@sveltejs/kit 3.0.0-next.13 → 3.0.0-next.16

package/src/types/internal.d.ts

@@ -158,7 +158,7 @@ export interface ServerHooks {
 	handleError: HandleServerError;
 	handleValidationError: HandleValidationError;
 	reroute: Reroute;
-	transport: Transport;
+	transport?: Transport;
 	init?: ServerInit;
 }
 
@@ -174,24 +174,23 @@ export interface Env {
 	public: Record<string, string>;
 }
 
+export interface InternalRequestOptions extends RequestOptions {
+	prerendering?: PrerenderOptions;
+	/** @internal for saving dependencies during prerendering and generating fallback pages */
+	read: (file: string) => Buffer<ArrayBuffer>;
+	/** @internal used during development to check feature availability depending on the current route */
+	before_handle?: (
+		event: RequestEvent,
+		config: any,
+		prerender: PrerenderOption,
+		handle: () => Promise<Response>
+	) => Promise<Response>;
+	emulator?: Emulator;
+}
+
 export class InternalServer extends Server {
 	init(options: ServerInitOptions): Promise<void>;
-	respond(
-		request: Request,
-		options: RequestOptions & {
-			prerendering?: PrerenderOptions;
-			/** @internal for saving dependencies during prerendering and generating fallback pages */
-			read: (file: string) => Buffer<ArrayBuffer>;
-			/** @internal used during development to check feature availability depending on the current route */
-			before_handle?: (
-				event: RequestEvent,
-				config: any,
-				prerender: PrerenderOption,
-				handle: () => Promise<Response>
-			) => Promise<Response>;
-			emulator?: Emulator;
-		}
-	): Promise<Response>;
+	respond(request: Request, options: InternalRequestOptions): Promise<Response>;
 }
 
 export interface ManifestData {
@@ -239,6 +238,8 @@ export interface PrerenderOptions {
 	dependencies: Map<string, PrerenderDependency>;
 	/** Results of remote `prerender` functions, shared across the whole prerender run so that each only executes once */
 	remote_responses: Map<string, Promise<any>>;
+	/** Route IDs whose resolution module has been emitted, shared across the whole prerender run so that each only generates once */
+	resolved_route_ids: Set<string>;
 	/** True for the duration of a call to the `reroute` hook */
 	inside_reroute?: boolean;
 }
@@ -535,39 +536,6 @@ export interface SSRClientRoute {
 	leaf: [has_server_load: boolean, node_id: number];
 }
 
-export interface SSRState {
-	fallback?: string;
-	getClientAddress(): string;
-	/**
-	 * True if we're currently attempting to render an error page.
-	 */
-	error: boolean;
-	/**
-	 * Allows us to prevent `event.fetch` from making infinitely looping internal requests.
-	 */
-	depth: number;
-	platform?: any;
-	prerendering?: PrerenderOptions;
-	/**
-	 * When fetching data from a +server.js endpoint in `load`, the page's
-	 * prerender option is inherited by the endpoint, unless overridden.
-	 */
-	prerender_default?: PrerenderOption;
-	/** @internal reads from the filesystem when user code tries to fetch a static asset */
-	read?: (file: string) => Buffer<ArrayBuffer>;
-	/**
-	 * Used to set up `__SVELTEKIT_TRACK__` which checks if a used feature is supported.
-	 * E.g. if `read` from `$app/server` is used, it checks whether the route's config is compatible.
-	 */
-	before_handle?: (
-		event: RequestEvent,
-		config: Record<string, any>,
-		prerender: PrerenderOption,
-		handle: () => Promise<Response>
-	) => Promise<Response>;
-	emulator?: Emulator;
-}
-
 export type StrictBody = string | ArrayBufferView;
 
