@sveltejs/kit 3.0.0-next.4 → 3.0.0-next.7

package/src/runtime/server/cookie.js

@@ -1,4 +1,4 @@
-import { parse, serialize } from 'cookie';
+import { parseCookie, parseSetCookie, stringifySetCookie } from 'cookie';
 import { DEV } from 'esm-env';
 import { normalize_path, resolve } from '../../utils/url.js';
 import { add_data_suffix } from '../pathname.js';
@@ -39,7 +39,7 @@ function generate_cookie_key(domain, path, name) {
 export function get_cookies(request, url) {
 	const header = request.headers.get('cookie') ?? '';
 	const initial_cookies = /** @type {Record<string, string>} */ (
-		parse(header, { decode: (value) => value })
+		parseCookie(header, { decode: (value) => value })
 	);
 
 	/** @type {string | undefined} */
@@ -48,7 +48,7 @@ export function get_cookies(request, url) {
 	/** @type {Map<string, import('./page/types.js').Cookie>} */
 	const new_cookies = new Map();
 
-	/** @type {import('cookie').SerializeOptions} */
+	/** @type {Omit<import('cookie').SetCookie, 'name' | 'value'>} */
 	const defaults = {
 		httpOnly: true,
 		path: '/',
@@ -63,10 +63,6 @@ export function get_cookies(request, url) {
 		// typescript users. `@type {import('@sveltejs/kit').Cookies}` above is not
 		// sufficient to do so.
 
-		/**
-		 * @param {string} name
-		 * @param {import('cookie').ParseOptions} [opts]
-		 */
 		get(name, opts) {
 			// Look for the most specific matching cookie from new_cookies
 			const best_match = Array.from(new_cookies.values())
@@ -83,7 +79,7 @@ export function get_cookies(request, url) {
 				return best_match.options.maxAge === 0 ? undefined : best_match.value;
 			}
 
-			const req_cookies = parse(header, { decode: opts?.decode });
+			const req_cookies = parseCookie(header, { decode: opts?.decode });
 			const cookie = req_cookies[name]; // the decoded string or undefined
 
 			// in development, if the cookie was set during this session with `cookies.set`,
@@ -106,11 +102,8 @@ export function get_cookies(request, url) {
 			return cookie;
 		},
 
-		/**
-		 * @param {import('cookie').ParseOptions} [opts]
-		 */
 		getAll(opts) {
-			const cookies = parse(header, { decode: opts?.decode });
+			const cookies = parseCookie(header, { decode: opts?.decode });
 
 			// Group cookies by name and find the most specific one for each name
 			const lookup = new Map();
@@ -141,29 +134,17 @@ export function get_cookies(request, url) {
 			);
 		},
 
-		/**
-		 * @param {string} name
-		 * @param {string} value
-		 * @param {import('cookie').SerializeOptions} options
-		 */
 		set(name, value, options) {
 			set_internal(name, value, { ...defaults, ...options });
 		},
 
-		/**
-		 * @param {string} name
-		 * @param {import('cookie').SerializeOptions} options
-		 */
 		delete(name, options) {
 			cookies.set(name, '', { ...options, maxAge: 0 });
 		},
 
-		/**
-		 * @param {string} name
-		 * @param {string} value
-		 * @param {import('cookie').SerializeOptions} options
-		 */
-		serialize(name, value, options) {
+		parse: parseSetCookie,
+
+		serialize(name, value, { encode, ...options }) {
 			let path = options.path ?? '/';
 
 			if (!options.domain || options.domain === url.hostname) {
@@ -173,7 +154,7 @@ export function get_cookies(request, url) {
 				path = resolve(normalized_url, path);
 			}
 
-			return serialize(name, value, { ...defaults, ...options, path });
+			return stringifySetCookie({ name, value, ...defaults, ...options, path }, { encode });
 		}
 	};
 
