@riducms/sveltekit 0.16.2 → 0.18.0

package/dist/browser-session.d.ts

@@ -0,0 +1,64 @@
+import type { SessionTokenStore } from "@riducms/sdk";
+/** The safe session snapshot shared by tabs and rendered pages. It never contains the token. */
+export interface SessionSnapshot {
+    id: string;
+    expiresAt: string;
+}
+/** Tabs share one cookie jar; a message only tells other tabs to adopt the change. */
+interface SessionMessage<Session> {
+    session: Session | null;
+}
+interface MessageChannel<Session> {
+    postMessage(message: SessionMessage<Session>): void;
+    addEventListener(type: "message", listener: (event: MessageEvent) => void): void;
+    removeEventListener(type: "message", listener: (event: MessageEvent) => void): void;
+    close(): void;
+}
+export interface BrowserSessionOptions<Session> {
+    cookieName: string;
+    /** The document whose cookie jar holds the token. */
+    document: {
+        cookie: string;
+    };
+    secure: boolean;
+    /**
+     * Server-rendered session snapshots, usually `() => data.session` from the root layout. They seed
+     * hydration and refresh the user; a stale snapshot never replaces newer browser state.
+     */
+    snapshot?: (() => Session | null | undefined) | undefined;
+    /** Cross-tab notifications. Tokens are never posted, only safe snapshots. */
+    channel?: MessageChannel<Session> | undefined;
+    /** Record a reactive read, such as a Svelte subscriber. */
+    track?: (() => void) | undefined;
+    /** The signed-in identity changed: SvelteKit loads that depend on auth must rerun. */
+    onAuthChange(): void;
+    /** Another tab or a server response replaced the token; verify the new one with Ridu. */
+    onExternalToken(): void;
+}
+/**
+ * Owns a token-transport session in the browser. The token lives in a frontend-domain cookie that
+ * server rendering also receives; this store reads it on every request and never caches it.
+ */
+export declare class BrowserSessionStore<Session extends SessionSnapshot> implements SessionTokenStore<Session> {
+    #private;
+    constructor(options: BrowserSessionOptions<Session>);
+    get token(): string | null;
+    get session(): Session | null;
+    subscribe(listener: () => void): () => boolean;
+    issued(token: string, session: Session): void;
+    verified(token: string, session: Session): void;
+    cleared(token: string): void;
+    /**
+     * Detect a token that changed without this tab's involvement, such as a server action login, an
+     * expired cookie, or a tab without BroadcastChannel. Call it when the page becomes visible.
+     */
+    checkExternalChange(): void;
+    /**
+     * Call once after hydration. A broadcast sent while this page was loading was missed, so compare
+     * the rendered session with the cookie: a session that ended or a token that appeared meanwhile
+     * reruns auth-dependent loads.
+     */
+    hydrated(): void;
+    dispose(): void;
+}
+export {};

package/dist/browser-session.js

@@ -0,0 +1,135 @@
+import { expiredTokenCookie, readCookie, tokenCookie } from "./cookie.js";
+/**
+ * Owns a token-transport session in the browser. The token lives in a frontend-domain cookie that
+ * server rendering also receives; this store reads it on every request and never caches it.
+ */
+export class BrowserSessionStore {
+    #options;
+    #listeners = new Set();
+    #session = null;
+    /** The token the current snapshot belongs to. Any other cookie value arrived out of band. */
+    #knownToken = null;
+    #lastSnapshot;
+    #receive = (event) => this.#adopt(event.data);
+    constructor(options) {
+        this.#options = options;
+        options.channel?.addEventListener("message", this.#receive);
+    }
+    get token() {
+        return readCookie(this.#options.document.cookie, this.#options.cookieName);
+    }
+    get session() {
+        this.#options.track?.();
+        this.#reconcile();
+        return this.#session;
+    }
+    subscribe(listener) {
+        this.#listeners.add(listener);
+        return () => this.#listeners.delete(listener);
+    }
+    issued(token, session) {
+        this.#options.document.cookie = tokenCookie(this.#options.cookieName, token, {
+            expires: new Date(session.expiresAt),
+            secure: this.#options.secure,
+        });
+        this.#session = session;
+        this.#knownToken = token;
+        this.#changed(true);
+    }
+    verified(token, session) {
+        // A late verification for a replaced token must not restore the previous account.
+        if (this.token !== token)
+            return;
+        this.#session = session;
+        this.#knownToken = token;
+        this.#emit();
+    }
+    cleared(token) {
+        // A late rejection or logout must not clear a newer login.
+        if (this.token !== token)
+            return;
+        this.#options.document.cookie = expiredTokenCookie(this.#options.cookieName, this.#options.secure);
+        this.#session = null;
+        this.#knownToken = null;
+        this.#changed(true);
+    }
+    /**
+     * Detect a token that changed without this tab's involvement, such as a server action login, an
+     * expired cookie, or a tab without BroadcastChannel. Call it when the page becomes visible.
+     */
+    checkExternalChange() {
+        const token = this.token;
+        if (token === this.#knownToken)
+            return;
+        this.#knownToken = token;
+        this.#session = null;
+        this.#emit();
+        if (token === null)
+            this.#options.onAuthChange();
+        else
+            this.#options.onExternalToken();
+    }
+    /**
+     * Call once after hydration. A broadcast sent while this page was loading was missed, so compare
+     * the rendered session with the cookie: a session that ended or a token that appeared meanwhile
+     * reruns auth-dependent loads.
+     */
+    hydrated() {
+        const rendered = this.#options.snapshot?.() ?? null;
+        const token = this.token;
+        if (rendered !== null && token === null)
+            this.#options.onAuthChange();
+        else if (rendered === null && token !== null)
+            this.checkExternalChange();
+    }
+    dispose() {
+        this.#options.channel?.removeEventListener("message", this.#receive);
+        this.#options.channel?.close();
+        this.#listeners.clear();
+    }
+    #reconcile() {
+        const incoming = this.#options.snapshot?.();
+        if (incoming === undefined || incoming === this.#lastSnapshot)
+            return;
+        this.#lastSnapshot = incoming;
+        const token = this.token;
+        if (incoming === null) {
+            // The server saw no session. Accept that only if this tab agrees there is no token.
+            if (token === null) {
+                this.#session = null;
+                this.#knownToken = null;
+            }
+            return;
+        }
+        if (token === null)
+            return;
+        // Accept the first snapshot, a refreshed user for the same session, or a token that changed
+        // out of band. A snapshot for another session than this tab's newer login is stale.
+        const outOfBand = token !== this.#knownToken;
+        if (outOfBand || this.#session === null || this.#session.id === incoming.id) {
+            this.#session = incoming;
+            this.#knownToken = token;
+        }
+    }
+    #adopt(message) {
+        const token = this.token;
+        if (message.session === null ? token !== null : token === null) {
+            // The cookie already moved on; let the visible state follow the cookie instead.
+            this.checkExternalChange();
+            return;
+        }
+        this.#session = message.session;
+        this.#knownToken = token;
+        this.#changed(false);
+    }
+    #changed(broadcast) {
+        this.#emit();
+        if (broadcast)
+            this.#options.channel?.postMessage({ session: this.#session });
+        this.#options.onAuthChange();
+    }
+    #emit() {
+        for (const listener of this.#listeners)
+            listener();
+    }
+}

