@strivacity/sdk-nuxt 4.0.0-beta.0 → 4.0.0-beta.2

package/src/runtime/composables/use-native-login.ts

@@ -1,9 +1,8 @@
-import type { NativeFlow, NativeParams, NativeFlowState, NativeFlowMessage } from '@strivacity/sdk-core/types';
+import type { NativeFlow, NativeFlowState, NativeFlowMessage } from '@strivacity/sdk-core/types';
 import type { LoginContext, UseNativeLoginOptions } from '../types';
 import { STRIVACITY_LOGIN_CONTEXT, type useNativeLoginContext } from './use-native-login-context';
 import { provide, ref, onMounted, onUnmounted } from 'vue';
-import { FallbackError } from '@strivacity/sdk-core/utils/errors';
-import { unflattenObject } from '@strivacity/sdk-core/utils';
+import { createNativeLoginController } from '@strivacity/sdk-core/utils';
 import { useStrivacity } from './use-strivacity';
 
 /**
@@ -14,169 +13,38 @@ import { useStrivacity } from './use-strivacity';
  * @throws {Error} - If the Strivacity SDK context is not found.
  */
 export function useNativeLogin(options: UseNativeLoginOptions = {}): ReturnType<typeof useNativeLoginContext> {
-	const abortController = new AbortController();
 	const { sdk } = useStrivacity<NativeFlow>();
-
-	const loading = ref<boolean>(true);
-	const forms = ref<Record<string, Record<string, unknown>>>({});
-	const messages = ref<Record<string, Record<string, NativeFlowMessage>>>({});
-	const state = ref<Partial<NativeFlowState>>({});
-
-	onMounted(async () => {
-		await sdk.init();
-
-		try {
-			await startSession(options.params);
-		} catch (error) {
-			if (error instanceof DOMException && error.name === 'AbortError') {
-				return;
-			}
-
-			sdk.logging?.error('Error fetching authorization URI', error as Error);
-			void options.onError?.(error as Error);
-			loading.value = false;
-		}
+	const controller = createNativeLoginController(() => sdk, options);
+	const snapshot = controller.getSnapshot();
+
+	const loading = ref<boolean>(snapshot.loading);
+	const forms = ref<Record<string, Record<string, unknown>>>(snapshot.forms);
+	const messages = ref<Record<string, Record<string, NativeFlowMessage>>>(snapshot.messages);
+	const state = ref<Partial<NativeFlowState>>(snapshot.state);
+
+	const unsubscribe = controller.subscribe((next) => {
+		loading.value = next.loading;
+		forms.value = next.forms;
+		messages.value = next.messages;
+		state.value = next.state;
 	});
 
-	onUnmounted(() => abortController.abort());
-
-	function handleResponse(nextState: Partial<NativeFlowState>) {
-		if (sdk.session) {
-			return void options.onLogin?.(sdk.session);
-		}
-
-		const newState: NativeFlowState = {
-			hostedUrl: nextState?.hostedUrl ?? state.value.hostedUrl,
-			finalizeUrl: nextState?.finalizeUrl ?? state.value.finalizeUrl,
-			screen: nextState?.screen ?? state.value.screen,
-			forms: nextState?.forms ?? state.value.forms,
-			layout: nextState?.layout ?? state.value.layout,
-			messages: nextState?.messages ?? {},
-			branding: nextState?.branding ?? state.value.branding,
-		};
-
-		if (newState.screen !== state.value.screen) {
-			forms.value = {};
-			messages.value = {};
-
-			for (const form of newState.forms ?? []) {
-				forms.value[form.id] = {};
-				messages.value[form.id] = {};
-			}
-		} else {
-			sdk.logging?.info(`Updating screen: ${newState.screen}`);
-		}
-
-		for (const formId of Object.keys(newState.messages ?? {})) {
-			if (formId === 'global') {
-				// eslint-disable-next-line @typescript-eslint/no-non-null-asserted-optional-chain
-				void options.onGlobalMessage?.(newState.messages?.global!);
-			} else {
-				messages.value[formId] = newState.messages![formId] ?? {};
-			}
-		}
-
-		state.value = newState;
-
-		if (!newState.finalizeUrl) {
-			loading.value = false;
-		}
-	}
-
-	async function startSession(loginParams: NativeParams = {}) {
-		try {
-			loading.value = true;
-
-			const nextState = await sdk.startSession(loginParams);
-
-			if (nextState) {
-				handleResponse(nextState);
-			}
-		} catch (error) {
-			if (error instanceof FallbackError) {
-				sdk.logging?.error('Fallback error occurred', error);
-				void options.onFallback?.(error);
-			} else {
-				sdk.logging?.error('Error starting session', error as Error);
-				void options.onError?.(error as Error);
-			}
-		}
-	}
-
-	function triggerFallback(message?: string) {
-		sdk.logging?.warn(message ? `Triggering fallback due to: ${message}` : 'Triggering fallback');
-
-		if (!state.value.hostedUrl) {
-			const error = new Error('No hosted URL provided');
-			sdk.logging?.error('Fallback error', error);
-			throw error;
-		}
-
-		void options.onFallback?.(new FallbackError(new URL(state.value.hostedUrl)));
-	}
+	onMounted(() => controller.start());
+	onUnmounted(unsubscribe);
 
