@solidjs/router 2.0.0-next.21 → 2.0.0-next.22

package/dist/data/action.js

@@ -118,6 +118,7 @@ function installRouterIntegrations() {
     if (isServer) {
         // Server-only: initSubmissions only decodes during SSR, so client builds
         // tree-shake the codec (which now lives behind the runtime's server entry).
+        // The codec is async from @solidjs/web 2.0.0-rc.7 (encrypted cookie).
         provideFlashDecoder(decodeFlashCookie);
     }
     else {

package/dist/index.js

@@ -1097,7 +1097,12 @@ function provideFlightConsumer(factory) {
  * decoder is always installed before useSubmission can read — and a
  * router-only app, where it never installs, has no actions that could have
  * produced a flash cookie in the first place.
+ *
+ * The decoder is async: the flash cookie is encrypted (solidjs/solid#3239),
+ * so the runtime's `decodeFlashCookie` decrypts through WebCrypto and the
+ * seeding read parks on the not-ready protocol until the decode settles.
  */
+
 let flashDecoder;
 function provideFlashDecoder(decoder) {
   flashDecoder || (flashDecoder = decoder);
@@ -1153,6 +1158,54 @@ function createRouterContext(integration, branches, getContext, options = {}) {
       }
     }
   }
+
+  // The decode, at most once per request: the decoder may answer with a
+  // Promise (the cookie is encrypted; the runtime's decodeFlashCookie is
+  // async), and this cache is what keeps the parked read's rerun from
+  // restarting it — resumption finds the settled outcome and just reads it.
+  // A decoder that rejects reads as "no flash", matching the runtime's own
+  // malformed-cookie semantics.
+  let flashDecode;
+
+  // The seeding read, as a memo: NotReadyError must surface from a reactive
+  // node the graph can park and retry — never from router setup, which no
+  // boundary guards — and the memo bounds the recompute to this function;
+  // a parked reader resumes into the settled cache above, never a second
+  // decode. Created only when a flash cookie actually arrived (server-only
+  // by construction: flashCookieHeader is only ever set there), and
+  //   - `lazy`: server memos compute eagerly by default — deferred to first
+  //     read, a request whose submissions are never read never decodes;
+  //   - `transparent`: the memo exists on the server only, so its owner
+  //     must not consume a hydration-id slot — the client, which seeds
+  //     submissions as [] without ever creating this memo, would miss it
+  //     and every sibling id would shift.
+  const flashSubmission = flashCookieHeader !== undefined ? createMemo(() => {
+    if (!flashDecoder) return undefined;
+    if (!flashDecode) {
+      const promise = flashDecoder(flashCookieHeader).then(value => {
+        flashDecode = {
+          done: true,
+          value
+        };
+      }, () => {
+        flashDecode = {
+          done: true,
+          value: undefined
+        };
+      });
+      flashDecode = {
+        done: false,
+        promise
+      };
+    }
+    // SSR carries the Promise through NotReadyError so the parked
+    // reader can resume, exactly like the lazy matches above.
+    if (!flashDecode.done) throw new NotReadyError(flashDecode.promise);
+    return flashDecode.value;
+  }, {
+    lazy: true,
+    transparent: true
+  }) : undefined;
   let submissions;
 
   // NotReadyError's source must be a reactive async node, not the raw
@@ -1384,12 +1437,16 @@ function createRouterContext(integration, branches, getContext, options = {}) {
   // Seeds the initial submission from a no-JS form post: the server
   // function runtime redirected back with the outcome in a one-shot flash
   // cookie (its default no-JS convention), consumed eagerly above and
-  // decoded here — so the post-redirect SSR renders useSubmission() state
-  // exactly as a scripted submission would. An explicitly pre-seeded
-  // `event.router.submission` (framework integrations) takes precedence.
+  // decoded through the flashSubmission memo — so the post-redirect SSR
+  // renders useSubmission() state exactly as a scripted submission would.
+  // The memo read may throw NotReadyError while the (encrypted) cookie
+  // decodes; the assignment in the submissions getter never completed, so
+  // the resumed rerun retries it against the settled decode. An explicitly
+  // pre-seeded `event.router.submission` (framework integrations) takes
+  // precedence.
   function initSubmissions() {
     const e = getRequestEvent();
-    const submission = e && e.router && e.router.submission || (flashDecoder && flashCookieHeader !== undefined ? flashDecoder(flashCookieHeader) : undefined);
+    const submission = e && e.router && e.router.submission || flashSubmission && flashSubmission();
     if (!submission) return [];
     return [{
       ...submission,
@@ -2616,6 +2673,7 @@ function installRouterIntegrations() {
   if (isServer) {
     // Server-only: initSubmissions only decodes during SSR, so client builds
     // tree-shake the codec (which now lives behind the runtime's server entry).
+    // The codec is async from @solidjs/web 2.0.0-rc.7 (encrypted cookie).
     provideFlashDecoder(decodeFlashCookie);
   } else {
     setRouterFormHandler(handleFormAction);

