@sveltejs/kit 2.27.3 → 2.29.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sveltejs/kit",
-  "version": "2.27.3",
+  "version": "2.29.0",
   "description": "SvelteKit is the fastest way to build Svelte apps",
   "keywords": [
     "framework",

package/src/core/config/index.js

@@ -126,6 +126,17 @@ export function validate_config(config) {
 	}
 
 	const validated = options(config, 'config');
+	const files = validated.kit.files;
+
+	files.hooks.client ??= path.join(files.src, 'hooks.client');
+	files.hooks.server ??= path.join(files.src, 'hooks.server');
+	files.hooks.universal ??= path.join(files.src, 'hooks');
+	files.lib ??= path.join(files.src, 'lib');
+	files.params ??= path.join(files.src, 'params');
+	files.routes ??= path.join(files.src, 'routes');
+	files.serviceWorker ??= path.join(files.src, 'service-worker');
+	files.appTemplate ??= path.join(files.src, 'app.html');
+	files.errorTemplate ??= path.join(files.src, 'error.html');
 
 	if (validated.kit.router.resolution === 'server') {
 		if (validated.kit.router.type === 'hash') {

package/src/core/config/options.js

@@ -1,4 +1,3 @@
-import { join } from 'node:path';
 import process from 'node:process';
 
 /** @typedef {import('./types.js').Validator} Validator */
@@ -125,18 +124,19 @@ const options = object(
 			}),
 
 			files: object({
-				assets: string('static'),
+				src: deprecate(string('src')),
+				assets: deprecate(string('static')),
 				hooks: object({
-					client: string(join('src', 'hooks.client')),
-					server: string(join('src', 'hooks.server')),
-					universal: string(join('src', 'hooks'))
+					client: deprecate(string(null)),
+					server: deprecate(string(null)),
+					universal: deprecate(string(null))
 				}),
-				lib: string(join('src', 'lib')),
-				params: string(join('src', 'params')),
-				routes: string(join('src', 'routes')),
-				serviceWorker: string(join('src', 'service-worker')),
-				appTemplate: string(join('src', 'app.html')),
-				errorTemplate: string(join('src', 'error.html'))
+				lib: deprecate(string(null)),
+				params: deprecate(string(null)),
+				routes: deprecate(string(null)),
+				serviceWorker: deprecate(string(null)),
+				appTemplate: deprecate(string(null)),
+				errorTemplate: deprecate(string(null))
 			}),
 
 			inlineStyleThreshold: number(0),
@@ -287,6 +287,25 @@ const options = object(
 	true
 );
 
+/**
+ * @param {Validator} fn
+ * @param {(keypath: string) => string} get_message
+ * @returns {Validator}
+ */
+function deprecate(
+	fn,
+	get_message = (keypath) =>
+		`The \`${keypath}\` option is deprecated, and will be removed in a future version`
+) {
+	return (input, keypath) => {
+		if (input !== undefined) {
+			console.warn(get_message(keypath));
+		}
+
+		return fn(input, keypath);
+	};
+}
+
 /**
  * @param {Record<string, Validator>} children
  * @param {boolean} [allow_unknown]

package/src/core/postbuild/prerender.js

@@ -242,6 +242,11 @@ async function prerender({ hash, out, manifest_path, metadata, verbose, env }) {
 				const filepath = saved.get(file);
 				if (filepath) return readFileSync(filepath);
 
+				// Static assets emitted during build
+				if (file.startsWith(config.appDir)) {
+					return readFileSync(`${out}/server/${file}`);
+				}
+
 				// stuff in `static`
 				return readFileSync(join(config.files.assets, file));
 			},

package/src/exports/index.js

@@ -8,6 +8,7 @@ import {
 	strip_data_suffix,
 	strip_resolution_suffix
 } from '../runtime/pathname.js';
+import { text_encoder } from '../runtime/utils.js';
 
 export { VERSION } from '../version.js';
 
