@vibesdotdev/kit 1.0.0-rc.3 → 1.0.0-rc.5

package/dist/lib/config/sveltekit-version.d.ts

@@ -0,0 +1,22 @@
+/**
+ * SvelteKit `version` config for a Vibes app.
+ *
+ * `version.name` is a build identity: the client offers a reload only when it
+ * changes, and the deploy smoke probe compares it with the commit it shipped.
+ * The deploy's build version therefore wins; an app label is only a fallback
+ * for a build that has none, and a timestamp keeps local builds changing.
+ *
+ * `svelte.config.js` imports this at config-load time (plain Node/Bun, no Vite
+ * transform), so it reads no environment: the caller passes the build version
+ * it read through its own tooling runtime.
+ */
+export declare function createKitVersion({ buildVersion, name, pollInterval, now }?: {
+    /** VIBES_BUILD_VERSION (or the host's commit sha) as the caller read it. */
+    buildVersion?: string;
+    name?: string;
+    pollInterval?: number;
+    now?: () => number;
+}): {
+    name: string;
+    pollInterval: number;
+};

package/dist/lib/config/sveltekit-version.js

@@ -0,0 +1,15 @@
+/**
+ * SvelteKit `version` config for a Vibes app.
+ *
+ * `version.name` is a build identity: the client offers a reload only when it
+ * changes, and the deploy smoke probe compares it with the commit it shipped.
+ * The deploy's build version therefore wins; an app label is only a fallback
+ * for a build that has none, and a timestamp keeps local builds changing.
+ *
+ * `svelte.config.js` imports this at config-load time (plain Node/Bun, no Vite
+ * transform), so it reads no environment: the caller passes the build version
+ * it read through its own tooling runtime.
+ */
+export function createKitVersion({ buildVersion, name, pollInterval = 60_000, now = Date.now } = {}) {
+    return { name: buildVersion || name || String(now()), pollInterval };
+}

package/dist/lib/server/handles/active-org.d.ts

@@ -47,6 +47,18 @@ interface ActiveOrgCookieOptions {
     maxAge: number;
     domain?: string;
 }
+/**
+ * The caller's validated org-membership id set, or `null` when NEITHER
+ * userContext (account-web) nor a JWT `orgs` claim is available to validate
+ * against (legacy token). Header validation treats `null` as fail-closed, and
+ * so must any other caller deciding whether a request may name an org.
+ */
+export declare function verifiedMembershipOrgIds(locals: {
+    userContext?: unknown;
+    user?: {
+        orgs?: unknown;
+    } | null;
+}): Set<string> | null;
 /**
  * Create a handle that reads the activeOrg cookie and populates
  * event.locals.activeOrgId.

package/dist/lib/server/handles/active-org.js

@@ -43,9 +43,10 @@ export const ACTIVE_ORG_HEADER_NAME = 'x-vibes-active-org';
 /**
  * The caller's validated org-membership id set, or `null` when NEITHER
  * userContext (account-web) nor a JWT `orgs` claim is available to validate
- * against (legacy token). Header validation treats `null` as fail-closed.
+ * against (legacy token). Header validation treats `null` as fail-closed, and
+ * so must any other caller deciding whether a request may name an org.
  */
-function membershipIds(locals) {
+export function verifiedMembershipOrgIds(locals) {
     const orgs = readUserContext(locals)?.organizations;
     if (orgs) {
         return new Set(orgs.map((org) => org.id));
@@ -96,7 +97,7 @@ export function createActiveOrgHandle() {
         // user-scoped data while believing it acts as the org.
         const headerOrgId = event.request.headers.get(ACTIVE_ORG_HEADER_NAME)?.trim();
         if (headerOrgId) {
-            const members = membershipIds(locals);
+            const members = verifiedMembershipOrgIds(locals);
             if (!members || !members.has(headerOrgId)) {
                 return forbiddenActiveOrgResponse();
             }

package/dist/lib/server/handles/index.d.ts

@@ -28,7 +28,7 @@ export { createUserContextHandle, invalidateUserContext } from './user-context.j
 export type { UserContextHandleOptions } from './user-context.js';
 export { checkProjectAccessViaProjectsApi, createActiveProjectHandle, invalidateActiveProjectAccess, readActiveProjectCookie, setActiveProjectCookie, ACTIVE_PROJECT_COOKIE_NAME } from './active-project.js';
 export type { ActiveProjectHandleOptions, ProjectAccessFetcher } from './active-project.js';
-export { createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, ACTIVE_ORG_HEADER_NAME } from './active-org.js';
+export { createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, ACTIVE_ORG_HEADER_NAME, verifiedMembershipOrgIds } from './active-org.js';
 export { createOrgMembershipHandle } from './org-membership.js';
 export { scopeFromLocals, tryScopeFromLocals } from './scope.js';
 export type { VibesScope } from './scope.js';

