@solidjs/web 2.0.0-rc.3 → 2.0.0-rc.4

package/server-functions/dist/server.dev.js

@@ -26,6 +26,32 @@ function withMeta(fn, meta) {
   Object.assign(metadata, meta);
   return fn;
 }
+const SERVER_FUNCTION_INVOKE = Symbol.for("solid.ServerFunctionInvoke");
+const INVOKE_OPTION_REDIRECTS = {
+  headers: "Session-dynamic headers belong to the prepareRequest hook, declaration metadata to " + "withMeta(fn, meta), and data belongs in the arguments, where it is serialized, typed, " + "and part of the cache key.",
+  method: "The method is declaration-scoped: declare the function with GET(fn).",
+  body: "The arguments are the body: pass them in the args array.",
+  timeout: "Compose timeouts through `signal` with AbortSignal.timeout(ms) (and AbortSignal.any to " + "combine it with a caller signal)."
+};
+function invoke(fn, options, ...args) {
+  const channel = typeof fn === "function" && fn[SERVER_FUNCTION_INVOKE];
+  if (!channel) {
+    throw new Error(isServerFunction(fn) ? "invoke: this wrapper does not forward the invocation channel " + "(SERVER_FUNCTION_INVOKE). Wrappers that share calls (caches, channels) opt in " + "deliberately — a caller's signal cannot own a wire other callers share. Invoke " + "the underlying reference directly, or use the wrapper's own per-call idioms." : "invoke expects a server function reference (or a wrapper that forwards its " + "invocation channel). Per-call options apply at the transport; for a data " + "layer's calls, use its per-call options instead.");
+  }
+  if (options === null || typeof options !== "object") {
+    throw new Error("invoke's second argument is the invocation options bag: invoke(fn, { signal }, ...args)");
+  }
+  const picked = {};
+  for (const key in options) {
+    if (key !== "signal" && key !== "keepalive" && key !== "priority") {
+      throw new Error(`\`${key}\` is not an invocation option. ` + (INVOKE_OPTION_REDIRECTS[key] || "Options here are strictly invocation-scoped (they vary between calls of the " + "same function): signal, keepalive, priority."));
+    }
+  }
+  if (options.signal !== undefined) picked.signal = options.signal;
+  if (options.keepalive !== undefined) picked.keepalive = options.keepalive;
+  if (options.priority !== undefined) picked.priority = options.priority;
+  return channel(args, picked);
+}
 const LIVE_SOURCE = Symbol.for("solid.LiveSource");
 const SERVER_FUNCTION_RPC = Symbol.for("solid.ServerFunctionRPC");
 function provideServerFunctionRPC(rpc) {
@@ -90,7 +116,23 @@ function subscribeFlightData(consumer) {
   return () => {
   };
 }
-const FUNCTION_HEADER = "X-Server-Function-Id";
+function serverFunctionAddress(endpoint, id) {
+  const mount = endpoint.endsWith("/") ? endpoint.slice(0, -1) : endpoint;
+  return `${mount}/${encodeURIComponent(id)}`;
+}
+function parseServerFunctionAddress(pathname, endpoint) {
+  const mount = endpoint.endsWith("/") ? endpoint.slice(0, -1) : endpoint;
+  if (!pathname.startsWith(mount)) return null;
+  const rest = pathname.slice(mount.length);
+  if (!rest.startsWith("/")) return null;
+  const segment = rest.slice(1);
+  if (!segment || segment.includes("/")) return null;
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return null;
+  }
+}
 const ERROR_HEADER = "X-Server-Function-Error";
 const ERROR_HEADER_MARKER = "=?1?";
 const NEEDS_ENCODING = /[^\x20-\x7e\xa0-\xff]/;
@@ -129,7 +171,8 @@ const BodyFormat = {
   File: "5",
   ArrayBuffer: "6",
   Uint8Array: "7",
-  Json: "8"
+  Json: "8",
+  Void: "9"
 };
 const JSON_SAFE_DEPTH_LIMIT = 4096;
 const EXIT = {};
@@ -549,6 +592,9 @@ function getServerFunction(id) {
   throw new Error("invalid server function: " + id);
 }
 function registerServerReference(id, fn, name) {
+  if (typeof fn !== "function") {
