SvelteKit 3.1

Apply the Svelte 5.57, Node.js 24, TypeScript 6.0, and JavaScript ES2026 prompts first. These rules cover SvelteKit's server and browser boundaries. Apply Node adapter settings only to Node deployments; verify equivalent controls in other adapters.

Configuration and private code

• Put SvelteKit configuration, including csrf, csp, paths.origin, and experimental, in the sveltekit(...) Vite plugin in vite.config.js. Review the effective production configuration; svelte.config.js is no longer read. Match Svelte, Vite, the Svelte Vite plugin, TypeScript, and adapter peer requirements to the deployed toolchain.
• Keep secrets and privileged helpers in server-only modules: src/lib/server (importable as #lib/server when the package imports alias is configured), another server directory outside src/routes and static, or a filename with a server segment. Keep them out of universal loads and components, including indirect imports. Build with TEST unset because that setting disables illegal server-import detection.
• Read private values from $app/env/private when using explicit environment variables, or from the private $env modules. Reserve env.publicPrefix for values safe to ship to the browser; static values are embedded at build time, while dynamic values cannot be used while prerendering. For explicit variables, declare and validate security-sensitive values in src/env.ts with defineEnvVars from @sveltejs/kit/env; leave secrets public: false.

Authentication, authorization, and routing

• Verify session cookies or bearer tokens