@sveltejs/kit 3.0.0-next.2 → 3.0.0-next.21

package/src/runtime/app/server/public.d.ts

@@ -0,0 +1,201 @@
+import { RouteId as AppRouteId, LayoutParams as AppLayoutParams } from '$app/types';
+
+export * from './index.js';
+
+// @ts-ignore this is an optional peer dependency so could be missing. Written like this so dts-buddy preserves the ts-ignore
+type Span = import('@opentelemetry/api').Span;
+
+export interface Cookies {
+	/**
+	 * Gets a cookie that was previously set with `cookies.set`, or from the request headers.
+	 * @param name the name of the cookie
+	 * @param opts the options, passed directly to `cookie.parseCookie`. See documentation [here](https://github.com/jshttp/cookie?tab=readme-ov-file#cookieparsecookiestr-options)
+	 */
+	get: (name: string, opts?: import('cookie').ParseOptions) => string | undefined;
+
+	/**
+	 * Gets all cookies that were previously set with `cookies.set`, or from the request headers.
+	 * @param opts the options, passed directly to `cookie.parseCookie`. See documentation [here](https://github.com/jshttp/cookie?tab=readme-ov-file#cookieparsecookiestr-options)
+	 */
+	getAll: (opts?: import('cookie').ParseOptions) => Array<{ name: string; value: string }>;
+
+	/**
+	 * Sets a cookie. This will add a `set-cookie` header to the response, but also make the cookie available via `cookies.get` or `cookies.getAll` during the current request.
+	 *
+	 * The `httpOnly` is `true` by default, as is `secure`, except during development, when it defaults to `false`. These must be explicitly disabled if you want cookies to be readable by client-side JavaScript and/or transmitted over HTTP.
+	 *
+	 * The `path` option is `'/'` by default. You can use relative paths, or set `path: ''` to make the cookie only available on the current path and its children.
+	 * @param name the name of the cookie
+	 * @param value the cookie value
+	 * @param opts the options passed to `cookie.stringifySetCookie` with the SvelteKit defaults described above. See documentation [here](https://github.com/jshttp/cookie?tab=readme-ov-file#cookiestringifysetcookiesetcookieobj-options)
+	 */
+	set: (name: string, value: string, opts: import('cookie').SerializeOptions) => void;
+
+	/**
+	 * Deletes a cookie by setting its value to an empty string and setting the expiry date in the past.
+	 *
+	 * The `httpOnly` is `true` by default, as is `secure`, except during development, when it defaults to `false`. These must be explicitly disabled if you want cookies to be readable by client-side JavaScript and/or transmitted over HTTP.
+	 *
+	 * The `path` option is `'/'` by default. You can use relative paths, or set `path: ''` to make the cookie only available on the current path and its children.
+	 * @param name the name of the cookie
+	 * @param opts the options passed to `cookie.stringifySetCookie` with the SvelteKit defaults described above. See documentation [here](https://github.com/jshttp/cookie?tab=readme-ov-file#cookiestringifysetcookiesetcookieobj-options)
+	 */
+	delete: (name: string, opts: import('cookie').SerializeOptions) => void;
+
+	/**
+	 * Parses a single `Set-Cookie` header. This allows you to apply cookies received from an external source:
+	 *
+	 * ```js
+	 * import { getRequestEvent } from '$app/server';
+	 *
+	 * export async function GET() {
+	 * 	const { cookies } = getRequestEvent();
+	 *
+	 * 	const response = await fetch('...');
+	 *
+	 * 	for (const str of response.headers.getSetCookie()) {
+	 * 		const { name, value, ...options } = cookies.parse(str);
+	 * 		cookies.set(name, value, { ...options, path: '/' });
+	 * 	}
+	 *
+	 * 	// ...
+	 * }
+	 * ```
+	 *
