@vibesdotdev/kit 0.0.0-stage → 1.0.0-rc.3

package/dist/lib/server/hooks/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * VibesKit Hooks - SvelteKit hooks integration
+ *
+ * Provides composable, reusable hooks for SvelteKit applications including:
+ * - Authentication and authorization
+ * - Security headers and middleware
+ * - Maintenance mode
+ * - User context enhancement
+ * - Error handling
+ */
+export { createVibesHandle, createBasicVibesHandle } from './handle';
+export type { VibesHandleConfig, SecurityConfig } from './handle';
+export { createMaintenanceHandle } from './maintenance';
+export type { MaintenanceConfig } from './maintenance';
+export { createAuthHandle, createAuthWrapperHandle, isPublicRoute, isAssetRequest } from './auth';
+export type { AuthConfig } from './auth';
+export { applySecurityHeaders, matchSecurityProfile, applySecurityProfile } from './security';
+export type { CSPConfig, SecurityHeadersConfig, SecurityPattern } from './security';
+export { createCacheControlHandle, applyCacheControl } from './cache';
+export type { CacheControlOptions } from './cache';
+export { enhanceUserContext, createPreferenceLoader } from './context';
+export type { ContextLoaders, PreferenceDatabase, PreferenceTable, UserContextConfig } from './context';
+export { createActivityHandle, shouldSkipActivityLogging } from './activity';
+export type { ActivityConfig, ActivityLogEntry, ActivityLoggerFunction, ActivityProperties } from './activity';
+export { createVibesErrorHandler, serializeError } from './errors';
+export type { ErrorHandlerConfig } from './errors';
+export { createUserStatusHandle } from './user-status';
+export type { UserStatusRoutingConfig } from './user-status';
+export { createReferralHandle } from './referral';
+export type { ReferralConfig } from './referral';
+export { createCorsHandle } from './cors';
+export type { CorsHandleOptions } from './cors';

package/dist/lib/server/hooks/index.js

@@ -0,0 +1,31 @@
+/**
+ * VibesKit Hooks - SvelteKit hooks integration
+ *
+ * Provides composable, reusable hooks for SvelteKit applications including:
+ * - Authentication and authorization
+ * - Security headers and middleware
+ * - Maintenance mode
+ * - User context enhancement
+ * - Error handling
+ */
+// Main handle composition
+export { createVibesHandle, createBasicVibesHandle } from './handle';
+// Individual handle creators
+export { createMaintenanceHandle } from './maintenance';
+export { createAuthHandle, createAuthWrapperHandle, isPublicRoute, isAssetRequest } from './auth';
+// Security utilities
+export { applySecurityHeaders, matchSecurityProfile, applySecurityProfile } from './security';
+// Cache control utilities
+export { createCacheControlHandle, applyCacheControl } from './cache';
+// Context enhancement
+export { enhanceUserContext, createPreferenceLoader } from './context';
+// Activity logging
+export { createActivityHandle, shouldSkipActivityLogging } from './activity';
+// Error handling
+export { createVibesErrorHandler, serializeError } from './errors';
+// User status routing
+export { createUserStatusHandle } from './user-status';
+// Referral attribution
+export { createReferralHandle } from './referral';
+// CORS
+export { createCorsHandle } from './cors';

package/dist/lib/server/hooks/maintenance.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Maintenance mode handle for SvelteKit
+ *
+ * Provides a reusable maintenance mode handler that can redirect users
+ * to a maintenance page or return API error responses.
+ */
+import type { Handle } from '@sveltejs/kit';
+/**
+ * Maintenance mode configuration
+ */
+export interface MaintenanceConfig {
+    /** Whether maintenance mode is enabled */
+    enabled?: boolean;
+    /** Dynamic resolver used when maintenance mode can change at runtime */
+    isEnabled?: () => boolean;
+    /** Paths that are allowed during maintenance (e.g., /api/health) */
+    allowedPaths?: string[];
+    /** Custom maintenance message */
+    message?: string;
+    /** ISO timestamp when maintenance is expected to end */
+    until?: string;
+}
+/**
+ * Create a maintenance mode handle
+ *
+ * @param config - Maintenance configuration
+ * @returns SvelteKit handle function
+ *
+ * @example
+ * ```typescript
+ * const maintenanceHandle = createMaintenanceHandle({
+ *   enabled: runtime.getEnv('MAINTENANCE_ENABLED') === 'true',
+ *   allowedPaths: ['/api/health', '/maintenance'],
+ *   message: runtime.getEnv('MAINTENANCE_MESSAGE')
+ * });
+ * ```
+ */
+export declare function createMaintenanceHandle(config?: MaintenanceConfig): Handle;

