fix: infer prerendered MIME types from generated files

[svelte-triage-bot]

• Prerendered URL paths omit or misrepresent generated file extensions, leaving HTML absent from builder.mimeTypes unless another asset supplies it.
• Preserve the shared MIME lookup introduced by #16564, exposed by #16875, and consumed by the build-time static server in #16908, including manifest precedence and the patched icon type.
• Scan actual prerendered output alongside client output rather than adding only page filenames: the latter misses redirect-only output and retains misleading URL extensions. No runtime MIME database or HTML fallback is needed.
• Cover pages, redirects, dependencies, generated data and absent prerendered output; retain static HTML alias coverage while adding a no-static-assets variant and nosniff, HEAD and compression regressions.

Fixes #17380

[changeset-bot]

🦋 Changeset detected

Latest commit: d06de6d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from d06de6d:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/d06de6dcad53c0f2a92aac5edb2cfc2763c5ece0

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/17381

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[dummdidumm]

@svelte-triage-bot do we need the additional test in adapter-node or does the one in core suffice? asking because there is no actual code change in adapter-node itself

[dummdidumm]

(but answered on the issue #17380 (comment) will dig into why)

(I think I would still be in favor of removing the node test to not make everything take even longer)

[theescodes]

Tested this on a production site that hit #17380. The site is fully prerendered, on Kit 3.0.0 and adapter-node 6.0.0, and served through a custom server that wraps handler and sets X-Content-Type-Options: nosniff.

I applied this PR's builder.js change to the installed Kit and rebuilt:

• mime_types in build/adapter-node.js now includes ".html":"text/html". Before, it had none; .xml was only there because of a prerendered sitemap.
• /, /about and /imprint are served as text/html;charset=utf-8. Before, they had no Content-Type.
• Other types are unchanged: sitemap.xml is still text/xml and favicon.ico is still image/x-icon.
• In Chromium the pages render again instead of showing their source. Client-side navigation works, and the CSP reports no violations.

Thanks in advance for the quick fix!