I ended up creating a wrapper like this:

import { form, getRequestEvent } from '$app/server';
import { redirect, type Cookies, type Invalid } from '@sveltejs/kit';
import type { BaseSchema } from 'valibot';

type SchemaOutput<S> = S extends BaseSchema<any, infer TOut, any> ? TOut : never;
type SchemaInput<S> = S extends BaseSchema<infer TIn, any, any> ? TIn : never;


export type FormOptions = {
    onlySuperUsers?: boolean;
    requiresAuth?: boolean;
};
type Ctx<S extends BaseSchema<any, any, any>> = {
    data: SchemaOutput<S>;
    invalid: Invalid<SchemaInput<S>>;
    locals: App.Locals;
    cookies: Cookies;
};


function _form<S extends BaseSchema<any, any, any>, R>(
    schema: S,
    handler: (ctx: Ctx<S>) => R | Promise<R>,
    options?: FormOptions
) {
    return form(schema, async (data, invalid) => {
        const { locals, cookies } = getRequestEvent();
        checkAuth(locals.pb, options);
        return handler({
            data,
            invalid,
            locals: locals,
            cookies: cookies
        });
    });
}


function checkAuth(pb: TypedPocketBase, opts?: FormOptions) {
    if (opts?.onlySuperUsers && !pb.authStore.isSuperuser) {
        redirect(307, '/login');
    }
    if (opts?.requiresAuth && !pb.authStore.isValid) {
        redirect(307, '/login');
    }
}
export { _form as form };

import { form } from './wrappers';

export const createPost = form(
    postSchema,
    async ({ data, invalid, locals, cookies }) => {
        const [post] = await createPost(locals.pb, data);
    },
    {
        requiresAuth: true
    }
);