@selvajs/selva 2.0.9 → 2.0.11

package/build/server/chunks/{bootHealth.server-DwPUi_JC.js.map → bootHealth.server-CCMjOn0m.js.map}

@@ -1 +1 @@
-{"version":3,"file":"bootHealth.server-DwPUi_JC.js","sources":["../../../.svelte-kit/adapter-node/chunks/bootHealth.server.js"],"sourcesContent":["import \"./context.js\";\nimport { p as providers, L as LocalComputeServerStore } from \"./providers.server.js\";\nlet cached = null;\nlet inflight = null;\nasync function run() {\n  let atRestSecrets = null;\n  const store = providers.data.computeServer;\n  if (store instanceof LocalComputeServerStore) {\n    try {\n      atRestSecrets = await store.verifySecrets();\n    } catch (err) {\n      console.error(\"[selva][boot] verifySecrets threw — treating as failure\", err);\n      atRestSecrets = {\n        ok: false,\n        plaintextFound: false,\n        failures: [\n          {\n            serverId: \"(unknown)\",\n            serverLabel: \"(unknown)\",\n            reason: \"key_mismatch\",\n            cause: err instanceof Error ? err.message : String(err)\n          }\n        ]\n      };\n    }\n  }\n  if (atRestSecrets && !atRestSecrets.ok) {\n    for (const f of atRestSecrets.failures) {\n      console.error(\n        `[selva][boot] compute server \"${f.serverLabel}\" (${f.serverId}): ${f.reason}${f.cause ? ` — ${f.cause}` : \"\"}`\n      );\n    }\n    console.error(\n      \"[selva][boot] At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.\"\n    );\n  }\n  return {\n    checkedAt: (/* @__PURE__ */ new Date()).toISOString(),\n    atRestSecrets\n  };\n}\nfunction getBootHealth() {\n  if (cached) return Promise.resolve(cached);\n  if (inflight) return inflight;\n  inflight = run().then((result) => {\n    cached = result;\n    inflight = null;\n    return result;\n  });\n  return inflight;\n}\nfunction isDegraded(report) {\n  return report.atRestSecrets !== null && !report.atRestSecrets.ok;\n}\nexport {\n  getBootHealth as g,\n  isDegraded as i\n};\n"],"names":[],"mappings":";;;AAEA,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,QAAQ,GAAG,IAAI;AACnB,eAAe,GAAG,GAAG;AACrB,EAAE,IAAI,aAAa,GAAG,IAAI;AAC1B,EAAE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC5C,EAAE,IAAI,KAAK,YAAY,uBAAuB,EAAE;AAChD,IAAI,IAAI;AACR,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;AACjD,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,MAAM,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,GAAG,CAAC;AACnF,MAAM,aAAa,GAAG;AACtB,QAAQ,EAAE,EAAE,KAAK;AACjB,QAAQ,cAAc,EAAE,KAAK;AAC7B,QAAQ,QAAQ,EAAE;AAClB,UAAU;AACV,YAAY,QAAQ,EAAE,WAAW;AACjC,YAAY,WAAW,EAAE,WAAW;AACpC,YAAY,MAAM,EAAE,cAAc;AAClC,YAAY,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAClE;AACA;AACA,OAAO;AACP,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;AAC1C,IAAI,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE;AAC5C,MAAM,OAAO,CAAC,KAAK;AACnB,QAAQ,CAAC,8BAA8B,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC;AACtH,OAAO;AACP,IAAI;AACJ,IAAI,OAAO,CAAC,KAAK;AACjB,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,OAAO;AACT,IAAI,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACzD,IAAI;AACJ,GAAG;AACH;AACA,SAAS,aAAa,GAAG;AACzB,EAAE,IAAI,MAAM,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAC5C,EAAE,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC/B,EAAE,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK;AACpC,IAAI,MAAM,GAAG,MAAM;AACnB,IAAI,QAAQ,GAAG,IAAI;AACnB,IAAI,OAAO,MAAM;AACjB,EAAE,CAAC,CAAC;AACJ,EAAE,OAAO,QAAQ;AACjB;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE;AAClE;;;;"}
+{"version":3,"file":"bootHealth.server-CCMjOn0m.js","sources":["../../../.svelte-kit/adapter-node/chunks/bootHealth.server.js"],"sourcesContent":["import \"./context.js\";\nimport { p as providers, L as LocalComputeServerStore } from \"./providers.server.js\";\nlet cached = null;\nlet inflight = null;\nasync function run() {\n  let atRestSecrets = null;\n  const store = providers.data.computeServer;\n  if (store instanceof LocalComputeServerStore) {\n    try {\n      atRestSecrets = await store.verifySecrets();\n    } catch (err) {\n      console.error(\"[selva][boot] verifySecrets threw — treating as failure\", err);\n      atRestSecrets = {\n        ok: false,\n        plaintextFound: false,\n        failures: [\n          {\n            serverId: \"(unknown)\",\n            serverLabel: \"(unknown)\",\n            reason: \"key_mismatch\",\n            cause: err instanceof Error ? err.message : String(err)\n          }\n        ]\n      };\n    }\n  }\n  if (atRestSecrets && !atRestSecrets.ok) {\n    for (const f of atRestSecrets.failures) {\n      console.error(\n        `[selva][boot] compute server \"${f.serverLabel}\" (${f.serverId}): ${f.reason}${f.cause ? ` — ${f.cause}` : \"\"}`\n      );\n    }\n    console.error(\n      \"[selva][boot] At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.\"\n    );\n  }\n  return {\n    checkedAt: (/* @__PURE__ */ new Date()).toISOString(),\n    atRestSecrets\n  };\n}\nfunction getBootHealth() {\n  if (cached) return Promise.resolve(cached);\n  if (inflight) return inflight;\n  inflight = run().then((result) => {\n    cached = result;\n    inflight = null;\n    return result;\n  });\n  return inflight;\n}\nfunction isDegraded(report) {\n  return report.atRestSecrets !== null && !report.atRestSecrets.ok;\n}\nexport {\n  getBootHealth as g,\n  isDegraded as i\n};\n"],"names":[],"mappings":";;;AAEA,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,QAAQ,GAAG,IAAI;AACnB,eAAe,GAAG,GAAG;AACrB,EAAE,IAAI,aAAa,GAAG,IAAI;AAC1B,EAAE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC5C,EAAE,IAAI,KAAK,YAAY,uBAAuB,EAAE;AAChD,IAAI,IAAI;AACR,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;AACjD,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,MAAM,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,GAAG,CAAC;AACnF,MAAM,aAAa,GAAG;AACtB,QAAQ,EAAE,EAAE,KAAK;AACjB,QAAQ,cAAc,EAAE,KAAK;AAC7B,QAAQ,QAAQ,EAAE;AAClB,UAAU;AACV,YAAY,QAAQ,EAAE,WAAW;AACjC,YAAY,WAAW,EAAE,WAAW;AACpC,YAAY,MAAM,EAAE,cAAc;AAClC,YAAY,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAClE;AACA;AACA,OAAO;AACP,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;AAC1C,IAAI,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE;AAC5C,MAAM,OAAO,CAAC,KAAK;AACnB,QAAQ,CAAC,8BAA8B,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC;AACtH,OAAO;AACP,IAAI;AACJ,IAAI,OAAO,CAAC,KAAK;AACjB,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,OAAO;AACT,IAAI,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACzD,IAAI;AACJ,GAAG;AACH;AACA,SAAS,aAAa,GAAG;AACzB,EAAE,IAAI,MAAM,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAC5C,EAAE,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC/B,EAAE,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK;AACpC,IAAI,MAAM,GAAG,MAAM;AACnB,IAAI,QAAQ,GAAG,IAAI;AACnB,IAAI,OAAO,MAAM;AACjB,EAAE,CAAC,CAAC;AACJ,EAAE,OAAO,QAAQ;AACjB;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE;AAClE;;;;"}

