@solidjs/router 0.17.0-next.5 → 1.0.0-next.7

package/dist/claims.d.ts

@@ -0,0 +1,21 @@
+import type { RouterContext } from "./types.js";
+/**
+ * The compiler claims every `a[href]` (and `form[action]`, which this handler
+ * ignores) at creation, and the runtime re-claims on `href` writes. This
+ * consumer gives each router-managed anchor the link-state vocabulary without
+ * a wrapper component:
+ *
+ * - `aria-current="page"` — the location matches the link exactly
+ * - `data-active` — exact or prefix match
+ * - `data-pending` — the link is the target of an in-flight navigation
+ *
+ * Elements are claimed at creation, so late mounts (`<Show>`, `<For>`,
+ * portals) are correct immediately. One render effect (owned by the router)
+ * subscribes to the location and sweeps a registry of claimed anchors —
+ * anchors themselves carry no reactive machinery, just a registry entry
+ * removed by their creating owner's cleanup. State is applied once at claim
+ * so it is correct before the next navigation; re-claims (an `href` write)
+ * are the same one-shot untracked refresh, reading the element's current
+ * `href` from the DOM.
+ */
+export declare function setupLinkClaims(router: RouterContext, explicitLinks?: boolean): void;

package/dist/claims.js

@@ -0,0 +1,108 @@
+import { registerElementClaim } from "@solidjs/web";
+import { createRenderEffect, getOwner, onCleanup, untrack } from "solid-js";
+import { comparablePath } from "./utils.js";
+/**
+ * The compiler claims every `a[href]` (and `form[action]`, which this handler
+ * ignores) at creation, and the runtime re-claims on `href` writes. This
+ * consumer gives each router-managed anchor the link-state vocabulary without
+ * a wrapper component:
+ *
+ * - `aria-current="page"` — the location matches the link exactly
+ * - `data-active` — exact or prefix match
+ * - `data-pending` — the link is the target of an in-flight navigation
+ *
+ * Elements are claimed at creation, so late mounts (`<Show>`, `<For>`,
+ * portals) are correct immediately. One render effect (owned by the router)
+ * subscribes to the location and sweeps a registry of claimed anchors —
+ * anchors themselves carry no reactive machinery, just a registry entry
+ * removed by their creating owner's cleanup. State is applied once at claim
+ * so it is correct before the next navigation; re-claims (an `href` write)
+ * are the same one-shot untracked refresh, reading the element's current
+ * `href` from the DOM.
+ */
+export function setupLinkClaims(router, explicitLinks) {
+    const basePath = router.base.path();
+    // per-element record; `current` remembers whether we set `aria-current`,
+    // so user-authored values (steppers, breadcrumbs) are never stripped
+    const claimed = new WeakMap();
+    const registry = new Set();
+    function isSvg(el) {
+        return el.namespaceURI === "http://www.w3.org/2000/svg";
+    }
+    /** The comparable pathname when the router manages this anchor, else `undefined`. */
+    function managedPath(a) {
+        if (explicitLinks && !a.hasAttribute("link"))
+            return;
+        const svg = isSvg(a);
+        // claims fire at creation while the element is still in the template's
+        // inert fragment, where the `href` property is not resolved — resolve the
+        // raw attribute against the live document instead
+        const href = svg ? a.href.baseVal : a.getAttribute("href");
+        const target = svg ? a.target.baseVal : a.target;
+        if (target || !href)
+            return;
+        const rel = (a.getAttribute("rel") || "").split(/\s+/);
+        if (a.hasAttribute("download") || rel.includes("external"))
+            return;
+        let url;
+        try {
+            url = new URL(href, document.baseURI);
+        }
+        catch {
+            return;
+        }
+        if (url.origin !== window.location.origin ||
+            (basePath && url.pathname && !url.pathname.toLowerCase().startsWith(basePath.toLowerCase())))
+            return;
+        return comparablePath(url.pathname);
+    }
+    function linkState(a) {
+        // read reactive sources unconditionally so the owning effect stays
+        // subscribed even while the anchor is not router-managed
+        const loc = decodeURI(comparablePath(router.location.pathname));
+        const routing = router.isRouting();
+        const path = managedPath(a);
+        // the root path is a prefix of everything, so it only matches exactly —
+        // there is no per-anchor `end` opt-out like useLinkState has
+        const matches = (target) => path !== undefined && (target === path || (path !== "" && target.startsWith(path + "/")));
+        // effects observe the committed location during a transition, so the
+        // in-flight target comes from pendingTarget — readable here because the
+        // isRouting write flushes after the target is assigned
+        const pending = routing && !!router.pendingTarget && matches(decodeURI(comparablePath(router.pendingTarget.value)));
+        return { active: matches(loc), pending, exact: path !== undefined && loc === path };
+    }
+    function apply(a, rec, { active, pending, exact }) {
+        active ? a.setAttribute("data-active", "") : a.removeAttribute("data-active");
+        pending ? a.setAttribute("data-pending", "") : a.removeAttribute("data-pending");
+        if (exact !== rec.current) {
+            exact ? a.setAttribute("aria-current", "page") : a.removeAttribute("aria-current");
+            rec.current = exact;
+        }
+    }
+    const refresh = (a, rec) => untrack(() => apply(a, rec, linkState(a)));
+    // The one subscription for every anchor: compute tracks the sources
+    // linkState derives from (the in-flight pendingTarget is readable in the
+    // effect phase because the isRouting write flushes after the target is
+    // assigned), the effect phase sweeps the registry untracked.
+    createRenderEffect(() => (router.location.pathname, router.isRouting()), () => registry.forEach(a => refresh(a, claimed.get(a))));
+    onCleanup(registerElementClaim(node => {
+        if (node.nodeName.toUpperCase() !== "A")
+            return;
+        const a = node;
+        // re-claim (href changed): the claiming write runs inside another
+        // effect, so refresh without leaking subscriptions into it
+        const existing = claimed.get(a);
+        if (existing)
+            return refresh(a, existing);
+        const rec = { current: false };
+        claimed.set(a, rec);
+        // claims fire during component setup, so an owner is present in
+        // practice to bound the registry entry's lifetime; without one, state
+        // is still applied once at creation
+        if (getOwner()) {
+            registry.add(a);
+            onCleanup(() => registry.delete(a));
+        }
+        refresh(a, rec);
+    }));
+}

