@sveltejs/kit 2.63.0 → 3.0.0-next.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sveltejs/kit",
-  "version": "2.63.0",
+  "version": "3.0.0-next.0",
   "description": "SvelteKit is the fastest way to build Svelte apps",
   "keywords": [
     "framework",
@@ -20,38 +20,35 @@
   "dependencies": {
     "@standard-schema/spec": "^1.0.0",
     "@sveltejs/acorn-typescript": "^1.0.9",
-    "@types/cookie": "^0.6.0",
     "acorn": "^8.16.0",
-    "cookie": "^0.6.0",
+    "cookie": "^1.1.1",
     "devalue": "^5.8.1",
     "esm-env": "^1.2.2",
-    "kleur": "^4.1.5",
     "magic-string": "^0.30.5",
     "mrmime": "^2.0.0",
-    "set-cookie-parser": "^3.0.0",
     "sirv": "^3.0.0"
   },
   "devDependencies": {
     "@opentelemetry/api": "^1.0.0",
     "@playwright/test": "^1.60.0",
-    "@sveltejs/vite-plugin-svelte": "^6.0.0-next.3",
+    "@sveltejs/vite-plugin-svelte": "^7.0.0",
     "@types/connect": "^3.4.38",
-    "@types/node": "^18.19.130",
-    "@types/set-cookie-parser": "^2.4.7",
+    "@types/node": "^22.19.19",
     "dts-buddy": "^0.8.0",
-    "jsdom": "^26.1.0",
-    "rollup": "^4.59.0",
+    "jsdom": "^29.1.1",
+    "rolldown": "^1.0.0-rc.6",
     "svelte": "^5.55.7",
-    "typescript": "^5.3.3",
-    "vite": "^6.4.2",
+    "svelte-preprocess": "^6.0.5",
+    "typescript": "~6.0.0",
+    "vite": "^8.0.10",
     "vitest": "^4.1.7"
   },
   "peerDependencies": {
+    "@sveltejs/vite-plugin-svelte": "^7.0.0",
     "@opentelemetry/api": "^1.0.0",
-    "@sveltejs/vite-plugin-svelte": "^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0 || ^7.0.0",
-    "svelte": "^4.0.0 || ^5.0.0-next.0",
-    "typescript": "^5.3.3 || ^6.0.0",
-    "vite": "^5.0.3 || ^6.0.0 || ^7.0.0-beta.0 || ^8.0.0"
+    "svelte": "^5.48.0",
+    "typescript": "^6.0.0",
+    "vite": "^8.0.0"
   },
   "peerDependenciesMeta": {
     "@opentelemetry/api": {
@@ -107,10 +104,6 @@
       "types": "./types/index.d.ts",
       "import": "./src/exports/node/index.js"
     },
-    "./node/polyfills": {
-      "types": "./types/index.d.ts",
-      "import": "./src/exports/node/polyfills.js"
-    },
     "./hooks": {
       "types": "./types/index.d.ts",
       "import": "./src/exports/hooks/index.js"
@@ -122,7 +115,7 @@
   },
   "types": "types/index.d.ts",
   "engines": {
-    "node": ">=18.13"
+    "node": ">=22"
   },
   "scripts": {
     "lint": "prettier --config ../../.prettierrc --check .",
@@ -137,7 +130,9 @@
     "test:server-side-route-resolution:build": "pnpm test:unit && pnpm -r --workspace-concurrency 1 --filter=\"./test/**\" test:server-side-route-resolution:build",
     "test:svelte-async:dev": "pnpm -r --workspace-concurrency 1 --filter=\"./test/**\" test:svelte-async:dev",
     "test:svelte-async:build": "pnpm test:unit && pnpm -r --workspace-concurrency 1 --filter=\"./test/**\" test:svelte-async:build",
-    "test:unit": "vitest --config kit.vitest.config.js run",
+    "test:unit:dev": "vitest --config kit.vitest.config.js run",
+    "test:unit:prod": "NODE_ENV=production vitest --config kit.vitest.config.js run csp.spec.js cookie.spec.js",
+    "test:unit": "pnpm test:unit:dev && pnpm test:unit:prod",
     "generate:version": "node scripts/generate-version.js",
     "generate:types": "node scripts/generate-dts.js"
   }

package/src/cli.js

@@ -1,8 +1,7 @@
 import fs from 'node:fs';
 import process from 'node:process';
-import { parseArgs } from 'node:util';
-import colors from 'kleur';
-import { load_config } from './core/config/index.js';
+import { parseArgs, styleText } from 'node:util';
+import { extract_svelte_config, load_vite_config } from './core/config/index.js';
 import { coalesce_to_error } from './utils/error.js';
 import { resolve_explicit_env_entry } from './core/env.js';
 
