@solidjs/web 2.0.0-rc.3 → 2.0.0-rc.5

package/types-cjs/server-functions/client.d.cts

@@ -1,7 +1,8 @@
-export { ChunkReader, ERROR_HEADER, FLASH_COOKIE, FUNCTION_HEADER, INSTANCE_HEADER, SINGLE_FLIGHT_HEADER, clearFlashCookie, createChunk, decodeErrorHeaderValue, decodeResponse, decodeResponsePayload, deserializeStream, encodeErrorHeaderValue, frameAddress, getFlightDataConsumer, getServerFunctionMetadata, getServerFunctionsCodec, hasFlashCookie, isServerFunction, serializeString, subscribeFlightData, withMeta } from "./shared.cjs";
+import type { ServerFunction, ServerFunctionMetadata } from "./shared.cjs";
+export { ChunkReader, ERROR_HEADER, FLASH_COOKIE, INSTANCE_HEADER, REDIRECT_HEADER, SERVER_FUNCTION_INVOKE, SINGLE_FLIGHT_HEADER, UNKNOWN_HEADER, clearFlashCookie, createChunk, decodeErrorHeaderValue, decodeRedirectHeaderValue, decodeResponse, decodeResponsePayload, deserializeStream, encodeErrorHeaderValue, frameAddress, getFlightDataConsumer, getFlightDataSourceIds, getServerFunctionMetadata, getServerFunctionsCodec, hasFlashCookie, invoke, isServerFunction, serializeString, subscribeFlightData, withMeta } from "./shared.cjs";
 export { REVALIDATE_HEADER } from "../response.cjs";
 import { JSONCodecOptions } from "../serializer-decode.cjs";
-export type { FlightDataConsumer, FlightDataContext, ServerFunction, ServerFunctionMetadata, SingleFlightPayload } from "./shared.cjs";
+export type { FlightDataConsumer, FlightDataContext, InvokeOptions, ServerFunction, ServerFunctionInvoker, ServerFunctionMetadata, SingleFlightPayload } from "./shared.cjs";
 /** The context `prepareRequest` receives alongside the outgoing RequestInit. */
 export interface PrepareRequestContext {
     /** The build-stable id of the function being called. */
@@ -25,10 +26,11 @@ export type PrepareRequestHook = (init: RequestInit, context: PrepareRequestCont
 /** Options for `configureServerFunctionsClient`. */
 export interface ServerFunctionsClientConfig {
     /**
-     * Endpoint the server's HTTP handler is mounted on. Must match the
-     * server configuration — SSR'd reference `url`s (e.g. form actions) and
-     * client fetches both derive from it. Prefix it when the app serves from
-     * a base path (e.g. `` `${BASE_URL}_server` ``).
+     * Mount path the server's HTTP handler answers on. Must match the server
+     * configuration — the id travels as the segment after it, and SSR'd
+     * reference `url`s (e.g. form actions) and client fetches both derive
+     * from it. Prefix it when the app serves from a base path
+     * (e.g. `` `${BASE_URL}_server` ``).
      * @default "/_server"
      */
     endpoint?: string;
@@ -38,6 +40,34 @@ export interface ServerFunctionsClientConfig {
      * `decodeResponse` sees them too.
      */
     codec?: JSONCodecOptions;
+    /**
+     * Sends every server-function request — retries, telemetry, a test
+     * double, or an app's own route. Always called as `(address, init)`, the
+     * address relative to the document as the global one receives it, so
+     * `parseServerFunctionUrl` reads the id back out for telemetry. `null`
+     * restores the global.
+     *
+     * ```ts
+     * configureServerFunctionsClient({
+     *   fetch: (address, init) => fetch(rewrite(address), init)
+     * });
+     * ```
+     *
+     * Forward `init` — the call's `signal` rides on it, and dropping it voids
+     * both the caller's abort and the teardown a live source's `break`
+     * performs. Keep the call same-origin, since a cross-origin send is
+     * stamped `Sec-Fetch-Site: cross-site` and the handler's origin gate
+     * refuses it, and hand back what the peer answered, unread.
+     *
+     * A retrying wrapper may re-send a request that got NO response; it must
+     * never replay one whose response ended. A response that dies mid-body may
+     * have executed (mutations are not idempotent), and reconnecting a live
+     * source is the runtime's job — a replay would race it.
