@sveltejs/kit 3.0.0-next.11 → 3.0.0-next.12

package/src/runtime/server/respond.js

@@ -11,7 +11,12 @@ import { respond_with_error } from './page/respond_with_error.js';
 import { get_self_origin, is_csrf_forbidden, is_remote_forbidden } from './csrf.js';
 import { has_prerendered_path, method_not_allowed, redirect_response } from './utils.js';
 import { handle_fatal_error } from './errors.js';
-import { decode_pathname, disable_search, normalize_path } from '../../utils/url.js';
+import {
+	decode_pathname,
+	disable_search,
+	normalize_path,
+	relative_pathname
+} from '../../utils/url.js';
 import { find_route } from '../../utils/routing.js';
 import { redirect_json_response, render_data } from './data/index.js';
 import { add_cookies_to_headers, get_cookies } from './cookie.js';
@@ -45,6 +50,28 @@ const default_filter = () => false;
 /** @type {import('types').RequiredResolveOptions['preload']} */
 const default_preload = ({ type }) => type === 'js' || type === 'css';
 
+// `Sec-Fetch-Dest` values for subresource requests that can never render an HTML error page
+// https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Dest
+const non_html_fetch_destinations = new Set([
+	'audio',
+	'audioworklet',
+	'font',
+	'image',
+	'json',
+	'manifest',
+	'paintworklet',
+	'report',
+	'script',
+	'serviceworker',
+	'sharedworker',
+	'style',
+	'track',
+	'video',
+	'webidentity',
+	'worker',
+	'xslt'
+]);
+
 const page_methods = new Set(['GET', 'HEAD', 'POST']);
 
 const allowed_page_methods = new Set(['GET', 'HEAD', 'OPTIONS']);
@@ -109,6 +136,8 @@ export async function internal_respond(request, options, manifest, state) {
 	/** @type {boolean[] | undefined} */
 	let invalidated_data_nodes;
 
+	let skip_route_resolution = false;
+
 	if (is_route_resolution_request) {
 		/**
 		 * If the request is for a route resolution, first modify the URL, then continue as normal
@@ -126,8 +155,15 @@ export async function internal_respond(request, options, manifest, state) {
 			.map((node) => node === '1');
 		url.searchParams.delete(INVALIDATED_PARAM);
 	} else if (remote_id) {
-		url.pathname = request.headers.get('x-sveltekit-pathname') ?? base;
-		url.search = request.headers.get('x-sveltekit-search') ?? '';
+		// query clients don't send these headers, leaving `event.url` as the endpoint URL
+		const pathname = request.headers.get('x-sveltekit-pathname');
+
+		if (pathname === null) {
+			skip_route_resolution = true;
+		} else {
+			url.pathname = pathname;
+			url.search = request.headers.get('x-sveltekit-search') ?? '';
+		}
 	}
 
 	/** @type {Record<string, string>} */
@@ -158,6 +194,7 @@ export async function internal_respond(request, options, manifest, state) {
 		is_in_remote_function: false,
 		is_in_remote_form_or_command: false,
 		is_in_remote_query: false,
+		is_in_remote_prerender: false,
 		is_in_render: false,
 		is_in_universal_load: false
 	};
@@ -331,7 +368,7 @@ export async function internal_respond(request, options, manifest, state) {
 		return text('Not found', { status: 404, headers });
 	}
 
-	if (!state.prerendering?.fallback) {
+	if (!state.prerendering?.fallback && !skip_route_resolution) {
 		try {
 			const matchers = await manifest._.matchers();
 			const result = find_route(resolved_path, manifest._.routes, matchers);
@@ -378,10 +415,9 @@ export async function internal_respond(request, options, manifest, state) {
 						status: 308,
 						headers: {
 							'x-sveltekit-normalize': '1',
+							// relative so (possibly invisible) path prefixes are preserved
 							location:
-								// ensure paths starting with '//' are not treated as protocol-relative
-								(normalized.startsWith('//') ? url.origin + normalized : normalized) +
-								(url.search === '?' ? '' : url.search)
+								relative_pathname(url.pathname, normalized) + (url.search === '?' ? '' : url.search)
 						}
 					});
 				}
@@ -631,13 +667,12 @@ export async function internal_respond(request, options, manifest, state) {
 					) {
 						endpoint = await route.endpoint();
 
