@sveltejs/kit 3.0.0-next.24 → 3.0.0-next.25

package/src/exports/vite/plugins/guard.js

@@ -0,0 +1,205 @@
+/** @import { TopLevelFilterExpression } from '@rolldown/pluginutils' */
+/** @import { ManifestData, ValidatedConfig } from 'types' */
+/** @import { Plugin } from 'vite' */
+import path from 'node:path';
+import { and, exactRegex, importerId, include, not } from '@rolldown/pluginutils';
+import { app_env_private, app_server } from '../module_ids.js';
+import {
+	error_for_missing_config,
+	normalize_id,
+	remote_module_pattern,
+	server_only_directory_pattern,
+	server_only_module_pattern
+} from '../utils.js';
+import { stackless } from '../../../utils/error.js';
+import { posixify } from '../../../utils/os.js';
+
+/**
+ * Ensures that client-side code can't accidentally import server-side code,
+ * whether in `*.server.js` files, `$app/server`, any `/server/` directory, or `$app/env/private`
+ * @param {ValidatedConfig} kit
+ * @param {() => { vite: typeof import('vite'); root: string; normalized_aliases: Array<{ alias: string, path: string }>; service_worker_entry_file: string | null; }} get_config
+ * @param {() => ManifestData} get_manifest_data
+ * @returns {Plugin}
+ */
+export function plugin_guard(kit, get_config, get_manifest_data) {
+	/** @type {string} */
+	let root;
+
+	/** @type {string} */
+	let normalized_cwd;
+	/** @type {Array<{ alias: string, path: string }>} */
+	let normalized_aliases;
+	/** @type {string} */
+	let normalized_node_modules;
+	/** @type {string} */
+	let normalized_routes;
+	/** @type {string} */
+	let normalized_assets;
+
+	/** @type {string | null} */
+	let service_worker_entry_file;
+
+	/** @type {Map<string, Set<string>>} */
+	const import_map = new Map();
+
+	return {
+		name: 'vite-plugin-sveltekit-guard',
+
+		// Run this plugin before built-in resolution, so that relative imports
+		// are added to the module graph
+		enforce: 'pre',
+
+		configResolved() {
+			/** @type {typeof import('vite')} */
+			let vite;
+			({ vite, root, normalized_aliases, service_worker_entry_file } = get_config());
+
+			normalized_cwd = vite.normalizePath(root);
+			normalized_node_modules = vite.normalizePath(path.resolve(root, 'node_modules'));
+			normalized_routes = vite.normalizePath(path.resolve(root, kit.files.routes));
+			normalized_assets = vite.normalizePath(path.resolve(root, kit.files.assets));
+		},
+
+		applyToEnvironment(environment) {
+			// the import map is only read for client-side violations in `load`, so skip other environments
+			return environment.config.consumer === 'client';
+		},
+
+		resolveId: {
+			// composable filters are not accepted type-wise but still work during build
+			// see https://github.com/vitejs/rolldown-vite/issues/605
+			filter: /** @type {any} */ (
+				/** @satisfies {TopLevelFilterExpression[]} */ ([
+					include(and(importerId(/.+/), not(importerId(/index\.html$/))))
+				])
+			),
+			async handler(id, importer, options) {
+				// composable filters only work during build so we still need this guard for dev
+				// see https://github.com/vitejs/rolldown-vite/issues/605
+				if (importer && !importer.endsWith('index.html')) {
+					const resolved = await this.resolve(id, importer, { ...options, skipSelf: true });
+
+					if (resolved) {
+						const normalized = normalize_id(resolved.id, normalized_aliases, normalized_cwd);
+
+						let importers = import_map.get(normalized);
+
+						if (!importers) {
+							importers = new Set();
+							import_map.set(normalized, importers);
+						}
+
+						importers.add(normalize_id(importer, normalized_aliases, normalized_cwd));
+					}
+				}
+			}
+		},
+
+		load: {
