@sveltejs/kit 2.54.0 → 2.56.0

package/src/runtime/server/utils.js

@@ -8,18 +8,6 @@ import { fix_stack_trace } from '../shared-server.js';
 import { ENDPOINT_METHODS } from '../../constants.js';
 import { escape_html } from '../../utils/escape.js';
 
-/** @param {any} body */
-export function is_pojo(body) {
-	if (typeof body !== 'object') return false;
-
-	if (body) {
-		if (body instanceof Uint8Array) return false;
-		if (body instanceof ReadableStream) return false;
-	}
-
-	return true;
-}
-
 /**
  * @param {Partial<Record<import('types').HttpMethod, any>>} mod
  * @param {import('types').HttpMethod} method

package/src/runtime/shared.js

@@ -1,6 +1,7 @@
 /** @import { Transport } from '@sveltejs/kit' */
 import * as devalue from 'devalue';
 import { base64_decode, base64_encode, text_decoder } from './utils.js';
+import * as svelte from 'svelte';
 
 /**
  * @param {string} route_id
@@ -50,17 +51,215 @@ export function stringify(data, transport) {
 	return devalue.stringify(data, encoders);
 }
 
+const object_proto_names = /* @__PURE__ */ Object.getOwnPropertyNames(Object.prototype)
+	.sort()
+	.join('\0');
+
+/**
+ * @param {unknown} thing
+ * @returns {thing is Record<PropertyKey, unknown>}
+ */
+function is_plain_object(thing) {
+	if (typeof thing !== 'object' || thing === null) return false;
+	const proto = Object.getPrototypeOf(thing);
+
+	return (
+		proto === Object.prototype ||
+		proto === null ||
+		Object.getPrototypeOf(proto) === null ||
+		Object.getOwnPropertyNames(proto).sort().join('\0') === object_proto_names
+	);
+}
+
+/**
+ * @param {Record<string, any>} value
+ * @param {Map<object, any>} clones
+ */
+function to_sorted(value, clones) {
+	const clone = Object.getPrototypeOf(value) === null ? Object.create(null) : {};
+	clones.set(value, clone);
+	Object.defineProperty(clone, remote_arg_marker, { value: true });
+
+	for (const key of Object.keys(value).sort()) {
+		const property = value[key];
+		Object.defineProperty(clone, key, {
+			value: clones.get(property) ?? property,
+			enumerable: true,
+			configurable: true,
+			writable: true
+		});
+	}
+
+	return clone;
+}
+
+// "sveltekit remote arg"
+const remote_object = '__skrao';
+const remote_map = '__skram';
+const remote_set = '__skras';
+const remote_regex_guard = '__skrag';
+const remote_arg_marker = Symbol(remote_object);
+
+/**
+ * @param {Transport} transport
+ * @param {boolean} sort
+ * @param {Map<any, any>} remote_arg_clones
+ */
+function create_remote_arg_reducers(transport, sort, remote_arg_clones) {
+	/** @type {Record<string, (value: unknown) => unknown>} */
+	const remote_fns_reducers = {
+		[remote_regex_guard]:
+			/** @type {(value: unknown) => void} */
+			(value) => {
+				if (value instanceof RegExp) {
+					throw new Error('Regular expressions are not valid remote function arguments');
+				}
+			}
+	};
+
+	if (sort) {
+		/** @type {(value: unknown) => Array<[unknown, unknown]> | undefined} */
+		remote_fns_reducers[remote_map] = (value) => {
+			if (!(value instanceof Map)) {
+				return;
+			}
+
+			/** @type {Array<[string, string]>} */
+			const entries = [];
+
+			for (const [key, val] of value) {
+				entries.push([stringify(key), stringify(val)]);
+			}
+
+			return entries.sort(([a1, a2], [b1, b2]) => {
+				if (a1 < b1) return -1;
+				if (a1 > b1) return 1;
+				if (a2 < b2) return -1;
+				if (a2 > b2) return 1;
+				return 0;
+			});
+		};
+
+		/** @type {(value: unknown) => unknown[] | undefined} */
+		remote_fns_reducers[remote_set] = (value) => {
+			if (!(value instanceof Set)) {
+				return;
+			}
+
+			/** @type {string[]} */
