@sveltejs/kit 3.0.0-next.6 → 3.0.0-next.7

package/src/utils/params.js

@@ -0,0 +1,66 @@
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+/**
+ * @param {import('types').RouteData[]} routes
+ * @returns {Set<string>}
+ */
+export function collect_matcher_names(routes) {
+	/** @type {Set<string>} */
+	const names = new Set();
+
+	for (const route of routes) {
+		for (const param of route.params) {
+			if (param.matcher) names.add(param.matcher);
+		}
+	}
+
+	return names;
+}
+
+/**
+ * @param {Record<string, unknown>} params
+ * @param {Set<string>} names
+ * @param {string} [file]
+ */
+export function validate_param_matchers(params, names, file) {
+	for (const name of names) {
+		if (!(name in params)) {
+			throw new Error(`No matcher found for parameter '${name}'${file ? ` in ${file}` : ''}`);
+		}
+	}
+}
+
+/**
+ * @param {{
+ *   routes: import('types').RouteData[];
+ *   params_path: string | null;
+ *   root: string;
+ *   load?: (file: string) => Promise<Record<string, unknown>>;
+ * }} opts
+ * @returns {Promise<Record<string, import('@sveltejs/kit').ParamMatcher> | null>}
+ */
+export async function load_and_validate_params({ routes, params_path, root, load }) {
+	const names = collect_matcher_names(routes);
+
+	if (names.size === 0) return null;
+
+	if (!params_path) {
+		throw new Error(`No matcher found for parameter '${names.values().next().value}'`);
+	}
+
+	const file = path.resolve(root, params_path);
+	const module = load ? await load(file) : await import(pathToFileURL(file).href);
+
+	if (!module.params || typeof module.params !== 'object') {
+		throw new Error(`${params_path} does not export \`params\` from \`defineParams\``);
+	}
+
+	validate_param_matchers(
+		/** @type {Record<string, unknown>} */ (module.params),
+		names,
+		params_path
+	);
+
+	return /** @type {Record<string, import('@sveltejs/kit').ParamMatcher>} */ (module.params);
+}

package/src/utils/routing.js

@@ -1,5 +1,4 @@
 import { BROWSER } from 'esm-env';
-import { decode_params } from './url.js';
 
 const param_pattern = /^(\[)?(\.\.\.)?(\w+)(?:=(\w+))?(\])?$/;
 
@@ -134,13 +133,43 @@ export function get_route_segments(route) {
 	return route.slice(1).split('/').filter(affects_path);
 }
 
+/**
+ * @param {import('@sveltejs/kit').ParamMatcher} matcher
+ * @param {string} value
+ * @returns {{ success: true, value: any } | { success: false }}
+ */
+function run_matcher(matcher, value) {
+	const result = matcher['~standard'].validate(value);
+
+	if (result instanceof Promise) {
+		throw new Error('Async param matchers are not supported');
+	}
+
+	if (result.issues) {
+		return { success: false };
+	}
+
+	const parsed = result.value;
+
+	if (
+		typeof parsed !== 'string' &&
+		typeof parsed !== 'number' &&
+		typeof parsed !== 'boolean' &&
+		typeof parsed !== 'bigint'
+	) {
+		throw new Error('Param matcher must return a string, number, boolean, or bigint');
+	}
+
+	return { success: true, value: parsed };
+}
+
 /**
  * @param {RegExpMatchArray} match
  * @param {import('types').RouteParam[]} params
  * @param {Record<string, import('@sveltejs/kit').ParamMatcher>} matchers
  */
 export function exec(match, params, matchers) {
-	/** @type {Record<string, string>} */
+	/** @type {Record<string, any>} */
 	const result = {};
 
 	const values = match.slice(1);
@@ -173,37 +202,41 @@ export function exec(match, params, matchers) {
 			}
 		}
 
-		if (!param.matcher || matchers[param.matcher](value)) {
-			result[param.name] = value;
+		const decoded = decodeURIComponent(value);
 
