@solidjs/web 2.0.0-rc.4 → 2.0.0-rc.5

package/dist/server.js

@@ -150,13 +150,13 @@ function resolveSerializerPlugins(customPlugins) {
 Feature.RegExp;
 
 const DEFAULT_DISABLED_FEATURES = Feature.AggregateError | Feature.BigIntTypedArray;
-const serializeOnlyDisabledFeatures = () => process.env.NODE_ENV === "development" ? 0 : Feature.ErrorPrototypeStack;
+const serializeOnlyDisabledFeatures = serializeErrorStacks => (serializeErrorStacks === undefined ? process.env.NODE_ENV === "development" : serializeErrorStacks) ? 0 : Feature.ErrorPrototypeStack;
 const HYDRATION_GLOBAL = "_$HY.r";
 function createSerializer(options) {
   return new Serializer({
     ...options,
     plugins: resolveSerializerPlugins(options.plugins),
-    disabledFeatures: (options.disabledFeatures === undefined ? DEFAULT_DISABLED_FEATURES : options.disabledFeatures) | serializeOnlyDisabledFeatures()
+    disabledFeatures: (options.disabledFeatures === undefined ? DEFAULT_DISABLED_FEATURES : options.disabledFeatures) | serializeOnlyDisabledFeatures(options.serializeErrorStacks)
   });
 }
 function createHydrationSerializer({
@@ -213,6 +213,7 @@ function isSafeError(value) {
   return !!(value && (typeof value === "object" || typeof value === "function") && value[SAFE_ERROR]);
 }
 const REVALIDATE_HEADER = "X-Revalidate";
+const RESPONSE_HEADER_VALUE_LIMIT = 4096;
 function initWithRevalidate(init = {}) {
   const resolved = typeof init === "number" ? {
     status: init
@@ -233,7 +234,13 @@ function initWithRevalidate(init = {}) {
   } else {
     headers = new Headers(responseInit.headers);
   }
-  revalidate !== undefined && headers.set(REVALIDATE_HEADER, revalidate.toString());
+  if (revalidate !== undefined) {
+    const keys = revalidate.toString();
+    if (keys.length > RESPONSE_HEADER_VALUE_LIMIT) {
+      throw new TypeError(`revalidate names ${keys.length} characters of cache keys; past ` + `${RESPONSE_HEADER_VALUE_LIMIT} the ${REVALIDATE_HEADER} header would overflow ` + `receivers (an 8 KiB proxy buffer holds the whole header block) and the response ` + `dies at the socket after the mutation committed. Split the invalidation across ` + `calls or use coarser keys — a dropped key would be a silently stale cache, so ` + `the runtime refuses rather than trims.`);
+    }
+    headers.set(REVALIDATE_HEADER, keys);
+  }
   return {
     responseInit,
     headers
@@ -251,7 +258,12 @@ function redirect(url, init = 302) {
     responseInit.status = 302;
   }
   const target = typeof url === "string" ? url : url[HREF];
-  headers.set("Location", typeof target === "string" ? target : String(url));
+  const location = typeof target === "string" ? target : String(url);
+  const encoded = location.replace(/[^\x00-\x7f]/gu, encodeURIComponent);
+  if (encoded.length > RESPONSE_HEADER_VALUE_LIMIT) {
+    throw new TypeError(`redirect() target is ${encoded.length} characters; past ` + `${RESPONSE_HEADER_VALUE_LIMIT} the Location header (and the scripted transport's ` + `redirect header) would overflow receivers and the response dies at the socket. ` + `A target this size is usually unbounded input echoed into the url — carry the ` + `state server-side instead. Refused rather than trimmed: a cut target is a ` + `different address.`);
+  }
+  headers.set("Location", encoded);
   return new Response(null, {
     ...responseInit,
     headers
@@ -267,11 +279,18 @@ function reload(init = {}) {
     headers
   });
 }
+const NULL_BODY_STATUSES = new Set([204, 205, 304]);
 function respond(value, init = {}) {
   const {
     responseInit,
     headers
   } = initWithRevalidate(init);
+  if (NULL_BODY_STATUSES.has(responseInit.status)) {
+    return new ResponseEnvelope(new Response(null, {
+      ...responseInit,
+      headers
+    }), value);
+  }
   headers.set("Content-Type", "application/json");
   return new ResponseEnvelope(new Response(JSON.stringify(value), {
     ...responseInit,
@@ -322,6 +341,7 @@ function serializeCookie(name, value, options = {}) {
   if (options.expires) cookie += `; Expires=${options.expires.toUTCString()}`;
   if (options.httpOnly) cookie += "; HttpOnly";
   if (options.secure) cookie += "; Secure";
+  if (options.partitioned) cookie += "; Partitioned";
   if (options.sameSite) {
     const sameSite = options.sameSite.toLowerCase();
     cookie += `; SameSite=${sameSite === "none" ? "None" : sameSite === "strict" ? "Strict" : "Lax"}`;
@@ -339,6 +359,7 @@ function clearFlashCookie() {
 
 const ERROR_HEADER = "X-Server-Function-Error";
