@solidjs/web 2.0.0-rc.4 → 2.0.0-rc.6

package/types/client.d.ts

@@ -136,7 +136,7 @@ export declare function claimElement<T extends Element>(node: T): T;
 export declare function setAttribute(node: Element, name: string, value: string): void;
 export declare function setAttributeNS(node: Element, namespace: string, name: string, value: string): void;
 export declare function className(node: Element, value: JSX.ClassValue, prev?: JSX.ClassValue): void;
-export declare function addEvent(node: Element, name: string, handler: EventListener | EventListenerObject | (EventListenerObject & AddEventListenerOptions), delegate: boolean): void;
+export declare function addEvent(node: Element, name: string, handler: EventListener | EventListenerObject | (EventListenerObject & AddEventListenerOptions), delegate: boolean): EventListener | EventListenerObject | void;
 export declare function style(node: Element, value: {
     [k: string]: string;
 }, prev?: {
@@ -149,6 +149,7 @@ export declare function applyRef<T extends Element = Element>(r: ((element: NoIn
 export declare function ref(fn: () => ((element: Element) => void) | ((element: Element) => void)[], element: Element): void;
 /** Compiler-emitted primitive; not for hand-written code. @internal */
 export declare function scope<T extends () => any>(fn: T): T;
+export declare function getInsertionParent(): Node | undefined;
 export declare function installHydrationRuntime(): void;
 /**
  * Compiler-emitted primitive; not for hand-written code.

package/types/constants.d.ts

@@ -15,4 +15,6 @@ declare const Namespaces: Record<string, string>;
 declare const VoidElements: Set<string>;
 declare const RawTextElements: Set<string>;
 declare const DOMElements: Set<string>;
-export { DOMWithState, ChildProperties, DelegatedEvents, SVGElements, MathMLElements, VoidElements, RawTextElements, Namespaces, DOMElements, $$SLOT, $$HOST };
+declare const COMPOSED_BODY_FRAMING: ReadonlySet<string>;
+declare function isHttpNavigationTarget(target: string): boolean;
+export { DOMWithState, ChildProperties, DelegatedEvents, SVGElements, MathMLElements, VoidElements, RawTextElements, Namespaces, DOMElements, $$SLOT, $$HOST, COMPOSED_BODY_FRAMING, isHttpNavigationTarget };

package/types/cookies.d.ts

@@ -13,6 +13,12 @@ export interface CookieOptions {
     secure?: boolean;
     /** Cookie `SameSite` attribute, any case. */
     sameSite?: "lax" | "strict" | "none" | "Lax" | "Strict" | "None";
+    /**
+     * Emit the `Partitioned` attribute (CHIPS): a third-party cookie keyed to
+     * the top-level site it was set under — the only third-party cookie that
+     * keeps working as browsers finish removing the rest. Requires `secure`.
+     */
+    partitioned?: boolean;
 }
 /**
  * Parses a `Cookie` request header into a name → value map. Names and
@@ -25,20 +31,6 @@ export interface CookieOptions {
  * `parseCookieHeader(event.request.headers.get("cookie"))`.
  */
 export declare function parseCookieHeader(header: string | null | undefined): Record<string, string>;
-/**
- * Serializes a cookie to a `Set-Cookie` header value. The name and value
- * are `encodeURIComponent`-encoded (the parser decodes symmetrically);
- * `path` defaults to `/` — the only defaulted attribute — and every other
- * attribute is emitted exactly when the caller asked for it: `domain`,
- * `maxAge` (seconds, truncated to an integer), `expires` (a `Date`),
- * `httpOnly`, `secure`, `sameSite` (`"lax" | "strict" | "none"`, any
- * case).
- *
- * The write half of the platform gap — the blessed response-cookie write
- * is `event.response.headers.append("set-cookie", serializeCookie(name,
- * value, options))`, which every head materialization path carries to the
- * wire entry-by-entry.
- */
 export declare function serializeCookie(name: string, value: string, options?: CookieOptions): string;
 export declare const FLASH_COOKIE = "flash";
 /** Whether a Cookie header carries a flash cookie (readable or not). */

