@solidjs/router 2.0.0-next.20 → 2.0.0-next.22

package/dist/data/action.js

@@ -1,6 +1,6 @@
 import { $TRACK, action as createSolidAction, createMemo, onCleanup, getOwner } from "solid-js";
 import { isResponseEnvelope, isServer, REVALIDATE_HEADER } from "@solidjs/web";
-import { createServerReference, decodeResponsePayload, parseServerFunctionUrl, subscribeFlightData } from "@solidjs/web/server-functions";
+import { createServerReference, decodeRedirectHeaderValue, decodeResponsePayload, parseServerFunctionUrl, REDIRECT_HEADER, subscribeFlightData } from "@solidjs/web/server-functions";
 // The explicit /server specifier is safe here: the only call site is
 // server-guarded, so client builds tree-shake the codec away.
 import { decodeFlashCookie } from "@solidjs/web/server-functions/server";
@@ -68,11 +68,13 @@ export function handleFormAction(evt, router, actionBase) {
  * carries everything an invocation needs — the function id in the path
  * (`<endpoint>/<id>`) and any bound `.with()` arguments (plain JSON in
  * `?args`, which the server prepends for natural-encoding bodies exactly as
- * it does for no-JS posts) — so the FormData is posted to it verbatim
- * through the server-function transport:
- * submissions, `aria-busy`, redirects, revalidation, and single-flight all
- * flow through the normal action machinery. Registered under the url, so
- * repeat submits reuse it (and a later real registration overrides it).
+ * it does for no-JS posts) — so the FormData is posted through the
+ * server-function transport, which addresses its own scripted calls at the
+ * url's data sibling (`<endpoint>/data/<id>`, solidjs/solid#3094) with the
+ * bound query intact: submissions, `aria-busy`, redirects, revalidation,
+ * and single-flight all flow through the normal action machinery.
+ * Registered under the rendered url, so repeat submits reuse it (and a
+ * later real registration overrides it).
  */
 function createServerFormAction(url) {
     const id = parseServerFunctionUrl(url);
@@ -116,6 +118,7 @@ function installRouterIntegrations() {
     if (isServer) {
         // Server-only: initSubmissions only decodes during SSR, so client builds
         // tree-shake the codec (which now lives behind the runtime's server entry).
+        // The codec is async from @solidjs/web 2.0.0-rc.7 (encrypted cookie).
         provideFlashDecoder(decodeFlashCookie);
     }
     else {
@@ -290,6 +293,10 @@ async function settleActionResult(result) {
 // response's metadata (and so the default revalidation pass must not run
 // again and wipe the freshly seeded cache).
 let flightApplications = 0;
+// The statuses fetch follows (Fetch §2.2.3) — the set the server masks into
+// the redirect carrier for scripted calls, and the set a locally-produced
+// redirect() envelope wears for real.
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 /**
  * Registers the router as the single-flight consumer of the server function
  * transport. Subscribing is the opt-in: while registered, the transport
@@ -309,23 +316,43 @@ export function setupFlightDataConsumer(router) {
 }
 /**
  * Applies a server function response's integration metadata: `X-Revalidate`
- * keys invalidate, `Location` navigates (hard for absolute urls), flight
- * data seeds the query cache, and matching entries revalidate. Shared by
- * the flight-data consumer and the action response path (which still sees
- * metadata-bearing responses when no flight data was collected).
+ * keys invalidate, the redirect carrier navigates (soft when same-origin,
+ * hard otherwise), flight data seeds the query cache, and matching entries
+ * revalidate. Shared by the flight-data consumer and the action response
+ * path (which still sees metadata-bearing responses when no flight data was
+ * collected).
  */
 function applyResponseMetadata(metadata, navigate, flightData) {
     let keys;
     if (metadata) {
         if (metadata.headers.has(REVALIDATE_HEADER))
             keys = metadata.headers.get(REVALIDATE_HEADER).split(",");
-        if (metadata.headers.has("Location")) {
-            const locationUrl = metadata.headers.get("Location") || "/";
-            if (locationUrl.startsWith("http")) {
-                window.location.href = locationUrl;
+        // The carrier delivers the target RESOLVED to an absolute url
+        // (solidjs/solid#3102), so the soft/hard split is a real origin
+        // comparison — never a guess from how the author spelled the target,
+        // which sent `redirect("/")` and `redirect(new URL("/", url).href)`
+        // down different navigation paths (solidjs/solid#3107). A redirect
+        // produced locally (a client-side action's `redirect()`) never crossed
+        // the wire, so no carrier was attached: it is the real 3xx with its
+        // Location, resolved against the page it runs in. A `Location` on any
+        // other status is the author's data (a 201's created-at) and never
+        // navigates. Same-origin targets navigate softly under the router;
+        // anything else leaves the app, so the document goes with it.
+        // `replace` matches what HTTP gives a form post: the target takes the
+        // submission's place in history rather than stacking on it.
+        const carried = decodeRedirectHeaderValue(metadata.headers.get(REDIRECT_HEADER));
+        const local = !carried && REDIRECT_STATUSES.has(metadata.status) && metadata.headers.get("Location");
+        const target = carried
+            ? new URL(carried.url)
+            : local
+                ? new URL(local, window.location.href)
+                : undefined;
+        if (target) {
+            if (target.origin === window.location.origin) {
+                navigate(target.pathname + target.search + target.hash, { replace: true });
             }
             else {
-                navigate(locationUrl);
+                window.location.href = target.href;
             }
         }
     }