+	 * Note the use of `headers.getSetCookie()`, which returns an array of cookie headers, _not_ `headers.get('set-cookie')` which returns a single comma-separated string.
+	 */
+	parse: typeof import('cookie').parseSetCookie;
+
+	/**
+	 * Serialize a cookie name-value pair into a `Set-Cookie` header string, but don't apply it to the response.
+	 *
+	 * The `httpOnly` is `true` by default, as is `secure`, except during development, when it defaults to `false`. These must be explicitly disabled if you want cookies to be readable by client-side JavaScript and/or transmitted over HTTP.
+	 *
+	 * The `path` option is `'/'` by default. You can use relative paths, or set `path: ''` to make the cookie only available on the current path and its children.
+	 * @param name the name of the cookie
+	 * @param value the cookie value
+	 * @param opts the options passed to `cookie.stringifySetCookie` with the SvelteKit defaults described above. See documentation [here](https://github.com/jshttp/cookie?tab=readme-ov-file#cookiestringifysetcookiesetcookieobj-options)
+	 */
+	serialize: (name: string, value: string, opts: import('cookie').SerializeOptions) => string;
+}
+
+export interface RequestEvent<
+	Params extends AppLayoutParams<'/'> = AppLayoutParams<'/'>,
+	RouteId extends AppRouteId | null = AppRouteId | null
+> {
+	/**
+	 * Get or set cookies related to the current request
+	 */
+	readonly cookies: Cookies;
+	/**
+	 * `fetch` is equivalent to the [native `fetch` web API](https://developer.mozilla.org/en-US/docs/Web/API/fetch), with a few additional features:
+	 *
+	 * - It can be used to make credentialed requests on the server, as it inherits the `cookie` and `authorization` headers for the page request.
+	 * - It can make relative requests on the server (ordinarily, `fetch` requires a URL with an origin when used in a server context).
+	 * - Internal requests (e.g. for `+server.js` routes) go directly to the handler function when running on the server, without the overhead of an HTTP call.
+	 * - During server-side rendering, the response will be captured and inlined into the rendered HTML by hooking into the `text` and `json` methods of the `Response` object. Note that headers will _not_ be serialized, unless explicitly included via [`filterSerializedResponseHeaders`](https://svelte.dev/docs/kit/hooks#handle)
+	 * - During hydration, the response will be read from the HTML, guaranteeing consistency and preventing an additional network request.
+	 *
+	 * You can learn more about making credentialed requests with cookies [here](https://svelte.dev/docs/kit/load#Cookies).
+	 */
+	readonly fetch: typeof fetch;
+	/**
+	 * The client's IP address, set by the adapter.
+	 */
+	readonly getClientAddress: () => string;
+	/**
+	 * Contains custom data that was added to the request within the [`server handle hook`](https://svelte.dev/docs/kit/hooks#handle).
+	 */
+	readonly locals: App.Locals;
+	/**
+	 * The parameters of the current route - e.g. for a route like `/blog/[slug]`, a `{ slug: string }` object.
+	 *
+	 * Inside `query` functions (including `query.batch` and `query.live`), accessing this property throws an error.
+	 * Pass values from the page as arguments to the query instead. Inside `form` and `command` functions it relates to the page
+	 * the remote function was called from, _not_ the URL of the endpoint SvelteKit creates for the remote function. Never use it
+	 * to determine whether or not a user is authorized to access certain data, as these values are part of the request which could be manipulated.
+	 */
+	readonly params: Params;
+	/**
+	 * Additional data made available through the adapter.
+	 */