+			filter: {
+				id: [
+					exactRegex(app_server),
+					exactRegex(app_env_private),
+					server_only_module_pattern,
+					server_only_directory_pattern
+				]
+			},
+			handler(id) {
+				const normalized = normalize_id(id, normalized_aliases, normalized_cwd);
+
+				let is_server_only = normalized === '$app/env/private' || normalized === '$app/server';
+
+				// skip .server.js files outside the cwd or in node_modules, as the filename might not mean 'server-only module' in this context
+				if (id.startsWith(normalized_cwd) && !id.startsWith(normalized_node_modules)) {
+					// e.g. `server.ts` or `foo.server.ts`
+					is_server_only ||= server_only_module_pattern.test(id);
+
+					// e.g. `server/foo.ts`, unless in `src/routes` or `static`
+					is_server_only ||=
+						server_only_directory_pattern.test(id) &&
+						!id.startsWith(normalized_routes + '/') &&
+						!id.startsWith(normalized_assets + '/');
+				}
+
+				if (!is_server_only) return;
+
+				const manifest_data = get_manifest_data();
+
+				/** @type {Set<string>} */
+				const entrypoints = new Set();
+				for (const node of manifest_data.nodes) {
+					if (node.component) entrypoints.add(node.component);
+					if (node.universal) entrypoints.add(node.universal);
+				}
+
+				if (manifest_data.hooks.client) entrypoints.add(manifest_data.hooks.client);
+				if (manifest_data.hooks.universal) entrypoints.add(manifest_data.hooks.universal);
+
+				if (service_worker_entry_file) {
+					entrypoints.add(posixify(path.relative(root, service_worker_entry_file)));
+				}
+
+				// Walk up the import graph from the server-only module, looking for a chain
+				// that leads back to a client entrypoint. We search all candidates (not just
+				// the first) because a module can be imported by both server and client code,
+				// and a greedy first-match could follow a server-only branch that never
+				// reaches an entrypoint — see https://github.com/sveltejs/kit/issues/16232
+				/** @type {Set<string>} */
+				const visited = new Set([normalized]);
+
+				/**
+				 * @param {string} current
+				 * @param {string[]} chain
+				 * @returns {string[] | null}
+				 */
+				function find_chain(current, chain) {
+					const importers = import_map.get(current);
+					if (!importers) return null;
+
+					for (const importer of importers) {
+						if (visited.has(importer)) continue;
+						visited.add(importer);
+
+						const next_chain = [...chain, importer];
+						if (entrypoints.has(importer)) {
+							return next_chain;
+						}
+						const result = find_chain(importer, next_chain);
+						if (result) return result;
+					}
+					return null;
+				}
+
+				const chain = find_chain(normalized, [normalized]);
+
+				if (chain) {
+					if (chain.some((id) => remote_module_pattern.test(id))) {
+						error_for_missing_config('remote functions', 'experimental.remoteFunctions', 'true');
+					}
+
+					const pyramid = chain
+						.reverse()
+						.map((id, i) => {
+							return `${' '.repeat(i + 1)}${id}`;
+						})
+						.join(' imports\n');
+
+					let message = `Cannot import ${normalized} into code that runs in the browser, as this could leak sensitive information.`;
+					message += `\n\n${pyramid}`;
+					message += `\n\nIf you're only using the import as a type, change it to \`import type\`.`;
+
+					throw stackless(message);
+				}
+
+				// No chain from this server-only module to a client entrypoint was found —
+				// the module is only imported from server code, which is valid.
+			}
+		},
+
+		// avoid watch mode rebuilds using stale import map data
+		buildEnd() {
+			import_map.clear();
+		}
+	};
+}

