From 09c0954645671c2d1777bd43cb2cd7e6acdcc4ee Mon Sep 17 00:00:00 2001
From: Luca Casonato <hello@lcas.dev>
Date: Sat, 17 Oct 2026 14:00:03 +0200
Subject: [PATCH] chore: switch from vendored devalue fork to upstream devalue
 6

`devalue` 6 ships the `js` tagged-template replacer API from
sveltejs/devalue#182, which is what the fork existed for. The replacer now
returns `js` fragments, so a signal inside a factory's args and in a sibling
position revives as one instance. Also adds unit round-trips for Temporal
types, typed arrays, `DataView`, `URL`, sparse arrays and special numbers.
---
 .oxfmtrc.json                    |   2 +-
 .oxlintrc.json                   |   1 -
 TODO.md                          |   2 +-
 pnpm-lock.yaml                   |   9 +
 src/package.json                 |   3 +-
 src/server/serialization.test.ts | 155 +++++++-
 src/server/serialization.ts      |  61 ++--
 src/vendor/devalue/LICENSE       |   7 -
 src/vendor/devalue/constants.js  |  12 -
 src/vendor/devalue/index.d.ts    |   2 -
 src/vendor/devalue/index.js      |   6 -
 src/vendor/devalue/uneval.js     | 583 -------------------------------
 src/vendor/devalue/utils.js      | 160 ---------
 13 files changed, 196 insertions(+), 807 deletions(-)
 delete mode 100644 src/vendor/devalue/LICENSE
 delete mode 100644 src/vendor/devalue/constants.js
 delete mode 100644 src/vendor/devalue/index.d.ts
 delete mode 100644 src/vendor/devalue/index.js
 delete mode 100644 src/vendor/devalue/uneval.js
 delete mode 100644 src/vendor/devalue/utils.js

diff --git a/.oxfmtrc.json b/.oxfmtrc.json
index 2966f36d4f5..faf34ad4ee5 100644
--- a/.oxfmtrc.json
+++ b/.oxfmtrc.json
@@ -2,5 +2,5 @@
   "$schema": "./node_modules/oxfmt/configuration_schema.json",
   "printWidth": 100,
   "proseWrap": "never",
-  "ignorePatterns": [".fresh", ".output", "www/public", "src/vendor"]
+  "ignorePatterns": [".fresh", ".output", "www/public"]
 }
diff --git a/.oxlintrc.json b/.oxlintrc.json
index 2aba2d32bf4..dc72033c28e 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -1,6 +1,5 @@
 {
   "$schema": "https://raw.githubusercontent.com/oxc-project/oxc/main/npm/oxlint/configuration_schema.json",
-  "ignorePatterns": ["src/vendor"],
   "overrides": [
     {
       "files": ["**/src/**/*.{ts,tsx}"],
diff --git a/TODO.md b/TODO.md
index eee0dd7f86a..761fb3a96c0 100644
--- a/TODO.md
+++ b/TODO.md
@@ -55,7 +55,7 @@ Gaps surfaced by comparing against the Fresh 2 test suite. (Programmatic route r
 - [x] Partial-navigation client e2e — scroll reset on a forward swap, scroll restoration on back/forward traverse, full-page fallback when a partial fetch 500s, and native in-page hash-link scrolling (no swap/reload). All in `tests/e2e/partials.spec.ts`. Scroll reset/restore is handled entirely by the Navigation API's default `intercept({ scroll: "after-transition" })` (no fresh3 code needed) — the test drives navigation via a JS `.click()` (`clickViaJs` in `util.ts`) so Playwright's scroll-into-view doesn't reset the page to the top before the navigation fires.
 - [ ] Remaining partial client e2e: focus reset after a swap, and request-abort behaviour when one navigation supersedes another in flight.
 - [ ] Head e2e gaps: multiple islands each rendering `<Head>` (merge), reactive `<meta>` content updates post-hydration, and `<style>`/`<template>`/`<noscript>` collection into the head.
-- [ ] Serializer wire-format coverage leans on devalue at the e2e layer; explicit unit round-trips for Temporal types, `Uint8Array` / typed arrays, `URL`, sparse arrays, and `undefined` / `NaN` / `±Infinity` are missing (only partly exercised via `tests/e2e/serialization.spec.ts`).
+- [x] Serializer wire-format unit round-trips in `src/server/serialization.test.ts` — Temporal types, `ArrayBuffer` / every typed array (incl. subarrays and shared buffers), `DataView`, `URL` / `URLSearchParams`, sparse arrays, and `undefined` / `NaN` / `±Infinity` / `-0`. These run against upstream `devalue` (6.x), which replaced our vendored fork once its `js`-template replacer API landed.
 
 ### WWW
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 7908dd1060c..f9c0115bd61 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -69,6 +69,9 @@ importers:
       '@prefresh/vite':
         specifier: ^4.0.1
         version: 4.0.1(@babel/core@7.29.7)(@prefresh/babel-plugin@0.5.3)(preact@11.0.0)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0))
+      devalue:
+        specifier: ^6.0.3
+        version: 6.0.3
       magic-string:
         specifier: ^1.4.2
         version: 1.4.2
@@ -1121,6 +1124,10 @@ packages:
     resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
     engines: {node: '>=8'}
 
+  devalue@6.0.3:
+    resolution: {integrity: sha512-3woMEITftG1wKeO/4d/QXH1DVKctTSZg3jNGPpjp9hNr5Hos8MCFF5McTML5ZtgKDObm2R591B0spRp2IVernA==}
+    engines: {node: '>=18'}
+
   devlop@1.1.0:
     resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==}
 