package/build/server/chunks/{hooks.server---blwhkE.js → hooks.server-BEJK3uzD.js}

@@ -1,8 +1,8 @@
 import { redirect, isHttpError } from '@sveltejs/kit';
 import { S as SYSTEM_CONTEXT } from './context-9tV9WxQ5.js';
-import { p as providers } from './providers.server-gJvnJT_K.js';
-import { g as getBootHealth } from './bootHealth.server-DwPUi_JC.js';
-import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from './auth-bootstrap.server-YBvyz9i1.js';
+import { p as providers } from './providers.server-CuhJFeVB.js';
+import { g as getBootHealth } from './bootHealth.server-CCMjOn0m.js';
+import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from './auth-bootstrap.server-B93MMm50.js';
 import { g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, c as clearRefreshCookie } from './admin-auth.server-CdTfBMI5.js';
 import 'zod';
 import './shared-server-DaWdgxVh.js';
@@ -18,6 +18,7 @@ function emptyProfile(userId) {
   return { userId, starredDefinitions: [], recentRuns: [] };
 }
 let headerAuthBootstrapWired = false;
+let proxyAuthLoginMissWarned = false;
 void getBootHealth();
 let firstRunResolved = false;
 async function isFirstRun() {
@@ -147,6 +148,30 @@ const handle = async ({ event, resolve }) => {
     let user = token ? await providers.auth.verifyToken(token) : null;
     if (!user && isPublicPage && providers.auth.proxyAuth) {
       user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);
+      if (!user && pathname === "/login") {
+        const dump = [];
+        event.request.headers.forEach((value, name) => dump.push(`  ${name}: ${value}`));
+        dump.sort();
+        console.warn(
+          `[HeaderAuth][debug] /login miss — full request headers:
+${dump.join("\n") || "  (no headers)"}`
+        );
+      }
+      if (!user && pathname === "/login" && !proxyAuthLoginMissWarned) {
+        proxyAuthLoginMissWarned = true;
+        const proxyAuth = providers.auth.proxyAuth;
+        const noHeaders = proxyAuth.hasNoIdentityHeaders(event.request.headers);
+        const configured = proxyAuth.configuredHeaderNames.join(", ");
+        if (noHeaders) {
+          console.warn(
+            `[HeaderAuth] /login was hit and NONE of the configured identity headers (${configured}) arrived on the request. The forward-auth proxy is not reaching this process, or it is not forwarding the configured headers. See the @selvajs/header-auth-provider README "Verification" section.`
+          );
+        } else {
+          console.warn(
+            `[HeaderAuth] /login was hit but the UPN header was missing or the user is not allowlisted. Configured headers: ${configured}. Some headers arrived but identification still failed — check that the UPN header is populated and that the user has been added to header-allowlist.json.`
+          );
+        }
+      }
     }
     if (user) {
       await providers.data.ensureUser(SYSTEM_CONTEXT, user.id);
@@ -195,4 +220,4 @@ const handleError = ({
 };
 
 export { handle, handleError, isPublicRoute, isStaticAsset };
-//# sourceMappingURL=hooks.server---blwhkE.js.map
+//# sourceMappingURL=hooks.server-BEJK3uzD.js.map

