@skgo/sveltekit-adapter 0.10.1 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@skgo/sveltekit-adapter",
-	"version": "0.10.1",
+	"version": "0.12.0",
 	"description": "SvelteKit adapter for skgo: builds a frontend that a Go binary renders and answers",
 	"keywords": [
 		"adapter",
@@ -32,10 +32,12 @@
 		"skgo-adapter/app-paths.js",
 		"skgo-adapter/app-server.js",
 		"skgo-adapter/entry.js",
+		"skgo-adapter/env-private.js",
 		"skgo-adapter/env.js",
 		"skgo-adapter/generated.js",
 		"skgo-adapter/identity.js",
-		"skgo-adapter/polyfill.js"
+		"skgo-adapter/polyfill.js",
+		"skgo-adapter/prerender-csp.js"
 	],
 	"peerDependencies": {
 		"@sveltejs/kit": "^3.0.0-next.0"

package/skgo-adapter/env-private.js

@@ -0,0 +1,48 @@
+import { resolve } from 'node:path';
+import { realpathSync } from 'node:fs';
+
+function canonical(file) {
+	try { return realpathSync.native(file); } catch { return file; }
+}
+
+// Vite's raw/transform middleware can serve generated server files directly.
+// Deny them before those middleware run, including absolute /@fs requests.
+export function protectEnvironmentFiles({ root, kitOut, output, base = '/', token }) {
+	const files = [
+		resolve(root, '.svelte-kit/skgo-env-values.js'),
+		resolve(root, '.svelte-kit/skgo-env-runtime.json'),
+		resolve(root, kitOut, 'generated/build/env/config.js'),
+		resolve(root, kitOut, 'generated/dev/env/config.js'),
+		resolve(root, output, 'env.json')
+	].map(canonical);
+	const directories = [
+		resolve(root, kitOut, 'output/server'),
+		resolve(root, kitOut, 'generated/build/env/private'),
+		resolve(root, kitOut, 'generated/dev/env/private'),
+		resolve(root, output, 'ssr')
+	].map(canonical);
+	return (req, res, next) => {
+		let path;
+		try { path = decodeURIComponent((req.url || '').split('?')[0]); }
+		catch { res.statusCode = 400; res.end('Bad request'); return; }
+		if (base !== '/' && path.startsWith(base)) path = '/' + path.slice(base.length);
+		if (token && /^\/__skgo_dev\/(?:module|styles)(?:\/|$)/.test(path) && req.headers['x-skgo-dev-token'] !== token) {
+			res.statusCode = 403; res.end('Forbidden'); return;
+		}
+		let file;
+		if (path.startsWith('/@id/')) {
+			const id = path.slice(5).replace('__x00__', '\0');
+			if (id === '$app/env/private' || id === '#app/env/private' || /<sveltekit:generated>\/env\/(?:config\.js|private(?:\/|$))/.test(id)) {
+				res.statusCode = 403; res.end('Forbidden'); return;
+			}
+			file = resolve(id);
+		} else {
+			file = path.startsWith('/@fs/') ? resolve(path.slice(4)) : resolve(root, '.' + path);
+		}
+		file = canonical(file);
+		if (files.includes(file) || directories.some(dir => file === dir || file.startsWith(dir + '/'))) {
+			res.statusCode = 403; res.end('Forbidden'); return;
+		}
+		next();
+	};
+}

package/skgo-adapter/env.js

@@ -25,7 +25,10 @@
  */
 
 import { createRequire } from 'node:module';
-import { existsSync, readdirSync, readFileSync, realpathSync, rmSync, statSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { protectEnvironmentFiles } from './env-private.js';
+import { existsSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, mkdirSync, writeFileSync, chmodSync } from 'node:fs';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
@@ -64,7 +67,7 @@ const { transformSync } = await fromApp('vite/rolldown/experimental');
 // `fetchModule` operates on the app's own `DevEnvironment`, so it has to be
 // the app's copy for the same reason rolldown is: a second module realm's
 // vite does not recognise this one's environments.
-const { fetchModule, isCSSRequest } = await fromApp('vite');
+const { fetchModule, isCSSRequest, loadEnv } = await fromApp('vite');
 
