@sveltejs/kit 3.0.0-next.1 → 3.0.0-next.10

package/src/runtime/server/respond.js

@@ -8,7 +8,7 @@ import { is_endpoint_request, render_endpoint } from './endpoint.js';
 import { render_page } from './page/index.js';
 import { render_response } from './page/render.js';
 import { respond_with_error } from './page/respond_with_error.js';
-import { is_form_content_type } from '../../utils/http.js';
+import { get_self_origin, is_csrf_forbidden, is_remote_forbidden } from './csrf.js';
 import {
 	handle_fatal_error,
 	has_prerendered_path,
@@ -70,23 +70,28 @@ export async function internal_respond(request, options, manifest, state) {
 	const is_data_request = has_data_suffix(url.pathname);
 	const remote_id = get_remote_id(url);
 
-	if (!DEV) {
+	if (!__SVELTEKIT_DEV__) {
 		const request_origin = request.headers.get('origin');
+		const self_origin = get_self_origin(options.paths_origin, url.origin);
 
 		if (remote_id) {
-			if (request.method !== 'GET' && request_origin !== url.origin) {
+			if (
+				is_remote_forbidden({
+					request,
+					request_origin,
+					self_origin
+				})
+			) {
 				const message = 'Cross-site remote requests are forbidden';
 				return json({ message }, { status: 403 });
 			}
 		} else if (options.csrf_check_origin) {
-			const forbidden =
-				is_form_content_type(request) &&
-				(request.method === 'POST' ||
-					request.method === 'PUT' ||
-					request.method === 'PATCH' ||
-					request.method === 'DELETE') &&
-				request_origin !== url.origin &&
-				(!request_origin || !options.csrf_trusted_origins.includes(request_origin));
+			const forbidden = is_csrf_forbidden({
+				request,
+				request_origin,
+				self_origin,
+				trusted_origins: options.csrf_trusted_origins
+			});
 
 			if (forbidden) {
 				const message = `Cross-site ${request.method} form submissions are forbidden`;
@@ -147,14 +152,16 @@ export async function internal_respond(request, options, manifest, state) {
 		},
 		remote: {
 			data: null,
+			explicit: null,
+			implicit: null,
 			forms: null,
-			refreshes: null,
 			requested: null,
-			reconnects: null,
 			batches: null,
 			live_iterators: null
 		},
 		is_in_remote_function: false,
+		is_in_remote_form_or_command: false,
+		is_in_remote_query: false,
 		is_in_render: false,
 		is_in_universal_load: false
 	};
@@ -317,7 +324,7 @@ export async function internal_respond(request, options, manifest, state) {
 		return resolve_route(resolved_path, new URL(request.url), manifest);
 	}
 
-	if (resolved_path === `/${app_dir}/env.js` || resolved_path === `/${app_dir}/env.script.js`) {
+	if (resolved_path === `/${app_dir}/env.js`) {
 		return get_public_env(request);
 	}
 
@@ -329,14 +336,17 @@ export async function internal_respond(request, options, manifest, state) {
 	}
 
 	if (!state.prerendering?.fallback) {
-		// TODO this could theoretically break — should probably be inside a try-catch
-		const matchers = await manifest._.matchers();
-		const result = find_route(resolved_path, manifest._.routes, matchers);
-
-		if (result) {
-			route = result.route;
-			event.route = { id: route.id };
-			event.params = result.params;
+		try {
+			const matchers = await manifest._.matchers();
+			const result = find_route(resolved_path, manifest._.routes, matchers);
+
+			if (result) {
+				route = result.route;
+				event.route = { id: route.id };
+				event.params = result.params;
+			}
+		} catch (e) {
+			return await handle_fatal_error(event, event_state, options, e);
 		}
 	}
 