@@ -2459,6 +2466,8 @@ snapshots:
 
   detect-libc@2.1.2: {}
 
+  devalue@6.0.3: {}
+
   devlop@1.1.0:
     dependencies:
       dequal: 2.0.3
diff --git a/src/package.json b/src/package.json
index 85a80c88b94..e2a79ff4a4f 100644
--- a/src/package.json
+++ b/src/package.json
@@ -86,11 +86,12 @@
     }
   },
   "scripts": {
-    "build": "GOMAXPROCS=1 tsgo -p tsconfig.json && find dist -name '*.test.*' -delete && cp -R vendor dist/vendor",
+    "build": "GOMAXPROCS=1 tsgo -p tsconfig.json && find dist -name '*.test.*' -delete",
     "prepack": "rm -rf dist && pnpm run build"
   },
   "dependencies": {
     "@prefresh/vite": "^4.0.1",
+    "devalue": "^6.0.3",
     "magic-string": "^1.4.2",
     "nitro": "^3.0.260903-beta",
     "preact-render-to-string": "^6.8.0",
diff --git a/src/server/serialization.test.ts b/src/server/serialization.test.ts
index e2efe9168d6..54be14310ed 100644
--- a/src/server/serialization.test.ts
+++ b/src/server/serialization.test.ts
@@ -178,10 +178,9 @@ test("factory args are recursively walked through the replacer — signals insid
   const factory = tagIslandExport((s: unknown) => ({ derived: s }), "islands/utils.tsx", "wrap");
   const sig = signal(7);
   const result = { __FRESH_FROM_FACTORY: { factory, args: [sig] } };
-  // Serialize the factory result on its own. (Sharing `sig` across the
-  // factory args AND a sibling position is NOT preserved — see the next
-  // test — and would push devalue into its IIFE-dedup form, which is a
-  // different shape than what this test is asserting about.)
+  // Serialize the factory result on its own. (Sharing `sig` with a
+  // sibling position would push devalue into its IIFE-dedup form, which is
+  // a different shape than what this test is asserting about.)
   const src = ser.serialize(result);
   // The arg is itself a signal-call expression — proving the args
   // went back through the replacer rather than being inlined as a
@@ -198,10 +197,7 @@ test("factory args are recursively walked through the replacer — signals insid
 test("the SAME factory-result reference used twice survives as one instance via devalue's IIFE-bound local", () => {
   // The simpler dedup case — two references to the same factory
   // result. devalue notices the same JS object and IIFE-wraps the
-  // shared expression. (Cross-boundary sharing — same signal both
-  // inside a factory's args AND as a sibling — is NOT preserved; that
-  // would require hoisting expressions into top-level `const`
-  // bindings, which we don't.)
+  // shared expression.
   const ser = createSerializer();
   const factory = tagIslandExport(
     (n: number) => ({ doubled: n * 2 }),
@@ -214,6 +210,15 @@ test("the SAME factory-result reference used twice survives as one instance via
   assert.equal(built.a, built.b);
 });
 
+test("a signal inside a factory's args AND in a sibling position survives as one shared instance", () => {
+  const ser = createSerializer();
+  const factory = tagIslandExport((s: unknown) => ({ derived: s }), "islands/utils.tsx", "wrap");
+  const sig = signal(7);
+  const src = ser.serialize({ a: { __FRESH_FROM_FACTORY: { factory, args: [sig] } }, b: sig });
+  const built = evalProgram(src, ser.imports) as { a: { __call: { args: unknown[] } }; b: unknown };
+  assert.equal(built.a.__call.args[0], built.b);
+});
+
 // ---------- aliasFor (post-hoc imports, e.g. the boot runtime) ----------
 
 test("aliasFor can register an additional import after serialize() — gets the next module index", () => {
@@ -284,6 +289,140 @@ test("`navigating()` serializes as a factory call via fresh/signals (not a bare
   assert.ok(entry.imports.has("navigating"));
 });
 
