@sveltejs/kit 3.0.0-next.1 → 3.0.0-next.11

package/src/types/private.d.ts

@@ -61,7 +61,10 @@ export namespace Csp {
 		| 'unsafe-eval'
 		| 'unsafe-hashes'
 		| 'unsafe-inline'
+		| 'unsafe-allow-redirects'
+		| 'unsafe-webtransport-hashes'
 		| 'wasm-unsafe-eval'
+		| 'trusted-types-eval'
 		| 'none';
 	type CryptoSource = `${'nonce' | 'sha256' | 'sha384' | 'sha512'}-${string}`;
 	type FrameSource = HostSource | SchemeSource | 'self' | 'none';
@@ -70,7 +73,16 @@ export namespace Csp {
 	type HostProtocolSchemes = `${string}://` | '';
 	type HttpDelineator = '/' | '?' | '#' | '\\';
 	type PortScheme = `:${number}` | '' | ':*';
-	type SchemeSource = 'http:' | 'https:' | 'data:' | 'mediastream:' | 'blob:' | 'filesystem:';
+	type SchemeSource =
+		| 'http:'
+		| 'https:'
+		| 'ws:'
+		| 'wss:'
+		| 'data:'
+		| 'mediastream:'
+		| 'blob:'
+		| 'filesystem:'
+		| (`${string}:` & {});
 	type Source = HostSource | SchemeSource | CryptoSource | BaseSource;
 	type Sources = Source[];
 }
@@ -147,10 +159,18 @@ export type HttpMethod = 'GET' | 'HEAD' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' |
 export interface Logger {
 	(msg: string): void;
 	success(msg: string): void;
+	/** Print a bold red message to stderr */
 	error(msg: string): void;
+	/** Print a bold yellow message to stderr */
 	warn(msg: string): void;
+	/** Print faded text to stdout if `verbose === true` */
 	minor(msg: string): void;
+	/** Print to stdout if `verbose === true` */
 	info(msg: string): void;
+	/** Print to stderr without formatting */
+	err(msg: string): void;
+	/** Print a bold red message, followed by a stack trace for each error (following `.cause` chains) */
+	prettyError(error: unknown, caller?: string): void;
 }
 
 export type MaybePromise<T> = T | Promise<T>;
@@ -212,6 +232,10 @@ export interface PrerenderUnseenRoutesHandler {
 	(details: { routes: string[]; message: string }): void;
 }
 
+export interface PrerenderInvalidUrlHandler {
+	(details: { href: string; referrer: string | null; message: string }): void;
+}
+
 export type PrerenderHttpErrorHandlerValue = 'fail' | 'warn' | 'ignore' | PrerenderHttpErrorHandler;
 export type PrerenderMissingIdHandlerValue = 'fail' | 'warn' | 'ignore' | PrerenderMissingIdHandler;
 export type PrerenderUnseenRoutesHandlerValue =
@@ -224,6 +248,11 @@ export type PrerenderEntryGeneratorMismatchHandlerValue =
 	| 'warn'
 	| 'ignore'
 	| PrerenderEntryGeneratorMismatchHandler;
+export type PrerenderInvalidUrlHandlerValue =
+	| 'fail'
+	| 'warn'
+	| 'ignore'
+	| PrerenderInvalidUrlHandler;
 
 export type PrerenderOption = boolean | 'auto';
 
@@ -252,3 +281,14 @@ export type DeepPartial<T> = T extends Record<PropertyKey, unknown> | unknown[]
 	: T | undefined;
 
 export type IsAny<T> = 0 extends 1 & T ? true : false;
+
+export type HasNonOptionalBoolean<T> =
+	IsAny<T> extends true
+		? never
+		: [T] extends [boolean]
+			? true
+			: T extends Array<infer U>
+				? HasNonOptionalBoolean<U>
+				: T extends Record<string, any>
+					? { [K in keyof T]: HasNonOptionalBoolean<T[K]> }[keyof T]
+					: never;

package/src/utils/error.js

@@ -1,5 +1,17 @@
 import { HttpError, SvelteKitError } from '@sveltejs/kit/internal';
 
