@happyvertical/smrt-app-runtime 0.57.7 → 0.57.9

package/dist/sveltekit.js

@@ -1,11 +1,8 @@
-import { B as deepFrozenPlainCopy, G as initializeDeployedApplicationRuntime, H as resolveBoundMembershipPermissions, K as isSessionTenantAuthorized, M as runtimeConfigurationFingerprint, R as isLocalMcpTokenPrincipal, V as ownValue, b as projectRuntimeDiagnostics, c as validateApplicationId, h as resolveApplicationStateRoot, i as initializeLocalApplicationRuntime, j as resolveApplicationId, m as removeOnboardingHandoff, p as prepareApplicationStateRoot, s as resolveLocalRuntimePaths, t as LocalRuntimeError, u as acquireWriterLease, z as PlainDataError } from "./chunks/src-DeNO6bG_.js";
-import { loadConfig, resolveEffectiveApplicationRuntime } from "@happyvertical/smrt-config";
-import { OidcIdentityCollection } from "@happyvertical/smrt-profiles";
-import { enableTenancy, getCurrentTenant, isTenancyEnabled, withSystemContext } from "@happyvertical/smrt-tenancy";
-import { MembershipCollection, PermissionResolver, RoleCollection, SessionService, TenantCollection, TenantStatus, UserCollection, UserStatus, getCurrentSessionPermissionContext, getRequestScopedDatabase, withPrincipalPermissionContext, withSessionPermissionContext } from "@happyvertical/smrt-users";
-import { getDatabase } from "@happyvertical/sql";
+import { n as normalizeTenantSelection, r as selectTenantSlug, t as createSubdomainTenantSelector } from "./chunks/tenancy-BzdIxH2M.js";
+import { RoleCollection, getRequestScopedDatabase } from "@happyvertical/smrt-users";
+import { authorizedTenantLocalsHandle, composeHandles, createSmrtSvelteKitRuntime, defaultWriterLease } from "@happyvertical/smrt-app-runtime/sveltekit-runtime";
 import { fail, json, redirect } from "@sveltejs/kit";
-import { ObjectRegistry } from "@happyvertical/smrt-core";
+import { LocalRuntimeError, removeOnboardingHandoff } from "@happyvertical/smrt-app-runtime";
 import { destroySessionCookie } from "@happyvertical/smrt-users/sveltekit";
 //#region src/sveltekit/handlers.ts
 var RUNTIME_DIAGNOSTICS_READ_PERMISSION = "runtime_diagnostics.read";
@@ -99,6 +96,7 @@ var OWNER_SETUP_FIELDS = Object.freeze({
 	token: "token",
 	name: "name",
 	email: "email",
+	password: "password",
 	tenantName: "tenantName"
 });
 var DEFAULT_OWNER_SETUP_MESSAGES = Object.freeze({
@@ -165,8 +163,9 @@ function createOwnerSetupPage(runtime, options = {}) {
 		const token = field(OWNER_SETUP_FIELDS.token);
 		const name = field(OWNER_SETUP_FIELDS.name);
 		const email = field(OWNER_SETUP_FIELDS.email);
+		const password = field(OWNER_SETUP_FIELDS.password);
 		const tenantName = field(OWNER_SETUP_FIELDS.tenantName).trim();
-		if (!token || !name.trim() || !email.includes("@")) return failure(400, "setup_invalid_input");
+		if (!token || !name.trim() || !email.includes("@") || options.requirePassword && !password) return failure(400, "setup_invalid_input");
 		const local = await runtime.localRuntime();
 		let result;
 		try {
@@ -174,6 +173,7 @@ function createOwnerSetupPage(runtime, options = {}) {
 				token,
 				name,
 				email,
+				password,
 				...tenantName ? { tenantName } : {},
 				userAgent: event.request.headers.get("user-agent") || void 0,
 				ipAddress: event.getClientAddress()
@@ -226,623 +226,6 @@ function isLoopbackHostname(hostname) {
 	return host === "localhost" || isLoopbackAddress(host);
 }
 //#endregion
-//#region src/sveltekit/tenancy.ts
-var ROOT_LIKE_HOSTS = /* @__PURE__ */ new Set([
-	"localhost",
-	"127.0.0.1",
-	"::1",
-	"[::1]"
-]);
-var RESERVED_SUBDOMAINS = /* @__PURE__ */ new Set([
-	"www",
-	"api",
-	"app",
-	"admin"
-]);
-var NO_SELECTION = Object.freeze({
-	tenantId: null,
-	tenantSlug: null
-});
-function selectTenantSlug(url, baseDomain = process.env.TENANT_BASE_DOMAIN) {
-	const hostname = url.hostname.toLowerCase();
