fix: preload modules for data-addressed server function calls

.changeset/bodyless-post-no-body-stream.md

@@ -0,0 +1,5 @@
+---
+"@solidjs/vite-plugin": patch
+---
+
+Only attach a request body in the dev middlewares' Node-to-web bridging when the incoming request actually carries one (Content-Length/Transfer-Encoding, or the h2 END_STREAM flag). An unconditionally attached empty stream made bodyless POSTs — zero-argument scripted server function calls, synthetic dispatches — parse as a present-but-unusable body, which @solidjs/web 2.0.0-rc.5 rejects as malformed (400) instead of ignoring.

.changeset/dev-middleware-data-address.md

@@ -0,0 +1,5 @@
+---
+'@solidjs/vite-plugin': patch
+---
+
+Dev middleware recognizes the scripted transport's data address. Scripted server-function calls now go to `<endpoint>/data/<id>` (solidjs/solid#3094), and the middleware's module-preload step assumed exactly one path segment after the mount — a cold function only client code references would never be evaluated in the SSR environment for a data-addressed call, answering 404 under `vite dev`. Dispatch itself was unaffected (mount matching is prefix-based). The id now parses from behind the literal `data` segment too; a function id spelled `data` still parses at the bare address, since an id occupies exactly one segment.

.changeset/drop-legacy-server-function-addressing.md

@@ -0,0 +1,5 @@
+---
+"@solidjs/vite-plugin": patch
+---
+
+Drop the retired `X-Server-Function-Id` header and `?id=` addressing fallback from the dev middleware's module-preload path. Addressing is path-only (`<endpoint>/<id>` and `<endpoint>/data/<id>`), matching the runtime's removal of its own transitional shims during the RC.

.changeset/id-hash-second-segment.md

@@ -0,0 +1,5 @@
+---
+"@solidjs/vite-plugin": patch
+---
+
+Read the file hash from the second id segment. Server-function ids are now identity-keyed `<name>-<hash>[-<ordinal>]` (solidjs/solid#3109) instead of positional `<hash>-<ordinal>`, so the dev middleware's id-to-module lookup takes the hash from `split('-')[1]` rather than the first segment.

examples/start-ssr/server.js

@@ -27,7 +27,15 @@ const MIME = {
 function webRequest(req) {
   const url = new URL(req.url || '/', `http://${req.headers.host || `localhost:${port}`}`);
   const method = req.method || 'GET';
-  const body = method === 'GET' || method === 'HEAD' ? undefined : Readable.toWeb(req);
+  // Attach a body only when the request carries one (Content-Length or
+  // Transfer-Encoding, RFC 9112 §6): the runtime treats a present body that
+  // decodes to nothing as malformed since @solidjs/web 2.0.0-rc.5.
+  const hasBody =
+    method !== 'GET' &&
+    method !== 'HEAD' &&
+    (req.headers['transfer-encoding'] !== undefined ||
+      (req.headers['content-length'] !== undefined && req.headers['content-length'] !== '0'));
+  const body = hasBody ? Readable.toWeb(req) : undefined;
   return new Request(url, {
     method,
     headers: req.headers,

examples/start-ssr/test/host-dispatch.mjs

@@ -23,7 +23,7 @@ try {
   // manifest (the same signal the browser's module request sends in a real
   // session); it also yields the compiled reference to pull the id from.
   const transformed = await server.transformRequest('/src/api.ts');
-  const match = /createServerReference\w*\("([^"]*-getServerMessage)"/.exec(transformed?.code || '');
+  const match = /createServerReference\w*\("(getServerMessage-[^"]*)"/.exec(transformed?.code || '');
   if (!match) throw new Error('could not extract function id from transformed module');
 
   const runner = server.environments.ssr.runner;
@@ -40,7 +40,7 @@ try {
   const body = await response.text();
   console.log(`HOST-DISPATCH ${response.status} ${body}`);
 
-  const nativeMatch = /createServerReference\w*\("([^"]*-nativeAddress)"/.exec(
+  const nativeMatch = /createServerReference\w*\("(nativeAddress-[^"]*)"/.exec(
     transformed?.code || '',
   );
   if (!nativeMatch) throw new Error('could not extract nativeAddress function id');

examples/start-ssr/test/run.mjs

@@ -297,25 +297,34 @@ function record(mode, phase, name, ok, detail = '') {
   console.log(`  [${mode}/${phase}] ${status} ${name}${detail && !ok ? ` — ${detail}` : ''}`);
 }
 
