@solidjs/web 2.0.0-rc.4 → 2.0.0-rc.6

package/server-functions/dist/server.dev.js

@@ -1,5 +1,15 @@
 import { sharedConfig } from 'solid-js';
 
+const COMPOSED_BODY_FRAMING = /*#__PURE__*/new Set(["content-length", "content-encoding", "transfer-encoding"]);
+function isHttpNavigationTarget(target) {
+  try {
+    const protocol = new URL(target, "http://base.invalid").protocol;
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
 const ENVELOPE = Symbol.for("solid.ResponseEnvelope");
 function isResponseEnvelope(value) {
   return !!(value && typeof value === "object" && value[ENVELOPE]);
@@ -9,6 +19,8 @@ function isSafeError(value) {
   return !!(value && (typeof value === "object" || typeof value === "function") && value[SAFE_ERROR]);
 }
 const REVALIDATE_HEADER = "X-Revalidate";
+const RESPONSE_HEADER_VALUE_LIMIT = 4096;
+const NULL_BODY_STATUSES = new Set([204, 205, 304]);
 
 const SERVER_FUNCTION_METADATA = Symbol.for("solid.ServerFunctionMetadata");
 function getServerFunctionMetadata(fn) {
@@ -81,6 +93,7 @@ function decodeSafe(text) {
   }
 }
 function serializeCookie(name, value, options = {}) {
+  assertServableCookie(name, options);
   let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
   cookie += `; Path=${options.path === undefined ? "/" : options.path}`;
   if (options.domain) cookie += `; Domain=${options.domain}`;
@@ -88,12 +101,32 @@ function serializeCookie(name, value, options = {}) {
   if (options.expires) cookie += `; Expires=${options.expires.toUTCString()}`;
   if (options.httpOnly) cookie += "; HttpOnly";
   if (options.secure) cookie += "; Secure";
+  if (options.partitioned) cookie += "; Partitioned";
   if (options.sameSite) {
     const sameSite = options.sameSite.toLowerCase();
     cookie += `; SameSite=${sameSite === "none" ? "None" : sameSite === "strict" ? "Strict" : "Lax"}`;
   }
   return cookie;
 }
+function assertServableCookie(name, options) {
+  const reject = reason => {
+    throw new Error(`serializeCookie: every browser silently rejects this cookie — ${reason}. ` + `It would never come back on a request, with no error anywhere.`);
+  };
+  const lower = name.toLowerCase();
+  if (lower.startsWith("__host-")) {
+    if (!options.secure) reject(`the __Host- prefix on \`${name}\` requires \`secure: true\``);
+    if (options.path !== undefined && options.path !== "/") reject(`the __Host- prefix on \`${name}\` requires \`Path=/\` (got \`${options.path}\`) — ` + `host-locking is the prefix's whole contract, so it cannot be path-scoped`);
+    if (options.domain) reject(`the __Host- prefix on \`${name}\` forbids \`Domain\` (got \`${options.domain}\`)`);
+  } else if (lower.startsWith("__secure-") && !options.secure) {
+    reject(`the __Secure- prefix on \`${name}\` requires \`secure: true\``);
+  }
+  if (options.sameSite && options.sameSite.toLowerCase() === "none" && !options.secure) {
+    reject("`SameSite=None` requires `secure: true`");
+  }
+  if (options.partitioned && !options.secure) {
+    reject("`Partitioned` requires `secure: true`");
+  }
+}
 const FLASH_COOKIE = "flash";
 const FLASH_MATCHER = new RegExp(`(?:^|;\\s*)${FLASH_COOKIE}=([^;]+)`);
 function hasFlashCookie(cookieHeader) {
@@ -112,8 +145,23 @@ function configureServerFunctionsCodec(codec) {
 function getServerFunctionsCodec() {
   return codecConfig.codec;
 }
-function subscribeFlightData(consumer) {
+const UNNAMED_FLIGHT_SOURCE = "true";
+const flightConfig = {
+  consumers: new Map()
+};
+function assertFlightSource(source) {
+  if (source === UNNAMED_FLIGHT_SOURCE || source === "" || source.includes(",")) {
+    throw new TypeError(`Invalid flight data source id "${source}": ids ride the ` + `${SINGLE_FLIGHT_HEADER} header as a comma-separated list, and "true" is ` + `reserved for the unnamed registration (the bare consumer/hook signatures).`);
+  }
+}
+function subscribeFlightData(sourceOrConsumer, maybeConsumer) {
+  const named = typeof sourceOrConsumer === "string";
+  if (named) assertFlightSource(sourceOrConsumer);
+  const source = named ? sourceOrConsumer : UNNAMED_FLIGHT_SOURCE;
+  const consumer = named ? maybeConsumer : sourceOrConsumer;
+  flightConfig.consumers.set(source, consumer);
   return () => {
+    if (flightConfig.consumers.get(source) === consumer) flightConfig.consumers.delete(source);
   };
 }
 function serverFunctionAddress(endpoint, id) {
@@ -125,10 +173,18 @@ function parseServerFunctionAddress(pathname, endpoint) {
   if (!pathname.startsWith(mount)) return null;
   const rest = pathname.slice(mount.length);
   if (!rest.startsWith("/")) return null;
-  const segment = rest.slice(1);
+  let segment = rest.slice(1);
+  let data = false;
+  if (segment.startsWith("data/")) {
+    segment = segment.slice(5);
+    data = true;
+  }
   if (!segment || segment.includes("/")) return null;
   try {
-    return decodeURIComponent(segment);
+    return {
+      id: decodeURIComponent(segment),
+      data
+    };
   } catch {
     return null;
   }
@@ -160,6 +216,28 @@ function decodeErrorHeaderValue(value) {
 }
 const INSTANCE_HEADER = "X-Server-Function-Instance";
 const BODY_FORMAT_HEADER = "X-Server-Function-Format";
+const UNKNOWN_HEADER = "X-Server-Function-Unknown";
+const REDIRECT_HEADER = "X-Server-Function-Redirect";
+function decodeRedirectHeaderValue(value) {
+  if (typeof value !== "string") return undefined;
+  const at = value.indexOf(" ");
+  if (at < 0) return undefined;
+  const status = Number(value.slice(0, at));
+  const url = value.slice(at + 1);
+  if (!Number.isInteger(status) || !url) return undefined;
+  if (status !== 301 && status !== 302 && status !== 303 && status !== 307 && status !== 308) return undefined;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return undefined;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return undefined;
+  return {
+    status,
+    url
+  };
+}
 const SINGLE_FLIGHT_HEADER = "X-Single-Flight";
 const FILE_FORM_KEY = "__server_function_file__";
 const BodyFormat = {
@@ -202,7 +280,11 @@ function isJSONSafe(value) {
       const proto = Object.getPrototypeOf(v);
       if (proto !== Object.prototype && proto !== null) return false;
       if (Symbol.asyncIterator in v || Symbol.iterator in v) return false;
-      for (const k in v) stack.push(v[k]);
+      for (const k in v) {
+        const descriptor = Object.getOwnPropertyDescriptor(v, k);
+        if (descriptor === undefined || !("value" in descriptor)) return false;
+        stack.push(descriptor.value);
+      }
     }
   }
   return true;
@@ -311,18 +393,34 @@ function createChunk(data) {
 class ChunkReader {
   constructor(stream) {
     this.reader = stream.getReader();
-    this.buffer = new Uint8Array(0);
+    this.store = new Uint8Array(0);
+    this.buffer = this.store;
     this.done = false;
   }
   async readChunk() {
     const chunk = await this.reader.read();
-    if (!chunk.done) {
-      const newBuffer = new Uint8Array(this.buffer.length + chunk.value.length);
-      newBuffer.set(this.buffer);
-      newBuffer.set(chunk.value, this.buffer.length);
-      this.buffer = newBuffer;
-    } else {
+    if (chunk.done) {
       this.done = true;
+      return;
+    }
+    const incoming = chunk.value;
+    const store = this.store;
+    const start = this.buffer.byteOffset;
+    const end = start + this.buffer.length;
+    const needed = this.buffer.length + incoming.length;
+    if (end + incoming.length <= store.length) {
+      store.set(incoming, end);
+      this.buffer = store.subarray(start, end + incoming.length);
+    } else if (needed <= store.length) {
+      store.copyWithin(0, start, end);
+      store.set(incoming, this.buffer.length);
+      this.buffer = store.subarray(0, needed);
+    } else {