@@ -200,7 +181,7 @@ export function get_cookies(request, url) {
 		// explicit header has highest precedence
 		if (header) {
 			const parsed = /** @type {Record<string, string>} */ (
-				parse(header, { decode: (value) => value })
+				parseCookie(header, { decode: (value) => value })
 			);
 			for (const name in parsed) {
 				combined_cookies[name] = parsed[name];
@@ -238,7 +219,8 @@ export function get_cookies(request, url) {
 		new_cookies.set(cookie_key, cookie);
 
 		if (DEV) {
-			const serialized = serialize(name, value, cookie.options);
+			const { encode, ...rest } = cookie.options;
+			const serialized = stringifySetCookie({ name, value, ...rest }, { encode });
 			if (text_encoder.encode(serialized).byteLength > MAX_COOKIE_SIZE) {
 				throw new Error(`Cookie "${name}" is too large, and will be discarded by the browser`);
 			}
@@ -296,15 +278,22 @@ export function path_matches(path, constraint) {
  */
 export function add_cookies_to_headers(headers, cookies) {
 	for (const new_cookie of cookies) {
-		const { name, value, options } = new_cookie;
-		headers.append('set-cookie', serialize(name, value, options));
+		const {
+			name,
+			value,
+			options: { encode, ...options }
+		} = new_cookie;
+		headers.append('set-cookie', stringifySetCookie({ name, value, ...options }, { encode }));
 
 		// special case — for routes ending with .html, the route data lives in a sibling
 		// `.html__data.json` file rather than a child `/__data.json` file, which means
 		// we need to duplicate the cookie
 		if (options.path.endsWith('.html')) {
 			const path = add_data_suffix(options.path);
-			headers.append('set-cookie', serialize(name, value, { ...options, path }));
+			headers.append(
+				'set-cookie',
+				stringifySetCookie({ name, value, ...options, path }, { encode })
+			);
 		}
 	}
 }

package/src/runtime/server/csrf.js

@@ -0,0 +1,65 @@
+import { is_form_content_type } from '../../utils/http.js';
+
+const mutating_form_methods = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+
+/**
+ * The origin SvelteKit treats as "self" when validating the `Origin` header on
+ * cross-site requests.
+ *
+ * By default (`paths.origin` is `undefined`), SvelteKit derives the origin
+ * from `request.url` (which is set by the adapter, and ultimately by the
+ * platform). When `paths.origin` is configured — for example so that a preview
+ * deployment whose URL isn't known at build time, or an app behind a reverse
+ * proxy, can declare a canonical origin — that value takes precedence.
+ *
+ * @param {string | undefined} paths_origin the configured `kit.paths.origin`
+ * @param {string} url_origin the origin derived from `request.url`
+ * @returns {string}
+ */
+export function get_self_origin(paths_origin, url_origin) {
+	return paths_origin || url_origin;
+}
+
+/**
+ * Determines whether a non-remote request should be rejected as a cross-site
+ * form submission (CSRF). Used by `respond.js` to gate form `POST`/`PUT`/
+ * `PATCH`/`DELETE` requests whose `Origin` header doesn't match the app's
+ * self-origin (and isn't in `trusted_origins`).
+ *
+ * @param {{
+ *   request: Request;
+ *   request_origin: string | null;
+ *   self_origin: string;
+ *   trusted_origins: string[];
+ * }} input
+ * @returns {boolean}
+ */
+export function is_csrf_forbidden({ request, request_origin, self_origin, trusted_origins }) {
+	return (
+		is_form_content_type(request) &&
+		mutating_form_methods.has(request.method) &&
+		request_origin !== self_origin &&
+		(!request_origin || !trusted_origins.includes(request_origin))
+	);
+}
+
+/**
+ * Determines whether a remote-function request should be rejected as cross-site.
+ *
+ * Unlike form submissions, remote functions accept any content type (e.g.
+ * `application/json`), so the check is solely on the request method and origin:
+ * a non-`GET` request is forbidden when its `Origin` header doesn't match the
+ * app's self-origin. Unlike `is_csrf_forbidden`, entries in `trusted_origins`
+ * are *not* honoured — remote function endpoints are an implementation detail,
+ * not a public API, so cross-origin calls are forbidden regardless.
+ *
+ * @param {{
+ *   request: Request;
+ *   request_origin: string | null;
+ *   self_origin: string;
+ * }} input
+ * @returns {boolean}
+ */
+export function is_remote_forbidden({ request, request_origin, self_origin }) {
+	return request.method !== 'GET' && request_origin !== self_origin;
+}

package/src/runtime/server/data/index.js

@@ -1,5 +1,5 @@
 import { text } from '@sveltejs/kit';
-import { HttpError, SvelteKitError, Redirect } from '@sveltejs/kit/internal';
+import { Redirect } from '@sveltejs/kit/internal';
 import { normalize_error } from '../../../utils/error.js';
 import { once } from '../../../utils/functions.js';
 import { server_data_serializer_json } from '../page/data_serializer.js';
@@ -107,13 +107,11 @@ export async function render_data(
 					// Math.min because array isn't guaranteed to resolve in order
 					length = Math.min(length, i + 1);
 