package/types/frames/frame-client.d.ts

@@ -59,6 +59,10 @@ export type FrameChunk = {
         content?: string;
         attrs?: Record<string, string>;
     }[];
+    preloads?: {
+        href: string;
+        attrs: Record<string, string>;
+    }[];
 } | {
     type: "slot";
     id: string;

package/types/frames/serializer-decode.d.ts

@@ -105,6 +105,18 @@ export interface JSONCodecOptions {
     disabledFeatures?: number;
     /** Maximum parse/deserialize depth. Defaults to 64. Must match on both peers. */
     depthLimit?: number;
+    /**
+     * Whether serialized `Error`s carry their `.stack` — server file paths,
+     * internal function names, the shape of the deployment — to the peer.
+     * Defaults to `NODE_ENV === "development"`, but that signal describes the
+     * PROCESS, not the artifact: a production build running with
+     * `NODE_ENV=development` (a base image, a stray dotenv) ships stacks to
+     * the wire — including for errors marked safe with `markSafeError`, whose
+     * stacks traverse application code (#3152). Set `false` to pin production
+     * disclosure regardless of the ambient variable. Encode-side only; the
+     * decode side is always permissive, so it need not match peers.
+     */
+    serializeErrorStacks?: boolean;
 }
 /**
  * A resident, response-scoped decode table over the keyed JSON codec: apply
@@ -142,10 +154,11 @@ export declare const DEFAULT_WEB_PLUGINS: any; /**
  * Integration-facing; may change (see the entry banner).
  */
 export declare function resolveSerializerPlugins(customPlugins?: SerializerPlugin[]): SerializerPlugin[];
-export declare function resolveCodecOptions({ plugins, disabledFeatures, depthLimit }?: JSONCodecOptions): {
+export declare function resolveCodecOptions({ plugins, disabledFeatures, depthLimit, serializeErrorStacks }?: JSONCodecOptions): {
     plugins: SerializerPlugin<any, any>[];
     disabledFeatures: any;
     depthLimit: number;
+    serializeErrorStacks: boolean;
 }; /**
  * Creates the decoding counterpart of `serializeJSON`. Cross-references
  * between chunks resolve through state shared across calls, so all chunks

package/types/frames/serializer.d.ts

@@ -19,6 +19,13 @@ export interface WebSerializerOptions {
      * any override — serialized stacks leak server paths to the client.
      */
     disabledFeatures?: number;
+    /**
+     * Whether serialized `Error`s carry their `.stack`. Defaults to
+     * `NODE_ENV === "development"`; set `false` to pin production disclosure
+     * to the deployment rather than the ambient variable (#3152 — see
+     * `JSONCodecOptions.serializeErrorStacks`).
+     */
+    serializeErrorStacks?: boolean;
     /** Extra plugins, composed ahead of `DEFAULT_WEB_PLUGINS`. */
     plugins?: SerializerPlugin[];
     /** Receives each emitted script chunk. */

package/types/jsx.d.ts

@@ -1080,6 +1080,7 @@ export namespace JSX {
   type HTMLFormEncType = "application/x-www-form-urlencoded" | "multipart/form-data" | "text/plain";
   type HTMLFormMethod = "post" | "get" | "dialog";
   type HTMLCrossorigin = "anonymous" | "use-credentials" | EnumeratedAcceptsEmpty;
+  type HTMLFetchPriority = "high" | "low" | "auto";
   type HTMLReferrerPolicy =
     | "no-referrer"
     | "no-referrer-when-downgrade"
@@ -1105,19 +1106,8 @@ export namespace JSX {
     | "allow-top-navigation"
     | "allow-top-navigation-by-user-activation"
     | "allow-top-navigation-to-custom-protocols";
-  type HTMLLinkAs =
-    | "audio"
-    | "document"
-    | "embed"
-    | "fetch"
-    | "font"
-    | "image"
-    | "object"
-    | "script"
-    | "style"
-    | "track"
-    | "video"
-    | "worker";
+  type HTMLPreloadAs = "fetch" | "font" | "image" | "script" | "style" | "track";
+  type HTMLLinkAs = HTMLPreloadAs | "audio" | "document" | "embed" | "object" | "video" | "worker";
 