+// ---------- wire-format round-trips for built-in value types ----------
+
+/** Serialize `value` and eval the emitted expression back into a value. */
+function roundTrip<T>(value: T): T {
+  const ser = createSerializer();
+  const src = ser.serialize(value);
+  return evalProgram(src, ser.imports) as T;
+}
+
+test("`undefined`, `NaN`, `±Infinity`, and `-0` round-trip, including nested in objects and arrays", () => {
+  for (const v of [undefined, NaN, Infinity, -Infinity, -0]) {
+    assert.ok(Object.is(roundTrip(v), v), `${String(v)} must round-trip`);
+  }
+  const out = roundTrip({ u: undefined, n: NaN, arr: [Infinity, -Infinity, -0, undefined] });
+  assert.ok("u" in out, "an `undefined`-valued key must survive, not be dropped");
+  assert.equal(out.u, undefined);
+  assert.ok(Number.isNaN(out.n));
+  assert.equal(out.arr.length, 4);
+  assert.equal(out.arr[0], Infinity);
+  assert.equal(out.arr[1], -Infinity);
+  assert.ok(Object.is(out.arr[2], -0));
+  assert.ok(3 in out.arr, "an explicit `undefined` element is not a hole");
+});
+
+/** An array of `length` holes with only `entries` populated. */
+function sparse(length: number, entries: Record<number, unknown>): unknown[] {
+  const arr: unknown[] = [];
+  arr.length = length;
+  return Object.assign(arr, entries);
+}
+
+test("sparse arrays keep their holes and length", () => {
+  // Mildly sparse (devalue emits `[1,,3]`), very sparse (emitted as
+  // `Object.assign(Array(n),{…})`), and a trailing hole (needs an extra `,`).
+  const cases = [
+    sparse(3, { 0: 1, 2: 3 }),
+    sparse(1000, { 3: "a", 997: "b" }),
+    sparse(3, { 0: 1, 1: 2 }),
+  ];
+  for (const arr of cases) {
+    const out = roundTrip(arr);
+    assert.equal(out.length, arr.length);
+    for (let i = 0; i < arr.length; i++) {
+      assert.equal(i in out, i in arr, `index ${i} hole-ness must match`);
+      assert.equal(out[i], arr[i]);
+    }
+  }
+});
+
+test("`URL` and `URLSearchParams` revive as instances", () => {
+  const out = roundTrip({
+    url: new URL("https://example.com/a?b=1#c"),
+    params: new URLSearchParams("x=1&x=2&y=</script>"),
+  });
+  assert.ok(out.url instanceof URL);
+  assert.equal(out.url.href, "https://example.com/a?b=1#c");
+  assert.ok(out.params instanceof URLSearchParams);
+  assert.deepEqual(out.params.getAll("x"), ["1", "2"]);
+  assert.equal(out.params.get("y"), "</script>");
+});
+
+test("`ArrayBuffer`, `Uint8Array`, and every other typed array revive with their type and contents", () => {
+  const values = [
+    new Int8Array([-128, 0, 127]),
+    new Uint8Array([0, 1, 255]),
+    new Uint8ClampedArray([0, 128, 255]),
+    new Int16Array([-32768, 32767]),
+    new Uint16Array([0, 65535]),
+    new Float16Array([1.5, -2]),
+    new Int32Array([-1, 2 ** 31 - 1]),
+    new Uint32Array([0, 2 ** 32 - 1]),
+    new Float32Array([0.5, -Infinity]),
+    new Float64Array([Math.PI, NaN, -0]),
+    new BigInt64Array([-(2n ** 63n), 1n]),
+    new BigUint64Array([2n ** 64n - 1n]),
+  ];
+  for (const v of values) {
+    const out = roundTrip(v);
+    assert.equal(out.constructor, v.constructor);
+    assert.deepEqual(out, v);
+  }
+  // A typed array referenced twice goes through devalue's hoisted-value path,
+  // which writes its elements separately from the inline path.
+  const big = new BigInt64Array([-(2n ** 63n), 1n]);
+  const shared = roundTrip({ a: big, b: big });
+  assert.equal(shared.a, shared.b);
+  assert.deepEqual(shared.a, big);
+  const buf = roundTrip(new Uint8Array([1, 2, 3]).buffer);
+  assert.ok(buf instanceof ArrayBuffer);
+  assert.deepEqual(new Uint8Array(buf), new Uint8Array([1, 2, 3]));
+});
+
+test("typed-array subarrays keep their window, and views sharing a buffer still share it", () => {
+  const buffer = new Uint8Array([10, 20, 30, 40, 50]).buffer;
+  const out = roundTrip({
+    whole: new Uint8Array(buffer),
+    sub: new Uint8Array(buffer, 1, 3),
+  });
+  assert.deepEqual([...out.sub], [20, 30, 40]);
+  assert.equal(out.sub.byteOffset, 1);
+  assert.equal(out.whole.buffer, out.sub.buffer, "both views must share one revived buffer");
+  out.whole[2] = 99;
+  assert.equal(out.sub[1], 99);
+});
+
+test("a `DataView` revives with its bytes, and a sub-view keeps its offset", () => {
+  const buffer = new Uint8Array([1, 2, 3, 4, 5, 6]).buffer;
+  const out = roundTrip(new DataView(buffer));
+  assert.ok(out instanceof DataView);
+  assert.equal(out.getUint32(0), 0x01020304);
+  const sub = roundTrip(new DataView(buffer, 2, 3));
+  assert.equal(sub.byteOffset, 2);
+  assert.equal(sub.byteLength, 3);
+  assert.equal(sub.getUint8(0), 3);
+});
+
+test("every Temporal type revives as an instance with the same value", () => {
+  const values = [
+    Temporal.Duration.from("P1Y2M3DT4H5M6.789S"),
+    Temporal.Instant.from("2026-01-02T03:04:05.123456789Z"),
+    Temporal.PlainDate.from("2026-01-02"),
+    Temporal.PlainTime.from("03:04:05.123"),
+    Temporal.PlainDateTime.from("2026-01-02T03:04:05"),
+    Temporal.PlainMonthDay.from("--01-02"),
+    Temporal.PlainYearMonth.from("2026-01"),
+    Temporal.ZonedDateTime.from("2026-01-02T03:04:05+01:00[Europe/Berlin]"),
+  ];
+  for (const v of values) {
+    const out = roundTrip(v);
+    assert.equal(Object.getPrototypeOf(out), Object.getPrototypeOf(v));
+    assert.equal(out.toString(), v.toString());
+  }
+});
+
 // ---------- `</script>` injection safety via uneval ----------
 
 test("strings containing `</script>` are escaped by devalue.uneval — `</script>` never appears verbatim", () => {
diff --git a/src/server/serialization.ts b/src/server/serialization.ts
index b89e030df05..425155a327d 100644
--- a/src/server/serialization.ts
+++ b/src/server/serialization.ts
@@ -17,7 +17,7 @@
 //      custom-typed nodes replaced by alias / call expressions. Shared
 //      references survive because devalue's `uneval` notices when the
 //      same JS object appears in two places and hoists it into an
-//      IIFE-bound local — including across `recurse` boundaries — so
+//      IIFE-bound local — including inside replacer `js` fragments — so
 //      a signal that appears as an island prop AND inside an event-
 //      handler factory's args revives as ONE instance;
 //
@@ -43,7 +43,18 @@
 //     `<signalAlias>(<peeked-value>)`; the peeked inner value goes back
 //     through the replacer for nested signal / factory handling.
 
-import { uneval } from "../vendor/devalue/index.js";
+import { uneval, type JavaScriptFragment, type JavaScriptTag } from "devalue";
+
+/**
+ * Build a `js` fragment from template pieces that aren't known until
+ * runtime (import aliases, a variable number of factory args). `strings`
+ * is literal JS source and must be one longer than `values`, exactly like
+ * a tagged template's string array; each value is serialized by devalue.
+ */
+function source(js: JavaScriptTag, strings: string[], values: unknown[]): JavaScriptFragment {
+  const template = Object.assign([...strings], { raw: [...strings] });
+  return js(template, ...values);
+}
 
 const SIGNAL_BRAND = Symbol.for("preact-signals");
 
@@ -115,8 +126,8 @@ export interface Serializer {
    * expressions, and return the JS source to place after `const data =
    * ` and before `;`. Shared references survive — devalue's own
    * IIFE-bound-local mechanism dedupes any value reached via the same
-   * JS object identity more than once, including across `recurse`
-   * boundaries.
+   * JS object identity more than once, including inside a factory's
+   * args.
    */
   serialize(value: unknown): string;
   /**
@@ -157,38 +168,39 @@ export function createSerializer(options: SerializerOptions = {}): Serializer {
     return `_${mod.index}_${idx}`;
   }
 
