@vibesdotdev/kit 0.0.0-stage → 1.0.0-rc.4

package/dist/lib/server/handles/active-project.js

@@ -0,0 +1,281 @@
+/**
+ * createActiveProjectHandle — reads the activeProject cookie, VALIDATES that
+ * the signed-in user can access that project, and sets locals.activeProjectId.
+ *
+ * The activeProject cookie scopes all app data queries when set. Because many
+ * project-scoped tables use projectId as their ONLY tenant boundary (no
+ * userId column), a cookie value that is trusted verbatim is a cross-tenant
+ * IDOR: a signed-in user could set `activeProject` to a victim's projectId
+ * and read/mutate the victim's rows. This handle therefore never publishes an
+ * unverified cookie value into locals.
+ *
+ * Validation. Project data is owned solely by app-web (see
+ * `@vibesdotdev/projects` — its API client deliberately has no cloud variant).
+ * The default validator asks app-web `GET /api/projects/:id` with the caller's
+ * session bearer: 2xx means the user owns the project, 401/403/404 means
+ * they do not. Results are cached per (userId, projectId) with a TTL so the
+ * hot path (every authenticated request) does at most one subrequest per user
+ * per TTL window per isolate — the same pattern as `createUserContextHandle`.
+ *
+ * Fail-closed. Whenever access cannot be POSITIVELY confirmed (lookup error,
+ * app-web unreachable, non-owner), `locals.activeProjectId` is set to null and
+ * the request proceeds scoped to "All Projects" (the user's own data). A
+ * project-scoping outage must degrade UX, never widen access.
+ *
+ * app-web itself MUST pass `validateProjectAccess` (a direct DB ownership
+ * lookup) instead of the HTTP default — a worker fetching its own public
+ * hostname can be rejected at the edge (self-loopback), and would recurse
+ * through this very handle.
+ *
+ * Runs AFTER sessionHandle (only reads cookie for authenticated users).
+ */
+import { DEV } from 'esm-env';
+import { kitLogger } from '../../kit-logger';
+import { asVibesKitLocals, requireKitRuntime } from '../locals.js';
+import { vibesServerRequestHeaders } from "../outbound.js";
+import { loadKitConfig } from "../../config/kit.config.descriptor.js";
+import { serviceBindingFetch } from '../services/service-binding-runtime.js';
+import { resolveOption } from '../helpers/resolve-option.js';
+import { settle } from '../../attempt.js';
+import { failureClass } from '../../failure-class.js';
+import { resolveServiceTransportOrigin } from "../services/service-transport.js";
+import { CapabilityError } from '@vibesdotdev/kernel';
+const logger = kitLogger('active-project-handle');
+class ProjectAccessUnavailableError extends CapabilityError {
+    constructor(status) {
+        super('Project access could not be verified', 'UNAVAILABLE', {
+            reason: 'project-access-upstream-failed',
+            details: { status }
+        });
+        this.name = 'ProjectAccessUnavailableError';
+    }
+}
+export const ACTIVE_PROJECT_COOKIE_NAME = 'activeProject';
+// Keyed per runtime port: one runtime's verdicts never answer for another's.
+const accessCaches = new WeakMap();
+function accessCacheFor(runtime) {
+    let cache = accessCaches.get(runtime);
+    if (!cache) {
+        cache = new Map();
+        accessCaches.set(runtime, cache);
+    }
+    return cache;
+}
+// Backstop against unbounded growth in long-lived isolates.
+const ACCESS_CACHE_MAX_ENTRIES = 5000;
+function accessCacheKey(userId, projectId) {
+    return `${userId}:${projectId}`;
+}
+function readAccessCache(runtime, key) {
+    const accessCache = accessCacheFor(runtime);
+    const entry = accessCache.get(key);
+    if (!entry)
+        return null;
+    if (Date.now() > entry.expiresAt) {
+        accessCache.delete(key);
+        return null;
+    }
+    return entry.allowed;
+}
+function writeAccessCache(runtime, key, allowed, ttlMs) {
+    const accessCache = accessCacheFor(runtime);
+    if (accessCache.size >= ACCESS_CACHE_MAX_ENTRIES) {
+        accessCache.clear();
+    }
+    accessCache.set(key, { allowed, expiresAt: Date.now() + ttlMs });
+}
+/**
+ * Invalidate cached project-access verdicts. Call after mutations that change
+ * access (project archived, ownership transferred). With no arguments, clears
+ * the runtime's whole cache.