+	readonly platform: Readonly<App.Platform> | undefined;
+	/**
+	 * The original request object.
+	 */
+	readonly request: Request;
+	/**
+	 * Info about the current route.
+	 */
+	readonly route: {
+		/**
+		 * The ID of the current route - e.g. for `src/routes/blog/[slug]`, it would be `/blog/[slug]`. It is `null` when no route is matched.
+		 *
+		 * Inside `query` functions (including `query.batch` and `query.live`), accessing this property throws an error.
+		 * Pass values from the page as arguments to the query instead. Inside `form` and `command` functions it relates to the page
+		 * the remote function was called from, _not_ the URL of the endpoint SvelteKit creates for the remote function. Never use it
+		 * to determine whether or not a user is authorized to access certain data, as these values are part of the request which could be manipulated.
+		 */
+		id: RouteId;
+	};
+	/**
+	 * If you need to set headers for the response, you can do so using the this method. This is useful if you want the page to be cached, for example:
+	 *
+	 *	```js
+	 *	/// file: src/routes/blog/+page.js
+	 *	export async function load({ fetch, setHeaders }) {
+	 *		const url = `https://cms.example.com/articles.json`;
+	 *		const response = await fetch(url);
+	 *
+	 *		setHeaders({
+	 *			age: response.headers.get('age'),
+	 *			'cache-control': response.headers.get('cache-control')
+	 *		});
+	 *
+	 *		return response.json();
+	 *	}
+	 *	```
+	 *
+	 * Setting the same header multiple times (even in separate `load` functions) is an error — you can only set a given header once.
+	 *
+	 * You cannot add a `set-cookie` header with `setHeaders` — use the [`cookies`](https://svelte.dev/docs/kit/$app-server#Cookies) API instead.
+	 */
+	readonly setHeaders: (headers: Record<string, string>) => void;
+	/**
+	 * The requested URL.
+	 *
+	 * Inside `query` functions (including `query.batch` and `query.live`), accessing this property throws an error.
+	 * Pass values from the page as arguments to the query instead. Inside `form` and `command` functions it relates to the page
+	 * the remote function was called from, _not_ the URL of the endpoint SvelteKit creates for the remote function. Never use it
+	 * to determine whether or not a user is authorized to access certain data, as these values are part of the request which could be manipulated.
+	 */
+	readonly url: URL;
+	/**
+	 * `true` if the request comes from the client asking for `+page/layout.server.js` data. The `url` property will be stripped of the internal information
+	 * related to the data request in this case. Use this property instead if the distinction is important to you.
+	 */
+	readonly isDataRequest: boolean;
+	/**
+	 * `true` for `+server.js` calls coming from SvelteKit without the overhead of actually making an HTTP request. This happens when you make same-origin `fetch` requests on the server.
+	 */
+	readonly isSubRequest: boolean;
+
+	/**
+	 * Access to spans for tracing. If tracing is not enabled, these spans will do nothing.
+	 * @since 2.31.0
+	 */
+	readonly tracing: {
+		/** Whether tracing is enabled. */
+		enabled: boolean;
+		/** The root span for the request. This span is named `sveltekit.handle.root`. */
+		root: Span;
+		/** The span associated with the current `handle` hook, `load` function, or form action. */
+		current: Span;
+	};
+
+	/**
+	 * `true` if the request comes from the client via a remote function. The `url` property will be stripped of the internal information
+	 * related to the data request in this case. Use this property instead if the distinction is important to you.
+	 */
+	readonly isRemoteRequest: boolean;
+}

