@happyvertical/smrt-app-runtime 0.53.3 → 0.53.5

package/dist/sveltekit.js

@@ -0,0 +1,807 @@
+import { B as deepFrozenPlainCopy, G as initializeDeployedApplicationRuntime, H as resolveBoundMembershipPermissions, K as isSessionTenantAuthorized, M as runtimeConfigurationFingerprint, R as isLocalMcpTokenPrincipal, V as ownValue, b as projectRuntimeDiagnostics, c as validateApplicationId, h as resolveApplicationStateRoot, i as initializeLocalApplicationRuntime, j as resolveApplicationId, m as removeOnboardingHandoff, p as prepareApplicationStateRoot, s as resolveLocalRuntimePaths, u as acquireWriterLease, z as PlainDataError } from "./chunks/src-D7cM0zHW.js";
+import { loadConfig, resolveEffectiveApplicationRuntime } from "@happyvertical/smrt-config";
+import { OidcIdentityCollection } from "@happyvertical/smrt-profiles";
+import { enableTenancy, getCurrentTenant, isTenancyEnabled, withSystemContext } from "@happyvertical/smrt-tenancy";
+import { MembershipCollection, PermissionResolver, RoleCollection, SessionService, TenantCollection, TenantStatus, UserCollection, UserStatus, getCurrentSessionPermissionContext, getRequestScopedDatabase, withPrincipalPermissionContext, withSessionPermissionContext } from "@happyvertical/smrt-users";
+import { getDatabase } from "@happyvertical/sql";
+import { fail, json, redirect } from "@sveltejs/kit";
+import { ObjectRegistry } from "@happyvertical/smrt-core";
+//#region src/sveltekit/handlers.ts
+var RUNTIME_DIAGNOSTICS_READ_PERMISSION = "runtime_diagnostics.read";
+function createRuntimeHealthHandler(runtime) {
+	return async () => json(await runtime.health());
+}
+function resolveInputValue(value) {
+	return typeof value === "function" ? value() : value;
+}
+function createRuntimeDiagnosticsHandler(options) {
+	const runtime = options.runtime;
+	const readDiagnostics = options.readDiagnostics ?? (runtime ? () => runtime.readDiagnostics({
+		toolNames: resolveInputValue(options.toolNames) ?? [],
+		observedAt: options.now?.() ?? /* @__PURE__ */ new Date(),
+		schemaStatus: resolveInputValue(options.schemaStatus) ?? "unknown",
+		migrationStatus: resolveInputValue(options.migrationStatus) ?? "unknown",
+		workerHeartbeatAt: options.workerHeartbeatAt?.() ?? null,
+		recentErrors: options.recentErrors?.() ?? []
+	}) : void 0);
+	const resolveRoleSlug = options.resolveRoleSlug ?? (runtime ? async (roleId) => {
+		const config = runtime.classOptions("Role");
+		const requestDb = getRequestScopedDatabase();
+		return (await (await RoleCollection.create(requestDb ? {
+			...config,
+			db: requestDb
+		} : config)).findById(roleId))?.slug ?? null;
+	} : void 0);
+	if (!readDiagnostics || !resolveRoleSlug) throw new TypeError("createRuntimeDiagnosticsHandler requires `runtime`, or both `readDiagnostics` and `resolveRoleSlug`.");
+	const resolveLocals = options.resolveLocals ?? ((event) => event.locals);
+	return async (event) => {
+		const locals = resolveLocals(event);
+		const principal = authenticatedPrincipal(locals);
+		if (!principal) return stableError(401, "authentication_required");
+		let authorized = locals.permissions?.includes(RUNTIME_DIAGNOSTICS_READ_PERMISSION) === true;
+		if (!authorized) try {
+			authorized = await resolveRoleSlug(principal.roleId) === "owner";
+		} catch {
+			authorized = false;
+		}
+		if (!authorized) return stableError(403, "authorization_denied");
+		try {
+			return json(await readDiagnostics());
+		} catch {
+			return stableError(503, "diagnostics_unavailable");
+		}
+	};
+}
+function authenticatedPrincipal(locals) {
+	const userId = locals?.user?.id;
+	const tenantId = locals?.tenantId;
+	const sessionId = locals?.sessionId;
+	const membership = locals?.membership;
+	if (typeof userId !== "string" || !userId || typeof tenantId !== "string" || !tenantId || typeof sessionId !== "string" || !sessionId || !membership || membership.userId !== userId || membership.tenantId !== tenantId || typeof membership.roleId !== "string" || !membership.roleId) return null;
+	try {
+		if (membership.isActive?.() !== true) return null;
+	} catch {
+		return null;
+	}
+	return { roleId: membership.roleId };
+}
+function stableError(status, code) {
+	return json({
+		schemaVersion: 1,
+		error: { code }
+	}, { status });
+}
+function createSessionLayoutLoad() {
+	return ({ locals }) => {
+		const value = locals;
+		return { session: {
+			authenticated: Boolean(value.user),
+			activeTenantId: value.tenantId ?? null,
+			selectedTenantSlug: value.selectedTenantSlug ?? null
+		} };
+	};
+}
+//#endregion
+//#region src/sveltekit/owner-setup.ts
+var OWNER_SETUP_FIELDS = Object.freeze({
+	token: "token",
+	name: "name",
+	email: "email",
+	tenantName: "tenantName"
+});
+var DEFAULT_OWNER_SETUP_MESSAGES = Object.freeze({
+	setup_disabled: "Local owner setup is disabled.",
+	setup_unavailable: "Local owner setup is available only from this device.",
+	setup_invalid_input: "Name, email, and a valid setup token are required.",
+	setup_invalid: "The setup invitation is invalid, expired, or already used. Run pnpm app:stop, pnpm app:recover, pnpm app:start, then pnpm app:open."
