sveltekit-adapter-middy 0.1.0 → 0.4.0

package/README.md

@@ -32,7 +32,7 @@ Creates a lambda that supports a Function URL with streaming responses.
   - `ssm`/`secrets-manger`
 - Removes `x-sveltekit-page` headers
 - Multiple `Set-Cookies`
-- Override `Origin` header with `ORIGIN` env
+- Trusted request origin via `HEADER_ORIGIN`, keeping SvelteKit's CSRF check intact
 
 Note: Bring your own deployment.
 
@@ -56,9 +56,83 @@ export default {
 
 ### Options
 
-- `handlerPath` (string): Relative path to handler override file. Overriding allows you to add in Content-Encoding, Security Headers, and pass in secrets more securely. Defaults to build-in minimalist handler.
+- `handlerPath` (string): Relative path to handler override file. Overriding allows you to add in Content-Encoding, Security Headers, and pass in secrets more securely. Defaults to build-in minimalist handler. See [Handler resolution](#handler-resolution).
 - `out` (string): Relative path to build dir. Defaults to `build`
 - `esbuildOptions` (object): `esbuild` option overrides. See [code]() for defaults.
+- `split` (object): Route splitting, `name` to route prefix. Defaults to `{}` (single lambda).
+
+### Request details
+
+- `getClientAddress()` returns the rightmost entry of `x-forwarded-for`, falling back to `requestContext.http.sourceIp`. CloudFront appends the viewer ip to any list a client supplies, so the rightmost entry is the one a client can't forge. This assumes exactly one trusted hop in front of the lambda — add another proxy and the trustworthy entry moves.
+- `read()` from `$app/server` is not supported. Static assets are written to `out/assets` for S3/CloudFront rather than bundled into the lambda, so there's no file for it to read. Using it fails the build rather than the request.
+- A body on a `GET` or `HEAD` is dropped; `Request` refuses to carry one.
+
+### Route splitting
+
+Build separate lambdas per route prefix, each with its own handler (and so its own middleware, IAM role, memory, and concurrency).
+
+```js
+adapter({
+  split: {
+    // `/admin/*` -> build/admin.mjs, using the default handler
+    admin: '/admin',
+    // `/api/*` -> build/api.mjs, using a custom handler
+    api: { prefix: '/api', handlerPath: './lambda/api.js' }
+  }
+})
+```
+
+Routes not matching any prefix go to `build/index.mjs`, as before. Static assets and prerendered pages are unaffected.
+
+Prefixes match SvelteKit **route ids**, not request paths, so param segments are written out literally:
+
+```js
+adapter({
+  split: {
+    // src/routes/[[lang]]/admin/**
+    admin: '/[[lang]]/admin',
+    // anything a prefix can't express
+    api: (route) => /(^|\/)api(\/|$)/.test(route.id)
+  }
+})
+```
+
+Routing requests to the right lambda is up to your infrastructure (eg CloudFront behaviours per path pattern). Note a localised prefix needs a pattern per shape — `/admin*` and `/*/admin*` for an optional `[[lang]]`. A split lambda only knows its own routes, so anything else sent to it renders a 404.
+
+### Handler resolution
+
+Each entry picks its handler from the first of these that exists. Specific beats global, and within each tier explicit beats implicit:
+
+1. that entry's own `handlerPath`
+2. `handler.js` beside the route it serves, eg `src/routes/admin/handler.js` for prefix `/admin`
+3. the top-level `handlerPath`
+4. `src/handler.js`
+5. the built-in minimalist handler
+
+So a per-entry middleware stack needs no config at all — drop a `handler.js` next to the route:
+
+```js
+// src/routes/admin/handler.js — only this lambda loads these parameters
+import middy from '@middy/core'
+import { executionModeStreamifyResponse } from '@middy/core/StreamifyResponse'
+import ssm from '@middy/ssm'
+import sveltekitHandler from './sveltekitHandler.js'
+import sveltekitMiddleware from './sveltekitMiddleware.js'
+
+export const handler = middy({ executionMode: executionModeStreamifyResponse })
+  .use([
+    ssm({ fetchData: { dbUrl: '/app/admin/db-url' }, setToContext: true }),
+    sveltekitMiddleware()
+  ])
+  .handler(sveltekitHandler)
+```
+
+Notes:
+
+- Handler files are copied into the build directory before bundling, so `./sveltekitHandler.js` and `./sveltekitMiddleware.js` resolve there, not next to your source file. Importing your own project code by relative path won't resolve; bare package specifiers are fine.
+- A `handlerPath` that doesn't exist throws rather than silently falling back.
+- Prefixes match route ids, so layout groups are ignored: `src/routes/(app)/admin/handler.js` serves prefix `/admin`.
+- SvelteKit ignores non-`+` files in the routes directory, so a colocated `handler.js` doesn't become a route.
 
