@vibesdotdev/kit 0.0.0-stage → 1.0.0-rc.4

package/dist/lib/server/hooks/errors.js

@@ -0,0 +1,339 @@
+/**
+ * Error handling for SvelteKit hooks
+ *
+ * Provides createVibesErrorHandler() for standardized error handling
+ * with logging, exception capture, and environment-aware error responses.
+ *
+ * A thrown value is untrusted: it may carry a getter that throws, sit behind a
+ * Proxy, be circular, or hold a huge payload. `serializeError` therefore reads
+ * only a fixed set of well-known fields through guarded parses, copies only
+ * plain data properties (never invoking a custom getter), bounds every text and
+ * payload it keeps, and redacts credential-named fields. It never throws.
+ */
+import * as z from 'zod/v4';
+import { kitLogger } from '../../kit-logger';
+import { settle, settleNow } from '../../attempt.js';
+import { failureClass } from '../../failure-class.js';
+import { asVibesKitLocals } from '../locals.js';
+const logger = kitLogger('vibeskit-errors');
+/** Longest message, name, code or cause text kept from a thrown value. */
+const MAX_TEXT_LENGTH = 2_000;
+/** Longest stack kept from a thrown value. */
+const MAX_STACK_LENGTH = 10_000;
+/** Most custom properties copied from a thrown value. */
+const MAX_EXTRA_PROPERTIES = 25;
+/** Longest JSON text kept for one custom property; a larger one is omitted. */
+const MAX_EXTRA_JSON_LENGTH = 2_000;
+/** Field names whose values never leave through a diagnostic. */
+const CREDENTIAL_FIELD = /pass(word)?|secret|token|authorization|cookie|credential|api[-_]?key|session/i;
+const REDACTED = '[redacted]';
+const UNKNOWN_MESSAGE = 'Unknown error';
+function isObjectOrFunction(value) {
+    return (typeof value === 'object' && value !== null) || typeof value === 'function';
+}
+/**
+ * Every kind of value a `throw` can carry. The boundary parse for a caught
+ * value: a catch clause's value, or SvelteKit's `error`, goes through
+ * `thrownValueOf` before it is serialized.
+ */
+export const ThrownValueSchema = z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.bigint(),
+    z.symbol(),
+    z.null(),
+    z.undefined(),
+    z.custom(isObjectOrFunction)
+]);
+/** The caught value as a `ThrownValue` (the parse accepts every value a `throw` can carry). */
+export function thrownValueOf(caught) {
+    const parsed = ThrownValueSchema.safeParse(caught);
+    return parsed.success ? parsed.data : undefined;
+}
+const MessageField = z.object({ message: z.string().min(1) });
+const NameField = z.object({ name: z.string().min(1) });
+const StackField = z.object({ stack: z.string() });
+const CodeField = z.object({ code: z.string() });
+const StatusField = z.object({ status: z.number() });
+const StatusCodeField = z.object({ statusCode: z.number() });
+const CauseText = z.union([
+    z.string(),
+    z.object({ message: z.string() }).transform((cause) => cause.message)
+]);
+const RESERVED_FIELDS = new Set([
+    'message',
+    'name',
+    'stack',
+    'code',
+    'status',
+    'statusCode'
+]);
+function truncate(text, limit) {
+    return text.length > limit ? `${text.slice(0, limit)}…` : text;
+}
+/**
+ * Whether a thrown value is an object whose fields can be looked at. Functions
+ * are not: a thrown function is described, not inspected.
+ */
+function isInspectable(value) {
+    return value !== null && typeof value === 'object';
+}
+/**
+ * Run `schema` against `input` where reading it may itself fail (a throwing
+ * getter, a Proxy trap). A value that cannot be read carries no such field:
+ * the failed attempt is not reported, because the response must still be
+ * produced and the hostile value is never repeated.
