@sveltejs/kit 3.0.0-next.3 → 3.0.0-next.6

package/src/runtime/client/types.d.ts

@@ -58,6 +58,12 @@ export interface SvelteKitApp {
 	hash: boolean;
 
 	root: typeof SvelteComponent;
+
+	/**
+	 * Lazily loads the contents of src/error.html, used as a last-resort
+	 * error page when the root layout's load function throws during client-side rendering.
+	 */
+	get_error_template: () => Promise<(data: { status: number; message: string }) => string>;
 }
 
 export type NavigationIntent = {
@@ -77,6 +83,7 @@ export type NavigationResult = NavigationRedirect | NavigationFinished;
 
 export type NavigationRedirect = {
 	type: 'redirect';
+	status: number;
 	location: string;
 };
 
@@ -119,7 +126,8 @@ export interface NavigationState {
 }
 
 export interface HydrateOptions {
-	status: number;
+	/** Provided in the case of a form action that returns `fail`, but otherwise derived from `error` */
+	status?: number;
 	error: App.Error | null;
 	node_ids: number[];
 	params: Record<string, string>;

package/src/runtime/client/utils.js

@@ -1,6 +1,6 @@
 import { BROWSER, DEV } from 'esm-env';
 import { writable } from 'svelte/store';
-import { assets } from '$app/paths';
+import { assets } from '$app/paths/internal/client';
 import { version } from '$app/env';
 import { noop } from '../../utils/functions.js';
 import { PRELOAD_PRIORITIES } from './constants.js';

package/src/runtime/form-utils.js

@@ -41,14 +41,11 @@ export function convert_formdata(data) {
 
 		if (is_array) key = key.slice(0, -2);
 
-		if (values.length > 1 && !is_array) {
-			throw new Error(`Form cannot contain duplicated keys — "${key}" has ${values.length} values`);
-		}
-
 		// an empty `<input type="file">` will submit a non-existent file, bizarrely
 		values = values.filter(
 			(entry) => typeof entry === 'string' || entry.name !== '' || entry.size > 0
 		);
+		if (values.length === 0 && !is_array) continue;
 
 		if (key.startsWith('n:')) {
 			key = key.slice(2);
@@ -58,6 +55,10 @@ export function convert_formdata(data) {
 			values = values.map((v) => v === 'on');
 		}
 
+		if (values.length > 1 && !is_array) {
+			throw new Error(`Form cannot contain duplicated keys — "${key}" has ${values.length} values`);
+		}
+
 		set_nested_value(result, key, is_array ? values : values[0]);
 	}
 
@@ -608,18 +609,53 @@ function get_type_prefix(field_type, is_array, input_value) {
 	return '';
 }
 
+/**
+ * A deep-clone implementation specifically for form data, where
+ * we don't need to worry about cycles and whatnot
+ * @param {any} value
+ * @returns {any}
+ */
+function deep_clone(value) {
+	if (value !== null && typeof value === 'object') {
+		if (value instanceof Date) {
+			return new Date(value.getTime());
+		}
+
+		if (value instanceof File) {
+			return value;
+		}
+
+		if (Array.isArray(value)) {
+			return value.map(deep_clone);
+		}
+
+		/** @type {Record<string, any>} */
+		const clone = {};
+		for (const key of Object.keys(value)) {
+			clone[key] = deep_clone(value[key]);
+		}
+
+		return clone;
+	}
+
+	return value;
+}
+
 /**
  * Creates a proxy-based field accessor for form data
  * @param {any} target - Function or empty POJO
- * @param {() => Record<string, any>} get_input - Function to get current input data
- * @param {(path: (string | number)[], value: any) => void} set_input - Function to set input data
+ * @param {() => Record<string, any>} get - Function to get current input data
+ * @param {(path: (string | number)[], value: any) => void} set - Function to set input data
  * @param {(path?: (string | number)[], all?: boolean) => Record<string, InternalRemoteFormIssue[]>} get_issues - Function to get current issues
+ * @param {() => Record<string, boolean>} get_touched - Function to get touched fields
+ * @param {() => Record<string, boolean>} get_dirty - Function to get dirty fields
  * @param {(string | number)[]} path - Current access path
  * @returns {any} Proxy object with name(), value(), and issues() methods
  */
-export function create_field_proxy(target, get_input, set_input, get_issues, path = []) {
+export function create_field_proxy(target, get, set, get_issues, get_touched, get_dirty, path) {
 	const get_value = () => {
-		return deep_get(get_input(), path);
+		const value = deep_get(get(), path);
+		return deep_clone(value);
 	};
 
