From 81962e436cc8c809b181473b8ef0f1343d46ef96 Mon Sep 17 00:00:00 2001
From: eleith <eleith@noreply.git.eleith.com>
Date: Mon, 2 Nov 2026 15:14:32 -0800
Subject: [PATCH 1/4] Apply SvelteKit 3 migration

---
 .changeset/web-framework-upgrade.md           |   5 +
 apps/web/MIGRATION_TASKS.md                   | 141 ++++++++++++++++++
 apps/web/package.json                         |   8 +-
 apps/web/src/hooks.server.test.ts             |   9 +-
 apps/web/src/hooks.server.ts                  |   5 +-
 .../src/lib/components/DocumentHead.svelte    |   2 +-
 .../web/src/lib/components/ThemeToggle.svelte |   2 +-
 .../bookmarks/BookmarkDetails.svelte          |   2 +-
 .../bookmarks/BookmarkDetailsDialog.svelte    |   2 +-
 .../components/bookmarks/BookmarkLogo.svelte  |   2 +-
 .../components/search/BookmarkSearch.svelte   |  19 ++-
 apps/web/src/lib/search/engine.test.ts        |   2 +-
 apps/web/src/lib/search/engine.ts             |   2 +-
 apps/web/src/lib/server/auth/access.test.ts   |   3 +-
 apps/web/src/lib/server/auth/access.ts        |   3 +-
 apps/web/src/lib/server/auth/index.ts         |   4 +-
 apps/web/src/routes/(protected)/+page.svelte  |  53 ++++---
 .../src/routes/(public)/signin/+page.svelte   |   6 +-
 apps/web/src/routes/+error.svelte             |   2 +-
 apps/web/src/routes/+layout.svelte            |   4 +-
 apps/web/svelte.config.js                     |  26 ----
 apps/web/tsconfig.json                        |  12 +-
 apps/web/vite.config.ts                       |  26 +++-
 23 files changed, 255 insertions(+), 85 deletions(-)
 create mode 100644 .changeset/web-framework-upgrade.md
 create mode 100644 apps/web/MIGRATION_TASKS.md
 delete mode 100644 apps/web/svelte.config.js

diff --git a/.changeset/web-framework-upgrade.md b/.changeset/web-framework-upgrade.md
new file mode 100644
index 0000000..5040a14
--- /dev/null
+++ b/.changeset/web-framework-upgrade.md
@@ -0,0 +1,5 @@
+---
+'@directory/web': patch
+---
+
+Upgrade the web app to SvelteKit 3.
diff --git a/apps/web/MIGRATION_TASKS.md b/apps/web/MIGRATION_TASKS.md
new file mode 100644
index 0000000..a5ea753
--- /dev/null
+++ b/apps/web/MIGRATION_TASKS.md
@@ -0,0 +1,141 @@
+<!-- Generated by sv migrate sveltekit-3:collect-migration-instructions -->
+
+# SvelteKit 3 migration tasks
+
+Some migrations are uncommon, context-dependent, or disproportionately difficult to automate safely. This document lists them.
+
+The findings are intentionally broad and may include files that do not require changes.
+
+AI agents can work through the migration tasks below one at a time:
+
+1. Read the linked documentation or pull request before changing code.
+2. Inspect every listed file and its surrounding context.
+3. Ignore a finding when the file is not actually affected.
+4. Make the smallest necessary change. Do not perform unrelated refactors or introduce unnecessary abstractions.
+5. Ask the user when application intent cannot be inferred.
+6. Run the project's appropriate checks after editing.
+
+Also search the project for `@migration-task` comments. They may describe additional manual migration work that must be resolved.
+
+## Migration tasks
+
+### Review `goto` destinations
+
+`goto(...)` now rejects destinations that do not resolve to an application route.
+
+#### What to do
+
+Confirm each destination is an internal route. Use `window.location.href` for external browser navigation, and handle rejected dynamic destinations where they can fail to resolve.
+
+#### References
+
+- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#$app-navigation-goto-rejects-for-URLs-that-don't-resolve-to-a-route)
+
+#### Files to review
+
+- [ ] `src/routes/(protected)/+page.svelte`
+
+### Replace `invalidateAll` with `refreshAll`
+
+`invalidateAll` is deprecated in favor of `refreshAll`
+
+#### What to do
+
+Replace `invalidateAll()` with `refreshAll()`. Note that `refreshAll()` will keep `page.state` intact. Check if that has unwanted impact on the application; if yes point this out in a comment with steps to take instead of replacing that instance of `invalidateAll()`. Similarly, replace goto(..., { invalidateAll: true }) with goto(..., { refreshAll: true }).
+
+#### References
+
+- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#$app-navigation-invalidateAll-is-deprecated-in-favour-of-refreshAll)
+
+#### Files to review
+
+- [ ] `src/routes/(protected)/+page.svelte`
+
+### `data-sveltekit-*` uses `false` instead of `"off"`
+
+The `"off"` value for `data-sveltekit-*` link attributes has been removed in favour of `false`.
+
+#### What to do
+
+Replace `data-sveltekit-...="off"` with `data-sveltekit-...="false"`.
+
+#### References
+
+- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#Miscellaneous-data-sveltekit-uses-false-instead-of-'off')
+
+#### Files to review
+
+- [ ] `src/routes/(protected)/+page.svelte`
+
+### CORS for static assets in development is handled by Vite
+
+SvelteKit no longer sets `access-control-allow-origin: *` on every static asset request in development. CORS is now delegated to Vite's built-in middleware.
+
+#### What to do
+
+If you rely on cross-origin access to static assets in dev, configure it in your Vite config by adding server.cors.origin = "\*" to your config.
+
+#### References
+
+- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#Security-CORS-for-static-assets-in-development-is-handled-by-Vite)
+
+### `json` and `text` are deprecated
+
+The `json(...)` and `text(...)` helpers from `@sveltejs/kit` for generating responses are deprecated.
+
+#### What to do
+
+Use `Response.json(...)` and `new Response(text)` instead.
+
+#### References
+
+- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#sveltejs-kit-json-and-text-are-deprecated)
+
+#### Files to review
+
+- [ ] `src/hooks.server.test.ts`
+- [ ] `src/lib/server/auth/access.test.ts`
+- [ ] `src/lib/server/auth/index.test.ts`
+- [ ] `src/routes/(protected)/(endpoints)/config/version/+server.ts`
+- [ ] `src/routes/(public)/healthz/+server.ts`
+- [ ] `src/routes/(public)/schema.json/+server.ts`
+
+### Move adapter-node `ORIGIN` to `paths.origin`
+
+The adapter-node `ORIGIN` environment variable is removed.
+
+#### What to do
+
+Find where `ORIGIN` is set (`.env` files, scripts, hosting dashboard, ...) and move the public-facing origin to `paths.origin` in `sveltekit(...)`. Do not delete `ORIGIN`: it is ignored by adapter-node now and may have other uses.
+
+#### References
+
+- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#Adapters-adapter-node)
+
+### Review `redirect(...)` destinations for external URLs
+
+`redirect(...)` to an external URL now requires an `external` option.
+
+#### What to do
+
+The automatic migration only analyzes static URLs. Inspect each `redirect` call: if the destination can be an external URL at runtime, pass `{ external: true }` for a blanket allow, or `{ external: [...] }` for a list of permitted origins, or keep it as is when determining that this should only handle app-internal redirects.
+
+#### References
+
+- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#Miscellaneous-External-redirects-must-be-opted-into)
+
+#### Files to review
+
+- [ ] `src/hooks.server.test.ts`
+- [ ] `src/lib/server/auth/access.test.ts`
+- [ ] `src/lib/server/auth/actions.ts`
+- [ ] `src/routes/(protected)/+page.server.ts`
+- [ ] `src/routes/(public)/signin/+page.server.ts`
+
+## Final verification
+
+- [ ] Review every migration task and ignore any irrelevant findings.
+- [ ] Resolve remaining `@migration-task` comments.
+- [ ] Run the project's type checker and tests.
+- [ ] Build the project successfully.
+- [ ] Delete this file when all migration work is complete.
diff --git a/apps/web/package.json b/apps/web/package.json
index 08bf49f..cbe0be8 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -29,8 +29,8 @@
 	"devDependencies": {
 		"@iconify-json/ph": "catalog:",
 		"@playwright/test": "catalog:",
-		"@sveltejs/adapter-node": "catalog:",
-		"@sveltejs/kit": "catalog:",
+		"@sveltejs/adapter-node": "^6.0.0",
+		"@sveltejs/kit": "^3.0.0",
 		"@sveltejs/vite-plugin-svelte": "catalog:",
 		"@types/node": "catalog:",
 		"@vitest/coverage-v8": "catalog:",
@@ -40,5 +40,9 @@
 		"unplugin-icons": "catalog:",
 		"vite": "catalog:",
 		"vitest": "catalog:"
+	},
+	"imports": {
+		"#lib": "./src/lib/index.js",
+		"#lib/*": "./src/lib/*"
 	}
 }
diff --git a/apps/web/src/hooks.server.test.ts b/apps/web/src/hooks.server.test.ts
index 5bab3ce..b722333 100644
--- a/apps/web/src/hooks.server.test.ts
+++ b/apps/web/src/hooks.server.test.ts
@@ -1,5 +1,6 @@
+import type { Handle } from '@sveltejs/kit/hooks';
+import type { RequestEvent } from '@sveltejs/kit';
 import { validateConfig } from '@directory/config';
-import type { Handle, RequestEvent } from '@sveltejs/kit';
 import { themeStyleTag } from './lib/server/appearance.js';
 import { afterEach, beforeEach, describe, expect, it, vi, type MockInstance } from 'vitest';
 import type { Authentication } from './lib/server/auth/index.js';
@@ -329,9 +330,13 @@ describe('server hooks', () => {
 			for (const cookie of ['', 'unrelated-cookie=opaque']) {
 				for (const [path, routeId, params] of [
 					['/public/photo.svg', '/(public)/public/[...file]', { file: 'photo.svg' }],
+
 					['/public/site.svg', '/(public)/public/[...file]', { file: 'site.svg' }],
+
 					['/%70ublic/photo.svg', '/(public)/public/[...file]', { file: 'photo.svg' }],
+
 					['/public/unknown.svg', '/(public)/public/[...file]', { file: 'unknown.svg' }],
+
 					[
 						'/bookmarks/photos/logo',
 						'/(protected)/(endpoints)/bookmarks/[id]/logo',
@@ -423,10 +428,12 @@ describe('server hooks', () => {
 				const themedHead = await transform({ html: head, done: false });
 				expect(themedHead).toBe(`\t${themeStyleTag(captured.display.appearance)}\n${head}`);
 				expect(await transform({ html: ending, done: true })).toBe(ending);
+
 				return new Response(opening + themedHead + ending, {
 					headers: { 'content-type': 'text/html' }
 				});
 			});
+
 			const response = await hooks.handle({ event: request, resolve });
 			const html = await response.text();
 			expect(html.match(/<style>/g)).toHaveLength(1);
diff --git a/apps/web/src/hooks.server.ts b/apps/web/src/hooks.server.ts
index 021238c..80f8fb2 100644
--- a/apps/web/src/hooks.server.ts
+++ b/apps/web/src/hooks.server.ts
@@ -1,7 +1,6 @@
-import { building, dev } from '$app/environment';
+import { building, dev } from '$app/env';
 import { env } from '$env/dynamic/private';
-import type { Handle, ServerInit } from '@sveltejs/kit';
-import { sequence } from '@sveltejs/kit/hooks';
+import { sequence, type Handle, type ServerInit } from '@sveltejs/kit/hooks';
 import { themeStyleTag } from './lib/server/appearance.js';
 import type { ServerState } from './lib/server/application.js';
 import { startDevelopment } from './lib/server/lifecycle/development.js';
diff --git a/apps/web/src/lib/components/DocumentHead.svelte b/apps/web/src/lib/components/DocumentHead.svelte
index cfb6a98..19aed07 100644
--- a/apps/web/src/lib/components/DocumentHead.svelte
+++ b/apps/web/src/lib/components/DocumentHead.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import type { DocumentMetadata } from '$lib/server/document.js';
+	import type { DocumentMetadata } from '#lib/server/document.js';
 
 	let { metadata, faviconPath }: { metadata: DocumentMetadata; faviconPath: string } = $props();
 </script>
diff --git a/apps/web/src/lib/components/ThemeToggle.svelte b/apps/web/src/lib/components/ThemeToggle.svelte
index 4b3b9f4..6aa50bb 100644
--- a/apps/web/src/lib/components/ThemeToggle.svelte
+++ b/apps/web/src/lib/components/ThemeToggle.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
-	import Button from '$lib/components/ui/Button.svelte';
+	import Button from '#lib/components/ui/Button.svelte';
 	import IconMoon from 'virtual:icons/ph/moon';
 	import IconSunDim from 'virtual:icons/ph/sun-dim';
 	import IconFaders from 'virtual:icons/ph/faders';
diff --git a/apps/web/src/lib/components/bookmarks/BookmarkDetails.svelte b/apps/web/src/lib/components/bookmarks/BookmarkDetails.svelte
index ed8d63e..6cc7e46 100644
--- a/apps/web/src/lib/components/bookmarks/BookmarkDetails.svelte
+++ b/apps/web/src/lib/components/bookmarks/BookmarkDetails.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import type { HTMLAttributes } from 'svelte/elements';
-	import type { DisplayLink } from '$lib/display/types.js';
+	import type { DisplayLink } from '#lib/display/types.js';
 	import BookmarkLogo from './BookmarkLogo.svelte';
 	import ButtonLink from '../ui/ButtonLink.svelte';
 	import Chip from '../ui/Chip.svelte';
diff --git a/apps/web/src/lib/components/bookmarks/BookmarkDetailsDialog.svelte b/apps/web/src/lib/components/bookmarks/BookmarkDetailsDialog.svelte
index 70b9c47..2813e86 100644
--- a/apps/web/src/lib/components/bookmarks/BookmarkDetailsDialog.svelte
+++ b/apps/web/src/lib/components/bookmarks/BookmarkDetailsDialog.svelte
@@ -4,7 +4,7 @@
 	import IconX from 'virtual:icons/ph/x';
 	import IconCaretLeft from 'virtual:icons/ph/caret-left';
 	import IconCaretRight from 'virtual:icons/ph/caret-right';
-	import type { DisplayLink } from '$lib/display/types.js';
+	import type { DisplayLink } from '#lib/display/types.js';
 	import BookmarkDetails from './BookmarkDetails.svelte';
 	import Button from '../ui/Button.svelte';
 
diff --git a/apps/web/src/lib/components/bookmarks/BookmarkLogo.svelte b/apps/web/src/lib/components/bookmarks/BookmarkLogo.svelte
index 17948d2..e1c1035 100644
--- a/apps/web/src/lib/components/bookmarks/BookmarkLogo.svelte
+++ b/apps/web/src/lib/components/bookmarks/BookmarkLogo.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import Logo from '../Logo.svelte';
-	import type { DisplayLink } from '$lib/display/types.js';
+	import type { DisplayLink } from '#lib/display/types.js';
 
 	interface Props {
 		readonly link: DisplayLink;
diff --git a/apps/web/src/lib/components/search/BookmarkSearch.svelte b/apps/web/src/lib/components/search/BookmarkSearch.svelte
index 0b03315..1fd1be8 100644
--- a/apps/web/src/lib/components/search/BookmarkSearch.svelte
+++ b/apps/web/src/lib/components/search/BookmarkSearch.svelte
@@ -1,8 +1,8 @@
 <script module lang="ts">
-	let engineImport: Promise<typeof import('$lib/search/engine.js')> | undefined;
+	let engineImport: Promise<typeof import('#lib/search/engine.js')> | undefined;
 
 	function loadEngine() {
-		engineImport ??= import('$lib/search/engine.js').catch((error: unknown) => {
+		engineImport ??= import('#lib/search/engine.js').catch((error: unknown) => {
 			engineImport = undefined;
 			throw error;
 		});
@@ -17,8 +17,8 @@
 	import Button from '../ui/Button.svelte';
 	import Input from '../ui/Input.svelte';
 	import { beforeNavigate, afterNavigate } from '$app/navigation';
-	import type { DirectoryContent } from '$lib/display/types.js';
-	import type { SearchResult } from '$lib/search/engine.js';
+	import type { DirectoryContent } from '#lib/display/types.js';
+	import type { SearchResult } from '#lib/search/engine.js';
 
 	let {
 		directory,
@@ -41,7 +41,7 @@
 	let navigating = $state(false);
 	let activated = $state(false);
 	let completedQuery: string | undefined;
-	let searchBookmarks: ReturnType<typeof import('$lib/search/engine.js').createSearch> | undefined;
+	let searchBookmarks: ReturnType<typeof import('#lib/search/engine.js').createSearch> | undefined;
 	let indexedSnapshotId: string | undefined;
 	let searchRequestVersion = 0;
 	let searchUnavailable = false;
@@ -112,11 +112,16 @@
 		};
 	});
 