 ## Recommended Infrastructure
 
@@ -66,6 +140,16 @@ export default {
 - S3: store static assets and pages
 - Lambda Function URL: server side rendering
 
+## Upgrading to 0.4
+
+Two behaviour changes need action:
+
+**Set `HEADER_ORIGIN`.** It previously overwrote the client's `Origin` header and was used as the request url origin, which made SvelteKit's CSRF check compare a value against itself — cross-site form posts were never rejected. The url origin now comes from `HEADER_ORIGIN` (or `host`) and the client's header is left alone, so the check works. If `HEADER_ORIGIN` doesn't match the origin browsers actually use, your own form posts will start returning 403.
+
+**`read()` from `$app/server` now fails the build.** It was declared as supported but never wired up, so it failed at runtime instead. If a route uses it, either drop the call or fetch the asset from your CDN.
+
+Also: a request body arriving on a `GET`/`HEAD` is dropped rather than throwing, `content-encoding` is no longer misread as a body encoding (`gzip` threw), and `getClientAddress()` returns a single ip rather than the raw `x-forwarded-for` list.
+
 ## Roadmap
 
 - infra diagram

package/index.js

@@ -1,18 +1,71 @@
 // Copyright 2026 will Farrell, and sveltekit-adapter-middy contributors.
 // SPDX-License-Identifier: MIT
-import { writeFileSync } from "node:fs";
+import { existsSync, readdirSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import esbuild from "esbuild";
 
 const name = "@middy/sveltekit";
-const files = fileURLToPath(new URL("./", import.meta.url).href);
+const files = fileURLToPath(new URL("./", import.meta.url));
+
+// `src/routes/admin/handler.js` -> `/admin`, matching the route id: layout
+// groups `(app)` are stripped, param segments `[[lang]]` are kept as written
+const routeHandlers = (routesDir) =>
+	new Map(
+		readdirSync(routesDir, { recursive: true })
+			.filter((file) => basename(file) === "handler.js")
+			.map((file) => [
+				`/${dirname(file)}`
+					.split(sep)
+					.join("/")
+					.replace(/\/\([^/]+\)/g, "")
+					.replace(/^\/\.$/, "/"),
+				join(routesDir, file),
+			]),
+	);
+
+// Specific beats global, explicit beats implicit: the entry's own `handlerPath`,
+// then a handler beside the route, then the top-level `handlerPath`, then
+// `src/handler.js`, then the built-in. A configured path that isn't there throws
+// rather than silently deploying the wrong middleware stack.
+export const resolveHandler = (entry, { routesDir, handlerPath, builtin }) => {
+	const configured = (path) => {
+		if (!existsSync(path)) {
+			throw new Error(`${name}: handlerPath not found: ${path}`);
+		}
+		return path;
+	};
+
+	if (entry.handlerPath) return configured(entry.handlerPath);
+	const local =
+		typeof entry.prefix === "string" &&
+		routeHandlers(routesDir).get(entry.prefix);
+	if (local) return local;
+	if (handlerPath) return configured(handlerPath);
+	const project = join(dirname(routesDir), "handler.js");
+	return existsSync(project) ? project : builtin;
+};
+
+// Routes matching an entry prefix go to that entry, everything else to `index`.
+// Prefixes match route ids, so param segments are written out: `/[[lang]]/admin`.
+// A function prefix covers anything a string can't express.
+const matches = ({ prefix }, route) =>
+	typeof prefix === "function"
+		? prefix(route)
+		: route.id === prefix || route.id.startsWith(`${prefix}/`);
+
+export const splitRoutes = (routes, entries) => {
+	const split = { index: [] };
+	for (const { name } of entries) split[name] = [];
+	for (const route of routes) {
+		const owner = entries.find((entry) => matches(entry, route));
+		split[owner?.name ?? "index"].push(route);
+	}
+	return split;
+};
 
 const sveltekitAdapterMiddy = (opts = {}) => {
-	const {
-		out = "build",
-		handlerPath = `${files}/handler.js`,
-		esbuildOptions = {},
-	} = opts;
+	const { out = "build", handlerPath, esbuildOptions = {}, split = {} } = opts;
 
 	return {
 		name,
@@ -27,53 +80,72 @@ const sveltekitAdapterMiddy = (opts = {}) => {
 				`${out}/assets${builder.config.kit.paths.base}`,
 			);
 
