@solidjs/web 2.0.0-rc.4 → 2.0.0-rc.5

package/dist/dev.cjs

@@ -215,7 +215,8 @@ function resourceIdentity(tag, props) {
   let id = "res:" + tag + ":" + (props.rel || "") + ":" + (props.href || props.src || "");
   for (let i = 0; i < RESOURCE_QUALIFIERS.length; i++) {
     const q = RESOURCE_QUALIFIERS[i];
-    if (props[q] != null) id += ":" + q + "=" + props[q];
+    const value = props[q];
+    if (value != null) id += ":" + q + "=" + (value === true ? "" : value);
   }
   return id;
 }
@@ -288,6 +289,7 @@ function decodeSafe(text) {
   }
 }
 function serializeCookie(name, value, options = {}) {
+  assertServableCookie(name, options);
   let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
   cookie += `; Path=${options.path === undefined ? "/" : options.path}`;
   if (options.domain) cookie += `; Domain=${options.domain}`;
@@ -295,12 +297,32 @@ function serializeCookie(name, value, options = {}) {
   if (options.expires) cookie += `; Expires=${options.expires.toUTCString()}`;
   if (options.httpOnly) cookie += "; HttpOnly";
   if (options.secure) cookie += "; Secure";
+  if (options.partitioned) cookie += "; Partitioned";
   if (options.sameSite) {
     const sameSite = options.sameSite.toLowerCase();
     cookie += `; SameSite=${sameSite === "none" ? "None" : sameSite === "strict" ? "Strict" : "Lax"}`;
   }
   return cookie;
 }
+function assertServableCookie(name, options) {
+  const reject = reason => {
+    throw new Error(`serializeCookie: every browser silently rejects this cookie — ${reason}. ` + `It would never come back on a request, with no error anywhere.`);
+  };
+  const lower = name.toLowerCase();
+  if (lower.startsWith("__host-")) {
+    if (!options.secure) reject(`the __Host- prefix on \`${name}\` requires \`secure: true\``);
+    if (options.path !== undefined && options.path !== "/") reject(`the __Host- prefix on \`${name}\` requires \`Path=/\` (got \`${options.path}\`) — ` + `host-locking is the prefix's whole contract, so it cannot be path-scoped`);
+    if (options.domain) reject(`the __Host- prefix on \`${name}\` forbids \`Domain\` (got \`${options.domain}\`)`);
+  } else if (lower.startsWith("__secure-") && !options.secure) {
+    reject(`the __Secure- prefix on \`${name}\` requires \`secure: true\``);
+  }
+  if (options.sameSite && options.sameSite.toLowerCase() === "none" && !options.secure) {
+    reject("`SameSite=None` requires `secure: true`");
+  }
+  if (options.partitioned && !options.secure) {
+    reject("`Partitioned` requires `secure: true`");
+  }
+}
 const FLASH_COOKIE = "flash";
 const FLASH_MATCHER = new RegExp(`(?:^|;\\s*)${FLASH_COOKIE}=([^;]+)`);
 function hasFlashCookie(cookieHeader) {
@@ -589,16 +611,18 @@ function setStyleProperty(node, name, value) {
 }
 function spread(node, props = {}, skipChildren) {
   const prevProps = {};
-  if (!skipChildren) insert(node, () => props.children);
+  const get = typeof props === "function" ? props : () => props;
+  if (!skipChildren) insert(node, () => get().children);
   effect(() => {
-    const r = props.ref;
+    const r = get().ref;
     (typeof r === "function" || Array.isArray(r)) && ref(() => r, node);
   }, () => {});
   effect(() => {
+    const source = get();
     const newProps = {};
-    for (const prop in props) {
+    for (const prop in source) {
       if (prop === "children" || prop === "ref") continue;
-      newProps[prop] = props[prop];
+      newProps[prop] = source[prop];
     }
     return newProps;
   }, props => assign(node, props, true, prevProps, true));
@@ -2092,6 +2116,7 @@ function isSafeError(value) {
   return !!(value && (typeof value === "object" || typeof value === "function") && value[SAFE_ERROR]);
 }
 const REVALIDATE_HEADER = "X-Revalidate";
+const RESPONSE_HEADER_VALUE_LIMIT = 4096;
 function initWithRevalidate(init = {}) {
   const resolved = typeof init === "number" ? {
     status: init
@@ -2112,7 +2137,13 @@ function initWithRevalidate(init = {}) {
   } else {
     headers = new Headers(responseInit.headers);
   }
-  revalidate !== undefined && headers.set(REVALIDATE_HEADER, revalidate.toString());
