@orochibraru/svelte-smol 1.8.0 → 1.8.2

package/dist/kit3/templates/env.ts

@@ -0,0 +1,133 @@
+import { env_prefix } from "MANIFEST";
+import process from "node:process";
+
+const expected = new Set([
+	"SOCKET_PATH",
+	"HOST",
+	"PORT",
+	"REUSE_PORT",
+	"IPV6_ONLY",
+	"CONNECTION_IDLE_TIMEOUT",
+	"BODY_SIZE_LIMIT",
+	"SHUTDOWN_TIMEOUT",
+	"DEVELOPMENT",
+	"XFF_DEPTH",
+	"ADDRESS_HEADER",
+	"PROTOCOL_HEADER",
+	"HOST_HEADER",
+	"PORT_HEADER",
+	"HEALTHCHECK_PATH",
+	"HEALTHCHECK_TIMEOUT",
+]);
+
+if (env_prefix) {
+	for (const name in process.env) {
+		if (
+			name.startsWith(env_prefix) &&
+			!expected.has(name.slice(env_prefix.length))
+		) {
+			throw new Error(
+				`You should change envPrefix (${env_prefix}) to avoid conflicts with existing environment variables — unexpectedly saw ${name}`,
+			);
+		}
+	}
+}
+
+function parsing_error(name: string, value: string, expected: string): never {
+	throw new Error(
+		`Invalid value for environment variable ${env_prefix + name}: ${JSON.stringify(value)} (expected ${expected})`,
+	);
+}
+
+export function env<T extends string | undefined = undefined>(
+	name: string,
+	fallback?: T,
+): string | T {
+	const prefixed = env_prefix + name;
+	return prefixed in process.env
+		? (process.env[prefixed] as string)
+		: (fallback as T);
+}
+
+const BOOLEANS: Record<string, boolean> = {
+	1: true,
+	true: true,
+	yes: true,
+	on: true,
+	0: false,
+	false: false,
+	no: false,
+	off: false,
+};
+
+export function boolean_env<T extends boolean | undefined = undefined>(
+	name: string,
+	fallback?: T,
+): boolean | T {
+	const value = env(name);
+	if (value === undefined) return fallback as T;
+	return (
+		BOOLEANS[value.toLowerCase()] ?? parsing_error(name, value, "a boolean")
+	);
+}
+
+export function number_env<T extends number | undefined = undefined>(
+	name: string,
+	fallback?: T,
+	limits: { min?: number; max?: number } = {},
+): number | T {
+	const value = env(name);
+	if (value === undefined) return fallback as T;
+	if (!/^\d+$/.test(value)) {
+		parsing_error(name, value, "a non-negative integer");
+	}
+
+	const number = Number(value);
+	if (
+		!Number.isSafeInteger(number) ||
+		number < (limits.min ?? 0) ||
+		number > (limits.max ?? Number.POSITIVE_INFINITY)
+	) {
+		const range =
+			limits.max === undefined
+				? `at least ${limits.min ?? 0}`
+				: `between ${limits.min ?? 0} and ${limits.max}`;
+		parsing_error(name, value, `an integer ${range}`);
+	}
+
+	return number;
+}
+
+export function bytes_env<T extends number | undefined = undefined>(
+	name: string,
+	fallback?: T,
+): number | T {
+	const value = env(name);
+	if (value === undefined) return fallback as T;
+	// adapter-node documents Infinity as the value that disables the limit
+	if (value === "Infinity") return Number.POSITIVE_INFINITY;
+	if (!/^(?:\d+(?:\.\d*)?|\.\d+)(?:[KMG])?$/i.test(value)) {
+		parsing_error(
+			name,
+			value,
+			"a non-negative number with an optional K, M, or G suffix, or Infinity",
+		);
+	}
+
+	const suffix = value.at(-1)?.toUpperCase() as string;
+	const multiplier =
+		(
+			{ K: 1024, M: 1024 * 1024, G: 1024 * 1024 * 1024 } as Record<
+				string,
+				number
+			>
+		)[suffix] ?? 1;
+	const number =
+		Number(multiplier === 1 ? value : value.slice(0, -1)) * multiplier;
+
+	if (!Number.isSafeInteger(number)) {
+		parsing_error(name, value, "a non-negative number of whole bytes");
+	}
+
+	return number;
+}

package/dist/kit3/templates/handler.ts

@@ -0,0 +1,135 @@
+import { app_dir, base, env_prefix, origin } from "MANIFEST";
+import { server_assets } from "ROUTES";
+import { server } from "SERVER";
+import type { Server as BunServer } from "bun";
+import { env, number_env } from "./env.ts";
+
+const address_header = env("ADDRESS_HEADER", "").toLowerCase();
+const protocol_header = env("PROTOCOL_HEADER", "").toLowerCase();
+const host_header = env("HOST_HEADER", "").toLowerCase();