@@ -12,9 +11,9 @@ function handle_error(e) {
 
 	if (error.name === 'SyntaxError') throw error;
 
-	console.error(colors.bold().red(`> ${error.message}`));
+	console.error(styleText(['bold', 'red'], `> ${error.message}`));
 	if (error.stack) {
-		console.error(colors.gray(error.stack.split('\n').slice(1).join('\n')));
+		console.error(styleText('grey', error.stack.split('\n').slice(1).join('\n')));
 	}
 
 	process.exit(1);
@@ -26,14 +25,15 @@ const help = `
   Usage: svelte-kit <command> [options]
 
   Commands:
-    sync        Synchronise generated type definitions
+    sync                   Synchronise generated type definitions
 
   Options:
-    --version, -v   Show version number
-    --help, -h      Show this help message
+    --version, -v          Show version number
+    --help, -h             Show this help message
 
   Sync Options:
-    --mode <mode>   Specify a mode for loading environment variables (default: development)
+    --config, -c <config>  Specify a custom Vite config file
+    --mode <mode>          Specify a mode for loading environment variables (default: development)
 `;
 
 let parsed;
@@ -42,14 +42,15 @@ try {
 		options: {
 			version: { type: 'boolean', short: 'v' },
 			help: { type: 'boolean', short: 'h' },
-			mode: { type: 'string', default: 'development' }
+			mode: { type: 'string', default: 'development' },
+			config: { type: 'string', short: 'c', default: undefined }
 		},
 		allowPositionals: true,
 		strict: true
 	});
 } catch (err) {
 	const error = /** @type {Error} */ (err);
-	console.error(colors.bold().red(`> ${error.message}`));
+	console.error(styleText(['bold', 'red'], `> ${error.message}`));
 	console.log(help);
 	process.exit(1);
 }
@@ -95,12 +96,14 @@ if (command === 'sync') {
 	}
 
 	try {
-		const config = await load_config();
+		const vite_config = await load_vite_config(values.config);
+		const sveltekit_config = extract_svelte_config(vite_config);
+
 		const sync = await import('./core/sync/sync.js');
-		sync.all_types(config, values.mode);
+		sync.all_types(sveltekit_config);
 
-		const explicit_env_entry = resolve_explicit_env_entry(config.kit);
-		await sync.env(config.kit, explicit_env_entry, values.mode);
+		const explicit_env_entry = resolve_explicit_env_entry(sveltekit_config.kit);
+		await sync.env(sveltekit_config.kit, explicit_env_entry, vite_config.root, values.mode);
 	} catch (error) {
 		handle_error(error);
 	} finally {
@@ -115,7 +118,7 @@ if (command === 'sync') {
 		}
 	}
 } else {
-	console.error(colors.bold().red(`> Unknown command: ${command}`));
+	console.error(styleText(['bold', 'red'], `> Unknown command: ${command}`));
 	console.log(help);
 	process.exit(1);
 }

