@sveltejs/kit 1.0.0-next.344 → 1.0.0-next.347

package/dist/node/polyfills.js

@@ -1,10 +1,13 @@
 import http from 'node:http';
 import https from 'node:https';
 import zlib from 'node:zlib';
-import Stream, { PassThrough, pipeline } from 'node:stream';
-import { types, deprecate } from 'node:util';
+import Stream, { PassThrough, pipeline as pipeline$1 } from 'node:stream';
+import { Buffer as Buffer$1 } from 'node:buffer';
+import { types, promisify, deprecate } from 'node:util';
 import { format } from 'node:url';
-import { isIP } from 'net';
+import { isIP } from 'node:net';
+import 'node:fs';
+import 'node:path';
 import { webcrypto } from 'crypto';
 
 var commonjsGlobal = typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};
@@ -64,7 +67,7 @@ function dataUriToBuffer(uri) {
 var ponyfill_es2018 = {exports: {}};
 
 /**
- * web-streams-polyfill v3.2.0
+ * web-streams-polyfill v3.2.1
  */
 
 (function (module, exports) {
@@ -3766,10 +3769,16 @@ var ponyfill_es2018 = {exports: {}};
     const byteLengthSizeFunction = (chunk) => {
         return chunk.byteLength;
     };
-    Object.defineProperty(byteLengthSizeFunction, 'name', {
-        value: 'size',
-        configurable: true
-    });
+    try {
+        Object.defineProperty(byteLengthSizeFunction, 'name', {
+            value: 'size',
+            configurable: true
+        });
+    }
+    catch (_a) {
+        // This property is non-configurable in older browsers, so ignore if this throws.
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/name#browser_compatibility
+    }
     /**
      * A queuing strategy that counts the number of bytes in each chunk.
      *
@@ -3828,10 +3837,16 @@ var ponyfill_es2018 = {exports: {}};
     const countSizeFunction = () => {
         return 1;
     };
-    Object.defineProperty(countSizeFunction, 'name', {
-        value: 'size',
-        configurable: true
-    });
+    try {
+        Object.defineProperty(countSizeFunction, 'name', {
+            value: 'size',
+            configurable: true
+        });
+    }
+    catch (_a) {
+        // This property is non-configurable in older browsers, so ignore if this throws.
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/name#browser_compatibility
+    }
     /**
      * A queuing strategy that counts the number of chunks.
      *
@@ -4319,16 +4334,14 @@ try {
 
 /*! fetch-blob. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */
 
-/** @typedef {import('buffer').Blob} NodeBlob} */
-
 // 64 KiB (same size chrome slice theirs blob into Uint8array's)
 const POOL_SIZE = 65536;
 
-/** @param {(Blob | NodeBlob | Uint8Array)[]} parts */
-async function * toIterator (parts, clone = true) {
+/** @param {(Blob | Uint8Array)[]} parts */
+async function * toIterator (parts, clone) {
   for (const part of parts) {
     if ('stream' in part) {
-      yield * part.stream();
+      yield * (/** @type {AsyncIterableIterator<Uint8Array>} */ (part.stream()));
     } else if (ArrayBuffer.isView(part)) {
       if (clone) {
         let position = part.byteOffset;
@@ -4342,17 +4355,16 @@ async function * toIterator (parts, clone = true) {
       } else {
         yield part;
       }
+    /* c8 ignore next 10 */
     } else {
-      /* c8 ignore start */
       // For blobs that have arrayBuffer but no stream method (nodes buffer.Blob)
-      let position = 0;
-      while (position !== part.size) {
-        const chunk = part.slice(position, Math.min(part.size, position + POOL_SIZE));
+      let position = 0, b = (/** @type {Blob} */ (part));
+      while (position !== b.size) {
+        const chunk = b.slice(position, Math.min(b.size, position + POOL_SIZE));
         const buffer = await chunk.arrayBuffer();
         position += buffer.byteLength;
         yield new Uint8Array(buffer);
       }
-      /* c8 ignore end */
     }
   }
 }
@@ -4362,6 +4374,7 @@ const _Blob = class Blob {
   #parts = []
   #type = ''
   #size = 0
+  #endings = 'transparent'
 
