fix(sveltekit): support external redirect permissions

[gerold-penz]

Summary

Support SvelteKit 3's explicit permission requirement for external redirects while preserving SvelteKit 2 behavior.

• Always allow redirects to Logto for sign-in and sign-out.
• Add HookConfig.allowExternalPostRedirectUri (default false) to opt into external post-sign-in destinations on SvelteKit 3+. SvelteKit 2 ignores the option and retains its existing behavior. URL validation remains SvelteKit's responsibility.
• Remove runtime version detection, adapt the optional redirect argument without type assertions, and derive the hook type from sequence to support the Handle type relocation in SvelteKit 3.
• Extend the SvelteKit peer range to include v3, document the configuration and migration behavior, and add a minor changeset.

Testing

• 18 SDK tests passed with SvelteKit 2.70.3 and with the real SvelteKit 3.0.1 runtime selected through a temporary module alias. Coverage includes default/false/true configuration, sign-in/sign-out redirects, internal and opted-in external destinations, and callback error/redirect propagation.
• Type checks passed against both SvelteKit 2.70.3 and 3.0.1 declarations; lint and the SDK dependency-closure build passed.
• An additional local smoke test exercised 27 real redirect scenarios per version, including relative and same-origin URLs, cross-origin and protocol-relative URLs, misleading hostname prefixes, and javascript:/data: destinations. SvelteKit 3 validation used its request context and Node 22.20.0.
• Full browser authentication was not exercised.

Checklist

• .changeset
• unit tests
• necessary TSDoc comments and configuration documentation

Reference: https://svelte.dev/docs/kit/migrating-to-sveltekit-3#Miscellaneous-External-redirects-must-be-opted-into

[gerold-penz]

Unfortunately, I forgot to include a check for Svelte version >= 3.0.0.

See: https://svelte.dev/docs/kit/@sveltejs-kit#VERSION

[charIeszhao]

@gerold-penz Thanks for the contribution! I've pushed an update directly to your PR in 5b42b81.

The SDK now always allows redirects to Logto for sign-in and sign-out. For external postRedirectUri destinations after the callback, applications can opt in with allowExternalPostRedirectUri: true in the third argument of handleLogto. This option defaults to false and only takes effect on SvelteKit 3+; SvelteKit 2 keeps its existing behavior.

I also removed the runtime version check, addressed the type compatibility between SvelteKit 2 and 3, and added tests and configuration documentation.

Could you try this version in your application and confirm whether it meets your needs?

[gerold-penz]

@gerold-penz Thanks for the contribution! I've pushed an update directly to your PR in 5b42b81.

The SDK now always allows redirects to Logto for sign-in and sign-out.
[...]
Could you try this version in your application and confirm whether it meets your needs?

@charIeszhao Hi, I tried the file https://github.com/gerold-penz/logto-js/blob/sveltekit-redirect/packages/sveltekit/src/index.ts in my program.
Everything is now working as expected in SvelteKit 3.0.1.

[charIeszhao]

@gerold-penz Thanks, a new version should be already available on NPM. Let me know if there's any other issues