+					const transformed = await handle_error_and_jsonify(event, event_state, options, error);
+
 					return /** @type {import('types').ServerErrorNode} */ ({
 						type: 'error',
-						error: await handle_error_and_jsonify(event, event_state, options, error),
-						status:
-							error instanceof HttpError || error instanceof SvelteKitError
-								? error.status
-								: undefined
+						error: transformed
 					});
 				})
 			)
@@ -156,7 +154,8 @@ export async function render_data(
 		if (error instanceof Redirect) {
 			return redirect_json_response(error);
 		} else {
-			return json_response(await handle_error_and_jsonify(event, event_state, options, error), 500);
+			const transformed = await handle_error_and_jsonify(event, event_state, options, error);
+			return json_response(transformed, transformed.status);
 		}
 	}
 }
@@ -182,6 +181,7 @@ export function redirect_json_response(redirect) {
 	return json_response(
 		/** @type {import('types').ServerRedirectNode} */ ({
 			type: 'redirect',
+			status: redirect.status,
 			location: redirect.location
 		})
 	);

package/src/runtime/server/env_module.js

@@ -16,7 +16,6 @@ let headers;
  */
 export function get_public_env(request) {
 	const env = rendered_env;
-	const script = request.url.endsWith('.script.js');
 
 	payload ??= devalue.uneval(env);
 	etag ??= `W/${Date.now()}`;
@@ -29,9 +28,5 @@ export function get_public_env(request) {
 		return new Response(undefined, { status: 304, headers });
 	}
 
-	if (script) {
-		return new Response(`globalThis.__sveltekit_sw={env:${payload}}`, { headers });
-	}
-
 	return new Response(`export const env=${payload}`, { headers });
 }

package/src/runtime/server/index.js

@@ -27,7 +27,7 @@ export class Server {
 		this.#manifest = manifest;
 
 		// Since AsyncLocalStorage is not working in webcontainers, we don't reset `sync_store`
-		// in `src/exports/internal/event.js` and handle only one request at a time.
+		// in `src/exports/internal/server/event.js` and handle only one request at a time.
 		if (IN_WEBCONTAINER) {
 			const respond = this.respond.bind(this);
 
@@ -120,7 +120,7 @@ export class Server {
 						module.handleValidationError ||
 						(({ issues }) => {
 							console.error('Remote function schema validation failed:', issues);
-							return { message: 'Bad Request' };
+							return { message: 'Bad Request', status: 400 };
 						}),
 					reroute: module.reroute || noop,
 					transport: module.transport || {}

package/src/runtime/server/page/actions.js

@@ -5,7 +5,7 @@ import { DEV } from 'esm-env';
 import { json } from '@sveltejs/kit';
 import { HttpError, Redirect, ActionFailure, SvelteKitError } from '@sveltejs/kit/internal';
 import { with_request_store, merge_tracing } from '@sveltejs/kit/internal/server';
-import { get_status, normalize_error } from '../../../utils/error.js';
+import { normalize_error } from '../../../utils/error.js';
 import { is_form_content_type, negotiate } from '../../../utils/http.js';
 import { create_replacer, handle_error_and_jsonify } from '../utils.js';
 import { record_span } from '../../telemetry/record_span.js';
@@ -36,13 +36,15 @@ export async function handle_action_json_request(event, event_state, options, se
 			`POST method not allowed. No form actions exist for ${DEV ? `the page at ${event.route.id}` : 'this page'}`
 		);
 