 	return new Proxy(target, {
@@ -628,24 +664,26 @@ export function create_field_proxy(target, get_input, set_input, get_issues, pat
 
 			// Handle array access like jobs[0]
 			if (/^\d+$/.test(prop)) {
-				return create_field_proxy({}, get_input, set_input, get_issues, [
+				return create_field_proxy({}, get, set, get_issues, get_touched, get_dirty, [
 					...path,
 					parseInt(prop, 10)
 				]);
 			}
 
 			const key = build_path_string(path);
+			const next = [...path, prop];
 
 			if (prop === 'set') {
 				const set_func = function (/** @type {any} */ newValue) {
-					set_input(path, newValue);
+					set(path, newValue);
 					return newValue;
 				};
-				return create_field_proxy(set_func, get_input, set_input, get_issues, [...path, prop]);
+
+				return create_field_proxy(set_func, get, set, get_issues, get_touched, get_dirty, next);
 			}
 
 			if (prop === 'value') {
-				return create_field_proxy(get_value, get_input, set_input, get_issues, [...path, prop]);
+				return create_field_proxy(get_value, get, set, get_issues, get_touched, get_dirty, next);
 			}
 
 			if (prop === 'issues' || prop === 'allIssues') {
@@ -659,15 +697,45 @@ export function create_field_proxy(target, get_input, set_input, get_issues, pat
 						}));
 					}
 
-					return all_issues
+					const issues = all_issues
 						?.filter((issue) => issue.name === key)
 						?.map((issue) => ({
 							path: issue.path,
 							message: issue.message
 						}));
+
+					return issues?.length ? issues : undefined;
+				};
+
+				return create_field_proxy(issues_func, get, set, get_issues, get_touched, get_dirty, next);
+			}
+
+			if (prop === 'touched' || prop === 'dirty') {
+				const fn = () => {
+					const object = prop === 'dirty' ? get_dirty() : get_touched();
+
+					if (key === '') {
+						return Object.keys(object).length > 0;
+					}
+
+					if (Object.hasOwn(object, key)) {
+						return true;
+					}
+
+					for (const candidate in object) {
+						if (!Object.hasOwn(object, candidate)) continue;
+						if (!candidate.startsWith(key)) continue;
+
+						const next = candidate[key.length];
+						if (next === '.' || next === '[') {
+							return true;
+						}
+					}
+
+					return false;
 				};
 
-				return create_field_proxy(issues_func, get_input, set_input, get_issues, [...path, prop]);
+				return create_field_proxy(fn, get, set, get_issues, get_touched, get_dirty, next);
 			}
 
 			if (prop === 'as') {
@@ -833,11 +901,11 @@ export function create_field_proxy(target, get_input, set_input, get_issues, pat
 					});
 				};
 
-				return create_field_proxy(as_func, get_input, set_input, get_issues, [...path, 'as']);
+				return create_field_proxy(as_func, get, set, get_issues, get_touched, get_dirty, next);
 			}
 
