skeletonlabs · Hugos68 · Apr 7, 2026 · Apr 7, 2026 · Apr 7, 2026 · Apr 7, 2026
diff --git a/.gitignore b/.gitignore
@@ -25,3 +25,6 @@ node_modules/
 .temp/
 *.tgz
 .vscode/launch.json
+
+# environment variables
+**.env
diff --git a/package.json b/package.json
@@ -5,6 +5,7 @@
 	"scripts": {
 		"doc": "pnpm --filter @skeletonlabs/skeleton.dev",
 		"themes": "pnpm --filter @skeletonlabs/themes.skeleton.dev",
+		"plus": "pnpm --filter @skeletonlabs/plus.skeleton.dev",
 		"svelte": "pnpm --filter @skeletonlabs/playground-skeleton-svelte",
 		"react": "pnpm --filter @skeletonlabs/playground-skeleton-react",
 		"test": "vitest run",

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
@@ -27,6 +27,8 @@ catalog:
   '@shikijs/transformers': 4.0.2
   '@shikijs/types': 4.0.2
   '@stackblitz/sdk': 1.11.0
+  '@supabase/ssr': 0.10.0
+  '@supabase/supabase-js': 2.101.1
   '@sveltejs/adapter-auto': 7.0.1
   '@sveltejs/adapter-vercel': 6.3.3
   '@sveltejs/kit': 2.55.0

diff --git a/sites/plus.skeleton.dev/.env.example b/sites/plus.skeleton.dev/.env.example
@@ -0,0 +1,2 @@
+PUBLIC_SUPABASE_URL=
+PUBLIC_SUPABASE_PUBLISHABLE_KEY=
diff --git a/sites/plus.skeleton.dev/package.json b/sites/plus.skeleton.dev/package.json
@@ -0,0 +1,29 @@
+{
+	"name": "@skeletonlabs/plus.skeleton.dev",
+	"version": "1.0.0",
+	"private": true,
+	"scripts": {
+		"dev": "vite dev",
+		"build": "vite build",
+		"check": "svelte-check --tsconfig ./tsconfig.json",
+		"postinstall": "svelte-kit sync"
+	},
+	"devDependencies": {
+		"@skeletonlabs/skeleton": "workspace:*",
+		"@skeletonlabs/skeleton-svelte": "workspace:*",
+		"@supabase/ssr": "catalog:",
+		"@supabase/supabase-js": "catalog:",
+		"@sveltejs/adapter-auto": "^7.0.0",
+		"@sveltejs/kit": "^2.50.2",
+		"@sveltejs/vite-plugin-svelte": "^6.2.4",
+		"@tailwindcss/forms": "^0.5.11",
+		"@tailwindcss/vite": "^4.1.18",
+		"svelte": "^5.54.0",
+		"svelte-check": "^4.4.2",
+		"tailwindcss": "^4.1.18",
+		"typescript": "^5.9.3",
+		"vite": "^7.3.1",
+		"vite-plugin-transform-lucide-imports": "catalog:"
+	},
+	"type": "module"
+}
diff --git a/sites/plus.skeleton.dev/src/app.d.ts b/sites/plus.skeleton.dev/src/app.d.ts
@@ -0,0 +1,21 @@
+import type { Session, SupabaseClient, User } from '@supabase/supabase-js';
+import type { Database } from './database.types.ts';
+
+declare global {
+	namespace App {
+		// interface Error {}
+		interface Locals {
+			supabase: SupabaseClient<Database>;
+			safeGetSession: () => Promise<{ session: Session | null; user: User | null }>;
+			session: Session | null;
+			user: User | null;
+		}
+		interface PageData {
+			session: Session | null;
+		}
+		// interface PageState {}
+		// interface Platform {}
+	}
+}
+
+export {};
diff --git a/sites/plus.skeleton.dev/src/app.html b/sites/plus.skeleton.dev/src/app.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+	<head>
+		<meta charset="utf-8" />
+		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		<meta name="text-scale" content="scale" />
+		%sveltekit.head%
+	</head>
+	<body data-sveltekit-preload-data="hover">
+		<div style="display: contents">%sveltekit.body%</div>
+	</body>
+</html>
diff --git a/sites/plus.skeleton.dev/src/hooks.server.ts b/sites/plus.skeleton.dev/src/hooks.server.ts
@@ -0,0 +1,56 @@
+import { PUBLIC_SUPABASE_URL, PUBLIC_SUPABASE_PUBLISHABLE_KEY } from '$env/static/public';
+import { createServerClient } from '@supabase/ssr';
+import type { Handle } from '@sveltejs/kit';
+
+export const handle: Handle = async ({ event, resolve }) => {
+	event.locals.supabase = createServerClient(PUBLIC_SUPABASE_URL, PUBLIC_SUPABASE_PUBLISHABLE_KEY, {
+		cookies: {
+			getAll() {
+				return event.cookies.getAll();
+			},
+			setAll(cookiesToSet, headers) {
+				/**
+				 * Note: You have to add the `path` variable to the
+				 * set and remove method due to sveltekit's cookie API
+				 * requiring this to be set, setting the path to an empty string
+				 * will replicate previous/standard behavior (https://kit.svelte.dev/docs/types#public-types-cookies)
+				 */
+				cookiesToSet.forEach(({ name, value, options }) => event.cookies.set(name, value, { ...options, path: '/' }));
+				if (Object.keys(headers).length > 0) {
+					event.setHeaders(headers);
+				}
+			},
+		},
+	});
+
+	/**
+	 * Unlike `supabase.auth.getSession()`, which returns the session _without_
+	 * validating the JWT, this function also calls `getUser()` to validate the
+	 * JWT before returning the session.
+	 */
+	event.locals.safeGetSession = async () => {
+		const {
+			data: { session },
+		} = await event.locals.supabase.auth.getSession();
+		if (!session) {
+			return { session: null, user: null };
+		}
+
+		const {
+			data: { user },
+			error,
+		} = await event.locals.supabase.auth.getUser();
+		if (error) {
+			// JWT validation has failed
+			return { session: null, user: null };
+		}
+
+		return { session, user };
+	};
+
+	return resolve(event, {
+		filterSerializedResponseHeaders(name) {
+			return name === 'content-range' || name === 'x-supabase-api-version';
+		},
+	});
+};
diff --git a/sites/plus.skeleton.dev/src/routes/+layout.server.ts b/sites/plus.skeleton.dev/src/routes/+layout.server.ts
@@ -0,0 +1,9 @@
+export const load = async (event) => {
+	const { session, user } = await event.locals.safeGetSession();
+
+	return {
+		session,
+		user,
+		cookies: event.cookies.getAll(),
+	};
+};
diff --git a/sites/plus.skeleton.dev/src/routes/+layout.svelte b/sites/plus.skeleton.dev/src/routes/+layout.svelte
@@ -0,0 +1,7 @@
+<script lang="ts">
+	import './layout.css';
+
+	let { children } = $props();
+</script>
+
+{@render children()}
-Original file line number
+Diff line change
@@ Expand Up / @@ -25,3 +25,6 @@ node_modules/ @@
     .temp/
     *.tgz
     .vscode/launch.json
+    # environment variables
+    **.env
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		PUBLIC_SUPABASE_URL=
		PUBLIC_SUPABASE_PUBLISHABLE_KEY=