@sveltejs/kit 3.0.0-next.13 → 3.0.0-next.14

package/src/runtime/server/page/render.js

@@ -11,7 +11,11 @@ import { uneval_action_response } from './actions.js';
 import { SVELTE_KIT_ASSETS } from '../../../constants.js';
 import { SCHEME } from '../../../utils/url.js';
 import { create_server_routing_response, generate_route_object } from './server_routing.js';
-import { add_data_suffix, add_resolution_suffix } from '../../pathname.js';
+import {
+	add_data_suffix,
+	add_resolution_suffix,
+	route_id_resolution_pathname
+} from '../../pathname.js';
 import { try_get_request_store, with_request_store } from '@sveltejs/kit/internal/server';
 import { text_encoder } from '../../utils.js';
 import { count_non_ssi_comments, create_replacer, get_global_name } from '../utils.js';
@@ -390,6 +394,20 @@ export async function render_response({
 				pathname,
 				create_server_routing_response(route, event.params, new URL(pathname, event.url), client)
 			);
+
+			// Prerender a route-ID-keyed `/_app/routes/<id>/__route.js` module alongside the
+			// pathname-keyed one above, so that `preloadCode(id)` can resolve a route ID without
+			// hitting the server.
+			if (route && !state.prerendering.resolved_route_ids.has(route.id)) {
+				state.prerendering.resolved_route_ids.add(route.id);
+
+				const id_pathname = paths.base + route_id_resolution_pathname(paths.app_dir, route.id);
+
+				state.prerendering.dependencies.set(
+					id_pathname,
+					create_server_routing_response(route, null, new URL(id_pathname, event.url), client)
+				);
+			}
 		}
 
 		const blocks = [];

package/src/runtime/server/page/serialize_data.js

@@ -1,5 +1,5 @@
 import { escape_html } from '../../../utils/escape.js';
-import { hash } from '../../../utils/hash.js';
+import { hash_request } from '../../../utils/hash.js';
 
 /**
  * Inside a script element, only `</script` and `<!--` hold special meaning to the HTML parser.
@@ -78,18 +78,7 @@ export function serialize_data(fetched, filter, prerendering = false) {
 	}
 
 	if (fetched.request_headers || fetched.request_body) {
-		/** @type {import('types').StrictBody[]} */
-		const values = [];
-
-		if (fetched.request_headers) {
-			values.push([...new Headers(fetched.request_headers)].join(','));
-		}
-
-		if (fetched.request_body) {
-			values.push(fetched.request_body);
-		}
-
-		attrs.push(`data-hash="${hash(...values)}"`);
+		attrs.push(`data-hash="${hash_request(fetched.request_headers, fetched.request_body)}"`);
 	}
 
 	// Compute the time the response should be cached, taking into account max-age and age.

package/src/runtime/server/page/server_routing.js

@@ -84,26 +84,75 @@ export async function resolve_route(resolved_path, url, manifest) {
 	}
 }
 