+/**
+ * For times when you need to throw an error, but without
+ * displaying a useless stack trace (since the developer
+ * can't do anything useful with it)
+ * @param {string} message
+ */
+export function stackless(message) {
+	const error = new Error(message);
+	error.stack = '';
+	return error;
+}
+
 /**
  * @param {unknown} err
  * @return {Error}
@@ -18,16 +30,24 @@ export function coalesce_to_error(err) {
  * @param {unknown} error
  */
 export function normalize_error(error) {
-	return /** @type {import('../exports/internal/index.js').Redirect | HttpError | SvelteKitError | Error} */ (
+	return /** @type {import('../exports/internal/shared.js').Redirect | HttpError | SvelteKitError | Error} */ (
 		error
 	);
 }
 
 /**
- * @param {unknown} error
+ * @param {any} transformed
+ * @param {any} [error]
  */
-export function get_status(error) {
-	return error instanceof HttpError || error instanceof SvelteKitError ? error.status : 500;
+export function get_status(transformed, error) {
+	const err = error ?? transformed;
+	const status = err instanceof HttpError || err instanceof SvelteKitError ? err.status : 500;
+
+	if (error == null || typeof transformed?.status !== 'number') {
+		return status;
+	} else {
+		return transformed.status;
+	}
 }
 
 /**

package/src/utils/escape.js

@@ -21,24 +21,12 @@ const escape_html_dict = {
 	'<': '&lt;'
 };
 
-const surrogates = // high surrogate without paired low surrogate
-	'[\\ud800-\\udbff](?![\\udc00-\\udfff])|' +
-	// a valid surrogate pair, the only match with 2 code units
-	// we match it so that we can match unpaired low surrogates in the same pass
-	// TODO: use lookbehind assertions once they are widely supported: (?<![\ud800-udbff])[\udc00-\udfff]
-	'[\\ud800-\\udbff][\\udc00-\\udfff]|' +
-	// unpaired low surrogate (see previous match)
-	'[\\udc00-\\udfff]';
+// `\p{Surrogate}` only matches unpaired surrogates with the `u` flag (a pair is one code point)
+/** @param {Record<string, string>} dict */
+const escape_regex = (dict) => new RegExp(`[${Object.keys(dict).join('')}]|\\p{Surrogate}`, 'gu');
 
-const escape_html_attr_regex = new RegExp(
-	`[${Object.keys(escape_html_attr_dict).join('')}]|` + surrogates,
-	'g'
-);
-
-const escape_html_regex = new RegExp(
-	`[${Object.keys(escape_html_dict).join('')}]|` + surrogates,
-	'g'
-);
+const escape_html_attr_regex = escape_regex(escape_html_attr_dict);
+const escape_html_regex = escape_regex(escape_html_dict);
 
 /**
  * Escapes unpaired surrogates (which are allowed in js strings but invalid in HTML) and
@@ -51,14 +39,10 @@ const escape_html_regex = new RegExp(
  */
 export function escape_html(str, is_attr) {
 	const dict = is_attr ? escape_html_attr_dict : escape_html_dict;
-	const escaped_str = str.replace(is_attr ? escape_html_attr_regex : escape_html_regex, (match) => {
-		if (match.length === 2) {
-			// valid surrogate pair
-			return match;
-		}
-
-		return dict[match] ?? `&#${match.charCodeAt(0)};`;
-	});
+	const escaped_str = str.replace(
+		is_attr ? escape_html_attr_regex : escape_html_regex,
+		(match) => dict[match] ?? `&#${match.charCodeAt(0)};`
+	);
 
 	return escaped_str;
 }

package/src/utils/features.js

@@ -1,6 +1,6 @@
 /**
  * @param {string} route_id
- * @param {any} config
+ * @param {Record<string, any>} config
  * @param {string} feature
  * @param {import('@sveltejs/kit').Adapter | undefined} adapter
  */

package/src/utils/fork.js

@@ -38,7 +38,8 @@ export function forked(module, callback) {
 			const worker = new Worker(fileURLToPath(module), {
 				env: {
 					...process.env,
-					SVELTEKIT_FORK: 'true'
+					SVELTEKIT_FORK: 'true',
+					FORCE_COLOR: '1'
 				}
 			});
 