   interface AnchorHTMLAttributes<T> extends HTMLAttributes<T> {
     download?: string | EnumeratedAcceptsEmpty | RemoveAttribute;
@@ -1367,7 +1357,7 @@ export namespace JSX {
     browsingtopics?: string | RemoveAttribute;
     crossorigin?: HTMLCrossorigin | RemoveAttribute;
     decoding?: "sync" | "async" | "auto" | RemoveAttribute;
-    fetchpriority?: "high" | "low" | "auto" | RemoveAttribute;
+    fetchpriority?: HTMLFetchPriority | RemoveAttribute;
     height?: number | string | RemoveAttribute;
     ismap?: BooleanAttribute | RemoveAttribute;
     loading?: "eager" | "lazy" | RemoveAttribute;
@@ -1522,7 +1512,7 @@ export namespace JSX {
     color?: string | RemoveAttribute;
     crossorigin?: HTMLCrossorigin | RemoveAttribute;
     disabled?: BooleanAttribute | RemoveAttribute;
-    fetchpriority?: "high" | "low" | "auto" | RemoveAttribute;
+    fetchpriority?: HTMLFetchPriority | RemoveAttribute;
     href?: string | RemoveAttribute;
     hreflang?: string | RemoveAttribute;
     imagesizes?: string | RemoveAttribute;
@@ -1713,7 +1703,7 @@ export namespace JSX {
     blocking?: "render" | RemoveAttribute;
     crossorigin?: HTMLCrossorigin | RemoveAttribute;
     defer?: BooleanAttribute | RemoveAttribute;
-    fetchpriority?: "high" | "low" | "auto" | RemoveAttribute;
+    fetchpriority?: HTMLFetchPriority | RemoveAttribute;
     for?: string | RemoveAttribute;
     integrity?: string | RemoveAttribute;
     nomodule?: BooleanAttribute | RemoveAttribute;
@@ -3500,6 +3490,11 @@ export namespace JSX {
      * @url https://developer.mozilla.org/en-US/docs/Web/API/HTMLSelectElement
      */
     select: SelectHTMLAttributes<HTMLSelectElement> & Properties<HTMLSelectElement>;
+    /**
+     * @url https://developer.mozilla.org/en-US/docs/Web/HTML/Element/selectedcontent
+     * @url https://developer.mozilla.org/en-US/docs/Web/API/HTMLSelectedContentElement
+     */
+    selectedcontent: HTMLAttributes<HTMLElement> & Properties<HTMLElement>;
     /**
      * @url https://developer.mozilla.org/en-US/docs/Web/HTML/Element/slot
      * @url https://developer.mozilla.org/en-US/docs/Web/API/HTMLSlotElement

package/types/response.d.ts

@@ -50,6 +50,8 @@ export declare const REVALIDATE_HEADER = "X-Revalidate";
 export interface ResponseHelperInit extends ResponseInit {
     revalidate?: string | string[];
 }
+/** @internal */
+export declare const RESPONSE_HEADER_VALUE_LIMIT = 4096;
 /**
  * Response redirecting to `url` (default 302). `revalidate` names the
  * cache keys the mutation invalidated.
@@ -60,6 +62,15 @@ export declare function redirect(url: string | Href, init?: number | ResponseHel
  * them when omitted).
  */
 export declare function reload(init?: ResponseHelperInit): Response;
+/**
+ * Statuses HTTP forbids a body on — the `Response` constructor enforces it
+ * by throwing on ANY body, `JSON.stringify(undefined)`'s `"undefined"`
+ * included. Shared with the server-function encoder, which answers void
+ * results on these statuses with a real null-body response and reports
+ * value-carrying ones as authoring errors (#3095).
+ * @internal
+ */
+export declare const NULL_BODY_STATUSES: ReadonlySet<number>;
 /**
  * A value paired with response metadata (status, headers, `revalidate`) —
  * for the things a naked return can't express. Progressive enhancement