+/**
+ * Resolve a route-ID resolution request (`/_app/routes/<id>/__route.js`) to a
+ * JS module containing the route's node loaders. Params are always `{}` since
+ * this endpoint exists to support `preloadCode(routeId)`, which doesn't need them.
+ *
+ * The module has one of three shapes, which the client uses to tell three cases apart:
+ *
+ * - `export const route = {...}` — a page route, with loaders to import
+ * - `export const endpoint_only = true` — a real route with no `+page`, so there is
+ *   nothing to preload, but the client can cache that fact and stop asking
+ * - an empty module — no such route
+ *
+ * @param {string} route_id
+ * @param {URL} url
+ * @param {SSRManifest} manifest
+ * @returns {Response}
+ */
+export function resolve_route_by_id(route_id, url, manifest) {
+	if (!manifest._.client?.routes) {
+		return text('Server-side route resolution disabled', { status: 400 });
+	}
+
+	try {
+		const route = manifest._.client.routes.find((r) => r.id === route_id);
+
+		if (route) {
+			return create_server_routing_response(route, null, url, manifest._.client).response;
+		}
+
+		// `client.routes` only contains routes with a `+page`, so a miss above doesn't mean the
+		// route doesn't exist — it might be a `+server.js`-only route. `_.routes` includes those
+		// (with `page: null`), so we can distinguish "exists but has no code" from "unknown".
+		if (manifest._.routes.some((r) => r.id === route_id && !r.page)) {
+			return text('export const endpoint_only = true;', { headers: js_headers() });
+		}
+
+		return create_server_routing_response(null, null, url, manifest._.client).response;
+	} catch {
+		return text('Error resolving route', { status: 500 });
+	}
+}
+
+function js_headers() {
+	return new Headers({
+		'content-type': 'application/javascript; charset=utf-8'
+	});
+}
+
 /**
  * @param {import('types').SSRClientRoute | null} route
- * @param {Partial<Record<string, string>>} params
+ * @param {Partial<Record<string, string>> | null} params
  * @param {URL} url
  * @param {NonNullable<SSRManifest['_']['client']>} client
  * @returns {{response: Response, body: string}}
  */
 export function create_server_routing_response(route, params, url, client) {
-	const headers = new Headers({
-		'content-type': 'application/javascript; charset=utf-8'
-	});
+	const headers = js_headers();
+	let body = '';
 
 	if (route) {
 		const csr_route = generate_route_object(route, url, client);
-		const body = `${create_css_import(route, url, client)}\nexport const route = ${csr_route}; export const params = ${JSON.stringify(params)};`;
+		body = `${create_css_import(route, url, client)}export const route = ${csr_route};`;
 
-		return { response: text(body, { headers }), body };
-	} else {
-		return { response: text('', { headers }), body: '' };
+		if (params !== null) {
+			body += `\nexport const params = ${JSON.stringify(params)}`;
+		}
 	}
+
+	return { response: text(body, { headers }), body };
 }
 
 /**
@@ -132,5 +181,5 @@ function create_css_import(route, url, client) {
 
 	if (!css) return '';
 
-	return `${create_client_import(client.start, url)}.then(x => x.load_css([${css}]));`;
+	return `${create_client_import(client.start, url)}.then(x => x.load_css([${css}]));\n`;
 }

package/src/runtime/server/respond.js

@@ -1,4 +1,4 @@
-/** @import { RequestState, SSRNode } from 'types' */
+/** @import { SSRNode } from 'types' */
 import { DEV } from 'esm-env';
 import { json, text } from '@sveltejs/kit';
 import { Redirect, SvelteKitError } from '@sveltejs/kit/internal';
@@ -26,13 +26,15 @@ import { validate_server_exports } from '../../utils/exports.js';
 import { action_json_redirect, is_action_json_request } from './page/actions.js';
 import { INVALIDATED_PARAM, TRAILING_SLASH_PARAM } from '../shared.js';
 import { get_public_env } from './env_module.js';
-import { resolve_route } from './page/server_routing.js';
+import { resolve_route, resolve_route_by_id } from './page/server_routing.js';
 import { validateHeaders } from './validate-headers.js';
 import {
 	add_data_suffix,
 	add_resolution_suffix,
+	extract_route_id,
 	has_data_suffix,
 	has_resolution_suffix,
+	is_route_id_resolution_path,
 	strip_data_suffix,
 	strip_resolution_suffix
 } from '../pathname.js';
@@ -40,6 +42,7 @@ import { server_data_serializer } from './page/data_serializer.js';
 import { get_remote_id, handle_remote_call } from './remote-functions.js';
 import { record_span } from '../telemetry/record_span.js';
 import { otel } from '../telemetry/otel.js';
+import { create_request_state } from './state.js';
 
 /** @type {import('types').RequiredResolveOptions['transformPageChunk']} */
 const default_transform = ({ html }) => html;
@@ -138,12 +141,16 @@ export async function internal_respond(request, options, manifest, state) {
 
 	let skip_route_resolution = false;
 
