@sveltejs/kit 3.0.0-next.7 → 3.0.0-next.9

package/src/runtime/client/entry.js

@@ -1,3 +1,24 @@
-// we expose this as a separate entry point (rather than treating client.js as the entry point)
-// so that everything other than `start`/`load_css` can be treeshaken
-export { start, load_css } from './client.js';
+/* in development or if `bundleStrategy` is 'split', this file is used as the entry point */
+
+import { set_payload } from './payload.js';
+
+/** @type {Promise<typeof import('./client-entry.js')>} */
+let client;
+
+/** @param {import('types').SvelteKitPayload} payload */
+export function init(payload) {
+	set_payload(payload);
+	// Importing the client after setting the payload ensures that modules such as
+	// `$app/paths` can read it during initialization.
+	client ??= import('./client-entry.js');
+}
+
+/** @param {Parameters<import('./client-entry.js').start>} args */
+export async function start(...args) {
+	return (await client).start(...args);
+}
+
+/** @param {Parameters<import('./client-entry.js').load_css>} args */
+export async function load_css(...args) {
+	return (await client).load_css(...args);
+}

package/src/runtime/client/payload.js

@@ -0,0 +1,17 @@
+/** @import {SvelteKitPayload} from 'types'; */
+
+/**
+ * Code inside the SvelteKit client runtime should only use this, not the global,
+ * so that the file hashes stay stable between rebuilds as long as the SvelteKit runtime doesn't change
+ */
+export let payload = __SVELTEKIT_PAYLOAD__ ?? /** @type {SvelteKitPayload} */ ({});
+
+/** @param {SvelteKitPayload} value */
+export function set_payload(value) {
+	payload = value;
+}
+
+// this makes Vite inject its dev client code as this module's first dependency
+// so that global constant replacements are done before any other module evaluates.
+// For build, it's inert.
+import.meta.hot;

package/src/runtime/client/remote-functions/form.svelte.js

@@ -8,8 +8,8 @@ import {
 	query_responses,
 	_goto,
 	set_nearest_error_page,
-	invalidateAll,
-	handle_error
+	handle_error,
+	refreshAll
 } from '../client.js';
 import { tick } from 'svelte';
 import { categorize_updates, remote_request } from './shared.svelte.js';
@@ -227,14 +227,14 @@ export function form(id) {
 
 					// if the developer took control of updates via `.updates(...)` (even with
 					// no arguments), or the server performed explicit refreshes, don't invalidateAll
-					const should_invalidate = refreshes === null && !response.r;
+					const should_refresh = refreshes === null && !response.r;
 
 					if (response.redirect) {
 						// Use internal version to allow redirects to external URLs
 						void _goto(
 							response.redirect,
 							{
-								invalidateAll: should_invalidate
+								refreshAll: should_refresh
 							},
 							0
 						);
@@ -244,8 +244,8 @@ export function form(id) {
 					const succeeded = raw_issues.length === 0;
 
 					if (succeeded) {
-						if (should_invalidate) {
-							void invalidateAll();
+						if (should_refresh) {
+							void refreshAll();
 						}
 					} else {
 						if (DEV) {

package/src/runtime/client/state.svelte.js

@@ -11,7 +11,6 @@ export const page = new (class Page {
 	route = $state.raw({ id: null });
 	state = $state.raw({});
 	status = $state.raw(-1);
-	// eslint-disable-next-line svelte/prefer-svelte-reactivity
 	url = $state.raw(new URL('a:'));
 })();
 

package/src/runtime/client/types.d.ts

@@ -10,6 +10,7 @@ import {
 	Uses
 } from 'types';
 import { Page, ParamMatcher } from '@sveltejs/kit';
+import { RenderNode } from '../types.js';
 
 export interface SvelteKitApp {
 	/**
@@ -57,8 +58,6 @@ export interface SvelteKitApp {
 	 */
 	hash: boolean;
 