package/types/serializer-decode.d.ts

@@ -105,6 +105,18 @@ export interface JSONCodecOptions {
     disabledFeatures?: number;
     /** Maximum parse/deserialize depth. Defaults to 64. Must match on both peers. */
     depthLimit?: number;
+    /**
+     * Whether serialized `Error`s carry their `.stack` — server file paths,
+     * internal function names, the shape of the deployment — to the peer.
+     * Defaults to `NODE_ENV === "development"`, but that signal describes the
+     * PROCESS, not the artifact: a production build running with
+     * `NODE_ENV=development` (a base image, a stray dotenv) ships stacks to
+     * the wire — including for errors marked safe with `markSafeError`, whose
+     * stacks traverse application code (#3152). Set `false` to pin production
+     * disclosure regardless of the ambient variable. Encode-side only; the
+     * decode side is always permissive, so it need not match peers.
+     */
+    serializeErrorStacks?: boolean;
 }
 /**
  * A resident, response-scoped decode table over the keyed JSON codec: apply
@@ -142,10 +154,11 @@ export declare const DEFAULT_WEB_PLUGINS: any; /**
  * Integration-facing; may change (see the entry banner).
  */
 export declare function resolveSerializerPlugins(customPlugins?: SerializerPlugin[]): SerializerPlugin[];
-export declare function resolveCodecOptions({ plugins, disabledFeatures, depthLimit }?: JSONCodecOptions): {
+export declare function resolveCodecOptions({ plugins, disabledFeatures, depthLimit, serializeErrorStacks }?: JSONCodecOptions): {
     plugins: SerializerPlugin<any, any>[];
     disabledFeatures: any;
     depthLimit: number;
+    serializeErrorStacks: boolean;
 }; /**
  * Creates the decoding counterpart of `serializeJSON`. Cross-references
  * between chunks resolve through state shared across calls, so all chunks

package/types/serializer.d.ts

@@ -19,6 +19,13 @@ export interface WebSerializerOptions {
      * any override — serialized stacks leak server paths to the client.
      */
     disabledFeatures?: number;
+    /**
+     * Whether serialized `Error`s carry their `.stack`. Defaults to
+     * `NODE_ENV === "development"`; set `false` to pin production disclosure
+     * to the deployment rather than the ambient variable (#3152 — see
+     * `JSONCodecOptions.serializeErrorStacks`).
+     */
+    serializeErrorStacks?: boolean;
     /** Extra plugins, composed ahead of `DEFAULT_WEB_PLUGINS`. */
     plugins?: SerializerPlugin[];
     /** Receives each emitted script chunk. */