+	/** Whether this is a `/${app_dir}/routes/<route_id>/__route.js` request, used by `preloadCode` */
+	let is_route_id_resolution_request = false;
+
 	if (is_route_resolution_request) {
 		/**
 		 * If the request is for a route resolution, first modify the URL, then continue as normal
 		 * for path resolution, then return the route object as a JS file.
 		 */
 		url.pathname = strip_resolution_suffix(url.pathname);
+		is_route_id_resolution_request = is_route_id_resolution_path(url.pathname, base, app_dir);
 	} else if (is_data_request) {
 		url.pathname =
 			strip_data_suffix(url.pathname) +
@@ -174,30 +181,7 @@ export async function internal_respond(request, options, manifest, state) {
 		url
 	);
 
-	/** @type {RequestState} */
-	const event_state = {
-		prerendering: state.prerendering,
-		transport: options.hooks.transport,
-		handleValidationError: options.hooks.handleValidationError,
-		tracing: {
-			record_span
-		},
-		remote: {
-			data: null,
-			explicit: null,
-			implicit: null,
-			forms: null,
-			requested: null,
-			batches: null,
-			live_iterators: null
-		},
-		is_in_remote_function: false,
-		is_in_remote_form_or_command: false,
-		is_in_remote_query: false,
-		is_in_remote_prerender: false,
-		is_in_render: false,
-		is_in_universal_load: false
-	};
+	const event_state = create_request_state(state, options.hooks);
 
 	/** @type {import('@sveltejs/kit').RequestEvent} */
 	const event = {
@@ -270,7 +254,8 @@ export async function internal_respond(request, options, manifest, state) {
 	/** @type {string | null} */
 	let resolved_path = url.pathname;
 
-	if (!remote_id) {
+	// `reroute` hooks receive pathnames, so they must not run for route-ID resolution requests
+	if (!remote_id && !is_route_id_resolution_request) {
 		const prerendering_reroute_state = state.prerendering?.inside_reroute;
 		try {
 			// For the duration or a reroute, disable the prerendering state as reroute could call API endpoints
@@ -354,6 +339,14 @@ export async function internal_respond(request, options, manifest, state) {
 	}
 
 	if (is_route_resolution_request) {
+		if (is_route_id_resolution_request) {
+			return resolve_route_by_id(
+				extract_route_id(resolved_path, app_dir),
+				new URL(request.url),
+				manifest
+			);
+		}
+
 		return resolve_route(resolved_path, new URL(request.url), manifest);
 	}
 

package/src/runtime/server/state.js

@@ -0,0 +1,43 @@
+/** @import { RequestState, ServerHooks, SSRState } from 'types' */
+import { record_span } from '../telemetry/record_span.js';
+
+/**
+ * @param {SSRState} state
+ * @param {ServerHooks} hooks
+ * @returns {RequestState}
+ */
+export function create_request_state(state, hooks) {
+	// Request state is rebuilt fresh, resetting remote caches and context flags.
+	return {
+		prerendering: state.prerendering,
+		transport: hooks.transport,
+		handleValidationError: hooks.handleValidationError,
+		tracing: {
+			record_span
+		},
+		remote: {
+			data: null,
+			explicit: null,
+			implicit: null,
+			forms: null,
+			requested: null,
+			batches: null,
+			live_iterators: null
+		},
+		is_in_remote_function: false,
+		is_in_remote_form_or_command: false,
+		is_in_remote_query: false,
+		is_in_remote_prerender: false,
+		is_in_render: false,
+		is_in_universal_load: false
+	};
+}
+
+/**
+ * @param {SSRState} state
+ * @returns {SSRState}
+ */
+export function fork_state_for_subrequest(state) {
+	// Sub-requests inherit all server state except for the incremented depth.
+	return { ...state, depth: state.depth + 1 };
+}

package/src/runtime/shared.js

@@ -1,6 +1,6 @@
 /** @import { Transport } from '@sveltejs/kit' */
 import * as devalue from 'devalue';
-import { base64_decode, base64_encode, text_encoder } from './utils.js';
+import { base64_decode, base64_encode, text_decoder, text_encoder } from './utils.js';
 
