@riducms/sveltekit 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Haniel Ubogu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,44 @@
+# `@riducms/sveltekit`
+
+SvelteKit integration for a Ridu application's generated client. Browsers call Ridu directly;
+server loads and form actions use a request-scoped client. Both authenticate with one session token
+kept in a cookie on the application's own domain, so the frontend and Ridu can run on unrelated
+domains with third-party cookies blocked.
+
+```ts
+// src/lib/ridu.ts
+import { PUBLIC_RIDU_URL } from "$env/static/public";
+import { defineRidu, type InferClient } from "@riducms/sveltekit";
+import { createClient } from "$lib/ridu.generated";
+
+export const ridu = defineRidu({ createClient, baseURL: PUBLIC_RIDU_URL, authCollection: "users" });
+export type Client = InferClient<typeof ridu>;
+```
+
+```ts
+// src/hooks.server.ts
+import { createRiduHandle } from "@riducms/sveltekit/server";
+import { ridu } from "$lib/ridu";
+
+export const handle = createRiduHandle(ridu);
+```
+
+Type `App.Locals.ridu` as `Client`, return `await locals.ridu.auth.getSession()` from the root
+layout's server load with `depends(AUTH_DEPENDENCY)`, and call
+`ridu.provide({ session: () => data.session })` in the root layout. Components then use
+`ridu.use()`; `client.auth.session` is reactive.
+
+The [SvelteKit guide](../../website/src/content/docs/sveltekit.md) covers loads, components,
+private images, and the security trade-off: the token cookie is readable by the application's
+scripts so the browser can send it to Ridu.
+
+## Ownership
+
+- `defineRidu` holds configuration and types. It never creates a shared authenticated client.
+- `createRiduHandle` creates one client per request. `auth.getSession()` verifies once per request;
+  a server-side login, logout, or rejected token writes the cookie on the response.
+- `provide` creates one browser client per mounted application and an isolated, credential-free
+  client for each server render. `BrowserSessionStore` owns the cookie, reactive session, tab
+  synchronization, and stale-event rules.
+- Transport, errors, and token handling stay in `@riducms/sdk`. This package only supplies
+  SvelteKit lifecycle, context, and reactivity.

package/package.json

@@ -0,0 +1,49 @@
+{
+	"bugs": {
+		"url": "https://github.com/riducms/ridu/issues"
+	},
+	"description": "SvelteKit integration for Ridu: direct browser requests, server rendering, and one session owner.",
+	"devDependencies": {
+		"@riducms/sdk": "0.4.0",
+		"@sveltejs/kit": "^2.48.0"
+	},
+	"exports": {
+		".": {
+			"default": "./src/index.ts",
+			"svelte": "./src/index.ts",
+			"types": "./src/index.ts"
+		},
+		"./server": {
+			"default": "./src/server.ts",
+			"svelte": "./src/server.ts",
+			"types": "./src/server.ts"
+		}
+	},
+	"files": [
+		"src",
+		"LICENSE"
+	],
+	"homepage": "https://riducms.com",
+	"license": "MIT",
+	"name": "@riducms/sveltekit",
+	"peerDependencies": {
+		"@riducms/sdk": "0.4.0",
+		"@sveltejs/kit": "^2.20.0",
+		"svelte": "^5.29.0"
+	},
+	"publishConfig": {
+		"access": "public",
+		"provenance": true
+	},
+	"repository": {
+		"directory": "packages/sveltekit",
+		"type": "git",
+		"url": "git+https://github.com/riducms/ridu.git"
+	},
+	"scripts": {
+		"check": "tsc -p tsconfig.json",
+		"test": "bun test"
+	},
+	"type": "module",
+	"version": "0.4.0"
+}