 			// Handle property access (nested fields)
-			return create_field_proxy({}, get_input, set_input, get_issues, [...path, prop]);
+			return create_field_proxy({}, get, set, get_issues, get_touched, get_dirty, next);
 		}
 	});
 }

package/src/runtime/server/cookie.js

@@ -1,4 +1,4 @@
-import { parse, serialize } from 'cookie';
+import { parseCookie, parseSetCookie, stringifySetCookie } from 'cookie';
 import { DEV } from 'esm-env';
 import { normalize_path, resolve } from '../../utils/url.js';
 import { add_data_suffix } from '../pathname.js';
@@ -39,7 +39,7 @@ function generate_cookie_key(domain, path, name) {
 export function get_cookies(request, url) {
 	const header = request.headers.get('cookie') ?? '';
 	const initial_cookies = /** @type {Record<string, string>} */ (
-		parse(header, { decode: (value) => value })
+		parseCookie(header, { decode: (value) => value })
 	);
 
 	/** @type {string | undefined} */
@@ -48,7 +48,7 @@ export function get_cookies(request, url) {
 	/** @type {Map<string, import('./page/types.js').Cookie>} */
 	const new_cookies = new Map();
 
-	/** @type {import('cookie').SerializeOptions} */
+	/** @type {Omit<import('cookie').SetCookie, 'name' | 'value'>} */
 	const defaults = {
 		httpOnly: true,
 		path: '/',
@@ -63,10 +63,6 @@ export function get_cookies(request, url) {
 		// typescript users. `@type {import('@sveltejs/kit').Cookies}` above is not
 		// sufficient to do so.
 
-		/**
-		 * @param {string} name
-		 * @param {import('cookie').ParseOptions} [opts]
-		 */
 		get(name, opts) {
 			// Look for the most specific matching cookie from new_cookies
 			const best_match = Array.from(new_cookies.values())
@@ -83,7 +79,7 @@ export function get_cookies(request, url) {
 				return best_match.options.maxAge === 0 ? undefined : best_match.value;
 			}
 
-			const req_cookies = parse(header, { decode: opts?.decode });
+			const req_cookies = parseCookie(header, { decode: opts?.decode });
 			const cookie = req_cookies[name]; // the decoded string or undefined
 
 			// in development, if the cookie was set during this session with `cookies.set`,
@@ -106,11 +102,8 @@ export function get_cookies(request, url) {
 			return cookie;
 		},
 
-		/**
-		 * @param {import('cookie').ParseOptions} [opts]
-		 */
 		getAll(opts) {
-			const cookies = parse(header, { decode: opts?.decode });
+			const cookies = parseCookie(header, { decode: opts?.decode });
 
 			// Group cookies by name and find the most specific one for each name
 			const lookup = new Map();
@@ -141,29 +134,17 @@ export function get_cookies(request, url) {
 			);
 		},
 
-		/**
-		 * @param {string} name
-		 * @param {string} value
-		 * @param {import('cookie').SerializeOptions} options
-		 */
 		set(name, value, options) {
 			set_internal(name, value, { ...defaults, ...options });
 		},
 
-		/**
-		 * @param {string} name
-		 * @param {import('cookie').SerializeOptions} options
-		 */
 		delete(name, options) {
 			cookies.set(name, '', { ...options, maxAge: 0 });
 		},
 
-		/**
-		 * @param {string} name
-		 * @param {string} value
-		 * @param {import('cookie').SerializeOptions} options
-		 */
-		serialize(name, value, options) {
+		parse: parseSetCookie,
+
+		serialize(name, value, { encode, ...options }) {
 			let path = options.path ?? '/';
 
 			if (!options.domain || options.domain === url.hostname) {
@@ -173,7 +154,7 @@ export function get_cookies(request, url) {
 				path = resolve(normalized_url, path);
 			}
 
-			return serialize(name, value, { ...defaults, ...options, path });
+			return stringifySetCookie({ name, value, ...defaults, ...options, path }, { encode });
 		}
 	};
 