 const BODY_FORMAT_HEADER = "X-Server-Function-Format";
+const REDIRECT_HEADER = "X-Server-Function-Redirect";
 const SINGLE_FLIGHT_HEADER = "X-Single-Flight";
 
 const HEAD_ELIGIBLE_TAGS = new Set(["title", "meta", "link", "style", "script", "base"]);
@@ -377,7 +398,8 @@ function resourceIdentity(tag, props) {
   let id = "res:" + tag + ":" + (props.rel || "") + ":" + (props.href || props.src || "");
   for (let i = 0; i < RESOURCE_QUALIFIERS.length; i++) {
     const q = RESOURCE_QUALIFIERS[i];
-    if (props[q] != null) id += ":" + q + "=" + props[q];
+    const value = props[q];
+    if (value != null) id += ":" + q + "=" + (value === true ? "" : value);
   }
   return id;
 }
@@ -439,6 +461,7 @@ function resolveAssets(moduleUrl, manifest) {
   if (!entry) return null;
   const css = [];
   const js = [];
+  let preloads;
   const visited = new Set();
   const walk = key => {
     if (visited.has(key)) return;
@@ -447,13 +470,26 @@ function resolveAssets(moduleUrl, manifest) {
     if (!e) return;
     js.push(joinAssetPath(base, e.file));
     if (e.css) for (let i = 0; i < e.css.length; i++) css.push(joinAssetPath(base, e.css[i]));
+    if (e.preloads) {
+      for (let i = 0; i < e.preloads.length; i++) {
+        const link = e.preloads[i];
+        if (!link || typeof link.href !== "string" || !link.href) continue;
+        if (!preloads) preloads = [];
+        preloads.push({
+          ...link,
+          href: joinAssetPath(base, link.href)
+        });
+      }
+    }
     if (e.imports) for (let i = 0; i < e.imports.length; i++) walk(e.imports[i]);
   };
   walk(moduleUrl);
-  return {
+  const assets = {
     js,
     css
   };
+  if (preloads) assets.preloads = preloads;
+  return assets;
 }
 function registerEntryAssets(manifest) {
   if (!manifest || typeof manifest === "function" || typeof manifest.resolve === "function") return;
@@ -463,6 +499,7 @@ function registerEntryAssets(manifest) {
     if (manifest[key].isEntry) {
       const assets = resolveAssets(key, manifest);
       if (assets) {
+        if (assets.preloads) for (let i = 0; i < assets.preloads.length; i++) ctx.registerAsset("preload", assets.preloads[i]);
         for (let i = 0; i < assets.css.length; i++) ctx.registerAsset("style", assets.css[i]);
         for (let i = 1; i < assets.js.length; i++) ctx.registerAsset("module", assets.js[i]);
       }
@@ -481,6 +518,7 @@ function createAssetTracking() {
     boundaryStyles,
     emittedAssets,
     inlineStyles,
+    preloadLinks: null,
     registerInlineStyle(desc) {
       let entry = inlineStyles.get(desc.id);
       if (!entry) {
@@ -572,6 +610,56 @@ function isCssUrl(url) {
   const q = url.search(/[?#]/);
   return (q === -1 ? url : url.slice(0, q)).endsWith(".css");
 }
+const PRELOAD_LINK_ATTRIBUTES = ["type", "crossorigin", "integrity", "referrerpolicy", "fetchpriority", "media"];
+function registerPreloadLink(tracking, headRegistry, link, nonce) {
+  if (!link || typeof link !== "object" || typeof link.href !== "string" || !link.href) {
+    return null;
+  }
+  if (typeof link.as !== "string") {
+    return null;
+  }
+  const as = asciiLowerCase(link.as);
+  let destination = null;
+  switch (as) {
+    case "script":
+    case "style":
+      destination = as;
+      break;
+    case "fetch":
+    case "font":
+    case "image":
+    case "track":
+      break;
+    default:
+      return null;
+  }
+  const props = {
+    rel: "preload",
+    href: link.href,
+    as
+  };
+  for (let i = 0; i < PRELOAD_LINK_ATTRIBUTES.length; i++) {
+    const name = PRELOAD_LINK_ATTRIBUTES[i];
+    const value = link[name];
+    if (value == null || value === false) continue;
+    props[name] = value === true ? "" : String(value);
+  }
+  const identity = resourceIdentity("link", props);
+  if (headRegistry.resources.has(identity)) return null;
+  const attrs = headAttrRecord(props);
+  const nonceValue = destination && nonce && nonce[destination];
+  if (typeof nonceValue === "string" && nonceValue) attrs.nonce = nonceValue;
+  const entry = {
+    href: props.href,
+    attrs,
+    attrHtml: renderHeadAttrHtml(props) + nonceAttr(nonce, destination)
+  };
+  headRegistry.resources.add(identity);
+  let links = tracking.preloadLinks;
+  if (!links) tracking.preloadLinks = links = [];
+  links.push(entry);
+  return entry;
+}
 function createHeadRegistry() {
   return {
     pending: [],
@@ -1048,6 +1136,10 @@ function renderToString(code, options = {}) {
       serializer.write(id, p);
     },
     registerAsset(type, value) {