package/types/server-functions/client.d.ts

@@ -1,4 +1,5 @@
-export { ChunkReader, ERROR_HEADER, FLASH_COOKIE, INSTANCE_HEADER, SERVER_FUNCTION_INVOKE, SINGLE_FLIGHT_HEADER, clearFlashCookie, createChunk, decodeErrorHeaderValue, decodeResponse, decodeResponsePayload, deserializeStream, encodeErrorHeaderValue, frameAddress, getFlightDataConsumer, getServerFunctionMetadata, getServerFunctionsCodec, hasFlashCookie, invoke, isServerFunction, serializeString, subscribeFlightData, withMeta } from "./shared.js";
+import type { ServerFunction, ServerFunctionMetadata } from "./shared.js";
+export { ChunkReader, ERROR_HEADER, FLASH_COOKIE, INSTANCE_HEADER, REDIRECT_HEADER, SERVER_FUNCTION_INVOKE, SINGLE_FLIGHT_HEADER, UNKNOWN_HEADER, clearFlashCookie, createChunk, decodeErrorHeaderValue, decodeRedirectHeaderValue, decodeResponse, decodeResponsePayload, deserializeStream, encodeErrorHeaderValue, frameAddress, getFlightDataConsumer, getFlightDataSourceIds, getServerFunctionMetadata, getServerFunctionsCodec, hasFlashCookie, invoke, isServerFunction, serializeString, subscribeFlightData, withMeta } from "./shared.js";
 export { REVALIDATE_HEADER } from "../response.js";
 import { JSONCodecOptions } from "../serializer-decode.js";
 export type { FlightDataConsumer, FlightDataContext, InvokeOptions, ServerFunction, ServerFunctionInvoker, ServerFunctionMetadata, SingleFlightPayload } from "./shared.js";
@@ -159,6 +160,25 @@ export declare function parseServerFunctionUrl(url: string): string | null;
 export declare function configureServerFunctionsClient(config?: ServerFunctionsClientConfig): void;
 export declare function createServerReference(id: string, name?: string, base?: string): ServerFunction;
 export declare function GET<A extends readonly any[], R>(fn: (...args: A) => R): ServerFunction<A, Awaited<R>>;
-export declare function live<A extends readonly any[], R>(fn: (...args: A) => R): ServerFunction<A, LiveSource<Awaited<R>>>;
+export interface LiveServerFunction<A extends readonly any[] = any[], R = any> {
+    (...args: A): LiveSource<R>;
+    /** The build-stable function id (stable across the client and server builds). */
+    readonly id: string;
+    /** URL invoking this function directly over HTTP. */
+    readonly url: string;
+}
+/**
+ * Declares a value-shaped live source: a server function returning an async
+ * iterable whose yields are successive VALUES of one logical query, with the
+ * contract that the source re-yields current state on every invocation.
+ * Calls to the returned reference produce an iterable that survives the
+ * connection — post-connect deaths re-invoke with exponential backoff
+ * (reset per healthy value, woken early by connectivity returning),
+ * first-connect failures reject like a normal call, and `break` aborts the
+ * in-flight request. Live calls are reads and never opt into single-flight
+ * enveloping. Wire state, if wanted, rides the returned iterable's
+ * `onstatus` hook. Compose with `GET` inside-out: `live(GET(fn))`.
+ */
+export declare function live<A extends readonly any[], R>(fn: (...args: A) => R): LiveServerFunction<A, Awaited<R>>;
 export declare function registerServerReference(): never;
 export declare function getServerFunctionInvocation(): ServerFunctionInvocation | undefined;

package/types/server-functions/flash.d.ts

@@ -13,6 +13,15 @@ export interface FlashSubmission {
     result?: any;
     /** The thrown value, when the call threw. */
     error?: any;
+    /**
+     * Set when the outcome was too large for the cookie's 4 KB ceiling and
+     * was degraded to fit (#3137): the input echo is dropped, and `result` /
+     * `error` may carry a bounded prefix — or the bare outcome flag `true` —
+     * rather than the full value. The submission still says what happened
+     * and where; integrations should render it as "succeeded (result too
+     * large to display)" rather than replaying the value.
+     */
+    truncated?: boolean;
 }
 export declare function encodeFlashCookie(url: string, result: any, input: any[], thrown?: boolean): string;
 export declare function decodeFlashCookie(cookieHeader: string | null): FlashSubmission | undefined;

