@sveltejs/kit 3.0.0-next.3 → 3.0.0-next.6

package/src/types/internal.d.ts

@@ -17,7 +17,6 @@ import {
 	RequestEvent,
 	SSRManifest,
 	Emulator,
-	Adapter,
 	ServerInit,
 	ClientInit,
 	Transport,
@@ -44,7 +43,6 @@ export interface ServerModule {
 export interface ServerInternalModule {
 	set_assets(path: string): void;
 	set_building(): void;
-	set_env(environment: Record<string, string>): void;
 	set_manifest(manifest: SSRManifest): void;
 	set_prerendering(): void;
 	set_read_implementation(implementation: (path: string) => ReadableStream): void;
@@ -101,6 +99,9 @@ export interface BuildData {
 		routes?: SSRClientRoute[];
 		stylesheets: string[];
 		fonts: string[];
+		/**
+		 * Whether the client uses public dynamic env vars — `$env/dynamic/public` or `$app/env/public`.
+		 */
 		uses_env_dynamic_public: boolean;
 		/** Only set in case of `bundleStrategy === 'inline'`. */
 		inline?: {
@@ -194,7 +195,7 @@ export class InternalServer extends Server {
 }
 
 export interface ManifestData {
-	/** Static files from `kit.config.files.assets`. */
+	/** Static files from `config.files.assets`. */
 	assets: Asset[];
 	hooks: {
 		client: string | null;
@@ -293,6 +294,7 @@ export interface RouteData {
 
 export type ServerRedirectNode = {
 	type: 'redirect';
+	status: number;
 	location: string;
 };
 
@@ -308,7 +310,7 @@ export type RemoteFunctionDataNode = {
 	/** value */
 	v?: any;
 	/** error */
-	e?: [status: number, error: any];
+	e?: App.Error;
 };
 
 export type RemoteFunctionData = {
@@ -389,10 +391,6 @@ export interface ServerDataSkippedNode {
 export interface ServerErrorNode {
 	type: 'error';
 	error: App.Error;
-	/**
-	 * Only set for HttpErrors.
-	 */
-	status?: number;
 }
 
 export interface ServerMetadataRoute {
@@ -503,6 +501,7 @@ export interface SSROptions {
 	hash_routing: boolean;
 	hooks: ServerHooks;
 	link_header_preload: ValidatedConfig['kit']['output']['linkHeaderPreload'];
+	paths_origin: string | undefined;
 	root: SSRComponent['default'];
 	service_worker: boolean;
 	service_worker_options: RegistrationOptions;
@@ -604,8 +603,7 @@ export type ValidatedConfig = Config & {
 	extensions: string[];
 };
 
-// TODO: remove the omit in 4.0
-export type ValidatedKitConfig = Omit<RecursiveRequired<KitConfig>, 'adapter'>;
+export type ValidatedKitConfig = RecursiveRequired<KitConfig>;
 
 export type BinaryFormMeta = {
 	remote_refreshes?: string[];

package/src/types/private.d.ts

@@ -61,7 +61,10 @@ export namespace Csp {
 		| 'unsafe-eval'
 		| 'unsafe-hashes'
 		| 'unsafe-inline'
+		| 'unsafe-allow-redirects'
+		| 'unsafe-webtransport-hashes'
 		| 'wasm-unsafe-eval'
+		| 'trusted-types-eval'
 		| 'none';
 	type CryptoSource = `${'nonce' | 'sha256' | 'sha384' | 'sha512'}-${string}`;
 	type FrameSource = HostSource | SchemeSource | 'self' | 'none';
@@ -70,7 +73,16 @@ export namespace Csp {
 	type HostProtocolSchemes = `${string}://` | '';
 	type HttpDelineator = '/' | '?' | '#' | '\\';
 	type PortScheme = `:${number}` | '' | ':*';
-	type SchemeSource = 'http:' | 'https:' | 'data:' | 'mediastream:' | 'blob:' | 'filesystem:';
+	type SchemeSource =
+		| 'http:'
+		| 'https:'
+		| 'ws:'
+		| 'wss:'
+		| 'data:'
+		| 'mediastream:'
+		| 'blob:'
+		| 'filesystem:'
+		| (`${string}:` & {});
 	type Source = HostSource | SchemeSource | CryptoSource | BaseSource;
 	type Sources = Source[];
 }
@@ -212,6 +224,10 @@ export interface PrerenderUnseenRoutesHandler {
 	(details: { routes: string[]; message: string }): void;
 }
 