-	if (ROOT_LIKE_HOSTS.has(hostname) || hostname.startsWith("[") || /^\d{1,3}(\.\d{1,3}){3}$/.test(hostname)) return null;
-	const normalizedBase = baseDomain?.trim().toLowerCase().replace(/^\.+|\.+$/g, "");
-	let candidate;
-	if (normalizedBase) {
-		if (hostname === normalizedBase) return null;
-		const suffix = `.${normalizedBase}`;
-		if (!hostname.endsWith(suffix)) return null;
-		candidate = hostname.slice(0, -suffix.length).split(".")[0];
-	} else {
-		const labels = hostname.split(".");
-		if (labels.length < 3) return null;
-		candidate = labels[0];
-	}
-	return candidate && !RESERVED_SUBDOMAINS.has(candidate) ? candidate : null;
-}
-function isMissingTenantTable(error) {
-	if (!(error instanceof Error)) return false;
-	return error.code === "42P01" || error.message.includes("relation \"tenants\" does not exist") || error.message.includes("no such table: tenants");
-}
-function createSubdomainTenantSelector(options) {
-	return async (event) => {
-		const tenantSlug = selectTenantSlug(event.url, options.baseDomain);
-		if (!tenantSlug) return NO_SELECTION;
-		let tenantId;
-		try {
-			const tenant = await (await TenantCollection.create(options.classOptions())).findBySlug(tenantSlug);
-			tenantId = tenant?.status === TenantStatus.ACTIVE ? tenant.id ?? null : null;
-		} catch (error) {
-			if (!isMissingTenantTable(error)) throw error;
-			tenantId = null;
-		}
-		return {
-			tenantId,
-			tenantSlug
-		};
-	};
-}
-function normalizeTenantSelection(selection) {
-	return {
-		tenantId: typeof selection?.tenantId === "string" && selection.tenantId ? selection.tenantId : null,
-		tenantSlug: typeof selection?.tenantSlug === "string" && selection.tenantSlug ? selection.tenantSlug : null
-	};
-}
-//#endregion
-//#region src/sveltekit/runtime.ts
-var DEFAULT_SESSION_TTL_SECONDS = 10080 * 60;
-function createSmrtSvelteKitRuntime(options = {}) {
-	return composeSmrtSvelteKitRuntime(options, {});
-}
-function composeSmrtSvelteKitRuntime(options, seams) {
-	const env = options.env ?? process.env;
-	const sourceRoot = options.sourceRoot ?? process.cwd();
-	const dataDirectory = options.dataDirectory ?? env.SMRT_DATA_DIR;
-	const initializeLocal = seams.initializeLocal ?? initializeLocalApplicationRuntime;
-	const initializeDeployed = seams.initializeDeployed ?? initializeDeployedApplicationRuntime;
-	if (options.enableTenancy !== false && !isTenancyEnabled()) enableTenancy();
-	let appId;
-	const applicationId = () => {
-		appId ??= options.appId ? validateApplicationId(options.appId) : resolveApplicationId({
-			sourceRoot,
-			explicitId: env.SMRT_APP_ID
-		});
-		return appId;
-	};
-	let resolved;
-	let resolvedPromise;
-	const resolvedRuntime = () => {
-		resolvedPromise ??= (async () => {
-			const value = typeof options.runtime === "function" ? await options.runtime() : options.runtime ?? await (seams.loadRuntime ?? loadConfiguredRuntime)();
-			resolved = value;
-			return value;
-		})().catch((error) => {
-			resolvedPromise = void 0;
-			throw error;
-		});
-		return resolvedPromise;
-	};
-	const requireResolved = () => {
-		if (!resolved) throw new Error("The SMRT application runtime is not resolved yet; await init() first.");
-		return resolved;
-	};
-	const baseDatabaseConfig = () => {
-		const runtime = requireResolved();
-		if (runtime.profile === "local") {
-			const paths = resolveLocalRuntimePaths({
-				appId: applicationId(),
-				dataDirectory,
-				sourceRoot,
-				env
-			});
-			return {
-				type: "sqlite",
-				url: paths.database,
-				secureFile: {
-					driver: "node:sqlite",
-					custody: "trusted-parent",
-					root: paths.root
-				}
-			};
-		}
-		const databaseUrl = env.DATABASE_URL;
-		if (!databaseUrl) throw new Error(`${runtime.profile} requires DATABASE_URL.`);
-		return {
-			type: "postgres",
-			url: databaseUrl
-		};
-	};
-	const baseClassOptions = (className) => {