+      const grown = new Uint8Array(Math.max(needed, store.length * 2));
+      grown.set(this.buffer);
+      grown.set(incoming, this.buffer.length);
+      this.store = grown;
+      this.buffer = grown.subarray(0, needed);
     }
   }
   async next() {
@@ -364,6 +462,27 @@ class ChunkReader {
     }
   }
 }
+const ERROR_TRAILER_PREFIX = "!";
+function encodeErrorTrailer(error) {
+  const shaped = error instanceof Error ? error : new Error(String(error));
+  return ERROR_TRAILER_PREFIX + JSON.stringify(shaped.name && shaped.name !== "Error" ? {
+    name: shaped.name,
+    message: shaped.message
+  } : {
+    message: shaped.message
+  });
+}
+function errorFromTrailer(payload) {
+  let shape;
+  try {
+    shape = JSON.parse(payload.slice(1));
+  } catch {
+    shape = null;
+  }
+  const error = new Error(shape && typeof shape.message === "string" ? shape.message : "Server function result could not be delivered.");
+  if (shape && typeof shape.name === "string") error.name = shape.name;
+  return error;
+}
 async function deserializeStream(source, codecOptions) {
   if (!source.body) {
     throw new Error("missing body");
@@ -371,11 +490,17 @@ async function deserializeStream(source, codecOptions) {
   const reader = new ChunkReader(source.body);
   const result = await reader.next();
   if (!result.done) {
+    if (result.value.startsWith(ERROR_TRAILER_PREFIX)) {
+      throw errorFromTrailer(result.value);
+    }
     const {
       createJSONDeserializer
     } = await import('@solidjs/web/serialization/decode');
     const deserializeChunk = createJSONDeserializer(codecOptions);
     function interpretChunk(chunk) {
+      if (chunk.startsWith(ERROR_TRAILER_PREFIX)) {
+        throw errorFromTrailer(chunk);
+      }
       return deserializeChunk(JSON.parse(chunk));
     }
     reader.drain(interpretChunk).then(() => deserializeChunk.abort(new Error("Server function stream ended unexpectedly.")), error => deserializeChunk.abort(error));
@@ -439,7 +564,8 @@ function copyInitHeaders(init) {
   for (const cookie of init.getSetCookie()) headers.append("Set-Cookie", cookie);
   return headers;
 }
-const STUB_GAP_FILL_EXCLUDED = /*#__PURE__*/new Set([ERROR_HEADER, BODY_FORMAT_HEADER, SINGLE_FLIGHT_HEADER, REVALIDATE_HEADER, "Location"].map(header => header.toLowerCase()));
+const STUB_GAP_FILL_EXCLUDED = /*#__PURE__*/new Set([ERROR_HEADER, BODY_FORMAT_HEADER, SINGLE_FLIGHT_HEADER, REVALIDATE_HEADER, REDIRECT_HEADER, "Location",
+...COMPOSED_BODY_FRAMING].map(header => header.toLowerCase()));
 function fillsStubGap(key, headers, response) {
   if (key === "set-cookie" || STUB_GAP_FILL_EXCLUDED.has(key)) return false;
   if (response.body === null && (key === "content-type" || key === "content-length")) return false;
@@ -455,24 +581,16 @@ function commitEventResponse(response, event = getRequestEvent()) {
     if (fillsStubGap(key, response.headers, response)) hasGaps = true;
   });
   if (!cookies.length && !hasGaps) return response;
-  try {
-    for (const cookie of cookies) response.headers.append("Set-Cookie", cookie);
-    stub.headers.forEach((value, key) => {
-      if (fillsStubGap(key, response.headers, response)) response.headers.set(key, value);
-    });
-    return response;
-  } catch {
-    const headers = copyInitHeaders(response.headers);
-    for (const cookie of cookies) headers.append("Set-Cookie", cookie);
-    stub.headers.forEach((value, key) => {
-      if (fillsStubGap(key, headers, response)) headers.set(key, value);
-    });
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  }
+  const headers = copyInitHeaders(response.headers);
+  for (const cookie of cookies) headers.append("Set-Cookie", cookie);
+  stub.headers.forEach((value, key) => {
+    if (fillsStubGap(key, headers, response)) headers.set(key, value);
+  });
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
 }
 
 function encodeInputValue(value) {
@@ -504,11 +622,35 @@ function encodeFlashCookie(url, result, input, thrown) {
     thrown: !!thrown,
     input: input.map(encodeInputValue)
   };
+  if (fitsCookie(payload)) return flashCookie(payload);
+  payload.truncated = true;
+  payload.input = [];
+  if (!fitsCookie(payload)) {
+    if (typeof payload.result === "string") {
+      let prefix = payload.result;
+      while (prefix.length > 0 && !fitsCookie({
+        ...payload,
+        result: prefix
+      })) {
+        prefix = prefix.slice(0, prefix.length >> 1);
+      }
+      payload.result = prefix.length > 0 ? prefix : true;
+    } else {
+      payload.result = true;
+    }
+  }
+  return flashCookie(payload);
+}
+function flashCookie(payload) {
   return serializeCookie(FLASH_COOKIE, JSON.stringify(payload), {
     secure: true,
     httpOnly: true
   });
 }
+const COOKIE_PAIR_BUDGET = 4000;
+function fitsCookie(payload) {
+  return FLASH_COOKIE.length + 1 + encodeURIComponent(JSON.stringify(payload)).length <= COOKIE_PAIR_BUDGET;
+}
 function decodeFlashCookie(cookieHeader) {
   const match = parseCookieHeader(cookieHeader)[FLASH_COOKIE];
   if (!match) return;
@@ -516,12 +658,14 @@ function decodeFlashCookie(cookieHeader) {
     const payload = JSON.parse(match);
     if (!payload || !payload.result) return;
     const result = payload.error ? new Error(payload.result) : payload.result;
-    return {
+    const submission = {
       input: Array.isArray(payload.input) ? payload.input.map(decodeInputValue) : [],
       url: payload.url,
       result: payload.thrown ? undefined : result,
       error: payload.thrown ? result : undefined
     };
+    if (payload.truncated) submission.truncated = true;
+    return submission;
   } catch (error) {
     console.error(error);
   }
@@ -536,7 +680,9 @@ const config = {
   transformDirectResult: undefined,
   handleNoJS: undefined,
   endpoint: "/_server",
-  csrf: true
+  csrf: true,
+  bodySizeLimit: 1_048_576,
+  maxArguments: 1000
 };
 function configureServerFunctionsServer({
   provideEvent,
@@ -548,7 +694,9 @@ function configureServerFunctionsServer({
   handleNoJS,
   endpoint,
   csrf,
-  codec
+  codec,
+  bodySizeLimit,
+  maxArguments
 } = {}) {
   if (provideEvent !== undefined) config.provideEvent = provideEvent;
   if (wrapInvocation !== undefined) config.wrapInvocation = wrapInvocation;
@@ -560,6 +708,16 @@ function configureServerFunctionsServer({
   if (endpoint !== undefined) config.endpoint = endpoint;
   if (csrf !== undefined) config.csrf = csrf;
   if (codec !== undefined) configureServerFunctionsCodec(codec);
+  if (bodySizeLimit !== undefined) config.bodySizeLimit = bodySizeLimit;
+  if (maxArguments !== undefined) config.maxArguments = maxArguments;
+}
+const flightSources = new Map();
+function registerFlightDataSource(source, hook) {
+  assertFlightSource(source);
+  flightSources.set(source, hook);
+  return () => {
+    if (flightSources.get(source) === hook) flightSources.delete(source);
+  };
 }
 function provideEvent(event, fn) {
   if (config.provideEvent) return config.provideEvent(event, fn);
@@ -567,6 +725,52 @@ function provideEvent(event, fn) {
   if (ctx) return ctx.run(event, fn);
   throw new Error("No request event provider. Configure one with configureServerFunctionsServer({ provideEvent }).");
 }
+function scopeDeferredResult(value, scope) {
+  if (value === null || typeof value !== "object" && typeof value !== "function") return value;
+  const promised = scope(() => nativePromise(value));
+  if (promised) {
+    return promised.then(result => scope(() => scopeDeferredResult(result, scope)));
+  }
+  if (typeof ReadableStream !== "undefined" && value instanceof ReadableStream) {
+    let reader;
+    return new ReadableStream({
+      async pull(controller) {
+        try {
+          const step = await scope(() => {
+            if (!reader) reader = value.getReader();