+			const items = [];
+
+			for (const item of value) {
+				items.push(stringify(item));
+			}
+
+			items.sort();
+			return items;
+		};
+
+		/** @type {(value: unknown) => Record<PropertyKey, unknown> | undefined} */
+		remote_fns_reducers[remote_object] = (value) => {
+			if (!is_plain_object(value)) {
+				return;
+			}
+
+			if (Object.hasOwn(value, remote_arg_marker)) {
+				return;
+			}
+
+			if (remote_arg_clones.has(value)) {
+				return remote_arg_clones.get(value);
+			}
+
+			return to_sorted(value, remote_arg_clones);
+		};
+	}
+
+	const user_reducers = Object.fromEntries(
+		Object.entries(transport).map(([k, v]) => [k, v.encode])
+	);
+	const all_reducers = { ...user_reducers, ...remote_fns_reducers };
+
+	/** @type {(value: unknown) => string} */
+	const stringify = (value) => devalue.stringify(value, all_reducers);
+
+	return all_reducers;
+}
+
+/** @param {Transport} transport */
+function create_remote_arg_revivers(transport) {
+	const remote_fns_revivers = {
+		/** @type {(value: unknown) => unknown} */
+		[remote_object]: (value) => value,
+		/** @type {(value: unknown) => Map<unknown, unknown>} */
+		[remote_map]: (value) => {
+			if (!Array.isArray(value)) {
+				throw new Error('Invalid data for Map reviver');
+			}
+
+			const map = new Map();
+
+			for (const item of value) {
+				if (
+					!Array.isArray(item) ||
+					item.length !== 2 ||
+					typeof item[0] !== 'string' ||
+					typeof item[1] !== 'string'
+				) {
+					throw new Error('Invalid data for Map reviver');
+				}
+				const [key, val] = item;
+				map.set(parse(key), parse(val));
+			}
+
+			return map;
+		},
+		/** @type {(value: unknown) => Set<unknown>} */
+		[remote_set]: (value) => {
+			if (!Array.isArray(value)) {
+				throw new Error('Invalid data for Set reviver');
+			}
+
+			const set = new Set();
+
+			for (const item of value) {
+				if (typeof item !== 'string') {
+					throw new Error('Invalid data for Set reviver');
+				}
+				set.add(parse(item));
+			}
+
+			return set;
+		}
+	};
+
+	const user_revivers = Object.fromEntries(
+		Object.entries(transport).map(([k, v]) => [k, v.decode])
+	);
+
+	const all_revivers = { ...user_revivers, ...remote_fns_revivers };
+
+	/** @type {(data: string) => unknown} */
+	const parse = (data) => devalue.parse(data, all_revivers);
+
+	return all_revivers;
+}
+
 /**
  * Stringifies the argument (if any) for a remote function in such a way that
  * it is both a valid URL and a valid file name (necessary for prerendering).
  * @param {any} value
  * @param {Transport} transport
+ * @param {boolean} [sort]
  */
-export function stringify_remote_arg(value, transport) {
+export function stringify_remote_arg(value, transport, sort = true) {
 	if (value === undefined) return '';
 
 	// If people hit file/url size limits, we can look into using something like compress_and_encode_text from svelte.dev beyond a certain size
-	const json_string = stringify(value, transport);
+	const json_string = devalue.stringify(
+		value,
+		create_remote_arg_reducers(transport, sort, new Map())
+	);
 
 	const bytes = new TextEncoder().encode(json_string);
 	return base64_encode(bytes).replaceAll('=', '').replaceAll('+', '-').replaceAll('/', '_');
@@ -79,9 +278,7 @@ export function parse_remote_arg(string, transport) {
 		base64_decode(string.replaceAll('-', '+').replaceAll('_', '/'))
 	);
 
-	const decoders = Object.fromEntries(Object.entries(transport).map(([k, v]) => [k, v.decode]));
-
-	return devalue.parse(json_string, decoders);
+	return devalue.parse(json_string, create_remote_arg_revivers(transport));
 }
 