-						// Prefer rendering the page if the endpoint can't handle this GET or HEAD request
-						if (route.page && (method === 'GET' || method === 'HEAD')) {
-							const endpoint_can_handle = !!(
-								endpoint.GET ||
-								endpoint.fallback ||
-								(method === 'HEAD' && endpoint.HEAD)
-							);
+						// Prefer rendering the page if the endpoint can't handle this GET, HEAD, or POST request
+						if (route.page && (method === 'GET' || method === 'HEAD' || method === 'POST')) {
+							const endpoint_can_handle =
+								method === 'POST'
+									? !!(endpoint.POST || endpoint.fallback)
+									: !!(endpoint.GET || endpoint.fallback || (method === 'HEAD' && endpoint.HEAD));
 							if (!endpoint_can_handle) {
 								endpoint = undefined;
 							}
@@ -733,6 +768,13 @@ export async function internal_respond(request, options, manifest, state) {
 			// if this request came direct from the user, rather than
 			// via our own `fetch`, render a 404 page
 			if (state.depth === 0) {
+				if (non_html_fetch_destinations.has(event.request.headers.get('sec-fetch-dest') ?? '')) {
+					return text('Not Found', {
+						status: 404,
+						headers: { vary: 'Sec-Fetch-Dest' }
+					});
+				}
+
 				return await respond_with_error({
 					event,
 					event_state,

package/src/runtime/server/utils.js

@@ -50,6 +50,16 @@ export function redirect_response(status, location) {
 	return response;
 }
 
+/**
+ * @param {Response} response
+ */
+export function with_version_header(response) {
+	if (__SVELTEKIT_APP_VERSION_CHECKS_ENABLED__) {
+		response.headers.set('x-sveltekit-version', __SVELTEKIT_APP_VERSION__);
+	}
+	return response;
+}
+
 /**
  * @param {import('@sveltejs/kit').RequestEvent} event
  * @param {Error & { path: string }} error

package/src/types/ambient-private.d.ts

@@ -45,3 +45,11 @@ declare module '__sveltekit/env/public/client' {
 declare module '__sveltekit/env/public/server' {
 	// exported environment variables are defined in env.d.ts
 }
+
+/** Internal version of $app/manifest */
+declare module '__sveltekit/manifest-data' {
+	export const immutable: Array<{ path: string }>;
+	export const assets: Array<{ path: string }>;
+	export const prerendered: Array<{ path: string }>;
+	export const routes: Array<{ id: string }>;
+}