+const port_header = env("PORT_HEADER", "").toLowerCase();
+const xff_depth = number_env("XFF_DEPTH", 1, { min: 1 });
+
+await server.init({
+	env: Bun.env as Record<string, string>,
+	read: (file) => server_assets.get(file)?.stream() ?? null,
+});
+
+/** The Bun-native SvelteKit request handler used by the generated server. */
+export async function handler(
+	request: Request,
+	bun_server: BunServer<undefined>,
+): Promise<Response> {
+	const normalized_request = normalize_request(request);
+	if (normalized_request instanceof Response) return normalized_request;
+
+	const response = await server.respond(normalized_request, {
+		platform: { server: bun_server },
+		getClientAddress: () => get_client_address(request, bun_server),
+	});
+
+	if (response.headers.get("content-type")?.startsWith("text/event-stream")) {
+		bun_server.timeout(request, 0);
+		response.headers.set("x-accel-buffering", "no");
+	}
+
+	return response;
+}
+
+/** Rewrites the request onto the public origin the user actually requested. */
+function normalize_request(request: Request): Request | Response {
+	try {
+		// an empty Host header makes request.url relative, so parsing belongs in the try
+		const url = new URL(request.url);
+		const request_origin =
+			same_host_remote_origin(request, url) ||
+			origin ||
+			get_origin(request, url);
+		return request_origin === url.origin
+			? request
+			: new Request(request_origin + url.pathname + url.search, request);
+	} catch (error) {
+		console.error(
+			`Could not determine request origin: ${error instanceof Error ? error.message : String(error)}`,
+		);
+		return new Response("Bad Request", { status: 400 });
+	}
+}
+
+function get_origin(request: Request, url: URL): string {
+	// assume TLS terminates upstream, like adapter-node; an http origin would fail CSRF checks
+	const protocol = decodeURIComponent(
+		(protocol_header && request.headers.get(protocol_header)) || "https",
+	);
+	if (!/^https?$/i.test(protocol)) {
+		throw new Error(
+			`The ${protocol_header} header specified ${protocol} which is an invalid protocol scheme. It should only contain the protocol scheme (e.g. \`https\`)`,
+		);
+	}
+
+	const host =
+		(host_header && request.headers.get(host_header)) ||
+		(request.headers.get("host") ?? url.host);
+	if (!host) {
+		throw new Error(
+			`Could not determine host from the ${host_header ? `${host_header} or ` : ""}host header`,
+		);
+	}
+
+	const port = port_header ? request.headers.get(port_header) : null;
+	if (port && Number.isNaN(+port)) {
+		throw new Error(
+			`The ${port_header} header specified ${port} which is an invalid port because it is not a number. The value should only contain the port number (e.g. 443)`,
+		);
+	}
+
+	// canonicalized so the caller's comparison with url.origin matches (case, default ports)
+	return new URL(`${protocol}://${host}${port ? `:${port}` : ""}`).origin;
+}
+
+function get_client_address(
+	request: Request,
+	bun_server: BunServer<undefined>,
+): string {
+	if (!address_header) {
+		// requestIP() is null over unix sockets; undefined matches adapter-node
+		return bun_server.requestIP(request)?.address as string;
+	}
+
+	const value = request.headers.get(address_header);
+	if (value === null) {
+		throw new Error(
+			`Address header was specified with ${env_prefix}ADDRESS_HEADER=${address_header} but is absent from request`,
+		);
+	}
+	if (address_header !== "x-forwarded-for") return value;
+
+	const addresses = value.split(",");
+	if (xff_depth > addresses.length) {
+		throw new Error(
+			`${env_prefix}XFF_DEPTH is ${xff_depth}, but only found ${addresses.length} addresses`,
+		);
+	}
+	return (addresses[addresses.length - xff_depth] as string).trim();
+}
+
+// Remote function calls are CSRF-checked against the request origin. When the
+// browser's Origin header matches the Host, use it instead of `paths.origin`.