package/src/browser-session.ts

@@ -0,0 +1,184 @@
+import type { SessionTokenStore } from "@riducms/sdk";
+
+import { expiredTokenCookie, readCookie, tokenCookie } from "./cookie.js";
+
+/** The safe session snapshot shared by tabs and rendered pages. It never contains the token. */
+export interface SessionSnapshot {
+	id: string;
+	expiresAt: string;
+}
+
+/** Tabs share one cookie jar; a message only tells other tabs to adopt the change. */
+interface SessionMessage<Session> {
+	session: Session | null;
+}
+
+interface MessageChannel<Session> {
+	postMessage(message: SessionMessage<Session>): void;
+	addEventListener(type: "message", listener: (event: MessageEvent) => void): void;
+	removeEventListener(type: "message", listener: (event: MessageEvent) => void): void;
+	close(): void;
+}
+
+export interface BrowserSessionOptions<Session> {
+	cookieName: string;
+	/** The document whose cookie jar holds the token. */
+	document: { cookie: string };
+	secure: boolean;
+	/**
+	 * Server-rendered session snapshots, usually `() => data.session` from the root layout. They seed
+	 * hydration and refresh the user; a stale snapshot never replaces newer browser state.
+	 */
+	snapshot?: (() => Session | null | undefined) | undefined;
+	/** Cross-tab notifications. Tokens are never posted, only safe snapshots. */
+	channel?: MessageChannel<Session> | undefined;
+	/** Record a reactive read, such as a Svelte subscriber. */
+	track?: (() => void) | undefined;
+	/** The signed-in identity changed: SvelteKit loads that depend on auth must rerun. */
+	onAuthChange(): void;
+	/** Another tab or a server response replaced the token; verify the new one with Ridu. */
+	onExternalToken(): void;
+}
+
+/**
+ * Owns a token-transport session in the browser. The token lives in a frontend-domain cookie that
+ * server rendering also receives; this store reads it on every request and never caches it.
+ */
+export class BrowserSessionStore<
+	Session extends SessionSnapshot,
+> implements SessionTokenStore<Session> {
+	readonly #options: BrowserSessionOptions<Session>;
+	readonly #listeners = new Set<() => void>();
+	#session: Session | null = null;
+	/** The token the current snapshot belongs to. Any other cookie value arrived out of band. */
+	#knownToken: string | null = null;
+	#lastSnapshot: Session | null | undefined;
+	readonly #receive = (event: MessageEvent) => this.#adopt(event.data as SessionMessage<Session>);
+
+	constructor(options: BrowserSessionOptions<Session>) {
+		this.#options = options;
+		options.channel?.addEventListener("message", this.#receive);
+	}
+
+	get token() {
+		return readCookie(this.#options.document.cookie, this.#options.cookieName);
+	}
+
+	get session() {
+		this.#options.track?.();
+		this.#reconcile();
+		return this.#session;
+	}
+
+	subscribe(listener: () => void) {
+		this.#listeners.add(listener);
+		return () => this.#listeners.delete(listener);
+	}
+
+	issued(token: string, session: Session) {
+		this.#options.document.cookie = tokenCookie(this.#options.cookieName, token, {
+			expires: new Date(session.expiresAt),
+			secure: this.#options.secure,
+		});
+		this.#session = session;
+		this.#knownToken = token;
+		this.#changed(true);
+	}
+
+	verified(token: string, session: Session) {
+		// A late verification for a replaced token must not restore the previous account.
+		if (this.token !== token) return;
+		this.#session = session;
+		this.#knownToken = token;
+		this.#emit();
+	}
+
+	cleared(token: string) {
+		// A late rejection or logout must not clear a newer login.
+		if (this.token !== token) return;
+		this.#options.document.cookie = expiredTokenCookie(
+			this.#options.cookieName,
+			this.#options.secure
+		);
+		this.#session = null;
+		this.#knownToken = null;
+		this.#changed(true);
+	}
+
+	/**
+	 * Detect a token that changed without this tab's involvement, such as a server action login, an
+	 * expired cookie, or a tab without BroadcastChannel. Call it when the page becomes visible.
+	 */
+	checkExternalChange() {
+		const token = this.token;
+		if (token === this.#knownToken) return;
+		this.#knownToken = token;
+		this.#session = null;
+		this.#emit();
+		if (token === null) this.#options.onAuthChange();
+		else this.#options.onExternalToken();
+	}
+
+	/**
+	 * Call once after hydration. A broadcast sent while this page was loading was missed, so compare
+	 * the rendered session with the cookie: a session that ended or a token that appeared meanwhile
+	 * reruns auth-dependent loads.
+	 */
+	hydrated() {
+		const rendered = this.#options.snapshot?.() ?? null;
+		const token = this.token;
+		if (rendered !== null && token === null) this.#options.onAuthChange();
+		else if (rendered === null && token !== null) this.checkExternalChange();
+	}
+
+	dispose() {
+		this.#options.channel?.removeEventListener("message", this.#receive);
+		this.#options.channel?.close();
+		this.#listeners.clear();
+	}
+
+	#reconcile() {
+		const incoming = this.#options.snapshot?.();
+		if (incoming === undefined || incoming === this.#lastSnapshot) return;
+		this.#lastSnapshot = incoming;
+		const token = this.token;
+		if (incoming === null) {
+			// The server saw no session. Accept that only if this tab agrees there is no token.
+			if (token === null) {
+				this.#session = null;
+				this.#knownToken = null;
+			}
+			return;
+		}
+		if (token === null) return;
+		// Accept the first snapshot, a refreshed user for the same session, or a token that changed
+		// out of band. A snapshot for another session than this tab's newer login is stale.
+		const outOfBand = token !== this.#knownToken;
+		if (outOfBand || this.#session === null || this.#session.id === incoming.id) {
+			this.#session = incoming;
+			this.#knownToken = token;
+		}
+	}
+
+	#adopt(message: SessionMessage<Session>) {
+		const token = this.token;
+		if (message.session === null ? token !== null : token === null) {
+			// The cookie already moved on; let the visible state follow the cookie instead.
+			this.checkExternalChange();
+			return;
+		}
+		this.#session = message.session;
+		this.#knownToken = token;
+		this.#changed(false);
+	}
+
+	#changed(broadcast: boolean) {
+		this.#emit();
+		if (broadcast) this.#options.channel?.postMessage({ session: this.#session });
+		this.#options.onAuthChange();
+	}
+
+	#emit() {
+		for (const listener of this.#listeners) listener();
+	}
+}