package/dist/index.js

@@ -1,6 +1,6 @@
 import { getOwner, runWithOwner, createMemo, createRenderEffect, onCleanup, untrack, createContext, createSignal, useContext, NotReadyError, isPending, DEV, latest, createComponent, createRoot, Show, createEffect, sharedConfig, onSettled, getObserver, $TRACK, action as action$1 } from 'solid-js';
 import { registerElementClaim, delegateEvents, isServer, getRequestEvent, hasFlashCookie, clearFlashCookie, createComponent as createComponent$1, memo, isServerFunction, getServerFunctionMetadata, getServerFunctionRPC, isResponseEnvelope, REVALIDATE_HEADER } from '@solidjs/web';
-import { subscribeFlightData, decodeResponsePayload, parseServerFunctionUrl, createServerReference } from '@solidjs/web/server-functions';
+import { subscribeFlightData, decodeRedirectHeaderValue, REDIRECT_HEADER, decodeResponsePayload, parseServerFunctionUrl, createServerReference } from '@solidjs/web/server-functions';
 import { decodeFlashCookie } from '@solidjs/web/server-functions/server';
 
 const hasSchemeRegex = /^(?:[a-z0-9]+:)?\/\//i;
@@ -1097,7 +1097,12 @@ function provideFlightConsumer(factory) {
  * decoder is always installed before useSubmission can read — and a
  * router-only app, where it never installs, has no actions that could have
  * produced a flash cookie in the first place.
+ *
+ * The decoder is async: the flash cookie is encrypted (solidjs/solid#3239),
+ * so the runtime's `decodeFlashCookie` decrypts through WebCrypto and the
+ * seeding read parks on the not-ready protocol until the decode settles.
  */
+
 let flashDecoder;
 function provideFlashDecoder(decoder) {
   flashDecoder || (flashDecoder = decoder);
@@ -1153,6 +1158,54 @@ function createRouterContext(integration, branches, getContext, options = {}) {
       }
     }
   }
+
+  // The decode, at most once per request: the decoder may answer with a
+  // Promise (the cookie is encrypted; the runtime's decodeFlashCookie is
+  // async), and this cache is what keeps the parked read's rerun from
+  // restarting it — resumption finds the settled outcome and just reads it.
+  // A decoder that rejects reads as "no flash", matching the runtime's own
+  // malformed-cookie semantics.
+  let flashDecode;
+
+  // The seeding read, as a memo: NotReadyError must surface from a reactive
+  // node the graph can park and retry — never from router setup, which no
+  // boundary guards — and the memo bounds the recompute to this function;
+  // a parked reader resumes into the settled cache above, never a second
+  // decode. Created only when a flash cookie actually arrived (server-only
+  // by construction: flashCookieHeader is only ever set there), and
+  //   - `lazy`: server memos compute eagerly by default — deferred to first
+  //     read, a request whose submissions are never read never decodes;
+  //   - `transparent`: the memo exists on the server only, so its owner
+  //     must not consume a hydration-id slot — the client, which seeds
+  //     submissions as [] without ever creating this memo, would miss it
+  //     and every sibling id would shift.
+  const flashSubmission = flashCookieHeader !== undefined ? createMemo(() => {
+    if (!flashDecoder) return undefined;
+    if (!flashDecode) {
+      const promise = flashDecoder(flashCookieHeader).then(value => {
+        flashDecode = {
+          done: true,
+          value
+        };
+      }, () => {
+        flashDecode = {
+          done: true,
+          value: undefined
+        };
+      });
+      flashDecode = {
+        done: false,
+        promise
+      };
+    }
+    // SSR carries the Promise through NotReadyError so the parked
+    // reader can resume, exactly like the lazy matches above.
+    if (!flashDecode.done) throw new NotReadyError(flashDecode.promise);
+    return flashDecode.value;
+  }, {
+    lazy: true,
+    transparent: true
+  }) : undefined;
   let submissions;
 