@@ -617,54 +627,80 @@ export async function internal_respond(request, options, manifest, state) {
 						invalidated_data_nodes,
 						trailing_slash
 					);
-				} else if (route.endpoint && (!route.page || is_endpoint_request(event))) {
-					response = await render_endpoint(event, event_state, await route.endpoint(), state);
-				} else if (route.page) {
-					if (!page_nodes) {
-						throw new Error('page_nodes not found. This should never happen');
-					} else if (page_methods.has(method)) {
-						response = await render_page(
-							event,
-							event_state,
-							route.page,
-							options,
-							manifest,
-							state,
-							page_nodes,
-							resolve_opts
-						);
-					} else {
-						const allowed_methods = new Set(allowed_page_methods);
-						const node = await manifest._.nodes[route.page.leaf]();
-						if (node?.server?.actions) {
-							allowed_methods.add('POST');
+				} else {
+					let endpoint;
+					if (
+						route.endpoint &&
+						(!route.page || (!state.prerendering && is_endpoint_request(event)))
+					) {
+						endpoint = await route.endpoint();
+
+						// Prefer rendering the page if the endpoint can't handle this GET or HEAD request
+						if (route.page && (method === 'GET' || method === 'HEAD')) {
+							const endpoint_can_handle = !!(
+								endpoint.GET ||
+								endpoint.fallback ||
+								(method === 'HEAD' && endpoint.HEAD)
+							);
+							if (!endpoint_can_handle) {
+								endpoint = undefined;
+							}
 						}
+					}
 
-						if (method === 'OPTIONS') {
-							// This will deny CORS preflight requests implicitly because we don't
-							// add the required CORS headers to the response.
-							response = new Response(null, {
-								status: 204,
-								headers: {
-									allow: Array.from(allowed_methods.values()).join(', ')
-								}
-							});
+					if (endpoint) {
+						response = await render_endpoint(event, event_state, endpoint, state);
+					} else if (route.page) {
+						if (!page_nodes) {
+							throw new Error('page_nodes not found. This should never happen');
+						} else if (page_methods.has(method)) {
+							response = await render_page(
+								event,
+								event_state,
+								route.page,
+								options,
+								manifest,
+								state,
+								page_nodes,
+								resolve_opts
+							);
 						} else {
-							const mod = [...allowed_methods].reduce((acc, curr) => {
-								acc[curr] = true;
-								return acc;
-							}, /** @type {Record<string, any>} */ ({}));
-							response = method_not_allowed(mod, method);
+							const allowed_methods = new Set(allowed_page_methods);
+							const node = await manifest._.nodes[route.page.leaf]();
+							if (node?.server?.actions) {
+								allowed_methods.add('POST');
+							}
+
+							if (method === 'OPTIONS') {
+								// This will deny CORS preflight requests implicitly because we don't
+								// add the required CORS headers to the response.
+								response = new Response(null, {
+									status: 204,
+									headers: {
+										allow: Array.from(allowed_methods.values()).join(', ')
+									}
+								});
+							} else {
+								const mod = [...allowed_methods].reduce((acc, curr) => {
+									acc[curr] = true;
+									return acc;
+								}, /** @type {Record<string, any>} */ ({}));
+								response = method_not_allowed(mod, method);
+							}
 						}
+					} else {
+						// a route will always have a page or an endpoint, but TypeScript doesn't know that
+						throw new Error('Route is neither page nor endpoint. This should never happen');
 					}
-				} else {
-					// a route will always have a page or an endpoint, but TypeScript doesn't know that
-					throw new Error('Route is neither page nor endpoint. This should never happen');
 				}
 
 				// If the route contains a page and an endpoint, we need to add a
 				// `Vary: Accept` header to the response because of browser caching
-				if (request.method === 'GET' && route.page && route.endpoint) {
+				if (
+					(request.method === 'GET' || request.method === 'HEAD') &&
+					route.page &&
+					route.endpoint
+				) {
 					const vary = response.headers
 						.get('vary')
 						?.split(',')

package/src/runtime/server/utils.js

@@ -75,8 +75,8 @@ export function static_error_page(options, status, message) {
  */
 export async function handle_fatal_error(event, state, options, error) {
 	error = error instanceof HttpError ? error : coalesce_to_error(error);
-	const status = get_status(error);
 	const body = await handle_error_and_jsonify(event, state, options, error);
+	const status = body.status;
 