+     *
+     * The wrapper replaces delivery for the requests the runtime chooses to
+     * send; the call-to-request mapping itself is not contractual.
+     */
+    fetch?: ((address: string, init: RequestInit) => Response | Promise<Response>) | null;
     /**
      * Runs before every server-function fetch. Return (or mutate and return)
      * the RequestInit the transport will use; `context.meta` is the
@@ -125,9 +155,30 @@ export interface ServerFunctionInvocation {
     id: string;
 }
 export declare function observeServerFunctionCalls(observer: (call: ServerFunctionCall) => void): () => void;
+export declare function serverFunctionUrl(id: string, boundArgs?: readonly unknown[]): string;
+export declare function parseServerFunctionUrl(url: string): string | null;
 export declare function configureServerFunctionsClient(config?: ServerFunctionsClientConfig): void;
 export declare function createServerReference(id: string, name?: string, base?: string): ServerFunction;
 export declare function GET<A extends readonly any[], R>(fn: (...args: A) => R): ServerFunction<A, Awaited<R>>;
-export declare function live<A extends readonly any[], R>(fn: (...args: A) => R): ServerFunction<A, LiveSource<Awaited<R>>>;
+export interface LiveServerFunction<A extends readonly any[] = any[], R = any> {
+    (...args: A): LiveSource<R>;
+    /** The build-stable function id (stable across the client and server builds). */
+    readonly id: string;
+    /** URL invoking this function directly over HTTP. */
+    readonly url: string;
+}
+/**
+ * Declares a value-shaped live source: a server function returning an async
+ * iterable whose yields are successive VALUES of one logical query, with the
+ * contract that the source re-yields current state on every invocation.
+ * Calls to the returned reference produce an iterable that survives the
+ * connection — post-connect deaths re-invoke with exponential backoff
+ * (reset per healthy value, woken early by connectivity returning),
+ * first-connect failures reject like a normal call, and `break` aborts the
+ * in-flight request. Live calls are reads and never opt into single-flight
+ * enveloping. Wire state, if wanted, rides the returned iterable's
+ * `onstatus` hook. Compose with `GET` inside-out: `live(GET(fn))`.
+ */
+export declare function live<A extends readonly any[], R>(fn: (...args: A) => R): LiveServerFunction<A, Awaited<R>>;
 export declare function registerServerReference(): never;
 export declare function getServerFunctionInvocation(): ServerFunctionInvocation | undefined;

package/types-cjs/server-functions/flash.d.cts

@@ -13,6 +13,15 @@ export interface FlashSubmission {
     result?: any;
     /** The thrown value, when the call threw. */
     error?: any;
+    /**
+     * Set when the outcome was too large for the cookie's 4 KB ceiling and
+     * was degraded to fit (#3137): the input echo is dropped, and `result` /
+     * `error` may carry a bounded prefix — or the bare outcome flag `true` —
+     * rather than the full value. The submission still says what happened
+     * and where; integrations should render it as "succeeded (result too
+     * large to display)" rather than replaying the value.
+     */
+    truncated?: boolean;
 }
 export declare function encodeFlashCookie(url: string, result: any, input: any[], thrown?: boolean): string;
 export declare function decodeFlashCookie(cookieHeader: string | null): FlashSubmission | undefined;

package/types-cjs/server-functions/registry.d.cts

@@ -1,4 +1,5 @@
-export type { ServerFunction, ServerFunctionMetadata, ServerFunctionRPC } from "./shared.cjs";
+export type { InvokeOptions, ServerFunction, ServerFunctionInvoker, ServerFunctionMetadata, ServerFunctionRPC } from "./shared.cjs";
+import type { InvokeOptions } from "./shared.cjs";
 export declare const SERVER_FUNCTION_METADATA: unique symbol;
 /**
  * Reads a server function reference's declaration metadata (e.g.
@@ -45,6 +46,42 @@ export declare function isServerFunction(fn: any): boolean;
  * ```
  */
 export declare function withMeta(fn: any, meta: any): any;
+export declare const SERVER_FUNCTION_INVOKE: unique symbol;
+/**
+ * Applies a server function once with per-call, invocation-scoped options —
+ * `Function.prototype.call` for server functions, the options bag in the
+ * `thisArg` slot (declaration wrappers like `GET` and `withMeta` are `bind`:
+ * they return a new reference with context baked in; `invoke` applies one
+ * call and leaves no residue on the reference).
