@sveltejs/kit 3.0.0-next.0 → 3.0.0-next.10

package/src/exports/url.js

@@ -0,0 +1,86 @@
+import { DEV } from 'esm-env';
+// we use the export subpath to conditionally import the client/server `get_origin`
+// so that `node:async_hooks` isn't pulled into the client build
+import { get_origin } from '#internal';
+import { matches_external_allowlist_entry } from '../utils/url.js';
+
+// See https://datatracker.ietf.org/doc/html/rfc2606 - no domains under the .invalid TLD can be registered
+const REDIRECT_BASE = 'https://sveltekit-redirect.invalid';
+
+/**
+ * Whether a redirect location is absolute, i.e. not a root-relative or path-relative URL,
+ * and not pointing to the same origin as we're currently on (if determineable).
+ * @param {string} location
+ */
+export function is_external_location(location) {
+	const origin = get_origin();
+
+	try {
+		return !matches_external_allowlist_entry(location, origin ?? REDIRECT_BASE);
+	} catch {
+		return true;
+	}
+}
+
+const javascript_protocols = new Set(['javascript:', 'data:']);
+
+/**
+ * @param {string} location
+ */
+function is_javascript_location(location) {
+	try {
+		return javascript_protocols.has(new URL(location, REDIRECT_BASE).protocol);
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * @param {string} location
+ * @param {{ external?: boolean | string[] }} [options]
+ */
+export function validate_redirect_location(location, options) {
+	if (!is_external_location(location)) return;
+
+	const external = options?.external;
+
+	if (!external) {
+		throw new Error(
+			DEV
+				? `Cannot redirect to external URL ${JSON.stringify(location)}. ` +
+						'To redirect to an external URL, pass `{ external: true }` or an allowlist of permitted origins as the third argument to `redirect`'
+				: 'Cannot redirect to external URL unless explicitly allowed'
+		);
+	}
+
+	if (external === true) {
+		if (is_javascript_location(location)) {
+			throw new Error(
+				DEV
+					? `Cannot redirect to ${JSON.stringify(location)} with \`{ external: true }\`. ` +
+							'The `javascript:` and `data:` protocols must be explicitly listed in the `external` allowlist'
+					: 'Cannot redirect to external URL unless explicitly allowed'
+			);
+		}
+
+		return;
+	}
+
+	if (Array.isArray(external)) {
+		if (!external.some((allowed) => matches_external_allowlist_entry(location, allowed))) {
+			throw new Error(
+				DEV
+					? `Cannot redirect to ${JSON.stringify(location)}: URL origin is not included in the \`external\` allowlist`
+					: 'Cannot redirect to external URL unless explicitly allowed'
+			);
+		}
+
+		return;
+	}
+
+	throw new Error(
+		DEV
+			? '`redirect` options.external must be `true` or an array of allowed origins'
+			: 'Invalid redirect options.external value'
+	);
+}

package/src/exports/vite/build/build_server.js

@@ -16,39 +16,16 @@ import { fix_css_urls } from '../../../utils/css.js';
 import { escape_for_interpolation } from '../../../utils/escape.js';
 
 /**
- * @overload Build without the client manifest so we can analyse the nodes.
  * @param {string} out
  * @param {ValidatedKitConfig} kit
  * @param {ManifestData} manifest_data
  * @param {Manifest} server_manifest
- * @param {null} client_manifest
- * @param {null} assets_path
- * @param {null} client_chunks
- * @param {string} root
- * @returns {void}
- */
-/**
- * @overload Or build with the client manifest
- * @param {string} out
- * @param {ValidatedKitConfig} kit
- * @param {ManifestData} manifest_data
- * @param {Manifest} server_manifest
- * @param {Manifest} client_manifest
+ * @param {Manifest | null} client_manifest
  * @param {string} assets_path
- * @param {Rolldown.RolldownOutput['output']} client_chunks
+ * @param {(Rolldown.OutputAsset | Rolldown.OutputChunk)[]} chunks
  * @param {string} root
  * @returns {void}
  */
-/**
- * @param {string} out
- * @param {ValidatedKitConfig} kit
- * @param {ManifestData} manifest_data
- * @param {Manifest} server_manifest
- * @param {Manifest | null} client_manifest
- * @param {string | null} assets_path
- * @param {Rolldown.RolldownOutput['output'] | null} client_chunks
- * @param {string} root
- */
 export function build_server_nodes(
 	out,
 	kit,
@@ -56,7 +33,7 @@ export function build_server_nodes(
 	server_manifest,
 	client_manifest,
 	assets_path,
-	client_chunks,
+	chunks,
 	root
 ) {
 	mkdirp(`${out}/server/nodes`);
@@ -75,8 +52,8 @@ export function build_server_nodes(
 	 */
 	let prepare_css_for_inlining = (css) => s(css);
 
