@solidjs/web 2.0.0-rc.2 → 2.0.0-rc.4

package/server-functions/dist/server.dev.cjs

@@ -28,6 +28,32 @@ function withMeta(fn, meta) {
   Object.assign(metadata, meta);
   return fn;
 }
+const SERVER_FUNCTION_INVOKE = Symbol.for("solid.ServerFunctionInvoke");
+const INVOKE_OPTION_REDIRECTS = {
+  headers: "Session-dynamic headers belong to the prepareRequest hook, declaration metadata to " + "withMeta(fn, meta), and data belongs in the arguments, where it is serialized, typed, " + "and part of the cache key.",
+  method: "The method is declaration-scoped: declare the function with GET(fn).",
+  body: "The arguments are the body: pass them in the args array.",
+  timeout: "Compose timeouts through `signal` with AbortSignal.timeout(ms) (and AbortSignal.any to " + "combine it with a caller signal)."
+};
+function invoke(fn, options, ...args) {
+  const channel = typeof fn === "function" && fn[SERVER_FUNCTION_INVOKE];
+  if (!channel) {
+    throw new Error(isServerFunction(fn) ? "invoke: this wrapper does not forward the invocation channel " + "(SERVER_FUNCTION_INVOKE). Wrappers that share calls (caches, channels) opt in " + "deliberately — a caller's signal cannot own a wire other callers share. Invoke " + "the underlying reference directly, or use the wrapper's own per-call idioms." : "invoke expects a server function reference (or a wrapper that forwards its " + "invocation channel). Per-call options apply at the transport; for a data " + "layer's calls, use its per-call options instead.");
+  }
+  if (options === null || typeof options !== "object") {
+    throw new Error("invoke's second argument is the invocation options bag: invoke(fn, { signal }, ...args)");
+  }
+  const picked = {};
+  for (const key in options) {
+    if (key !== "signal" && key !== "keepalive" && key !== "priority") {
+      throw new Error(`\`${key}\` is not an invocation option. ` + (INVOKE_OPTION_REDIRECTS[key] || "Options here are strictly invocation-scoped (they vary between calls of the " + "same function): signal, keepalive, priority."));
+    }
+  }
+  if (options.signal !== undefined) picked.signal = options.signal;
+  if (options.keepalive !== undefined) picked.keepalive = options.keepalive;
+  if (options.priority !== undefined) picked.priority = options.priority;
+  return channel(args, picked);
+}
 const LIVE_SOURCE = Symbol.for("solid.LiveSource");
 const SERVER_FUNCTION_RPC = Symbol.for("solid.ServerFunctionRPC");
 function provideServerFunctionRPC(rpc) {
@@ -92,7 +118,23 @@ function subscribeFlightData(consumer) {
   return () => {
   };
 }
-const FUNCTION_HEADER = "X-Server-Function-Id";
+function serverFunctionAddress(endpoint, id) {
+  const mount = endpoint.endsWith("/") ? endpoint.slice(0, -1) : endpoint;
+  return `${mount}/${encodeURIComponent(id)}`;
+}
+function parseServerFunctionAddress(pathname, endpoint) {
+  const mount = endpoint.endsWith("/") ? endpoint.slice(0, -1) : endpoint;
+  if (!pathname.startsWith(mount)) return null;
+  const rest = pathname.slice(mount.length);
+  if (!rest.startsWith("/")) return null;
+  const segment = rest.slice(1);
+  if (!segment || segment.includes("/")) return null;
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return null;
+  }
+}
 const ERROR_HEADER = "X-Server-Function-Error";
 const ERROR_HEADER_MARKER = "=?1?";
 const NEEDS_ENCODING = /[^\x20-\x7e\xa0-\xff]/;
@@ -131,7 +173,8 @@ const BodyFormat = {
   File: "5",
   ArrayBuffer: "6",
   Uint8Array: "7",
-  Json: "8"
+  Json: "8",
+  Void: "9"
 };
 const JSON_SAFE_DEPTH_LIMIT = 4096;
 const EXIT = {};
@@ -551,6 +594,9 @@ function getServerFunction(id) {
   throw new Error("invalid server function: " + id);
 }
 function registerServerReference(id, fn, name) {
+  if (typeof fn !== "function") {