-			// Now that the params match, reset the buffer if the next param isn't the [...rest]
-			// and the next value is defined, otherwise the buffer will cause us to skip values
-			const next_param = params[i + 1];
-			const next_value = values[i + 1];
-			if (next_param && !next_param.rest && next_param.optional && next_value && param.chained) {
-				buffered = 0;
-			}
+		if (param.matcher) {
+			const outcome = run_matcher(matchers[param.matcher], decoded);
+
+			if (!outcome.success) {
+				// in the `/[[a=b]]/...` case, if the value didn't satisfy the matcher,
+				// keep track of the number of skipped optional parameters and continue
+				if (param.optional && param.chained) {
+					buffered++;
+					continue;
+				}
 
-			// There are no more params and no more values, but all non-empty values have been matched
-			if (
-				!next_param &&
-				!next_value &&
-				Object.keys(result).length === values_needing_match.length
-			) {
-				buffered = 0;
+				// otherwise, if the matcher returns `false`, the route did not match
+				return;
 			}
-			continue;
+
+			result[param.name] = outcome.value;
+		} else {
+			result[param.name] = decoded;
 		}
 
-		// in the `/[[a=b]]/...` case, if the value didn't satisfy the matcher,
-		// keep track of the number of skipped optional parameters and continue
-		if (param.optional && param.chained) {
-			buffered++;
-			continue;
+		// Now that the params match, reset the buffer if the next param isn't the [...rest]
+		// and the next value is defined, otherwise the buffer will cause us to skip values
+		const next_param = params[i + 1];
+		const next_value = values[i + 1];
+		if (next_param && !next_param.rest && next_param.optional && next_value && param.chained) {
+			buffered = 0;
 		}
 
-		// otherwise, if the matcher returns `false`, the route did not match
-		return;
+		// There are no more params and no more values, but all non-empty values have been matched
+		if (!next_param && !next_value && Object.keys(result).length === values_needing_match.length) {
+			buffered = 0;
+		}
+		continue;
 	}
 