+		const error = await handle_error_and_jsonify(event, event_state, options, no_actions_error);
+
 		return action_json(
 			{
 				type: 'error',
-				error: await handle_error_and_jsonify(event, event_state, options, no_actions_error)
+				error
 			},
 			{
-				status: no_actions_error.status,
+				status: error.status,
 				headers: {
 					// https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/405
 					// "The server must generate an Allow header field in a 405 status code response"
@@ -62,22 +64,27 @@ export async function handle_action_json_request(event, event_state, options, se
 		}
 
 		if (data instanceof ActionFailure) {
-			return action_json({
-				type: 'failure',
-				status: data.status,
-				// @ts-expect-error we assign a string to what is supposed to be an object. That's ok
-				// because we don't use the object outside, and this way we have better code navigation
-				// through knowing where the related interface is used.
-				data: stringify_action_response(
-					data.data,
-					/** @type {string} */ (event.route.id),
-					options.hooks.transport
-				)
-			});
-		} else {
+			return action_json(
+				{
+					type: 'failure',
+					status: data.status,
+					// @ts-expect-error we assign a string to what is supposed to be an object. That's ok
+					// because we don't use the object outside, and this way we have better code navigation
+					// through knowing where the related interface is used.
+					data: stringify_action_response(
+						data.data,
+						/** @type {string} */ (event.route.id),
+						options.hooks.transport
+					)
+				},
+				{
+					status: data.status
+				}
+			);
+		} else if (data) {
 			return action_json({
 				type: 'success',
-				status: data ? 200 : 204,
+				status: 200,
 				// @ts-expect-error see comment above
 				data: stringify_action_response(
 					data,
@@ -85,6 +92,9 @@ export async function handle_action_json_request(event, event_state, options, se
 					options.hooks.transport
 				)
 			});
+		} else {
+			// no data returned — use 204 No Content (without a body, per the spec)
+			return new Response(null, { status: 204 });
 		}
 	} catch (e) {
 		const err = normalize_error(e);
@@ -93,18 +103,20 @@ export async function handle_action_json_request(event, event_state, options, se
 			return action_json_redirect(err);
 		}
 
+		const transformed = await handle_error_and_jsonify(
+			event,
+			event_state,
+			options,
+			check_incorrect_fail_use(err)
+		);
+
 		return action_json(
 			{
 				type: 'error',
-				error: await handle_error_and_jsonify(
-					event,
-					event_state,
-					options,
-					check_incorrect_fail_use(err)
-				)
+				error: transformed
 			},
 			{
-				status: get_status(err)
+				status: transformed.status
 			}
 		);
 	}
@@ -163,6 +175,7 @@ export async function handle_action_request(event, event_state, server) {
 		});
 		return {
 			type: 'error',
+			// We're lying a bit with the types here; this will be transformed into a proper App.Error object later
 			error: new SvelteKitError(
 				405,
 				'Method Not Allowed',
@@ -207,6 +220,7 @@ export async function handle_action_request(event, event_state, server) {
 
 		return {
 			type: 'error',
+			// @ts-expect-error We're lying a bit with the types here; this will be transformed into a proper App.Error object later
 			error: check_incorrect_fail_use(err)
 		};
 	}
@@ -243,11 +257,12 @@ async function call_action(event, event_state, actions) {
 		}
 	}
 
-	const action = actions[name];
-	if (!action) {
+	if (!Object.hasOwn(actions, name)) {
 		throw new SvelteKitError(404, 'Not Found', `No action with name '${name}' found`);
 	}
 
+	const action = actions[name];
+
 	if (!is_form_content_type(event.request)) {
 		throw new SvelteKitError(
 			415,

package/src/runtime/server/page/index.js

@@ -269,6 +269,7 @@ export async function render_page(
 						if (state.prerendering && should_prerender_data) {
 							const body = JSON.stringify({
 								type: 'redirect',
+								status: err.status,
 								location: err.location
 							});
 
@@ -281,8 +282,8 @@ export async function render_page(
 						return redirect_response(err.status, err.location);
 					}
 
-					const status = get_status(err);
 					const error = await handle_error_and_jsonify(event, event_state, options, err);
+					const status = error.status;
 
 					while (i--) {
 						if (page.errors[i]) {

package/src/runtime/server/page/load_data.js

@@ -377,7 +377,7 @@ export function create_universal_fetch(event, state, fetched, csr, resolve_opts)
 						}
 
 						void push_fetched(base64_encode(result), true);
-					})();
+					})().catch(noop); // prevent unhandled rejection potentially crashing the process
 
 					return (teed_body = b);
 				}

package/src/runtime/server/page/render.js

@@ -11,7 +11,7 @@ import { uneval_action_response } from './actions.js';
 import { SVELTE_KIT_ASSETS } from '../../../constants.js';
 import { SCHEME } from '../../../utils/url.js';
 import { create_server_routing_response, generate_route_object } from './server_routing.js';
-import { add_resolution_suffix } from '../../pathname.js';
+import { add_data_suffix, add_resolution_suffix } from '../../pathname.js';
 import { try_get_request_store, with_request_store } from '@sveltejs/kit/internal/server';
 import { text_encoder } from '../../utils.js';
 import {
@@ -20,7 +20,6 @@ import {
 	get_global_name,
 	handle_error_and_jsonify
 } from '../utils.js';
-import { get_status } from '../../../utils/error.js';
 import * as env from '__sveltekit/env';
 import { collect_remote_data } from '../remote.js';
 
