@solidjs/web 2.0.0-rc.3 → 2.0.0-rc.5

package/server-functions/dist/server.dev.cjs

@@ -11,6 +11,8 @@ function isSafeError(value) {
   return !!(value && (typeof value === "object" || typeof value === "function") && value[SAFE_ERROR]);
 }
 const REVALIDATE_HEADER = "X-Revalidate";
+const RESPONSE_HEADER_VALUE_LIMIT = 4096;
+const NULL_BODY_STATUSES = new Set([204, 205, 304]);
 
 const SERVER_FUNCTION_METADATA = Symbol.for("solid.ServerFunctionMetadata");
 function getServerFunctionMetadata(fn) {
@@ -28,6 +30,32 @@ function withMeta(fn, meta) {
   Object.assign(metadata, meta);
   return fn;
 }
+const SERVER_FUNCTION_INVOKE = Symbol.for("solid.ServerFunctionInvoke");
+const INVOKE_OPTION_REDIRECTS = {
+  headers: "Session-dynamic headers belong to the prepareRequest hook, declaration metadata to " + "withMeta(fn, meta), and data belongs in the arguments, where it is serialized, typed, " + "and part of the cache key.",
+  method: "The method is declaration-scoped: declare the function with GET(fn).",
+  body: "The arguments are the body: pass them in the args array.",
+  timeout: "Compose timeouts through `signal` with AbortSignal.timeout(ms) (and AbortSignal.any to " + "combine it with a caller signal)."
+};
+function invoke(fn, options, ...args) {
+  const channel = typeof fn === "function" && fn[SERVER_FUNCTION_INVOKE];
+  if (!channel) {
+    throw new Error(isServerFunction(fn) ? "invoke: this wrapper does not forward the invocation channel " + "(SERVER_FUNCTION_INVOKE). Wrappers that share calls (caches, channels) opt in " + "deliberately — a caller's signal cannot own a wire other callers share. Invoke " + "the underlying reference directly, or use the wrapper's own per-call idioms." : "invoke expects a server function reference (or a wrapper that forwards its " + "invocation channel). Per-call options apply at the transport; for a data " + "layer's calls, use its per-call options instead.");
+  }
+  if (options === null || typeof options !== "object") {
+    throw new Error("invoke's second argument is the invocation options bag: invoke(fn, { signal }, ...args)");
+  }
+  const picked = {};
+  for (const key in options) {
+    if (key !== "signal" && key !== "keepalive" && key !== "priority") {
+      throw new Error(`\`${key}\` is not an invocation option. ` + (INVOKE_OPTION_REDIRECTS[key] || "Options here are strictly invocation-scoped (they vary between calls of the " + "same function): signal, keepalive, priority."));
+    }
+  }
+  if (options.signal !== undefined) picked.signal = options.signal;
+  if (options.keepalive !== undefined) picked.keepalive = options.keepalive;
+  if (options.priority !== undefined) picked.priority = options.priority;
+  return channel(args, picked);
+}
 const LIVE_SOURCE = Symbol.for("solid.LiveSource");
 const SERVER_FUNCTION_RPC = Symbol.for("solid.ServerFunctionRPC");
 function provideServerFunctionRPC(rpc) {
@@ -57,6 +85,7 @@ function decodeSafe(text) {
   }
 }
 function serializeCookie(name, value, options = {}) {
+  assertServableCookie(name, options);
   let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
   cookie += `; Path=${options.path === undefined ? "/" : options.path}`;
   if (options.domain) cookie += `; Domain=${options.domain}`;
@@ -64,12 +93,32 @@ function serializeCookie(name, value, options = {}) {
   if (options.expires) cookie += `; Expires=${options.expires.toUTCString()}`;
   if (options.httpOnly) cookie += "; HttpOnly";
   if (options.secure) cookie += "; Secure";
+  if (options.partitioned) cookie += "; Partitioned";
   if (options.sameSite) {
     const sameSite = options.sameSite.toLowerCase();
     cookie += `; SameSite=${sameSite === "none" ? "None" : sameSite === "strict" ? "Strict" : "Lax"}`;
   }
   return cookie;
 }
+function assertServableCookie(name, options) {
+  const reject = reason => {
+    throw new Error(`serializeCookie: every browser silently rejects this cookie — ${reason}. ` + `It would never come back on a request, with no error anywhere.`);
+  };
+  const lower = name.toLowerCase();
+  if (lower.startsWith("__host-")) {
+    if (!options.secure) reject(`the __Host- prefix on \`${name}\` requires \`secure: true\``);
+    if (options.path !== undefined && options.path !== "/") reject(`the __Host- prefix on \`${name}\` requires \`Path=/\` (got \`${options.path}\`) — ` + `host-locking is the prefix's whole contract, so it cannot be path-scoped`);
+    if (options.domain) reject(`the __Host- prefix on \`${name}\` forbids \`Domain\` (got \`${options.domain}\`)`);
+  } else if (lower.startsWith("__secure-") && !options.secure) {
+    reject(`the __Secure- prefix on \`${name}\` requires \`secure: true\``);
+  }
+  if (options.sameSite && options.sameSite.toLowerCase() === "none" && !options.secure) {
+    reject("`SameSite=None` requires `secure: true`");
+  }
+  if (options.partitioned && !options.secure) {
+    reject("`Partitioned` requires `secure: true`");
+  }
+}
 const FLASH_COOKIE = "flash";
 const FLASH_MATCHER = new RegExp(`(?:^|;\\s*)${FLASH_COOKIE}=([^;]+)`);
 function hasFlashCookie(cookieHeader) {
@@ -88,11 +137,50 @@ function configureServerFunctionsCodec(codec) {
 function getServerFunctionsCodec() {
   return codecConfig.codec;
 }
-function subscribeFlightData(consumer) {
+const UNNAMED_FLIGHT_SOURCE = "true";
+const flightConfig = {
+  consumers: new Map()
+};
+function assertFlightSource(source) {
+  if (source === UNNAMED_FLIGHT_SOURCE || source === "" || source.includes(",")) {
+    throw new TypeError(`Invalid flight data source id "${source}": ids ride the ` + `${SINGLE_FLIGHT_HEADER} header as a comma-separated list, and "true" is ` + `reserved for the unnamed registration (the bare consumer/hook signatures).`);
+  }
+}
+function subscribeFlightData(sourceOrConsumer, maybeConsumer) {
+  const named = typeof sourceOrConsumer === "string";
+  if (named) assertFlightSource(sourceOrConsumer);
+  const source = named ? sourceOrConsumer : UNNAMED_FLIGHT_SOURCE;
+  const consumer = named ? maybeConsumer : sourceOrConsumer;
+  flightConfig.consumers.set(source, consumer);
   return () => {
+    if (flightConfig.consumers.get(source) === consumer) flightConfig.consumers.delete(source);
   };
 }
-const FUNCTION_HEADER = "X-Server-Function-Id";
+function serverFunctionAddress(endpoint, id) {
+  const mount = endpoint.endsWith("/") ? endpoint.slice(0, -1) : endpoint;
+  return `${mount}/${encodeURIComponent(id)}`;
+}
+function parseServerFunctionAddress(pathname, endpoint) {
+  const mount = endpoint.endsWith("/") ? endpoint.slice(0, -1) : endpoint;
+  if (!pathname.startsWith(mount)) return null;
+  const rest = pathname.slice(mount.length);
+  if (!rest.startsWith("/")) return null;
+  let segment = rest.slice(1);
+  let data = false;
+  if (segment.startsWith("data/")) {
+    segment = segment.slice(5);
+    data = true;
+  }
+  if (!segment || segment.includes("/")) return null;
+  try {
+    return {
+      id: decodeURIComponent(segment),
+      data
+    };
+  } catch {
+    return null;
+  }
+}
 const ERROR_HEADER = "X-Server-Function-Error";
 const ERROR_HEADER_MARKER = "=?1?";
 const NEEDS_ENCODING = /[^\x20-\x7e\xa0-\xff]/;
@@ -120,6 +208,28 @@ function decodeErrorHeaderValue(value) {
 }
 const INSTANCE_HEADER = "X-Server-Function-Instance";
 const BODY_FORMAT_HEADER = "X-Server-Function-Format";
+const UNKNOWN_HEADER = "X-Server-Function-Unknown";