package/src/runtime/app/server/remote/command.js

@@ -1,4 +1,4 @@
-/** @import { RemoteCommand } from '@sveltejs/kit' */
+/** @import { RemoteCommand } from '@sveltejs/kit/remote' */
 /** @import { MaybePromise, RemoteCommandInternals } from 'types' */
 /** @import { StandardSchemaV1 } from '@standard-schema/spec' */
 import { get_request_store } from '@sveltejs/kit/internal/server';
@@ -65,21 +65,23 @@ export function command(validate_or_fn, maybe_fn) {
 	const wrapper = (arg) => {
 		const { event, state } = get_request_store();
 
-		if (!MUTATIVE_METHODS.includes(event.request.method)) {
-			throw new Error(
-				`Cannot call a command (\`${__.name}(${maybe_fn ? '...' : ''})\`) from a ${event.request.method} handler`
-			);
+		if (
+			!MUTATIVE_METHODS.includes(event.request.method) ||
+			state.is_in_remote_query ||
+			state.is_in_remote_prerender
+		) {
+			const violation =
+				state.is_in_remote_query || state.is_in_remote_prerender
+					? `inside a query or prerender function`
+					: `from a ${event.request.method} handler`;
+
+			throw new Error(`Cannot call a command (${__.name}) ${violation}`);
 		}
 
 		if (state.is_in_render) {
-			throw new Error(
-				`Cannot call a command (\`${__.name}(${maybe_fn ? '...' : ''})\`) during server-side rendering`
-			);
+			throw new Error(`Cannot call a command (${__.name}) during server-side rendering`);
 		}
 
-		state.remote.refreshes ??= new Map();
-		state.remote.reconnects ??= new Map();
-
 		const promise = Promise.resolve(
 			run_remote_function(event, state, true, () => validate(arg), fn)
 		);

package/src/runtime/app/server/remote/form.js

@@ -1,5 +1,5 @@
-/** @import { RemoteFormInput, RemoteForm, InvalidField } from '@sveltejs/kit' */
-/** @import { InternalRemoteFormIssue, MaybePromise, RemoteFormInternals } from 'types' */
+/** @import { RemoteFormInput, RemoteForm, InvalidField } from '@sveltejs/kit/remote' */
+/** @import { InternalRemoteFormIssue, MaybePromise, HasNonOptionalBoolean, RemoteFormInternals } from 'types' */
 /** @import { StandardSchemaV1 } from '@standard-schema/spec' */
 import { get_request_store } from '@sveltejs/kit/internal/server';
 import {
@@ -7,9 +7,10 @@ import {
 	set_nested_value,
 	deep_set,
 	normalize_issue,
-	flatten_issues
+	flatten_issues,
+	parse_form_key
 } from '../../../form-utils.js';
-import { get_cache, run_remote_function } from './shared.js';
+import { get_cache, get_implicit_lookup, run_remote_function } from './shared.js';
 import { ValidationError } from '@sveltejs/kit/internal';
 
 /**
@@ -44,7 +45,7 @@ import { ValidationError } from '@sveltejs/kit/internal';
  * @template {StandardSchemaV1<RemoteFormInput, Record<string, any>>} Schema
  * @template Output
  * @overload
- * @param {Schema} validate
+ * @param {true extends HasNonOptionalBoolean<StandardSchemaV1.InferInput<Schema>> ? 'Error: All booleans in form schemas must be optional (e.g. `v.optional(v.boolean(), false)`) because checkbox inputs do not send a false value when unchecked.' : Schema} validate
  * @param {(data: StandardSchemaV1.InferOutput<Schema>, issue: InvalidField<StandardSchemaV1.InferInput<Schema>>) => MaybePromise<Output>} fn
  * @returns {RemoteForm<StandardSchemaV1.InferInput<Schema>, Output>}
  * @since 2.27
@@ -71,8 +72,7 @@ export function form(validate_or_fn, maybe_fn) {
 	 * @param {string | number | boolean} [key]
 	 */
 	function create_instance(key) {
-		/** @type {RemoteForm<Input, Output>} */
-		const instance = {};
+		const instance = /** @type {RemoteForm<Input, Output>} */ ({});
 
 		instance.method = 'POST';
 
@@ -88,8 +88,8 @@ export function form(validate_or_fn, maybe_fn) {
 			name: '',
 			id: '',
 			fn: async (data, meta, form_data) => {
-				/** @type {{ submission: true, input?: Record<string, any>, issues?: InternalRemoteFormIssue[], result: Output }} */
-				const output = {};
+				const output =
+					/** @type {{ submission: true, input?: Record<string, any>, issues?: InternalRemoteFormIssue[], result: Output }} */ ({});
 
 				// make it possible to differentiate between user submission and programmatic `field.set(...)` updates
 				output.submission = true;
@@ -102,15 +102,12 @@ export function form(validate_or_fn, maybe_fn) {
 				}
 
 				if (validated?.issues !== undefined) {
-					handle_issues(output, validated.issues, form_data);
+					handle_issues(output, validated.issues, form_data, __.id);
 				} else {
 					if (validated !== undefined) {
 						data = validated.value;
 					}
 
