The Complete Production SOP: How to Deploy and Run SvelteKit Server Hooks & Standalone API Endpoints in Autonomous AI Agents

---
name: "sveltekit-server-endpoints-hooks"
description: "Intercept incoming HTTP requests, manage user sessions, and write REST endpoints in SvelteKit."
metadata:
  author: "Svelte"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "write hooks.server.ts sveltekit"
  - "create +server.ts sveltekit"
  - "event.locals session sveltekit"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# SvelteKit Server Hooks & Standalone API Endpoints

## SOP Rules
1. Define handle hook in src/hooks.server.ts: export const handle: Handle = async ({ event, resolve }) => { ... }.
2. Hydrate session: event.locals.user = await validateSession(event.cookies.get('session_id')).
3. Standalone API routes must be placed in src/routes/**/+server.ts exporting explicit HTTP verb functions (GET, POST, PUT, PATCH, DELETE).
4. Always return standard Response objects using SvelteKit's json() helper or error() helper.
5. Enforce ambient type contracts in src/app.d.ts under App.Locals.

import type { Handle } from '@sveltejs/kit';

export const handle: Handle = async ({ event, resolve }) => {
  const sessionToken = event.cookies.get('session_token');

  if (sessionToken) {
    // Validate token against auth provider or cache
    event.locals.user = { id: 'usr_123', email: '[email protected]', role: 'admin' };
  } else {
    event.locals.user = null;
  }

  const response = await resolve(event, {
    transformPageChunk: ({ html }) => html
  });

  // Enforce defensive security headers
  response.headers.set('X-Frame-Options', 'DENY');
  response.headers.set('X-Content-Type-Options', 'nosniff');
  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');

  return response;
};

import { json, error } from '@sveltejs/kit';
import type { RequestHandler } from './$types';

export const GET: RequestHandler = async ({ locals }) => {
  if (!locals.user) {
    throw error(401, { message: 'Unauthorized access' });
  }

  const projects = [
    { id: 'prj_1', name: 'Agent Skill Registry', owner: locals.user.id }
  ];

  return json({ data: projects, status: 'success' }, { status: 200 });
};

export const POST: RequestHandler = async ({ request, locals }) => {
  if (!locals.user) {
    throw error(401, { message: 'Unauthorized' });
  }

  const body = await request.json();
  if (!body.name || typeof body.name !== 'string') {
    throw error(400, { message: 'Project name is required' });
  }

  const newProject = { id: `prj_${Date.now()}`, name: body.name, owner: locals.user.id };
  return json(newProject, { status: 201 });
};

declare global {
  namespace App {
    interface Locals {
      user: {
        id: string;
        email: string;
        role: string;
      } | null;
    }
    interface Error {
      message: string;
      code?: string;
    }
  }
}

export {};