-	if (client_chunks && kit.inlineStyleThreshold > 0 && kit.output.bundleStrategy === 'split') {
-		for (const chunk of client_chunks) {
+	if (chunks && kit.inlineStyleThreshold > 0 && kit.output.bundleStrategy === 'split') {
+		for (const chunk of chunks) {
 			if (chunk.type !== 'asset' || !chunk.fileName.endsWith('.css')) {
 				continue;
 			}
@@ -132,6 +109,9 @@ export function build_server_nodes(
 		}
 	}
 
+	/** path to the `.svelte-kit` directory */
+	const out_dir = normalizePath(kit.outDir);
+
 	for (let i = 0; i < manifest_data.nodes.length; i++) {
 		const node = manifest_data.nodes[i];
 
@@ -155,7 +135,11 @@ export function build_server_nodes(
 		/** @type {Set<string>} */
 		const eager_assets = new Set();
 
-		if (node.component && client_manifest) {
+		const uses_server_component = node.child_pages
+			? node.child_pages.some((child) => child.page_options?.ssr !== false)
+			: node.page_options?.ssr !== false;
+
+		if (node.component && uses_server_component) {
 			exports.push(
 				'let component_cache;',
 				`export const component = async () => component_cache ??= (await import('../${
@@ -165,7 +149,12 @@ export function build_server_nodes(
 		}
 
 		if (node.universal) {
-			if (!!node.page_options && node.page_options.ssr === false) {
+			if (
+				(kit.router.type === 'hash' &&
+					node.page_options !== null &&
+					node.page_options?.ssr === undefined) ||
+				(node.page_options && node.page_options.ssr === false)
+			) {
 				exports.push(`export const universal = ${s(node.page_options, null, 2)};`);
 			} else {
 				imports.push(
@@ -185,18 +174,7 @@ export function build_server_nodes(
 			exports.push(`export const server_id = ${s(node.server)};`);
 		}
 
-		if (
-			client_manifest &&
-			(node.universal || node.component) &&
-			kit.output.bundleStrategy === 'split'
-		) {
-			const entry_path = `${normalizePath(kit.outDir)}/generated/client-optimized/nodes/${i}.js`;
-			const entry = find_deps(client_manifest, entry_path, true, root);
-
-			// Eagerly load client stylesheets and fonts imported by the SSR-ed page to avoid FOUC.
-			// However, if it is not used during SSR (not present in the server manifest),
-			// then it can be lazily loaded in the browser.
-
+		if ((node.universal || node.component) && kit.output.bundleStrategy === 'split') {
 			/** @type {AssetDependencies | undefined} */
 			let component;
 			if (node.component) {
@@ -209,25 +187,41 @@ export function build_server_nodes(
 				universal = find_deps(server_manifest, node.universal, true, root);
 			}
 
-			/** @type {Set<string>} */
-			const eager_css = new Set();
+			if (client_manifest) {
+				const entry_path = `${out_dir}/generated/client-optimized/nodes/${i}.js`;
+				const entry = find_deps(client_manifest, entry_path, true, root);
 
-			entry.stylesheet_map.forEach((value, filepath) => {
-				// pages and layouts are renamed to node indexes when optimised for the client
-				// so we use the original filename instead to check against the server manifest
-				if (filepath === entry_path) {
-					filepath = node.component ?? filepath;
-				}
+				// Eagerly load client stylesheets and fonts imported by the SSR-ed page to avoid FOUC.
+				// However, if it is not used during SSR (not present in the server manifest),
+				// then it can be lazily loaded in the browser.
 
