Options for `configureServerFunctionsServer`. */
 export interface ServerFunctionsServerConfig {
   /**
@@ -287,6 +307,12 @@ export interface ServerFunctionsServerConfig {
    * @default "/_server"
    */
   endpoint?: string;
+  /**
+   * Same-origin protection for HTTP server function calls. Enabled by
+   * default. Set to `false` only when another trusted layer protects the
+   * endpoint.
+   */
+  csrf?: boolean | ServerFunctionCSRFOptions;
   /**
    * Codec options (extra plugins etc.) for decoding arguments and encoding
    * results — must match the client's. Stored in the shared layer, so
@@ -392,6 +418,36 @@ export function GET<A extends readonly any[], R>(
   fn: (...args: A) => R
 ): ServerFunction<A, Awaited<R>>;
 
+/** Wire-state transitions a live call's iterable can report (client side).
+ * `"closed"` carries the error when a definite rejection (4xx) ended the
+ * call instead of the retry loop. */
+export type LiveSourceStatus = "connected" | "reconnecting" | "closed";
+
+/**
+ * Type-level mirror of the client's live answer shape so isomorphic code
+ * assigning `onstatus` typechecks against either build's declarations. On
+ * the server the hook is inert: in-process calls hand back the source's
+ * own iterable — there is no connection to report on.
+ */
+export type LiveSource<R> = R & {
+  onstatus?: (state: LiveSourceStatus, error?: unknown) => void;
+};
+
+/**
+ * Declares a value-shaped live source: a server function returning an async
+ * iterable whose yields are successive VALUES of one logical query, with
+ * the contract that the source re-yields current state on every invocation.
+ * Writes `live: true` on the metadata channel and brands the resolved
+ * iterable (registered symbol `solid.LiveSource`) so SSR faces meeting the
+ * value in-process can apply live policy (document face: first value, then
+ * client takeover). Dispatch is untouched — over-the-wire calls stream the
+ * raw registered function's result. Declare live outermost:
+ * `live(GET(fn))`.
+ */
+export function live<A extends readonly any[], R>(
+  fn: (...args: A) => R
+): ServerFunction<A, LiveSource<Awaited<R>>>;
+
 /** Identity of the currently executing server function call. */
 export interface ServerFunctionInvocation {
   id: string;
@@ -501,6 +557,11 @@ export interface HandleServerFunctionOptions {
     args: unknown[],
     thrown?: boolean
   ): Response | Promise<Response>;
+  /**
+   * Overrides same-origin protection for this handler. Set to `false` only
+   * when another trusted layer protects the endpoint.
+   */
+  csrf?: boolean | ServerFunctionCSRFOptions;
   /** Overrides the configured codec options for this handler. */
   codec?: JSONCodecOptions;
 }
@@ -515,6 +576,10 @@ export interface HandleServerFunctionOptions {
  * (default `/_server`); platform adapters (h3, express, ...) convert their
  * request shape to a web `Request` around it.
  *
+ * Requests are same-origin by default. The handler accepts browser requests
+ * proven by `Sec-Fetch-Site`, `Origin`, or `Referer`, and rejects requests
+ * without usable metadata unless explicitly configured otherwise.
+ *
  * When the event carries a `response` head stub (`event.response`, see the
  * server entry's `ResponseStub`), the handler folds it onto every outgoing
  * response as the head freezes — its `Set-Cookie` values (cookies appended
@@ -578,6 +643,34 @@ export const GENERIC_SERVER_ERROR_MESSAGE: string;
  */
 export function sanitizeServerError(value: unknown): unknown;
 