 /**
  * @param {string} route_id
@@ -331,6 +331,7 @@ export async function stringify_command_arg(value, transport) {
  */
 function url_friendly_base64_encode(string) {
 	const bytes = text_encoder.encode(string);
+	// TODO replace with `bytes.toBase64({ alphabet: 'base64url', omitPadding: true })` when we require Node >= 25
 	return base64_encode(bytes).replaceAll('=', '').replaceAll('+', '-').replaceAll('/', '_');
 }
 
@@ -342,7 +343,8 @@ function url_friendly_base64_encode(string) {
 export function parse_remote_arg(string, transport) {
 	if (!string) return undefined;
 
-	const json_string = new TextDecoder().decode(
+	const json_string = text_decoder.decode(
+		// TODO replace with `Uint8Array.fromBase64(string, { alphabet: 'base64url' })` when we require Node >= 25
 		// no need to add back `=` characters, atob can handle it
 		base64_decode(string.replaceAll('-', '+').replaceAll('_', '/'))
 	);

package/src/runtime/utils.js

@@ -1,6 +1,7 @@
 import { BROWSER } from 'esm-env';
 
 export const text_encoder = new TextEncoder();
+export const text_decoder = new TextDecoder();
 
 /**
  * Like node's path.relative, but without using node
@@ -28,6 +29,7 @@ export function get_relative_path(from, to) {
  * @returns {string}
  */
 export function base64_encode(bytes) {
+	// TODO replace with `bytes.toBase64()` when we require Node >= 25
 	// Using `Buffer` is faster than iterating
 	if (!BROWSER && globalThis.Buffer) {
 		return globalThis.Buffer.from(bytes).toString('base64');
@@ -47,6 +49,7 @@ export function base64_encode(bytes) {
  * @returns {Uint8Array}
  */
 export function base64_decode(encoded) {
+	// TODO replace with `Uint8Array.fromBase64(encoded)` when we require Node >= 25
 	// Using `Buffer` is faster than iterating
 	if (!BROWSER && globalThis.Buffer) {
 		const buffer = globalThis.Buffer.from(encoded, 'base64');

package/src/types/ambient-private.d.ts

@@ -51,5 +51,5 @@ declare module '__sveltekit/manifest-data' {
 	export const immutable: Array<{ path: string }>;
 	export const assets: Array<{ path: string }>;
 	export const prerendered: Array<{ path: string }>;
-	export const routes: Array<{ id: string }>;
+	export const routes: Array<{ id: string; page: boolean; endpoint: boolean }>;
 }

package/src/types/ambient.d.ts

@@ -78,9 +78,41 @@ declare module '$app/manifest' {
 	 */
 	export const prerendered: Array<{ path: import('$app/types').Path }>;
 	/**
-	 * An array of objects with an `id` property representing the routes in your app.
-	 */
-	export const routes: Array<{ id: import('$app/types').RouteId }>;
+	 * A route in your app, along with its capabilities. `page` indicates the presence of a `+page`,
+	 * while `endpoint` indicates the presence of a `+server`. Both are `true` when both files exist.
+	 */
+	export type ManifestRoute =
+		| {
+				id: Exclude<import('$app/types').PageRouteId, import('$app/types').EndpointRouteId>;
+				page: true;
+				endpoint: false;
+		  }
+		| {
+				id: Exclude<import('$app/types').EndpointRouteId, import('$app/types').PageRouteId>;
+				page: false;
+				endpoint: true;
+		  }
+		| {
+				id: Extract<import('$app/types').PageRouteId, import('$app/types').EndpointRouteId>;
+				page: true;
+				endpoint: true;
+		  };
+	/**
+	 * An array of objects representing the routes in your app. Only routes that the router can match
+	 * are included — directories that merely hold a `+layout` are not routes of their own.
+	 *
+	 * Each object has an `id`, plus `page` and `endpoint` booleans describing whether the route has a
+	 * `+page` and/or a `+server`. Both are `true` for a route that has both, so the capabilities can
+	 * be filtered independently:
+	 *
+	 * ```js
+	 * import { routes } from '$app/manifest';
+	 *
+	 * const pages = routes.filter((route) => route.page);
+	 * const endpoints = routes.filter((route) => route.endpoint);
+	 * ```
+	 */
+	export const routes: ManifestRoute[];
 }
 