package/src/exports/vite/utils.js

@@ -1,5 +1,9 @@
+/** @import { UserConfig } from 'vite' */
+/** @import { EnforcedConfig } from './types.js' */
 import fs from 'node:fs';
 import path from 'node:path';
+import process from 'node:process';
+import { styleText } from 'node:util';
 import { posixify } from '../../utils/os.js';
 import { negotiate } from '../../utils/http.js';
 import { escape_html } from '../../utils/escape.js';
@@ -227,3 +231,96 @@ export function error_for_missing_config(feature_name, path, value) {
 		`
 	);
 }
+
+/** @type {EnforcedConfig} */
+export const enforced_config = {
+	appType: true,
+	base: true,
+	build: {
+		cssCodeSplit: true,
+		emptyOutDir: true,
+		lib: {
+			entry: true,
+			name: true,
+			formats: true
+		},
+		manifest: true,
+		outDir: true,
+		rolldownOptions: {
+			input: true,
+			output: {
+				format: true,
+				entryFileNames: true,
+				chunkFileNames: true,
+				assetFileNames: true
+			},
+			preserveEntrySignatures: true
+		},
+		ssr: true
+	},
+	publicDir: true,
+	resolve: {
+		alias: {
+			$app: true,
+			$env: true,
+			'<sveltekit:generated>': true
+		}
+	}
+};
+
+/**
+ * @param {UserConfig} config
+ * @param {UserConfig} resolved_config
+ */
+export function warn_overridden_config(config, resolved_config) {
+	const overridden = find_overridden_config(config, resolved_config, enforced_config, '', []);
+
+	if (overridden.length > 0) {
+		console.error(
+			styleText(
+				['bold', 'red'],
+				'The following Vite config options will be overridden by SvelteKit:'
+			) + overridden.map((key) => `\n  - ${key}`).join('')
+		);
+	}
+}
+
+/**
+ * @param {Record<string, any>} config
+ * @param {Record<string, any>} resolved_config
+ * @param {EnforcedConfig} enforced_config
+ * @param {string} path
+ * @param {string[]} out used locally to compute the return value
+ */
+export function find_overridden_config(config, resolved_config, enforced_config, path, out) {
+	if (config == null || resolved_config == null) {
+		return out;
+	}
+
+	for (const key in enforced_config) {
+		if (typeof config === 'object' && key in config && key in resolved_config) {
+			const enforced = enforced_config[key];
+			const resolved = resolved_config[key];
+
+			if (enforced === true) {
+				if (comparable(config[key]) !== comparable(resolved)) {
+					out.push(path + key);
+				}
+			} else {
+				find_overridden_config(config[key], resolved, enforced, path + key + '.', out);
+			}
+		}
+	}
+	return out;
+}
+
+/**
+ * Normalizes a config value for comparison, since Windows paths may use backslashes
+ * and differ in casing (e.g. the drive letter) depending on where they came from.
+ * @param {any} value
+ */
+export function comparable(value) {
+	if (typeof value !== 'string') return value;
+	const normalized = posixify(value);
+	return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}

package/src/runtime/app/server/remote/query.js

@@ -330,7 +330,7 @@ function batch(validate_or_fn, maybe_fn) {
 		id: '',
 		name: '',
 		validate,
-		run: async (args, options) => {
+		run: async (args) => {
 			const { event, state } = get_request_store();
 
 			return run_remote_function(
@@ -347,7 +347,7 @@ function batch(validate_or_fn, maybe_fn) {
 								const data = get_result(arg, i);
 								return { type: 'result', data };
 							} catch (error) {
-								const transformed = await handle_error_and_jsonify(event, state, options, error);
+								const transformed = await handle_error_and_jsonify(event, state, error);
 
 								return {
 									type: 'error',

package/src/runtime/client/client.js

@@ -615,7 +615,7 @@ async function _invalidate(reset_page_state = true) {
 
 	const token = (invalidation_token = {});
 	const nav_token = navigation_token;
-	const navigating = is_navigating;
+	const prev_current = current;
 	const intent = await get_navigation_intent(current.url, true);
 
 	// Clear preload, it might be affected by the invalidation.
@@ -655,9 +655,9 @@ async function _invalidate(reset_page_state = true) {
 		);
 	}
 