   /**
    * The Blob() constructor returns a new Blob object. The content
@@ -4369,7 +4382,7 @@ const _Blob = class Blob {
    * in the parameter array.
    *
    * @param {*} blobParts
-   * @param {{ type?: string }} [options]
+   * @param {{ type?: string, endings?: string }} [options]
    */
   constructor (blobParts = [], options = {}) {
     if (typeof blobParts !== 'object' || blobParts === null) {
@@ -4396,15 +4409,19 @@ const _Blob = class Blob {
       } else if (element instanceof Blob) {
         part = element;
       } else {
-        part = encoder.encode(element);
+        part = encoder.encode(`${element}`);
       }
 
-      this.#size += ArrayBuffer.isView(part) ? part.byteLength : part.size;
-      this.#parts.push(part);
+      const size = ArrayBuffer.isView(part) ? part.byteLength : part.size;
+      // Avoid pushing empty parts into the array to better GC them
+      if (size) {
+        this.#size += size;
+        this.#parts.push(part);
+      }
     }
 
+    this.#endings = `${options.endings === undefined ? 'transparent' : options.endings}`;
     const type = options.type === undefined ? '' : String(options.type);
-
     this.#type = /^[\x20-\x7E]*$/.test(type) ? type : '';
   }
 
@@ -4470,6 +4487,7 @@ const _Blob = class Blob {
     const it = toIterator(this.#parts, true);
 
     return new globalThis.ReadableStream({
+      // @ts-ignore
       type: 'bytes',
       async pull (ctrl) {
         const chunk = await it.next();
@@ -4601,6 +4619,11 @@ const _File = class File extends Blob$1 {
   get [Symbol.toStringTag] () {
     return 'File'
   }
+
+  static [Symbol.hasInstance] (object) {
+    return !!object && object instanceof Blob$1 &&
+      /^(File)$/.test(object[Symbol.toStringTag])
+  }
 };
 
 /** @type {typeof globalThis.File} */// @ts-ignore
@@ -4743,6 +4766,22 @@ const isAbortSignal = object => {
 	);
 };
 
+/**
+ * isDomainOrSubdomain reports whether sub is a subdomain (or exact match) of
+ * the parent domain.
+ *
+ * Both domains must already be in canonical form.
+ * @param {string|URL} original
+ * @param {string|URL} destination
+ */
+const isDomainOrSubdomain = (destination, original) => {
+	const orig = new URL(original).hostname;
+	const dest = new URL(destination).hostname;
+
+	return orig === dest || orig.endsWith(`.${dest}`);
+};
+
+const pipeline = promisify(Stream.pipeline);
 const INTERNALS$2 = Symbol('Body internals');
 
 /**
@@ -4765,13 +4804,13 @@ class Body {
 			body = null;
 		} else if (isURLSearchParameters(body)) {
 			// Body is a URLSearchParams
-			body = Buffer.from(body.toString());
-		} else if (isBlob(body)) ; else if (Buffer.isBuffer(body)) ; else if (types.isAnyArrayBuffer(body)) {
+			body = Buffer$1.from(body.toString());
+		} else if (isBlob(body)) ; else if (Buffer$1.isBuffer(body)) ; else if (types.isAnyArrayBuffer(body)) {
 			// Body is ArrayBuffer
-			body = Buffer.from(body);
+			body = Buffer$1.from(body);
 		} else if (ArrayBuffer.isView(body)) {
 			// Body is ArrayBufferView
-			body = Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+			body = Buffer$1.from(body.buffer, body.byteOffset, body.byteLength);
 		} else if (body instanceof Stream) ; else if (body instanceof FormData) {
 			// Body is FormData
 			body = formDataToBlob(body);
@@ -4779,12 +4818,12 @@ class Body {
 		} else {
 			// None of the above
 			// coerce to string then buffer
-			body = Buffer.from(String(body));
+			body = Buffer$1.from(String(body));
 		}
 
 		let stream = body;
 
