breaking: nested server-only directories by rChaoz · Pull Request #15685 · sveltejs/kit

rChaoz · 2026-04-09T11:52:17Z

Instead of only considering $lib/server/** as server-only modules, consider $lib/**/server/** instead, see issue above for reasoning.

As per the conversation in #12733, adding this as defaults for v3 (breaking change).

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
This message body should clearly illustrate what problems it solves.
Ideally, include a test that fails without this PR but passes with it.

Tests

Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

changeset-bot · 2026-04-09T11:52:23Z

🦋 Changeset detected

Latest commit: 86e9d45

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

svelte-docs-bot · 2026-04-09T11:52:48Z

Preview: https://svelte-dev-git-preview-kit-15685-svelte.vercel.app/

elliott-with-the-longest-name-on-github · 2026-04-21T18:15:55Z


- adding `.server` to the filename, e.g. `secrets.server.js`
- placing them in `$lib/server`, e.g. `$lib/server/secrets.js`
+- For single modules, add `.server` to the filename, e.g. `secrets.server.js`. This works for _any_ file in the project directory, including within `$lib` or `$routes`.


I don't think we automatically create a $routes alias, do we?

Right, I've had one in my projects for so long I forgot it's not native

elliott-with-the-longest-name-on-github · 2026-04-21T18:17:31Z

 	const import_map = new Map();
-	const server_only_pattern = /.*\.server\..+/;
+	// Matches any ID that has .server. in its filename
+	const server_only_module_pattern = /\.server\.[^/]+$/;


did we change this from what it was before on purpose?

Yes, for consistency

elliott-with-the-longest-name-on-github · 2026-04-21T18:19:23Z

-					normalized.startsWith('$lib/server/') ||
-					(is_internal && server_only_pattern.test(path.basename(id)));
+					(normalized.startsWith('$lib/') && server_only_directory_pattern.test(id)) ||
+					(is_internal && server_only_module_pattern.test(id));


Was there any reason to change this?

Same reason as above. It also prevents false positives because the hook ID filters no longer match .server in directory names

Co-authored-by: Elliott Johnson <hello@ell.iott.dev>

pkg-svelte-dev · 2026-07-01T23:38:00Z

Install the latest version of @sveltejs/kit from 86e9d45:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/86e9d45cd4a991e7026cea149b7a08e33b630dcb

Open in pkg.svelte.dev: https://pkg.svelte.dev/@sveltejs/kit/c/86e9d45cd4a991e7026cea149b7a08e33b630dcb

Note

This PR is from a fork. A maintainer must approve the fork build on pkg.svelte.dev before the install URLs above will work.

Rich-Harris

thank you!

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to version-3, this PR will be updated. ⚠️

⚠️

⚠️ `version-3` is currently in **pre mode** so this branch has prereleases rather than normal releases. If you want to exit prereleases, run `changeset pre exit` on `version-3`. ⚠️