-	// A navigation started before the invalidation and ended before it finished. The invalidation did not redirect,
-	// hence it likely contains outdated data now, so we ignore it.
-	if (navigating && !is_navigating) {
+	// a navigation applied its result while the invalidation was loading,
+	// so the invalidation contains outdated data for a page we are no longer on
+	if (current !== prev_current) {
 		return;
 	}
 

package/src/runtime/form-utils.js

@@ -3,7 +3,7 @@
 
 import { DEV } from 'esm-env';
 import * as devalue from 'devalue';
-import { text_decoder, text_encoder } from './utils.js';
+import { stream_from_iterable, text_decoder, text_encoder } from './utils.js';
 import { noop } from '../utils/functions.js';
 import { SvelteKitError } from '@sveltejs/kit/internal';
 
@@ -441,25 +441,17 @@ class LazyFile {
 	}
 	stream() {
 		const range = read_range(this.#get_chunk, this.#offset, this.size);
-		let cursor = 0;
-		return new ReadableStream({
-			pull: async (controller) => {
-				const { value, done } = await range.next();
-				if (done) {
-					if (cursor < this.size) {
-						controller.error('incomplete file data');
-					} else {
-						controller.close();
-					}
-					return;
-				}
-				cursor += value.byteLength;
-				controller.enqueue(value);
-				if (cursor >= this.size) {
-					controller.close();
+		const size = this.size;
+		return stream_from_iterable(
+			(async function* () {
+				let cursor = 0;
+				for await (const chunk of range) {
+					cursor += chunk.byteLength;
+					yield chunk;
 				}
-			}
-		});
+				if (cursor < size) throw new Error('incomplete file data');
+			})()
+		);
 	}
 	async text() {
 		return text_decoder.decode(await this.arrayBuffer());

package/src/runtime/server/data/index.js

@@ -6,14 +6,13 @@ import { server_data_serializer_json } from '../page/data_serializer.js';
 import { load_server_data } from '../page/load_data.js';
 import { handle_error_and_jsonify } from '../errors.js';
 import { normalize_path } from '../../../utils/url.js';
-import { text_encoder } from '../../utils.js';
+import { stream_text } from '../../utils.js';
 import { with_version_header } from '../utils.js';
 
 /**
  * @param {import('@sveltejs/kit').RequestEvent} event
  * @param {import('types').RequestState} state
  * @param {{ page: Pick<import('types').PageNodeIndexes, 'layouts' | 'leaf'> | null }} route
- * @param {import('types').SSROptions} options
  * @param {import('@sveltejs/kit').SSRManifest} manifest
  * @param {boolean[] | undefined} invalidated_data_nodes
  * @param {import('types').TrailingSlash} trailing_slash
@@ -23,7 +22,6 @@ export async function render_data(
 	event,
 	state,
 	route,
-	options,
 	manifest,
 	invalidated_data_nodes,
 	trailing_slash
@@ -92,7 +90,7 @@ export async function render_data(
 			return fn();
 		});
 
-		const data_serializer = server_data_serializer_json(event, state, options);
+		const data_serializer = server_data_serializer_json(event, state);
 		await Promise.all(
 			promises.map(async (p, i) => {
 				const node = await p.catch(async (error) => {
@@ -100,7 +98,7 @@ export async function render_data(
 						throw error;
 					}
 
