@sveltejs/kit 3.0.0-next.6 → 3.0.0-next.7

package/src/exports/node/index.js

@@ -1,6 +1,6 @@
 import { createReadStream } from 'node:fs';
 import { Readable } from 'node:stream';
-import { SvelteKitError } from '../internal/index.js';
+import { SvelteKitError } from '../internal/shared.js';
 import { noop } from '../../utils/functions.js';
 
 /** @type {WeakMap<import('http').IncomingMessage, (chunk: Buffer) => void>} */

package/src/exports/params.js

@@ -0,0 +1,63 @@
+/**
+ * Define [parameter matchers](https://svelte.dev/docs/kit/advanced-routing#Matching) for your app.
+ *
+ * @example
+ * ```js
+ * import { defineParams } from '@sveltejs/kit';
+ * import * as v from 'valibot';
+ *
+ * export const params = defineParams({
+ * 	locale: (param) => {
+ * 		if (param !== 'de' && param !== 'en') return;
+ * 		return param;
+ * 	},
+ * 	number: v.pipe(v.string(), v.toNumber())
+ * });
+ * ```
+ *
+ * @template {Record<string, import('./public.js').ParamDefinition>} T
+ * @param {T} definitions
+ * @returns {import('./public.js').DefinedParams<T>}
+ */
+export function defineParams(definitions) {
+	/** @type {Record<string, import('./public.js').ParamMatcher>} */
+	const matchers = {};
+
+	for (const [key, definition] of Object.entries(definitions)) {
+		matchers[key] = normalize_param_definition(definition);
+	}
+
+	return /** @type {import('./public.js').DefinedParams<T>} */ (matchers);
+}
+
+/**
+ * @param {import('@sveltejs/kit').ParamDefinition} definition
+ * @returns {import('@sveltejs/kit').ParamMatcher}
+ */
+export function normalize_param_definition(definition) {
+	if (typeof definition === 'function') {
+		return /** @type {import('@sveltejs/kit').ParamMatcher} */ (
+			/** @type {unknown} */ ({
+				'~standard': {
+					validate(/** @type {unknown} */ value) {
+						const result = definition(/** @type {string} */ (value));
+
+						if (result === undefined) {
+							return { issues: [{ message: 'Invalid param' }] };
+						}
+
+						if (/** @type {any} */ (result) instanceof Promise) return result; // will be validated and rejected upstream
+
+						return { value: result };
+					}
+				}
+			})
+		);
+	}
+
+	if (definition && typeof definition === 'object' && '~standard' in definition) {
+		return definition;
+	}
+
+	throw new Error('Invalid param definition');
+}

package/src/exports/public.d.ts

@@ -23,6 +23,7 @@ import {
 import { BuildData, SSRNodeLoader, SSRRoute, ValidatedConfig } from 'types';
 import { SvelteConfig } from '@sveltejs/vite-plugin-svelte';
 import { StandardSchemaV1 } from '@standard-schema/spec';
+import { Plugin } from 'vite';
 import {
 	RouteId as AppRouteId,
 	LayoutParams as AppLayoutParams,
@@ -70,6 +71,13 @@ export interface Adapter {
 	 * during dev, build and prerendering.
 	 */
 	emulate?: () => MaybePromise<Emulator>;
+	vite?: {
+		/**
+		 * Plugins provided by the adapter are placed before any of SvelteKit's own plugins.
+		 * @since 3.0.0
+		 */
+		plugins?: Plugin[];
+	};
 }
 
