fix(adapter-cloudflare): await initialization on every request to prevent race condition

[thomastheyoung]

Description

This PR fixes a race condition in the Cloudflare adapter's worker where concurrent requests during cold start can bypass server initialization.

The problem

Currently, await initialized is inside the if (!origin) conditional:

async fetch(req, env, ctx) {
    if (!origin) {
        origin = new URL(req.url).origin;
        await initialized;
    }
    // ... handle request
}

This creates a race condition:

1. Request A arrives, origin is undefined
2. Request A enters the if block, sets origin, begins awaiting initialized
3. Request B arrives before Request A's await resolves
4. Request B sees origin is now set (truthy), skips the if block entirely
5. Request B proceeds to handle the request before the server has finished initializing

The fix

Move await initialized outside the conditional:

async fetch(req, env, ctx) {
    if (!origin) {
        origin = new URL(req.url).origin;
    }
    await initialized;
    // ... handle request
}

Why this is safe

The Server.init() method in packages/kit/src/runtime/server/index.js uses a memoization pattern:

let init_promise;

async init({ env, read }) {
  // ...
  await (init_promise ??= (async () => {
    // actual initialization logic
  })());
}

The ??= operator ensures the initialization logic only executes once:

1. First call: init_promise is undefined, so the async IIFE runs and its promise is stored
2. Subsequent calls: init_promise is already set, returns the same (resolved) promise immediately

This means awaiting initialized on every request:

Scenario	Behavior
First request	Awaits pending promise → waits for init
Concurrent requests during init	Await the same promise → all wait together
Requests after init	Await resolved promise → microtask, essentially instant

The initialization logic is never re-executed. The only "cost" is microtask scheduling from awaiting a resolved promise, which is negligible.

Reproduction

While difficult to reproduce reliably, this can manifest during:

• Cold starts with concurrent requests (e.g., page load triggering multiple API calls)
• High-traffic deployments where new isolates spin up frequently
• Load testing scenarios

Symptoms may include undefined behavior, errors from uninitialized server state, or inconsistent responses.

[changeset-bot]

🦋 Changeset detected

Latest commit: cb6e515

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/adapter-cloudflare	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[teemingc]

Thanks! Can you generate a changeset for this?

[thomastheyoung]

Done! Thanks for looking at it. Let me know if you need anything else.