@sveltekit-i18n/base 3.0.0 → 3.0.1

package/README.md

@@ -328,7 +328,7 @@ Load-triggering methods return the promise of the matching load — concurrent d
 - `setRoute(route)` – update the current route
 - `loadConfig(config)` – (re)configure the instance
 - `addTranslations(translations)` – add synchronous translations
-- `snapshot()` – serialize the active locale (and the fallback) for the current route, shaped like `config.translations` so the receiving instance hydrates from it
+- `snapshot()` – serialize the active locale (and the fallback) for the current route, shaped like `config.translations` so the receiving instance hydrates by passing it to `addTranslations()`
 - `invalidate(locale?)` – mark loaded translations stale (one locale, or all); loaders run again on the next load trigger, and a load still in flight for an invalidated locale settles with its data discarded
 - `destroy()` – detach a per-request or per-component instance: in-flight loads settle discarded, further load and mutation calls are ignored, reads keep working
 

package/dist/I18n.svelte.d.ts

@@ -46,9 +46,14 @@ declare class I18nCore<ParserParams extends Parser.Params = any, ParserOutput =
      * Serializes what this instance holds for the active locale and the fallback
      * locale, narrowed to the current route: a key owned only by loaders that do
      * not match the route is left out. The result is shaped like
-     * `config.translations`, so a client hydrates by handing it back to the
-     * constructor — the bookkeeping derived from it then keeps the matching
-     * loaders from fetching the same data again.
+     * `config.translations`, so a client hydrates by passing it to
+     * `addTranslations()` — the bookkeeping derived from it then keeps the
+     * matching loaders from fetching the same data again. Apply it to the
+     * instance rather than assigning it to `config.translations`: the payload is
+     * a subset — two locales, and nothing of a key its loaders claim for another
+     * route — so assigning it would drop the rest of the config's own data.
+     * A literal `__proto__` key is left out: the serializer SvelteKit hands load
+     * data to refuses an object that carries one.
      */
     snapshot: () => Translations.SerializedTranslations;
     /**

package/dist/I18n.svelte.js

@@ -1,4 +1,4 @@
-import { fetchTranslations, hasOwn, mergeTranslations, read, resolveLoaders, sanitizerFactory, sanitizeTranslationLocales, testRoute, toDotNotation, translate } from './utils.js';
+import { fetchTranslations, hasOwn, mergeTranslations, omitProtoKeys, read, resolveLoaders, sanitizerFactory, sanitizeTranslationLocales, testRoute, toDotNotation, translate } from './utils.js';
 import { logError, logger, loggerFactory, setLogger } from './logger.js';
 const defaultCache = Number.POSITIVE_INFINITY;
 class I18nCore {
@@ -211,9 +211,14 @@ class I18nCore {
      * Serializes what this instance holds for the active locale and the fallback
      * locale, narrowed to the current route: a key owned only by loaders that do
      * not match the route is left out. The result is shaped like
-     * `config.translations`, so a client hydrates by handing it back to the
-     * constructor — the bookkeeping derived from it then keeps the matching
-     * loaders from fetching the same data again.
+     * `config.translations`, so a client hydrates by passing it to
+     * `addTranslations()` — the bookkeeping derived from it then keeps the
+     * matching loaders from fetching the same data again. Apply it to the
+     * instance rather than assigning it to `config.translations`: the payload is
+     * a subset — two locales, and nothing of a key its loaders claim for another
+     * route — so assigning it would drop the rest of the config's own data.
+     * A literal `__proto__` key is left out: the serializer SvelteKit hands load
+     * data to refuses an object that carries one.
      */
     snapshot = () => {
         const { fallbackLocale } = this.#config ?? {};
@@ -228,9 +233,13 @@ class I18nCore {
             if (!data)
                 return acc;
             const offRoute = this.#offRouteKeys(locale, route);
-            const relevant = Object.keys(data)
+            const onRoute = Object.keys(data)
                 .filter((key) => !offRoute.has(key))
                 .reduce((keep, key) => ({ ...keep, [key]: read(data, key) }), {});
+            const relevant = omitProtoKeys(onRoute);
+            if (relevant !== onRoute) {
+                logger.warn(`Leaving a '__proto__' key of locale '${locale}' out of the snapshot: load data cannot carry it.`);
+            }
             // An empty entry would still stamp the locale's freshness on the client,
             // starting its `cache` window on data it never received.
             if (!Object.keys(relevant).length)

package/dist/utils.d.ts

@@ -17,6 +17,7 @@ export declare const sanitizeTranslationLocales: (input: Translations.Serialized
 export declare const toDotNotation: DotNotation.T;
 export declare const resolveLoaders: (input?: readonly Loader.LoaderModule[]) => Loader.LoaderModule[];
 export declare const mergeTranslations: (target: any, source: any, path: string, onConflict?: (path: string) => void) => any;
+export declare const omitProtoKeys: (value: any) => any;
 export declare const serialize: (input: Array<Loader.LoaderModule & {
     data: any;
 }>) => Translations.SerializedTranslations;

package/dist/utils.js

@@ -185,6 +185,27 @@ export const mergeTranslations = (target, source, path, onConflict) => {
         [key]: hasOwn(acc, key) ? mergeTranslations(read(acc, key), read(source, key), `${path}.${key}`, onConflict) : read(source, key),
     }), target);
 };
+const isPlainObject = (value) => {
+    if (!value || typeof value !== 'object')
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+};
+// devalue, which SvelteKit serializes load data with, refuses an object with
+// an own '__proto__' key. Branches without one are returned as they are.
+export const omitProtoKeys = (value) => {
+    if (Array.isArray(value)) {
+        const items = value.map(omitProtoKeys);
+        return items.some((item, i) => item !== value[i]) ? items : value;
+    }
+    if (!isPlainObject(value))
+        return value;
+    const keys = Object.keys(value);
+    const entries = keys.filter((key) => key !== '__proto__').map((key) => [key, omitProtoKeys(value[key])]);
+    if (entries.length === keys.length && entries.every(([key, item]) => item === value[key]))
+        return value;
+    return entries.reduce((acc, [key, item]) => ({ ...acc, [key]: item }), {});
+};
 const reportLoaderConflict = (path) => {
     logger.warn(`Conflicting translations for '${path}'. Keeping the value of the last loader.`);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sveltekit-i18n/base",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "Base functionality of sveltekit-i18n library with a support for external message parsers.",
   "type": "module",
   "types": "./dist/index.d.ts",