+ */
+export function invalidateActiveProjectAccess(runtime, userId, projectId) {
+    const accessCache = accessCacheFor(runtime);
+    if (!userId) {
+        accessCache.clear();
+        return;
+    }
+    if (projectId) {
+        accessCache.delete(accessCacheKey(userId, projectId));
+        return;
+    }
+    for (const key of accessCache.keys()) {
+        if (key.startsWith(`${userId}:`))
+            accessCache.delete(key);
+    }
+}
+async function resolveProjectsOrigin(runtime, option) {
+    const fromOption = resolveOption(option, runtime);
+    const explicit = fromOption?.trim();
+    if (explicit)
+        return resolveServiceTransportOrigin(runtime, explicit);
+    const config = await loadKitConfig(runtime);
+    return resolveServiceTransportOrigin(runtime, config.projectsOrigin);
+}
+/** The option's calling convention: a zero-argument function is a getter, anything else a fetcher. */
+function isFetcherGetter(option) {
+    return option.length === 0;
+}
+function resolveFetcher(runtime, option, serviceBindingName) {
+    if (option === null) {
+        return globalFetch;
+    }
+    if (option !== undefined) {
+        if (isFetcherGetter(option)) {
+            const got = option();
+            if (got)
+                return got;
+        }
+        else {
+            return option;
+        }
+    }
+    const fromBinding = serviceBindingFetch(runtime, serviceBindingName);
+    return fromBinding ?? globalFetch;
+}
+/** The runtime's global `fetch`, looked up at call time. */
+const globalFetch = (input, init) => globalThis.fetch(input, init);
+/**
+ * Ask app-web whether the caller can access the project, presenting the
+ * caller's session bearer. `GET /api/projects/:id` is owner-scoped — 2xx
+ * confirms access, 401/403/404 deny it. Any other status is a lookup failure
+ * and throws — callers must treat a throw as "not confirmed" (fail closed).
+ *
+ * This is the handle's default validator (where it is wrapped in a TTL
+ * cache); it is exported so cookie-SETTING endpoints outside app-web
+ * (hq-web / account-web project switchers) can enforce the same ownership
+ * rule before writing the cross-subdomain cookie.
+ */
+export async function checkProjectAccessViaProjectsApi(event, projectId, options = {}) {
+    const serviceBindingName = options.serviceBindingName === undefined ? 'APP_SERVICE' : options.serviceBindingName;
+    const runtime = requireKitRuntime(asVibesKitLocals(event.locals));
+    const fetcher = resolveFetcher(runtime, options.fetcher, serviceBindingName);
+    const origin = await resolveProjectsOrigin(runtime, options.projectsOrigin);
+    const url = `${origin}/api/projects/${encodeURIComponent(projectId)}`;
+    const response = await fetcher(url, {
+        headers: vibesServerRequestHeaders(event, { accept: 'application/json' }, { destination: url })
+    });
+    // Drain/cancel the body so workerd doesn't leak the connection.
+    const body = response.body;
+    if (body) {
+        const cancelled = await settle(() => body.cancel());
+        if (!cancelled.ok) {
+            logger.warn('Projects response body cancellation failed', {
+                reason: failureClass(cancelled.error)
+            });
+        }
+    }
+    if (response.ok)
+        return true;
+    if (response.status === 401 || response.status === 403 || response.status === 404) {
+        return false;
+    }
+    throw new ProjectAccessUnavailableError(response.status);
+}
+/**
+ * Create a handle that reads the activeProject cookie, validates the user's
+ * access to that project, and populates `event.locals.activeProjectId`.
+ *
+ * When activeProjectId is null, the user is viewing "All Projects" (their full data).
+ * When set to a projectId, queries should be scoped to that project — and this
+ * handle guarantees the value has been checked against the user's own projects.