-	root: typeof SvelteComponent;
-
 	/**
 	 * Lazily loads the contents of src/error.html, used as a last-resort
 	 * error page when the root layout's load function throws during client-side rendering.
@@ -91,13 +90,10 @@ export type NavigationFinished = {
 	type: 'loaded';
 	state: NavigationState;
 	props: {
-		constructors: Array<typeof SvelteComponent>;
-		errors?: Array<typeof SvelteComponent | undefined>;
-		components?: SvelteComponent[];
 		page: Page;
 		form?: Record<string, any> | null;
 		error?: App.Error;
-		[key: `data_${number}`]: Record<string, any>;
+		tree: RenderNode;
 	};
 };
 

package/src/runtime/components/root.svelte

@@ -0,0 +1,66 @@
+<script lang="ts">
+	import { afterNavigate } from '$app/navigation';
+	import type { Page } from '@sveltejs/kit';
+	import type { RenderNode } from '../types.js';
+
+	interface Props {
+		page: Page;
+		tree: RenderNode;
+		components: any[];
+		resetters: Array<(() => void) | undefined>;
+		form?: any;
+		error?: App.Error;
+	}
+
+	const { page, components, resetters, tree, form, error }: Props = $props();
+
+	let mounted = $state(false);
+	let navigated = $state(false);
+	let title = $state('');
+
+	afterNavigate(() => {
+		if (mounted) {
+			navigated = true;
+			title = document.title || 'untitled page';
+		} else {
+			mounted = true;
+		}
+	});
+</script>
+
+{#snippet node(n: RenderNode, depth: number)}
+	{const Component = $derived(n.component)}
+	{const Error = $derived(n.error)}
+	{const data = $derived(n.data)}
+
+	<svelte:boundary onerror={(_, reset) => (resetters[depth] = reset)}>
+		{#if n.child}
+			<!-- svelte-ignore binding_property_non_reactive -->
+			<Component bind:this={components[depth]} {data} {form} params={page.params}>
+				{@render node(n.child, depth + 1)}
+			</Component>
+		{:else}
+			<!-- svelte-ignore binding_property_non_reactive -->
+			<Component bind:this={components[depth]} {data} {form} params={page.params} {error} />
+		{/if}
+
+		{#snippet failed(error)}
+			<Error {error} />
+		{/snippet}
+	</svelte:boundary>
+{/snippet}
+
+{@render node(tree, 0)}
+
+{#if mounted}
+	<div
+		id="svelte-announcer"
+		aria-live="assertive"
+		aria-atomic="true"
+		style="position: absolute; left: 0; top: 0; clip: rect(0 0 0 0); clip-path: inset(50%); overflow: hidden; white-space: nowrap; width: 1px; height: 1px"
+	>
+		{#if navigated}
+			{title}
+		{/if}
+	</div>
+{/if}

package/src/runtime/env/dynamic/private.js

@@ -0,0 +1,7 @@
+import { DEV } from 'esm-env';
+import * as env from '../../app/env/private.js';
+export { env };
+
+if (DEV) {
+	console.warn('`$env/dynamic/private` is deprecated, use `$app/env/private` instead');
+}

package/src/runtime/env/dynamic/public.js

@@ -0,0 +1,7 @@
+import { DEV } from 'esm-env';
+import * as env from '../../app/env/public/index.js';
+export { env };
+
+if (DEV) {
+	console.warn('`$env/dynamic/public` is deprecated, use `$app/env/public` instead');
+}

package/src/runtime/env/static/private.js

@@ -0,0 +1,6 @@
+import { DEV } from 'esm-env';
+export * from '../../app/env/private.js';
+
+if (DEV) {
+	console.warn('`$env/static/private` is deprecated, use `$app/env/private` instead');
+}

package/src/runtime/env/static/public.js

@@ -0,0 +1,6 @@
+import { DEV } from 'esm-env';
+export * from '../../app/env/public/index.js';
+
+if (DEV) {
+	console.warn('`$env/static/public` is deprecated, use `$app/env/public` instead');
+}

package/src/runtime/form-utils.js

@@ -150,10 +150,7 @@ export async function deserialize_binary_form(request) {
 		throw deserialize_error('no body');
 	}
 
-	// TODO: remove this workaround once we upgrade to TS 6.0
-	const reader = /** @type {ReadableStreamDefaultReader<Uint8Array<ArrayBuffer>>} */ (
-		request.body.getReader()
-	);
+	const reader = request.body.getReader();
 
 	/** @type {Array<Promise<Uint8Array<ArrayBuffer> | undefined>>} */
 	const chunks = [];

package/src/runtime/server/cookie.js

@@ -12,10 +12,11 @@ import { text_encoder } from '../utils.js';
 const cookie_paths = {};
 