-				if (component?.stylesheet_map.has(filepath) || universal?.stylesheet_map.has(filepath)) {
-					value.css.forEach((file) => eager_css.add(file));
-					value.assets.forEach((file) => eager_assets.add(file));
-				}
-			});
+				/** @type {Set<string>} */
+				const eager_css = new Set();
+
+				entry.stylesheet_map.forEach((value, filepath) => {
+					// pages and layouts are renamed to node indexes when optimised for the client
+					// so we use the original filename instead to check against the server manifest
+					if (filepath === entry_path) {
+						filepath = node.component ?? filepath;
+					}
+
+					if (component?.stylesheet_map.has(filepath) || universal?.stylesheet_map.has(filepath)) {
+						value.css.forEach((file) => eager_css.add(file));
+						value.assets.forEach((file) => eager_assets.add(file));
+					}
+				});
 
-			imported = entry.imports;
-			stylesheets = Array.from(eager_css);
-			fonts = filter_fonts(Array.from(eager_assets));
+				imported = entry.imports;
+				stylesheets = Array.from(eager_css);
+				fonts = filter_fonts(Array.from(eager_assets));
+			} else {
+				for (const entry of [component, universal]) {
+					if (!entry) continue;
+					imported.push(...entry.imports);
+					stylesheets.push(...entry.stylesheets);
+					fonts.push(...entry.fonts);
+				}
+			}
 		}
 
 		exports.push(
@@ -244,7 +238,7 @@ export function build_server_nodes(
 
 		// Keep track of Vite asset filenames so that we avoid touching unrelated ones
 		// when adjusting the inlined CSS
-		if (stylesheets_to_inline.size && assets_path && eager_assets.size) {
+		if (stylesheets_to_inline.size && eager_assets.size) {
 			vite_assets = new Set(
 				Array.from(eager_assets).map((asset) => {
 					return decodeURIComponent(asset.replace(`${assets_path}/`, ''));

package/src/exports/vite/build/remote.js

@@ -13,7 +13,7 @@ import { posixify } from '../../../utils/os.js';
  * @param {Array<{ hash: string, file: string }>} remotes
  * @param {ServerMetadata} metadata
  * @param {string} cwd
- * @param {Rolldown.RolldownOutput} server_bundle
+ * @param {(Rolldown.OutputAsset | Rolldown.OutputChunk)[]} server_chunks
  * @param {NonNullable<import('vitest/config').ViteUserConfig['build']>['sourcemap']} sourcemap
  */
 export async function treeshake_prerendered_remotes(
@@ -22,11 +22,14 @@ export async function treeshake_prerendered_remotes(
 	remotes,
 	metadata,
 	cwd,
-	server_bundle,
+	server_chunks,
 	sourcemap
 ) {
 	if (remotes.length === 0) return;
 
+	/** @type {string[]} */
+	const chunk_paths = [];
+
 	for (const remote of remotes) {
 		const exports_map = metadata.remotes.get(remote.hash);
 		if (!exports_map) continue;
@@ -45,7 +48,7 @@ export async function treeshake_prerendered_remotes(
 		// remove file extension
 		const remote_filename = path.basename(remote.file).split('.').slice(0, -1).join('.');
 
-		const remote_chunk = Object.values(server_bundle).find((chunk) => {
+		const remote_chunk = server_chunks.find((chunk) => {
 			return chunk.name === remote_filename;
 		});
 
@@ -88,8 +91,13 @@ export async function treeshake_prerendered_remotes(
 
 		const stubbed = modified_code.toString();
 		fs.writeFileSync(chunk_path, stubbed);
+		chunk_paths.push(chunk_path);
+	}
+
+	if (!chunk_paths.length) return;
 
-		const bundle = /** @type {import('vite').Rolldown.RolldownOutput} */ (
+	for (const chunk_path of chunk_paths) {
+		const bundle = /** @type {Rolldown.RolldownOutput} */ (
 			await vite.build({
 				configFile: false,
 				build: {
@@ -97,7 +105,7 @@ export async function treeshake_prerendered_remotes(
 					ssr: true,
 					target: 'esnext',
 					sourcemap,
-					rollupOptions: {
+					rolldownOptions: {
 						// avoid resolving imports
 						external: (id) => !id.endsWith(chunk_path),
 						input: {
@@ -108,14 +116,13 @@ export async function treeshake_prerendered_remotes(
 			})
 		);
 
-		const chunk = bundle.output.find(
-			(output) => output.type === 'chunk' && output.name === 'treeshaken'
-		);
-		if (chunk && chunk.type === 'chunk') {
-			fs.writeFileSync(chunk_path, chunk.code);
+		for (const output of bundle.output) {
+			if (output.type !== 'chunk' || output.name !== 'treeshaken') return;
+
+			fs.writeFileSync(chunk_path, output.code);
 
 			const chunk_sourcemap = bundle.output.find(
-				(output) => output.type === 'asset' && output.fileName === chunk.fileName + '.map'
+				(o) => o.type === 'asset' && o.fileName === output.fileName + '.map'
 			);
 			if (chunk_sourcemap && chunk_sourcemap.type === 'asset') {
 				fs.writeFileSync(chunk_path + '.map', chunk_sourcemap.source);

package/src/exports/vite/build/utils.js

@@ -124,14 +124,6 @@ export function filter_fonts(assets) {
 	return assets.filter((asset) => /\.(woff2?|ttf|otf)$/.test(asset));
 }
 