package/src/cookie.ts

@@ -0,0 +1,47 @@
+/** Frontend-domain cookie that holds a Ridu session token. */
+export const DEFAULT_COOKIE_NAME = "ridu_token";
+
+/** Read one cookie value from a `document.cookie` or `Cookie` header string. */
+export function readCookie(header: string, name: string): string | null {
+	for (const part of header.split(";")) {
+		const separator = part.indexOf("=");
+		if (separator < 0 || part.slice(0, separator).trim() !== name) continue;
+		const value = part.slice(separator + 1).trim();
+		if (value === "") return null;
+		try {
+			return decodeURIComponent(value);
+		} catch {
+			return null;
+		}
+	}
+	return null;
+}
+
+export interface TokenCookieOptions {
+	/** Absolute session expiry; the browser drops the cookie when the session ends. */
+	expires: Date;
+	/** Send only over HTTPS. Plain-HTTP development cannot keep a Secure cookie. */
+	secure: boolean;
+}
+
+/**
+ * Serialize the token cookie for `document.cookie`. It is deliberately readable by scripts, so the
+ * browser client can send it directly to Ridu; SameSite=Lax keeps it off cross-site subrequests.
+ */
+export function tokenCookie(name: string, token: string, options: TokenCookieOptions): string {
+	const attributes = [
+		`${name}=${encodeURIComponent(token)}`,
+		"Path=/",
+		`Expires=${options.expires.toUTCString()}`,
+		"SameSite=Lax",
+	];
+	if (options.secure) attributes.push("Secure");
+	return attributes.join("; ");
+}
+
+/** Serialize an expired token cookie that removes the stored token. */
+export function expiredTokenCookie(name: string, secure: boolean): string {
+	const attributes = [`${name}=`, "Path=/", "Max-Age=0", "SameSite=Lax"];
+	if (secure) attributes.push("Secure");
+	return attributes.join("; ");
+}