+const REDIRECT_HEADER = "X-Server-Function-Redirect";
+function decodeRedirectHeaderValue(value) {
+  if (typeof value !== "string") return undefined;
+  const at = value.indexOf(" ");
+  if (at < 0) return undefined;
+  const status = Number(value.slice(0, at));
+  const url = value.slice(at + 1);
+  if (!Number.isInteger(status) || !url) return undefined;
+  if (status !== 301 && status !== 302 && status !== 303 && status !== 307 && status !== 308) return undefined;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return undefined;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return undefined;
+  return {
+    status,
+    url
+  };
+}
 const SINGLE_FLIGHT_HEADER = "X-Single-Flight";
 const FILE_FORM_KEY = "__server_function_file__";
 const BodyFormat = {
@@ -131,7 +241,8 @@ const BodyFormat = {
   File: "5",
   ArrayBuffer: "6",
   Uint8Array: "7",
-  Json: "8"
+  Json: "8",
+  Void: "9"
 };
 const JSON_SAFE_DEPTH_LIMIT = 4096;
 const EXIT = {};
@@ -161,7 +272,11 @@ function isJSONSafe(value) {
       const proto = Object.getPrototypeOf(v);
       if (proto !== Object.prototype && proto !== null) return false;
       if (Symbol.asyncIterator in v || Symbol.iterator in v) return false;
-      for (const k in v) stack.push(v[k]);
+      for (const k in v) {
+        const descriptor = Object.getOwnPropertyDescriptor(v, k);
+        if (descriptor === undefined || !("value" in descriptor)) return false;
+        stack.push(descriptor.value);
+      }
     }
   }
   return true;
@@ -270,18 +385,34 @@ function createChunk(data) {
 class ChunkReader {
   constructor(stream) {
     this.reader = stream.getReader();
-    this.buffer = new Uint8Array(0);
+    this.store = new Uint8Array(0);
+    this.buffer = this.store;
     this.done = false;
   }
   async readChunk() {
     const chunk = await this.reader.read();
-    if (!chunk.done) {
-      const newBuffer = new Uint8Array(this.buffer.length + chunk.value.length);
-      newBuffer.set(this.buffer);
-      newBuffer.set(chunk.value, this.buffer.length);
-      this.buffer = newBuffer;
-    } else {
+    if (chunk.done) {
       this.done = true;
+      return;
+    }
+    const incoming = chunk.value;
+    const store = this.store;
+    const start = this.buffer.byteOffset;
+    const end = start + this.buffer.length;
+    const needed = this.buffer.length + incoming.length;
+    if (end + incoming.length <= store.length) {
+      store.set(incoming, end);
+      this.buffer = store.subarray(start, end + incoming.length);
+    } else if (needed <= store.length) {
+      store.copyWithin(0, start, end);
+      store.set(incoming, this.buffer.length);
+      this.buffer = store.subarray(0, needed);
+    } else {
+      const grown = new Uint8Array(Math.max(needed, store.length * 2));
+      grown.set(this.buffer);
+      grown.set(incoming, this.buffer.length);
+      this.store = grown;
+      this.buffer = grown.subarray(0, needed);
     }
   }
   async next() {
@@ -323,6 +454,27 @@ class ChunkReader {
     }
   }
 }
+const ERROR_TRAILER_PREFIX = "!";
+function encodeErrorTrailer(error) {
+  const shaped = error instanceof Error ? error : new Error(String(error));
+  return ERROR_TRAILER_PREFIX + JSON.stringify(shaped.name && shaped.name !== "Error" ? {
+    name: shaped.name,
+    message: shaped.message
+  } : {
+    message: shaped.message
+  });
+}
+function errorFromTrailer(payload) {
+  let shape;
+  try {
+    shape = JSON.parse(payload.slice(1));
+  } catch {
+    shape = null;
+  }
+  const error = new Error(shape && typeof shape.message === "string" ? shape.message : "Server function result could not be delivered.");
+  if (shape && typeof shape.name === "string") error.name = shape.name;
+  return error;
+}
 async function deserializeStream(source, codecOptions) {
   if (!source.body) {
     throw new Error("missing body");
@@ -330,11 +482,17 @@ async function deserializeStream(source, codecOptions) {
   const reader = new ChunkReader(source.body);
   const result = await reader.next();
   if (!result.done) {
+    if (result.value.startsWith(ERROR_TRAILER_PREFIX)) {
+      throw errorFromTrailer(result.value);
+    }
     const {
       createJSONDeserializer
     } = await import('@solidjs/web/serialization/decode');
     const deserializeChunk = createJSONDeserializer(codecOptions);
     function interpretChunk(chunk) {
+      if (chunk.startsWith(ERROR_TRAILER_PREFIX)) {
+        throw errorFromTrailer(chunk);
+      }
       return deserializeChunk(JSON.parse(chunk));
     }
     reader.drain(interpretChunk).then(() => deserializeChunk.abort(new Error("Server function stream ended unexpectedly.")), error => deserializeChunk.abort(error));
@@ -398,7 +556,7 @@ function copyInitHeaders(init) {
   for (const cookie of init.getSetCookie()) headers.append("Set-Cookie", cookie);
   return headers;
 }
-const STUB_GAP_FILL_EXCLUDED = /*#__PURE__*/new Set([ERROR_HEADER, BODY_FORMAT_HEADER, SINGLE_FLIGHT_HEADER, REVALIDATE_HEADER, "Location"].map(header => header.toLowerCase()));
+const STUB_GAP_FILL_EXCLUDED = /*#__PURE__*/new Set([ERROR_HEADER, BODY_FORMAT_HEADER, SINGLE_FLIGHT_HEADER, REVALIDATE_HEADER, REDIRECT_HEADER, "Location"].map(header => header.toLowerCase()));
 function fillsStubGap(key, headers, response) {
   if (key === "set-cookie" || STUB_GAP_FILL_EXCLUDED.has(key)) return false;
   if (response.body === null && (key === "content-type" || key === "content-length")) return false;
@@ -414,24 +572,16 @@ function commitEventResponse(response, event = getRequestEvent()) {
     if (fillsStubGap(key, response.headers, response)) hasGaps = true;
   });
   if (!cookies.length && !hasGaps) return response;
-  try {
-    for (const cookie of cookies) response.headers.append("Set-Cookie", cookie);
-    stub.headers.forEach((value, key) => {
-      if (fillsStubGap(key, response.headers, response)) response.headers.set(key, value);
-    });
-    return response;
-  } catch {
-    const headers = copyInitHeaders(response.headers);
-    for (const cookie of cookies) headers.append("Set-Cookie", cookie);
-    stub.headers.forEach((value, key) => {
-      if (fillsStubGap(key, headers, response)) headers.set(key, value);
-    });
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  }
+  const headers = copyInitHeaders(response.headers);
+  for (const cookie of cookies) headers.append("Set-Cookie", cookie);
+  stub.headers.forEach((value, key) => {
+    if (fillsStubGap(key, headers, response)) headers.set(key, value);
+  });
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
 }
 
 function encodeInputValue(value) {
@@ -463,11 +613,35 @@ function encodeFlashCookie(url, result, input, thrown) {
     thrown: !!thrown,
     input: input.map(encodeInputValue)
   };
+  if (fitsCookie(payload)) return flashCookie(payload);
+  payload.truncated = true;
+  payload.input = [];
+  if (!fitsCookie(payload)) {
+    if (typeof payload.result === "string") {
+      let prefix = payload.result;
+      while (prefix.length > 0 && !fitsCookie({
+        ...payload,
+        result: prefix
+      })) {
+        prefix = prefix.slice(0, prefix.length >> 1);
+      }
+      payload.result = prefix.length > 0 ? prefix : true;
+    } else {
+      payload.result = true;
+    }
+  }
+  return flashCookie(payload);
+}
+function flashCookie(payload) {
   return serializeCookie(FLASH_COOKIE, JSON.stringify(payload), {
     secure: true,