+export interface ServerFunctionRequestCall {
+  type: "request";
+  id: string;
+  instance: string;
+  request: Request;
+  meta: ServerFunctionMetadata | undefined;
+  time: number;
+}
+
+export interface ServerFunctionResponseCall {
+  type: "response";
+  id: string;
+  instance: string;
+  response: Response;
+  meta: ServerFunctionMetadata | undefined;
+  time: number;
+}
+
+export type ServerFunctionCall = ServerFunctionRequestCall | ServerFunctionResponseCall;
+
+/**
+ * Client-only inspection seam. A no-op on this entry so isomorphic
+ * `@solidjs/web/server-functions` imports resolve.
+ */
+export function observeServerFunctionCalls(
+  observer: (call: ServerFunctionCall) => void
+): () => void;
+
 /**
  * Overrides the build-variant dev flag for this module instance — the seam
  * for test harnesses and hand-rolled bundles whose packaging cannot replace

package/types-cjs/server-mock.d.cts

@@ -39,6 +39,15 @@ export type AssetResolver = {
 };
 /** Bare-function shorthand for `AssetResolver` (no sync fast path). */
 export type AssetResolverFn = (key: string) => ResolvedAssets | null | undefined | Promise<ResolvedAssets | null | undefined>;
+/**
+ * CSP nonce for the tags a server render emits. A string applies to both
+ * nonce-aware destinations; a `{ script, style }` pair routes each tag to
+ * its destination's nonce, with `false` leaving that destination un-nonced.
+ */
+export type CSPNonce = string | {
+    script: string | false;
+    style: string | false;
+};
 /**
  * Renders a component tree synchronously to an HTML string. Async reads inside
  * `<Loading>` boundaries emit their `fallback` content; for full-graph
@@ -55,7 +64,7 @@ export type AssetResolverFn = (key: string) => ResolvedAssets | null | undefined
  * ```
  */
 export declare function renderToString<T>(fn: () => T, options?: {
-    nonce?: string;
+    nonce?: CSPNonce;
     renderId?: string;
     noScripts?: boolean;
     plugins?: any[];
@@ -100,7 +109,7 @@ export declare function renderToString<T>(fn: () => T, options?: {
  * ```
  */
 export declare function renderToStream<T>(fn: () => T, options?: {
-    nonce?: string;
+    nonce?: CSPNonce;
     renderId?: string;
     noScripts?: boolean;
     plugins?: any[];

package/types-cjs/server.d.cts

@@ -57,10 +57,31 @@ export type AssetResolverFn = (
   key: string
 ) => ResolvedAssets | null | undefined | Promise<ResolvedAssets | null | undefined>;
 
+/**
+ * CSP nonce for the tags a server render emits. A string applies to both
+ * nonce-aware destinations. A `{ script, style }` pair routes each tag to
+ * the directive governing its fetch (`script-src-elem` / `style-src-elem`,
+ * falling back to `script-src` / `style-src` then `default-src`). Both
+ * keys are required; `false` leaves that destination un-nonced. Worker
+ * destinations take the script nonce, which only applies when their own
+ * fallback reaches `script-src`. A nonce on a `useHead` tag's own props
+ * always wins.
+ *
+ * Only `renderToString` / `renderToStream` take this shape. Surfaces that
+ * emit one script (`HydrationScript`, `generateHydrationScript`,
+ * `createSSRResponse`) take a string — project with `scriptNonce`.
+ */
+export type CSPNonce = string | { script: string | false; style: string | false };
+
+/** The script-destination half of a render `nonce`. */
+export function scriptNonce(nonce?: CSPNonce): string | undefined;
+/** The style-destination half of a render `nonce`. */
+export function styleNonce(nonce?: CSPNonce): string | undefined;
+
 export function renderToString<T>(
   fn: () => T,
   options?: {
-    nonce?: string;
+    nonce?: CSPNonce;
     renderId?: string;
     noScripts?: boolean;
     plugins?: SerializerPlugin[];
@@ -82,7 +103,7 @@ export function renderToString<T>(
 export function renderToStream<T>(
   fn: () => T,
   options?: {
-    nonce?: string;
+    nonce?: CSPNonce;
     renderId?: string;
     noScripts?: boolean;
     plugins?: SerializerPlugin[];