+      if (type === "preload") {
+        registerPreloadLink(tracking, headRegistry, value, nonce);
+        return;
+      }
       if (type === "inline-style") {
         tracking.registerInlineStyle(value);
         return;
@@ -1075,7 +1167,7 @@ function renderToString(code, options = {}) {
   sharedConfig.context.noHydrate = true;
   serializer.close();
   const head = renderShellHead(headRegistry, nonce, null, noScripts);
-  return assembleDocument(resolveSSRSelectValues(html), tracking.emittedAssets, tracking.inlineStyles, scripts.length ? scripts : "", nonce, head, onHead);
+  return assembleDocument(resolveSSRSelectValues(html), tracking.emittedAssets, tracking.preloadLinks, tracking.inlineStyles, scripts.length ? scripts : "", nonce, head, onHead);
 }
 function renderToStream(code, options = {}) {
   let {
@@ -1229,6 +1321,8 @@ function renderToStream(code, options = {}) {
     asset(type, value) {
       if (type === "module") {
         buffer.write(`<link rel="modulepreload" href="${value}"${nonceAttr(nonce, "script")}>`);
+      } else if (type === "preload") {
+        buffer.write(`<link${value.attrHtml}>`);
       } else if (type === "inline-style") {
         buffer.write(renderInlineStyle(value, nonce));
       } else if (type === "head-tag") {
@@ -1236,7 +1330,7 @@ function renderToStream(code, options = {}) {
       }
     },
     shell(shellHtml, meta) {
-      buffer.write(assembleDocument(shellHtml, meta.preloads, meta.inlineStyles, meta.tasks.length ? meta.tasks : "", nonce, meta.head, onHead));
+      buffer.write(assembleDocument(shellHtml, meta.preloads, meta.preloadLinks, meta.inlineStyles, meta.tasks.length ? meta.tasks : "", nonce, meta.head, onHead));
     },
     ...options.sink
   };
@@ -1269,6 +1363,29 @@ function renderToStream(code, options = {}) {
     }
   };
   const registry = new Map();
+  const pendingSerialized = new Map();
+  const trackSerialized = (id, p) => {
+    let settle;
+    const raced = Promise.race([p, new Promise(r => settle = r)]);
+    pendingSerialized.set(id, settle);
+    const drop = () => pendingSerialized.delete(id);
+    p.then(drop, drop);
+    return raced;
+  };
+  const abandonSubtree = key => {
+    for (const [k, entry] of registry) {
+      if (k.length > key.length && k.startsWith(key)) {
+        registry.delete(k);
+        entry.resolve();
+      }
+    }
+    for (const [id, settle] of pendingSerialized) {
+      if (id.startsWith(key)) {
+        pendingSerialized.delete(id);
+        settle();
+      }
+    }
+  };
   const writeTasks = () => {
     if (tasks.length && !completed && firstFlushed) {
       buffer.write(`<script${nonceAttr(nonce, "script")}>${tasks}</script>`);
@@ -1339,6 +1456,11 @@ function renderToStream(code, options = {}) {
       }, nonce, tags);
     },
     registerAsset(type, value) {
+      if (type === "preload") {
+        const entry = registerPreloadLink(tracking, headRegistry, value, nonce);
+        if (entry && firstFlushed) sink.asset("preload", entry);
+        return;
+      }
       if (type === "inline-style") {
         const entry = tracking.registerInlineStyle(value);
         if (firstFlushed && !tracking.currentBoundaryId && !entry.emitted) {
@@ -1383,13 +1505,14 @@ function renderToStream(code, options = {}) {
     },
     serialize(id, p, deferStream) {
       if (sharedConfig.context.noHydrate) return;
-      if (!firstFlushed && p && typeof p === "object" && "then" in p) {
-        if (deferStream) {
+      if (p && typeof p === "object" && typeof p.then === "function") {
+        if (!firstFlushed && deferStream) {
           blockingPromises.add(p);
           p.then(d => serializer.write(id, d)).catch(e => serializer.write(id, e));
           return;
         }
-        if (canBatchStubs && !shellCompleted) {
+        p = trackSerialized(id, p);
+        if (!firstFlushed && canBatchStubs && !shellCompleted) {
           (stubBatch ||= new Map()).set(id, p);
           return;
         }
@@ -1434,6 +1557,7 @@ function renderToStream(code, options = {}) {
         if (registry.has(key)) {
           const item = registry.get(key);
           registry.delete(key);
+          if (error) abandonSubtree(key);
           if (item.children) {
             for (const k in item.children) {
               value = replacePlaceholder(value, k, item.children[k]);
@@ -1558,6 +1682,7 @@ function renderToStream(code, options = {}) {
     const head = renderShellHead(headRegistry, nonce, k => registry.has(k), noScripts);