+  if (revalidate !== undefined) {
+    const keys = revalidate.toString();
+    if (keys.length > RESPONSE_HEADER_VALUE_LIMIT) {
+      throw new TypeError(`revalidate names ${keys.length} characters of cache keys; past ` + `${RESPONSE_HEADER_VALUE_LIMIT} the ${REVALIDATE_HEADER} header would overflow ` + `receivers (an 8 KiB proxy buffer holds the whole header block) and the response ` + `dies at the socket after the mutation committed. Split the invalidation across ` + `calls or use coarser keys — a dropped key would be a silently stale cache, so ` + `the runtime refuses rather than trims.`);
+    }
+    headers.set(REVALIDATE_HEADER, keys);
+  }
   return {
     responseInit,
     headers
@@ -2130,7 +2161,12 @@ function redirect(url, init = 302) {
     responseInit.status = 302;
   }
   const target = typeof url === "string" ? url : url[HREF];
-  headers.set("Location", typeof target === "string" ? target : String(url));
+  const location = typeof target === "string" ? target : String(url);
+  const encoded = location.replace(/[^\x00-\x7f]/gu, encodeURIComponent);
+  if (encoded.length > RESPONSE_HEADER_VALUE_LIMIT) {
+    throw new TypeError(`redirect() target is ${encoded.length} characters; past ` + `${RESPONSE_HEADER_VALUE_LIMIT} the Location header (and the scripted transport's ` + `redirect header) would overflow receivers and the response dies at the socket. ` + `A target this size is usually unbounded input echoed into the url — carry the ` + `state server-side instead. Refused rather than trimmed: a cut target is a ` + `different address.`);
+  }
+  headers.set("Location", encoded);
   return new Response(null, {
     ...responseInit,
     headers
@@ -2146,11 +2182,18 @@ function reload(init = {}) {
     headers
   });
 }
+const NULL_BODY_STATUSES = new Set([204, 205, 304]);
 function respond(value, init = {}) {
   const {
     responseInit,
     headers
   } = initWithRevalidate(init);
+  if (NULL_BODY_STATUSES.has(responseInit.status)) {
+    return new ResponseEnvelope(new Response(null, {
+      ...responseInit,
+      headers
+    }), value);
+  }
   headers.set("Content-Type", "application/json");
   return new ResponseEnvelope(new Response(JSON.stringify(value), {
     ...responseInit,
@@ -2368,8 +2411,10 @@ exports.Dynamic = Dynamic;
 exports.HREF = HREF;
 exports.HydrationScript = HydrationScript;
 exports.MathMLElements = MathMLElements;
+exports.NULL_BODY_STATUSES = NULL_BODY_STATUSES;
 exports.Namespaces = Namespaces;
 exports.Portal = Portal;
+exports.RESPONSE_HEADER_VALUE_LIMIT = RESPONSE_HEADER_VALUE_LIMIT;
 exports.REVALIDATE_HEADER = REVALIDATE_HEADER;
 exports.RawTextElements = RawTextElements;
 exports.RequestContext = RequestContext;

package/dist/dev.js

@@ -214,7 +214,8 @@ function resourceIdentity(tag, props) {
   let id = "res:" + tag + ":" + (props.rel || "") + ":" + (props.href || props.src || "");
   for (let i = 0; i < RESOURCE_QUALIFIERS.length; i++) {
     const q = RESOURCE_QUALIFIERS[i];
-    if (props[q] != null) id += ":" + q + "=" + props[q];
+    const value = props[q];
+    if (value != null) id += ":" + q + "=" + (value === true ? "" : value);
   }
   return id;
 }
@@ -287,6 +288,7 @@ function decodeSafe(text) {
   }
 }
 function serializeCookie(name, value, options = {}) {
+  assertServableCookie(name, options);
   let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
   cookie += `; Path=${options.path === undefined ? "/" : options.path}`;
   if (options.domain) cookie += `; Domain=${options.domain}`;
@@ -294,12 +296,32 @@ function serializeCookie(name, value, options = {}) {
   if (options.expires) cookie += `; Expires=${options.expires.toUTCString()}`;
   if (options.httpOnly) cookie += "; HttpOnly";
   if (options.secure) cookie += "; Secure";
+  if (options.partitioned) cookie += "; Partitioned";
   if (options.sameSite) {
     const sameSite = options.sameSite.toLowerCase();
     cookie += `; SameSite=${sameSite === "none" ? "None" : sameSite === "strict" ? "Strict" : "Lax"}`;
   }
   return cookie;
 }