-	beforeNavigate(() => {
+	beforeNavigate(({ shallow, type }) => {
+		if (shallow && type === 'goto') return;
+
 		navigating = true;
 		searchRequestVersion++;
 	});
-	afterNavigate(() => {
+
+	afterNavigate(({ shallow, type }) => {
+		if (shallow && type === 'goto') return;
+
 		navigating = false;
 		if (query.trim()) activated = true;
 	});
diff --git a/apps/web/src/lib/search/engine.test.ts b/apps/web/src/lib/search/engine.test.ts
index 1e2e537..a402175 100644
--- a/apps/web/src/lib/search/engine.test.ts
+++ b/apps/web/src/lib/search/engine.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import type { DirectoryContent, DisplayGroup, DisplayLink } from '$lib/display/types.js';
+import type { DirectoryContent, DisplayGroup, DisplayLink } from '#lib/display/types.js';
 import { createSearch } from './engine.js';
 
 function link(id: string, fields: Partial<DisplayLink> = {}): DisplayLink {
diff --git a/apps/web/src/lib/search/engine.ts b/apps/web/src/lib/search/engine.ts
index 5a0ecb9..ea0cb8c 100644
--- a/apps/web/src/lib/search/engine.ts
+++ b/apps/web/src/lib/search/engine.ts
@@ -1,5 +1,5 @@
 import Fuse from 'fuse.js';
-import type { DirectoryContent, DisplayLink } from '$lib/display/types.js';
+import type { DirectoryContent, DisplayLink } from '#lib/display/types.js';
 
 export interface SearchResult {
 	readonly link: DisplayLink;
diff --git a/apps/web/src/lib/server/auth/access.test.ts b/apps/web/src/lib/server/auth/access.test.ts
index d42567d..959a75e 100644
--- a/apps/web/src/lib/server/auth/access.test.ts
+++ b/apps/web/src/lib/server/auth/access.test.ts
@@ -1,5 +1,6 @@
+import type { Handle } from '@sveltejs/kit/hooks';
+import type { RequestEvent } from '@sveltejs/kit';
 import { beforeEach, expect, it, vi } from 'vitest';
-import type { Handle, RequestEvent } from '@sveltejs/kit';
 import { protectAuthRequest, requireSignIn, type AccessPolicy } from './access.js';
 import { logger } from '../logger.js';
 
diff --git a/apps/web/src/lib/server/auth/access.ts b/apps/web/src/lib/server/auth/access.ts
index 607da78..3d58fe9 100644
--- a/apps/web/src/lib/server/auth/access.ts
+++ b/apps/web/src/lib/server/auth/access.ts
@@ -1,4 +1,5 @@
-import { isRedirect, type Handle, type RequestEvent } from '@sveltejs/kit';
+import { isRedirect, type RequestEvent } from '@sveltejs/kit';
+import type { Handle } from '@sveltejs/kit/hooks';
 import { logger } from '../logger.js';
 import { isSignInError, localRedirect, signInLocation } from './redirect.js';
 import { hasExpectedOrigin } from './request.js';
diff --git a/apps/web/src/lib/server/auth/index.ts b/apps/web/src/lib/server/auth/index.ts
index 0a34ea4..ff66a1f 100644
--- a/apps/web/src/lib/server/auth/index.ts
+++ b/apps/web/src/lib/server/auth/index.ts
@@ -1,8 +1,8 @@
+import type { RequestEvent } from '@sveltejs/kit';
 import { randomBytes } from 'node:crypto';
 import { betterAuth, type BetterAuthOptions } from 'better-auth/minimal';
 import { isAuthPath } from 'better-auth/svelte-kit';
-import { sequence } from '@sveltejs/kit/hooks';
-import type { Handle, RequestEvent } from '@sveltejs/kit';
+import { sequence, type Handle } from '@sveltejs/kit/hooks';
 import type { DirectoryAuth } from '@directory/config/types';
 import { logger } from '../logger.js';
 import { protectAuthRequest, requireSignIn } from './access.js';
diff --git a/apps/web/src/routes/(protected)/+page.svelte b/apps/web/src/routes/(protected)/+page.svelte
index 00002e6..23e726c 100644
--- a/apps/web/src/routes/(protected)/+page.svelte
+++ b/apps/web/src/routes/(protected)/+page.svelte
@@ -2,18 +2,18 @@
 	import { onMount } from 'svelte';
 	import { SvelteURLSearchParams } from 'svelte/reactivity';
 	import IconSignOut from 'virtual:icons/ph/sign-out';
-	import { beforeNavigate, pushState, replaceState } from '$app/navigation';
+	import { beforeNavigate, goto } from '$app/navigation';
 	import { page } from '$app/state';
-	import BookmarkLogo from '$lib/components/bookmarks/BookmarkLogo.svelte';
-	import BookmarkDetails from '$lib/components/bookmarks/BookmarkDetails.svelte';
-	import BookmarkDetailsDialog from '$lib/components/bookmarks/BookmarkDetailsDialog.svelte';
-	import Logo from '$lib/components/Logo.svelte';
-	import ThemeToggle from '$lib/components/ThemeToggle.svelte';
-	import BookmarkSearch from '$lib/components/search/BookmarkSearch.svelte';
-	import Button from '$lib/components/ui/Button.svelte';
-	import { nextResultIndex } from '$lib/search/result-navigation.js';
-	import type { DisplayLink } from '$lib/display/types.js';
-	import type { SearchResult } from '$lib/search/engine.js';
+	import BookmarkLogo from '#lib/components/bookmarks/BookmarkLogo.svelte';
+	import BookmarkDetails from '#lib/components/bookmarks/BookmarkDetails.svelte';
+	import BookmarkDetailsDialog from '#lib/components/bookmarks/BookmarkDetailsDialog.svelte';
+	import Logo from '#lib/components/Logo.svelte';
+	import ThemeToggle from '#lib/components/ThemeToggle.svelte';
+	import BookmarkSearch from '#lib/components/search/BookmarkSearch.svelte';
+	import Button from '#lib/components/ui/Button.svelte';
+	import { nextResultIndex } from '#lib/search/result-navigation.js';
+	import type { DisplayLink } from '#lib/display/types.js';
+	import type { SearchResult } from '#lib/search/engine.js';
 	import type { PageData } from './$types.js';
 
 	let { data }: { data: PageData } = $props();
@@ -66,7 +66,11 @@
 		if (query) parameters.set('q', query);
 		const url = parameters.size ? `/?${parameters}` : '/';
 		// eslint-disable-next-line svelte/no-navigation-without-resolve -- Query URLs stay absolute in this root-only directory.
-		replaceState(url, { ...page.state, directoryQuery: query });
+		goto(url, {
+			shallow: true,
+			replace: true,
+			state: { ...page.state, directoryQuery: query }
+		});
 	}
 
 	function detailURL(id: string) {
@@ -139,7 +143,10 @@
 		pendingFilterQuery = undefined;
 		isClosingDetails = false;
 		// eslint-disable-next-line svelte/no-navigation-without-resolve -- This absolute href comes from the real tile anchor.
-		pushState(href, { ...page.state, directoryDetail: { id, fromGrid: true } });
+		goto(href, {
+			shallow: true,
+			state: { ...page.state, directoryDetail: { id, fromGrid: true } }
+		});
 	}
 
 	function navigateDetails(step: -1 | 1) {
@@ -148,9 +155,13 @@
 		if (!id) return;
 		returnTile = findBookmarkTile(id);
 		// eslint-disable-next-line svelte/no-navigation-without-resolve -- Root-only URLs must stay absolute.
-		replaceState(detailURL(id), {
-			...page.state,
-			directoryDetail: { id, fromGrid: page.state.directoryDetail?.fromGrid ?? false }
+		goto(detailURL(id), {
+			shallow: true,
+			replace: true,
+			state: {
+				...page.state,
+				directoryDetail: { id, fromGrid: page.state.directoryDetail?.fromGrid ?? false }
+			}
 		});
 	}
 
@@ -162,7 +173,11 @@
 			return;
 		}
 		// eslint-disable-next-line svelte/no-navigation-without-resolve -- Root-only URLs must stay absolute.
-		replaceState(directoryURL, { ...page.state, directoryDetail: null });
+		goto(directoryURL, {
+			shallow: true,
+			replace: true,
+			state: { ...page.state, directoryDetail: null }
+		});
 	}
 
 	function selectDetailFilter(query: string) {
@@ -196,7 +211,9 @@
 		directoryHeading?.focus({ preventScroll: true });
 	}
 
-	beforeNavigate(() => {
+	beforeNavigate(({ shallow, type }) => {
+		if (shallow && type === 'goto') return;
+
 		isClosingDetails = false;
 		pendingFilterQuery = undefined;
 		returnTile = undefined;
diff --git a/apps/web/src/routes/(public)/signin/+page.svelte b/apps/web/src/routes/(public)/signin/+page.svelte
index 2d2a00d..2c6c803 100644
--- a/apps/web/src/routes/(public)/signin/+page.svelte
+++ b/apps/web/src/routes/(public)/signin/+page.svelte
@@ -2,9 +2,9 @@
 	import { onMount } from 'svelte';
 	import IconWarningCircle from 'virtual:icons/ph/warning-circle';
 	import IconSignIn from 'virtual:icons/ph/sign-in';
-	import Logo from '$lib/components/Logo.svelte';
-	import Button from '$lib/components/ui/Button.svelte';
-	import Input from '$lib/components/ui/Input.svelte';
+	import Logo from '#lib/components/Logo.svelte';
+	import Button from '#lib/components/ui/Button.svelte';
+	import Input from '#lib/components/ui/Input.svelte';
 	import type { PageData } from './$types.js';
 
 	let { data }: { data: PageData } = $props();
diff --git a/apps/web/src/routes/+error.svelte b/apps/web/src/routes/+error.svelte
index a1c93a3..7c4c24c 100644
--- a/apps/web/src/routes/+error.svelte
+++ b/apps/web/src/routes/+error.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
-	import ButtonLink from '$lib/components/ui/ButtonLink.svelte';
+	import ButtonLink from '#lib/components/ui/ButtonLink.svelte';
 </script>
 
 <svelte:head>
diff --git a/apps/web/src/routes/+layout.svelte b/apps/web/src/routes/+layout.svelte
index 9c210ce..1195418 100644
--- a/apps/web/src/routes/+layout.svelte
+++ b/apps/web/src/routes/+layout.svelte
@@ -1,8 +1,8 @@
 <script lang="ts">
 	import { onMount, type Snippet } from 'svelte';
 	import { page } from '$app/state';
-	import ConfigUpdateNotice from '$lib/components/ConfigUpdateNotice.svelte';
-	import DocumentHead from '$lib/components/DocumentHead.svelte';
+	import ConfigUpdateNotice from '#lib/components/ConfigUpdateNotice.svelte';
+	import DocumentHead from '#lib/components/DocumentHead.svelte';
 	import type { LayoutData } from './$types';
 	import '../lib/styles/reset.css';
 	import '../lib/styles/theme.css';
diff --git a/apps/web/svelte.config.js b/apps/web/svelte.config.js
deleted file mode 100644
index 53758b0..0000000
--- a/apps/web/svelte.config.js
+++ /dev/null
@@ -1,26 +0,0 @@
-import adapter from '@sveltejs/adapter-node';
-import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
-
-const connectSources = ['self'];
-if (process.env.NODE_ENV === 'development') connectSources.push('ws:', 'wss:');
-
-export default {
-	preprocess: vitePreprocess(),
-	kit: {
-		adapter: adapter(),
-		csp: {
-			// OIDC form redirects cross origins; state-changing requests are checked server-side.
-			directives: {
-				'default-src': ['self'],
-				'script-src': ['self'],
-				'style-src': ['self', 'unsafe-inline'],
-				'img-src': ['self'],
-				'font-src': ['self'],
-				'connect-src': connectSources,
-				'object-src': ['none'],
-				'base-uri': ['self'],
-				'frame-ancestors': ['none']
-			}
-		}
-	}
-};
diff --git a/apps/web/tsconfig.json b/apps/web/tsconfig.json
index 9f26ab7..8827211 100644
--- a/apps/web/tsconfig.json
+++ b/apps/web/tsconfig.json
@@ -1,20 +1,12 @@
 {
-	"extends": "./.svelte-kit/tsconfig.json",
+	"extends": "$app/tsconfig",
 	"compilerOptions": {
 		"strict": true,
 		"noUncheckedIndexedAccess": true,
 		"exactOptionalPropertyTypes": true,
-		"allowJs": true,
-		"checkJs": true,
-		"esModuleInterop": true,
-		"forceConsistentCasingInFileNames": true,
-		"resolveJsonModule": true,
-		"skipLibCheck": true,
 		"sourceMap": true,
-		"moduleResolution": "bundler",
-		"types": ["node", "unplugin-icons/types/svelte"]
+		"types": ["$app/types", "node", "unplugin-icons/types/svelte"]
 	},
-	// Keep the generated Kit includes in sync with .svelte-kit/tsconfig.json.
 	"include": [
 		".svelte-kit/ambient.d.ts",
 		".svelte-kit/env.d.ts",
diff --git a/apps/web/vite.config.ts b/apps/web/vite.config.ts
index 137fcf3..94895c2 100644
--- a/apps/web/vite.config.ts
+++ b/apps/web/vite.config.ts
@@ -1,8 +1,14 @@
+import adapter from '@sveltejs/adapter-node';
+import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
 import { sveltekit } from '@sveltejs/kit/vite';
 import { defineConfig, loadEnv } from 'vite';
 import { prepareRuntimeEnvironment } from './src/lib/server/runtime-environment.js';
 import Icons from 'unplugin-icons/vite';
 
