@sveltejs/kit 3.0.0-next.24 → 3.0.0-next.25

package/src/exports/vite/index.js

@@ -9,15 +9,7 @@ import path from 'node:path';
 import process from 'node:process';
 import { styleText } from 'node:util';
 
-import {
-	and,
-	code,
-	exactRegex,
-	importerId,
-	include,
-	not,
-	prefixRegex
-} from '@rolldown/pluginutils';
+import { code, include, prefixRegex } from '@rolldown/pluginutils';
 import MagicString from 'magic-string';
 
 import { copy, read, resolve_entry } from '../../utils/filesystem.js';
@@ -26,20 +18,19 @@ import { to_fs } from '../../utils/vite.js';
 import { create_exported_declarations } from '../../core/env.js';
 import * as sync from '../../core/sync/sync.js';
 import { load_and_validate_params } from '../../utils/params.js';
-import { runtime_directory, logger } from '../../core/utils.js';
+import { runtime_directory, logger, get_global_name } from '../../core/utils.js';
 import { generate_manifest } from '../../core/generate_manifest/index.js';
 import { build_server_nodes } from './build/build_server.js';
 import { find_deps, resolve_symlinks } from './build/utils.js';
 import { dev } from './dev/index.js';
 import { preview } from './preview/index.js';
 import {
+	enforced_config,
 	error_for_missing_config,
 	get_config_aliases,
 	is_remote_module,
-	normalize_id,
 	remote_module_pattern,
-	server_only_directory_pattern,
-	server_only_module_pattern
+	warn_overridden_config
 } from './utils.js';
 import { stackless } from '../../utils/error.js';
 import { adapt } from '../../core/adapt/index.js';
@@ -51,51 +42,16 @@ import { hash } from '../../utils/hash.js';
 import { dedent } from '../../core/sync/utils.js';
 import create_manifest_data from '../../core/sync/create_manifest_data/index.js';
 import { get_import_aliases, get_hash_import_keys } from '../../utils/imports.js';
-import { app_env_private, app_server } from './module_ids.js';
 import { import_peer } from '../../utils/import.js';
 import { compact } from '../../utils/array.js';
 import { should_ignore, has_children } from './static_analysis/utils.js';
 import { process_config, split_config, validate_config } from '../../core/config/index.js';
 import { treeshake_prerendered_remotes } from './build/remote.js';
 import { get_runner } from '../../runner.js';
-import { plugin_env_vars } from './plugins/env-vars.js';
+import { plugin_env_vars, plugin_service_worker_env_vars } from './plugins/env-vars.js';
+import { plugin_guard } from './plugins/guard.js';
 import { get_manifest_routes, write_app_manifest } from '../../core/sync/write_app_manifest.js';
-
-/** @type {import('./types.js').EnforcedConfig} */
-const enforced_config = {
-	appType: true,
-	base: true,
-	build: {
-		cssCodeSplit: true,
-		emptyOutDir: true,
-		lib: {
-			entry: true,
-			name: true,
-			formats: true
-		},
-		manifest: true,
-		outDir: true,
-		rolldownOptions: {
-			input: true,
-			output: {
-				format: true,
-				entryFileNames: true,
-				chunkFileNames: true,
-				assetFileNames: true
-			},
-			preserveEntrySignatures: true
-		},
-		ssr: true
-	},
-	publicDir: true,
-	resolve: {
-		alias: {
-			$app: true,
-			$env: true,
-			'<sveltekit:generated>': true
-		}
-	}
-};
+import { plugin_service_worker_build } from './build/service-worker.js';
 
 const options_regex = /(export\s+const\s+(prerender|csr|ssr|trailingSlash))\s*=/s;
 
@@ -276,9 +232,6 @@ function kit({ svelte_config }) {
 	/** @type {string} The base directory for the Vite builds */
 	let out;
 
-	/** @type {string} */
-	let version_hash;
-
 	/** @type {ResolvedConfig} */
 	let vite_config;
 
@@ -299,16 +252,8 @@ function kit({ svelte_config }) {
 
 	/** @type {string | null} */
 	let service_worker_entry_file;
-	/** @type {string} */
-	let normalized_cwd;
 	/** @type {Array<{ alias: string, path: string }>} */
 	let normalized_aliases;
-	/** @type {string} */
-	let normalized_node_modules;
-	/** @type {string} */
-	let normalized_routes;
-	/** @type {string} */
-	let normalized_assets;
 	/**
 	 * A map showing which features (such as `$app/server:read`) are defined
 	 * in which chunks, so that we can later determine which routes use which features
@@ -319,6 +264,9 @@ function kit({ svelte_config }) {
 	const sourcemapIgnoreList = /** @param {string} relative_path */ (relative_path) =>
 		relative_path.includes('node_modules') || relative_path.includes(kit.outDir);
 