 // These are the same two Kit functions its own dev server calls in
 // `update_manifest`: one derives the route/node graph from the authored tree,
@@ -324,6 +327,11 @@ export function gojaEnvironment() {
 		load: {
 			order: 'pre',
 			handler(id) {
+				if (/\/\.svelte-kit\/skgo-env-(?:values\.js|runtime\.json)(?:\?|$)/.test(id)) {
+					throw new Error('skgo: environment build inputs are private');
+				}
+				const environment = goEnvironmentModule(id);
+				if (environment !== null) return environment;
 				if (!id.startsWith(PREFIX)) return null;
 				const make = sources[id.slice(PREFIX.length)];
 				if (!make) throw new Error('skgo: no virtual module ' + id.slice(PREFIX.length));
@@ -926,6 +934,11 @@ export function gojaDevEnvironment({ outDir = '.svelte-kit' } = {}) {
 		load: {
 			order: 'pre',
 			handler(id) {
+				if (/\/\.svelte-kit\/skgo-env-(?:values\.js|runtime\.json)(?:\?|$)/.test(id)) {
+					throw new Error('skgo: environment build inputs are private');
+				}
+				const environment = goEnvironmentModule(id);
+				if (environment !== null) return environment;
 				if (!id.startsWith(PREFIX)) return null;
 				const make = sources[id.slice(PREFIX.length)];
 				if (!make) throw new Error('skgo: no virtual module ' + id.slice(PREFIX.length));
@@ -1056,3 +1069,75 @@ function errorText(e) {
 	if (e instanceof Error) return e.stack ?? e.message;
 	return String(e);
 }
+
+
+// Values are validated by Go once before Kit loads its environment declaration.
+// This must be a real file: Kit imports env.ts in a separate Vite server with
+// configFile:false, where this adapter's virtual modules do not exist.
+export function goEnvironmentValues(output = 'build') {
+	let token = '';
+	let kitOut = '.svelte-kit';
+	let fields = [];
+	let values = {};
+	return {
+		plugin: {
+			name: 'skgo-environment-values',
+			configureServer(server) {
+				// A server-only build input can contain private values. Vite's
+				// filesystem endpoint must not make it downloadable in development.
+				server.middlewares.use(protectEnvironmentFiles({
+					root: server.config.root, kitOut, output, base: server.config.base, token
+				}));
+			},
+			configResolved(config) {
+				const schema = join(config.root, 'skgo.env.json');
+				if (!existsSync(schema)) return;
+				fields = JSON.parse(readFileSync(schema, 'utf8')).fields;
+				const setup = config.plugins.find((p) => p.name === 'vite-plugin-sveltekit-setup');
+				const kit = setup?.api?.options;
+				if (!kit) throw new Error('skgo: Kit environment configuration is unavailable');
+				kitOut = kit.outDir;
+				const raw = loadEnv(config.mode, resolve(config.root, kit.env.dir), '');
+				// Pass only declared values; diagnostics never echo the full process env.
+				const input = Object.fromEntries(fields.filter((f) => f.name in raw).map((f) => [f.name, raw[f.name]]));
+				try {
+					values = JSON.parse(execFileSync('go', ['tool', 'skgo', 'env', '--schema', schema], {
+						cwd: config.root, input: JSON.stringify(input), encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe']
+					}));
+				} catch (error) {
+					throw new Error('skgo: Go environment validation failed\n' + String(error.stderr || error.message));
+				}
+				const file = join(config.root, '.svelte-kit/skgo-env-values.js');
+				mkdirSync(dirname(file), { recursive: true });
+				writeFileSync(file, 'export const values = ' + JSON.stringify(values) + ';\n', { mode: 0o600 });
+				chmodSync(file, 0o600);
+
+				if (config.command === 'serve') {
+					token = randomBytes(32).toString('hex');
+					const artifact = { token, fields, static: Object.fromEntries(fields.filter((f) => f.static && f.name in values).map((f) => [f.name, values[f.name]])), values: input };
+					const runtimeFile = join(config.root, '.svelte-kit/skgo-env-runtime.json');
+					writeFileSync(runtimeFile, JSON.stringify(artifact), { mode: 0o600 });
+					chmodSync(runtimeFile, 0o600);
+				}
+			},
+		},
+		artifact() {
+			return { fields, static: Object.fromEntries(fields.filter((f) => f.static && f.name in values).map((f) => [f.name, values[f.name]])) };
+		}
+	};
+}
+
+// Kit's public/private modules snapshot these properties during evaluation.
+// Go installs the snapshot before loading any application module. In particular,
+// importing Kit's original config here would re-run JavaScript validators and
+// bake the development/build environment into newly-created renderer runtimes.
+function goEnvironmentModule(id) {
+	if (!existsSync(join(process.cwd(), 'skgo.env.json'))) return null;
+	if (!/\/generated\/(?:build|dev)\/env\/config\.js$/.test(id.replaceAll('\\', '/'))) return null;
+	return `const snapshot = globalThis.__skgo_environment || {};
+export const dynamic_private_env = snapshot.private || {};
+export const explicit_public_env = snapshot.public || {};
+export const rendered_env = snapshot.dynamicPublic || {};
+export const variables = {};
+export function set_env() {}`;
+}