 /**
- * Cookies that are larger than this size (including the name and other
- * attributes) are discarded by browsers
+ * Cookies whose name and value combined are larger than this size are
+ * discarded by browsers. This is the limit codified for the name/value pair
+ * in RFC 6265bis: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-20#section-5.6-7.5.1
  */
-const MAX_COOKIE_SIZE = 4129;
+const MAX_COOKIE_SIZE = 4096;
 
 /**
  * Generates a unique key for a cookie based on its domain, path, and name in
@@ -42,6 +43,25 @@ export function get_cookies(request, url) {
 		parseCookie(header, { decode: (value) => value })
 	);
 
+	/** @type {ReturnType<typeof parseCookie> | undefined} */
+	let default_cookies;
+
+	/**
+	 * The header never changes during the request, so the default-decode parse is cached
+	 * @param {import('cookie').ParseOptions} [opts]
+	 */
+	function parse_header(opts) {
+		return opts?.decode ? parseCookie(header, opts) : (default_cookies ??= parseCookie(header));
+	}
+
+	/** @param {import('./page/types.js').Cookie} cookie */
+	function matches_url(cookie) {
+		return (
+			domain_matches(url.hostname, cookie.options.domain) &&
+			path_matches(url.pathname, cookie.options.path)
+		);
+	}
+
 	/** @type {string | undefined} */
 	let normalized_url;
 
@@ -65,22 +85,23 @@ export function get_cookies(request, url) {
 
 		get(name, opts) {
 			// Look for the most specific matching cookie from new_cookies
-			const best_match = Array.from(new_cookies.values())
-				.filter((c) => {
-					return (
-						c.name === name &&
-						domain_matches(url.hostname, c.options.domain) &&
-						path_matches(url.pathname, c.options.path)
-					);
-				})
-				.sort((a, b) => b.options.path.length - a.options.path.length)[0];
+			/** @type {import('./page/types.js').Cookie | undefined} */
+			let best_match;
+			for (const c of new_cookies.values()) {
+				if (
+					c.name === name &&
+					matches_url(c) &&
+					(!best_match || c.options.path.length > best_match.options.path.length)
+				) {
+					best_match = c;
+				}
+			}
 
 			if (best_match) {
 				return best_match.options.maxAge === 0 ? undefined : best_match.value;
 			}
 
-			const req_cookies = parseCookie(header, { decode: opts?.decode });
-			const cookie = req_cookies[name]; // the decoded string or undefined
+			const cookie = parse_header(opts)[name]; // the decoded string or undefined
 
 			// in development, if the cookie was set during this session with `cookies.set`,
 			// but at a different path, warn the user. (ignore cookies from request headers,
@@ -103,16 +124,14 @@ export function get_cookies(request, url) {
 		},
 
 		getAll(opts) {
-			const cookies = parseCookie(header, { decode: opts?.decode });
+			// copy, so the cached parse isn't mutated below
+			const cookies = { ...parse_header(opts) };
 
 			// Group cookies by name and find the most specific one for each name
 			const lookup = new Map();
 
 			for (const c of new_cookies.values()) {
-				if (
-					domain_matches(url.hostname, c.options.domain) &&
-					path_matches(url.pathname, c.options.path)
-				) {
+				if (matches_url(c)) {
 					const existing = lookup.get(c.name);
 
 					// If no existing cookie or this one has a more specific (longer) path, use this one
@@ -124,7 +143,13 @@ export function get_cookies(request, url) {
 
 			// Add the most specific cookies to the result
 			for (const c of lookup.values()) {
-				cookies[c.name] = c.value;
+				// tombstones (deleted cookies) shadow request-header cookies,
+				// mirroring the behavior of `get()`
+				if (c.options.maxAge === 0) {
+					delete cookies[c.name];
+				} else {
+					cookies[c.name] = c.value;
+				}
 			}
 
 			return /** @type {Array<{ name: string; value: string }>} */ (
@@ -219,9 +244,12 @@ export function get_cookies(request, url) {
 		new_cookies.set(cookie_key, cookie);
 
 		if (DEV) {
-			const { encode, ...rest } = cookie.options;
-			const serialized = stringifySetCookie({ name, value, ...rest }, { encode });
-			if (text_encoder.encode(serialized).byteLength > MAX_COOKIE_SIZE) {
+			const size =
+				// only the name/value pair counts towards MAX_COOKIE_SIZE, not the other attributes
+				text_encoder.encode(name).byteLength +
+				text_encoder.encode((options.encode ?? encodeURIComponent)(value)).byteLength;
+
+			if (size > MAX_COOKIE_SIZE) {
 				throw new Error(`Cookie "${name}" is too large, and will be discarded by the browser`);
 			}
 

