fix: set input type before spread value (#18345)

### Before submitting the PR, please make sure you do the following

- [x] It's really useful if your PR references an issue where it is
discussed ahead of time. In many cases, features are absent for a
reason. For large changes, please create an RFC:
https://github.com/sveltejs/rfcs
- [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`.
- [x] This message body should clearly illustrate what problems it
solves.
- [x] Ideally, include a test that fails without this PR but passes with
it.
- [x] If this PR changes code within `packages/svelte/src`, add a
changeset (`npx changeset`).

### Tests and linting

- [x] Run the tests with `pnpm test` and lint the project with `pnpm
lint`

Fixes #18332.

When spread props put `value` before a later `type="hidden"` on an
`<input>`, `set_attributes` currently writes the value while the element
is still a text input. Browsers sanitize text input values by removing
newlines, so the hidden input permanently loses them before `type` is
applied.

This sets an input's `type` first whenever the same spread update also
includes `value` or `__value`, so the existing value handling runs with
the final input type. The new runtime-browser sample covers both the
problematic spread-first order and the already-working type-first order.

Validation:

- `corepack pnpm lint`
- `CI=1 corepack pnpm test`
- `corepack pnpm vitest run
packages/svelte/tests/runtime-browser/test.ts -t
input-type-before-value-spread`

---------

Co-authored-by: Rich Harris <rich.harris@vercel.com>
Co-authored-by: Rich Harris <hello@rich-harris.dev>

.changeset/input-type-before-value.md

@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: preserve newlines in spread input values when the `type` attribute is applied after `value`

packages/svelte/src/internal/client/dom/elements/attributes.js

@@ -332,6 +332,15 @@ function set_attributes(
 
 	var setters = get_setters(element);
 
+	if (element.nodeName === INPUT_TAG && 'type' in next && ('value' in next || '__value' in next)) {
+		var type = next.type;
+
+		if (type !== current.type || (type === undefined && element.hasAttribute('type'))) {
+			current.type = type;
+			set_attribute(element, 'type', type, skip_warning);
+		}
+	}
+
 	// since key is captured we use const
 	for (const key in next) {
 		// let instead of var because referenced in a closure

packages/svelte/tests/runtime-runes/samples/input-type-before-value-spread/_config.js

@@ -0,0 +1,15 @@
+import { test } from '../../test';
+
+const value = 'line1\nline2\nline3';
+
+export default test({
+	mode: ['client'],
+	test({ assert, target }) {
+		const [spread_first, type_first] = target.querySelectorAll('input');
+
+		assert.equal(spread_first?.type, 'hidden');
+		assert.equal(spread_first?.value, value);
+		assert.equal(type_first?.type, 'hidden');
+		assert.equal(type_first?.value, value);
+	}
+});

packages/svelte/tests/runtime-runes/samples/input-type-before-value-spread/main.svelte

@@ -0,0 +1,7 @@
+<script>
+	const value = 'line1\nline2\nline3';
+	const spread = { name: 'field', value };
+</script>
+
+<input {...spread} type="hidden" />
+<input type="hidden" {...spread} />