package/dist/lib/server/hooks/maintenance.js

@@ -0,0 +1,55 @@
+/**
+ * Maintenance mode handle for SvelteKit
+ *
+ * Provides a reusable maintenance mode handler that can redirect users
+ * to a maintenance page or return API error responses.
+ */
+/**
+ * Create a maintenance mode handle
+ *
+ * @param config - Maintenance configuration
+ * @returns SvelteKit handle function
+ *
+ * @example
+ * ```typescript
+ * const maintenanceHandle = createMaintenanceHandle({
+ *   enabled: runtime.getEnv('MAINTENANCE_ENABLED') === 'true',
+ *   allowedPaths: ['/api/health', '/maintenance'],
+ *   message: runtime.getEnv('MAINTENANCE_MESSAGE')
+ * });
+ * ```
+ */
+export function createMaintenanceHandle(config = {}) {
+    const { allowedPaths = ['/api/health', '/maintenance'], message = 'The system is currently undergoing maintenance. Please try again later.', until } = config;
+    return ({ event, resolve }) => {
+        const pathname = event.url.pathname;
+        const enabled = config.isEnabled?.() ?? config.enabled ?? false;
+        // Skip maintenance checks if disabled or path is allowed
+        if (!enabled || allowedPaths.some((path) => pathname.startsWith(path.trim()))) {
+            return resolve(event);
+        }
+        // Redirect to maintenance page for web requests
+        if (!pathname.startsWith('/api/') && !pathname.startsWith('/public-api/')) {
+            return new Response(null, {
+                status: 302,
+                headers: { location: '/maintenance' }
+            });
+        }
+        // Return maintenance response for API requests
+        if (pathname.startsWith('/api/') || pathname.startsWith('/public-api/')) {
+            return new Response(JSON.stringify({
+                error: 'Service temporarily unavailable',
+                message,
+                maintenance: true,
+                ...(until && { until })
+            }), {
+                status: 503,
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Retry-After': '300' // Suggest retry after 5 minutes
+                }
+            });
+        }
+        return resolve(event);
+    };
+}

package/dist/lib/server/hooks/referral.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Referral attribution hook
+ *
+ * Handles referral attribution for OAuth signups where we can't
+ * intercept the registration action directly.
+ *
+ * Accepts database dependencies via configuration to avoid direct imports —
+ * this module is a shared library and cannot import app-level db modules.
+ */
+import type { Handle } from '@sveltejs/kit';
+export interface ReferralConfig {
+    /** Enable referral attribution hook */
+    enabled: boolean;
+    /** Check whether the user already has a referral attribution */
+    hasExistingReferral: (userId: string) => Promise<boolean>;
+    /** Function to record a referral attribution */
+    recordReferralAttribution: (userId: string, referralCode: string, ipAddress?: string) => Promise<boolean>;
+    /**
+     * Declares that a trusted proxy sets the client-address headers
+     * (`X-Forwarded-For`, `X-Real-IP`). Default `false`: the headers are client
+     * input and are never read; the address is the connection's own.
+     */
+    trustProxy?: boolean;
+}
+/**
+ * Create a referral attribution handle
+ *
+ * This hook checks for pending referral attributions after OAuth signups.
+ * It runs after authentication and checks if:
+ * 1. User is logged in
+ * 2. User was created recently (within threshold)
+ * 3. User doesn't already have a referral attribution
+ * 4. There's a referral cookie present
+ *
+ * @param config - Referral configuration (must include hasExistingReferral and recordReferralAttribution)
+ * @returns SvelteKit handle function
+ */
+export declare function createReferralHandle(config: ReferralConfig): Handle;