package/dist/lib/server/handles/index.js

@@ -26,7 +26,7 @@
  */
 export { createUserContextHandle, invalidateUserContext } from './user-context.js';
 export { checkProjectAccessViaProjectsApi, createActiveProjectHandle, invalidateActiveProjectAccess, readActiveProjectCookie, setActiveProjectCookie, ACTIVE_PROJECT_COOKIE_NAME } from './active-project.js';
-export { createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, ACTIVE_ORG_HEADER_NAME } from './active-org.js';
+export { createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, ACTIVE_ORG_HEADER_NAME, verifiedMembershipOrgIds } from './active-org.js';
 export { createOrgMembershipHandle } from './org-membership.js';
 export { scopeFromLocals, tryScopeFromLocals } from './scope.js';
 export { actingScopeFromLocals, matchesActingOwner } from './acting-scope.js';

package/dist/lib/server/index.d.ts

@@ -40,7 +40,7 @@ export type { FormActionConfig } from './action';
 export { vibesLayoutLoad as vibesLayout, vibesLayoutAuth, vibesLayoutFeature } from './layout/load';
 export type { VibesLayoutLoadOptions, FeatureGateOptions } from './layout/load';
 export { createVibesHandle, createBasicVibesHandle, createVibesErrorHandler, createMaintenanceHandle, createAuthHandle, createAuthWrapperHandle, createActivityHandle, applySecurityHeaders, matchSecurityProfile, applySecurityProfile, enhanceUserContext, createPreferenceLoader, shouldSkipActivityLogging, isPublicRoute, isAssetRequest, serializeError, createCacheControlHandle, applyCacheControl, createCorsHandle } from './hooks';
-export { createUserContextHandle, invalidateUserContext, createActiveProjectHandle, checkProjectAccessViaProjectsApi, invalidateActiveProjectAccess, readActiveProjectCookie, setActiveProjectCookie, ACTIVE_PROJECT_COOKIE_NAME, createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, createOrgMembershipHandle, scopeFromLocals, tryScopeFromLocals, actingScopeFromLocals, matchesActingOwner, createAuthEnforcementHandle, createActiveUserGateHandle, createDemoAwareAuthEnforcementHandle, createDemoAwareActiveUserGateHandle, createDemoBannerHandle, createPermissionFetchHandle, invalidatePermissionCache } from './handles';
+export { createUserContextHandle, invalidateUserContext, createActiveProjectHandle, checkProjectAccessViaProjectsApi, invalidateActiveProjectAccess, readActiveProjectCookie, setActiveProjectCookie, ACTIVE_PROJECT_COOKIE_NAME, createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, verifiedMembershipOrgIds, createOrgMembershipHandle, scopeFromLocals, tryScopeFromLocals, actingScopeFromLocals, matchesActingOwner, createAuthEnforcementHandle, createActiveUserGateHandle, createDemoAwareAuthEnforcementHandle, createDemoAwareActiveUserGateHandle, createDemoBannerHandle, createPermissionFetchHandle, invalidatePermissionCache } from './handles';
 export type { UserContextHandleOptions, AuthEnforcementOptions, ActiveUserGateOptions, ActiveUserStatus, PermissionFetchHandleOptions, VibesScope, ActingScope } from './handles';
 export type { VibesHandleConfig, SecurityConfig, MaintenanceConfig, AuthConfig, ActivityConfig, ActivityLogEntry, ActivityLoggerFunction, CSPConfig, SecurityHeadersConfig, SecurityPattern, ContextLoaders, UserContextConfig, ErrorHandlerConfig, CacheControlOptions } from './hooks';
 export type { VibesConfig, VibesHandler, VibesContext, AuthConfig as VibesAuthConfig, RateLimitConfig, CachingConfig, BillingConfig, ValidationConfig, MetadataConfig } from '../types';