@@ -60,9 +61,13 @@ export function forked(module, callback) {
 				}
 			);
 
+			worker.once('error', reject);
+
 			worker.on('exit', (code) => {
 				if (code) {
-					reject(new Error(`Failed with code ${code}`));
+					const error = new Error(`Failed with code ${code}`);
+					error.stack = error.message;
+					reject(error);
 				}
 			});
 		});

package/src/utils/import.js

@@ -2,7 +2,12 @@ import fs from 'node:fs';
 import path from 'node:path';
 
 /**
- * Resolves a peer dependency relative to the current working directory. Duplicated with `packages/adapter-auto`
+ * Resolves a peer dependency relative to the current working directory.
+ *
+ * Mainly used to resolve the correct Vite package when an app's SvelteKit is a
+ * linked local repository.
+ *
+ * Duplicated with `packages/adapter-auto`
  * @param {string} dependency
  * @param {string} root
  */

package/src/utils/imports.js

@@ -0,0 +1,83 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * Reads the `imports` field from the package.json at the given directory.
+ * @param {string} cwd
+ * @returns {Record<string, string | Record<string, string>> | undefined}
+ */
+export function read_package_imports(cwd) {
+	const pkg_path = path.resolve(cwd, 'package.json');
+	if (fs.existsSync(pkg_path)) {
+		try {
+			return JSON.parse(fs.readFileSync(pkg_path, 'utf-8')).imports;
+		} catch {
+			// malformed package.json — ignore, the user will see other errors
+		}
+	}
+}
+
+/**
+ * Normalizes an import value to a string path, handling both string values
+ * and conditional export objects (using the `default` key).
+ * @param {string | Record<string, string>} value
+ * @returns {string | null}
+ */
+export function normalize_import_value(value) {
+	if (typeof value === 'string') {
+		return value.replace(/^\.\//, '');
+	}
+	if (value && typeof value === 'object' && typeof value.default === 'string') {
+		return value.default.replace(/^\.\//, '');
+	}
+	return null;
+}
+
+/**
+ * Returns the `#`-prefixed import keys from the package.json `imports` field.
+ * @param {string} cwd
+ * @returns {string[]}
+ */
+export function get_hash_import_keys(cwd) {
+	const imports = read_package_imports(cwd);
+	if (!imports) return [];
+	return Object.keys(imports).filter((key) => key.startsWith('#'));
+}
+
+/**
+ * Computes alias entries for `normalize_id` from the package.json `imports` field.
+ * Each entry maps a `#xx` alias to its absolute target path. Entries are sorted
+ * by path length descending so that longer/more-specific paths are matched first.
+ *
+ * @param {string} root
+ * @param {(p: string) => string} [normalize] - optional path normalizer (e.g. `vite.normalizePath`)
+ * @returns {Array<{ alias: string, path: string }>}
+ */
+export function get_import_aliases(root, normalize) {
+	const imports = read_package_imports(root);
+	if (!imports) return [];
+
+	/** @type {Array<{ alias: string, path: string }>} */
+	const aliases = [];
+
+	for (const [key, raw_value] of Object.entries(imports)) {
+		if (!key.startsWith('#')) continue;
+
+		const value = normalize_import_value(raw_value);
+		if (!value) continue;
+
+		// For `#xx/*` imports, the target directory is the value without `/*`
+		// For `#xx` imports, the target is the file itself
+		const target = value.endsWith('/*') ? value.slice(0, -2) : value;
+		if (target.includes('*')) continue; // not sure if this is even allowed in Node, anyway it's too niche/complex to support here
+		const abs = path.resolve(root, target);
+		const alias = key.endsWith('/*') ? key.slice(0, -2) : key;
+
+		aliases.push({ alias, path: normalize ? normalize(abs) : abs });
+	}
+
+	// Sort by path length descending so longer/more-specific paths match first
+	aliases.sort((a, b) => b.path.length - a.path.length);
+
+	return aliases;
+}