+ *
+ * ```ts
+ * import { invoke } from "@solidjs/web/server-functions";
+ *
+ * const user = await invoke(getUser, { signal: controller.signal }, id);
+ * ```
+ *
+ * Options are strictly invocation-scoped — things that vary between calls
+ * of the SAME function and cannot be declared or configured: `signal`
+ * (the call's lifecycle; aborting rejects the call and cancels the
+ * request), `keepalive` (calls made while the page unloads), `priority`
+ * (fetch priority hint). Anything with a longer lifetime is refused with a
+ * pointer to its home: session-dynamic transport policy → `prepareRequest`;
+ * declaration-static shape → `GET`/`withMeta`; call policy (retries,
+ * dedupe, deadlines) → the data layer that owns the call, wired through
+ * `signal`.
+ *
+ * Dispatches through the reference's invocation channel
+ * (`SERVER_FUNCTION_INVOKE`). Core's declaration wrappers forward it —
+ * `GET` invokes over its query encoding, `live` ends its iteration on
+ * abort. Wrappers that share calls (caches, channels) may adapt or decline
+ * it; a data layer needs neither — it holds the reference below such
+ * wrappers and invokes it directly with its own signal. On the server the
+ * call runs in-process: `signal`
+ * rejects the caller (the work, like a server behind HTTP, runs on unless
+ * the function observes a signal itself) and the transport hints are
+ * no-ops, since they describe a wire that does not exist.
+ */
+export declare function invoke<A extends readonly any[], R>(fn: (...args: A) => R, options: InvokeOptions, ...args: A): R;
 export declare const LIVE_SOURCE: unique symbol;
 /**
  * Fills the RPC seam. Called by the transport halves (client fetch RPC,

package/types-cjs/server-functions/server.d.cts

@@ -1,9 +1,10 @@
-export { ERROR_HEADER, FLASH_COOKIE, FUNCTION_HEADER, INSTANCE_HEADER, SINGLE_FLIGHT_HEADER, clearFlashCookie, decodeErrorHeaderValue, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, getServerFunctionMetadata, hasFlashCookie, isServerFunction, subscribeFlightData, withMeta } from "./shared.cjs";
+export { ERROR_HEADER, FLASH_COOKIE, INSTANCE_HEADER, REDIRECT_HEADER, SERVER_FUNCTION_INVOKE, SINGLE_FLIGHT_HEADER, UNKNOWN_HEADER, clearFlashCookie, decodeErrorHeaderValue, decodeRedirectHeaderValue, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, getServerFunctionMetadata, hasFlashCookie, invoke, isServerFunction, subscribeFlightData, withMeta } from "./shared.cjs";
 export { decodeFlashCookie, encodeFlashCookie } from "./flash.cjs";
 import { ResponseEnvelope } from "../response.cjs";
 import { JSONCodecOptions } from "../serializer-decode.cjs";
 import { RequestEvent } from "../server.cjs";
-export type { FlightDataConsumer, FlightDataContext, ServerFunction, ServerFunctionMetadata, SingleFlightPayload } from "./shared.cjs";
+import type { ServerFunction, ServerFunctionMetadata } from "./shared.cjs";
+export type { FlightDataConsumer, FlightDataContext, InvokeOptions, ServerFunction, ServerFunctionInvoker, ServerFunctionMetadata, SingleFlightPayload } from "./shared.cjs";
 export type { FlashSubmission } from "./flash.cjs";
 /**
  * The request event a server function call runs under: the base
@@ -130,6 +131,18 @@ export interface ServerFunctionCSRFOptions {
      * @default false
      */
     allowRequestsWithoutOriginCheck?: boolean;
+    /**
+     * Applies the origin gate to GET-declared reads as well. By default the
+     * gate is skipped for declared reads: same-origin policy already keeps a
+     * cross-site caller from READING the response, and the gate's `Vary`
+     * fragments (or, on CDNs that ignore Vary, poisons) the shared-cache
+     * entries the `GET` helper exists to enable (#3071). The premise that
+     * skip rests on is `GET()`'s safety contract — declared reads are safe
+     * to EXECUTE from any origin (#3114). A deployment that does not rely
+     * on shared caches can enable this to gate its reads too.