package/src/definition.ts

@@ -0,0 +1,77 @@
+import type {
+	AuthCollectionSlug,
+	ClientOptions,
+	RiduClient,
+	RiduConfigShape,
+	SessionFor,
+	SessionTokenStore,
+} from "@riducms/sdk";
+
+import { DEFAULT_COOKIE_NAME } from "./cookie.js";
+
+/**
+ * The generated `createClient` from `ridu.generated.ts`. Its auth parameter is generic, so `any`
+ * is the only parameter type every generated signature accepts.
+ */
+export type ClientFactory = (options: ClientOptions<any>) => RiduClient<any, any>;
+
+/** The application contract bound by a generated factory. */
+export type ConfigOf<Factory extends ClientFactory> =
+	ReturnType<Factory> extends RiduClient<infer Config, infer _Default> ? Config : never;
+
+export interface RiduDefinitionOptions<Factory extends ClientFactory, Slug extends string> {
+	/** The generated factory, which binds the application's types. */
+	createClient: Factory;
+	/** Public Ridu origin, such as `PUBLIC_RIDU_URL`. Browsers call it directly. */
+	baseURL: string;
+	/** The auth collection whose users sign in to this application. */
+	authCollection: Slug;
+	/** Frontend-domain cookie that stores the session token. Defaults to `ridu_token`. */
+	cookieName?: string;
+	/** Fetch used by server-side clients. Defaults to the platform fetch. */
+	fetch?: ClientOptions["fetch"];
+}
+
+export const definitionKey: unique symbol = Symbol("ridu.sveltekit.definition");
+
+/** Internal binding shared by the browser provider and the server hook. */
+export interface RiduDefinition<
+	Config extends RiduConfigShape,
+	Slug extends AuthCollectionSlug<Config>,
+> {
+	readonly baseURL: string;
+	readonly authCollection: Slug;
+	readonly cookieName: string;
+	client(
+		token: SessionTokenStore<SessionFor<Config, Slug>>,
+		options?: { fetch?: ClientOptions["fetch"]; memoizeSession?: boolean }
+	): RiduClient<Config, Slug>;
+}
+
+export function createDefinition<
+	Factory extends ClientFactory,
+	Slug extends AuthCollectionSlug<ConfigOf<Factory>>,
+>(options: RiduDefinitionOptions<Factory, Slug>): RiduDefinition<ConfigOf<Factory>, Slug> {
+	const baseURL = new URL(options.baseURL).href.replace(/\/$/, "");
+	const cookieName = options.cookieName ?? DEFAULT_COOKIE_NAME;
+	if (!/^[A-Za-z0-9_-]+$/.test(cookieName)) {
+		throw new TypeError("cookieName may contain only letters, digits, underscores, and hyphens");
+	}
+	return {
+		baseURL,
+		authCollection: options.authCollection,
+		cookieName,
+		client(token, clientOptions = {}) {
+			const fetch = clientOptions.fetch ?? options.fetch;
+			return options.createClient({
+				baseURL,
+				...(fetch === undefined ? {} : { fetch }),
+				auth: {
+					collection: options.authCollection,
+					token: token as SessionTokenStore,
+					memoizeSession: clientOptions.memoizeSession === true,
+				},
+			}) as RiduClient<ConfigOf<Factory>, Slug>;
+		},
+	};
+}