+ *
+ * @example
+ * ```typescript
+ * import { sequence } from '@sveltejs/kit/hooks';
+ * import { createSessionFetchHandle } from '@vibesdotdev/auth/system/session-handle';
+ * import { createActiveProjectHandle } from '../../index.ts/server';
+ *
+ * export const handle = sequence(
+ *   createSessionFetchHandle({ sessionUrl: accountLinks.session }),
+ *   createActiveProjectHandle()
+ * );
+ * ```
+ */
+export function createActiveProjectHandle(options = {}) {
+    const { validateProjectAccess, cacheTtlMs = 60_000 } = options;
+    return async ({ event, resolve }) => {
+        const locals = asVibesKitLocals(event.locals);
+        // Only read activeProject for authenticated users
+        if (!locals.user) {
+            locals.activeProjectId = null;
+            return resolve(event);
+        }
+        const cookieProjectId = readActiveProjectCookie(event.cookies);
+        if (!cookieProjectId) {
+            locals.activeProjectId = null;
+            return resolve(event);
+        }
+        const userId = locals.user.id;
+        const cacheKey = accessCacheKey(userId, cookieProjectId);
+        const runtime = requireKitRuntime(locals);
+        const cached = readAccessCache(runtime, cacheKey);
+        if (cached !== null) {
+            locals.activeProjectId = cached ? cookieProjectId : null;
+            return resolve(event);
+        }
+        const verdict = await settle(async () => {
+            const confirmed = validateProjectAccess
+                ? await validateProjectAccess({ userId, projectId: cookieProjectId, event })
+                : await checkProjectAccessViaProjectsApi(event, cookieProjectId, options);
+            writeAccessCache(runtime, cacheKey, confirmed, cacheTtlMs);
+            return confirmed;
+        });
+        let allowed = false;
+        if (verdict.ok) {
+            allowed = verdict.value;
+        }
+        else {
+            // Fail CLOSED: an unverifiable cookie must never scope queries.
+            // Not cached — the next request retries the lookup.
+            logger.warn('Active project access validation failed; falling back to All Projects', {
+                reason: failureClass(verdict.error)
+            });
+        }
+        locals.activeProjectId = allowed ? cookieProjectId : null;
+        return resolve(event);
+    };
+}
+/**
+ * Read the activeProject cookie value.
+ *
+ * SECURITY: this is the RAW cookie value — attacker-controlled until it has
+ * been validated against the user's projects. Only `createActiveProjectHandle`
+ * (which validates) and cookie-echo endpoints should consume it; never scope a
+ * data query by this value directly.
+ */
+export function readActiveProjectCookie(cookies) {
+    const value = cookies.get(ACTIVE_PROJECT_COOKIE_NAME);
+    return value && value.length > 0 ? value : null;
+}
+/**
+ * Set the activeProject cookie.
+ * Call this from UI handlers when the user switches projects.
+ *
+ * activeProject is a user's CURRENT PROJECT scope and must be shared across every
+ * .vibes.dev app, exactly like the session + `activeOrg` cookies. Callers that
+ * know the base domain (the app, via PUBLIC_VIBES_BASE_DOMAIN) pass it here so
+ * the cookie is `domain=.vibes.dev` and every subdomain sends it. Omit `domain`
+ * (host-only) only in local dev where there is no shared parent domain. Clearing
+ * (projectId=null) must also carry the domain, or the cross-subdomain cookie is
+ * never removed. `sameSite: 'none'` REQUIRES `Secure` — browsers silently DROP a
+ * SameSite=None cookie that isn't Secure. When a cross-subdomain `domain` is set
+ * we are on a real HTTPS origin, so force Secure regardless of how esm-env's DEV
+ * resolves in the worker runtime (it can mis-resolve to true → Secure:false → the
+ * cookie is rejected). Mirrors `setActiveOrgCookie`.
+ *
+ * @param projectId - The projectId to scope to, or null for "All Projects"
+ */
+export function setActiveProjectCookie(cookies, projectId, options) {
+    const maxAge = 60 * 60 * 24 * 365; // 1 year
+    const cookieOptions = {
+        path: '/',
+        httpOnly: true,
+        secure: options?.domain ? true : !DEV,
+        sameSite: 'none',
+        maxAge: projectId ? maxAge : 0
+    };
+    if (options?.domain)
+        cookieOptions.domain = options.domain;
+    cookies.set(ACTIVE_PROJECT_COOKIE_NAME, projectId ?? '', cookieOptions);
+}

package/dist/lib/server/handles/active-team.d.ts

@@ -0,0 +1,88 @@
+/**
+ * createActiveTeamHandle — reads the activeTeam cookie, validates it
+ * against the user's known team memberships (when present), and sets
+ * `locals.activeTeamId`.