+ */
+export function parseGuarded(schema, input) {
+    const parsed = settleNow(() => schema.safeParse(input));
+    return parsed.ok && parsed.value.success ? parsed.value.data : undefined;
+}
+/** `String(value)` for text that may not be convertible (a throwing toString). */
+function describeGuarded(value) {
+    // A value whose own conversion throws is described generically.
+    const text = settleNow(() => truncate(String(value), MAX_TEXT_LENGTH));
+    return text.ok ? text.value : UNKNOWN_MESSAGE;
+}
+/**
+ * `value instanceof type` for a value that may be hostile: a Proxy whose
+ * prototype trap throws is simply not an instance.
+ */
+export function guardedInstanceOf(value, type) {
+    // A value that cannot be inspected is not an instance of anything.
+    const inspected = settleNow(() => value instanceof type);
+    return inspected.ok && inspected.value;
+}
+/** The thrown value when it is an Error (guarded), else nothing. */
+export function errorInstance(value) {
+    return guardedInstanceOf(value, Error) ? value : undefined;
+}
+/**
+ * An Error for whatever was thrown: the value itself when it is one, else an
+ * Error carrying its bounded description.
+ */
+export function failureAsError(value) {
+    return errorInstance(value) ?? new Error(describeGuarded(value));
+}
+function guardedOwnKeys(source) {
+    // A Proxy whose ownKeys trap throws exposes no custom properties.
+    const keys = settleNow(() => Object.keys(source));
+    return keys.ok ? keys.value : [];
+}
+/**
+ * The JSON text of one custom property, or nothing. Only a plain data property
+ * is read: an accessor is never invoked. Circular, unserializable and oversized
+ * values are omitted, and credential-named fields are redacted at any depth.
+ */
+function extraPropertyJson(source, key) {
+    // best-effort: a custom property that cannot be serialized is omitted
+    const json = settleNow(() => {
+        const descriptor = Object.getOwnPropertyDescriptor(source, key);
+        if (!descriptor || !('value' in descriptor))
+            return undefined;
+        if (CREDENTIAL_FIELD.test(key))
+            return JSON.stringify(REDACTED);
+        return JSON.stringify(descriptor.value, (field, value) => CREDENTIAL_FIELD.test(field) ? REDACTED : value);
+    });
+    if (!json.ok || json.value === undefined)
+        return undefined;
+    return CREDENTIAL_FIELD.test(key) || json.value.length <= MAX_EXTRA_JSON_LENGTH
+        ? json.value
+        : undefined;
+}
+function generateRequestId() {
+    const cryptoObj = globalThis.crypto;
+    if (cryptoObj && 'randomUUID' in cryptoObj) {
+        return cryptoObj.randomUUID();
+    }
+    return `req_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+}
+function resolveRequestId(event) {
+    const localRequestId = asVibesKitLocals(event.locals).requestId?.trim();
+    if (localRequestId) {
+        return localRequestId;
+    }
+    const headerRequestId = event.request.headers.get('x-request-id')?.trim();
+    if (headerRequestId) {
+        return headerRequestId;
+    }
+    return generateRequestId();
+}
+/**
+ * Serialize error objects safely for JSON responses. Never throws, whatever
+ * was thrown; the result is bounded and carries no credential-named values.