+    throw new Error(`Server function${name ? ` \`${name}\`` : ""} (${id}) is not a function: a module-level ` + `"use server" export must evaluate to a server function (got ${fn === null ? "null" : typeof fn}). Move non-function exports out of the directive module.`);
+  }
   registerServerFunction(id, fn);
   return {
     id,
@@ -558,6 +604,33 @@ function registerServerReference(id, fn, name) {
     name
   };
 }
+function inProcessInvoker(call) {
+  return (args, options) => {
+    const signal = options && options.signal;
+    if (!signal) return call(...args);
+    if (signal.aborted) return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+      const onAbort = () => reject(signal.reason);
+      signal.addEventListener("abort", onAbort, {
+        once: true
+      });
+      let result;
+      try {
+        result = call(...args);
+      } catch (error) {
+        signal.removeEventListener("abort", onAbort);
+        return reject(error);
+      }
+      Promise.resolve(result).then(value => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      }, error => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      });
+    });
+  };
+}
 function createServerReference({
   id,
   fn,
@@ -568,13 +641,15 @@ function createServerReference({
   const metadata = name === undefined ? {} : {
     name
   };
-  return new Proxy(fn, {
+  const invokeChannel = inProcessInvoker((...args) => proxy(...args));
+  const proxy = new Proxy(fn, {
     get(target, prop) {
       if (prop === "id") return id;
       if (prop === "url") {
-        return `${config.endpoint}?id=${encodeURIComponent(id)}`;
+        return serverFunctionAddress(config.endpoint, id);
       }
       if (prop === SERVER_FUNCTION_METADATA) return metadata;
+      if (prop === SERVER_FUNCTION_INVOKE) return invokeChannel;
       return target[prop];
     },
     apply(target, thisArg, args) {
@@ -611,6 +686,7 @@ function createServerReference({
       }) : result;
     }
   });
+  return proxy;
 }
 function GET(fn) {
   if (!isServerFunction(fn) || typeof fn.id !== "string") {
@@ -637,6 +713,7 @@ function live(fn) {
     return result;
   };
   wrapped[SERVER_FUNCTION_METADATA] = metadata;
+  wrapped[SERVER_FUNCTION_INVOKE] = inProcessInvoker(wrapped);
   wrapped.id = fn.id;
   Object.defineProperty(wrapped, "url", {
     get: () => fn.url,
@@ -650,24 +727,23 @@ function getServerFunctionInvocation() {
 function getEventServerFunctionInvocation(event) {
   return event && INVOCATIONS.get(event);
 }
-function resolveFunctionId(request, url) {
-  const reference = request.headers.get(FUNCTION_HEADER);
-  if (reference) {
-    return reference.split("#")[0];
-  }
-  return url.searchParams.get("id");
+function resolveFunctionId(url) {
+  return parseServerFunctionAddress(url.pathname, config.endpoint);
 }
 async function parseArguments(request, url, instance, codec) {
   const parsed = [];
   const bodyFormat = request.method === "POST" ? request.headers.get(BODY_FORMAT_HEADER) : null;
-  if (!instance || request.method === "GET" || bodyFormat !== BodyFormat.Serialized) {
-    const args = url.searchParams.get("args");
-    if (args) {
-      const result = args.startsWith(";0x") ? await deserializeString(args, codec) : JSON.parse(args);
-      for (const arg of result) {
-        parsed.push(arg);
-      }
+  const args = url.searchParams.get("args");
+  if (args && (!instance || request.method === "GET" || bodyFormat !== BodyFormat.Serialized)) {
+    const result = args.startsWith(";0x") ? await deserializeString(args, codec) : JSON.parse(args);
+    if (!Array.isArray(result)) {
+      throw new TypeError("Server function arguments must encode an array");
+    }
+    for (const arg of result) {
+      parsed.push(arg);
     }
+  } else if (!args && url.search && (request.method === "GET" || request.method === "HEAD")) {
+    parsed.push(url.searchParams);