     sink.shell(resolveSSRSelectValues(html), {
       preloads: tracking.emittedAssets,
+      preloadLinks: tracking.preloadLinks,
       inlineStyles: tracking.inlineStyles,
       tasks,
       head
@@ -2704,12 +2829,12 @@ function allSettled(promises) {
     return;
   });
 }
-function assembleDocument(html, emittedAssets, inlineStyles, scripts, nonce, headTags, onHead) {
+function assembleDocument(html, emittedAssets, preloadLinks, inlineStyles, scripts, nonce, headTags, onHead) {
   const scriptTag = scripts ? `<script${nonceAttr(nonce, "script")}>${scripts}</script>` : "";
   const title = headTags ? headTags.title : null;
   let headTagsHtml = headTags ? headTags.html : "";
   const headPrelude = headTags ? headTags.prelude : "";
-  if (!onHead && title == null && !headTagsHtml && !headPrelude && !(emittedAssets && emittedAssets.size) && !(inlineStyles && inlineStyles.size)) {
+  if (!onHead && title == null && !headTagsHtml && !headPrelude && !(emittedAssets && emittedAssets.size) && !preloadLinks && !(inlineStyles && inlineStyles.size)) {
     if (!scriptTag) return html;
     const xs = html.indexOf("<!--xs-->");
     return xs === -1 ? html + scriptTag : html.slice(0, xs) + scriptTag + html.slice(xs);
@@ -2728,7 +2853,7 @@ function assembleDocument(html, emittedAssets, inlineStyles, scripts, nonce, hea
       if (title != null) {
         titleHtml = headTags.noScripts ? `<title data-dh="title">${escape(title)}</title>` : `<script${nonceAttr(nonce, "script")}>(function(x,t){(t=document.querySelector("title"))?(t.hasAttribute("data-dh")||t.setAttribute("data-dhf",t.textContent),t.textContent=x):(document.title=x,t=document.querySelector("title"));t&&t.setAttribute("data-dh","title")})(${JSON.stringify(title).replace(/</g, "\\u003C")})</script>`;
       }
-      onHead(headPrelude + headTagsHtml + titleHtml + renderHeadAssets(emittedAssets, inlineStyles, nonce));
+      onHead(headPrelude + headTagsHtml + titleHtml + renderHeadAssets(emittedAssets, preloadLinks, inlineStyles, nonce));
     }
     if (!scriptTag) return html;
     const xs = html.indexOf("<!--xs-->");
@@ -2748,13 +2873,13 @@ function assembleDocument(html, emittedAssets, inlineStyles, scripts, nonce, hea
       headTagsHtml = `<title data-dh="title">${winner}</title>` + headTagsHtml;
     }
   }
-  const head = headTagsHtml + renderHeadAssets(emittedAssets, inlineStyles, nonce);
+  const head = headTagsHtml + renderHeadAssets(emittedAssets, preloadLinks, inlineStyles, nonce);
   if (!scriptTag) return html.slice(0, headIdx) + head + html.slice(headIdx);
   const xsIdx = html.indexOf("<!--xs-->");
   if (xsIdx === -1) return html.slice(0, headIdx) + head + html.slice(headIdx) + scriptTag;
   return xsIdx < headIdx ? html.slice(0, xsIdx) + scriptTag + html.slice(xsIdx, headIdx) + head + html.slice(headIdx) : html.slice(0, headIdx) + head + html.slice(headIdx, xsIdx) + scriptTag + html.slice(xsIdx);
 }
-function renderHeadAssets(emittedAssets, inlineStyles, nonce) {
+function renderHeadAssets(emittedAssets, preloadLinks, inlineStyles, nonce) {
   let head = "";
   const styleAttr = nonceAttr(nonce, "style");
   const scriptAttr = nonceAttr(nonce, "script");
@@ -2763,6 +2888,9 @@ function renderHeadAssets(emittedAssets, inlineStyles, nonce) {
       head += isCssUrl(url) ? `<link rel="stylesheet" href="${url}"${styleAttr}>` : `<link rel="modulepreload" href="${url}"${scriptAttr}>`;
     }
   }
+  if (preloadLinks) {
+    for (const entry of preloadLinks) head += `<link${entry.attrHtml}>`;
+  }
   if (inlineStyles && inlineStyles.size) {
     for (const entry of inlineStyles.values()) {
       if (entry.emitted) continue;
@@ -3027,7 +3155,7 @@ function copyInitHeaders(init) {
   for (const cookie of init.getSetCookie()) headers.append("Set-Cookie", cookie);
   return headers;
 }
-const STUB_GAP_FILL_EXCLUDED = /*#__PURE__*/new Set([ERROR_HEADER, BODY_FORMAT_HEADER, SINGLE_FLIGHT_HEADER, REVALIDATE_HEADER, "Location"].map(header => header.toLowerCase()));
+const STUB_GAP_FILL_EXCLUDED = /*#__PURE__*/new Set([ERROR_HEADER, BODY_FORMAT_HEADER, SINGLE_FLIGHT_HEADER, REVALIDATE_HEADER, REDIRECT_HEADER, "Location"].map(header => header.toLowerCase()));
 function fillsStubGap(key, headers, response) {
   if (key === "set-cookie" || STUB_GAP_FILL_EXCLUDED.has(key)) return false;
   if (response.body === null && (key === "content-type" || key === "content-length")) return false;
@@ -3043,24 +3171,16 @@ function commitEventResponse(response, event = getRequestEvent()) {