 export type LoadProperties<input extends Record<string, any> | void> = input extends void
@@ -490,32 +498,6 @@ export interface KitConfig {
 	};
 	/** Experimental features. Here be dragons. These are not subject to semantic versioning, so breaking changes or removal can happen in any release. */
 	experimental?: {
-		/**
-		 * Options for enabling server-side [OpenTelemetry](https://opentelemetry.io/) tracing for SvelteKit operations including the [`handle` hook](https://svelte.dev/docs/kit/hooks#Server-hooks-handle), [`load` functions](https://svelte.dev/docs/kit/load), [form actions](https://svelte.dev/docs/kit/form-actions), and [remote functions](https://svelte.dev/docs/kit/remote-functions).
-		 * @default { server: false, serverFile: false }
-		 * @since 2.31.0
-		 */
-		tracing?: {
-			/**
-			 * Enables server-side [OpenTelemetry](https://opentelemetry.io/) span emission for SvelteKit operations including the [`handle` hook](https://svelte.dev/docs/kit/hooks#Server-hooks-handle), [`load` functions](https://svelte.dev/docs/kit/load), [form actions](https://svelte.dev/docs/kit/form-actions), and [remote functions](https://svelte.dev/docs/kit/remote-functions).
-			 * @default false
-			 * @since 2.31.0
-			 */
-			server?: boolean;
-		};
-
-		/**
-		 * @since 2.31.0
-		 */
-		instrumentation?: {
-			/**
-			 * Enables `instrumentation.server.js` for tracing and observability instrumentation.
-			 * @default false
-			 * @since 2.31.0
-			 */
-			server?: boolean;
-		};
-
 		/**
 		 * Whether to enable the experimental remote functions feature. This feature is not yet stable and may be changed or removed at any time.
 		 * @default false
@@ -719,7 +701,7 @@ export interface KitConfig {
 		 * @default undefined
 		 * @since 3.0
 		 */
-		origin?: `http://${string}` | `https://${string}`;
+		origin?: string;
 		/**
 		 * Whether to use relative asset paths.
 		 *
@@ -904,6 +886,17 @@ export interface KitConfig {
 				register?: false;
 		  }
 	);
+	/**
+	 * Options for enabling [OpenTelemetry](https://opentelemetry.io/) tracing for SvelteKit operations.
+	 * @default { server: false }
+	 */
+	tracing?: {
+		/**
+		 * Enables server-side [OpenTelemetry](https://opentelemetry.io/) span emission for SvelteKit operations including the [`handle` hook](https://svelte.dev/docs/kit/hooks#Server-hooks-handle), [`load` functions](https://svelte.dev/docs/kit/load), [form actions](https://svelte.dev/docs/kit/form-actions), and [remote functions](https://svelte.dev/docs/kit/remote-functions). Tracing — and more significantly, observability instrumentation — can have a nontrivial overhead, so consider whether you really need it, or if it might be more appropriate to turn it on in development and preview environments only.
+		 * @default false
+		 */
+		server?: boolean;
+	};
 	typescript?: {
 		/**
 		 * A function that allows you to edit the generated `tsconfig.json`. You can mutate the config (recommended) or return a new one.
@@ -1078,7 +1071,7 @@ export type Transport = Record<string, Transporter>;
  */
 export interface Transporter<
 	T = any,
-	U = Exclude<any, false | 0 | '' | null | undefined | typeof NaN>
+	U = any /* minus falsy values, but we can't properly express that */
 > {
 	encode: (value: T) => false | U;
 	decode: (data: U) => T;
@@ -1437,7 +1430,7 @@ export type AfterNavigate = (Navigation | NavigationEnter) & {
 };
 
 /**
- * The shape of the [`page`](https://svelte.dev/docs/kit/$app-state#page) reactive object and the [`$page`](https://svelte.dev/docs/kit/$app-stores) store.
+ * The shape of the [`page`](https://svelte.dev/docs/kit/$app-state#page) reactive object.
  */
 export interface Page<
 	Params extends AppLayoutParams<'/'> = AppLayoutParams<'/'>,
@@ -1485,7 +1478,64 @@ export interface Page<
 /**
  * The shape of a param matcher. See [matching](https://svelte.dev/docs/kit/advanced-routing#Matching) for more info.
  */
-export type ParamMatcher = (param: string) => boolean;
+export type ParamMatcher<Output = any> = StandardSchemaV1<string, Output>;
+
+/**
+ * A value that can be parsed from a URL param and losslessly encoded with `String(...)`.
+ */
+export type ParamValue = string | number | boolean | bigint;
+
+/**
+ * A param matcher definition passed to [`defineParams`](https://svelte.dev/docs/kit/@sveltejs-kit#defineParams).
+ */
+export type ParamDefinition =
+	| ((param: string) => ParamValue | undefined)
+	| StandardSchemaV1<string, ParamValue>;
+
+/**
+ * The return type of [`defineParams`](https://svelte.dev/docs/kit/@sveltejs-kit#defineParams).
+ */
+export type DefinedParams<T extends Record<string, ParamDefinition>> = {
+	readonly [K in keyof T]: ParamEntry<T[K]>;
+};
+
+/**
+ * Normalizes a property of defineParams (schema or function) to standard schema.
+ */
+type ParamEntry<M> =
+	M extends StandardSchemaV1<any, any>
+		? StandardSchemaV1.InferOutput<M> extends ParamValue
+			? StandardSchemaV1<any, M>
+			: StandardSchemaV1<any, never>
+		: M extends (param: string) => infer R
+			? Exclude<R, undefined> extends ParamValue
+				? StandardSchemaV1<any, Exclude<R, undefined>>
+				: StandardSchemaV1<any, never>
+			: never;
+
+/**
+ * Extracts the param type from a matcher.
+ */
+export type MatcherParam<M extends StandardSchemaV1<any, any>> =
+	M extends StandardSchemaV1<any, infer Inner>
+		? Inner extends ParamValue
+			? Inner
+			: Inner extends StandardSchemaV1<any, any>
+				? StandardSchemaV1.InferOutput<Inner> extends ParamValue
+					? StandardSchemaV1.InferOutput<Inner>
+					: never
+				: never
+		: never;
+
+/**
+ * Define [parameter matchers](https://svelte.dev/docs/kit/advanced-routing#Matching) for your app.
+ *
+ * @template T
+ * @param definitions
+ */
+export function defineParams<T extends Record<string, ParamDefinition>>(
+	definitions: T
+): DefinedParams<T>;
 