+const connectSources = ['self'];
+
+if (process.env.NODE_ENV === 'development') connectSources.push('ws:', 'wss:');
+
 export default defineConfig(({ command, mode, isPreview }) => {
 	const development = command === 'serve' && !isPreview;
 	if (development) {
@@ -27,7 +33,25 @@ export default defineConfig(({ command, mode, isPreview }) => {
 					}
 				}
 			},
-			sveltekit(),
+
+			sveltekit({
+				preprocess: vitePreprocess(),
+				adapter: adapter(),
+				csp: {
+					// OIDC form redirects cross origins; state-changing requests are checked server-side.
+					directives: {
+						'default-src': ['self'],
+						'script-src': ['self'],
+						'style-src': ['self', 'unsafe-inline'],
+						'img-src': ['self'],
+						'font-src': ['self'],
+						'connect-src': connectSources,
+						'object-src': ['none'],
+						'base-uri': ['self'],
+						'frame-ancestors': ['none']
+					}
+				}
+			}),
 			Icons({ compiler: 'svelte' }),
 			// Kit's SSR loader does not run import.meta.hot.dispose.
 			{
-- 
2.54.0


From 5a1d6d6066ecf11509ed63467235d0a8c54b247b Mon Sep 17 00:00:00 2001
From: eleith <eleith@noreply.git.eleith.com>
Date: Tue, 3 Nov 2026 05:29:51 -0800
Subject: [PATCH 2/4] Integrate SvelteKit 3 runtime

---
 .changeset/web-framework-upgrade.md           |   2 +-
 apps/web/e2e/support/server.ts                |   4 +-
 apps/web/package.json                         |   5 +-
 apps/web/src/hooks.server.test.ts             |   8 +-
 apps/web/src/hooks.server.ts                  |   5 +-
 apps/web/src/lib/server/boot.process.test.ts  |  25 +-
 apps/web/src/lib/server/boot.test.ts          |  71 +-
 apps/web/src/lib/server/boot.ts               |  10 +-
 .../lib/server/lifecycle/development.test.ts  |   2 +-
 .../src/lib/server/lifecycle/development.ts   |   8 +-
 .../lib/server/lifecycle/production.test.ts   |   2 +-
 .../src/lib/server/lifecycle/production.ts    |   5 +-
 .../lib/server/runtime-environment.test.ts    | 201 ++++--
 .../web/src/lib/server/runtime-environment.ts |  50 +-
 apps/web/src/start.ts                         |  16 +-
 apps/web/tsconfig.json                        |  20 +-
 apps/web/vite.config.ts                       |  44 +-
 eslint.config.js                              |  10 +-
 package.json                                  |   1 +
 pnpm-lock.yaml                                | 606 +++---------------
 pnpm-workspace.yaml                           |   9 +-
 21 files changed, 401 insertions(+), 703 deletions(-)

diff --git a/.changeset/web-framework-upgrade.md b/.changeset/web-framework-upgrade.md
index 5040a14..6d6f130 100644
--- a/.changeset/web-framework-upgrade.md
+++ b/.changeset/web-framework-upgrade.md
@@ -2,4 +2,4 @@
 '@directory/web': patch
 ---
 
-Upgrade the web app to SvelteKit 3.
+Upgrade the web app to SvelteKit 3 while keeping `site.url` runtime-configured.
diff --git a/apps/web/e2e/support/server.ts b/apps/web/e2e/support/server.ts
index f4cc615..bf3c09c 100644
--- a/apps/web/e2e/support/server.ts
+++ b/apps/web/e2e/support/server.ts
@@ -71,8 +71,8 @@ export async function startServer(options: ServerOptions) {
 		const script = `
 import { once } from 'node:events';
 const { server } = await import(${JSON.stringify(serverModule)});
-if (!server.server.listening) await once(server.server, 'listening');
-process.send({ ready: server.server.address().port });
+if (!server.listening) await once(server, 'listening');
+process.send({ ready: server.address().port });
 `;
 		const child = spawn(process.execPath, ['--input-type=module', '--eval', script], {
 			cwd: temporary,
diff --git a/apps/web/package.json b/apps/web/package.json
index cbe0be8..a8a3afe 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -29,8 +29,8 @@
 	"devDependencies": {
 		"@iconify-json/ph": "catalog:",
 		"@playwright/test": "catalog:",
-		"@sveltejs/adapter-node": "^6.0.0",
-		"@sveltejs/kit": "^3.0.0",
+		"@sveltejs/adapter-node": "catalog:",
+		"@sveltejs/kit": "catalog:",
 		"@sveltejs/vite-plugin-svelte": "catalog:",
 		"@types/node": "catalog:",
 		"@vitest/coverage-v8": "catalog:",
@@ -42,7 +42,6 @@
 		"vitest": "catalog:"
 	},
 	"imports": {
-		"#lib": "./src/lib/index.js",
 		"#lib/*": "./src/lib/*"
 	}
 }
diff --git a/apps/web/src/hooks.server.test.ts b/apps/web/src/hooks.server.test.ts
index b722333..e61c498 100644
--- a/apps/web/src/hooks.server.test.ts
+++ b/apps/web/src/hooks.server.test.ts
@@ -15,7 +15,6 @@ const adapterEvents: NodeJS.EventEmitter = process;
 const mocks = vi.hoisted(() => ({
 	building: false,
 	dev: false,
-	env: { ORIGIN: 'https://directory.example.com' },
 	boot: vi.fn<typeof import('./lib/server/boot.js').bootApp>(),
 	report: vi.fn<typeof import('./lib/server/logger.js').reportStartupFailure>(),
 	load: vi.fn<typeof import('@directory/config').loadConfigFile>(),
@@ -23,8 +22,7 @@ const mocks = vi.hoisted(() => ({
 	prepare: vi.fn<typeof import('./lib/server/directory/snapshot.js').prepareSnapshot>()
 }));
 
-vi.mock('$env/dynamic/private', () => ({ env: mocks.env }));
-vi.mock('$app/environment', () => ({
+vi.mock('$app/env', () => ({
 	get building() {
 		return mocks.building;
 	},
@@ -173,7 +171,7 @@ describe('server hooks', () => {
 		expect(ready.currentSnapshot).not.toHaveBeenCalled();
 		pending.resolve(ready);
 		await startup;
-		expect(mocks.boot).toHaveBeenCalledExactlyOnceWith(undefined, mocks.env);
+		expect(mocks.boot).toHaveBeenCalledExactlyOnceWith();
 		expect((await hooks.handle({ event: event(), resolve })).status).toBe(200);
 		adapterEvents.emit('sveltekit:shutdown');
 		expect((await hooks.handle({ event: event(), resolve })).status).toBe(503);
@@ -186,7 +184,7 @@ describe('server hooks', () => {
 		await hooks.init();
 		expect(development).toHaveBeenCalledOnce();
 		expect(production).not.toHaveBeenCalled();
-		expect(mocks.boot).toHaveBeenCalledExactlyOnceWith(undefined, mocks.env);
+		expect(mocks.boot).toHaveBeenCalledExactlyOnceWith();
 		process.emit('directory:dev-stop');
 	});
 
diff --git a/apps/web/src/hooks.server.ts b/apps/web/src/hooks.server.ts
index 80f8fb2..2653ea7 100644
--- a/apps/web/src/hooks.server.ts
+++ b/apps/web/src/hooks.server.ts
@@ -1,5 +1,4 @@
 import { building, dev } from '$app/env';
-import { env } from '$env/dynamic/private';
 import { sequence, type Handle, type ServerInit } from '@sveltejs/kit/hooks';
 import { themeStyleTag } from './lib/server/appearance.js';
 import type { ServerState } from './lib/server/application.js';
@@ -12,8 +11,8 @@ const server: ServerState = { application: undefined };
 export const init: ServerInit = async () => {
 	if (building) return;
 	try {
-		if (dev) await startDevelopment(server, env);
-		else await startProduction(server, env);
+		if (dev) await startDevelopment(server);
+		else await startProduction(server);
 	} catch (error) {
 		reportStartupFailure(error);
 		// eslint-disable-next-line preserve-caught-error -- Raw startup errors may contain configuration secrets.
diff --git a/apps/web/src/lib/server/boot.process.test.ts b/apps/web/src/lib/server/boot.process.test.ts
index 54861de..e0b404e 100644
--- a/apps/web/src/lib/server/boot.process.test.ts
+++ b/apps/web/src/lib/server/boot.process.test.ts
@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { describe, expect, it, onTestFinished, vi } from 'vitest';
 import { applySetCookies } from 'better-auth/cookies';
+import { PUBLIC_AUTHORITY_HEADER, PUBLIC_PROTOCOL_HEADER } from './runtime-environment.js';
 
 const serverModule = new URL('../../../build/bootstrap/start.js', import.meta.url).href;
 const sentinel = 'PRIVATE_CONFIG_CREDENTIAL_LINK';
@@ -38,8 +39,8 @@ async function launchServer(contents: string | undefined, environment: NodeJS.Pr
 	const script = `
 import { once } from 'node:events';
 const { server } = await import(${JSON.stringify(serverModule)});
-if (!server.server.listening) await once(server.server, 'listening');
-process.send(server.server.address().port);
+if (!server.listening) await once(server, 'listening');
+process.send(server.address().port);
 `;
 	const child = spawn(process.execPath, ['--input-type=module', '--eval', script], {
 		cwd: temporary,
@@ -202,7 +203,9 @@ it.each([
 		host: 'foreign.example.com',
 		'x-forwarded-host': 'foreign.example.com',
 		'x-forwarded-proto': 'http',
-		'x-forwarded-port': '80'
+		'x-forwarded-port': '80',
+		[PUBLIC_PROTOCOL_HEADER]: 'http',
+		[PUBLIC_AUTHORITY_HEADER]: 'foreign.example.com:80'
 	};
 	const gated = await fetch(address, { redirect: 'manual', headers: transportHeaders });
 	expect(gated.status).toBe(303);
@@ -231,18 +234,26 @@ it.each([
 	applySetCookies(headers, response.headers.getSetCookie());
 	const authenticated = await fetch(address, { redirect: 'manual', headers });
 	expect(authenticated.status).toBe(200);
-	expect(await authenticated.text()).not.toContain(sentinel);
+	const html = await authenticated.text();
+	expect(html).toContain(`property="og:url" content="${origin}/"`);
+	expect(html).not.toContain(sentinel);
 	expect(server.output()).not.toContain(sentinel);
 	expect(server.output()).not.toContain(server.path);
 	expect(await server.stop()).toEqual({ code: 0, signal: null });
 });
 
 it('keeps application environment references and fallbacks stable across bootstrap and reloads', async () => {
-	const fallbackTitle = '${DIRECTORY_TITLE} ${MISSING_TITLE:-Fallback}';
-	const title = 'Configured Fallback';
+	const fallbackTitle =
+		'${DIRECTORY_TITLE} ${MISSING_TITLE:-Fallback} ${ORIGIN} ${HOST_HEADER} ${PROTOCOL_HEADER} ${PORT_HEADER}';
+	const title =
+		'Configured Fallback http://localhost original-host original-protocol original-port';
 	const server = await launchServer(source(fallbackTitle), {
 		...hostileEnvironment,
-		DIRECTORY_TITLE: 'Configured'
+		DIRECTORY_TITLE: 'Configured',
+		ORIGIN: 'http://localhost',
+		HOST_HEADER: 'original-host',
+		PROTOCOL_HEADER: 'original-protocol',
+		PORT_HEADER: 'original-port'
 	});
 	const address = await server.ready();
 	await expectPage(address, title);
diff --git a/apps/web/src/lib/server/boot.test.ts b/apps/web/src/lib/server/boot.test.ts
index 1f95327..61aa08d 100644
--- a/apps/web/src/lib/server/boot.test.ts
+++ b/apps/web/src/lib/server/boot.test.ts
@@ -12,7 +12,8 @@ const mocks = vi.hoisted(() => ({
 	load: vi.fn<typeof import('@directory/config').loadConfigFile>(),
 	monitor: vi.fn<typeof import('@directory/config').startConfigReloading>(),
 	auth: vi.fn<typeof import('./auth/index.js').createAuthentication>(),
-	stop: vi.fn<() => void>()
+	stop: vi.fn<() => void>(),
+	runtime: vi.fn<typeof import('./runtime-environment.js').getRuntimeEnvironment>()
 }));
 vi.mock('@directory/config', async (importOriginal) => ({
 	...(await importOriginal<typeof import('@directory/config')>()),
@@ -22,11 +23,11 @@ vi.mock('@directory/config', async (importOriginal) => ({
 	startConfigReloading: mocks.monitor
 }));
 vi.mock('./auth/index.js', () => ({ createAuthentication: mocks.auth }));
+vi.mock('./runtime-environment.js', () => ({ getRuntimeEnvironment: mocks.runtime }));
 
 const path = '/config/directory.yaml';
 const sentinel = 'PRIVATE-config-credential';
 const origin = 'https://directory.example.com';
-const frameworkEnv = { ORIGIN: origin };
 const auth = { credentials: { username: 'family', password: sentinel } };
 const authentication: Authentication = {
 	strategy: 'credentials',
@@ -41,7 +42,7 @@ function configuration(title = 'Home', enabled = false): DirectoryConfiguration
 
 beforeEach(() => {
 	vi.resetAllMocks();
-	vi.stubEnv('ORIGIN', origin);
+	mocks.runtime.mockReturnValue({ env: process.env, origin });
 	mocks.path.mockReturnValue(path);
 	mocks.publicDir.mockReturnValue('/mounted/public');
 	mocks.load.mockResolvedValue(configuration());
@@ -56,7 +57,7 @@ describe('application boot wiring', () => {
 		const pending = Promise.withResolvers<DirectoryConfiguration>();
 		mocks.load.mockReturnValueOnce(pending.promise);
 		const env = { CONFIG_PATH: path, DIRECTORY_PUBLIC_DIR: '/mounted/public' };
-		const startup = bootApp(env);
+		const startup = bootApp({ env, origin });
 		expect(mocks.path).toHaveBeenCalledExactlyOnceWith({ env });
 		expect(mocks.publicDir).toHaveBeenCalledExactlyOnceWith(path, { env });
 		expect(mocks.load).toHaveBeenCalledExactlyOnceWith(path, { env });
@@ -106,11 +107,11 @@ describe('application boot wiring', () => {
 	});
 
 	it('constructs auth before monitoring from the prepared origin, not legacy auth settings', async () => {
-		vi.stubEnv('ORIGIN', origin);
+		vi.stubEnv('ORIGIN', 'https://not-kit.example.com');
 		vi.stubEnv('AUTH_URL', 'https://not-kit.example.com');
 		mocks.load.mockResolvedValueOnce(configuration('Home', true));
 		const env = { ORIGIN: sentinel, AUTH_URL: sentinel };
-		const app = await bootApp(env, frameworkEnv);
+		const app = await bootApp({ env, origin });
 		expect(mocks.load).toHaveBeenCalledExactlyOnceWith(path, { env });
 		expect(mocks.auth).toHaveBeenCalledExactlyOnceWith({ ...auth, origin });
 		expect(mocks.auth.mock.invocationCallOrder[0]).toBeLessThan(
@@ -122,51 +123,30 @@ describe('application boot wiring', () => {
 	describe.each([false, true])('canonical URL consistency (auth enabled: %s)', (enabled) => {
 		it('boots with the prepared canonical URL regardless of auth state', async () => {
 			mocks.load.mockResolvedValueOnce(configuration('Home', enabled));
-			const app = await bootApp({}, frameworkEnv);
+			const app = await bootApp({ env: {}, origin });
 			expect(app.currentSnapshot().configuration.site.url).toBe(origin);
 			expect(app.authentication).toBe(enabled ? authentication : undefined);
 		});
 
