@sveltejs/kit 3.0.0-next.0 → 3.0.0-next.10

package/src/exports/index.js

@@ -1,6 +1,5 @@
 /** @import { StandardSchemaV1 } from '@standard-schema/spec' */
-
-import { HttpError, Redirect, ActionFailure, ValidationError } from './internal/index.js';
+import { HttpError, Redirect, ActionFailure, ValidationError } from './internal/shared.js';
 import { BROWSER, DEV } from 'esm-env';
 import {
 	add_data_suffix,
@@ -11,8 +10,10 @@ import {
 	strip_resolution_suffix
 } from '../runtime/pathname.js';
 import { text_encoder } from '../runtime/utils.js';
+import { validate_redirect_location } from './url.js';
 
 export { VERSION } from '../version.js';
+export { defineParams } from './params.js';
 
 // Keep the status codes as `number` because restricting to certain numbers makes it unnecessarily hard to use compared to the benefits
 // (we have runtime errors already to check for invalid codes). Also see https://github.com/sveltejs/kit/issues/11780
@@ -26,10 +27,10 @@ export { VERSION } from '../version.js';
  * return an error response without invoking `handleError`.
  * Make sure you're not catching the thrown error, which would prevent SvelteKit from handling it.
  * @param {number} status The [HTTP status code](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#client_error_responses). Must be in the range 400-599.
- * @param {App.Error} body An object that conforms to the App.Error type. If a string is passed, it will be used as the message property.
+ * @param {Omit<App.Error, 'status'> & { status?: App.Error['status'] }} body An object that conforms to the App.Error type. If a string is passed, it will be used as the message property.
  * @overload
  * @param {number} status
- * @param {App.Error} body
+ * @param {Omit<App.Error, 'status'> & { status?: App.Error['status'] }} body
  * @return {never}
  * @throws {import('./public.js').HttpError} This error instructs SvelteKit to initiate HTTP error handling.
  * @throws {Error} If the provided status is invalid (not between 400 and 599).
@@ -40,10 +41,10 @@ export { VERSION } from '../version.js';
  * return an error response without invoking `handleError`.
  * Make sure you're not catching the thrown error, which would prevent SvelteKit from handling it.
  * @param {number} status The [HTTP status code](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#client_error_responses). Must be in the range 400-599.
- * @param {{ message: string } extends App.Error ? App.Error | string | undefined : never} [body] An object that conforms to the App.Error type. If a string is passed, it will be used as the message property.
+ * @param {{ status: number; message: string } extends App.Error ? string | void | undefined : never} body The error message.
  * @overload
  * @param {number} status
- * @param {{ message: string } extends App.Error ? App.Error | string | undefined : never} [body]
+ * @param {{ status: number; message: string } extends App.Error ? string | void | undefined : never} body
  * @return {never}
  * @throws {import('./public.js').HttpError} This error instructs SvelteKit to initiate HTTP error handling.
  * @throws {Error} If the provided status is invalid (not between 400 and 599).
@@ -54,17 +55,34 @@ export { VERSION } from '../version.js';
  * return an error response without invoking `handleError`.
  * Make sure you're not catching the thrown error, which would prevent SvelteKit from handling it.
  * @param {number} status The [HTTP status code](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#client_error_responses). Must be in the range 400-599.
- * @param {{ message: string } extends App.Error ? App.Error | string | undefined : never} body An object that conforms to the App.Error type. If a string is passed, it will be used as the message property.
+ * @param {string} body The error message.
+ * @param {{ status: number; message: string } extends App.Error ? never : Omit<App.Error, 'status' | 'message'>} properties Additional properties of the App.Error type.
+ * @overload
+ * @param {number} status
+ * @param {string} body
+ * @param {{ status: number; message: string } extends App.Error ? never : Omit<App.Error, 'status' | 'message'>} properties
  * @return {never}
  * @throws {import('./public.js').HttpError} This error instructs SvelteKit to initiate HTTP error handling.
  * @throws {Error} If the provided status is invalid (not between 400 and 599).
  */
-export function error(status, body) {
+/**
+ * Throws an error with a HTTP status code and an optional message.