+     * @default false
+     */
+    protectDeclaredReads?: boolean;
 }
 /** Options for `configureServerFunctionsServer`. */
 export interface ServerFunctionsServerConfig {
@@ -150,10 +163,13 @@ export interface ServerFunctionsServerConfig {
      */
     wrapInvocation?: WrapInvocationHook;
     /**
-     * The single-flight hook: produces the data payload folded into
+     * The unnamed single-flight hook: produces the data payload folded into
      * responses of calls that opted in (see `CollectFlightDataHook`).
      * Registered once by the integration that owns data production (a
-     * router); per-handler `collectFlightData` options override it.
+     * router); per-handler `collectFlightData` options override it. Other
+     * integrations contribute additively through
+     * `registerFlightDataSource(id, hook)` instead of competing for this
+     * slot.
      */
     collectFlightData?: CollectFlightDataHook;
     /**
@@ -208,10 +224,11 @@ export interface ServerFunctionsServerConfig {
      */
     handleNoJS?: ((result: unknown, request: Request, args: unknown[], thrown?: boolean) => Response | Promise<Response>) | null;
     /**
-     * Endpoint the HTTP handler is mounted on, used for the `url` of SSR'd
-     * references (e.g. form actions) — must match the client configuration.
-     * Prefix it when the app serves from a base path (e.g.
-     * `` `${BASE_URL}_server` ``).
+     * Mount path the HTTP handler answers on. Must match the client
+     * configuration — the id travels as the segment after it, a request whose
+     * path does not start with it is not a call, and SSR'd reference `url`s
+     * (e.g. form actions) derive from it. Prefix it when the app serves from
+     * a base path (e.g. `` `${BASE_URL}_server` ``).
      * @default "/_server"
      */
     endpoint?: string;
@@ -227,6 +244,24 @@ export interface ServerFunctionsServerConfig {
      * `decodeResponse` sees them too.
      */
     codec?: JSONCodecOptions;
+    /**
+     * Upper bound, in bytes, on a call's argument payload — the POST body,
+     * or the `?args=` query encoding. The payload is buffered and decoded
+     * before dispatch, so its cost is paid before application code can
+     * decline it; the bound is enforced up front and a request over it is
+     * refused with `413` before any decoding (#3115). Raise it for functions
+     * that accept large uploads, or set `Infinity` to remove the bound.
+     * @default 1_048_576 (1 MiB)
+     */
+    bodySizeLimit?: number;
+    /**
+     * Upper bound on the number of arguments a call may carry. The decoded
+     * argument array is spread into the function call, so an unbounded list
+     * forces a range error out of any function regardless of what it does;
+     * past the bound the request is refused with `400` (#3115).
+     * @default 1000
+     */
+    maxArguments?: number;
 }
 /**
  * A registered server function: its build-stable id paired with the
@@ -346,6 +381,16 @@ export interface HandleServerFunctionOptions {
     csrf?: boolean | ServerFunctionCSRFOptions;
     /** Overrides the configured codec options for this handler. */
     codec?: JSONCodecOptions;
+    /**
+     * Overrides the configured argument payload bound for this handler (see
+     * `ServerFunctionsServerConfig.bodySizeLimit`).
+     */
+    bodySizeLimit?: number;
+    /**
+     * Overrides the configured argument count bound for this handler (see
+     * `ServerFunctionsServerConfig.maxArguments`).
+     */
+    maxArguments?: number;
 }
 export interface ServerFunctionRequestCall {
     type: "request";
@@ -365,6 +410,7 @@ export interface ServerFunctionResponseCall {
 }
 export type ServerFunctionCall = ServerFunctionRequestCall | ServerFunctionResponseCall;
 export declare function configureServerFunctionsServer(config?: ServerFunctionsServerConfig): void;
+export declare function registerFlightDataSource(source: string, hook: CollectFlightDataHook): () => void;
 export declare function registerServerFunction<T extends any[], R>(id: string, callback: (...args: T) => R): (...args: T) => R;
 export declare function getServerFunction<T extends any[], R>(id: string): (...args: T) => R;
 export declare function registerServerReference<T extends any[], R>(id: string, fn: (...args: T) => R, name?: string): ServerFunctionReference<T, R>;
@@ -375,6 +421,8 @@ export declare function getServerFunctionInvocation(): ServerFunctionInvocation
 export declare function getEventServerFunctionInvocation(event: RequestEvent | undefined): ServerFunctionInvocation | undefined;
 export declare function foldSetCookies(headers: Headers, setCookies: readonly string[]): Headers;
 export declare function createNoJSHandler(options?: NoJSHandlerOptions): (result: unknown, request: Request, args: unknown[], thrown?: boolean) => Response;
+/** @internal */
+export declare function guardFailures(value: any, state: any): any;
 /**
  * The response-side codec stream: `serializeStream` (shared.js) hardened
  * with request-lifetime teardown. Server-only on purpose — the shared half
@@ -383,12 +431,14 @@ export declare function createNoJSHandler(options?: NoJSHandlerOptions): (result
  * An abort of `signal` (the platform fires request.signal when the caller's
  * fetch aborts or the tab goes away) or the consumer cancelling the
  * ReadableStream (how platforms surface a dropped connection to the body)
- * stops pending serialization and tears down a top-level async-iterable
- * value — the producer's `iterator.return()` runs, so generator `finally`
- * blocks execute instead of the server pumping a stream nobody is reading.