-		it.each([
-			{ name: 'process ORIGIN missing', prepared: undefined, privateEnv: frameworkEnv },
-			{ name: 'process ORIGIN empty', prepared: '', privateEnv: frameworkEnv },
-			{
-				name: 'prepared process origin changed',
-				prepared: 'https://other.example.com',
-				privateEnv: frameworkEnv
-			},
-			{ name: 'Kit private URLs missing', prepared: origin, privateEnv: {} },
-			{
-				name: 'Kit private ORIGIN differs',
-				prepared: origin,
-				privateEnv: { ...frameworkEnv, ORIGIN: sentinel }
-			},
-			{
-				name: 'site.url changed after preparation',
-				prepared: origin,
-				privateEnv: frameworkEnv,
-				url: 'https://other.example.com'
-			}
-		])(
-			'fails closed when $name before auth or monitoring',
-			async ({ prepared, privateEnv, ...change }) => {
-				vi.stubEnv('ORIGIN', prepared);
-				const config = configuration('Home', enabled);
-				if ('url' in change && change.url) config.site.url = change.url;
-				mocks.load.mockResolvedValueOnce(config);
-				await expect(bootApp({}, privateEnv)).rejects.toMatchObject({
-					issue: { code: 'auth_failed' }
-				});
-				expect(mocks.auth).not.toHaveBeenCalled();
-				expect(mocks.monitor).not.toHaveBeenCalled();
-			}
-		);
+		it('rejects a changed site.url before auth or monitoring', async () => {
+			const config = configuration('Home', enabled);
+			config.site.url = 'https://other.example.com';
+			mocks.load.mockResolvedValueOnce(config);
+			await expect(bootApp({ env: {}, origin })).rejects.toMatchObject({
+				issue: { code: 'auth_failed' }
+			});
+			expect(mocks.auth).not.toHaveBeenCalled();
+			expect(mocks.monitor).not.toHaveBeenCalled();
+		});
 	});
 
-	it('uses the process environment when no environments are injected', async () => {
+	it('uses the captured environment rather than the modified process environment', async () => {
+		const env = { CONFIG_PATH: path, HOST_HEADER: 'original-host-header' };
+		mocks.runtime.mockReturnValue({ env, origin });
+		vi.stubEnv('HOST_HEADER', 'changed-by-adapter-preparation');
 		await bootApp();
-		expect(mocks.path).toHaveBeenCalledExactlyOnceWith({ env: process.env });
-		expect(mocks.load).toHaveBeenCalledExactlyOnceWith(path, { env: process.env });
+		expect(mocks.path).toHaveBeenCalledExactlyOnceWith({ env });
+		expect(mocks.load).toHaveBeenCalledExactlyOnceWith(path, { env });
 	});
 
 	it('retains safe loader diagnostics without starting monitoring', async () => {
@@ -196,12 +176,11 @@ describe('application boot wiring', () => {
 	);
 
 	it('does not start monitoring when authentication initialization fails', async () => {
-		vi.stubEnv('ORIGIN', origin);
 		mocks.load.mockResolvedValueOnce(configuration('Home', true));
 		mocks.auth.mockImplementationOnce(() => {
 			throw new Error(sentinel);
 		});
-		await expect(bootApp({}, frameworkEnv)).rejects.toMatchObject({
+		await expect(bootApp({ env: {}, origin })).rejects.toMatchObject({
 			issue: { code: 'auth_failed' }
 		});
 		expect(mocks.monitor).not.toHaveBeenCalled();
diff --git a/apps/web/src/lib/server/boot.ts b/apps/web/src/lib/server/boot.ts
index 548f1c7..318db19 100644
--- a/apps/web/src/lib/server/boot.ts
+++ b/apps/web/src/lib/server/boot.ts
@@ -5,16 +5,16 @@ import {
 	resolvePublicDir,
 	startConfigReloading
 } from '@directory/config';
-import type { ConfigEnvironment, DirectoryConfiguration } from '@directory/config/types';
+import type { DirectoryConfiguration } from '@directory/config/types';
 import { createApplication, type Application } from './application.js';
 import { DirectoryError } from './directory-error.js';
 import { reportConfigError } from './logger.js';
+import { getRuntimeEnvironment, type RuntimeEnvironment } from './runtime-environment.js';
 
 export async function bootApp(
-	env: ConfigEnvironment = process.env,
-	frameworkEnv: ConfigEnvironment = process.env
+	runtime: RuntimeEnvironment = getRuntimeEnvironment()
 ): Promise<Application> {
-	const options = { env };
+	const options = { env: runtime.env };
 	let path: string;
 	let publicDir: string;
 	let config: DirectoryConfiguration;
@@ -30,7 +30,7 @@ export async function bootApp(
 	}
 
 	// Reject changes between framework URL preparation and the initial application load.
-	if (config.site.url !== process.env.ORIGIN || config.site.url !== frameworkEnv.ORIGIN) {
+	if (config.site.url !== runtime.origin) {
 		throw new DirectoryError({ code: 'auth_failed' });
 	}
 
diff --git a/apps/web/src/lib/server/lifecycle/development.test.ts b/apps/web/src/lib/server/lifecycle/development.test.ts
index cfe0c25..4eac290 100644
--- a/apps/web/src/lib/server/lifecycle/development.test.ts
+++ b/apps/web/src/lib/server/lifecycle/development.test.ts
@@ -48,7 +48,7 @@ describe('development lifecycle', () => {
 		mocks.boot.mockResolvedValueOnce(ready);
 		const off = vi.spyOn(process, 'off');
 		await startDevelopment(server);
-		expect(mocks.boot).toHaveBeenCalledExactlyOnceWith(undefined, undefined);
+		expect(mocks.boot).toHaveBeenCalledExactlyOnceWith();
 		expect(server.application).toBe(ready);
 		expect(listeners.mock.calls.filter(([name]) => name === 'sveltekit:shutdown')).toEqual([]);
 		const shutdown = devStopListener();
diff --git a/apps/web/src/lib/server/lifecycle/development.ts b/apps/web/src/lib/server/lifecycle/development.ts
index 177bd3c..758455c 100644
--- a/apps/web/src/lib/server/lifecycle/development.ts
+++ b/apps/web/src/lib/server/lifecycle/development.ts
@@ -1,4 +1,3 @@
-import type { ConfigEnvironment } from '@directory/config/types';
 import { bootApp } from '../boot.js';
 import type { Application, ServerState } from '../application.js';
 
@@ -8,17 +7,14 @@ interface DevelopmentAttempt {
 	stopped: boolean;
 }
 
-export async function startDevelopment(
-	server: ServerState,
-	env?: ConfigEnvironment
-): Promise<void> {
+export async function startDevelopment(server: ServerState): Promise<void> {
 	process.emit('directory:dev-stop');
 	const attempt: DevelopmentAttempt = { server, application: undefined, stopped: false };
 	const shutdown = () => stopDevelopment(attempt, shutdown);
 	process.once('directory:dev-stop', shutdown);
 	let application: Application;
 	try {
-		application = await bootApp(undefined, env);
+		application = await bootApp();
 	} catch (error) {
 		stopDevelopment(attempt, shutdown);
 		throw error;
diff --git a/apps/web/src/lib/server/lifecycle/production.test.ts b/apps/web/src/lib/server/lifecycle/production.test.ts
index ae733ad..1f5959d 100644
--- a/apps/web/src/lib/server/lifecycle/production.test.ts
+++ b/apps/web/src/lib/server/lifecycle/production.test.ts
@@ -44,7 +44,7 @@ describe('production lifecycle', () => {
 		const ready = application('Production');
 		mocks.boot.mockResolvedValueOnce(ready);
 		await startProduction(server);
-		expect(mocks.boot).toHaveBeenCalledExactlyOnceWith(undefined, undefined);
+		expect(mocks.boot).toHaveBeenCalledExactlyOnceWith();
 		expect(server.application).toBe(ready);
 		expect(listeners.mock.calls.filter(([name]) => name === 'directory:dev-stop')).toEqual([]);
 		const shutdown = listeners.mock.calls.find(([name]) => name === 'sveltekit:shutdown')![1];
diff --git a/apps/web/src/lib/server/lifecycle/production.ts b/apps/web/src/lib/server/lifecycle/production.ts
index 5cc9f21..7820190 100644
--- a/apps/web/src/lib/server/lifecycle/production.ts
+++ b/apps/web/src/lib/server/lifecycle/production.ts
@@ -1,9 +1,8 @@
-import type { ConfigEnvironment } from '@directory/config/types';
 import { bootApp } from '../boot.js';
 import type { Application, ServerState } from '../application.js';
 
-export async function startProduction(server: ServerState, env?: ConfigEnvironment): Promise<void> {
-	const application = await bootApp(undefined, env);
+export async function startProduction(server: ServerState): Promise<void> {
+	const application = await bootApp();
 	// adapter-node emits shutdown after listening, which waits for Kit init.
 	process.once('sveltekit:shutdown', () => stopProduction(server, application));
 	server.application = application;
diff --git a/apps/web/src/lib/server/runtime-environment.test.ts b/apps/web/src/lib/server/runtime-environment.test.ts
index 126b3c9..0bc03f0 100644
--- a/apps/web/src/lib/server/runtime-environment.test.ts
+++ b/apps/web/src/lib/server/runtime-environment.test.ts
@@ -1,27 +1,29 @@
-import { spawn } from 'node:child_process';
-import { cp, mkdir, mkdtemp, rm, symlink, writeFile } from 'node:fs/promises';
+import { spawn, spawnSync } from 'node:child_process';
+import { cp, mkdir, mkdtemp, readdir, rm, symlink, writeFile } from 'node:fs/promises';
+import {
+	createServer as createHttpServer,
+	type IncomingMessage,
+	type ServerResponse
+} from 'node:http';
 import { createServer } from 'node:net';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { DirectoryError } from './directory-error.js';
-import { prepareRuntimeEnvironment } from './runtime-environment.js';
+import {
+	installRequestOrigin,
+	prepareAdapterEnvironment,
+	prepareRuntimeEnvironment,
+	PUBLIC_AUTHORITY_HEADER,
+	PUBLIC_PROTOCOL_HEADER
+} from './runtime-environment.js';
 
 const origin = 'https://directory.example.com';
 const sentinel = 'PRIVATE-runtime-setting';
 let directory: string;
 let path: string;
 
-beforeEach(async () => {
-	directory = await mkdtemp(join(tmpdir(), 'directory-runtime-'));
-	path = join(directory, 'directory.yaml');
-});
-
-afterEach(async () => {
-	await rm(directory, { recursive: true, force: true });
-});
-
 function credentials(extra = ''): string {
 	return `links: {}
 site:
@@ -33,8 +35,36 @@ auth:
 ${extra}`;
 }
 
-describe('framework environment preparation', () => {
-	it('captures the final Vite CLI port before Kit snapshots the stale framework origin', async () => {
+describe('runtime environment preparation', () => {
+	beforeEach(async () => {
+		directory = await mkdtemp(join(tmpdir(), 'directory-runtime-'));
+		path = join(directory, 'directory.yaml');
+	});
+
+	afterEach(async () => {
+		await rm(directory, { recursive: true, force: true });
+	});
+
+	it('loads tooling configuration without requiring operator YAML', () => {
+		const web = fileURLToPath(new URL('../../../', import.meta.url));
+		const script = `
+import { loadConfig } from ${JSON.stringify(import.meta.resolve('@sveltejs/load-config'))};
+const result = await loadConfig(${JSON.stringify(web)}, { traverse: false });
+if (!result) throw new Error('Svelte configuration not found');
+if ('error' in result) throw result.error;
+`;
+		const env: NodeJS.ProcessEnv = { ...process.env, CONFIG_PATH: path };
+		delete env.VITEST;
+		const result = spawnSync(process.execPath, ['--input-type=module', '--eval', script], {
+			cwd: web,
+			env,
+			encoding: 'utf8',
+			timeout: 20_000
+		});
+		expect(result.status, result.stdout + result.stderr).toBe(0);
+	}, 30_000);
+
+	it('uses the final Vite CLI port for request URLs despite stale environment settings', async () => {
 		const web = fileURLToPath(new URL('../../../', import.meta.url));
 		const vite = join(web, 'node_modules/vite/bin/vite.js');
 		const host = '127.0.0.1';
@@ -50,12 +80,16 @@ describe('framework environment preparation', () => {
 		if (address === null || typeof address === 'string') throw new Error('Expected a TCP port');
 		const port = String(address.port);
 