package/dist/lib/server/hooks/referral.js

@@ -0,0 +1,91 @@
+/**
+ * Referral attribution hook
+ *
+ * Handles referral attribution for OAuth signups where we can't
+ * intercept the registration action directly.
+ *
+ * Accepts database dependencies via configuration to avoid direct imports —
+ * this module is a shared library and cannot import app-level db modules.
+ */
+import { settle, settleNow } from '../../attempt.js';
+import { failureClass } from '../../failure-class.js';
+import { getClientIpFromHeaders } from '../../utils/client-ip.js';
+import { kitLogger } from '../../kit-logger';
+import { asVibesKitLocals } from '../locals.js';
+const logger = kitLogger('referral-handle');
+const REFERRAL_COOKIE_NAME = 'vibes_ref';
+// Consider a user "just created" if their account is less than 5 minutes old
+const NEW_USER_THRESHOLD_MS = 5 * 60 * 1000;
+/**
+ * The client address to record: the proxy-set headers only when a proxy is
+ * declared, else the connection's address; undefined (unidentified) when the
+ * runtime cannot say. A header is never taken from an undeclared client.
+ */
+function declaredClientAddress(event, trustProxy) {
+    if (trustProxy) {
+        const forwarded = getClientIpFromHeaders(event.request.headers);
+        if (forwarded)
+            return forwarded;
+    }
+    // A runtime that cannot identify the client records attribution without an address.
+    const address = settleNow(() => event.getClientAddress());
+    return address.ok ? address.value : undefined;
+}
+/**
+ * Create a referral attribution handle
+ *
+ * This hook checks for pending referral attributions after OAuth signups.
+ * It runs after authentication and checks if:
+ * 1. User is logged in
+ * 2. User was created recently (within threshold)
+ * 3. User doesn't already have a referral attribution
+ * 4. There's a referral cookie present
+ *
+ * @param config - Referral configuration (must include hasExistingReferral and recordReferralAttribution)
+ * @returns SvelteKit handle function
+ */
+export function createReferralHandle(config) {
+    const { enabled, hasExistingReferral, recordReferralAttribution, trustProxy = false } = config;
+    return async ({ event, resolve }) => {
+        if (!enabled) {
+            return resolve(event);
+        }
+        const user = asVibesKitLocals(event.locals).user;
+        const referralCode = event.cookies.get(REFERRAL_COOKIE_NAME);
+        // Only process if we have both a logged-in user and a referral code
+        if (!user?.id || !referralCode) {
+            return resolve(event);
+        }
+        // Check if user was created recently (likely just signed up)
+        const userCreatedAt = user.createdAt ? new Date(user.createdAt) : null;
+        if (!userCreatedAt) {
+            return resolve(event);
+        }
+        const isNewUser = Date.now() - userCreatedAt.getTime() < NEW_USER_THRESHOLD_MS;
+        if (!isNewUser) {
+            // User is not new, clear the stale referral cookie
+            event.cookies.delete(REFERRAL_COOKIE_NAME, { path: '/' });
+            return resolve(event);
+        }
+        // Check if user already has a referral record
+        const attributed = await settle(async () => {
+            if (await hasExistingReferral(user.id)) {
+                // Already has a referral, clear the cookie
+                event.cookies.delete(REFERRAL_COOKIE_NAME, { path: '/' });
+                return;
+            }
+            // Record the referral attribution
+            const ipAddress = declaredClientAddress(event, trustProxy);
+            const success = await recordReferralAttribution(user.id, referralCode, ipAddress);
+            if (success) {
+                // Clear the cookie after successful attribution
+                event.cookies.delete(REFERRAL_COOKIE_NAME, { path: '/' });
+            }
+        });
+        if (!attributed.ok) {
+            // Referral attribution is declared-optional: log the reason, don't fail the request
+            logger.warn('Referral attribution failed', { reason: failureClass(attributed.error) });
+        }
+        return resolve(event);
+    };
+}