+ *
+ * @param error - Error object to serialize
+ * @returns Serializable error object
+ */
+export function serializeError(error) {
+    if (!error) {
+        return { message: UNKNOWN_MESSAGE, name: 'Error' };
+    }
+    if (!isInspectable(error)) {
+        return { message: describeGuarded(error), name: 'Error' };
+    }
+    const message = parseGuarded(MessageField, error)?.message;
+    const serialized = {
+        message: truncate(message ?? describeGuarded(error), MAX_TEXT_LENGTH),
+        name: truncate(parseGuarded(NameField, error)?.name ?? 'Error', MAX_TEXT_LENGTH)
+    };
+    // Add stack trace if available
+    const stack = parseGuarded(StackField, error)?.stack;
+    if (stack !== undefined) {
+        serialized.stack = truncate(stack, MAX_STACK_LENGTH);
+    }
+    // Add error code if available
+    const code = parseGuarded(CodeField, error)?.code;
+    if (code !== undefined) {
+        serialized.code = truncate(code, MAX_TEXT_LENGTH);
+    }
+    // Add status code if available
+    const status = parseGuarded(StatusField, error)?.status ?? parseGuarded(StatusCodeField, error)?.statusCode;
+    if (status !== undefined) {
+        serialized.statusCode = status;
+    }
+    // Add custom properties, bounded
+    let copied = 0;
+    for (const key of guardedOwnKeys(error)) {
+        if (copied >= MAX_EXTRA_PROPERTIES)
+            break;
+        if (RESERVED_FIELDS.has(key))
+            continue;
+        const json = extraPropertyJson(error, key);
+        if (json !== undefined) {
+            serialized[key] = JSON.parse(json);
+            copied++;
+        }
+    }
+    return serialized;
+}
+/**
+ * The text of a serialized error's `cause` (a string, or an object carrying a
+ * message), bounded; undefined when it has none.
+ */
+export function serializedCauseMessage(serialized) {
+    const cause = CauseText.safeParse(serialized.cause);
+    return cause.success ? truncate(cause.data, MAX_TEXT_LENGTH) : undefined;
+}
+/**
+ * Create a vibes error handler for SvelteKit
+ *
+ * Handles errors with logging, exception capture, and environment-aware responses.
+ *
+ * @param config - Error handler configuration
+ * @returns SvelteKit HandleServerError function
+ *
+ * @example
+ * ```typescript
+ * export const handleError = createVibesErrorHandler({
+ *   environment: 'production',
+ *   captureException: async (error) => {
+ *     await sentry.captureException(error);
+ *   },
+ *   logSystemError: async (error, context) => {
+ *     await ActivityLogger.logSystemEvent('system.error', null, context);
+ *   }
+ * });
+ * ```
+ */
+export function createVibesErrorHandler(config = {}) {
+    const { environment = 'production', showDetailedErrors = environment !== 'production', showStackTraces = environment === 'development', captureException, logSystemError } = config;
+    return async ({ error, event, status, message }) => {
+        const requestId = resolveRequestId(event);
+        const locals = asVibesKitLocals(event.locals);
+        locals.requestId = requestId;
+        locals.correlationId = requestId;
+        // Serialize the original error before any wrapping so we do not lose payload fields.
+        const serializedError = serializeError(thrownValueOf(error));
+        const actualError = errorInstance(error) ?? new Error(serializedError.message || message || UNKNOWN_MESSAGE);
+        const causeMessage = serializedCauseMessage(serializedError);
+        // Capture exception to external service (Sentry, PostHog, etc.)
+        if (captureException && status !== 404) {
+            const captured = await settle(() => captureException(actualError));
+            if (!captured.ok) {
+                logger.warn('Exception capture failed', { reason: failureClass(captured.error) });
+            }
+        }
+        // Log critical errors (5xx)
+        if (status >= 500 && logSystemError) {
+            const logged = await settle(() => logSystemError(actualError, {
+                url: event.url.pathname,
+                method: event.request.method,
+                status,
+                userId: locals.user?.id || null,
+                environment,
+                requestId,
+                routeId: event.route?.id || null,
+                serializedError
+            }));
+            if (!logged.ok) {
+                logger.warn('System error logging failed', { reason: failureClass(logged.error) });
+            }
+        }
+        // A server failure (5xx) answers with fixed, value-free facts in every
+        // environment: what the error said (message, stack, cause, code, payload) is
+        // for the log above, never for the response. The request id ties them.