@@ -68,7 +67,7 @@ export async function render_response({
 }) {
 	if (state.prerendering) {
 		if (options.csp.mode === 'nonce') {
-			throw new Error('Cannot use prerendering if config.kit.csp.mode === "nonce"');
+			throw new Error('Cannot use prerendering if config.csp.mode === "nonce"');
 		}
 
 		if (options.app_template_contains_nonce) {
@@ -92,7 +91,7 @@ export async function render_response({
 	// TODO if we add a client entry point one day, we will need to include inline_styles with the entry, otherwise stylesheets will be linked even if they are below inlineStyleThreshold
 	const inline_styles = new Map();
 
-	/** @type {ReturnType<typeof options.root.render>} */
+	/** @type {Awaited<ReturnType<typeof options.root.render>>} */
 	let rendered;
 
 	const form_value =
@@ -119,7 +118,12 @@ export async function render_response({
 	// if appropriate, use relative paths for greater portability
 	if (paths.relative) {
 		if (!state.prerendering?.fallback) {
-			const segments = event.url.pathname.slice(paths.base.length).split('/').slice(2);
+			// the relative path depth must reflect the URL the browser is actually at, which
+			// for a data request includes the `__data.json` suffix that was stripped during routing
+			const pathname = event.isDataRequest
+				? add_data_suffix(event.url.pathname)
+				: event.url.pathname;
+			const segments = pathname.slice(paths.base.length).split('/').slice(2);
 
 			base = segments.map(() => '..').join('/') || '.';
 
@@ -200,7 +204,7 @@ export async function render_response({
 
 						const transformed = await handle_error_and_jsonify(event, event_state, options, e);
 						props.page.error = props.error = error = transformed;
-						props.page.status = status = get_status(e);
+						props.page.status = status = transformed.status;
 						return transformed;
 					}
 				: undefined
@@ -234,36 +238,27 @@ export async function render_response({
 				// portable as possible, but reset afterwards
 				if (paths.relative) paths.override({ base, assets });
 
-				const maybe_promise = options.root.render(props, render_opts);
 				// We have to invoke .then eagerly here in order to kick off rendering: it's only starting on access,
 				// and `await maybe_promise` would eagerly access the .then property but call its function only after a tick, which is too late
 				// for the paths.reset() below and for any eager getRequestEvent() calls during rendering without AsyncLocalStorage available.
-				const rendered =
-					options.async && 'then' in maybe_promise
-						? /** @type {ReturnType<typeof options.root.render> & Promise<any>} */ (
-								maybe_promise
-							).then((r) => r)
-						: maybe_promise;
-
-				// TODO 3.0 remove options.async
-				if (options.async) {
-					// we reset this synchronously, rather than after async rendering is complete,
-					// to avoid cross-talk between requests. This is a breaking change for
-					// anyone who opts into async SSR, since `base` and `assets` will no
-					// longer be relative to the current pathname.
-					// TODO 3.0 remove `base` and `assets` in favour of `resolve(...)` and `asset(...)`
-					paths.reset();
-				}
+				// TODO use render from 'svelte/server' here
+				const rendered = options.root.render(props, render_opts).then((r) => r);
 
-				const { head, html, css, hashes } = /** @type {ReturnType<typeof options.root.render>} */ (
-					options.async ? await rendered : rendered
-				);
+				// we reset this synchronously, rather than after async rendering is complete,
+				// to avoid cross-talk between requests. This is a breaking change for
+				// anyone who opts into async SSR, since `base` and `assets` will no
+				// longer be relative to the current pathname.
+				// TODO 3.0 remove `base` and `assets` in favour of `resolve(...)` and `asset(...)`
+				paths.reset();
+
+				// @ts-expect-error the legacy `render` API only returns html still, but the new API uses body
+				const { head, html: body, css, hashes } = await rendered;
 