package/dist/cookie.d.ts

@@ -0,0 +1,17 @@
+/** Frontend-domain cookie that holds a Ridu session token. */
+export declare const DEFAULT_COOKIE_NAME = "ridu_token";
+/** Read one cookie value from a `document.cookie` or `Cookie` header string. */
+export declare function readCookie(header: string, name: string): string | null;
+export interface TokenCookieOptions {
+    /** Absolute session expiry; the browser drops the cookie when the session ends. */
+    expires: Date;
+    /** Send only over HTTPS. Plain-HTTP development cannot keep a Secure cookie. */
+    secure: boolean;
+}
+/**
+ * Serialize the token cookie for `document.cookie`. It is deliberately readable by scripts, so the
+ * browser client can send it directly to Ridu; SameSite=Lax keeps it off cross-site subrequests.
+ */
+export declare function tokenCookie(name: string, token: string, options: TokenCookieOptions): string;
+/** Serialize an expired token cookie that removes the stored token. */
+export declare function expiredTokenCookie(name: string, secure: boolean): string;

package/dist/cookie.js

@@ -0,0 +1,42 @@
+/** Frontend-domain cookie that holds a Ridu session token. */
+export const DEFAULT_COOKIE_NAME = "ridu_token";
+/** Read one cookie value from a `document.cookie` or `Cookie` header string. */
+export function readCookie(header, name) {
+    for (const part of header.split(";")) {
+        const separator = part.indexOf("=");
+        if (separator < 0 || part.slice(0, separator).trim() !== name)
+            continue;
+        const value = part.slice(separator + 1).trim();
+        if (value === "")
+            return null;
+        try {
+            return decodeURIComponent(value);
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+/**
+ * Serialize the token cookie for `document.cookie`. It is deliberately readable by scripts, so the
+ * browser client can send it directly to Ridu; SameSite=Lax keeps it off cross-site subrequests.
+ */
+export function tokenCookie(name, token, options) {
+    const attributes = [
+        `${name}=${encodeURIComponent(token)}`,
+        "Path=/",
+        `Expires=${options.expires.toUTCString()}`,
+        "SameSite=Lax",
+    ];
+    if (options.secure)
+        attributes.push("Secure");
+    return attributes.join("; ");
+}
+/** Serialize an expired token cookie that removes the stored token. */
+export function expiredTokenCookie(name, secure) {
+    const attributes = [`${name}=`, "Path=/", "Max-Age=0", "SameSite=Lax"];
+    if (secure)
+        attributes.push("Secure");
+    return attributes.join("; ");
+}

package/dist/definition.d.ts

@@ -0,0 +1,34 @@
+import type { AuthCollectionSlug, ClientOptions, RiduClient, RiduConfigShape, SessionFor, SessionTokenStore } from "@riducms/sdk";
+/**
+ * The generated `createClient` from `ridu.generated.ts`. Its auth parameter is generic, so `any`
+ * is the only parameter type every generated signature accepts.
+ */
+export type ClientFactory = (options: ClientOptions<any>) => RiduClient<any, any>;
+/** The application contract bound by a generated factory. */
+export type ConfigOf<Factory extends ClientFactory> = ReturnType<Factory> extends RiduClient<infer Config, infer _Default> ? Config : never;
+export interface RiduDefinitionOptions<Factory extends ClientFactory, Slug extends string> {
+    /** The generated factory, which binds the application's types. */
+    createClient: Factory;
+    /** Public Ridu origin, such as `PUBLIC_RIDU_URL`. Browsers call it directly. */
+    baseURL: string;
+    /** The auth collection whose users sign in to this application. */
+    authCollection: Slug;
+    /** Frontend-domain cookie that stores the session token. Defaults to `ridu_token`. */
+    cookieName?: string;
+    /** Fetch used by server-side clients. Defaults to SvelteKit's `event.fetch`. */
+    fetch?: ClientOptions["fetch"];
+}
+export declare const definitionKey: unique symbol;
+/** Internal binding shared by the browser provider and the server hook. */
+export interface RiduDefinition<Config extends RiduConfigShape, Slug extends AuthCollectionSlug<Config>> {
+    readonly baseURL: string;
+    readonly authCollection: Slug;
+    readonly cookieName: string;
+    client(token: SessionTokenStore<SessionFor<Config, Slug>>, options?: {
+        fetch?: ClientOptions["fetch"];
+        /** Used when neither the call nor the definition supplies a fetch. */
+        fallbackFetch?: ClientOptions["fetch"];
+        memoizeSession?: boolean;
+    }): RiduClient<Config, Slug>;
+}
+export declare function createDefinition<Factory extends ClientFactory, Slug extends AuthCollectionSlug<ConfigOf<Factory>>>(options: RiduDefinitionOptions<Factory, Slug>): RiduDefinition<ConfigOf<Factory>, Slug>;