@@ -200,7 +181,7 @@ export function get_cookies(request, url) {
 		// explicit header has highest precedence
 		if (header) {
 			const parsed = /** @type {Record<string, string>} */ (
-				parse(header, { decode: (value) => value })
+				parseCookie(header, { decode: (value) => value })
 			);
 			for (const name in parsed) {
 				combined_cookies[name] = parsed[name];
@@ -238,7 +219,8 @@ export function get_cookies(request, url) {
 		new_cookies.set(cookie_key, cookie);
 
 		if (DEV) {
-			const serialized = serialize(name, value, cookie.options);
+			const { encode, ...rest } = cookie.options;
+			const serialized = stringifySetCookie({ name, value, ...rest }, { encode });
 			if (text_encoder.encode(serialized).byteLength > MAX_COOKIE_SIZE) {
 				throw new Error(`Cookie "${name}" is too large, and will be discarded by the browser`);
 			}
@@ -296,15 +278,22 @@ export function path_matches(path, constraint) {
  */
 export function add_cookies_to_headers(headers, cookies) {
 	for (const new_cookie of cookies) {
-		const { name, value, options } = new_cookie;
-		headers.append('set-cookie', serialize(name, value, options));
+		const {
+			name,
+			value,
+			options: { encode, ...options }
+		} = new_cookie;
+		headers.append('set-cookie', stringifySetCookie({ name, value, ...options }, { encode }));
 
 		// special case — for routes ending with .html, the route data lives in a sibling
 		// `.html__data.json` file rather than a child `/__data.json` file, which means
 		// we need to duplicate the cookie
 		if (options.path.endsWith('.html')) {
 			const path = add_data_suffix(options.path);
-			headers.append('set-cookie', serialize(name, value, { ...options, path }));
+			headers.append(
+				'set-cookie',
+				stringifySetCookie({ name, value, ...options, path }, { encode })
+			);
 		}
 	}
 }

package/src/runtime/server/csrf.js

@@ -0,0 +1,65 @@
+import { is_form_content_type } from '../../utils/http.js';
+
+const mutating_form_methods = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+
+/**
+ * The origin SvelteKit treats as "self" when validating the `Origin` header on
+ * cross-site requests.
+ *
+ * By default (`paths.origin` is `undefined`), SvelteKit derives the origin
+ * from `request.url` (which is set by the adapter, and ultimately by the
+ * platform). When `paths.origin` is configured — for example so that a preview
+ * deployment whose URL isn't known at build time, or an app behind a reverse
+ * proxy, can declare a canonical origin — that value takes precedence.
+ *
+ * @param {string | undefined} paths_origin the configured `kit.paths.origin`
+ * @param {string} url_origin the origin derived from `request.url`
+ * @returns {string}
+ */
+export function get_self_origin(paths_origin, url_origin) {
+	return paths_origin || url_origin;
+}
+
+/**
+ * Determines whether a non-remote request should be rejected as a cross-site
+ * form submission (CSRF). Used by `respond.js` to gate form `POST`/`PUT`/
+ * `PATCH`/`DELETE` requests whose `Origin` header doesn't match the app's
+ * self-origin (and isn't in `trusted_origins`).
+ *
+ * @param {{
+ *   request: Request;
+ *   request_origin: string | null;
+ *   self_origin: string;
+ *   trusted_origins: string[];
+ * }} input
+ * @returns {boolean}
+ */
+export function is_csrf_forbidden({ request, request_origin, self_origin, trusted_origins }) {
+	return (
+		is_form_content_type(request) &&
+		mutating_form_methods.has(request.method) &&
+		request_origin !== self_origin &&
+		(!request_origin || !trusted_origins.includes(request_origin))
+	);
+}
+
+/**
+ * Determines whether a remote-function request should be rejected as cross-site.
+ *
+ * Unlike form submissions, remote functions accept any content type (e.g.
+ * `application/json`), so the check is solely on the request method and origin:
+ * a non-`GET` request is forbidden when its `Origin` header doesn't match the
+ * app's self-origin. Unlike `is_csrf_forbidden`, entries in `trusted_origins`
+ * are *not* honoured — remote function endpoints are an implementation detail,
+ * not a public API, so cross-origin calls are forbidden regardless.
+ *
+ * @param {{
+ *   request: Request;
+ *   request_origin: string | null;
+ *   self_origin: string;
+ * }} input
+ * @returns {boolean}
+ */
+export function is_remote_forbidden({ request, request_origin, self_origin }) {
+	return request.method !== 'GET' && request_origin !== self_origin;
+}