package/src/core/adapt/builder.js

@@ -3,17 +3,17 @@
 /** @import { ResolvedConfig } from 'vite' */
 /** @import { RouteDefinition, EnvVarConfig } from '@sveltejs/kit' */
 /** @import { RouteData, ValidatedConfig, BuildData, ServerMetadata, ServerMetadataRoute, Prerendered, PrerenderMap, Logger, RemoteChunk } from 'types' */
-import colors from 'kleur';
+import { loadEnv } from 'vite';
 import * as devalue from 'devalue';
 import { createReadStream, createWriteStream, existsSync, statSync } from 'node:fs';
 import { extname, resolve, join, dirname, relative } from 'node:path';
 import { pipeline } from 'node:stream';
-import { promisify } from 'node:util';
+import { promisify, styleText } from 'node:util';
 import zlib from 'node:zlib';
-import { copy, rimraf, mkdirp, posixify } from '../../utils/filesystem.js';
+import { copy, rimraf, mkdirp } from '../../utils/filesystem.js';
+import { posixify } from '../../utils/os.js';
 import { generate_manifest } from '../generate_manifest/index.js';
 import { get_route_segments } from '../../utils/routing.js';
-import { get_env } from '../../exports/vite/utils.js';
 import generate_fallback from '../postbuild/fallback.js';
 import { write } from '../sync/utils.js';
 import { list_files } from '../utils.js';
@@ -109,71 +109,21 @@ export function create_builder({
 			);
 		},
 
-		async createEntries(fn) {
-			const seen = new Set();
-
-			for (let i = 0; i < route_data.length; i += 1) {
-				const route = route_data[i];
-				if (prerender_map.get(route.id) === true) continue;
-				const { id, filter, complete } = fn(routes[i]);
-
-				if (seen.has(id)) continue;
-				seen.add(id);
-
-				const group = [route];
-
-				// figure out which lower priority routes should be considered fallbacks
-				for (let j = i + 1; j < route_data.length; j += 1) {
-					if (prerender_map.get(routes[j].id) === true) continue;
-					if (filter(routes[j])) {
-						group.push(route_data[j]);
-					}
-				}
-
-				const filtered = new Set(group);
-
-				// heuristic: if /foo/[bar] is included, /foo/[bar].json should
-				// also be included, since the page likely needs the endpoint
-				// TODO is this still necessary, given the new way of doing things?
-				filtered.forEach((route) => {
-					if (route.page) {
-						const endpoint = route_data.find((candidate) => candidate.id === route.id + '.json');
-
-						if (endpoint) {
-							filtered.add(endpoint);
-						}
-					}
-				});
-
-				if (filtered.size > 0) {
-					await complete({
-						generateManifest: ({ relativePath }) =>
-							generate_manifest({
-								build_data,
-								prerendered: [],
-								relative_path: relativePath,
-								routes: Array.from(filtered),
-								remotes
-							})
-					});
-				}
-			}
-		},
-
 		findServerAssets(route_data) {
 			return find_server_assets(
 				build_data,
-				route_data.map((route) => /** @type {import('types').RouteData} */ (lookup.get(route)))
+				route_data.map((route) => /** @type {import('types').RouteData} */ (lookup.get(route))),
+				vite_config.root
 			);
 		},
 
 		async generateFallback(dest) {
 			const manifest_path = `${config.kit.outDir}/output/server/manifest-full.js`;
-			const env = get_env(config.kit.env, vite_config.mode);
+			const env = loadEnv(vite_config.mode, config.kit.env.dir, '');
 
 			const fallback = await generate_fallback({
 				manifest_path,
-				env: env.all,
+				env,
 				out_dir: config.kit.outDir,
 				origin: config.kit.prerender.origin,
 				assets: config.kit.files.assets
@@ -181,11 +131,10 @@ export function create_builder({
 
 			if (existsSync(dest)) {
 				console.log(
-					colors
-						.bold()
-						.yellow(
-							`Overwriting ${dest} with fallback page. Consider using a different name for the fallback.`
-						)
+					styleText(
+						['bold', 'yellow'],
+						`Overwriting ${dest} with fallback page. Consider using a different name for the fallback.`
+					)
 				);
 			}
 
@@ -196,24 +145,22 @@ export function create_builder({
 			if (!build_data.client?.uses_env_dynamic_public) return;
 
 			const dest = `${config.kit.outDir}/output/prerendered/dependencies/${config.kit.appDir}/env.js`;
-			const env = get_env(config.kit.env, vite_config.mode);
+			const env = loadEnv(vite_config.mode, config.kit.env.dir, '');
 
-			const values = config.kit.experimental.explicitEnvironmentVariables ? {} : env.public;
+			/** @type {Record<string, any>} */
+			const values = {};
+			const variables = explicit_env_config ?? {};
 