+    throw new Error(`Server function${name ? ` \`${name}\`` : ""} (${id}) is not a function: a module-level ` + `"use server" export must evaluate to a server function (got ${fn === null ? "null" : typeof fn}). Move non-function exports out of the directive module.`);
+  }
   registerServerFunction(id, fn);
   return {
     id,
@@ -556,6 +602,33 @@ function registerServerReference(id, fn, name) {
     name
   };
 }
+function inProcessInvoker(call) {
+  return (args, options) => {
+    const signal = options && options.signal;
+    if (!signal) return call(...args);
+    if (signal.aborted) return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+      const onAbort = () => reject(signal.reason);
+      signal.addEventListener("abort", onAbort, {
+        once: true
+      });
+      let result;
+      try {
+        result = call(...args);
+      } catch (error) {
+        signal.removeEventListener("abort", onAbort);
+        return reject(error);
+      }
+      Promise.resolve(result).then(value => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      }, error => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      });
+    });
+  };
+}
 function createServerReference({
   id,
   fn,
@@ -566,13 +639,15 @@ function createServerReference({
   const metadata = name === undefined ? {} : {
     name
   };
-  return new Proxy(fn, {
+  const invokeChannel = inProcessInvoker((...args) => proxy(...args));
+  const proxy = new Proxy(fn, {
     get(target, prop) {
       if (prop === "id") return id;
       if (prop === "url") {
-        return `${config.endpoint}?id=${encodeURIComponent(id)}`;
+        return serverFunctionAddress(config.endpoint, id);
       }
       if (prop === SERVER_FUNCTION_METADATA) return metadata;
+      if (prop === SERVER_FUNCTION_INVOKE) return invokeChannel;
       return target[prop];
     },
     apply(target, thisArg, args) {
@@ -609,6 +684,7 @@ function createServerReference({
       }) : result;
     }
   });
+  return proxy;
 }
 function GET(fn) {
   if (!isServerFunction(fn) || typeof fn.id !== "string") {
@@ -635,6 +711,7 @@ function live(fn) {
     return result;
   };
   wrapped[SERVER_FUNCTION_METADATA] = metadata;
+  wrapped[SERVER_FUNCTION_INVOKE] = inProcessInvoker(wrapped);
   wrapped.id = fn.id;
   Object.defineProperty(wrapped, "url", {
     get: () => fn.url,
@@ -648,24 +725,23 @@ function getServerFunctionInvocation() {
 function getEventServerFunctionInvocation(event) {
   return event && INVOCATIONS.get(event);
 }
-function resolveFunctionId(request, url) {
-  const reference = request.headers.get(FUNCTION_HEADER);
-  if (reference) {
-    return reference.split("#")[0];
-  }
-  return url.searchParams.get("id");
+function resolveFunctionId(url) {
+  return parseServerFunctionAddress(url.pathname, config.endpoint);
 }
 async function parseArguments(request, url, instance, codec) {
   const parsed = [];
   const bodyFormat = request.method === "POST" ? request.headers.get(BODY_FORMAT_HEADER) : null;
-  if (!instance || request.method === "GET" || bodyFormat !== BodyFormat.Serialized) {
-    const args = url.searchParams.get("args");
-    if (args) {
-      const result = args.startsWith(";0x") ? await deserializeString(args, codec) : JSON.parse(args);
-      for (const arg of result) {
-        parsed.push(arg);
-      }
+  const args = url.searchParams.get("args");
+  if (args && (!instance || request.method === "GET" || bodyFormat !== BodyFormat.Serialized)) {
+    const result = args.startsWith(";0x") ? await deserializeString(args, codec) : JSON.parse(args);
+    if (!Array.isArray(result)) {
+      throw new TypeError("Server function arguments must encode an array");
+    }
+    for (const arg of result) {
+      parsed.push(arg);