package/src/utils/mime.js

@@ -0,0 +1,9 @@
+import { mimes, lookup } from 'mrmime';
+
+// `mrmime` does not include `.ico` in its database. The IANA-registered
+// type is `image/vnd.microsoft.icon`, but `image/x-icon` is the
+// semi-official type that is universally supported by browsers and other
+// tools, so we use that.
+mimes['ico'] = 'image/x-icon';
+
+export { lookup };

package/src/utils/page_nodes.js

@@ -69,7 +69,7 @@ export class PageNodes {
 	}
 
 	get_config() {
-		/** @type {any} */
+		/** @type {Record<string, any>} */
 		let current = {};
 
 		for (const node of this.data) {
@@ -77,13 +77,11 @@ export class PageNodes {
 
 			current = {
 				...current,
-				// TODO: should we override the server config value with the universal value similar to other page options?
-				...node?.universal?.config,
-				...node?.server?.config
+				...node?.server?.config,
+				...node?.universal?.config
 			};
 		}
 
-		// TODO 3.0 always return `current`? then we can get rid of `?? {}` in other places
 		return Object.keys(current).length ? current : undefined;
 	}
 

package/src/utils/params.js

@@ -0,0 +1,66 @@
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+/**
+ * @param {import('types').RouteData[]} routes
+ * @returns {Set<string>}
+ */
+export function collect_matcher_names(routes) {
+	/** @type {Set<string>} */
+	const names = new Set();
+
+	for (const route of routes) {
+		for (const param of route.params) {
+			if (param.matcher) names.add(param.matcher);
+		}
+	}
+
+	return names;
+}
+
+/**
+ * @param {Record<string, unknown>} params
+ * @param {Set<string>} names
+ * @param {string} [file]
+ */
+export function validate_param_matchers(params, names, file) {
+	for (const name of names) {
+		if (!(name in params)) {
+			throw new Error(`No matcher found for parameter '${name}'${file ? ` in ${file}` : ''}`);
+		}
+	}
+}
+
+/**
+ * @param {{
+ *   routes: import('types').RouteData[];
+ *   params_path: string | null;
+ *   root: string;
+ *   load?: (file: string) => Promise<Record<string, unknown>>;
+ * }} opts
+ * @returns {Promise<Record<string, import('@sveltejs/kit').ParamMatcher> | null>}
+ */
+export async function load_and_validate_params({ routes, params_path, root, load }) {
+	const names = collect_matcher_names(routes);
+
+	if (names.size === 0) return null;
+
+	if (!params_path) {
+		throw new Error(`No matcher found for parameter '${names.values().next().value}'`);
+	}
+
+	const file = path.resolve(root, params_path);
+	const module = load ? await load(file) : await import(pathToFileURL(file).href);
+
+	if (!module.params || typeof module.params !== 'object') {
+		throw new Error(`${params_path} does not export \`params\` from \`defineParams\``);
+	}
+
+	validate_param_matchers(
+		/** @type {Record<string, unknown>} */ (module.params),
+		names,
+		params_path
+	);
+
+	return /** @type {Record<string, import('@sveltejs/kit').ParamMatcher>} */ (module.params);
+}

package/src/utils/routing.js

@@ -1,7 +1,6 @@
 import { BROWSER } from 'esm-env';
-import { decode_params } from './url.js';
 
-const param_pattern = /^(\[)?(\.\.\.)?(\w+)(?:=(\w+))?(\])?$/;
+const param_pattern = /^(\[)?(\.\.\.)?([\w-]+)(?:=([\w-]+))?(\])?$/;
 
 const root_group_pattern = /^\/\((?:[^)]+)\)$/;
 