-  // devalue's `uneval` invokes the replacer as `(value, recurse)` where
-  // `recurse` is a bound helper that shares the outer call's reference
-  // graph and dedup state. Recursing through it (rather than calling
-  // `uneval(...)` again) is what lets devalue notice when the same
-  // signal / factory-result / function reference appears in two places
-  // and emit a single IIFE-bound local — so reactivity is preserved
-  // across an island prop + a `{signal}` text child + an event-handler
-  // argument without us tracking sharing ourselves.
-  const replacer = (v: unknown, recurse: (value: unknown) => string): string | undefined => {
+  // devalue's `uneval` invokes the replacer as `(value, js)`. Each `js`
+  // fragment is literal JS source with "holes" that devalue serializes
+  // itself, after its reference analysis has seen them. That is what lets
+  // devalue notice when the same signal / factory-result / function
+  // reference appears in two places — including once as a top-level value
+  // and once inside a factory's args — and emit a single IIFE-bound local,
+  // so reactivity is preserved across an island prop + a `{signal}` text
+  // child + an event-handler argument without us tracking sharing ourselves.
+  const replacer = (v: unknown, js: JavaScriptTag): JavaScriptFragment | undefined => {
     // Order matters. `makeComputed` results carry BOTH the factory
     // marker AND the signal brand — the only correct round-trip path
     // is to re-invoke the factory, so FactoryFunction wins.
     if (isFromFactory(v)) {
       const { factory, args } = (v as { __FRESH_FROM_FACTORY: FactoryMarker }).__FRESH_FROM_FACTORY;
-      // The factory is itself a SerializableFunction — `recurse(factory)`
-      // re-enters the replacer, hits the `isSerializableFunction`
-      // branch below, registers the import, and returns the alias. The
-      // pre-check just gives a specific error message instead of
-      // devalue's generic "can't uneval a function".
+      // The factory is itself a SerializableFunction — as a hole it
+      // re-enters the replacer, hits the `isSerializableFunction` branch
+      // below, registers the import, and becomes the alias. The pre-check
+      // just gives a specific error message instead of devalue's generic
+      // "can't uneval a function".
       if (!isSerializableFunction(factory)) {
         throw new TypeError(
           "factory(...) wrapper isn't an island-exported function — make sure the factory itself is exported from an `islands/` module (or shipped by a `fresh/...` runtime entrypoint).",
         );
       }
-      const factorySrc = recurse(factory);
-      const argSources = args.map(recurse);
-      return `(${factorySrc})(${argSources.join(",")})`;
+      // `(<factory>)(<arg0>,<arg1>,…)`
+      const strings =
+        args.length === 0 ? ["(", ")()"] : ["(", ")(", ...args.slice(1).map(() => ","), ")"];
+      return source(js, strings, [factory, ...args]);
     }
 
     if (isSerializableFunction(v)) {
       const { specifier, export: exp } = v.__FRESH_SERIALIZABLE_FUNCTION;
-      return aliasFor(specifier, exp);
+      return source(js, [aliasFor(specifier, exp)], []);
     }
 
     if (isSignalLike(v)) {
@@ -200,9 +212,8 @@ export function createSerializer(options: SerializerOptions = {}): Serializer {
           "Cannot serialize a computed signal; wrap its factory with `makeComputed()` from `fresh/signals` or pass a plain signal instead.",
         );
       }
-      const innerSrc = recurse(v.peek());
       const signalAlias = aliasFor(SIGNAL_HELPER_SPECIFIER, SIGNAL_HELPER_EXPORT);
-      return `${signalAlias}(${innerSrc})`;
+      return source(js, [`${signalAlias}(`, ")"], [v.peek()]);
     }
 
     // A VNode prop (JSX passed to an island) — not structurally serializable
@@ -212,7 +223,7 @@ export function createSerializer(options: SerializerOptions = {}): Serializer {
       const slotIndex = options.slot(v);
       if (slotIndex !== null) {
         const slotAlias = aliasFor(SIGNAL_HELPER_SPECIFIER, SLOT_HELPER_EXPORT);
-        return `${slotAlias}(${slotIndex})`;
+        return source(js, [`${slotAlias}(${slotIndex})`], []);
       }
     }
 
