fix(web): close the server-function boundary defects

[frenzzy]

Twenty-two verified defects in the server-function runtime, fixed together because they were found together and because three of them share a hunk.

How this was built

Every defect was reproduced first, then pinned by a spec proven red on f0f7531b before a line of source changed. The fixes were written independently, in eight separate checkouts, and only then merged into one tree — so the overlap between them is measured rather than assumed.

That measurement is why this is one PR and twenty-two issues rather than twenty-two PRs. Each of the 32 source hunks was reverted one at a time, rebuilt, and the suite re-run to record which specs go red:

• One hunk is genuinely cross-cutting. Neutering stripUnsafeKeys in server-functions/src/shared.ts reddens the new response-decode specs (7), the new flash-decode specs (2) and the already-shipped argument-road specs (server-functions-proto-keys, open-gaps). Three decode roads, one guard — which is the fix: the strip moves from a caller to extractBody, the boundary all three share.
• Every other hunk reddens only its own group's specs. Reported as a negative result: the remaining findings are independent defects that happen to live nearby, not one defect wearing many faces. Two near-merges were refused on that evidence — isJSONSafe's -0 and own-names edits sit three lines apart in one function with the same-sounding rationale, but redden disjoint specs.

Verification

	baseline f0f7531b	this branch
vitest run	667 passed	667 passed
vitest run --config vite.config.server.mjs	59 files, 647 passed + 2 skipped	84 files, 737 passed + 2 skipped
vitest run --config vite.config.hydrate.mjs	164 passed	164 passed

tsc --project tsconfig.build.json and tsconfig.test.json clean; prettier --check clean on every touched file. No pre-existing test was edited or deleted — where a fix first reddened one, the fix was rewritten, not the test.

What is deliberately not here

Several findings were left unfixed with the reasoning recorded in the issues rather than forced into a patch: non-enumerable accessors on an Error carrier (closing that means invoking hidden accessors, the hazard 47995412 removed); the frames/ transport's own decode leg, which bypasses extractBody; a sync-iterable class instance, whose carrier properties are dropped by a different function. Two judgement calls are flagged in their issues as yours rather than asserted here — whether GET()'s contract should say that a declared read is a navigable document, and whether the slowloris time bound belongs in core or in the adapter.

Issues

• Fixes A decoded promise nobody holds takes the process down #3232 — A decoded promise nobody holds takes the process down
• Fixes The prototype-key strip guards the argument road only — the response and flash decodes hand the key through #3233 — The prototype-key strip guards the argument road only — the response and flash decodes hand the key through
• Fixes The single-flight fold stamps this request's cookies onto a Response the integration still holds #3234 — The single-flight fold stamps this request's cookies onto a Response the integration still holds
• Fixes The result guard walks neither Error carriers nor non-enumerable slots, so the channels under them ride unguarded #3235 — The result guard walks neither Error carriers nor non-enumerable slots, so the channels under them ride unguarded
• Fixes The body cap is decided by the peer's Content-Length, so every ordinary POST skips it #3236 — The body cap is decided by the peer's Content-Length, so every ordinary POST skips it
• Fixes A GET() grant governs an id, not the function it was granted to #3237 — A GET() grant governs an id, not the function it was granted to
• Fixes A wrapInvocation option that is not a hook removes the configured authorization gate #3238 — A wrapInvocation option that is not a hook removes the configured authorization gate
• Fixes The flash cookie carries the submission with no SameSite, no lifetime and no __Host- prefix #3239 — The flash cookie carries the submission with no SameSite, no lifetime and no __Host- prefix
• Fixes A per-handler wrapInvocation never sees the calls the dispatched body makes #3240 — A per-handler wrapInvocation never sees the calls the dispatched body makes
• Fixes A generator or stream returned inside a container is scoped to no request #3241 — A generator or stream returned inside a container is scoped to no request
• Fixes new fn() enters a server function body past every guard the apply trap holds #3242 — new fn() enters a server function body past every guard the apply trap holds
• Fixes One un-encodable flight slice takes the committed mutation's own result down with it #3243 — One un-encodable flight slice takes the committed mutation's own result down with it
• Fixes The client transport buffers every response twice and never ends the connection it opened #3244 — The client transport buffers every response twice and never ends the connection it opened
• Fixes A body-format tag the client cannot read resolves the call as a void success #3245 — A body-format tag the client cannot read resolves the call as a void success
• Fixes provideEvent's exactly-once contract is enforced on HTTP dispatch and nowhere else #3246 — provideEvent's exactly-once contract is enforced on HTTP dispatch and nowhere else
• Fixes transformResult sees every failure an author shaped by hand and none that happen to the app #3247 — transformResult sees every failure an author shaped by hand and none that happen to the app
• Fixes A falsy outcome is no outcome: a committed submission reports nothing to the next render #3248 — A falsy outcome is no outcome: a committed submission reports nothing to the next render
• Fixes The degrade ladder bounds every field but url, so the cookie is discarded whole while claiming it fit #3249 — The degrade ladder bounds every field but url, so the cookie is discarded whole while claiming it fit
• Fixes A form navigation refused before dispatch is left on /_server/<id> with everything the user typed gone #3250 — A form navigation refused before dispatch is left on /_server/<id> with everything the user typed gone
• Fixes The single-flight source list is honored as a multiset, so a caller picks its own amplification factor #3251 — The single-flight source list is honored as a multiset, so a caller picks its own amplification factor
• Fixes A redirecting mutation loses single-flight whenever the page sends no Referer #3252 — A redirecting mutation loses single-flight whenever the page sends no Referer
• Fixes -0 takes the JSON fast path and arrives as +0 #3253 — -0 takes the JSON fast path and arrives as +0