@@ -20,7 +19,7 @@ export function parse_route_id(id) {
 					`^${get_route_segments(id)
 						.map((segment) => {
 							// special case — /[...rest]/ could contain zero segments
-							const rest_match = /^\[\.\.\.(\w+)(?:=(\w+))?\]$/.exec(segment);
+							const rest_match = /^\[\.\.\.([\w-]+)(?:=([\w-]+))?\]$/.exec(segment);
 							if (rest_match) {
 								params.push({
 									name: rest_match[1],
@@ -32,7 +31,7 @@ export function parse_route_id(id) {
 								return '(?:/([^]*))?';
 							}
 							// special case — /[[optional]]/ could contain zero segments
-							const optional_match = /^\[\[(\w+)(?:=(\w+))?\]\]$/.exec(segment);
+							const optional_match = /^\[\[([\w-]+)(?:=([\w-]+))?\]\]$/.exec(segment);
 							if (optional_match) {
 								params.push({
 									name: optional_match[1],
@@ -73,7 +72,7 @@ export function parse_route_id(id) {
 										const match = /** @type {RegExpExecArray} */ (param_pattern.exec(content));
 										if (!BROWSER && !match) {
 											throw new Error(
-												`Invalid param: ${content}. Params and matcher names can only have underscores and alphanumeric characters.`
+												`Invalid param: ${content}. Params and matcher names can only have underscores, hyphens, and alphanumeric characters.`
 											);
 										}
 
@@ -104,7 +103,7 @@ export function parse_route_id(id) {
 	return { pattern, params };
 }
 
-const optional_param_regex = /\/\[\[\w+?(?:=\w+)?\]\]/;
+const optional_param_regex = /\/\[\[[\w-]+?(?:=[\w-]+)?\]\]/;
 
 /**
  * Removes optional params from a route ID.
@@ -134,13 +133,43 @@ export function get_route_segments(route) {
 	return route.slice(1).split('/').filter(affects_path);
 }
 
+/**
+ * @param {import('@sveltejs/kit').ParamMatcher} matcher
+ * @param {string} value
+ * @returns {{ success: true, value: any } | { success: false }}
+ */
+function run_matcher(matcher, value) {
+	const result = matcher['~standard'].validate(value);
+
+	if (result instanceof Promise) {
+		throw new Error('Async param matchers are not supported');
+	}
+
+	if (result.issues) {
+		return { success: false };
+	}
+
+	const parsed = result.value;
+
+	if (
+		typeof parsed !== 'string' &&
+		typeof parsed !== 'number' &&
+		typeof parsed !== 'boolean' &&
+		typeof parsed !== 'bigint'
+	) {
+		throw new Error('Param matcher must return a string, number, boolean, or bigint');
+	}
+
+	return { success: true, value: parsed };
+}
+
 /**
  * @param {RegExpMatchArray} match
  * @param {import('types').RouteParam[]} params
  * @param {Record<string, import('@sveltejs/kit').ParamMatcher>} matchers
  */
 export function exec(match, params, matchers) {
-	/** @type {Record<string, string>} */
+	/** @type {Record<string, any>} */
 	const result = {};
 
 	const values = match.slice(1);
@@ -173,37 +202,41 @@ export function exec(match, params, matchers) {
 			}
 		}
 
-		if (!param.matcher || matchers[param.matcher](value)) {
-			result[param.name] = value;
+		const decoded = decodeURIComponent(value);
 
-			// Now that the params match, reset the buffer if the next param isn't the [...rest]
-			// and the next value is defined, otherwise the buffer will cause us to skip values
-			const next_param = params[i + 1];
-			const next_value = values[i + 1];
-			if (next_param && !next_param.rest && next_param.optional && next_value && param.chained) {
-				buffered = 0;
-			}
+		if (param.matcher) {
+			const outcome = run_matcher(matchers[param.matcher], decoded);
+
+			if (!outcome.success) {
+				// in the `/[[a=b]]/...` case, if the value didn't satisfy the matcher,
+				// keep track of the number of skipped optional parameters and continue
+				if (param.optional && param.chained) {
+					buffered++;
+					continue;
+				}
 
-			// There are no more params and no more values, but all non-empty values have been matched
-			if (
-				!next_param &&
-				!next_value &&
-				Object.keys(result).length === values_needing_match.length
-			) {
-				buffered = 0;
+				// otherwise, if the matcher returns `false`, the route did not match
+				return;
 			}
-			continue;
+
+			result[param.name] = outcome.value;
+		} else {
+			result[param.name] = decoded;
 		}
 