+function assertServableCookie(name, options) {
+  const reject = reason => {
+    throw new Error(`serializeCookie: every browser silently rejects this cookie — ${reason}. ` + `It would never come back on a request, with no error anywhere.`);
+  };
+  const lower = name.toLowerCase();
+  if (lower.startsWith("__host-")) {
+    if (!options.secure) reject(`the __Host- prefix on \`${name}\` requires \`secure: true\``);
+    if (options.path !== undefined && options.path !== "/") reject(`the __Host- prefix on \`${name}\` requires \`Path=/\` (got \`${options.path}\`) — ` + `host-locking is the prefix's whole contract, so it cannot be path-scoped`);
+    if (options.domain) reject(`the __Host- prefix on \`${name}\` forbids \`Domain\` (got \`${options.domain}\`)`);
+  } else if (lower.startsWith("__secure-") && !options.secure) {
+    reject(`the __Secure- prefix on \`${name}\` requires \`secure: true\``);
+  }
+  if (options.sameSite && options.sameSite.toLowerCase() === "none" && !options.secure) {
+    reject("`SameSite=None` requires `secure: true`");
+  }
+  if (options.partitioned && !options.secure) {
+    reject("`Partitioned` requires `secure: true`");
+  }
+}
 const FLASH_COOKIE = "flash";
 const FLASH_MATCHER = new RegExp(`(?:^|;\\s*)${FLASH_COOKIE}=([^;]+)`);
 function hasFlashCookie(cookieHeader) {
@@ -588,16 +610,18 @@ function setStyleProperty(node, name, value) {
 }
 function spread(node, props = {}, skipChildren) {
   const prevProps = {};
-  if (!skipChildren) insert(node, () => props.children);
+  const get = typeof props === "function" ? props : () => props;
+  if (!skipChildren) insert(node, () => get().children);
   effect(() => {
-    const r = props.ref;
+    const r = get().ref;
     (typeof r === "function" || Array.isArray(r)) && ref(() => r, node);
   }, () => {});
   effect(() => {
+    const source = get();
     const newProps = {};
-    for (const prop in props) {
+    for (const prop in source) {
       if (prop === "children" || prop === "ref") continue;
-      newProps[prop] = props[prop];
+      newProps[prop] = source[prop];
     }
     return newProps;
   }, props => assign(node, props, true, prevProps, true));
@@ -2091,6 +2115,7 @@ function isSafeError(value) {
   return !!(value && (typeof value === "object" || typeof value === "function") && value[SAFE_ERROR]);
 }
 const REVALIDATE_HEADER = "X-Revalidate";
+const RESPONSE_HEADER_VALUE_LIMIT = 4096;
 function initWithRevalidate(init = {}) {
   const resolved = typeof init === "number" ? {
     status: init
@@ -2111,7 +2136,13 @@ function initWithRevalidate(init = {}) {
   } else {
     headers = new Headers(responseInit.headers);
   }
-  revalidate !== undefined && headers.set(REVALIDATE_HEADER, revalidate.toString());
+  if (revalidate !== undefined) {
+    const keys = revalidate.toString();
+    if (keys.length > RESPONSE_HEADER_VALUE_LIMIT) {
+      throw new TypeError(`revalidate names ${keys.length} characters of cache keys; past ` + `${RESPONSE_HEADER_VALUE_LIMIT} the ${REVALIDATE_HEADER} header would overflow ` + `receivers (an 8 KiB proxy buffer holds the whole header block) and the response ` + `dies at the socket after the mutation committed. Split the invalidation across ` + `calls or use coarser keys — a dropped key would be a silently stale cache, so ` + `the runtime refuses rather than trims.`);
+    }
+    headers.set(REVALIDATE_HEADER, keys);
+  }
   return {
     responseInit,
     headers
@@ -2129,7 +2160,12 @@ function redirect(url, init = 302) {
     responseInit.status = 302;
   }
   const target = typeof url === "string" ? url : url[HREF];
-  headers.set("Location", typeof target === "string" ? target : String(url));
+  const location = typeof target === "string" ? target : String(url);
+  const encoded = location.replace(/[^\x00-\x7f]/gu, encodeURIComponent);
+  if (encoded.length > RESPONSE_HEADER_VALUE_LIMIT) {