-			if (config.kit.experimental.explicitEnvironmentVariables) {
-				const variables = explicit_env_config ?? {};
+			/** @type {Record<string, StandardSchemaV1.Issue[]>} */
+			const issues = {};
 
-				/** @type {Record<string, StandardSchemaV1.Issue[]>} */
-				const issues = {};
-
-				for (const [name, config] of Object.entries(variables)) {
-					if (config.static || !config.public) continue;
-					values[name] = validate(variables, env.all[name], name, issues);
-				}
-
-				handle_issues(issues);
+			for (const [name, config] of Object.entries(variables)) {
+				if (config.static || !config.public) continue;
+				values[name] = validate(variables, env[name], name, issues);
 			}
 
+			handle_issues(issues);
+
 			write(dest, `export const env=${devalue.uneval(values)}`);
 		},
 
@@ -225,7 +172,8 @@ export function create_builder({
 				routes: subset
 					? subset.map((route) => /** @type {import('types').RouteData} */ (lookup.get(route)))
 					: route_data.filter((route) => prerender_map.get(route.id) !== true),
-				remotes
+				remotes,
+				root: vite_config.root
 			});
 		},
 

package/src/core/adapt/index.js

@@ -1,7 +1,9 @@
-import colors from 'kleur';
+/** @import { Adapter } from '@sveltejs/kit' */
+import { styleText } from 'node:util';
 import { create_builder } from './builder.js';
 
 /**
+ * @param {Adapter} adapter
  * @param {import('types').ValidatedConfig} config
  * @param {import('types').BuildData} build_data
  * @param {import('types').ServerMetadata} server_metadata
@@ -13,6 +15,7 @@ import { create_builder } from './builder.js';
  * @param {Record<string, import('@sveltejs/kit').EnvVarConfig<any>> | null} explicit_env_config
  */
 export async function adapt(
+	adapter,
 	config,
 	build_data,
 	server_metadata,
@@ -23,10 +26,9 @@ export async function adapt(
 	vite_config,
 	explicit_env_config
 ) {
-	// This is only called when adapter is truthy, so the cast is safe
-	const { name, adapt } = /** @type {import('@sveltejs/kit').Adapter} */ (config.kit.adapter);
+	const { name, adapt } = adapter;
 
-	console.log(colors.bold().cyan(`\n> Using ${name}`));
+	console.log(styleText(['bold', 'cyan'], `\n> Using ${name}`));
 
 	const builder = create_builder({
 		config,

package/src/core/config/index.js

@@ -16,7 +16,7 @@ import { import_peer } from '../../utils/import.js';
  * @param {ValidatedConfig} config
  */
 export function load_template(cwd, { kit }) {
-	const { env, files } = kit;
+	const { files } = kit;
 
 	const relative = path.relative(cwd, files.appTemplate);
 
@@ -33,16 +33,6 @@ export function load_template(cwd, { kit }) {
 		}
 	});
 
-	if (!kit.experimental.explicitEnvironmentVariables) {
-		for (const match of contents.matchAll(/%sveltekit\.env\.([^%]+)%/g)) {
-			if (!match[1].startsWith(env.publicPrefix)) {
-				throw new Error(
-					`Environment variables in ${relative} must start with ${env.publicPrefix} (saw %sveltekit.env.${match[1]}%)`
-				);
-			}
-		}
-	}
-
 	return contents;
 }
 