+ *
+ * Mirrors `createActiveOrgHandle`. The activeTeam cookie scopes data
+ * queries to a single team within the currently active org. When unset
+ * (or invalidated), `activeTeamId` falls back to null and downstream
+ * scope/loader code treats the user as acting at org-level (not within
+ * a specific team).
+ *
+ * Cookie validation. If `locals.userContext.teamMemberships` is
+ * populated, this handle clears the cookie when it points to a team
+ * the user is no longer a member of. When `userContext` is null or
+ * lacks `teamMemberships`, the cookie passes through and the data
+ * layer is responsible for any membership-aware filtering.
+ *
+ * Apps that need to populate `teamMemberships` should add a fetch to
+ * their `userContextHandle` (or augment the account `/api/account/context`
+ * response with the user's team memberships from app-web). Today,
+ * apps that have not done so will see this handle behave permissively
+ * — cookies pass through and `scope.team` is only populated when
+ * `teamMemberships` is present.
+ */
+import type { Handle } from '@sveltejs/kit';
+export declare const ACTIVE_TEAM_COOKIE_NAME = "activeTeam";
+/** The cookie attributes `setActiveTeamCookie` writes. */
+interface ActiveTeamCookieOptions {
+    path: string;
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: 'none';
+    maxAge: number;
+    domain?: string;
+}
+/**
+ * Create a handle that reads the activeTeam cookie and populates
+ * `event.locals.activeTeamId`.
+ *
+ * When `activeTeamId` is null, the user is acting at org-level (no team
+ * binding). When set, scope.team should be populated by a later handle
+ * (createScopeHandle).
+ *
+ * @example
+ * ```typescript
+ * import { sequence } from '@sveltejs/kit/hooks';
+ * import {
+ *   createActiveOrgHandle,
+ *   createActiveTeamHandle,
+ *   createUserContextHandle
+ * } from '../../index.ts/server';
+ *
+ * export const handle = sequence(
+ *   createUserContextHandle({ accountOrigin }),
+ *   createActiveOrgHandle(),
+ *   createActiveTeamHandle()
+ * );
+ * ```
+ */
+export declare function createActiveTeamHandle(): Handle;
+/**
+ * Read the activeTeam cookie value.
+ */
+export declare function readActiveTeamCookie(cookies: {
+    get: (name: string) => string | undefined;
+}): string | null;
+/**
+ * Set the activeTeam cookie.
+ * Call this from UI handlers when the user switches teams.
+ *
+ * activeTeam is a user's CURRENT TEAM scope and must be shared across every
+ * .vibes.dev app, like the session + `activeOrg`/`activeProject` cookies. Callers
+ * that know the base domain pass it here so the cookie is `domain=.vibes.dev`.
+ * `sameSite: 'none'` REQUIRES `Secure` — browsers silently drop a SameSite=None
+ * cookie that isn't Secure — so force Secure whenever a cross-subdomain `domain`
+ * is set. Clearing (teamId=null) carries the domain + maxAge:0. Mirrors
+ * `setActiveOrgCookie`. (Team switching is not yet wired into any app — this
+ * setter is aligned preemptively so it's correct when team scoping ships.)
+ *
+ * @param teamId - The teamId to scope to, or null to clear
+ */
+export declare function setActiveTeamCookie(cookies: {
+    get: (name: string) => string | undefined;
+    set: (name: string, value: string, options: ActiveTeamCookieOptions) => void;
+}, teamId: string | null, options?: {
+    domain?: string;
+}): void;
+export {};

package/dist/lib/server/handles/active-team.js

@@ -0,0 +1,112 @@
+/**
+ * createActiveTeamHandle — reads the activeTeam cookie, validates it
+ * against the user's known team memberships (when present), and sets
+ * `locals.activeTeamId`.
+ *
+ * Mirrors `createActiveOrgHandle`. The activeTeam cookie scopes data
+ * queries to a single team within the currently active org. When unset
+ * (or invalidated), `activeTeamId` falls back to null and downstream
+ * scope/loader code treats the user as acting at org-level (not within
+ * a specific team).