     }
+  } else if (!args && url.search && (request.method === "GET" || request.method === "HEAD")) {
+    parsed.push(url.searchParams);
   }
   if (request.method === "POST" && request.body !== null) {
     const decoded = await extractBody(request.clone(), codec);
@@ -920,6 +996,7 @@ function encodeResult(value, headers, status, codec, signal) {
     });
   }
   if (value === undefined) {
+    headers.set(BODY_FORMAT_HEADER, BodyFormat.Void);
     return new Response(null, {
       status,
       headers
@@ -955,6 +1032,17 @@ function sanitizeServerError(value) {
 function observeServerFunctionCalls() {
   return () => {};
 }
+function serverFunctionUrl(id, boundArgs) {
+  const address = serverFunctionAddress(config.endpoint, id);
+  if (!boundArgs || !boundArgs.length) return address;
+  if (!isJSONSafe(boundArgs)) {
+    throw new Error("Bound arguments in an action url must be JSON-safe: the server reads them the way it " + "reads a form post's, and that convention has no codec. Pass the value through the " + "function's body, or call the reference instead of rendering a url for it.");
+  }
+  return `${address}?args=${encodeURIComponent(JSON.stringify(boundArgs))}`;
+}
+function parseServerFunctionUrl(url) {
+  return parseServerFunctionAddress(new URL(url, "http://localhost").pathname, config.endpoint);
+}
 async function matchesOrigin(origin, request, matcher) {
   if (matcher === undefined) return origin === new URL(request.url).origin;
   if (typeof matcher === "function") return !!(await matcher(origin, request));
@@ -1012,18 +1100,20 @@ function forbiddenResponse() {
 async function handleServerFunctionRequest(request, options = {}) {
   const codec = options.codec !== undefined ? options.codec : getServerFunctionsCodec();
   const url = new URL(request.url);
+  const method = request.method;
+  const functionId = resolveFunctionId(url);
+  const declaredRead = (method === "GET" || method === "HEAD") && functionId !== null && METHODS.get(functionId) === "GET";
   const csrf = options.csrf !== undefined ? options.csrf : config.csrf;
-  const protectsRequest = csrf !== false;
+  const protectsRequest = csrf !== false && !declaredRead;
   if (protectsRequest && !(await allowsServerFunctionRequest(request, csrf === true ? {} : csrf))) {
-    return forbiddenResponse();
+    return finalizeTransportResponse(forbiddenResponse(), method);
   }
   const instance = request.headers.get(INSTANCE_HEADER);
-  const functionId = resolveFunctionId(request, url);
   if (!functionId) {
     const response = new Response(DEV ? "Server function not found" : null, {
       status: 404
     });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
   let serverFunction;
   try {
@@ -1032,16 +1122,16 @@ async function handleServerFunctionRequest(request, options = {}) {
     const response = new Response(DEV ? `Unknown server function: ${functionId}` : null, {
       status: 404
     });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
-  if (request.method === "GET" && METHODS.get(functionId) !== "GET") {
+  if (method !== "POST" && !declaredRead) {
     const response = new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
       status: 405,
       headers: {
-        Allow: "POST"
+        Allow: METHODS.get(functionId) === "GET" ? "POST, GET, HEAD" : "POST"
       }
     });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
   const event = options.createEvent ? options.createEvent(request) : {
     request,
@@ -1054,7 +1144,15 @@ async function handleServerFunctionRequest(request, options = {}) {
   const transformFlightResult = options.transformFlightResult !== undefined ? options.transformFlightResult : config.transformFlightResult;