-// Dev function IDs are `hash-count-name`; pull the one for `name` out of the
-// client-transformed module so the endpoint can be hit directly.
+// Pull the function id for `name` out of the client-transformed module so
+// the endpoint can be hit directly.
 function extractFunctionId(transformedCode, name) {
-  // The import identifier may be aliased (e.g. createServerReference_1), and
-  // newer compilers pass the function name as a second argument after the id.
-  const match = transformedCode.match(new RegExp(`createServerReference\\w*\\("([^"]*-${name})"`));
+  // The import identifier may be aliased (e.g. createServerReference_1).
+  // Ids are identity-keyed `<name>-<hash>[-<ordinal>]` (solidjs/solid#3109);
+  // the literal `-` after the name keeps e.g. `getServerMessage2` from
+  // matching a probe for `getServerMessage`.
+  const match = transformedCode.match(new RegExp(`createServerReference\\w*\\("(${name}-[^"]*)"`));
   return match ? match[1] : null;
 }
 
-async function runCsrfChecks(mode, origin) {
-  const crossSite = await fetch(origin + '/_server/csrf-probe', {
-    method: 'POST',
-    headers: { 'Sec-Fetch-Site': 'cross-site' },
-  });
+async function runCsrfChecks(mode, origin, registeredId) {
+  // The runtime answers unknown ids 404 before the same-origin check runs
+  // (@solidjs/web 2.0.0-rc.5), so the rejection must be probed against a
+  // registered function id.
+  const crossSite = await fetch(
+    `${origin}/_server/${encodeURIComponent(registeredId || 'csrf-probe')}`,
+    {
+      method: 'POST',
+      headers: { 'Sec-Fetch-Site': 'cross-site' },
+    },
+  );
   record(
     mode,
     'csrf',
     'cross-site server function request rejected',
     crossSite.status === 403,
+    registeredId ? `status ${crossSite.status}` : 'no registered id to probe',
   );
 
   const sameOrigin = await fetch(origin + '/_server/csrf-probe', { method: 'POST' });
@@ -924,7 +933,7 @@ async function runDevMode() {
     );
     const bogus = await fetch(origin + '/_server/bogus-0');
     record(mode, 'sf', 'dev middleware rejects unknown id', bogus.status === 404);
-    await runCsrfChecks(mode, origin);
+    await runCsrfChecks(mode, origin, functionId);
 
     const html = await runSsrChecks(mode, origin);
     record(mode, 'dev', 'Vite client injected into <head>', html.includes('/@vite/client'));
@@ -1192,7 +1201,8 @@ async function runProdMode() {
 
     const bogus = await fetch(origin + '/_server/bogus-0');
     record(mode, 'sf', 'prod handler rejects unknown id', bogus.status === 404);
-    await runCsrfChecks(mode, origin);
+    const registeredId = serverBundle.match(/registerServerReference\w*\("([^"]+)"/)?.[1] ?? null;
+    await runCsrfChecks(mode, origin, registeredId);
 
     const html = await runSsrChecks(mode, origin);
     record(
@@ -1771,10 +1781,10 @@ async function runConfigureMode() {
     });
     captureLog(server);
     await waitForHttp(origin + '/', 30000, { headers: { accept: 'text/html' } });
-    // Production ids are the dev id minus its dev-only trailing `-name`
-    // segment (`hash-count` vs `hash-count-name`), so the dev phase's id
-    // carries over. Dispatch before any page render, like dev.
-    const prodId = functionId ? functionId.replace(/-configureProbe$/, '') : null;
+    // Identity-keyed ids (`<name>-<hash>[-<ordinal>]`, solidjs/solid#3109)
+    // are the same in dev and prod, so the dev phase's id carries over
+    // as-is. Dispatch before any page render, like dev.
+    const prodId = functionId;
     const prod = prodId ? await dispatch(prodId) : null;
     record(
       mode,
@@ -2837,8 +2847,8 @@ async function runMiddlewareMode() {
     });
     captureLog(server);
     await waitForHttp(prodOrigin + '/', 30000, { headers: { accept: 'text/html' } });
-    // Prod ids drop the dev-only trailing `-name` segment.
-    const prodId = functionId ? functionId.replace(/-whoAmI$/, '') : null;
+    // Identity-keyed ids are the same in dev and prod (solidjs/solid#3109).
+    const prodId = functionId;
     await runMiddlewareChecksOverHttp('mw-prod', prodOrigin, prodId);
     await runHttpChecks('mw-prod', prodOrigin);
   } catch (e) {