+ *
+ * Cookie validation. If `locals.userContext.teamMemberships` is
+ * populated, this handle clears the cookie when it points to a team
+ * the user is no longer a member of. When `userContext` is null or
+ * lacks `teamMemberships`, the cookie passes through and the data
+ * layer is responsible for any membership-aware filtering.
+ *
+ * Apps that need to populate `teamMemberships` should add a fetch to
+ * their `userContextHandle` (or augment the account `/api/account/context`
+ * response with the user's team memberships from app-web). Today,
+ * apps that have not done so will see this handle behave permissively
+ * — cookies pass through and `scope.team` is only populated when
+ * `teamMemberships` is present.
+ */
+import { DEV } from 'esm-env';
+import { readUserContext } from './user-context-schema.js';
+export const ACTIVE_TEAM_COOKIE_NAME = 'activeTeam';
+/**
+ * Create a handle that reads the activeTeam cookie and populates
+ * `event.locals.activeTeamId`.
+ *
+ * When `activeTeamId` is null, the user is acting at org-level (no team
+ * binding). When set, scope.team should be populated by a later handle
+ * (createScopeHandle).
+ *
+ * @example
+ * ```typescript
+ * import { sequence } from '@sveltejs/kit/hooks';
+ * import {
+ *   createActiveOrgHandle,
+ *   createActiveTeamHandle,
+ *   createUserContextHandle
+ * } from '../../index.ts/server';
+ *
+ * export const handle = sequence(
+ *   createUserContextHandle({ accountOrigin }),
+ *   createActiveOrgHandle(),
+ *   createActiveTeamHandle()
+ * );
+ * ```
+ */
+export function createActiveTeamHandle() {
+    return async ({ event, resolve }) => {
+        if (!event.locals.user) {
+            event.locals.activeTeamId = null;
+            return resolve(event);
+        }
+        const cookieTeamId = readActiveTeamCookie(event.cookies);
+        event.locals.activeTeamId = cookieTeamId;
+        if (!cookieTeamId) {
+            return resolve(event);
+        }
+        const memberships = readUserContext(event.locals)?.teamMemberships;
+        if (!memberships) {
+            // userContext does not yet include team memberships — defer
+            // validation to the data layer (which can still filter queries
+            // using the cookie value).
+            return resolve(event);
+        }
+        if (!memberships.some((entry) => entry.teamId === cookieTeamId)) {
+            // Cookie points to a team the user is not a member of. Clear it
+            // so downstream scope checks fall back to org-level only.
+            event.locals.activeTeamId = null;
+        }
+        return resolve(event);
+    };
+}
+/**
+ * Read the activeTeam cookie value.
+ */
+export function readActiveTeamCookie(cookies) {
+    const value = cookies.get(ACTIVE_TEAM_COOKIE_NAME);
+    return value && value.length > 0 ? value : null;
+}
+/**
+ * Set the activeTeam cookie.
+ * Call this from UI handlers when the user switches teams.
+ *
+ * activeTeam is a user's CURRENT TEAM scope and must be shared across every
+ * .vibes.dev app, like the session + `activeOrg`/`activeProject` cookies. Callers
+ * that know the base domain pass it here so the cookie is `domain=.vibes.dev`.
+ * `sameSite: 'none'` REQUIRES `Secure` — browsers silently drop a SameSite=None
+ * cookie that isn't Secure — so force Secure whenever a cross-subdomain `domain`
+ * is set. Clearing (teamId=null) carries the domain + maxAge:0. Mirrors
+ * `setActiveOrgCookie`. (Team switching is not yet wired into any app — this
+ * setter is aligned preemptively so it's correct when team scoping ships.)
+ *
+ * @param teamId - The teamId to scope to, or null to clear
+ */
+export function setActiveTeamCookie(cookies, teamId, options) {
+    const maxAge = 60 * 60 * 24 * 365; // 1 year
+    const cookieOptions = {
+        path: '/',
+        httpOnly: true,
+        secure: options?.domain ? true : !DEV,
+        sameSite: 'none',
+        maxAge: teamId ? maxAge : 0
+    };
+    if (options?.domain)
+        cookieOptions.domain = options.domain;
+    cookies.set(ACTIVE_TEAM_COOKIE_NAME, teamId ?? '', cookieOptions);
+}

package/dist/lib/server/handles/active-user-gate.d.ts

@@ -0,0 +1,55 @@
+import type { RequestEvent } from '@sveltejs/kit';
+/**
+ * createActiveUserGateHandle — enforce lifecycle status on protected apps.