-	function triggerClose() {
-		sdk.logging?.debug('Triggering close');
-		void options.onClose?.();
-	}
-
-	async function submitForm(formId: string, customBody?: Record<string, unknown>) {
-		try {
-			loading.value = true;
-
-			const nextState = await sdk.submitForm(formId, customBody ?? unflattenObject(forms.value[formId] ?? {}));
-
-			if (nextState) {
-				handleResponse(nextState);
-			}
-		} catch (error) {
-			if (error instanceof FallbackError) {
-				sdk.logging?.error('Fallback error occurred', error);
-				void options.onFallback?.(error);
-			} else {
-				sdk.logging?.error('Error submitting form', error as Error);
-				void options.onError?.(error as Error);
-			}
-		}
-	}
-
-	function setFormValue(formId: string, widgetId: string, value: unknown) {
-		if (forms.value[formId] === undefined) {
-			forms.value[formId] = {};
-		}
-
-		forms.value[formId][widgetId] = value === '' ? null : value;
-	}
-
-	function setMessage(formId: string, widgetId: string, value: NativeFlowMessage) {
-		if (messages.value[formId] === undefined) {
-			messages.value[formId] = {};
-		}
-
-		messages.value[formId][widgetId] = value;
-	}
-
-	provide<LoginContext>(STRIVACITY_LOGIN_CONTEXT, {
+	const context: LoginContext = {
 		loading,
 		forms,
 		messages,
 		state,
-		triggerFallback,
-		triggerClose,
-		submitForm,
-		setFormValue,
-		setMessage,
-	});
-
-	return {
-		loading,
-		forms,
-		messages,
-		state,
-		triggerFallback,
-		triggerClose,
-		submitForm,
-		setFormValue,
-		setMessage,
+		triggerFallback: controller.triggerFallback,
+		triggerClose: controller.triggerClose,
+		submitForm: controller.submitForm,
+		setFormValue: controller.setFormValue,
+		setMessage: controller.setMessage,
 	};
+
+	provide<LoginContext>(STRIVACITY_LOGIN_CONTEXT, context);
+
+	return context;
 }

package/src/runtime/composables/use-strivacity.ts

@@ -1,95 +1,245 @@
-import type { EmbeddedFlow, IdTokenClaims, NativeFlow, PopupFlow, RedirectFlow } from '@strivacity/sdk-core/types';
+import type { EmbeddedFlow, IdTokenClaims, NativeFlow, PopupFlow, RedirectFlow, SessionData } from '@strivacity/sdk-core/types';
 import type { SDKContext } from '../types';
-import { ref } from 'vue';
+import { computed, ref } from 'vue';
 import { initFlow } from '@strivacity/sdk-core';
-import { useRuntimeConfig } from '#app';
+import { isSessionExpired } from '@strivacity/sdk-core/utils';
+import { tryUseNuxtApp, useRuntimeConfig } from '#app';
 import { useSession } from './use-session';
 import createLogging from '#strivacity-options-logging';
 import createHttpClient from '#strivacity-options-httpClient';
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-let sdk: any;
+type Flow = RedirectFlow | PopupFlow | NativeFlow | EmbeddedFlow;
 