 export interface Uses {
@@ -681,8 +649,35 @@ export type RecordSpan = <T>(options: {
  * used for tracking things like remote function calls
  */
 export interface RequestState {
-	readonly prerendering: PrerenderOptions | undefined;
-	readonly transport: ServerHooks['transport'];
+	readonly getClientAddress: () => string;
+	readonly platform?: any;
+	/** @internal reads from the filesystem when user code tries to fetch a static asset */
+	readonly read?: (file: string) => Buffer<ArrayBuffer>;
+	/**
+	 * Used to set up `__SVELTEKIT_TRACK__` which checks if a used feature is supported.
+	 * E.g. if `read` from `$app/server` is used, it checks whether the route's config is compatible.
+	 */
+	readonly before_handle?: (
+		event: RequestEvent,
+		config: Record<string, any>,
+		prerender: PrerenderOption,
+		handle: () => Promise<Response>
+	) => Promise<Response>;
+	readonly emulator?: Emulator;
+	readonly prerendering?: PrerenderOptions;
+	/**
+	 * When fetching data from a +server.js endpoint in `load`, the page's
+	 * prerender option is inherited by the endpoint, unless overridden.
+	 */
+	prerender_default?: PrerenderOption;
+	/**
+	 * True if we're currently attempting to render an error page.
+	 */
+	error: boolean;
+	/**
+	 * Allows us to prevent `event.fetch` from making infinitely looping internal requests.
+	 */
+	readonly depth: number;
 	readonly handleValidationError: ServerHooks['handleValidationError'];
 	readonly tracing: {
 		record_span: RecordSpan;
@@ -737,7 +732,6 @@ export interface RequestState {
 	readonly is_in_remote_query: boolean;
 	readonly is_in_remote_prerender: boolean;
 	readonly is_in_render: boolean;
-	readonly is_in_universal_load: boolean;
 	/**
 	 * The event before `derive_remote_function_event` hid or stubbed properties.
 	 * Hooks like `handleValidationError` receive this so `url` etc. stay accessible

package/src/utils/filesystem.js

@@ -2,28 +2,6 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { posixify } from './os.js';
 
-/** @param {string} dir */
-export function mkdirp(dir) {
-	try {
-		fs.mkdirSync(dir, { recursive: true });
-	} catch (/** @type {any} */ e) {
-		if (e.code === 'EEXIST') {
-			if (!fs.statSync(dir).isDirectory()) {
-				throw new Error(`Cannot create directory ${dir}, a file already exists at this position`, {
-					cause: e
-				});
-			}
-			return;
-		}
-		throw e;
-	}
-}
-
-/** @param {string} path */
-export function rimraf(path) {
-	fs.rmSync(path, { force: true, recursive: true });
-}
-
 /**
  * @param {string} source
  * @param {string} target
@@ -58,7 +36,7 @@ export function copy(source, target, opts = {}) {
 				go(path.join(from, file), path.join(to, file));
 			});
 		} else {
-			mkdirp(path.dirname(to));
+			fs.mkdirSync(path.dirname(to), { recursive: true });
 
 			if (opts.replace) {
 				const data = fs.readFileSync(from, 'utf-8');

package/src/utils/hash.js

@@ -20,3 +20,24 @@ export function hash(...values) {
 
 	return (hash >>> 0).toString(36);
 }
+
+/**
+ * Hash of the headers and body a `fetch` was called with. The server-side serializer and the
+ * client-side cache lookup must produce identical values for cached responses to be found.
+ * @param {HeadersInit | undefined} headers
+ * @param {import('types').StrictBody | null | undefined} body
+ */
+export function hash_request(headers, body) {
+	/** @type {import('types').StrictBody[]} */
+	const values = [];
+
+	if (headers) {
+		values.push([...new Headers(headers)].join(','));
+	}
+
+	if (body) {
+		values.push(body);
+	}
+
+	return hash(...values);
+}

package/src/utils/http.js

@@ -11,7 +11,7 @@ export function negotiate(accept, types) {
 	const parts = [];
 
 	accept.split(',').forEach((str, i) => {
-		const match = /([^/ \t]+)\/([^; \t]+)[ \t]*(?:;[ \t]*q=([0-9.]+))?/.exec(str);
+		const match = /^[ \t]*([^/ \t]+)\/([^; \t]+)[ \t]*(?:;[ \t]*q=([0-9.]+))?/.exec(str);
 