package/types/server-functions/server.d.ts

@@ -1,8 +1,9 @@
-export { ERROR_HEADER, FLASH_COOKIE, INSTANCE_HEADER, SERVER_FUNCTION_INVOKE, SINGLE_FLIGHT_HEADER, clearFlashCookie, decodeErrorHeaderValue, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, getServerFunctionMetadata, hasFlashCookie, invoke, isServerFunction, subscribeFlightData, withMeta } from "./shared.js";
+export { ERROR_HEADER, FLASH_COOKIE, INSTANCE_HEADER, REDIRECT_HEADER, SERVER_FUNCTION_INVOKE, SINGLE_FLIGHT_HEADER, UNKNOWN_HEADER, clearFlashCookie, decodeErrorHeaderValue, decodeRedirectHeaderValue, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, getServerFunctionMetadata, hasFlashCookie, invoke, isServerFunction, subscribeFlightData, withMeta } from "./shared.js";
 export { decodeFlashCookie, encodeFlashCookie } from "./flash.js";
 import { ResponseEnvelope } from "../response.js";
 import { JSONCodecOptions } from "../serializer-decode.js";
 import { RequestEvent } from "../server.js";
+import type { ServerFunction, ServerFunctionMetadata } from "./shared.js";
 export type { FlightDataConsumer, FlightDataContext, InvokeOptions, ServerFunction, ServerFunctionInvoker, ServerFunctionMetadata, SingleFlightPayload } from "./shared.js";
 export type { FlashSubmission } from "./flash.js";
 /**
@@ -130,6 +131,18 @@ export interface ServerFunctionCSRFOptions {
      * @default false
      */
     allowRequestsWithoutOriginCheck?: boolean;
+    /**
+     * Applies the origin gate to GET-declared reads as well. By default the
+     * gate is skipped for declared reads: same-origin policy already keeps a
+     * cross-site caller from READING the response, and the gate's `Vary`
+     * fragments (or, on CDNs that ignore Vary, poisons) the shared-cache
+     * entries the `GET` helper exists to enable (#3071). The premise that
+     * skip rests on is `GET()`'s safety contract — declared reads are safe
+     * to EXECUTE from any origin (#3114). A deployment that does not rely
+     * on shared caches can enable this to gate its reads too.
+     * @default false
+     */
+    protectDeclaredReads?: boolean;
 }
 /** Options for `configureServerFunctionsServer`. */
 export interface ServerFunctionsServerConfig {
@@ -150,10 +163,13 @@ export interface ServerFunctionsServerConfig {
      */
     wrapInvocation?: WrapInvocationHook;
     /**
-     * The single-flight hook: produces the data payload folded into
+     * The unnamed single-flight hook: produces the data payload folded into
      * responses of calls that opted in (see `CollectFlightDataHook`).
      * Registered once by the integration that owns data production (a
-     * router); per-handler `collectFlightData` options override it.
+     * router); per-handler `collectFlightData` options override it. Other
+     * integrations contribute additively through
+     * `registerFlightDataSource(id, hook)` instead of competing for this
+     * slot.
      */
     collectFlightData?: CollectFlightDataHook;
     /**
@@ -225,9 +241,29 @@ export interface ServerFunctionsServerConfig {
     /**
      * Codec options (extra plugins etc.) for decoding arguments and encoding
      * results — must match the client's. Stored in the shared layer, so
-     * `decodeResponse` sees them too.
+     * `decodeResponse` sees them too. When `serializeErrorStacks` is omitted,
+     * the server-function boundary defaults it from this module's compiled
+     * development variant.
      */
     codec?: JSONCodecOptions;
+    /**
+     * Upper bound, in bytes, on a call's argument payload — the POST body,
+     * or the `?args=` query encoding. The payload is buffered and decoded
+     * before dispatch, so its cost is paid before application code can
+     * decline it; the bound is enforced up front and a request over it is
+     * refused with `413` before any decoding (#3115). Raise it for functions
+     * that accept large uploads, or set `Infinity` to remove the bound.
+     * @default 1_048_576 (1 MiB)
+     */
+    bodySizeLimit?: number;
+    /**
+     * Upper bound on the number of arguments a call may carry. The decoded
+     * argument array is spread into the function call, so an unbounded list
+     * forces a range error out of any function regardless of what it does;
+     * past the bound the request is refused with `400` (#3115).
