sveltekit-adapter-middy 0.2.0 → 0.4.0

package/README.md

@@ -32,7 +32,7 @@ Creates a lambda that supports a Function URL with streaming responses.
   - `ssm`/`secrets-manger`
 - Removes `x-sveltekit-page` headers
 - Multiple `Set-Cookies`
-- Override `Origin` header with `ORIGIN` env
+- Trusted request origin via `HEADER_ORIGIN`, keeping SvelteKit's CSRF check intact
 
 Note: Bring your own deployment.
 
@@ -56,9 +56,83 @@ export default {
 
 ### Options
 
-- `handlerPath` (string): Relative path to handler override file. Overriding allows you to add in Content-Encoding, Security Headers, and pass in secrets more securely. Defaults to build-in minimalist handler.
+- `handlerPath` (string): Relative path to handler override file. Overriding allows you to add in Content-Encoding, Security Headers, and pass in secrets more securely. Defaults to build-in minimalist handler. See [Handler resolution](#handler-resolution).
 - `out` (string): Relative path to build dir. Defaults to `build`
 - `esbuildOptions` (object): `esbuild` option overrides. See [code]() for defaults.
+- `split` (object): Route splitting, `name` to route prefix. Defaults to `{}` (single lambda).
+
+### Request details
+
+- `getClientAddress()` returns the rightmost entry of `x-forwarded-for`, falling back to `requestContext.http.sourceIp`. CloudFront appends the viewer ip to any list a client supplies, so the rightmost entry is the one a client can't forge. This assumes exactly one trusted hop in front of the lambda — add another proxy and the trustworthy entry moves.
+- `read()` from `$app/server` is not supported. Static assets are written to `out/assets` for S3/CloudFront rather than bundled into the lambda, so there's no file for it to read. Using it fails the build rather than the request.
+- A body on a `GET` or `HEAD` is dropped; `Request` refuses to carry one.
+
+### Route splitting
+
+Build separate lambdas per route prefix, each with its own handler (and so its own middleware, IAM role, memory, and concurrency).
+
+```js
+adapter({
+  split: {
+    // `/admin/*` -> build/admin.mjs, using the default handler
+    admin: '/admin',
+    // `/api/*` -> build/api.mjs, using a custom handler
+    api: { prefix: '/api', handlerPath: './lambda/api.js' }
+  }
+})
+```
+
+Routes not matching any prefix go to `build/index.mjs`, as before. Static assets and prerendered pages are unaffected.
+
+Prefixes match SvelteKit **route ids**, not request paths, so param segments are written out literally:
+
+```js
+adapter({
+  split: {
+    // src/routes/[[lang]]/admin/**
+    admin: '/[[lang]]/admin',
+    // anything a prefix can't express
+    api: (route) => /(^|\/)api(\/|$)/.test(route.id)
+  }
+})
+```
+
+Routing requests to the right lambda is up to your infrastructure (eg CloudFront behaviours per path pattern). Note a localised prefix needs a pattern per shape — `/admin*` and `/*/admin*` for an optional `[[lang]]`. A split lambda only knows its own routes, so anything else sent to it renders a 404.
+
+### Handler resolution
+
+Each entry picks its handler from the first of these that exists. Specific beats global, and within each tier explicit beats implicit:
+
+1. that entry's own `handlerPath`
+2. `handler.js` beside the route it serves, eg `src/routes/admin/handler.js` for prefix `/admin`
+3. the top-level `handlerPath`
+4. `src/handler.js`
+5. the built-in minimalist handler
+
+So a per-entry middleware stack needs no config at all — drop a `handler.js` next to the route:
+
+```js
+// src/routes/admin/handler.js — only this lambda loads these parameters
+import middy from '@middy/core'
+import { executionModeStreamifyResponse } from '@middy/core/StreamifyResponse'
+import ssm from '@middy/ssm'
+import sveltekitHandler from './sveltekitHandler.js'
+import sveltekitMiddleware from './sveltekitMiddleware.js'
+
+export const handler = middy({ executionMode: executionModeStreamifyResponse })
+  .use([
+    ssm({ fetchData: { dbUrl: '/app/admin/db-url' }, setToContext: true }),
+    sveltekitMiddleware()
+  ])
+  .handler(sveltekitHandler)
+```
+
+Notes:
+
+- Handler files are copied into the build directory before bundling, so `./sveltekitHandler.js` and `./sveltekitMiddleware.js` resolve there, not next to your source file. Importing your own project code by relative path won't resolve; bare package specifiers are fine.
+- A `handlerPath` that doesn't exist throws rather than silently falling back.
+- Prefixes match route ids, so layout groups are ignored: `src/routes/(app)/admin/handler.js` serves prefix `/admin`.
+- SvelteKit ignores non-`+` files in the routes directory, so a colocated `handler.js` doesn't become a route.
 