+ * When called during request handling, this will cause SvelteKit to
+ * return an error response without invoking `handleError`.
+ * Make sure you're not catching the thrown error, which would prevent SvelteKit from handling it.
+ * @param {any} status The [HTTP status code](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#client_error_responses). Must be in the range 400-599.
+ * @param {any} [body] An object that conforms to the App.Error type. If a string is passed, it will be used as the message property.
+ * @param {any} [properties] Additional properties of the App.Error type when passing a string message.
+ * @return {never}
+ * @throws {import('./public.js').HttpError} This error instructs SvelteKit to initiate HTTP error handling.
+ * @throws {Error} If the provided status is invalid (not between 400 and 599).
+ */
+export function error(status, body, properties) {
 	if ((!BROWSER || DEV) && (isNaN(status) || status < 400 || status > 599)) {
 		throw new Error(`HTTP error status codes must be between 400 and 599 — ${status} is invalid`);
 	}
 
-	throw new HttpError(status, body);
+	throw new HttpError(status, body, properties);
 }
 
 /**
@@ -92,19 +110,23 @@ export function isHttpError(e, status) {
  *
  * @param {300 | 301 | 302 | 303 | 304 | 305 | 306 | 307 | 308 | ({} & number)} status The [HTTP status code](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#redirection_messages). Must be in the range 300-308.
  * @param {string | URL} location The location to redirect to.
+ * @param {{ external?: boolean | string[] }} [options] To redirect to an external URL, you must pass `{ external: true }` to allow any external URL except `javascript:` URLs, or `{ external: [...] }` with an allowlist of permitted origins.
  * @throws {import('./public.js').Redirect} This error instructs SvelteKit to redirect to the specified location.
- * @throws {Error} If the provided status is invalid or the location cannot be used as a header value.
+ * @throws {Error} If the provided status is invalid, the location cannot be used as a header value, or the location is an external URL without permission.
  * @return {never}
  */
-export function redirect(status, location) {
+export function redirect(status, location, options) {
 	if ((!BROWSER || DEV) && (isNaN(status) || status < 300 || status > 308)) {
 		throw new Error('Invalid status code');
 	}
 
+	const href = location.toString();
+	validate_redirect_location(href, options);
+
 	throw new Redirect(
 		// @ts-ignore
 		status,
-		location.toString()
+		href
 	);
 }
 
@@ -212,7 +234,7 @@ export function isActionFailure(e) {
  * ```ts
  * import { invalid } from '@sveltejs/kit';
  * import { form } from '$app/server';
- * import { tryLogin } from '$lib/server/auth';
+ * import { tryLogin } from '#lib/server/auth';
  * import * as v from 'valibot';
  *
  * export const login = form(

package/src/exports/internal/client.js

@@ -0,0 +1,5 @@
+export function get_origin() {
+	return window.location.origin;
+}
+
+export * from './shared.js';

package/src/exports/internal/env.js

@@ -1,7 +1,7 @@
 /** @import { StandardSchemaV1 } from '@standard-schema/spec' */
 /** @import { EnvVarConfig } from '@sveltejs/kit' */
 
-import { stackless } from '../vite/utils.js';
+import { stackless } from '../../utils/error.js';
 
 const MISSING = {
 	message: `Value is missing. If it is optional, add a Standard Schema validator declaring it as such.`
@@ -16,7 +16,7 @@ const ASYNC_VALIDATOR = {
 };
 
 /**
- * @param {Record<string, EnvVarConfig<any>>} variables
+ * @param {Record<string, EnvVarConfig<any> | undefined>} variables
  * @param {string | undefined} value
  * @param {string} name
  * @param {Record<string, StandardSchemaV1.Issue[]>} issues

package/src/exports/internal/index.js

@@ -1,90 +1 @@
-/** @import { StandardSchemaV1 } from '@standard-schema/spec' */
-
-export class HttpError {
-	/**
-	 * @param {number} status
-	 * @param {{message: string} extends App.Error ? (App.Error | string | undefined) : App.Error} body
-	 */
-	constructor(status, body) {
-		this.status = status;
-		if (typeof body === 'string') {
-			this.body = { message: body };
-		} else if (body) {
-			this.body = body;
-		} else {
-			this.body = { message: `Error: ${status}` };
-		}
-	}
-
-	toString() {
-		return JSON.stringify(this.body);
-	}
-}
-
-export class Redirect {
-	/**
-	 * @param {300 | 301 | 302 | 303 | 304 | 305 | 306 | 307 | 308} status
-	 * @param {string} location
-	 */
-	constructor(status, location) {
-		try {
-			new Headers({ location });
-		} catch {
-			throw new Error(
-				`Invalid redirect location ${JSON.stringify(location)}: ` +
-					'this string contains characters that cannot be used in HTTP headers'
-			);
-		}
-
-		this.status = status;
-		this.location = location;
-	}
-}
-
-/**
- * An error that was thrown from within the SvelteKit runtime that is not fatal and doesn't result in a 500, such as a 404.