package/dist/data/action.d.ts

@@ -1,5 +1,5 @@
 import { type JSX } from "@solidjs/web";
-import type { Submission, NarrowResponse } from "../types.js";
+import type { RouterContext, Submission, NarrowResponse } from "../types.js";
 export type Action<T extends Array<any>, U, V = T> = (T extends [FormData | URLSearchParams] | [] ? JSX.SerializableAttributeValue : unknown) & ((...vars: T) => Promise<NarrowResponse<U>>) & {
     url: string;
     with<A extends any[], B extends any[]>(this: (this: any, ...args: [...A, ...B]) => Promise<NarrowResponse<U>>, ...args: A): Action<B, U, V>;
@@ -13,7 +13,34 @@ type ActionFactory = {
     }): Action<T, U>;
 };
 export declare const actions: Map<string, Action<any, any, any>>;
+/**
+ * The document-delegation submit handler for router actions. Lives here —
+ * not in events.ts — so the router's event wiring holds no static reference
+ * to the action module; `installRouterIntegrations` slots it in when the
+ * first action is created on the client.
+ */
+export declare function handleFormAction(evt: SubmitEvent, router: RouterContext, actionBase: string): void;
+/**
+ * Entry point for delegation's lazy fallback (data/events.ts): when no form
+ * handler was ever installed — no action module in the client graph at all —
+ * the router intercepts posts to server-action urls synchronously and loads
+ * this module to run them. The FormData was captured at submit time; only
+ * the enctype conversion and the generic invocation happen here.
+ */
+export declare function submitServerForm(router: RouterContext, url: string, form: HTMLFormElement, data: FormData): void;
 export declare function useSubmissions<T extends Array<any>, U, V>(fn: Action<T, U, V>, filter?: (input: V) => boolean): Submission<V, NarrowResponse<U>>[];
 export declare function useAction<T extends Array<any>, U, V>(action: Action<T, U, V>): (...args: Parameters<Action<T, U, V>>) => Promise<NarrowResponse<U>>;
 export declare const action: ActionFactory;
+/**
+ * Registers the router as the single-flight consumer of the server function
+ * transport. Subscribing is the opt-in: while registered, the transport
+ * sends the `X-Single-Flight` request header on mutations and delivers the
+ * folded payload here — fresh route data is seeded into the `query` cache
+ * and the envelope metadata (redirect `Location`, `X-Revalidate` keys) is
+ * applied, all before the action sees its plain return value. Called by the
+ * Router component on the client unless `singleFlight={false}`, which now
+ * simply means "never subscribe" — no consumer, no request header, no
+ * collection work on the server. Returns the unsubscribe function.
+ */
+export declare function setupFlightDataConsumer(router: RouterContext): () => void;
 export {};