 		// no match equals invalid header — ignore
 		if (match) {
@@ -57,12 +57,13 @@ export function negotiate(accept, types) {
 }
 
 /**
- * Returns `true` if the request contains a `content-type` header with the given type
- * @param {Request} request
+ * Returns `true` if a `content-type` header value is one of the given types, ignoring
+ * parameters such as `charset` and comparing case-insensitively
+ * @param {string | null | undefined} header
  * @param  {...string} types
  */
-function is_content_type(request, ...types) {
-	const type = request.headers.get('content-type')?.split(';', 1)[0].trim() ?? '';
+export function matches_content_type(header, ...types) {
+	const type = header?.split(';', 1)[0].trim() ?? '';
 	return types.includes(type.toLowerCase());
 }
 
@@ -72,8 +73,8 @@ function is_content_type(request, ...types) {
 export function is_form_content_type(request) {
 	// These content types must be protected against CSRF
 	// https://developer.mozilla.org/en-US/docs/Web/API/HTMLFormElement/enctype
-	return is_content_type(
-		request,
+	return matches_content_type(
+		request.headers.get('content-type'),
 		'application/x-www-form-urlencoded',
 		'multipart/form-data',
 		'text/plain',

package/src/utils/import.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 
 /**
  * Resolves a peer dependency relative to the current working directory.
@@ -51,7 +52,7 @@ function resolve_peer(dependency, root) {
  */
 export async function import_peer(dependency, root) {
 	try {
-		return await import(/* @vite-ignore */ resolve_peer(dependency, root));
+		return await import(/* @vite-ignore */ pathToFileURL(resolve_peer(dependency, root)).href);
 	} catch {
 		return await import(/* @vite-ignore */ dependency);
 	}

package/src/utils/params.js

@@ -25,7 +25,7 @@ export function collect_matcher_names(routes) {
  */
 export function validate_param_matchers(params, names, file) {
 	for (const name of names) {
-		if (!(name in params)) {
+		if (!Object.hasOwn(params, name)) {
 			throw new Error(`No matcher found for parameter '${name}'${file ? ` in ${file}` : ''}`);
 		}
 	}

package/src/utils/regex.js

@@ -0,0 +1,9 @@
+/**
+ * Escapes characters that have special meaning in a regular expression.
+ * @param {string} str
+ * @returns {string} escaped string
+ */
+export function escape_for_regexp(str) {
+	// TODO replace with `RegExp.escape(str)` when we require Node >= 24
+	return str.replace(/[.*+?^${}()|[\]\\]/g, (match) => '\\' + match);
+}

package/src/utils/routing.js

@@ -1,9 +1,32 @@
 import { BROWSER } from 'esm-env';
+import { escape_for_regexp } from './regex.js';
 
 const param_pattern = /^(\[)?(\.\.\.)?([\w-]+)(?:=([\w-]+))?(\])?$/;
 
 const root_group_pattern = /^\/\((?:[^)]+)\)$/;
 