+});
+function createOwnerSetupPage(runtime, options = {}) {
+	const redirectTo = options.redirectTo ?? "/";
+	const messages = {
+		...DEFAULT_OWNER_SETUP_MESSAGES,
+		...options.messages
+	};
+	const failure = (status, code) => fail(status, {
+		code,
+		message: messages[code]
+	});
+	const resolveUser = options.resolveUser ?? ((event) => event.locals.user);
+	const load = async (event) => {
+		if (resolveUser(event)) redirect(303, redirectTo);
+		if ((await runtime.resolvedRuntime()).profile !== "local" || !isLoopbackRequest(event)) return {
+			available: false,
+			token: ""
+		};
+		const available = (await (await runtime.localRuntime()).diagnostics()).bootstrap.status !== "claimed";
+		return {
+			available,
+			token: available ? event.url.searchParams.get(OWNER_SETUP_FIELDS.token) || "" : ""
+		};
+	};
+	const claim = async (event) => {
+		if ((await runtime.resolvedRuntime()).profile !== "local") return failure(404, "setup_disabled");
+		if (!isLoopbackRequest(event)) return failure(403, "setup_unavailable");
+		let form;
+		try {
+			form = await event.request.formData();
+		} catch {
+			return failure(400, "setup_invalid_input");
+		}
+		const field = (name2) => {
+			const value = form.get(name2);
+			return typeof value === "string" ? value : "";
+		};
+		const token = field(OWNER_SETUP_FIELDS.token);
+		const name = field(OWNER_SETUP_FIELDS.name);
+		const email = field(OWNER_SETUP_FIELDS.email);
+		const tenantName = field(OWNER_SETUP_FIELDS.tenantName).trim();
+		if (!token || !name.trim() || !email.includes("@")) return failure(400, "setup_invalid_input");
+		const local = await runtime.localRuntime();
+		let result;
+		try {
+			result = await local.claimOwner({
+				token,
+				name,
+				email,
+				...tenantName ? { tenantName } : {},
+				userAgent: event.request.headers.get("user-agent") || void 0,
+				ipAddress: event.getClientAddress()
+			});
+		} catch {
+			return failure(400, "setup_invalid");
+		}
+		if (options.removeOnboardingHandoff !== false && runtime.applicationStateRoot) try {
+			removeOnboardingHandoff(runtime.applicationStateRoot());
+		} catch {}
+		const cookie = runtime.sessionCookie;
+		event.cookies.set(cookie.name, result.sessionId, {
+			path: cookie.path,
+			...cookie.domain ? { domain: cookie.domain } : {},
+			httpOnly: true,
+			secure: cookie.secure ?? event.url.protocol === "https:",
+			sameSite: cookie.sameSite,
+			maxAge: cookie.maxAgeSeconds
+		});
+		try {
+			await options.onOwnerClaimed?.(result, event);
+		} catch {}
+		redirect(303, redirectTo);
+	};
+	return Object.freeze({
+		load,
+		actions: Object.freeze({ default: claim })
+	});
+}
+function isLoopbackRequest(event) {
+	let address;
+	try {
+		address = event.getClientAddress();
+	} catch {
+		return false;
+	}
+	return isLoopbackAddress(address) && isLoopbackHostname(event.url.hostname);
+}
+function isLoopbackAddress(value) {
+	if (typeof value !== "string") return false;
+	let host = value.trim().toLowerCase().replace(/^\[|\]$/g, "");
+	if (host === "::1" || host === "0:0:0:0:0:0:0:1") return true;
+	if (host.startsWith("::ffff:")) host = host.slice(7);
+	const octets = host.split(".");
+	return octets.length === 4 && octets.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255) && Number(octets[0]) === 127;
+}
+function isLoopbackHostname(hostname) {
+	const host = hostname.trim().toLowerCase().replace(/\.$/, "");
+	return host === "localhost" || isLoopbackAddress(host);
+}
+//#endregion
+//#region src/sveltekit/tenancy.ts
+var ROOT_LIKE_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1",
+	"[::1]"
+]);
+var RESERVED_SUBDOMAINS = /* @__PURE__ */ new Set([
+	"www",
+	"api",
+	"app",
+	"admin"
+]);
+var NO_SELECTION = Object.freeze({
+	tenantId: null,
+	tenantSlug: null
+});
+function selectTenantSlug(url, baseDomain = process.env.TENANT_BASE_DOMAIN) {
+	const hostname = url.hostname.toLowerCase();