-		// in the `/[[a=b]]/...` case, if the value didn't satisfy the matcher,
-		// keep track of the number of skipped optional parameters and continue
-		if (param.optional && param.chained) {
-			buffered++;
-			continue;
+		// Now that the params match, reset the buffer if the next param isn't the [...rest]
+		// and the next value is defined, otherwise the buffer will cause us to skip values
+		const next_param = params[i + 1];
+		const next_value = values[i + 1];
+		if (next_param && !next_param.rest && next_param.optional && next_value && param.chained) {
+			buffered = 0;
 		}
 
-		// otherwise, if the matcher returns `false`, the route did not match
-		return;
+		// There are no more params and no more values, but all non-empty values have been matched
+		if (!next_param && !next_value && Object.keys(result).length === values_needing_match.length) {
+			buffered = 0;
+		}
+		continue;
 	}
 
 	if (buffered) return;
@@ -227,7 +260,7 @@ function escape(str) {
 	);
 }
 
-const basic_param_pattern = /\[(\[)?(\.\.\.)?(\w+?)(?:=(\w+))?\]\]?/g;
+const basic_param_pattern = /\[(\[)?(\.\.\.)?([\w-]+?)(?:=([\w-]+))?\]\]?/g;
 
 /**
  * Populate a route ID with params to resolve a pathname.
@@ -242,7 +275,7 @@ const basic_param_pattern = /\[(\[)?(\.\.\.)?(\w+?)(?:=(\w+))?\]\]?/g;
  * ); // `/blog/hello-world/something/else`
  * ```
  * @param {string} id
- * @param {Record<string, string | undefined>} params
+ * @param {Record<string, import('@sveltejs/kit').ParamValue | undefined>} params
  * @returns {string}
  */
 export function resolve_route(id, params) {
@@ -254,20 +287,33 @@ export function resolve_route(id, params) {
 		segments
 			.map((segment) =>
 				segment.replace(basic_param_pattern, (_, optional, rest, name) => {
-					const param_value = params[name];
+					const value = params[name];
 
-					// This is nested so TS correctly narrows the type
-					if (!param_value) {
+					if (value === undefined || value === '') {
 						if (optional) return '';
-						if (rest && param_value !== undefined) return '';
+						if (rest && value !== undefined) return '';
 						throw new Error(`Missing parameter '${name}' in route ${id}`);
 					}
 
-					if (param_value.startsWith('/') || param_value.endsWith('/'))
-						throw new Error(
-							`Parameter '${name}' in route ${id} cannot start or end with a slash -- this would cause an invalid route like foo//bar`
-						);
-					return param_value;
+					if (typeof value === 'string') {
+						if (value.startsWith('/') || value.endsWith('/')) {
+							throw new Error(
+								`Parameter '${name}' in route ${id} cannot start or end with a slash -- this would cause an invalid route like foo//bar`
+							);
+						}
+
+						return value;
+					}
+
+					if (
+						typeof value === 'number' ||
+						typeof value === 'boolean' ||
+						typeof value === 'bigint'
+					) {
+						return String(value);
+					}
+
+					throw new Error('Parameter values must be a string, number, boolean, or bigint');
 				})
 			)
 			.filter(Boolean)
@@ -290,7 +336,7 @@ export function has_server_load(node) {
  * @param {string} path - The decoded pathname to match
  * @param {Route[]} routes
  * @param {Record<string, import('@sveltejs/kit').ParamMatcher>} matchers
- * @returns {{ route: Route, params: Record<string, string> } | null}
+ * @returns {{ route: Route, params: Record<string, any> } | null}
  */
 export function find_route(path, routes, matchers) {
 	for (const route of routes) {
@@ -301,7 +347,7 @@ export function find_route(path, routes, matchers) {
 		if (matched) {
 			return {
 				route,
-				params: decode_params(matched)
+				params: matched
 			};
 		}
 	}

package/src/utils/shared-iterator.js

@@ -52,6 +52,11 @@ export class SharedIterator {
 	/** @type {unknown} */
 	#terminal_error = undefined;
 
+	/** Whether `done()` or `fail()` has been broadcast. */
+	get closed() {
+		return this.#closed;
+	}
+
 	/**
 	 * @param {(instance: SharedIterator<T>) => (() => void)} [start]
 	 */