package/dist/routing.d.ts

@@ -216,7 +216,22 @@ export declare function getRouteMatches(branches: Branch[], location: string): R
 export declare function mergeParams(matches: RouteMatch[]): Params;
 export declare function registerFlightRouter(router: RouterContext): () => void;
 export declare function provideFlightConsumer(factory: (router: RouterContext) => () => void): void;
-export declare function provideFlashDecoder(decoder: (cookieHeader: string | null) => FlashSubmission | undefined): void;
+/**
+ * The flash-cookie codec, provided by the action side (data/action.ts) so
+ * the router core never carries it: the core consumes the cookie eagerly
+ * per request (detection + one-shot clear via the runtime's isomorphic half)
+ * but defers decoding to this slot, read when the submissions signal
+ * initializes. Actions are created at module scope, so on the server the
+ * decoder is always installed before useSubmission can read — and a
+ * router-only app, where it never installs, has no actions that could have
+ * produced a flash cookie in the first place.
+ *
+ * The decoder is async: the flash cookie is encrypted (solidjs/solid#3239),
+ * so the runtime's `decodeFlashCookie` decrypts through WebCrypto and the
+ * seeding read parks on the not-ready protocol until the decode settles.
+ */
+type FlashDecoder = (cookieHeader: string | null) => Promise<FlashSubmission | undefined>;
+export declare function provideFlashDecoder(decoder: FlashDecoder): void;
 export declare function getIntent(): Intent | undefined;
 export declare function getInPreloadFn(): boolean;
 export declare function setInPreloadFn(value: boolean): void;
@@ -226,3 +241,4 @@ export declare function createRouterContext(integration: RouterIntegration, bran
     transformUrl?: (url: string) => string;
 }): RouterContext;
 export declare function createRouteContext(router: RouterContext, parent: RouteContext, outlet: () => JSX.Element, match: () => RouteMatch, matches?: () => RouteMatch[]): RouteContext;
+export {};