-					const transformed = await handle_error_and_jsonify(event, state, options, error);
+					const transformed = await handle_error_and_jsonify(event, state, error);
 
 					return /** @type {import('types').ServerErrorNode} */ ({
 						type: 'error',
@@ -120,27 +118,14 @@ export async function render_data(
 		}
 
 		return with_version_header(
-			new Response(
-				new ReadableStream({
-					async start(controller) {
-						controller.enqueue(text_encoder.encode(data));
-						for await (const chunk of chunks) {
-							controller.enqueue(text_encoder.encode(chunk));
-						}
-						controller.close();
-					},
-
-					type: 'bytes'
-				}),
-				{
-					headers: {
-						// we use a proprietary content type to prevent buffering.
-						// the `text` prefix makes it inspectable
-						'content-type': 'text/sveltekit-data',
-						'cache-control': 'private, no-store'
-					}
+			new Response(stream_text(data, chunks), {
+				headers: {
+					// we use a proprietary content type to prevent buffering.
+					// the `text` prefix makes it inspectable
+					'content-type': 'text/sveltekit-data',
+					'cache-control': 'private, no-store'
 				}
-			)
+			})
 		);
 	} catch (e) {
 		const error = normalize_error(e);
@@ -148,7 +133,7 @@ export async function render_data(
 		if (error instanceof Redirect) {
 			return redirect_json_response(error);
 		} else {
-			const transformed = await handle_error_and_jsonify(event, state, options, error);
+			const transformed = await handle_error_and_jsonify(event, state, error);
 			return json_response(transformed, transformed.status);
 		}
 	}

package/src/runtime/server/errors.js

@@ -8,17 +8,16 @@ import {
 import { with_request_store } from '@sveltejs/kit/internal/server';
 import { add_deprecated_handle_error_properties, coalesce_to_error } from '../../utils/error.js';
 import { negotiate } from '../../utils/http.js';
-import { fix_stack_trace } from './internal.js';
+import { fix_stack_trace, hooks, options } from './internal.js';
 import { escape_html } from '../../utils/escape.js';
 
 /**
  * @param {import('@sveltejs/kit').RequestEvent} event
  * @param {import('types').RequestState} state
- * @param {import('types').SSROptions} options
  * @param {unknown} error
  */
-export async function handle_fatal_error(event, state, options, error) {
-	const body = await handle_error_and_jsonify(event, state, options, error);
+export async function handle_fatal_error(event, state, error) {
+	const body = await handle_error_and_jsonify(event, state, error);
 	const status = body.status;
 
 	// sec-fetch-dest would be nicer, but non-browser clients and plain HTTP hosts don't send it
@@ -33,17 +32,16 @@ export async function handle_fatal_error(event, state, options, error) {
 		});
 	}
 
-	return static_error_page(options, status, body.message);
+	return static_error_page(status, body.message);
 }
 
 /**
  * @param {import('@sveltejs/kit').RequestEvent} event
  * @param {import('types').RequestState} state
- * @param {import('types').SSROptions} options
  * @param {any} error
  * @returns {App.Error | Promise<App.Error>}
  */
-export function handle_error_and_jsonify(event, state, options, error) {
+export function handle_error_and_jsonify(event, state, error) {
 	if (error instanceof HandledHttpError) {
 		return error.body;
 	}
@@ -90,7 +88,7 @@ export function handle_error_and_jsonify(event, state, options, error) {
 		const input = { ...caught, event };
 		if (__SVELTEKIT_DEV__) add_deprecated_handle_error_properties(input, fallback);
 
-		result = with_request_store({ event, state }, () => options.hooks.handleError(input));
+		result = with_request_store({ event, state }, () => hooks.handleError(input));
 	} catch (hook_error) {
 		log_handle_error_hook_failure(error, hook_error);
 		return { status: fallback.status, message: 'Internal Error' };
@@ -141,11 +139,10 @@ function log_handle_error_hook_failure(error, hook_error) {
 /**
  * Return as a response that renders the error.html
  *
- * @param {import('types').SSROptions} options
  * @param {number} status
  * @param {string} message
  */
-export function static_error_page(options, status, message) {
+export function static_error_page(status, message) {
 	let page = options.templates.error({ status, message: escape_html(message) });
 
 	if (__SVELTEKIT_DEV__) {

package/src/runtime/server/fetch.js

@@ -2,14 +2,13 @@ import { parseSetCookie } from 'cookie';
 import { noop } from '../../utils/functions.js';
 import { respond } from './respond.js';
 import * as paths from '#app/paths';
-import { read_implementation } from './internal.js';
+import { hooks, read_implementation } from './internal.js';
 import { has_prerendered_path } from './utils.js';
 import { fork_state_for_subrequest } from './state.js';
 