     if (fillsStubGap(key, response.headers, response)) hasGaps = true;
   });
   if (!cookies.length && !hasGaps) return response;
-  try {
-    for (const cookie of cookies) response.headers.append("Set-Cookie", cookie);
-    stub.headers.forEach((value, key) => {
-      if (fillsStubGap(key, response.headers, response)) response.headers.set(key, value);
-    });
-    return response;
-  } catch {
-    const headers = copyInitHeaders(response.headers);
-    for (const cookie of cookies) headers.append("Set-Cookie", cookie);
-    stub.headers.forEach((value, key) => {
-      if (fillsStubGap(key, headers, response)) headers.set(key, value);
-    });
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  }
+  const headers = copyInitHeaders(response.headers);
+  for (const cookie of cookies) headers.append("Set-Cookie", cookie);
+  stub.headers.forEach((value, key) => {
+    if (fillsStubGap(key, headers, response)) headers.set(key, value);
+  });
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
 }
 function deriveHead(stub, responseInit = {}) {
   const headers = mergeStubHeaders(copyInitHeaders(responseInit.headers), stub);
@@ -3226,6 +3346,11 @@ function registerClientOnlyPreload(moduleUrl) {
       const css = assets.css[i];
       if (typeof css === "string") registerAsset("style", css);else registerAsset("inline-style", css);
     }
+    if (assets.preloads) {
+      for (let i = 0; i < assets.preloads.length; i++) {
+        registerAsset("preload", assets.preloads[i]);
+      }
+    }
     for (let i = 0; i < assets.js.length; i++) registerAsset("module", assets.js[i]);
   };
   const assets = resolve(moduleUrl);
@@ -3329,4 +3454,4 @@ function httpHeader(name, value, options) {
   }
 }
 
-export { CLAIMS_DOCUMENT, CLAIMS_STREAM, CLAIM_PROP, ChildProperties, DOMElements, DOMWithState, DelegatedEvents, Dynamic, HREF, HydrationScript, MathMLElements, Namespaces, Portal, REVALIDATE_HEADER, RawTextElements, RequestContext, ResponseEnvelope, SAFE_ERROR, SVGElements, VoidElements, notSup as acquireAsset, notSup as addEvent, applyRef, notSup as assign, claimElement, claimElementTree, notSup as className, clearFlashCookie, clientOnly, commitEventResponse, commitResponseStub, composeMiddleware, createLiveHoles, createRequestEvent, createResponseStub, createSSRResponse, notSup as delegateEvents, dynamic, notSup as dynamicProperty, effect, escape, generateHydrationScript, notSup as getDelegatedRoot, getExpectedRedirectStatus, getHydrationKey, notSup as getNextElement, notSup as getNextMarker, notSup as getNextMatch, getRequestEvent, getServerFunctionMetadata, getServerFunctionRPC, hasFlashCookie, httpHeader, httpStatus, notSup as hydrate, notSup as insert, isDev, isHref, isResponseEnvelope, isSafeError, isServer, isServerFunction, markSafeError, memo, parseCookieHeader, redirect, notSup as ref, notSup as registerDelegatedContainer, notSup as registerDelegatedRoot, registerElementClaim, reload, notSup as render, renderToStream, renderToString, resolveSSRNode, resolveSSRSelectValues, respond, notSup as runHydrationEvents, scriptNonce, serializeCookie, notSup as setAttribute, notSup as setAttributeNS, notSup as setProperty, notSup as setStyleProperty, notSup as spread, ssr, ssrAttribute, ssrClaim, ssrClassName, ssrElement, ssrGroup, ssrHydrationKey, ssrSelectValues, ssrStyle, ssrStyleProperty, notSup as style, styleNonce, notSup as template, notSup as unregisterDelegatedContainer, notSup as unregisterDelegatedRoot, useHead };
+export { CLAIMS_DOCUMENT, CLAIMS_STREAM, CLAIM_PROP, ChildProperties, DOMElements, DOMWithState, DelegatedEvents, Dynamic, HREF, HydrationScript, MathMLElements, NULL_BODY_STATUSES, Namespaces, Portal, RESPONSE_HEADER_VALUE_LIMIT, REVALIDATE_HEADER, RawTextElements, RequestContext, ResponseEnvelope, SAFE_ERROR, SVGElements, VoidElements, notSup as acquireAsset, notSup as addEvent, applyRef, notSup as assign, claimElement, claimElementTree, notSup as className, clearFlashCookie, clientOnly, commitEventResponse, commitResponseStub, composeMiddleware, createLiveHoles, createRequestEvent, createResponseStub, createSSRResponse, notSup as delegateEvents, dynamic, notSup as dynamicProperty, effect, escape, generateHydrationScript, notSup as getDelegatedRoot, getExpectedRedirectStatus, getHydrationKey, notSup as getNextElement, notSup as getNextMarker, notSup as getNextMatch, getRequestEvent, getServerFunctionMetadata, getServerFunctionRPC, hasFlashCookie, httpHeader, httpStatus, notSup as hydrate, notSup as