 /**
@@ -94,6 +126,8 @@ declare module '$app/types' {
 		// These are all functions so that we can leverage function overloads to get the correct type.
 		// Using the return types directly would error with a "not the same type" error.
 		// https://www.typescriptlang.org/docs/handbook/declaration-merging.html#merging-interfaces
+		PageRouteId(): string;
+		EndpointRouteId(): string;
 		RouteId(): string;
 		RouteParams(): Record<string, Record<string, string>>;
 		LayoutParams(): Record<string, Record<string, string>>;
@@ -103,7 +137,21 @@ declare module '$app/types' {
 	}
 
 	/**
-	 * A union of all the route IDs in your app. Used for `page.route.id` and `event.route.id`.
+	 * A union of the route IDs in your app that have a `+page`.
+	 *
+	 * A route ID can be in both `PageRouteId` and `EndpointRouteId`, if its directory contains both a `+page` and a `+server`.
+	 */
+	export type PageRouteId = ReturnType<AppTypes['PageRouteId']>;
+
+	/**
+	 * A union of the route IDs in your app that have a `+server`.
+	 *
+	 * A route ID can be in both `PageRouteId` and `EndpointRouteId`, if its directory contains both a `+page` and a `+server`.
+	 */
+	export type EndpointRouteId = ReturnType<AppTypes['EndpointRouteId']>;
+
+	/**
+	 * A union of all the route IDs in your app — the union of `PageRouteId` and `EndpointRouteId`. Used for `page.route.id` and `event.route.id`.
 	 */
 	export type RouteId = ReturnType<AppTypes['RouteId']>;
 
@@ -119,12 +167,15 @@ declare module '$app/types' {
 		? ReturnType<AppTypes['RouteParams']>[T]
 		: Record<string, never>;
 
+	/**
+	 * The route IDs accepted by `LayoutParams`. Like `RouteId`, these preserve route groups and `[param]` syntax, but they identify directories containing layouts rather than matchable routes.
+	 */
+	type LayoutParamsId = keyof ReturnType<AppTypes['LayoutParams']>;
+
 	/**
 	 * A utility for getting the parameters associated with a given layout, which is similar to `RouteParams` but also includes optional parameters for any child route.
 	 */
-	export type LayoutParams<T extends RouteId> = T extends keyof ReturnType<AppTypes['LayoutParams']>
-		? ReturnType<AppTypes['LayoutParams']>[T]
-		: Record<string, never>;
+	export type LayoutParams<T extends LayoutParamsId> = ReturnType<AppTypes['LayoutParams']>[T];
 
 	/**
 	 * A union of all valid paths in your app, relative to the `base` path.

package/src/types/global-private.d.ts

@@ -53,7 +53,7 @@ declare global {
 	const __SVELTEKIT_MANIFEST_IMMUTABLE__: string[];
 	const __SVELTEKIT_MANIFEST_ASSETS__: string[];
 	const __SVELTEKIT_MANIFEST_PRERENDERED__: string[];
-	const __SVELTEKIT_MANIFEST_ROUTES__: { id: string }[];
+	const __SVELTEKIT_MANIFEST_ROUTES__: Array<{ id: string }>;
 	/**
 	 * This makes the use of specific features visible at both dev and build time, in such a
 	 * way that we can error when they are not supported by the target platform.

package/src/types/internal.d.ts

@@ -239,6 +239,8 @@ export interface PrerenderOptions {
 	dependencies: Map<string, PrerenderDependency>;
 	/** Results of remote `prerender` functions, shared across the whole prerender run so that each only executes once */
 	remote_responses: Map<string, Promise<any>>;
+	/** Route IDs whose resolution module has been emitted, shared across the whole prerender run so that each only generates once */
+	resolved_route_ids: Set<string>;
 	/** True for the duration of a call to the `reroute` hook */
 	inside_reroute?: boolean;
 }
@@ -536,7 +538,6 @@ export interface SSRClientRoute {
 }
 
 export interface SSRState {
-	fallback?: string;
 	getClientAddress(): string;
 	/**
 	 * True if we're currently attempting to render an error page.