-		// Run the real Vite/Kit lifecycle without writing generated files into the working app.
 		await mkdir(join(directory, 'src/routes'), { recursive: true });
-		for (const file of ['src/app.html', 'svelte.config.js', 'tsconfig.json']) {
+		for (const file of ['src/app.html', 'tsconfig.json']) {
 			await cp(join(web, file), join(directory, file));
 		}
-		await symlink(join(web, 'node_modules'), join(directory, 'node_modules'), 'dir');
+		// Kit 3 must generate this fixture's own node_modules/$app, not overwrite the app's.
+		await mkdir(join(directory, 'node_modules'));
+		for (const name of await readdir(join(web, 'node_modules'))) {
+			if (name.startsWith('.') || name === '$app') continue;
+			await symlink(join(web, 'node_modules', name), join(directory, 'node_modules', name), 'dir');
+		}
 		await writeFile(join(directory, 'package.json'), '{"type":"module"}');
 		await writeFile(
 			join(directory, 'vite.config.mjs'),
@@ -63,18 +97,21 @@ describe('framework environment preparation', () => {
 export default (env) => {
   const result = config(env);
   return { ...result, cacheDir: ${JSON.stringify(join(directory, '.vite'))},
-    server: { ...result.server, fs: { allow: ${JSON.stringify([directory, web])} } } };
+    server: { ...result.server, fs: { allow: ${JSON.stringify([directory, join(web, '../..')])} } } };
 };`
 		);
 		await writeFile(path, 'links: {}');
+		await writeFile(
+			join(directory, 'src/hooks.server.ts'),
+			`export { init, handle } from ${JSON.stringify(join(web, 'src/hooks.server.ts'))};`
+		);
 		await writeFile(
 			join(directory, '.env'),
 			'PORT=2\nORIGIN=https://stale.example.com\nAUTH_URL=https://stale.example.com\n'
 		);
 		await writeFile(
 			join(directory, 'src/routes/+page.server.js'),
-			`import { env } from '$env/dynamic/private';
-export const load = () => ({ settings: env.ORIGIN + '|' + process.env.PORT });`
+			`export const load = ({ url }) => ({ settings: url.origin + '|' + process.env.PORT });`
 		);
 		await writeFile(
 			join(directory, 'src/routes/+page.svelte'),
@@ -88,7 +125,13 @@ export const load = () => ({ settings: env.ORIGIN + '|' + process.env.PORT });`
 			[vite, '--host', host, '--configLoader', 'runner', '--port', port],
 			{
 				cwd: directory,
-				env: { ...env, NODE_ENV: 'development', PORT: '1', CONFIG_PATH: path },
+				env: {
+					...env,
+					NODE_ENV: 'development',
+					PORT: '1',
+					CONFIG_PATH: path,
+					DIRECTORY_PUBLIC_DIR: join(directory, 'public')
+				},
 				stdio: ['ignore', 'pipe', 'pipe']
 			}
 		);
@@ -99,13 +142,16 @@ export const load = () => ({ settings: env.ORIGIN + '|' + process.env.PORT });`
 		child.once('error', (error) => (failure = error));
 		const closed = new Promise<void>((resolve) => child.once('close', () => resolve()));
 		try {
-			// Probe HTTP, not Vite's console URL (which changes with CI and ANSI colors).
 			const html = await vi.waitFor(
 				async () => {
 					expect(failure, output).toBeUndefined();
 					expect(child.exitCode, output).toBeNull();
 					const response = await fetch(`http://${host}:${port}/`, {
-						headers: { connection: 'close' },
+						headers: {
+							connection: 'close',
+							[PUBLIC_PROTOCOL_HEADER]: 'https',
+							[PUBLIC_AUTHORITY_HEADER]: 'foreign.example.com'
+						},
 						signal: AbortSignal.timeout(5000)
 					});
 					const html = await response.text();
@@ -126,7 +172,7 @@ export const load = () => ({ settings: env.ORIGIN + '|' + process.env.PORT });`
 		}
 	}, 30_000);
 
-	it('uses site.url instead of legacy framework settings', async () => {
+	it('uses YAML site.url without treating legacy framework settings as configuration', async () => {
 		await writeFile(path, credentials());
 		const env = {
 			CONFIG_PATH: path,
@@ -137,8 +183,10 @@ export const load = () => ({ settings: env.ORIGIN + '|' + process.env.PORT });`
 			AUTH_SECRET: sentinel
 		};
 		const before = { ...env };
-		await prepareRuntimeEnvironment(env);
-		expect(env).toEqual({ ...before, ORIGIN: origin });
+		const runtime = await prepareRuntimeEnvironment(env);
+		expect(runtime.origin).toBe(origin);
+		expect(runtime.env).toEqual(before);
+		expect(env).toEqual(before);
 	});
 
 	it.each([
@@ -146,63 +194,55 @@ export const load = () => ({ settings: env.ORIGIN + '|' + process.env.PORT });`
 		{ settings: { NODE_ENV: 'development' }, expected: 'http://localhost:5173' },
 		{ settings: { NODE_ENV: 'production', PORT: '8080' }, expected: 'http://localhost:8080' }
 	])(
-		'sets canonical framework URLs for an open directory: $expected',
+		'prepares the default origin for an open directory: $expected',
 		async ({ settings, expected }) => {
 			await writeFile(path, 'links: {}');
-			const env = {
-				CONFIG_PATH: path,
-				ORIGIN: sentinel,
-				AUTH_URL: sentinel,
-				NEXTAUTH_URL: sentinel,
-				AUTH_REDIRECT_PROXY_URL: sentinel,
-				...settings
-			};
-			await prepareRuntimeEnvironment(env);
-			expect(env.ORIGIN).toBe(expected);
-			expect(env.AUTH_URL).toBe(sentinel);
+			const runtime = await prepareRuntimeEnvironment({ CONFIG_PATH: path, ...settings });
+			expect(runtime.origin).toBe(expected);
 		}
 	);
 
-	it('uses an explicit site.url even with auth disabled and an ephemeral listen port', async () => {
-		await writeFile(path, `site:\n  url: '${origin}'\nlinks: {}`);
-		const env = { CONFIG_PATH: path, PORT: '0', ORIGIN: sentinel, AUTH_URL: sentinel };
-		await prepareRuntimeEnvironment(env);
-		expect(env.ORIGIN).toBe(origin);
-		expect(env.AUTH_URL).toBe(sentinel);
-	});
-
-	it('preserves explicit legacy-named environment interpolation in YAML', async () => {
+	it('keeps interpolation values captured before transport settings are changed', async () => {
 		await writeFile(path, credentials().replace(origin, '${ORIGIN}'));
-		const env = { CONFIG_PATH: path, ORIGIN: origin, AUTH_URL: sentinel };
-		await prepareRuntimeEnvironment(env);
-		expect(env.ORIGIN).toBe(origin);
-		expect(env.AUTH_URL).toBe(sentinel);
+		const env = {
+			CONFIG_PATH: path,
+			PORT: '0',
+			ORIGIN: origin,
+			HOST_HEADER: 'original-host',
+			PROTOCOL_HEADER: 'original-protocol',
+			PORT_HEADER: 'original-port',
+			AUTH_SECRET: sentinel
+		};
+		const before = { ...env };
+		const runtime = await prepareRuntimeEnvironment(env);
+		prepareAdapterEnvironment(env);
+		expect(runtime.origin).toBe(origin);
+		expect(runtime.env).toEqual(before);
+		expect(env.ORIGIN).toBeUndefined();
+		expect(env).toMatchObject({
+			HOST_HEADER: PUBLIC_AUTHORITY_HEADER,
+			PROTOCOL_HEADER: PUBLIC_PROTOCOL_HEADER,
+			PORT_HEADER: '',
+			AUTH_SECRET: sentinel
+		});
 	});
 
 	it.each([{ PORT: '0' }, { SOCKET_PATH: '/tmp/directory.sock' }, { LISTEN_FDS: '1' }])(
 		'fails safely without site.url for a nonstandard listener: %j',
 		async (settings) => {
 			await writeFile(path, 'links: {}');
-			const env = {
-				CONFIG_PATH: path,
-				ORIGIN: sentinel,
-				AUTH_URL: sentinel,
-				NEXTAUTH_URL: sentinel,
-				AUTH_REDIRECT_PROXY_URL: sentinel,
-				...settings
-			};
-			const before = { ...env };
-			await expect(prepareRuntimeEnvironment(env)).rejects.toMatchObject({
+			await expect(
+				prepareRuntimeEnvironment({ CONFIG_PATH: path, ...settings })
+			).rejects.toMatchObject({
 				issue: {
 					code: 'load_failed',
 					issues: [expect.objectContaining({ code: 'invalid_value', path: '/site/url' })]
 				}
 			});
-			expect(env).toEqual(before);
 		}
 	);
 
-	it('fails safely before changing the environment for invalid configuration', async () => {
+	it('redacts invalid configuration without changing the caller environment', async () => {
 		await writeFile(path, credentials(`  secret: '${sentinel}'\n`));
 		const env = { CONFIG_PATH: path, ORIGIN: sentinel, AUTH_URL: sentinel };
 		const before = { ...env };
@@ -221,3 +261,38 @@ export const load = () => ({ settings: env.ORIGIN + '|' + process.env.PORT });`
 		});
 	});
 });
+
+it.each([
+	{
+		origin: 'https://directory.example.com:8443',
+		protocol: 'https',
+		authority: 'directory.example.com:8443'
+	},
+	{ origin: 'http://[::1]:8080', protocol: 'http', authority: '[::1]:8080' }
+])(
+	'overwrites private headers before the adapter sees $origin, without rewriting browser Origin',
+	({ origin, protocol, authority }) => {
+		let received: IncomingMessage['headers'] | undefined;
+		const server = createHttpServer((request) => {
+			received = { ...request.headers };
+		});
+		installRequestOrigin(server, origin);
+		const request = {
+			headers: {
+				host: 'foreign.example.com',
+				origin: 'https://foreign.example.com',
+				'x-forwarded-host': 'foreign.example.com',
+				[PUBLIC_PROTOCOL_HEADER]: 'https',
+				[PUBLIC_AUTHORITY_HEADER]: 'foreign.example.com'
+			}
+		} as unknown as IncomingMessage;
+		server.emit('request', request, {} as ServerResponse);
+		expect(received).toEqual({
+			host: 'foreign.example.com',
+			origin: 'https://foreign.example.com',
+			'x-forwarded-host': 'foreign.example.com',
+			[PUBLIC_PROTOCOL_HEADER]: protocol,
+			[PUBLIC_AUTHORITY_HEADER]: authority
+		});
+	}
+);
diff --git a/apps/web/src/lib/server/runtime-environment.ts b/apps/web/src/lib/server/runtime-environment.ts
index 49f407d..b551f1e 100644
--- a/apps/web/src/lib/server/runtime-environment.ts
+++ b/apps/web/src/lib/server/runtime-environment.ts
@@ -1,12 +1,29 @@
 import { ConfigError, loadConfigFile } from '@directory/config';
+import type { ConfigEnvironment } from '@directory/config/types';
+import type { Server } from 'node:http';
 import { DirectoryError } from './directory-error.js';
 
+export const PUBLIC_PROTOCOL_HEADER = 'x-directory-public-protocol';
+export const PUBLIC_AUTHORITY_HEADER = 'x-directory-public-authority';
+
+export interface RuntimeEnvironment {
+	readonly env: ConfigEnvironment;
+	readonly origin: string;
+}
+
+// The standalone bootstrap and Kit's bundled hooks need the same captured values.
+const runtimeKey = Symbol.for('directory.runtime-environment');
+const runtimeState = globalThis as typeof globalThis & {
+	[runtimeKey]?: RuntimeEnvironment;
+};
+
 export async function prepareRuntimeEnvironment(
-	env: NodeJS.ProcessEnv = process.env
-): Promise<void> {
+	env: ConfigEnvironment = process.env
+): Promise<RuntimeEnvironment> {
+	const captured = Object.freeze({ ...env });
 	let origin: string;
 	try {
-		const config = await loadConfigFile(undefined, { env });
+		const config = await loadConfigFile(undefined, { env: captured });
 		origin = config.site.url;
 	} catch (error) {
 		throw new DirectoryError({
@@ -15,6 +32,29 @@ export async function prepareRuntimeEnvironment(
 		});
 	}
 
-	// adapter-node 5 still captures ORIGIN before Kit starts; authentication uses site.url directly.
-	env.ORIGIN = origin;
+	const runtime = Object.freeze({ env: captured, origin });
+	runtimeState[runtimeKey] = runtime;
+	return runtime;
+}
+
+export function getRuntimeEnvironment(): RuntimeEnvironment {
+	const runtime = runtimeState[runtimeKey];
+	if (!runtime) throw new DirectoryError({ code: 'prepare_failed' });
+	return runtime;
+}
+
+export function prepareAdapterEnvironment(env: NodeJS.ProcessEnv = process.env): void {
+	delete env.ORIGIN;
+	env.PROTOCOL_HEADER = PUBLIC_PROTOCOL_HEADER;
+	env.HOST_HEADER = PUBLIC_AUTHORITY_HEADER;
+	env.PORT_HEADER = '';
+}
+
+export function installRequestOrigin(server: Server, origin: string): void {
+	const url = new URL(origin);
+	const protocol = url.protocol.slice(0, -1);
+	server.prependListener('request', (request) => {
+		request.headers[PUBLIC_PROTOCOL_HEADER] = protocol;
+		request.headers[PUBLIC_AUTHORITY_HEADER] = url.host;
+	});
 }
diff --git a/apps/web/src/start.ts b/apps/web/src/start.ts
index 69c7fa5..57146a5 100644
--- a/apps/web/src/start.ts
+++ b/apps/web/src/start.ts
@@ -1,13 +1,17 @@
-import { prepareRuntimeEnvironment } from './lib/server/runtime-environment.js';
+import {
+	installRequestOrigin,
+	prepareAdapterEnvironment,
+	prepareRuntimeEnvironment
+} from './lib/server/runtime-environment.js';
 import { reportStartupFailure } from './lib/server/logger.js';
 
-try {
-	await prepareRuntimeEnvironment();
-} catch (error) {
+const runtime = await prepareRuntimeEnvironment().catch((error: unknown) => {
 	reportStartupFailure(error);
 	process.exit(1);
-}
+});
+prepareAdapterEnvironment();
 
-// adapter-node captures ORIGIN during import, before its Kit init hook runs.
 const entry = '../index.js';
 export const { server } = await import(entry);
+// Adapter initialization finishes before listening; install before the next request turn.
+installRequestOrigin(server, runtime.origin);
diff --git a/apps/web/tsconfig.json b/apps/web/tsconfig.json
index 8827211..9be4e0f 100644
--- a/apps/web/tsconfig.json
+++ b/apps/web/tsconfig.json
@@ -7,23 +7,5 @@
 		"sourceMap": true,
 		"types": ["$app/types", "node", "unplugin-icons/types/svelte"]
 	},
-	"include": [
-		".svelte-kit/ambient.d.ts",
-		".svelte-kit/env.d.ts",
-		".svelte-kit/non-ambient.d.ts",
-		".svelte-kit/types/**/$types.d.ts",
-		"vite.config.js",
-		"vite.config.ts",
-		"src/**/*.js",
-		"src/**/*.ts",
-		"src/**/*.svelte",
-		"test/**/*.js",
-		"test/**/*.ts",
-		"test/**/*.svelte",
-		"tests/**/*.js",
-		"tests/**/*.ts",
-		"tests/**/*.svelte",
-		"playwright.config.ts",
-		"e2e/**/*.ts"
-	]
+	"include": ["src", "vite.config.ts", "vitest.config.ts", "playwright.config.ts", "e2e/**/*.ts"]
 }
diff --git a/apps/web/vite.config.ts b/apps/web/vite.config.ts
index 94895c2..deb8364 100644
--- a/apps/web/vite.config.ts
+++ b/apps/web/vite.config.ts
@@ -1,20 +1,36 @@
 import adapter from '@sveltejs/adapter-node';
+import type { Adapter } from '@sveltejs/kit';
+import { getRequest } from '@sveltejs/kit/node';
 import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
 import { sveltekit } from '@sveltejs/kit/vite';
 import { defineConfig, loadEnv } from 'vite';
 import { prepareRuntimeEnvironment } from './src/lib/server/runtime-environment.js';
 import Icons from 'unplugin-icons/vite';
 
-const connectSources = ['self'];
+const connectSources: ('self' | 'ws:' | 'wss:')[] = ['self'];
 
 if (process.env.NODE_ENV === 'development') connectSources.push('ws:', 'wss:');
 