@@ -64,85 +54,23 @@ export function load_error_page(config) {
 }
 
 /**
- * Loads and validates Svelte config file. Tries Vite config first, falls back to svelte.config.js
- * @param {{ cwd?: string }} options
- * @returns {Promise<ValidatedConfig>}
+ * @param {string} [config]
  */
-export async function load_config({ cwd = process.cwd() } = {}) {
-	try {
-		const vite_config = await load_config_from_vite({ cwd });
-		if (vite_config) {
-			return vite_config;
-		}
-	} catch (e) {
-		// TODO SvelteKit 3: fail completely instead
-		console.error(
-			'Loading Svelte config from Vite config failed:',
-			e,
-			'\n\nFalling back to loading svelte.config.js'
-		);
-	}
-
-	return load_svelte_config(cwd);
-}
-
-/**
- * Loads and validates Svelte config file
- * @param {string} [cwd]
- * @returns {Promise<ValidatedConfig>}
- */
-export async function load_svelte_config(cwd = process.cwd()) {
-	const config_files = ['js', 'ts']
-		.map((ext) => path.join(cwd, `svelte.config.${ext}`))
-		.filter((f) => fs.existsSync(f));
-
-	if (config_files.length === 0) {
-		console.log(
-			`No Svelte config file found in ${cwd} - using SvelteKit's default configuration without an adapter.`
-		);
-		return process_config({}, { cwd });
-	}
-
-	const config_file = config_files[0];
-	if (config_files.length > 1) {
-		console.log(
-			`Found multiple Svelte config files in ${cwd}: ${config_files.map((f) => path.basename(f)).join(', ')}. Using ${path.basename(config_file)}`
-		);
-	}
+export async function load_vite_config(config) {
+	const { resolveConfig } = /** @type {import('vite')} */ (
+		await import_peer('vite', process.cwd())
+	);
 
-	const config = await import(`${url.pathToFileURL(config_file).href}?ts=${Date.now()}`);
-	return process_config(config.default, { cwd, source: path.relative(cwd, config_file) });
+	return resolveConfig({ configFile: config }, 'build', process.env.MODE ?? 'production');
 }
 
 /**
- * Loads and validates Svelte config via Vite config resolution (if set that way).
- * @param {{ cwd?: string; mode?: string }} options
- * @returns {Promise<ValidatedConfig | undefined>}
+ * @param {ResolvedConfig} vite_config
+ * @returns {ValidatedConfig}
  */
-async function load_config_from_vite({ cwd = process.cwd(), mode } = {}) {
-	const { resolveConfig } = await import_peer('vite');
-	const current_cwd = process.cwd();
-
-	if (cwd !== current_cwd) {
-		process.chdir(cwd);
-	}
-
-	/** @type {ResolvedConfig} */
-	let resolved;
-
-	try {
-		resolved = await resolveConfig({}, 'build', mode ?? process.env.MODE ?? 'production');
-	} finally {
-		if (cwd !== current_cwd) {
-			process.chdir(current_cwd);
-		}
-	}
-
-	const plugin = resolved.plugins.find(
-		(plugin) => plugin.name === 'vite-plugin-sveltekit-setup' && plugin.api?.options
-	);
-
-	return plugin?.api.options;
+export function extract_svelte_config(vite_config) {
+	const plugin = vite_config.plugins.find((p) => p.name === 'vite-plugin-sveltekit-setup');
+	return plugin?.api.options ?? process_config({});
 }
 
 /**

package/src/core/config/options.js

@@ -1,8 +1,6 @@
 /** @import { Validator } from './types.js' */
 
 import process from 'node:process';
-import colors from 'kleur';
-import { supportsTrustedTypes } from '../sync/utils.js';
 
 const directives = object({
 	'child-src': string_array(),
@@ -29,14 +27,8 @@ const directives = object({
 	'navigate-to': string_array(),
 	'report-uri': string_array(),
 	'report-to': string_array(),
-	'require-trusted-types-for': validate(undefined, (input, keypath) => {
-		assert_trusted_types_supported(keypath);
-		return string_array()(input, keypath);
-	}),
-	'trusted-types': validate(undefined, (input, keypath) => {
-		assert_trusted_types_supported(keypath);
-		return string_array()(input, keypath);
-	}),
+	'require-trusted-types-for': string_array(),
+	'trusted-types': string_array(),
 	'upgrade-insecure-requests': boolean(false),
 	'require-sri-for': string_array(),
 	'block-all-mixed-content': boolean(false),
@@ -66,15 +58,9 @@ const options = object(
 		}),
 
 		kit: object({
-			adapter: validate(null, (input, keypath) => {
+			adapter: validate(undefined, (input, keypath) => {
 				if (typeof input !== 'object' || !input.adapt) {
-					let message = `${keypath} should be an object with an "adapt" method`;
-
-					if (Array.isArray(input) || typeof input === 'string') {
-						// for the early adapter adopters
-						message += ', rather than the name of an adapter';
-					}
-
+					const message = `The SvelteKit Vite plugin ${keypath} should be an object with an \`adapt\` method`;
 					throw new Error(`${message}. See https://svelte.dev/docs/kit/adapters`);
 				}
 