package/src/utils/hash.js

@@ -20,3 +20,24 @@ export function hash(...values) {
 
 	return (hash >>> 0).toString(36);
 }
+
+/**
+ * Hash of the headers and body a `fetch` was called with. The server-side serializer and the
+ * client-side cache lookup must produce identical values for cached responses to be found.
+ * @param {HeadersInit | undefined} headers
+ * @param {import('types').StrictBody | null | undefined} body
+ */
+export function hash_request(headers, body) {
+	/** @type {import('types').StrictBody[]} */
+	const values = [];
+
+	if (headers) {
+		values.push([...new Headers(headers)].join(','));
+	}
+
+	if (body) {
+		values.push(body);
+	}
+
+	return hash(...values);
+}

package/src/utils/http.js

@@ -11,7 +11,7 @@ export function negotiate(accept, types) {
 	const parts = [];
 
 	accept.split(',').forEach((str, i) => {
-		const match = /([^/ \t]+)\/([^; \t]+)[ \t]*(?:;[ \t]*q=([0-9.]+))?/.exec(str);
+		const match = /^[ \t]*([^/ \t]+)\/([^; \t]+)[ \t]*(?:;[ \t]*q=([0-9.]+))?/.exec(str);
 
 		// no match equals invalid header — ignore
 		if (match) {
@@ -57,12 +57,13 @@ export function negotiate(accept, types) {
 }
 
 /**
- * Returns `true` if the request contains a `content-type` header with the given type
- * @param {Request} request
+ * Returns `true` if a `content-type` header value is one of the given types, ignoring
+ * parameters such as `charset` and comparing case-insensitively
+ * @param {string | null | undefined} header
  * @param  {...string} types
  */
-function is_content_type(request, ...types) {
-	const type = request.headers.get('content-type')?.split(';', 1)[0].trim() ?? '';
+export function matches_content_type(header, ...types) {
+	const type = header?.split(';', 1)[0].trim() ?? '';
 	return types.includes(type.toLowerCase());
 }
 
@@ -72,8 +73,8 @@ function is_content_type(request, ...types) {
 export function is_form_content_type(request) {
 	// These content types must be protected against CSRF
 	// https://developer.mozilla.org/en-US/docs/Web/API/HTMLFormElement/enctype
-	return is_content_type(
-		request,
+	return matches_content_type(
+		request.headers.get('content-type'),
 		'application/x-www-form-urlencoded',
 		'multipart/form-data',
 		'text/plain',

package/src/utils/import.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 
 /**
  * Resolves a peer dependency relative to the current working directory.
@@ -51,7 +52,7 @@ function resolve_peer(dependency, root) {
  */
 export async function import_peer(dependency, root) {
 	try {
-		return await import(/* @vite-ignore */ resolve_peer(dependency, root));
+		return await import(/* @vite-ignore */ pathToFileURL(resolve_peer(dependency, root)).href);
 	} catch {
 		return await import(/* @vite-ignore */ dependency);
 	}

package/src/utils/params.js

@@ -25,7 +25,7 @@ export function collect_matcher_names(routes) {
  */
 export function validate_param_matchers(params, names, file) {
 	for (const name of names) {
-		if (!(name in params)) {
+		if (!Object.hasOwn(params, name)) {
 			throw new Error(`No matcher found for parameter '${name}'${file ? ` in ${file}` : ''}`);
 		}
 	}

package/src/utils/regex.js

@@ -0,0 +1,9 @@
+/**
+ * Escapes characters that have special meaning in a regular expression.
+ * @param {string} str
+ * @returns {string} escaped string
+ */
+export function escape_for_regexp(str) {
+	// TODO replace with `RegExp.escape(str)` when we require Node >= 24
+	return str.replace(/[.*+?^${}()|[\]\\]/g, (match) => '\\' + match);
+}