   }
   if (request.method === "POST" && request.body !== null) {
     const decoded = await extractBody(request.clone(), codec);
@@ -922,6 +998,7 @@ function encodeResult(value, headers, status, codec, signal) {
     });
   }
   if (value === undefined) {
+    headers.set(BODY_FORMAT_HEADER, BodyFormat.Void);
     return new Response(null, {
       status,
       headers
@@ -957,6 +1034,17 @@ function sanitizeServerError(value) {
 function observeServerFunctionCalls() {
   return () => {};
 }
+function serverFunctionUrl(id, boundArgs) {
+  const address = serverFunctionAddress(config.endpoint, id);
+  if (!boundArgs || !boundArgs.length) return address;
+  if (!isJSONSafe(boundArgs)) {
+    throw new Error("Bound arguments in an action url must be JSON-safe: the server reads them the way it " + "reads a form post's, and that convention has no codec. Pass the value through the " + "function's body, or call the reference instead of rendering a url for it.");
+  }
+  return `${address}?args=${encodeURIComponent(JSON.stringify(boundArgs))}`;
+}
+function parseServerFunctionUrl(url) {
+  return parseServerFunctionAddress(new URL(url, "http://localhost").pathname, config.endpoint);
+}
 async function matchesOrigin(origin, request, matcher) {
   if (matcher === undefined) return origin === new URL(request.url).origin;
   if (typeof matcher === "function") return !!(await matcher(origin, request));
@@ -1014,18 +1102,20 @@ function forbiddenResponse() {
 async function handleServerFunctionRequest(request, options = {}) {
   const codec = options.codec !== undefined ? options.codec : getServerFunctionsCodec();
   const url = new URL(request.url);
+  const method = request.method;
+  const functionId = resolveFunctionId(url);
+  const declaredRead = (method === "GET" || method === "HEAD") && functionId !== null && METHODS.get(functionId) === "GET";
   const csrf = options.csrf !== undefined ? options.csrf : config.csrf;
-  const protectsRequest = csrf !== false;
+  const protectsRequest = csrf !== false && !declaredRead;
   if (protectsRequest && !(await allowsServerFunctionRequest(request, csrf === true ? {} : csrf))) {
-    return forbiddenResponse();
+    return finalizeTransportResponse(forbiddenResponse(), method);
   }
   const instance = request.headers.get(INSTANCE_HEADER);
-  const functionId = resolveFunctionId(request, url);
   if (!functionId) {
     const response = new Response(DEV ? "Server function not found" : null, {
       status: 404
     });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
   let serverFunction;
   try {
@@ -1034,16 +1124,16 @@ async function handleServerFunctionRequest(request, options = {}) {
     const response = new Response(DEV ? `Unknown server function: ${functionId}` : null, {
       status: 404
     });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
-  if (request.method === "GET" && METHODS.get(functionId) !== "GET") {
+  if (method !== "POST" && !declaredRead) {
     const response = new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
       status: 405,
       headers: {
-        Allow: "POST"
+        Allow: METHODS.get(functionId) === "GET" ? "POST, GET, HEAD" : "POST"
       }
     });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
   const event = options.createEvent ? options.createEvent(request) : {
     request,
@@ -1056,7 +1146,15 @@ async function handleServerFunctionRequest(request, options = {}) {
   const transformFlightResult = options.transformFlightResult !== undefined ? options.transformFlightResult : config.transformFlightResult;
   const handleNoJS = options.handleNoJS !== undefined ? options.handleNoJS : config.handleNoJS !== undefined ? config.handleNoJS : isFormPost(request) ? defaultNoJSHandler || (defaultNoJSHandler = createNoJSHandler()) : undefined;
