fix: only reference env.js/env.script.js if dynamic public env vars are in use, and emit them as prerender output

[Nic-Polumeyv]

With experimental.explicitEnvironmentVariables enabled, every prerendered page boots through import("/_app/env.js") and a service worker that imports $app/env/public calls importScripts('/_app/env.script.js'), but adapter-static never writes either file. Static hosts answer the missing module with fallback HTML and hydration dies on a MIME error before any user code runs.

The renderer and generateEnvModule() disagree about when runtime env is needed. render_response defers env loading whenever the flag is set, even if every public variable is static: true and nothing can ever read env.js. Meanwhile generateEnvModule() only writes the file when client.uses_env_dynamic_public is set, which is always false under explicit env vars because $env/dynamic/public is disabled, so its explicit-env branch was unreachable.

This PR makes both sides read the same bit. uses_env_dynamic_public is now also true when the client bundle contains $app/env/public and at least one public variable is dynamic. Static-only apps get fully inlined env and no env.js import, and pages that do defer pick up a previously missing modulepreload. For the genuinely dynamic case generateEnvModule() now emits env.js, plus env.script.js when the app has a service worker, since non-module workers load dynamic vars via importScripts. The service worker build also drops the importScripts prelude when all public vars are static, resolving the TODO from #15934.

Two new test/prerendering apps cover both directions. explicit-env-static asserts prerendered HTML inlines the values and references no env.js, and that the service worker doesn't call importScripts. explicit-env-dynamic asserts the deferral stays and that env.js/env.script.js are emitted with only the dynamic values. Four of the eight assertions fail on main.

Hopefully this continues my redemption arc after #16008 😅

Fixes #15985

---

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
• This message body should clearly illustrate what problems it solves.
• Ideally, include a test that fails without this PR but passes with it.

Tests

• Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

• If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

• Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 40b364d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[teemingc]

Can we separate the two changes into two PRs?

[Nic-Polumeyv]

Sure, reverted the second commit so this PR is now just the env.js/env.script.js fix. The SSR omission gates on the broadened uses_env_dynamic_public from this PR, on main that flag is always false under explicit env vars so the change alone would strip env from apps that do read it at runtime. I'll open it as a follow-up once this merges.

[teemingc]

Thank you. This was a great catch. I just deduped some of the tests and moved them into an existing test suite. Also made it so that env.script.js is only generated if there are public dynamic env variables declared.