 	// ideally we'd use sec-fetch-dest instead, but Safari — quelle surprise — doesn't support it
 	const type = negotiate(event.request.headers.get('accept') || 'text/html', [
@@ -98,9 +98,9 @@ export async function handle_fatal_error(event, state, options, error) {
  * @param {import('types').RequestState} state
  * @param {import('types').SSROptions} options
  * @param {any} error
- * @returns {Promise<App.Error>}
+ * @returns {App.Error | Promise<App.Error>}
  */
-export async function handle_error_and_jsonify(event, state, options, error) {
+export function handle_error_and_jsonify(event, state, options, error) {
 	if (error instanceof HttpError) {
 		// @ts-expect-error custom user errors may not have a message field if App.Error is overwritten
 		return { message: 'Unknown Error', ...error.body };
@@ -113,11 +113,34 @@ export async function handle_error_and_jsonify(event, state, options, error) {
 	const status = get_status(error);
 	const message = get_message(error);
 
-	return (
-		(await with_request_store({ event, state }, () =>
-			options.hooks.handleError({ error, event, status, message })
-		)) ?? { message }
-	);
+	// TODO 4.0 await this, rather than handling the non-Promise case
+	const result = with_request_store({ event, state }, () =>
+		options.hooks.handleError({ error, event, status, message })
+	) ?? { status, message };
+
+	if (result instanceof Promise) {
+		if (!__SVELTEKIT_SUPPORTS_ASYNC__ && state.is_in_render) {
+			console.warn(
+				`To use an async \`handleError\` hook to handle errors that occur during rendering, you must enable \`compilerOptions.experimental.async\` in the SvelteKit plugin of your Vite config. The returned error has been replaced with a generic object`
+			);
+
+			// we're discarding the result, but we still need to prevent an unhandled
+			// rejection if the user's async `handleError` hook rejects
+			result.catch(() => {});
+
+			return {
+				status,
+				message: 'Internal Error'
+			};
+		}
+
+		return result.then((body) => {
+			body ??= { status, message };
+			return { ...body, status: get_status(body, error) };
+		});
+	}
+
+	return { ...result, status: get_status(result, error) };
 }
 
 /**
@@ -228,7 +251,7 @@ export function clean_up_stack_trace(error) {
 		return line.replace(/\((.+)(:\d+:\d+)\)$/, (_, file, loc) => `(${relative(file)}${loc})`);
 	});
 
-	// progressive enhancement for people who haven't configured kit.files.src to something else
+	// progressive enhancement for people who haven't configured files.src to something else
 	const last_line_from_src_code = stack_trace.findLastIndex((line) => /\(src[\\/]/.test(line));
 
 	if (last_line_from_src_code === -1) {

package/src/runtime/shared.js

@@ -96,6 +96,8 @@ function to_sorted(value, clones) {
 const remote_object = '__skrao';
 const remote_map = '__skram';
 const remote_set = '__skras';
+const remote_file = '__skraf';
+const remote_promise_guard = '__skrap';
 const remote_regex_guard = '__skrag';
 const remote_arg_marker = Symbol(remote_object);
 
@@ -107,13 +109,12 @@ const remote_arg_marker = Symbol(remote_object);
 function create_remote_arg_reducers(transport, sort, remote_arg_clones) {
 	/** @type {Record<string, (value: unknown) => unknown>} */
 	const remote_fns_reducers = {
-		[remote_regex_guard]:
-			/** @type {(value: unknown) => void} */
-			(value) => {
-				if (value instanceof RegExp) {
-					throw new Error('Regular expressions are not valid remote function arguments');
-				}
+		/** @param {unknown} value */
+		[remote_regex_guard]: (value) => {
+			if (value instanceof RegExp) {
+				throw new Error('Regular expressions are not valid remote function arguments');
 			}
+		}
 	};
 