- * Top-level only: that is the value-tier shape ("return a stream from the
- * server function"); iterables nested inside user objects are consumed by
- * the codec directly and stay untouched.
+ * stops pending serialization and tears down EVERY async-iterable or
+ * ReadableStream source in the result graph, nested ones included (#3125) —
+ * each producer's `iterator.return()` / `reader.cancel()` runs, so
+ * generator `finally` blocks execute instead of the server pumping streams
+ * nobody is reading. The wiring rides guardFailures' walk: it already wraps
+ * every channel before the codec sees the value, so the demand gate and the
+ * teardown registry are threaded through its state (`{ items: rows() }` —
+ * a cursor beside a total — gets the same two guarantees as `return rows()`).
  */
 export declare function serializeResponseStream(value: any, codecOptions: any, signal: any): ReadableStream<any>;
 /** Message a sanitized (production) server error carries on the wire. */
@@ -396,4 +446,6 @@ export declare const GENERIC_SERVER_ERROR_MESSAGE = "Internal Server Error";
 export declare function setServerFunctionsDev(dev: boolean): void;
 export declare function sanitizeServerError(value: unknown): unknown;
 export declare function observeServerFunctionCalls(observer: (call: ServerFunctionCall) => void): () => void;
+export declare function serverFunctionUrl(id: string, boundArgs?: readonly unknown[]): string;
+export declare function parseServerFunctionUrl(url: string): string | null;
 export declare function handleServerFunctionRequest(request: Request, options?: HandleServerFunctionOptions): Promise<Response>;

package/types-cjs/server-functions/shared.d.cts

@@ -1,4 +1,4 @@
-export { LIVE_SOURCE, SERVER_FUNCTION_METADATA, getServerFunctionMetadata, getServerFunctionRPC, isServerFunction, provideServerFunctionRPC, withMeta } from "./registry.cjs";
+export { LIVE_SOURCE, SERVER_FUNCTION_INVOKE, SERVER_FUNCTION_METADATA, getServerFunctionMetadata, getServerFunctionRPC, invoke, isServerFunction, provideServerFunctionRPC, withMeta } from "./registry.cjs";
 export { FLASH_COOKIE, clearFlashCookie, hasFlashCookie, matchFlashCookie } from "../cookies.cjs";
 import { JSONCodecOptions } from "../serializer-decode.cjs";
 /**
@@ -8,19 +8,22 @@ import { JSONCodecOptions } from "../serializer-decode.cjs";
  * HTTP handler. Integrations decoding passthrough responses themselves (no
  * registered consumer) see this shape from `decodeResponse`. The top level
  * is reserved for the protocol — integration payload lives entirely under
- * `data`, which can be any codec-serializable value.
+ * `data`, the envelope keyed by source id (the unnamed registration's
+ * slice rides under the reserved id "true"); each slice can be any
+ * codec-serializable value.
  */
 export interface SingleFlightPayload<T = unknown, D = unknown> {
     /** The server function's return (or thrown) value. */
     value: T;
-    /** The integration-produced data payload. */
+    /** The integration-produced data payload, keyed by source id. */
     data: D;
 }
 /**
  * Envelope context delivered alongside single-flight data: the transport
- * response, whose headers carry the integration metadata (`Location` for
- * redirect-with-data, `X-Revalidate` keys) and status. The body is already
- * consumed — read `data` and `value` from the delivery, not from here.