+function same_host_remote_origin(request: Request, url: URL) {
+	const request_origin = request.headers.get("origin");
+	if (
+		!request_origin ||
+		!url.pathname.startsWith(`${base}/${app_dir}/remote/`)
+	) {
+		return null;
+	}
+	try {
+		const parsed = new URL(request_origin);
+		const host =
+			(host_header && request.headers.get(host_header)) ||
+			request.headers.get("host");
+		return parsed.host === host ? parsed.origin : null;
+	} catch {
+		return null;
+	}
+}

package/dist/kit3/templates/healthcheck.ts

@@ -0,0 +1,31 @@
+import { healthcheck_path } from "MANIFEST";
+import server_options from "SERVER_OPTIONS";
+import process from "node:process";
+import { env, number_env } from "./env.ts";
+
+const unix = env("SOCKET_PATH", server_options.unix);
+const timeout = number_env("HEALTHCHECK_TIMEOUT", 2000);
+const path = env("HEALTHCHECK_PATH", healthcheck_path || "/_health");
+
+// a server bound to a wildcard address is reached over loopback
+const raw_host = env("HOST", server_options.hostname) ?? "";
+const host = ["", "0.0.0.0", "::"].includes(raw_host) ? "127.0.0.1" : raw_host;
+const port = env("PORT", server_options.port?.toString()) ?? 3000;
+
+const url = unix
+	? `http://localhost${path}`
+	: `http://${host.includes(":") ? `[${host}]` : host}:${port}${path}`;
+
+try {
+	const response = await fetch(url, {
+		signal: AbortSignal.timeout(timeout),
+		...(unix ? { unix } : {}),
+	});
+	if (!response.ok) throw new Error(`status ${response.status}`);
+	process.exit(0);
+} catch (error) {
+	console.error(
+		`unhealthy: ${url} -> ${error instanceof Error ? error.message : String(error)}`,
+	);
+	process.exit(1);
+}

package/dist/kit3/templates/index.ts

@@ -0,0 +1,114 @@
+import { healthcheck_path } from "MANIFEST";
+import { routes } from "ROUTES";
+import server_options from "SERVER_OPTIONS";
+import fs from "node:fs";
+import process from "node:process";
+import type { Serve } from "bun";
+import { boolean_env, bytes_env, env, number_env } from "./env.ts";
+import { handler } from "./handler.ts";
+
+// nothing enforces `engines.bun` at install time, and the build may have run on a newer Bun.