package/src/types/ambient.d.ts

@@ -57,32 +57,30 @@ declare namespace App {
 }
 
 /**
- * This module is only available to [service workers](https://svelte.dev/docs/kit/service-workers).
+ * This module is available to [service workers](https://svelte.dev/docs/kit/service-workers) and other contexts.
+ * It exports information about the build output, static files, prerendered pages, and routes.
  */
-declare module '$service-worker' {
+declare module '$app/manifest' {
 	/**
-	 * The `base` path of the deployment. Typically this is equivalent to `config.paths.base`, but it is calculated from `location.pathname` meaning that it will continue to work correctly if the site is deployed to a subdirectory.
-	 * Note that there is a `base` but no `assets`, since service workers cannot be used if `config.paths.assets` is specified.
-	 */
-	export const base: string;
-	/**
-	 * An array of URL strings representing the files generated by Vite, suitable for caching with `cache.addAll(build)`.
+	 * An array of `{ path: string }` objects representing the files generated by Vite.
+	 * The path is relative to the [base path](https://svelte.dev/docs/kit/configuration#paths), and is intended for use with `cache.add(...)` inside a [service worker](https://svelte.dev/docs/kit/service-workers).
 	 * During development, this is an empty array.
 	 */
-	export const build: string[];
+	export const immutable: Array<{ path: string }>;
 	/**
-	 * An array of URL strings representing the files in your static directory, or whatever directory is specified by `config.files.assets`. You can customize which files are included from `static` directory using [`config.serviceWorker.files`](https://svelte.dev/docs/kit/configuration#serviceWorker)
+	 * An array of `{ path: AssetPath }` objects representing the files in your `static` directory, or whatever directory is specified by `config.files.assets`.
+	 * The path is relative to the [base path](https://svelte.dev/docs/kit/configuration#paths), and can be used with [`asset(...)`](https://svelte.dev/docs/kit/$app-paths#asset).
 	 */
-	export const files: string[];
+	export const assets: Array<{ path: import('$app/types').AssetPath }>;
 	/**
-	 * An array of pathnames corresponding to prerendered pages and endpoints.
+	 * An array of `{ path: Path }` objects representing prerendered pages and endpoints, relative to the [base path](https://svelte.dev/docs/kit/configuration#paths).
 	 * During development, this is an empty array.
 	 */
-	export const prerendered: string[];
+	export const prerendered: Array<{ path: import('$app/types').Path }>;
 	/**
-	 * See [`config.version`](https://svelte.dev/docs/kit/configuration#version). It's useful for generating unique cache names inside your service worker, so that a later deployment of your app can invalidate old caches.
+	 * An array of objects with an `id` property representing the routes in your app.
 	 */
-	export const version: string;
+	export const routes: Array<{ id: import('$app/types').RouteId }>;
 }
 
 /**
@@ -99,9 +97,9 @@ declare module '$app/types' {
 		RouteId(): string;
 		RouteParams(): Record<string, Record<string, string>>;
 		LayoutParams(): Record<string, Record<string, string>>;
-		Pathname(): string;
+		Path(): string;
 		ResolvedPathname(): string;
-		Asset(): string;
+		AssetPath(): string;
 	}
 
 	/**
@@ -129,25 +127,22 @@ declare module '$app/types' {
 		: Record<string, never>;
 
 	/**
-	 * A union of all valid pathnames in your app.
+	 * A union of all valid paths in your app, relative to the `base` path.
 	 */
-	export type Pathname = ReturnType<AppTypes['Pathname']>;
+	export type Path = ReturnType<AppTypes['Path']>;
 
 	/**
-	 * `Pathname`, but possibly suffixed with a search string and/or hash.
+	 * `Path`, but possibly suffixed with a search string and/or hash.
 	 */
-	export type PathnameWithSearchOrHash =
-		| Pathname
-		| `${Pathname}?${string}`
-		| `${Pathname}#${string}`;
+	export type PathnameWithSearchOrHash = Path | `${Path}?${string}` | `${Path}#${string}`;
 
 	/**
-	 * `Pathname`, but possibly prefixed with a base path. Used for `page.url.pathname`.
+	 * `Path`, but prefixed with a base path. Used for `page.url.pathname`.
 	 */
 	export type ResolvedPathname = ReturnType<AppTypes['ResolvedPathname']>;
 
 	/**
-	 * A union of all the filenames of assets contained in your `static` directory.
+	 * A union of all the filenames of assets contained in your `static` directory, relative to the `base` path.
 	 */
-	export type Asset = ReturnType<AppTypes['Asset']>;
+	export type AssetPath = ReturnType<AppTypes['AssetPath']>;
 }