+export interface PrerenderInvalidUrlHandler {
+	(details: { href: string; referrer: string | null; message: string }): void;
+}
+
 export type PrerenderHttpErrorHandlerValue = 'fail' | 'warn' | 'ignore' | PrerenderHttpErrorHandler;
 export type PrerenderMissingIdHandlerValue = 'fail' | 'warn' | 'ignore' | PrerenderMissingIdHandler;
 export type PrerenderUnseenRoutesHandlerValue =
@@ -224,6 +240,11 @@ export type PrerenderEntryGeneratorMismatchHandlerValue =
 	| 'warn'
 	| 'ignore'
 	| PrerenderEntryGeneratorMismatchHandler;
+export type PrerenderInvalidUrlHandlerValue =
+	| 'fail'
+	| 'warn'
+	| 'ignore'
+	| PrerenderInvalidUrlHandler;
 
 export type PrerenderOption = boolean | 'auto';
 
@@ -252,3 +273,14 @@ export type DeepPartial<T> = T extends Record<PropertyKey, unknown> | unknown[]
 	: T | undefined;
 
 export type IsAny<T> = 0 extends 1 & T ? true : false;
+
+export type HasNonOptionalBoolean<T> =
+	IsAny<T> extends true
+		? never
+		: [T] extends [boolean]
+			? true
+			: T extends Array<infer U>
+				? HasNonOptionalBoolean<U>
+				: T extends Record<string, any>
+					? { [K in keyof T]: HasNonOptionalBoolean<T[K]> }[keyof T]
+					: never;

package/src/types/synthetic/$lib.md

@@ -1,4 +1,4 @@
-This is a simple alias to `src/lib`, or whatever directory is specified as [`config.kit.files.lib`](https://svelte.dev/docs/kit/configuration#files). It allows you to access common components and utility modules without `../../../../` nonsense.
+This is a simple alias to `src/lib`, or whatever directory is specified as [`config.files.lib`](https://svelte.dev/docs/kit/configuration#files). It allows you to access common components and utility modules without `../../../../` nonsense.
 
 ### `$lib/server`
 

package/src/utils/error.js

@@ -36,10 +36,18 @@ export function normalize_error(error) {
 }
 
 /**
- * @param {unknown} error
+ * @param {any} transformed
+ * @param {any} [error]
  */
-export function get_status(error) {
-	return error instanceof HttpError || error instanceof SvelteKitError ? error.status : 500;
+export function get_status(transformed, error) {
+	const err = error ?? transformed;
+	const status = err instanceof HttpError || err instanceof SvelteKitError ? err.status : 500;
+
+	if (error == null || typeof transformed?.status !== 'number') {
+		return status;
+	} else {
+		return transformed.status;
+	}
 }
 
 /**

package/src/utils/shared-iterator.js

@@ -52,6 +52,11 @@ export class SharedIterator {
 	/** @type {unknown} */
 	#terminal_error = undefined;
 
+	/** Whether `done()` or `fail()` has been broadcast. */
+	get closed() {
+		return this.#closed;
+	}
+
 	/**
 	 * @param {(instance: SharedIterator<T>) => (() => void)} [start]
 	 */

package/src/utils/url.js

@@ -1,10 +1,13 @@
 import { BROWSER, DEV } from 'esm-env';
+import { try_get_request_store } from '../exports/internal/event.js';
 
 /**
  * Matches a URI scheme. See https://www.rfc-editor.org/rfc/rfc3986#section-3.1
  * @type {RegExp}
  */
-export const SCHEME = /^[a-z][a-z\d+\-.]+:/i;
+export const SCHEME = /^[a-z][a-z\d+\-.]*:/i;
+// See https://datatracker.ietf.org/doc/html/rfc2606 - no domains under the .invalid TLD can be registered
+const REDIRECT_BASE = 'https://sveltekit-redirect.invalid';
 
 const internal = new URL('a://');
 