- * `SvelteKitError` goes through `handleError`.
- * @extends Error
- */
-export class SvelteKitError extends Error {
-	/**
-	 * @param {number} status
-	 * @param {string} text
-	 * @param {string} message
-	 */
-	constructor(status, text, message) {
-		super(message);
-		this.status = status;
-		this.text = text;
-	}
-}
-
-/**
- * @template [T=undefined]
- */
-export class ActionFailure {
-	/**
-	 * @param {number} status
-	 * @param {T} data
-	 */
-	constructor(status, data) {
-		this.status = status;
-		this.data = data;
-	}
-}
-
-/**
- * Error thrown when form validation fails imperatively
- */
-export class ValidationError extends Error {
-	/**
-	 * @param {StandardSchemaV1.Issue[]} issues
-	 */
-	constructor(issues) {
-		super('Validation failed');
-		this.name = 'ValidationError';
-		this.issues = issues;
-	}
-}
-
-export { init_remote_functions } from './remote-functions.js';
+export * from '#internal';

package/src/exports/internal/{event.js → server/event.js}

@@ -1,8 +1,7 @@
 /** @import { RequestEvent } from '@sveltejs/kit' */
 /** @import { RequestStore } from 'types' */
 /** @import { AsyncLocalStorage } from 'node:async_hooks' */
-
-import { IN_WEBCONTAINER } from '../../runtime/server/constants.js';
+import { IN_WEBCONTAINER } from '../../../runtime/server/constants.js';
 
 /** @type {RequestStore | null} */
 let sync_store = null;

package/src/exports/internal/server/index.js

@@ -0,0 +1,33 @@
+/** @import { Span } from '@opentelemetry/api' */
+import { try_get_request_store } from './event.js';
+
+export function get_origin() {
+	return try_get_request_store()?.event.url.origin;
+}
+
+/**
+ * @template {{ tracing: { enabled: boolean, root: Span, current: Span } }} T
+ * @param {T} event_like
+ * @param {Span} current
+ * @returns {T}
+ */
+export function merge_tracing(event_like, current) {
+	return {
+		...event_like,
+		tracing: {
+			...event_like.tracing,
+			current
+		}
+	};
+}
+
+export {
+	with_request_store,
+	getRequestEvent,
+	get_request_store,
+	try_get_request_store
+} from './event.js';
+
+export { init_remote_functions } from './remote-functions.js';
+
+export * from '../shared.js';

package/src/exports/internal/shared.js

@@ -0,0 +1,89 @@
+/** @import { StandardSchemaV1 } from '@standard-schema/spec' */
+
+export class HttpError {
+	/**
+	 * @param {number} status
+	 * @param {Omit<App.Error, 'status'> | string | undefined} body
+	 * @param {Omit<App.Error, 'status' | 'message'>} [properties]
+	 */
+	constructor(status, body, properties) {
+		this.status = status;
+		if (typeof body === 'string') {
+			this.body = { ...properties, message: body, status };
+		} else if (body) {
+			this.body = { ...body, status };
+		} else {
+			this.body = { message: `Error: ${status}`, status };
+		}
+	}
+
+	toString() {
+		return JSON.stringify(this.body);
+	}
+}
+
+export class Redirect {
+	/**
+	 * @param {300 | 301 | 302 | 303 | 304 | 305 | 306 | 307 | 308} status
+	 * @param {string} location
+	 */
+	constructor(status, location) {
+		try {
+			new Headers({ location });
+		} catch {
+			throw new Error(
+				`Invalid redirect location ${JSON.stringify(location)}: ` +
+					'this string contains characters that cannot be used in HTTP headers'
+			);
+		}
+
+		this.status = status;
+		this.location = location;
+	}
+}
+
+/**
+ * An error that was thrown from within the SvelteKit runtime that is not fatal and doesn't result in a 500, such as a 404.