     httpOnly: true
   });
 }
+const COOKIE_PAIR_BUDGET = 4000;
+function fitsCookie(payload) {
+  return FLASH_COOKIE.length + 1 + encodeURIComponent(JSON.stringify(payload)).length <= COOKIE_PAIR_BUDGET;
+}
 function decodeFlashCookie(cookieHeader) {
   const match = parseCookieHeader(cookieHeader)[FLASH_COOKIE];
   if (!match) return;
@@ -475,12 +649,14 @@ function decodeFlashCookie(cookieHeader) {
     const payload = JSON.parse(match);
     if (!payload || !payload.result) return;
     const result = payload.error ? new Error(payload.result) : payload.result;
-    return {
+    const submission = {
       input: Array.isArray(payload.input) ? payload.input.map(decodeInputValue) : [],
       url: payload.url,
       result: payload.thrown ? undefined : result,
       error: payload.thrown ? result : undefined
     };
+    if (payload.truncated) submission.truncated = true;
+    return submission;
   } catch (error) {
     console.error(error);
   }
@@ -495,7 +671,9 @@ const config = {
   transformDirectResult: undefined,
   handleNoJS: undefined,
   endpoint: "/_server",
-  csrf: true
+  csrf: true,
+  bodySizeLimit: 1_048_576,
+  maxArguments: 1000
 };
 function configureServerFunctionsServer({
   provideEvent,
@@ -507,7 +685,9 @@ function configureServerFunctionsServer({
   handleNoJS,
   endpoint,
   csrf,
-  codec
+  codec,
+  bodySizeLimit,
+  maxArguments
 } = {}) {
   if (provideEvent !== undefined) config.provideEvent = provideEvent;
   if (wrapInvocation !== undefined) config.wrapInvocation = wrapInvocation;
@@ -519,6 +699,16 @@ function configureServerFunctionsServer({
   if (endpoint !== undefined) config.endpoint = endpoint;
   if (csrf !== undefined) config.csrf = csrf;
   if (codec !== undefined) configureServerFunctionsCodec(codec);
+  if (bodySizeLimit !== undefined) config.bodySizeLimit = bodySizeLimit;
+  if (maxArguments !== undefined) config.maxArguments = maxArguments;
+}
+const flightSources = new Map();
+function registerFlightDataSource(source, hook) {
+  assertFlightSource(source);
+  flightSources.set(source, hook);
+  return () => {
+    if (flightSources.get(source) === hook) flightSources.delete(source);
+  };
 }
 function provideEvent(event, fn) {
   if (config.provideEvent) return config.provideEvent(event, fn);
@@ -540,6 +730,7 @@ function provideRPC() {
 }
 function registerServerFunction(id, callback) {
   provideRPC();
+  if (REGISTRATIONS.get(id) !== callback) METHODS.delete(id);
   REGISTRATIONS.set(id, callback);
   return callback;
 }
@@ -551,6 +742,9 @@ function getServerFunction(id) {
   throw new Error("invalid server function: " + id);
 }
 function registerServerReference(id, fn, name) {
+  if (typeof fn !== "function") {
+    throw new Error(`Server function${name ? ` \`${name}\`` : ""} (${id}) is not a function: a module-level ` + `"use server" export must evaluate to a server function (got ${fn === null ? "null" : typeof fn}). Move non-function exports out of the directive module.`);
+  }
   registerServerFunction(id, fn);
   return {
     id,
@@ -558,6 +752,33 @@ function registerServerReference(id, fn, name) {
     name
   };
 }
+function inProcessInvoker(call) {
+  return (args, options) => {
+    const signal = options && options.signal;
+    if (!signal) return call(...args);
+    if (signal.aborted) return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+      const onAbort = () => reject(signal.reason);
+      signal.addEventListener("abort", onAbort, {
+        once: true
+      });
+      let result;
+      try {
+        result = call(...args);
+      } catch (error) {
+        signal.removeEventListener("abort", onAbort);
+        return reject(error);
+      }
+      Promise.resolve(result).then(value => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      }, error => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      });
+    });
+  };
+}
 function createServerReference({
   id,
   fn,
@@ -568,20 +789,25 @@ function createServerReference({
   const metadata = name === undefined ? {} : {
     name
   };
-  return new Proxy(fn, {
+  const invokeChannel = inProcessInvoker((...args) => proxy(...args));
+  const proxy = new Proxy(fn, {
     get(target, prop) {
       if (prop === "id") return id;
       if (prop === "url") {
-        return `${config.endpoint}?id=${encodeURIComponent(id)}`;
+        return serverFunctionAddress(config.endpoint, id);
       }
       if (prop === SERVER_FUNCTION_METADATA) return metadata;
+      if (prop === SERVER_FUNCTION_INVOKE) return invokeChannel;
       return target[prop];
     },
     apply(target, thisArg, args) {
       const ogEvt = getRequestEvent();
       if (!ogEvt) throw new Error("Cannot call server function outside of a request");
       const evt = {
-        ...ogEvt
+        ...ogEvt,
+        locals: {
+          ...ogEvt.locals
+        }
       };
       INVOCATIONS.set(evt, {
         id
@@ -611,6 +837,7 @@ function createServerReference({
       }) : result;
     }
   });
+  return proxy;
 }
 function GET(fn) {
   if (!isServerFunction(fn) || typeof fn.id !== "string") {
@@ -637,6 +864,7 @@ function live(fn) {
     return result;
   };
   wrapped[SERVER_FUNCTION_METADATA] = metadata;
+  wrapped[SERVER_FUNCTION_INVOKE] = inProcessInvoker(wrapped);
   wrapped.id = fn.id;
   Object.defineProperty(wrapped, "url", {
     get: () => fn.url,
@@ -650,40 +878,107 @@ function getServerFunctionInvocation() {
 function getEventServerFunctionInvocation(event) {
   return event && INVOCATIONS.get(event);
 }
-function resolveFunctionId(request, url) {
-  const reference = request.headers.get(FUNCTION_HEADER);
-  if (reference) {
-    return reference.split("#")[0];
+function resolveAddress(url) {
+  return parseServerFunctionAddress(url.pathname, config.endpoint);
+}
+const DECODE_DEPTH_LIMIT = 64;
+function assertDecodeDepth(value) {
+  let level = [value];
+  for (let depth = 0; level.length > 0; depth++) {
+    if (depth > DECODE_DEPTH_LIMIT) {
+      throw new TypeError("Server function arguments exceed the decode depth limit");
+    }
+    const next = [];
+    for (const node of level) {
+      if (node === null || typeof node !== "object") continue;
+      if (Array.isArray(node)) {
+        for (const child of node) next.push(child);
+      } else {
+        for (const key of Object.keys(node)) next.push(node[key]);
+      }
+    }
+    level = next;
+  }
+}
+async function bufferBodyWithin(request, limit) {
+  const reader = request.clone().body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (;;) {
+    const {
+      done,
+      value
+    } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > limit) {
+      reader.cancel().catch(() => {});
+      return null;
+    }
+    chunks.push(value);
   }
-  return url.searchParams.get("id");
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new Request(request, {
+    body
+  });
 }
-async function parseArguments(request, url, instance, codec) {
+async function parseArguments(request, url, scripted, codec) {
   const parsed = [];
   const bodyFormat = request.method === "POST" ? request.headers.get(BODY_FORMAT_HEADER) : null;
-  if (!instance || request.method === "GET" || bodyFormat !== BodyFormat.Serialized) {
-    const args = url.searchParams.get("args");
-    if (args) {
-      const result = args.startsWith(";0x") ? await deserializeString(args, codec) : JSON.parse(args);