@@ -142,7 +143,7 @@ export function json(data, init) {
 	// means less duplicated work
 	const headers = new Headers(init?.headers);
 	if (!headers.has('content-length')) {
-		headers.set('content-length', encoder.encode(body).byteLength.toString());
+		headers.set('content-length', text_encoder.encode(body).byteLength.toString());
 	}
 
 	if (!headers.has('content-type')) {
@@ -155,8 +156,6 @@ export function json(data, init) {
 	});
 }
 
-const encoder = new TextEncoder();
-
 /**
  * Create a `Response` object from the supplied body.
  * @param {string} body The value that will be used as-is.
@@ -165,7 +164,7 @@ const encoder = new TextEncoder();
 export function text(body, init) {
 	const headers = new Headers(init?.headers);
 	if (!headers.has('content-length')) {
-		const encoded = encoder.encode(body);
+		const encoded = text_encoder.encode(body);
 		headers.set('content-length', encoded.byteLength.toString());
 		return new Response(encoded, {
 			...init,

package/src/exports/public.d.ts

@@ -420,26 +420,38 @@ export interface KitConfig {
 	};
 	/**
 	 * Where to find various files within your project.
+	 * @deprecated
 	 */
 	files?: {
+		/**
+		 * the location of your source code
+		 * @deprecated
+		 * @default "src"
+		 * @since 2.28
+		 */
+		src?: string;
 		/**
 		 * a place to put static files that should have stable URLs and undergo no processing, such as `favicon.ico` or `manifest.json`
+		 * @deprecated
 		 * @default "static"
 		 */
 		assets?: string;
 		hooks?: {
 			/**
 			 * The location of your client [hooks](https://svelte.dev/docs/kit/hooks).
+			 * @deprecated
 			 * @default "src/hooks.client"
 			 */
 			client?: string;
 			/**
 			 * The location of your server [hooks](https://svelte.dev/docs/kit/hooks).
+			 * @deprecated
 			 * @default "src/hooks.server"
 			 */
 			server?: string;
 			/**
 			 * The location of your universal [hooks](https://svelte.dev/docs/kit/hooks).
+			 * @deprecated
 			 * @default "src/hooks"
 			 * @since 2.3.0
 			 */
@@ -447,31 +459,37 @@ export interface KitConfig {
 		};
 		/**
 		 * your app's internal library, accessible throughout the codebase as `$lib`
+		 * @deprecated
 		 * @default "src/lib"
 		 */
 		lib?: string;
 		/**
 		 * a directory containing [parameter matchers](https://svelte.dev/docs/kit/advanced-routing#Matching)
+		 * @deprecated
 		 * @default "src/params"
 		 */
 		params?: string;
 		/**
 		 * the files that define the structure of your app (see [Routing](https://svelte.dev/docs/kit/routing))
+		 * @deprecated
 		 * @default "src/routes"
 		 */
 		routes?: string;
 		/**
 		 * the location of your service worker's entry point (see [Service workers](https://svelte.dev/docs/kit/service-workers))
+		 * @deprecated
 		 * @default "src/service-worker"
 		 */
 		serviceWorker?: string;
 		/**
 		 * the location of the template for HTML responses
+		 * @deprecated
 		 * @default "src/app.html"
 		 */
 		appTemplate?: string;
 		/**
 		 * the location of the template for fallback error responses
+		 * @deprecated
 		 * @default "src/error.html"
 		 */
 		errorTemplate?: string;
@@ -1020,12 +1038,15 @@ export interface NavigationEvent<
 /**
  * Information about the target of a specific navigation.
  */
-export interface NavigationTarget {
+export interface NavigationTarget<
+	Params extends AppLayoutParams<'/'> = AppLayoutParams<'/'>,
+	RouteId extends AppRouteId | null = AppRouteId | null
+> {
 	/**
 	 * Parameters of the target page - e.g. for a route like `/blog/[slug]`, a `{ slug: string }` object.
 	 * Is `null` if the target is not part of the SvelteKit app (could not be resolved to a route).
 	 */
-	params: Record<string, string> | null;
+	params: Params | null;
 	/**
 	 * Info about the target route
 	 */
@@ -1033,7 +1054,7 @@ export interface NavigationTarget {
 		/**
 		 * The ID of the current route - e.g. for `src/routes/blog/[slug]`, it would be `/blog/[slug]`. It is `null` when no route is matched.
 		 */
-		id: string | null;
+		id: RouteId | null;
 	};
 	/**
 	 * The URL that is navigated to
@@ -1043,8 +1064,8 @@ export interface NavigationTarget {
 