+// order() rather than satisfies(): a range would reject canary builds such as 1.5.0-canary.1
+if (Bun.semver.order(Bun.version, "1.4.0") < 0) {
+	throw new Error(
+		`@orochibraru/svelte-smol requires Bun 1.4 or newer, but this is Bun ${Bun.version}`,
+	);
+}
+
+const options = { ...server_options } as Serve.Options<undefined, string>;
+
+const unix = env("SOCKET_PATH", options.unix);
+
+if (unix) {
+	options.unix = unix;
+	delete options.hostname;
+	delete options.port;
+	delete options.reusePort;
+	delete options.ipv6Only;
+
+	// an unclean shutdown leaves the socket file behind and the next listen would
+	// fail with EADDRINUSE; the zero-size check (same heuristic as adapter-node)
+	// avoids deleting a regular file that happens to sit at this path
+	try {
+		if (fs.statSync(unix).size === 0) fs.rmSync(unix);
+	} catch {
+		// ignore
+	}
+} else {
+	delete options.unix;
+	options.hostname = env("HOST", options.hostname);
+	// always set an explicit port: left undefined, Bun.serve reads the unprefixed
+	// BUN_PORT/PORT/NODE_PORT itself, bypassing envPrefix isolation
+	options.port = env("PORT", options.port?.toString()) ?? 3000;
+	options.reusePort = boolean_env("REUSE_PORT", options.reusePort);
+	options.ipv6Only = boolean_env("IPV6_ONLY", options.ipv6Only);
+}
+
+// not IDLE_TIMEOUT: that name means idle-shutdown seconds on adapter-node, and a
+// carried-over value would crash on the 255 cap or silently kill slow requests
+options.idleTimeout = number_env(
+	"CONNECTION_IDLE_TIMEOUT",
+	options.idleTimeout,
+	{ max: 255 },
+);
+options.development =
+	boolean_env("DEVELOPMENT") ?? options.development ?? false;
+options.maxRequestBodySize = bytes_env(
+	"BODY_SIZE_LIMIT",
+	options.maxRequestBodySize ?? 512 * 1024,
+);
+
+const shutdown_timeout = number_env("SHUTDOWN_TIMEOUT", 30);
+
+options.fetch = handler;
+options.routes = healthcheck_path
+	? {
+			...routes,
+			[healthcheck_path]: {
+				GET: () =>
+					Response.json(
+						{ status: "ok", uptime: Math.round(process.uptime()) },
+						{ headers: { "cache-control": "no-store" } },
+					),
+			},
+		}
+	: routes;
+
+const server = Bun.serve(options);
+
+console.log(unix ? `Listening on ${unix}` : `Listening on ${server.url}`);
+
+let shutting_down = false;
+
+async function graceful_shutdown(reason: "SIGINT" | "SIGTERM") {
+	if (shutting_down) return process.exit(1);
+	shutting_down = true;
+
+	if (server.pendingRequests !== 0) {
+		console.log(
+			`Waiting for ${server.pendingRequests} requests to finish before shutting down...\n` +
+				"Press Ctrl+C again to force shutdown.",
+		);
+	}
+
+	// stop() waits for in-flight requests, and an open event stream is one forever,
+	// so race the drain against the deadline. The timer must stay referenced: a
+	// draining server no longer holds the event loop open on its own
+	let deadline: ReturnType<typeof setTimeout> | undefined;
+	const drained = await Promise.race([
+		server.stop().then(() => true),
+		new Promise<boolean>((resolve) => {
+			deadline = setTimeout(() => resolve(false), shutdown_timeout * 1000);
+		}),
+	]);
+	clearTimeout(deadline);
+
+	// force-close aborts the in-flight handlers, so shutdown listeners do not tear
+	// down resources those handlers still hold
+	if (!drained) await server.stop(true);
+
+	process.emit("sveltekit:shutdown" as "exit", reason as never);
+}
+
+process.on("SIGTERM", () => graceful_shutdown("SIGTERM"));
+process.on("SIGINT", () => graceful_shutdown("SIGINT"));

package/dist/kit3/templates/routes-util.ts

@@ -0,0 +1,207 @@
+import { app_dir, base, embed } from "MANIFEST";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import type { BunRequest, Serve } from "bun";
+
+type RouteHandler = Serve.Routes<undefined, string>[string];
+type AssetMeta = { hash: string; mtime: number; br?: boolean; gz?: boolean };
+
+// not Bun.main: when the built server is imported from a wrapper script rather than
+// run directly, Bun.main is the wrapper and every asset path resolves wrong
+const dir = path.dirname(fileURLToPath(import.meta.url));
+
+/** Embedded assets are imported by identity path; on-disk assets live next to this module. */
+function resolve_file(subdir: string, filename: string) {
+	return embed ? filename : path.resolve(dir, subdir, filename);
+}
+
+const CONTENT_ENCODING = { br: "br", gz: "gzip" };
+
+// the URL Standard's path percent-encode set, plus `%` and `\` so they stay literal
+// biome-ignore lint/suspicious/noControlCharactersInRegex: control characters are part of the encode set
+const ESCAPED_PATH_CHAR = /[\u0000-\u001f\u007f-\u{10ffff} "#<>?`{}%\\]/gu;
+
+/**
+ * WHATWG path serialization: the exact bytes user agents put on the wire, because
+ * Bun matches route keys against the raw request pathname.