+	/** @type {string} the `__sveltekit_xxx` name, without `globalThis.` */
+	let global_name;
+
 	/** @type {string} name for `globalThis.__sveltekit_xxx` */
 	let kit_global;
 
@@ -384,21 +332,17 @@ function kit({ svelte_config }) {
 				out_dir = posixify(kit.outDir);
 				out = `${out_dir}/output`;
 
-				version_hash = hash(kit.version.name);
+				global_name = get_global_name(kit.version.name, !is_build);
+				kit_global = `globalThis.${global_name}`;
 
-				kit_global = is_build
-					? `globalThis.__sveltekit_${version_hash}`
-					: 'globalThis.__sveltekit_dev';
+				service_worker_entry_file = resolve_entry(kit.files.serviceWorker);
+				service_worker_entry_file &&= posixify(service_worker_entry_file);
 
 				vite = await import_peer('vite', root);
 
 				env = vite.loadEnv(config_env.mode, kit.env.dir, '');
 
-				normalized_cwd = vite.normalizePath(root);
 				normalized_aliases = get_import_aliases(root, vite.normalizePath.bind(vite));
-				normalized_node_modules = vite.normalizePath(path.resolve(root, 'node_modules'));
-				normalized_routes = vite.normalizePath(path.resolve(root, kit.files.routes));
-				normalized_assets = vite.normalizePath(path.resolve(root, kit.files.assets));
 
 				// Add `#`-prefixed import keys to the enforced config so users are warned
 				// if they try to set them in their Vite config's resolve.alias
@@ -546,7 +490,12 @@ function kit({ svelte_config }) {
 					__SVELTEKIT_SUPPORTS_ASYNC__: s(
 						svelte_config.compilerOptions?.experimental?.async ?? false
 					),
-					__SVELTEKIT_DEV__: s(!is_build)
+					__SVELTEKIT_DEV__: s(!is_build),
+					__SVELTEKIT_GLOBAL_NAME__: s(global_name),
+					__SVELTEKIT_CSRF_CHECK_ORIGIN__: s(!kit.csrf.trustedOrigins.includes('*')),
+					__SVELTEKIT_LINK_HEADER_PRELOAD__: s(kit.output.linkHeaderPreload),
+					__SVELTEKIT_PATHS_ORIGIN__: s(kit.paths.origin) ?? 'undefined',
+					__SVELTEKIT_SERVICE_WORKER__: s(kit.serviceWorker.register && !!service_worker_entry_file)
 				};
 
 				if (is_build) {
@@ -641,164 +590,6 @@ function kit({ svelte_config }) {
 	/** @type {Record<string, EnvVarConfig<any>> | null} */
 	let explicit_env_config = null;
 