 	if (sort) {
@@ -229,6 +230,24 @@ function create_remote_arg_revivers(transport) {
 			}
 
 			return set;
+		},
+		/** @type {(value: any) => File} */
+		[remote_file]: (value) => {
+			if (
+				!value ||
+				typeof value !== 'object' ||
+				typeof value.name !== 'string' ||
+				typeof value.type !== 'string' ||
+				typeof value.size !== 'number' ||
+				typeof value.lastModified !== 'number' ||
+				!(value.data instanceof ArrayBuffer)
+			) {
+				throw new Error('Invalid data for File reviver');
+			}
+
+			const { data, name, ...meta } = value;
+
+			return new File([data], name, meta);
 		}
 	};
 
@@ -249,18 +268,69 @@ function create_remote_arg_revivers(transport) {
  * it is both a valid URL and a valid file name (necessary for prerendering).
  * @param {any} value
  * @param {Transport} transport
- * @param {boolean} [sort]
  */
-export function stringify_remote_arg(value, transport, sort = true) {
+export function stringify_remote_arg(value, transport) {
 	if (value === undefined) return '';
 
 	// If people hit file/url size limits, we can look into using something like compress_and_encode_text from svelte.dev beyond a certain size
-	const json_string = devalue.stringify(
-		value,
-		create_remote_arg_reducers(transport, sort, new Map())
-	);
+	const json = devalue.stringify(value, create_remote_arg_reducers(transport, true, new Map()));
+
+	return url_friendly_base64_encode(json);
+}
+
+/**
+ * Stringifies command arguments, including `File` objects.
+ * @param {any} value
+ * @param {Transport} transport
+ */
+export async function stringify_command_arg(value, transport) {
+	if (value === undefined) return '';
+
+	const reducers = create_remote_arg_reducers(transport, false, new Map());
 
-	const bytes = text_encoder.encode(json_string);
+	/** @type {Set<Promise<any>>} */
+	const allowed_promises = new Set();
+
+	/** @param {any} value */
+	reducers[remote_file] = (value) => {
+		if (value instanceof File) {
+			const promise = value.arrayBuffer().then((data) => ({
+				data,
+				lastModified: value.lastModified,
+				name: value.name,
+				size: value.size,
+				type: value.type
+			}));
+
+			allowed_promises.add(promise);
+
+			return promise;
+		}
+	};
+
+	// we don't want to allow arbitrary promises, because they won't
+	// show up as promises on the other side. this is something
+	// we could potentially change in future. stringifyAsync
+	// will await them, so we need to explicitly deny them
+	/** @param {unknown} value */
+	reducers[remote_promise_guard] = (value) => {
+		if (value instanceof Promise && !allowed_promises.has(value)) {
+			throw new Error('Promises are not valid remote function arguments');
+		}
+	};
+
+	const json = await devalue.stringifyAsync(value, reducers);
+
+	return url_friendly_base64_encode(json);
+}
+
+/**
+ * Base64-encodes `string` in such a way that the result is safe to use
+ * as both a URI component and a filename
+ * @param {string} string
+ */
+function url_friendly_base64_encode(string) {
+	const bytes = text_encoder.encode(string);
 	return base64_encode(bytes).replaceAll('=', '').replaceAll('+', '-').replaceAll('/', '_');
 }
 

package/src/runtime/telemetry/otel.js

@@ -15,7 +15,7 @@ if (__SVELTEKIT_SERVER_TRACING_ENABLED__) {
 		})
 		.catch(() => {
 			throw new Error(
-				'Tracing is enabled (see `config.kit.experimental.instrumentation.server` in your svelte.config.js), but `@opentelemetry/api` is not available. This error will likely resolve itself when you set up your tracing instrumentation in `instrumentation.server.js`. For more information, see https://svelte.dev/docs/kit/observability#opentelemetry-api'
+				'Tracing is enabled (see the SvelteKit plugin `tracing.server` option in your vite.config.js), but `@opentelemetry/api` is not available. This error will likely resolve itself when you set up your tracing instrumentation in `instrumentation.server.js`. For more information, see https://svelte.dev/docs/kit/observability#opentelemetry-api'
 			);
 		});
 }