   const handleNoJS = options.handleNoJS !== undefined ? options.handleNoJS : config.handleNoJS !== undefined ? config.handleNoJS : isFormPost(request) ? defaultNoJSHandler || (defaultNoJSHandler = createNoJSHandler()) : undefined;
   const collectsFlight = !!(flightHook && instance && request.headers.has(SINGLE_FLIGHT_HEADER));
-  const parsed = await parseArguments(request, url, instance, codec);
+  let parsed;
+  try {
+    parsed = await parseArguments(request, url, instance, codec);
+  } catch {
+    const response = new Response(DEV ? "Malformed server function arguments" : null, {
+      status: 400
+    });
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+  }
   const flightContext = {
     id: functionId,
     args: parsed,
@@ -1201,7 +1299,34 @@ async function handleServerFunctionRequest(request, options = {}) {
     }
   };
   const response = commitEventResponse(await dispatch(), event);
-  return protectsRequest ? withCSRFVary(response) : response;
+  return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+}
+function finalizeTransportResponse(response, method) {
+  const stripBody = method === "HEAD" && response.body !== null;
+  if (stripBody || !response.headers.has("Cache-Control")) {
+    try {
+      if (!response.headers.has("Cache-Control")) {
+        response.headers.set("Cache-Control", "no-store");
+      }
+      if (!stripBody) return response;
+      response.body.cancel().catch(() => {});
+      return new Response(null, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      });
+    } catch {
+      const headers = new Headers(response.headers);
+      if (!headers.has("Cache-Control")) headers.set("Cache-Control", "no-store");
+      if (stripBody) response.body.cancel().catch(() => {});
+      return new Response(stripBody ? null : response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
+    }
+  }
+  return response;
 }
 
-export { ERROR_HEADER, FLASH_COOKIE, FUNCTION_HEADER, GENERIC_SERVER_ERROR_MESSAGE, GET, INSTANCE_HEADER, SINGLE_FLIGHT_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getEventServerFunctionInvocation, getServerFunction, getServerFunctionInvocation, getServerFunctionMetadata, handleServerFunctionRequest, hasFlashCookie, isServerFunction, live, observeServerFunctionCalls, registerServerFunction, registerServerReference, sanitizeServerError, serializeResponseStream, setServerFunctionsDev, subscribeFlightData, withMeta };
+export { ERROR_HEADER, FLASH_COOKIE, GENERIC_SERVER_ERROR_MESSAGE, GET, INSTANCE_HEADER, SERVER_FUNCTION_INVOKE, SINGLE_FLIGHT_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getEventServerFunctionInvocation, getServerFunction, getServerFunctionInvocation, getServerFunctionMetadata, handleServerFunctionRequest, hasFlashCookie, invoke, isServerFunction, live, observeServerFunctionCalls, parseServerFunctionUrl, registerServerFunction, registerServerReference, sanitizeServerError, serializeResponseStream, serverFunctionUrl, setServerFunctionsDev, subscribeFlightData, withMeta };

package/server-functions/dist/server.js

@@ -26,6 +26,32 @@ function withMeta(fn, meta) {
   Object.assign(metadata, meta);
   return fn;
 }
+const SERVER_FUNCTION_INVOKE = Symbol.for("solid.ServerFunctionInvoke");
+const INVOKE_OPTION_REDIRECTS = {
+  headers: "Session-dynamic headers belong to the prepareRequest hook, declaration metadata to " + "withMeta(fn, meta), and data belongs in the arguments, where it is serialized, typed, " + "and part of the cache key.",
+  method: "The method is declaration-scoped: declare the function with GET(fn).",
+  body: "The arguments are the body: pass them in the args array.",
+  timeout: "Compose timeouts through `signal` with AbortSignal.timeout(ms) (and AbortSignal.any to " + "combine it with a caller signal)."