   // NotReadyError's source must be a reactive async node, not the raw
@@ -1384,12 +1437,16 @@ function createRouterContext(integration, branches, getContext, options = {}) {
   // Seeds the initial submission from a no-JS form post: the server
   // function runtime redirected back with the outcome in a one-shot flash
   // cookie (its default no-JS convention), consumed eagerly above and
-  // decoded here — so the post-redirect SSR renders useSubmission() state
-  // exactly as a scripted submission would. An explicitly pre-seeded
-  // `event.router.submission` (framework integrations) takes precedence.
+  // decoded through the flashSubmission memo — so the post-redirect SSR
+  // renders useSubmission() state exactly as a scripted submission would.
+  // The memo read may throw NotReadyError while the (encrypted) cookie
+  // decodes; the assignment in the submissions getter never completed, so
+  // the resumed rerun retries it against the settled decode. An explicitly
+  // pre-seeded `event.router.submission` (framework integrations) takes
+  // precedence.
   function initSubmissions() {
     const e = getRequestEvent();
-    const submission = e && e.router && e.router.submission || (flashDecoder && flashCookieHeader !== undefined ? flashDecoder(flashCookieHeader) : undefined);
+    const submission = e && e.router && e.router.submission || flashSubmission && flashSubmission();
     if (!submission) return [];
     return [{
       ...submission,
@@ -2562,11 +2619,13 @@ function handleFormAction(evt, router, actionBase) {
  * carries everything an invocation needs — the function id in the path
  * (`<endpoint>/<id>`) and any bound `.with()` arguments (plain JSON in
  * `?args`, which the server prepends for natural-encoding bodies exactly as
- * it does for no-JS posts) — so the FormData is posted to it verbatim
- * through the server-function transport:
- * submissions, `aria-busy`, redirects, revalidation, and single-flight all
- * flow through the normal action machinery. Registered under the url, so
- * repeat submits reuse it (and a later real registration overrides it).
+ * it does for no-JS posts) — so the FormData is posted through the
+ * server-function transport, which addresses its own scripted calls at the
+ * url's data sibling (`<endpoint>/data/<id>`, solidjs/solid#3094) with the
+ * bound query intact: submissions, `aria-busy`, redirects, revalidation,
+ * and single-flight all flow through the normal action machinery.
+ * Registered under the rendered url, so repeat submits reuse it (and a
+ * later real registration overrides it).
  */
 function createServerFormAction(url) {
   const id = parseServerFunctionUrl(url);
@@ -2614,6 +2673,7 @@ function installRouterIntegrations() {
   if (isServer) {
     // Server-only: initSubmissions only decodes during SSR, so client builds
     // tree-shake the codec (which now lives behind the runtime's server entry).
+    // The codec is async from @solidjs/web 2.0.0-rc.7 (encrypted cookie).
     provideFlashDecoder(decodeFlashCookie);
   } else {
     setRouterFormHandler(handleFormAction);
@@ -2791,6 +2851,11 @@ async function settleActionResult(result) {
 // again and wipe the freshly seeded cache).
 let flightApplications = 0;
 
+// The statuses fetch follows (Fetch §2.2.3) — the set the server masks into
+// the redirect carrier for scripted calls, and the set a locally-produced
+// redirect() envelope wears for real.
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
 /**
  * Registers the router as the single-flight consumer of the server function
  * transport. Subscribing is the opt-in: while registered, the transport
@@ -2813,21 +2878,39 @@ function setupFlightDataConsumer(router) {
 