+    throw new TypeError(`redirect() target is ${encoded.length} characters; past ` + `${RESPONSE_HEADER_VALUE_LIMIT} the Location header (and the scripted transport's ` + `redirect header) would overflow receivers and the response dies at the socket. ` + `A target this size is usually unbounded input echoed into the url — carry the ` + `state server-side instead. Refused rather than trimmed: a cut target is a ` + `different address.`);
+  }
+  headers.set("Location", encoded);
   return new Response(null, {
     ...responseInit,
     headers
@@ -2145,11 +2181,18 @@ function reload(init = {}) {
     headers
   });
 }
+const NULL_BODY_STATUSES = new Set([204, 205, 304]);
 function respond(value, init = {}) {
   const {
     responseInit,
     headers
   } = initWithRevalidate(init);
+  if (NULL_BODY_STATUSES.has(responseInit.status)) {
+    return new ResponseEnvelope(new Response(null, {
+      ...responseInit,
+      headers
+    }), value);
+  }
   headers.set("Content-Type", "application/json");
   return new ResponseEnvelope(new Response(JSON.stringify(value), {
     ...responseInit,
@@ -2303,4 +2346,4 @@ _moduleUrl) {
 function httpStatus(_code, _text) {}
 function httpHeader(_name, _value, _options) {}
 
-export { ChildProperties, DOMElements, DOMWithState, DelegatedEvents, Dynamic, HREF, HydrationScript, MathMLElements, Namespaces, Portal, REVALIDATE_HEADER, RawTextElements, RequestContext, ResponseEnvelope, SAFE_ERROR, SVGElements, VoidElements, acquireAsset, addEvent, applyRef, assign, claimElement, claimElementTree, className, clearFlashCookie, clientOnly, commitEventResponse, composeMiddleware, createRequestEvent, createResponseStub, createSSRResponse, delegateEvents, driveList, dynamic, dynamicProperty, effect, escape, generateHydrationScript, getDelegatedRoot, getExpectedRedirectStatus, getFirstChild, getHydrationKey, getNextElement, getNextMarker, getNextMatch, getNextSibling, getRequestEvent, getServerFunctionMetadata, getServerFunctionRPC, hasFlashCookie, httpHeader, httpStatus, hydrate, insert, installHydrationRuntime, installListDriver, isDev, isHref, isResponseEnvelope, isSafeError, isServer, isServerFunction, listDriver, markSafeError, memo, parseCookieHeader, patchDriver, redirect, ref, registerDelegatedContainer, registerDelegatedRoot, registerElementClaim, reload, render, renderToStream, renderToString, resolveSSRNode, respond, rowProof, runHydrationEvents, scope, serializeCookie, setAttribute, setAttributeNS, setProperty, setStyleProperty, spread, ssr, ssrAttribute, ssrClassName, ssrElement, ssrGroup, ssrHydrationKey, ssrStyle, ssrStyleProperty, style, template, unregisterDelegatedContainer, unregisterDelegatedRoot, useHead, waitAsset, warmAsset };
+export { ChildProperties, DOMElements, DOMWithState, DelegatedEvents, Dynamic, HREF, HydrationScript, MathMLElements, NULL_BODY_STATUSES, Namespaces, Portal, RESPONSE_HEADER_VALUE_LIMIT, REVALIDATE_HEADER, RawTextElements, RequestContext, ResponseEnvelope, SAFE_ERROR, SVGElements, VoidElements, acquireAsset, addEvent, applyRef, assign, claimElement, claimElementTree, className, clearFlashCookie, clientOnly, commitEventResponse, composeMiddleware, createRequestEvent, createResponseStub, createSSRResponse, delegateEvents, driveList, dynamic, dynamicProperty, effect, escape, generateHydrationScript, getDelegatedRoot, getExpectedRedirectStatus, getFirstChild, getHydrationKey, getNextElement, getNextMarker, getNextMatch, getNextSibling, getRequestEvent, getServerFunctionMetadata, getServerFunctionRPC, hasFlashCookie, httpHeader, httpStatus, hydrate, insert, installHydrationRuntime, installListDriver, isDev, isHref, isResponseEnvelope, isSafeError, isServer, isServerFunction, listDriver, markSafeError, memo, parseCookieHeader, patchDriver, redirect, ref, registerDelegatedContainer, registerDelegatedRoot, registerElementClaim, reload, render, renderToStream, renderToString, resolveSSRNode, respond, rowProof, runHydrationEvents, scope, serializeCookie, setAttribute, setAttributeNS, setProperty, setStyleProperty, spread, ssr, ssrAttribute, ssrClassName, ssrElement, ssrGroup, ssrHydrationKey, ssrStyle, ssrStyleProperty, style, template, unregisterDelegatedContainer, unregisterDelegatedRoot, useHead, waitAsset, warmAsset };