-	/** @type {Map<string, Set<string>>} */
-	const import_map = new Map();
-
-	/**
-	 * Ensures that client-side code can't accidentally import server-side code,
-	 * whether in `*.server.js` files, `$app/server`, any `/server/` directory, or `$app/env/private`
-	 * @type {Plugin}
-	 */
-	const plugin_guard = {
-		name: 'vite-plugin-sveltekit-guard',
-
-		// Run this plugin before built-in resolution, so that relative imports
-		// are added to the module graph
-		enforce: 'pre',
-
-		applyToEnvironment(environment) {
-			// the import map is only read for client-side violations in `load`, so skip other environments
-			return environment.config.consumer === 'client';
-		},
-
-		resolveId: {
-			// composable filters are not accepted type-wise but still work during build
-			// see https://github.com/vitejs/rolldown-vite/issues/605
-			filter: /** @type {any} */ (
-				/** @satisfies {TopLevelFilterExpression[]} */ ([
-					include(and(importerId(/.+/), not(importerId(/index\.html$/))))
-				])
-			),
-			async handler(id, importer, options) {
-				// composable filters only work during build so we still need this guard for dev
-				// see https://github.com/vitejs/rolldown-vite/issues/605
-				if (importer && !importer.endsWith('index.html')) {
-					const resolved = await this.resolve(id, importer, { ...options, skipSelf: true });
-
-					if (resolved) {
-						const normalized = normalize_id(resolved.id, normalized_aliases, normalized_cwd);
-
-						let importers = import_map.get(normalized);
-
-						if (!importers) {
-							importers = new Set();
-							import_map.set(normalized, importers);
-						}
-
-						importers.add(normalize_id(importer, normalized_aliases, normalized_cwd));
-					}
-				}
-			}
-		},
-
-		load: {
-			filter: {
-				id: [
-					exactRegex(app_server),
-					exactRegex(app_env_private),
-					server_only_module_pattern,
-					server_only_directory_pattern
-				]
-			},
-			handler(id) {
-				const normalized = normalize_id(id, normalized_aliases, normalized_cwd);
-
-				let is_server_only = normalized === '$app/env/private' || normalized === '$app/server';
-
-				// skip .server.js files outside the cwd or in node_modules, as the filename might not mean 'server-only module' in this context
-				if (id.startsWith(normalized_cwd) && !id.startsWith(normalized_node_modules)) {
-					// e.g. `server.ts` or `foo.server.ts`
-					is_server_only ||= server_only_module_pattern.test(id);
-
-					// e.g. `server/foo.ts`, unless in `src/routes` or `static`
-					is_server_only ||=
-						server_only_directory_pattern.test(id) &&
-						!id.startsWith(normalized_routes + '/') &&
-						!id.startsWith(normalized_assets + '/');
-				}
-
-				if (!is_server_only) return;
-
-				// in dev, this doesn't exist, so we need to create it
-				manifest_data ??= create_manifest_data(svelte_config, root);
-
-				/** @type {Set<string>} */
-				const entrypoints = new Set();
-				for (const node of manifest_data.nodes) {
-					if (node.component) entrypoints.add(node.component);
-					if (node.universal) entrypoints.add(node.universal);
-				}
-
-				if (manifest_data.hooks.client) entrypoints.add(manifest_data.hooks.client);
-				if (manifest_data.hooks.universal) entrypoints.add(manifest_data.hooks.universal);
-
-				if (service_worker_entry_file) {
-					entrypoints.add(posixify(path.relative(root, service_worker_entry_file)));
-				}
-
-				// Walk up the import graph from the server-only module, looking for a chain
-				// that leads back to a client entrypoint. We search all candidates (not just
-				// the first) because a module can be imported by both server and client code,
-				// and a greedy first-match could follow a server-only branch that never
-				// reaches an entrypoint — see https://github.com/sveltejs/kit/issues/16232
-				/** @type {Set<string>} */
-				const visited = new Set([normalized]);
-
-				/**
-				 * @param {string} current
-				 * @param {string[]} chain
-				 * @returns {string[] | null}
-				 */
-				function find_chain(current, chain) {
-					const importers = import_map.get(current);
-					if (!importers) return null;
-
-					for (const importer of importers) {
-						if (visited.has(importer)) continue;
-						visited.add(importer);
-
-						const next_chain = [...chain, importer];
-						if (entrypoints.has(importer)) {
-							return next_chain;
-						}
-						const result = find_chain(importer, next_chain);
-						if (result) return result;
-					}
-					return null;
-				}
-
-				const chain = find_chain(normalized, [normalized]);
-
-				if (chain) {
-					if (chain.some((id) => remote_module_pattern.test(id))) {
-						error_for_missing_config('remote functions', 'experimental.remoteFunctions', 'true');
-					}
-
-					const pyramid = chain
-						.reverse()
-						.map((id, i) => {
-							return `${' '.repeat(i + 1)}${id}`;
-						})
-						.join(' imports\n');
-
-					let message = `Cannot import ${normalized} into code that runs in the browser, as this could leak sensitive information.`;
-					message += `\n\n${pyramid}`;
-					message += `\n\nIf you're only using the import as a type, change it to \`import type\`.`;
-
-					throw stackless(message);
-				}
-
-				// No chain from this server-only module to a client entrypoint was found —
-				// the module is only imported from server code, which is valid.
-			}
-		},
-
-		// avoid watch mode rebuilds using stale import map data
-		buildEnd() {
-			import_map.clear();
-		}
-	};
-
 	/** @type {ViteDevServer} */
 	let dev_server;
 
@@ -1003,127 +794,6 @@ function kit({ svelte_config }) {
 	/** @type {Array<{ path: string }> | null} */
 	let immutable = null;
 