insert, isDev, isHref, isResponseEnvelope, isSafeError, isServer, isServerFunction, markSafeError, memo, parseCookieHeader, redirect, notSup as ref, notSup as registerDelegatedContainer, notSup as registerDelegatedRoot, registerElementClaim, reload, notSup as render, renderToStream, renderToString, resolveSSRNode, resolveSSRSelectValues, respond, notSup as runHydrationEvents, scriptNonce, serializeCookie, notSup as setAttribute, notSup as setAttributeNS, notSup as setProperty, notSup as setStyleProperty, notSup as spread, ssr, ssrAttribute, ssrClaim, ssrClassName, ssrElement, ssrGroup, ssrHydrationKey, ssrSelectValues, ssrStyle, ssrStyleProperty, notSup as style, styleNonce, notSup as template, notSup as unregisterDelegatedContainer, notSup as unregisterDelegatedRoot, useHead };

package/dist/web.cjs

@@ -215,7 +215,8 @@ function resourceIdentity(tag, props) {
   let id = "res:" + tag + ":" + (props.rel || "") + ":" + (props.href || props.src || "");
   for (let i = 0; i < RESOURCE_QUALIFIERS.length; i++) {
     const q = RESOURCE_QUALIFIERS[i];
-    if (props[q] != null) id += ":" + q + "=" + props[q];
+    const value = props[q];
+    if (value != null) id += ":" + q + "=" + (value === true ? "" : value);
   }
   return id;
 }
@@ -294,6 +295,7 @@ function serializeCookie(name, value, options = {}) {
   if (options.expires) cookie += `; Expires=${options.expires.toUTCString()}`;
   if (options.httpOnly) cookie += "; HttpOnly";
   if (options.secure) cookie += "; Secure";
+  if (options.partitioned) cookie += "; Partitioned";
   if (options.sameSite) {
     const sameSite = options.sameSite.toLowerCase();
     cookie += `; SameSite=${sameSite === "none" ? "None" : sameSite === "strict" ? "Strict" : "Lax"}`;
@@ -580,16 +582,18 @@ function setStyleProperty(node, name, value) {
 }
 function spread(node, props = {}, skipChildren) {
   const prevProps = {};
-  if (!skipChildren) insert(node, () => props.children);
+  const get = typeof props === "function" ? props : () => props;
+  if (!skipChildren) insert(node, () => get().children);
   effect(() => {
-    const r = props.ref;
+    const r = get().ref;
     (typeof r === "function" || Array.isArray(r)) && ref(() => r, node);
   }, () => {});
   effect(() => {
+    const source = get();
     const newProps = {};
-    for (const prop in props) {
+    for (const prop in source) {
       if (prop === "children" || prop === "ref") continue;
-      newProps[prop] = props[prop];
+      newProps[prop] = source[prop];
     }
     return newProps;
   }, props => assign(node, props, true, prevProps, true));
@@ -2016,6 +2020,7 @@ function isSafeError(value) {
   return !!(value && (typeof value === "object" || typeof value === "function") && value[SAFE_ERROR]);
 }
 const REVALIDATE_HEADER = "X-Revalidate";
+const RESPONSE_HEADER_VALUE_LIMIT = 4096;
 function initWithRevalidate(init = {}) {
   const resolved = typeof init === "number" ? {
     status: init
@@ -2036,7 +2041,13 @@ function initWithRevalidate(init = {}) {
   } else {
     headers = new Headers(responseInit.headers);
   }
-  revalidate !== undefined && headers.set(REVALIDATE_HEADER, revalidate.toString());
+  if (revalidate !== undefined) {
+    const keys = revalidate.toString();
+    if (keys.length > RESPONSE_HEADER_VALUE_LIMIT) {
+      throw new TypeError(`revalidate names ${keys.length} characters of cache keys; past ` + `${RESPONSE_HEADER_VALUE_LIMIT} the ${REVALIDATE_HEADER} header would overflow ` + `receivers (an 8 KiB proxy buffer holds the whole header block) and the response ` + `dies at the socket after the mutation committed. Split the invalidation across ` + `calls or use coarser keys — a dropped key would be a silently stale cache, so ` + `the runtime refuses rather than trims.`);
+    }
+    headers.set(REVALIDATE_HEADER, keys);
+  }
   return {
     responseInit,
     headers
@@ -2054,7 +2065,12 @@ function redirect(url, init = 302) {
     responseInit.status = 302;
   }
   const target = typeof url === "string" ? url : url[HREF];
-  headers.set("Location", typeof target === "string" ? target : String(url));
+  const location = typeof target === "string" ? target : String(url);
+  const encoded = location.replace(/[^\x00-\x7f]/gu, encodeURIComponent);
+  if (encoded.length > RESPONSE_HEADER_VALUE_LIMIT) {
+    throw new TypeError(`redirect() target is ${encoded.length} characters; past ` + `${RESPONSE_HEADER_VALUE_LIMIT} the Location header (and the scripted transport's ` + `redirect header) would overflow receivers and the response dies at the socket. ` + `A target this size is usually unbounded input echoed into the url — carry the ` + `state server-side instead. Refused rather than trimmed: a cut target is a ` + `different address.`);