-					state.remote.refreshes ??= new Map();
-					state.remote.reconnects ??= new Map();
-
 					const issue = create_issues();
 
 					try {
@@ -123,7 +120,7 @@ export function form(validate_or_fn, maybe_fn) {
 						);
 					} catch (e) {
 						if (e instanceof ValidationError) {
-							handle_issues(output, e.issues, form_data);
+							handle_issues(output, e.issues, form_data, __.id);
 						} else {
 							throw e;
 						}
@@ -133,7 +130,12 @@ export function form(validate_or_fn, maybe_fn) {
 				// We don't need to care about args or deduplicating calls, because uneval results are only relevant in full page reloads
 				// where only one form submission is active at the same time
 				if (!event.isRemoteRequest) {
-					get_cache(__, state)[''] ??= { serialize: true, data: output };
+					const cache = get_cache(__, state);
+					cache[''] ??= output;
+
+					// register under the client-side action id so the output is serialized
+					// into the page, allowing the hydrated client to restore `result`/`issues`/`input`
+					get_implicit_lookup(__, state)[__.key ? `${__.id}/${__.key}` : __.id] = () => cache[''];
 				}
 
 				return output;
@@ -143,42 +145,55 @@ export function form(validate_or_fn, maybe_fn) {
 		Object.defineProperty(instance, '__', { value: __ });
 
 		Object.defineProperty(instance, 'action', {
-			get: () => `?/remote=${__.id}`,
+			get: () => {
+				const search = new URLSearchParams(get_request_store().event.url.search);
+				search.delete('/remote');
+
+				const query = search.toString();
+				const action_id = __.key ? `${__.id}/${encodeURIComponent(__.key)}` : __.id;
+
+				return `?${query ? `${query}&` : ''}/remote=${action_id}`;
+			},
 			enumerable: true
 		});
 
 		Object.defineProperty(instance, 'fields', {
 			get() {
-				return create_field_proxy(
-					{},
-					() => get_cache(__)?.['']?.data?.input ?? {},
-					(path, value) => {
-						const cache = get_cache(__);
+				// the form instance is created once per module and shared across requests,
+				// so the current request's state has to be resolved at access time
+				return create_field_proxy({
+					form_id: __.id,
+					get: () => get_cache(__, get_request_store().state)?.['']?.input ?? {},
+					set: (path, value) => {
+						const cache = get_cache(__, get_request_store().state);
 						const entry = cache[''];
 
-						if (entry?.data?.submission) {
+						if (entry?.submission) {
 							// don't override a submission
 							return;
 						}
 
 						if (path.length === 0) {
-							(cache[''] ??= { serialize: true, data: {} }).data.input = value;
+							(cache[''] ??= {}).input = value;
 							return;
 						}
 
-						const input = entry?.data?.input ?? {};
+						const input = entry?.input ?? {};
 						deep_set(input, path.map(String), value);
-						(cache[''] ??= { serialize: true, data: {} }).data.input = input;
+						(cache[''] ??= {}).input = input;
 					},
-					() => flatten_issues(get_cache(__)?.['']?.data?.issues ?? [])
-				);
+					get_issues: () =>
+						flatten_issues(get_cache(__, get_request_store().state)?.['']?.issues ?? []),
+					get_touched: () => ({}),
+					get_dirty: () => ({})
+				});
 			}
 		});
 
 		Object.defineProperty(instance, 'result', {
 			get() {
 				try {
-					return get_cache(__)?.['']?.data?.result;
+					return get_cache(__, get_request_store().state)?.['']?.result;
 				} catch {
 					return undefined;
 				}
@@ -190,6 +205,10 @@ export function form(validate_or_fn, maybe_fn) {
 			get: () => 0
 		});
 