-/**
- * @param {import('types').ValidatedKitConfig} config
- * @returns {string}
- */
-export function assets_base(config) {
-	return (config.paths.assets || config.paths.base || '.') + '/';
-}
-
 /**
  * Writes a function with arguments used by a template literal.
  * This helps us store strings in a module and inject values at runtime.

package/src/exports/vite/dev/index.js

@@ -10,12 +10,14 @@ import { isCSSRequest, loadEnv, buildErrorMessage } from 'vite';
 import { createReadableStream, getRequest, setResponse } from '../../../exports/node/index.js';
 import { coalesce_to_error } from '../../../utils/error.js';
 import { resolve_entry } from '../../../utils/filesystem.js';
+import { load_and_validate_params } from '../../../utils/params.js';
 import { from_fs, to_fs } from '../../../utils/vite.js';
 import { posixify } from '../../../utils/os.js';
 import { load_error_page } from '../../../core/config/index.js';
 import { SVELTE_KIT_ASSETS } from '../../../constants.js';
 import * as sync from '../../../core/sync/sync.js';
 import { get_mime_lookup, get_runtime_base } from '../../../core/utils.js';
+import '../../../utils/mime.js'; // extend mrmime with additional types (affects sirv too)
 import { compact } from '../../../utils/array.js';
 import { is_chrome_devtools_request, not_found } from '../utils.js';
 import { SCHEME } from '../../../utils/url.js';
@@ -31,10 +33,9 @@ const vite_css_query_regex = /(?:\?|&)(?:raw|url|inline)(?:&|$)/;
  * @param {import('types').ValidatedConfig} svelte_config
  * @param {() => Array<{ hash: string, file: string }>} get_remotes
  * @param {string} root The project root directory
- * @param {import('@sveltejs/kit').Adapter | undefined} adapter
  * @return {Promise<Promise<() => void>>}
  */
-export async function dev(vite, vite_config, svelte_config, get_remotes, root, adapter) {
+export async function dev(vite, vite_config, svelte_config, get_remotes, root) {
 	/** @type {AsyncLocalStorage<{ event: RequestEvent, config: any, prerender: PrerenderOption }>} */
 	const async_local_storage = new AsyncLocalStorage();
 
@@ -42,7 +43,12 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root, a
 		const context = async_local_storage.getStore();
 		if (!context || context.prerender === true) return;
 
-		check_feature(/** @type {string} */ (context.event.route.id), context.config, label, adapter);
+		check_feature(
+			/** @type {string} */ (context.event.route.id),
+			context.config,
+			label,
+			svelte_config.kit.adapter
+		);
 	};
 
 	const fetch = globalThis.fetch;
@@ -79,6 +85,10 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root, a
 				vite.config.logger.error(msg, { error: err });
 			}
 
+			// TODO this is inadequate — it doesn't reliably show the overlay on every page load,
+			// and when it does appear it may immediately vanish. `vite.ws.send` broadcasts
+			// to all connected clients, even ones that are unaffected by the error.
+			// we need a more considered approach
 			vite.ws.send({
 				type: 'error',
 				err: /** @type {import('vite').ErrorPayload['err']} */ ({
@@ -106,10 +116,17 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root, a
 		return { module, module_node, url };
 	}
 
-	function update_manifest() {
+	async function update_manifest() {
 		try {
 			({ manifest_data } = sync.create(svelte_config, root));
 
+			await load_and_validate_params({
+				routes: manifest_data.routes,
+				params_path: manifest_data.params,
+				root,
+				load: (file) => loud_ssr_load_module(file)
+			});
+
 			if (manifest_error) {
 				manifest_error = null;
 				vite.ws.send({ type: 'full-reload' });
@@ -288,22 +305,18 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root, a
 					})
 				),
 				matchers: async () => {
-					/** @type {Record<string, import('@sveltejs/kit').ParamMatcher>} */
-					const matchers = {};
-
-					for (const key in manifest_data.matchers) {
-						const file = manifest_data.matchers[key];
-						const url = path.resolve(root, file);
-						const module = await vite.ssrLoadModule(url, { fixStacktrace: true });
-
-						if (module.match) {
-							matchers[key] = module.match;
-						} else {
-							throw new Error(`${file} does not export a \`match\` function`);
-						}
+					if (!manifest_data.params) return {};
+
+					const url = path.resolve(root, manifest_data.params);
+					const module = await vite.ssrLoadModule(url, { fixStacktrace: true });
+
+					if (!module.params) {
+						throw new Error(
+							`${manifest_data.params} does not export \`params\` from \`defineParams\``
+						);
 					}
 