 /**
  * A single entry yielded by [`requested`](https://svelte.dev/docs/kit/$app-server#requested)
@@ -2284,8 +2334,8 @@ export type RemoteQueryUpdate =
 	| RemoteQueryOverride;
 
 export type RemoteResource<T> = Promise<T> & {
-	/** The error in case the query fails. Most often this is a [`HttpError`](https://svelte.dev/docs/kit/@sveltejs-kit#HttpError) but it isn't guaranteed to be. */
-	get error(): any;
+	/** The error in case the query fails. */
+	get error(): App.Error | undefined;
 	/** `true` before the first result is available and during refreshes */
 	get loading(): boolean;
 } & (

package/src/exports/url.js

@@ -0,0 +1,84 @@
+import { DEV } from 'esm-env';
+// we use the export subpath to conditionally import the client/server `get_origin`
+// so that `node:async_hooks` isn't pulled into the client build
+import { get_origin } from '#internal';
+import { matches_external_allowlist_entry } from '../utils/url.js';
+
+// See https://datatracker.ietf.org/doc/html/rfc2606 - no domains under the .invalid TLD can be registered
+const REDIRECT_BASE = 'https://sveltekit-redirect.invalid';
+
+/**
+ * Whether a redirect location is absolute, i.e. not a root-relative or path-relative URL,
+ * and not pointing to the same origin as we're currently on (if determineable).
+ * @param {string} location
+ */
+export function is_external_location(location) {
+	const origin = get_origin();
+
+	try {
+		return !matches_external_allowlist_entry(location, origin ?? REDIRECT_BASE);
+	} catch {
+		return true;
+	}
+}
+
+/**
+ * @param {string} location
+ */
+function is_javascript_location(location) {
+	try {
+		return new URL(location, REDIRECT_BASE).protocol === 'javascript:';
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * @param {string} location
+ * @param {{ external?: boolean | string[] }} [options]
+ */
+export function validate_redirect_location(location, options) {
+	if (!is_external_location(location)) return;
+
+	const external = options?.external;
+
+	if (!external) {
+		throw new Error(
+			DEV
+				? `Cannot redirect to external URL ${JSON.stringify(location)}. ` +
+						'To redirect to an external URL, pass `{ external: true }` or an allowlist of permitted origins as the third argument to `redirect`'
+				: 'Cannot redirect to external URL unless explicitly allowed'
+		);
+	}
+
+	if (external === true) {
+		if (is_javascript_location(location)) {
+			throw new Error(
+				DEV
+					? `Cannot redirect to ${JSON.stringify(location)} with \`{ external: true }\`. ` +
+							'The `:javascript` protocol must be explicitly listed in the `external` allowlist'
+					: 'Cannot redirect to external URL unless explicitly allowed'
+			);
+		}
+
+		return;
+	}
+
+	if (Array.isArray(external)) {
+		if (!external.some((allowed) => matches_external_allowlist_entry(location, allowed))) {
+			throw new Error(
+				DEV
+					? `Cannot redirect to ${JSON.stringify(location)}: URL origin is not included in the \`external\` allowlist`
+					: 'Cannot redirect to external URL unless explicitly allowed'
+			);
+		}
+
+		return;
+	}
+
+	throw new Error(
+		DEV
+			? '`redirect` options.external must be `true` or an array of allowed origins'
+			: 'Invalid redirect options.external value'
+	);
+}