-      for (const arg of result) {
-        parsed.push(arg);
-      }
+  const args = url.searchParams.get("args");
+  if (args && (!scripted || request.method === "GET" || bodyFormat !== BodyFormat.Serialized)) {
+    let result;
+    if (args.startsWith(";0x")) {
+      result = await deserializeString(args, codec);
+    } else {
+      result = JSON.parse(args);
+      assertDecodeDepth(result);
     }
+    if (!Array.isArray(result)) {
+      throw new TypeError("Server function arguments must encode an array");
+    }
+    for (const arg of result) {
+      parsed.push(arg);
+    }
+  } else if (!args && url.search && (request.method === "GET" || request.method === "HEAD")) {
+    parsed.push(url.searchParams);
   }
   if (request.method === "POST" && request.body !== null) {
     const decoded = await extractBody(request.clone(), codec);
     if (bodyFormat === BodyFormat.Serialized || bodyFormat === BodyFormat.Json) {
+      if (bodyFormat === BodyFormat.Json) assertDecodeDepth(decoded);
+      if (!Array.isArray(decoded)) {
+        throw new TypeError("Server function arguments must encode an array");
+      }
       return decoded;
     }
+    if (decoded === undefined) {
+      throw new TypeError("Server function body carries no usable encoding");
+    }
     parsed.push(decoded);
   }
   return parsed;
 }
-async function foldFlightData(hook, event, headers, outcome, context = {}) {
+async function foldFlightData(hooks, event, headers, outcome, context = {}) {
   if (outcome.value instanceof Response && outcome.value.body) return outcome.value;
   digestOutcome(event, outcome);
-  const data = await hook(event, outcome);
-  if (data === undefined) return outcome.value;
-  headers.set(SINGLE_FLIGHT_HEADER, "true");
+  const folded = [];
+  for (const [source, hook] of hooks) {
+    try {
+      const slice = await hook(event, outcome);
+      if (slice !== undefined) folded.push([source, slice]);
+    } catch (error) {
+      console.error(`Error collecting flight data for source "${source}"`, error);
+    }
+  }
+  if (folded.length === 0) return outcome.value;
+  const data = Object.fromEntries(folded);
+  headers.set(SINGLE_FLIGHT_HEADER, folded.map(([source]) => source).join(","));
   if (context.transformFlightResult) {
     const transformed = await context.transformFlightResult(event, {
       value: outcome.value,
@@ -772,6 +1067,52 @@ function mergeResponseHeaders(target, source) {
   }
 }
 const validRedirectStatuses = new Set([301, 302, 303, 307, 308]);
+function maskRedirect(headers, response, requestUrl) {
+  const target = response.headers && response.headers.get("Location");
+  if (target) {
+    headers.set(REDIRECT_HEADER, `${response.status} ${new URL(target, requestUrl)}`);
+  }
+  headers.delete("Location");
+}
+const BOUNDED_COMPOSED_HEADERS = [REDIRECT_HEADER, "Location", REVALIDATE_HEADER];
+function refusedTargetScheme(target) {
+  const match = /^[a-zA-Z][a-zA-Z0-9+.-]*:/.exec(target);
+  return match !== null && !/^https?:$/i.test(match[0]);
+}
+function enforceComposedHeaderInvariants(response) {
+  for (const name of BOUNDED_COMPOSED_HEADERS) {
+    const value = response.headers.get(name);
+    if (value === null) continue;
+    if (value.length > RESPONSE_HEADER_VALUE_LIMIT) {
+      return refuseComposedHeader(response, name, `${name} response header refused at ${value.length} characters`, DEV ? `The ${name} response header is ${value.length} characters; past ` + `${RESPONSE_HEADER_VALUE_LIMIT} it would overflow receivers (an 8 KiB proxy ` + `buffer holds the whole header block) and the response dies at the socket after ` + `the mutation committed. Refused rather than trimmed: a cut redirect target is a ` + `different address, a dropped revalidate key is a silently stale cache. The ` + `redirect()/reload() helpers enforce this bound with the full reasoning at the ` + `call site.` : null);
+    }
+    if (name === REVALIDATE_HEADER) continue;
+    const target = name === REDIRECT_HEADER ? value.slice(value.indexOf(" ") + 1) : value;
+    if (refusedTargetScheme(target)) {
+      return refuseComposedHeader(response, name, `${name} response header refused: non-http(s) navigation target`, DEV ? `The ${name} response header carries a navigation target with a non-http(s) ` + `scheme ("${target.slice(0, 64)}"). A javascript: target is same-origin script ` + `execution in any integration that navigates to it, so only http(s) and ` + `relative targets leave this transport. If the target came from request data ` + `(?next= and friends), validate it against your own origin before redirecting.` : null);
+    }
+  }
+  return response;
+}
+function refuseComposedHeader(response, name, headerMessage, body) {
+  if (response.body) {
+    try {
+      const cancelled = response.body.cancel();
+      if (cancelled && typeof cancelled.then === "function") cancelled.then(undefined, () => {});
+    } catch {}
+  }
+  const headers = new Headers();
+  headers.set(ERROR_HEADER, boundedErrorHeaderValue(DEV ? headerMessage : GENERIC_SERVER_ERROR_MESSAGE));
+  return new Response(body, {
+    status: 500,
+    headers
+  });
+}
+function warnScripted304(functionId) {
+  if (DEV) {
+    console.warn(`Server function "${functionId}" answered a scripted call with 304 Not Modified. ` + `The client transport sends no conditional headers, so nothing was asked to be ` + `revalidated: the call resolves to undefined, not "unchanged". For conditional ` + `reads, declare the function GET and set ETag/Cache-Control response headers - ` + `the browser owns that exchange and replays its cached answer on a 304.`);
+  }
+}
 function createNoJSHandler({
   base = ""
 } = {}) {
@@ -815,44 +1156,279 @@ function isFormPost(request) {
   const type = request.headers.get("content-type") || "";
   return type.startsWith("application/x-www-form-urlencoded") || type.startsWith("multipart/form-data");
 }
-function serializeResponseStream(value, codecOptions, signal) {
-  let closeIterator = null;
-  let closed = false;
-  let cancelSerialize = null;
-  let onAbort = null;
-  const teardown = () => {
-    if (closed) return;
-    closed = true;
-    if (onAbort) signal.removeEventListener("abort", onAbort);
-    if (cancelSerialize) cancelSerialize();
-    if (closeIterator) closeIterator();
+function guardFailures(value, state) {
+  if (!state) state = {
+    seen: new WeakMap(),
+    cyclic: new WeakSet()
   };
-  if (value !== null && typeof value === "object" && typeof value[Symbol.asyncIterator] === "function") {
+  const entered = enterGuard(value, state);
+  if (!(entered instanceof Frame)) return entered;
+  const stack = [entered];
+  let delivered = NOTHING;
+  for (;;) {
+    const top = stack[stack.length - 1];
+    const items = top.items;
+    let pushed = null;
+    while (top.i < items.length) {
+      const i = top.i;
+      let original;
+      if (top.kind === OBJECT) {
+        const descriptor = top.descriptors[items[i]];
+        if ("value" in descriptor) {
+          original = descriptor.value;
+        } else if (typeof descriptor.get === "function") {
+          if (top.accessorRead !== i) {
+            try {
+              top.accessorValue = descriptor.get.call(top.value);
+            } catch (error) {
+              throw sanitizeServerError(error);
+            }
+            top.accessorRead = i;
+          }
+          original = top.accessorValue;