+};
+function invoke(fn, options, ...args) {
+  const channel = typeof fn === "function" && fn[SERVER_FUNCTION_INVOKE];
+  if (!channel) {
+    throw new Error(isServerFunction(fn) ? "invoke: this wrapper does not forward the invocation channel " + "(SERVER_FUNCTION_INVOKE). Wrappers that share calls (caches, channels) opt in " + "deliberately — a caller's signal cannot own a wire other callers share. Invoke " + "the underlying reference directly, or use the wrapper's own per-call idioms." : "invoke expects a server function reference (or a wrapper that forwards its " + "invocation channel). Per-call options apply at the transport; for a data " + "layer's calls, use its per-call options instead.");
+  }
+  if (options === null || typeof options !== "object") {
+    throw new Error("invoke's second argument is the invocation options bag: invoke(fn, { signal }, ...args)");
+  }
+  const picked = {};
+  for (const key in options) {
+    if (key !== "signal" && key !== "keepalive" && key !== "priority") {
+      throw new Error(`\`${key}\` is not an invocation option. ` + (INVOKE_OPTION_REDIRECTS[key] || "Options here are strictly invocation-scoped (they vary between calls of the " + "same function): signal, keepalive, priority."));
+    }
+  }
+  if (options.signal !== undefined) picked.signal = options.signal;
+  if (options.keepalive !== undefined) picked.keepalive = options.keepalive;
+  if (options.priority !== undefined) picked.priority = options.priority;
+  return channel(args, picked);
+}
 const LIVE_SOURCE = Symbol.for("solid.LiveSource");
 const SERVER_FUNCTION_RPC = Symbol.for("solid.ServerFunctionRPC");
 function provideServerFunctionRPC(rpc) {
@@ -90,7 +116,23 @@ function subscribeFlightData(consumer) {
   return () => {
   };
 }
-const FUNCTION_HEADER = "X-Server-Function-Id";
+function serverFunctionAddress(endpoint, id) {
+  const mount = endpoint.endsWith("/") ? endpoint.slice(0, -1) : endpoint;
+  return `${mount}/${encodeURIComponent(id)}`;
+}
+function parseServerFunctionAddress(pathname, endpoint) {
+  const mount = endpoint.endsWith("/") ? endpoint.slice(0, -1) : endpoint;
+  if (!pathname.startsWith(mount)) return null;
+  const rest = pathname.slice(mount.length);
+  if (!rest.startsWith("/")) return null;
+  const segment = rest.slice(1);
+  if (!segment || segment.includes("/")) return null;
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return null;
+  }
+}
 const ERROR_HEADER = "X-Server-Function-Error";
 const ERROR_HEADER_MARKER = "=?1?";
 const NEEDS_ENCODING = /[^\x20-\x7e\xa0-\xff]/;
@@ -129,7 +171,8 @@ const BodyFormat = {
   File: "5",
   ArrayBuffer: "6",
   Uint8Array: "7",
-  Json: "8"
+  Json: "8",
+  Void: "9"
 };
 const JSON_SAFE_DEPTH_LIMIT = 4096;
 const EXIT = {};
@@ -549,6 +592,9 @@ function getServerFunction(id) {
   throw new Error("invalid server function: " + id);
 }
 function registerServerReference(id, fn, name) {
+  if (typeof fn !== "function") {
+    throw new Error(`Server function${name ? ` \`${name}\`` : ""} (${id}) is not a function: a module-level ` + `"use server" export must evaluate to a server function (got ${fn === null ? "null" : typeof fn}). Move non-function exports out of the directive module.`);
+  }
   registerServerFunction(id, fn);
   return {
     id,
@@ -556,6 +602,33 @@ function registerServerReference(id, fn, name) {
     name
   };
 }
+function inProcessInvoker(call) {
+  return (args, options) => {
+    const signal = options && options.signal;
+    if (!signal) return call(...args);
+    if (signal.aborted) return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+      const onAbort = () => reject(signal.reason);
+      signal.addEventListener("abort", onAbort, {
+        once: true
+      });
+      let result;
+      try {
+        result = call(...args);
+      } catch (error) {
+        signal.removeEventListener("abort", onAbort);
+        return reject(error);
+      }
+      Promise.resolve(result).then(value => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      }, error => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      });
+    });
+  };
+}
 function createServerReference({
   id,