+const escape_sequence_pattern = /\[([ux])\+([^\]]+)\]/;
+
+/**
+ * Decodes the codepoints of an `[x+nn]` or `[u+nnnn]` escape sequence
+ * @param {string} code the sequence without its `[x+`/`[u+` prefix or `]` suffix
+ */
+export function decode_escape_sequence(code) {
+	return String.fromCodePoint(...code.split('-').map((codepoint) => parseInt(codepoint, 16)));
+}
+
+/**
+ * Encodes the characters that `decode_pathname` leaves untouched, so that a decoded
+ * escape sequence still matches the pattern `parse_route_id` builds for it
+ * @param {string} str
+ */
+export function encode_pathname_chars(str) {
+	return str.replace(
+		/[%/?#]/g,
+		(char) => '%' + char.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0')
+	);
+}
+
 /**
  * Creates the regex pattern, extracts parameter names, and generates types for a route
  * @param {string} id
@@ -51,19 +74,8 @@ export function parse_route_id(id) {
 							const result = parts
 								.map((content, i) => {
 									if (i % 2) {
-										if (content.startsWith('x+')) {
-											return escape(String.fromCharCode(parseInt(content.slice(2), 16)));
-										}
-
-										if (content.startsWith('u+')) {
-											return escape(
-												String.fromCharCode(
-													...content
-														.slice(2)
-														.split('-')
-														.map((code) => parseInt(code, 16))
-												)
-											);
+										if (content.startsWith('x+') || content.startsWith('u+')) {
+											return escape(decode_escape_sequence(content.slice(2)));
 										}
 
 										// We know the match cannot be null in the browser because manifest generation
@@ -243,25 +255,36 @@ export function exec(match, params, matchers) {
 	return result;
 }
 
+/**
+ * `decode_pathname` leaves these characters untouched, so routes have to match their encoded forms
+ * @type {Record<string, string>}
+ */
+const encoded = {
+	'%': '%25',
+	'/': '%2[Ff]',
+	'?': '%3[Ff]',
+	'#': '%23'
+};
+
 /** @param {string} str */
 function escape(str) {
-	return (
-		str
-			.normalize()
-			// escape [ and ] before escaping other characters, since they are used in the replacements
-			.replace(/[[\]]/g, '\\$&')
-			// replace %, /, ? and # with their encoded versions because decode_pathname leaves them untouched
-			.replace(/%/g, '%25')
-			.replace(/\//g, '%2[Ff]')
-			.replace(/\?/g, '%3[Ff]')
-			.replace(/#/g, '%23')
-			// escape characters that have special meaning in regex
-			.replace(/[.*+?^${}()|\\]/g, '\\$&')
-	);
+	// the replacements in `encoded` are regex source themselves, so they must not be escaped again
+	return str
+		.normalize()
+		.split(/([%/?#])/)
+		.map((part, i) => (i % 2 ? encoded[part] : escape_for_regexp(part)))
+		.join('');
 }
 
 const basic_param_pattern = /\[(\[)?(\.\.\.)?([\w-]+?)(?:=([\w-]+))?\]\]?/g;
 
+// escape sequences are expanded in the same pass as the params, so that a param
+// value containing `[x+2f]` is not itself expanded
+export const segment_pattern = new RegExp(
+	`${escape_sequence_pattern.source}|${basic_param_pattern.source}`,
+	'g'
+);
+
 /**
  * Populate a route ID with params to resolve a pathname.
  * @example
@@ -286,7 +309,9 @@ export function resolve_route(id, params) {
 		'/' +
 		segments
 			.map((segment) =>
-				segment.replace(basic_param_pattern, (_, optional, rest, name) => {
+				segment.replace(segment_pattern, (_, escape_type, escape_code, optional, rest, name) => {
+					if (escape_type) return encode_pathname_chars(decode_escape_sequence(escape_code));
+
 					const value = params[name];
 
 					if (value === undefined || value === '') {

package/src/utils/url.js

@@ -46,6 +46,7 @@ export function relative_pathname(from, to) {
 export function matches_external_allowlist_entry(location, allowed) {
 	if (location === allowed) return true;
 
+	// TODO replace the try/catch with `URL.parse` when browser support allows (Chrome 126, Firefox 126, Safari 18)
 	try {
 		const allow = new URL(allowed);
 		const loc = new URL(location, allow);

package/src/version.js

@@ -1,4 +1,4 @@
 // generated during release, do not modify
 
 /** @type {string} */
-export const VERSION = '3.0.0-next.13';
+export const VERSION = '3.0.0-next.16';