-		if (Buffer.isBuffer(body)) {
+		if (Buffer$1.isBuffer(body)) {
 			stream = Stream.Readable.from(body);
 		} else if (isBlob(body)) {
 			stream = Stream.Readable.from(body.stream());
@@ -4852,7 +4891,7 @@ class Body {
 	 */
 	async blob() {
 		const ct = (this.headers && this.headers.get('content-type')) || (this[INTERNALS$2].body && this[INTERNALS$2].body.type) || '';
-		const buf = await this.buffer();
+		const buf = await this.arrayBuffer();
 
 		return new Blob$1([buf], {
 			type: ct
@@ -4865,8 +4904,8 @@ class Body {
 	 * @return  Promise
 	 */
 	async json() {
-		const buffer = await consumeBody(this);
-		return JSON.parse(buffer.toString());
+		const text = await this.text();
+		return JSON.parse(text);
 	}
 
 	/**
@@ -4876,7 +4915,7 @@ class Body {
 	 */
 	async text() {
 		const buffer = await consumeBody(this);
-		return buffer.toString();
+		return new TextDecoder().decode(buffer);
 	}
 
 	/**
@@ -4898,7 +4937,10 @@ Object.defineProperties(Body.prototype, {
 	arrayBuffer: {enumerable: true},
 	blob: {enumerable: true},
 	json: {enumerable: true},
-	text: {enumerable: true}
+	text: {enumerable: true},
+	data: {get: deprecate(() => {},
+		'data doesn\'t exist, use json(), text(), arrayBuffer(), or body instead',
+		'https://github.com/node-fetch/node-fetch/issues/1000 (response)')}
 });
 
 /**
@@ -4923,12 +4965,12 @@ async function consumeBody(data) {
 
 	// Body is null
 	if (body === null) {
-		return Buffer.alloc(0);
+		return Buffer$1.alloc(0);
 	}
 
 	/* c8 ignore next 3 */
 	if (!(body instanceof Stream)) {
-		return Buffer.alloc(0);
+		return Buffer$1.alloc(0);
 	}
 
 	// Body is stream
@@ -4955,10 +4997,10 @@ async function consumeBody(data) {
 	if (body.readableEnded === true || body._readableState.ended === true) {
 		try {
 			if (accum.every(c => typeof c === 'string')) {
-				return Buffer.from(accum.join(''));
+				return Buffer$1.from(accum.join(''));
 			}
 
-			return Buffer.concat(accum, accumBytes);
+			return Buffer$1.concat(accum, accumBytes);
 		} catch (error) {
 			throw new FetchError(`Could not create Buffer from response body for ${data.url}: ${error.message}`, 'system', error);
 		}
@@ -5038,7 +5080,7 @@ const extractContentType = (body, request) => {
 	}
 
 	// Body is a Buffer (Buffer, ArrayBuffer or ArrayBufferView)
-	if (Buffer.isBuffer(body) || types.isAnyArrayBuffer(body) || ArrayBuffer.isView(body)) {
+	if (Buffer$1.isBuffer(body) || types.isAnyArrayBuffer(body) || ArrayBuffer.isView(body)) {
 		return null;
 	}
 
@@ -5083,7 +5125,7 @@ const getTotalBytes = request => {
 	}
 
 	// Body is Buffer
-	if (Buffer.isBuffer(body)) {
+	if (Buffer$1.isBuffer(body)) {
 		return body.length;
 	}
 
@@ -5101,15 +5143,15 @@ const getTotalBytes = request => {
  *
  * @param {Stream.Writable} dest The stream to write to.
  * @param obj.body Body object from the Body instance.
- * @returns {void}
+ * @returns {Promise<void>}
  */
-const writeToStream = (dest, {body}) => {
+const writeToStream = async (dest, {body}) => {
 	if (body === null) {
 		// Body is null
 		dest.end();
 	} else {
 		// Body is stream
-		body.pipe(dest);
+		await pipeline(body, dest);
 	}
 };
 