+ * `SvelteKitError` goes through `handleError`.
+ * @extends Error
+ */
+export class SvelteKitError extends Error {
+	/**
+	 * @param {number} status
+	 * @param {string} text
+	 * @param {string} message
+	 */
+	constructor(status, text, message) {
+		super(message);
+		this.status = status;
+		this.text = text;
+	}
+}
+
+/**
+ * @template [T=undefined]
+ */
+export class ActionFailure {
+	/**
+	 * @param {number} status
+	 * @param {T} data
+	 */
+	constructor(status, data) {
+		this.status = status;
+		this.data = data;
+	}
+}
+
+/**
+ * Error thrown when form validation fails imperatively
+ */
+export class ValidationError extends Error {
+	/**
+	 * @param {StandardSchemaV1.Issue[]} issues
+	 */
+	constructor(issues) {
+		super('Validation failed');
+		this.name = 'ValidationError';
+		this.issues = issues;
+	}
+}

package/src/exports/node/index.js

@@ -1,8 +1,11 @@
 import { createReadStream } from 'node:fs';
 import { Readable } from 'node:stream';
-import { SvelteKitError } from '../internal/index.js';
+import { SvelteKitError } from '../internal/shared.js';
 import { noop } from '../../utils/functions.js';
 
+/** @type {WeakMap<import('http').IncomingMessage, (chunk: Buffer) => void>} */
+const body_data_listeners = new WeakMap();
+
 /**
  * @param {import('http').IncomingMessage} req
  * @param {number} [body_size_limit]
@@ -47,17 +50,19 @@ function get_raw_body(req, body_size_limit) {
 				return;
 			}
 
-			req.on('error', (error) => {
+			/** @param {Error} error */
+			const on_error = (error) => {
 				cancelled = true;
 				controller.error(error);
-			});
+			};
 
-			req.on('end', () => {
+			const on_end = () => {
 				if (cancelled) return;
 				controller.close();
-			});
+			};
 
-			req.on('data', (chunk) => {
+			/** @param {Buffer} chunk */
+			const on_data = (chunk) => {
 				if (cancelled) return;
 
 				size += chunk.length;
@@ -89,7 +94,12 @@ function get_raw_body(req, body_size_limit) {
 				if (controller.desiredSize === null || controller.desiredSize <= 0) {
 					req.pause();
 				}
-			});
+			};
+
+			req.on('error', on_error);
+			req.on('end', on_end);
+			req.on('data', on_data);
+			body_data_listeners.set(req, on_data);
 		},
 
 		pull() {
@@ -109,11 +119,9 @@ function get_raw_body(req, body_size_limit) {
  *   base: string;
  *   bodySizeLimit?: number;
  * }} options
- * @returns {Promise<Request>}
+ * @returns {Request}
  */
-// TODO 3.0 make the signature synchronous?
-// eslint-disable-next-line @typescript-eslint/require-await
-export async function getRequest({ request, base, bodySizeLimit }) {
+export function getRequest({ request, base, bodySizeLimit }) {
 	let headers = /** @type {Record<string, string>} */ (request.headers);
 	if (request.httpVersionMajor >= 2) {
 		// the Request constructor rejects headers with ':' in the name
@@ -154,14 +162,53 @@ export async function getRequest({ request, base, bodySizeLimit }) {
 	});
 }
 
+/**
+ * Drains any unconsumed request body once the response has been sent. When a
+ * route doesn't read the request body (for example a page route receiving a
+ * POST), the unread bytes remain buffered in the socket. On keep-alive
+ * connections Node's HTTP parser then reads those leftover bytes as the next
+ * request, fails to parse them, and resets the connection — losing any
+ * pipelined request. Resuming the request discards the bytes so the connection
+ * stays usable.