diff --git a/src/vendor/devalue/LICENSE b/src/vendor/devalue/LICENSE
deleted file mode 100644
index c4e49f8d71f..00000000000
--- a/src/vendor/devalue/LICENSE
+++ /dev/null
@@ -1,7 +0,0 @@
-Copyright (c) 2018-19 [these people](https://github.com/rich-harris/devalue/graphs/contributors)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/src/vendor/devalue/constants.js b/src/vendor/devalue/constants.js
deleted file mode 100644
index 05532ae9ca0..00000000000
--- a/src/vendor/devalue/constants.js
+++ /dev/null
@@ -1,12 +0,0 @@
-export const UNDEFINED = -1;
-export const HOLE = -2;
-export const NAN = -3;
-export const POSITIVE_INFINITY = -4;
-export const NEGATIVE_INFINITY = -5;
-export const NEGATIVE_ZERO = -6;
-export const SPARSE = -7;
-
-// The largest valid value for a JavaScript array's `length` property,
-// and the largest valid array index (one less than the max length).
-export const MAX_ARRAY_LEN = 2 ** 32 - 1;
-export const MAX_ARRAY_INDEX = MAX_ARRAY_LEN - 1;
diff --git a/src/vendor/devalue/index.d.ts b/src/vendor/devalue/index.d.ts
deleted file mode 100644
index df427cfcf20..00000000000
--- a/src/vendor/devalue/index.d.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-type Reducer = (value: unknown, recurse: (value: unknown) => string) => string | undefined | void;
-export function uneval(value: unknown, replacer?: Reducer): string;
diff --git a/src/vendor/devalue/index.js b/src/vendor/devalue/index.js
deleted file mode 100644
index 2e289991f07..00000000000
--- a/src/vendor/devalue/index.js
+++ /dev/null
@@ -1,6 +0,0 @@
-// Vendored from https://github.com/lucacasonato/devalue (fork of
-// https://github.com/sveltejs/devalue). Inlined while the fork is
-// unpublished so the package doesn't depend on a git URL. Only the
-// `uneval` entrypoint is used — `parse`/`stringify` are not vendored.
-// Licensed MIT (see ./LICENSE).
-export { uneval } from "./uneval.js";
diff --git a/src/vendor/devalue/uneval.js b/src/vendor/devalue/uneval.js
deleted file mode 100644
index d70f7bbc060..00000000000
--- a/src/vendor/devalue/uneval.js
+++ /dev/null
@@ -1,583 +0,0 @@
-import {
-	DevalueError,
-	enumerable_symbols,
-	escaped,
-	get_type,
-	is_plain_object,
-	is_primitive,
-	stringify_key,
-	stringify_string,
-	valid_array_indices
-} from './utils.js';
-
-const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_$';
-const unsafe_chars = /[<\b\f\n\r\t\0\u2028\u2029]/g;
-const reserved =
-	/^(?:do|if|in|for|int|let|new|try|var|byte|case|char|else|enum|goto|long|this|void|with|await|break|catch|class|const|final|float|short|super|throw|while|yield|delete|double|export|import|native|return|switch|throws|typeof|boolean|default|extends|finally|package|private|abstract|continue|debugger|function|volatile|interface|protected|transient|implements|instanceof|synchronized)$/;
-
-/**
- * Turn a value into the JavaScript that creates an equivalent value
- * @param {any} value
- * @param {(value: any, uneval: (value: any) => string) => string | void} [replacer]
- */
-export function uneval(value, replacer) {
-	const counts = new Map();
-
-	/** @type {string[]} */
-	const keys = [];
-
-	/** @type {Map<any, string | undefined>} */
-	const custom = new Map();
-
-	/** @param {any} thing */
-	function walk(thing) {
-		if (!is_primitive(thing)) {
-			if (counts.has(thing)) {
-				counts.set(thing, counts.get(thing) + 1);
-				return;
-			}
-
-			counts.set(thing, 1);
-
-			if (replacer) {
-				let calledWalk = false;
-				const str = replacer(thing, (value) => {
-					calledWalk = true;
-					walk(value);
-					return '<placeholder>';
-				});
-
-				if (typeof str === 'string') {
-					// If the replacer called walk, then we need to handle the possiblilty that inner values
-					// are seen multiple times, and may need to be deduped with a name. In that case run the
-					// replacer again during stringify.
-					custom.set(thing, calledWalk ? undefined : str);
-					return;
-				}
-			}
-
-			if (typeof thing === 'function') {
-				throw new DevalueError(`Cannot stringify a function`, keys, thing, value);
-			}
-
-			const type = get_type(thing);
-
-			switch (type) {
-				case 'Number':
-				case 'BigInt':
-				case 'String':
-				case 'Boolean':
-				case 'Date':
-				case 'RegExp':
-				case 'URL':
-				case 'URLSearchParams':
-					return;
-
-				case 'Array':
-					/** @type {any[]} */ (thing).forEach((value, i) => {
-						keys.push(`[${i}]`);
-						walk(value);
-						keys.pop();
-					});
-					break;
-
-				case 'Set':
-					Array.from(thing).forEach(walk);
-					break;
-
-				case 'Map':
-					for (const [key, value] of thing) {
-						keys.push(`.get(${is_primitive(key) ? stringify_primitive(key) : '...'})`);
-						walk(value);
-						keys.pop();
-					}
-					break;
-
-				case 'Int8Array':
-				case 'Uint8Array':
-				case 'Uint8ClampedArray':
-				case 'Int16Array':
-				case 'Uint16Array':
-				case 'Float16Array':
-				case 'Int32Array':
-				case 'Uint32Array':
-				case 'Float32Array':
-				case 'Float64Array':
-				case 'BigInt64Array':
-				case 'BigUint64Array':
-				case 'DataView':
-					walk(thing.buffer);
-					return;
-
-				case 'ArrayBuffer':
-					return;
-
-				case 'Temporal.Duration':
-				case 'Temporal.Instant':
-				case 'Temporal.PlainDate':
-				case 'Temporal.PlainTime':
-				case 'Temporal.PlainDateTime':
-				case 'Temporal.PlainMonthDay':
-				case 'Temporal.PlainYearMonth':
-				case 'Temporal.ZonedDateTime':
-					return;
-
-				default:
-					if (!is_plain_object(thing)) {
-						throw new DevalueError(`Cannot stringify arbitrary non-POJOs`, keys, thing, value);
-					}
-