-	/**
-	 * Creates the service worker virtual modules
-	 * @type {Plugin}
-	 */
-	const plugin_service_worker = {
-		name: 'vite-plugin-sveltekit-service-worker',
-
-		config(config) {
-			service_worker_entry_file = resolve_entry(kit.files.serviceWorker);
-
-			if (!service_worker_entry_file) return;
-
-			service_worker_entry_file = posixify(service_worker_entry_file);
-
-			if (kit.paths.assets) {
-				throw new Error('Cannot use service worker alongside config.paths.assets');
-			}
-
-			const user_service_worker_output_config =
-				config.environments?.serviceWorker?.build?.rolldownOptions?.output;
-
-			/** @type {import('vite').UserConfig} */
-			const new_config = {
-				environments: {
-					serviceWorker: {
-						define: {
-							__SVELTEKIT_PAYLOAD__: kit_global
-						},
-						build: {
-							modulePreload: false,
-							rolldownOptions: {
-								external: [`${kit.paths.base}/${kit.appDir}/env.js`],
-								input: {
-									'service-worker': service_worker_entry_file
-								},
-								output: {
-									format: 'es',
-									entryFileNames: 'service-worker.js',
-									assetFileNames: `${kit.appDir}/immutable/assets/[name].[hash][extname]`,
-									codeSplitting:
-										(Array.isArray(user_service_worker_output_config)
-											? user_service_worker_output_config[0].codeSplitting
-											: user_service_worker_output_config?.codeSplitting) ?? false
-								}
-							},
-							outDir: `${out}/client`,
-							minify: initial_config.build?.minify,
-							// avoid overwriting the client build Vite manifest
-							manifest: '.vite/service-worker-manifest.json'
-						},
-						consumer: 'client'
-					}
-				}
-			};
-
-			warn_overridden_config(config, new_config);
-
-			return new_config;
-		},
-
-		// our serviceWorker environment only exists when building because Vite only
-		// supports the default client environment during development (for now)
-		applyToEnvironment(environment) {
-			return environment.name === 'serviceWorker';
-		},
-
-		generateBundle(_, bundle) {
-			const invalid_modules = new Set();
-			const modules = new Map([
-				[`${runtime_directory}/app/forms/index.js`, '$app/forms'],
-				[`${runtime_directory}/app/navigation/index.js`, '$app/navigation'],
-				[`${runtime_directory}/app/state/index.js`, '$app/state']
-			]);
-
-			for (const output of Object.values(bundle)) {
-				if (output.type !== 'chunk') continue;
-
-				for (const id of output.moduleIds) {
-					const module = modules.get(id);
-					if (module) invalid_modules.add(module);
-				}
-			}
-
-			if (invalid_modules.size > 0) {
-				throw new Error(
-					`Cannot import ${Array.from(modules.values())
-						.filter((module) => invalid_modules.has(module))
-						.join(', ')} into service-worker code.`
-				);
-			}
-		}
-	};
-
-	/** @type {Plugin} */
-	const plugin_service_worker_env = {
-		name: 'vite-plugin-sveltekit-service-worker-env',
-		configResolved() {
-			if (service_worker_entry_file) {
-				// @ts-expect-error transform is defined in this object
-				plugin_service_worker_env.transform.filter = {
-					id: exactRegex(service_worker_entry_file)
-				};
-			}
-		},
-		applyToEnvironment(environment) {
-			return !!service_worker_entry_file && environment.config.consumer === 'client';
-		},
-		transform: {
-			handler(code) {
-				// prepend the service worker with an import that configures
-				// `env`, in case `$app/env/public` is imported. In production
-				// this is required: dynamic public env vars aren't known at
-				// build time, so `env.js` is loaded at runtime. In dev, the
-				// imported module just inlines the current values instead.
-				return {
-					code: `import '<sveltekit:generated>/env/service-worker.js';\n${code}`
-				};
-			}
-		}
-	};
-
 	/** @type {Map<string, Rolldown.RolldownOutput['output']>} */
 	const watch_build_output = new Map();
 	/** @type {(() => Promise<void>) | null} */
@@ -1252,7 +922,7 @@ function kit({ svelte_config }) {
 							manifest: true,
 							rolldownOptions: {
 								output: {
-									name: `__sveltekit_${version_hash}.app`,
+									name: `${global_name}.app`,
 									assetFileNames: `${app_immutable}/assets/[name].[hash][extname]`,
 									hoistTransitiveImports: false,
 									sourcemapIgnoreList
@@ -2041,9 +1711,26 @@ function kit({ svelte_config }) {
 			plugin_env_vars(svelte_config, (vars) => {
 				explicit_env_config = vars;
 			}),
-			process.env.TEST !== 'true' ? plugin_guard : undefined,
-			plugin_service_worker,
-			plugin_service_worker_env,
+			process.env.TEST !== 'true'
+				? plugin_guard(
+						svelte_config,
+						() => ({
+							vite,
+							root,
+							normalized_aliases,
+							service_worker_entry_file
+						}),
+						// in dev, this doesn't exist yet, so we need to create it
+						() => (manifest_data ??= create_manifest_data(svelte_config, root))
+					)
+				: undefined,
+			plugin_service_worker_build(svelte_config, () => ({
+				service_worker_entry_file,
+				kit_global,
+				initial_config,
+				out
+			})),
+			plugin_service_worker_env_vars(() => service_worker_entry_file),
 			plugin_compile,
 			plugin_adapter,
 			svelte_config.adapter?.vite?.plugins?.post
@@ -2051,52 +1738,6 @@ function kit({ svelte_config }) {
 	);
 }
 