+	if (ROOT_LIKE_HOSTS.has(hostname) || hostname.startsWith("[") || /^\d{1,3}(\.\d{1,3}){3}$/.test(hostname)) return null;
+	const normalizedBase = baseDomain?.trim().toLowerCase().replace(/^\.+|\.+$/g, "");
+	let candidate;
+	if (normalizedBase) {
+		if (hostname === normalizedBase) return null;
+		const suffix = `.${normalizedBase}`;
+		if (!hostname.endsWith(suffix)) return null;
+		candidate = hostname.slice(0, -suffix.length).split(".")[0];
+	} else {
+		const labels = hostname.split(".");
+		if (labels.length < 3) return null;
+		candidate = labels[0];
+	}
+	return candidate && !RESERVED_SUBDOMAINS.has(candidate) ? candidate : null;
+}
+function isMissingTenantTable(error) {
+	if (!(error instanceof Error)) return false;
+	return error.code === "42P01" || error.message.includes("relation \"tenants\" does not exist") || error.message.includes("no such table: tenants");
+}
+function createSubdomainTenantSelector(options) {
+	return async (event) => {
+		const tenantSlug = selectTenantSlug(event.url, options.baseDomain);
+		if (!tenantSlug) return NO_SELECTION;
+		let tenantId;
+		try {
+			const tenant = await (await TenantCollection.create(options.classOptions())).findBySlug(tenantSlug);
+			tenantId = tenant?.status === TenantStatus.ACTIVE ? tenant.id ?? null : null;
+		} catch (error) {
+			if (!isMissingTenantTable(error)) throw error;
+			tenantId = null;
+		}
+		return {
+			tenantId,
+			tenantSlug
+		};
+	};
+}
+function normalizeTenantSelection(selection) {
+	return {
+		tenantId: typeof selection?.tenantId === "string" && selection.tenantId ? selection.tenantId : null,
+		tenantSlug: typeof selection?.tenantSlug === "string" && selection.tenantSlug ? selection.tenantSlug : null
+	};
+}
+//#endregion
+//#region src/sveltekit/runtime.ts
+var DEFAULT_SESSION_TTL_SECONDS = 10080 * 60;
+function createSmrtSvelteKitRuntime(options = {}) {
+	return composeSmrtSvelteKitRuntime(options, {});
+}
+function composeSmrtSvelteKitRuntime(options, seams) {
+	const env = options.env ?? process.env;
+	const sourceRoot = options.sourceRoot ?? process.cwd();
+	const dataDirectory = options.dataDirectory ?? env.SMRT_DATA_DIR;
+	const initializeLocal = seams.initializeLocal ?? initializeLocalApplicationRuntime;
+	const initializeDeployed = seams.initializeDeployed ?? initializeDeployedApplicationRuntime;
+	if (options.enableTenancy !== false && !isTenancyEnabled()) enableTenancy();
+	let appId;
+	const applicationId = () => {
+		appId ??= options.appId ? validateApplicationId(options.appId) : resolveApplicationId({
+			sourceRoot,
+			explicitId: env.SMRT_APP_ID
+		});
+		return appId;
+	};
+	let resolved;
+	let resolvedPromise;
+	const resolvedRuntime = () => {
+		resolvedPromise ??= (async () => {
+			const value = typeof options.runtime === "function" ? await options.runtime() : options.runtime ?? await (seams.loadRuntime ?? loadConfiguredRuntime)();
+			resolved = value;
+			return value;
+		})().catch((error) => {
+			resolvedPromise = void 0;
+			throw error;
+		});
+		return resolvedPromise;
+	};
+	const requireResolved = () => {
+		if (!resolved) throw new Error("The SMRT application runtime is not resolved yet; await init() first.");
+		return resolved;
+	};
+	const baseDatabaseConfig = () => {
+		const runtime = requireResolved();
+		if (runtime.profile === "local") return {
+			type: "sqlite",
+			url: resolveLocalRuntimePaths({
+				appId: applicationId(),
+				dataDirectory,
+				sourceRoot,
+				env
+			}).database
+		};
+		const databaseUrl = env.DATABASE_URL;
+		if (!databaseUrl) throw new Error(`${runtime.profile} requires DATABASE_URL.`);
+		return {
+			type: "postgres",
+			url: databaseUrl
+		};
+	};
+	const baseClassOptions = (className) => {
+		const defaults = { db: baseDatabaseConfig() };
+		const override = options.classOverrides?.[className];
+		return override ? {
+			...defaults,
+			...override