+  }
+  headers.set("Location", encoded);
   return new Response(null, {
     ...responseInit,
     headers
@@ -2070,11 +2086,18 @@ function reload(init = {}) {
     headers
   });
 }
+const NULL_BODY_STATUSES = new Set([204, 205, 304]);
 function respond(value, init = {}) {
   const {
     responseInit,
     headers
   } = initWithRevalidate(init);
+  if (NULL_BODY_STATUSES.has(responseInit.status)) {
+    return new ResponseEnvelope(new Response(null, {
+      ...responseInit,
+      headers
+    }), value);
+  }
   headers.set("Content-Type", "application/json");
   return new ResponseEnvelope(new Response(JSON.stringify(value), {
     ...responseInit,
@@ -2289,8 +2312,10 @@ exports.Dynamic = Dynamic;
 exports.HREF = HREF;
 exports.HydrationScript = HydrationScript;
 exports.MathMLElements = MathMLElements;
+exports.NULL_BODY_STATUSES = NULL_BODY_STATUSES;
 exports.Namespaces = Namespaces;
 exports.Portal = Portal;
+exports.RESPONSE_HEADER_VALUE_LIMIT = RESPONSE_HEADER_VALUE_LIMIT;
 exports.REVALIDATE_HEADER = REVALIDATE_HEADER;
 exports.RawTextElements = RawTextElements;
 exports.RequestContext = RequestContext;

package/dist/web.js

@@ -214,7 +214,8 @@ function resourceIdentity(tag, props) {
   let id = "res:" + tag + ":" + (props.rel || "") + ":" + (props.href || props.src || "");
   for (let i = 0; i < RESOURCE_QUALIFIERS.length; i++) {
     const q = RESOURCE_QUALIFIERS[i];
-    if (props[q] != null) id += ":" + q + "=" + props[q];
+    const value = props[q];
+    if (value != null) id += ":" + q + "=" + (value === true ? "" : value);
   }
   return id;
 }
@@ -293,6 +294,7 @@ function serializeCookie(name, value, options = {}) {
   if (options.expires) cookie += `; Expires=${options.expires.toUTCString()}`;
   if (options.httpOnly) cookie += "; HttpOnly";
   if (options.secure) cookie += "; Secure";
+  if (options.partitioned) cookie += "; Partitioned";
   if (options.sameSite) {
     const sameSite = options.sameSite.toLowerCase();
     cookie += `; SameSite=${sameSite === "none" ? "None" : sameSite === "strict" ? "Strict" : "Lax"}`;
@@ -579,16 +581,18 @@ function setStyleProperty(node, name, value) {
 }
 function spread(node, props = {}, skipChildren) {
   const prevProps = {};
-  if (!skipChildren) insert(node, () => props.children);
+  const get = typeof props === "function" ? props : () => props;
+  if (!skipChildren) insert(node, () => get().children);
   effect(() => {
-    const r = props.ref;
+    const r = get().ref;
     (typeof r === "function" || Array.isArray(r)) && ref(() => r, node);
   }, () => {});
   effect(() => {
+    const source = get();
     const newProps = {};
-    for (const prop in props) {
+    for (const prop in source) {
       if (prop === "children" || prop === "ref") continue;
-      newProps[prop] = props[prop];
+      newProps[prop] = source[prop];
     }
     return newProps;
   }, props => assign(node, props, true, prevProps, true));
@@ -2015,6 +2019,7 @@ function isSafeError(value) {
   return !!(value && (typeof value === "object" || typeof value === "function") && value[SAFE_ERROR]);
 }
 const REVALIDATE_HEADER = "X-Revalidate";
+const RESPONSE_HEADER_VALUE_LIMIT = 4096;
 function initWithRevalidate(init = {}) {
   const resolved = typeof init === "number" ? {
     status: init
@@ -2035,7 +2040,13 @@ function initWithRevalidate(init = {}) {
   } else {
     headers = new Headers(responseInit.headers);
   }
-  revalidate !== undefined && headers.set(REVALIDATE_HEADER, revalidate.toString());
+  if (revalidate !== undefined) {
+    const keys = revalidate.toString();
+    if (keys.length > RESPONSE_HEADER_VALUE_LIMIT) {
+      throw new TypeError(`revalidate names ${keys.length} characters of cache keys; past ` + `${RESPONSE_HEADER_VALUE_LIMIT} the ${REVALIDATE_HEADER} header would overflow ` + `receivers (an 8 KiB proxy buffer holds the whole header block) and the response ` + `dies at the socket after the mutation committed. Split the invalidation across ` + `calls or use coarser keys — a dropped key would be a silently stale cache, so ` + `the runtime refuses rather than trims.`);
+    }
+    headers.set(REVALIDATE_HEADER, keys);
+  }
   return {
     responseInit,
     headers
@@ -2053,7 +2064,12 @@ function redirect(url, init = 302) {
     responseInit.status = 302;
   }
   const target = typeof url === "string" ? url : url[HREF];
