refactor(web): upgrade to SvelteKit 3 #107

Merged

eleith merged 3 commits from upgrade/sveltekit3-native into main 2026-10-30 15:00:12 +00:00

Conversation 1 Commits 3 Files Changed 138

+742 -1110

eleith-gitea-agent Bot commented 2026-10-30 14:27:46 +00:00

Copy link

Copy source

Summary

• Upgrade to SvelteKit 3.1.1, adapter-node 6.0.1 and Svelte 5.57.3, with exact compatible tooling pins. Consolidate configuration in Vite and use native #lib subpath imports.
• Use native reverse-proxy origin handling; keep runtime YAML/public URL configuration and a portable image. No production bootstrap, custom origin header, database migration or application version bump.
• Preserve form feedback and auth transitions, explicitly allow Google consent redirects, and fix shallow URL synchronization to read page.shallow.url rather than the stale fully loaded page.url.
• Replace applicable deprecated APIs with refreshAll, shallow goto and Response.json. Include a normal web patch changeset.

Closes #66.

Three commits

1. Exact official sv@1.1.1 migration output. This intentionally non-green checkpoint retains the generated report and version ranges; transformations succeeded but the tool's automatic formatter failed during pnpm's non-TTY dependency reconciliation.
2. Required manual integration: exact pins/lock, configuration repairs, native proxy docs/E2E boundary, compile/runtime fixes and focused regression coverage. Repairs the tool-generated invalid email markup.
3. Modern API cleanup and removal of the resolved migration report.

Validation

• Final independent code review and readability review passed.
• All eight projects passed builds, type checks, lint and coverage gates: 2,310 unit tests, including 1,067 web tests. Coverage thresholds unchanged.
• 15 targeted browser tests passed with one worker (auth, booking/deep links, selected host duration/client navigation/form-feedback cases). Full 71-test browser suite is deferred to PR CI to avoid overwhelming the owner's machine.
• Unchanged native production entrypoint passed controlled proxy-header checks against the same build across three runtime HTTPS origins, including a non-default port and explicit YAML URL without ORIGIN: same-origin validation, foreign-Origin rejection, secure login cookies and authenticated admin access. This is not live TLS/Nginx verification.
• Full CI/frozen-install results are pending. Docker image build was not run locally. No release, deployment or live calendar/SMTP/IdP exercise.

Test quality

Removed five pre-existing URL-sync unit cases whose assertions were inside SSR-erased effect roots, rather than adding compiler/router test machinery. Genuine pure-helper coverage remains, and existing booking/deep-link browser journeys now assert URL mirroring and continued usability. No broad test audit is claimed and no browser case was removed.

Deployment and limits

• Set the public ORIGIN (or explicit YAML url.app) to match proxy-derived request origins. Configure native PROTOCOL_HEADER=x-forwarded-proto; proxy overwrites that header and preserves public Host. Optional HOST_HEADER is only for a corresponding trusted forwarding policy. Keep backend access private; native adapter does not authenticate forwarded headers.
• Existing X-Real-IP auth trust remains unchanged. The owner confirms their reverse proxy is configured correctly.
• A separate pre-existing watcher-cleanup issue was observed during smoke teardown: the native HTTP shutdown leaves the existing config watcher keeping the process alive. Adapter 5 and 6 share the same shutdown-event behavior and application boot is unchanged. No lifecycle fix or replacement server is folded into this migration.
• Final code review also identified an unchanged pre-existing CSP restriction: form-action 'self' can block the native Google-consent form's external redirect in Chromium. The new consent test verifies the HTTP redirect/cookie contract, not a browser round trip through Google. This CSP follow-up is not folded into the framework migration.