 /**
  * Applies a server function response's integration metadata: `X-Revalidate`
- * keys invalidate, `Location` navigates (hard for absolute urls), flight
- * data seeds the query cache, and matching entries revalidate. Shared by
- * the flight-data consumer and the action response path (which still sees
- * metadata-bearing responses when no flight data was collected).
+ * keys invalidate, the redirect carrier navigates (soft when same-origin,
+ * hard otherwise), flight data seeds the query cache, and matching entries
+ * revalidate. Shared by the flight-data consumer and the action response
+ * path (which still sees metadata-bearing responses when no flight data was
+ * collected).
  */
 function applyResponseMetadata(metadata, navigate, flightData) {
   let keys;
   if (metadata) {
     if (metadata.headers.has(REVALIDATE_HEADER)) keys = metadata.headers.get(REVALIDATE_HEADER).split(",");
-    if (metadata.headers.has("Location")) {
-      const locationUrl = metadata.headers.get("Location") || "/";
-      if (locationUrl.startsWith("http")) {
-        window.location.href = locationUrl;
+    // The carrier delivers the target RESOLVED to an absolute url
+    // (solidjs/solid#3102), so the soft/hard split is a real origin
+    // comparison — never a guess from how the author spelled the target,
+    // which sent `redirect("/")` and `redirect(new URL("/", url).href)`
+    // down different navigation paths (solidjs/solid#3107). A redirect
+    // produced locally (a client-side action's `redirect()`) never crossed
+    // the wire, so no carrier was attached: it is the real 3xx with its
+    // Location, resolved against the page it runs in. A `Location` on any
+    // other status is the author's data (a 201's created-at) and never
+    // navigates. Same-origin targets navigate softly under the router;
+    // anything else leaves the app, so the document goes with it.
+    // `replace` matches what HTTP gives a form post: the target takes the
+    // submission's place in history rather than stacking on it.
+    const carried = decodeRedirectHeaderValue(metadata.headers.get(REDIRECT_HEADER));
+    const local = !carried && REDIRECT_STATUSES.has(metadata.status) && metadata.headers.get("Location");
+    const target = carried ? new URL(carried.url) : local ? new URL(local, window.location.href) : undefined;
+    if (target) {
+      if (target.origin === window.location.origin) {
+        navigate(target.pathname + target.search + target.hash, {
+          replace: true
+        });
       } else {
-        navigate(locationUrl);
+        window.location.href = target.href;
       }
     }
   }

package/dist/routing.d.ts

@@ -216,7 +216,22 @@ export declare function getRouteMatches(branches: Branch[], location: string): R
 export declare function mergeParams(matches: RouteMatch[]): Params;
 export declare function registerFlightRouter(router: RouterContext): () => void;
 export declare function provideFlightConsumer(factory: (router: RouterContext) => () => void): void;
-export declare function provideFlashDecoder(decoder: (cookieHeader: string | null) => FlashSubmission | undefined): void;
+/**
+ * The flash-cookie codec, provided by the action side (data/action.ts) so
+ * the router core never carries it: the core consumes the cookie eagerly
+ * per request (detection + one-shot clear via the runtime's isomorphic half)
+ * but defers decoding to this slot, read when the submissions signal
+ * initializes. Actions are created at module scope, so on the server the
+ * decoder is always installed before useSubmission can read — and a
+ * router-only app, where it never installs, has no actions that could have
+ * produced a flash cookie in the first place.
+ *
+ * The decoder is async: the flash cookie is encrypted (solidjs/solid#3239),
+ * so the runtime's `decodeFlashCookie` decrypts through WebCrypto and the
+ * seeding read parks on the not-ready protocol until the decode settles.
+ */
+type FlashDecoder = (cookieHeader: string | null) => Promise<FlashSubmission | undefined>;
+export declare function provideFlashDecoder(decoder: FlashDecoder): void;
 export declare function getIntent(): Intent | undefined;
 export declare function getInPreloadFn(): boolean;
 export declare function setInPreloadFn(value: boolean): void;
@@ -226,3 +241,4 @@ export declare function createRouterContext(integration: RouterIntegration, bran
     transformUrl?: (url: string) => string;
 }): RouterContext;
 export declare function createRouteContext(router: RouterContext, parent: RouteContext, outlet: () => JSX.Element, match: () => RouteMatch, matches?: () => RouteMatch[]): RouteContext;
+export {};