 /**
  * - `enter`: The app has hydrated/started
- * - `form`: The user submitted a `<form>` with a GET method
- * - `leave`: The user is leaving the app by closing the tab or using the back/forward buttons to go to a different document
+ * - `form`: The user submitted a `<form method="GET">`
+ * - `leave`: The app is being left either because the tab is being closed or a navigation to a different document is occurring
  * - `link`: Navigation was triggered by a link click
  * - `goto`: Navigation was triggered by a `goto(...)` call or a redirect
  * - `popstate`: Navigation was triggered by back/forward navigation
@@ -1062,7 +1083,7 @@ export interface Navigation {
 	to: NavigationTarget | null;
 	/**
 	 * The type of navigation:
-	 * - `form`: The user submitted a `<form>`
+	 * - `form`: The user submitted a `<form method="GET">`
 	 * - `leave`: The app is being left either because the tab is being closed or a navigation to a different document is occurring
 	 * - `link`: Navigation was triggered by a link click
 	 * - `goto`: Navigation was triggered by a `goto(...)` call or a redirect
@@ -1100,7 +1121,7 @@ export interface BeforeNavigate extends Navigation {
 export interface OnNavigate extends Navigation {
 	/**
 	 * The type of navigation:
-	 * - `form`: The user submitted a `<form>`
+	 * - `form`: The user submitted a `<form method="GET">`
 	 * - `link`: Navigation was triggered by a link click
 	 * - `goto`: Navigation was triggered by a `goto(...)` call or a redirect
 	 * - `popstate`: Navigation was triggered by back/forward navigation
@@ -1119,7 +1140,7 @@ export interface AfterNavigate extends Omit<Navigation, 'type'> {
 	/**
 	 * The type of navigation:
 	 * - `enter`: The app has hydrated/started
-	 * - `form`: The user submitted a `<form>`
+	 * - `form`: The user submitted a `<form method="GET">`
 	 * - `link`: Navigation was triggered by a link click
 	 * - `goto`: Navigation was triggered by a `goto(...)` call or a redirect
 	 * - `popstate`: Navigation was triggered by back/forward navigation
@@ -1565,6 +1586,8 @@ export type RemoteForm<Result> = {
 	for(key: string | number | boolean): Omit<RemoteForm<Result>, 'for'>;
 	/** The result of the form submission */
 	get result(): Result | undefined;
+	/** The number of pending submissions */
+	get pending(): number;
 	/** Spread this onto a `<button>` or `<input type="submit">` */
 	buttonProps: {
 		type: 'submit';
@@ -1586,14 +1609,20 @@ export type RemoteForm<Result> = {
 			formaction: string;
 			onclick: (event: Event) => void;
 		};
+		/** The number of pending submissions */
+		get pending(): number;
 	};
 };
 
 /**
  * The return value of a remote `command` function. See [Remote functions](https://svelte.dev/docs/kit/remote-functions#command) for full documentation.
  */
-export type RemoteCommand<Input, Output> = (arg: Input) => Promise<Awaited<Output>> & {
-	updates(...queries: Array<RemoteQuery<any> | RemoteQueryOverride>): Promise<Awaited<Output>>;
+export type RemoteCommand<Input, Output> = {
+	(arg: Input): Promise<Awaited<Output>> & {
+		updates(...queries: Array<RemoteQuery<any> | RemoteQueryOverride>): Promise<Awaited<Output>>;
+	};
+	/** The number of pending command executions */
+	get pending(): number;
 };
 