-					if (enumerable_symbols(thing).length > 0) {
-						throw new DevalueError(`Cannot stringify POJOs with symbolic keys`, keys, thing, value);
-					}
-
-					for (const key of Object.keys(thing)) {
-						if (key === '__proto__') {
-							throw new DevalueError(
-								`Cannot stringify objects with __proto__ keys`,
-								keys,
-								thing,
-								value
-							);
-						}
-
-						keys.push(stringify_key(key));
-						walk(thing[key]);
-						keys.pop();
-					}
-			}
-		} else if (typeof thing === 'symbol') {
-			throw new DevalueError(`Cannot stringify a Symbol primitive`, keys, thing, value);
-		}
-	}
-
-	walk(value);
-
-	const names = new Map();
-
-	Array.from(counts)
-		.filter((entry) => entry[1] > 1)
-		.sort((a, b) => b[1] - a[1])
-		.forEach((entry, i) => {
-			names.set(entry[0], get_name(i));
-		});
-
-	/**
-	 * @param {any} thing
-	 * @returns {string}
-	 */
-	function stringify(thing) {
-		if (names.has(thing)) {
-			return names.get(thing);
-		}
-
-		if (is_primitive(thing)) {
-			return stringify_primitive(thing);
-		}
-
-		if (custom.has(thing)) {
-			const str = custom.get(thing);
-			if (str !== undefined) {
-				return str;
-			}
-			const finalStr = replacer(thing, (value) => stringify(value));
-			if (typeof finalStr === 'string') {
-				custom.set(thing, finalStr);
-				return finalStr;
-			}
-			throw new TypeError(
-				'Replacer must return a string when called on a value it previously returned a string for'
-			);
-		}
-
-		const type = get_type(thing);
-
-		switch (type) {
-			case 'Number':
-			case 'String':
-			case 'Boolean':
-			case 'BigInt':
-				return `Object(${stringify(thing.valueOf())})`;
-
-			case 'RegExp':
-				const { source, flags } = thing;
-				return flags
-					? `new RegExp(${stringify_string(source)},"${flags}")`
-					: `new RegExp(${stringify_string(source)})`;
-
-			case 'Date':
-				return `new Date(${thing.getTime()})`;
-
-			case 'URL':
-				return `new URL(${stringify_string(thing.toString())})`;
-
-			case 'URLSearchParams':
-				return `new URLSearchParams(${stringify_string(thing.toString())})`;
-
-			case 'Array': {
-				// For dense arrays (no holes), we iterate normally.
-				// When we encounter the first hole, we call Object.keys
-				// to determine the sparseness, then decide between:
-				//   - Array literal with holes: [,"a",,] (default)
-				//   - Object.assign: Object.assign(Array(n),{...}) (for very sparse arrays)
-				// Only the Object.assign path avoids iterating every slot, which
-				// is what protects against the DoS of e.g. `arr[1000000] = 1`.
-				let has_holes = false;
-
-				let result = '[';
-
-				for (let i = 0; i < thing.length; i += 1) {
-					if (i > 0) result += ',';
-
-					if (Object.hasOwn(thing, i)) {
-						result += stringify(thing[i]);
-					} else if (!has_holes) {
-						// Decide between array literal and Object.assign.
-						//
-						// Array literal: holes are consecutive commas.
-						// For example, [, "a", ,] is written as [,"a",,].
-						// Each hole costs 1 char (a comma).
-						//
-						// Object.assign: populated indices are listed explicitly.
-						// For example, [, "a", ,] would be written as
-						// Object.assign(Array(3),{1:"a"}). This avoids paying
-						// per-hole, but has a large fixed overhead for the
-						// "Object.assign(Array(n),{...})" wrapper, and each
-						// element costs extra chars for its index and colon.
-						//
-						// The serialized values are the same size either way, so
-						// the choice comes down to the structural overhead:
-						//
-						//   Array literal overhead:
-						//     1 char per element or hole (comma separators)
-						//     + 2 chars for "[" and "]"
-						//     = L + 2
-						//
-						//   Object.assign overhead:
-						//     "Object.assign(Array(" — 20 chars
-						//     + length              — d chars
-						//     + "),{"               — 3 chars
-						//     + for each populated element:
-						//       index + ":" + ","   — (d + 2) chars
-						//     + "})"                — 2 chars
-						//     = (25 + d) + P * (d + 2)
-						//
-						// where L is the array length, P is the number of
-						// populated elements, and d is the number of digits
-						// in L (an upper bound on the digits in any index).
-						//
-						// Object.assign is cheaper when:
-						//   (25 + d) + P * (d + 2) < L + 2
-						const populated_keys = valid_array_indices(/** @type {any[]} */ (thing));
-						const population = populated_keys.length;
-						const d = String(thing.length).length;
-
-						const hole_cost = thing.length + 2;
-						const sparse_cost = 25 + d + population * (d + 2);
-
-						if (hole_cost > sparse_cost) {
-							const entries = populated_keys.map((k) => `${k}:${stringify(thing[k])}`).join(',');
-							return `Object.assign(Array(${thing.length}),{${entries}})`;
-						}
-
-						// Re-process this index as a hole in the array literal
-						has_holes = true;
-						i -= 1;
-					}
-					// else: already decided on array literal, hole is just an empty slot
-					// (the comma separator is all we need — no content for this position)
-				}
-
-				const tail = thing.length === 0 || thing.length - 1 in thing ? '' : ',';
-				return result + tail + ']';
-			}
-
-			case 'Set':
-			case 'Map':
-				return `new ${type}([${Array.from(thing).map(stringify).join(',')}])`;
-
-			case 'Int8Array':
-			case 'Uint8Array':
-			case 'Uint8ClampedArray':
-			case 'Int16Array':
-			case 'Uint16Array':
-			case 'Float16Array':
-			case 'Int32Array':
-			case 'Uint32Array':
-			case 'Float32Array':
-			case 'Float64Array':