-		const defaults = { db: baseDatabaseConfig() };
-		const override = options.classOverrides?.[className];
-		return override ? {
-			...defaults,
-			...override
-		} : defaults;
-	};
-	const rlsRequestDatabase = () => {
-		if (getCurrentSessionPermissionContext()?.postgresRls !== true) return void 0;
-		return getRequestScopedDatabase() ?? void 0;
-	};
-	const databaseConfig = () => rlsRequestDatabase() ?? baseDatabaseConfig();
-	const classOptions = (className) => {
-		const base = baseClassOptions(className);
-		if (options.classOverrides?.[className]?.db !== void 0) return base;
-		const requestDb = rlsRequestDatabase();
-		return requestDb ? {
-			...base,
-			db: requestDb
-		} : base;
-	};
-	const getCollection = (className) => ObjectRegistry.getCollection(className, classOptions(className));
-	const writerLease = options.acquireWriterLease === false ? void 0 : options.acquireWriterLease ?? ((context) => defaultWriterLease(context, env));
-	let localPromise;
-	let localLease;
-	const localRuntime = async () => {
-		const runtime = await resolvedRuntime();
-		if (runtime.profile !== "local") throw new Error("Owner bootstrap is available only in the local profile.");
-		if (localPromise) return localPromise;
-		const bindHost = options.bindHost || env.HOST || (env.NODE_ENV === "development" ? "127.0.0.1" : null);
-		if (!bindHost) throw new Error("Local production startup requires an explicit loopback HOST; use pnpm app:start.");
-		const id = applicationId();
-		localLease ??= writerLease?.({
-			appId: id,
-			dataDirectory,
-			sourceRoot
-		});
-		localPromise = initializeLocal({
-			appId: id,
-			dataDirectory,
-			sourceRoot,
-			env,
-			bindHost,
-			providers: {
-				database: runtime.providers.database,
-				authentication: runtime.providers.authentication,
-				tenancy: runtime.providers.tenancy,
-				assets: runtime.providers.assets,
-				secrets: runtime.providers.secrets,
-				jobs: runtime.providers.jobs,
-				network: runtime.providers.network
-			},
-			backgroundJobs: options.backgroundJobs ?? env.SMRT_BACKGROUND_JOBS === "true",
-			paidCapabilities: options.paidCapabilities,
-			bootstrapTtlSeconds: options.bootstrapTtlSeconds,
-			sessionTtlSeconds: options.sessionTtlSeconds,
-			ownerTenant: options.ownerTenant,
-			prepareDatabase: options.prepareDatabase,
-			now: options.now
-		}).then(({ runtime: initialized, bootstrap }) => {
-			if (bootstrap) try {
-				options.onBootstrapInvitation?.(bootstrap, { bindHost });
-			} catch {}
-			return initialized;
-		}).catch((error) => {
-			localLease?.release();
-			localLease = void 0;
-			localPromise = void 0;
-			throw error;
-		});
-		return localPromise;
-	};
-	let deployedPromise;
-	const deployedRuntime = async () => {
-		const runtime = await resolvedRuntime();
-		if (runtime.profile === "local") throw new Error("deployed_runtime_unavailable");
-		const profile = runtime.profile;
-		const databaseUrl = env.DATABASE_URL;
-		if (!databaseUrl) throw new Error(`${profile} requires DATABASE_URL.`);
-		const authenticationProvider = runtime.providers.authentication.provider;
-		if (authenticationProvider === "owner-bootstrap") throw new Error("Deployed profiles require public authentication.");
-		const readiness = options.providerReadiness;
-		if (!readiness) throw new Error(`${profile} requires providerReadiness probes for authentication, assets, and secrets.`);
-		deployedPromise ??= initializeDeployed({
-			profile,
-			providers: {
-				database: runtime.providers.database,
-				authentication: runtime.providers.authentication,
-				tenancy: runtime.providers.tenancy,
-				assets: runtime.providers.assets,
-				secrets: runtime.providers.secrets,
-				jobs: runtime.providers.jobs,
-				network: runtime.providers.network
-			},
-			database: {
-				engine: "postgres",
-				connect: () => getDatabase({
-					type: "postgres",