+ * response, whose headers carry the integration metadata (the redirect
+ * carrier for redirect-with-data, `X-Revalidate` keys) and status. The
+ * body is already consumed — read `data` and `value` from the delivery,
+ * not from here.
  */
 export interface FlightDataContext {
     /** The HTTP response the data arrived on (metadata only). */
@@ -45,6 +48,42 @@ export interface ServerFunction<A extends readonly any[] = any[], T = any> {
     /** URL invoking this function directly over HTTP (form `action`s, raw fetches). */
     readonly url: string;
 }
+/**
+ * Per-call, invocation-scoped options for `invoke` — things that vary
+ * between calls of the SAME function and cannot be declared (`GET`,
+ * `withMeta`) or configured (`prepareRequest`). On the server the call is
+ * in-process: `signal` still rejects the caller, the transport hints are
+ * no-ops (they describe a wire that does not exist).
+ */
+export interface InvokeOptions {
+    /**
+     * The call's lifecycle. Aborting rejects the call with the signal's
+     * reason and cancels the request (firing `request.signal` server-side);
+     * a live source's iteration ends across reconnects. When provided, the
+     * signal owns the wire — timeouts compose through it
+     * (`AbortSignal.timeout`, `AbortSignal.any`).
+     */
+    signal?: AbortSignal;
+    /**
+     * Lets the request outlive the page — fire-and-forget calls during
+     * unload (`pagehide`). Maps to fetch's `keepalive`, body-size caps
+     * included.
+     */
+    keepalive?: boolean;
+    /** Fetch priority hint — speculative prefetch vs. interaction fetch. */
+    priority?: "high" | "low" | "auto";
+}
+/**
+ * A reference's invocation channel, carried under `SERVER_FUNCTION_INVOKE`:
+ * applies one call with per-call options. Declaration wrappers (`GET`,
+ * `live`) forward it mechanically — they keep the call mapping 1:1. A
+ * wrapper that shares calls (a deduping cache, a multicast channel) opts
+ * in deliberately, deciding first what a caller's abort means for shared
+ * work — or declines, leaving `invoke` to answer with a directed error.
+ * Options arrive already validated — `invoke` admits only
+ * invocation-scoped keys.
+ */
+export type ServerFunctionInvoker<A extends readonly any[] = any[], R = any> = (args: A, options?: InvokeOptions) => R;
 /**
  * Declaration-static metadata attached to a server function reference
  * through declaration wrappers (`GET`, `withMeta`). Read it with
@@ -95,11 +134,27 @@ export interface ServerFunctionRPC {
 export type BodyFormatValue = (typeof BodyFormat)[keyof typeof BodyFormat];
 export declare function configureServerFunctionsCodec(codec: JSONCodecOptions | undefined): void;
 export declare function getServerFunctionsCodec(): JSONCodecOptions | undefined;
+/**
+ * Validates a flight data source id (both registration halves share the
+ * rule): ids travel the `SINGLE_FLIGHT_HEADER` as a comma-separated list,
+ * so they cannot be empty or contain commas, and "true" is reserved for
+ * the unnamed registration.
+ *
+ * Transport building block; not meant for hand-written code.
+ * @internal
+ */
+export declare function assertFlightSource(source: string): void;
 export declare function subscribeFlightData<D = unknown>(consumer: FlightDataConsumer<D>): () => void;
-export declare function getFlightDataConsumer(): FlightDataConsumer | undefined;
+export declare function subscribeFlightData<D = unknown>(source: string, consumer: FlightDataConsumer<D>): () => void;
+export declare function getFlightDataConsumer(source?: string): FlightDataConsumer | undefined;
+export declare function getFlightDataSourceIds(): string[];
 export declare function frameAddress(id: string, args?: readonly unknown[]): string;
-/** Header carrying the server function id. */
-export declare const FUNCTION_HEADER = "X-Server-Function-Id";
+export declare function serverFunctionAddress(endpoint: string, id: string): string;
+export declare function serverFunctionDataAddress(endpoint: string, id: string): string;
+export declare function parseServerFunctionAddress(pathname: string, endpoint: string): {
+    id: string;
+    data: boolean;
+} | null;
 /**
  * Response header marking a thrown server-function error. The value is the
  * error's message (the structured error itself travels in the body); `"true"`
@@ -115,6 +170,51 @@ export declare function decodeErrorHeaderValue(value: string): string;
 export declare const INSTANCE_HEADER = "X-Server-Function-Instance";
 /** Header carrying the body format tag (a `BodyFormat` value). */
 export declare const BODY_FORMAT_HEADER = "X-Server-Function-Format";
+/**
+ * Header labelling the unknown-id 404: the address was well-formed but its
+ * id is not registered in the deployment that answered (#3110). This is the
+ * ordinary shape of version skew — a tab holding the previous build's ids
+ * across a deploy — and the label is what lets an integration recover
+ * (e.g. reload the document) instead of surfacing a generic failed call.