⚠️

⚠️ # Releases ## @sveltejs/adapter-node@6.0.0-next.2 ### Major Changes - breaking: add `kit.paths.origin` config option, remove `kit.prerender.origin` and the `adapter-node` `ORIGIN` environment variable ([#16161](#16161)) ### Patch Changes - Updated dependencies [[`3c434fb`](3c434fb), [`a9284e8`](a9284e8), [`3726a7a`](3726a7a), [`f9d2240`](f9d2240), [`a9284e8`](a9284e8), [`7c040ba`](7c040ba), [`223eaad`](223eaad), [`223eaad`](223eaad), [`3b907d4`](3b907d4), [`fd628a5`](fd628a5), [`223eaad`](223eaad), [`6c1d035`](6c1d035), [`178eac0`](178eac0), [`c6562a9`](c6562a9), [`8eca2ab`](8eca2ab), [`61cf188`](61cf188)]: - @sveltejs/kit@3.0.0-next.6 ## @sveltejs/kit@3.0.0-next.6 ### Major Changes - breaking: return no content for 204 responses ([#16200](#16200)) - breaking: form action responses now use the HTTP status code returned from `fail` ([#16200](#16200)) - breaking: nested server-only directories ([#15685](#15685)) - breaking: add `kit.paths.origin` config option, remove `kit.prerender.origin` and the `adapter-node` `ORIGIN` environment variable ([#16161](#16161)) - breaking: don't abort navigation when calling `invalidate(All)` during navigation ([#16188](#16188)) - breaking: allow `handleError` to influence status code ([#16162](#16162)) - breaking: forbid external redirects by default ([#16198](#16198)) ### Minor Changes - feat: use `type: 'module'` for service worker registrations ([#16169](#16169)) - feat: add `dirty()` property to form fields ([#16208](#16208)) - feat: add `cookies.parse` method ([#16203](#16203)) ### Patch Changes - fix: drain unconsumed request bodies so keep-alive connections don't hang ([#16170](#16170)) - fix: properly handle Date objects in form.fields.set ([#16168](#16168)) - fix: skip clean fields when programmatically validating forms ([#16208](#16208)) - breaking: experimental remote form `validate({ includeUntouched })` option is now `all` ([#16208](#16208)) - fix: return `undefined` from `fields.branch.issues()` when only `fields.branch.leaf` has issues ([#16187](#16187)) - feat: add field.touched() helper to remote form fields ([#14692](#14692)) ## @sveltejs/adapter-cloudflare@8.0.0-next.1 ### Patch Changes - fix: avoid overriding user's existing `_headers` rules ([#16183](#16183)) - Updated dependencies [[`3c434fb`](3c434fb), [`a9284e8`](a9284e8), [`3726a7a`](3726a7a), [`f9d2240`](f9d2240), [`a9284e8`](a9284e8), [`7c040ba`](7c040ba), [`223eaad`](223eaad), [`223eaad`](223eaad), [`3b907d4`](3b907d4), [`fd628a5`](fd628a5), [`223eaad`](223eaad), [`6c1d035`](6c1d035), [`178eac0`](178eac0), [`c6562a9`](c6562a9), [`8eca2ab`](8eca2ab), [`61cf188`](61cf188)]: - @sveltejs/kit@3.0.0-next.6 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…rness (nib dcc-3cm6) Pre-pilot review of the v2 harness, run before dcc-vkeh spends. Verdict was do not run yet: five defects would have corrupted or voided the pilot, four of them silently. 1. The answers were reachable from a cell. Cells run under --dangerously-skip-permissions, where ../threads.json is the thread axis's answer key, ../../*/ is every other subject and ../../../runs/ is every prior cell. Detection ships here (verify_cell_isolation.sh, wired into the runner; all four existing cells CLEAN) plus a PreToolUse hook that denies any path inside the benchmark tree but outside the cell's own checkout. Posture decision is dcc-suz4. 2. run_cell_v2.sh could not address the pooled corpus at all -- it resolved only v2/subjects/NN-*.json + v2/repos/<id>. New fixture_lib.sh resolves all three fixture shapes (anchor, pooled, null). 3. The gh shim's --json filter was a case-sensitive substring blocklist over a 46-field API. latestReviews leaked CHANGES_REQUESTED and APPROVED against a 2026-04-09 checkpoint; commits returned all 8 post-checkpoint commits. Now an allowlist, 0 of 30 probed fields reachable. 4. A URL target skipped the date check entirely. URLs are now parsed and date-checked; an unresolvable target denies. 5. Every cell recorded build-capability.json = {"error":"detection failed"} -- detect_build.sh was passed dirname "$REPO" and 2>/dev/null || echo destroyed the real diagnostic, voiding dcc-fhp1's identifiable-rather-than-weaker guarantee. Two findings changed facts rather than code: docs-at reported Wayback outages as "no snapshot" (3 of 12 identical requests failed at connection level, logged as MISS either way) and its filter=statuscode:200 dropped every site that redirects, making SvelteKit's docs unreachable for every sveltejs/kit#15685 cell. Both fixed. The null arm's file probe silently covered 12 of 33 files on the large subject; full coverage surfaces 8 hits where 1 was adjudicated. Filed as dcc-nvrt. Full review, including the accepted risks, in v2/analysis/HARNESS-REVIEW.md.