+        const isServerFailure = status >= 500 || (serializedError.statusCode ?? 0) >= 500;
+        if (isServerFailure) {
+            const facts = {
+                status,
+                requestId,
+                method: event.request.method,
+                path: event.url.pathname,
+                routeId: event.route?.id || undefined
+            };
+            return {
+                message: `Internal server error (Request ID: ${requestId})`,
+                name: 'Error',
+                statusCode: Math.max(status, serializedError.statusCode ?? 0),
+                environment,
+                requestId,
+                method: event.request.method,
+                path: event.url.pathname,
+                routeId: event.route?.id || undefined,
+                diagnostic: showDetailedErrors ? facts : undefined,
+                showDetailedErrors,
+                originalStatus: status
+            };
+        }
+        // Development/staging: return detailed error information
+        if (showDetailedErrors) {
+            const detailMessage = serializedError.message || message || UNKNOWN_MESSAGE;
+            const displayMessage = `${detailMessage} (Request ID: ${requestId})`;
+            const diagnosticPayload = {
+                ...serializedError,
+                status,
+                requestId,
+                method: event.request.method,
+                path: event.url.pathname,
+                routeId: event.route?.id || undefined
+            };
+            return {
+                message: displayMessage,
+                name: serializedError.name || 'Error',
+                stack: showStackTraces ? serializedError.stack : undefined,
+                code: serializedError.code || undefined,
+                statusCode: serializedError.statusCode || status,
+                environment,
+                requestId,
+                method: event.request.method,
+                path: event.url.pathname,
+                routeId: event.route?.id || undefined,
+                causeMessage,
+                diagnostic: diagnosticPayload,
+                showDetailedErrors: true,
+                originalStatus: status,
+                originalMessage: message
+            };
+        }
+        // Production: return sanitized error message
+        const sanitizedMessage = status >= 500 ? `Internal server error (Request ID: ${requestId})` : message;
+        return {
+            message: sanitizedMessage,
+            requestId,
+            environment,
+            showDetailedErrors: false
+        };
+    };
+}

package/dist/lib/server/hooks/handle.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Main handle composition for SvelteKit
+ *
+ * Provides createVibesHandle() which composes all vibeskit hooks functionality
+ * into a single, configurable SvelteKit handle function.
+ *
+ * Supports plugin system for extensible middleware.
+ */
+import { type Handle } from '@sveltejs/kit';
+import { type MaintenanceConfig } from './maintenance';
+import { type AuthConfig } from './auth';
+import { type SecurityHeadersConfig, type SecurityPattern } from './security';
+import { type UserContextConfig } from './context';
+import { type ActivityConfig } from './activity';
+import { type UserStatusRoutingConfig } from './user-status';
+import { type ReferralConfig } from './referral';
+import type { VibesPlugin } from '../../types/plugin';
+/**
+ * Security configuration for hooks
+ */
+export interface SecurityConfig {
+    /** Pattern-based security profile matching */
+    patterns: SecurityPattern[];
+    /** Security headers configuration */
+    headers?: SecurityHeadersConfig;
+}
+/**
+ * Complete vibes handle configuration
+ */
+export interface VibesHandleConfig {
+    /** Authentication configuration */
+    auth: AuthConfig;
+    /** Security configuration */
+    security: SecurityConfig;
+    /** User context enhancement */
+    context?: UserContextConfig;
+    /** Maintenance mode */
+    maintenance?: MaintenanceConfig;
+    /** Activity logging */
+    activity?: ActivityConfig;
+    /** User status routing (pending/active/suspended/banned) */
+    userStatus?: UserStatusRoutingConfig;
+    /** Referral attribution */
+    referral?: ReferralConfig;
+    /** Development mode flag */
+    isDev?: boolean;
+    /** Development mode for error detail visibility */
+    developmentMode?: {
+        enabled?: boolean;
+        resolveEnabled?: () => boolean;
+        resolveWarningEnabled?: () => boolean;
+    };
+}
+/**
+ * Create a complete vibes handle with all features
+ *
+ * Composes plugins, maintenance mode, auth, security, and context enhancement
+ * into a single SvelteKit handle function.