 ## Recommended Infrastructure
 
@@ -66,6 +140,16 @@ export default {
 - S3: store static assets and pages
 - Lambda Function URL: server side rendering
 
+## Upgrading to 0.4
+
+Two behaviour changes need action:
+
+**Set `HEADER_ORIGIN`.** It previously overwrote the client's `Origin` header and was used as the request url origin, which made SvelteKit's CSRF check compare a value against itself — cross-site form posts were never rejected. The url origin now comes from `HEADER_ORIGIN` (or `host`) and the client's header is left alone, so the check works. If `HEADER_ORIGIN` doesn't match the origin browsers actually use, your own form posts will start returning 403.
+
+**`read()` from `$app/server` now fails the build.** It was declared as supported but never wired up, so it failed at runtime instead. If a route uses it, either drop the call or fetch the asset from your CDN.
+
+Also: a request body arriving on a `GET`/`HEAD` is dropped rather than throwing, `content-encoding` is no longer misread as a body encoding (`gzip` threw), and `getClientAddress()` returns a single ip rather than the raw `x-forwarded-for` list.
+
 ## Roadmap
 
 - infra diagram

package/index.js

@@ -1,18 +1,71 @@
 // Copyright 2026 will Farrell, and sveltekit-adapter-middy contributors.
 // SPDX-License-Identifier: MIT
-import { writeFileSync } from "node:fs";
+import { existsSync, readdirSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import esbuild from "esbuild";
 
 const name = "@middy/sveltekit";
-const files = fileURLToPath(new URL("./", import.meta.url).href);
+const files = fileURLToPath(new URL("./", import.meta.url));
+
+// `src/routes/admin/handler.js` -> `/admin`, matching the route id: layout
+// groups `(app)` are stripped, param segments `[[lang]]` are kept as written
+const routeHandlers = (routesDir) =>
+	new Map(
+		readdirSync(routesDir, { recursive: true })
+			.filter((file) => basename(file) === "handler.js")
+			.map((file) => [
+				`/${dirname(file)}`
+					.split(sep)
+					.join("/")
+					.replace(/\/\([^/]+\)/g, "")
+					.replace(/^\/\.$/, "/"),
+				join(routesDir, file),
+			]),
+	);
+
+// Specific beats global, explicit beats implicit: the entry's own `handlerPath`,
+// then a handler beside the route, then the top-level `handlerPath`, then
+// `src/handler.js`, then the built-in. A configured path that isn't there throws
+// rather than silently deploying the wrong middleware stack.
+export const resolveHandler = (entry, { routesDir, handlerPath, builtin }) => {
+	const configured = (path) => {
+		if (!existsSync(path)) {
+			throw new Error(`${name}: handlerPath not found: ${path}`);
+		}
+		return path;
+	};
+
+	if (entry.handlerPath) return configured(entry.handlerPath);
+	const local =
+		typeof entry.prefix === "string" &&
+		routeHandlers(routesDir).get(entry.prefix);
+	if (local) return local;
+	if (handlerPath) return configured(handlerPath);
+	const project = join(dirname(routesDir), "handler.js");
+	return existsSync(project) ? project : builtin;
+};
+
+// Routes matching an entry prefix go to that entry, everything else to `index`.
+// Prefixes match route ids, so param segments are written out: `/[[lang]]/admin`.
+// A function prefix covers anything a string can't express.
+const matches = ({ prefix }, route) =>
+	typeof prefix === "function"
+		? prefix(route)
+		: route.id === prefix || route.id.startsWith(`${prefix}/`);
+
+export const splitRoutes = (routes, entries) => {
+	const split = { index: [] };
+	for (const { name } of entries) split[name] = [];
+	for (const route of routes) {
+		const owner = entries.find((entry) => matches(entry, route));
+		split[owner?.name ?? "index"].push(route);
+	}
+	return split;
+};
 
 const sveltekitAdapterMiddy = (opts = {}) => {
-	const {
-		out = "build",
-		handlerPath = `${files}/handler.js`,
-		esbuildOptions = {},
-	} = opts;
+	const { out = "build", handlerPath, esbuildOptions = {}, split = {} } = opts;
 
 	return {
 		name,
@@ -27,53 +80,72 @@ const sveltekitAdapterMiddy = (opts = {}) => {
 				`${out}/assets${builder.config.kit.paths.base}`,
 			);
 