package/src/types/global-private.d.ts

@@ -6,6 +6,8 @@ declare global {
 	const __SVELTEKIT_APP_VERSION__: string;
 	const __SVELTEKIT_APP_VERSION_FILE__: string;
 	const __SVELTEKIT_APP_VERSION_POLL_INTERVAL__: number;
+	/** True if version checks are enabled (i.e. `bundleStrategy !== 'inline'`) */
+	const __SVELTEKIT_APP_VERSION_CHECKS_ENABLED__: boolean;
 	/**
 	 * True if the user ran `vite dev`. This is different from `esm-env` because
 	 * it is influenced by `NODE_ENV` which can still be true during `vite preview`
@@ -42,6 +44,16 @@ declare global {
 	 * Whether the `experimental.async` flag is applied
 	 */
 	const __SVELTEKIT_SUPPORTS_ASYNC__: boolean;
+	/**
+	 * Manifest data placeholders used by `$app/manifest`. During build, these
+	 * are bare identifiers (fake globals) that the bundler leaves as unresolved
+	 * references. They are replaced with real values by scanning the output
+	 * chunks after each build completes.
+	 */
+	const __SVELTEKIT_MANIFEST_IMMUTABLE__: string[];
+	const __SVELTEKIT_MANIFEST_ASSETS__: string[];
+	const __SVELTEKIT_MANIFEST_PRERENDERED__: string[];
+	const __SVELTEKIT_MANIFEST_ROUTES__: { id: string }[];
 	/**
 	 * This makes the use of specific features visible at both dev and build time, in such a
 	 * way that we can error when they are not supported by the target platform.

package/src/types/internal.d.ts

@@ -496,6 +496,7 @@ export interface SSROptions {
 		}): string;
 		error(values: { message: string; status: number }): string;
 	};
+	version: string;
 	version_hash: string;
 }
 
@@ -646,7 +647,7 @@ export interface RemoteFormInternals extends BaseRemoteInternals {
 	 * For keyed (`form.for(key)`) instances: the id as the client computes it
 	 * (the key is JSON-stringified but not URI-encoded, unlike `id`)
 	 */
-	action_id?: string;
+	key?: string;
 	fn(body: Record<string, any>, meta: BinaryFormMeta, form_data: FormData | null): Promise<any>;
 }
 
@@ -700,8 +701,11 @@ export interface RequestState {
 		 */
 		implicit: null | Map<RemoteInternals, Record<string, () => MaybePromise<any>>>;
 		/**
-		 * Data that is explicitly included because of a `set(...)` or `refresh()`.
-		 * This is always awaited
+		 * Data that is explicitly included because of a `set(...)`, `refresh()` or
+		 * `reconnect()`. The stored function is invoked lazily at the end of the
+		 * request by `collect_remote_data`; if the query was already read (and thus
+		 * cached) earlier in the request, invoking it does no additional work. This
+		 * is always awaited and serialized.
 		 */
 		explicit: null | Map<
 			string,
@@ -736,8 +740,14 @@ export interface RequestState {
 	readonly is_in_remote_function: boolean;
 	readonly is_in_remote_form_or_command: boolean;
 	readonly is_in_remote_query: boolean;
+	readonly is_in_remote_prerender: boolean;
 	readonly is_in_render: boolean;
 	readonly is_in_universal_load: boolean;
+	/**
+	 * The event before `derive_remote_function_event` hid or stubbed properties.
+	 * Hooks like `handleValidationError` receive this so `url` etc. stay accessible
+	 */
+	readonly original_event?: RequestEvent;
 }
 
 export interface RequestStore {

package/src/utils/url.js

@@ -27,6 +27,18 @@ export function is_root_relative(path) {
 	return path[0] === '/' && path[1] !== '/';
 }
 
+/**
+ * Relative reference from `from` to `to`, which must differ only by a trailing slash
+ * @param {string} from
+ * @param {string} to
+ * @returns {string}
+ */
+export function relative_pathname(from, to) {
+	const segment = to.replace(/\/$/, '').split('/').at(-1);
+
+	return from.endsWith('/') ? `../${segment}` : `${segment}/`;
+}
+
 /**
  * @param {string} location
  * @param {string} allowed

package/src/version.js

@@ -1,4 +1,4 @@
 // generated during release, do not modify
 
 /** @type {string} */
-export const VERSION = '3.0.0-next.11';
+export const VERSION = '3.0.0-next.12';