+		} : defaults;
+	};
+	const rlsRequestDatabase = () => {
+		if (getCurrentSessionPermissionContext()?.postgresRls !== true) return void 0;
+		return getRequestScopedDatabase() ?? void 0;
+	};
+	const databaseConfig = () => rlsRequestDatabase() ?? baseDatabaseConfig();
+	const classOptions = (className) => {
+		const base = baseClassOptions(className);
+		if (options.classOverrides?.[className]?.db !== void 0) return base;
+		const requestDb = rlsRequestDatabase();
+		return requestDb ? {
+			...base,
+			db: requestDb
+		} : base;
+	};
+	const getCollection = (className) => ObjectRegistry.getCollection(className, classOptions(className));
+	const writerLease = options.acquireWriterLease === false ? void 0 : options.acquireWriterLease ?? ((context) => defaultWriterLease(context, env));
+	let localPromise;
+	let localLease;
+	const localRuntime = async () => {
+		const runtime = await resolvedRuntime();
+		if (runtime.profile !== "local") throw new Error("Owner bootstrap is available only in the local profile.");
+		if (localPromise) return localPromise;
+		const bindHost = options.bindHost || env.HOST || (env.NODE_ENV === "development" ? "127.0.0.1" : null);
+		if (!bindHost) throw new Error("Local production startup requires an explicit loopback HOST; use pnpm app:start.");
+		const id = applicationId();
+		localLease ??= writerLease?.({
+			appId: id,
+			dataDirectory,
+			sourceRoot
+		});
+		localPromise = initializeLocal({
+			appId: id,
+			dataDirectory,
+			sourceRoot,
+			env,
+			bindHost,
+			providers: {
+				database: runtime.providers.database,
+				authentication: runtime.providers.authentication,
+				tenancy: runtime.providers.tenancy,
+				assets: runtime.providers.assets,
+				secrets: runtime.providers.secrets,
+				jobs: runtime.providers.jobs,
+				network: runtime.providers.network
+			},
+			backgroundJobs: options.backgroundJobs ?? env.SMRT_BACKGROUND_JOBS === "true",
+			paidCapabilities: options.paidCapabilities,
+			bootstrapTtlSeconds: options.bootstrapTtlSeconds,
+			sessionTtlSeconds: options.sessionTtlSeconds,
+			prepareDatabase: options.prepareDatabase,
+			now: options.now
+		}).then(({ runtime: initialized, bootstrap }) => {
+			if (bootstrap) try {
+				options.onBootstrapInvitation?.(bootstrap, { bindHost });
+			} catch {}
+			return initialized;
+		}).catch((error) => {
+			localLease?.release();
+			localLease = void 0;
+			localPromise = void 0;
+			throw error;
+		});
+		return localPromise;
+	};
+	let deployedPromise;
+	const deployedRuntime = async () => {
+		const runtime = await resolvedRuntime();
+		if (runtime.profile === "local") throw new Error("deployed_runtime_unavailable");
+		const profile = runtime.profile;
+		const databaseUrl = env.DATABASE_URL;
+		if (!databaseUrl) throw new Error(`${profile} requires DATABASE_URL.`);
+		const authenticationProvider = runtime.providers.authentication.provider;
+		if (authenticationProvider === "owner-bootstrap") throw new Error("Deployed profiles require public authentication.");
+		const readiness = options.providerReadiness;
+		if (!readiness) throw new Error(`${profile} requires providerReadiness probes for authentication, assets, and secrets.`);
+		deployedPromise ??= initializeDeployed({
+			profile,
+			providers: {
+				database: runtime.providers.database,
+				authentication: runtime.providers.authentication,
+				tenancy: runtime.providers.tenancy,
+				assets: runtime.providers.assets,
+				secrets: runtime.providers.secrets,
+				jobs: runtime.providers.jobs,
+				network: runtime.providers.network
+			},
+			database: {
+				engine: "postgres",
+				connect: () => getDatabase({
+					type: "postgres",
+					url: databaseUrl
+				}),
+				close: async (db) => {
+					await db.close?.();
+				}
+			},
+			authentication: {
+				provider: authenticationProvider,
+				readiness: readiness("authentication", {