-					url: databaseUrl
-				}),
-				close: async (db) => {
-					await db.close?.();
-				}
-			},
-			authentication: {
-				provider: authenticationProvider,
-				readiness: readiness("authentication", {
-					profile,
-					provider: authenticationProvider
-				})
-			},
-			assets: {
-				provider: runtime.providers.assets.provider,
-				readiness: readiness("assets", {
-					profile,
-					provider: runtime.providers.assets.provider
-				})
-			},
-			secrets: {
-				provider: runtime.providers.secrets.provider,
-				readiness: readiness("secrets", {
-					profile,
-					provider: runtime.providers.secrets.provider
-				})
-			},
-			prepareDatabase: options.prepareDatabase
-		});
-		return deployedPromise;
-	};
-	const ready = async () => {
-		if ((await resolvedRuntime()).profile === "local") {
-			await localRuntime();
-			return;
-		}
-		await deployedRuntime();
-	};
-	const configurationFingerprint = () => runtimeConfigurationFingerprint(requireResolved(), env);
-	const health = async () => {
-		await ready();
-		const runtime = requireResolved();
-		const publicHealth = {
-			schemaVersion: 1,
-			status: "ready",
-			profile: runtime.profile
-		};
-		return runtime.profile === "local" ? {
-			...publicHealth,
-			application: applicationId(),
-			instance: env.SMRT_PROCESS_INSTANCE || null,
-			configuration: configurationFingerprint()
-		} : publicHealth;
-	};
-	const readDiagnostics = async (diagnosticsOptions) => {
-		await ready();
-		const runtime = requireResolved();
-		const schema = {
-			status: diagnosticsOptions.schemaStatus ?? "unknown",
-			migrations: diagnosticsOptions.migrationStatus ?? "unknown"
-		};
-		if (runtime.profile === "local") {
-			const diagnostics = await (await localRuntime()).diagnostics();
-			return projectRuntimeDiagnostics({
-				profile: "local",
-				health: "healthy",
-				schema,
-				capabilities: {
-					"asset-storage": "available",
-					authentication: "available",
-					"background-jobs": diagnostics.jobs.backgroundEnabled ? "available" : "disabled",
-					database: "available",
-					"paid-capabilities": diagnostics.paidCapabilitiesEnabled ? "available" : "disabled",
-					"secret-storage": "available"
-				},
-				toolNames: diagnosticsOptions.toolNames,
-				worker: {
-					topology: diagnostics.jobs.topology,
-					required: diagnostics.jobs.backgroundEnabled,
-					heartbeatAt: diagnosticsOptions.workerHeartbeatAt
-				},
-				recentErrors: diagnosticsOptions.recentErrors,
-				observedAt: diagnosticsOptions.observedAt
-			});
-		}
-		const deployed = await deployedPromise;
-		if (!deployed) throw new Error("deployed_runtime_unavailable");
-		const readiness = await deployed.readiness();
-		const componentStatus = (component) => readiness.components[component].status === "ready" ? "available" : "unavailable";
-		return projectRuntimeDiagnostics({
-			profile: runtime.profile,
-			health: deployed.health().status === "healthy" ? readiness.status === "ready" ? "healthy" : "degraded" : "stopped",
-			schema,
-			capabilities: {
-				"asset-storage": componentStatus("assets"),
-				authentication: componentStatus("authentication"),
-				"background-jobs": "available",
-				database: componentStatus("database"),
-				"paid-capabilities": "unknown",
-				"secret-storage": componentStatus("secrets")
-			},
-			toolNames: diagnosticsOptions.toolNames,
-			worker: {
-				topology: deployed.resolvedRuntime.providers.jobs.topology,
-				required: true,
-				heartbeatAt: diagnosticsOptions.workerHeartbeatAt
-			},
-			recentErrors: diagnosticsOptions.recentErrors,
-			observedAt: diagnosticsOptions.observedAt
-		});
-	};
-	const selectTenant = options.selectTenant ?? createSubdomainTenantSelector({
-		baseDomain: options.tenantBaseDomain ?? env.TENANT_BASE_DOMAIN,
-		classOptions: () => baseClassOptions("Tenant")
-	});