package/dist/definition.js

@@ -0,0 +1,26 @@
+import { DEFAULT_COOKIE_NAME } from "./cookie.js";
+export const definitionKey = Symbol("ridu.sveltekit.definition");
+export function createDefinition(options) {
+    const baseURL = new URL(options.baseURL).href.replace(/\/$/, "");
+    const cookieName = options.cookieName ?? DEFAULT_COOKIE_NAME;
+    if (!/^[A-Za-z0-9_-]+$/.test(cookieName)) {
+        throw new TypeError("cookieName may contain only letters, digits, underscores, and hyphens");
+    }
+    return {
+        baseURL,
+        authCollection: options.authCollection,
+        cookieName,
+        client(token, clientOptions = {}) {
+            const fetch = clientOptions.fetch ?? options.fetch ?? clientOptions.fallbackFetch;
+            return options.createClient({
+                baseURL,
+                ...(fetch === undefined ? {} : { fetch }),
+                auth: {
+                    collection: options.authCollection,
+                    token: token,
+                    memoizeSession: clientOptions.memoizeSession === true,
+                },
+            });
+        },
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,41 @@
+import type { AuthCollectionSlug, RiduClient, RiduConfigShape, SessionFor } from "@riducms/sdk";
+import { definitionKey, type ClientFactory, type ConfigOf, type RiduDefinition, type RiduDefinitionOptions } from "./definition.js";
+export { DEFAULT_COOKIE_NAME } from "./cookie.js";
+export type { ClientFactory, ConfigOf, RiduDefinitionOptions } from "./definition.js";
+/** The dependency every auth-sensitive load should declare with `depends(AUTH_DEPENDENCY)`. */
+export declare const AUTH_DEPENDENCY = "ridu:auth";
+export interface ProvideOptions<Session> {
+    /**
+     * The session rendered by the root layout, usually `() => data.session`. It seeds hydration and
+     * later refreshes the user; it never overrides a newer sign-in or sign-out in this tab.
+     */
+    session?: Session | null | (() => Session | null);
+}
+/** One application's Ridu binding. It holds configuration, never an authenticated client. */
+export interface Ridu<Config extends RiduConfigShape, Slug extends AuthCollectionSlug<Config>> {
+    readonly baseURL: string;
+    readonly authCollection: Slug;
+    readonly cookieName: string;
+    /**
+     * Create the client for this mounted application and share it with descendants. Call it once,
+     * during initialization of the root layout. Server renders get an isolated, credential-free
+     * client whose `auth.session` is the rendered snapshot.
+     */
+    provide(options?: ProvideOptions<SessionFor<Config, Slug>>): RiduClient<Config, Slug>;
+    /** Read the client provided by the root layout. Call it during component initialization. */
+    use(): RiduClient<Config, Slug>;
+    /** @internal */
+    readonly [definitionKey]: RiduDefinition<Config, Slug>;
+}
+/** The client type of a `defineRidu` result, for `App.Locals`. */
+export type InferClient<Binding> = Binding extends Ridu<infer Config, infer Slug> ? RiduClient<Config, Slug> : never;
+/** The session type of a `defineRidu` result. */
+export type InferSession<Binding> = Binding extends Ridu<infer Config, infer Slug> ? SessionFor<Config, Slug> : never;
+/**
+ * Bind an application's generated client to SvelteKit.
+ *
+ * ```ts
+ * export const ridu = defineRidu({ createClient, baseURL: PUBLIC_RIDU_URL, authCollection: "users" });
+ * ```
+ */
+export declare function defineRidu<Factory extends ClientFactory, const Slug extends AuthCollectionSlug<ConfigOf<Factory>>>(options: RiduDefinitionOptions<Factory, Slug>): Ridu<ConfigOf<Factory>, Slug>;

package/dist/index.js

@@ -0,0 +1,94 @@
+import { getContext, onDestroy, onMount, setContext } from "svelte";
+import { createSubscriber } from "svelte/reactivity";
+import { invalidate } from "$app/navigation";
+// SvelteKit 2 re-exports this from $app/environment, which SvelteKit 3 deprecates.
+import { BROWSER } from "esm-env";
+import { BrowserSessionStore } from "./browser-session.js";
+import { createDefinition, definitionKey, } from "./definition.js";
+export { DEFAULT_COOKIE_NAME } from "./cookie.js";
+/** The dependency every auth-sensitive load should declare with `depends(AUTH_DEPENDENCY)`. */
+export const AUTH_DEPENDENCY = "ridu:auth";
+const clientKey = Symbol("ridu.sveltekit.client");
+/**
+ * Bind an application's generated client to SvelteKit.
+ *
+ * ```ts
+ * export const ridu = defineRidu({ createClient, baseURL: PUBLIC_RIDU_URL, authCollection: "users" });
+ * ```
+ */
+export function defineRidu(options) {
+    const definition = createDefinition(options);
+    return {
+        baseURL: definition.baseURL,
+        authCollection: definition.authCollection,
+        cookieName: definition.cookieName,
+        [definitionKey]: definition,
+        provide(provideOptions = {}) {
+            const provided = provideOptions.session;
+            const snapshot = typeof provided === "function" ? provided : () => provided;
+            const client = BROWSER
+                ? browserClient(definition, snapshot)
+                : renderClient(definition, snapshot);
+            setContext(clientKey, client);
+            return client;
+        },
+        use() {
+            const client = getContext(clientKey);
+            if (client === undefined) {
+                throw new Error("ridu.use() needs ridu.provide() in the root layout");
+            }
+            return client;
+        },
+    };
+}
+function browserClient(definition, snapshot) {
+    let client;
+    const channel = typeof BroadcastChannel === "undefined"
+        ? undefined
+        : new BroadcastChannel(`ridu-auth:${definition.cookieName}`);
+    const store = new BrowserSessionStore({
+        cookieName: definition.cookieName,
+        document,
+        secure: location.protocol === "https:",
+        snapshot,
+        channel,
+        track: createSubscriber((update) => store.subscribe(update)),
+        onAuthChange: refreshAuthLoads,
+        onExternalToken: () => {
+            // getSession reports the verified snapshot back to the store.
+            client?.auth.getSession().then(refreshAuthLoads, refreshAuthLoads);
+        },
+    });
+    client = definition.client(store);
+    const visible = () => {
+        if (document.visibilityState === "visible")
+            store.checkExternalChange();
+    };
+    document.addEventListener("visibilitychange", visible);
+    onMount(() => store.hydrated());
+    onDestroy(() => {
+        document.removeEventListener("visibilitychange", visible);
+        store.dispose();
+    });
+    return client;
+}
+/** Rerun loads that declared `depends(AUTH_DEPENDENCY)`. Ordinary mutations never do this. */
+function refreshAuthLoads() {
+    invalidate(AUTH_DEPENDENCY).catch((error) => {
+        // A failed load renders SvelteKit's error page; keep the failure visible to developers.
+        console.error("Ridu could not refresh auth-dependent loads", error);
+    });
+}
+/** A server render never holds a credential; components see the rendered snapshot only. */
+function renderClient(definition, snapshot) {
+    return definition.client({
+        token: null,
+        get session() {
+            return snapshot() ?? null;
+        },
+        issued() {
+            throw new Error("Sign in from a browser event, a form action, or a server load");
+        },
+        cleared() { },
+    });
+}

