[ryansolid]

Requested by Ryan · project thread

Before: a server component wrapped in prerendered() (return props => <jsx/>) was saved as an Internal Server Error artifact, because the integration encoded the returned render function itself. Client navigation to it crashed in both static and hybrid builds. Hybrid never fell back to the server, since the bad artifact (or a host's 200 fallback page) didn't look like a miss. Page load also refetched every prerendered read the server had already rendered.

After: the artifact is exactly what the app's server-function endpoint answers for the call's GET address, status and headers included. Server components, codec values and plain JSON all round-trip. Page load makes no request, and navigation fetches only the artifact. In hybrid mode, a missing artifact falls back to the live server through the app's own transport fetch, even when the host answers with a 200 page. Artifacts are versioned by build, so a CDN never serves the previous deploy's answer. The app's transport fetch is never displaced.

How:

• prerender-crawler
  • PrerenderContext.fetch(input) sends a request through the crawl's own transport, paced like a page, and returns the raw response.
  • The new buildId option reaches integrations as context.buildId. The Vite plugin mints one per process and defines it as import.meta.env.PRERENDER_BUILD. It is per process rather than per plugin instance because a build can evaluate the config more than once.
• @solidjs/prerender integration
  • The sink records each call's GET address (serverFunctionUrl, resolved in the app's realm).
  • After the crawl, it replays each address through context.fetch and stores the response as _static/<build>/<label>.<key>.txt: a marker line with status and headers, followed by the body bytes.
  • Each captured call therefore runs once more at the end of the build.
• @solidjs/prerender client
  • prerendered() returns the runtime's own GET reference and declares its own send: withMeta(fn, { fetch }), from feat(web): a server function reference can declare its own client send solid#4170 (released in rc.16). The send maps a prerendered call's GET address to its artifact and rebuilds the Response, and passes everything else to next, the app's send.
  • Keys are derived synchronously (a small SHA-256, checked against crypto.subtle), so the lookup reaches fetch in the same tick and hydration adoption keeps working.
• Breaking (0.x):
  • New artifact format, extension and directory.
  • The codec option on serverFunctions() is removed.
  • @solidjs/web must be >=2.0.0-rc.16.
  • The SSG example moves to rc.16 and router next.41.

Verified:

• Unit tests on rc.16: crawler 62, Solid 39, all passing.
• The SSG example on rc.16, with nothing wired by hand, in a browser:
  • A direct load of a post or the posts list makes no request beyond the page.
  • Client navigation fetches only _static/<build>/ artifacts, with no errors.
• A server-component route app built on solid next, checked earlier in this PR:
  • In static mode, the load makes no requests and navigation renders the baked frame.
  • In hybrid mode, navigation falls back to /_server/data when the artifact is missing.

Not covered: the hybrid server still runs prerendered() functions live during SSR rather than reading the artifacts.

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​solidjs/​web@​2.0.0-rc.6 ⏵ 2.0.0-rc.16	+1		+1
	filesystem-routing@​0.2.1 ⏵ 0.4.0	+14		+1	+2
	solid-js@​2.0.0-rc.6 ⏵ 2.0.0-rc.16	+1		+1	-1
	@​solidjs/​vite-plugin@​3.0.0-next.39 ⏵ 3.0.0-next.50	+1		+1	+2
	@​solidjs/​router@​2.0.0-next.21 ⏵ 2.0.0-next.41	+1		+1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Low adoption: npm @solidjs/compiler-darwin-x64 Location: Package overview From: pnpm-lock.yaml → npm/@solidjs/vite-plugin@3.0.0-next.50 → npm/@solidjs/compiler-darwin-x64@2.0.0-rc.15 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@solidjs/compiler-darwin-x64@2.0.0-rc.15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report