 /**
@@ -91,3 +288,34 @@ export function parse_remote_arg(string, transport) {
 export function create_remote_key(id, payload) {
 	return id + '/' + payload;
 }
+
+/**
+ * @param {string} key
+ * @returns {{ id: string; payload: string }}
+ */
+export function split_remote_key(key) {
+	const i = key.lastIndexOf('/');
+
+	if (i === -1) {
+		throw new Error(`Invalid remote key: ${key}`);
+	}
+
+	return {
+		id: key.slice(0, i),
+		payload: key.slice(i + 1)
+	};
+}
+
+/**
+ * @template T
+ * @param {string} key
+ * @param {() => T} fn
+ * @returns {T}
+ * @deprecated TODO remove in SvelteKit 3.0
+ */
+export function unfriendly_hydratable(key, fn) {
+	if (!svelte.hydratable) {
+		throw new Error('Remote functions require Svelte 5.44.0 or later');
+	}
+	return svelte.hydratable(key, fn);
+}

package/src/types/global-private.d.ts

@@ -9,8 +9,6 @@ declare global {
 	const __SVELTEKIT_PATHS_RELATIVE__: boolean;
 	/** True if `config.kit.experimental.instrumentation.server` is `true` */
 	const __SVELTEKIT_SERVER_TRACING_ENABLED__: boolean;
-	/** true if corresponding config option is set to true */
-	const __SVELTEKIT_EXPERIMENTAL__REMOTE_FUNCTIONS__: boolean;
 	/** True if `config.kit.experimental.forkPreloads` is `true` */
 	const __SVELTEKIT_FORK_PRELOADS__: boolean;
 	/** True if `config.kit.router.resolution === 'client'` */
@@ -35,8 +33,10 @@ declare global {
 		assets?: string;
 		/** Public environment variables */
 		env?: Record<string, string>;
-		/** Serialized data from remote functions */
-		data?: Record<string, any>;
+		/** Serialized data from query/form/command functions */
+		query?: Record<string, any>;
+		/** Serialized data from prerender functions */
+		prerender?: Record<string, any>;
 		/** Create a placeholder promise */
 		defer?: (id: number) => Promise<any>;
 		/** Resolve a placeholder promise */

package/src/types/internal.d.ts

@@ -312,6 +312,21 @@ export type RemoteFunctionResponse =
 			refreshes: string | undefined;
 	  };
 
+export type RemoteRefreshResult = {
+	type: 'result';
+	data: any;
+};
+
+export type RemoteRefreshError = {
+	type: 'error';
+	status?: number;
+	error: App.Error;
+};
+
+export type RemoteRefreshEntry = RemoteRefreshResult | RemoteRefreshError;
+
+export type RemoteRefreshMap = Record<string, RemoteRefreshEntry>;
+
 /**
  * Signals a successful response of the server `load` function.
  * The `uses` property tells the client when it's possible to reuse this data
@@ -379,7 +394,7 @@ export interface ServerMetadata {
 	}>;
 	routes: Map<string, ServerMetadataRoute>;
 	/** For each hashed remote file, a map of export name -> { type, dynamic }, where `dynamic` is `false` for non-dynamic prerender functions */
-	remotes: Map<string, Map<string, { type: RemoteInfo['type']; dynamic: boolean }>>;
+	remotes: Map<string, Map<string, { type: RemoteInternals['type']; dynamic: boolean }>>;
 }
 
 export interface SSRComponent {
@@ -569,40 +584,53 @@ export type BinaryFormMeta = {
 	validate_only?: boolean;
 };
 