-const loadingRef = ref<boolean>(true);
-const languageRef = ref<string>(globalThis.navigator?.language ?? 'en-US');
-const isAuthenticatedRef = ref<boolean>(false);
-const idTokenClaimsRef = ref<IdTokenClaims | null>(null);
-const accessTokenRef = ref<string | null>(null);
-const refreshTokenRef = ref<string | null>(null);
-const accessTokenExpiredRef = ref<boolean>(true);
-const accessTokenExpirationDateRef = ref<number | null>(null);
+// Browser-only singleton: there is exactly one user per page there. It is never created during SSR, where a module-level
+// instance would be shared by every concurrent request (and leak one user's session into another user's HTML).
+let clientContext: SDKContext<Flow> | undefined;
 
-const updateSession = async () => {
-	const authenticated = await sdk.isAuthenticated;
-
-	if (loadingRef.value) {
-		loadingRef.value = false;
-	}
-	if (sdk.language !== languageRef.value) {
-		languageRef.value = sdk.language;
-	}
-	if (authenticated !== isAuthenticatedRef.value) {
-		isAuthenticatedRef.value = authenticated;
-	}
-	if (sdk.idTokenClaims !== idTokenClaimsRef.value) {
-		idTokenClaimsRef.value = sdk.idTokenClaims || null;
-	}
-	if (sdk.accessToken !== accessTokenRef.value) {
-		accessTokenRef.value = sdk.accessToken || null;
-	}
-	if (sdk.refreshToken !== refreshTokenRef.value) {
-		refreshTokenRef.value = sdk.refreshToken || null;
-	}
-	if (sdk.accessTokenExpired !== accessTokenExpiredRef.value) {
-		accessTokenExpiredRef.value = sdk.accessTokenExpired;
-	}
-	if (sdk.accessTokenExpirationDate !== accessTokenExpirationDateRef.value) {
-		accessTokenExpirationDateRef.value = sdk.accessTokenExpirationDate || null;
-	}
-};
+/**
+ * Derives the reactive state from a session. Used by the SSR context, and as the browser's initial state, so the first client
+ * render matches the server-rendered HTML (no hydration mismatch) until the browser SDK takes over.
+ *
+ * @param {SessionData | undefined} session - The current session (`useSession()`).
+ * @param {boolean} serverManaged - Whether server-managed sessions are enabled (`serverSessionUri`).
+ * @returns The derived state values.
+ */
+function deriveState(session: SessionData | undefined, serverManaged: boolean) {
+	return {
+		// With client-managed sessions the server cannot know the session (it lives in browser storage), so stay "loading"
+		// until the browser SDK has loaded it.
+		loading: !serverManaged,
+		language: 'en-US',
+		isAuthenticated: serverManaged && !isSessionExpired(session),
+		idTokenClaims: session?.claims ?? null,
+		accessToken: session?.access_token ?? null,
+		accessTokenExpired: isSessionExpired(session),
+		accessTokenExpirationDate: session?.expires_at ?? null,
+	};
+}
 
 /**
- * A composable to access the Strivacity SDK context.
+ * Creates the browser SDK instance and its reactive state. Called once, by the `strivacity` client plugin (or lazily by
+ * the first `useStrivacity()` call in the browser).
  *
- * @template T - The type of the Strivacity SDK flow (RedirectFlow, PopupFlow, NativeFlow, or EmbeddedFlow).
- * @returns {SDKContext<T>} The Strivacity SDK context.
+ * @returns {SDKContext} The browser SDK context.
  */
-export const useStrivacity = <
-	T extends RedirectFlow | PopupFlow | NativeFlow | EmbeddedFlow = RedirectFlow | PopupFlow | NativeFlow | EmbeddedFlow,
->(): SDKContext<T> => {
-	if (!sdk) {
-		sdk = initFlow({
-			...useRuntimeConfig().public.strivacity,
-			logging: createLogging ? createLogging() : undefined,
-			httpClient: createHttpClient ? createHttpClient() : undefined,
-		});
-		sdk.subscribeToAllEvents(updateSession);
-
-		sdk.session = useSession().value;
-		void updateSession();
+export function getClientContext(): SDKContext<Flow> {
+	if (clientContext) {
+		return clientContext;
 	}
 