 				if (hashes) {
 					csp.add_script_hashes(hashes.script);
 				}
 
-				return { head, html, css, hashes };
+				return { head, body, css, hashes };
 			});
 		} finally {
 			if (DEV) {
@@ -273,7 +268,7 @@ export async function render_response({
 			paths.reset(); // just in case `options.root.render(...)` failed
 		}
 	} else {
-		rendered = { head: '', html: '', css: { code: '', map: null }, hashes: { script: [] } };
+		rendered = { head: '', body: '', css: { code: '', map: null }, hashes: { script: [] } };
 	}
 
 	for (const { node } of branch) {
@@ -294,7 +289,7 @@ export async function render_response({
 	}
 
 	const head = new Head(rendered.head);
-	let body = rendered.html;
+	let body = rendered.body;
 
 	/** @param {string} path */
 	const prefixed = (path) => {
@@ -374,7 +369,13 @@ export async function render_response({
 	if (page_config.csr && client) {
 		const route = client.routes?.find((r) => r.id === event.route.id) ?? null;
 
-		if (client.uses_env_dynamic_public && state.prerendering) {
+		// when serving a prerendered page in an app that uses runtime public env vars, we must
+		// import the env.js module so that it evaluates before any user code can evaluate.
+		// TODO revert to using top-level await once https://bugs.webkit.org/show_bug.cgi?id=242740 is fixed
+		// https://github.com/sveltejs/kit/pull/11601
+		const load_env_eagerly = client.uses_env_dynamic_public && !!state.prerendering;
+
+		if (load_env_eagerly) {
 			modulepreloads.add(`${paths.app_dir}/env.js`);
 		}
 
@@ -386,7 +387,7 @@ export async function render_response({
 			/** @type {(path: string) => void} */
 			let add_preload;
 
-			// see the kit.output.preloadStrategy option for details on why we have multiple options here
+			// see the output.preloadStrategy option for details on why we have multiple options here
 			if (options.link_header_preload && !state.prerendering) {
 				add_preload = (path) =>
 					link_headers.add(`<${encodeURI(path)}>; rel="modulepreload"; nopush`);
@@ -411,12 +412,6 @@ export async function render_response({
 
 		const blocks = [];
 
-		// when serving a prerendered page in an app that uses $app/env/public, we must
-		// import the env.js module so that it evaluates before any user code can evaluate.
-		// TODO revert to using top-level await once https://bugs.webkit.org/show_bug.cgi?id=242740 is fixed
-		// https://github.com/sveltejs/kit/pull/11601
-		const load_env_eagerly = client.uses_env_dynamic_public && state.prerendering; // TODO implement uses_env_dynamic_public
-
 		const properties = [`base: ${base_expression}`];
 
 		if (paths.assets) {
@@ -438,7 +433,7 @@ export async function render_response({
 
 			if (Object.keys(options.hooks.transport).length > 0) {
 				if (client.inline) {
-					app_declaration = `const app = __sveltekit_${options.version_hash}.app.app;`;
+					app_declaration = `const app = ${global}.app.app;`;
 				} else if (client.app) {
 					app_declaration = `const app = await import(${s(prefixed(client.app))});`;
 				} else {
@@ -501,7 +496,7 @@ export async function render_response({
 				`error: ${serialized.error}`
 			];
 
-			if (status !== 200) {
+			if (status !== 200 && !error) {
 				hydrate.push(`status: ${status}`);
 			}
 
@@ -555,12 +550,9 @@ export async function render_response({
 		}
 
 		if (options.service_worker) {
-			let opts = __SVELTEKIT_DEV__ ? ", { type: 'module' }" : '';
+			let opts = ", { type: 'module' }";
 			if (options.service_worker_options != null) {
-				const service_worker_options = { ...options.service_worker_options };
-				if (__SVELTEKIT_DEV__) {
-					service_worker_options.type = 'module';
-				}
+				const service_worker_options = { ...options.service_worker_options, type: 'module' };
 				opts = `, ${s(service_worker_options)}`;
 			}
 
@@ -579,11 +571,8 @@ export async function render_response({
 					}`);
 		}
 
-		// we need to eagerly import the Vite client module in development to ensure
-		// that Vite global constant replacements are initialised before our code runs
 		const init_app = `
 				{
-					${DEV ? `import('${paths.base}/@vite/client')` : ''}
 					${blocks.join('\n\n\t\t\t\t\t')}
 				}
 			`;