package/src/runtime/server/data/index.js

@@ -1,5 +1,5 @@
 import { text } from '@sveltejs/kit';
-import { HttpError, SvelteKitError, Redirect } from '@sveltejs/kit/internal';
+import { Redirect } from '@sveltejs/kit/internal';
 import { normalize_error } from '../../../utils/error.js';
 import { once } from '../../../utils/functions.js';
 import { server_data_serializer_json } from '../page/data_serializer.js';
@@ -107,13 +107,11 @@ export async function render_data(
 					// Math.min because array isn't guaranteed to resolve in order
 					length = Math.min(length, i + 1);
 
+					const transformed = await handle_error_and_jsonify(event, event_state, options, error);
+
 					return /** @type {import('types').ServerErrorNode} */ ({
 						type: 'error',
-						error: await handle_error_and_jsonify(event, event_state, options, error),
-						status:
-							error instanceof HttpError || error instanceof SvelteKitError
-								? error.status
-								: undefined
+						error: transformed
 					});
 				})
 			)
@@ -156,7 +154,8 @@ export async function render_data(
 		if (error instanceof Redirect) {
 			return redirect_json_response(error);
 		} else {
-			return json_response(await handle_error_and_jsonify(event, event_state, options, error), 500);
+			const transformed = await handle_error_and_jsonify(event, event_state, options, error);
+			return json_response(transformed, transformed.status);
 		}
 	}
 }
@@ -182,6 +181,7 @@ export function redirect_json_response(redirect) {
 	return json_response(
 		/** @type {import('types').ServerRedirectNode} */ ({
 			type: 'redirect',
+			status: redirect.status,
 			location: redirect.location
 		})
 	);

package/src/runtime/server/env_module.js

@@ -16,7 +16,6 @@ let headers;
  */
 export function get_public_env(request) {
 	const env = rendered_env;
-	const script = request.url.endsWith('.script.js');
 
 	payload ??= devalue.uneval(env);
 	etag ??= `W/${Date.now()}`;
@@ -29,9 +28,5 @@ export function get_public_env(request) {
 		return new Response(undefined, { status: 304, headers });
 	}
 
-	if (script) {
-		return new Response(`globalThis.__sveltekit_sw={env:${payload}}`, { headers });
-	}
-
 	return new Response(`export const env=${payload}`, { headers });
 }

package/src/runtime/server/index.js

@@ -120,7 +120,7 @@ export class Server {
 						module.handleValidationError ||
 						(({ issues }) => {
 							console.error('Remote function schema validation failed:', issues);
-							return { message: 'Bad Request' };
+							return { message: 'Bad Request', status: 400 };
 						}),
 					reroute: module.reroute || noop,
 					transport: module.transport || {}

package/src/runtime/server/page/actions.js

@@ -5,7 +5,7 @@ import { DEV } from 'esm-env';
 import { json } from '@sveltejs/kit';
 import { HttpError, Redirect, ActionFailure, SvelteKitError } from '@sveltejs/kit/internal';
 import { with_request_store, merge_tracing } from '@sveltejs/kit/internal/server';
-import { get_status, normalize_error } from '../../../utils/error.js';
+import { normalize_error } from '../../../utils/error.js';
 import { is_form_content_type, negotiate } from '../../../utils/http.js';
 import { create_replacer, handle_error_and_jsonify } from '../utils.js';
 import { record_span } from '../../telemetry/record_span.js';
@@ -36,13 +36,15 @@ export async function handle_action_json_request(event, event_state, options, se
 			`POST method not allowed. No form actions exist for ${DEV ? `the page at ${event.route.id}` : 'this page'}`
 		);
 