-			builder.log.minor("Building server");
 			await builder.writeServer(tmp);
-			writeFileSync(
-				`${tmp}/manifest.js`,
-				[
-					`export const manifest = ${builder.generateManifest({
-						relativePath: "./",
-					})};`,
-					`export const prerendered = new Set(${JSON.stringify(
-						builder.prerendered.paths,
-					)});`,
-					`export const base = ${JSON.stringify(
-						builder.config.kit.paths.base,
-					)};`,
-				].join("\n\n"),
-			);
 
 			builder.copy(
-				`${files}/sveltekitMiddleware.js`,
+				`${files}sveltekitMiddleware.js`,
 				`${tmp}/sveltekitMiddleware.js`,
 			);
-			builder.copy(
-				`${files}/sveltekitHandler.js`,
-				`${tmp}/sveltekitHandler.js`,
-			);
-			builder.copy(handlerPath, `${tmp}/handler.js`);
+			builder.copy(`${files}sveltekitHandler.js`, `${tmp}/sveltekitHandler.js`);
+
+			const entries = Object.entries(split).map(([name, value]) => {
+				const config = typeof value === "object" ? value : { prefix: value };
+				return {
+					name,
+					prefix: config.prefix,
+					handlerPath: config.handlerPath,
+				};
+			});
+			const routes = splitRoutes(builder.routes, entries);
+			entries.push({ name: "index" });
+
+			const resolveOptions = {
+				routesDir: builder.config.kit.files.routes,
+				handlerPath,
+				builtin: `${files}handler.js`,
+			};
 
 			try {
-				const result = await esbuild.build({
-					target: "node24",
-					bundle: true,
-					platform: "node",
-					format: "esm",
-					treeShaking: true,
-					...esbuildOptions,
-					entryPoints: [`${tmp}/handler.js`],
-					outfile: `${out}/index.mjs`,
-					external: ["node:*", ...(esbuildOptions?.external ?? [])],
-				});
+				for (const entry of entries) {
+					const entryHandler = resolveHandler(entry, resolveOptions);
+					builder.log.minor(`Building server: ${entry.name} (${entryHandler})`);
+					writeFileSync(
+						`${tmp}/manifest.js`,
+						[
+							`export const manifest = ${builder.generateManifest({
+								relativePath: "./",
+								routes: routes[entry.name],
+							})};`,
+							`export const prerendered = new Set(${JSON.stringify(
+								builder.prerendered.paths,
+							)});`,
+							`export const base = ${JSON.stringify(
+								builder.config.kit.paths.base,
+							)};`,
+						].join("\n\n"),
+					);
+					builder.copy(entryHandler, `${tmp}/handler.js`);
 
-				if (result.warnings.length > 0) {
-					const formatted = await esbuild.formatMessages(result.warnings, {
-						kind: "warning",
-						color: true,
+					const result = await esbuild.build({
+						target: "node24",
+						bundle: true,
+						platform: "node",
+						format: "esm",
+						treeShaking: true,
+						...esbuildOptions,
+						entryPoints: [`${tmp}/handler.js`],
+						outfile: `${out}/${entry.name}.mjs`,
+						external: ["node:*", ...(esbuildOptions?.external ?? [])],
 					});
 
-					console.error(formatted.join("\n"));
+					if (result.warnings.length > 0) {
+						const formatted = await esbuild.formatMessages(result.warnings, {
+							kind: "warning",
+							color: true,
+						});
+
+						console.error(formatted.join("\n"));
+					}
 				}
 			} catch (err) {
 				const formatted = await esbuild.formatMessages(err.errors, {
@@ -96,7 +168,7 @@ const sveltekitAdapterMiddy = (opts = {}) => {
 			);
 		},
 		supports: {
-			read: () => true,
+			read: () => false,
 		},
 	};
 };