package/dist/lib/server/index.js

@@ -44,7 +44,7 @@ export { vibesLayoutLoad as vibesLayout, vibesLayoutAuth, vibesLayoutFeature } f
 // Hooks integration for SvelteKit
 export { createVibesHandle, createBasicVibesHandle, createVibesErrorHandler, createMaintenanceHandle, createAuthHandle, createAuthWrapperHandle, createActivityHandle, applySecurityHeaders, matchSecurityProfile, applySecurityProfile, enhanceUserContext, createPreferenceLoader, shouldSkipActivityLogging, isPublicRoute, isAssetRequest, serializeError, createCacheControlHandle, applyCacheControl, createCorsHandle } from './hooks';
 // Composable handles for the handle chain
-export { createUserContextHandle, invalidateUserContext, createActiveProjectHandle, checkProjectAccessViaProjectsApi, invalidateActiveProjectAccess, readActiveProjectCookie, setActiveProjectCookie, ACTIVE_PROJECT_COOKIE_NAME, createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, createOrgMembershipHandle, scopeFromLocals, tryScopeFromLocals, actingScopeFromLocals, matchesActingOwner, createAuthEnforcementHandle, createActiveUserGateHandle, createDemoAwareAuthEnforcementHandle, createDemoAwareActiveUserGateHandle, createDemoBannerHandle, createPermissionFetchHandle, invalidatePermissionCache } from './handles';
+export { createUserContextHandle, invalidateUserContext, createActiveProjectHandle, checkProjectAccessViaProjectsApi, invalidateActiveProjectAccess, readActiveProjectCookie, setActiveProjectCookie, ACTIVE_PROJECT_COOKIE_NAME, createActiveOrgHandle, readActiveOrgCookie, setActiveOrgCookie, ACTIVE_ORG_COOKIE_NAME, verifiedMembershipOrgIds, createOrgMembershipHandle, scopeFromLocals, tryScopeFromLocals, actingScopeFromLocals, matchesActingOwner, createAuthEnforcementHandle, createActiveUserGateHandle, createDemoAwareAuthEnforcementHandle, createDemoAwareActiveUserGateHandle, createDemoBannerHandle, createPermissionFetchHandle, invalidatePermissionCache } from './handles';
 // Helper functions
 export { 
 // Authentication helpers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibesdotdev/kit",
-  "version": "1.0.0-rc.3",
+  "version": "1.0.0-rc.5",
   "dependencies": {
     "@codemirror/autocomplete": "^6.20.4",
     "@codemirror/commands": "^6.11.1",
@@ -47,23 +47,23 @@
     "tailwind-variants": "^3.3.1",
     "tw-animate-css": "^1.4.0",
     "vaul-svelte": "^1.0.0-next.7",
-    "@vibesdotdev/surface-sveltekit": "^1.0.0-rc.3"
+    "@vibesdotdev/surface-sveltekit": "^1.0.0-rc.6"
   },
   "peerDependencies": {
     "@humanspeak/svelte-markdown": "^1.9.5",
     "@iconify/svelte": "^5.2.3",
     "@sveltejs/kit": "^2.70.3",
-    "@vibesdotdev/config": "^1.0.0-rc.3",
-    "@vibesdotdev/infra-core": "^1.0.0-rc.3",
-    "@vibesdotdev/kernel": "^1.0.0-rc.6",
+    "@vibesdotdev/config": "^1.0.0-rc.0",
+    "@vibesdotdev/infra-core": "^1.0.0-rc.0",
+    "@vibesdotdev/kernel": "^1.0.0-rc.0",
     "drizzle-orm": "^0.45.4",
     "svelte": "^5.57.2",
     "tailwindcss": "^4.3.3",
     "zod": "^4.6.7",
-    "@vibesdotdev/design-tokens": "^1.0.0-rc.2",
-    "@vibesdotdev/filesystem": "^1.0.0-rc.2",
-    "@vibesdotdev/paths": "^1.0.0-rc.3",
-    "@vibesdotdev/shared": "^1.0.0-rc.4"
+    "@vibesdotdev/design-tokens": "^1.0.0-rc.0",
+    "@vibesdotdev/filesystem": "^1.0.0-rc.0",
+    "@vibesdotdev/paths": "^1.0.0-rc.0",
+    "@vibesdotdev/shared": "^1.0.0-rc.0"
   },
   "main": "./dist/lib/index.js",
   "exports": {
@@ -956,6 +956,12 @@
       "import": "./dist/lib/config/css-hash.js",
       "default": "./dist/lib/config/css-hash.js"
     },
+    "./config/sveltekit-version": {
+      "types": "./dist/lib/config/sveltekit-version.d.ts",
+      "bun": "./dist/lib/config/sveltekit-version.js",
+      "import": "./dist/lib/config/sveltekit-version.js",
+      "default": "./dist/lib/config/sveltekit-version.js"
+    },
     "./config/sveltekit-browser-csp": {
       "types": "./dist/lib/config/sveltekit-browser-csp.d.ts",
       "bun": "./dist/lib/config/sveltekit-browser-csp.js",
@@ -1363,10 +1369,10 @@
     "ui-components",
     "typescript"
   ],
-  "gitHead": "2497670f26b07dcb1509d8d3d9a8cdb6d3c48ad2",
+  "gitHead": "5b9a620a037cea8a45d0492ea6e346875c84c6c4",
   "_vibes_source": {
     "repo": "ssh://git@git.vibes.dev/vibesdotdev/kit.git",
-    "sha": "2497670f26b07dcb1509d8d3d9a8cdb6d3c48ad2",
-    "workspaceDigest": "sha256:1074d90f7afb4b90cadf570abc635c4c592019898cc7e547706e7553261e97de"
+    "sha": "5b9a620a037cea8a45d0492ea6e346875c84c6c4",
+    "workspaceDigest": "sha256:44aa7d9701e939721471f7b830f303df963e9a90603baf9d43d645dba2b7e1de"
   }
 }