+        } else {
+          top.i++;
+          continue;
+        }
+      } else {
+        original = items[i];
+      }
+      let guarded;
+      if (delivered !== NOTHING) {
+        guarded = delivered;
+        delivered = NOTHING;
+      } else {
+        guarded = enterGuard(original, state);
+        if (guarded instanceof Frame) {
+          pushed = guarded;
+          break;
+        }
+      }
+      if (top.kind === ARRAY) {
+        if (guarded !== original) {
+          top.next[i] = guarded;
+          top.changed = true;
+        }
+      } else if (top.kind === MAP) {
+        if ((i & 1) === 0) top.pendingKey = guarded;else top.next.set(top.pendingKey, guarded);
+        if (guarded !== original) top.changed = true;
+      } else if (top.kind === SET) {
+        top.next.add(guarded);
+        if (guarded !== original) top.changed = true;
+      } else if (guarded !== original || top.accessorRead === i) {
+        Object.defineProperty(top.next, items[i], top.accessorRead === i ? {
+          enumerable: true,
+          configurable: true,
+          writable: true,
+          value: guarded
+        } : {
+          ...top.descriptors[items[i]],
+          value: guarded
+        });
+        top.changed = true;
+      }
+      top.i++;
+    }
+    if (pushed !== null) {
+      stack.push(pushed);
+      continue;
+    }
+    stack.pop();
+    const out = keepGuarded(top.value, top.next, top.changed, state);
+    if (stack.length === 0) return out;
+    delivered = out;
+  }
+}
+const NOTHING = Symbol();
+const ARRAY = 0;
+const MAP = 1;
+const SET = 2;
+const OBJECT = 3;
+class Frame {
+  constructor(kind, value, next, items, descriptors) {
+    this.kind = kind;
+    this.value = value;
+    this.next = next;
+    this.items = items;
+    this.descriptors = descriptors;
+    this.i = 0;
+    this.changed = false;
+    this.accessorRead = -1;
+    this.accessorValue = undefined;
+    this.pendingKey = undefined;
+  }
+}
+function enterGuard(value, state) {
+  if (value === null || typeof value !== "object") return value;
+  if (state.seen.has(value)) {
+    state.cyclic.add(value);
+    return state.seen.get(value);
+  }
+  if (typeof ReadableStream !== "undefined" && value instanceof ReadableStream) {
+    let reader;
+    const gate = state.gate;
+    let finished = false;
+    const close = () => {
+      if (finished) return;
+      finished = true;
+      try {
+        const cancelled = reader ? reader.cancel() : value.cancel();
+        if (cancelled && typeof cancelled.then === "function") cancelled.then(undefined, () => {});
+      } catch {}
+    };
+    const guardedStream = new ReadableStream({
+      async pull(controller) {
+        try {
+          if (gate && !finished && !gate.wantsMore()) await gate.awaitDemand();
+          if (finished) {
+            controller.close();
+            return;
+          }
+          if (!reader) reader = value.getReader();
+          const {
+            done,
+            value: chunk
+          } = await reader.read();
+          done ? controller.close() : controller.enqueue(guardFailures(chunk, state));
+        } catch (error) {
+          controller.error(sanitizeServerError(error));
+        }
+      },
+      cancel(reason) {
+        finished = true;
+        return reader ? reader.cancel(reason) : value.cancel(reason);
+      }
+    });
+    if (gate) gate.onOpen(close);
+    state.seen.set(value, guardedStream);
+    return guardedStream;
+  }
+  if (typeof value.then === "function") {
+    const guardedPromise = Promise.resolve(value).then(resolved => guardFailures(resolved, state), error => {
+      throw sanitizeServerError(error);
+    });
+    state.seen.set(value, guardedPromise);
+    return guardedPromise;
+  }
+  if (typeof value[Symbol.asyncIterator] === "function") {
     const source = value;
-    value = {
+    const gate = state.gate;
+    const guardedIterable = {
       [Symbol.asyncIterator]() {
-        const it = source[Symbol.asyncIterator]();
+        const iterator = source[Symbol.asyncIterator]();
         let finished = false;
-        closeIterator = () => {
+        const close = () => {
           if (finished) return;
           finished = true;
           try {
-            const returned = it.return && it.return();
+            const returned = iterator.return && iterator.return();
             if (returned && typeof returned.then === "function") returned.then(undefined, () => {});
           } catch {}
         };
-        if (closed) closeIterator();
+        if (gate) gate.onOpen(close);
+        const step = () => finished ? Promise.resolve({
+          done: true,
+          value: undefined
+        }) : iterator.next().then(step => {
+          if (step.done) {
+            finished = true;
+            return step;
+          }
+          return {
+            done: false,
+            value: guardFailures(step.value, state)
+          };
+        }, error => {
+          throw sanitizeServerError(error);
+        });
         return {
-          next: () => finished ? Promise.resolve({
-            done: true,
-            value: undefined
-          }) : it.next()
+          next: () => finished || !gate || gate.wantsMore() ? step() : gate.awaitDemand().then(step),
+          return: () => {
+            close();
+            return Promise.resolve({
+              done: true,
+              value: undefined
+            });
+          }
         };
       }
     };
+    state.seen.set(value, guardedIterable);
+    return guardedIterable;
+  }
+  if (Array.isArray(value)) {
+    const next = value.slice();
+    state.seen.set(value, next);
+    return new Frame(ARRAY, value, next, value, null);
+  }
+  if (value instanceof Map) {
+    const next = new Map();
+    state.seen.set(value, next);
+    const items = [];
+    for (const entry of value) items.push(entry[0], entry[1]);
+    return new Frame(MAP, value, next, items, null);
+  }
+  if (value instanceof Set) {
+    const next = new Set();
+    state.seen.set(value, next);
+    return new Frame(SET, value, next, [...value], null);
   }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    state.seen.set(value, value);
+    return value;
+  }
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  const next = Object.create(prototype, descriptors);
+  state.seen.set(value, next);
+  return new Frame(OBJECT, value, next, Object.keys(descriptors), descriptors);
+}
+function keepGuarded(value, next, changed, state) {
+  if (changed || state.cyclic.has(value)) return next;
+  state.seen.set(value, value);
+  return value;
+}
+function serializeResponseStream(value, codecOptions, signal) {
+  let closed = false;
+  let streamController = null;
+  let demandWaiters = null;
+  const wantsMore = () => streamController !== null && streamController.desiredSize > 0;
+  const awaitDemand = () => new Promise(resolve => (demandWaiters ??= []).push(resolve));
+  const supplyDemand = () => {
+    const resolvers = demandWaiters;
+    demandWaiters = null;
+    if (resolvers) for (const resolve of resolvers) resolve();
+  };
+  const sourceClosers = new Set();
+  const gate = {
+    wantsMore,
+    awaitDemand,
+    onOpen(close) {
+      if (closed) close();else sourceClosers.add(close);
+    }
+  };
+  value = guardFailures(value, {
+    seen: new WeakMap(),
+    cyclic: new WeakSet(),
+    gate