@@ -116,10 +102,8 @@ const options = object(
 			}),
 
 			csrf: object({
-				checkOrigin: deprecate(
-					boolean(true),
-					(keypath) =>
-						`\`${keypath}\` has been deprecated in favour of \`csrf.trustedOrigins\`. It will be removed in a future version`
+				checkOrigin: removed(
+					(keypath) => `\`${keypath}\` has been removed in favour of \`csrf.trustedOrigins\``
 				),
 				trustedOrigins: string_array([])
 			}),
@@ -127,9 +111,7 @@ const options = object(
 			embedded: boolean(false),
 
 			env: object({
-				dir: string(process.cwd()),
-				publicPrefix: string('PUBLIC_'),
-				privatePrefix: string('')
+				dir: string(process.cwd())
 			}),
 
 			experimental: object({
@@ -139,7 +121,6 @@ const options = object(
 				instrumentation: object({
 					server: boolean(false)
 				}),
-				explicitEnvironmentVariables: boolean(false),
 				remoteFunctions: boolean(false),
 				forkPreloads: boolean(false),
 				handleRenderingErrors: boolean(false)
@@ -168,7 +149,10 @@ const options = object(
 			outDir: string('.svelte-kit'),
 
 			output: object({
-				preloadStrategy: list(['modulepreload', 'preload-js', 'preload-mjs']),
+				linkHeaderPreload: boolean(false),
+				preloadStrategy: removed(
+					(keypath) => `\`${keypath}\` has been removed. modulepreload will always be used`
+				),
 				bundleStrategy: list(['split', 'single', 'inline'])
 			}),
 
@@ -326,22 +310,37 @@ const options = object(
 	true
 );
 
+// /**
+//  * @param {Validator} fn
+//  * @param {(keypath: string) => string} get_message
+//  * @returns {Validator}
+//  */
+// function deprecate(
+// 	fn,
+// 	get_message = (keypath) =>
+// 		`The \`${keypath}\` option is deprecated, and will be removed in a future version`
+// ) {
+// 	return (input, keypath) => {
+// 		if (input !== undefined) {
+// 			console.warn(styleText(['bold', 'yellow'], get_message(keypath)));
+// 		}
+
+// 		return fn(input, keypath);
+// 	};
+// }
+
 /**
- * @param {Validator} fn
  * @param {(keypath: string) => string} get_message
  * @returns {Validator}
  */
-function deprecate(
-	fn,
+function removed(
 	get_message = (keypath) =>
-		`The \`${keypath}\` option is deprecated, and will be removed in a future version`
+		`The \`${keypath}\` option has been removed. Please see the list of breaking changes for your major release`
 ) {
 	return (input, keypath) => {
-		if (input !== undefined) {
-			console.warn(colors.bold().yellow(get_message(keypath)));
+		if (typeof input !== 'undefined') {
+			throw new Error(get_message(keypath));
 		}
-
-		return fn(input, keypath);
 	};
 }
 
@@ -350,7 +349,7 @@ function deprecate(
  * @param {boolean} [allow_unknown]
  * @returns {Validator}
  */
-function object(children, allow_unknown = false) {
+export function object(children, allow_unknown = false) {
 	return (input, keypath) => {
 		/** @type {Record<string, any>} */
 		const output = {};
@@ -390,7 +389,7 @@ function object(children, allow_unknown = false) {
  * @param {(value: any, keypath: string) => any} fn
  * @returns {Validator}
  */
-function validate(fallback, fn) {
+export function validate(fallback, fn) {
 	return (input, keypath) => {
 		return input === undefined ? fallback : fn(input, keypath);
 	};
@@ -494,13 +493,4 @@ function assert_string(input, keypath) {
 	}
 }
 
-/** @param {string} keypath */
-function assert_trusted_types_supported(keypath) {
-	if (!supportsTrustedTypes()) {
-		throw new Error(
-			`${keypath} is not supported by your version of Svelte. Please upgrade to Svelte 5.51.0 or later to use this directive.`
-		);
-	}
-}
-
 export default options;