package/build/server/chunks/hooks.server-BEJK3uzD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.server-BEJK3uzD.js","sources":["../../../.svelte-kit/adapter-node/entries/hooks.server.js"],"sourcesContent":["import { redirect, isHttpError } from \"@sveltejs/kit\";\nimport { S as SYSTEM_CONTEXT } from \"../chunks/context.js\";\nimport { p as providers } from \"../chunks/providers.server.js\";\nimport { g as getBootHealth } from \"../chunks/bootHealth.server.js\";\nimport { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from \"../chunks/auth-bootstrap.server.js\";\nimport { g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, h as clearRefreshCookie } from \"../chunks/admin-auth.server.js\";\nfunction emptyProfile(userId) {\n  return { userId, starredDefinitions: [], recentRuns: [] };\n}\nlet headerAuthBootstrapWired = false;\nlet proxyAuthLoginMissWarned = false;\nvoid getBootHealth();\nlet firstRunResolved = false;\nasync function isFirstRun() {\n  if (firstRunResolved) return false;\n  const usersPage = await providers.auth.listUsers({ limit: 1 });\n  if (usersPage === null) {\n    firstRunResolved = true;\n    return false;\n  }\n  if (usersPage.items.length === 0) return true;\n  firstRunResolved = true;\n  return false;\n}\nasync function buildContext(user, sessionToken) {\n  let actingOrgId;\n  let orgPermissions = [];\n  const platformPermissions = await providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id);\n  const membership = await providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id);\n  if (membership) {\n    actingOrgId = membership.org.id;\n    orgPermissions = membership.member.permissions;\n  }\n  if (!actingOrgId && platformPermissions.includes(\"instance_admin\")) {\n    const firstOrgPage = await providers.data.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });\n    const firstOrg = firstOrgPage.items[0];\n    if (firstOrg) actingOrgId = firstOrg.id;\n  }\n  return {\n    userId: user.id,\n    actingOrgId,\n    platformPermissions,\n    orgPermissions,\n    adapterContext: sessionToken ? { sessionToken } : void 0\n  };\n}\nconst PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([\n  \"/\",\n  // landing — guests see it; authed users get redirected by +page.server.ts\n  \"/login\",\n  \"/setup\",\n  \"/accept-invite\"\n]);\nconst PUBLIC_PATH_PREFIXES = [\"/auth/\", \"/logout\"];\nconst PUBLIC_API_ROUTES = /* @__PURE__ */ new Set([\"/api/health\"]);\nconst STATIC_ASSET_PREFIXES = [\"/_app/\", \"/favicon/\"];\nconst STATIC_ASSET_PATHS = /* @__PURE__ */ new Set([\"/favicon.svg\", \"/robots.txt\"]);\nfunction isStaticAsset(pathname) {\n  if (STATIC_ASSET_PATHS.has(pathname)) return true;\n  return STATIC_ASSET_PREFIXES.some((p) => pathname.startsWith(p));\n}\nfunction isPublicRoute(pathname) {\n  if (PUBLIC_PAGE_ROUTES.has(pathname)) return true;\n  if (PUBLIC_API_ROUTES.has(pathname)) return true;\n  return PUBLIC_PATH_PREFIXES.some((p) => pathname.startsWith(p));\n}\nconst handle = async ({ event, resolve }) => {\n  event.locals.providers = providers;\n  if (!headerAuthBootstrapWired) {\n    wireHeaderAuthBootstrap();\n    headerAuthBootstrapWired = true;\n  }\n  const { pathname } = event.url;\n  if (isStaticAsset(pathname)) {\n    return applySecurityHeaders(await resolve(event), pathname);\n  }\n  if (pathname === \"/api/health\") {\n    return applySecurityHeaders(await resolve(event), pathname);\n  }\n  const publicRoute = isPublicRoute(pathname);\n  const isJsonApiRoute = pathname.startsWith(\"/api/\") || pathname.startsWith(\"/admin/api/\");\n  if (!publicRoute) {\n    if (await isFirstRun()) {\n      if (isJsonApiRoute) {\n        return applySecurityHeaders(\n          new Response(JSON.stringify({ error: \"Setup required\" }), {\n            status: 503,\n            headers: { \"Content-Type\": \"application/json\" }\n          }),\n          pathname\n        );\n      }\n      redirect(303, \"/setup\");\n    }\n  }\n  const needsAuth = !publicRoute;\n  if (needsAuth) {\n    let token = event.cookies.get(\"admin_session\") ?? \"\";\n    let user = await providers.auth.verifyToken(token);\n    if (!user) {\n      const refreshToken = getRefreshToken(event.cookies);\n      const oauth = providers.auth.oauth;\n      if (refreshToken && oauth) {\n        const refreshed = await oauth.refreshSession(refreshToken);\n        if (refreshed) {\n          setSessionCookie(event.cookies, refreshed.sessionToken);\n          setRefreshCookie(event.cookies, refreshed.refreshToken);\n          token = refreshed.sessionToken;\n          user = await providers.auth.verifyToken(token);\n        } else {\n          clearRefreshCookie(event.cookies);\n        }\n      }\n    }\n    if (!user && providers.auth.proxyAuth) {\n      user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n      if (user) await bootstrapUserSession(user);\n    }\n    if (!user) {\n      if (isJsonApiRoute) {\n        return applySecurityHeaders(\n          new Response(JSON.stringify({ error: \"Unauthorized\" }), {\n            status: 401,\n            headers: { \"Content-Type\": \"application/json\" }\n          }),\n          pathname\n        );\n      }\n      redirect(303, `/login?redirectTo=${encodeURIComponent(pathname)}`);\n    }\n    await providers.data.ensureUser(SYSTEM_CONTEXT, user.id);\n    event.locals.user = user;\n    event.locals.profile = await providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id) ?? emptyProfile(user.id);\n    event.locals.ctx = await buildContext(user, token);\n  } else {\n    const isPublicPage = PUBLIC_PAGE_ROUTES.has(pathname);\n    const token = isPublicPage ? event.cookies.get(\"admin_session\") ?? \"\" : \"\";\n    let user = token ? await providers.auth.verifyToken(token) : null;\n    if (!user && isPublicPage && providers.auth.proxyAuth) {\n      user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n      if (!user && pathname === \"/login\") {\n        const dump = [];\n        event.request.headers.forEach((value, name) => dump.push(`  ${name}: ${value}`));\n        dump.sort();\n        console.warn(\n          `[HeaderAuth][debug] /login miss — full request headers:\n${dump.join(\"\\n\") || \"  (no headers)\"}`\n        );\n      }\n      if (!user && pathname === \"/login\" && !proxyAuthLoginMissWarned) {\n        proxyAuthLoginMissWarned = true;\n        const proxyAuth = providers.auth.proxyAuth;\n        const noHeaders = proxyAuth.hasNoIdentityHeaders(event.request.headers);\n        const configured = proxyAuth.configuredHeaderNames.join(\", \");\n        if (noHeaders) {\n          console.warn(\n            `[HeaderAuth] /login was hit and NONE of the configured identity headers (${configured}) arrived on the request. The forward-auth proxy is not reaching this process, or it is not forwarding the configured headers. See the @selvajs/header-auth-provider README \"Verification\" section.`\n          );\n        } else {\n          console.warn(\n            `[HeaderAuth] /login was hit but the UPN header was missing or the user is not allowlisted. Configured headers: ${configured}. Some headers arrived but identification still failed — check that the UPN header is populated and that the user has been added to header-allowlist.json.`\n          );\n        }\n      }\n    }\n    if (user) {\n      await providers.data.ensureUser(SYSTEM_CONTEXT, user.id);\n      event.locals.user = user;\n      event.locals.profile = await providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id) ?? emptyProfile(user.id);\n      event.locals.ctx = await buildContext(user, token);\n    }\n  }\n  return applySecurityHeaders(await resolve(event), pathname);\n};\nfunction applySecurityHeaders(response, pathname) {\n  response.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n  response.headers.set(\"Referrer-Policy\", \"strict-origin-when-cross-origin\");\n  response.headers.set(\n    \"Permissions-Policy\",\n    \"accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()\"\n  );\n  if (process.env.NODE_ENV === \"production\") {\n    response.headers.set(\"Strict-Transport-Security\", \"max-age=31536000; includeSubDomains\");\n  }\n  if (pathname.startsWith(\"/_app/\")) {\n    response.headers.set(\"Cache-Control\", \"public, max-age=31536000, immutable\");\n  } else if (pathname.startsWith(\"/favicon/\") || pathname === \"/favicon.svg\" || pathname === \"/robots.txt\") {\n    response.headers.set(\"Cache-Control\", \"public, max-age=604800\");\n  }\n  return response;\n}\nconst handleError = ({\n  error,\n  status,\n  event\n}) => {\n  if (isHttpError(error)) {\n    return { message: error.body.message };\n  }\n  if (status === 404) {\n    return { message: \"Page not found.