package/src/runtime/server/csrf.js

@@ -36,7 +36,7 @@ export function get_self_origin(paths_origin, url_origin) {
  */
 export function is_csrf_forbidden({ request, request_origin, self_origin, trusted_origins }) {
 	return (
-		is_form_content_type(request) &&
+		(!request.headers.get('content-type') || is_form_content_type(request)) &&
 		mutating_form_methods.has(request.method) &&
 		request_origin !== self_origin &&
 		(!request_origin || !trusted_origins.includes(request_origin))

package/src/runtime/server/data/index.js

@@ -96,29 +96,25 @@ export async function render_data(
 			return fn();
 		});
 
-		let length = promises.length;
-		const nodes = await Promise.all(
-			promises.map((p, i) =>
-				p.catch(async (error) => {
+		const data_serializer = server_data_serializer_json(event, event_state, options);
+		await Promise.all(
+			promises.map(async (p, i) => {
+				const node = await p.catch(async (error) => {
 					if (error instanceof Redirect) {
 						throw error;
 					}
 
-					// Math.min because array isn't guaranteed to resolve in order
-					length = Math.min(length, i + 1);
-
 					const transformed = await handle_error_and_jsonify(event, event_state, options, error);
 
 					return /** @type {import('types').ServerErrorNode} */ ({
 						type: 'error',
 						error: transformed
 					});
-				})
-			)
-		);
+				});
 
-		const data_serializer = server_data_serializer_json(event, event_state, options);
-		for (let i = 0; i < nodes.length; i++) data_serializer.add_node(i, nodes[i]);
+				data_serializer.add_node(i, node);
+			})
+		);
 		const { data, chunks } = data_serializer.get_data();
 
 		if (!chunks) {

package/src/runtime/server/page/index.js

@@ -1,5 +1,6 @@
+/** @import { Component } from 'svelte' */
 /** @import { ActionResult, RequestEvent, SSRManifest } from '@sveltejs/kit' */
-/** @import { PageNodeIndexes, RequestState, RequiredResolveOptions, ServerDataNode, SSRComponent, SSRNode, SSROptions, SSRState } from 'types' */
+/** @import { PageNodeIndexes, RequestState, RequiredResolveOptions, ServerDataNode, SSRNode, SSROptions, SSRState } from 'types' */
 import { text } from '@sveltejs/kit';
 import { HttpError, Redirect } from '@sveltejs/kit/internal';
 import { compact } from '../../../utils/array.js';
@@ -316,13 +317,7 @@ export async function render_page(
 								},
 								status,
 								error,
-								error_components: await load_error_components(
-									options,
-									ssr,
-									error_branch,
-									page,
-									manifest
-								),
+								error_components: await load_error_components(ssr, error_branch, page, manifest),
 								branch: error_branch,
 								fetched,
 								data_serializer
@@ -374,7 +369,7 @@ export async function render_page(
 			action_result,
 			fetched,
 			data_serializer: !ssr ? server_data_serializer(event, event_state, options) : data_serializer,
-			error_components: await load_error_components(options, ssr, branch, page, manifest)
+			error_components: await load_error_components(ssr, branch, page, manifest)
 		});
 	} catch (e) {
 		// a remote function could have thrown a redirect during render
@@ -398,18 +393,16 @@ export async function render_page(
 }
 
 /**
- *
- * @param {SSROptions} options
  * @param {boolean} ssr
  * @param {Array<import('./types.js').Loaded | null>} branch
  * @param {PageNodeIndexes} page
  * @param {SSRManifest} manifest
  */
-async function load_error_components(options, ssr, branch, page, manifest) {
-	/** @type {Array<SSRComponent | undefined> | undefined} */
+async function load_error_components(ssr, branch, page, manifest) {
+	/** @type {Array<Component | undefined> | undefined} */
 	let error_components;
 
-	if (options.server_error_boundaries && ssr) {
+	if (ssr) {
 		let last_idx = -1;
 		error_components = await Promise.all(
 			// eslint-disable-next-line @typescript-eslint/await-thenable