+					profile,
+					provider: authenticationProvider
+				})
+			},
+			assets: {
+				provider: runtime.providers.assets.provider,
+				readiness: readiness("assets", {
+					profile,
+					provider: runtime.providers.assets.provider
+				})
+			},
+			secrets: {
+				provider: runtime.providers.secrets.provider,
+				readiness: readiness("secrets", {
+					profile,
+					provider: runtime.providers.secrets.provider
+				})
+			},
+			prepareDatabase: options.prepareDatabase
+		});
+		return deployedPromise;
+	};
+	const ready = async () => {
+		if ((await resolvedRuntime()).profile === "local") {
+			await localRuntime();
+			return;
+		}
+		await deployedRuntime();
+	};
+	const configurationFingerprint = () => runtimeConfigurationFingerprint(requireResolved(), env);
+	const health = async () => {
+		await ready();
+		const runtime = requireResolved();
+		const publicHealth = {
+			schemaVersion: 1,
+			status: "ready",
+			profile: runtime.profile
+		};
+		return runtime.profile === "local" ? {
+			...publicHealth,
+			application: applicationId(),
+			instance: env.SMRT_PROCESS_INSTANCE || null,
+			configuration: configurationFingerprint()
+		} : publicHealth;
+	};
+	const readDiagnostics = async (diagnosticsOptions) => {
+		await ready();
+		const runtime = requireResolved();
+		const schema = {
+			status: diagnosticsOptions.schemaStatus ?? "unknown",
+			migrations: diagnosticsOptions.migrationStatus ?? "unknown"
+		};
+		if (runtime.profile === "local") {
+			const diagnostics = await (await localRuntime()).diagnostics();
+			return projectRuntimeDiagnostics({
+				profile: "local",
+				health: "healthy",
+				schema,
+				capabilities: {
+					"asset-storage": "available",
+					authentication: "available",
+					"background-jobs": diagnostics.jobs.backgroundEnabled ? "available" : "disabled",
+					database: "available",
+					"paid-capabilities": diagnostics.paidCapabilitiesEnabled ? "available" : "disabled",
+					"secret-storage": "available"
+				},
+				toolNames: diagnosticsOptions.toolNames,
+				worker: {
+					topology: diagnostics.jobs.topology,
+					required: diagnostics.jobs.backgroundEnabled,
+					heartbeatAt: diagnosticsOptions.workerHeartbeatAt
+				},
+				recentErrors: diagnosticsOptions.recentErrors,
+				observedAt: diagnosticsOptions.observedAt
+			});
+		}
+		const deployed = await deployedPromise;
+		if (!deployed) throw new Error("deployed_runtime_unavailable");
+		const readiness = await deployed.readiness();
+		const componentStatus = (component) => readiness.components[component].status === "ready" ? "available" : "unavailable";
+		return projectRuntimeDiagnostics({
+			profile: runtime.profile,
+			health: deployed.health().status === "healthy" ? readiness.status === "ready" ? "healthy" : "degraded" : "stopped",
+			schema,
+			capabilities: {
+				"asset-storage": componentStatus("assets"),
+				authentication: componentStatus("authentication"),
+				"background-jobs": "available",
+				database: componentStatus("database"),
+				"paid-capabilities": "unknown",
+				"secret-storage": componentStatus("secrets")
+			},
+			toolNames: diagnosticsOptions.toolNames,
+			worker: {
+				topology: deployed.resolvedRuntime.providers.jobs.topology,
+				required: true,
+				heartbeatAt: diagnosticsOptions.workerHeartbeatAt
+			},
+			recentErrors: diagnosticsOptions.recentErrors,
+			observedAt: diagnosticsOptions.observedAt
+		});
+	};
+	const selectTenant = options.selectTenant ?? createSubdomainTenantSelector({
+		baseDomain: options.tenantBaseDomain ?? env.TENANT_BASE_DOMAIN,
+		classOptions: () => baseClassOptions("Tenant")
+	});
+	const readinessHandle = async ({ event, resolve }) => {
+		await ready();
+		return resolve(event);
+	};
+	const tenantSelectionHandle = async ({ event, resolve }) => {
+		const locals = runtimeLocals(event.locals);
+		const selection = normalizeTenantSelection(await selectTenant({