package/dist/lib/server/hooks/security.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Security headers and middleware for SvelteKit hooks
+ *
+ * Provides functions to apply security headers to responses and match
+ * security profiles based on request patterns.
+ */
+import type { RequestEvent } from '@sveltejs/kit';
+/**
+ * Content Security Policy configuration
+ */
+export interface CSPConfig {
+    directives: Record<string, string[]>;
+    reportOnly?: boolean;
+    reportUri?: string;
+}
+/**
+ * Security headers configuration
+ */
+export interface SecurityHeadersConfig {
+    frameOptions?: 'DENY' | 'SAMEORIGIN' | string;
+    hsts?: boolean;
+    noSniff?: boolean;
+    xssProtection?: boolean;
+    csp?: CSPConfig;
+}
+/**
+ * Security profile pattern matching
+ */
+export interface SecurityPattern {
+    match: string;
+    profile: 'api' | 'upload' | 'admin' | 'publicReadOnly' | 'none' | 'custom';
+}
+/**
+ * Apply security headers to a response
+ * Handles immutable response headers gracefully (e.g., from redirects)
+ *
+ * @param response - Response object from resolve()
+ * @param config - Security headers configuration
+ * @param options - Additional options (e.g., isDev)
+ * @returns Response with security headers applied
+ */
+export declare function applySecurityHeaders(response: Response, config?: SecurityHeadersConfig, options?: {
+    isDev?: boolean;
+}): Response;
+/**
+ * Match a pathname against security patterns to determine which profile to apply
+ *
+ * @param pathname - Request pathname
+ * @param patterns - Array of security patterns to match against
+ * @returns Security profile name or null if no match
+ */
+export declare function matchSecurityProfile(pathname: string, patterns: SecurityPattern[]): SecurityPattern['profile'] | null;
+/**
+ * Apply security middleware based on matched profile
+ * Uses existing securityConfigs from vibeskit/middleware
+ *
+ * @param event - SvelteKit request event
+ * @param profile - Security profile to apply
+ */
+export declare function applySecurityProfile(event: RequestEvent, profile: SecurityPattern['profile']): void;

package/dist/lib/server/hooks/security.js

@@ -0,0 +1,92 @@
+/**
+ * Security headers and middleware for SvelteKit hooks
+ *
+ * Provides functions to apply security headers to responses and match
+ * security profiles based on request patterns.
+ */
+import { minimatch } from 'minimatch';
+import { settleNow } from '../../attempt.js';
+import { securityConfigs } from '../middleware/security';
+/**
+ * Apply security headers to a response
+ * Handles immutable response headers gracefully (e.g., from redirects)
+ *
+ * @param response - Response object from resolve()
+ * @param config - Security headers configuration
+ * @param options - Additional options (e.g., isDev)
+ * @returns Response with security headers applied
+ */
+export function applySecurityHeaders(response, config = {}, options = {}) {
+    const { frameOptions = 'DENY', hsts = !options.isDev, noSniff = true, xssProtection = true, csp } = config;
+    // best-effort: a response with immutable headers (a redirect) keeps what it has
+    if (!settleNow(() => {
+        // X-Content-Type-Options
+        if (noSniff) {
+            response.headers.set('X-Content-Type-Options', 'nosniff');
+        }
+        // X-Frame-Options
+        if (frameOptions) {
+            response.headers.set('X-Frame-Options', frameOptions);
+        }
+        // X-XSS-Protection
+        if (xssProtection) {
+            response.headers.set('X-XSS-Protection', '1; mode=block');
+        }
+        // Referrer Policy
+        response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+        // Permissions Policy
+        response.headers.set('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
+        // HSTS (only in production)
+        if (hsts) {
+            response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
+        }
+        // Content Security Policy
+        if (csp) {
+            const cspString = Object.entries(csp.directives)
+                .map(([directive, values]) => `${directive} ${values.join(' ')}`)
+                .join('; ');
+            const headerName = csp.reportOnly
+                ? 'Content-Security-Policy-Report-Only'
+                : 'Content-Security-Policy';
+            response.headers.set(headerName, cspString);
+        }
+    }).ok) {
+        return response;
+    }
+    return response;
+}
+/**
+ * Match a pathname against security patterns to determine which profile to apply
+ *
+ * @param pathname - Request pathname
+ * @param patterns - Array of security patterns to match against
+ * @returns Security profile name or null if no match
+ */
+export function matchSecurityProfile(pathname, patterns) {
+    for (const { match, profile } of patterns) {
+        if (minimatch(pathname, match)) {
+            return profile;
+        }
+    }
+    return null;
+}
+/**
+ * Apply security middleware based on matched profile
+ * Uses existing securityConfigs from vibeskit/middleware
+ *
+ * @param event - SvelteKit request event
+ * @param profile - Security profile to apply
+ */
+export function applySecurityProfile(event, profile) {
+    if (profile === 'none') {
+        return; // No security middleware
+    }
+    // Apply the appropriate security config from middleware
+    // Only apply known profiles - 'custom' and unknown profiles are skipped
+    if (isConfiguredProfile(profile)) {
+        securityConfigs[profile](event);
+    }
+}
+function isConfiguredProfile(profile) {
+    return Object.hasOwn(securityConfigs, profile);
+}