-	const readinessHandle = async ({ event, resolve }) => {
-		await ready();
-		return resolve(event);
-	};
-	const tenantSelectionHandle = async ({ event, resolve }) => {
-		const locals = runtimeLocals(event.locals);
-		const selection = normalizeTenantSelection(await selectTenant({
-			url: event.url,
-			request: event.request
-		}));
-		locals.selectedTenantId = selection.tenantId;
-		locals.selectedTenantSlug = selection.tenantSlug;
-		return resolve(event);
-	};
-	const sessionCookieName = options.session?.cookieName ?? "sid";
-	const sessionSkipPaths = options.session?.skipPaths ?? [];
-	const sessionServiceOptions = () => ({
-		...baseClassOptions("Session"),
-		...options.session,
-		defaultTTL: options.session?.ttl ?? DEFAULT_SESSION_TTL_SECONDS,
-		autoExtend: options.session?.autoExtend ?? false
-	});
-	const postgresRls = () => requireResolved().providers.tenancy.isolation === "database-rls" ? true : options.session?.postgresRls;
-	let permissionResolverPromise;
-	const permissionResolver = () => {
-		permissionResolverPromise ??= PermissionResolver.create(baseClassOptions("Permission")).catch((error) => {
-			permissionResolverPromise = void 0;
-			throw error;
-		});
-		return permissionResolverPromise;
-	};
-	const runAsPrincipal = async (principal, fn) => {
-		if (!principal || typeof principal !== "object") throw new Error("A bound principal is required.");
-		const snapshot = snapshotBoundPrincipal(principal);
-		const tokenDerived = isLocalMcpTokenPrincipal(snapshot);
-		const userId = ownValue(snapshot, "id");
-		const tenantId = ownValue(snapshot, "tenantId");
-		const snapshotScopes = ownValue(snapshot, "scopes");
-		const requestedTenantBinding = ownValue(snapshot, "tenantBinding");
-		const requestedScopes = snapshotScopes === void 0 ? void 0 : Object.freeze([...snapshotScopes]);
-		if (requestedScopes !== void 0 && !requestedScopes.every((scope) => typeof scope === "string")) throw new Error("A bound principal has malformed scopes.");
-		if (typeof userId !== "string" || userId.length === 0) throw new Error("A bound principal requires a user id.");
-		if (typeof tenantId !== "string" || tenantId.length === 0) throw new Error("A bound principal requires a tenant.");
-		if (tokenDerived && requestedTenantBinding !== void 0 && requestedTenantBinding !== "direct") throw new Error("A local MCP token principal binds only through its direct membership.");
-		const binding = tokenDerived ? "direct" : requestedTenantBinding ?? "direct-or-inherited";
-		if (binding !== "direct" && binding !== "direct-or-inherited") throw new Error("Unknown tenant binding mode for a bound principal.");
-		const resolved2 = await resolveBoundMembershipPermissions({
-			memberships: await MembershipCollection.create(baseClassOptions("Membership")),
-			resolver: await permissionResolver(),
-			userId,
-			tenantId,
-			binding
-		});
-		if (!resolved2) throw new Error(binding === "direct" ? "The bound principal has no active direct membership in its tenant." : "The bound principal has no authorized membership in its tenant.");
-		const cap = requestedScopes ? new Set(requestedScopes) : void 0;
-		const permissions = [...resolved2.permissions].filter((permission) => !cap || cap.has(permission));
-		return withPrincipalPermissionContext({
-			...baseClassOptions("Session"),
-			userId,
-			tenantId,
-			permissions,
-			enterTenantContext: true,
-			postgresRls: postgresRls()
-		}, () => fn(Object.freeze(Object.assign(/* @__PURE__ */ Object.create(null), snapshot, {
-			id: userId,
-			tenantId,
-			tenantBinding: binding,
-			scopes: Object.freeze([...permissions])
-		}))));
-	};
-	const verifyLocalMcpToken = async (token) => {
-		if ((await resolvedRuntime()).profile !== "local") return null;
-		return await (await localRuntime()).mcpTokens?.verify(token) ?? null;
-	};
-	const resolveMcpPrincipal = async (identity) => {