package/dist/request-session.d.ts

@@ -0,0 +1,19 @@
+import type { SessionTokenStore } from "@riducms/sdk";
+import type { Cookies } from "@sveltejs/kit";
+import type { SessionSnapshot } from "./browser-session.js";
+/**
+ * Owns the token for one SvelteKit request. It reads the same frontend cookie the browser client
+ * writes, and a server-side login, logout, or rejected token updates that cookie on the response.
+ */
+export declare class RequestSessionStore<Session extends SessionSnapshot> implements SessionTokenStore<Session> {
+    #private;
+    private readonly cookies;
+    private readonly cookieName;
+    private readonly secure;
+    constructor(cookies: Cookies, cookieName: string, secure: boolean);
+    get token(): string | null;
+    get session(): Session | null;
+    issued(token: string, session: Session): void;
+    verified(token: string, session: Session): void;
+    cleared(token: string): void;
+}

package/dist/request-session.js

@@ -0,0 +1,46 @@
+/**
+ * Owns the token for one SvelteKit request. It reads the same frontend cookie the browser client
+ * writes, and a server-side login, logout, or rejected token updates that cookie on the response.
+ */
+export class RequestSessionStore {
+    cookies;
+    cookieName;
+    secure;
+    #session = null;
+    constructor(cookies, cookieName, secure) {
+        this.cookies = cookies;
+        this.cookieName = cookieName;
+        this.secure = secure;
+    }
+    get token() {
+        return this.cookies.get(this.cookieName) ?? null;
+    }
+    get session() {
+        return this.#session;
+    }
+    issued(token, session) {
+        this.cookies.set(this.cookieName, token, {
+            path: "/",
+            expires: new Date(session.expiresAt),
+            httpOnly: false,
+            sameSite: "lax",
+            secure: this.secure,
+        });
+        this.#session = session;
+    }
+    verified(token, session) {
+        if (this.token === token)
+            this.#session = session;
+    }
+    cleared(token) {
+        if (this.token !== token)
+            return;
+        this.cookies.delete(this.cookieName, {
+            path: "/",
+            httpOnly: false,
+            sameSite: "lax",
+            secure: this.secure,
+        });
+        this.#session = null;
+    }
+}

package/dist/server.d.ts

@@ -0,0 +1,34 @@
+import type { AuthCollectionSlug, ClientOptions, RiduClient, RiduConfigShape } from "@riducms/sdk";
+import type { RequestEvent } from "@sveltejs/kit";
+import { definitionKey, type RiduDefinition } from "./definition.js";
+interface Binding<Config extends RiduConfigShape, Slug extends AuthCollectionSlug<Config>> {
+    readonly [definitionKey]: RiduDefinition<Config, Slug>;
+}
+export interface ServerClientOptions {
+    /**
+     * Fetch for server requests to Ridu. Defaults to the definition's fetch, then to SvelteKit's
+     * `event.fetch`. The client sends its token in a header with `credentials: "omit"`, so
+     * `event.fetch` does not forward the web app's cookies to Ridu.
+     */
+    fetch?: ClientOptions["fetch"];
+}
+/**
+ * Create the Ridu client for one SvelteKit request. It authenticates with the request's frontend
+ * cookie, verifies `auth.getSession()` at most once, and writes the cookie on the response after a
+ * server-side login, logout, or rejected token.
+ */
+export declare function createServerClient<Config extends RiduConfigShape, Slug extends AuthCollectionSlug<Config>>(ridu: Binding<Config, Slug>, event: Pick<RequestEvent, "cookies" | "url"> & Partial<Pick<RequestEvent, "fetch">>, options?: ServerClientOptions): RiduClient<Config, Slug>;
+/**
+ * A server `handle` hook. SvelteKit 2 exports `Handle` from `@sveltejs/kit` and SvelteKit 3 from
+ * `@sveltejs/kit/hooks`; this shape is assignable to both.
+ */
+export type RiduHandle = (input: {
+    event: RequestEvent;
+    resolve: (event: RequestEvent) => Response | Promise<Response>;
+}) => Response | Promise<Response>;
+/**
+ * A SvelteKit `handle` that sets `event.locals.ridu` for each request. Compose it with other hooks
+ * through `sequence`.
+ */
+export declare function createRiduHandle<Config extends RiduConfigShape, Slug extends AuthCollectionSlug<Config>>(ridu: Binding<Config, Slug>, options?: ServerClientOptions): RiduHandle;
+export {};

package/dist/server.js

@@ -0,0 +1,27 @@
+import { definitionKey } from "./definition.js";
+import { RequestSessionStore } from "./request-session.js";
+/**
+ * Create the Ridu client for one SvelteKit request. It authenticates with the request's frontend
+ * cookie, verifies `auth.getSession()` at most once, and writes the cookie on the response after a
+ * server-side login, logout, or rejected token.
+ */
+export function createServerClient(ridu, event, options = {}) {
+    const definition = ridu[definitionKey];
+    const store = new RequestSessionStore(event.cookies, definition.cookieName, event.url.protocol === "https:");
+    return definition.client(store, {
+        ...(options.fetch === undefined ? {} : { fetch: options.fetch }),
+        ...(event.fetch === undefined ? {} : { fallbackFetch: event.fetch }),
+        memoizeSession: true,
+    });
+}
+/**
+ * A SvelteKit `handle` that sets `event.locals.ridu` for each request. Compose it with other hooks
+ * through `sequence`.
+ */
+export function createRiduHandle(ridu, options = {}) {
+    return ({ event, resolve }) => {
+        // Applications type `App.Locals.ridu` with their own client; assign without widening it.
+        Object.assign(event.locals, { ridu: createServerClient(ridu, event, options) });
+        return resolve(event);
+    };
+}