 export type RemoteResource<T> = Promise<Awaited<T>> & {
@@ -1623,7 +1652,7 @@ export type RemoteQuery<T> = RemoteResource<T> & {
 	 */
 	refresh(): Promise<void>;
 	/**
-	 * Temporarily override the value of a query. This is used with the `updates` method of a [command](https://svelte.dev/docs/kit/remote-functions#command-Single-flight-mutations) or [enhanced form submission](https://svelte.dev/docs/kit/remote-functions#form-enhance) to provide optimistic updates.
+	 * Temporarily override the value of a query. This is used with the `updates` method of a [command](https://svelte.dev/docs/kit/remote-functions#command-Updating-queries) or [enhanced form submission](https://svelte.dev/docs/kit/remote-functions#form-enhance) to provide optimistic updates.
 	 *
 	 * ```svelte
 	 * <script>

package/src/exports/vite/build/build_remote.js

@@ -102,9 +102,10 @@ export async function treeshake_prerendered_remotes(out, manifest_data, metadata
 		input[prefix + remote.hash] = remote_file;
 	}
 
-	const bundle = await vite.build({
+	const bundle = /** @type {import('vite').Rollup.RollupOutput} */ (await vite.build({
 		configFile: false,
 		build: {
+			write: false,
 			ssr: true,
 			rollupOptions: {
 				external: (id) => {
@@ -114,11 +115,10 @@ export async function treeshake_prerendered_remotes(out, manifest_data, metadata
 				input
 			}
 		}
-	});
+	}));
 
-	// @ts-expect-error TypeScript doesn't know what type `bundle` is
 	for (const chunk of bundle.output) {
-		if (chunk.name.startsWith(prefix)) {
+		if (chunk.type === 'chunk' && chunk.name.startsWith(prefix)) {
 			fs.writeFileSync(`${dir}/${chunk.fileName.slice(prefix.length)}`, chunk.code);
 		}
 	}

package/src/exports/vite/index.js

@@ -15,9 +15,8 @@ import { build_server_nodes } from './build/build_server.js';
 import { build_service_worker } from './build/build_service_worker.js';
 import { assets_base, find_deps, resolve_symlinks } from './build/utils.js';
 import { dev } from './dev/index.js';
-import { is_illegal, module_guard } from './graph_analysis/index.js';
 import { preview } from './preview/index.js';
-import { get_config_aliases, get_env, normalize_id, strip_virtual_prefix } from './utils.js';
+import { get_config_aliases, get_env, normalize_id, stackless } from './utils.js';
 import { write_client_manifest } from '../../core/sync/write_client_manifest.js';
 import prerender from '../../core/postbuild/prerender.js';
 import analyse from '../../core/postbuild/analyse.js';
@@ -37,6 +36,7 @@ import {
 import { import_peer } from '../../utils/import.js';
 import { compact } from '../../utils/array.js';
 import { build_remotes, treeshake_prerendered_remotes } from './build/build_remote.js';
+import { should_ignore } from './static_analysis/utils.js';
 
 const cwd = process.cwd();
 
@@ -90,7 +90,7 @@ const warning_preprocessor = {
 		const basename = path.basename(filename);
 		if (basename.startsWith('+page.') || basename.startsWith('+layout.')) {
 			const match = content.match(options_regex);
-			if (match) {
+			if (match && match.index !== undefined && !should_ignore(content, match.index)) {
 				const fixed = basename.replace('.svelte', '(.server).js/ts');
 
 				const message =
@@ -219,6 +219,7 @@ async function kit({ svelte_config }) {
 
 	const normalized_cwd = vite.normalizePath(cwd);
 	const normalized_lib = vite.normalizePath(kit.files.lib);
+	const normalized_node_modules = vite.normalizePath(path.resolve('node_modules'));
 
 	/**
 	 * A map showing which features (such as `$app/server:read`) are defined
@@ -374,9 +375,6 @@ async function kit({ svelte_config }) {
 		}
 	};
 
-	/** @type {Map<string, string>} */
-	const import_map = new Map();
-
 	/** @type {import('vite').Plugin} */
 	const plugin_virtual_modules = {
 		name: 'vite-plugin-sveltekit-virtual-modules',
@@ -389,6 +387,7 @@ async function kit({ svelte_config }) {