+  });
+  let cancelSerialize = null;
+  let onAbort = null;
+  const finishSource = () => {
+    for (const close of sourceClosers) close();
+    sourceClosers.clear();
+    supplyDemand();
+  };
+  const teardown = () => {
+    if (closed) return;
+    closed = true;
+    if (onAbort) signal.removeEventListener("abort", onAbort);
+    if (cancelSerialize) cancelSerialize();
+    finishSource();
+  };
   return new ReadableStream({
     async start(controller) {
+      streamController = controller;
       if (signal) {
         if (signal.aborted) {
           teardown();
@@ -888,16 +1464,29 @@ function serializeResponseStream(value, codecOptions, signal) {
           if (closed) return;
           closed = true;
           if (onAbort) signal.removeEventListener("abort", onAbort);
+          finishSource();
           controller.close();
         },
         onError(error) {
           if (closed) return;
           closed = true;
           if (onAbort) signal.removeEventListener("abort", onAbort);
-          controller.error(error);
+          finishSource();
+          try {
+            const delivered = sanitizeServerError(DEV && error instanceof Error ? new Error(`Server function result could not be encoded: ${error.message}`) : error);
+            controller.enqueue(createChunk(encodeErrorTrailer(delivered)));
+            controller.close();
+          } catch {
+            try {
+              controller.error(error);
+            } catch {}
+          }
         }
       });
     },
+    pull() {
+      supplyDemand();
+    },
     cancel() {
       teardown();
     }
@@ -911,6 +1500,18 @@ function serializedResponse(value, headers, codec, signal) {
   });
 }
 function encodeResult(value, headers, status, codec, signal) {
+  if (NULL_BODY_STATUSES.has(status)) {
+    if (value === undefined || value === null) {
+      headers.set(BODY_FORMAT_HEADER, BodyFormat.Void);
+      return new Response(null, {
+        status,
+        headers
+      });
+    }
+    const error = new Error(`Server function answered status ${status}, which forbids a response body, with a value. ` + `Return respond(undefined, { status: ${status} }) for a bodiless answer, or drop the ` + `status to send the value.`);
+    headers.set(ERROR_HEADER, encodeErrorHeaderValue(error.message));
+    return encodeResult(error, headers, 500, codec, signal);
+  }
   const direct = getHeadersAndBody(value);
   if (direct) {
     for (const [key, val] of Object.entries(direct.headers || {})) {
@@ -922,6 +1523,7 @@ function encodeResult(value, headers, status, codec, signal) {
     });
   }
   if (value === undefined) {
+    headers.set(BODY_FORMAT_HEADER, BodyFormat.Void);
     return new Response(null, {
       status,
       headers
@@ -938,11 +1540,25 @@ function encodeResult(value, headers, status, codec, signal) {
     }
   } catch {
   }
-  const response = serializedResponse(value, headers, codec, signal);
-  return status === 200 ? response : new Response(response.body, {
-    status,
-    headers
-  });
+  try {
+    const response = serializedResponse(value, headers, codec, signal);
+    return status === 200 ? response : new Response(response.body, {
+      status,
+      headers
+    });
+  } catch (error) {
+    throw DEV && error instanceof Error ? new Error(`Server function result could not be encoded: ${error.message}`) : error;
+  }
+}
+const ERROR_HEADER_VALUE_LIMIT = 1024;
+function boundedErrorHeaderValue(message) {
+  let label = message.length > 256 ? message.slice(0, 256) : message;
+  let encoded = encodeErrorHeaderValue(label);
+  while (encoded.length > ERROR_HEADER_VALUE_LIMIT && label.length > 1) {
+    label = label.slice(0, Math.ceil(label.length / 2));
+    encoded = encodeErrorHeaderValue(label);
+  }
+  return encoded;
 }
 const GENERIC_SERVER_ERROR_MESSAGE = "Internal Server Error";
 let DEV = true === true;
@@ -957,9 +1573,21 @@ function sanitizeServerError(value) {
 function observeServerFunctionCalls() {
   return () => {};
 }
+function serverFunctionUrl(id, boundArgs) {
+  const address = serverFunctionAddress(config.endpoint, id);
+  if (!boundArgs || !boundArgs.length) return address;
+  if (!isJSONSafe(boundArgs)) {
+    throw new Error("Bound arguments in an action url must be JSON-safe: the server reads them the way it " + "reads a form post's, and that convention has no codec. Pass the value through the " + "function's body, or call the reference instead of rendering a url for it.");
+  }
+  return `${address}?args=${encodeURIComponent(JSON.stringify(boundArgs))}`;
+}
+function parseServerFunctionUrl(url) {
+  const parsed = parseServerFunctionAddress(new URL(url, "http://localhost").pathname, config.endpoint);
+  return parsed && parsed.id;
+}
 async function matchesOrigin(origin, request, matcher) {
   if (matcher === undefined) return origin === new URL(request.url).origin;
-  if (typeof matcher === "function") return !!(await matcher(origin, request));
+  if (typeof matcher === "function") return (await matcher(origin, request)) === true;
   return Array.isArray(matcher) ? matcher.includes(origin) : origin === matcher;
 }
 async function allowsServerFunctionRequest(request, options) {
@@ -1014,49 +1642,121 @@ function forbiddenResponse() {
 async function handleServerFunctionRequest(request, options = {}) {
   const codec = options.codec !== undefined ? options.codec : getServerFunctionsCodec();
   const url = new URL(request.url);
+  const method = request.method;
+  const address = resolveAddress(url);
+  const functionId = address && address.id;
+  const declaredRead = (method === "GET" || method === "HEAD") && functionId !== null && METHODS.get(functionId) === "GET";
   const csrf = options.csrf !== undefined ? options.csrf : config.csrf;
-  const protectsRequest = csrf !== false;
+  const protectsRequest = csrf !== false && (!declaredRead || typeof csrf === "object" && csrf.protectDeclaredReads === true);
+  let serverFunction;
+  if (functionId) {
+    try {
+      serverFunction = getServerFunction(functionId);
+    } catch {
+      return finalizeTransportResponse(new Response(DEV ? `Unknown server function: ${functionId}` : null, {
+        status: 404,
+        headers: {
+          [UNKNOWN_HEADER]: "true"
+        }
+      }), method);
+    }
+  }
   if (protectsRequest && !(await allowsServerFunctionRequest(request, csrf === true ? {} : csrf))) {
-    return forbiddenResponse();
+    return finalizeTransportResponse(forbiddenResponse(), method);
   }
   const instance = request.headers.get(INSTANCE_HEADER);
-  const functionId = resolveFunctionId(request, url);
   if (!functionId) {
     const response = new Response(DEV ? "Server function not found" : null, {
       status: 404
     });
-    return protectsRequest ? withCSRFVary(response) : response;
-  }
-  let serverFunction;
-  try {
-    serverFunction = getServerFunction(functionId);
-  } catch {
-    const response = new Response(DEV ? `Unknown server function: ${functionId}` : null, {
-      status: 404
-    });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
-  if (request.method === "GET" && METHODS.get(functionId) !== "GET") {
+  const scripted = address.data;
+  if (method !== "POST" && !declaredRead) {
     const response = new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
       status: 405,
       headers: {
-        Allow: "POST"