-	return {
+	const options = useRuntimeConfig().public.strivacity;
+	// eslint-disable-next-line @typescript-eslint/no-explicit-any
+	const sdk: any = initFlow({
+		...options,
+		logging: createLogging ? createLogging() : undefined,
+		httpClient: createHttpClient ? createHttpClient() : undefined,
+	});
+
+	// Start from the same values the server rendered with, then let the SDK update them.
+	const initial = deriveState(useSession().value, !!options.serverSessionUri);
+	const loading = ref<boolean>(initial.loading);
+	const language = ref<string>(initial.language);
+	const isAuthenticated = ref<boolean>(initial.isAuthenticated);
+	const idTokenClaims = ref<IdTokenClaims | null>(initial.idTokenClaims);
+	const accessToken = ref<string | null>(initial.accessToken);
+	const refreshToken = ref<string | null>(null);
+	const accessTokenExpired = ref<boolean>(initial.accessTokenExpired);
+	const accessTokenExpirationDate = ref<number | null>(initial.accessTokenExpirationDate);
+
+	const updateSession = async () => {
+		const authenticated = await sdk.isAuthenticated;
+
+		if (loading.value) {
+			loading.value = false;
+		}
+		if (sdk.language !== language.value) {
+			language.value = sdk.language;
+		}
+		if (authenticated !== isAuthenticated.value) {
+			isAuthenticated.value = authenticated;
+		}
+		if (sdk.idTokenClaims !== idTokenClaims.value) {
+			idTokenClaims.value = sdk.idTokenClaims || null;
+		}
+		if (sdk.accessToken !== accessToken.value) {
+			accessToken.value = sdk.accessToken || null;
+		}
+		if (sdk.refreshToken !== refreshToken.value) {
+			refreshToken.value = sdk.refreshToken || null;
+		}
+		if (sdk.accessTokenExpired !== accessTokenExpired.value) {
+			accessTokenExpired.value = sdk.accessTokenExpired;
+		}
+		if (sdk.accessTokenExpirationDate !== accessTokenExpirationDate.value) {
+			accessTokenExpirationDate.value = sdk.accessTokenExpirationDate || null;
+		}
+	};
+
+	sdk.subscribeToAllEvents(updateSession);
+	sdk.session = useSession().value;
+	void updateSession();
+
+	clientContext = {
 		sdk,
-		loading: loadingRef,
-		language: languageRef,
-		isAuthenticated: isAuthenticatedRef,
-		idTokenClaims: idTokenClaimsRef,
-		accessToken: accessTokenRef,
-		refreshToken: refreshTokenRef,
-		accessTokenExpired: accessTokenExpiredRef,
-		accessTokenExpirationDate: accessTokenExpirationDateRef,
+		loading,
+		language,
+		isAuthenticated,
+		idTokenClaims,
+		accessToken,
+		refreshToken,
+		accessTokenExpired,
+		accessTokenExpirationDate,
 		init: () => sdk.init(),
 		subscribeToEvent: ((...args: Parameters<typeof sdk.subscribeToEvent>) => sdk.subscribeToEvent(...args)) as typeof sdk.subscribeToEvent,
 		subscribeToAllEvents: (...args: Parameters<typeof sdk.subscribeToAllEvents>) => sdk.subscribeToAllEvents(...args),
 		checkAuthentication: (...args: Parameters<typeof sdk.checkAuthentication>) => sdk.checkAuthentication(...args),
 		tokenExchange: (...args: Parameters<typeof sdk.tokenExchange>) => sdk.tokenExchange(...args),
 		handleCallback: (...args: Parameters<typeof sdk.handleCallback>) => sdk.handleCallback(...args),
-		refresh: () => sdk.refresh(),
+		refresh: (...args: Parameters<typeof sdk.refresh>) => sdk.refresh(...args),
 		revoke: () => sdk.revoke(),
 		logout: (...args: Parameters<typeof sdk.logout>) => sdk.logout(...args),
 		login: (...args: Parameters<typeof sdk.login>) => sdk.login(...args),
 		register: (...args: Parameters<typeof sdk.register>) => sdk.register(...args),
 		entry: (...args: Parameters<typeof sdk.entry>) => sdk.entry(...args),
 	};
+
+	return clientContext;
+}
+
+const SDK_METHODS = new Set([
+	'init',
+	'login',
+	'register',
+	'entry',
+	'handleCallback',
+	'tokenExchange',
+	'refresh',
+	'revoke',
+	'logout',
+	'updateSession',
+	'cleanupSession',
+	'startSession',
+	'submitForm',
+	'finalizeSession',
+]);