package/dist/lib/server/hooks/user-status.d.ts

@@ -0,0 +1,72 @@
+/**
+ * User status routing middleware
+ *
+ * Redirects users based on their account status (pending, active, suspended, banned)
+ * to appropriate route groups.
+ *
+ * Accepts database dependencies via configuration to avoid direct imports —
+ * this module is a shared library and cannot import app-level db modules.
+ */
+import { type Handle } from '@sveltejs/kit';
+import * as z from 'zod/v4';
+declare const UserStatusSchema: z.ZodEnum<{
+    pending: "pending";
+    active: "active";
+    suspended: "suspended";
+    banned: "banned";
+}>;
+/** The account status the routing handle resolves; `src/globals.d.ts` augments `App.Locals` with it. */
+export type UserStatus = z.infer<typeof UserStatusSchema>;
+/**
+ * Route group configuration for user status routing
+ */
+export interface UserStatusRoutingConfig {
+    /** Enable user status routing */
+    enabled: boolean;
+    /** Resolve the current status for a user through the owning app/runtime */
+    resolveUserStatus: (userId: string) => Promise<UserStatus | null>;
+    /** Routes that pending users are redirected to */
+    pendingRoutes: string[];
+    /** Routes that active users should not access (they get redirected away) */
+    pendingOnlyRoutes: string[];
+    /** Where to redirect banned users */
+    bannedRedirect: string;
+    /** Where to redirect suspended users */
+    suspendedRedirect: string;
+    /** Where to redirect pending users trying to access active-only routes */
+    pendingRedirect: string;
+    /** Where to redirect active users trying to access pending-only routes */
+    activeRedirect: string;
+    /** Routes that bypass status checking (e.g., API, auth, assets) */
+    bypassRoutes: string[];
+}
+/**
+ * Create a user status routing handle
+ *
+ * This handle checks the user's account status and redirects them
+ * to appropriate routes based on their status:
+ * - pending: Can only access pending routes
+ * - active: Can access all routes except pending-only routes
+ * - suspended: Redirected to suspended page
+ * - banned: Redirected to banned page
+ *
+ * @param config - User status routing configuration (must include resolveUserStatus)
+ * @returns SvelteKit handle function
+ *
+ * @example
+ * ```typescript
+ * const userStatusHandle = createUserStatusHandle({
+ *   enabled: true,
+ *   resolveUserStatus: (userId) => authRuntime.resolveUserStatus(userId),
+ *   pendingRoutes: ['/pending/**'],
+ *   pendingOnlyRoutes: ['/pending/**'],
+ *   bannedRedirect: '/banned',
+ *   suspendedRedirect: '/suspended',
+ *   pendingRedirect: '/pending',
+ *   activeRedirect: '/dashboard',
+ *   bypassRoutes: ['/api/**', '/auth/**']
+ * });
+ * ```
+ */
+export declare function createUserStatusHandle(config: Pick<UserStatusRoutingConfig, 'resolveUserStatus'> & Partial<Omit<UserStatusRoutingConfig, 'resolveUserStatus'>>): Handle;
+export {};