@@ -5119,6 +5161,7 @@ const writeToStream = (dest, {body}) => {
  * Headers class offers convenient helpers
  */
 
+/* c8 ignore next 9 */
 const validateHeaderName = typeof http.validateHeaderName === 'function' ?
 	http.validateHeaderName :
 	name => {
@@ -5129,6 +5172,7 @@ const validateHeaderName = typeof http.validateHeaderName === 'function' ?
 		}
 	};
 
+/* c8 ignore next 9 */
 const validateHeaderValue = typeof http.validateHeaderValue === 'function' ?
 	http.validateHeaderValue :
 	(name, value) => {
@@ -5251,8 +5295,8 @@ class Headers extends URLSearchParams {
 						return Reflect.get(target, p, receiver);
 				}
 			}
-			/* c8 ignore next */
 		});
+		/* c8 ignore next */
 	}
 
 	get [Symbol.toStringTag]() {
@@ -5873,12 +5917,20 @@ function parseReferrerPolicyFromHeader(headers) {
 	return policy;
 }
 
+/**
+ * Request.js
+ *
+ * Request class contains server only options
+ *
+ * All spec algorithm step numbers are based on https://fetch.spec.whatwg.org/commit-snapshots/ae716822cb3a61843226cd090eefc6589446c1d2/.
+ */
+
 const INTERNALS = Symbol('Request internals');
 
 /**
  * Check if `obj` is an instance of Request.
  *
- * @param  {*} obj
+ * @param  {*} object
  * @return {boolean}
  */
 const isRequest = object => {
@@ -5888,6 +5940,10 @@ const isRequest = object => {
 	);
 };
 
+const doBadDataWarn = deprecate(() => {},
+	'.data is not a valid RequestInit property, use .body instead',
+	'https://github.com/node-fetch/node-fetch/issues/1000 (request)');
+
 /**
  * Request class
  *
@@ -5910,14 +5966,20 @@ class Request extends Body {
 		}
 
 		if (parsedURL.username !== '' || parsedURL.password !== '') {
-			throw new TypeError(`${parsedURL} is an url with embedded credentails.`);
+			throw new TypeError(`${parsedURL} is an url with embedded credentials.`);
 		}
 
 		let method = init.method || input.method || 'GET';
-		method = method.toUpperCase();
+		if (/^(delete|get|head|options|post|put)$/i.test(method)) {
+			method = method.toUpperCase();
+		}
+
+		if ('data' in init) {
+			doBadDataWarn();
+		}
 
 		// eslint-disable-next-line no-eq-null, eqeqeq
-		if (((init.body != null || isRequest(input)) && input.body !== null) &&
+		if ((init.body != null || (isRequest(input) && input.body !== null)) &&
 			(method === 'GET' || method === 'HEAD')) {
 			throw new TypeError('Request with GET/HEAD method cannot have body');
 		}
@@ -5990,14 +6052,17 @@ class Request extends Body {
 		this.referrerPolicy = init.referrerPolicy || input.referrerPolicy || '';
 	}
 
+	/** @returns {string} */
 	get method() {
 		return this[INTERNALS].method;
 	}
 
+	/** @returns {string} */
 	get url() {
 		return format(this[INTERNALS].parsedURL);
 	}
 
+	/** @returns {Headers} */
 	get headers() {
 		return this[INTERNALS].headers;
 	}
@@ -6006,6 +6071,7 @@ class Request extends Body {
 		return this[INTERNALS].redirect;
 	}
 