-/**
- * @param {UserConfig} config
- * @param {UserConfig} resolved_config
- */
-function warn_overridden_config(config, resolved_config) {
-	const overridden = find_overridden_config(config, resolved_config, enforced_config, '', []);
-
-	if (overridden.length > 0) {
-		console.error(
-			styleText(
-				['bold', 'red'],
-				'The following Vite config options will be overridden by SvelteKit:'
-			) + overridden.map((key) => `\n  - ${key}`).join('')
-		);
-	}
-}
-
-/**
- * @param {Record<string, any>} config
- * @param {Record<string, any>} resolved_config
- * @param {import('./types.js').EnforcedConfig} enforced_config
- * @param {string} path
- * @param {string[]} out used locally to compute the return value
- */
-function find_overridden_config(config, resolved_config, enforced_config, path, out) {
-	if (config == null || resolved_config == null) {
-		return out;
-	}
-
-	for (const key in enforced_config) {
-		if (typeof config === 'object' && key in config && key in resolved_config) {
-			const enforced = enforced_config[key];
-			const resolved = resolved_config[key];
-
-			if (enforced === true) {
-				if (comparable(config[key]) !== comparable(resolved)) {
-					out.push(path + key);
-				}
-			} else {
-				find_overridden_config(config[key], resolved, enforced, path + key + '.', out);
-			}
-		}
-	}
-	return out;
-}
-
 /**
  * Collects the content-hashed files of a Vite manifest, in the shape of
  * `$app/manifest`'s `immutable` export.
@@ -2127,17 +1768,6 @@ const collect_immutable = (manifest, app_dir, inlined) => {
 	return Array.from(files, (path) => ({ path }));
 };
 
-/**
- * Normalizes a config value for comparison, since Windows paths may use backslashes
- * and differ in casing (e.g. the drive letter) depending on where they came from.
- * @param {any} value
- */
-function comparable(value) {
-	if (typeof value !== 'string') return value;
-	const normalized = posixify(value);
-	return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
-}
-
 /**
  * Replaces manifest data placeholder identifiers in output chunks with real
  * values, or strings that are valid JS (so thecode doesn't crash during prerendering)

package/src/exports/vite/plugins/env-vars.js

@@ -2,6 +2,7 @@
 /** @import { EnvVarConfig } from '@sveltejs/kit/env' */
 /** @import { ValidatedConfig } from 'types' */
 import path from 'node:path';
+import { exactRegex } from '@rolldown/pluginutils';
 import * as sync from '../../../core/sync/sync.js';
 import { create_env_modules, resolve_env_entry } from '../../../core/env.js';
 import { import_peer } from '../../../utils/import.js';
@@ -115,3 +116,44 @@ export function plugin_env_vars(config, callback) {
 		}
 	};
 }
+
+/**
+ * @param {() => string | null} get_service_worker_entry_file
+ * @returns {Plugin}
+ */
+export function plugin_service_worker_env_vars(get_service_worker_entry_file) {
+	/** @type {string | null} */
+	let service_worker_entry_file;
+
+	/** @satisfies {Plugin} */
+	const plugin = {
+		name: 'vite-plugin-sveltekit-service-worker-env',
+		configResolved() {
+			service_worker_entry_file = get_service_worker_entry_file();
+
+			if (service_worker_entry_file) {
+				plugin.transform.filter = {
+					id: exactRegex(service_worker_entry_file)
+				};
+			}
+		},
+		applyToEnvironment(environment) {
+			return !!service_worker_entry_file && environment.config.consumer === 'client';
+		},
+		transform: {
+			filter: {},
+			handler(code) {
+				// prepend the service worker with an import that configures
+				// `env`, in case `$app/env/public` is imported. In production
+				// this is required: dynamic public env vars aren't known at
+				// build time, so `env.js` is loaded at runtime. In dev, the
+				// imported module just inlines the current values instead.
+				return {
+					code: `import '<sveltekit:generated>/env/service-worker.js';\n${code}`
+				};
+			}
+		}
+	};
+
+	return plugin;
+}