+ */
+function encode_pathname(pathname: string) {
+	return pathname.replace(ESCAPED_PATH_CHAR, (char) =>
+		encodeURIComponent(char),
+	);
+}
+
+/** Registers a path both as user agents send it and fully percent-encoded. */
+function route_paths(pathname: string) {
+	const minimal = encode_pathname(pathname);
+	const full = pathname.split("/").map(encodeURIComponent).join("/");
+	return minimal === full ? [minimal] : [minimal, full];
+}
+
+function to_paths(url: string) {
+	return route_paths(path.posix.join(base, url));
+}
+
+function to_directory_paths(url: string) {
+	const directory = `${path.posix.join(base, url).replace(/\/$/, "")}/`;
+	const paths = route_paths(directory);
+	if (directory !== "/") {
+		paths.push(...route_paths(directory.slice(0, -1)));
+	}
+	return paths;
+}
+
+/**
+ * If-None-Match takes precedence over If-Modified-Since (RFC 9110 §13.1.3);
+ * dates compare at whole-second precision because HTTP dates have none finer.
+ */
+function is_fresh(request: Request, etag: string, mtime: number) {
+	const header = request.headers.get("if-none-match");
+	if (header !== null) {
+		return header
+			.split(",")
+			.some((value) => ["*", etag].includes(value.trim().replace(/^W\//, "")));
+	}
+
+	const since = Date.parse(request.headers.get("if-modified-since") ?? "");
+	return (
+		Number.isFinite(since) &&
+		Math.trunc(mtime / 1000) <= Math.trunc(since / 1000)
+	);
+}
+
+function negotiate(accept: string | null, meta: AssetMeta): "br" | "gz" | null {
+	if (accept === null || (!meta.br && !meta.gz)) return null;
+
+	const accepted = new Set<string>();
+	for (const part of accept.split(",")) {
+		const [name = "", ...params] = part.trim().toLowerCase().split(";");
+		if (params.some((param) => /^q=0(\.0*)?$/.test(param.trim()))) continue;
+		accepted.add(name.trim());
+	}
+
+	if (meta.br && (accepted.has("br") || accepted.has("*"))) return "br";
+	if (meta.gz && (accepted.has("gzip") || accepted.has("*"))) return "gz";
+	return null;
+}
+
+function route_entries(
+	paths: string[],
+	route: RouteHandler,
+): Array<[string, RouteHandler]> {
+	return paths.map((route_path) => [route_path, route]);
+}
+
+/** Serves one file with its build-time validator and precompressed variants. */
+function file_route(
+	file: string,
+	meta: AssetMeta,
+	extra_headers: Record<string, string> = {},
+): RouteHandler {
+	const content_type = Bun.file(file).type;
+	const last_modified = new Date(meta.mtime).toUTCString();
+
+	const handler = (request: BunRequest) => {
+		// Bun serializes Range itself for file bodies; ranges apply to the identity representation
+		const encoding =
+			request.headers.get("range") === null
+				? negotiate(request.headers.get("accept-encoding"), meta)
+				: null;
+		const etag =
+			encoding === null ? `"${meta.hash}"` : `"${meta.hash}-${encoding}"`;
+
+		const response_headers: Record<string, string> = {
+			"content-type": content_type,
+			...extra_headers,
+			etag,
+			"last-modified": last_modified,
+		};
+		if (meta.br || meta.gz) response_headers.vary = "accept-encoding";
+
+		if (is_fresh(request, etag, meta.mtime)) {
+			return new Response(null, { status: 304, headers: response_headers });
+		}
+
+		let body_file = file;
+		if (encoding !== null) {
+			response_headers["content-encoding"] = CONTENT_ENCODING[encoding];
+			body_file = `${file}.${encoding}`;
+		}
+		return new Response(Bun.file(body_file), { headers: response_headers });
+	};
+
+	return { GET: handler };
+}
+
+export function client_asset(