+			url: event.url,
+			request: event.request
+		}));
+		locals.selectedTenantId = selection.tenantId;
+		locals.selectedTenantSlug = selection.tenantSlug;
+		return resolve(event);
+	};
+	const sessionCookieName = options.session?.cookieName ?? "sid";
+	const sessionSkipPaths = options.session?.skipPaths ?? [];
+	const sessionServiceOptions = () => ({
+		...baseClassOptions("Session"),
+		...options.session,
+		defaultTTL: options.session?.ttl ?? DEFAULT_SESSION_TTL_SECONDS,
+		autoExtend: options.session?.autoExtend ?? false
+	});
+	const postgresRls = () => requireResolved().providers.tenancy.isolation === "database-rls" ? true : options.session?.postgresRls;
+	let permissionResolverPromise;
+	const permissionResolver = () => {
+		permissionResolverPromise ??= PermissionResolver.create(baseClassOptions("Permission")).catch((error) => {
+			permissionResolverPromise = void 0;
+			throw error;
+		});
+		return permissionResolverPromise;
+	};
+	const runAsPrincipal = async (principal, fn) => {
+		if (!principal || typeof principal !== "object") throw new Error("A bound principal is required.");
+		const snapshot = snapshotBoundPrincipal(principal);
+		const tokenDerived = isLocalMcpTokenPrincipal(snapshot);
+		const userId = ownValue(snapshot, "id");
+		const tenantId = ownValue(snapshot, "tenantId");
+		const snapshotScopes = ownValue(snapshot, "scopes");
+		const requestedTenantBinding = ownValue(snapshot, "tenantBinding");
+		const requestedScopes = snapshotScopes === void 0 ? void 0 : Object.freeze([...snapshotScopes]);
+		if (requestedScopes !== void 0 && !requestedScopes.every((scope) => typeof scope === "string")) throw new Error("A bound principal has malformed scopes.");
+		if (typeof userId !== "string" || userId.length === 0) throw new Error("A bound principal requires a user id.");
+		if (typeof tenantId !== "string" || tenantId.length === 0) throw new Error("A bound principal requires a tenant.");
+		if (tokenDerived && requestedTenantBinding !== void 0 && requestedTenantBinding !== "direct") throw new Error("A local MCP token principal binds only through its direct membership.");
+		const binding = tokenDerived ? "direct" : requestedTenantBinding ?? "direct-or-inherited";
+		if (binding !== "direct" && binding !== "direct-or-inherited") throw new Error("Unknown tenant binding mode for a bound principal.");
+		const resolved2 = await resolveBoundMembershipPermissions({
+			memberships: await MembershipCollection.create(baseClassOptions("Membership")),
+			resolver: await permissionResolver(),
+			userId,
+			tenantId,
+			binding
+		});
+		if (!resolved2) throw new Error(binding === "direct" ? "The bound principal has no active direct membership in its tenant." : "The bound principal has no authorized membership in its tenant.");
+		const cap = requestedScopes ? new Set(requestedScopes) : void 0;
+		const permissions = [...resolved2.permissions].filter((permission) => !cap || cap.has(permission));
+		return withPrincipalPermissionContext({
+			...baseClassOptions("Session"),
+			userId,
+			tenantId,
+			permissions,
+			enterTenantContext: true,
+			postgresRls: postgresRls()
+		}, () => fn(Object.freeze(Object.assign(/* @__PURE__ */ Object.create(null), snapshot, {
+			id: userId,
+			tenantId,
+			tenantBinding: binding,
+			scopes: Object.freeze([...permissions])
+		}))));
+	};
+	const verifyLocalMcpToken = async (token) => {
+		if ((await resolvedRuntime()).profile !== "local") return null;
+		return await (await localRuntime()).mcpTokens?.verify(token) ?? null;
+	};
+	const resolveMcpPrincipal = async (identity) => {
+		if ((await resolvedRuntime()).profile === "local") return null;
+		if (!identity || typeof identity !== "object") return null;
+		const issuer = ownValue(identity, "issuer");
+		const subject = ownValue(identity, "subject");