package/package.json

@@ -6,31 +6,33 @@
 		"esm-env": "^1.2.2"
 	},
 	"description": "SvelteKit integration for Ridu: direct browser requests, server rendering, and one session owner.",
-	"devDependencies": {
-		"@riducms/sdk": "0.16.2",
-		"@sveltejs/kit": "^2.48.0"
-	},
 	"exports": {
 		".": {
-			"default": "./src/index.ts",
-			"svelte": "./src/index.ts",
-			"types": "./src/index.ts"
+			"default": "./dist/index.js",
+			"svelte": "./dist/index.js",
+			"types": "./dist/index.d.ts"
 		},
 		"./server": {
-			"default": "./src/server.ts",
-			"svelte": "./src/server.ts",
-			"types": "./src/server.ts"
+			"default": "./dist/server.js",
+			"svelte": "./dist/server.js",
+			"types": "./dist/server.d.ts"
 		}
 	},
 	"files": [
-		"src",
+		"dist",
+		"!dist/**/*.test.*",
+		"!dist/**/*.spec.*",
 		"LICENSE"
 	],
 	"homepage": "https://riducms.com",
+	"imports": {
+		"#lib": "./src/lib/index.js",
+		"#lib/*": "./src/lib/*"
+	},
 	"license": "MIT",
 	"name": "@riducms/sveltekit",
 	"peerDependencies": {
-		"@riducms/sdk": "0.16.2",
+		"@riducms/sdk": "0.18.0",
 		"@sveltejs/kit": "^2.20.0 || ^3.0.0",
 		"svelte": "^5.29.0"
 	},
@@ -44,9 +46,18 @@
 		"url": "git+https://github.com/riducms/ridu.git"
 	},
 	"scripts": {
-		"check": "tsc -p tsconfig.json",
-		"test": "bun test"
-	},
+		"build": "bun run package",
+		"check": "svelte-kit sync && tsc -p tsconfig.json",
+		"dev": "svelte-kit sync && bun run --parallel dev:package",
+		"dev:package": "svelte-package --watch",
+		"package": "svelte-kit sync && svelte-package && publint",
+		"test": "svelte-kit sync && bun test"
+	},
+	"sideEffects": [
+		"**/*.css"
+	],
+	"svelte": "./dist/index.js",
 	"type": "module",
-	"version": "0.16.2"
+	"types": "./dist/index.d.ts",
+	"version": "0.18.0"
 }

package/src/browser-session.ts

@@ -1,184 +0,0 @@
-import type { SessionTokenStore } from "@riducms/sdk";
-
-import { expiredTokenCookie, readCookie, tokenCookie } from "./cookie.js";
-
-/** The safe session snapshot shared by tabs and rendered pages. It never contains the token. */
-export interface SessionSnapshot {
-	id: string;
-	expiresAt: string;
-}
-
-/** Tabs share one cookie jar; a message only tells other tabs to adopt the change. */
-interface SessionMessage<Session> {
-	session: Session | null;
-}
-
-interface MessageChannel<Session> {
-	postMessage(message: SessionMessage<Session>): void;
-	addEventListener(type: "message", listener: (event: MessageEvent) => void): void;
-	removeEventListener(type: "message", listener: (event: MessageEvent) => void): void;
-	close(): void;
-}
-
-export interface BrowserSessionOptions<Session> {
-	cookieName: string;
-	/** The document whose cookie jar holds the token. */
-	document: { cookie: string };
-	secure: boolean;
-	/**
-	 * Server-rendered session snapshots, usually `() => data.session` from the root layout. They seed
-	 * hydration and refresh the user; a stale snapshot never replaces newer browser state.
-	 */
-	snapshot?: (() => Session | null | undefined) | undefined;
-	/** Cross-tab notifications. Tokens are never posted, only safe snapshots. */
-	channel?: MessageChannel<Session> | undefined;
-	/** Record a reactive read, such as a Svelte subscriber. */
-	track?: (() => void) | undefined;
-	/** The signed-in identity changed: SvelteKit loads that depend on auth must rerun. */
-	onAuthChange(): void;
-	/** Another tab or a server response replaced the token; verify the new one with Ridu. */
-	onExternalToken(): void;
-}
-
-/**
- * Owns a token-transport session in the browser. The token lives in a frontend-domain cookie that
- * server rendering also receives; this store reads it on every request and never caches it.
- */
-export class BrowserSessionStore<
-	Session extends SessionSnapshot,
-> implements SessionTokenStore<Session> {
-	readonly #options: BrowserSessionOptions<Session>;
-	readonly #listeners = new Set<() => void>();
-	#session: Session | null = null;
-	/** The token the current snapshot belongs to. Any other cookie value arrived out of band. */
-	#knownToken: string | null = null;
-	#lastSnapshot: Session | null | undefined;
-	readonly #receive = (event: MessageEvent) => this.#adopt(event.data as SessionMessage<Session>);
-
-	constructor(options: BrowserSessionOptions<Session>) {
-		this.#options = options;
-		options.channel?.addEventListener("message", this.#receive);
-	}
-
-	get token() {
-		return readCookie(this.#options.document.cookie, this.#options.cookieName);
-	}
-
-	get session() {
-		this.#options.track?.();
-		this.#reconcile();
-		return this.#session;
-	}
-
-	subscribe(listener: () => void) {
-		this.#listeners.add(listener);
-		return () => this.#listeners.delete(listener);
-	}
-
-	issued(token: string, session: Session) {
-		this.#options.document.cookie = tokenCookie(this.#options.cookieName, token, {
-			expires: new Date(session.expiresAt),
-			secure: this.#options.secure,
-		});
-		this.#session = session;
-		this.#knownToken = token;
-		this.#changed(true);
-	}
-
-	verified(token: string, session: Session) {
-		// A late verification for a replaced token must not restore the previous account.
-		if (this.token !== token) return;
-		this.#session = session;
-		this.#knownToken = token;
-		this.#emit();
-	}
-
-	cleared(token: string) {
-		// A late rejection or logout must not clear a newer login.
-		if (this.token !== token) return;
-		this.#options.document.cookie = expiredTokenCookie(
-			this.#options.cookieName,
-			this.#options.secure
-		);
-		this.#session = null;
-		this.#knownToken = null;
-		this.#changed(true);
-	}
-
-	/**
-	 * Detect a token that changed without this tab's involvement, such as a server action login, an
-	 * expired cookie, or a tab without BroadcastChannel. Call it when the page becomes visible.
-	 */
-	checkExternalChange() {
-		const token = this.token;
-		if (token === this.#knownToken) return;
-		this.#knownToken = token;
-		this.#session = null;
-		this.#emit();
-		if (token === null) this.#options.onAuthChange();
-		else this.#options.onExternalToken();
-	}
-
-	/**
-	 * Call once after hydration. A broadcast sent while this page was loading was missed, so compare
-	 * the rendered session with the cookie: a session that ended or a token that appeared meanwhile
-	 * reruns auth-dependent loads.
-	 */
-	hydrated() {
-		const rendered = this.#options.snapshot?.() ?? null;
-		const token = this.token;
-		if (rendered !== null && token === null) this.#options.onAuthChange();
-		else if (rendered === null && token !== null) this.checkExternalChange();
-	}
-
-	dispose() {
-		this.#options.channel?.removeEventListener("message", this.#receive);
-		this.#options.channel?.close();
-		this.#listeners.clear();
-	}
-
-	#reconcile() {
-		const incoming = this.#options.snapshot?.();
-		if (incoming === undefined || incoming === this.#lastSnapshot) return;
-		this.#lastSnapshot = incoming;
-		const token = this.token;
-		if (incoming === null) {
-			// The server saw no session. Accept that only if this tab agrees there is no token.
-			if (token === null) {
-				this.#session = null;
-				this.#knownToken = null;
-			}
-			return;
-		}
-		if (token === null) return;
-		// Accept the first snapshot, a refreshed user for the same session, or a token that changed
-		// out of band. A snapshot for another session than this tab's newer login is stale.
-		const outOfBand = token !== this.#knownToken;
-		if (outOfBand || this.#session === null || this.#session.id === incoming.id) {
-			this.#session = incoming;
-			this.#knownToken = token;
-		}
-	}
-
-	#adopt(message: SessionMessage<Session>) {
-		const token = this.token;
-		if (message.session === null ? token !== null : token === null) {
-			// The cookie already moved on; let the visible state follow the cookie instead.
-			this.checkExternalChange();
-			return;
-		}
-		this.#session = message.session;
-		this.#knownToken = token;
-		this.#changed(false);
-	}
-
-	#changed(broadcast: boolean) {
-		this.#emit();
-		if (broadcast) this.#options.channel?.postMessage({ session: this.#session });
-		this.#options.onAuthChange();
-	}
-
-	#emit() {
-		for (const listener of this.#listeners) listener();
-	}
-}