   const collectsFlight = !!(flightHook && instance && request.headers.has(SINGLE_FLIGHT_HEADER));
-  const parsed = await parseArguments(request, url, instance, codec);
+  let parsed;
+  try {
+    parsed = await parseArguments(request, url, instance, codec);
+  } catch {
+    const response = new Response(DEV ? "Malformed server function arguments" : null, {
+      status: 400
+    });
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+  }
   const flightContext = {
     id: functionId,
     args: parsed,
@@ -1203,15 +1301,42 @@ async function handleServerFunctionRequest(request, options = {}) {
     }
   };
   const response = commitEventResponse(await dispatch(), event);
-  return protectsRequest ? withCSRFVary(response) : response;
+  return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+}
+function finalizeTransportResponse(response, method) {
+  const stripBody = method === "HEAD" && response.body !== null;
+  if (stripBody || !response.headers.has("Cache-Control")) {
+    try {
+      if (!response.headers.has("Cache-Control")) {
+        response.headers.set("Cache-Control", "no-store");
+      }
+      if (!stripBody) return response;
+      response.body.cancel().catch(() => {});
+      return new Response(null, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      });
+    } catch {
+      const headers = new Headers(response.headers);
+      if (!headers.has("Cache-Control")) headers.set("Cache-Control", "no-store");
+      if (stripBody) response.body.cancel().catch(() => {});
+      return new Response(stripBody ? null : response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
+    }
+  }
+  return response;
 }
 
 exports.ERROR_HEADER = ERROR_HEADER;
 exports.FLASH_COOKIE = FLASH_COOKIE;
-exports.FUNCTION_HEADER = FUNCTION_HEADER;
 exports.GENERIC_SERVER_ERROR_MESSAGE = GENERIC_SERVER_ERROR_MESSAGE;
 exports.GET = GET;
 exports.INSTANCE_HEADER = INSTANCE_HEADER;
+exports.SERVER_FUNCTION_INVOKE = SERVER_FUNCTION_INVOKE;
 exports.SINGLE_FLIGHT_HEADER = SINGLE_FLIGHT_HEADER;
 exports.clearFlashCookie = clearFlashCookie;
 exports.configureServerFunctionsServer = configureServerFunctionsServer;
@@ -1230,13 +1355,16 @@ exports.getServerFunctionInvocation = getServerFunctionInvocation;
 exports.getServerFunctionMetadata = getServerFunctionMetadata;
 exports.handleServerFunctionRequest = handleServerFunctionRequest;
 exports.hasFlashCookie = hasFlashCookie;
+exports.invoke = invoke;
 exports.isServerFunction = isServerFunction;
 exports.live = live;
 exports.observeServerFunctionCalls = observeServerFunctionCalls;
+exports.parseServerFunctionUrl = parseServerFunctionUrl;
 exports.registerServerFunction = registerServerFunction;
 exports.registerServerReference = registerServerReference;
 exports.sanitizeServerError = sanitizeServerError;
 exports.serializeResponseStream = serializeResponseStream;
+exports.serverFunctionUrl = serverFunctionUrl;
 exports.setServerFunctionsDev = setServerFunctionsDev;
 exports.subscribeFlightData = subscribeFlightData;
 exports.withMeta = withMeta;

package/server-functions/dist/server.dev.js

@@ -26,6 +26,32 @@ function withMeta(fn, meta) {
   Object.assign(metadata, meta);
   return fn;
 }
+const SERVER_FUNCTION_INVOKE = Symbol.for("solid.ServerFunctionInvoke");
+const INVOKE_OPTION_REDIRECTS = {
+  headers: "Session-dynamic headers belong to the prepareRequest hook, declaration metadata to " + "withMeta(fn, meta), and data belongs in the arguments, where it is serialized, typed, " + "and part of the cache key.",
+  method: "The method is declaration-scoped: declare the function with GET(fn).",
+  body: "The arguments are the body: pass them in the args array.",
+  timeout: "Compose timeouts through `signal` with AbortSignal.timeout(ms) (and AbortSignal.any to " + "combine it with a caller signal)."