package/src/runtime/types.d.ts

@@ -0,0 +1,8 @@
+import { Component } from 'svelte';
+
+export interface RenderNode {
+	component: Component;
+	error: Component;
+	data: Record<string, any>;
+	child?: RenderNode;
+}

package/src/types/ambient.d.ts

@@ -25,29 +25,34 @@ declare namespace App {
 	 * Defines the common shape of expected and unexpected errors. Expected errors are thrown using the `error` function. Unexpected errors are handled by the `handleError` hooks which should return this shape.
 	 */
 	export interface Error {
+		status: number;
 		message: string;
 	}
 
 	/**
 	 * The interface that defines `event.locals`, which can be accessed in server [hooks](https://svelte.dev/docs/kit/hooks) (`handle`, and `handleError`), server-only `load` functions, and `+server.js` files.
 	 */
+	// eslint-disable-next-line @typescript-eslint/no-empty-object-type
 	export interface Locals {}
 
 	/**
-	 * Defines the common shape of the [page.data state](https://svelte.dev/docs/kit/$app-state#page) and [$page.data store](https://svelte.dev/docs/kit/$app-stores#page) - that is, the data that is shared between all pages.
+	 * Defines the common shape of the [page.data state](https://svelte.dev/docs/kit/$app-state#page) - that is, the data that is shared between all pages.
 	 * The `Load` and `ServerLoad` functions in `./$types` will be narrowed accordingly.
 	 * Use optional properties for data that is only present on specific pages. Do not add an index signature (`[key: string]: any`).
 	 */
+	// eslint-disable-next-line @typescript-eslint/no-empty-object-type
 	export interface PageData {}
 
 	/**
 	 * The shape of the `page.state` object, which can be manipulated using the [`pushState`](https://svelte.dev/docs/kit/$app-navigation#pushState) and [`replaceState`](https://svelte.dev/docs/kit/$app-navigation#replaceState) functions from `$app/navigation`.
 	 */
+	// eslint-disable-next-line @typescript-eslint/no-empty-object-type
 	export interface PageState {}
 
 	/**
 	 * If your adapter provides [platform-specific context](https://svelte.dev/docs/kit/adapters#Platform-specific-context) via `event.platform`, you can specify it here.
 	 */
+	// eslint-disable-next-line @typescript-eslint/no-empty-object-type
 	export interface Platform {}
 }
 
@@ -56,8 +61,8 @@ declare namespace App {
  */
 declare module '$service-worker' {
 	/**
-	 * The `base` path of the deployment. Typically this is equivalent to `config.kit.paths.base`, but it is calculated from `location.pathname` meaning that it will continue to work correctly if the site is deployed to a subdirectory.
-	 * Note that there is a `base` but no `assets`, since service workers cannot be used if `config.kit.paths.assets` is specified.
+	 * The `base` path of the deployment. Typically this is equivalent to `config.paths.base`, but it is calculated from `location.pathname` meaning that it will continue to work correctly if the site is deployed to a subdirectory.
+	 * Note that there is a `base` but no `assets`, since service workers cannot be used if `config.paths.assets` is specified.
 	 */
 	export const base: string;
 	/**
@@ -66,7 +71,7 @@ declare module '$service-worker' {
 	 */
 	export const build: string[];
 	/**
-	 * An array of URL strings representing the files in your static directory, or whatever directory is specified by `config.kit.files.assets`. You can customize which files are included from `static` directory using [`config.kit.serviceWorker.files`](https://svelte.dev/docs/kit/configuration#serviceWorker)
+	 * An array of URL strings representing the files in your static directory, or whatever directory is specified by `config.files.assets`. You can customize which files are included from `static` directory using [`config.serviceWorker.files`](https://svelte.dev/docs/kit/configuration#serviceWorker)
 	 */
 	export const files: string[];
 	/**
@@ -75,7 +80,7 @@ declare module '$service-worker' {
 	 */
 	export const prerendered: string[];
 	/**
-	 * See [`config.kit.version`](https://svelte.dev/docs/kit/configuration#version). It's useful for generating unique cache names inside your service worker, so that a later deployment of your app can invalidate old caches.
+	 * See [`config.version`](https://svelte.dev/docs/kit/configuration#version). It's useful for generating unique cache names inside your service worker, so that a later deployment of your app can invalidate old caches.
 	 */
 	export const version: string;
 }