## Summary - Upgrade to SvelteKit 3.1.1, adapter-node 6.0.1 and Svelte 5.57.3, with exact compatible tooling pins. Consolidate configuration in Vite and use native #lib subpath imports. - Use native reverse-proxy origin handling; keep runtime YAML/public URL configuration and a portable image. No production bootstrap, custom origin header, database migration or application version bump. - Preserve form feedback and auth transitions, explicitly allow Google consent redirects, and fix shallow URL synchronization to read page.shallow.url rather than the stale fully loaded page.url. - Replace applicable deprecated APIs with refreshAll, shallow goto and Response.json. Include a normal web patch changeset. Closes #66. ## Three commits 1. Exact official sv@1.1.1 migration output. This intentionally non-green checkpoint retains the generated report and version ranges; transformations succeeded but the tool's automatic formatter failed during pnpm's non-TTY dependency reconciliation. 2. Required manual integration: exact pins/lock, configuration repairs, native proxy docs/E2E boundary, compile/runtime fixes and focused regression coverage. Repairs the tool-generated invalid email markup. 3. Modern API cleanup and removal of the resolved migration report. ## Validation - Final independent code review and readability review passed. - All eight projects passed builds, type checks, lint and coverage gates: **2,310 unit tests**, including **1,067 web tests**. Coverage thresholds unchanged. - **15 targeted browser tests** passed with one worker (auth, booking/deep links, selected host duration/client navigation/form-feedback cases). Full **71-test browser suite is deferred to PR CI** to avoid overwhelming the owner's machine. - Unchanged native production entrypoint passed controlled proxy-header checks against the same build across three runtime HTTPS origins, including a non-default port and explicit YAML URL without ORIGIN: same-origin validation, foreign-Origin rejection, secure login cookies and authenticated admin access. This is not live TLS/Nginx verification. - Full CI/frozen-install results are pending. Docker image build was not run locally. No release, deployment or live calendar/SMTP/IdP exercise. ## Test quality Removed five pre-existing URL-sync unit cases whose assertions were inside SSR-erased effect roots, rather than adding compiler/router test machinery. Genuine pure-helper coverage remains, and existing booking/deep-link browser journeys now assert URL mirroring and continued usability. No broad test audit is claimed and no browser case was removed. ## Deployment and limits - Set the public ORIGIN (or explicit YAML url.app) to match proxy-derived request origins. Configure native PROTOCOL_HEADER=x-forwarded-proto; proxy overwrites that header and preserves public Host. Optional HOST_HEADER is only for a corresponding trusted forwarding policy. Keep backend access private; native adapter does not authenticate forwarded headers. - Existing X-Real-IP auth trust remains unchanged. The owner confirms their reverse proxy is configured correctly. - A separate pre-existing watcher-cleanup issue was observed during smoke teardown: the native HTTP shutdown leaves the existing config watcher keeping the process alive. Adapter 5 and 6 share the same shutdown-event behavior and application boot is unchanged. No lifecycle fix or replacement server is folded into this migration. - Final code review also identified an unchanged pre-existing CSP restriction: form-action 'self' can block the native Google-consent form's external redirect in Chromium. The new consent test verifies the HTTP redirect/cookie contract, not a browser round trip through Google. This CSP follow-up is not folded into the framework migration.

eleith-gitea-agent Bot added 1 commit 2026-10-30 14:27:47 +00:00

chore(web): apply official SvelteKit 3 migration ... 78f82833f1

Preserve exact sv@1.1.1 transformation output and generated task report. This tool-only checkpoint is intentionally non-green: automatic formatting failed during pnpm's non-TTY dependency reconciliation. Required manual integration follows separately.

eleith added 2 commits 2026-10-30 14:43:41 +00:00

fix(web): integrate SvelteKit 3 with native runtime behavior ... c84110ff46

Pin the compatible toolchain and resolved graph; repair configuration, types, form updates and callback transitions. Preserve native trusted-proxy origin handling and document its boundary. Fix shallow-URL feedback using the router's actual shallow URL. Replace vacuous SSR-erased effect tests with meaningful assertions in existing browser journeys.

refactor(web): finish SvelteKit 3 API cleanup ... 67869f8041

Use refreshAll, explicit shallow goto with replacement/state and rejection handling, and native Response.json. Remove the resolved migration task report.

eleith force-pushed upgrade/sveltekit3-native from 1d8ff40934 to 67869f8041 2026-10-30 14:43:41 +00:00 Compare

eleith-gitea-agent Bot commented 2026-10-30 14:44:22 +00:00

Copy link

Copy source

Amended commit 2 with the month-end E2E repair and replayed commit 3, as approved. The PR still contains exactly three commits; raw migration commit 78f8283 is unchanged. New head: 67869f8041.

The previous 70/71 run exposed a pre-existing test assumption: after the last Friday working window, October has no remaining bookable days. The test now reuses the existing month-navigation helper and proves recovery to Step 2 with a selectable slot. The toolbar and no-fetch checks remain intact; no application, timeout, harness or CI configuration changes.

Validation: focused code/readability review clear; formatting, ESLint and web type checks pass (0 errors/warnings); the previously failing case passes with one worker and no retries. The full suite has not been rerun locally; fresh PR CI remains the merge gate.

<!-- sveltekit3-weekend-fix:67869f804111f891d466495b23eb2e4776782732 --> Amended commit 2 with the month-end E2E repair and replayed commit 3, as approved. The PR still contains exactly three commits; raw migration commit 78f8283 is unchanged. New head: 67869f804111f891d466495b23eb2e4776782732. The previous 70/71 run exposed a pre-existing test assumption: after the last Friday working window, October has no remaining bookable days. The test now reuses the existing month-navigation helper and proves recovery to Step 2 with a selectable slot. The toolbar and no-fetch checks remain intact; no application, timeout, harness or CI configuration changes. Validation: focused code/readability review clear; formatting, ESLint and web type checks pass (0 errors/warnings); the previously failing case passes with one worker and no retries. The full suite has not been rerun locally; fresh PR CI remains the merge gate.

eleith merged commit 67869f8041 into main 2026-10-30 15:00:12 +00:00

eleith deleted branch upgrade/sveltekit3-native 2026-10-30 15:00:12 +00:00

eleith-gitea-agent Bot referenced this pull request 2026-10-30 15:40:00 +00:00

fix(web): allow Google consent form redirects #108

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

blocked

Waiting on a prerequisite before work can proceed

bug

Something is not working

enhancement

New feature

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

eleith-gitea-agent Bot eleith (eleith)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eleith/when#107