+ * Nothing distinguishes it otherwise: a CDN 404 and a skew 404 look alike.
+ */
+export declare const UNKNOWN_HEADER = "X-Server-Function-Unknown";
+/**
+ * Header carrying a redirect to scripted callers. fetch FOLLOWS redirect
+ * statuses before the transport can read them, so a scripted answer masks
+ * the 3xx to 200 and this header carries what the mask erases: the author's
+ * status and the target RESOLVED against the request url — exactly the
+ * meaning HTTP assigns the `Location` a form post would have received.
+ * Value: `<status> <absolute-url>`, decode with `decodeRedirectHeaderValue`.
+ *
+ * Carrying the resolved absolute form is the point (#3102, #3107): the
+ * reader never guesses navigation strategy from how the author spelled the
+ * target — `redirect("/")` and `redirect(new URL("/", url).href)` arrive
+ * identical by construction, and same-origin vs cross-origin is a real URL
+ * comparison, not a `startsWith("http")` coin toss. `Location` itself never
+ * rides a masked answer: on a 200 it has no HTTP meaning, and it collided
+ * with authored Locations on statuses that forward (a 201's created-at is
+ * data, not navigation).
+ */
+export declare const REDIRECT_HEADER = "X-Server-Function-Redirect";
+/**
+ * Decodes a `REDIRECT_HEADER` value into the author's status and the
+ * resolved absolute target. Integration plumbing for readers of the header
+ * (routers); the wire format is the runtime's own, not a contract to parse
+ * by hand.
+ *
+ * The documented output — a resolved ABSOLUTE http(s) target and a redirect
+ * status — is enforced, not assumed (#3175): the absoluteness used to be a
+ * property of the server having resolved it, and a hostile or buggy peer
+ * could ride a `javascript:` target straight into the `location.href =
+ * decoded.url` an integration reasonably writes. A value that does not
+ * parse as an absolute http(s) url, or whose status is not one the runtime
+ * masks, decodes to `undefined` — the same answer a missing header gives.
+ */
+export declare function decodeRedirectHeaderValue(value: string | null | undefined): {
+    status: number;
+    url: string;
+} | undefined;
 /**
  * Header driving the single-flight protocol on both legs: on the request it
  * opts the call into flight-data collection (the integration sends it on
@@ -141,6 +241,13 @@ export declare const BodyFormat: {
      * included) on the response.
      */
     Json: string;
+    /**
+     * No body at all — a function that returned nothing. It marks the response
+     * as one the runtime encoded, which separates a void result with a status
+     * on it from a refusal answered by something else. Decoding falls through
+     * to `undefined`, which is what a peer predating the tag reads too.
+     */
+    Void: string;
 };
 export declare function isJSONSafe(value: unknown): boolean;
 export declare function getHeadersAndBody(body: unknown): {
@@ -157,15 +264,14 @@ export declare class ChunkReader {
         value: string;
     }>;
     drain(interpret: any): Promise<void>;
-} /**
- * Serializes a value as a stream of length-prefixed SerovalNode chunks.
- * Async values (promises, streams) keep the stream open until they settle,
- * so one connection carries incremental results. Codec options must match
- * the deserializing peer.
- *
- * Transport building block; not meant for hand-written code.
+}
+/**
+ * Encodes a terminal error-trailer frame payload. The value is expected to
+ * be already sanitized by the caller; only `name` and `message` travel.
+ * Transport wire detail; not meant for hand-written code.