@@ -27,6 +30,100 @@ export function is_root_relative(path) {
 	return path[0] === '/' && path[1] !== '/';
 }
 
+/**
+ * Whether a redirect location is absolute, i.e. not a root-relative or path-relative URL,
+ * and not pointing to the same origin as we're currently on (if determineable).
+ * @param {string} location
+ */
+export function is_external_location(location) {
+	const origin = BROWSER ? window.location.origin : try_get_request_store()?.event.url.origin;
+
+	try {
+		return !matches_external_allowlist_entry(location, origin ?? REDIRECT_BASE);
+	} catch {
+		return true;
+	}
+}
+
+/**
+ * @param {string} location
+ */
+function is_javascript_location(location) {
+	try {
+		return new URL(location, REDIRECT_BASE).protocol === 'javascript:';
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * @param {string} location
+ * @param {string} allowed
+ */
+export function matches_external_allowlist_entry(location, allowed) {
+	if (location === allowed) return true;
+
+	try {
+		const allow = new URL(allowed);
+		const loc = new URL(location, allow);
+
+		// this is stricter than `loc.origin === allow.origin`, which can fail in `blob:` cases
+		return loc.protocol === allow.protocol && loc.host === allow.host;
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * @param {string} location
+ * @param {{ external?: boolean | string[] }} [options]
+ */
+export function validate_redirect_location(location, options) {
+	if (!is_external_location(location)) return;
+
+	const external = options?.external;
+
+	if (!external) {
+		throw new Error(
+			DEV
+				? `Cannot redirect to external URL ${JSON.stringify(location)}. ` +
+						'To redirect to an external URL, pass `{ external: true }` or an allowlist of permitted origins as the third argument to `redirect`'
+				: 'Cannot redirect to external URL unless explicitly allowed'
+		);
+	}
+
+	if (external === true) {
+		if (is_javascript_location(location)) {
+			throw new Error(
+				DEV
+					? `Cannot redirect to ${JSON.stringify(location)} with \`{ external: true }\`. ` +
+							'The `:javascript` protocol must be explicitly listed in the `external` allowlist'
+					: 'Cannot redirect to external URL unless explicitly allowed'
+			);
+		}
+
+		return;
+	}
+
+	if (Array.isArray(external)) {
+		if (!external.some((allowed) => matches_external_allowlist_entry(location, allowed))) {
+			throw new Error(
+				DEV
+					? `Cannot redirect to ${JSON.stringify(location)}: URL origin is not included in the \`external\` allowlist`
+					: 'Cannot redirect to external URL unless explicitly allowed'
+			);
+		}
+
+		return;
+	}
+
+	throw new Error(
+		DEV
+			? '`redirect` options.external must be `true` or an array of allowed origins'
+			: 'Invalid redirect options.external value'
+	);
+}
+
 /**
  * @param {string} path
  * @param {import('types').TrailingSlash} trailing_slash
@@ -119,6 +216,7 @@ export function make_trackable(url, callback, search_params_callback, allow_hash
 	/**
 	 * URL properties that could change during the lifetime of the page,
 	 * which excludes things like `origin`
+	 * @type {(keyof URL)[]}
 	 */
 	const tracked_url_properties = ['href', 'pathname', 'search', 'toString', 'toJSON'];
 	if (allow_hash) tracked_url_properties.push('hash');
@@ -127,7 +225,6 @@ export function make_trackable(url, callback, search_params_callback, allow_hash
 		Object.defineProperty(tracked, property, {
 			get() {
 				callback();
-				// @ts-expect-error
 				return url[property];
 			},
 

package/src/version.js

@@ -1,4 +1,4 @@
 // generated during release, do not modify
 
 /** @type {string} */
-export const VERSION = '3.0.0-next.3';
+export const VERSION = '3.0.0-next.6';