package/dist/lib/server/hooks/user-status.js

@@ -0,0 +1,142 @@
+/**
+ * User status routing middleware
+ *
+ * Redirects users based on their account status (pending, active, suspended, banned)
+ * to appropriate route groups.
+ *
+ * Accepts database dependencies via configuration to avoid direct imports —
+ * this module is a shared library and cannot import app-level db modules.
+ */
+import { redirect } from '@sveltejs/kit';
+import * as z from 'zod/v4';
+import { asVibesKitLocals } from '../locals.js';
+const UserStatusSchema = z.enum(['pending', 'active', 'suspended', 'banned']);
+const DEFAULT_CONFIG = {
+    enabled: true,
+    pendingRoutes: ['/pending', '/pending/**'],
+    pendingOnlyRoutes: ['/pending', '/pending/**'],
+    bannedRedirect: '/banned',
+    suspendedRedirect: '/suspended',
+    pendingRedirect: '/pending',
+    activeRedirect: '/dashboard',
+    bypassRoutes: [
+        '/api/**',
+        '/auth/**',
+        '/_app/**',
+        '/favicon.ico',
+        '/robots.txt',
+        '/sitemap.xml',
+        '/banned',
+        '/suspended',
+        '/restricted',
+        '/maintenance'
+    ]
+};
+/**
+ * Check if pathname matches any of the patterns
+ */
+function matchesPattern(pathname, patterns) {
+    return patterns.some((pattern) => {
+        // Exact match
+        if (pathname === pattern)
+            return true;
+        // Glob match with **
+        if (pattern.endsWith('/**')) {
+            const prefix = pattern.slice(0, -3);
+            return pathname === prefix || pathname.startsWith(`${prefix}/`);
+        }
+        // Prefix match
+        return pathname.startsWith(`${pattern}/`);
+    });
+}
+/**
+ * Create a user status routing handle
+ *
+ * This handle checks the user's account status and redirects them
+ * to appropriate routes based on their status:
+ * - pending: Can only access pending routes
+ * - active: Can access all routes except pending-only routes
+ * - suspended: Redirected to suspended page
+ * - banned: Redirected to banned page
+ *
+ * @param config - User status routing configuration (must include resolveUserStatus)
+ * @returns SvelteKit handle function
+ *
+ * @example
+ * ```typescript
+ * const userStatusHandle = createUserStatusHandle({
+ *   enabled: true,
+ *   resolveUserStatus: (userId) => authRuntime.resolveUserStatus(userId),
+ *   pendingRoutes: ['/pending/**'],
+ *   pendingOnlyRoutes: ['/pending/**'],
+ *   bannedRedirect: '/banned',
+ *   suspendedRedirect: '/suspended',
+ *   pendingRedirect: '/pending',
+ *   activeRedirect: '/dashboard',
+ *   bypassRoutes: ['/api/**', '/auth/**']
+ * });
+ * ```
+ */
+export function createUserStatusHandle(config) {
+    const mergedConfig = { ...DEFAULT_CONFIG, ...config };
+    return async ({ event, resolve }) => {
+        const locals = asVibesKitLocals(event.locals);
+        // Skip if disabled
+        if (!mergedConfig.enabled) {
+            return resolve(event);
+        }
+        const pathname = event.url.pathname;
+        // Skip bypass routes (API, auth, assets, etc.)
+        if (matchesPattern(pathname, mergedConfig.bypassRoutes)) {
+            return resolve(event);
+        }
+        // Skip if no authenticated user
+        if (!locals.user?.id) {
+            return resolve(event);
+        }
+        // Get fresh user status from the owning app/runtime
+        const status = await config.resolveUserStatus(locals.user.id);
+        // If we can't get status, allow the request to proceed
+        // (the route's own guards will handle it)
+        if (!status) {
+            return resolve(event);
+        }
+        // A status this handle does not know is not "active": refuse (fail closed).
+        const known = UserStatusSchema.safeParse(status);
+        if (!known.success) {
+            return new Response(JSON.stringify({
+                error: { message: 'Account status not recognized', code: 'user-status-unrecognized' }
+            }), { status: 403, headers: { 'Content-Type': 'application/json' } });
+        }
+        // Handle each status
+        switch (known.data) {
+            case 'banned':
+                // Always redirect to banned page unless already there
+                if (pathname !== mergedConfig.bannedRedirect) {
+                    throw redirect(302, mergedConfig.bannedRedirect);
+                }
+                break;
+            case 'suspended':
+                // Always redirect to suspended page unless already there
+                if (pathname !== mergedConfig.suspendedRedirect) {
+                    throw redirect(302, mergedConfig.suspendedRedirect);
+                }
+                break;
+            case 'pending':
+                // Pending users can only access pending routes
+                if (!matchesPattern(pathname, mergedConfig.pendingRoutes)) {
+                    throw redirect(302, mergedConfig.pendingRedirect);
+                }
+                break;
+            case 'active':
+                // Active users should not access pending-only routes
+                if (matchesPattern(pathname, mergedConfig.pendingOnlyRoutes)) {
+                    throw redirect(302, mergedConfig.activeRedirect);
+                }
+                break;
+        }
+        // Add status to locals for use by routes
+        locals.userStatus = known.data;
+        return resolve(event);
+    };
+}