-			case 'BigInt64Array':
-			case 'BigUint64Array': {
-				let str = `new ${type}`;
-
-				if (!names.has(thing.buffer)) {
-					const array = new thing.constructor(thing.buffer);
-					str += `([${array}])`;
-				} else {
-					str += `(${stringify(thing.buffer)})`;
-				}
-
-				// handle subarrays
-				if (thing.byteLength !== thing.buffer.byteLength) {
-					const start = thing.byteOffset / thing.BYTES_PER_ELEMENT;
-					const end = start + thing.length;
-					str += `.subarray(${start},${end})`;
-				}
-
-				return str;
-			}
-
-			case 'DataView': {
-				let str = `new DataView`;
-
-				if (!names.has(thing.buffer)) {
-					str += `(new Uint8Array([${new Uint8Array(thing.buffer)}]).buffer`;
-				} else {
-					str += `(${stringify(thing.buffer)}`;
-				}
-
-				// handle subviews
-				if (thing.byteLength !== thing.buffer.byteLength) {
-					str += `,${thing.startOffset},${thing.byteLength}`;
-				}
-
-				return str + ')';
-			}
-
-			case 'ArrayBuffer': {
-				const ui8 = new Uint8Array(thing);
-				return `new Uint8Array([${ui8.toString()}]).buffer`;
-			}
-
-			case 'Temporal.Duration':
-			case 'Temporal.Instant':
-			case 'Temporal.PlainDate':
-			case 'Temporal.PlainTime':
-			case 'Temporal.PlainDateTime':
-			case 'Temporal.PlainMonthDay':
-			case 'Temporal.PlainYearMonth':
-			case 'Temporal.ZonedDateTime':
-				return `${type}.from(${stringify_string(thing.toString())})`;
-
-			default:
-				const keys = Object.keys(thing);
-				const obj = keys.map((key) => `${safe_key(key)}:${stringify(thing[key])}`).join(',');
-				const proto = Object.getPrototypeOf(thing);
-				if (proto === null) {
-					return keys.length > 0 ? `{${obj},__proto__:null}` : `{__proto__:null}`;
-				}
-
-				return `{${obj}}`;
-		}
-	}
-
-	const str = stringify(value);
-
-	if (names.size) {
-		/** @type {string[]} */
-		const params = [];
-
-		/** @type {string[]} */
-		const statements = [];
-
-		/** @type {string[]} */
-		const values = [];
-
-		names.forEach((name, thing) => {
-			params.push(name);
-
-			if (custom.has(thing)) {
-				const str = custom.get(thing);
-				if (str !== undefined) {
-					values.push(str);
-					return;
-				}
-				const finalStr = replacer(thing, (value) => stringify(value));
-				if (typeof finalStr === 'string') {
-					values.push(finalStr);
-					return;
-				}
-				throw new TypeError(
-					'Replacer must return a string when called on a value it previously returned a string for'
-				);
-			}
-
-			if (is_primitive(thing)) {
-				values.push(stringify_primitive(thing));
-				return;
-			}
-
-			const type = get_type(thing);
-
-			switch (type) {
-				case 'Number':
-				case 'String':
-				case 'Boolean':
-				case 'BigInt':
-					values.push(`Object(${stringify(thing.valueOf())})`);
-					break;
-
-				case 'RegExp':
-					const { source, flags } = thing;
-					const regexp = flags
-						? `new RegExp(${stringify_string(source)},"${flags}")`
-						: `new RegExp(${stringify_string(source)})`
-					values.push(regexp);
-					break;
-
-				case 'Date':
-					values.push(`new Date(${thing.getTime()})`);
-					break;
-
-				case 'URL':
-					values.push(`new URL(${stringify_string(thing.toString())})`);
-					break;
-
-				case 'URLSearchParams':
-					values.push(`new URLSearchParams(${stringify_string(thing.toString())})`);
-					break;
-
-				case 'Array':
-					values.push(`Array(${thing.length})`);
-					/** @type {any[]} */ (thing).forEach((v, i) => {
-						statements.push(`${name}[${i}]=${stringify(v)}`);
-					});
-					break;
-
-				case 'Set':
-					values.push(`new Set`);
-					statements.push(
-						`${name}.${Array.from(thing)
-							.map((v) => `add(${stringify(v)})`)
-							.join('.')}`
-					);
-					break;
-
-				case 'Map':
-					values.push(`new Map`);
-					statements.push(
-						`${name}.${Array.from(thing)
-							.map(([k, v]) => `set(${stringify(k)}, ${stringify(v)})`)
-							.join('.')}`
-					);
-					break;
-
-				case 'Int8Array':
-				case 'Uint8Array':
-				case 'Uint8ClampedArray':
-				case 'Int16Array':
-				case 'Uint16Array':
-				case 'Float16Array':
-				case 'Int32Array':
-				case 'Uint32Array':
-				case 'Float32Array':
-				case 'Float64Array':
-				case 'BigInt64Array':
-				case 'BigUint64Array': {
-					let str = `new ${type}`;
-
-					if (!names.has(thing.buffer)) {
-						const array = new thing.constructor(thing.buffer);
-						str += `([${array}])`;
-					} else {
-						str += `(${stringify(thing.buffer)})`;
-					}
-
-					// handle subarrays
-					if (thing.byteLength !== thing.buffer.byteLength) {
-						const start = thing.byteOffset / thing.BYTES_PER_ELEMENT;
-						const end = start + thing.length;
-						str += `.subarray(${start},${end})`;
-					}
-
-					values.push(`{}`);
-					statements.push(`${name}=${str}`);
-					break;
-				}
-
-				case 'DataView': {
-					let str = `new DataView`;
-
-					if (!names.has(thing.buffer)) {
-						str += `(new Uint8Array([${new Uint8Array(thing.buffer)}]).buffer`;
-					} else {
-						str += `(${stringify(thing.buffer)}`;
-					}
-
-					// handle subviews
-					if (thing.byteLength !== thing.buffer.byteLength) {
-						str += `,${thing.byteOffset},${thing.byteLength}`;
-					}
-
-					str += ')';
-
-					values.push(`{}`);
-					statements.push(`${name}=${str}`);
-					break;
-				}
-
-				case 'ArrayBuffer':
-					values.push(`new Uint8Array([${new Uint8Array(thing)}]).buffer`);
-					break;
-
-				default:
-					values.push(Object.getPrototypeOf(thing) === null ? 'Object.create(null)' : '{}');
-					Object.keys(thing).forEach((key) => {