+        Allow: METHODS.get(functionId) === "GET" ? "POST, GET, HEAD" : "POST"
       }
     });
-    return protectsRequest ? withCSRFVary(response) : response;
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+  }
+  const bodySizeLimit = options.bodySizeLimit !== undefined ? options.bodySizeLimit : config.bodySizeLimit;
+  const argsEncoding = url.searchParams.get("args");
+  if (argsEncoding !== null && argsEncoding.length > bodySizeLimit) {
+    const response = new Response(DEV ? "Server function arguments exceed the configured bodySizeLimit" : null, {
+      status: 413
+    });
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+  }
+  if (method === "POST" && request.body !== null && bodySizeLimit !== Infinity) {
+    const raw = request.headers.get("content-length");
+    const declared = raw !== null && /^\d+$/.test(raw) ? Number(raw) : NaN;
+    if (declared > bodySizeLimit) {
+      const response = new Response(DEV ? "Server function request body exceeds the configured bodySizeLimit" : null, {
+        status: 413
+      });
+      return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+    }
+    if (!(declared > 0)) {
+      const bounded = await bufferBodyWithin(request, bodySizeLimit);
+      if (bounded === null) {
+        const response = new Response(DEV ? "Server function request body exceeds the configured bodySizeLimit" : null, {
+          status: 413
+        });
+        return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+      }
+      request = bounded;
+    }
   }
-  const event = options.createEvent ? options.createEvent(request) : {
+  let event = options.createEvent ? options.createEvent(request) : {
     request,
     locals: {}
   };
+  if (typeof event?.then === "function") event = await event;
+  const refuseCommitted = raw => {
+    const response = commitEventResponse(raw, event);
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+  };
   const provide = options.provideEvent || provideEvent;
   const flightHook = options.collectFlightData !== undefined ? options.collectFlightData : config.collectFlightData;
   const transformResult = options.transformResult !== undefined ? options.transformResult : config.transformResult;
   const wrapInvocation = options.wrapInvocation !== undefined ? options.wrapInvocation : config.wrapInvocation;
   const transformFlightResult = options.transformFlightResult !== undefined ? options.transformFlightResult : config.transformFlightResult;
-  const handleNoJS = options.handleNoJS !== undefined ? options.handleNoJS : config.handleNoJS !== undefined ? config.handleNoJS : isFormPost(request) ? defaultNoJSHandler || (defaultNoJSHandler = createNoJSHandler()) : undefined;
-  const collectsFlight = !!(flightHook && instance && request.headers.has(SINGLE_FLIGHT_HEADER));
-  const parsed = await parseArguments(request, url, instance, codec);
+  let handleNoJS = options.handleNoJS !== undefined ? options.handleNoJS : config.handleNoJS;
+  if (handleNoJS === undefined && !scripted && isFormPost(request)) {
+    const fetchMode = request.headers.get("Sec-Fetch-Mode");
+    if (fetchMode === null || fetchMode === "navigate") {
+      handleNoJS = defaultNoJSHandler || (defaultNoJSHandler = createNoJSHandler());
+    } else {
+      const response = new Response(DEV ? "The bare server-function address answers form navigations with the " + "no-JS redirect convention. Scripted callers use the data address " + `(…/data/${functionId}) or send the ${BODY_FORMAT_HEADER} tag.` : null, {
+        status: 400
+      });
+      return refuseCommitted(response);
+    }
+  }
+  const flightHeader = scripted && method === "POST" ? request.headers.get(SINGLE_FLIGHT_HEADER) : null;
+  const flightHooks = flightHeader ? flightHeader.split(",").flatMap(source => {
+    const hook = source === "true" ? flightHook : flightSources.get(source);
+    return hook ? [[source, hook]] : [];
+  }) : [];
+  const collectsFlight = flightHooks.length > 0;
+  let parsed;
+  try {
+    parsed = await parseArguments(request, url, scripted, codec);
+  } catch {
+    const response = new Response(DEV ? "Malformed server function arguments" : null, {
+      status: 400
+    });
+    return refuseCommitted(response);
+  }
+  const maxArguments = options.maxArguments !== undefined ? options.maxArguments : config.maxArguments;
+  if (parsed.length > maxArguments) {
+    const response = new Response(DEV ? "Server function call exceeds the configured maxArguments" : null, {
+      status: 400
+    });
+    return refuseCommitted(response);
+  }
   const flightContext = {
     id: functionId,
     args: parsed,
@@ -1092,25 +1792,29 @@ async function handleServerFunctionRequest(request, options = {}) {
           response,
           value
         } = result;
-        if (!instance && !handleNoJS && response && response.body) {
+        if (!scripted && !handleNoJS && response && response.body) {
           return response;
         }
         if (response && response.headers) {
           mergeResponseHeaders(headers, response.headers);
         }
-        if (response && response.status && (response.status < 300 || response.status >= 400)) {
+        if (response && response.status && (!scripted || !validRedirectStatuses.has(response.status))) {
           status = response.status;
+        } else if (response && response.status) {
+          maskRedirect(headers, response, request.url);
         }
         metadata = response;
         result = value;
       } else if (result instanceof Response) {
         if (result.headers && result.headers.has("X-Content-Raw")) return result;
-        if (instance) {
+        if (scripted) {
           if (result.headers) {
             mergeResponseHeaders(headers, result.headers);
           }
-          if (result.status && (result.status < 300 || result.status >= 400)) {
+          if (result.status && !validRedirectStatuses.has(result.status)) {
             status = result.status;
+          } else if (result.status) {
+            maskRedirect(headers, result, request.url);
           }
           metadata = result;
           if (result.body == null) {
@@ -1119,7 +1823,7 @@ async function handleServerFunctionRequest(request, options = {}) {
         }
       }
       if (collectsFlight) {
-        result = await foldFlightData(flightHook, event, headers, {
+        result = await foldFlightData(flightHooks, event, headers, {
           id: functionId,
           value: result,
           response: metadata,
@@ -1128,19 +1832,37 @@ async function handleServerFunctionRequest(request, options = {}) {
         }, flightContext);
         if (result instanceof Response && result.headers.has("X-Content-Raw")) return result;
       }
-      if (!instance) {
-        if (handleNoJS) return handleNoJS(result, request, parsed);
+      if (!scripted) {
+        if (handleNoJS) return handleNoJS(result ?? metadata, request, parsed);
         if (result instanceof Response) return result;
-        return encodeResult(result, headers, 200, codec, request.signal);
+        return encodeResult(result, headers, status, codec, request.signal);
       }
+      if (status === 304) warnScripted304(functionId);
       return encodeResult(result, headers, status, codec, request.signal);
     } catch (x) {
+      const respondThrown = value => {
+        const safe = sanitizeServerError(value);
+        if (!scripted) {