+
+function browserOnly(name: string): () => never {
+	return () => {
+		throw new Error(`[@strivacity/sdk-nuxt] ${name}() is only available in the browser. During SSR, useStrivacity() is read-only.`);
+	};
+}
+
+/**
+ * Builds a read-only context for server-side rendering from the current request's session (`useSession()`, filled by the
+ * module's server middleware when server-managed sessions are enabled). No SDK instance is created on the server.
+ *
+ * @returns {SDKContext} The read-only SSR context.
+ */
+function createServerContext(): SDKContext<Flow> {
+	const options = useRuntimeConfig().public.strivacity;
+	const session = useSession();
+	const serverManaged = !!options.serverSessionUri;
+
+	const state = computed(() => deriveState(session.value, serverManaged));
+	const isAuthenticated = computed(() => state.value.isAuthenticated);
+	const idTokenClaims = computed(() => state.value.idTokenClaims);
+	const accessToken = computed(() => state.value.accessToken);
+	const accessTokenExpired = computed(() => state.value.accessTokenExpired);
+	const accessTokenExpirationDate = computed(() => state.value.accessTokenExpirationDate);
+	const noopSubscription = () => ({ dispose: () => undefined });
+
+	const values: Record<string, () => unknown> = {
+		options: () => options,
+		session: () => session.value ?? null,
+		isAuthenticated: async () => Promise.resolve(isAuthenticated.value),
+		isAuthenticatedSync: () => isAuthenticated.value,
+		idTokenClaims: () => idTokenClaims.value,
+		accessToken: () => accessToken.value,
+		accessTokenExpired: () => accessTokenExpired.value,
+		accessTokenExpirationDate: () => accessTokenExpirationDate.value,
+		subscribeToEvent: () => noopSubscription,
+		subscribeToAllEvents: () => noopSubscription,
+		checkAuthentication: () => async () => Promise.resolve(isAuthenticated.value),
+	};
+
+	const sdk = new Proxy(
+		{},
+		{
+			get(_target, property) {
+				if (typeof property !== 'string') {
+					return undefined;
+				}
+				if (property in values) {
+					return values[property]!();
+				}
+				if (SDK_METHODS.has(property)) {
+					return browserOnly(`sdk.${property}`);
+				}
+
+				return undefined;
+			},
+		},
+	) as Flow;
+
+	return {
+		sdk,
+		loading: ref<boolean>(state.value.loading),
+		language: ref<string>(state.value.language),
+		isAuthenticated,
+		idTokenClaims,
+		accessToken,
+		refreshToken: ref<string | null>(null),
+		accessTokenExpired,
+		accessTokenExpirationDate,
+		init: async () => Promise.resolve(),
+		subscribeToEvent: noopSubscription,
+		subscribeToAllEvents: noopSubscription,
+		checkAuthentication: async () => Promise.resolve(isAuthenticated.value),
+		tokenExchange: browserOnly('tokenExchange'),
+		handleCallback: browserOnly('handleCallback'),
+		refresh: browserOnly('refresh'),
+		revoke: browserOnly('revoke'),
+		logout: browserOnly('logout'),
+		login: browserOnly('login'),
+		register: browserOnly('register'),
+		entry: browserOnly('entry'),
+	};
+}
+
+/**
+ * A composable to access the Strivacity SDK context.
+ *
+ * In the browser it returns the live SDK instance and its reactive state. During server-side rendering it returns a
+ * read-only context derived from the current request's session: the refs and `sdk.options` / `sdk.session` can be read,
+ * while SDK methods such as `login()` throw, because authentication flows only run in the browser.
+ *
+ * @template T - The type of the Strivacity SDK flow (RedirectFlow, PopupFlow, NativeFlow, or EmbeddedFlow).
+ * @returns {SDKContext<T>} The Strivacity SDK context.
+ */
+export const useStrivacity = <T extends Flow = Flow>(): SDKContext<T> => {
+	if (import.meta.server || tryUseNuxtApp()?.ssrContext) {
+		return createServerContext() as unknown as SDKContext<T>;
+	}
+
+	return getClientContext() as unknown as SDKContext<T>;
 };