+	/** @returns {AbortSignal} */
 	get signal() {
 		return this[INTERNALS].signal;
 	}
@@ -6063,8 +6129,8 @@ Object.defineProperties(Request.prototype, {
 /**
  * Convert a Request to Node.js http request options.
  *
- * @param   Request  A Request instance
- * @return  Object   The options object to be passed to http.request
+ * @param {Request} request - A Request instance
+ * @return The options object to be passed to http.request
  */
 const getNodeRequestOptions = request => {
 	const {parsedURL} = request[INTERNALS];
@@ -6153,6 +6219,7 @@ const getNodeRequestOptions = request => {
 	};
 
 	return {
+		/** @type {URL} */
 		parsedURL,
 		options
 	};
@@ -6167,6 +6234,21 @@ class AbortError extends FetchBaseError {
 	}
 }
 
+/*! node-domexception. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */
+
+if (!globalThis.DOMException) {
+  try {
+    const { MessageChannel } = require('worker_threads'),
+    port = new MessageChannel().port1,
+    ab = new ArrayBuffer();
+    port.postMessage(ab, [ab, ab]);
+  } catch (err) {
+    err.constructor.name === 'DOMException' && (
+      globalThis.DOMException = err.constructor
+    );
+  }
+}
+
 /**
  * Index.js
  *
@@ -6230,7 +6312,7 @@ async function fetch(url, options_) {
 		};
 
 		// Send request
-		const request_ = send(parsedURL, options);
+		const request_ = send(parsedURL.toString(), options);
 
 		if (signal) {
 			signal.addEventListener('abort', abortAndFinalize);
@@ -6282,7 +6364,19 @@ async function fetch(url, options_) {
 				const location = headers.get('Location');
 
 				// HTTP fetch step 5.3
-				const locationURL = location === null ? null : new URL(location, request.url);
+				let locationURL = null;
+				try {
+					locationURL = location === null ? null : new URL(location, request.url);
+				} catch {
+					// error here can only be invalid URL in Location: header
+					// do not throw when options.redirect == manual
+					// let the user extract the errorneous redirect URL
+					if (request.redirect !== 'manual') {
+						reject(new FetchError(`uri requested responds with an invalid redirect URL: ${location}`, 'invalid-redirect'));
+						finalize();
+						return;
+					}
+				}
 
 				// HTTP fetch step 5.5
 				switch (request.redirect) {
@@ -6291,11 +6385,7 @@ async function fetch(url, options_) {
 						finalize();
 						return;
 					case 'manual':
-						// Node-fetch-specific step: make manual redirect a bit easier to use by setting the Location header value to the resolved URL.
-						if (locationURL !== null) {
-							headers.set('Location', locationURL);
-						}
-
+						// Nothing to do
 						break;
 					case 'follow': {
 						// HTTP-redirect fetch step 2
@@ -6326,6 +6416,18 @@ async function fetch(url, options_) {
 							referrerPolicy: request.referrerPolicy
 						};
 
+						// when forwarding sensitive headers like "Authorization",
+						// "WWW-Authenticate", and "Cookie" to untrusted targets,
+						// headers will be ignored when following a redirect to a domain
+						// that is not a subdomain match or exact match of the initial domain.
+						// For example, a redirect from "foo.com" to either "foo.com" or "sub.foo.com"
+						// will forward the sensitive headers, but a redirect to "bar.com" will not.
+						if (!isDomainOrSubdomain(request.url, locationURL)) {
+							for (const name of ['authorization', 'www-authenticate', 'cookie', 'cookie2']) {
+								requestOptions.headers.delete(name);
+							}
+						}
+
 						// HTTP-redirect fetch step 9
 						if (response_.statusCode !== 303 && request.body && options_.body instanceof Stream.Readable) {
 							reject(new FetchError('Cannot follow redirect with body being a readable stream', 'unsupported-redirect'));
@@ -6364,8 +6466,13 @@ async function fetch(url, options_) {
 				});
 			}
 
-			let body = pipeline(response_, new PassThrough(), reject);
+			let body = pipeline$1(response_, new PassThrough(), error => {
+				if (error) {
+					reject(error);
+				}
+			});
 			// see https://github.com/nodejs/node/pull/29376
+			/* c8 ignore next 3 */
 			if (process.version < 'v12.10') {
 				response_.on('aborted', abortAndFinalize);
 			}
@@ -6409,7 +6516,11 @@ async function fetch(url, options_) {
 