-					return matchers;
+					return module.params;
 				}
 			}
 		};
@@ -320,7 +333,9 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root, a
 		return error.stack?.replaceAll('\0', ''); // remove null bytes from e.g. virtual module IDs, or the response will fail
 	}
 
-	update_manifest();
+	await update_manifest();
+
+	const params_file = resolve_entry(svelte_config.kit.files.params);
 
 	/**
 	 * @param {string} event
@@ -330,7 +345,7 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root, a
 		vite.watcher.on(event, (file) => {
 			if (
 				file.startsWith(svelte_config.kit.files.routes + path.sep) ||
-				file.startsWith(svelte_config.kit.files.params + path.sep) ||
+				(params_file && file === params_file) ||
 				svelte_config.kit.moduleExtensions.some((ext) => file.endsWith(`.remote${ext}`)) ||
 				// in contrast to server hooks, client hooks are written to the client manifest
 				// and therefore need rebuilding when they are added/removed
@@ -351,9 +366,6 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root, a
 		}, 100);
 	};
 
-	// flag to skip watchers if server is already restarting
-	let restarting = false;
-
 	// Debounce add/unlink events because in case of folder deletion or moves
 	// they fire in rapid succession, causing needless invocations.
 	// These watchers only run for routes, param matchers, and client hooks.
@@ -362,7 +374,7 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root, a
 	watch('change', (file) => {
 		// Don't run for a single file if the whole manifest is about to get updated
 		// Unless it's a file where the trailing slash page option might have changed
-		if (timeout || restarting || !/\+(page|layout|server).*$/.test(file)) return;
+		if (timeout || !/\+(page|layout|server).*$/.test(file)) return;
 		sync.update(svelte_config, manifest_data, file, root);
 	});
 
@@ -373,7 +385,7 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root, a
 	// send the vite client a full-reload event without path being set
 	if (appTemplate !== 'index.html') {
 		vite.watcher.on('change', (file) => {
-			if (file === appTemplate && !restarting) {
+			if (file === appTemplate) {
 				vite.ws.send({ type: 'full-reload' });
 			}
 		});
@@ -390,26 +402,12 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root, a
 		}
 	});
 
-	vite.watcher.on('change', async (file) => {
-		// changing the svelte config requires restarting the dev server
-		// the config is only read on start and passed on to vite-plugin-svelte
-		// which needs up-to-date values to operate correctly
-		if (file.match(/[/\\]svelte\.config\.[jt]s$/)) {
-			console.log(`svelte config changed, restarting vite dev-server. changed file: ${file}`);
-			restarting = true;
-			await vite.restart();
-		}
-	});
-
 	const assets = svelte_config.kit.paths.assets ? SVELTE_KIT_ASSETS : svelte_config.kit.paths.base;
 	const asset_server = sirv(svelte_config.kit.files.assets, {
 		dev: true,
 		etag: true,
 		maxAge: 0,
-		extensions: [],
-		setHeaders: (res) => {
-			res.setHeader('access-control-allow-origin', '*');
-		}
+		extensions: []
 	});
 
 	vite.middlewares.use((req, res, next) => {
@@ -436,7 +434,7 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root, a
 	});
 
 	const env = loadEnv(vite_config.mode, svelte_config.kit.env.dir, '');
-	const emulator = await adapter?.emulate?.();
+	const emulator = await svelte_config.kit.adapter?.emulate?.();
 
 	return () => {
 		const serve_static_middleware = vite.middlewares.stack.find(
@@ -527,7 +525,7 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root, a
 					read: (file) => createReadableStream(from_fs(file))
 				});
 
-				const request = await getRequest({
+				const request = getRequest({
 					base,
 					request: req
 				});
@@ -578,10 +576,10 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root, a
 				if (rendered.status === 404) {
 					// @ts-expect-error
 					serve_static_middleware.handle(req, res, () => {
-						void setResponse(res, rendered);
+						setResponse(res, rendered);
 					});
 				} else {
-					void setResponse(res, rendered);
+					setResponse(res, rendered);
 				}
 			} catch (e) {
 				const error = coalesce_to_error(e);