package/src/runtime/middleware/auth.server.ts

@@ -1,4 +1,6 @@
+import { appendResponseHeader } from 'h3';
 import { defineNuxtRouteMiddleware, useNuxtApp } from '#imports';
+import { flushSetCookies, toClientSession } from '@strivacity/sdk-core/utils';
 import { useSession } from '../composables/use-session';
 
 export default defineNuxtRouteMiddleware(async () => {
@@ -12,5 +14,12 @@ export default defineNuxtRouteMiddleware(async () => {
 	const { useStrivacity } = await import('../server/composables/use-strivacity');
 	const sdk = useStrivacity(h3Event);
 
-	useSession().value = (await sdk.getSession()) ?? undefined;
+	const session = await sdk.getSession();
+	const cookies = flushSetCookies(h3Event, new Response(null)).headers.getSetCookie();
+
+	for (const cookie of cookies) {
+		appendResponseHeader(h3Event, 'set-cookie', cookie);
+	}
+
+	useSession().value = toClientSession(session) ?? undefined;
 });

package/src/runtime/plugins/strivacity.client.ts

@@ -0,0 +1,17 @@
+import { defineNuxtPlugin } from '#app';
+import { getClientContext } from '../composables/use-strivacity';
+
+/**
+ * Creates the browser SDK instance as soon as the Nuxt app starts on the client (it is never created during SSR), and
+ * exposes it as `useNuxtApp().$strivacity`. `useStrivacity()` returns the same context.
+ */
+export default defineNuxtPlugin({
+	name: 'strivacity',
+	setup() {
+		return {
+			provide: {
+				strivacity: getClientContext(),
+			},
+		};
+	},
+});

package/src/runtime/server/plugins/auth.server.ts

@@ -1,7 +1,7 @@
 import type { H3Event } from 'h3';
 import type { NitroApp } from 'nitropack/types';
 import type { NuxtServerSDK, NuxtServerSDKInitConfig } from '../../types';
-import { toWebRequest } from 'h3';
+import { toWebRequest, createError } from 'h3';
 import { useRuntimeConfig } from '#imports';
 import { defineNitroPlugin } from 'nitropack/dist/runtime/plugin';
 import { createBaseServerSDK } from '@strivacity/sdk-core/server';
@@ -16,11 +16,72 @@ declare module 'h3' {
 	}
 }
 