+};
+function invoke(fn, options, ...args) {
+  const channel = typeof fn === "function" && fn[SERVER_FUNCTION_INVOKE];
+  if (!channel) {
+    throw new Error(isServerFunction(fn) ? "invoke: this wrapper does not forward the invocation channel " + "(SERVER_FUNCTION_INVOKE). Wrappers that share calls (caches, channels) opt in " + "deliberately — a caller's signal cannot own a wire other callers share. Invoke " + "the underlying reference directly, or use the wrapper's own per-call idioms." : "invoke expects a server function reference (or a wrapper that forwards its " + "invocation channel). Per-call options apply at the transport; for a data " + "layer's calls, use its per-call options instead.");
+  }
+  if (options === null || typeof options !== "object") {
+    throw new Error("invoke's second argument is the invocation options bag: invoke(fn, { signal }, ...args)");
+  }
+  const picked = {};
+  for (const key in options) {
+    if (key !== "signal" && key !== "keepalive" && key !== "priority") {
+      throw new Error(`\`${key}\` is not an invocation option. ` + (INVOKE_OPTION_REDIRECTS[key] || "Options here are strictly invocation-scoped (they vary between calls of the " + "same function): signal, keepalive, priority."));
+    }
+  }
+  if (options.signal !== undefined) picked.signal = options.signal;
+  if (options.keepalive !== undefined) picked.keepalive = options.keepalive;
+  if (options.priority !== undefined) picked.priority = options.priority;
+  return channel(args, picked);
+}
 const LIVE_SOURCE = Symbol.for("solid.LiveSource");
 const SERVER_FUNCTION_RPC = Symbol.for("solid.ServerFunctionRPC");
 function provideServerFunctionRPC(rpc) {
@@ -90,7 +116,23 @@ function subscribeFlightData(consumer) {
   return () => {
   };
 }
-const FUNCTION_HEADER = "X-Server-Function-Id";
+function serverFunctionAddress(endpoint, id) {
+  const mount = endpoint.endsWith("/") ? endpoint.slice(0, -1) : endpoint;
+  return `${mount}/${encodeURIComponent(id)}`;
+}
+function parseServerFunctionAddress(pathname, endpoint) {
+  const mount = endpoint.endsWith("/") ? endpoint.slice(0, -1) : endpoint;
+  if (!pathname.startsWith(mount)) return null;
+  const rest = pathname.slice(mount.length);
+  if (!rest.startsWith("/")) return null;
+  const segment = rest.slice(1);
+  if (!segment || segment.includes("/")) return null;
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return null;
+  }
+}
 const ERROR_HEADER = "X-Server-Function-Error";
 const ERROR_HEADER_MARKER = "=?1?";
 const NEEDS_ENCODING = /[^\x20-\x7e\xa0-\xff]/;
@@ -129,7 +171,8 @@ const BodyFormat = {
   File: "5",
   ArrayBuffer: "6",
   Uint8Array: "7",
-  Json: "8"
+  Json: "8",
+  Void: "9"
 };
 const JSON_SAFE_DEPTH_LIMIT = 4096;
 const EXIT = {};
@@ -549,6 +592,9 @@ function getServerFunction(id) {
   throw new Error("invalid server function: " + id);
 }
 function registerServerReference(id, fn, name) {
+  if (typeof fn !== "function") {
+    throw new Error(`Server function${name ? ` \`${name}\`` : ""} (${id}) is not a function: a module-level ` + `"use server" export must evaluate to a server function (got ${fn === null ? "null" : typeof fn}). Move non-function exports out of the directive module.`);
+  }
   registerServerFunction(id, fn);
   return {
     id,
@@ -556,6 +602,33 @@ function registerServerReference(id, fn, name) {
     name
   };
 }
+function inProcessInvoker(call) {
+  return (args, options) => {
+    const signal = options && options.signal;
+    if (!signal) return call(...args);
+    if (signal.aborted) return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+      const onAbort = () => reject(signal.reason);
+      signal.addEventListener("abort", onAbort, {
+        once: true
+      });
+      let result;
+      try {
+        result = call(...args);
+      } catch (error) {
+        signal.removeEventListener("abort", onAbort);
+        return reject(error);
+      }
+      Promise.resolve(result).then(value => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      }, error => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      });
+    });
+  };
+}
 function createServerReference({
   id,
   fn,
@@ -566,13 +639,15 @@ function createServerReference({
   const metadata = name === undefined ? {} : {
     name
   };
-  return new Proxy(fn, {
+  const invokeChannel = inProcessInvoker((...args) => proxy(...args));
+  const proxy = new Proxy(fn, {
     get(target, prop) {
       if (prop === "id") return id;