package/skgo-adapter/generated.js

@@ -10,7 +10,7 @@
  * first-class.
  *
  * @param {any} parsed the parsed contents of `skgo.remotes.json`
- * @returns {{ remotes: string[], loads: string[], actions: string[], endpoints: Record<string, string[]> }}
+ * @returns {{ remotes: string[], loads: string[], actions: string[], endpoints: Record<string, string[]>, prerender?: { root: string, package: string } }}
  */
 export function validateGenerated(parsed) {
 	if (!Array.isArray(parsed.remotes)) {
@@ -37,6 +37,13 @@ export function validateGenerated(parsed) {
 			);
 		}
 	}
+	if (parsed.loads.length > 0 && (
+		typeof parsed.prerender?.root !== 'string' ||
+		typeof parsed.prerender?.package !== 'string' ||
+		!parsed.prerender.package.startsWith('./')
+	)) {
+		throw new Error('skgo: generated Go loads need a build-time prerender command; run `go generate ./...`.');
+	}
 	if (!Array.isArray(parsed.actions)) {
 		throw new Error('skgo: skgo.remotes.json has no `actions` array. Run `go generate ./...` before building the frontend.');
 	}
@@ -57,7 +64,7 @@ export function validateGenerated(parsed) {
 			);
 		}
 	}
-	return { remotes: parsed.remotes, loads: parsed.loads, actions: parsed.actions, endpoints: parsed.endpoints };
+	return { remotes: parsed.remotes, loads: parsed.loads, actions: parsed.actions, endpoints: parsed.endpoints, prerender: parsed.prerender };
 }
 
 /**

package/skgo-adapter/prerender-csp.js

@@ -0,0 +1,19 @@
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+
+// Kit writes streamed promise settlements after the closing HTML tag. Its
+// prerendered CSP meta tag hashes the boot script but does not hash those later
+// inline scripts. Add only the hashes of scripts present in the finished file.
+export function authorizePrerenderedScripts(file) {
+	const html = readFileSync(file, 'utf8');
+	const meta = /<meta http-equiv="content-security-policy" content="([^"]*)">/i.exec(html);
+	if (!meta) return;
+	const additions = [];
+	for (const [, attributes, body] of html.matchAll(/<script([^>]*)>([\s\S]*?)<\/script>/gi)) {
+		if (/\bsrc\s*=/.test(attributes)) continue;
+		const hash = `'sha256-${createHash('sha256').update(body).digest('base64')}'`;
+		if (!meta[1].includes(hash)) additions.push(hash);
+	}
+	if (!additions.length) return;
+	writeFileSync(file, html.replace(meta[0], meta[0].replace(meta[1], `${meta[1]} ${[...new Set(additions)].join(' ')}`)));
+}

package/skgo-adapter.js

@@ -1,5 +1,6 @@
 import {
 	existsSync,
+	mkdtempSync,
 	mkdirSync,
 	readdirSync,
 	readFileSync,
@@ -8,11 +9,33 @@ import {
 	statSync,
 	writeFileSync
 } from 'node:fs';
+import { spawn } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { gojaDevEnvironment, gojaEnvironment, nodeTable, SSR_TARGET } from './skgo-adapter/env.js';
+import { gojaDevEnvironment, gojaEnvironment, goEnvironmentValues, nodeTable, SSR_TARGET } from './skgo-adapter/env.js';
 import { identity } from './skgo-adapter/identity.js';
 import { checkEndpoints, validateGenerated } from './skgo-adapter/generated.js';
+import { authorizePrerenderedScripts } from './skgo-adapter/prerender-csp.js';
+
+function runPrerenderCommand(command, args, cwd, input = '') {
+	return new Promise((resolve, reject) => {
+		const child = spawn(command, args, { cwd, stdio: ['pipe', 'pipe', 'pipe'] });
+		let stdout = '';
+		let stderr = '';
+		child.stdout.setEncoding('utf8');
+		child.stderr.setEncoding('utf8');
+		child.stdout.on('data', (chunk) => (stdout += chunk));
+		child.stderr.on('data', (chunk) => (stderr += chunk));
+		child.on('error', reject);
+		child.on('close', (code) => {
+			if (code === 0) resolve(stdout);
+			else reject(new Error(`skgo prerender command exited ${code}: ${stderr}`));
+		});
+		child.stdin.end(input);
+	});
+}
 