-		if ((await resolvedRuntime()).profile === "local") return null;
-		if (!identity || typeof identity !== "object") return null;
-		const issuer = ownValue(identity, "issuer");
-		const subject = ownValue(identity, "subject");
-		if (typeof issuer !== "string" || issuer.length === 0 || typeof subject !== "string" || subject.length === 0) return null;
-		return withSystemContext(async () => {
-			const identities = await OidcIdentityCollection.create(baseClassOptions("OidcIdentity"));
-			let linked;
-			try {
-				linked = await identities.findBySubject(issuer, subject);
-			} catch {
-				return null;
-			}
-			if (!linked?.profileId) return null;
-			const owners = await (await UserCollection.create(baseClassOptions("User"))).list({
-				where: { profileId: linked.profileId },
-				limit: 2
-			});
-			const user = owners.length === 1 ? owners[0] : void 0;
-			if (typeof user?.id !== "string" || user.id.length === 0 || user.status !== UserStatus.ACTIVE) return null;
-			const memberships = await MembershipCollection.create(baseClassOptions("Membership"));
-			const tenants = new Set((await memberships.findActiveByUser(user.id)).map((membership) => membership.tenantId).filter((tenantId2) => typeof tenantId2 === "string" && tenantId2.length > 0));
-			if (tenants.size !== 1) return null;
-			const [tenantId] = tenants;
-			return Object.freeze({
-				id: user.id,
-				tenantId,
-				kind: "human",
-				tenantBinding: "direct"
-			});
-		});
-	};
-	let sessionServicePromise;
-	const sessionService = () => {
-		sessionServicePromise ??= (async () => {
-			const service = new TenantAuthorizingSessionService(sessionServiceOptions(), requireResolved().providers.tenancy.context === "required");
-			await service.initialize();
-			return service;
-		})().catch((error) => {
-			sessionServicePromise = void 0;
-			throw error;
-		});
-		return sessionServicePromise;
-	};
-	const sessionStep = async ({ event, resolve }) => {
-		const locals = runtimeLocals(event.locals);
-		clearSessionLocals(locals);
-		const rls = postgresRls();
-		const skipped = sessionSkipPaths.some((path) => event.url.pathname.startsWith(path));
-		if (skipped && !rls) return resolve(event);
-		const sessionId = skipped ? void 0 : event.cookies.get(sessionCookieName);
-		if (!sessionId && !rls) return resolve(event);
-		let resolveEntered = false;
-		let downstream;
-		try {
-			const service = await sessionService();
-			return await withSessionPermissionContext({
-				...sessionServiceOptions(),
-				enterTenantContext: true,
-				postgresRls: rls,
-				sessionId: sessionId ?? null,
-				sessionService: service
-			}, async (context) => {
-				if (context.session) {
-					locals.user = context.user;
-					locals.membership = context.membership ?? null;
-					locals.permissions = context.permissions;
-					locals.tenantId = context.tenantId;
-					locals.sessionId = context.sessionId;
-					if (context.tenantId) verifiedSessionTenants.set(locals, context.tenantId);
-				}
-				resolveEntered = true;
-				try {
-					return await resolve(event);
-				} catch (error) {
-					downstream = { error };
-					throw error;
-				}
-			});
-		} catch (error) {
-			if (downstream) throw downstream.error;
-			if (resolveEntered) throw error;
-			clearSessionLocals(locals);
-			return new Response("Internal Server Error", { status: 500 });
-		}
-	};
-	const sessionCookie = Object.freeze({
-		name: options.session?.cookieName ?? "sid",
-		path: options.session?.cookiePath ?? "/",
-		...options.session?.cookieDomain ? { domain: options.session.cookieDomain } : {},
-		sameSite: options.session?.cookieSameSite ?? "lax",
-		...options.session?.cookieSecure !== void 0 ? { secure: options.session.cookieSecure } : {},
-		maxAgeSeconds: options.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS
-	});
-	const init = () => ready();