+            return reader.read();
+          });
+          if (step.done) controller.close();else controller.enqueue(step.value);
+        } catch (error) {
+          controller.error(error);
+        }
+      },
+      cancel(reason) {
+        return scope(() => reader ? reader.cancel(reason) : value.cancel(reason));
+      }
+    }, {
+      highWaterMark: 0
+    });
+  }
+  const scopedIterator = symbol => ({
+    [symbol]() {
+      const iterator = scope(() => value[symbol]());
+      return new Proxy(iterator, {
+        get(target, property) {
+          const member = Reflect.get(target, property, target);
+          return typeof member === "function" && (property === "next" || property === "return" || property === "throw") ? (...args) => scope(() => member.apply(target, args)) : member;
+        }
+      });
+    }
+  });
+  if (typeof value[Symbol.asyncIterator] === "function") {
+    return scopedIterator(Symbol.asyncIterator);
+  }
+  if (typeof value[Symbol.iterator] === "function" && !Array.isArray(value) && !(value instanceof Map) && !(value instanceof Set) && !ArrayBuffer.isView(value)) {
+    return scopedIterator(Symbol.iterator);
+  }
+  return value;
+}
 const REGISTRATIONS = new Map();
 const METHODS = new Map();
 const INVOCATIONS = new WeakMap();
@@ -581,6 +785,7 @@ function provideRPC() {
 }
 function registerServerFunction(id, callback) {
   provideRPC();
+  if (REGISTRATIONS.get(id) !== callback) METHODS.delete(id);
   REGISTRATIONS.set(id, callback);
   return callback;
 }
@@ -654,13 +859,17 @@ function createServerReference({
       const ogEvt = getRequestEvent();
       if (!ogEvt) throw new Error("Cannot call server function outside of a request");
       const evt = {
-        ...ogEvt
+        ...ogEvt,
+        locals: {
+          ...ogEvt.locals
+        }
       };
       INVOCATIONS.set(evt, {
         id
       });
       evt.serverOnly = true;
-      const result = provideEvent(evt, () => {
+      const scope = run => provideEvent(evt, run);
+      let result = provideEvent(evt, () => {
         const run = () => fn.apply(thisArg, args);
         return config.wrapInvocation ? config.wrapInvocation(run, {
           id,
@@ -669,19 +878,20 @@ function createServerReference({
           direct: true
         }) : run();
       });
+      result = scopeDeferredResult(result, scope);
       const transform = config.transformDirectResult;
       if (transform && result && typeof result.then === "function") {
-        return result.then(value => transform(value, {
+        return result.then(value => scopeDeferredResult(transform(value, {
           id,
           args,
           event: evt
-        }));
+        }), scope));
       }
-      return transform ? transform(result, {
+      return transform ? scopeDeferredResult(transform(result, {
         id,
         args,
         event: evt
-      }) : result;
+      }), scope) : result;
     }
   });
   return proxy;
@@ -725,18 +935,107 @@ function getServerFunctionInvocation() {
 function getEventServerFunctionInvocation(event) {
   return event && INVOCATIONS.get(event);
 }
-function resolveFunctionId(url) {
+function resolveAddress(url) {
   return parseServerFunctionAddress(url.pathname, config.endpoint);
 }
-async function parseArguments(request, url, instance, codec) {
+const DECODE_DEPTH_LIMIT = 64;
+function assertDecodeDepth(value) {
+  let level = [value];
+  for (let depth = 0; level.length > 0; depth++) {
+    if (depth > DECODE_DEPTH_LIMIT) {
+      throw new TypeError("Server function arguments exceed the decode depth limit");
+    }
+    const next = [];
+    for (const node of level) {
+      if (node === null || typeof node !== "object") continue;
+      if (Array.isArray(node)) {
+        for (const child of node) next.push(child);
+      } else {
+        for (const key of Object.keys(node)) next.push(node[key]);
+      }
+    }
+    level = next;
+  }
+}
+const UNSAFE_ARGUMENT_KEYS = ["__proto__", "constructor", "prototype"];
+function stripUnsafeArgumentKeys(value) {
+  const stack = [value];
+  const seen = new Set();
+  while (stack.length) {
+    const v = stack.pop();
+    if (v === null || typeof v !== "object" || seen.has(v)) continue;
+    seen.add(v);
+    for (const key of UNSAFE_ARGUMENT_KEYS) {
+      delete v[key];
+    }
+    for (const key of Object.keys(v)) stack.push(v[key]);
+    if (v instanceof Map) {
+      for (const [k, entry] of v) stack.push(k, entry);
+    } else if (v instanceof Set) {
+      for (const member of v) stack.push(member);
+    }
+  }
+  return value;
+}
+async function bufferBodyWithin(request, limit) {
+  const reader = request.body.getReader();
+  const signal = request.signal;
+  const chunks = [];
+  let total = 0;
+  const onAbort = () => {
+    reader.cancel(signal.reason).catch(() => {});
+  };
+  if (signal.aborted) onAbort();else signal.addEventListener("abort", onAbort, {
+    once: true
+  });
+  try {
+    for (;;) {
+      const {
+        done,
+        value
+      } = await reader.read();
+      if (signal.aborted) throw signal.reason;
+      if (done) break;
+      total += value.byteLength;
+      if (total > limit) {
+        reader.cancel().catch(() => {});
+        return null;
+      }
+      chunks.push(value);
+    }
+  } catch (error) {
+    reader.cancel(error).catch(() => {});
+    throw error;
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+    reader.releaseLock();
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new Request(request, {
+    body
+  });
+}
+async function parseArguments(request, url, scripted, codec) {
   const parsed = [];
   const bodyFormat = request.method === "POST" ? request.headers.get(BODY_FORMAT_HEADER) : null;
   const args = url.searchParams.get("args");
-  if (args && (!instance || request.method === "GET" || bodyFormat !== BodyFormat.Serialized)) {
-    const result = args.startsWith(";0x") ? await deserializeString(args, codec) : JSON.parse(args);
+  if (args && (!scripted || request.method === "GET" || bodyFormat !== BodyFormat.Serialized)) {
+    let result;
+    if (args.startsWith(";0x")) {
+      result = await deserializeString(args, codec);
+    } else {
+      result = JSON.parse(args);
+      assertDecodeDepth(result);
+    }
     if (!Array.isArray(result)) {
       throw new TypeError("Server function arguments must encode an array");
     }
+    stripUnsafeArgumentKeys(result);
     for (const arg of result) {
       parsed.push(arg);
     }
@@ -746,18 +1045,37 @@ async function parseArguments(request, url, instance, codec) {
   if (request.method === "POST" && request.body !== null) {
     const decoded = await extractBody(request.clone(), codec);
     if (bodyFormat === BodyFormat.Serialized || bodyFormat === BodyFormat.Json) {
-      return decoded;
+      if (bodyFormat === BodyFormat.Json) assertDecodeDepth(decoded);
+      if (!Array.isArray(decoded)) {
+        throw new TypeError("Server function arguments must encode an array");
+      }
+      return stripUnsafeArgumentKeys(decoded);
+    }
+    if (decoded === undefined) {
+      if (bodyFormat === null && (await request.clone().arrayBuffer()).byteLength === 0) {
+        return parsed;
+      }
+      throw new TypeError("Server function body carries no usable encoding");
     }
     parsed.push(decoded);
   }
   return parsed;
 }
-async function foldFlightData(hook, event, headers, outcome, context = {}) {
+async function foldFlightData(hooks, event, headers, outcome, context = {}) {
   if (outcome.value instanceof Response && outcome.value.body) return outcome.value;
   digestOutcome(event, outcome);
-  const data = await hook(event, outcome);
-  if (data === undefined) return outcome.value;