+	url: string,
+	filename: string | undefined,
+	meta: AssetMeta,
+) {
+	const immutable = url.startsWith(`${app_dir}/immutable/`);
+	const route = file_route(
+		resolve_file("client", filename ?? url),
+		meta,
+		immutable ? { "cache-control": "public,max-age=31536000,immutable" } : {},
+	);
+
+	const paths = to_paths(url);
+	if (url.endsWith("/index.html") || url === "index.html") {
+		paths.push(...to_directory_paths(url.slice(0, -"index.html".length)));
+	} else if (url.endsWith(".html")) {
+		// sirv also serves `page.html` at `/page`
+		paths.push(...to_paths(url.slice(0, -".html".length)));
+	}
+
+	return route_entries(paths, route);
+}
+
+export function server_asset(url: string, filename = url) {
+	return Bun.file(resolve_file("client", filename));
+}
+
+export function prerendered_asset(
+	url: string,
+	filename: string | undefined,
+	meta: AssetMeta,
+) {
+	const route = file_route(resolve_file("prerendered", filename ?? url), meta);
+	return route_entries(to_paths(url), route);
+}
+
+export function prerendered_page(
+	url: string,
+	filename: string,
+	meta: AssetMeta,
+) {
+	const route = file_route(resolve_file("prerendered", filename), meta);
+	// path already contains base, no need to add it here
+	const entries = route_entries(route_paths(url), route);
+
+	const inverted = url.endsWith("/") ? url.slice(0, -1) : `${url}/`;
+	if (inverted) {
+		const canonical = encode_pathname(url);
+		entries.push(
+			...route_entries(route_paths(inverted), {
+				GET: (req: BunRequest) => {
+					const location = canonical + new URL(req.url).search;
+					return new Response(null, { status: 308, headers: { location } });
+				},
+			}),
+		);
+	}
+
+	return entries;
+}
+
+export function prerendered_redirect(
+	url: string,
+	status: number,
+	location: string,
+) {
+	const route = {
+		GET: new Response(null, { status, headers: { location } }),
+	};
+	// path already contains base, no need to add it here
+	return route_entries(route_paths(url), route);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@orochibraru/svelte-smol",
-	"version": "1.8.0",
+	"version": "1.8.2",
 	"type": "module",
 	"main": "./dist/index.js",
 	"keywords": [
@@ -33,32 +33,26 @@
 		"access": "public"
 	},
 	"scripts": {
-		"build": "rm -rf dist && tsc -p tsconfig.build.json && cp -R templates dist/templates",
+		"build": "rm -rf dist && tsc -p tsconfig.build.json && cp -R kit2/templates dist/kit2/templates && cp -R kit3/templates dist/kit3/templates",
 		"prepack": "bun run build",
-		"typecheck": "tsc --noEmit -p tsconfig.json",
+		"typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p kit2 && tsc --noEmit -p kit3",
 		"test": "bun test index.test.ts",
-		"test:integration": "bun test test/integration.test.ts",
+		"test:integration": "bun test integration",
 		"lint": "biome check .",
 		"lint:fix": "biome check --write .",
-		"release": "semantic-release",
-		"release:dry": "semantic-release --dry-run --no-ci",
 		"prepare": "husky"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.5.11",
-		"@semantic-release/github": "^12.0.9",
-		"@semantic-release/npm": "^13.1.5",
 		"@sveltejs/kit": "^2.70.3",
 		"@sveltejs/vite-plugin-svelte": "^7.3.0",
 		"@types/bun": "^1.4.0",
-		"conventional-changelog-conventionalcommits": "^8",
 		"husky": "^9.1.7",
-		"semantic-release": "^25.0.9",
 		"svelte": "^5.56.10",
 		"typescript": "^7",
 		"vite": "^8.2.2"
 	},
 	"peerDependencies": {
-		"@sveltejs/kit": "^2.0.0"
+		"@sveltejs/kit": "^2.0.0 || ^3.0.0-next.0"
 	}
 }