-	return Object.freeze({
-		handle: composeHandles(readinessHandle, tenantSelectionHandle, sessionStep, authorizedTenantLocalsHandle),
-		init,
-		sessionCookie,
-		resolvedRuntime,
-		ready,
-		applicationId,
-		applicationStateRoot: () => resolveApplicationStateRoot({
-			appId: applicationId(),
-			dataDirectory,
-			sourceRoot
-		}),
-		configurationFingerprint,
-		databaseConfig,
-		classOptions,
-		getCollection,
-		runAsPrincipal,
-		verifyLocalMcpToken,
-		resolveMcpPrincipal,
-		localRuntime,
-		deployedRuntime,
-		health,
-		readDiagnostics
-	});
-}
-function defaultWriterLease(context, env = process.env) {
-	return acquireWriterLease(prepareApplicationStateRoot({
-		appId: context.appId,
-		dataDirectory: context.dataDirectory,
-		sourceRoot: context.sourceRoot
-	}), { operationInstance: env.SMRT_OPERATION_INSTANCE });
-}
-var verifiedSessionTenants = /* @__PURE__ */ new WeakMap();
-var TenantAuthorizingSessionService = class extends SessionService {
-	tenantRequired;
-	constructor(options, tenantRequired) {
-		super(options);
-		this.tenantRequired = tenantRequired;
-	}
-	async loadSessionContext(sessionId) {
-		const context = await super.loadSessionContext(sessionId);
-		if (!context) return null;
-		if (typeof context.tenantId === "string" && context.tenantId.length > 0) return isSessionTenantAuthorized(context) ? context : null;
-		return this.tenantRequired ? null : context;
-	}
-};
-function clearSessionLocals(locals) {
-	locals.user = null;
-	locals.membership = null;
-	locals.permissions = [];
-	locals.tenantId = null;
-	locals.sessionId = null;
-	locals.tenantContext = void 0;
-	verifiedSessionTenants.delete(locals);
-}
-var authorizedTenantLocalsHandle = async ({ event, resolve }) => {
-	const locals = runtimeLocals(event.locals);
-	const activeContext = getCurrentTenant();
-	if (locals.user && locals.tenantId && verifiedSessionTenants.get(locals) === locals.tenantId && activeContext?.tenantId === locals.tenantId) locals.tenantContext = activeContext;
-	return resolve(event);
-};
-function composeHandles(...handles) {
-	return ({ event, resolve }) => {
-		const run = (index, current, resolveOptions) => {
-			const next = handles[index];
-			if (!next) return resolve(current, resolveOptions);
-			return next({
-				event: current,
-				resolve: (nextEvent, nextOptions) => run(index + 1, nextEvent, nextOptions ?? resolveOptions)
-			});
-		};
-		return run(0, event);
-	};
-}
-function runtimeLocals(locals) {
-	return locals;
-}
-async function loadConfiguredRuntime() {
-	return resolveEffectiveApplicationRuntime(await loadConfig());
-}
-function snapshotBoundPrincipal(principal) {
-	if (!principal || typeof principal !== "object" || Array.isArray(principal)) throw new Error("A bound principal is required.");
-	let snapshot;
-	try {
-		snapshot = deepFrozenPlainCopy(principal);
-	} catch (error) {
-		if (error instanceof PlainDataError) throw new Error(`A bound principal ${error.message}.`);
-		throw error;
-	}
-	for (const key of [
-		"id",
-		"tenantId",
-		"kind",
-		"tenantBinding"
-	]) {
-		const value = ownValue(snapshot, key);
-		if (value !== void 0 && typeof value !== "string") throw new Error(`A bound principal has a malformed ${key}.`);
-	}
-	for (const key of ["scopes", "roles"]) {
-		const value = ownValue(snapshot, key);
-		if (value !== void 0 && (!Array.isArray(value) || !value.every((entry) => typeof entry === "string"))) throw new Error(`A bound principal has malformed ${key}.`);
-	}
-	const allowCrossTenant = ownValue(snapshot, "allowCrossTenant");
-	if (allowCrossTenant !== void 0 && typeof allowCrossTenant !== "boolean") throw new Error("A bound principal has a malformed allowCrossTenant.");
-	return snapshot;
-}
-//#endregion
 //#region src/sveltekit/sign-out.ts
 function isSameOriginRequest(request, url) {
 	const site = request.headers.get("sec-fetch-site");