package/src/index.ts

@@ -0,0 +1,156 @@
+import type { AuthCollectionSlug, RiduClient, RiduConfigShape, SessionFor } from "@riducms/sdk";
+import { getContext, onDestroy, onMount, setContext } from "svelte";
+import { createSubscriber } from "svelte/reactivity";
+import { browser } from "$app/environment";
+import { invalidate } from "$app/navigation";
+
+import { BrowserSessionStore } from "./browser-session.js";
+import {
+	createDefinition,
+	definitionKey,
+	type ClientFactory,
+	type ConfigOf,
+	type RiduDefinition,
+	type RiduDefinitionOptions,
+} from "./definition.js";
+
+export { DEFAULT_COOKIE_NAME } from "./cookie.js";
+export type { ClientFactory, ConfigOf, RiduDefinitionOptions } from "./definition.js";
+
+/** The dependency every auth-sensitive load should declare with `depends(AUTH_DEPENDENCY)`. */
+export const AUTH_DEPENDENCY = "ridu:auth";
+
+export interface ProvideOptions<Session> {
+	/**
+	 * The session rendered by the root layout, usually `() => data.session`. It seeds hydration and
+	 * later refreshes the user; it never overrides a newer sign-in or sign-out in this tab.
+	 */
+	session?: Session | null | (() => Session | null);
+}
+
+/** One application's Ridu binding. It holds configuration, never an authenticated client. */
+export interface Ridu<Config extends RiduConfigShape, Slug extends AuthCollectionSlug<Config>> {
+	readonly baseURL: string;
+	readonly authCollection: Slug;
+	readonly cookieName: string;
+	/**
+	 * Create the client for this mounted application and share it with descendants. Call it once,
+	 * during initialization of the root layout. Server renders get an isolated, credential-free
+	 * client whose `auth.session` is the rendered snapshot.
+	 */
+	provide(options?: ProvideOptions<SessionFor<Config, Slug>>): RiduClient<Config, Slug>;
+	/** Read the client provided by the root layout. Call it during component initialization. */
+	use(): RiduClient<Config, Slug>;
+	/** @internal */
+	readonly [definitionKey]: RiduDefinition<Config, Slug>;
+}
+
+/** The client type of a `defineRidu` result, for `App.Locals`. */
+export type InferClient<Binding> =
+	Binding extends Ridu<infer Config, infer Slug> ? RiduClient<Config, Slug> : never;
+
+/** The session type of a `defineRidu` result. */
+export type InferSession<Binding> =
+	Binding extends Ridu<infer Config, infer Slug> ? SessionFor<Config, Slug> : never;
+
+const clientKey = Symbol("ridu.sveltekit.client");
+
+/**
+ * Bind an application's generated client to SvelteKit.
+ *
+ * ```ts
+ * export const ridu = defineRidu({ createClient, baseURL: PUBLIC_RIDU_URL, authCollection: "users" });
+ * ```
+ */
+export function defineRidu<
+	Factory extends ClientFactory,
+	const Slug extends AuthCollectionSlug<ConfigOf<Factory>>,
+>(options: RiduDefinitionOptions<Factory, Slug>): Ridu<ConfigOf<Factory>, Slug> {
+	type Config = ConfigOf<Factory>;
+	type Session = SessionFor<Config, Slug>;
+	const definition = createDefinition<Factory, Slug>(options);
+	return {
+		baseURL: definition.baseURL,
+		authCollection: definition.authCollection,
+		cookieName: definition.cookieName,
+		[definitionKey]: definition,
+		provide(provideOptions = {}) {
+			const provided = provideOptions.session;
+			const snapshot =
+				typeof provided === "function" ? provided : () => provided as Session | null | undefined;
+			const client = browser
+				? browserClient(definition, snapshot)
+				: renderClient(definition, snapshot);
+			setContext(clientKey, client);
+			return client;
+		},
+		use() {
+			const client = getContext<RiduClient<Config, Slug> | undefined>(clientKey);
+			if (client === undefined) {
+				throw new Error("ridu.use() needs ridu.provide() in the root layout");
+			}
+			return client;
+		},
+	};
+}
+
+function browserClient<Config extends RiduConfigShape, Slug extends AuthCollectionSlug<Config>>(
+	definition: RiduDefinition<Config, Slug>,
+	snapshot: () => SessionFor<Config, Slug> | null | undefined
+) {
+	type Session = SessionFor<Config, Slug>;
+	let client: RiduClient<Config, Slug> | undefined;
+	const channel =
+		typeof BroadcastChannel === "undefined"
+			? undefined
+			: new BroadcastChannel(`ridu-auth:${definition.cookieName}`);
+	const store: BrowserSessionStore<Session> = new BrowserSessionStore<Session>({
+		cookieName: definition.cookieName,
+		document,
+		secure: location.protocol === "https:",
+		snapshot,
+		channel,
+		track: createSubscriber((update) => store.subscribe(update)),
+		onAuthChange: refreshAuthLoads,
+		onExternalToken: () => {
+			// getSession reports the verified snapshot back to the store.
+			client?.auth.getSession().then(refreshAuthLoads, refreshAuthLoads);
+		},
+	});
+	client = definition.client(store);
+	const visible = () => {
+		if (document.visibilityState === "visible") store.checkExternalChange();
+	};
+	document.addEventListener("visibilitychange", visible);
+	onMount(() => store.hydrated());
+	onDestroy(() => {
+		document.removeEventListener("visibilitychange", visible);
+		store.dispose();
+	});
+	return client;
+}
+
+/** Rerun loads that declared `depends(AUTH_DEPENDENCY)`. Ordinary mutations never do this. */
+function refreshAuthLoads() {
+	invalidate(AUTH_DEPENDENCY).catch((error: unknown) => {
+		// A failed load renders SvelteKit's error page; keep the failure visible to developers.
+		console.error("Ridu could not refresh auth-dependent loads", error);
+	});
+}
+
+/** A server render never holds a credential; components see the rendered snapshot only. */
+function renderClient<Config extends RiduConfigShape, Slug extends AuthCollectionSlug<Config>>(
+	definition: RiduDefinition<Config, Slug>,
+	snapshot: () => SessionFor<Config, Slug> | null | undefined
+) {
+	return definition.client({
+		token: null,
+		get session() {
+			return snapshot() ?? null;
+		},
+		issued() {
+			throw new Error("Sign in from a browser event, a form action, or a server load");
+		},
+		cleared() {},
+	});
+}

