Solid 2.0 rc.13: runtime parity, call-record panel, observe exclusion

[ryansolid]

Ports the devtools from the rc.0 runtime they were written against onto Solid 2.0 rc.13. Three feature commits plus a final one that resolves the published runtime: the first makes the toolbar build and read the current runtime again; the second puts the server-function panel back on a live data source and keeps the toolbar out of the runtime's observe layer; the third shows a call the moment its request is sent; the last regenerates the lockfile against npm.

Runtime

Peer floor is ^2.0.0-rc.13 for solid-js / @solidjs/web (and @solidjs/compiler pinned to 2.0.0-rc.13). 2.0.0-rc.12 was never published — npm goes rc.11 → rc.13 — and the floor is the lowest published version that carries both features commits 2 and 3 depend on: OBSERVE.include / CallLive.request / OBSERVE.records.subscribe(type, fn, { bodies: true }) (solidjs/solid#3705) and the "request" record / CallRequestEvent (solidjs/solid#3708). rc.11's @solidjs/web types contain neither; rc.13's contain both.

pnpm-lock.yaml now resolves from the registry (no link: overrides were ever committed; the branch was developed against local links). pnpm added the rc.13 Solid packages to minimumReleaseAgeExclude in pnpm-workspace.yaml so the fresh release installs. All suites were re-run against the published packages: vitest 96/96, tsc clean, build emits only _$$click (16×), Playwright 8/8, publint + attw clean.

Commit 1 — build and read the rc.13 runtime (282e395)

• Delegated events were dead. The build compiled JSX with @dom-expressions/[email protected], which emits $$click; the rc.9+ runtime reads _$$click. Every click in the reactivity and ownership panels was a no-op. The build (and the e2e fixture) now compile with @solidjs/compiler, the compiler that ships with the runtime. Dist before: 16× $$click, 0× _$$click; after: 0× $$click, 16× _$$click.
• Node errors are read off the extension: node._x?._error (was node._error).
• Store slot nodes are recognised by their _host backref (the previous _isStoreNode field never existed); they render as store again.
• The built-in hot-reload wrapper memo is now created with _plumbing (CONFIG_PLUMBING = 1 << 25) and unnamed, rather than named [solid-refresh]…. The graph hides plumbing nodes and the ownership tree walks through them without a row. Prefix handling kept.
• e2e: the production server build now sanitizes render errors to Internal Server Error, so Playwright runs with NODE_OPTIONS=--conditions=development (the toolbar only ships under that condition).
• The server-side Errored fallback wrote signals during SSR, which rc.11 reports as SERVER_WRITE (deprecated, becoming an error). On the server it now sets the 500 status and logs only.
• registry.test.ts's "no dev runtime" suite relied on Node resolving solid-js to a build without DEV; rc.11's node → development condition resolves server.dev.js, so the suite mocks solid-js with a switchable DEV.

Commit 2 — call record + observe exclusion (b1911ae)

• observeServerFunctionCalls was removed from @solidjs/web/server-functions in rc.9; the panel has shown nothing since. src/index.tsx now subscribes to OBSERVE.records for "call" with { bodies: true } and maps each settled record into the tracker's existing request/response events (callRecordToEvents, unit-tested): request at event.at, response at at + durationMs, meta.name from the record's source name, a fetch-rejected call as request-only with the failure on meta.error, nothing when no request was built.
• DevToolbar marks its owner with OBSERVE.exclude; AppScope hands the wrapped app back with OBSERVE.include (nearest marked ancestor answers), so the toolbar's own signals and effects are never reported as the app's by diagnostics, attribution or the performance tracks — which the Vite plugin now enables by default in vite dev.

Commit 3 — a call appears when its request is sent (05b6c73)

• The "call" record arrives at settle, so a slow or hung call never appeared. The panel now also subscribes to the "request" record (solidjs/solid#3708): a row appears the moment the request is handed to fetch, and the "call" record completes it — joined by the live object the runtime hands to both listeners (a WeakMap<CallLive, instance>). A settled call whose request was never seen (subscription came mid-call) is shown whole from its "call" record.
• A fetch that itself rejected re-shows the row as failed: "Request failed: " in place of "Waiting for response.", and an ERR badge in the list.
• connectCallRecords(records) owns the wiring behind a structural channel type so tests drive it with a fake; requestRecordToEvent / settleRecordToEvents are the pure mappings beside the settle-only callRecordToEvents.

Commit 4 — resolve the rc.13 runtime from the registry (ac9fdd4)

• package.json: peers and devDeps solid-js / @solidjs/web ^2.0.0-rc.13, @solidjs/compiler 2.0.0-rc.13.
• pnpm-lock.yaml regenerated from npm; pnpm-workspace.yaml gains the rc.13 minimumReleaseAgeExclude entries pnpm wrote during install.

Public API changes

• Peer dependencies solid-js / @solidjs/web: ^2.0.0-rc.0 → ^2.0.0-rc.13 (breaking for consumers on earlier RCs; the package was already non-functional on rc.9+).
• Build devDependency: @dom-expressions/compiler → @solidjs/compiler; @solidjs/vite-plugin devDependency 3.0.0-next.35 → 3.0.0-next.46.
• No changes to the package's exports (DevToolbar, mountDevToolbar, pushServerFunctionCall, ServerFunctionCall unchanged).

Behavior changes

• A server-function call appears when its request is handed to fetch and completes at settle; a fetch that fails is marked as failed. request.time is the send time (after serialization and prepareRequest), as it was under the rc.0 probe, so the displayed duration is wire + decode.
• SSR render errors no longer seed the toolbar's error-panel state during the server render (it never survived hydration; the 500 status and the log remain).

Tests

Unit 73/75 → 96/96 (vitest), typecheck clean, e2e 7/8 → 8/8 (Playwright), publint + attw clean. Verified against the published 2.0.0-rc.13 packages resolved from npm.

— Claude via Cursor

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​solidjs/​web@​2.0.0-rc.0 ⏵ 2.0.0-rc.13	+5		+1	+1
	@​solidjs/​compiler@​2.0.0-rc.7 ⏵ 2.0.0-rc.13	+16		+1	+3
	solid-js@​2.0.0-rc.0 ⏵ 2.0.0-rc.13			+1	+1
	@​solidjs/​vite-plugin@​3.0.0-next.35 ⏵ 3.0.0-next.46			+1	+2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Low adoption: npm @solidjs/compiler-darwin-arm64 Location: Package overview From: pnpm-lock.yaml → npm/@solidjs/[email protected] → npm/@solidjs/[email protected] ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@solidjs/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm @solidjs/compiler-darwin-x64 Location: Package overview From: pnpm-lock.yaml → npm/@solidjs/[email protected] → npm/@solidjs/[email protected] ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@solidjs/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm @solidjs/compiler-darwin-x64 Location: Package overview From: pnpm-lock.yaml → npm/@solidjs/[email protected] → npm/@solidjs/[email protected] ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@solidjs/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm @solidjs/compiler-linux-arm64-gnu Location: Package overview From: pnpm-lock.yaml → npm/@solidjs/[email protected] → npm/@solidjs/[email protected] ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@solidjs/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm @solidjs/compiler-win32-x64-msvc Location: Package overview From: pnpm-lock.yaml → npm/@solidjs/[email protected] → npm/@solidjs/[email protected] ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@solidjs/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report