+          if (handleNoJS) return handleNoJS(safe, request, parsed, true);
+          const message = safe instanceof Error ? safe.message : String(safe);
+          return new Response(DEV ? message : null, {
+            status: 500
+          });
+        }
+        const error = safe instanceof Error ? safe.message : typeof safe === "string" ? safe : "true";
+        headers.set(ERROR_HEADER, boundedErrorHeaderValue(error));
+        return encodeResult(safe, headers, 500, codec, request.signal);
+      };
       if (x instanceof Response || isResponseEnvelope(x)) {
         if (transformResult) {
-          x = await transformResult(event, x, {
-            ...flightContext,
-            thrown: true
-          });
+          try {
+            x = await transformResult(event, x, {
+              ...flightContext,
+              thrown: true
+            });
+          } catch (hookError) {
+            return respondThrown(hookError);
+          }
         }
         let status = 200;
         let metadata;
@@ -1152,8 +1874,10 @@ async function handleServerFunctionRequest(request, options = {}) {
           if (response && response.headers) {
             mergeResponseHeaders(headers, response.headers);
           }
-          if (response && response.status && (!instance || response.status < 300 || response.status >= 400)) {
+          if (response && response.status && (!scripted || !validRedirectStatuses.has(response.status))) {
             status = response.status;
+          } else if (response && response.status) {
+            maskRedirect(headers, response, request.url);
           }
           metadata = response;
           x = value;
@@ -1161,8 +1885,10 @@ async function handleServerFunctionRequest(request, options = {}) {
           if (x.headers) {
             mergeResponseHeaders(headers, x.headers);
           }
-          if (x.status && (!instance || x.status < 300 || x.status >= 400)) {
+          if (x.status && (!scripted || !validRedirectStatuses.has(x.status))) {
             status = x.status;
+          } else if (x.status) {
+            maskRedirect(headers, x, request.url);
           }
           metadata = x;
           if (x.body == null) {
@@ -1170,7 +1896,7 @@ async function handleServerFunctionRequest(request, options = {}) {
           }
         }
         if (collectsFlight) {
-          x = await foldFlightData(flightHook, event, headers, {
+          x = await foldFlightData(flightHooks, event, headers, {
             id: functionId,
             value: x,
             response: metadata,
@@ -1178,47 +1904,77 @@ async function handleServerFunctionRequest(request, options = {}) {
             thrown: true
           }, flightContext);
           if (x instanceof Response && x.headers.has("X-Content-Raw")) {
+            x = ownResponse(x);
             x.headers.set(ERROR_HEADER, "true");
             return x;
           }
         }
         headers.set(ERROR_HEADER, "true");
-        if (!instance) {
+        if (!scripted) {
           if (handleNoJS) return handleNoJS(x ?? metadata, request, parsed, true);
           if (x instanceof Response) return x;
         }
+        if (scripted && status === 304) warnScripted304(functionId);
         return encodeResult(x, headers, status, codec, request.signal);
       }
-      const safe = sanitizeServerError(x);
-      if (!instance) {
-        if (handleNoJS) return handleNoJS(safe, request, parsed, true);
-        const message = safe instanceof Error ? safe.message : String(safe);
-        return new Response(DEV ? message : null, {
-          status: 500
-        });
-      }
-      const error = safe instanceof Error ? safe.message : typeof safe === "string" ? safe : "true";
-      headers.set(ERROR_HEADER, encodeErrorHeaderValue(error));
-      return encodeResult(safe, headers, 200, codec, request.signal);
+      return respondThrown(x);
     }
   };
-  const response = commitEventResponse(await dispatch(), event);
-  return protectsRequest ? withCSRFVary(response) : response;
+  const response = commitEventResponse(enforceComposedHeaderInvariants(ownResponse(await dispatch())), event);
+  return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+}
+function ownResponse(response) {
+  try {
+    return new Response(response.body, response);
+  } catch {
+    return response;
+  }
+}
+function finalizeTransportResponse(response, method) {
+  const stripBody = method === "HEAD" && response.body !== null;
+  const defaultsCache = !response.headers.has("Cache-Control") && response.status !== 304;
+  if (stripBody || defaultsCache) {
+    try {
+      if (defaultsCache) {
+        response.headers.set("Cache-Control", "no-store");
+      }
+      if (!stripBody) return response;
+      response.body.cancel().catch(() => {});
+      return new Response(null, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      });
+    } catch {
+      const headers = new Headers(response.headers);
+      if (defaultsCache && !headers.has("Cache-Control")) headers.set("Cache-Control", "no-store");
+      if (stripBody) response.body.cancel().catch(() => {});
+      return new Response(stripBody ? null : response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
+    }
+  }
+  return response;
 }
 
 exports.ERROR_HEADER = ERROR_HEADER;
 exports.FLASH_COOKIE = FLASH_COOKIE;
-exports.FUNCTION_HEADER = FUNCTION_HEADER;
 exports.GENERIC_SERVER_ERROR_MESSAGE = GENERIC_SERVER_ERROR_MESSAGE;
 exports.GET = GET;
 exports.INSTANCE_HEADER = INSTANCE_HEADER;
+exports.REDIRECT_HEADER = REDIRECT_HEADER;
+exports.SERVER_FUNCTION_INVOKE = SERVER_FUNCTION_INVOKE;
 exports.SINGLE_FLIGHT_HEADER = SINGLE_FLIGHT_HEADER;
+exports.UNKNOWN_HEADER = UNKNOWN_HEADER;
 exports.clearFlashCookie = clearFlashCookie;
 exports.configureServerFunctionsServer = configureServerFunctionsServer;
 exports.createNoJSHandler = createNoJSHandler;
 exports.createServerReference = createServerReference;
 exports.decodeErrorHeaderValue = decodeErrorHeaderValue;
 exports.decodeFlashCookie = decodeFlashCookie;
+exports.decodeRedirectHeaderValue = decodeRedirectHeaderValue;
 exports.decodeResponse = decodeResponse;
 exports.decodeResponsePayload = decodeResponsePayload;
 exports.encodeErrorHeaderValue = encodeErrorHeaderValue;
@@ -1228,15 +1984,20 @@ exports.getEventServerFunctionInvocation = getEventServerFunctionInvocation;
 exports.getServerFunction = getServerFunction;
 exports.getServerFunctionInvocation = getServerFunctionInvocation;
 exports.getServerFunctionMetadata = getServerFunctionMetadata;
+exports.guardFailures = guardFailures;
 exports.handleServerFunctionRequest = handleServerFunctionRequest;
 exports.hasFlashCookie = hasFlashCookie;
+exports.invoke = invoke;
 exports.isServerFunction = isServerFunction;
 exports.live = live;
 exports.observeServerFunctionCalls = observeServerFunctionCalls;
+exports.parseServerFunctionUrl = parseServerFunctionUrl;
+exports.registerFlightDataSource = registerFlightDataSource;
 exports.registerServerFunction = registerServerFunction;
 exports.registerServerReference = registerServerReference;
 exports.sanitizeServerError = sanitizeServerError;
 exports.serializeResponseStream = serializeResponseStream;
+exports.serverFunctionUrl = serverFunctionUrl;
 exports.setServerFunctionsDev = setServerFunctionsDev;
 exports.subscribeFlightData = subscribeFlightData;
 exports.withMeta = withMeta;