   fn,
@@ -566,13 +639,15 @@ function createServerReference({
   const metadata = name === undefined ? {} : {
     name
   };
-  return new Proxy(fn, {
+  const invokeChannel = inProcessInvoker((...args) => proxy(...args));
+  const proxy = new Proxy(fn, {
     get(target, prop) {
       if (prop === "id") return id;
       if (prop === "url") {
-        return `${config.endpoint}?id=${encodeURIComponent(id)}`;
+        return serverFunctionAddress(config.endpoint, id);
       }
       if (prop === SERVER_FUNCTION_METADATA) return metadata;
+      if (prop === SERVER_FUNCTION_INVOKE) return invokeChannel;
       return target[prop];
     },
     apply(target, thisArg, args) {
@@ -609,6 +684,7 @@ function createServerReference({
       }) : result;
     }
   });
+  return proxy;
 }
 function GET(fn) {
   if (!isServerFunction(fn) || typeof fn.id !== "string") {
@@ -635,6 +711,7 @@ function live(fn) {
     return result;
   };
   wrapped[SERVER_FUNCTION_METADATA] = metadata;
+  wrapped[SERVER_FUNCTION_INVOKE] = inProcessInvoker(wrapped);
   wrapped.id = fn.id;
   Object.defineProperty(wrapped, "url", {
     get: () => fn.url,
@@ -648,24 +725,23 @@ function getServerFunctionInvocation() {
 function getEventServerFunctionInvocation(event) {
   return event && INVOCATIONS.get(event);
 }
-function resolveFunctionId(request, url) {
-  const reference = request.headers.get(FUNCTION_HEADER);
-  if (reference) {
-    return reference.split("#")[0];
-  }
-  return url.searchParams.get("id");
+function resolveFunctionId(url) {
+  return parseServerFunctionAddress(url.pathname, config.endpoint);
 }
 async function parseArguments(request, url, instance, codec) {
   const parsed = [];
   const bodyFormat = request.method === "POST" ? request.headers.get(BODY_FORMAT_HEADER) : null;
-  if (!instance || request.method === "GET" || bodyFormat !== BodyFormat.Serialized) {
-    const args = url.searchParams.get("args");
-    if (args) {
-      const result = args.startsWith(";0x") ? await deserializeString(args, codec) : JSON.parse(args);
-      for (const arg of result) {
-        parsed.push(arg);
-      }
+  const args = url.searchParams.get("args");
+  if (args && (!instance || request.method === "GET" || bodyFormat !== BodyFormat.Serialized)) {
+    const result = args.startsWith(";0x") ? await deserializeString(args, codec) : JSON.parse(args);
+    if (!Array.isArray(result)) {
+      throw new TypeError("Server function arguments must encode an array");
+    }
+    for (const arg of result) {
+      parsed.push(arg);
     }
+  } else if (!args && url.search && (request.method === "GET" || request.method === "HEAD")) {
+    parsed.push(url.searchParams);
   }
   if (request.method === "POST" && request.body !== null) {
     const decoded = await extractBody(request.clone(), codec);
@@ -920,6 +996,7 @@ function encodeResult(value, headers, status, codec, signal) {
     });
   }
   if (value === undefined) {
+    headers.set(BODY_FORMAT_HEADER, BodyFormat.Void);
     return new Response(null, {
       status,
       headers
@@ -955,6 +1032,17 @@ function sanitizeServerError(value) {
 function observeServerFunctionCalls() {
   return () => {};
 }
+function serverFunctionUrl(id, boundArgs) {
+  const address = serverFunctionAddress(config.endpoint, id);
+  if (!boundArgs || !boundArgs.length) return address;
+  if (!isJSONSafe(boundArgs)) {
+    throw new Error("Bound arguments in an action url must be JSON-safe: the server reads them the way it " + "reads a form post's, and that convention has no codec. Pass the value through the " + "function's body, or call the reference instead of rendering a url for it.");
+  }
+  return `${address}?args=${encodeURIComponent(JSON.stringify(boundArgs))}`;
+}
+function parseServerFunctionUrl(url) {
+  return parseServerFunctionAddress(new URL(url, "http://localhost").pathname, config.endpoint);
+}
 async function matchesOrigin(origin, request, matcher) {
   if (matcher === undefined) return origin === new URL(request.url).origin;
   if (typeof matcher === "function") return !!(await matcher(origin, request));
@@ -1012,18 +1100,20 @@ function forbiddenResponse() {