 	if (buffered) return;
@@ -242,7 +275,7 @@ const basic_param_pattern = /\[(\[)?(\.\.\.)?(\w+?)(?:=(\w+))?\]\]?/g;
  * ); // `/blog/hello-world/something/else`
  * ```
  * @param {string} id
- * @param {Record<string, string | undefined>} params
+ * @param {Record<string, import('@sveltejs/kit').ParamValue | undefined>} params
  * @returns {string}
  */
 export function resolve_route(id, params) {
@@ -254,20 +287,33 @@ export function resolve_route(id, params) {
 		segments
 			.map((segment) =>
 				segment.replace(basic_param_pattern, (_, optional, rest, name) => {
-					const param_value = params[name];
+					const value = params[name];
 
-					// This is nested so TS correctly narrows the type
-					if (!param_value) {
+					if (value === undefined || value === '') {
 						if (optional) return '';
-						if (rest && param_value !== undefined) return '';
+						if (rest && value !== undefined) return '';
 						throw new Error(`Missing parameter '${name}' in route ${id}`);
 					}
 
-					if (param_value.startsWith('/') || param_value.endsWith('/'))
-						throw new Error(
-							`Parameter '${name}' in route ${id} cannot start or end with a slash -- this would cause an invalid route like foo//bar`
-						);
-					return param_value;
+					if (typeof value === 'string') {
+						if (value.startsWith('/') || value.endsWith('/')) {
+							throw new Error(
+								`Parameter '${name}' in route ${id} cannot start or end with a slash -- this would cause an invalid route like foo//bar`
+							);
+						}
+
+						return value;
+					}
+
+					if (
+						typeof value === 'number' ||
+						typeof value === 'boolean' ||
+						typeof value === 'bigint'
+					) {
+						return String(value);
+					}
+
+					throw new Error('Parameter values must be a string, number, boolean, or bigint');
 				})
 			)
 			.filter(Boolean)
@@ -290,7 +336,7 @@ export function has_server_load(node) {
  * @param {string} path - The decoded pathname to match
  * @param {Route[]} routes
  * @param {Record<string, import('@sveltejs/kit').ParamMatcher>} matchers
- * @returns {{ route: Route, params: Record<string, string> } | null}
+ * @returns {{ route: Route, params: Record<string, any> } | null}
  */
 export function find_route(path, routes, matchers) {
 	for (const route of routes) {
@@ -301,7 +347,7 @@ export function find_route(path, routes, matchers) {
 		if (matched) {
 			return {
 				route,
-				params: decode_params(matched)
+				params: matched
 			};
 		}
 	}

package/src/utils/streaming.js

@@ -1,3 +1,5 @@
+import { noop } from './functions.js';
+
 /**
  * Create an async iterator and a function to push values into it
  * @template T
@@ -30,10 +32,18 @@ export function create_async_iterator() {
 			};
 		},
 		add: (promise) => {
-			deferred.push(Promise.withResolvers());
-			void promise.then((value) => {
-				deferred[++resolved].resolve(value);
-			});
+			const next = Promise.withResolvers();
+			void next.promise.catch(noop); // prevent unhandled rejection potentially crashing the process
+			deferred.push(next);
+
+			void promise.then(
+				(value) => {
+					deferred[++resolved].resolve(value);
+				},
+				(error) => {
+					deferred[++resolved].reject(error);
+				}
+			);
 		}
 	};
 }

package/src/utils/url.js

@@ -1,13 +1,10 @@
 import { BROWSER, DEV } from 'esm-env';
-import { try_get_request_store } from '../exports/internal/event.js';
 
 /**
  * Matches a URI scheme. See https://www.rfc-editor.org/rfc/rfc3986#section-3.1
  * @type {RegExp}
  */
 export const SCHEME = /^[a-z][a-z\d+\-.]*:/i;
-// See https://datatracker.ietf.org/doc/html/rfc2606 - no domains under the .invalid TLD can be registered
-const REDIRECT_BASE = 'https://sveltekit-redirect.invalid';
 
 const internal = new URL('a://');
 
@@ -30,32 +27,6 @@ export function is_root_relative(path) {
 	return path[0] === '/' && path[1] !== '/';
 }
 
-/**
- * Whether a redirect location is absolute, i.e. not a root-relative or path-relative URL,
- * and not pointing to the same origin as we're currently on (if determineable).
- * @param {string} location
- */
-export function is_external_location(location) {
-	const origin = BROWSER ? window.location.origin : try_get_request_store()?.event.url.origin;
-
-	try {
-		return !matches_external_allowlist_entry(location, origin ?? REDIRECT_BASE);
-	} catch {
-		return true;
-	}
-}
-
-/**
- * @param {string} location
- */
-function is_javascript_location(location) {
-	try {
-		return new URL(location, REDIRECT_BASE).protocol === 'javascript:';
-	} catch {
-		return false;
-	}
-}
-
 /**
  * @param {string} location
  * @param {string} allowed
@@ -74,56 +45,6 @@ export function matches_external_allowlist_entry(location, allowed) {
 	}
 }
 
-/**
- * @param {string} location
- * @param {{ external?: boolean | string[] }} [options]
- */
-export function validate_redirect_location(location, options) {
-	if (!is_external_location(location)) return;
-
-	const external = options?.external;
-
-	if (!external) {
-		throw new Error(
-			DEV
-				? `Cannot redirect to external URL ${JSON.stringify(location)}. ` +
-						'To redirect to an external URL, pass `{ external: true }` or an allowlist of permitted origins as the third argument to `redirect`'
-				: 'Cannot redirect to external URL unless explicitly allowed'
-		);
-	}
-
-	if (external === true) {
-		if (is_javascript_location(location)) {
-			throw new Error(
-				DEV
-					? `Cannot redirect to ${JSON.stringify(location)} with \`{ external: true }\`. ` +
-							'The `:javascript` protocol must be explicitly listed in the `external` allowlist'
-					: 'Cannot redirect to external URL unless explicitly allowed'
-			);
-		}
-
-		return;
-	}
-
-	if (Array.isArray(external)) {
-		if (!external.some((allowed) => matches_external_allowlist_entry(location, allowed))) {
-			throw new Error(
-				DEV
-					? `Cannot redirect to ${JSON.stringify(location)}: URL origin is not included in the \`external\` allowlist`
-					: 'Cannot redirect to external URL unless explicitly allowed'
-			);
-		}
-
-		return;
-	}
-
-	throw new Error(
-		DEV
-			? '`redirect` options.external must be `true` or an array of allowed origins'
-			: 'Invalid redirect options.external value'
-	);
-}
-
 /**
  * @param {string} path
  * @param {import('types').TrailingSlash} trailing_slash

package/src/version.js

@@ -1,4 +1,4 @@
 // generated during release, do not modify
 
 /** @type {string} */
-export const VERSION = '3.0.0-next.6';
+export const VERSION = '3.0.0-next.7';