+		if (typeof issuer !== "string" || issuer.length === 0 || typeof subject !== "string" || subject.length === 0) return null;
+		return withSystemContext(async () => {
+			const identities = await OidcIdentityCollection.create(baseClassOptions("OidcIdentity"));
+			let linked;
+			try {
+				linked = await identities.findBySubject(issuer, subject);
+			} catch {
+				return null;
+			}
+			if (!linked?.profileId) return null;
+			const owners = await (await UserCollection.create(baseClassOptions("User"))).list({
+				where: { profileId: linked.profileId },
+				limit: 2
+			});
+			const user = owners.length === 1 ? owners[0] : void 0;
+			if (typeof user?.id !== "string" || user.id.length === 0 || user.status !== UserStatus.ACTIVE) return null;
+			const memberships = await MembershipCollection.create(baseClassOptions("Membership"));
+			const tenants = new Set((await memberships.findActiveByUser(user.id)).map((membership) => membership.tenantId).filter((tenantId2) => typeof tenantId2 === "string" && tenantId2.length > 0));
+			if (tenants.size !== 1) return null;
+			const [tenantId] = tenants;
+			return Object.freeze({
+				id: user.id,
+				tenantId,
+				kind: "human",
+				tenantBinding: "direct"
+			});
+		});
+	};
+	let sessionServicePromise;
+	const sessionService = () => {
+		sessionServicePromise ??= (async () => {
+			const service = new TenantAuthorizingSessionService(sessionServiceOptions(), requireResolved().providers.tenancy.context === "required");
+			await service.initialize();
+			return service;
+		})().catch((error) => {
+			sessionServicePromise = void 0;
+			throw error;
+		});
+		return sessionServicePromise;
+	};
+	const sessionStep = async ({ event, resolve }) => {
+		const locals = runtimeLocals(event.locals);
+		clearSessionLocals(locals);
+		const rls = postgresRls();
+		const skipped = sessionSkipPaths.some((path) => event.url.pathname.startsWith(path));
+		if (skipped && !rls) return resolve(event);
+		const sessionId = skipped ? void 0 : event.cookies.get(sessionCookieName);
+		if (!sessionId && !rls) return resolve(event);
+		let resolveEntered = false;
+		let downstream;
+		try {
+			const service = await sessionService();
+			return await withSessionPermissionContext({
+				...sessionServiceOptions(),
+				enterTenantContext: true,
+				postgresRls: rls,
+				sessionId: sessionId ?? null,
+				sessionService: service
+			}, async (context) => {
+				if (context.session) {
+					locals.user = context.user;
+					locals.membership = context.membership ?? null;
+					locals.permissions = context.permissions;
+					locals.tenantId = context.tenantId;
+					locals.sessionId = context.sessionId;
+					if (context.tenantId) verifiedSessionTenants.set(locals, context.tenantId);
+				}
+				resolveEntered = true;
+				try {
+					return await resolve(event);
+				} catch (error) {
+					downstream = { error };
+					throw error;
+				}
+			});
+		} catch (error) {
+			if (downstream) throw downstream.error;
+			if (resolveEntered) throw error;
+			clearSessionLocals(locals);
+			return new Response("Internal Server Error", { status: 500 });
+		}
+	};
+	const sessionCookie = Object.freeze({
+		name: options.session?.cookieName ?? "sid",
+		path: options.session?.cookiePath ?? "/",
+		...options.session?.cookieDomain ? { domain: options.session.cookieDomain } : {},
+		sameSite: options.session?.cookieSameSite ?? "lax",
+		...options.session?.cookieSecure !== void 0 ? { secure: options.session.cookieSecure } : {},
+		maxAgeSeconds: options.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS
+	});
+	const init = () => ready();
+	return Object.freeze({
+		handle: composeHandles(readinessHandle, tenantSelectionHandle, sessionStep, authorizedTenantLocalsHandle),
+		init,
+		sessionCookie,
+		resolvedRuntime,
+		ready,
+		applicationId,
+		applicationStateRoot: () => resolveApplicationStateRoot({
+			appId: applicationId(),
+			dataDirectory,