package/src/cookie.ts

@@ -1,47 +0,0 @@
-/** Frontend-domain cookie that holds a Ridu session token. */
-export const DEFAULT_COOKIE_NAME = "ridu_token";
-
-/** Read one cookie value from a `document.cookie` or `Cookie` header string. */
-export function readCookie(header: string, name: string): string | null {
-	for (const part of header.split(";")) {
-		const separator = part.indexOf("=");
-		if (separator < 0 || part.slice(0, separator).trim() !== name) continue;
-		const value = part.slice(separator + 1).trim();
-		if (value === "") return null;
-		try {
-			return decodeURIComponent(value);
-		} catch {
-			return null;
-		}
-	}
-	return null;
-}
-
-export interface TokenCookieOptions {
-	/** Absolute session expiry; the browser drops the cookie when the session ends. */
-	expires: Date;
-	/** Send only over HTTPS. Plain-HTTP development cannot keep a Secure cookie. */
-	secure: boolean;
-}
-
-/**
- * Serialize the token cookie for `document.cookie`. It is deliberately readable by scripts, so the
- * browser client can send it directly to Ridu; SameSite=Lax keeps it off cross-site subrequests.
- */
-export function tokenCookie(name: string, token: string, options: TokenCookieOptions): string {
-	const attributes = [
-		`${name}=${encodeURIComponent(token)}`,
-		"Path=/",
-		`Expires=${options.expires.toUTCString()}`,
-		"SameSite=Lax",
-	];
-	if (options.secure) attributes.push("Secure");
-	return attributes.join("; ");
-}
-
-/** Serialize an expired token cookie that removes the stored token. */
-export function expiredTokenCookie(name: string, secure: boolean): string {
-	const attributes = [`${name}=`, "Path=/", "Max-Age=0", "SameSite=Lax"];
-	if (secure) attributes.push("Secure");
-	return attributes.join("; ");
-}

package/src/definition.ts

@@ -1,82 +0,0 @@
-import type {
-	AuthCollectionSlug,
-	ClientOptions,
-	RiduClient,
-	RiduConfigShape,
-	SessionFor,
-	SessionTokenStore,
-} from "@riducms/sdk";
-
-import { DEFAULT_COOKIE_NAME } from "./cookie.js";
-
-/**
- * The generated `createClient` from `ridu.generated.ts`. Its auth parameter is generic, so `any`
- * is the only parameter type every generated signature accepts.
- */
-export type ClientFactory = (options: ClientOptions<any>) => RiduClient<any, any>;
-
-/** The application contract bound by a generated factory. */
-export type ConfigOf<Factory extends ClientFactory> =
-	ReturnType<Factory> extends RiduClient<infer Config, infer _Default> ? Config : never;
-
-export interface RiduDefinitionOptions<Factory extends ClientFactory, Slug extends string> {
-	/** The generated factory, which binds the application's types. */
-	createClient: Factory;
-	/** Public Ridu origin, such as `PUBLIC_RIDU_URL`. Browsers call it directly. */
-	baseURL: string;
-	/** The auth collection whose users sign in to this application. */
-	authCollection: Slug;
-	/** Frontend-domain cookie that stores the session token. Defaults to `ridu_token`. */
-	cookieName?: string;
-	/** Fetch used by server-side clients. Defaults to SvelteKit's `event.fetch`. */
-	fetch?: ClientOptions["fetch"];
-}
-
-export const definitionKey: unique symbol = Symbol("ridu.sveltekit.definition");
-
-/** Internal binding shared by the browser provider and the server hook. */
-export interface RiduDefinition<
-	Config extends RiduConfigShape,
-	Slug extends AuthCollectionSlug<Config>,
-> {
-	readonly baseURL: string;
-	readonly authCollection: Slug;
-	readonly cookieName: string;
-	client(
-		token: SessionTokenStore<SessionFor<Config, Slug>>,
-		options?: {
-			fetch?: ClientOptions["fetch"];
-			/** Used when neither the call nor the definition supplies a fetch. */
-			fallbackFetch?: ClientOptions["fetch"];
-			memoizeSession?: boolean;
-		}
-	): RiduClient<Config, Slug>;
-}
-
-export function createDefinition<
-	Factory extends ClientFactory,
-	Slug extends AuthCollectionSlug<ConfigOf<Factory>>,
->(options: RiduDefinitionOptions<Factory, Slug>): RiduDefinition<ConfigOf<Factory>, Slug> {
-	const baseURL = new URL(options.baseURL).href.replace(/\/$/, "");
-	const cookieName = options.cookieName ?? DEFAULT_COOKIE_NAME;
-	if (!/^[A-Za-z0-9_-]+$/.test(cookieName)) {
-		throw new TypeError("cookieName may contain only letters, digits, underscores, and hyphens");
-	}
-	return {
-		baseURL,
-		authCollection: options.authCollection,
-		cookieName,
-		client(token, clientOptions = {}) {
-			const fetch = clientOptions.fetch ?? options.fetch ?? clientOptions.fallbackFetch;
-			return options.createClient({
-				baseURL,
-				...(fetch === undefined ? {} : { fetch }),
-				auth: {
-					collection: options.authCollection,
-					token: token as SessionTokenStore,
-					memoizeSession: clientOptions.memoizeSession === true,
-				},
-			}) as RiduClient<ConfigOf<Factory>, Slug>;
-		},
-	};
-}