+     * @default 1000
+     */
+    maxArguments?: number;
 }
 /**
  * A registered server function: its build-stable id paired with the
@@ -347,6 +383,16 @@ export interface HandleServerFunctionOptions {
     csrf?: boolean | ServerFunctionCSRFOptions;
     /** Overrides the configured codec options for this handler. */
     codec?: JSONCodecOptions;
+    /**
+     * Overrides the configured argument payload bound for this handler (see
+     * `ServerFunctionsServerConfig.bodySizeLimit`).
+     */
+    bodySizeLimit?: number;
+    /**
+     * Overrides the configured argument count bound for this handler (see
+     * `ServerFunctionsServerConfig.maxArguments`).
+     */
+    maxArguments?: number;
 }
 export interface ServerFunctionRequestCall {
     type: "request";
@@ -366,6 +412,7 @@ export interface ServerFunctionResponseCall {
 }
 export type ServerFunctionCall = ServerFunctionRequestCall | ServerFunctionResponseCall;
 export declare function configureServerFunctionsServer(config?: ServerFunctionsServerConfig): void;
+export declare function registerFlightDataSource(source: string, hook: CollectFlightDataHook): () => void;
 export declare function registerServerFunction<T extends any[], R>(id: string, callback: (...args: T) => R): (...args: T) => R;
 export declare function getServerFunction<T extends any[], R>(id: string): (...args: T) => R;
 export declare function registerServerReference<T extends any[], R>(id: string, fn: (...args: T) => R, name?: string): ServerFunctionReference<T, R>;
@@ -376,6 +423,8 @@ export declare function getServerFunctionInvocation(): ServerFunctionInvocation
 export declare function getEventServerFunctionInvocation(event: RequestEvent | undefined): ServerFunctionInvocation | undefined;
 export declare function foldSetCookies(headers: Headers, setCookies: readonly string[]): Headers;
 export declare function createNoJSHandler(options?: NoJSHandlerOptions): (result: unknown, request: Request, args: unknown[], thrown?: boolean) => Response;
+/** @internal */
+export declare function guardFailures(value: any, state: any): any;
 /**
  * The response-side codec stream: `serializeStream` (shared.js) hardened
  * with request-lifetime teardown. Server-only on purpose — the shared half
@@ -384,14 +433,16 @@ export declare function createNoJSHandler(options?: NoJSHandlerOptions): (result
  * An abort of `signal` (the platform fires request.signal when the caller's
  * fetch aborts or the tab goes away) or the consumer cancelling the
  * ReadableStream (how platforms surface a dropped connection to the body)
- * stops pending serialization and tears down a top-level async-iterable
- * value — the producer's `iterator.return()` runs, so generator `finally`
- * blocks execute instead of the server pumping a stream nobody is reading.
- * Top-level only: that is the value-tier shape ("return a stream from the
- * server function"); iterables nested inside user objects are consumed by
- * the codec directly and stay untouched.
+ * stops pending serialization and tears down EVERY async-iterable or
+ * ReadableStream source in the result graph, nested ones included (#3125) —
+ * each producer's `iterator.return()` / `reader.cancel()` runs, so
+ * generator `finally` blocks execute instead of the server pumping streams
+ * nobody is reading. The wiring rides guardFailures' walk: it already wraps
+ * every channel before the codec sees the value, so the demand gate and the
+ * teardown registry are threaded through its state (`{ items: rows() }` —
+ * a cursor beside a total — gets the same two guarantees as `return rows()`).
  */
-export declare function serializeResponseStream(value: any, codecOptions: any, signal: any): ReadableStream<any>;
+export declare function serializeResponseStream(value: any, codecOptions: any, signal: any, scope: any): ReadableStream<any>;
 /** Message a sanitized (production) server error carries on the wire. */
 export declare const GENERIC_SERVER_ERROR_MESSAGE = "Internal Server Error";
 export declare function setServerFunctionsDev(dev: boolean): void;
@@ -399,4 +450,73 @@ export declare function sanitizeServerError(value: unknown): unknown;
 export declare function observeServerFunctionCalls(observer: (call: ServerFunctionCall) => void): () => void;
