Remote Functions Architecture

Deep dive into SveltyCMS type-safe SvelteKit Server Functions, Local SDK zero-HTTP execution, and request lifecycles.

8/20/2026

3 min read

On this page

SveltyCMS uses SvelteKit Server Functions (.server.ts) and the Local SDK (locals.cms) to provide a strictly typed, zero-network bridge between frontend components and backend database adapters.

🎯 Architectural Concept

Traditional monolithic CMS platforms require frontend components to make network HTTP requests (or form action serialization) to communicate with backend logic.

In SveltyCMS:

Zero HTTP Serialization Overhead: Remote functions in +page.server.ts and +layout.server.ts run in-process on the server, invoking database adapters directly through locals.cms.
End-to-End TypeScript Inference: Return types from load() and form actions flow directly into Svelte 5 $props() without manual JSON parsing.
Fail-Closed Security Gating: Every remote function invocation passes sequentially through the centralized hooks.server.ts middleware pipeline.

sequenceDiagram participant UI as Svelte 5 Component participant Hook as hooks.server.ts (Security Pipeline) participant Server as +page.server.ts (Remote Function) participant SDK as locals.cms (Local SDK) participant DB as DB Adapter (SQLite / Postgres / Maria / Mongo) UI->>Hook: Request / Page Navigation Hook->>Hook: handleSystemState (Setup Check) Hook->>Hook: handleAuthentication (Session / Token) Hook->>Hook: handleAuthorization (RBAC & Bitset Gate) Hook->>Server: Dispatch to Page Action / Loader Server->>SDK: locals.cms.collections.find("posts") SDK->>DB: Direct In-Process Query DB-->>SDK: Data Records SDK-->>Server: Typed Results Server-->>UI: Full TypeScript Inferred Props

🏗️ Request Lifecycle Stages

Gatekeeper (src/hooks.server.ts):
- handleSystemState: Verifies installation is complete.
- handleAuthentication: Validates __Host- session cookie or Bearer token against L1/L2 session cache.
- handleAuthorization: Evaluates 64-bit integer bitmasks via hasPermissionWithRoles.
Dispatcher (src/routes/(app)/.../+page.server.ts):
- Receives strongly-typed parameters.
- Validates input schemas using Valibot.
Local SDK (src/services/sdk/index.ts):
- Accesses locals.cms instance attached during hook initialization.
- Bypasses HTTP routing and invokes database adapter methods directly.
Adapter Execution (src/databases/core/):
- Resolves prepared query plans and caches via single-flight deduplication.

📊 Measured Performance Impact

By eliminating inter-process HTTP network hops and JSON serialization on server-side renders:

Metric	External REST Call (`fetch`)	Local SDK Server Function (`locals.cms`)	Improvement
Call Latency	`1.85 ms` (HTTP overhead)	`0.44 ms` (Direct in-process)	~76% faster
Memory Allocation	Multiple JSON string buffers	Shared object references	~60% less GC pressure
Type Safety	Manual runtime assertion	Automatic TypeScript inference	Compile-time safety

Note

Methodology: Benchmarked on Bun v1.3.14, SQLite in-process adapter, Intel i7-13700H, measuring 1,000 sequential findOne operations on 2026-08-20.

🔗 Source Reference

src/hooks.server.ts — Master middleware security sequence.
src/services/sdk/index.ts — Local SDK implementation.
src/routes/api/[...path]/+server.ts — API dispatcher.

Next Steps

Review the Security Architecture for permission details.
Discover how to build content models with Collections Reference.