package/package.json

@@ -1,12 +1,11 @@
 {
 	"name": "sveltekit-adapter-middy",
-	"version": "0.1.0",
+	"version": "0.4.0",
 	"description": "SvelteKit adapter for AWS Lambda with Middy",
 	"type": "module",
 	"engines": {
 		"node": ">=24"
 	},
-	"engineStrict": true,
 	"workspaces": [
 		".github"
 	],
@@ -35,21 +34,31 @@
 		"git:unit-staged": "node --test",
 		"git:test-staged": "npm run git:unit-staged",
 		"lint": "biome check --write --no-errors-on-unmatched",
-		"test": "npm run test:lint && npm run test:unit && npm run test:types && npm run test:sast && npm run test:perf && npm run test:dast",
-		"test:sast": "npm run test:sast:license && npm run test:sast:lockfile && npm run test:sast:semgrep && npm run test:sast:trufflehog && npm run test:sast:trivy",
-		"test:sast:license": "license-check-and-add check -f license.json",
+		"test": "npm run test:lint && npm run test:unit && npm run test:mutation && npm run test:types && npm run test:sast && npm run test:perf && npm run test:dast",
+		"test:sast": "npm run test:sast:license && npm run test:sast:lockfile && npm run test:sast:semgrep && npm run test:sast:trufflehog && npm run test:sast:gitleaks && npm run test:sast:actionlint && npm run test:sast:zizmor && npm run test:sast:trivy",
+		"test:sast:actionlint": "actionlint",
+		"test:sast:gitleaks": "npm run test:sast:gitleaks:dir && npm run test:sast:gitleaks:git",
+		"test:sast:gitleaks:dir": "gitleaks dir . --redact --no-banner",
+		"test:sast:gitleaks:git": "gitleaks git . --redact --no-banner",
+		"test:sast:license": "license-check-and-add check -f .license.config.json",
 		"test:sast:lockfile": "lockfile-lint --path package-lock.json --type npm --allowed-hosts npm --validate-https",
-		"test:sast:semgrep": "semgrep scan --config auto",
-		"test:sast:trivy": "trivy fs --scanners vuln,license --include-dev-deps --ignored-licenses 0BSD,Apache-2.0,BSD-1-Clause,BSD-2-Clause,BSD-3-Clause,CC0-1.0,CC-BY-4.0,ISC,MIT,Python-2.0 --exit-code 1 --disable-telemetry .",
+		"test:sast:semgrep": "semgrep scan --config auto --error",
+		"test:sast:trivy": "trivy fs --scanners vuln,license --include-dev-deps --ignored-licenses 0BSD,Apache-2.0,BSD-1-Clause,BSD-2-Clause,BSD-3-Clause,CC0-1.0,CC-BY-4.0,ISC,MIT,Python-2.0,LGPL-3.0-or-later,MPL-2.0,BlueOak-1.0.0,Unlicense --exit-code 1 --skip-files '**/bun.lock' --disable-telemetry .",
 		"test:sast:trufflehog": "trufflehog filesystem --only-verified --log-level=-1 ./",
+		"test:sast:zizmor": "zizmor .github",
 		"test:lint": "biome check --staged --no-errors-on-unmatched",
 		"test:unit": "node --test --test-force-exit --experimental-test-coverage --test-coverage-lines=80 --test-coverage-branches=70 --test-coverage-functions=80 --test-coverage-exclude=sveltekitMiddleware.js --test-coverage-exclude=handler.js --test-coverage-exclude=index.js ./*.test.js",
+		"test:mutation": "stryker run",
 		"test:types": "tstyche",
 		"test:perf": "node --test --test-concurrency=1 ./*.perf.js",
 		"test:dast": "npm run test:dast:fuzz",
 		"test:dast:fuzz": "node --test ./*.fuzz.js",
-		"release:license:add": "license-check-and-add add -f license.json",
-		"release:license:remove": "license-check-and-add remove -f license.json"
+		"rm": "npm run rm:macos && npm run rm:node_modules && npm run rm:lock",
+		"rm:macos": "find . -name '.DS_Store' -type f -delete",
+		"rm:lock": "find . -name 'package-lock.json' -type f -delete",
+		"rm:node_modules": "find . -name 'node_modules' -type d -prune -exec rm -rf '{}' +",
+		"release:license:add": "license-check-and-add add -f .license.config.json",
+		"release:license:remove": "license-check-and-add remove -f .license.config.json"
 	},
 	"license": "MIT",
 	"keywords": [
@@ -83,17 +92,24 @@
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.0.0",
-		"@commitlint/cli": "^20.0.0",
-		"@commitlint/config-conventional": "^20.0.0",
+		"@commitlint/cli": "^21.0.0",
+		"@commitlint/config-conventional": "^21.0.0",
+		"@stryker-mutator/core": "^9.0.0",
 		"fast-check": "^4.0.0",
 		"husky": "^9.0.0",
 		"license-check-and-add": "4.0.5",
 		"tinybench": "^6.0.0",
-		"tstyche": "^6.0.0"
+		"tstyche": "^7.0.0",
+		"typescript": "^7.0.0"
+	},
+	"overrides": {
+		"qs": "^6.15.2",
+		"brace-expansion": ">=5.0.9",
+		"fast-uri": "^3.1.5"
 	},
 	"dependencies": {
-		"@datastream/string": "0.0.42",
+		"@datastream/string": "0.7.0",
 		"@middy/core": "^7.0.0",
-		"esbuild": "^0.27.0"
+		"esbuild": "^0.28.0"
 	}
 }