-						statements.push(`${name}${safe_prop(key)}=${stringify(thing[key])}`);
-					});
-			}
-		});
-
-		statements.push(`return ${str}`);
-
-		return `(function(${params.join(',')}){${statements.join(';')}}(${values.join(',')}))`;
-	} else {
-		return str;
-	}
-}
-
-/** @param {number} num */
-function get_name(num) {
-	let name = '';
-
-	do {
-		name = chars[num % chars.length] + name;
-		num = ~~(num / chars.length) - 1;
-	} while (num >= 0);
-
-	return reserved.test(name) ? `${name}0` : name;
-}
-
-/** @param {string} c */
-function escape_unsafe_char(c) {
-	return escaped[c] || c;
-}
-
-/** @param {string} str */
-function escape_unsafe_chars(str) {
-	return str.replace(unsafe_chars, escape_unsafe_char);
-}
-
-/** @param {string} key */
-function safe_key(key) {
-	return /^[_$a-zA-Z][_$a-zA-Z0-9]*$/.test(key) ? key : escape_unsafe_chars(JSON.stringify(key));
-}
-
-/** @param {string} key */
-function safe_prop(key) {
-	return /^[_$a-zA-Z][_$a-zA-Z0-9]*$/.test(key)
-		? `.${key}`
-		: `[${escape_unsafe_chars(JSON.stringify(key))}]`;
-}
-
-/** @param {any} thing */
-function stringify_primitive(thing) {
-	const type = typeof thing;
-	if (type === 'string') return stringify_string(thing);
-	if (thing === void 0) return 'void 0';
-	if (thing === 0 && 1 / thing < 0) return '-0';
-	const str = String(thing);
-	if (type === 'number') return str.replace(/^(-)?0\./, '$1.');
-	if (type === 'bigint') return thing + 'n';
-	return str;
-}
diff --git a/src/vendor/devalue/utils.js b/src/vendor/devalue/utils.js
deleted file mode 100644
index 54c26a10999..00000000000
--- a/src/vendor/devalue/utils.js
+++ /dev/null
@@ -1,160 +0,0 @@
-import { MAX_ARRAY_INDEX, MAX_ARRAY_LEN } from './constants.js';
-
-/** @type {Record<string, string>} */
-export const escaped = {
-	'<': '\\u003C',
-	'\\': '\\\\',
-	'\b': '\\b',
-	'\f': '\\f',
-	'\n': '\\n',
-	'\r': '\\r',
-	'\t': '\\t',
-	'\u2028': '\\u2028',
-	'\u2029': '\\u2029'
-};
-
-export class DevalueError extends Error {
-	/**
-	 * @param {string} message
-	 * @param {string[]} keys
-	 * @param {any} [value] - The value that failed to be serialized
-	 * @param {any} [root] - The root value being serialized
-	 */
-	constructor(message, keys, value, root) {
-		super(message);
-		this.name = 'DevalueError';
-		this.path = keys.join('');
-		this.value = value;
-		this.root = root;
-	}
-}
-
-/** @param {any} thing */
-export function is_primitive(thing) {
-	return thing === null || (typeof thing !== 'object' && typeof thing !== 'function');
-}
-
-const object_proto_names = /* @__PURE__ */ Object.getOwnPropertyNames(Object.prototype)
-	.sort()
-	.join('\0');
-
-/** @param {any} thing */
-export function is_plain_object(thing) {
-	const proto = Object.getPrototypeOf(thing);
-
-	return (
-		proto === Object.prototype ||
-		proto === null ||
-		Object.getPrototypeOf(proto) === null ||
-		Object.getOwnPropertyNames(proto).sort().join('\0') === object_proto_names
-	);
-}
-
-/** @param {any} thing */
-export function get_type(thing) {
-	return Object.prototype.toString.call(thing).slice(8, -1);
-}
-
-/** @param {string} char */
-function get_escaped_char(char) {
-	switch (char) {
-		case '"':
-			return '\\"';
-		case '<':
-			return '\\u003C';
-		case '\\':
-			return '\\\\';
-		case '\n':
-			return '\\n';
-		case '\r':
-			return '\\r';
-		case '\t':
-			return '\\t';
-		case '\b':
-			return '\\b';
-		case '\f':
-			return '\\f';
-		case '\u2028':
-			return '\\u2028';
-		case '\u2029':
-			return '\\u2029';
-		default:
-			return char < ' ' ? `\\u${char.charCodeAt(0).toString(16).padStart(4, '0')}` : '';
-	}
-}
-
-/** @param {string} str */
-export function stringify_string(str) {
-	let result = '';
-	let last_pos = 0;
-	const len = str.length;
-
-	for (let i = 0; i < len; i += 1) {
-		const char = str[i];
-		const replacement = get_escaped_char(char);
-		if (replacement) {
-			result += str.slice(last_pos, i) + replacement;
-			last_pos = i + 1;
-		}
-	}
-
-	return `"${last_pos === 0 ? str : result + str.slice(last_pos)}"`;
-}
-
-/** @param {Record<string | symbol, any>} object */
-export function enumerable_symbols(object) {
-	return Object.getOwnPropertySymbols(object).filter(
-		(symbol) => Object.getOwnPropertyDescriptor(object, symbol).enumerable
-	);
-}
-
-const is_identifier = /^[a-zA-Z_$][a-zA-Z_$0-9]*$/;
-
-/** @param {string} key */
-export function stringify_key(key) {
-	return is_identifier.test(key) ? '.' + key : '[' + JSON.stringify(key) + ']';
-}
-
-/** @param {number} n */
-export function is_valid_array_index(n) {
-	if (!Number.isInteger(n)) return false;
-	if (n < 0) return false;
-	if (n > MAX_ARRAY_INDEX) return false;
-	return true;
-}
-
-/** @param {number} n */
-export function is_valid_array_len(n) {
-	if (!Number.isInteger(n)) return false;
-	if (n < 0) return false;
-	if (n > MAX_ARRAY_LEN) return false;
-	return true;
-}
-
-/** @param {string} s */
-function is_valid_array_index_string(s) {
-	if (s.length === 0) return false;
-	if (s.length > 1 && s.charCodeAt(0) === 48) return false; // leading zero
-	for (let i = 0; i < s.length; i++) {
-		const c = s.charCodeAt(i);
-		if (c < 48 || c > 57) return false;
-	}
-	// by this point we know it's a string of digits, but it has to be within
-	// the range of valid array indices
-	return is_valid_array_index(+s);
-}
-
-/**
- * Finds the populated indices of an array.
- * @param {unknown[]} array
- */
-export function valid_array_indices(array) {
-	const keys = Object.keys(array);
-	for (var i = keys.length - 1; i >= 0; i--) {
-		if (is_valid_array_index_string(keys[i])) {
-			break;
-		}
-	}
-	keys.length = i + 1;
-	return keys;
-}