package/src/request-session.ts

@@ -0,0 +1,54 @@
+import type { SessionTokenStore } from "@riducms/sdk";
+import type { Cookies } from "@sveltejs/kit";
+
+import type { SessionSnapshot } from "./browser-session.js";
+
+/**
+ * Owns the token for one SvelteKit request. It reads the same frontend cookie the browser client
+ * writes, and a server-side login, logout, or rejected token updates that cookie on the response.
+ */
+export class RequestSessionStore<
+	Session extends SessionSnapshot,
+> implements SessionTokenStore<Session> {
+	#session: Session | null = null;
+
+	constructor(
+		private readonly cookies: Cookies,
+		private readonly cookieName: string,
+		private readonly secure: boolean
+	) {}
+
+	get token() {
+		return this.cookies.get(this.cookieName) ?? null;
+	}
+
+	get session() {
+		return this.#session;
+	}
+
+	issued(token: string, session: Session) {
+		this.cookies.set(this.cookieName, token, {
+			path: "/",
+			expires: new Date(session.expiresAt),
+			httpOnly: false,
+			sameSite: "lax",
+			secure: this.secure,
+		});
+		this.#session = session;
+	}
+
+	verified(token: string, session: Session) {
+		if (this.token === token) this.#session = session;
+	}
+
+	cleared(token: string) {
+		if (this.token !== token) return;
+		this.cookies.delete(this.cookieName, {
+			path: "/",
+			httpOnly: false,
+			sameSite: "lax",
+			secure: this.secure,
+		});
+		this.#session = null;
+	}
+}

package/src/server.ts

@@ -0,0 +1,60 @@
+import type {
+	AuthCollectionSlug,
+	ClientOptions,
+	RiduClient,
+	RiduConfigShape,
+	SessionFor,
+} from "@riducms/sdk";
+import type { Handle, RequestEvent } from "@sveltejs/kit";
+
+import { definitionKey, type RiduDefinition } from "./definition.js";
+import { RequestSessionStore } from "./request-session.js";
+
+interface Binding<Config extends RiduConfigShape, Slug extends AuthCollectionSlug<Config>> {
+	readonly [definitionKey]: RiduDefinition<Config, Slug>;
+}
+
+export interface ServerClientOptions {
+	/** Fetch for server requests to Ridu. Defaults to the definition's fetch or the platform fetch. */
+	fetch?: ClientOptions["fetch"];
+}
+
+/**
+ * Create the Ridu client for one SvelteKit request. It authenticates with the request's frontend
+ * cookie, verifies `auth.getSession()` at most once, and writes the cookie on the response after a
+ * server-side login, logout, or rejected token.
+ */
+export function createServerClient<
+	Config extends RiduConfigShape,
+	Slug extends AuthCollectionSlug<Config>,
+>(
+	ridu: Binding<Config, Slug>,
+	event: Pick<RequestEvent, "cookies" | "url">,
+	options: ServerClientOptions = {}
+): RiduClient<Config, Slug> {
+	const definition = ridu[definitionKey];
+	const store = new RequestSessionStore<SessionFor<Config, Slug>>(
+		event.cookies,
+		definition.cookieName,
+		event.url.protocol === "https:"
+	);
+	return definition.client(store, {
+		...(options.fetch === undefined ? {} : { fetch: options.fetch }),
+		memoizeSession: true,
+	});
+}
+
+/**
+ * A SvelteKit `handle` that sets `event.locals.ridu` for each request. Compose it with other hooks
+ * through `sequence`.
+ */
+export function createRiduHandle<
+	Config extends RiduConfigShape,
+	Slug extends AuthCollectionSlug<Config>,
+>(ridu: Binding<Config, Slug>, options: ServerClientOptions = {}): Handle {
+	return ({ event, resolve }) => {
+		// Applications type `App.Locals.ridu` with their own client; assign without widening it.
+		Object.assign(event.locals, { ridu: createServerClient(ridu, event, options) });
+		return resolve(event);
+	};
+}