+function createAdapter(getOrigin: () => string | undefined): Adapter {
+	const native = adapter();
+	const nativeVite = native.vite;
+	return {
+		...native,
+		vite: (context) => {
+			const settings = typeof nativeVite === 'function' ? nativeVite(context) : nativeVite;
+			return {
+				...settings,
+				getRequest: (options) => getRequest({ ...options, base: getOrigin() ?? options.base })
+			};
+		}
+	};
+}
+
 export default defineConfig(({ command, mode, isPreview }) => {
 	const development = command === 'serve' && !isPreview;
-	if (development) {
-		Object.assign(process.env, loadEnv(mode, process.cwd(), ''));
-	}
-	const port = Number(process.env.PORT ?? 5173);
+	const environment = development ? loadEnv(mode, process.cwd(), '') : undefined;
+	const port = Number(environment?.PORT ?? process.env.PORT ?? 5173);
+	let origin: string | undefined;
 	return {
 		server: { port, strictPort: true },
 		optimizeDeps: { include: ['fuse.js'] },
@@ -22,21 +38,19 @@ export default defineConfig(({ command, mode, isPreview }) => {
 			{
 				name: 'directory-dev-environment',
 				enforce: 'pre',
-				config: {
-					order: 'pre',
-					async handler(config) {
-						if (!development) return;
-						// CLI overrides are merged before config hooks. Kit snapshots env in its own
-						// config hook, so configResolved would leave $env/dynamic/private stale.
-						process.env.PORT = String(config.server?.port ?? 5173);
-						await prepareRuntimeEnvironment();
-					}
+				async configureServer(server) {
+					if (!development) return;
+					Object.assign(process.env, environment);
+					// Config discovery also uses command=serve. Wait for a real dev server,
+					// after CLI overrides, before reading operator YAML.
+					process.env.PORT = String(server.config.server.port ?? 5173);
+					origin = (await prepareRuntimeEnvironment()).origin;
 				}
 			},
 
 			sveltekit({
 				preprocess: vitePreprocess(),
-				adapter: adapter(),
+				adapter: createAdapter(() => origin),
 				csp: {
 					// OIDC form redirects cross origins; state-changing requests are checked server-side.
 					directives: {
diff --git a/eslint.config.js b/eslint.config.js
index 2c271bc..aa6fbd3 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -4,7 +4,15 @@ import svelte from 'eslint-plugin-svelte';
 import { defineConfig } from 'eslint/config';
 import globals from 'globals';
 import ts from 'typescript-eslint';
-import svelteConfig from './apps/web/svelte.config.js';
+import { loadConfig } from '@sveltejs/load-config';
+import { fileURLToPath } from 'node:url';
+
+const loadedConfig = await loadConfig(fileURLToPath(new URL('./apps/web', import.meta.url)), {
+	traverse: false
+});
+if (!loadedConfig) throw new Error('Svelte configuration not found');
+if ('error' in loadedConfig) throw loadedConfig.error;
+const svelteConfig = loadedConfig.config;
 
 export default defineConfig(
 	{
diff --git a/package.json b/package.json
index 0627d15..ecedb0d 100644
--- a/package.json
+++ b/package.json
@@ -28,6 +28,7 @@
 	"devDependencies": {
 		"@changesets/cli": "catalog:",
 		"@eslint/js": "catalog:",
+		"@sveltejs/load-config": "catalog:",
 		"eslint": "catalog:",
 		"eslint-config-prettier": "catalog:",
 		"eslint-plugin-svelte": "catalog:",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 80021b7..7a5d303 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -19,11 +19,14 @@ catalogs:
       specifier: 1.61.1
       version: 1.61.1
     '@sveltejs/adapter-node':
-      specifier: 5.5.4
-      version: 5.5.4
+      specifier: 6.0.1
+      version: 6.0.1
     '@sveltejs/kit':
-      specifier: 2.70.1
-      version: 2.70.1
+      specifier: 3.1.1
+      version: 3.1.1
+    '@sveltejs/load-config':
+      specifier: 0.2.2
+      version: 0.2.2
     '@sveltejs/vite-plugin-svelte':
       specifier: 7.1.2
       version: 7.1.2
@@ -61,11 +64,11 @@ catalogs:
       specifier: 3.5.2
       version: 3.5.2
     svelte:
-      specifier: 5.56.0
-      version: 5.56.0
+      specifier: 5.57.3
+      version: 5.57.3
     svelte-check:
-      specifier: 4.4.8
-      version: 4.4.8
+      specifier: 4.7.7
+      version: 4.7.7
     typescript:
       specifier: 6.0.3
       version: 6.0.3
@@ -92,6 +95,9 @@ importers:
       '@eslint/js':
         specifier: 'catalog:'
         version: 10.0.1(eslint@10.4.1)
+      '@sveltejs/load-config':
+        specifier: 'catalog:'
+        version: 0.2.2
       eslint:
         specifier: 'catalog:'
         version: 10.4.1
@@ -100,7 +106,7 @@ importers:
         version: 10.1.8(eslint@10.4.1)
       eslint-plugin-svelte:
         specifier: 'catalog:'
-        version: 3.18.0(eslint@10.4.1)(svelte@5.56.0(@typescript-eslint/types@8.60.0))
+        version: 3.18.0(eslint@10.4.1)(svelte@5.57.3(@typescript-eslint/types@8.60.0))
       globals:
         specifier: 'catalog:'
         version: 17.6.0
@@ -109,10 +115,10 @@ importers:
         version: 3.8.3
       prettier-plugin-svelte:
         specifier: 'catalog:'
-        version: 3.5.2(prettier@3.8.3)(svelte@5.56.0(@typescript-eslint/types@8.60.0))
+        version: 3.5.2(prettier@3.8.3)(svelte@5.57.3(@typescript-eslint/types@8.60.0))
       svelte:
         specifier: 'catalog:'
-        version: 5.56.0(@typescript-eslint/types@8.60.0)
+        version: 5.57.3(@typescript-eslint/types@8.60.0)
       typescript:
         specifier: 'catalog:'
         version: 6.0.3
@@ -161,10 +167,10 @@ importers:
         version: 2.18.2(preact@10.24.3)
       better-auth:
         specifier: 1.7.14
-        version: 1.7.14(@sveltejs/kit@2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vitest@4.1.7)
+        version: 1.7.14(@sveltejs/kit@3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vitest@4.1.7)
       bits-ui:
         specifier: 'catalog:'
-        version: 2.18.1(@internationalized/date@3.12.4)(@sveltejs/kit@2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))
+        version: 2.18.1(@internationalized/date@3.12.4)(@sveltejs/kit@3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))
       fuse.js:
         specifier: 'catalog:'
         version: 7.5.0
@@ -180,13 +186,13 @@ importers:
         version: 1.61.1
       '@sveltejs/adapter-node':
         specifier: 'catalog:'
-        version: 5.5.4(@sveltejs/kit@2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))
+        version: 6.0.1(@sveltejs/kit@3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))
       '@sveltejs/kit':
         specifier: 'catalog:'
-        version: 2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
+        version: 3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
       '@sveltejs/vite-plugin-svelte':
         specifier: 'catalog:'
-        version: 7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
+        version: 7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
       '@types/node':
         specifier: 'catalog:'
         version: 24.12.4
@@ -195,16 +201,16 @@ importers:
         version: 4.1.7(vitest@4.1.7)
       svelte:
         specifier: 'catalog:'
-        version: 5.56.0(@typescript-eslint/types@8.60.0)
+        version: 5.57.3(@typescript-eslint/types@8.60.0)
       svelte-check:
         specifier: 'catalog:'
-        version: 4.4.8(picomatch@4.0.7)(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)
+        version: 4.7.7(picomatch@4.0.7)(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)
       typescript:
         specifier: 'catalog:'
         version: 6.0.3
       unplugin-icons:
         specifier: 'catalog:'
-        version: 23.0.1(svelte@5.56.0(@typescript-eslint/types@8.60.0))
+        version: 23.0.1(svelte@5.57.3(@typescript-eslint/types@8.60.0))
       vite:
         specifier: 'catalog:'
         version: 8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)
@@ -688,13 +694,6 @@ packages:
     resolution: {integrity: sha512-6QEf6yqFbETdwGITKq57aYoPfX/3K8XFNwsAlx0C1M7o8cb79sv1M3w+tWuWvIcSbNqrLF7OD7YpZMVVz335hQ==}
     engines: {node: '>=20.0.0'}
 
-  '@napi-rs/lzma-linux-x64-gnu@1.5.1':
-    resolution: {integrity: sha512-oTXEIha4SsuXdTA4Iyskj0kpdx2yVXdhd75c2v3xGrHFfVMsbhTPZU/nMPL4sWKo4pBHm3aucLaqGlF696dTyQ==}
-    engines: {node: ^22.20 || ^24.12 || >=25}
-    cpu: [x64]
-    os: [linux]
-    libc: [glibc]
-
   '@napi-rs/wasm-runtime@1.2.5':
     resolution: {integrity: sha512-HshSvXzmBxNzqejd3k/KemgQ3hdREUYFRRrgxOZ+gPljDIsO2SDZrVZMd4Z/HsxudQbE62OVyVFE8z9BCurfjA==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=23.5.0}
@@ -823,180 +822,6 @@ packages:
   '@rolldown/pluginutils@1.0.1':
     resolution: {integrity: sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==}
 
-  '@rollup/plugin-commonjs@29.0.3':
-    resolution: {integrity: sha512-ZaOxZceP7SOUW7Lqw5IRVweSQYWaeIPnXIGLiB690EBA3FGJTO40EEr2L5yZplJWsgTCogILRSpcAe7+U0Otdg==}
-    engines: {node: '>=16.0.0 || 14 >= 14.17'}
-    peerDependencies:
-      rollup: ^2.68.0||^3.0.0||^4.0.0
-    peerDependenciesMeta:
-      rollup:
-        optional: true
-
-  '@rollup/plugin-json@6.1.0':
-    resolution: {integrity: sha512-EGI2te5ENk1coGeADSIwZ7G2Q8CJS2sF120T7jLw4xFw9n7wIOXHo+kIYRAoVpJAN+kmqZSoO3Fp4JtoNF4ReA==}
-    engines: {node: '>=14.0.0'}
-    peerDependencies:
-      rollup: ^1.20.0||^2.0.0||^3.0.0||^4.0.0
-    peerDependenciesMeta:
-      rollup:
-        optional: true
-
-  '@rollup/plugin-node-resolve@16.0.3':
-    resolution: {integrity: sha512-lUYM3UBGuM93CnMPG1YocWu7X802BrNF3jW2zny5gQyLQgRFJhV1Sq0Zi74+dh/6NBx1DxFC4b4GXg9wUCG5Qg==}
-    engines: {node: '>=14.0.0'}
-    peerDependencies:
-      rollup: ^2.78.0||^3.0.0||^4.0.0
-    peerDependenciesMeta:
-      rollup:
-        optional: true
-
-  '@rollup/pluginutils@5.4.0':
-    resolution: {integrity: sha512-MfPp06CjRLfXQ3wY0R8vJDYBy/MvVcc9OulEfR0B8Iv9ko+GCNaRZ+EpJYFl27LhKsZK0o420sYCRHCjfCgeUg==}
-    engines: {node: '>=14.0.0'}
-    peerDependencies:
-      rollup: ^1.20.0||^2.0.0||^3.0.0||^4.0.0
-    peerDependenciesMeta:
-      rollup:
-        optional: true
-
-  '@rollup/rollup-android-arm-eabi@4.64.7':
-    resolution: {integrity: sha512-GFF2tHk0NqYVObrK0+/ps/LEXsV/v2q6Lyiy7mZr+Ej24fpQScvqK2ziz9NHeEQYnKWKym38Ml7dZbPtC9tuAw==}
-    cpu: [arm]
-    os: [android]
-
-  '@rollup/rollup-android-arm64@4.64.7':
-    resolution: {integrity: sha512-BOymcXJFYYXqluDidj6sLelNjXruC3u1BqVxLn2OPCXH9xaPSOTH+MS4uychsGI1NU7tJoiv9KvqijDHFe+hhQ==}
-    cpu: [arm64]
-    os: [android]
-
-  '@rollup/rollup-darwin-arm64@4.64.7':
-    resolution: {integrity: sha512-jgVpGweIbls2H5jfBB70tnX52abMd5pJr3xmtoDILx6JdmGl+Un+tMb9R+MbHPVB46tTBpY8emtn7M71SnQhEQ==}
-    cpu: [arm64]
-    os: [darwin]
-
-  '@rollup/rollup-darwin-x64@4.64.7':
-    resolution: {integrity: sha512-AVMpt94mrXH7WjyWKmd9nT4RC5yM0AN3Lt6A89xVIsuLDi3dDX6dxMytLbW36FlppY9JsoqUoS3LUUpUrYxiMQ==}
-    cpu: [x64]
-    os: [darwin]
-
-  '@rollup/rollup-freebsd-arm64@4.64.7':
-    resolution: {integrity: sha512-Nje29c/MyajxRNFGU05oyeTDS6SWdMg/wWMSlZSBTBju5BKz2NVc0kFiFSQGzRELNiB+CBk/ZvAVsWsENgjGag==}
-    cpu: [arm64]
-    os: [freebsd]
-
-  '@rollup/rollup-freebsd-x64@4.64.7':
-    resolution: {integrity: sha512-xxgN5/kMzCNz/NYJ4t49B0/WS6InNlWv6xvgwUQqNnWM9WJMMwMUGWrAxdNEgYWdHL0sMnuh8I87StGrIMTA+w==}
-    cpu: [x64]
-    os: [freebsd]
-
-  '@rollup/rollup-linux-arm-gnueabihf@4.64.7':
-    resolution: {integrity: sha512-5U/9gVn/X657I8+NHoHO9Wnfyd0lEXwqbslobRoB9TC8SwYzOitcIr6TLE7531Q/NWs3L4mb+YOGzlf3vHIeYw==}
-    cpu: [arm]
-    os: [linux]
-    libc: [glibc]
-
-  '@rollup/rollup-linux-arm-musleabihf@4.64.7':
-    resolution: {integrity: sha512-hcDS0a/Y8ggM3dcOfzH7UpSaogCViWTtNDSl0EXpWIj8g8/r86ITqptjil2hayTXS0Umzb+Yt3mjgpQVFVf2+A==}
-    cpu: [arm]
-    os: [linux]
-    libc: [musl]
-
-  '@rollup/rollup-linux-arm64-gnu@4.64.7':
-    resolution: {integrity: sha512-awbAr4N7Qd/yjZAQBEEPzgcPveYG2Gi5L6gq1/Bp+3SMRjn5F68Wv1zKsntzvvoioBR6yKvhLtWqu11am1TsxA==}
-    cpu: [arm64]
-    os: [linux]
-    libc: [glibc]
-
-  '@rollup/rollup-linux-arm64-musl@4.64.7':
-    resolution: {integrity: sha512-Ut7xQJfeLhzu2yN3rHzVvL9ccyPJvN4aCdP1V7hJ5lGxX/eCzgB9SiMk/Md3J+rWWZgvoYsDW4BUFggJr32pBA==}
-    cpu: [arm64]
-    os: [linux]
-    libc: [musl]
-
-  '@rollup/rollup-linux-loong64-gnu@4.64.7':
-    resolution: {integrity: sha512-trqoni/vHkuM5oo5iQhoKPh6fjjD7E80pMgCXWgGxU8vSRPUlwvG8GeYvEEcB6eJAxNa99WH9iVHPHelgtKiHA==}
-    cpu: [loong64]
-    os: [linux]
-    libc: [glibc]
-
-  '@rollup/rollup-linux-loong64-musl@4.64.7':
-    resolution: {integrity: sha512-gvlUy0XFIwtUWiQmhc+4GT2Knm3KosinpUVhr7CtTFA78gFDnE5NWwMPzHrJsYpKkh2LlY7yvBIboN1FAV6Xeg==}
-    cpu: [loong64]
-    os: [linux]
-    libc: [musl]
-
-  '@rollup/rollup-linux-ppc64-gnu@4.64.7':
-    resolution: {integrity: sha512-8yS/kSXTJ/47Z62JW+C2AJ3vd/8zZw016vFjtNpZwmZlwJumLua4s1i78dkYuSSqQ+0aIMxJcBp/4uIwp2ehjA==}
-    cpu: [ppc64]
-    os: [linux]
-    libc: [glibc]
-
-  '@rollup/rollup-linux-ppc64-musl@4.64.7':
-    resolution: {integrity: sha512-mxVSKvvty0hOP1AFo/l4Kpv3i3HK0zx4rYUrirZDToYlWhS3xzmIkq3vUJ7rtrM2cPyXveDyDT6M1FfXZ9hTRA==}
-    cpu: [ppc64]
-    os: [linux]
-    libc: [musl]
-
-  '@rollup/rollup-linux-riscv64-gnu@4.64.7':
-    resolution: {integrity: sha512-lEse1zra1CagM+uHH2bl28GInDsZZ45NJzHei2OMaXQFzZWKBO1hFo07rS0xB6ayV4WU360UrSmPDSyCMpYsUQ==}
-    cpu: [riscv64]
-    os: [linux]
-    libc: [glibc]
-
-  '@rollup/rollup-linux-riscv64-musl@4.64.7':
-    resolution: {integrity: sha512-d/cqCoiG9WMZ5VuJZ5Qdlv9g97QyoGwnmvHccvGhKSacTy7xFrAS+jMcJSBdMNOw1oacSkl6p7K6O/DRYTKL3g==}
-    cpu: [riscv64]
-    os: [linux]
-    libc: [musl]
-
-  '@rollup/rollup-linux-s390x-gnu@4.64.7':
-    resolution: {integrity: sha512-kVEA//CeDOZZP1XCH2JBgqXb9+ALlwuA/4civaazMVdgzaSQC9WM38w65zG/LLk0lA7F9Od19CSBZW7J9mCbNg==}
-    cpu: [s390x]
-    os: [linux]
-    libc: [glibc]
-
-  '@rollup/rollup-linux-x64-gnu@4.64.7':
-    resolution: {integrity: sha512-14oLfDsOSr0TSntT/34jRg/V8B2XW/Jomh9zX9CjIM9gwwNlI1OCymS/GVn0DV32h67eRf7U0GGem0rvfXgNwQ==}
-    cpu: [x64]
-    os: [linux]
-    libc: [glibc]
-
-  '@rollup/rollup-linux-x64-musl@4.64.7':
-    resolution: {integrity: sha512-dFVtPfjZqAnUPpPY4Bfg+87yo1IBW9HiY8iCFtg49Pn46MfZTebSHZh8PL6SOsgyt9LQP8Nj/sE6jm3aWpySmQ==}
-    cpu: [x64]
-    os: [linux]
-    libc: [musl]
-
-  '@rollup/rollup-openbsd-x64@4.64.7':
-    resolution: {integrity: sha512-Dm9CZ2SM3u2NgvBj4awW/gGqkOwzH8f6MSYIJE6+bKcKLI+T0+LhpD6vtetTfrIIx+rLXDf5RJqBP6v7V5O+wg==}
-    cpu: [x64]
-    os: [openbsd]
-
-  '@rollup/rollup-openharmony-arm64@4.64.7':
-    resolution: {integrity: sha512-oaxsvS2mL6+78741CT2HCORBvy1USg3Wqpt5qvZwy3aMXRMl4zxyDo8maeFRWJkF3dp0Wbi71fKH5Gr9YI3vYA==}
-    cpu: [arm64]
-    os: [openharmony]
-
-  '@rollup/rollup-win32-arm64-msvc@4.64.7':
-    resolution: {integrity: sha512-UKZz1Y4mxUqkWh60uH7B1aZn6UcAimPk4ipRktpb3wfZq7JrzZYyAXTwiafkb3T+kd5P3Sf+vzcRdsDks4WtjQ==}
-    cpu: [arm64]
-    os: [win32]
-
-  '@rollup/rollup-win32-ia32-msvc@4.64.7':
-    resolution: {integrity: sha512-WWkSuC1J+mZJnsDh0mRaCAFSWfQdl6y3fDjZeWElI6zHo8CcOSG5lY3yurKJjEq+FrX0WD60sFrVVpbHqzMmrw==}
-    cpu: [ia32]
-    os: [win32]
-
-  '@rollup/rollup-win32-x64-gnu@4.64.7':
-    resolution: {integrity: sha512-u9bp2yXCI3/BUjUxY6uWknAY32pfvvDCPysyUTySotx0dj3ydlFHrRQYfn/b/kZgnfjyEwySMtI7Ga054uiysQ==}
-    cpu: [x64]
-    os: [win32]
-
-  '@rollup/rollup-win32-x64-msvc@4.64.7':
-    resolution: {integrity: sha512-EhX6N3XPMEnVU5cRfNgzPOKcSucsbu3nNNWuoAaEuKIqmddBKHN5b9d4rPe65T1I+FaOT176JKiZNsUBp3rqbA==}
-    cpu: [x64]
-    os: [win32]
-
   '@sinclair/typebox@0.34.49':
     resolution: {integrity: sha512-brySQQs7Jtn0joV8Xh9ZV/hZb9Ozb0pmazDIASBkYKCjXrXU3mpcFahmK/z4YDhGkQvP9mWJbVyahdtU5wQA+A==}
 