-  headers.set(SINGLE_FLIGHT_HEADER, "true");
+  const folded = [];
+  for (const [source, hook] of hooks) {
+    try {
+      const slice = await hook(event, outcome);
+      if (slice !== undefined) folded.push([source, slice]);
+    } catch (error) {
+      console.error(`Error collecting flight data for source "${source}"`, error);
+    }
+  }
+  if (folded.length === 0) return outcome.value;
+  const data = Object.fromEntries(folded);
+  headers.set(SINGLE_FLIGHT_HEADER, folded.map(([source]) => source).join(","));
   if (context.transformFlightResult) {
     const transformed = await context.transformFlightResult(event, {
       value: outcome.value,
@@ -837,7 +1155,7 @@ function foldSetCookies(headers, setCookies) {
 }
 function mergeResponseHeaders(target, source) {
   source.forEach((value, key) => {
-    if (key !== "set-cookie") target.append(key, value);
+    if (key !== "set-cookie" && !COMPOSED_BODY_FRAMING.has(key)) target.append(key, value);
   });
   if (source.getSetCookie) {
     for (const cookie of source.getSetCookie()) target.append("Set-Cookie", cookie);
@@ -846,6 +1164,48 @@ function mergeResponseHeaders(target, source) {
   }
 }
 const validRedirectStatuses = new Set([301, 302, 303, 307, 308]);
+function maskRedirect(headers, response, requestUrl) {
+  const target = response.headers && response.headers.get("Location");
+  if (target) {
+    headers.set(REDIRECT_HEADER, `${response.status} ${new URL(target, requestUrl)}`);
+  }
+  headers.delete("Location");
+}
+const BOUNDED_COMPOSED_HEADERS = [REDIRECT_HEADER, "Location", REVALIDATE_HEADER];
+function enforceComposedHeaderInvariants(response) {
+  for (const name of BOUNDED_COMPOSED_HEADERS) {
+    const value = response.headers.get(name);
+    if (value === null) continue;
+    if (value.length > RESPONSE_HEADER_VALUE_LIMIT) {
+      return refuseComposedHeader(response, name, `${name} response header refused at ${value.length} characters`, DEV ? `The ${name} response header is ${value.length} characters; past ` + `${RESPONSE_HEADER_VALUE_LIMIT} it would overflow receivers (an 8 KiB proxy ` + `buffer holds the whole header block) and the response dies at the socket after ` + `the mutation committed. Refused rather than trimmed: a cut redirect target is a ` + `different address, a dropped revalidate key is a silently stale cache. The ` + `redirect()/reload() helpers enforce this bound with the full reasoning at the ` + `call site.` : null);
+    }
+    if (name === REVALIDATE_HEADER) continue;
+    const target = name === REDIRECT_HEADER ? value.slice(value.indexOf(" ") + 1) : value;
+    if (!isHttpNavigationTarget(target)) {
+      return refuseComposedHeader(response, name, `${name} response header refused: non-http(s) navigation target`, DEV ? `The ${name} response header carries a navigation target with a non-http(s) ` + `scheme ("${target.slice(0, 64)}"). A javascript: target is same-origin script ` + `execution in any integration that navigates to it, so only http(s) and ` + `relative targets leave this transport. If the target came from request data ` + `(?next= and friends), validate it against your own origin before redirecting.` : null);
+    }
+  }
+  return response;
+}
+function refuseComposedHeader(response, name, headerMessage, body) {
+  if (response.body) {
+    try {
+      const cancelled = response.body.cancel();
+      if (cancelled && typeof cancelled.then === "function") cancelled.then(undefined, () => {});
+    } catch {}
+  }
+  const headers = new Headers();
+  headers.set(ERROR_HEADER, boundedErrorHeaderValue(DEV ? headerMessage : GENERIC_SERVER_ERROR_MESSAGE));
+  return new Response(body, {
+    status: 500,
+    headers
+  });
+}
+function warnScripted304(functionId) {
+  if (DEV) {
+    console.warn(`Server function "${functionId}" answered a scripted call with 304 Not Modified. ` + `The client transport sends no conditional headers, so nothing was asked to be ` + `revalidated: the call resolves to undefined, not "unchanged". For conditional ` + `reads, declare the function GET and set ETag/Cache-Control response headers - ` + `the browser owns that exchange and replays its cached answer on a 304.`);
+  }
+}
 function createNoJSHandler({
   base = ""
 } = {}) {
@@ -889,44 +1249,291 @@ function isFormPost(request) {
   const type = request.headers.get("content-type") || "";
   return type.startsWith("application/x-www-form-urlencoded") || type.startsWith("multipart/form-data");
 }
-function serializeResponseStream(value, codecOptions, signal) {
-  let closeIterator = null;
-  let closed = false;
-  let cancelSerialize = null;
-  let onAbort = null;
-  const teardown = () => {
-    if (closed) return;
-    closed = true;
-    if (onAbort) signal.removeEventListener("abort", onAbort);
-    if (cancelSerialize) cancelSerialize();
-    if (closeIterator) closeIterator();
+function guardFailures(value, state) {
+  if (!state) state = {
+    seen: new WeakMap(),
+    cyclic: new WeakSet()
   };
-  if (value !== null && typeof value === "object" && typeof value[Symbol.asyncIterator] === "function") {
+  const entered = enterGuard(value, state);
+  if (!(entered instanceof Frame)) return entered;
+  const stack = [entered];
+  let delivered = NOTHING;
+  for (;;) {
+    const top = stack[stack.length - 1];
+    const items = top.items;
+    let pushed = null;
+    while (top.i < items.length) {
+      const i = top.i;
+      let original;
+      if (top.kind === OBJECT) {
+        const descriptor = top.descriptors[items[i]];
+        if ("value" in descriptor) {
+          original = descriptor.value;
+        } else if (typeof descriptor.get === "function") {
+          if (top.accessorRead !== i) {
+            try {
+              top.accessorValue = descriptor.get.call(top.value);
+            } catch (error) {
+              throw sanitizeServerError(error);
+            }
+            top.accessorRead = i;
+          }
+          original = top.accessorValue;
+        } else {
+          top.i++;
+          continue;
+        }
+      } else {
+        original = items[i];
+      }
+      let guarded;
+      if (delivered !== NOTHING) {
+        guarded = delivered;
+        delivered = NOTHING;
+      } else {
+        guarded = enterGuard(original, state);
+        if (guarded instanceof Frame) {
+          pushed = guarded;
+          break;
+        }
+      }
+      if (top.kind === ARRAY) {
+        if (guarded !== original) {
+          top.next[i] = guarded;
+          top.changed = true;
+        }
+      } else if (top.kind === MAP) {
+        if ((i & 1) === 0) top.pendingKey = guarded;else top.next.set(top.pendingKey, guarded);
+        if (guarded !== original) top.changed = true;
+      } else if (top.kind === SET) {
+        top.next.add(guarded);
+        if (guarded !== original) top.changed = true;
+      } else if (guarded !== original || top.accessorRead === i) {
+        Object.defineProperty(top.next, items[i], {
+          value: guarded,
+          writable: true,
+          configurable: true,
+          enumerable: top.descriptors[items[i]].enumerable
+        });
+        top.changed = true;
+      }
+      top.i++;
+    }
+    if (pushed !== null) {
+      stack.push(pushed);
+      continue;
+    }
+    stack.pop();
+    const out = keepGuarded(top.value, top.next, top.changed, state);
+    if (stack.length === 0) return out;
+    delivered = out;
+  }
+}
+const NOTHING = Symbol();
+const ARRAY = 0;
+const MAP = 1;
+const SET = 2;
+const OBJECT = 3;
+class Frame {
+  constructor(kind, value, next, items, descriptors) {
+    this.kind = kind;
+    this.value = value;
+    this.next = next;
+    this.items = items;
+    this.descriptors = descriptors;
+    this.i = 0;
+    this.changed = false;