-export type RemoteInfo =
-	| {
-			type: 'query' | 'command';
-			id: string;
-			name: string;
-	  }
-	| {
-			/**
-			 * Corresponds to the name of the client-side exports (that's why we use underscores and not dots)
-			 */
-			type: 'query_batch';
-			id: string;
-			name: string;
-			/** Direct access to the function, for remote functions called from the client */
-			run: (args: any[], options: SSROptions) => Promise<any[]>;
-	  }
-	| {
-			type: 'form';
-			id: string;
-			name: string;
-			fn: (
-				body: Record<string, any>,
-				meta: BinaryFormMeta,
-				form_data: FormData | null
-			) => Promise<any>;
-	  }
-	| {
-			type: 'prerender';
-			id: string;
-			name: string;
-			has_arg: boolean;
-			dynamic?: boolean;
-			inputs?: RemotePrerenderInputsGenerator;
-	  };
+interface BaseRemoteInternals {
+	type: string;
+	id: string;
+	name: string;
+}
+
+export interface RemoteQueryInternals extends BaseRemoteInternals {
+	type: 'query';
+	validate: (arg?: any) => MaybePromise<any>;
+}
+export interface RemoteQueryLiveInternals extends BaseRemoteInternals {
+	type: 'query_live';
+	run(
+		event: RequestEvent,
+		state: RequestState,
+		arg: any
+	): Promise<{ iterator: AsyncIterator<any>; cancel: () => void }>;
+}
+
+export interface RemoteQueryBatchInternals extends BaseRemoteInternals {
+	type: 'query_batch';
+	run: (args: any[], options: SSROptions) => Promise<any[]>;
+}
+
+export interface RemoteCommandInternals extends BaseRemoteInternals {
+	type: 'command';
+}
+
+export interface RemoteFormInternals extends BaseRemoteInternals {
+	type: 'form';
+	fn(body: Record<string, any>, meta: BinaryFormMeta, form_data: FormData | null): Promise<any>;
+}
+
+export interface RemotePrerenderInternals extends BaseRemoteInternals {
+	type: 'prerender';
+	has_arg: boolean;
+	dynamic?: boolean;
+	inputs?: RemotePrerenderInputsGenerator;
+}
+
+export type RemoteInternals =
+	| RemoteQueryInternals
+	| RemoteQueryLiveInternals
+	| RemoteQueryBatchInternals
+	| RemoteCommandInternals
+	| RemoteFormInternals
+	| RemotePrerenderInternals;
 
 export interface InternalRemoteFormIssue extends RemoteFormIssue {
 	name: string;
@@ -621,17 +649,25 @@ export type RecordSpan = <T>(options: {
  * used for tracking things like remote function calls
  */
 export interface RequestState {
-	prerendering: PrerenderOptions | undefined;
-	transport: ServerHooks['transport'];
-	handleValidationError: ServerHooks['handleValidationError'];
-	tracing: {
+	readonly prerendering: PrerenderOptions | undefined;
+	readonly transport: ServerHooks['transport'];
+	readonly handleValidationError: ServerHooks['handleValidationError'];
+	readonly tracing: {
 		record_span: RecordSpan;
 	};
-	is_in_remote_function: boolean;
-	form_instances?: Map<any, any>;
-	remote_data?: Map<RemoteInfo, Record<string, MaybePromise<any>>>;
-	refreshes?: Record<string, Promise<any>>;
-	allows_commands?: boolean;
+	readonly remote: {
+		data: null | Map<
+			RemoteInternals,
+			Record<string, { serialize: boolean; data: MaybePromise<any> }>
+		>;
+		forms: null | Map<any, any>;
+		refreshes: null | Record<string, Promise<any>>;
+		requested: null | Map<string, string[]>;
+		validated: null | Map<string, Set<any>>;
+	};
+	readonly is_in_remote_function: boolean;
+	readonly is_in_render: boolean;
+	readonly is_in_universal_load: boolean;
 }
 
 export interface RequestStore {

package/src/utils/css.js

@@ -1,6 +1,5 @@
 import MagicString from 'magic-string';
 import * as svelte from 'svelte/compiler';
-import { escape_for_interpolation } from './escape.js';
 
 /** @typedef {ReturnType<typeof import('svelte/compiler').parseCss>['children']} StyleSheetChildren */
 
@@ -60,8 +59,6 @@ export function fix_css_urls({
 		return css;
 	}
 
-	css = escape_for_interpolation(css);
-
 	// safe guard in case of trailing slashes (but this should never happen)
 	if (paths_assets.endsWith('/')) {
 		paths_assets = paths_assets.slice(0, -1);

package/src/utils/escape.js

@@ -1,3 +1,5 @@
+import { s } from './misc.js';
+
 /**
  * When inside a double-quoted attribute value, only `&` and `"` hold special meaning.
  * @see https://html.spec.whatwg.org/multipage/parsing.html#attribute-value-(double-quoted)-state
@@ -61,11 +63,21 @@ export function escape_html(str, is_attr) {
 	return escaped_str;
 }
 