+ *
+ * After sessionHandle has populated `event.locals.user`, this handle checks
+ * `locals.user.status` and redirects non-`active` users to a designated URL
+ * (typically the auth app's `/pending`, `/suspended`, `/banned` pages).
+ *
+ * Users without a session are left alone — `createAuthEnforcementHandle` is
+ * the one responsible for forcing sign-in. Keep the two handles in sequence:
+ *
+ *     sequence(
+ *       sessionHandle,                 // populates locals.user
+ *       createActiveUserGateHandle({...}),
+ *       createAuthEnforcementHandle({...})
+ *     )
+ *
+ * Or put the gate AFTER auth enforcement if you prefer. Either order works;
+ * we just skip users with no session.
+ *
+ * API routes: by default return a JSON 403 body describing the status so the
+ * client can show an appropriate UI. Disable via `enforceOnApiRoutes: false`.
+ *
+ * Allowlist: pass `publicRoutes` to let specific paths through even for a
+ * pending user (e.g. `/api/account/me` so the pending page can still fetch
+ * its own data).
+ */
+import { type Handle } from '@sveltejs/kit';
+export type ActiveUserStatus = 'pending' | 'active' | 'suspended' | 'banned';
+export interface ActiveUserGateOptions {
+    /**
+     * Base URL of the auth app. Redirects will hit
+     *   `${authOrigin}/pending` for pending users,
+     *   `${authOrigin}/suspended` for suspended users,
+     *   `${authOrigin}/banned` for banned users.
+     * Can be omitted if you override each target explicitly.
+     */
+    authOrigin?: string | ((event: RequestEvent) => string | Promise<string>);
+    /** Override the full URL for pending users. Defaults to `${authOrigin}/pending`. */
+    pendingRedirectUrl?: string;
+    /** Override for suspended users. Defaults to `${authOrigin}/suspended`. */
+    suspendedRedirectUrl?: string;
+    /** Override for banned users. Defaults to `${authOrigin}/banned`. */
+    bannedRedirectUrl?: string;
+    /**
+     * Routes that should always pass through (supports globs).
+     * Examples: ['/api/health/**', '/api/account/context'].
+     */
+    publicRoutes?: string[];
+    /**
+     * If true (default), API routes return a 403 JSON body instead of redirecting.
+     */
+    enforceOnApiRoutes?: boolean;
+}
+export declare function createActiveUserGateHandle(options?: ActiveUserGateOptions): Handle;

package/dist/lib/server/handles/active-user-gate.js

@@ -0,0 +1,142 @@
+/**
+ * createActiveUserGateHandle — enforce lifecycle status on protected apps.
+ *
+ * After sessionHandle has populated `event.locals.user`, this handle checks
+ * `locals.user.status` and redirects non-`active` users to a designated URL
+ * (typically the auth app's `/pending`, `/suspended`, `/banned` pages).
+ *
+ * Users without a session are left alone — `createAuthEnforcementHandle` is
+ * the one responsible for forcing sign-in. Keep the two handles in sequence:
+ *
+ *     sequence(
+ *       sessionHandle,                 // populates locals.user
+ *       createActiveUserGateHandle({...}),
+ *       createAuthEnforcementHandle({...})
+ *     )
+ *
+ * Or put the gate AFTER auth enforcement if you prefer. Either order works;
+ * we just skip users with no session.
+ *
+ * API routes: by default return a JSON 403 body describing the status so the
+ * client can show an appropriate UI. Disable via `enforceOnApiRoutes: false`.
+ *
+ * Allowlist: pass `publicRoutes` to let specific paths through even for a
+ * pending user (e.g. `/api/account/me` so the pending page can still fetch
+ * its own data).