package/dist/routing.js

@@ -541,16 +541,6 @@ export function provideFlightConsumer(factory) {
             flightRouters.set(router, factory(router));
     }
 }
-/**
- * The flash-cookie codec, provided by the action side (data/action.ts) so
- * the router core never carries it: the core consumes the cookie eagerly
- * per request (detection + one-shot clear via the runtime's isomorphic half)
- * but defers decoding to this slot, read when the submissions signal
- * initializes. Actions are created at module scope, so on the server the
- * decoder is always installed before useSubmission can read — and a
- * router-only app, where it never installs, has no actions that could have
- * produced a flash cookie in the first place.
- */
 let flashDecoder;
 export function provideFlashDecoder(decoder) {
     flashDecoder || (flashDecoder = decoder);
@@ -605,6 +595,44 @@ export function createRouterContext(integration, branches, getContext, options =
             }
         }
     }
+    // The decode, at most once per request: the decoder may answer with a
+    // Promise (the cookie is encrypted; the runtime's decodeFlashCookie is
+    // async), and this cache is what keeps the parked read's rerun from
+    // restarting it — resumption finds the settled outcome and just reads it.
+    // A decoder that rejects reads as "no flash", matching the runtime's own
+    // malformed-cookie semantics.
+    let flashDecode;
+    // The seeding read, as a memo: NotReadyError must surface from a reactive
+    // node the graph can park and retry — never from router setup, which no
+    // boundary guards — and the memo bounds the recompute to this function;
+    // a parked reader resumes into the settled cache above, never a second
+    // decode. Created only when a flash cookie actually arrived (server-only
+    // by construction: flashCookieHeader is only ever set there), and
+    //   - `lazy`: server memos compute eagerly by default — deferred to first
+    //     read, a request whose submissions are never read never decodes;
+    //   - `transparent`: the memo exists on the server only, so its owner
+    //     must not consume a hydration-id slot — the client, which seeds
+    //     submissions as [] without ever creating this memo, would miss it
+    //     and every sibling id would shift.
+    const flashSubmission = flashCookieHeader !== undefined
+        ? createMemo(() => {
+            if (!flashDecoder)
+                return undefined;
+            if (!flashDecode) {
+                const promise = flashDecoder(flashCookieHeader).then(value => {
+                    flashDecode = { done: true, value };
+                }, () => {
+                    flashDecode = { done: true, value: undefined };
+                });
+                flashDecode = { done: false, promise };
+            }
+            // SSR carries the Promise through NotReadyError so the parked
+            // reader can resume, exactly like the lazy matches above.
+            if (!flashDecode.done)
+                throw new NotReadyError(flashDecode.promise);
+            return flashDecode.value;
+        }, { lazy: true, transparent: true })
+        : undefined;
     let submissions;
     // NotReadyError's source must be a reactive async node, not the raw
     // Promise. Keep one reader per boundary for this router owner so rejection
@@ -843,15 +871,16 @@ export function createRouterContext(integration, branches, getContext, options =
     // Seeds the initial submission from a no-JS form post: the server
     // function runtime redirected back with the outcome in a one-shot flash
     // cookie (its default no-JS convention), consumed eagerly above and
-    // decoded here — so the post-redirect SSR renders useSubmission() state
-    // exactly as a scripted submission would. An explicitly pre-seeded
-    // `event.router.submission` (framework integrations) takes precedence.
+    // decoded through the flashSubmission memo — so the post-redirect SSR
+    // renders useSubmission() state exactly as a scripted submission would.
+    // The memo read may throw NotReadyError while the (encrypted) cookie
+    // decodes; the assignment in the submissions getter never completed, so
+    // the resumed rerun retries it against the settled decode. An explicitly
+    // pre-seeded `event.router.submission` (framework integrations) takes
+    // precedence.
     function initSubmissions() {
         const e = getRequestEvent();
-        const submission = (e && e.router && e.router.submission) ||
-            (flashDecoder && flashCookieHeader !== undefined
-                ? flashDecoder(flashCookieHeader)
-                : undefined);
+        const submission = (e && e.router && e.router.submission) || (flashSubmission && flashSubmission());
         if (!submission)
             return [];
         return [

package/package.json

@@ -6,7 +6,7 @@
     "Ryan Turnquist"
   ],
   "license": "MIT",
-  "version": "2.0.0-next.20",
+  "version": "2.0.0-next.22",
   "homepage": "https://github.com/solidjs/solid-router#readme",
   "repository": {
     "type": "git",
@@ -38,21 +38,21 @@
     "@rollup/plugin-node-resolve": "15.3.0",
     "@rollup/plugin-terser": "0.4.4",
     "@solidjs/vite-plugin": "3.0.0-next.35",
-    "@solidjs/web": "^2.0.0-rc.4",
+    "@solidjs/web": "^2.0.0-rc.7",
     "@types/jest": "^29.5.14",
     "@types/node": "^22.10.0",
     "babel-preset-solid": "^2.0.0-rc.2",
     "jsdom": "^25.0.1",
     "prettier": "^3.4.1",
     "rollup": "^4.27.4",
-    "solid-js": "^2.0.0-rc.4",
+    "solid-js": "^2.0.0-rc.7",
     "typescript": "^5.7.2",
     "vite": "^8.2.2",
     "vitest": "^4.1.11"
   },
   "peerDependencies": {
-    "@solidjs/web": "^2.0.0-rc.4",
-    "solid-js": "^2.0.0-rc.4"
+    "@solidjs/web": "^2.0.0-rc.7",
+    "solid-js": "^2.0.0-rc.7"
   },
   "scripts": {
     "build": "rm -rf dist && tsc && rollup -c",