 async function handleServerFunctionRequest(request, options = {}) {
   const codec = options.codec !== undefined ? options.codec : getServerFunctionsCodec();
   const url = new URL(request.url);
+  const method = request.method;
+  const functionId = resolveFunctionId(url);
+  const declaredRead = (method === "GET" || method === "HEAD") && functionId !== null && METHODS.get(functionId) === "GET";
   const csrf = options.csrf !== undefined ? options.csrf : config.csrf;
-  const protectsRequest = csrf !== false;
+  const protectsRequest = csrf !== false && !declaredRead;
   if (protectsRequest && !(await allowsServerFunctionRequest(request, csrf === true ? {} : csrf))) {
-    return forbiddenResponse();
+    return finalizeTransportResponse(forbiddenResponse(), method);
   }
   const instance = request.headers.get(INSTANCE_HEADER);
-  const functionId = resolveFunctionId(request, url);
   if (!functionId) {
     const response = new Response(DEV ? "Server function not found" : null, {
       status: 404
     });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
   let serverFunction;
   try {
@@ -1032,16 +1122,16 @@ async function handleServerFunctionRequest(request, options = {}) {
     const response = new Response(DEV ? `Unknown server function: ${functionId}` : null, {
       status: 404
     });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
-  if (request.method === "GET" && METHODS.get(functionId) !== "GET") {
+  if (method !== "POST" && !declaredRead) {
     const response = new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
       status: 405,
       headers: {
-        Allow: "POST"
+        Allow: METHODS.get(functionId) === "GET" ? "POST, GET, HEAD" : "POST"
       }
     });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
   const event = options.createEvent ? options.createEvent(request) : {
     request,
@@ -1054,7 +1144,15 @@ async function handleServerFunctionRequest(request, options = {}) {
   const transformFlightResult = options.transformFlightResult !== undefined ? options.transformFlightResult : config.transformFlightResult;
   const handleNoJS = options.handleNoJS !== undefined ? options.handleNoJS : config.handleNoJS !== undefined ? config.handleNoJS : isFormPost(request) ? defaultNoJSHandler || (defaultNoJSHandler = createNoJSHandler()) : undefined;
   const collectsFlight = !!(flightHook && instance && request.headers.has(SINGLE_FLIGHT_HEADER));
-  const parsed = await parseArguments(request, url, instance, codec);
+  let parsed;
+  try {
+    parsed = await parseArguments(request, url, instance, codec);
+  } catch {
+    const response = new Response(DEV ? "Malformed server function arguments" : null, {
+      status: 400
+    });
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+  }
   const flightContext = {
     id: functionId,
     args: parsed,
@@ -1201,7 +1299,34 @@ async function handleServerFunctionRequest(request, options = {}) {
     }
   };
   const response = commitEventResponse(await dispatch(), event);
-  return protectsRequest ? withCSRFVary(response) : response;
+  return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+}
+function finalizeTransportResponse(response, method) {
+  const stripBody = method === "HEAD" && response.body !== null;
+  if (stripBody || !response.headers.has("Cache-Control")) {
+    try {
+      if (!response.headers.has("Cache-Control")) {
+        response.headers.set("Cache-Control", "no-store");
+      }
+      if (!stripBody) return response;
+      response.body.cancel().catch(() => {});
+      return new Response(null, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      });
+    } catch {
+      const headers = new Headers(response.headers);
+      if (!headers.has("Cache-Control")) headers.set("Cache-Control", "no-store");
+      if (stripBody) response.body.cancel().catch(() => {});
+      return new Response(stripBody ? null : response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
+    }
+  }
+  return response;
 }
 