package/dist/data/action.js

@@ -1,13 +1,119 @@
 import { $TRACK, action as createSolidAction, createMemo, onCleanup, getOwner } from "solid-js";
 import { isResponseEnvelope, isServer } from "@solidjs/web";
-import { decodeResponse } from "@solidjs/web/server-functions";
-import { useRouter } from "../routing.js";
+import { createServerReference, decodeResponse, subscribeFlightData } from "@solidjs/web/server-functions";
+import { provideFlashDecoder, provideFlightConsumer, useRouter } from "../routing.js";
+import { setRouterFormHandler } from "./events.js";
+import { decodeFlashCookie } from "./flash.js";
 import { mockBase, setFunctionName } from "../utils.js";
 import { cacheKeyOp, hashKey, revalidate, query } from "./query.js";
 const submitHooksSymbol = Symbol("routerActionSubmitHooks");
 const settledHooksSymbol = Symbol("routerActionSettledHooks");
 const invokeSymbol = Symbol("routerActionInvoke");
+// Forms submitted through delegation are marked `aria-busy` while their
+// action is in flight — the form half of the attribute vocabulary links get
+// (`data-active`/`data-pending`). Style with `form[aria-busy] button { ... }`.
+// A counter (not a boolean) keeps the attribute through overlapping
+// submissions from the same form.
+const busyForms = /* #__PURE__ */ new WeakMap();
+function setFormBusy(form, delta) {
+    const count = (busyForms.get(form) || 0) + delta;
+    busyForms.set(form, count);
+    count > 0 ? form.setAttribute("aria-busy", "true") : form.removeAttribute("aria-busy");
+}
 export const actions = /* #__PURE__ */ new Map();
+/**
+ * The document-delegation submit handler for router actions. Lives here —
+ * not in events.ts — so the router's event wiring holds no static reference
+ * to the action module; `installRouterIntegrations` slots it in when the
+ * first action is created on the client.
+ */
+export function handleFormAction(evt, router, actionBase) {
+    if (evt.defaultPrevented)
+        return;
+    let actionRef = evt.submitter && evt.submitter.hasAttribute("formaction")
+        ? evt.submitter.getAttribute("formaction")
+        : evt.target.getAttribute("action");
+    if (!actionRef)
+        return;
+    const serverAction = !actionRef.startsWith("https://action/");
+    if (serverAction) {
+        // normalize server actions
+        const url = new URL(actionRef, mockBase);
+        actionRef = router.parsePath(url.pathname + url.search);
+        if (!actionRef.startsWith(actionBase))
+            return;
+    }
+    if (evt.target.method.toUpperCase() !== "POST")
+        throw new Error("Only POST forms are supported for Actions");
+    // A registry miss on a server-action url is a direct bind whose module
+    // never loaded client-side (server components): the url is self-describing
+    // (`?id`, bound `?args`), so a generic invocation is synthesized from it —
+    // delegation alone is sufficient, the no-JS path stays a no-JS fallback.
+    // Client-only actions (`https://action/`) are their module's JS by
+    // definition, so a miss there falls through to native submission.
+    const handler = actions.get(actionRef) || (serverAction && createServerFormAction(actionRef));
+    if (handler) {
+        evt.preventDefault();
+        const data = new FormData(evt.target, evt.submitter);
+        handler.call({ r: router, f: evt.target }, evt.target.enctype === "multipart/form-data"
+            ? data
+            : new URLSearchParams(data));
+    }
+}
+/**
+ * Synthesizes a router action for a server-rendered action url. The url
+ * carries everything an invocation needs — the function id and any bound
+ * `.with()` arguments (plain JSON in `?args`, which the server prepends for
+ * natural-encoding bodies exactly as it does for no-JS posts) — so the
+ * FormData is posted to it verbatim through the server-function transport:
+ * submissions, `aria-busy`, redirects, revalidation, and single-flight all
+ * flow through the normal action machinery. Registered under the url, so
+ * repeat submits reuse it (and a later real registration overrides it).
+ */
+function createServerFormAction(url) {
+    const id = new URL(url, mockBase).searchParams.get("id");
+    if (!id)
+        return undefined;
+    // typecheck resolves the server half of the dual module; this path only
+    // runs in the browser, where the client transport's signature applies
+    const stub = createServerReference(id, undefined, url);
+    const caller = Object.assign((form) => stub(form), { url });
