@vibesdotdev/kit 1.0.0-rc.3 → 1.0.0-rc.4

package/dist/lib/server/handles/active-org.d.ts

@@ -47,6 +47,18 @@ interface ActiveOrgCookieOptions {
     maxAge: number;
     domain?: string;
 }
+/**
+ * The caller's validated org-membership id set, or `null` when NEITHER
+ * userContext (account-web) nor a JWT `orgs` claim is available to validate
+ * against (legacy token). Header validation treats `null` as fail-closed, and
+ * so must any other caller deciding whether a request may name an org.
+ */
+export declare function verifiedMembershipOrgIds(locals: {
+    userContext?: unknown;
+    user?: {
+        orgs?: unknown;
+    } | null;
+}): Set<string> | null;
 /**
  * Create a handle that reads the activeOrg cookie and populates
  * event.locals.activeOrgId.

package/dist/lib/server/handles/active-org.js

@@ -43,9 +43,10 @@ export const ACTIVE_ORG_HEADER_NAME = 'x-vibes-active-org';
 /**
  * The caller's validated org-membership id set, or `null` when NEITHER
  * userContext (account-web) nor a JWT `orgs` claim is available to validate
- * against (legacy token). Header validation treats `null` as fail-closed.
+ * against (legacy token). Header validation treats `null` as fail-closed, and
+ * so must any other caller deciding whether a request may name an org.
  */
-function membershipIds(locals) {
+export function verifiedMembershipOrgIds(locals) {
     const orgs = readUserContext(locals)?.organizations;
     if (orgs) {
         return new Set(orgs.map((org) => org.id));
@@ -96,7 +97,7 @@ export function createActiveOrgHandle() {
         // user-scoped data while believing it acts as the org.
         const headerOrgId = event.request.headers.get(ACTIVE_ORG_HEADER_NAME)?.trim();
         if (headerOrgId) {
-            const members = membershipIds(locals);
+            const members = verifiedMembershipOrgIds(locals);
             if (!members || !members.has(headerOrgId)) {
                 return forbiddenActiveOrgResponse();
             }

package/dist/lib/server/handles/index.d.ts

@@ -28,7 +28,7 @@ export { createUserContextHandle, invalidateUserContext } from './user-context.j
 export type { UserContextHandleOptions } from './user-context.js';
 export { checkProjectAccessViaProjectsApi, createActiveProjectHandle, invalidateActiveProjectAccess, readActiveProjectCookie, setActiveProjectCookie, ACTIVE_PROJECT_COOKIE_NAME } from './active-project.js';
 export type { ActiveProjectHandleOptions, ProjectAccessFetcher } from './active-project.js';
-export { createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, ACTIVE_ORG_HEADER_NAME } from './active-org.js';
+export { createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, ACTIVE_ORG_HEADER_NAME, verifiedMembershipOrgIds } from './active-org.js';
 export { createOrgMembershipHandle } from './org-membership.js';
 export { scopeFromLocals, tryScopeFromLocals } from './scope.js';
 export type { VibesScope } from './scope.js';

package/dist/lib/server/handles/index.js

@@ -26,7 +26,7 @@
  */
 export { createUserContextHandle, invalidateUserContext } from './user-context.js';
 export { checkProjectAccessViaProjectsApi, createActiveProjectHandle, invalidateActiveProjectAccess, readActiveProjectCookie, setActiveProjectCookie, ACTIVE_PROJECT_COOKIE_NAME } from './active-project.js';
-export { createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, ACTIVE_ORG_HEADER_NAME } from './active-org.js';
+export { createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, ACTIVE_ORG_HEADER_NAME, verifiedMembershipOrgIds } from './active-org.js';
 export { createOrgMembershipHandle } from './org-membership.js';
 export { scopeFromLocals, tryScopeFromLocals } from './scope.js';
 export { actingScopeFromLocals, matchesActingOwner } from './acting-scope.js';

package/dist/lib/server/index.d.ts

@@ -40,7 +40,7 @@ export type { FormActionConfig } from './action';
 export { vibesLayoutLoad as vibesLayout, vibesLayoutAuth, vibesLayoutFeature } from './layout/load';
 export type { VibesLayoutLoadOptions, FeatureGateOptions } from './layout/load';
 export { createVibesHandle, createBasicVibesHandle, createVibesErrorHandler, createMaintenanceHandle, createAuthHandle, createAuthWrapperHandle, createActivityHandle, applySecurityHeaders, matchSecurityProfile, applySecurityProfile, enhanceUserContext, createPreferenceLoader, shouldSkipActivityLogging, isPublicRoute, isAssetRequest, serializeError, createCacheControlHandle, applyCacheControl, createCorsHandle } from './hooks';
-export { createUserContextHandle, invalidateUserContext, createActiveProjectHandle, checkProjectAccessViaProjectsApi, invalidateActiveProjectAccess, readActiveProjectCookie, setActiveProjectCookie, ACTIVE_PROJECT_COOKIE_NAME, createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, createOrgMembershipHandle, scopeFromLocals, tryScopeFromLocals, actingScopeFromLocals, matchesActingOwner, createAuthEnforcementHandle, createActiveUserGateHandle, createDemoAwareAuthEnforcementHandle, createDemoAwareActiveUserGateHandle, createDemoBannerHandle, createPermissionFetchHandle, invalidatePermissionCache } from './handles';
+export { createUserContextHandle, invalidateUserContext, createActiveProjectHandle, checkProjectAccessViaProjectsApi, invalidateActiveProjectAccess, readActiveProjectCookie, setActiveProjectCookie, ACTIVE_PROJECT_COOKIE_NAME, createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, verifiedMembershipOrgIds, createOrgMembershipHandle, scopeFromLocals, tryScopeFromLocals, actingScopeFromLocals, matchesActingOwner, createAuthEnforcementHandle, createActiveUserGateHandle, createDemoAwareAuthEnforcementHandle, createDemoAwareActiveUserGateHandle, createDemoBannerHandle, createPermissionFetchHandle, invalidatePermissionCache } from './handles';
 export type { UserContextHandleOptions, AuthEnforcementOptions, ActiveUserGateOptions, ActiveUserStatus, PermissionFetchHandleOptions, VibesScope, ActingScope } from './handles';
 export type { VibesHandleConfig, SecurityConfig, MaintenanceConfig, AuthConfig, ActivityConfig, ActivityLogEntry, ActivityLoggerFunction, CSPConfig, SecurityHeadersConfig, SecurityPattern, ContextLoaders, UserContextConfig, ErrorHandlerConfig, CacheControlOptions } from './hooks';
 export type { VibesConfig, VibesHandler, VibesContext, AuthConfig as VibesAuthConfig, RateLimitConfig, CachingConfig, BillingConfig, ValidationConfig, MetadataConfig } from '../types';