 /**
  * @param {{
  *   event: import('@sveltejs/kit').RequestEvent;
- *   options: import('types').SSROptions;
  *   manifest: import('@sveltejs/kit').SSRManifest;
  *   state: import('types').RequestState;
  *   get_cookie_header: (url: URL, header: string | null) => string;
@@ -17,7 +16,7 @@ import { fork_state_for_subrequest } from './state.js';
  * }} opts
  * @returns {typeof fetch}
  */
-export function create_fetch({ event, options, manifest, state, get_cookie_header, set_internal }) {
+export function create_fetch({ event, manifest, state, get_cookie_header, set_internal }) {
 	/**
 	 * @type {typeof fetch}
 	 */
@@ -30,7 +29,7 @@ export function create_fetch({ event, options, manifest, state, get_cookie_heade
 		let credentials =
 			(info instanceof Request ? info.credentials : init?.credentials) ?? 'same-origin';
 
-		return options.hooks.handleFetch({
+		return hooks.handleFetch({
 			event,
 			request: original_request,
 			fetch: async (info, init) => {
@@ -148,18 +147,19 @@ export function create_fetch({ event, options, manifest, state, get_cookie_heade
 					request.headers.set('accept-language', accept_language);
 				}
 
-				const response = await internal_fetch(request, options, manifest, state);
+				const response = await internal_fetch(request, manifest, state);
 
 				for (const str of response.headers.getSetCookie()) {
-					const { name, value, ...options } = parseSetCookie(str, { decode: (v) => v });
+					const { name, value, ...cookie_options } = parseSetCookie(str, { decode: (v) => v });
 
-					const path = options.path ?? (url.pathname.split('/').slice(0, -1).join('/') || '/');
+					const path =
+						cookie_options.path ?? (url.pathname.split('/').slice(0, -1).join('/') || '/');
 
-					// options.sameSite is string, something more specific is required - type cast is safe
+					// sameSite is string, something more specific is required - type cast is safe
 					set_internal(name, /** @type {string} */ (value), {
 						path,
 						encode: (value) => value,
-						.../** @type {import('cookie').SerializeOptions} */ (options)
+						.../** @type {import('cookie').SerializeOptions} */ (cookie_options)
 					});
 				}
 
@@ -193,12 +193,11 @@ function normalize_fetch_input(info, init, url) {
 
 /**
  * @param {Request} request
- * @param {import('types').SSROptions} options
  * @param {import('@sveltejs/kit').SSRManifest} manifest
  * @param {import('types').RequestState} state
  * @returns {Promise<Response>}
  */
-async function internal_fetch(request, options, manifest, state) {
+async function internal_fetch(request, manifest, state) {
 	if (request.signal?.aborted) {
 		throw new DOMException('The operation was aborted.', 'AbortError');
 	}
@@ -206,7 +205,7 @@ async function internal_fetch(request, options, manifest, state) {
 	const subrequest_state = fork_state_for_subrequest(state);
 
 	if (!request.signal) {
-		return await respond(request, options, manifest, subrequest_state);
+		return await respond(request, manifest, subrequest_state);
 	}
 
 	let remove_abort_listener = noop;
@@ -219,8 +218,7 @@ async function internal_fetch(request, options, manifest, state) {
 		remove_abort_listener = () => request.signal.removeEventListener('abort', on_abort);
 	});
 
-	return Promise.race([
-		respond(request, options, manifest, subrequest_state),
-		abort_promise
-	]).finally(remove_abort_listener);
+	return Promise.race([respond(request, manifest, subrequest_state), abort_promise]).finally(
+		remove_abort_listener
+	);
 }