\" };\n  }\n  const cause = error instanceof Error && error.cause ? `\n  caused by: ${error.cause}` : \"\";\n  console.error(\n    `[Unhandled error] ${event.request.method} ${event.url.pathname}\n  ${error}${cause}`\n  );\n  return { message: \"An unexpected error occurred.\" };\n};\nexport {\n  handle,\n  handleError,\n  isPublicRoute,\n  isStaticAsset\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAMA,SAAS,YAAY,CAAC,MAAM,EAAE;AAC9B,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;AAC3D;AACA,IAAI,wBAAwB,GAAG,KAAK;AACpC,IAAI,wBAAwB,GAAG,KAAK;AACpC,KAAK,aAAa,EAAE;AACpB,IAAI,gBAAgB,GAAG,KAAK;AAC5B,eAAe,UAAU,GAAG;AAC5B,EAAE,IAAI,gBAAgB,EAAE,OAAO,KAAK;AACpC,EAAE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAChE,EAAE,IAAI,SAAS,KAAK,IAAI,EAAE;AAC1B,IAAI,gBAAgB,GAAG,IAAI;AAC3B,IAAI,OAAO,KAAK;AAChB,EAAE;AACF,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;AAC/C,EAAE,gBAAgB,GAAG,IAAI;AACzB,EAAE,OAAO,KAAK;AACd;AACA,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE;AAChD,EAAE,IAAI,WAAW;AACjB,EAAE,IAAI,cAAc,GAAG,EAAE;AACzB,EAAE,MAAM,mBAAmB,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC9F,EAAE,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC1F,EAAE,IAAI,UAAU,EAAE;AAClB,IAAI,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE;AACnC,IAAI,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW;AAClD,EAAE;AACF,EAAE,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACtE,IAAI,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACzF,IAAI,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,IAAI,IAAI,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC,EAAE;AAC3C,EAAE;AACF,EAAE,OAAO;AACT,IAAI,MAAM,EAAE,IAAI,CAAC,EAAE;AACnB,IAAI,WAAW;AACf,IAAI,mBAAmB;AACvB,IAAI,cAAc;AAClB,IAAI,cAAc,EAAE,YAAY,GAAG,EAAE,YAAY,EAAE,GAAG;AACtD,GAAG;AACH;AACA,MAAM,kBAAkB,mBAAmB,IAAI,GAAG,CAAC;AACnD,EAAE,GAAG;AACL;AACA,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE;AACF,CAAC,CAAC;AACF,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC;AAClD,MAAM,iBAAiB,mBAAmB,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;AAClE,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC;AACrD,MAAM,kBAAkB,mBAAmB,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;AACnF,SAAS,aAAa,CAAC,QAAQ,EAAE;AACjC,EAAE,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACnD,EAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAClE;AACA,SAAS,aAAa,CAAC,QAAQ,EAAE;AACjC,EAAE,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACnD,EAAE,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAClD,EAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACjE;AACK,MAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC7C,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS;AACpC,EAAE,IAAI,CAAC,wBAAwB,EAAE;AACjC,IAAI,uBAAuB,EAAE;AAC7B,IAAI,wBAAwB,GAAG,IAAI;AACnC,EAAE;AACF,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,GAAG;AAChC,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE;AAC/B,IAAI,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC/D,EAAE;AACF,EAAE,IAAI,QAAQ,KAAK,aAAa,EAAE;AAClC,IAAI,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC/D,EAAE;AACF,EAAE,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC;AAC7C,EAAE,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;AAC3F,EAAE,IAAI,CAAC,WAAW,EAAE;AACpB,IAAI,IAAI,MAAM,UAAU,EAAE,EAAE;AAC5B,MAAM,IAAI,cAAc,EAAE;AAC1B,QAAQ,OAAO,oBAAoB;AACnC,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE;AACpE,YAAY,MAAM,EAAE,GAAG;AACvB,YAAY,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACzD,WAAW,CAAC;AACZ,UAAU;AACV,SAAS;AACT,MAAM;AACN,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC7B,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,SAAS,GAAG,CAAC,WAAW;AAChC,EAAE,IAAI,SAAS,EAAE;AACjB,IAAI,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;AACxD,IAAI,IAAI,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACtD,IAAI,IAAI,CAAC,IAAI,EAAE;AACf,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;AACzD,MAAM,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK;AACxC,MAAM,IAAI,YAAY,IAAI,KAAK,EAAE;AACjC,QAAQ,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC;AAClE,QAAQ,IAAI,SAAS,EAAE;AACvB,UAAU,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AACjE,UAAU,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AACjE,UAAU,KAAK,GAAG,SAAS,CAAC,YAAY;AACxC,UAAU,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACxD,QAAQ,CAAC,MAAM;AACf,UAAU,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;AAC3C,QAAQ;AACR,MAAM;AACN,IAAI;AACJ,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AAC3C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtF,MAAM,IAAI,IAAI,EAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC;AAChD,IAAI;AACJ,IAAI,IAAI,CAAC,IAAI,EAAE;AACf,MAAM,IAAI,cAAc,EAAE;AAC1B,QAAQ,OAAO,oBAAoB;AACnC,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;AAClE,YAAY,MAAM,EAAE,GAAG;AACvB,YAAY,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACzD,WAAW,CAAC;AACZ,UAAU;AACV,SAAS;AACT,MAAM;AACN,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACxE,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC5D,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC5B,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AACxH,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;AACtD,EAAE,CAAC,MAAM;AACT,IAAI,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;AACzD,IAAI,MAAM,KAAK,GAAG,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE;AAC9E,IAAI,IAAI,IAAI,GAAG,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,IAAI;AACrE,IAAI,IAAI,CAAC,IAAI,IAAI,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AAC3D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtF,MAAM,IAAI,CAAC,IAAI,IAAI,QAAQ,KAAK,QAAQ,EAAE;AAC1C,QAAQ,MAAM,IAAI,GAAG,EAAE;AACvB,QAAQ,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACxF,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,QAAQ,OAAO,CAAC,IAAI;AACpB,UAAU,CAAC;AACX,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;AACtC,SAAS;AACT,MAAM;AACN,MAAM,IAAI,CAAC,IAAI,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,wBAAwB,EAAE;AACvE,QAAQ,wBAAwB,GAAG,IAAI;AACvC,QAAQ,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS;AAClD,QAAQ,MAAM,SAAS,GAAG,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AAC/E,QAAQ,MAAM,UAAU,GAAG,SAAS,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;AACrE,QAAQ,IAAI,SAAS,EAAE;AACvB,UAAU,OAAO,CAAC,IAAI;AACtB,YAAY,CAAC,yEAAyE,EAAE,UAAU,CAAC,mMAAmM;AACtS,WAAW;AACX,QAAQ,CAAC,MAAM;AACf,UAAU,OAAO,CAAC,IAAI;AACtB,YAAY,CAAC,+GAA+G,EAAE,UAAU,CAAC,0JAA0J;AACnS,WAAW;AACX,QAAQ;AACR,MAAM;AACN,IAAI;AACJ,IAAI,IAAI,IAAI,EAAE;AACd,MAAM,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC9D,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1H,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;AACxD,IAAI;AACJ,EAAE;AACF,EAAE,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC7D;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE;AAClD,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC3D,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;AAC5E,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG;AACtB,IAAI,oBAAoB;AACxB,IAAI;AACJ,GAAG;AACH,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE;AAC7C,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,qCAAqC,CAAC;AAC5F,EAAE;AACF,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;AACrC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC;AAChF,EAAE,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,aAAa,EAAE;AAC5G,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC;AACnE,EAAE;AACF,EAAE,OAAO,QAAQ;AACjB;AACK,MAAC,WAAW,GAAG,CAAC;AACrB,EAAE,KAAK;AACP,EAAE,MAAM;AACR,EAAE;AACF,CAAC,KAAK;AACN,EAAE,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE;AAC1B,IAAI,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;AAC1C,EAAE;AACF,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE;AACtB,IAAI,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE;AACzC,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG;AACxD,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE;AACjC,EAAE,OAAO,CAAC,KAAK;AACf,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;AACnE,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC;AAClB,GAAG;AACH,EAAE,OAAO,EAAE,OAAO,EAAE,+BAA+B,EAAE;AACrD;;;;"}