-export default defineNitroPlugin((nitroApp) => {
-	void setupAuthPlugin(nitroApp);
+type BaseSDK = ReturnType<typeof createBaseServerSDK<H3Event>>;
+
+export default defineNitroPlugin((nitroApp: NitroApp) => {
+	let base: BaseSDK | undefined;
+	let setupError: unknown;
+
+	const ready = setupAuthPlugin()
+		.then((result) => {
+			base = result;
+		})
+		.catch((error: unknown) => {
+			// NOTE: Nitro calls plugins synchronously and never awaits or catches their result, so a rejection
+			// here would otherwise be a silent unhandled rejection. Logging it and falling back to a stub sdk
+			// below turns every request into a clear 500 instead of an unrelated "sdk is undefined" error.
+			// eslint-disable-next-line no-console
+			console.error('[@strivacity/sdk-nuxt] Failed to initialize the Strivacity server SDK:', error);
+			setupError = error;
+		});
+
+	// NOTE: Registered synchronously, before setupAuthPlugin's awaited dynamic imports resolve, so even the
+	// very first request right after startup is covered by it - the hook itself just awaits `ready` first.
+	nitroApp.hooks.hook('request', async (event: H3Event) => {
+		await ready;
+
+		event.context.strivacity ??= {} as never;
+
+		if (event.context.strivacity.sdk) {
+			return;
+		}
+
+		if (!base) {
+			event.context.strivacity.sdk = new Proxy({} as NuxtServerSDK, {
+				get: () => {
+					throw createError({ statusCode: 500, statusMessage: 'Strivacity SDK failed to initialize', cause: setupError });
+				},
+			});
+			return;
+		}
+
+		const sdk = base;
+
+		event.context.strivacity.sdk = {
+			get options() {
+				return sdk.options;
+			},
+			getSession: (_event, params) => sdk.getSession(event, params),
+			updateSession: (session) => sdk.updateSession(session, event),
+			refreshSession: () => sdk.refreshSession(event),
+			revokeSession: () => sdk.revokeSession(event),
+			getEntrySession: (entryUrl) => sdk.getEntrySession(entryUrl),
+			completeLogin: (params) => sdk.completeLogin(params, event),
+			logout: (postLogoutRedirectUri) => sdk.logout(postLogoutRedirectUri, event),
+			handleLogin: (evt) => sdk.handleLogin(evt),
+			handleRegister: (evt) => sdk.handleRegister(evt),
+			handleCallback: (evt) => sdk.handleCallback(evt),
+			handleRefresh: (evt) => sdk.handleRefresh(evt),
+			handleRevoke: (evt) => sdk.handleRevoke(evt),
+			handleEntry: (evt) => sdk.handleEntry(evt),
+			handleLogout: (evt) => sdk.handleLogout(evt),
+			handleBackChannelLogout: (evt) => sdk.handleBackChannelLogout(evt),
+			handler: (evt) => sdk.handler(evt),
+		};
+	});
 });
 
-async function setupAuthPlugin(nitroApp: NitroApp) {
+async function setupAuthPlugin(): Promise<BaseSDK> {
 	const config = useRuntimeConfig();
 	const initConfig = { ...config.strivacity } as NuxtServerSDKInitConfig;
 	const customStorage = (await import('#strivacity-options-storage')).default();
@@ -50,35 +111,10 @@ async function setupAuthPlugin(nitroApp: NitroApp) {
 		initConfig.storage = createEncryptedCookieStorage(initConfig.secret, { defaultCookieOptions: { maxAge: initConfig.cookieMaxAge } });
 	}
 
-	const base = createBaseServerSDK<H3Event>(
+	return createBaseServerSDK<H3Event>(
 		{
 			toRequest: (event) => toWebRequest(event),
 		},
 		initConfig,
 	);
-
-	nitroApp.hooks.hook('request', (event: H3Event) => {
-		event.context.strivacity ??= {} as never;
-		event.context.strivacity.sdk ??= {
-			get options() {
-				return base.options;
-			},
-			getSession: () => base.getSession(event),
-			updateSession: (session) => base.updateSession(session, event),
-			refreshSession: () => base.refreshSession(event),
-			revokeSession: () => base.revokeSession(event),
-			getEntrySession: (entryUrl) => base.getEntrySession(entryUrl),
-			completeLogin: (params) => base.completeLogin(params, event),
-			logout: (postLogoutRedirectUri) => base.logout(postLogoutRedirectUri, event),
-			handleLogin: (evt) => base.handleLogin(evt),
-			handleRegister: (evt) => base.handleRegister(evt),
-			handleCallback: (evt) => base.handleCallback(evt),
-			handleRefresh: (evt) => base.handleRefresh(evt),
-			handleRevoke: (evt) => base.handleRevoke(evt),
-			handleEntry: (evt) => base.handleEntry(evt),
-			handleLogout: (evt) => base.handleLogout(evt),
-			handleBackChannelLogout: (evt) => base.handleBackChannelLogout(evt),
-			handler: (evt) => base.handler(evt),
-		};
-	});
 }