[Bug?]: Module level "use server" is not working anymore

[frenzzy]

Duplicates

• I have searched the existing issues

Latest version

• I have tested the latest version

Current behavior 😯

When you build a SolidStart app using npm run build, you receive the following warning:

Error when using sourcemap for reporting an error: Can't resolve original location of error.
Module level directives cause errors when bundled, "use server" in "src/hi.ts" was ignored.

Expected behavior 🤔

Either the module-level "use server" should work as it did before SolidStart v1.1.0, or the documentation should be updated:
https://docs.solidjs.com/solid-start/reference/server/use-server#use-server

If "use server" is inserted as the first line in a file, the entire file will become server-only.

Steps to reproduce 🕹

Steps:

1. Run npm create solid with the default selections to create a new project.
2. Create src/hi.ts with the following content:

   'use server'
   export const hi = async () => {
     console.log('hi!')
   }

3. Add the following to src/app.tsx:

   import { action } from "@solidjs/router";
   import { hi } from "./hi";
   const a = action(hi)

4. Run npm run build and observe the output:
   

Context 🔦

No response

Your environment 🌎

SolidStart v1.1.0
Vinxi v0.5.3

[atilafassina]

thanks for this issue (and for our chat on discord), @frenzzy
despite the warning, it seems that not using const still works.
@brenelz got a failing test in a PR and now we're digging on the issue.

[frenzzy]

The issue is still reproduced with @solidjs/start@1.1.1 and @tanstack/server-functions-plugin@1.103.1

FYI @atilafassina

[frenzzy]

With export function also does not work:

// src/hi.ts
'use server'
export async function hi() {
  console.log('hi!')
}

[brenelz]

Even tho that warning still shows up the actual code should work as expected

[atilafassina]

@frenzzy yes. The warning is still there. I added to the release notes that we're still digging on it. It's not exactly straightforward to remove that warning because I believe it's something between the sf-plugin and Vinxi configuration - because of the refactoring we have planned it may take a while before we know this is something that needs extra effort.

As @brenelz said, the code should work as expected. This means that we have some tests to make sure there is no leak of server logic to the client bundle. If you can find a case where it does, please open an issue and feel free to mention all of us - security is top priority. But at the moment I have no reason to consider this as a critical bug because all evidence I have points to it being safe to use in production.

[josephg]

I just upgraded to solidstart 1.1.3 (from 1.0.10) and I started running into this problem:

📦 Compiling client router...
vinxi building router client in client mode
vite v6.0.3 building for production...
src/lib/server.ts (1:0): Error when using sourcemap for reporting an error: Can't resolve original location of error.
src/lib/server.ts (1:0): Module level directives cause errors when bundled, "use server" in "src/lib/server.ts" was ignored.
[plugin:vite:resolve] [plugin vite:resolve] Module "fs" has been externalized for browser compatibility, imported by "/home/seph/src/quill/quill-metal/src/lib/server.ts". See https://vite.dev/guide/troubleshooting.html#module-externalized-for-browser-compatibility for more details.
src/lib/db.ts (1:0): Error when using sourcemap for reporting an error: Can't resolve original location of error.
src/lib/db.ts (1:0): Module level directives cause errors when bundled, "use server" in "src/lib/db.ts" was ignored.
".prisma/client/index-browser" is imported by ".prisma/client/index-browser?commonjs-external", but could not be resolved – treating it as an external dependency.
virtual:$vinxi/handler/client (1:97): "default" is not exported by "src/entry-client.tsx", imported by "virtual:$vinxi/handler/client".

It is potentially a security problem - as vinxi is now trying to bundle my server-only code into my browser bundle. For example, I'm using prisma on the backend and the build process is now trying to bundle it for the browser:

I'm not sure why this issue has been closed as fixed. Its clearly not resolved - at least not in 1.1.3.

EDIT: I've forward this to the security email address. Please delete this comment if necessary.

[thednp]

I also encountered this issue with my project after updating to the latest, however I tested some solid-start examples (pnpm create solid) and they work fine. Strange.

EDIT1: bundling the "with-drizzle" project also shows a console warning for the use of "use server" but the build works fine.

EDIT2: I think I managed to isolate the issue to the usage of the router exports "cache", "revalidate", and/or "query", somehow it doesn't work with file(s) where these exports are used especially when using "use server".
This used to work with previous versions just fine, but now this combination seems to break the logic somehow.