-			builder.log.minor("Building server");
 			await builder.writeServer(tmp);
-			writeFileSync(
-				`${tmp}/manifest.js`,
-				[
-					`export const manifest = ${builder.generateManifest({
-						relativePath: "./",
-					})};`,
-					`export const prerendered = new Set(${JSON.stringify(
-						builder.prerendered.paths,
-					)});`,
-					`export const base = ${JSON.stringify(
-						builder.config.kit.paths.base,
-					)};`,
-				].join("\n\n"),
-			);
 
 			builder.copy(
-				`${files}/sveltekitMiddleware.js`,
+				`${files}sveltekitMiddleware.js`,
 				`${tmp}/sveltekitMiddleware.js`,
 			);
-			builder.copy(
-				`${files}/sveltekitHandler.js`,
-				`${tmp}/sveltekitHandler.js`,
-			);
-			builder.copy(handlerPath, `${tmp}/handler.js`);
+			builder.copy(`${files}sveltekitHandler.js`, `${tmp}/sveltekitHandler.js`);
+
+			const entries = Object.entries(split).map(([name, value]) => {
+				const config = typeof value === "object" ? value : { prefix: value };
+				return {
+					name,
+					prefix: config.prefix,
+					handlerPath: config.handlerPath,
+				};
+			});
+			const routes = splitRoutes(builder.routes, entries);
+			entries.push({ name: "index" });
+
+			const resolveOptions = {
+				routesDir: builder.config.kit.files.routes,
+				handlerPath,
+				builtin: `${files}handler.js`,
+			};
 
 			try {
-				const result = await esbuild.build({
-					target: "node24",
-					bundle: true,
-					platform: "node",
-					format: "esm",
-					treeShaking: true,
-					...esbuildOptions,
-					entryPoints: [`${tmp}/handler.js`],
-					outfile: `${out}/index.mjs`,
-					external: ["node:*", ...(esbuildOptions?.external ?? [])],
-				});
+				for (const entry of entries) {
+					const entryHandler = resolveHandler(entry, resolveOptions);
+					builder.log.minor(`Building server: ${entry.name} (${entryHandler})`);
+					writeFileSync(
+						`${tmp}/manifest.js`,
+						[
+							`export const manifest = ${builder.generateManifest({
+								relativePath: "./",
+								routes: routes[entry.name],
+							})};`,
+							`export const prerendered = new Set(${JSON.stringify(
+								builder.prerendered.paths,
+							)});`,
+							`export const base = ${JSON.stringify(
+								builder.config.kit.paths.base,
+							)};`,
+						].join("\n\n"),
+					);
+					builder.copy(entryHandler, `${tmp}/handler.js`);
 
-				if (result.warnings.length > 0) {
-					const formatted = await esbuild.formatMessages(result.warnings, {
-						kind: "warning",
-						color: true,
+					const result = await esbuild.build({
+						target: "node24",
+						bundle: true,
+						platform: "node",
+						format: "esm",
+						treeShaking: true,
+						...esbuildOptions,
+						entryPoints: [`${tmp}/handler.js`],
+						outfile: `${out}/${entry.name}.mjs`,
+						external: ["node:*", ...(esbuildOptions?.external ?? [])],
 					});
 
-					console.error(formatted.join("\n"));
+					if (result.warnings.length > 0) {
+						const formatted = await esbuild.formatMessages(result.warnings, {
+							kind: "warning",
+							color: true,
+						});
+
+						console.error(formatted.join("\n"));
+					}
 				}
 			} catch (err) {
 				const formatted = await esbuild.formatMessages(err.errors, {
@@ -96,7 +168,7 @@ const sveltekitAdapterMiddy = (opts = {}) => {
 			);
 		},
 		supports: {
-			read: () => true,
+			read: () => false,
 		},
 	};
 };