+ *
+ * @param config - Vibes handle configuration
+ * @param plugins - Registered plugins map
+ * @param middleware - Additional custom middleware to inject
+ * @param overrides - Configuration overrides
+ * @returns Composed SvelteKit handle function
+ *
+ * @example
+ * ```typescript
+ * export const handle = createVibesHandle({
+ *   auth: {
+ *     handler: betterAuthHandler,
+ *     publicRoutes: ['/', '/auth/**', '/api/health/**'],
+ *     redirectTo: '/auth'
+ *   },
+ *   security: {
+ *     patterns: [
+ *       { match: '/api/upload/**', profile: 'upload' },
+ *       { match: '/api/admin/**', profile: 'admin' },
+ *       { match: '/api/**', profile: 'api' }
+ *     ],
+ *     headers: {
+ *       frameOptions: 'DENY',
+ *       hsts: true
+ *     }
+ *   },
+ *   context: {
+ *     loaders: {
+ *       loadPreferences: async (userId) => getPreferences(userId),
+ *       loadPermissions: true,
+ *       loadBilling: true
+ *     }
+ *   },
+ *   maintenance: {
+ *     enabled: runtime.getEnv('MAINTENANCE_ENABLED') === 'true',
+ *     allowedPaths: ['/api/health', '/maintenance']
+ *   },
+ *   isDev: DEV
+ * });
+ * ```
+ */
+export declare function createVibesHandle(config: VibesHandleConfig, plugins?: Map<string, VibesPlugin>, middleware?: Handle[], overrides?: Partial<VibesHandleConfig>): Handle;
+/**
+ * Simpler handle creator for basic auth + security
+ * Use this if you don't need maintenance mode or context enhancement
+ *
+ * @param config - Basic configuration
+ * @returns SvelteKit handle function
+ */
+export declare function createBasicVibesHandle(config: {
+    auth: AuthConfig;
+    security: SecurityConfig;
+    isDev?: boolean;
+}): Handle;

package/dist/lib/server/hooks/handle.js

@@ -0,0 +1,240 @@
+/**
+ * Main handle composition for SvelteKit
+ *
+ * Provides createVibesHandle() which composes all vibeskit hooks functionality
+ * into a single, configurable SvelteKit handle function.
+ *
+ * Supports plugin system for extensible middleware.
+ */
+import { error as httpError, isHttpError } from '@sveltejs/kit';
+import { sequence } from '@sveltejs/kit/hooks';
+import * as z from 'zod/v4';
+import { settle } from '../../attempt.js';
+import { asVibesKitLocals } from '../locals.js';
+import { parseGuarded } from './errors';
+import { createMaintenanceHandle } from './maintenance';
+import { createAuthHandle, isPublicRoute } from './auth';
+import { applySecurityHeaders, matchSecurityProfile, applySecurityProfile } from './security';
+import { enhanceUserContext } from './context';
+import { createActivityHandle } from './activity';
+import { createUserStatusHandle } from './user-status';
+import { createReferralHandle } from './referral';
+/** A field that keeps its value only when it has the expected type. */
+function lenient(schema) {
+    return schema.optional().catch(undefined);
+}
+/** The fields of an HttpError body this handle reads; other fields pass through. */
+const HttpErrorBodySchema = z.looseObject({
+    message: lenient(z.string()),
+    requestId: lenient(z.string()),
+    statusCode: lenient(z.number()),
+    showDetailedErrors: lenient(z.boolean()),
+    environment: lenient(z.enum(['development', 'staging', 'production'])),
+    showDevelopmentModeWarning: lenient(z.boolean()),
+    stack: lenient(z.string()),
+    name: lenient(z.string()),
+    causeMessage: lenient(z.string())
+});
+/** The fields an HttpError instance itself may carry. */
+const CaughtHttpErrorSchema = z.object({
+    message: lenient(z.string()),
+    stack: lenient(z.string()),
+    name: lenient(z.string())
+});
+function generateRequestId() {
+    const cryptoObj = globalThis.crypto;
+    if (cryptoObj && 'randomUUID' in cryptoObj) {
+        return cryptoObj.randomUUID();
+    }
+    return `req_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+}
+/**
+ * Create a complete vibes handle with all features
+ *
+ * Composes plugins, maintenance mode, auth, security, and context enhancement
+ * into a single SvelteKit handle function.