+ */
+import { json } from '@sveltejs/kit';
+import { minimatch } from 'minimatch';
+import * as z from 'zod/v4';
+import { resolveOption } from '../helpers/resolve-option.js';
+/** The lifecycle status the session JWT carries; an absent status means active. */
+const SessionUserSchema = z.looseObject({ status: z.unknown().optional() });
+const ActiveUserStatusSchema = z.enum(['pending', 'active', 'suspended', 'banned']);
+/**
+ * The user's lifecycle status as the gate reads it. A status the gate does not
+ * define (or a user object it cannot read) is `unrecognised`, which it refuses:
+ * the gate cannot say such a user is active.
+ */
+function readStatus(user) {
+    const session = SessionUserSchema.safeParse(user);
+    if (!session.success)
+        return 'unrecognised';
+    const status = ActiveUserStatusSchema.safeParse(session.data.status ?? 'active');
+    return status.success ? status.data : 'unrecognised';
+}
+function isPublicRoute(pathname, publicRoutes) {
+    return publicRoutes.some((route) => {
+        if (pathname === route)
+            return true;
+        if (route.includes('*'))
+            return minimatch(pathname, route);
+        return pathname.startsWith(`${route}/`);
+    });
+}
+/** A static asset path. Never under `/api/`: an API route named `x.json` is an endpoint, not an asset. */
+function isAssetRequest(pathname) {
+    return !pathname.startsWith('/api/') && /\.[a-zA-Z0-9]+$/.test(pathname);
+}
+async function resolveTarget(status, options, event) {
+    const authOrigin = await resolveOption(options.authOrigin, event);
+    const origin = authOrigin?.replace(/\/$/, '');
+    switch (status) {
+        case 'pending':
+            return options.pendingRedirectUrl ?? (origin ? `${origin}/pending` : '/pending');
+        case 'suspended':
+            return options.suspendedRedirectUrl ?? (origin ? `${origin}/suspended` : '/suspended');
+        case 'banned':
+            return options.bannedRedirectUrl ?? (origin ? `${origin}/banned` : '/banned');
+        case 'active':
+            return null;
+        default:
+            return null;
+    }
+}
+export function createActiveUserGateHandle(options = {}) {
+    const { publicRoutes = [], enforceOnApiRoutes = true } = options;
+    return async ({ event, resolve }) => {
+        const pathname = event.url.pathname;
+        // Assets always through.
+        if (isAssetRequest(pathname))
+            return resolve(event);
+        // No session? Let auth enforcement handle it.
+        if (!event.locals.user)
+            return resolve(event);
+        // Active users never see this handle intervene.
+        const status = readStatus(event.locals.user);
+        if (status === 'active')
+            return resolve(event);
+        // Allowlisted routes bypass even for pending users.
+        if (isPublicRoute(pathname, publicRoutes))
+            return resolve(event);
+        // Fail closed on a status the gate does not define: a fixed, value-free refusal.
+        if (status === 'unrecognised') {
+            if (pathname.startsWith('/api/') && !enforceOnApiRoutes)
+                return resolve(event);
+            const message = 'Your account status is not recognised.';
+            if (pathname.startsWith('/api/')) {
+                return json({ error: { code: 'status_restricted', message } }, { status: 403 });
+            }
+            return new Response(message, {
+                status: 403,
+                headers: { 'Content-Type': 'text/plain' }
+            });
+        }
+        const target = await resolveTarget(status, options, event);
+        if (!target)
+            return resolve(event);
+        if (pathname.startsWith('/api/')) {
+            if (!enforceOnApiRoutes)
+                return resolve(event);
+            return json({
+                error: {
+                    code: 'status_restricted',
+                    status,
+                    message: statusMessage(status),
+                    redirect: target
+                }
+            }, { status: 403 });
+        }
+        // Don't bounce them if they're already on the target (same origin case).
+        const currentUrl = event.url.toString();
+        if (currentUrl === target || currentUrl.startsWith(`${target}?`)) {
+            return resolve(event);
+        }
+        return new Response(null, {
+            status: 302,
+            headers: { Location: target }
+        });
+    };
+}
+function statusMessage(status) {
+    switch (status) {
+        case 'pending':
+            return 'Your account is on the waitlist. An admin needs to approve you before you can access the app.';
+        case 'suspended':
+            return 'Your account is suspended. Contact support to reinstate access.';
+        case 'banned':
+            return 'Your account has been banned.';
+        default:
+            return 'Your account is not active.';
+    }
+}