+    return actionImpl(caller);
+}
+/**
+ * Entry point for delegation's lazy fallback (data/events.ts): when no form
+ * handler was ever installed — no action module in the client graph at all —
+ * the router intercepts posts to server-action urls synchronously and loads
+ * this module to run them. The FormData was captured at submit time; only
+ * the enctype conversion and the generic invocation happen here.
+ */
+export function submitServerForm(router, url, form, data) {
+    const handler = actions.get(url) || createServerFormAction(url);
+    // no `?id` — not the server function convention; nothing can run it,
+    // resubmit natively (submit() bypasses the delegated handler)
+    if (!handler)
+        return form.submit();
+    handler.call({ r: router, f: form }, form.enctype === "multipart/form-data" ? data : new URLSearchParams(data));
+}
+// Wires the action layer into the router's slots exactly once, triggered by
+// the first action creation. Not an import side effect — with
+// `sideEffects: false`, module evaluation only happens when action() is
+// actually used, which is precisely when the wiring is wanted: no action in
+// the graph means no form interception, no single-flight subscription (the
+// server is never asked to collect), and no flash cookies to decode. On the
+// server, actions are created at module scope, so the flash decoder is
+// always installed before useSubmission can read the submissions signal.
+let integrationsInstalled = false;
+function installRouterIntegrations() {
+    if (integrationsInstalled)
+        return;
+    integrationsInstalled = true;
+    provideFlashDecoder(decodeFlashCookie);
+    if (!isServer) {
+        setRouterFormHandler(handleFormAction);
+        provideFlightConsumer(setupFlightDataConsumer);
+    }
+}
 export function useSubmissions(fn, filter) {
     const router = useRouter();
     const subs = createMemo(() => router.submissions[0]().filter(s => s.url === fn.base && (!filter || filter(s.input))));
@@ -32,9 +138,10 @@ function actionImpl(fn, options = {}) {
         const form = this.f;
         const submitHooks = current[submitHooksSymbol];
         const settledHooks = current[settledHooksSymbol];
-        const runMutation = () => (router.singleFlight && fn.withOptions
-            ? fn.withOptions({ headers: { "X-Single-Flight": "true" } })
-            : fn)(...variables);
+        // Single-flight opt-in is no longer per call: the router's registered
+        // flight-data consumer (see setupFlightDataConsumer) makes the transport
+        // send the request header itself, so the mutation is just called.
+        const runMutation = () => fn(...variables);
         const run = createSolidAction(async function* (context) {
             context.optimistic?.();
             try {
@@ -47,16 +154,24 @@ function actionImpl(fn, options = {}) {
                 return { error: true, value: error };
             }
         });
-        const settled = await settleActionResult(run({
-            call: runMutation,
-            optimistic: submitHooks.size
-                ? () => {
-                    for (const hook of submitHooks.values())
-                        hook(...variables);
-                }
-                : undefined
-        }));
-        const response = await handleResponse(settled.value, settled.error, router.navigatorFactory());
+        form && setFormBusy(form, 1);
+        let settled;
+        let response;
+        try {
+            settled = await settleActionResult(run({
+                call: runMutation,
+                optimistic: submitHooks.size
+                    ? () => {
+                        for (const hook of submitHooks.values())
+                            hook(...variables);
+                    }
+                    : undefined
+            }));
+            response = await handleResponse(settled.value, settled.error, router.navigatorFactory());
+        }
+        finally {
+            form && setFormBusy(form, -1);
+        }
         if (!response)
             return undefined;
         let submission;
@@ -121,6 +236,7 @@ function toAction(invoke, url, boundArgs = [], base = url, submitHooks = new Map
     fn[submitHooksSymbol] = submitHooks;
     fn[settledHooksSymbol] = settledHooks;
     fn[invokeSymbol] = invoke;
+    installRouterIntegrations();
     if (!isServer) {
         actions.set(url, fn);
         // Only remove the registration if it still belongs to this instance —
@@ -147,11 +263,52 @@ async function settleActionResult(result) {