-  headers.set("Location", typeof target === "string" ? target : String(url));
+  const location = typeof target === "string" ? target : String(url);
+  const encoded = location.replace(/[^\x00-\x7f]/gu, encodeURIComponent);
+  if (encoded.length > RESPONSE_HEADER_VALUE_LIMIT) {
+    throw new TypeError(`redirect() target is ${encoded.length} characters; past ` + `${RESPONSE_HEADER_VALUE_LIMIT} the Location header (and the scripted transport's ` + `redirect header) would overflow receivers and the response dies at the socket. ` + `A target this size is usually unbounded input echoed into the url — carry the ` + `state server-side instead. Refused rather than trimmed: a cut target is a ` + `different address.`);
+  }
+  headers.set("Location", encoded);
   return new Response(null, {
     ...responseInit,
     headers
@@ -2069,11 +2085,18 @@ function reload(init = {}) {
     headers
   });
 }
+const NULL_BODY_STATUSES = new Set([204, 205, 304]);
 function respond(value, init = {}) {
   const {
     responseInit,
     headers
   } = initWithRevalidate(init);
+  if (NULL_BODY_STATUSES.has(responseInit.status)) {
+    return new ResponseEnvelope(new Response(null, {
+      ...responseInit,
+      headers
+    }), value);
+  }
   headers.set("Content-Type", "application/json");
   return new ResponseEnvelope(new Response(JSON.stringify(value), {
     ...responseInit,
@@ -2224,4 +2247,4 @@ _moduleUrl) {
 function httpStatus(_code, _text) {}
 function httpHeader(_name, _value, _options) {}
 
-export { ChildProperties, DOMElements, DOMWithState, DelegatedEvents, Dynamic, HREF, HydrationScript, MathMLElements, Namespaces, Portal, REVALIDATE_HEADER, RawTextElements, RequestContext, ResponseEnvelope, SAFE_ERROR, SVGElements, VoidElements, acquireAsset, addEvent, applyRef, assign, claimElement, claimElementTree, className, clearFlashCookie, clientOnly, commitEventResponse, composeMiddleware, createRequestEvent, createResponseStub, createSSRResponse, delegateEvents, driveList, dynamic, dynamicProperty, effect, escape, generateHydrationScript, getDelegatedRoot, getExpectedRedirectStatus, getFirstChild, getHydrationKey, getNextElement, getNextMarker, getNextMatch, getNextSibling, getRequestEvent, getServerFunctionMetadata, getServerFunctionRPC, hasFlashCookie, httpHeader, httpStatus, hydrate, insert, installHydrationRuntime, installListDriver, isDev, isHref, isResponseEnvelope, isSafeError, isServer, isServerFunction, listDriver, markSafeError, memo, parseCookieHeader, patchDriver, redirect, ref, registerDelegatedContainer, registerDelegatedRoot, registerElementClaim, reload, render, renderToStream, renderToString, resolveSSRNode, respond, rowProof, runHydrationEvents, scope, serializeCookie, setAttribute, setAttributeNS, setProperty, setStyleProperty, spread, ssr, ssrAttribute, ssrClassName, ssrElement, ssrGroup, ssrHydrationKey, ssrStyle, ssrStyleProperty, style, template, unregisterDelegatedContainer, unregisterDelegatedRoot, useHead, waitAsset, warmAsset };
+export { ChildProperties, DOMElements, DOMWithState, DelegatedEvents, Dynamic, HREF, HydrationScript, MathMLElements, NULL_BODY_STATUSES, Namespaces, Portal, RESPONSE_HEADER_VALUE_LIMIT, REVALIDATE_HEADER, RawTextElements, RequestContext, ResponseEnvelope, SAFE_ERROR, SVGElements, VoidElements, acquireAsset, addEvent, applyRef, assign, claimElement, claimElementTree, className, clearFlashCookie, clientOnly, commitEventResponse, composeMiddleware, createRequestEvent, createResponseStub, createSSRResponse, delegateEvents, driveList, dynamic, dynamicProperty, effect, escape, generateHydrationScript, getDelegatedRoot, getExpectedRedirectStatus, getFirstChild, getHydrationKey, getNextElement, getNextMarker, getNextMatch, getNextSibling, getRequestEvent, getServerFunctionMetadata, getServerFunctionRPC, hasFlashCookie, httpHeader, httpStatus, hydrate, insert, installHydrationRuntime, installListDriver, isDev, isHref, isResponseEnvelope, isSafeError, isServer, isServerFunction, listDriver, markSafeError, memo, parseCookieHeader, patchDriver, redirect, ref, registerDelegatedContainer, registerDelegatedRoot, registerElementClaim, reload, render, renderToStream, renderToString, resolveSSRNode, respond, rowProof, runHydrationEvents, scope, serializeCookie, setAttribute, setAttributeNS, setProperty, setStyleProperty, spread, ssr, ssrAttribute, ssrClassName, ssrElement, ssrGroup, ssrHydrationKey, ssrStyle, ssrStyleProperty, style, template, unregisterDelegatedContainer, unregisterDelegatedRoot, useHead, waitAsset, warmAsset };