+/** @typedef {{ placeholder: string, replacement: string }} Replacement */
+
 /**
- * Escapes backticks and dollar signs so that they can be safely used in template literals.
+ * Escapes backslashes, backticks, and dollar signs so that the string can be
+ * safely used as part of a template literal.
  * @param {string} str
+ * @param {Replacement[]} replacements Placeholders to replace after escaping.
+ * 																		 This is necessary when the string contains
+ * 																		 placeholders that we want to preserve, such as `${assets}`
  * @returns {string} escaped string
  */
-export function escape_for_interpolation(str) {
-	return str.replaceAll('`', '\\`').replaceAll('$', '\\$');
+export function escape_for_interpolation(str, replacements) {
+	let escaped = s(str).slice(1, -1).replaceAll('`', '\\`').replaceAll('$', '\\$');
+	for (const { placeholder, replacement } of replacements) {
+		escaped = escaped.replaceAll(placeholder, replacement);
+	}
+	return escaped;
 }

package/src/version.js

@@ -1,4 +1,4 @@
 // generated during release, do not modify
 
 /** @type {string} */
-export const VERSION = '2.54.0';
+export const VERSION = '2.56.0';

package/types/index.d.ts

@@ -1426,6 +1426,22 @@ declare module '@sveltejs/kit' {
 	 */
 	export type ParamMatcher = (param: string) => boolean;
 
+	export type RequestedResult<T> = Iterable<T> &
+		AsyncIterable<T> & {
+			/**
+			 * Call `refresh` on all queries selected by this `requested` invocation.
+			 * This is identical to:
+			 * ```ts
+			 * import { requested } from '$app/server';
+			 *
+			 * for await (const arg of requested(query, ...) {
+			 *   void query(arg).refresh();
+			 * }
+			 * ```
+			 */
+			refreshAll: () => Promise<void>;
+		};
+
 	export interface RequestEvent<
 		Params extends AppLayoutParams<'/'> = AppLayoutParams<'/'>,
 		RouteId extends AppRouteId | null = AppRouteId | null
@@ -1888,10 +1904,12 @@ declare module '@sveltejs/kit' {
 	type AsArgs<Type extends keyof InputTypeMap, Value> = Type extends 'checkbox'
 		? Value extends string[]
 			? [type: Type, value: Value[number] | (string & {})]
-			: [type: Type]
+			: [type: Type] | [type: Type, value: Value | (string & {})]
 		: Type extends 'radio' | 'submit' | 'hidden'
 			? [type: Type, value: Value | (string & {})]
-			: [type: Type];
+			: Type extends 'file' | 'file multiple'
+				? [type: Type]
+				: [type: Type] | [type: Type, value: Value | (string & {})];
 
 	/**
 	 * Form field accessor type that provides name(), value(), and issues() methods
@@ -2032,7 +2050,7 @@ declare module '@sveltejs/kit' {
 				form: HTMLFormElement;
 				data: Input;
 				submit: () => Promise<void> & {
-					updates: (...queries: Array<RemoteQuery<any> | RemoteQueryOverride>) => Promise<void>;
+					updates: (...updates: RemoteQueryUpdate[]) => Promise<void>;
 				};
 			}) => void | Promise<void>
 		): {
@@ -2076,14 +2094,19 @@ declare module '@sveltejs/kit' {
 	 * The return value of a remote `command` function. See [Remote functions](https://svelte.dev/docs/kit/remote-functions#command) for full documentation.
 	 */
 	export type RemoteCommand<Input, Output> = {
-		(arg: undefined extends Input ? Input | void : Input): Promise<Awaited<Output>> & {
-			updates(...queries: Array<RemoteQuery<any> | RemoteQueryOverride>): Promise<Awaited<Output>>;
+		(arg: undefined extends Input ? Input | void : Input): Promise<Output> & {
+			updates(...updates: RemoteQueryUpdate[]): Promise<Output>;
 		};
 		/** The number of pending command executions */
 		get pending(): number;
 	};
 