@@ -1008,27 +833,35 @@ packages:
     peerDependencies:
       acorn: ^8.9.0
 
-  '@sveltejs/adapter-node@5.5.4':
-    resolution: {integrity: sha512-45X92CXW+2J8ZUzPv3eLlKWEzINKiiGeFWTjyER4ZN4sGgNoaoeSkCY/QYNxHpPXy71QPsctwccBo9jJs0ySPQ==}
+  '@sveltejs/adapter-node@6.0.1':
+    resolution: {integrity: sha512-Pt/YcMakEkTjdQXaAvxrjrDnoGX4zU7pAZICnoLfpI+CawLGigq5upjFW9rVK2QY7yfpR1xeRG/kgI+syzPB3w==}
     peerDependencies:
-      '@sveltejs/kit': ^2.4.0
+      '@sveltejs/kit': ^3.0.0-next.0
 
-  '@sveltejs/kit@2.70.1':
-    resolution: {integrity: sha512-nY9SPHGOZro3doud9vZXDBwl9tCZIouuJztjgSHs6PAIrv9M/z5O7eOhPV5xU7CgVHA976Jwu3BA1hIFvXztkA==}
-    engines: {node: '>=18.13'}
+  '@sveltejs/kit@3.1.1':
+    resolution: {integrity: sha512-BiEMvekYXE9Gu/YhWJ/yJ0WDLH1PX/dmjuAeFp5rrtdmgdzkjt7DvimlSP+/U4tgposl7pkE20luHpcnc6BgRw==}
+    engines: {node: '>=22.17'}
     hasBin: true
     peerDependencies:
       '@opentelemetry/api': ^1.0.0
-      '@sveltejs/vite-plugin-svelte': ^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0 || ^7.0.0
-      svelte: ^4.0.0 || ^5.0.0-next.0
-      typescript: ^5.3.3 || ^6.0.0
-      vite: ^5.0.3 || ^6.0.0 || ^7.0.0-beta.0 || ^8.0.0
+      '@sveltejs/vite-plugin-svelte': ^7.0.0
+      svelte: ^5.57.1
+      typescript: ^6.0.0
+      vite: ^8.0.12
     peerDependenciesMeta:
       '@opentelemetry/api':
         optional: true
       typescript:
         optional: true
 
+  '@sveltejs/load-config@0.2.2':
+    resolution: {integrity: sha512-K7dsJDQxBOF+f+epuhMactcjK2VP4MRkLKtwSykNtEI+cKVEyzrmmhQ1pmoxI800m4JKcyJ05L2M4yPwAGiBNw==}
+    engines: {node: '>= 18.0.0'}
+
+  '@sveltejs/load-config@0.2.3':
+    resolution: {integrity: sha512-VT3qmUb8pRV2QrZjd8iAmtg8lf4W0TIjZbvXtz5MKei/q96teWZgGJyyidJzOjzZzvdq616eSRVeMYIQChUTAQ==}
+    engines: {node: '>= 18.0.0'}
+
   '@sveltejs/vite-plugin-svelte@7.1.2':
     resolution: {integrity: sha512-DrUBA2UXRfDmUX/ZTiEopd3X40yavsJF1FX2RygcuIScHL7o5YX1fMvoYnDhjeJQC4weCOklirpNWlcb2NiSeA==}
     engines: {node: ^20.19 || ^22.12 || >=24}
@@ -1118,9 +951,6 @@ packages:
   '@types/chai@5.2.3':
     resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
 
-  '@types/cookie@0.6.0':
-    resolution: {integrity: sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==}
-
   '@types/deep-eql@4.0.2':
     resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
 
@@ -1136,12 +966,6 @@ packages:
   '@types/node@24.12.4':
     resolution: {integrity: sha512-GUUEShf+PBCGW2KaXwcIt3Yk+e3pkKwWKb9GSyM9WQVE+ep2jzmHdGsHzu4wgcZy5fN9FBdVzjpBQsYlpfpgLA==}
 
-  '@types/resolve@1.20.2':
-    resolution: {integrity: sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==}
-
-  '@types/trusted-types@2.0.7':
-    resolution: {integrity: sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==}
-
   '@typescript-eslint/eslint-plugin@8.60.0':
     resolution: {integrity: sha512-QYb/sa74/s7OKMbACMjrYnGspj9Hs5YI5aaffSL65UfeBUzVzBJfVo3oWSpbzPurvm7yaCCo2Lk7lVj610HqKw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -1365,9 +1189,6 @@ packages:
     resolution: {integrity: sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==}
     engines: {node: '>=6'}
 
-  commondir@1.0.1:
-    resolution: {integrity: sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==}
-
   confbox@0.1.8:
     resolution: {integrity: sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w==}
 
@@ -1377,9 +1198,9 @@ packages:
   convert-source-map@2.0.0:
     resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
 
-  cookie@0.6.0:
-    resolution: {integrity: sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==}
-    engines: {node: '>= 0.6'}
+  cookie@2.0.1:
+    resolution: {integrity: sha512-yuToqVvRrj6pfDXREyQAAv8SkAEk/8GS3jQRTiUMm66TVtBYmqQeoEjL2Lmq8Rpo6271vH76InTChTitEAm65w==}
+    engines: {node: '>=22'}
 
   cross-spawn@7.0.6:
     resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
@@ -1420,10 +1241,6 @@ packages:
   devalue@5.9.4:
     resolution: {integrity: sha512-sPAT4pztbu6586/hrhOnMKS17IJrvg12mXiSPSS3W5qDeN2RGgvZ0diZCm31dBbnevfVmujNO3IM2wrS4Y2Rhg==}
 
-  es-errors@1.3.0:
-    resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
-    engines: {node: '>= 0.4'}
-
   es-module-lexer@2.3.2:
     resolution: {integrity: sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==}
 
@@ -1513,9 +1330,6 @@ packages:
     resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
     engines: {node: '>=4.0'}
 
-  estree-walker@2.0.2:
-    resolution: {integrity: sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==}
-
   estree-walker@3.0.3:
     resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
 
@@ -1582,9 +1396,6 @@ packages:
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
     os: [darwin]
 
-  function-bind@1.1.2:
-    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
-
   fuse.js@7.5.0:
     resolution: {integrity: sha512-sQtrEfA+ez/3G0cCZecF70oqpCRttCexYUG4mUrtWL49ULUzUyxokt5kyqwtKzj1270RaKih+hcP3qLcumccow==}
     engines: {node: '>=10'}
@@ -1609,10 +1420,6 @@ packages:
     resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
     engines: {node: '>=8'}
 
-  hasown@2.0.4:
-    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
-    engines: {node: '>= 0.4'}
-
   html-escaper@2.0.2:
     resolution: {integrity: sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==}
 
@@ -1638,10 +1445,6 @@ packages:
   inline-style-parser@0.2.7:
     resolution: {integrity: sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==}
 
-  is-core-module@2.17.0:
-    resolution: {integrity: sha512-J/vG0zBCbIKOQFfufSwyXdMrsohyJIUNkrnmo6WZGzoM7tr/lsbfW5b2BvisL6zsyMzK9UxV9L6c7AoFbyXHOA==}
-    engines: {node: '>= 0.4'}
-
   is-extglob@2.1.1:
     resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
     engines: {node: '>=0.10.0'}
@@ -1650,12 +1453,6 @@ packages:
     resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
     engines: {node: '>=0.10.0'}
 
-  is-module@1.0.0:
-    resolution: {integrity: sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g==}
-
-  is-reference@1.2.1:
-    resolution: {integrity: sha512-U82MsXXiFIrjCK4otLT+o2NA2Cd2g5MLoOVXUZjIOhLurrRxpEXzI8O0KZHr3IjLvlAH1kTPYSuqer5T9ZVBKQ==}
-
   is-reference@3.0.3:
     resolution: {integrity: sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw==}
 
@@ -1698,10 +1495,6 @@ packages:
   keyv@4.5.4:
     resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
 
-  kleur@4.1.5:
-    resolution: {integrity: sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==}
-    engines: {node: '>=6'}
-
   known-css-properties@0.37.0:
     resolution: {integrity: sha512-JCDrsP4Z1Sb9JwG0aJ8Eo2r7k4Ou5MwmThS/6lcIe1ICyb7UBJKGRIUUdqc2ASdE/42lgz6zFUnzAIhtXnBVrQ==}
 
@@ -1812,6 +1605,9 @@ packages:
   magic-string@0.30.21:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
+  magic-string@1.4.5:
+    resolution: {integrity: sha512-oLLC2+YvQUfAa+vxoufE/yc1icb87M9iXIRqAoR/2EhE/8cb3SF/+Gi0c2By1B+5Vz2e2vQtUvHiu1+63Znh+w==}
+
   magicast@0.5.5:
     resolution: {integrity: sha512-UicdXN8zQ3JHlxVq+28afMXPr1z7WNY6+7EJnzTdQWkTAlMLF5fNCCKxJHBQwGaNGR11581EiQmQzx73+MvszA==}
 
@@ -1876,9 +1672,6 @@ packages:
     resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
     engines: {node: '>=8'}
 
-  path-parse@1.0.7:
-    resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
-
   pathe@2.0.3:
     resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
 
@@ -1966,21 +1759,11 @@ packages:
     resolution: {integrity: sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==}
     engines: {node: '>= 14.18.0'}
 