+    this.accessorRead = -1;
+    this.accessorValue = undefined;
+    this.pendingKey = undefined;
+  }
+}
+function guardOperation(state, run) {
+  return state.scope ? state.scope(run) : run();
+}
+function enterGuard(value, state) {
+  if (value === null || typeof value !== "object") return value;
+  if (state.seen.has(value)) {
+    state.cyclic.add(value);
+    return state.seen.get(value);
+  }
+  if (typeof ReadableStream !== "undefined" && value instanceof ReadableStream) {
+    let reader;
+    const gate = state.gate;
+    let finished = false;
+    const close = () => {
+      if (finished) return;
+      finished = true;
+      try {
+        const cancelled = guardOperation(state, () => reader ? reader.cancel() : value.cancel());
+        if (cancelled && typeof cancelled.then === "function") cancelled.then(undefined, () => {});
+      } catch {}
+    };
+    const guardedStream = new ReadableStream({
+      async pull(controller) {
+        try {
+          if (gate && !finished && !gate.wantsMore()) await gate.awaitDemand();
+          if (finished) {
+            controller.close();
+            return;
+          }
+          if (!reader) reader = guardOperation(state, () => value.getReader());
+          const {
+            done,
+            value: chunk
+          } = await guardOperation(state, () => reader.read());
+          done ? controller.close() : controller.enqueue(guardOperation(state, () => guardFailures(chunk, state)));
+        } catch (error) {
+          controller.error(guardOperation(state, () => sanitizeServerError(error)));
+        }
+      },
+      cancel(reason) {
+        finished = true;
+        return guardOperation(state, () => reader ? reader.cancel(reason) : value.cancel(reason));
+      }
+    });
+    if (gate) gate.onOpen(close);
+    state.seen.set(value, guardedStream);
+    return guardedStream;
+  }
+  if (typeof value.then === "function") {
+    const guardedPromise = Promise.resolve(value).then(resolved => guardOperation(state, () => guardFailures(resolved, state)), error => {
+      throw guardOperation(state, () => sanitizeServerError(error));
+    });
+    guardedPromise.catch(() => {});
+    state.seen.set(value, guardedPromise);
+    return guardedPromise;
+  }
+  if (typeof value[Symbol.asyncIterator] === "function") {
     const source = value;
-    value = {
+    const gate = state.gate;
+    const guardedIterable = {
       [Symbol.asyncIterator]() {
-        const it = source[Symbol.asyncIterator]();
+        const iterator = guardOperation(state, () => source[Symbol.asyncIterator]());
         let finished = false;
-        closeIterator = () => {
+        const close = () => {
           if (finished) return;
           finished = true;
           try {
-            const returned = it.return && it.return();
+            const returned = iterator.return && guardOperation(state, () => iterator.return());
             if (returned && typeof returned.then === "function") returned.then(undefined, () => {});
           } catch {}
         };
-        if (closed) closeIterator();
+        if (gate) gate.onOpen(close);
+        const step = () => finished ? Promise.resolve({
+          done: true,
+          value: undefined
+        }) : guardOperation(state, () => iterator.next()).then(step => {
+          if (step.done) {
+            finished = true;
+            return step;
+          }
+          return {
+            done: false,
+            value: guardOperation(state, () => guardFailures(step.value, state))
+          };
+        }, error => {
+          throw guardOperation(state, () => sanitizeServerError(error));
+        });
         return {
-          next: () => finished ? Promise.resolve({
-            done: true,
-            value: undefined
-          }) : it.next()
+          next: () => finished || !gate || gate.wantsMore() ? step() : gate.awaitDemand().then(step),
+          return: () => {
+            close();
+            return Promise.resolve({
+              done: true,
+              value: undefined
+            });
+          }
         };
       }
     };
+    state.seen.set(value, guardedIterable);
+    return guardedIterable;
+  }
+  if (state.scope && typeof value[Symbol.iterator] === "function" && !Array.isArray(value) && !(value instanceof Map) && !(value instanceof Set) && !ArrayBuffer.isView(value)) {
+    const scopedIterable = scopeDeferredResult(value, state.scope);
+    state.seen.set(value, scopedIterable);
+    return scopedIterable;
+  }
+  if (Array.isArray(value)) {
+    const next = value.slice();
+    state.seen.set(value, next);
+    return new Frame(ARRAY, value, next, value, null);
+  }
+  if (value instanceof Map) {
+    const next = new Map();
+    state.seen.set(value, next);
+    const items = [];
+    for (const entry of value) items.push(entry[0], entry[1]);
+    return new Frame(MAP, value, next, items, null);
+  }
+  if (value instanceof Set) {
+    const next = new Set();
+    state.seen.set(value, next);
+    return new Frame(SET, value, next, [...value], null);
   }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    state.seen.set(value, value);
+    return value;
+  }
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  for (const key of Object.keys(descriptors)) {
+    descriptors[key].configurable = true;
+    if ("value" in descriptors[key]) descriptors[key].writable = true;
+  }
+  const next = Object.create(prototype, descriptors);
+  state.seen.set(value, next);
+  return new Frame(OBJECT, value, next, Object.keys(value), descriptors);
+}
+function keepGuarded(value, next, changed, state) {
+  if (changed || state.cyclic.has(value)) return next;
+  state.seen.set(value, value);
+  return value;
+}
+function serializeResponseStream(value, codecOptions, signal, scope) {
+  let closed = false;
+  let streamController = null;
+  let demandWaiters = null;
+  const wantsMore = () => streamController !== null && streamController.desiredSize > 0;
+  const awaitDemand = () => new Promise(resolve => (demandWaiters ??= []).push(resolve));
+  const supplyDemand = () => {
+    const resolvers = demandWaiters;
+    demandWaiters = null;
+    if (resolvers) for (const resolve of resolvers) resolve();
+  };
+  const sourceClosers = new Set();
+  const gate = {
+    wantsMore,
+    awaitDemand,
+    onOpen(close) {
+      if (closed) close();else sourceClosers.add(close);
+    }
+  };
+  const guardState = {
+    seen: new WeakMap(),
+    cyclic: new WeakSet(),
+    gate,
+    scope
+  };
+  value = guardOperation(guardState, () => guardFailures(value, guardState));
+  let cancelSerialize = null;
+  let onAbort = null;
+  const finishSource = () => {
+    for (const close of sourceClosers) close();
+    sourceClosers.clear();
+    supplyDemand();
+  };
+  const teardown = () => {
+    if (closed) return;
+    closed = true;
+    if (onAbort) signal.removeEventListener("abort", onAbort);
+    if (cancelSerialize) cancelSerialize();
+    finishSource();
+  };
   return new ReadableStream({
     async start(controller) {
+      streamController = controller;
       if (signal) {
         if (signal.aborted) {
           teardown();
@@ -962,29 +1569,54 @@ function serializeResponseStream(value, codecOptions, signal) {
           if (closed) return;
           closed = true;
           if (onAbort) signal.removeEventListener("abort", onAbort);
+          finishSource();
           controller.close();
         },
         onError(error) {
           if (closed) return;
           closed = true;
           if (onAbort) signal.removeEventListener("abort", onAbort);
-          controller.error(error);
+          finishSource();
+          try {
