Require the async (encrypted) flash decoder in the submissions seed (solidjs/solid#3239)

[ryansolid]

Summary

Companion to the encrypted no-JS flash cookie in @solidjs/web (solidjs/solid#3239, commit solidjs/solid@fbe5bef4): the flash payload carries the submitted form input, so it is now AES-GCM encrypted and decodeFlashCookie is async (WebCrypto has no sync API). The provideFlashDecoder slot now takes exactly that shape — async only, no sync compatibility path to forget about later — and the submissions seed absorbs the Promise.

How the server handles it

The seeding read moves into a memo created only when a flash cookie actually arrived, and the in-flight decode rides NotReadyError — the same SSR spelling the router already uses for unresolved lazy route matches:

• Throws from a reactive node, never router setup. The memo is what parks; whatever scope read useSubmission resumes into the settled result.
• At most one decode per request. The decode outcome is cached at router scope, so the parked reader's rerun (and any concurrent reader) finds the settled value rather than restarting the work.
• No cost without a read. Server memos compute eagerly by default; lazy: true defers to the first submissions read, so a request that renders without touching useSubmission never decodes — and a request without a flash cookie never creates the memo at all. (The eager half — detection + one-shot clear — is unchanged.)
• Hydration ids stay aligned. The memo exists on the server only; the client seeds [] without ever creating it. transparent: true keeps its owner out of the hydration-id chain, so sibling ids don't shift (the #3012 class of bug).

The one temporary line

The provide site wraps the runtime export in an async arrow (provideFlashDecoder(async h => decodeFlashCookie(h))) only because the installed rc.6 still types it synchronous; it carries a TODO(@solidjs/web >= 2.0.0-rc.7) to pass decodeFlashCookie directly with the dep bump in this PR.

Tests

The flash-seeding server spec now runs the async shape throughout: the parking round-trip (first read throws NotReadyError, resumed read seeds from a decode that ran exactly once), the laziness guarantee (a rendered request that never reads submissions never decodes, while the one-shot clear still lands), and the existing seeding/pre-seed/no-cookie contracts through a parked read helper. Full suite: 395 client + 35 server + type tests pass.

Draft until @solidjs/web 2.0.0-rc.7 ships the encrypted flash runtime; lands in unison with solidjs/solid-vite-plugin#343 (deployment-secret injection).

[changeset-bot]

🦋 Changeset detected

Latest commit: 8edac15

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@solidjs/router	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR