@orochibraru/svelte-smol 1.7.0-next.2 → 1.7.0

package/README.md

@@ -10,25 +10,17 @@ no JS files to ship, just one binary plus its static assets.
 bun add -d @orochibraru/svelte-smol
 ```
 
-For SvelteKit 3 (prerelease), install from the `next` tag instead:
-
-```bash
-bun add -d @orochibraru/svelte-smol@next @sveltejs/kit@next
-```
-
 ## Usage
 
-SvelteKit 3 reads its options from the `sveltekit()` Vite plugin:
-
 ```js
-// vite.config.js
-import { sveltekit } from "@sveltejs/kit/vite";
-import { defineConfig } from "vite";
+// svelte.config.js
 import adapter from "@orochibraru/svelte-smol";
 
-export default defineConfig({
-  plugins: [sveltekit({ adapter: adapter() })],
-});
+export default {
+  kit: {
+    adapter: adapter(),
+  },
+};
 ```
 
 The compile step runs under the Bun runtime, so build with:

package/dist/index.d.ts

@@ -130,22 +130,18 @@ export interface AdapterOptions {
  *
  * @example
  * ```js
- * // vite.config.js
- * import { sveltekit } from "@sveltejs/kit/vite";
- * import { defineConfig } from "vite";
+ * // svelte.config.js
  * import adapter from "@orochibraru/svelte-smol";
  *
- * export default defineConfig({
- *   plugins: [
- *     sveltekit({
- *       adapter: adapter({
- *         // cross-compile for an Alpine container from any host
- *         target: "bun-linux-x64-musl",
- *         bytecode: true,
- *       }),
+ * export default {
+ *   kit: {
+ *     adapter: adapter({
+ *       // cross-compile for an Alpine container from any host
+ *       target: "bun-linux-x64-musl",
+ *       bytecode: true,
  *     }),
- *   ],
- * });
+ *   },
+ * };
  * ```
  *
  * @see {@link https://bun.com/docs/bundler/executables | Bun — Single-file executables}

package/dist/index.js

@@ -1,4 +1,3 @@
-import { mkdirSync, rmSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 // `node:url`, not `Bun.fileURLToPath`: this module is loaded at config-parse
 // time by Node-based tooling too (svelte-check, the Svelte language server,
@@ -43,22 +42,18 @@ const templates = fileURLToPath(new URL("./templates", import.meta.url));
  *
  * @example
  * ```js
- * // vite.config.js
- * import { sveltekit } from "@sveltejs/kit/vite";
- * import { defineConfig } from "vite";
+ * // svelte.config.js
  * import adapter from "@orochibraru/svelte-smol";
  *
- * export default defineConfig({
- *   plugins: [
- *     sveltekit({
- *       adapter: adapter({
- *         // cross-compile for an Alpine container from any host
- *         target: "bun-linux-x64-musl",
- *         bytecode: true,
- *       }),
+ * export default {
+ *   kit: {
+ *     adapter: adapter({
+ *       // cross-compile for an Alpine container from any host
+ *       target: "bun-linux-x64-musl",
+ *       bytecode: true,
  *     }),
- *   ],
- * });
+ *   },
+ * };
  * ```
  *
  * @see {@link https://bun.com/docs/bundler/executables | Bun — Single-file executables}
@@ -77,12 +72,12 @@ export default function adapter(options = {}) {
             read: () => true,
         },
         async adapt(builder) {
-            const { base } = builder.config.paths;
+            const { base } = builder.config.kit.paths;
             const tmp = builder.getBuildDirectory("adapter-bun");
-            rmSync(out, { force: true, recursive: true });
-            rmSync(tmp, { force: true, recursive: true });
-            mkdirSync(out, { recursive: true });
-            mkdirSync(tmp, { recursive: true });
+            builder.rimraf(out);
+            builder.rimraf(tmp);
+            builder.mkdirp(`${out}/`);
+            builder.mkdirp(tmp);
             builder.log.minor("Copying assets");
             builder.writeClient(`${out}/client${base}`);
             builder.writePrerendered(`${out}/prerendered${base}`);
@@ -95,15 +90,10 @@ export default function adapter(options = {}) {
             }
             builder.log.minor("Building server");
             builder.writeServer(`${tmp}/server`);
-            // SvelteKit 3 no longer hands out a serialised manifest; it writes a
-            // module exporting a ready-made `server` instance instead.
-            builder.generateServerInstance(`${tmp}/server/instance.js`, {
-                serverDirectory: `${tmp}/server`,
-            });
             await Bun.write(`${tmp}/server/manifest.js`, [
+                `export const manifest = ${builder.generateManifest({ relativePath: "./" })};`,
                 `export const prerendered = new Set(${JSON.stringify(builder.prerendered.paths)});`,
                 `export const base = ${JSON.stringify(base)};`,
-                `export const app_path = ${JSON.stringify(builder.getAppPath())};`,
             ].join("\n\n"));
             // Entry templates ship as raw `.ts` — `bun build --compile` runs them