     }
     return result;
 }
+/**
+ * Registers the router as the single-flight consumer of the server function
+ * transport. Subscribing is the opt-in: while registered, the transport
+ * sends the `X-Single-Flight` request header on mutations and delivers the
+ * folded payload here — fresh route data is seeded into the `query` cache
+ * and the envelope metadata (redirect `Location`, `X-Revalidate` keys) is
+ * applied, all before the action sees its plain return value. Called by the
+ * Router component on the client unless `singleFlight={false}`, which now
+ * simply means "never subscribe" — no consumer, no request header, no
+ * collection work on the server. Returns the unsubscribe function.
+ */
+export function setupFlightDataConsumer(router) {
+    return subscribeFlightData((data, { response }) => applyResponseMetadata(response, router.navigatorFactory(), data));
+}
+/**
+ * Applies a server function response's integration metadata: `X-Revalidate`
+ * keys invalidate, `Location` navigates (hard for absolute urls), flight
+ * data seeds the query cache, and matching entries revalidate. Shared by
+ * the flight-data consumer and the action response path (which still sees
+ * metadata-bearing responses when no flight data was collected).
+ */
+async function applyResponseMetadata(metadata, navigate, flightData) {
+    let keys;
+    if (metadata) {
+        if (metadata.headers.has("X-Revalidate"))
+            keys = metadata.headers.get("X-Revalidate").split(",");
+        if (metadata.headers.has("Location")) {
+            const locationUrl = metadata.headers.get("Location") || "/";
+            if (locationUrl.startsWith("http")) {
+                window.location.href = locationUrl;
+            }
+            else {
+                navigate(locationUrl);
+            }
+        }
+    }
+    // invalidate
+    cacheKeyOp(keys, entry => (entry[0] = 0));
+    // set cache
+    flightData && Object.keys(flightData).forEach(k => query.set(k, flightData[k]));
+    // trigger revalidation
+    await revalidate(keys, false);
+}
 async function handleResponse(response, error, navigate) {
     let data;
-    let custom;
-    let keys;
-    let flightKeys;
+    let flightData;
     let metadata;
     if (isResponseEnvelope(response)) {
         // client-only respond(): the value rides in memory beside the metadata
@@ -160,15 +317,17 @@ async function handleResponse(response, error, navigate) {
     }
     else if (response instanceof Response) {
         metadata = response;
-        // responses the transport hands over whole (redirects, revalidation,
-        // single-flight) carry a codec-encoded body the router decodes itself
+        // responses the transport hands over whole (redirects, revalidation)
+        // carry a codec-encoded body the router decodes itself. With the
+        // flight-data consumer registered single-flight payloads never reach
+        // this path, but a manually opted-in call (no consumer) still can —
+        // unwrap the standardized { value, data } shape for it too.
         if (response.body) {
             data = await decodeResponse(response);
             if (response.headers.has("X-Single-Flight")) {
-                custom = data;
-                data = custom._$value;
-                delete custom._$value;
-                flightKeys = Object.keys(custom);
+                const payload = data;
+                data = payload.value;
+                flightData = payload.data;
             }
         }
     }
@@ -176,24 +335,6 @@ async function handleResponse(response, error, navigate) {
         return { error: response };
     else
         data = response;
-    if (metadata) {
-        if (metadata.headers.has("X-Revalidate"))
-            keys = metadata.headers.get("X-Revalidate").split(",");
-        if (metadata.headers.has("Location")) {
-            const locationUrl = metadata.headers.get("Location") || "/";
-            if (locationUrl.startsWith("http")) {
-                window.location.href = locationUrl;
-            }
-            else {
-                navigate(locationUrl);
-            }
-        }
-    }
-    // invalidate
-    cacheKeyOp(keys, entry => (entry[0] = 0));
-    // set cache
-    flightKeys && flightKeys.forEach(k => query.set(k, custom[k]));
-    // trigger revalidation
-    await revalidate(keys, false);
+    await applyResponseMetadata(metadata, navigate, flightData);
     return data != null ? { data } : undefined;
 }