       if (prop === "url") {
-        return `${config.endpoint}?id=${encodeURIComponent(id)}`;
+        return serverFunctionAddress(config.endpoint, id);
       }
       if (prop === SERVER_FUNCTION_METADATA) return metadata;
+      if (prop === SERVER_FUNCTION_INVOKE) return invokeChannel;
       return target[prop];
     },
     apply(target, thisArg, args) {
@@ -609,6 +684,7 @@ function createServerReference({
       }) : result;
     }
   });
+  return proxy;
 }
 function GET(fn) {
   if (!isServerFunction(fn) || typeof fn.id !== "string") {
@@ -635,6 +711,7 @@ function live(fn) {
     return result;
   };
   wrapped[SERVER_FUNCTION_METADATA] = metadata;
+  wrapped[SERVER_FUNCTION_INVOKE] = inProcessInvoker(wrapped);
   wrapped.id = fn.id;
   Object.defineProperty(wrapped, "url", {
     get: () => fn.url,
@@ -648,24 +725,23 @@ function getServerFunctionInvocation() {
 function getEventServerFunctionInvocation(event) {
   return event && INVOCATIONS.get(event);
 }
-function resolveFunctionId(request, url) {
-  const reference = request.headers.get(FUNCTION_HEADER);
-  if (reference) {
-    return reference.split("#")[0];
-  }
-  return url.searchParams.get("id");
+function resolveFunctionId(url) {
+  return parseServerFunctionAddress(url.pathname, config.endpoint);
 }
 async function parseArguments(request, url, instance, codec) {
   const parsed = [];
   const bodyFormat = request.method === "POST" ? request.headers.get(BODY_FORMAT_HEADER) : null;
-  if (!instance || request.method === "GET" || bodyFormat !== BodyFormat.Serialized) {
-    const args = url.searchParams.get("args");
-    if (args) {
-      const result = args.startsWith(";0x") ? await deserializeString(args, codec) : JSON.parse(args);
-      for (const arg of result) {
-        parsed.push(arg);
-      }
+  const args = url.searchParams.get("args");
+  if (args && (!instance || request.method === "GET" || bodyFormat !== BodyFormat.Serialized)) {
+    const result = args.startsWith(";0x") ? await deserializeString(args, codec) : JSON.parse(args);
+    if (!Array.isArray(result)) {
+      throw new TypeError("Server function arguments must encode an array");
+    }
+    for (const arg of result) {
+      parsed.push(arg);
     }
+  } else if (!args && url.search && (request.method === "GET" || request.method === "HEAD")) {
+    parsed.push(url.searchParams);
   }
   if (request.method === "POST" && request.body !== null) {
     const decoded = await extractBody(request.clone(), codec);
@@ -920,6 +996,7 @@ function encodeResult(value, headers, status, codec, signal) {
     });
   }
   if (value === undefined) {
+    headers.set(BODY_FORMAT_HEADER, BodyFormat.Void);
     return new Response(null, {
       status,
       headers
@@ -955,6 +1032,17 @@ function sanitizeServerError(value) {
 function observeServerFunctionCalls() {
   return () => {};
 }
+function serverFunctionUrl(id, boundArgs) {
+  const address = serverFunctionAddress(config.endpoint, id);
+  if (!boundArgs || !boundArgs.length) return address;
+  if (!isJSONSafe(boundArgs)) {
+    throw new Error("Bound arguments in an action url must be JSON-safe: the server reads them the way it " + "reads a form post's, and that convention has no codec. Pass the value through the " + "function's body, or call the reference instead of rendering a url for it.");
+  }
+  return `${address}?args=${encodeURIComponent(JSON.stringify(boundArgs))}`;
+}
+function parseServerFunctionUrl(url) {
+  return parseServerFunctionAddress(new URL(url, "http://localhost").pathname, config.endpoint);
+}
 async function matchesOrigin(origin, request, matcher) {
   if (matcher === undefined) return origin === new URL(request.url).origin;
   if (typeof matcher === "function") return !!(await matcher(origin, request));
@@ -1012,18 +1100,20 @@ function forbiddenResponse() {
 async function handleServerFunctionRequest(request, options = {}) {
   const codec = options.codec !== undefined ? options.codec : getServerFunctionsCodec();
   const url = new URL(request.url);
+  const method = request.method;
+  const functionId = resolveFunctionId(url);
+  const declaredRead = (method === "GET" || method === "HEAD") && functionId !== null && METHODS.get(functionId) === "GET";
   const csrf = options.csrf !== undefined ? options.csrf : config.csrf;
-  const protectsRequest = csrf !== false;
+  const protectsRequest = csrf !== false && !declaredRead;
   if (protectsRequest && !(await allowsServerFunctionRequest(request, csrf === true ? {} : csrf))) {