+ *
+ * @param config - Vibes handle configuration
+ * @param plugins - Registered plugins map
+ * @param middleware - Additional custom middleware to inject
+ * @param overrides - Configuration overrides
+ * @returns Composed SvelteKit handle function
+ *
+ * @example
+ * ```typescript
+ * export const handle = createVibesHandle({
+ *   auth: {
+ *     handler: betterAuthHandler,
+ *     publicRoutes: ['/', '/auth/**', '/api/health/**'],
+ *     redirectTo: '/auth'
+ *   },
+ *   security: {
+ *     patterns: [
+ *       { match: '/api/upload/**', profile: 'upload' },
+ *       { match: '/api/admin/**', profile: 'admin' },
+ *       { match: '/api/**', profile: 'api' }
+ *     ],
+ *     headers: {
+ *       frameOptions: 'DENY',
+ *       hsts: true
+ *     }
+ *   },
+ *   context: {
+ *     loaders: {
+ *       loadPreferences: async (userId) => getPreferences(userId),
+ *       loadPermissions: true,
+ *       loadBilling: true
+ *     }
+ *   },
+ *   maintenance: {
+ *     enabled: runtime.getEnv('MAINTENANCE_ENABLED') === 'true',
+ *     allowedPaths: ['/api/health', '/maintenance']
+ *   },
+ *   isDev: DEV
+ * });
+ * ```
+ */
+export function createVibesHandle(config, plugins, middleware, overrides) {
+    const mergedConfig = { ...config, ...overrides };
+    const { auth, security, context, maintenance, activity, userStatus, referral, isDev = false, developmentMode } = mergedConfig;
+    // Create individual handles
+    const maintenanceHandle = createMaintenanceHandle(maintenance);
+    const authHandle = createAuthHandle(auth);
+    const activityHandle = activity ? createActivityHandle(activity) : null;
+    const userStatusHandle = userStatus?.enabled ? createUserStatusHandle(userStatus) : null;
+    const referralHandle = referral?.enabled !== false && referral ? createReferralHandle(referral) : null;
+    const requestContextHandle = async ({ event, resolve }) => {
+        const incomingRequestId = event.request.headers.get('x-request-id')?.trim();
+        const requestId = incomingRequestId && incomingRequestId.length > 0 ? incomingRequestId : generateRequestId();
+        const locals = asVibesKitLocals(event.locals);
+        locals.requestId = requestId;
+        locals.correlationId = requestId;
+        const environment = isDev ? 'development' : 'production';
+        const developmentModeEnabled = developmentMode?.resolveEnabled?.() ?? developmentMode?.enabled ?? true;
+        const showDevelopmentModeWarning = !isDev && developmentModeEnabled && (developmentMode?.resolveWarningEnabled?.() ?? true);
+        const resolved = await settle(() => resolve(event));
+        if (resolved.ok) {
+            const response = resolved.value;
+            response.headers.set('x-request-id', requestId);
+            response.headers.set('x-correlation-id', requestId);
+            return response;
+        }
+        const caught = resolved.error;
+        // Only a SvelteKit HttpError is enriched; any other failure goes on unchanged.
+        if (isHttpError(caught)) {
+            // An HttpError body is whatever its thrower gave it: parse the fields this
+            // handle reads, drop any that do not have the expected type, and keep
+            // the rest of an object body as it was.
+            const body = parseGuarded(HttpErrorBodySchema, caught.body);
+            const caughtFields = parseGuarded(CaughtHttpErrorSchema, caught);
+            const message = parseGuarded(z.string(), caught.body) ??
+                body?.message ??
+                caughtFields?.message ??
+                'An unexpected error occurred';
+            const showDetailedErrors = body?.showDetailedErrors ?? developmentModeEnabled;
+            const stack = body?.stack ?? caughtFields?.stack;
+            const name = body?.name ?? caughtFields?.name ?? 'HttpError';
+            // A server failure (5xx) never carries what an error said: no stack, cause
+            // text or diagnostic, whatever the thrower attached. Its message is the
+            // thrower's own explicit text, as before.