 			// If importing from a service-worker, only allow $service-worker & $env/static/public, but none of the other virtual modules.
 			// This check won't catch transitive imports, but it will warn when the import comes from a service-worker directly.
 			// Transitive imports will be caught during the build.
+			// TODO move this logic to plugin_guard
 			if (importer) {
 				const parsed_importer = path.parse(importer);
 
@@ -405,8 +404,6 @@ async function kit({ svelte_config }) {
 						)} into service-worker code. Only the modules $service-worker and $env/static/public are available in service workers.`
 					);
 				}
-
-				import_map.set(id, importer);
 			}
 
 			// treat $env/static/[public|private] as virtual
@@ -414,9 +411,11 @@ async function kit({ svelte_config }) {
 				// ids with :$ don't work with reverse proxies like nginx
 				return `\0virtual:${id.substring(1)}`;
 			}
+
 			if (id === '__sveltekit/remote') {
 				return `${runtime_directory}/client/remote-functions/index.js`;
 			}
+
 			if (id.startsWith('__sveltekit/')) {
 				return `\0virtual:${id}`;
 			}
@@ -429,37 +428,6 @@ async function kit({ svelte_config }) {
 				? `globalThis.__sveltekit_${version_hash}`
 				: 'globalThis.__sveltekit_dev';
 
-			if (options?.ssr === false && process.env.TEST !== 'true') {
-				if (
-					is_illegal(id, {
-						cwd: normalized_cwd,
-						node_modules: vite.normalizePath(path.resolve('node_modules')),
-						server: vite.normalizePath(path.join(normalized_lib, 'server'))
-					})
-				) {
-					const relative = normalize_id(id, normalized_lib, normalized_cwd);
-
-					const illegal_module = strip_virtual_prefix(relative);
-
-					const error_prefix = `Cannot import ${illegal_module} into client-side code. This could leak sensitive information.`;
-					const error_suffix = `
-Tips:
- - To resolve this error, ensure that no exports from ${illegal_module} are used, even transitively, in client-side code.
- - If you're only using the import as a type, change it to \`import type\`.
- - If you're not sure which module is causing this, try building your app -- it will create a more helpful error.`;
-
-					if (import_map.has(illegal_module)) {
-						const importer = path.relative(
-							cwd,
-							/** @type {string} */ (import_map.get(illegal_module))
-						);
-						throw new Error(`${error_prefix}\nImported by: ${importer}.${error_suffix}`);
-					}
-
-					throw new Error(`${error_prefix}${error_suffix}`);
-				}
-			}
-
 			switch (id) {
 				case env_static_private:
 					return create_static_module('$env/static/private', env.private);
@@ -566,6 +534,10 @@ Tips:
 		}
 	};
 
+	/** @type {Map<string, Set<string>>} */
+	const import_map = new Map();
+	const server_only_pattern = /.*\.server\..+/;
+
 	/**
 	 * Ensures that client-side code can't accidentally import server-side code,
 	 * whether in `*.server.js` files, `$app/server`, `$lib/server`, or `$env/[static|dynamic]/private`
@@ -574,23 +546,89 @@ Tips:
 	const plugin_guard = {
 		name: 'vite-plugin-sveltekit-guard',
 
-		writeBundle: {
-			sequential: true,
-			handler(_options) {
-				if (vite_config.build.ssr) return;
+		// Run this plugin before built-in resolution, so that relative imports
+		// are added to the module graph
+		enforce: 'pre',
 
-				const guard = module_guard(this, {
-					cwd: vite.normalizePath(process.cwd()),
-					lib: vite.normalizePath(kit.files.lib)
-				});
+		async resolveId(id, importer) {
+			if (importer && !importer.endsWith('index.html')) {
+				const resolved = await this.resolve(id, importer, { skipSelf: true });
 
-				manifest_data.nodes.forEach((_node, i) => {
-					const id = vite.normalizePath(
-						path.resolve(kit.outDir, `generated/client-optimized/nodes/${i}.js`)
-					);
+				if (resolved) {
+					const normalized = normalize_id(resolved.id, normalized_lib, normalized_cwd);
 
-					guard.check(id);
-				});
+					let importers = import_map.get(normalized);
+
+					if (!importers) {
+						importers = new Set();