+            const delivered = sanitizeServerError(DEV && error instanceof Error ? new Error(`Server function result could not be encoded: ${error.message}`) : error);
+            controller.enqueue(createChunk(encodeErrorTrailer(delivered)));
+            controller.close();
+          } catch {
+            try {
+              controller.error(error);
+            } catch {}
+          }
         }
       });
     },
+    pull() {
+      supplyDemand();
+    },
     cancel() {
       teardown();
     }
   });
 }
-function serializedResponse(value, headers, codec, signal) {
+function serializedResponse(value, headers, codec, signal, scope) {
   headers.set(BODY_FORMAT_HEADER, BodyFormat.Serialized);
   headers.set("Content-Type", "text/plain");
-  return new Response(serializeResponseStream(value, codec, signal), {
+  return new Response(serializeResponseStream(value, codec, signal, scope), {
     headers
   });
 }
-function encodeResult(value, headers, status, codec, signal) {
+function encodeResult(value, headers, status, codec, signal, scope) {
+  if (NULL_BODY_STATUSES.has(status)) {
+    if (value === undefined || value === null) {
+      headers.set(BODY_FORMAT_HEADER, BodyFormat.Void);
+      return new Response(null, {
+        status,
+        headers
+      });
+    }
+    const error = new Error(`Server function answered status ${status}, which forbids a response body, with a value. ` + `Return respond(undefined, { status: ${status} }) for a bodiless answer, or drop the ` + `status to send the value.`);
+    headers.set(ERROR_HEADER, encodeErrorHeaderValue(error.message));
+    return encodeResult(error, headers, 500, codec, signal, scope);
+  }
   const direct = getHeadersAndBody(value);
   if (direct) {
     for (const [key, val] of Object.entries(direct.headers || {})) {
@@ -1003,21 +1635,37 @@ function encodeResult(value, headers, status, codec, signal) {
     });
   }
   try {
-    if (isJSONSafe(value)) {
+    const jsonSafe = scope ? scope(() => isJSONSafe(value)) : isJSONSafe(value);
+    if (jsonSafe) {
       headers.set(BODY_FORMAT_HEADER, BodyFormat.Json);
       headers.set("Content-Type", "application/json");
-      return new Response(JSON.stringify(value), {
+      const body = scope ? scope(() => JSON.stringify(value)) : JSON.stringify(value);
+      return new Response(body, {
         status,
         headers
       });
     }
   } catch {
   }
-  const response = serializedResponse(value, headers, codec, signal);
-  return status === 200 ? response : new Response(response.body, {
-    status,
-    headers
-  });
+  try {
+    const response = serializedResponse(value, headers, codec, signal, scope);
+    return status === 200 ? response : new Response(response.body, {
+      status,
+      headers
+    });
+  } catch (error) {
+    throw DEV && error instanceof Error ? new Error(`Server function result could not be encoded: ${error.message}`) : error;
+  }
+}
+const ERROR_HEADER_VALUE_LIMIT = 1024;
+function boundedErrorHeaderValue(message) {
+  let label = message.length > 256 ? message.slice(0, 256) : message;
+  let encoded = encodeErrorHeaderValue(label);
+  while (encoded.length > ERROR_HEADER_VALUE_LIMIT && label.length > 1) {
+    label = label.slice(0, Math.ceil(label.length / 2));
+    encoded = encodeErrorHeaderValue(label);
+  }
+  return encoded;
 }
 const GENERIC_SERVER_ERROR_MESSAGE = "Internal Server Error";
 let DEV = true === true;
@@ -1041,11 +1689,12 @@ function serverFunctionUrl(id, boundArgs) {
   return `${address}?args=${encodeURIComponent(JSON.stringify(boundArgs))}`;
 }
 function parseServerFunctionUrl(url) {
-  return parseServerFunctionAddress(new URL(url, "http://localhost").pathname, config.endpoint);
+  const parsed = parseServerFunctionAddress(new URL(url, "http://localhost").pathname, config.endpoint);
+  return parsed && parsed.id;
 }
 async function matchesOrigin(origin, request, matcher) {
   if (matcher === undefined) return origin === new URL(request.url).origin;
-  if (typeof matcher === "function") return !!(await matcher(origin, request));
+  if (typeof matcher === "function") return (await matcher(origin, request)) === true;
   return Array.isArray(matcher) ? matcher.includes(origin) : origin === matcher;
 }
 async function allowsServerFunctionRequest(request, options) {
@@ -1097,14 +1746,37 @@ function forbiddenResponse() {
     }
   }));
 }
+function nativePromise(value) {
+  if (value instanceof Promise) return value;
+  try {
+    if (Object.prototype.toString.call(value) === "[object Promise]") return Promise.prototype.then.call(value, value => value);
+  } catch {}
+}
 async function handleServerFunctionRequest(request, options = {}) {
-  const codec = options.codec !== undefined ? options.codec : getServerFunctionsCodec();
+  const codec = {
+    ...(options.codec !== undefined ? options.codec : getServerFunctionsCodec())
+  };
+  codec.serializeErrorStacks ??= DEV;
   const url = new URL(request.url);
   const method = request.method;
-  const functionId = resolveFunctionId(url);
+  const address = resolveAddress(url);
+  const functionId = address && address.id;
   const declaredRead = (method === "GET" || method === "HEAD") && functionId !== null && METHODS.get(functionId) === "GET";
   const csrf = options.csrf !== undefined ? options.csrf : config.csrf;
-  const protectsRequest = csrf !== false && !declaredRead;
+  const protectsRequest = csrf !== false && (!declaredRead || typeof csrf === "object" && csrf.protectDeclaredReads === true);
+  let serverFunction;
+  if (functionId) {
+    try {
+      serverFunction = getServerFunction(functionId);
+    } catch {
+      return finalizeTransportResponse(new Response(DEV ? `Unknown server function: ${functionId}` : null, {
+        status: 404,
+        headers: {
+          [UNKNOWN_HEADER]: "true"
+        }
+      }), method);
+    }
+  }
   if (protectsRequest && !(await allowsServerFunctionRequest(request, csrf === true ? {} : csrf))) {
     return finalizeTransportResponse(forbiddenResponse(), method);
   }
@@ -1115,15 +1787,7 @@ async function handleServerFunctionRequest(request, options = {}) {
     });
     return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
-  let serverFunction;
-  try {
-    serverFunction = getServerFunction(functionId);
-  } catch {
-    const response = new Response(DEV ? `Unknown server function: ${functionId}` : null, {
-      status: 404
-    });
-    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
-  }
+  const scripted = address.data;
   if (method !== "POST" && !declaredRead) {
     const response = new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
       status: 405,
@@ -1133,25 +1797,103 @@ async function handleServerFunctionRequest(request, options = {}) {
     });
     return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
-  const event = options.createEvent ? options.createEvent(request) : {
-    request,
-    locals: {}
+  const bodySizeLimit = options.bodySizeLimit !== undefined ? options.bodySizeLimit : config.bodySizeLimit;
+  const argsEncoding = url.searchParams.get("args");
+  if (argsEncoding !== null && argsEncoding.length > bodySizeLimit) {
+    const response = new Response(DEV ? "Server function arguments exceed the configured bodySizeLimit" : null, {
+      status: 413
+    });
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+  }
+  if (method === "POST" && request.body !== null && bodySizeLimit !== Infinity) {
+    const raw = request.headers.get("content-length");
+    const declared = raw !== null && /^\d+$/.test(raw) ? Number(raw) : NaN;
+    if (declared > bodySizeLimit) {
+      const response = new Response(DEV ? "Server function request body exceeds the configured bodySizeLimit" : null, {
+        status: 413
+      });
+      return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+    }