+            const isServerFailure = caught.status >= 500;
+            const errorBody = {
+                ...body,
+                message,
+                name,
+                statusCode: body?.statusCode ?? caught.status,
+                requestId: body?.requestId ?? requestId,
+                method: event.request.method,
+                path: event.url.pathname,
+                routeId: event.route?.id || undefined,
+                environment: body?.environment ?? environment,
+                showDetailedErrors,
+                showDevelopmentModeWarning: body?.showDevelopmentModeWarning ?? showDevelopmentModeWarning,
+                // Expected errors (HttpError) bypass handleError, so a client error's own
+                // stack is injected here when detailed errors are on.
+                ...(showDetailedErrors && !isServerFailure && { stack }),
+                ...(isServerFailure && { stack: undefined, causeMessage: undefined, diagnostic: undefined })
+            };
+            throw httpError(caught.status, errorBody);
+        }
+        throw caught;
+    };
+    // Create the main application handle
+    const appHandle = async ({ event, resolve }) => {
+        const locals = asVibesKitLocals(event.locals);
+        // 1. Apply security middleware based on route pattern
+        const pathname = event.url.pathname;
+        const securityProfile = matchSecurityProfile(pathname, security.patterns);
+        if (securityProfile) {
+            applySecurityProfile(event, securityProfile);
+        }
+        // 2. Enhance user context if authenticated
+        if (locals.user && context) {
+            await enhanceUserContext(event, context);
+        }
+        // 3. Check authentication for protected routes
+        const isPublic = isPublicRoute(pathname, auth.publicRoutes);
+        if (!isPublic && !locals.user && !pathname.startsWith('/api/auth')) {
+            // This is handled by createAuthHandle in sequence, but we need to
+            // ensure context is set before resolve
+        }
+        // 4. Resolve the request
+        let response = await resolve(event);
+        // 5. Apply security headers to the response
+        response = applySecurityHeaders(response, security.headers, { isDev });
+        return response;
+    };
+    // Compose all handles in sequence
+    // 1. Request context (IDs + headers)
+    // 2. Plugin handles (sorted by priority)
+    // 3. Maintenance mode
+    // 4. Auth
+    // 5. App handle (security, context)
+    // 6. Activity logging
+    // 7. Custom middleware
+    const handles = [];
+    handles.push(requestContextHandle);
+    // Add plugin handles sorted by priority
+    if (plugins && plugins.size > 0) {
+        const pluginList = Array.from(plugins.values())
+            .filter((p) => p.createHandle)
+            .sort((a, b) => (a.priority || 100) - (b.priority || 100));
+        for (const plugin of pluginList) {
+            const pluginHandle = plugin.createHandle();
+            handles.push(pluginHandle);
+        }
+    }
+    // Core handles
+    handles.push(maintenanceHandle, authHandle, appHandle);
+    // User status routing runs after auth so we have user info
+    if (userStatusHandle) {
+        handles.push(userStatusHandle);
+    }
+    // Referral attribution runs after auth (needs user info and createdAt)
+    if (referralHandle) {
+        handles.push(referralHandle);
+    }
+    // Activity handle runs after auth/context so it has user info
+    if (activityHandle) {
+        handles.push(activityHandle);
+    }
+    // Custom middleware last
+    if (middleware && middleware.length > 0) {
+        handles.push(...middleware);
+    }
+    return sequence(...handles);
+}
+/**
+ * Simpler handle creator for basic auth + security
+ * Use this if you don't need maintenance mode or context enhancement
+ *
+ * @param config - Basic configuration
+ * @returns SvelteKit handle function
+ */
+export function createBasicVibesHandle(config) {
+    return createVibesHandle({
+        ...config,
+        context: undefined,
+        maintenance: { enabled: false }
+    });
+}