-    return forbiddenResponse();
+    return finalizeTransportResponse(forbiddenResponse(), method);
   }
   const instance = request.headers.get(INSTANCE_HEADER);
-  const functionId = resolveFunctionId(request, url);
   if (!functionId) {
     const response = new Response(DEV ? "Server function not found" : null, {
       status: 404
     });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
   let serverFunction;
   try {
@@ -1032,16 +1122,16 @@ async function handleServerFunctionRequest(request, options = {}) {
     const response = new Response(DEV ? `Unknown server function: ${functionId}` : null, {
       status: 404
     });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
-  if (request.method === "GET" && METHODS.get(functionId) !== "GET") {
+  if (method !== "POST" && !declaredRead) {
     const response = new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
       status: 405,
       headers: {
-        Allow: "POST"
+        Allow: METHODS.get(functionId) === "GET" ? "POST, GET, HEAD" : "POST"
       }
     });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
   const event = options.createEvent ? options.createEvent(request) : {
     request,
@@ -1054,7 +1144,15 @@ async function handleServerFunctionRequest(request, options = {}) {
   const transformFlightResult = options.transformFlightResult !== undefined ? options.transformFlightResult : config.transformFlightResult;
   const handleNoJS = options.handleNoJS !== undefined ? options.handleNoJS : config.handleNoJS !== undefined ? config.handleNoJS : isFormPost(request) ? defaultNoJSHandler || (defaultNoJSHandler = createNoJSHandler()) : undefined;
   const collectsFlight = !!(flightHook && instance && request.headers.has(SINGLE_FLIGHT_HEADER));
-  const parsed = await parseArguments(request, url, instance, codec);
+  let parsed;
+  try {
+    parsed = await parseArguments(request, url, instance, codec);
+  } catch {
+    const response = new Response(DEV ? "Malformed server function arguments" : null, {
+      status: 400
+    });
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+  }
   const flightContext = {
     id: functionId,
     args: parsed,
@@ -1201,7 +1299,34 @@ async function handleServerFunctionRequest(request, options = {}) {
     }
   };
   const response = commitEventResponse(await dispatch(), event);
-  return protectsRequest ? withCSRFVary(response) : response;
+  return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+}
+function finalizeTransportResponse(response, method) {
+  const stripBody = method === "HEAD" && response.body !== null;
+  if (stripBody || !response.headers.has("Cache-Control")) {
+    try {
+      if (!response.headers.has("Cache-Control")) {
+        response.headers.set("Cache-Control", "no-store");
+      }
+      if (!stripBody) return response;
+      response.body.cancel().catch(() => {});
+      return new Response(null, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      });
+    } catch {
+      const headers = new Headers(response.headers);
+      if (!headers.has("Cache-Control")) headers.set("Cache-Control", "no-store");
+      if (stripBody) response.body.cancel().catch(() => {});
+      return new Response(stripBody ? null : response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
+    }
+  }
+  return response;
 }
 
-export { ERROR_HEADER, FLASH_COOKIE, FUNCTION_HEADER, GENERIC_SERVER_ERROR_MESSAGE, GET, INSTANCE_HEADER, SINGLE_FLIGHT_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getEventServerFunctionInvocation, getServerFunction, getServerFunctionInvocation, getServerFunctionMetadata, handleServerFunctionRequest, hasFlashCookie, isServerFunction, live, observeServerFunctionCalls, registerServerFunction, registerServerReference, sanitizeServerError, serializeResponseStream, setServerFunctionsDev, subscribeFlightData, withMeta };
+export { ERROR_HEADER, FLASH_COOKIE, GENERIC_SERVER_ERROR_MESSAGE, GET, INSTANCE_HEADER, SERVER_FUNCTION_INVOKE, SINGLE_FLIGHT_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getEventServerFunctionInvocation, getServerFunction, getServerFunctionInvocation, getServerFunctionMetadata, handleServerFunctionRequest, hasFlashCookie, invoke, isServerFunction, live, observeServerFunctionCalls, parseServerFunctionUrl, registerServerFunction, registerServerReference, sanitizeServerError, serializeResponseStream, serverFunctionUrl, setServerFunctionsDev, subscribeFlightData, withMeta };