+		Object.defineProperty(instance, 'submitted', {
+			get: () => false
+		});
+
 		Object.defineProperty(instance, 'preflight', {
 			// preflight is a noop on the server
 			value: () => instance
@@ -217,11 +236,15 @@ export function form(validate_or_fn, maybe_fn) {
 				value: (key) => {
 					const { state } = get_request_store();
 					const cache_key = __.id + '|' + JSON.stringify(key);
+					/** @type {RemoteForm<Input, Output> & { __: RemoteFormInternals }} */
 					let instance = (state.remote.forms ??= new Map()).get(cache_key);
 
 					if (!instance) {
-						instance = create_instance(key);
-						instance.__.id = `${__.id}/${encodeURIComponent(JSON.stringify(key))}`;
+						instance = /** @type {RemoteForm<Input, Output> & { __: RemoteFormInternals }} */ (
+							create_instance(key)
+						);
+						instance.__.id = __.id;
+						instance.__.key = JSON.stringify(key);
 						instance.__.name = __.name;
 
 						state.remote.forms.set(cache_key, instance);
@@ -242,8 +265,9 @@ export function form(validate_or_fn, maybe_fn) {
  * @param {{ issues?: InternalRemoteFormIssue[], input?: Record<string, any>, result: any }} output
  * @param {readonly StandardSchemaV1.Issue[]} issues
  * @param {FormData | null} form_data - null if the form is progressively enhanced
+ * @param {string} form_id - hash/name of the form
  */
-function handle_issues(output, issues, form_data) {
+function handle_issues(output, issues, form_data, form_id) {
 	output.issues = issues.map((issue) => normalize_issue(issue, true));
 
 	// if it was a progressively-enhanced submission, we don't need
@@ -251,19 +275,17 @@ function handle_issues(output, issues, form_data) {
 	if (form_data) {
 		output.input = {};
 
-		for (let key of form_data.keys()) {
+		for (const field_name of form_data.keys()) {
 			// redact sensitive fields
-			if (/^[.\]]?_/.test(key)) continue;
-
-			const is_array = key.endsWith('[]');
-			const values = form_data.getAll(key).filter((value) => typeof value === 'string');
+			if (/^[.\]]?_/.test(field_name)) continue;
 
-			if (is_array) key = key.slice(0, -2);
+			const values = form_data.getAll(field_name).filter((value) => typeof value === 'string');
+			const field = parse_form_key(form_id, field_name);
 
 			set_nested_value(
 				/** @type {Record<string, any>} */ (output.input),
-				key,
-				is_array ? values : values[0]
+				field,
+				field.is_array ? values : values[0]
 			);
 		}
 	}

package/src/runtime/app/server/remote/prerender.js

@@ -1,19 +1,14 @@
-/** @import { RemoteResource, RemotePrerenderFunction } from '@sveltejs/kit' */
-/** @import { RemotePrerenderInputsGenerator, RemotePrerenderInternals, MaybePromise } from 'types' */
+/** @import { RemoteResource, RemotePrerenderFunction } from '@sveltejs/kit/remote' */
+/** @import { RemoteFunctionResponse, RemotePrerenderInputsGenerator, RemotePrerenderInternals, MaybePromise } from 'types' */
 /** @import { StandardSchemaV1 } from '@standard-schema/spec' */
-import { error, json } from '@sveltejs/kit';
-import { DEV } from 'esm-env';
+import { json } from '@sveltejs/kit';
+import { HandledHttpError } from '@sveltejs/kit/internal';
 import { get_request_store } from '@sveltejs/kit/internal/server';
-import { stringify, stringify_remote_arg } from '../../../shared.js';
+import { stringify_remote_arg } from '../../../shared.js';
+import { parse, stringify } from '#app/internal/transport';
 import { noop } from '../../../../utils/functions.js';
-import { app_dir, base } from '$app/paths/internal/server';
-import {
-	create_validator,
-	get_cache,
-	get_response,
-	parse_remote_response,
-	run_remote_function
-} from './shared.js';
+import { app_dir, base } from '#app/paths';
+import { create_validator, get_response, run_remote_function } from './shared.js';
 