+    if (!(declared > 0)) {
+      let bounded;
+      try {
+        bounded = await bufferBodyWithin(request, bodySizeLimit);
+      } catch {
+        const response = new Response(DEV ? "Malformed server function arguments" : null, {
+          status: 400
+        });
+        return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+      }
+      if (bounded === null) {
+        const response = new Response(DEV ? "Server function request body exceeds the configured bodySizeLimit" : null, {
+          status: 413
+        });
+        return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+      }
+      request = bounded;
+    }
+  }
+  let event;
+  try {
+    event = options.createEvent ? options.createEvent(request) : {
+      request,
+      locals: {}
+    };
+    const promised = nativePromise(event);
+    if (promised) event = await promised;
+  } catch (error) {
+    const safe = sanitizeServerError(error);
+    const message = safe instanceof Error ? safe.message : String(safe);
+    const headers = new Headers();
+    headers.set(ERROR_HEADER, boundedErrorHeaderValue(message));
+    const response = scripted ? encodeResult(safe, headers, 500, codec, request.signal) : new Response(DEV ? message : null, {
+      status: 500
+    });
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+  }
+  const refuseCommitted = raw => {
+    const response = commitEventResponse(raw, event);
+    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   };
   const provide = options.provideEvent || provideEvent;
+  const scope = run => provide(event, run);
   const flightHook = options.collectFlightData !== undefined ? options.collectFlightData : config.collectFlightData;
   const transformResult = options.transformResult !== undefined ? options.transformResult : config.transformResult;
   const wrapInvocation = options.wrapInvocation !== undefined ? options.wrapInvocation : config.wrapInvocation;
   const transformFlightResult = options.transformFlightResult !== undefined ? options.transformFlightResult : config.transformFlightResult;
-  const handleNoJS = options.handleNoJS !== undefined ? options.handleNoJS : config.handleNoJS !== undefined ? config.handleNoJS : isFormPost(request) ? defaultNoJSHandler || (defaultNoJSHandler = createNoJSHandler()) : undefined;
-  const collectsFlight = !!(flightHook && instance && request.headers.has(SINGLE_FLIGHT_HEADER));
+  let handleNoJS = options.handleNoJS !== undefined ? options.handleNoJS : config.handleNoJS;
+  if (handleNoJS === undefined && !scripted && isFormPost(request)) {
+    const fetchMode = request.headers.get("Sec-Fetch-Mode");
+    if (fetchMode === null || fetchMode === "navigate") {
+      handleNoJS = defaultNoJSHandler || (defaultNoJSHandler = createNoJSHandler());
+    } else {
+      const response = new Response(DEV ? "The bare server-function address answers form navigations with the " + "no-JS redirect convention. Scripted callers use the data address " + `(…/data/${functionId}) or send the ${BODY_FORMAT_HEADER} tag.` : null, {
+        status: 400
+      });
+      return refuseCommitted(response);
+    }
+  }
+  const flightHeader = scripted && method === "POST" ? request.headers.get(SINGLE_FLIGHT_HEADER) : null;
+  const flightHooks = flightHeader ? flightHeader.split(",").flatMap(source => {
+    const hook = source === "true" ? flightHook : flightSources.get(source);
+    return hook ? [[source, hook]] : [];
+  }) : [];
+  const collectsFlight = flightHooks.length > 0;
   let parsed;
   try {
-    parsed = await parseArguments(request, url, instance, codec);
+    parsed = await parseArguments(request, url, scripted, codec);
   } catch {
     const response = new Response(DEV ? "Malformed server function arguments" : null, {
       status: 400
     });
-    return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
+    return refuseCommitted(response);
+  }
+  const maxArguments = options.maxArguments !== undefined ? options.maxArguments : config.maxArguments;
+  if (parsed.length > maxArguments) {
+    const response = new Response(DEV ? "Server function call exceeds the configured maxArguments" : null, {
+      status: 400
+    });
+    return refuseCommitted(response);
   }
   const flightContext = {
     id: functionId,
@@ -1165,7 +1907,8 @@ async function handleServerFunctionRequest(request, options = {}) {
   const headers = new Headers();
   const dispatch = async () => {
     try {
-      let result = await provide(event, async () => {
+      let invocations = 0;
+      const invokeOnce = async () => {
         INVOCATIONS.set(event, {
           id: functionId
         });
@@ -1177,7 +1920,16 @@ async function handleServerFunctionRequest(request, options = {}) {
           request,
           direct: false
         }) : run();
+      };
+      let result = await provide(event, () => {
+        if (++invocations > 1) {
+          throw new Error("provideEvent invoked the server function callback more than once: a second " + "invocation would commit the call's side effects twice. The hook must call " + "fn exactly once and return its result.");
+        }
+        return invokeOnce();
       });
+      if (invocations !== 1) {
+        throw new Error(invocations === 0 ? "provideEvent returned without invoking the server function callback: the call " + "would have answered as a void success without running the function. The hook " + "must call fn exactly once and return its result." : "provideEvent invoked the server function callback more than once: a second " + "invocation would commit the call's side effects twice. The hook must call " + "fn exactly once and return its result.");
+      }
       if (transformResult) {
         result = await transformResult(event, result, flightContext);
       }
@@ -1188,25 +1940,29 @@ async function handleServerFunctionRequest(request, options = {}) {
           response,
           value
         } = result;
-        if (!instance && !handleNoJS && response && response.body) {
+        if (!scripted && !handleNoJS && response && response.body) {
           return response;
         }
         if (response && response.headers) {
           mergeResponseHeaders(headers, response.headers);
         }
-        if (response && response.status && (response.status < 300 || response.status >= 400)) {
+        if (response && response.status && (!scripted || !validRedirectStatuses.has(response.status))) {
           status = response.status;
+        } else if (response && response.status) {
+          maskRedirect(headers, response, request.url);
         }
         metadata = response;
         result = value;
       } else if (result instanceof Response) {
         if (result.headers && result.headers.has("X-Content-Raw")) return result;
-        if (instance) {
+        if (scripted) {
           if (result.headers) {
             mergeResponseHeaders(headers, result.headers);
           }
-          if (result.status && (result.status < 300 || result.status >= 400)) {
+          if (result.status && !validRedirectStatuses.has(result.status)) {
             status = result.status;
+          } else if (result.status) {
+            maskRedirect(headers, result, request.url);
           }
           metadata = result;
           if (result.body == null) {
@@ -1215,7 +1971,7 @@ async function handleServerFunctionRequest(request, options = {}) {
         }
       }
       if (collectsFlight) {
-        result = await foldFlightData(flightHook, event, headers, {
+        result = await foldFlightData(flightHooks, event, headers, {
           id: functionId,
           value: result,
           response: metadata,
@@ -1224,19 +1980,37 @@ async function handleServerFunctionRequest(request, options = {}) {
