Inject the deployment secret into server builds (solidjs/solid#3239)

[ryansolid]

Summary

Companion to the encrypted no-JS flash cookie landing in @solidjs/web (solidjs/solid#3239, commit solidjs/solid@fbe5bef4). The flash carries the submitted form input — whatever the user typed — so the runtime now AES-GCM encrypts it under a key derived (domain-separated) from the deployment secret, and withholds the flash entirely when no secret exists.

This PR provides that secret with zero configuration through the internal bundler contract:

globalThis.__SOLID_SECRET__ ??= "<random-per-build>";

emitted as the first statement of the generated server-function handler module (virtual:solid-server-function-handler).

Why this shape

• Once per plugin instance (node:crypto randomBytes(32)): a production build bakes one value into the emitted server chunk, so every instance of that deployment shares it — the runtime requires this (a per-process value would silently lose flashes behind a load balancer). A dev session holds one value for its lifetime; a restart invalidates in-flight flashes, which are 60-second one-shot cookies — the next render just reads "no flash".
• The handler module covers both halves: every dispatch surface (dev middleware, prod handler) loads it before serving a form POST (the encode), and the generated SSR handler imports it at module load, so the secret is in place for the render that follows the redirect (the decode).
• Server-only by construction: the handler module already hard-errors when imported from a client graph, so the secret never rides client output.
• ??= keeps explicit config authoritative: configureServerFunctionsServer({ secret }) outranks the global in the runtime's resolution order, and an outer harness that injects its own __SOLID_SECRET__ earlier wins over this snippet.
• __SOLID_SECRET__, not a flash-specific name: the secret is the deployment-wide concept; the runtime derives per-purpose keys from it under domain strings (solid.flash.v1 today), so future features (and other tooling) share one contract without key-material overlap.

Verification

Built examples/start-ssr: dist/server/server.js leads with the ??= line carrying a 64-hex value; the client output contains no reference. pnpm build and the example suite pass.

Draft until @solidjs/web 2.0.0-rc.7 ships the encrypted flash runtime this pairs with.

Made with Cursor

[changeset-bot]

🦋 Changeset detected

Latest commit: 4479860

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@solidjs/vite-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@solidjs/vite-plugin@343

commit: 4479860