             // straight through. The virtual specifiers (`ENV`, `MANIFEST`,
@@ -124,22 +114,16 @@ export default function adapter(options = {}) {
                     HANDLER: "./handler.ts",
                     MANIFEST: "./server/manifest.js",
                     SERVE_OPTIONS: JSON.stringify(serveOptions),
-                    SERVER: "./server/instance.js",
+                    SERVER: "./server/index.js",
                 },
             });
             const entry = `${tmp}/index.ts`;
-            if (builder.hasServerInstrumentationFile()) {
+            if (builder.hasServerInstrumentationFile?.()) {
                 // Instrumentation (OpenTelemetry &c.) has to load before anything
                 // else in the bundle. A compiled binary has no post-build
-                // entrypoint to rewrite, so prepend the imports to the compile
-                // entrypoint instead. The initializer populates
-                // `$env/dynamic/private` first, so instrumentation can read it.
-                const initializer = builder.createInstrumentationInitializer({
-                    outputDirectory: tmp,
-                    serverDirectory: `${tmp}/server`,
-                    environment: "export default Bun.env;",
-                });
-                await Bun.write(entry, `import ${JSON.stringify(initializer)};\nimport "./server/instrumentation.server.js";\n${await Bun.file(entry).text()}`);
+                // entrypoint to rewrite, so prepend the import to the compile
+                // entrypoint instead.
+                await Bun.write(entry, `import "./server/instrumentation.server.js";\n${await Bun.file(entry).text()}`);
             }
             const check = (result, label) => {
                 if (!result.success) {

package/dist/templates/handler.ts

@@ -1,13 +1,13 @@
 /* global ENV_PREFIX, BUILD_OPTIONS */
 
 import { env } from "ENV";
-import { app_path, base, prerendered } from "MANIFEST";
-import { server as kit_server } from "SERVER";
+import { base, manifest, prerendered } from "MANIFEST";
+import { Server } from "SERVER";
 import { statSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import type { Server as SvelteKitServer } from "@sveltejs/kit";
 
-const server = kit_server as SvelteKitServer & {
+const server = new Server(manifest) as SvelteKitServer & {
 	websocket?: () => Bun.WebSocketHandler<undefined> | undefined;
 };
 
@@ -33,7 +33,7 @@ const self_dir = compiled ? dirname(process.execPath) : import.meta.dir;
 const assets_root = resolve(self_dir, env("ASSETS_DIR", ""));
 const client_dir = `${assets_root}/client${base}`;
 const prerendered_dir = `${assets_root}/prerendered${base}`;
-const immutable_prefix = `/${app_path}/immutable/`;
+const immutable_prefix = `${base}/${manifest.appDir}/immutable/`;
 
 await server.init({
 	env: Bun.env as Record<string, string>,
@@ -166,7 +166,10 @@ const ssr = async (request: Request, bunServer: Bun.Server<undefined>) => {
 		return asset;
 	}
 
-	const baseOrigin = origin || get_origin(request.headers);
+	const baseOrigin =
+		same_host_remote_origin(request, url) ||
+		origin ||
+		get_origin(request.headers);
 	const path = request.url.slice(request.url.split("/", 3).join("/").length);
 	const newRequest = new Request(baseOrigin + path, request);
 
@@ -233,3 +236,24 @@ function get_origin(headers: Headers) {
 
 	return port ? `${protocol}://${host}:${port}` : `${protocol}://${host}`;
 }
+
+// Remote function calls are CSRF-checked against the request origin. When the
+// browser's Origin header matches the Host, use it instead of ORIGIN.
+function same_host_remote_origin(request: Request, url: URL) {
+	const request_origin = request.headers.get("origin");
+	if (
+		!request_origin ||
+		!url.pathname.startsWith(`${base}/${manifest.appDir}/remote/`)
+	) {
+		return null;
+	}
+	try {
+		const parsed = new URL(request_origin);
+		const host =
+			(host_header && request.headers.get(host_header)) ||
+			request.headers.get("host");
+		return parsed.host === host ? parsed.origin : null;
+	} catch {
+		return null;
+	}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@orochibraru/svelte-smol",
-	"version": "1.7.0-next.2",
+	"version": "1.7.0",
 	"type": "module",
 	"main": "./dist/index.js",
 	"keywords": [
@@ -48,7 +48,7 @@
 		"@biomejs/biome": "^2.5.11",
 		"@semantic-release/github": "^12.0.9",
 		"@semantic-release/npm": "^13.1.5",
-		"@sveltejs/kit": "^3.0.0-next.27",
+		"@sveltejs/kit": "^2.70.3",
 		"@sveltejs/vite-plugin-svelte": "^7.3.0",
 		"@types/bun": "^1.4.0",
 		"conventional-changelog-conventionalcommits": "^8",
@@ -59,6 +59,6 @@
 		"vite": "^8.2.2"
 	},
 	"peerDependencies": {
-		"@sveltejs/kit": "^3.0.0-next.0"
+		"@sveltejs/kit": "^2.0.0"
 	}
 }