package/build/server/chunks/{permissions.server-toUY36oB.js → permissions.server-Bfvp6EaK.js}

@@ -1,8 +1,8 @@
-import { l as getPermissionStore } from './providers.server-gJvnJT_K.js';
+import { l as getPermissionStore } from './providers.server-CuhJFeVB.js';
 
 async function setUserPlatformPermissions(ctx, userId, permissions) {
   return getPermissionStore().set(ctx, userId, permissions);
 }
 
 export { setUserPlatformPermissions as s };
-//# sourceMappingURL=permissions.server-toUY36oB.js.map
+//# sourceMappingURL=permissions.server-Bfvp6EaK.js.map

package/build/server/chunks/{permissions.server-toUY36oB.js.map → permissions.server-Bfvp6EaK.js.map}

@@ -1 +1 @@
-{"version":3,"file":"permissions.server-toUY36oB.js","sources":["../../../.svelte-kit/adapter-node/chunks/permissions.server.js"],"sourcesContent":["import { h as getPermissionStore } from \"./providers.server.js\";\nasync function setUserPlatformPermissions(ctx, userId, permissions) {\n  return getPermissionStore().set(ctx, userId, permissions);\n}\nexport {\n  setUserPlatformPermissions as s\n};\n"],"names":[],"mappings":";;AACA,eAAe,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE;AACpE,EAAE,OAAO,kBAAkB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC;AAC3D;;;;"}
+{"version":3,"file":"permissions.server-Bfvp6EaK.js","sources":["../../../.svelte-kit/adapter-node/chunks/permissions.server.js"],"sourcesContent":["import { h as getPermissionStore } from \"./providers.server.js\";\nasync function setUserPlatformPermissions(ctx, userId, permissions) {\n  return getPermissionStore().set(ctx, userId, permissions);\n}\nexport {\n  setUserPlatformPermissions as s\n};\n"],"names":[],"mappings":";;AACA,eAAe,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE;AACpE,EAAE,OAAO,kBAAkB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC;AAC3D;;;;"}

package/build/server/chunks/{providers.server-gJvnJT_K.js → providers.server-CuhJFeVB.js}