+						import_map.set(normalized, importers);
+					}
+
+					importers.add(normalize_id(importer, normalized_lib, normalized_cwd));
+				}
+			}
+		},
+
+		load(id, options) {
+			if (options?.ssr === true || process.env.TEST === 'true') {
+				return;
+			}
+
+			// skip .server.js files outside the cwd or in node_modules, as the filename might not mean 'server-only module' in this context
+			const is_internal = id.startsWith(normalized_cwd) && !id.startsWith(normalized_node_modules);
+
+			const normalized = normalize_id(id, normalized_lib, normalized_cwd);
+
+			const is_server_only =
+				normalized === '$env/static/private' ||
+				normalized === '$env/dynamic/private' ||
+				normalized === '$app/server' ||
+				normalized.startsWith('$lib/server/') ||
+				(is_internal && server_only_pattern.test(path.basename(id)));
+
+			if (is_server_only) {
+				// in dev, this doesn't exist, so we need to create it
+				manifest_data ??= sync.all(svelte_config, vite_config_env.mode).manifest_data;
+
+				/** @type {Set<string>} */
+				const entrypoints = new Set();
+				for (const node of manifest_data.nodes) {
+					if (node.component) entrypoints.add(node.component);
+					if (node.universal) entrypoints.add(node.universal);
+				}
+
+				const normalized = normalize_id(id, normalized_lib, normalized_cwd);
+				const chain = [normalized];
+
+				let current = normalized;
+
+				while (true) {
+					const importers = import_map.get(current);
+					if (!importers) break;
+
+					const candidates = Array.from(importers).filter((importer) => !chain.includes(importer));
+					if (candidates.length === 0) break;
+
+					chain.push((current = candidates[0]));
+
+					if (entrypoints.has(current)) {
+						let message = `Cannot import ${normalized} into code that runs in the browser, as this could leak sensitive information.`;
+
+						const pyramid = chain
+							.reverse()
+							.map((id, i) => {
+								return `${' '.repeat(i + 1)}${id}`;
+							})
+							.join(' imports\n');
+
+						message += `\n\n${pyramid}`;
+						message += `\n\nIf you're only using the import as a type, change it to \`import type\`.`;
+
+						throw stackless(message);
+					}
+				}
+
+				throw new Error('An impossible situation occurred');
 			}
 		}
 	};
@@ -956,23 +994,36 @@ Tips:
 
 				secondary_build_started = true;
 
-				const { output: client_chunks } = /** @type {import('vite').Rollup.RollupOutput} */ (
-					await vite.build({
-						configFile: vite_config.configFile,
-						// CLI args
-						mode: vite_config_env.mode,
-						logLevel: vite_config.logLevel,
-						clearScreen: vite_config.clearScreen,
-						build: {
-							minify: initial_config.build?.minify,
-							assetsInlineLimit: vite_config.build.assetsInlineLimit,
-							sourcemap: vite_config.build.sourcemap
-						},
-						optimizeDeps: {
-							force: vite_config.optimizeDeps.force
-						}
-					})
-				);
+				let client_chunks;
+
+				try {
+					const bundle = /** @type {import('vite').Rollup.RollupOutput} */ (
+						await vite.build({
+							configFile: vite_config.configFile,
+							// CLI args
+							mode: vite_config_env.mode,
+							logLevel: vite_config.logLevel,
+							clearScreen: vite_config.clearScreen,
+							build: {
+								minify: initial_config.build?.minify,
+								assetsInlineLimit: vite_config.build.assetsInlineLimit,
+								sourcemap: vite_config.build.sourcemap
+							},
+							optimizeDeps: {
+								force: vite_config.optimizeDeps.force
+							}
+						})
+					);
+
+					client_chunks = bundle.output;
+				} catch (e) {
+					const error =
+						e instanceof Error ? e : new Error(/** @type {any} */ (e).message ?? e ?? '<unknown>');
+
+					// without this, errors that occur during the secondary build
+					// will be logged twice
+					throw stackless(error.stack ?? error.message);
+				}
 
 				copy(
 					`${out}/server/${kit.appDir}/immutable/assets`,