[changeset-bot]

🦋 Changeset detected

Latest commit: 7d5e66f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
@solidjs/web	Patch
@solidjs/babel-plugin	Patch
@solidjs/element	Patch
@solidjs/h	Patch
@solidjs/html	Patch
test-integration	Patch
@solidjs/compiler	Patch
@solidjs/diagnostics	Patch
@solidjs/signals	Patch
solid-js	Patch
@solidjs/universal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codspeed-hq]

Merging this PR will not alter performance

✅ 136 untouched benchmarks

---

_{Comparing frenzzy:fix/server-function-boundary-sweep (a56c001) with next (ead7b1a)}

[frenzzy]

Superseded on next — closing.

Every fix here landed in your own commits, and in three places yours is the better call:

• A body-format tag the client cannot read resolves the call as a void success #3245 — you found the hole was deeper than I reported: the content-type sniffing branches matched regardless of the tag, so an unknown tag over a urlencoded or multipart body decoded as a form. My change only closed the silent undefined.
• A wrapInvocation option that is not a hook removes the configured authorization gate #3238 — I had null fall back to the configured hook. Throwing a configuration error at hook resolution is the right answer: an invalid hook is a broken deployment, not a value to interpret.
• The degrade ladder bounds every field but url, so the cookie is discarded whole while claiming it fit #3249 — I added a last rung to the degrade ladder to bound url. Refusing the flash outright when it cannot fit is better; a cookie that cannot tell the truth about its url should not be written at all.

I've re-run my own repros against next to confirm the fixes hold rather than take the commit messages for it: the decoded-promise crash exits 0, the Error-carrier channel is sanitized on all four carrier shapes, Content-Length: 10 on a 2 MiB body is a 413 with zero bytes reaching the function, register -> register -> GET() is a 403 with the mutation unrun, and transformResult now observes all six throw shapes.

The three dispositions I did not get my way on are noted and not re-litigated here: the response-leg strip (#3233), the flight-slice preflight (#3243), and the flash refusal statuses (#3250). #3239 is the one still open.

Thanks for turning these around so quickly.

[ryansolid]

Closing the loop with the full disposition, now that everything from this sweep has landed. Thanks again @frenzzy — 22 filed issues, and the triage upheld most of them. The complete record lives in the conformance matrix (packages/web/test/server/server-function-matrix/MATRIX.md), but in short:

Fixed on next (each as its own commit with tests): #3232 ff2ecf11, #3234 c0bc9baa, #3235 5cee0f77 (Error-carrier half), #3236 7009adfd, #3237 12263816, #3238 ed6b6053, #3241 84a94bc1, #3244 b7b17abf (clone half), #3245 6c9f8f45, #3246 292bdc52, #3247 a1ff2860, #3248 f21e060b, #3249 3393fb62, #3251 a14c1385, #3253 6bb51c9b.

#3239 (flash cookie confidentiality) got the deepest treatment: the payload is now AES-GCM encrypted, always, under a key derived from a deployment-wide secret (fbe5bef4), with SameSite=Lax + Max-Age=60 and no-key-means-no-flash rather than plaintext. Two companion drafts land in unison with rc.7: solidjs/solid-vite-plugin#343 (injects the secret into server builds with zero configuration) and solidjs/solid-router#597 (absorbs the now-async decoder).

Ratified as-is after review (closed, no code change): #3240 (entry-only wrapInvocation, semantics pinned in docs/tests), #3250 (security refusals keep raw statuses; a refused request's Referer is untrusted), #3252 (server-authored same-origin Location alone names the fold destination), #3242 (native Proxy construction semantics stay).

Rejected as proposed: #3233 (decode-boundary stripping destroys legitimate constructor/prototype data on trusted results) and #3243 (the slice-isolation probe is incomplete and leaks an internal helper) — both with the reasoning recorded on the issues.

The wholesale form of this PR was never mergeable — 43 files across independent concerns — but as an audit it was excellent: it drove a permanent conformance matrix for the server-function protocol that future changes get checked against. That's a better legacy than a merge.