package/src/index.ts

@@ -1,157 +0,0 @@
-import type { AuthCollectionSlug, RiduClient, RiduConfigShape, SessionFor } from "@riducms/sdk";
-import { getContext, onDestroy, onMount, setContext } from "svelte";
-import { createSubscriber } from "svelte/reactivity";
-import { invalidate } from "$app/navigation";
-// SvelteKit 2 re-exports this from $app/environment, which SvelteKit 3 deprecates.
-import { BROWSER } from "esm-env";
-
-import { BrowserSessionStore } from "./browser-session.js";
-import {
-	createDefinition,
-	definitionKey,
-	type ClientFactory,
-	type ConfigOf,
-	type RiduDefinition,
-	type RiduDefinitionOptions,
-} from "./definition.js";
-
-export { DEFAULT_COOKIE_NAME } from "./cookie.js";
-export type { ClientFactory, ConfigOf, RiduDefinitionOptions } from "./definition.js";
-
-/** The dependency every auth-sensitive load should declare with `depends(AUTH_DEPENDENCY)`. */
-export const AUTH_DEPENDENCY = "ridu:auth";
-
-export interface ProvideOptions<Session> {
-	/**
-	 * The session rendered by the root layout, usually `() => data.session`. It seeds hydration and
-	 * later refreshes the user; it never overrides a newer sign-in or sign-out in this tab.
-	 */
-	session?: Session | null | (() => Session | null);
-}
-
-/** One application's Ridu binding. It holds configuration, never an authenticated client. */
-export interface Ridu<Config extends RiduConfigShape, Slug extends AuthCollectionSlug<Config>> {
-	readonly baseURL: string;
-	readonly authCollection: Slug;
-	readonly cookieName: string;
-	/**
-	 * Create the client for this mounted application and share it with descendants. Call it once,
-	 * during initialization of the root layout. Server renders get an isolated, credential-free
-	 * client whose `auth.session` is the rendered snapshot.
-	 */
-	provide(options?: ProvideOptions<SessionFor<Config, Slug>>): RiduClient<Config, Slug>;
-	/** Read the client provided by the root layout. Call it during component initialization. */
-	use(): RiduClient<Config, Slug>;
-	/** @internal */
-	readonly [definitionKey]: RiduDefinition<Config, Slug>;
-}
-
-/** The client type of a `defineRidu` result, for `App.Locals`. */
-export type InferClient<Binding> =
-	Binding extends Ridu<infer Config, infer Slug> ? RiduClient<Config, Slug> : never;
-
-/** The session type of a `defineRidu` result. */
-export type InferSession<Binding> =
-	Binding extends Ridu<infer Config, infer Slug> ? SessionFor<Config, Slug> : never;
-
-const clientKey = Symbol("ridu.sveltekit.client");
-
-/**
- * Bind an application's generated client to SvelteKit.
- *
- * ```ts
- * export const ridu = defineRidu({ createClient, baseURL: PUBLIC_RIDU_URL, authCollection: "users" });
- * ```
- */
-export function defineRidu<
-	Factory extends ClientFactory,
-	const Slug extends AuthCollectionSlug<ConfigOf<Factory>>,
->(options: RiduDefinitionOptions<Factory, Slug>): Ridu<ConfigOf<Factory>, Slug> {
-	type Config = ConfigOf<Factory>;
-	type Session = SessionFor<Config, Slug>;
-	const definition = createDefinition<Factory, Slug>(options);
-	return {
-		baseURL: definition.baseURL,
-		authCollection: definition.authCollection,
-		cookieName: definition.cookieName,
-		[definitionKey]: definition,
-		provide(provideOptions = {}) {
-			const provided = provideOptions.session;
-			const snapshot =
-				typeof provided === "function" ? provided : () => provided as Session | null | undefined;
-			const client = BROWSER
-				? browserClient(definition, snapshot)
-				: renderClient(definition, snapshot);
-			setContext(clientKey, client);
-			return client;
-		},
-		use() {
-			const client = getContext<RiduClient<Config, Slug> | undefined>(clientKey);
-			if (client === undefined) {
-				throw new Error("ridu.use() needs ridu.provide() in the root layout");
-			}
-			return client;
-		},
-	};
-}
-
-function browserClient<Config extends RiduConfigShape, Slug extends AuthCollectionSlug<Config>>(
-	definition: RiduDefinition<Config, Slug>,
-	snapshot: () => SessionFor<Config, Slug> | null | undefined
-) {
-	type Session = SessionFor<Config, Slug>;
-	let client: RiduClient<Config, Slug> | undefined;
-	const channel =
-		typeof BroadcastChannel === "undefined"
-			? undefined
-			: new BroadcastChannel(`ridu-auth:${definition.cookieName}`);
-	const store: BrowserSessionStore<Session> = new BrowserSessionStore<Session>({
-		cookieName: definition.cookieName,
-		document,
-		secure: location.protocol === "https:",
-		snapshot,
-		channel,
-		track: createSubscriber((update) => store.subscribe(update)),
-		onAuthChange: refreshAuthLoads,
-		onExternalToken: () => {
-			// getSession reports the verified snapshot back to the store.
-			client?.auth.getSession().then(refreshAuthLoads, refreshAuthLoads);
-		},
-	});
-	client = definition.client(store);
-	const visible = () => {
-		if (document.visibilityState === "visible") store.checkExternalChange();
-	};
-	document.addEventListener("visibilitychange", visible);
-	onMount(() => store.hydrated());
-	onDestroy(() => {
-		document.removeEventListener("visibilitychange", visible);
-		store.dispose();
-	});
-	return client;
-}
-
-/** Rerun loads that declared `depends(AUTH_DEPENDENCY)`. Ordinary mutations never do this. */
-function refreshAuthLoads() {
-	invalidate(AUTH_DEPENDENCY).catch((error: unknown) => {
-		// A failed load renders SvelteKit's error page; keep the failure visible to developers.
-		console.error("Ridu could not refresh auth-dependent loads", error);
-	});
-}
-
-/** A server render never holds a credential; components see the rendered snapshot only. */
-function renderClient<Config extends RiduConfigShape, Slug extends AuthCollectionSlug<Config>>(
-	definition: RiduDefinition<Config, Slug>,
-	snapshot: () => SessionFor<Config, Slug> | null | undefined
-) {
-	return definition.client({
-		token: null,
-		get session() {
-			return snapshot() ?? null;
-		},
-		issued() {
-			throw new Error("Sign in from a browser event, a form action, or a server load");
-		},
-		cleared() {},
-	});
-}