package/sveltekitHandler.js

@@ -5,30 +5,37 @@ import { Readable } from "node:stream";
 const lambdaHandler = async (event, context, { signal: _signal }) => {
 	const { server, env: _env } = context;
 	const { headers, rawQueryString, body: rawBody, isBase64Encoded } = event;
-	const { method, path } = event.requestContext.http;
+	const { method, path, sourceIp } = event.requestContext.http;
 
-	// Override origin
-	headers.origin =
-		process.env.HEADER_ORIGIN ?? headers.origin ?? "https://example.com";
+	// The url origin must come from a trusted source. SvelteKit's CSRF check
+	// rejects form posts where the `origin` header doesn't match `url.origin`,
+	// so deriving one from the other would make the check unfailable. Set
+	// `HEADER_ORIGIN` in production; `host` is only as trustworthy as what fronts it.
+	const origin =
+		process.env.HEADER_ORIGIN ?? `https://${headers.host ?? "example.com"}`;
 
 	const queryString = rawQueryString ? `?${rawQueryString}` : "";
-	const url = `${headers.origin}${path}${queryString}`;
+	const url = `${origin}${path}${queryString}`;
 
-	const encoding = isBase64Encoded
-		? "base64"
-		: (headers["content-encoding"] ?? "utf-8");
+	// `content-encoding` is a compression scheme, not a Buffer encoding
 	const body =
-		typeof rawBody === "string" ? Buffer.from(rawBody, encoding) : rawBody;
+		typeof rawBody === "string"
+			? Buffer.from(rawBody, isBase64Encoded ? "base64" : "utf8")
+			: rawBody;
 
 	const rendered = await server.respond(
 		new Request(url, {
 			method,
 			headers: new Headers(headers),
-			body,
+			// Request throws if a GET/HEAD carries one, however it arrived
+			body: method === "GET" || method === "HEAD" ? null : body,
 		}),
 		{
 			getClientAddress() {
-				return headers["x-forwarded-for"];
+				// CloudFront appends the viewer ip to any client-supplied list, so
+				// the rightmost entry is the only one a client can't forge.
+				const forwarded = headers["x-forwarded-for"]?.split(",").at(-1)?.trim();
+				return forwarded || sourceIp;
 			},
 		},
 	);
@@ -53,7 +60,7 @@ const lambdaHandler = async (event, context, { signal: _signal }) => {
 		}
 
 		if (rendered.body) {
-			response.body = Readable.from(rendered.body);
+			response.body = Readable.fromWeb(rendered.body);
 		}
 
 		return response;

package/sveltekitMiddleware.js

@@ -22,7 +22,9 @@ const sveltekitMiddleware = () => {
 				pattern: formActionPattern,
 				replacement: formActionReplacement,
 			});
-			request.response.body.pipe(stream);
+			request.response.body = request.response.body
+				.setEncoding("utf8")
+				.pipe(stream);
 		}
 	};
 	return {

package/license.json

@@ -1,26 +0,0 @@
-{
-	"license": "license.template",
-	"licenseFormats": {
-		"js|ts": {
-			"eachLine": {
-				"prepend": "// "
-			}
-		}
-	},
-	"ignoreFile": ".gitignore",
-	"ignore": [
-		".github/**/*",
-		".husky/**/*",
-		"fixtures/*",
-		"commitlint.config.cjs",
-		"LICENSE",
-		"license.template",
-		"**/.gitignore",
-		"**/*.fuzz.js",
-		"**/*.perf.js",
-		"**/*.test.js",
-		"**/*.md",
-		"**/*.yml",
-		".DS_Store"
-	]
-}

package/license.template

@@ -1,2 +0,0 @@
-Copyright 2026 will Farrell, and sveltekit-adapter-middy contributors.
-SPDX-License-Identifier: MIT