+			sourceRoot
+		}),
+		configurationFingerprint,
+		databaseConfig,
+		classOptions,
+		getCollection,
+		runAsPrincipal,
+		verifyLocalMcpToken,
+		resolveMcpPrincipal,
+		localRuntime,
+		deployedRuntime,
+		health,
+		readDiagnostics
+	});
+}
+function defaultWriterLease(context, env = process.env) {
+	return acquireWriterLease(prepareApplicationStateRoot({
+		appId: context.appId,
+		dataDirectory: context.dataDirectory,
+		sourceRoot: context.sourceRoot
+	}), { operationInstance: env.SMRT_OPERATION_INSTANCE });
+}
+var verifiedSessionTenants = /* @__PURE__ */ new WeakMap();
+var TenantAuthorizingSessionService = class extends SessionService {
+	tenantRequired;
+	constructor(options, tenantRequired) {
+		super(options);
+		this.tenantRequired = tenantRequired;
+	}
+	async loadSessionContext(sessionId) {
+		const context = await super.loadSessionContext(sessionId);
+		if (!context) return null;
+		if (typeof context.tenantId === "string" && context.tenantId.length > 0) return isSessionTenantAuthorized(context) ? context : null;
+		return this.tenantRequired ? null : context;
+	}
+};
+function clearSessionLocals(locals) {
+	locals.user = null;
+	locals.membership = null;
+	locals.permissions = [];
+	locals.tenantId = null;
+	locals.sessionId = null;
+	locals.tenantContext = void 0;
+	verifiedSessionTenants.delete(locals);
+}
+var authorizedTenantLocalsHandle = async ({ event, resolve }) => {
+	const locals = runtimeLocals(event.locals);
+	const activeContext = getCurrentTenant();
+	if (locals.user && locals.tenantId && verifiedSessionTenants.get(locals) === locals.tenantId && activeContext?.tenantId === locals.tenantId) locals.tenantContext = activeContext;
+	return resolve(event);
+};
+function composeHandles(...handles) {
+	return ({ event, resolve }) => {
+		const run = (index, current, resolveOptions) => {
+			const next = handles[index];
+			if (!next) return resolve(current, resolveOptions);
+			return next({
+				event: current,
+				resolve: (nextEvent, nextOptions) => run(index + 1, nextEvent, nextOptions ?? resolveOptions)
+			});
+		};
+		return run(0, event);
+	};
+}
+function runtimeLocals(locals) {
+	return locals;
+}
+async function loadConfiguredRuntime() {
+	return resolveEffectiveApplicationRuntime(await loadConfig());
+}
+function snapshotBoundPrincipal(principal) {
+	if (!principal || typeof principal !== "object" || Array.isArray(principal)) throw new Error("A bound principal is required.");
+	let snapshot;
+	try {
+		snapshot = deepFrozenPlainCopy(principal);
+	} catch (error) {
+		if (error instanceof PlainDataError) throw new Error(`A bound principal ${error.message}.`);
+		throw error;
+	}
+	for (const key of [
+		"id",
+		"tenantId",
+		"kind",
+		"tenantBinding"
+	]) {
+		const value = ownValue(snapshot, key);
+		if (value !== void 0 && typeof value !== "string") throw new Error(`A bound principal has a malformed ${key}.`);
+	}
+	for (const key of ["scopes", "roles"]) {
+		const value = ownValue(snapshot, key);
+		if (value !== void 0 && (!Array.isArray(value) || !value.every((entry) => typeof entry === "string"))) throw new Error(`A bound principal has malformed ${key}.`);
+	}
+	const allowCrossTenant = ownValue(snapshot, "allowCrossTenant");
+	if (allowCrossTenant !== void 0 && typeof allowCrossTenant !== "boolean") throw new Error("A bound principal has a malformed allowCrossTenant.");
+	return snapshot;
+}
+//#endregion
+export { DEFAULT_OWNER_SETUP_MESSAGES, OWNER_SETUP_FIELDS, RUNTIME_DIAGNOSTICS_READ_PERMISSION, authorizedTenantLocalsHandle, composeHandles, createOwnerSetupPage, createRuntimeDiagnosticsHandler, createRuntimeHealthHandler, createSessionLayoutLoad, createSmrtSvelteKitRuntime, createSubdomainTenantSelector, defaultWriterLease, isLoopbackAddress, isLoopbackHostname, isLoopbackRequest, normalizeTenantSelection, selectTenantSlug };
+
+//# sourceMappingURL=sveltekit.js.map