+		const error = await handle_error_and_jsonify(event, event_state, options, no_actions_error);
+
 		return action_json(
 			{
 				type: 'error',
-				error: await handle_error_and_jsonify(event, event_state, options, no_actions_error)
+				error
 			},
 			{
-				status: no_actions_error.status,
+				status: error.status,
 				headers: {
 					// https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/405
 					// "The server must generate an Allow header field in a 405 status code response"
@@ -62,22 +64,27 @@ export async function handle_action_json_request(event, event_state, options, se
 		}
 
 		if (data instanceof ActionFailure) {
-			return action_json({
-				type: 'failure',
-				status: data.status,
-				// @ts-expect-error we assign a string to what is supposed to be an object. That's ok
-				// because we don't use the object outside, and this way we have better code navigation
-				// through knowing where the related interface is used.
-				data: stringify_action_response(
-					data.data,
-					/** @type {string} */ (event.route.id),
-					options.hooks.transport
-				)
-			});
-		} else {
+			return action_json(
+				{
+					type: 'failure',
+					status: data.status,
+					// @ts-expect-error we assign a string to what is supposed to be an object. That's ok
+					// because we don't use the object outside, and this way we have better code navigation
+					// through knowing where the related interface is used.
+					data: stringify_action_response(
+						data.data,
+						/** @type {string} */ (event.route.id),
+						options.hooks.transport
+					)
+				},
+				{
+					status: data.status
+				}
+			);
+		} else if (data) {
 			return action_json({
 				type: 'success',
-				status: data ? 200 : 204,
+				status: 200,
 				// @ts-expect-error see comment above
 				data: stringify_action_response(
 					data,
@@ -85,6 +92,9 @@ export async function handle_action_json_request(event, event_state, options, se
 					options.hooks.transport
 				)
 			});
+		} else {
+			// no data returned — use 204 No Content (without a body, per the spec)
+			return new Response(null, { status: 204 });
 		}
 	} catch (e) {
 		const err = normalize_error(e);
@@ -93,18 +103,20 @@ export async function handle_action_json_request(event, event_state, options, se
 			return action_json_redirect(err);
 		}
 
+		const transformed = await handle_error_and_jsonify(
+			event,
+			event_state,
+			options,
+			check_incorrect_fail_use(err)
+		);
+
 		return action_json(
 			{
 				type: 'error',
-				error: await handle_error_and_jsonify(
-					event,
-					event_state,
-					options,
-					check_incorrect_fail_use(err)
-				)
+				error: transformed
 			},
 			{
-				status: get_status(err)
+				status: transformed.status
 			}
 		);
 	}
@@ -163,6 +175,7 @@ export async function handle_action_request(event, event_state, server) {
 		});
 		return {
 			type: 'error',
+			// We're lying a bit with the types here; this will be transformed into a proper App.Error object later
 			error: new SvelteKitError(
 				405,
 				'Method Not Allowed',
@@ -207,6 +220,7 @@ export async function handle_action_request(event, event_state, server) {
 
 		return {
 			type: 'error',
+			// @ts-expect-error We're lying a bit with the types here; this will be transformed into a proper App.Error object later
 			error: check_incorrect_fail_use(err)
 		};
 	}
@@ -243,11 +257,12 @@ async function call_action(event, event_state, actions) {
 		}
 	}
 
-	const action = actions[name];
-	if (!action) {
+	if (!Object.hasOwn(actions, name)) {
 		throw new SvelteKitError(404, 'Not Found', `No action with name '${name}' found`);
 	}
 
+	const action = actions[name];
+
 	if (!is_form_content_type(event.request)) {
 		throw new SvelteKitError(
 			415,

package/src/runtime/server/page/index.js

@@ -269,6 +269,7 @@ export async function render_page(
 						if (state.prerendering && should_prerender_data) {
 							const body = JSON.stringify({
 								type: 'redirect',
+								status: err.status,
 								location: err.location
 							});
 
@@ -281,8 +282,8 @@ export async function render_page(
 						return redirect_response(err.status, err.location);
 					}
 
-					const status = get_status(err);
 					const error = await handle_error_and_jsonify(event, event_state, options, err);
+					const status = error.status;
 
 					while (i--) {
 						if (page.errors[i]) {