package/dist/data/events.d.ts

@@ -1,4 +1,12 @@
 import type { RouterContext } from "../types.js";
+/**
+ * The submit delegation consults this slot instead of importing the action
+ * module: the action side installs its handler on first action creation
+ * (see data/action.ts), so an app that never creates an action never pulls
+ * the data layer into its bundle through the router's event wiring.
+ */
+export type RouterFormHandler = (evt: SubmitEvent, router: RouterContext, actionBase: string) => void;
+export declare function setRouterFormHandler(handler: RouterFormHandler | undefined): void;
 type NativeEventConfig = {
     preload?: boolean;
     explicitLinks?: boolean;

package/dist/data/events.js

@@ -1,7 +1,9 @@
 import { delegateEvents } from "@solidjs/web";
 import { onCleanup } from "solid-js";
-import { actions } from "./action.js";
-import { mockBase } from "../utils.js";
+let formHandler;
+export function setRouterFormHandler(handler) {
+    formHandler = handler;
+}
 export function setupNativeEvents({ preload = true, explicitLinks = false, actionBase = "/_server", transformUrl } = {}) {
     return (router) => {
         const basePath = router.base.path();
@@ -76,30 +78,29 @@ export function setupNativeEvents({ preload = true, explicitLinks = false, actio
             }, 20);
         }
         function handleFormSubmit(evt) {
+            if (formHandler)
+                return formHandler(evt, router, actionBase);
+            // No form handler means no action module in the client graph at all
+            // (e.g. server components binding forms straight to server functions).
+            // A POST to a url under actionBase is self-describing, so delegation
+            // is still sufficient: intercept synchronously — the no-JS treatment
+            // is reserved for clients with no JS — capture the FormData, and load
+            // the handler lazily. Apps that never submit one never load it.
             if (evt.defaultPrevented)
                 return;
-            let actionRef = evt.submitter && evt.submitter.hasAttribute("formaction")
+            const form = evt.target;
+            const ref = evt.submitter && evt.submitter.hasAttribute("formaction")
                 ? evt.submitter.getAttribute("formaction")
-                : evt.target.getAttribute("action");
-            if (!actionRef)
+                : form.getAttribute("action");
+            if (!ref || ref.startsWith("https://action/"))
                 return;
-            if (!actionRef.startsWith("https://action/")) {
-                // normalize server actions
-                const url = new URL(actionRef, mockBase);
-                actionRef = router.parsePath(url.pathname + url.search);
-                if (!actionRef.startsWith(actionBase))
-                    return;
-            }
-            if (evt.target.method.toUpperCase() !== "POST")
-                throw new Error("Only POST forms are supported for Actions");
-            const handler = actions.get(actionRef);
-            if (handler) {
-                evt.preventDefault();
-                const data = new FormData(evt.target, evt.submitter);
-                handler.call({ r: router, f: evt.target }, evt.target.enctype === "multipart/form-data"
-                    ? data
-                    : new URLSearchParams(data));
-            }
+            const url = new URL(ref, document.baseURI);
+            const path = router.parsePath(url.pathname + url.search);
+            if (!path.startsWith(actionBase) || form.method.toUpperCase() !== "POST")
+                return;
+            evt.preventDefault();
+            const data = new FormData(form, evt.submitter);
+            import("./serverForms.js").then(m => m.submitServerForm(router, path, form, data));
         }
         // ensure delegated event run first
         delegateEvents(["click", "submit"]);

package/dist/data/flash.d.ts

@@ -0,0 +1,21 @@
+export { FLASH_COOKIE, hasFlashCookie, clearFlashCookie } from "./flashCookie.js";
+/** What rides the cookie: a Submission minus its lifecycle methods. */
+export interface FlashSubmission {
+    input: any[];
+    url: string;
+    result?: any;
+    error?: any;
+}
+/**
+ * Encodes the outcome of a no-JS submission as a Set-Cookie value. `url` is
+ * the action url (pathname + search of the server function call) so the
+ * seeded submission matches `useSubmission` filters; `thrown` errors land on
+ * `error`, returned values on `result` (mirroring the scripted split).
+ */
+export declare function encodeFlashCookie(url: string, result: any, input: any[], thrown?: boolean): string;
+/**
+ * Decodes the flash cookie out of a request's Cookie header. Returns
+ * undefined when absent or unreadable (a malformed cookie must never take
+ * down SSR — it is cleared either way).
+ */
+export declare function decodeFlashCookie(cookieHeader: string | null): FlashSubmission | undefined;