package/dist/routing.js

@@ -541,16 +541,6 @@ export function provideFlightConsumer(factory) {
             flightRouters.set(router, factory(router));
     }
 }
-/**
- * The flash-cookie codec, provided by the action side (data/action.ts) so
- * the router core never carries it: the core consumes the cookie eagerly
- * per request (detection + one-shot clear via the runtime's isomorphic half)
- * but defers decoding to this slot, read when the submissions signal
- * initializes. Actions are created at module scope, so on the server the
- * decoder is always installed before useSubmission can read — and a
- * router-only app, where it never installs, has no actions that could have
- * produced a flash cookie in the first place.
- */
 let flashDecoder;
 export function provideFlashDecoder(decoder) {
     flashDecoder || (flashDecoder = decoder);
@@ -605,6 +595,44 @@ export function createRouterContext(integration, branches, getContext, options =
             }
         }
     }
+    // The decode, at most once per request: the decoder may answer with a
+    // Promise (the cookie is encrypted; the runtime's decodeFlashCookie is
+    // async), and this cache is what keeps the parked read's rerun from
+    // restarting it — resumption finds the settled outcome and just reads it.
+    // A decoder that rejects reads as "no flash", matching the runtime's own
+    // malformed-cookie semantics.
+    let flashDecode;
+    // The seeding read, as a memo: NotReadyError must surface from a reactive
+    // node the graph can park and retry — never from router setup, which no
+    // boundary guards — and the memo bounds the recompute to this function;
+    // a parked reader resumes into the settled cache above, never a second
+    // decode. Created only when a flash cookie actually arrived (server-only
+    // by construction: flashCookieHeader is only ever set there), and
+    //   - `lazy`: server memos compute eagerly by default — deferred to first
+    //     read, a request whose submissions are never read never decodes;
+    //   - `transparent`: the memo exists on the server only, so its owner
+    //     must not consume a hydration-id slot — the client, which seeds
+    //     submissions as [] without ever creating this memo, would miss it
+    //     and every sibling id would shift.
+    const flashSubmission = flashCookieHeader !== undefined
+        ? createMemo(() => {
+            if (!flashDecoder)
+                return undefined;
+            if (!flashDecode) {
+                const promise = flashDecoder(flashCookieHeader).then(value => {
+                    flashDecode = { done: true, value };
+                }, () => {
+                    flashDecode = { done: true, value: undefined };
+                });
+                flashDecode = { done: false, promise };
+            }
+            // SSR carries the Promise through NotReadyError so the parked
+            // reader can resume, exactly like the lazy matches above.
+            if (!flashDecode.done)
+                throw new NotReadyError(flashDecode.promise);
+            return flashDecode.value;
+        }, { lazy: true, transparent: true })
+        : undefined;
     let submissions;
     // NotReadyError's source must be a reactive async node, not the raw
     // Promise. Keep one reader per boundary for this router owner so rejection
@@ -843,15 +871,16 @@ export function createRouterContext(integration, branches, getContext, options =
     // Seeds the initial submission from a no-JS form post: the server
     // function runtime redirected back with the outcome in a one-shot flash
     // cookie (its default no-JS convention), consumed eagerly above and
-    // decoded here — so the post-redirect SSR renders useSubmission() state
-    // exactly as a scripted submission would. An explicitly pre-seeded
-    // `event.router.submission` (framework integrations) takes precedence.
+    // decoded through the flashSubmission memo — so the post-redirect SSR
+    // renders useSubmission() state exactly as a scripted submission would.
+    // The memo read may throw NotReadyError while the (encrypted) cookie
+    // decodes; the assignment in the submissions getter never completed, so
+    // the resumed rerun retries it against the settled decode. An explicitly
+    // pre-seeded `event.router.submission` (framework integrations) takes
+    // precedence.
     function initSubmissions() {
         const e = getRequestEvent();
-        const submission = (e && e.router && e.router.submission) ||
-            (flashDecoder && flashCookieHeader !== undefined
-                ? flashDecoder(flashCookieHeader)
-                : undefined);
+        const submission = (e && e.router && e.router.submission) || (flashSubmission && flashSubmission());
         if (!submission)
             return [];
         return [

package/package.json

@@ -6,7 +6,7 @@
     "Ryan Turnquist"
   ],
   "license": "MIT",
-  "version": "2.0.0-next.21",
+  "version": "2.0.0-next.22",
   "homepage": "https://github.com/solidjs/solid-router#readme",
   "repository": {
     "type": "git",
@@ -38,21 +38,21 @@
     "@rollup/plugin-node-resolve": "15.3.0",
     "@rollup/plugin-terser": "0.4.4",
     "@solidjs/vite-plugin": "3.0.0-next.35",
-    "@solidjs/web": "^2.0.0-rc.5",
+    "@solidjs/web": "^2.0.0-rc.7",
     "@types/jest": "^29.5.14",
     "@types/node": "^22.10.0",
     "babel-preset-solid": "^2.0.0-rc.2",
     "jsdom": "^25.0.1",
     "prettier": "^3.4.1",
     "rollup": "^4.27.4",
-    "solid-js": "^2.0.0-rc.5",
+    "solid-js": "^2.0.0-rc.7",
     "typescript": "^5.7.2",
     "vite": "^8.2.2",
     "vitest": "^4.1.11"
   },
   "peerDependencies": {
-    "@solidjs/web": "^2.0.0-rc.5",
-    "solid-js": "^2.0.0-rc.5"
+    "@solidjs/web": "^2.0.0-rc.7",
+    "solid-js": "^2.0.0-rc.7"
   },
   "scripts": {
     "build": "rm -rf dist && tsc && rollup -c",