package/src/exports/vite/dev/index.js

@@ -10,12 +10,14 @@ import { isCSSRequest, loadEnv, buildErrorMessage } from 'vite';
 import { createReadableStream, getRequest, setResponse } from '../../../exports/node/index.js';
 import { coalesce_to_error } from '../../../utils/error.js';
 import { resolve_entry } from '../../../utils/filesystem.js';
+import { load_and_validate_params } from '../../../utils/params.js';
 import { from_fs, to_fs } from '../../../utils/vite.js';
 import { posixify } from '../../../utils/os.js';
 import { load_error_page } from '../../../core/config/index.js';
 import { SVELTE_KIT_ASSETS } from '../../../constants.js';
 import * as sync from '../../../core/sync/sync.js';
 import { get_mime_lookup, get_runtime_base } from '../../../core/utils.js';
+import '../../../utils/mime.js'; // extend mrmime with additional types (affects sirv too)
 import { compact } from '../../../utils/array.js';
 import { is_chrome_devtools_request, not_found } from '../utils.js';
 import { SCHEME } from '../../../utils/url.js';
@@ -83,6 +85,10 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root) {
 				vite.config.logger.error(msg, { error: err });
 			}
 
+			// TODO this is inadequate — it doesn't reliably show the overlay on every page load,
+			// and when it does appear it may immediately vanish. `vite.ws.send` broadcasts
+			// to all connected clients, even ones that are unaffected by the error.
+			// we need a more considered approach
 			vite.ws.send({
 				type: 'error',
 				err: /** @type {import('vite').ErrorPayload['err']} */ ({
@@ -110,10 +116,17 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root) {
 		return { module, module_node, url };
 	}
 
-	function update_manifest() {
+	async function update_manifest() {
 		try {
 			({ manifest_data } = sync.create(svelte_config, root));
 
+			await load_and_validate_params({
+				routes: manifest_data.routes,
+				params_path: manifest_data.params,
+				root,
+				load: (file) => loud_ssr_load_module(file)
+			});
+
 			if (manifest_error) {
 				manifest_error = null;
 				vite.ws.send({ type: 'full-reload' });
@@ -292,22 +305,18 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root) {
 					})
 				),
 				matchers: async () => {
-					/** @type {Record<string, import('@sveltejs/kit').ParamMatcher>} */
-					const matchers = {};
-
-					for (const key in manifest_data.matchers) {
-						const file = manifest_data.matchers[key];
-						const url = path.resolve(root, file);
-						const module = await vite.ssrLoadModule(url, { fixStacktrace: true });
-
-						if (module.match) {
-							matchers[key] = module.match;
-						} else {
-							throw new Error(`${file} does not export a \`match\` function`);
-						}
+					if (!manifest_data.params) return {};
+
+					const url = path.resolve(root, manifest_data.params);
+					const module = await vite.ssrLoadModule(url, { fixStacktrace: true });
+
+					if (!module.params) {
+						throw new Error(
+							`${manifest_data.params} does not export \`params\` from \`defineParams\``
+						);
 					}
 
-					return matchers;
+					return module.params;
 				}
 			}
 		};
@@ -324,7 +333,9 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root) {
 		return error.stack?.replaceAll('\0', ''); // remove null bytes from e.g. virtual module IDs, or the response will fail
 	}
 
-	update_manifest();
+	await update_manifest();
+
+	const params_file = resolve_entry(svelte_config.kit.files.params);
 
 	/**
 	 * @param {string} event
@@ -334,7 +345,7 @@ export async function dev(vite, vite_config, svelte_config, get_remotes, root) {
 		vite.watcher.on(event, (file) => {
 			if (
 				file.startsWith(svelte_config.kit.files.routes + path.sep) ||
-				file.startsWith(svelte_config.kit.files.params + path.sep) ||
+				(params_file && file === params_file) ||
 				svelte_config.kit.moduleExtensions.some((ext) => file.endsWith(`.remote${ext}`)) ||
 				// in contrast to server hooks, client hooks are written to the client manifest
 				// and therefore need rebuilding when they are added/removed