package/dist/data/flash.js

@@ -0,0 +1,78 @@
+// The no-JS form convention's cookie codec. When a form posts to a server
+// function without the client runtime (no instance header), the server
+// handler redirects back carrying the outcome in a one-shot "flash" cookie;
+// the next SSR pass reads it and seeds the router's submission state so
+// useSubmission() renders the result exactly as a scripted submission would.
+// Both codec halves live in this module so the write (src/server.ts, the
+// handler's handleNoJS) and the read (provided to the router core by
+// data/action.ts) can never drift apart. The cookie's name/clearing live in
+// flashCookie.ts — the only piece the router core itself consumes — so this
+// codec stays out of bundles that never load the action layer.
+import { FLASH_COOKIE, matchFlashCookie } from "./flashCookie.js";
+export { FLASH_COOKIE, hasFlashCookie, clearFlashCookie } from "./flashCookie.js";
+// Form payloads have no JSON encoding, so entries are captured as pair
+// arrays under a marker key ($f / $u) and revived to real FormData /
+// URLSearchParams on the way out. File entries cannot ride a cookie and are
+// dropped.
+function encodeInputValue(value) {
+    if (value instanceof FormData)
+        return { $f: [...value.entries()].filter(([, v]) => typeof v === "string") };
+    if (value instanceof URLSearchParams)
+        return { $u: [...value.entries()] };
+    return value;
+}
+function decodeInputValue(value) {
+    if (value && typeof value === "object") {
+        if (Array.isArray(value.$f)) {
+            const form = new FormData();
+            for (const [k, v] of value.$f)
+                form.append(k, v);
+            return form;
+        }
+        if (Array.isArray(value.$u))
+            return new URLSearchParams(value.$u);
+    }
+    return value;
+}
+/**
+ * Encodes the outcome of a no-JS submission as a Set-Cookie value. `url` is
+ * the action url (pathname + search of the server function call) so the
+ * seeded submission matches `useSubmission` filters; `thrown` errors land on
+ * `error`, returned values on `result` (mirroring the scripted split).
+ */
+export function encodeFlashCookie(url, result, input, thrown) {
+    const isError = result instanceof Error;
+    const payload = {
+        url,
+        result: isError ? result.message : result,
+        error: isError,
+        thrown: !!thrown,
+        input: input.map(encodeInputValue)
+    };
+    return `${FLASH_COOKIE}=${encodeURIComponent(JSON.stringify(payload))}; Secure; HttpOnly; Path=/`;
+}
+/**
+ * Decodes the flash cookie out of a request's Cookie header. Returns
+ * undefined when absent or unreadable (a malformed cookie must never take
+ * down SSR — it is cleared either way).
+ */
+export function decodeFlashCookie(cookieHeader) {
+    const match = matchFlashCookie(cookieHeader);
+    if (!match)
+        return;
+    try {
+        const payload = JSON.parse(decodeURIComponent(match));
+        if (!payload || !payload.result)
+            return;
+        const result = payload.error ? new Error(payload.result) : payload.result;
+        return {
+            input: Array.isArray(payload.input) ? payload.input.map(decodeInputValue) : [],
+            url: payload.url,
+            result: payload.thrown ? undefined : result,
+            error: payload.thrown ? result : undefined
+        };
+    }
+    catch (error) {
+        console.error(error);
+    }
+}

package/dist/data/flashCookie.d.ts

@@ -0,0 +1,7 @@
+export declare const FLASH_COOKIE = "flash";
+/** Whether a Cookie header carries a flash cookie (readable or not). */
+export declare function hasFlashCookie(cookieHeader: string | null): boolean;
+/** The raw encoded flash payload out of a Cookie header, if present. */
+export declare function matchFlashCookie(cookieHeader: string | null): string | undefined;
+/** The Set-Cookie value clearing the flash cookie after it has been read. */
+export declare function clearFlashCookie(): string;