         }, flightContext);
         if (result instanceof Response && result.headers.has("X-Content-Raw")) return result;
       }
-      if (!instance) {
-        if (handleNoJS) return handleNoJS(result, request, parsed);
+      if (!scripted) {
+        if (handleNoJS) return handleNoJS(result ?? metadata, request, parsed);
         if (result instanceof Response) return result;
-        return encodeResult(result, headers, 200, codec, request.signal);
+        return encodeResult(result, headers, status, codec, request.signal, scope);
       }
-      return encodeResult(result, headers, status, codec, request.signal);
+      if (status === 304) warnScripted304(functionId);
+      return encodeResult(result, headers, status, codec, request.signal, scope);
     } catch (x) {
+      const respondThrown = value => {
+        const safe = sanitizeServerError(value);
+        if (!scripted) {
+          if (handleNoJS) return handleNoJS(safe, request, parsed, true);
+          const message = safe instanceof Error ? safe.message : String(safe);
+          return new Response(DEV ? message : null, {
+            status: 500
+          });
+        }
+        const error = safe instanceof Error ? safe.message : typeof safe === "string" ? safe : "true";
+        headers.set(ERROR_HEADER, boundedErrorHeaderValue(error));
+        return encodeResult(safe, headers, 500, codec, request.signal, scope);
+      };
       if (x instanceof Response || isResponseEnvelope(x)) {
         if (transformResult) {
-          x = await transformResult(event, x, {
-            ...flightContext,
-            thrown: true
-          });
+          try {
+            x = await transformResult(event, x, {
+              ...flightContext,
+              thrown: true
+            });
+          } catch (hookError) {
+            return respondThrown(hookError);
+          }
         }
         let status = 200;
         let metadata;
@@ -1248,8 +2022,10 @@ async function handleServerFunctionRequest(request, options = {}) {
           if (response && response.headers) {
             mergeResponseHeaders(headers, response.headers);
           }
-          if (response && response.status && (!instance || response.status < 300 || response.status >= 400)) {
+          if (response && response.status && (!scripted || !validRedirectStatuses.has(response.status))) {
             status = response.status;
+          } else if (response && response.status) {
+            maskRedirect(headers, response, request.url);
           }
           metadata = response;
           x = value;
@@ -1257,8 +2033,10 @@ async function handleServerFunctionRequest(request, options = {}) {
           if (x.headers) {
             mergeResponseHeaders(headers, x.headers);
           }
-          if (x.status && (!instance || x.status < 300 || x.status >= 400)) {
+          if (x.status && (!scripted || !validRedirectStatuses.has(x.status))) {
             status = x.status;
+          } else if (x.status) {
+            maskRedirect(headers, x, request.url);
           }
           metadata = x;
           if (x.body == null) {
@@ -1266,7 +2044,7 @@ async function handleServerFunctionRequest(request, options = {}) {
           }
         }
         if (collectsFlight) {
-          x = await foldFlightData(flightHook, event, headers, {
+          x = await foldFlightData(flightHooks, event, headers, {
             id: functionId,
             value: x,
             response: metadata,
@@ -1274,38 +2052,38 @@ async function handleServerFunctionRequest(request, options = {}) {
             thrown: true
           }, flightContext);
           if (x instanceof Response && x.headers.has("X-Content-Raw")) {
+            x = ownResponse(x);
             x.headers.set(ERROR_HEADER, "true");
             return x;
           }
         }
         headers.set(ERROR_HEADER, "true");
-        if (!instance) {
+        if (!scripted) {
           if (handleNoJS) return handleNoJS(x ?? metadata, request, parsed, true);
           if (x instanceof Response) return x;
         }
-        return encodeResult(x, headers, status, codec, request.signal);
-      }
-      const safe = sanitizeServerError(x);
-      if (!instance) {
-        if (handleNoJS) return handleNoJS(safe, request, parsed, true);
-        const message = safe instanceof Error ? safe.message : String(safe);
-        return new Response(DEV ? message : null, {
-          status: 500
-        });
+        if (scripted && status === 304) warnScripted304(functionId);
+        return encodeResult(x, headers, status, codec, request.signal, scope);
       }
-      const error = safe instanceof Error ? safe.message : typeof safe === "string" ? safe : "true";
-      headers.set(ERROR_HEADER, encodeErrorHeaderValue(error));
-      return encodeResult(safe, headers, 200, codec, request.signal);
+      return respondThrown(x);
     }
   };
-  const response = commitEventResponse(await dispatch(), event);
+  const response = commitEventResponse(enforceComposedHeaderInvariants(ownResponse(await dispatch())), event);
   return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
 }
+function ownResponse(response) {
+  try {
+    return new Response(response.body, response);
+  } catch {
+    return response;
+  }
+}
 function finalizeTransportResponse(response, method) {
   const stripBody = method === "HEAD" && response.body !== null;
-  if (stripBody || !response.headers.has("Cache-Control")) {
+  const defaultsCache = !response.headers.has("Cache-Control") && response.status !== 304;
+  if (stripBody || defaultsCache) {
     try {
-      if (!response.headers.has("Cache-Control")) {
+      if (defaultsCache) {
         response.headers.set("Cache-Control", "no-store");
       }
       if (!stripBody) return response;
@@ -1317,7 +2095,7 @@ function finalizeTransportResponse(response, method) {
       });
     } catch {
       const headers = new Headers(response.headers);
-      if (!headers.has("Cache-Control")) headers.set("Cache-Control", "no-store");
+      if (defaultsCache && !headers.has("Cache-Control")) headers.set("Cache-Control", "no-store");
       if (stripBody) response.body.cancel().catch(() => {});
       return new Response(stripBody ? null : response.body, {
         status: response.status,
@@ -1329,4 +2107,4 @@ function finalizeTransportResponse(response, method) {
   return response;
 }
 
-export { ERROR_HEADER, FLASH_COOKIE, GENERIC_SERVER_ERROR_MESSAGE, GET, INSTANCE_HEADER, SERVER_FUNCTION_INVOKE, SINGLE_FLIGHT_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getEventServerFunctionInvocation, getServerFunction, getServerFunctionInvocation, getServerFunctionMetadata, handleServerFunctionRequest, hasFlashCookie, invoke, isServerFunction, live, observeServerFunctionCalls, parseServerFunctionUrl, registerServerFunction, registerServerReference, sanitizeServerError, serializeResponseStream, serverFunctionUrl, setServerFunctionsDev, subscribeFlightData, withMeta };
+export { ERROR_HEADER, FLASH_COOKIE, GENERIC_SERVER_ERROR_MESSAGE, GET, INSTANCE_HEADER, REDIRECT_HEADER, SERVER_FUNCTION_INVOKE, SINGLE_FLIGHT_HEADER, UNKNOWN_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeRedirectHeaderValue, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getEventServerFunctionInvocation, getServerFunction, getServerFunctionInvocation, getServerFunctionMetadata, guardFailures, handleServerFunctionRequest, hasFlashCookie, invoke, isServerFunction, live, observeServerFunctionCalls, parseServerFunctionUrl, registerFlightDataSource, registerServerFunction, registerServerReference, sanitizeServerError, serializeResponseStream, serverFunctionUrl, setServerFunctionsDev, subscribeFlightData, withMeta };