 export declare function serverFunctionUrl(id: string, boundArgs?: readonly unknown[]): string;
 export declare function parseServerFunctionUrl(url: string): string | null;
+/**
+ * Web-standard HTTP handler for server function calls: resolves the
+ * function id from the request, enforces the method allowlist (POST always
+ * dispatches; GET and HEAD dispatch only to functions that declared `GET`,
+ * with HEAD returning the equivalent GET's status and headers minus the
+ * body; every other method answers 405), decodes arguments, runs the
+ * function under a request-event scope, and encodes the result (forwarding
+ * redirect/revalidation metadata through headers). Mount it on the endpoint
+ * the client transport targets (default `/_server`); platform adapters (h3,
+ * express, ...) convert their request shape to a web `Request` around it.
+ *
+ * Requests are same-origin by default. The handler accepts browser requests
+ * proven by `Sec-Fetch-Site`, `Origin`, or `Referer`, and rejects requests
+ * without usable metadata unless explicitly configured otherwise. GET/HEAD
+ * requests to `GET`-declared functions skip this gate: they are reads by
+ * contract, cross-site response READING is already blocked by same-origin
+ * policy, and skipping it keeps the `Vary: Sec-Fetch-Site, Origin, Referer`
+ * it would impose off the responses shared caches are meant to store.
+ *
+ * Every response leaves with `Cache-Control: no-store` unless the function
+ * set its own cache policy (via `respond()` headers or a returned
+ * `Response`) — caching is opt-in on the wire, not just in prose.
+ *
+ * When the event carries a `response` head stub (`event.response`, see the
+ * server entry's `ResponseStub`), the handler folds it onto every outgoing
+ * response as the head freezes — its `Set-Cookie` values (cookies appended
+ * during the call) append cookie-by-cookie alongside the result's own,
+ * other stub headers fill gaps (the call's response metadata wins; the
+ * protocol-owned family — the error/format/single-flight tags, `Location`,
+ * `X-Revalidate` — never fills, and neither does `Content-Type`/`Content-
+ * Length` onto a bodiless response) — and marks the stub `committed`, so
+ * later cookie/header writes report instead of silently missing the wire.
+ *
+ * ## Thrown-error sanitization (security default)
+ *
+ * A thrown `Response`/envelope (`redirect`/`reload`/`respond`) is intentional
+ * control flow and is forwarded untouched. A *plain* thrown value (a bare
+ * `Error`, string, or object) is different: serialized verbatim it would ship
+ * its `message` and every own-property to the client — a driver/ORM error's
+ * failing query, connection string, or bound parameters included. So outside
+ * the dev build a plain thrown value is replaced with a generic `Error`
+ * before serialization; the client still receives *an* `Error` (the shape
+ * `submission.error` etc. expect), just with no leaked content. The dev
+ * build keeps full fidelity (message, stack, own-props) for DX and the dev
+ * toolbar inspector. Dev/prod is the BUILD VARIANT, not `NODE_ENV`:
+ * `@solidjs/web` publishes a dev copy of this entry behind the
+ * `development` export condition (what Vite dev resolves) and the default
+ * resolution sanitizes — as does importing the runtime source directly with
+ * no bundler signal (fail-safe).
+ *
+ * Escape hatch: brand the value with `markSafeError` (`Symbol.for(
+ * "solid.SafeError")`) to send its content intact in every environment.
+ * A `wrapInvocation`/`transformResult` override that maps errors expresses
+ * intent the same way — throw a `Response`/envelope, or brand the mapped
+ * error safe; an unbranded plain error it lets propagate is sanitized like
+ * any other, so a framework onError policy must brand its result to keep a
+ * custom client-facing message in production.
+ *
+ * @example
+ * ```ts
+ * import { handleServerFunctionRequest } from "@solidjs/web/server-functions";
+ * import "virtual:solid-server-function-manifest";
+ *
+ * // in the server's request handling:
+ * if (url.pathname.startsWith("/_server")) {
+ *   return handleServerFunctionRequest(request);
+ * }
+ * ```
+ */
 export declare function handleServerFunctionRequest(request: Request, options?: HandleServerFunctionOptions): Promise<Response>;