+ *
+ * Because `get_raw_body` attaches a `data` listener, Node marks the request as
+ * being consumed (`req._consuming`) and skips its own automatic drain, so we
+ * have to do it ourselves. The whole remaining body is read and discarded; this
+ * is the intended trade-off (keeping the connection reusable) over destroying it.
+ * @see https://github.com/sveltejs/kit/issues/14916
+ * @see https://github.com/sveltejs/kit/issues/15526
+ * @param {import('http').ServerResponse} res
+ */
+function drain_request(res) {
+	const req = res.req;
+	if (!req || req.readableEnded || req.destroyed) return;
+
+	// When the body went unread, get_raw_body's `data` listener is still attached
+	// and enqueues into a ReadableStream nobody consumes; it pauses the request at
+	// the high water mark, so one chunk sits in memory and the rest stays buffered
+	// in the socket. Remove only that `data` listener so the resumed stream drops
+	// the remaining bytes instead of re-buffering them. The `end` and `error`
+	// listeners stay attached so the body's ReadableStream is still closed (or
+	// errored) once draining completes, and a consumer that stopped reading
+	// mid-body sees a clean end instead of hanging.
+	const on_data = body_data_listeners.get(req);
+	if (on_data) {
+		req.removeListener('data', on_data);
+		body_data_listeners.delete(req);
+	}
+
+	req.resume();
+}
+
 /**
  * @param {import('http').ServerResponse} res
  * @param {Response} response
- * @returns {Promise<void>}
+ * @returns {void}
  */
-// TODO 3.0 make the signature synchronous?
-// eslint-disable-next-line @typescript-eslint/require-await
-export async function setResponse(res, response) {
+export function setResponse(res, response) {
+	res.once('finish', () => drain_request(res));
+	res.once('close', () => drain_request(res));
+
 	for (const [key, value] of response.headers) {
 		try {
 			res.setHeader(key, key === 'set-cookie' ? response.headers.getSetCookie() : value);

package/src/exports/params.js

@@ -0,0 +1,63 @@
+/**
+ * Define [parameter matchers](https://svelte.dev/docs/kit/advanced-routing#Matching) for your app.
+ *
+ * @example
+ * ```js
+ * import { defineParams } from '@sveltejs/kit';
+ * import * as v from 'valibot';
+ *
+ * export const params = defineParams({
+ * 	locale: (param) => {
+ * 		if (param !== 'de' && param !== 'en') return;
+ * 		return param;
+ * 	},
+ * 	number: v.pipe(v.string(), v.toNumber())
+ * });
+ * ```
+ *
+ * @template {Record<string, import('./public.js').ParamDefinition>} T
+ * @param {T} definitions
+ * @returns {import('./public.js').DefinedParams<T>}
+ */
+export function defineParams(definitions) {
+	/** @type {Record<string, import('./public.js').ParamMatcher>} */
+	const matchers = {};
+
+	for (const [key, definition] of Object.entries(definitions)) {
+		matchers[key] = normalize_param_definition(definition);
+	}
+
+	return /** @type {import('./public.js').DefinedParams<T>} */ (matchers);
+}
+
+/**
+ * @param {import('@sveltejs/kit').ParamDefinition} definition
+ * @returns {import('@sveltejs/kit').ParamMatcher}
+ */
+export function normalize_param_definition(definition) {
+	if (typeof definition === 'function') {
+		return /** @type {import('@sveltejs/kit').ParamMatcher} */ (
+			/** @type {unknown} */ ({
+				'~standard': {
+					validate(/** @type {unknown} */ value) {
+						const result = definition(/** @type {string} */ (value));
+
+						if (result === undefined) {
+							return { issues: [{ message: 'Invalid param' }] };
+						}
+
+						if (/** @type {any} */ (result) instanceof Promise) return result; // will be validated and rejected upstream
+
+						return { value: result };
+					}
+				}
+			})
+		);
+	}
+
+	if (definition && typeof definition === 'object' && '~standard' in definition) {
+		return definition;
+	}
+
+	throw new Error('Invalid param definition');
+}