package/package.json

@@ -1,12 +1,11 @@
 {
 	"name": "sveltekit-adapter-middy",
-	"version": "0.2.0",
+	"version": "0.4.0",
 	"description": "SvelteKit adapter for AWS Lambda with Middy",
 	"type": "module",
 	"engines": {
 		"node": ">=24"
 	},
-	"engineStrict": true,
 	"workspaces": [
 		".github"
 	],
@@ -92,23 +91,25 @@
 		"url": "https://github.com/sponsors/willfarrell"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "^2.5.3",
-		"@commitlint/cli": "^21.2.1",
-		"@commitlint/config-conventional": "^21.2.0",
+		"@biomejs/biome": "^2.0.0",
+		"@commitlint/cli": "^21.0.0",
+		"@commitlint/config-conventional": "^21.0.0",
 		"@stryker-mutator/core": "^9.0.0",
-		"fast-check": "^4.9.0",
-		"husky": "^9.1.7",
+		"fast-check": "^4.0.0",
+		"husky": "^9.0.0",
 		"license-check-and-add": "4.0.5",
-		"tinybench": "^6.0.2",
-		"tstyche": "^7.2.1",
-		"typescript": "^6.0.3"
+		"tinybench": "^6.0.0",
+		"tstyche": "^7.0.0",
+		"typescript": "^7.0.0"
 	},
 	"overrides": {
-		"qs": "^6.15.2"
+		"qs": "^6.15.2",
+		"brace-expansion": ">=5.0.9",
+		"fast-uri": "^3.1.5"
 	},
 	"dependencies": {
-		"@datastream/string": "0.5.0",
-		"@middy/core": "^7.7.0",
-		"esbuild": "^0.28.1"
+		"@datastream/string": "0.7.0",
+		"@middy/core": "^7.0.0",
+		"esbuild": "^0.28.0"
 	}
 }

package/sveltekitHandler.js

@@ -5,29 +5,37 @@ import { Readable } from "node:stream";
 const lambdaHandler = async (event, context, { signal: _signal }) => {
 	const { server, env: _env } = context;
 	const { headers, rawQueryString, body: rawBody, isBase64Encoded } = event;
-	const { method, path } = event.requestContext.http;
+	const { method, path, sourceIp } = event.requestContext.http;
 
-	// Override origin
-	headers.origin =
-		process.env.HEADER_ORIGIN ?? headers.origin ?? "https://example.com";
+	// The url origin must come from a trusted source. SvelteKit's CSRF check
+	// rejects form posts where the `origin` header doesn't match `url.origin`,
+	// so deriving one from the other would make the check unfailable. Set
+	// `HEADER_ORIGIN` in production; `host` is only as trustworthy as what fronts it.
+	const origin =
+		process.env.HEADER_ORIGIN ?? `https://${headers.host ?? "example.com"}`;
 
 	const queryString = rawQueryString ? `?${rawQueryString}` : "";
-	const url = `${headers.origin}${path}${queryString}`;
+	const url = `${origin}${path}${queryString}`;
 
-	// Buffer.from defaults a missing encoding to utf-8
-	const encoding = isBase64Encoded ? "base64" : headers["content-encoding"];
+	// `content-encoding` is a compression scheme, not a Buffer encoding
 	const body =
-		typeof rawBody === "string" ? Buffer.from(rawBody, encoding) : rawBody;
+		typeof rawBody === "string"
+			? Buffer.from(rawBody, isBase64Encoded ? "base64" : "utf8")
+			: rawBody;
 
 	const rendered = await server.respond(
 		new Request(url, {
 			method,
 			headers: new Headers(headers),
-			body,
+			// Request throws if a GET/HEAD carries one, however it arrived
+			body: method === "GET" || method === "HEAD" ? null : body,
 		}),
 		{
 			getClientAddress() {
-				return headers["x-forwarded-for"];
+				// CloudFront appends the viewer ip to any client-supplied list, so
+				// the rightmost entry is the only one a client can't forge.
+				const forwarded = headers["x-forwarded-for"]?.split(",").at(-1)?.trim();
+				return forwarded || sourceIp;
 			},
 		},
 	);

package/sveltekitMiddleware.js

@@ -22,7 +22,9 @@ const sveltekitMiddleware = () => {
 				pattern: formActionPattern,
 				replacement: formActionReplacement,
 			});
-			request.response.body = request.response.body.pipe(stream);
+			request.response.body = request.response.body
+				.setEncoding("utf8")
+				.pipe(stream);
 		}
 	};
 	return {