package/dist/lib/server/index.js

@@ -44,7 +44,7 @@ export { vibesLayoutLoad as vibesLayout, vibesLayoutAuth, vibesLayoutFeature } f
 // Hooks integration for SvelteKit
 export { createVibesHandle, createBasicVibesHandle, createVibesErrorHandler, createMaintenanceHandle, createAuthHandle, createAuthWrapperHandle, createActivityHandle, applySecurityHeaders, matchSecurityProfile, applySecurityProfile, enhanceUserContext, createPreferenceLoader, shouldSkipActivityLogging, isPublicRoute, isAssetRequest, serializeError, createCacheControlHandle, applyCacheControl, createCorsHandle } from './hooks';
 // Composable handles for the handle chain
-export { createUserContextHandle, invalidateUserContext, createActiveProjectHandle, checkProjectAccessViaProjectsApi, invalidateActiveProjectAccess, readActiveProjectCookie, setActiveProjectCookie, ACTIVE_PROJECT_COOKIE_NAME, createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, createOrgMembershipHandle, scopeFromLocals, tryScopeFromLocals, actingScopeFromLocals, matchesActingOwner, createAuthEnforcementHandle, createActiveUserGateHandle, createDemoAwareAuthEnforcementHandle, createDemoAwareActiveUserGateHandle, createDemoBannerHandle, createPermissionFetchHandle, invalidatePermissionCache } from './handles';
+export { createUserContextHandle, invalidateUserContext, createActiveProjectHandle, checkProjectAccessViaProjectsApi, invalidateActiveProjectAccess, readActiveProjectCookie, setActiveProjectCookie, ACTIVE_PROJECT_COOKIE_NAME, createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, verifiedMembershipOrgIds, createOrgMembershipHandle, scopeFromLocals, tryScopeFromLocals, actingScopeFromLocals, matchesActingOwner, createAuthEnforcementHandle, createActiveUserGateHandle, createDemoAwareAuthEnforcementHandle, createDemoAwareActiveUserGateHandle, createDemoBannerHandle, createPermissionFetchHandle, invalidatePermissionCache } from './handles';
 // Helper functions
 export { 
 // Authentication helpers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibesdotdev/kit",
-  "version": "1.0.0-rc.3",
+  "version": "1.0.0-rc.4",
   "dependencies": {
     "@codemirror/autocomplete": "^6.20.4",
     "@codemirror/commands": "^6.11.1",
@@ -47,15 +47,15 @@
     "tailwind-variants": "^3.3.1",
     "tw-animate-css": "^1.4.0",
     "vaul-svelte": "^1.0.0-next.7",
-    "@vibesdotdev/surface-sveltekit": "^1.0.0-rc.3"
+    "@vibesdotdev/surface-sveltekit": "^1.0.0-rc.4"
   },
   "peerDependencies": {
     "@humanspeak/svelte-markdown": "^1.9.5",
     "@iconify/svelte": "^5.2.3",
     "@sveltejs/kit": "^2.70.3",
-    "@vibesdotdev/config": "^1.0.0-rc.3",
-    "@vibesdotdev/infra-core": "^1.0.0-rc.3",
-    "@vibesdotdev/kernel": "^1.0.0-rc.6",
+    "@vibesdotdev/config": "^1.0.0-rc.4",
+    "@vibesdotdev/infra-core": "^1.0.0-rc.5",
+    "@vibesdotdev/kernel": "^1.0.0-rc.7",
     "drizzle-orm": "^0.45.4",
     "svelte": "^5.57.2",
     "tailwindcss": "^4.3.3",
@@ -1363,10 +1363,10 @@
     "ui-components",
     "typescript"
   ],
-  "gitHead": "2497670f26b07dcb1509d8d3d9a8cdb6d3c48ad2",
+  "gitHead": "6bbec0948115ec8da30b8ca050834c1ce81678ad",
   "_vibes_source": {
     "repo": "ssh://git@git.vibes.dev/vibesdotdev/kit.git",
-    "sha": "2497670f26b07dcb1509d8d3d9a8cdb6d3c48ad2",
-    "workspaceDigest": "sha256:1074d90f7afb4b90cadf570abc635c4c592019898cc7e547706e7553261e97de"
+    "sha": "6bbec0948115ec8da30b8ca050834c1ce81678ad",
+    "workspaceDigest": "sha256:56faf7a330d6e35063c1d928c6f3afa4237c70bfa499b3be765e84e88e3b921f"
   }
 }