 // Which skgo this adapter is: the version this package was published at, and a
 // fingerprint taken over its own files. The Go that reads the manifest below
@@ -56,26 +79,114 @@ export default function skgo({ out = 'build', precompress = true } = {}) {
 	// runs, so the plugin that declares the environment has to exist here; the
 	// build itself waits until adapt() knows the node table.
 	const goja = gojaEnvironment();
+	const environment = goEnvironmentValues(out);
+	let prerenderBinary;
+	let prerenderRoot;
+	let prerenderBuild;
+	let unflatten;
+	let transportDecoders = {};
+	async function buildPrerenderBinary() {
+		if (!prerenderBuild) {
+			prerenderBuild = (async () => {
+				const generated = readGenerated();
+				if (!generated.prerender) throw new Error('skgo: generated prerender command is missing');
+				prerenderRoot = resolve(process.cwd(), generated.prerender.root);
+				const dir = mkdtempSync(join(tmpdir(), 'skgo-prerender-'));
+				prerenderBinary = join(dir, 'loads');
+				await runPrerenderCommand('go', ['build', '-o', prerenderBinary, generated.prerender.package], prerenderRoot);
+				process.on('exit', () => rmSync(dir, { recursive: true, force: true }));
+				const fromKit = createRequire(realpathSync(join(process.cwd(), 'node_modules/@sveltejs/kit/package.json')));
+				({ unflatten } = await import(pathToFileURL(fromKit.resolve('devalue')).href));
+				const hooks = join(process.cwd(), '.svelte-kit/output/server/entries/hooks.universal.js');
+				if (existsSync(hooks)) {
+					const { transport = {} } = await import(pathToFileURL(hooks).href);
+					transportDecoders = Object.fromEntries(Object.entries(transport).map(([key, entry]) => [key, entry.decode]));
+				}
+			})();
+		}
+		await prerenderBuild;
+	}
 
 	return {
 		name: 'skgo',
+		emulate() {
+			return {
+				platform: () => ({
+					async skgoPrerenderLoad(module, event) {
+						await buildPrerenderBinary();
+						const headers = Object.fromEntries(
+							[...event.request.headers].map(([name, value]) => [name, [value]])
+						);
+						const cookies = event.cookies.getAll();
+						if (cookies.length) {
+							headers.cookie = [cookies.map(({ name, value }) => `${encodeURIComponent(name)}=${encodeURIComponent(value)}`).join('; ')];
+						}
+						const request = {
+							module,
+							url: event.url.href,
+							routeId: event.route.id,
+							params: Object.fromEntries(Object.entries(event.params)),
+							parent: await event.parent(),
+							headers
+						};
+						const raw = await runPrerenderCommand(prerenderBinary, [], prerenderRoot, JSON.stringify(request));
+						const answer = JSON.parse(raw);
+						for (const [name, values] of Object.entries(answer.headers ?? {})) {
+							event.setHeaders({ [name]: values.join(', ') });
+						}
+						for (const cookie of answer.cookies ?? []) {
+							event.cookies.set(cookie.name, cookie.value, {
+								path: cookie.path,
+								...(cookie.domain ? { domain: cookie.domain } : {}),
+								...(cookie.maxAge ? { maxAge: cookie.maxAge } : {}),
+								httpOnly: cookie.httpOnly,
+								secure: cookie.secure,
+								sameSite: ['lax', 'lax', 'strict', 'none'][cookie.sameSite] ?? 'lax'
+							});
+						}
+						if (answer.data) {
+							const pending = new Map();
+							const revivers = {
+								...transportDecoders,
+								Promise: (id) => {
+									let resolve;
+									let reject;
+									const promise = new Promise((yes, no) => { resolve = yes; reject = no; });
+									pending.set(id, { promise, resolve, reject });
+									return promise;
+								}
+							};
+							answer.data = unflatten(answer.data, revivers);
+							for (const chunk of answer.chunks ?? []) {
+								const deferred = pending.get(chunk.id);
+								if (!deferred) throw new Error(`skgo: unknown prerender deferred id ${chunk.id}`);
+								if (chunk.error) deferred.reject(new Error(chunk.error));
+								else deferred.resolve(unflatten(chunk.data, revivers));
+							}
+						}
+						return answer;
+					}
+				})
+			};
+		},
 		// Both halves of the same environment. Kit hands `vite.plugins.post` to
 		// vite unconditionally — it is a member of the plugin array kit returns
 		// whether it is building or serving — so the environment the build
 		// compiles the SSR bundle in is also declared in `vite dev`, where Go
 		// pulls one transformed module at a time out of it instead. Each plugin
 		// states its own `apply`, so only one of them is ever live.
-		vite: { plugins: { post: [goja.plugin, gojaDevEnvironment()] } },
+		vite: { plugins: { post: [environment.plugin, goja.plugin, gojaDevEnvironment()] } },
 		async adapt(builder) {
 			rmSync(out, { force: true, recursive: true });
 