package/src/request-session.ts

@@ -1,54 +0,0 @@
-import type { SessionTokenStore } from "@riducms/sdk";
-import type { Cookies } from "@sveltejs/kit";
-
-import type { SessionSnapshot } from "./browser-session.js";
-
-/**
- * Owns the token for one SvelteKit request. It reads the same frontend cookie the browser client
- * writes, and a server-side login, logout, or rejected token updates that cookie on the response.
- */
-export class RequestSessionStore<
-	Session extends SessionSnapshot,
-> implements SessionTokenStore<Session> {
-	#session: Session | null = null;
-
-	constructor(
-		private readonly cookies: Cookies,
-		private readonly cookieName: string,
-		private readonly secure: boolean
-	) {}
-
-	get token() {
-		return this.cookies.get(this.cookieName) ?? null;
-	}
-
-	get session() {
-		return this.#session;
-	}
-
-	issued(token: string, session: Session) {
-		this.cookies.set(this.cookieName, token, {
-			path: "/",
-			expires: new Date(session.expiresAt),
-			httpOnly: false,
-			sameSite: "lax",
-			secure: this.secure,
-		});
-		this.#session = session;
-	}
-
-	verified(token: string, session: Session) {
-		if (this.token === token) this.#session = session;
-	}
-
-	cleared(token: string) {
-		if (this.token !== token) return;
-		this.cookies.delete(this.cookieName, {
-			path: "/",
-			httpOnly: false,
-			sameSite: "lax",
-			secure: this.secure,
-		});
-		this.#session = null;
-	}
-}

package/src/server.ts

@@ -1,74 +0,0 @@
-import type {
-	AuthCollectionSlug,
-	ClientOptions,
-	RiduClient,
-	RiduConfigShape,
-	SessionFor,
-} from "@riducms/sdk";
-import type { RequestEvent } from "@sveltejs/kit";
-
-import { definitionKey, type RiduDefinition } from "./definition.js";
-import { RequestSessionStore } from "./request-session.js";
-
-interface Binding<Config extends RiduConfigShape, Slug extends AuthCollectionSlug<Config>> {
-	readonly [definitionKey]: RiduDefinition<Config, Slug>;
-}
-
-export interface ServerClientOptions {
-	/**
-	 * Fetch for server requests to Ridu. Defaults to the definition's fetch, then to SvelteKit's
-	 * `event.fetch`. The client sends its token in a header with `credentials: "omit"`, so
-	 * `event.fetch` does not forward the web app's cookies to Ridu.
-	 */
-	fetch?: ClientOptions["fetch"];
-}
-
-/**
- * Create the Ridu client for one SvelteKit request. It authenticates with the request's frontend
- * cookie, verifies `auth.getSession()` at most once, and writes the cookie on the response after a
- * server-side login, logout, or rejected token.
- */
-export function createServerClient<
-	Config extends RiduConfigShape,
-	Slug extends AuthCollectionSlug<Config>,
->(
-	ridu: Binding<Config, Slug>,
-	event: Pick<RequestEvent, "cookies" | "url"> & Partial<Pick<RequestEvent, "fetch">>,
-	options: ServerClientOptions = {}
-): RiduClient<Config, Slug> {
-	const definition = ridu[definitionKey];
-	const store = new RequestSessionStore<SessionFor<Config, Slug>>(
-		event.cookies,
-		definition.cookieName,
-		event.url.protocol === "https:"
-	);
-	return definition.client(store, {
-		...(options.fetch === undefined ? {} : { fetch: options.fetch }),
-		...(event.fetch === undefined ? {} : { fallbackFetch: event.fetch }),
-		memoizeSession: true,
-	});
-}
-
-/**
- * A server `handle` hook. SvelteKit 2 exports `Handle` from `@sveltejs/kit` and SvelteKit 3 from
- * `@sveltejs/kit/hooks`; this shape is assignable to both.
- */
-export type RiduHandle = (input: {
-	event: RequestEvent;
-	resolve: (event: RequestEvent) => Response | Promise<Response>;
-}) => Response | Promise<Response>;
-
-/**
- * A SvelteKit `handle` that sets `event.locals.ridu` for each request. Compose it with other hooks
- * through `sequence`.
- */
-export function createRiduHandle<
-	Config extends RiduConfigShape,
-	Slug extends AuthCollectionSlug<Config>,
->(ridu: Binding<Config, Slug>, options: ServerClientOptions = {}): RiduHandle {
-	return ({ event, resolve }) => {
-		// Applications type `App.Locals.ridu` with their own client; assign without widening it.
-		Object.assign(event.locals, { ridu: createServerClient(ridu, event, options) });
-		return resolve(event);
-	};
-}