 			// For gzip
 			if (codings === 'gzip' || codings === 'x-gzip') {
-				body = pipeline(body, zlib.createGunzip(zlibOptions), reject);
+				body = pipeline$1(body, zlib.createGunzip(zlibOptions), error => {
+					if (error) {
+						reject(error);
+					}
+				});
 				response = new Response(body, responseOptions);
 				resolve(response);
 				return;
@@ -6419,20 +6530,48 @@ async function fetch(url, options_) {
 			if (codings === 'deflate' || codings === 'x-deflate') {
 				// Handle the infamous raw deflate response from old servers
 				// a hack for old IIS and Apache servers
-				const raw = pipeline(response_, new PassThrough(), reject);
+				const raw = pipeline$1(response_, new PassThrough(), error => {
+					if (error) {
+						reject(error);
+					}
+				});
 				raw.once('data', chunk => {
 					// See http://stackoverflow.com/questions/37519828
-					body = (chunk[0] & 0x0F) === 0x08 ? pipeline(body, zlib.createInflate(), reject) : pipeline(body, zlib.createInflateRaw(), reject);
+					if ((chunk[0] & 0x0F) === 0x08) {
+						body = pipeline$1(body, zlib.createInflate(), error => {
+							if (error) {
+								reject(error);
+							}
+						});
+					} else {
+						body = pipeline$1(body, zlib.createInflateRaw(), error => {
+							if (error) {
+								reject(error);
+							}
+						});
+					}
 
 					response = new Response(body, responseOptions);
 					resolve(response);
 				});
+				raw.once('end', () => {
+					// Some old IIS servers return zero-length OK deflate responses, so
+					// 'data' is never emitted. See https://github.com/node-fetch/node-fetch/pull/903
+					if (!response) {
+						response = new Response(body, responseOptions);
+						resolve(response);
+					}
+				});
 				return;
 			}
 
 			// For br
 			if (codings === 'br') {
-				body = pipeline(body, zlib.createBrotliDecompress(), reject);
+				body = pipeline$1(body, zlib.createBrotliDecompress(), error => {
+					if (error) {
+						reject(error);
+					}
+				});
 				response = new Response(body, responseOptions);
 				resolve(response);
 				return;
@@ -6443,12 +6582,13 @@ async function fetch(url, options_) {
 			resolve(response);
 		});
 
-		writeToStream(request_, request);
+		// eslint-disable-next-line promise/prefer-await-to-then
+		writeToStream(request_, request).catch(reject);
 	});
 }
 
 function fixResponseChunkedTransferBadEnding(request, errorCallback) {
-	const LAST_CHUNK = Buffer.from('0\r\n\r\n');
+	const LAST_CHUNK = Buffer$1.from('0\r\n\r\n');
 
 	let isChunkedTransfer = false;
 	let properLastChunkReceived = false;
@@ -6475,13 +6615,13 @@ function fixResponseChunkedTransferBadEnding(request, errorCallback) {
 		});
 
 		socket.on('data', buf => {
-			properLastChunkReceived = Buffer.compare(buf.slice(-5), LAST_CHUNK) === 0;
+			properLastChunkReceived = Buffer$1.compare(buf.slice(-5), LAST_CHUNK) === 0;
 
 			// Sometimes final 0-length chunk and end of message code are in separate packets
 			if (!properLastChunkReceived && previousChunk) {
 				properLastChunkReceived = (
-					Buffer.compare(previousChunk.slice(-3), LAST_CHUNK.slice(0, 3)) === 0 &&
-					Buffer.compare(buf.slice(-2), LAST_CHUNK.slice(3)) === 0
+					Buffer$1.compare(previousChunk.slice(-3), LAST_CHUNK.slice(0, 3)) === 0 &&
+					Buffer$1.compare(buf.slice(-2), LAST_CHUNK.slice(3)) === 0
 				);
 			}