rChaoz marked this pull request as ready for review April 9, 2026 11:52

vercel Bot reviewed Apr 9, 2026

View reviewed changes

Comment thread packages/kit/src/exports/vite/index.js Outdated

rChaoz force-pushed the feat/recursive-server-dirs branch from 2244f2d to 2f75514 Compare April 9, 2026 12:06

rChaoz changed the title ~~Feat/recursive server dirs~~ feat: recursive $lib server dirs Apr 9, 2026

vercel Bot reviewed Apr 9, 2026

View reviewed changes

Comment thread packages/kit/src/exports/vite/index.js

rChaoz marked this pull request as draft April 9, 2026 12:30

rChaoz and others added 2 commits April 15, 2026 21:11

Treat /server/** as server-only

2cb8c60

Update tests

cd3c44f

rChaoz force-pushed the feat/recursive-server-dirs branch from 2f75514 to cd3c44f Compare April 15, 2026 18:32

rChaoz marked this pull request as ready for review April 15, 2026 18:32

rChaoz changed the title ~~feat: recursive $lib server dirs~~ feat!: recursive $lib server dirs Apr 15, 2026

rChaoz added 2 commits April 15, 2026 21:35

Add changeset

329f934

Update documentation

26bce18

rChaoz mentioned this pull request Apr 15, 2026

feat: add option to recursively consider server dirs in $lib #12733

Closed

6 tasks

elliott-with-the-longest-name-on-github reviewed Apr 21, 2026

View reviewed changes

elliott-with-the-longest-name-on-github changed the title ~~feat!: recursive $lib server dirs~~ breaking: nested server-only directories Apr 21, 2026

Update .changeset/lazy-nights-lay.md

ff82930

Co-authored-by: Elliott Johnson <hello@ell.iott.dev>

teemingc reviewed May 18, 2026

View reviewed changes

Comment thread documentation/docs/30-advanced/50-server-only-modules.md Outdated

Apply suggestion from @teemingc

46e212c

teemingc requested changes May 18, 2026

View reviewed changes

teemingc linked an issue Jun 6, 2026 that may be closed by this pull request

Add option to consider lib/**/server/** as server files #12732

Closed

teemingc added the breaking change label Jun 26, 2026

merge version-3

a1b8267

update tests

86e9d45

Rich-Harris approved these changes Jul 1, 2026

View reviewed changes

Rich-Harris merged commit 7c040ba into sveltejs:version-3 Jul 2, 2026
16 of 17 checks passed

github-actions Bot mentioned this pull request Jul 2, 2026

Version Packages (next) #16174

Merged

rChaoz deleted the feat/recursive-server-dirs branch July 2, 2026 07:08

teemingc mentioned this pull request Jul 2, 2026

Add option to consider lib/**/server/** as server files #12732

Closed

manuel3108 mentioned this pull request Aug 7, 2026

sv migrate sveltejs/cli#1124

Closed

Uh oh!

Uh oh!

Conversation

rChaoz commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

Tests

Changesets

Edits

Uh oh!

changeset-bot Bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

svelte-docs-bot Bot commented Apr 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elliott-with-the-longest-name-on-github Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

rChaoz Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

elliott-with-the-longest-name-on-github Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

rChaoz Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

elliott-with-the-longest-name-on-github Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

rChaoz Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

pkg-svelte-dev Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Rich-Harris left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rChaoz commented Apr 9, 2026 •

edited

Loading

changeset-bot Bot commented Apr 9, 2026 •

edited

Loading

pkg-svelte-dev Bot commented Jul 1, 2026 •

edited

Loading