@@ -4073,6 +4073,14 @@ const DEFAULT_HEADERS = {
   email: "SELVA-Email",
   displayName: "SELVA-DisplayName"
 };
+function dumpHeaders(headers) {
+  const entries = [];
+  headers.forEach((value, name) => entries.push([name, value]));
+  entries.sort((a, b) => a[0].localeCompare(b[0]));
+  if (entries.length === 0)
+    return "  (no headers)";
+  return entries.map(([name, value]) => `  ${name}: ${value}`).join("\n");
+}
 function toAuthUser(u) {
   return {
     id: u.id,
@@ -4087,6 +4095,12 @@ class HeaderProxyAuth {
   users;
   headers;
   bootstrapPolicy;
+  // One-shot diagnostic flag. Flipped the first time we see a request that
+  // carries none of the configured SELVA-* headers, so deploys with a
+  // misconfigured proxy get a single loud warning in the logs without
+  // spamming on every anonymous request. Reset is intentional — the
+  // process restarts and you see the warning again next deploy.
+  missingHeadersWarned = false;
   constructor(users, headers, bootstrapPolicy) {
     this.users = users;
     this.headers = headers;
@@ -4095,10 +4109,29 @@ class HeaderProxyAuth {
   setBootstrapPolicy(policy) {
     this.bootstrapPolicy = policy ?? void 0;
   }
+  /**
+   * Names of the configured identity headers, in priority order. Exposed so
+   * the hook layer can emit per-page diagnostics ("you hit /login without
+   * these headers") without having to know provider internals.
+   */
+  get configuredHeaderNames() {
+    return [this.headers.upn, this.headers.email, this.headers.displayName];
+  }
+  /** True iff none of the configured identity headers are present. */
+  hasNoIdentityHeaders(headers) {
+    return !headers.get(this.headers.upn) && !headers.get(this.headers.email) && !headers.get(this.headers.displayName);
+  }
   async identifyFromHeaders(headers) {
     const upn = headers.get(this.headers.upn);
-    if (!upn || !upn.trim())
+    if (!upn || !upn.trim()) {
+      console.warn(`[HeaderAuth][debug] identifyFromHeaders: no UPN. Configured: upn=${this.headers.upn} email=${this.headers.email} display=${this.headers.displayName}. All headers received:
+${dumpHeaders(headers)}`);
+      if (!this.missingHeadersWarned && this.hasNoIdentityHeaders(headers)) {
+        this.missingHeadersWarned = true;
+        console.warn(`[HeaderAuth] No identity headers received on the first non-authed request. Expected one of: ${this.headers.upn}, ${this.headers.email}, ${this.headers.displayName}. If you reach the app through your forward-auth proxy, this means the proxy is not forwarding the configured headers — check your forward_auth / copy_headers config. If you're hitting the app directly (bypassing the proxy), bind the process to 127.0.0.1 and only reach it through the proxy. See @selvajs/header-auth-provider README.`);
+      }
       return null;
+    }
     const email = headers.get(this.headers.email)?.trim() || void 0;
     const displayName = headers.get(this.headers.displayName)?.trim() || void 0;
     let entry = await this.users.findByUpn(upn);
@@ -4112,8 +4145,11 @@ class HeaderProxyAuth {
         }
       }
     }
-    if (!entry || entry.disabled)
+    if (!entry || entry.disabled) {
+      console.warn(`[HeaderAuth][debug] identifyFromHeaders: UPN "${upn}" did not resolve to an active allowlist entry (entry=${entry ? "disabled" : "missing"}). email=${email ?? "(none)"} displayName=${displayName ?? "(none)"}. All headers received:
+${dumpHeaders(headers)}`);
       return null;
+    }
     if (!entry.email && email || !entry.displayName && displayName) {
       await this.users.materializeFromHeaders(entry.id, { email, displayName }).catch(() => {
       });
@@ -4484,4 +4520,4 @@ function getAuditQuery() {
 }
 
 export { LocalComputeServerStore as L, MAX_PAGE_LIMIT as M, ProviderError as P, getAuditQuery as a, branding as b, getOrganizationProvider as c, getInviteStore as d, getUserProfileStore as e, flag as f, getAuthProvider as g, getProjectProvider as h, getDefinitionMeta as i, getComputeServerConfigStore as j, getPlatformProjectGrantStore as k, getPermissionStore as l, getStorageProvider as m, getDataProvider as n, isOrgServer as o, providers as p, isPlatformServer as q, definitionService as r, definitionPaths as s, tenancy as t };
-//# sourceMappingURL=providers.server-gJvnJT_K.js.map
+//# sourceMappingURL=providers.server-CuhJFeVB.js.map