 /**
  * Creates a remote prerender function. When called from the browser, the function will be invoked on the server via a `fetch` call.
@@ -89,50 +84,55 @@ export function prerender(validate_or_fn, fn_or_options, maybe_options) {
 
 	/** @type {RemotePrerenderFunction<Input, Output> & { __: RemotePrerenderInternals }} */
 	const wrapper = (arg) => {
+		const { event, state } = get_request_store();
+		const payload = stringify_remote_arg(arg);
+
+		// `get_response` (as opposed to bare `get_cache`) also registers the call in the
+		// implicit lookup, so that the result is inlined into the page payload (`data.p`)
+		// and the client doesn't need to fetch it again upon hydration
 		/** @type {Promise<Output> & Partial<RemoteResource<Output>>} */
-		const promise = (async () => {
-			const { event, state } = get_request_store();
-			const payload = stringify_remote_arg(arg, state.transport);
+		const promise = get_response(__, payload, state, async () => {
 			const id = __.id;
 			const url = `${base}/${app_dir}/remote/${id}${payload ? `/${payload}` : ''}`;
 
-			if (!state.prerendering && !DEV && !event.isRemoteRequest) {
+			if (!state.prerendering && !__SVELTEKIT_DEV__ && !event.isRemoteRequest) {
+				/** @type {RemoteFunctionResponse | undefined} */
+				let prerendered;
+
 				try {
-					return await get_response(__, payload, state, async () => {
-						const cache = get_cache(__, state);
-
-						// TODO adapters can provide prerendered data more efficiently than
-						// fetching from the public internet
-						const promise = (cache[payload] ??= {
-							serialize: true,
-							data: fetch(new URL(url, event.url.origin).href).then(async (response) => {
-								if (!response.ok) {
-									throw new Error('Prerendered response not found');
-								}
-
-								const prerendered = await response.json();
-
-								if (prerendered.type === 'error') {
-									error(prerendered.status, prerendered.error);
-								}
-
-								return prerendered.result;
-							})
-						}).data;
-
-						return parse_remote_response(await promise, state.transport);
-					});
+					// TODO adapters can provide prerendered data more efficiently than
+					// fetching from the public internet
+					// `request.url` rather than `event.url`, which throws inside queries
+					const response = await fetch(new URL(url, event.request.url).href);
+
+					if (response.ok) {
+						prerendered = /** @type {RemoteFunctionResponse} */ (await response.json());
+					}
 				} catch {
 					// not available prerendered, fallback to normal function
 				}
+
+				if (prerendered) {
+					if (prerendered.type === 'error') {
+						throw new HandledHttpError(prerendered.error);
+					}
+
+					return parse(prerendered.data)._;
+				}
 			}
 
+			// during a prerender run, the same function might be invoked while rendering
+			// multiple pages — share the result across the entire run
 			if (state.prerendering?.remote_responses.has(url)) {
 				return /** @type {Promise<any>} */ (state.prerendering.remote_responses.get(url));
 			}
 
-			const promise = get_response(__, payload, state, () =>
-				run_remote_function(event, state, false, () => validate(arg), fn)
+			const promise = run_remote_function(
+				event,
+				{ ...state, is_in_remote_prerender: true },
+				false,
+				() => validate(arg),
+				fn
 			);
 
 			if (state.prerendering) {
@@ -142,7 +142,7 @@ export function prerender(validate_or_fn, fn_or_options, maybe_options) {
 			const result = await promise;
 
 			if (state.prerendering) {
-				const body = { type: 'result', result: stringify(result, state.transport) };
+				const body = { type: 'result', data: stringify({ _: result }) };
 				state.prerendering.dependencies.set(url, {
 					body: JSON.stringify(body),
 					response: json(body)
@@ -151,7 +151,7 @@ export function prerender(validate_or_fn, fn_or_options, maybe_options) {
 
 			// TODO this is missing error/loading/current/status
 			return result;
-		})();
+		});
 
 		promise.catch(noop);