  * @internal
  */
+export declare function encodeErrorTrailer(error: unknown): string;
 export declare function serializeStream(value: unknown, codecOptions?: JSONCodecOptions): ReadableStream<Uint8Array>;
 export declare function serializeString(value: unknown, codecOptions?: JSONCodecOptions): Promise<string>;
 export declare function deserializeStream<T = unknown>(source: Request | Response, codecOptions?: JSONCodecOptions): Promise<T>;

package/types-cjs/server-mock.d.cts

@@ -1,10 +1,23 @@
 import type { RequestEvent, RequestEventLocals, ResponseStub } from "./client.cjs";
+import type { JSX } from "./jsx.cjs";
+/** An explicit `<link rel="preload">` emitted by the SSR asset pipeline. */
+export type PreloadLink = {
+    href: string;
+    as: JSX.HTMLPreloadAs;
+    type?: string;
+    crossorigin?: JSX.HTMLCrossorigin;
+    integrity?: string;
+    referrerpolicy?: JSX.HTMLReferrerPolicy;
+    fetchpriority?: JSX.HTMLFetchPriority;
+    media?: string;
+};
 /** Static asset manifest produced by a build (e.g. parsed Vite manifest.json). */
 export type AssetManifest = Record<string, {
     file: string;
     css?: string[];
     isEntry?: boolean;
     imports?: string[];
+    preloads?: PreloadLink[];
 }> & {
     _base?: string;
 };
@@ -17,6 +30,7 @@ export type InlineStyleAsset = {
 export type ResolvedAssets = {
     js: string[];
     css: (string | InlineStyleAsset)[];
+    preloads?: PreloadLink[];
 };
 /**
  * Resolver form of the manifest option — the primitive a dev server
@@ -24,8 +38,9 @@ export type ResolvedAssets = {
  * normalized into a sync resolver internally). `resolve` may return a
  * promise (async resolvers require streaming rendering); CSS entries may be
  * URL strings (emitted as load-gated `<link>` tags) or inline-style
- * descriptors (emitted as `<style>` tags). A bare `resolve`-shaped function
- * is accepted as shorthand for `{ resolve }`.
+ * descriptors (emitted as `<style>` tags), and `preloads` carries explicit
+ * preload links selected by the integration. A bare `resolve`-shaped
+ * function is accepted as shorthand for `{ resolve }`.
  */
 export type AssetResolver = {
     resolve(key: string): ResolvedAssets | null | undefined | Promise<ResolvedAssets | null | undefined>;

package/types-cjs/server.d.cts

@@ -5,12 +5,24 @@ export { clearFlashCookie, hasFlashCookie } from "./cookies.cjs";
 export { getServerFunctionMetadata, getServerFunctionRPC, isServerFunction } from "./server-functions/registry.cjs";
 import { JSX } from "./jsx.cjs";
 import { SerializerPlugin } from "./serializer-decode.cjs";
+/** An explicit `<link rel="preload">` emitted by the SSR asset pipeline. */
+export type PreloadLink = {
+    href: string;
+    as: JSX.HTMLPreloadAs;
+    type?: string;
+    crossorigin?: JSX.HTMLCrossorigin;
+    integrity?: string;
+    referrerpolicy?: JSX.HTMLReferrerPolicy;
+    fetchpriority?: JSX.HTMLFetchPriority;
+    media?: string;
+};
 /** Static asset manifest produced by a build (e.g. parsed Vite manifest.json). */
 export type AssetManifest = Record<string, {
     file: string;
     css?: string[];
     isEntry?: boolean;
     imports?: string[];
+    preloads?: PreloadLink[];
 }> & {
     _base?: string;
 };
@@ -23,6 +35,7 @@ export type InlineStyleAsset = {
 export type ResolvedAssets = {
     js: string[];
     css: (string | InlineStyleAsset)[];
+    preloads?: PreloadLink[];
 };
 /**
  * Resolver form of the manifest option — the primitive a dev server
@@ -30,8 +43,9 @@ export type ResolvedAssets = {
  * normalized into a sync resolver internally). `resolve` may return a
  * promise (async resolvers require streaming rendering); CSS entries may be
  * URL strings (emitted as load-gated `<link>` tags) or inline-style
- * descriptors (emitted as `<style>` tags). A bare `resolve`-shaped function
- * is accepted as shorthand for `{ resolve }`.
+ * descriptors (emitted as `<style>` tags), and `preloads` carries explicit
+ * preload links selected by the integration. A bare `resolve`-shaped
+ * function is accepted as shorthand for `{ resolve }`.
  */
 export type AssetResolver = {
     resolve(key: string): ResolvedAssets | null | undefined | Promise<ResolvedAssets | null | undefined>;