package/src/types/global-private.d.ts

@@ -1,3 +1,5 @@
+import { SvelteKitPayload } from 'types';
+
 declare global {
 	const __SVELTEKIT_ADAPTER_NAME__: string;
 	const __SVELTEKIT_APP_DIR__: string;
@@ -13,13 +15,13 @@ declare global {
 	const __SVELTEKIT_PATHS_ASSETS__: string;
 	const __SVELTEKIT_PATHS_BASE__: string;
 	const __SVELTEKIT_PATHS_RELATIVE__: boolean;
-	/** True if `config.kit.experimental.instrumentation.server` is `true` */
+	/** True if `config.tracing.server` is `true` */
 	const __SVELTEKIT_SERVER_TRACING_ENABLED__: boolean;
-	/** True if `config.kit.experimental.forkPreloads` is `true` */
+	/** True if `config.experimental.forkPreloads` is `true` */
 	const __SVELTEKIT_FORK_PRELOADS__: boolean;
-	/** True if `config.kit.router.resolution === 'client'` */
+	/** True if `config.router.resolution === 'client'` */
 	const __SVELTEKIT_CLIENT_ROUTING__: boolean;
-	/** True if `config.kit.router.type === 'hash'` */
+	/** True if `config.router.type === 'hash'` */
 	const __SVELTEKIT_HASH_ROUTING__: boolean;
 	/**
 	 * True if any node in the manifest has a server load function.
@@ -31,28 +33,20 @@ declare global {
 	 * Used for treeshaking universal load code from client bundles when no universal loads exist.
 	 */
 	const __SVELTEKIT_HAS_UNIVERSAL_LOAD__: boolean;
-	/** The `__sveltekit_abc123` object in the init `<script>` */
-	const __SVELTEKIT_PAYLOAD__: {
-		/** The basepath, usually relative to the current page */
-		base: string;
-		/** Path to externally-hosted assets */
-		assets?: string;
-		/** Public environment variables */
-		env?: Record<string, string>;
-		/** Serialized data from query/form/command functions */
-		query?: Record<string, any>;
-		/** Serialized data from prerender functions */
-		prerender?: Record<string, any>;
-		/** Create a placeholder promise */
-		defer?: (id: number) => Promise<any>;
-		/** Resolve a placeholder promise */
-		resolve?: (data: { id: number; data: any; error: any }) => void;
-	};
+	/**
+	 * The `__sveltekit_abc123` object in the init `<script>`.
+	 * Should only be used when bundleStrategy !== 'inline' to avoid SvelteKit runtime changing on every build, preventing cacheability.
+	 */
+	const __SVELTEKIT_PAYLOAD__: SvelteKitPayload;
 	/**
 	 * The Vite `root` setting used to construct paths to nodes and components
 	 * for the SSR manifest during development
 	 */
 	const __SVELTEKIT_ROOT__: string;
+	/**
+	 * Whether the `experimental.async` flag is applied
+	 */
+	const __SVELTEKIT_SUPPORTS_ASYNC__: boolean;
 	/**
 	 * This makes the use of specific features visible at both dev and build time, in such a
 	 * way that we can error when they are not supported by the target platform.
@@ -68,7 +62,6 @@ declare global {
 	 * to throw an error if the feature would fail in production.
 	 */
 	var __SVELTEKIT_TRACK__: (label: string) => void;
-	var __SVELTEKIT_EXPERIMENTAL_USE_TRANSFORM_ERROR__: boolean;
 	var Bun: object;
 	var Deno: object;
 }