-export { ERROR_HEADER, FLASH_COOKIE, FUNCTION_HEADER, GENERIC_SERVER_ERROR_MESSAGE, GET, INSTANCE_HEADER, SINGLE_FLIGHT_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getEventServerFunctionInvocation, getServerFunction, getServerFunctionInvocation, getServerFunctionMetadata, handleServerFunctionRequest, hasFlashCookie, isServerFunction, live, observeServerFunctionCalls, registerServerFunction, registerServerReference, sanitizeServerError, serializeResponseStream, setServerFunctionsDev, subscribeFlightData, withMeta };
+export { ERROR_HEADER, FLASH_COOKIE, GENERIC_SERVER_ERROR_MESSAGE, GET, INSTANCE_HEADER, SERVER_FUNCTION_INVOKE, SINGLE_FLIGHT_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getEventServerFunctionInvocation, getServerFunction, getServerFunctionInvocation, getServerFunctionMetadata, handleServerFunctionRequest, hasFlashCookie, invoke, isServerFunction, live, observeServerFunctionCalls, parseServerFunctionUrl, registerServerFunction, registerServerReference, sanitizeServerError, serializeResponseStream, serverFunctionUrl, setServerFunctionsDev, subscribeFlightData, withMeta };

package/types/client.d.ts

@@ -79,6 +79,8 @@ export interface RequestEvent {
 export type { CookieOptions } from "./cookies.js";
 export type { ServerFunction, ServerFunctionMetadata, ServerFunctionRPC } from "./server-functions/shared.js";
 export declare const waitAsset: (promise: Promise<unknown>) => void;
+export declare let listDriver: ((parent: Node, listFn: any, marker?: Node, lateClassic?: () => void) => boolean) | undefined;
+export declare function installListDriver(driver: typeof listDriver): void;
 export { DOMWithState, ChildProperties, DOMElements, SVGElements, MathMLElements, VoidElements, RawTextElements, Namespaces, DelegatedEvents } from "./constants.js";
 /** Client stub — hydration bootstrap is a server-only emit. */
 export declare function generateHydrationScript(_options?: {
@@ -145,10 +147,10 @@ export declare function spread<T>(node: Element, accessor: T, skipChildren?: Boo
 export declare function dynamicProperty(props: unknown, key: string): unknown;
 export declare function applyRef<T extends Element = Element>(r: ((element: NoInfer<T>) => void) | ((element: NoInfer<T>) => void)[], element: T): void;
 export declare function ref(fn: () => ((element: Element) => void) | ((element: Element) => void)[], element: Element): void;
-export declare function rowProof(fn: any): any; /** Compiler-emitted primitive; not for hand-written code. @internal */
+/** Compiler-emitted primitive; not for hand-written code. @internal */
 export declare function scope<T extends () => any>(fn: T): T;
 export declare function installHydrationRuntime(): void;
-export declare function patchDriver(subject: any, body: any): void; /**
+/**
  * Compiler-emitted primitive; not for hand-written code.
  * @internal
  */

package/types/index.d.ts

@@ -1,6 +1,7 @@
 import { Component } from "solid-js";
 import type { JSX } from "./jsx.js";
 export * from "./client.js";
+export { patchDriver, rowProof, driveList } from "./patch-driver.js";
 export * from "./server-mock.js";
 export * from "./response.js";
 export type { JSX } from "./jsx.js";

package/types/patch-driver.d.ts

@@ -0,0 +1,3 @@
+export declare function rowProof<T extends Function>(fn: T): T;
+export declare const driveList: (parent: Node, listFn: any, marker?: Node, lateClassic?: () => void) => boolean;
+export declare const patchDriver: (subject: any, body: any) => void;

package/types/response.d.ts

@@ -16,7 +16,15 @@ export declare const ResponseEnvelope: {
 export declare function isResponseEnvelope(value: unknown): value is ResponseEnvelope;
 export declare const HREF: unique symbol;
 export interface Href {
-    [HREF]: true;
+    /**
+     * The brand doubles as a channel: when the slot holds a string it is the
+     * value's *logical* path — the routable pathname before an integration's
+     * display rendering (eg. a hash router's `#` prefix). `redirect()` prefers
+     * it over coercion so Location headers carry routable paths; `toString()`
+     * remains the display href for the DOM. `true` brands a value whose
+     * string form is already logical.
+     */
+    [HREF]: true | string;
     toString(): string;
 }
 /** Whether `value` is an `Href`-branded URL-bearing value. */