+			write(`${out}/env.json`, JSON.stringify(environment.artifact()));
 			const generated = readGenerated();
 			const { manifest: kit, source } = await readKitManifest(builder);
 			const hashes = checkRemoteHashes(kit, generated.remotes);
 
-			const nodes = await readNodes(builder, source, kit);
+			const { nodes, allServerIds } = await readNodes(builder, source, kit);
 			const serverIds = nodes.map((node) => node.server);
-			checkServerLoads(serverIds, generated.loads, generated.actions);
+			checkServerLoads(allServerIds, generated.loads, generated.actions);
 
 			const endpoints = checkEndpoints(builder, generated.endpoints);
 
@@ -83,6 +194,9 @@ export default function skgo({ out = 'build', precompress = true } = {}) {
 			checkRemoteIds(`${out}/client`, generated.remotes, hashes);
 
 			builder.writePrerendered(`${out}/prerendered`);
+			for (const file of walk(`${out}/prerendered`)) {
+				if (file.endsWith('.html')) authorizePrerenderedScripts(file);
+			}
 			const prerendered = readPrerendered(builder);
 			// The SPA shell is still emitted: it is what a page whose branch turns
 			// SSR off is answered with.
@@ -205,7 +319,7 @@ export default function skgo({ out = 'build', precompress = true } = {}) {
  * halves were never checked against each other. The shape checks themselves
  * live in `skgo-adapter/generated.js`, beside the paths they validate.
  *
- * @returns {{ remotes: string[], loads: string[], actions: string[], endpoints: Record<string, string[]> }}
+ * @returns {{ remotes: string[], loads: string[], actions: string[], endpoints: Record<string, string[]>, prerender?: { root: string, package: string } }}
  */
 function readGenerated() {
 	let raw;
@@ -354,7 +468,7 @@ async function readKitManifest(builder) {
  * @param {import('@sveltejs/kit').Builder} builder
  * @param {string} source kit's generated manifest, as text
  * @param {any} kit the same manifest, imported
- * @returns {Promise<Node[]>}
+ * @returns {Promise<{ nodes: Node[], allServerIds: string[] }>}
  */
 async function readNodes(builder, source, kit) {
 	const dir = join(builder.getServerDirectory(), 'nodes');
@@ -382,6 +496,11 @@ async function readNodes(builder, source, kit) {
 
 	/** @type {Node[]} */
 	const nodes = [];
+	const allServerIds = [];
+	for (const file of files.values()) {
+		const module = await import(pathToFileURL(file).href);
+		if (module.server_id) allServerIds.push(module.server_id);
+	}
 	for (const index of order) {
 		const file = files.get(index);
 		if (!file) {
@@ -402,7 +521,7 @@ async function readNodes(builder, source, kit) {
 		});
 	}
 
-	return nodes;
+	return { nodes, allServerIds };
 }
 
 /**
@@ -645,9 +764,8 @@ function* walk(dir) {
 /**
  * The same check for server loads. Kit decides whether its client asks for
  * `__data.json` at all by looking for a `load` export in the *built*
- * `+*.server.js`, so a stub that did not reach the build is a page whose Go load
- * is never called, and a compiled stub with no Go load behind it is a page whose
- * data nobody answers.
+ * `+*.server.js`. A prerendered leaf is removed from the final manifest, so
+ * check all node modules Kit compiled, including the removed leaves.
  *
  * @param {string[]} nodes
  * @param {string[]} loads