-	export type RemoteResource<T> = Promise<Awaited<T>> & {
+	export type RemoteQueryUpdate =
+		| RemoteQuery<any>
+		| RemoteQueryFunction<any, any>
+		| RemoteQueryOverride;
+
+	export type RemoteResource<T> = Promise<T> & {
 		/** The error in case the query fails. Most often this is a [`HttpError`](https://svelte.dev/docs/kit/@sveltejs-kit#HttpError) but it isn't guaranteed to be. */
 		get error(): any;
 		/** `true` before the first result is available and during refreshes */
@@ -2096,12 +2119,18 @@ declare module '@sveltejs/kit' {
 			  }
 			| {
 					/** The current value of the query. Undefined until `ready` is `true` */
-					get current(): Awaited<T>;
+					get current(): T;
 					ready: true;
 			  }
 		);
 
 	export type RemoteQuery<T> = RemoteResource<T> & {
+		/**
+		 * Returns a plain promise with the result.
+		 * Unlike awaiting the resource directly, this can only be used _outside_ render
+		 * (i.e. in load functions, event handlers and so on)
+		 */
+		run(): Promise<T>;
 		/**
 		 * On the client, this function will update the value of the query without re-fetching it.
 		 *
@@ -2135,13 +2164,10 @@ declare module '@sveltejs/kit' {
 		 * </form>
 		 * ```
 		 */
-		withOverride(update: (current: Awaited<T>) => Awaited<T>): RemoteQueryOverride;
+		withOverride(update: (current: T) => T): RemoteQueryOverride;
 	};
 
-	export interface RemoteQueryOverride {
-		_key: string;
-		release(): void;
-	}
+	export type RemoteQueryOverride = () => void;
 
 	/**
 	 * The return value of a remote `prerender` function. See [Remote functions](https://svelte.dev/docs/kit/remote-functions#prerender) for full documentation.
@@ -3221,7 +3247,7 @@ declare module '$app/paths' {
 }
 
 declare module '$app/server' {
-	import type { RequestEvent, RemoteCommand, RemoteForm, RemoteFormInput, InvalidField, RemotePrerenderFunction, RemoteQueryFunction } from '@sveltejs/kit';
+	import type { RequestEvent, RemoteCommand, RemoteForm, RemoteFormInput, InvalidField, RemotePrerenderFunction, RemoteQueryFunction, RequestedResult } from '@sveltejs/kit';
 	import type { StandardSchemaV1 } from '@standard-schema/spec';
 	/**
 	 * Read the contents of an imported asset from the filesystem
@@ -3367,6 +3393,34 @@ declare module '$app/server' {
 		 */
 		function batch<Schema extends StandardSchemaV1, Output>(schema: Schema, fn: (args: StandardSchemaV1.InferOutput<Schema>[]) => MaybePromise<(arg: StandardSchemaV1.InferOutput<Schema>, idx: number) => Output>): RemoteQueryFunction<StandardSchemaV1.InferInput<Schema>, Output>;
 	}
+	/**
+	 * In the context of a remote `command` or `form` request, returns an iterable
+	 * of the client-requested refreshes' validated arguments up to the supplied limit.
+	 * Arguments that fail validation or exceed the limit are recorded as failures in
+	 * the response to the client.
+	 *
+	 * @example
+	 * ```ts
+	 * import { requested } from '$app/server';
+	 *
+	 * for (const arg of requested(getPost, 5)) {
+	 * 	// it's safe to throw away this promise -- SvelteKit
+	 * 	// will await it for us and handle any errors by sending
+	 * 	// them to the client.
+	 * 	void getPost(arg).refresh();
+	 * }
+	 * ```
+	 *
+	 * As a shorthand for the above, you can also call `refreshAll` on the result:
+	 *
+	 * ```ts
+	 * import { requested } from '$app/server';
+	 *
+	 * await requested(getPost, 5).refreshAll();
+	 * ```
+	 *
+	 * */
+	export function requested<Input, Output>(query: RemoteQueryFunction<Input, Output>, limit?: number): RequestedResult<Input>;
 	type RemotePrerenderInputsGenerator<Input = any> = () => MaybePromise<Input[]>;
 	type MaybePromise<T> = T | Promise<T>;