-  resolve@1.22.13:
-    resolution: {integrity: sha512-Dj/cW9zBV2aRj6XzCxuGIs3ESZKv02jixne3q6jFZYZ3/Tg09gHHviSMDL4kObh9pqSahdRHEnDoaP2gn8YLhA==}
-    engines: {node: '>= 0.4'}
-    hasBin: true
-
   rolldown@1.0.3:
     resolution: {integrity: sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
 
-  rollup@4.64.7:
-    resolution: {integrity: sha512-aCiJONoZp0lNGJ6sYqspLkh6UXaWEey/7Ko2TZyXQ4kgzAhDUxAgbt/oulXKmD+zFHXw1k+RF6ZZWOrjp7DZnQ==}
-    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
-    hasBin: true
-
   rou3@0.9.2:
     resolution: {integrity: sha512-3SOzvaAg8rkHrXtRjpCvCvbyO5to9oOO27Z/XqHEYXfMRVSw/qMIVdmaOk9W2lcRLtR6dlqTjo9hDeJk70QBYQ==}
 
@@ -2044,17 +1827,13 @@ packages:
     resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
     engines: {node: '>=8'}
 
-  supports-preserve-symlinks-flag@1.0.0:
-    resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
-    engines: {node: '>= 0.4'}
-
-  svelte-check@4.4.8:
-    resolution: {integrity: sha512-67adfgBox5eNSNIvIIwgFizKGdcRrGpiMoNO2obHcYuLz7iTa8Xgm/NGU3ntMFnNm8K1grFOIG6HhMLX/vcN8w==}
+  svelte-check@4.7.7:
+    resolution: {integrity: sha512-Ge2IMdeTpbJuzNFGRiiMg0RWgbScysKQu7xwcyFJ22+DU9F5nPX51+Q3gHmGqRxYQMx2knreVWt5oCtfe0vf2g==}
     engines: {node: '>= 18.0.0'}
     hasBin: true
     peerDependencies:
       svelte: ^4.0.0 || ^5.0.0-next.0
-      typescript: '>=5.0.0'
+      typescript: ^5.0.0 || ^6.0.0
 
   svelte-eslint-parser@1.9.0:
     resolution: {integrity: sha512-aKdKQAZP7MobfVcQNyy5Yk0QjlC9m5T1lTS0qA7+0EIsFzFX3WgbGHfb8267QK+4hI8Az9+2f+hk5sp39op8sg==}
@@ -2071,8 +1850,8 @@ packages:
     peerDependencies:
       svelte: ^5.30.2
 
-  svelte@5.56.0:
-    resolution: {integrity: sha512-kTXr26t1bchFp28ROrb957LtbujpBmBDibmqMGziVpUs7awBi96TGgX6SovrA8BNoEUDVRK2Fb9FkeYlGspoVg==}
+  svelte@5.57.3:
+    resolution: {integrity: sha512-5mAftM3SoDV9X0zdF386F9p2pv8iKOwi/KfBS1XnBAkVCKFzVOLHUoa8iGWAt4buoicLmyWVRpuuD5wplXOQsg==}
     engines: {node: '>=18'}
 
   tabbable@6.5.0:
@@ -2688,9 +2467,6 @@ snapshots:
       tinyglobby: 0.2.17
       yaml: 2.9.1
 
-  '@napi-rs/lzma-linux-x64-gnu@1.5.1':
-    optional: true
-
   '@napi-rs/wasm-runtime@1.2.5(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)':
     dependencies:
       '@emnapi/core': 1.10.0
@@ -2763,117 +2539,6 @@ snapshots:
 
   '@rolldown/pluginutils@1.0.1': {}
 
-  '@rollup/plugin-commonjs@29.0.3(rollup@4.64.7)':
-    dependencies:
-      '@rollup/pluginutils': 5.4.0(rollup@4.64.7)
-      commondir: 1.0.1
-      estree-walker: 2.0.2
-      fdir: 6.5.0(picomatch@4.0.7)
-      is-reference: 1.2.1
-      magic-string: 0.30.21
-      picomatch: 4.0.7
-    optionalDependencies:
-      rollup: 4.64.7
-
-  '@rollup/plugin-json@6.1.0(rollup@4.64.7)':
-    dependencies:
-      '@rollup/pluginutils': 5.4.0(rollup@4.64.7)
-    optionalDependencies:
-      rollup: 4.64.7
-
-  '@rollup/plugin-node-resolve@16.0.3(rollup@4.64.7)':
-    dependencies:
-      '@rollup/pluginutils': 5.4.0(rollup@4.64.7)
-      '@types/resolve': 1.20.2
-      deepmerge: 4.3.1
-      is-module: 1.0.0
-      resolve: 1.22.13
-    optionalDependencies:
-      rollup: 4.64.7
-
-  '@rollup/pluginutils@5.4.0(rollup@4.64.7)':
-    dependencies:
-      '@types/estree': 1.0.9
-      estree-walker: 2.0.2
-      picomatch: 4.0.7
-    optionalDependencies:
-      rollup: 4.64.7
-
-  '@rollup/rollup-android-arm-eabi@4.64.7':
-    optional: true
-
-  '@rollup/rollup-android-arm64@4.64.7':
-    optional: true
-
-  '@rollup/rollup-darwin-arm64@4.64.7':
-    optional: true
-
-  '@rollup/rollup-darwin-x64@4.64.7':
-    optional: true
-
-  '@rollup/rollup-freebsd-arm64@4.64.7':
-    optional: true
-
-  '@rollup/rollup-freebsd-x64@4.64.7':
-    optional: true
-
-  '@rollup/rollup-linux-arm-gnueabihf@4.64.7':
-    optional: true
-
-  '@rollup/rollup-linux-arm-musleabihf@4.64.7':
-    optional: true
-
-  '@rollup/rollup-linux-arm64-gnu@4.64.7':
-    optional: true
-
-  '@rollup/rollup-linux-arm64-musl@4.64.7':
-    optional: true
-
-  '@rollup/rollup-linux-loong64-gnu@4.64.7':
-    optional: true
-
-  '@rollup/rollup-linux-loong64-musl@4.64.7':
-    optional: true
-
-  '@rollup/rollup-linux-ppc64-gnu@4.64.7':
-    optional: true
-
-  '@rollup/rollup-linux-ppc64-musl@4.64.7':
-    optional: true
-
-  '@rollup/rollup-linux-riscv64-gnu@4.64.7':
-    optional: true
-
-  '@rollup/rollup-linux-riscv64-musl@4.64.7':
-    optional: true
-
-  '@rollup/rollup-linux-s390x-gnu@4.64.7':
-    optional: true
-
-  '@rollup/rollup-linux-x64-gnu@4.64.7':
-    optional: true
-
-  '@rollup/rollup-linux-x64-musl@4.64.7':
-    optional: true
-
-  '@rollup/rollup-openbsd-x64@4.64.7':
-    optional: true
-
-  '@rollup/rollup-openharmony-arm64@4.64.7':
-    optional: true
-
-  '@rollup/rollup-win32-arm64-msvc@4.64.7':
-    optional: true
-
-  '@rollup/rollup-win32-ia32-msvc@4.64.7':
-    optional: true
-
-  '@rollup/rollup-win32-x64-gnu@4.64.7':
-    optional: true
-
-  '@rollup/rollup-win32-x64-msvc@4.64.7':
-    optional: true
-
   '@sinclair/typebox@0.34.49': {}
 
   '@standard-schema/spec@1.1.0': {}
@@ -2882,40 +2547,36 @@ snapshots:
     dependencies:
       acorn: 8.19.0
 
-  '@sveltejs/adapter-node@5.5.4(@sveltejs/kit@2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))':
+  '@sveltejs/adapter-node@6.0.1(@sveltejs/kit@3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))':
     dependencies:
-      '@rollup/plugin-commonjs': 29.0.3(rollup@4.64.7)
-      '@rollup/plugin-json': 6.1.0(rollup@4.64.7)
-      '@rollup/plugin-node-resolve': 16.0.3(rollup@4.64.7)
-      '@sveltejs/kit': 2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
-      rollup: 4.64.7
+      '@sveltejs/kit': 3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
 
-  '@sveltejs/kit@2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))':
+  '@sveltejs/kit@3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))':
     dependencies:
+      '@rolldown/pluginutils': 1.0.1
       '@standard-schema/spec': 1.1.0
-      '@sveltejs/acorn-typescript': 1.0.13(acorn@8.19.0)
-      '@sveltejs/vite-plugin-svelte': 7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
-      '@types/cookie': 0.6.0
-      acorn: 8.19.0
-      cookie: 0.6.0
+      '@sveltejs/vite-plugin-svelte': 7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
+      cookie: 2.0.1
       devalue: 5.9.4
       esm-env: 1.2.2
-      kleur: 4.1.5
-      magic-string: 0.30.21
+      magic-string: 1.4.5
       mrmime: 2.0.1
-      set-cookie-parser: 3.1.3
       sirv: 3.0.2
-      svelte: 5.56.0(@typescript-eslint/types@8.60.0)
+      svelte: 5.57.3(@typescript-eslint/types@8.60.0)
       vite: 8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)
     optionalDependencies:
       typescript: 6.0.3
 
-  '@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))':
+  '@sveltejs/load-config@0.2.2': {}
+
+  '@sveltejs/load-config@0.2.3': {}
+
+  '@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))':
     dependencies:
       deepmerge: 4.3.1
       magic-string: 0.30.21
       obug: 2.2.1
-      svelte: 5.56.0(@typescript-eslint/types@8.60.0)
+      svelte: 5.57.3(@typescript-eslint/types@8.60.0)
       vite: 8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)
       vitefu: 1.1.3(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
 
@@ -2977,8 +2638,6 @@ snapshots:
       '@types/deep-eql': 4.0.2
       assertion-error: 2.0.1
 
-  '@types/cookie@0.6.0': {}
-
   '@types/deep-eql@4.0.2': {}
 
   '@types/esrecurse@4.3.1': {}
@@ -2991,10 +2650,6 @@ snapshots:
     dependencies:
       undici-types: 7.16.0
 
-  '@types/resolve@1.20.2': {}
-
-  '@types/trusted-types@2.0.7': {}
-
   '@typescript-eslint/eslint-plugin@8.60.0(@typescript-eslint/parser@8.60.0(eslint@10.4.1)(typescript@6.0.3))(eslint@10.4.1)(typescript@6.0.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
@@ -3168,7 +2823,7 @@ snapshots:
 
   balanced-match@4.0.4: {}
 
-  better-auth@1.7.14(@sveltejs/kit@2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vitest@4.1.7):
+  better-auth@1.7.14(@sveltejs/kit@3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vitest@4.1.7):
     dependencies:
       '@better-auth/core': 1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.12)(kysely@0.29.8)(nanostores@1.5.5)
       '@better-auth/drizzle-adapter': 1.7.14(@better-auth/core@1.7.14(@better-auth/utils@0.5.1)(@better-fetch/fetch@1.3.3)(better-call@1.4.4(zod@4.6.7))(jose@6.2.12)(kysely@0.29.8)(nanostores@1.5.5))(@better-auth/utils@0.5.1)
@@ -3188,8 +2843,8 @@ snapshots:
       nanostores: 1.5.5
       zod: 4.6.7
     optionalDependencies:
-      '@sveltejs/kit': 2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
-      svelte: 5.56.0(@typescript-eslint/types@8.60.0)
+      '@sveltejs/kit': 3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
+      svelte: 5.57.3(@typescript-eslint/types@8.60.0)
       vitest: 4.1.7(@types/node@24.12.4)(@vitest/coverage-v8@4.1.7)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
     transitivePeerDependencies:
       - '@opentelemetry/api'
@@ -3203,15 +2858,15 @@ snapshots:
     optionalDependencies:
       zod: 4.6.7
 
-  bits-ui@2.18.1(@internationalized/date@3.12.4)(@sveltejs/kit@2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0)):
+  bits-ui@2.18.1(@internationalized/date@3.12.4)(@sveltejs/kit@3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0)):
     dependencies:
       '@floating-ui/core': 1.8.0
       '@floating-ui/dom': 1.8.0
       '@internationalized/date': 3.12.4
       esm-env: 1.2.2
-      runed: 0.35.1(@sveltejs/kit@2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))
-      svelte: 5.56.0(@typescript-eslint/types@8.60.0)
-      svelte-toolbelt: 0.10.6(@sveltejs/kit@2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))
+      runed: 0.35.1(@sveltejs/kit@3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))
+      svelte: 5.57.3(@typescript-eslint/types@8.60.0)
+      svelte-toolbelt: 0.10.6(@sveltejs/kit@3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))
       tabbable: 6.5.0
     transitivePeerDependencies:
       - '@sveltejs/kit'
@@ -3230,15 +2885,13 @@ snapshots:
 
   clsx@2.1.1: {}
 
-  commondir@1.0.1: {}
-
   confbox@0.1.8: {}
 
   confbox@0.3.1: {}
 
   convert-source-map@2.0.0: {}
 
-  cookie@0.6.0: {}
+  cookie@2.0.1: {}
 
   cross-spawn@7.0.6:
     dependencies:
@@ -3264,8 +2917,6 @@ snapshots:
 
   devalue@5.9.4: {}
 
-  es-errors@1.3.0: {}
-
   es-module-lexer@2.3.2: {}
 
   esbuild@0.28.2:
@@ -3303,7 +2954,7 @@ snapshots:
     dependencies:
       eslint: 10.4.1
 
-  eslint-plugin-svelte@3.18.0(eslint@10.4.1)(svelte@5.56.0(@typescript-eslint/types@8.60.0)):
+  eslint-plugin-svelte@3.18.0(eslint@10.4.1)(svelte@5.57.3(@typescript-eslint/types@8.60.0)):
     dependencies:
       '@eslint-community/eslint-utils': 4.10.1(eslint@10.4.1)
       '@jridgewell/sourcemap-codec': 1.6.0
@@ -3315,9 +2966,9 @@ snapshots:
       postcss-load-config: 3.1.4(postcss@8.5.30)
       postcss-safe-parser: 7.1.0(postcss@8.5.30)
       semver: 7.8.5
-      svelte-eslint-parser: 1.9.0(svelte@5.56.0(@typescript-eslint/types@8.60.0))
+      svelte-eslint-parser: 1.9.0(svelte@5.57.3(@typescript-eslint/types@8.60.0))
     optionalDependencies:
-      svelte: 5.56.0(@typescript-eslint/types@8.60.0)
+      svelte: 5.57.3(@typescript-eslint/types@8.60.0)
     transitivePeerDependencies:
       - ts-node
 
@@ -3404,8 +3055,6 @@ snapshots:
 
   estraverse@5.3.0: {}
 
-  estree-walker@2.0.2: {}
-
   estree-walker@3.0.3:
     dependencies:
       '@types/estree': 1.0.9
@@ -3458,8 +3107,6 @@ snapshots:
   fsevents@2.3.3:
     optional: true
 
-  function-bind@1.1.2: {}
-
   fuse.js@7.5.0: {}
 
   glob-parent@6.0.2:
@@ -3474,10 +3121,6 @@ snapshots:
 
   has-flag@4.0.0: {}
 
-  hasown@2.0.4:
-    dependencies:
-      function-bind: 1.1.2
-
   html-escaper@2.0.2: {}
 
   human-id@4.2.2: {}
@@ -3492,22 +3135,12 @@ snapshots:
 
   inline-style-parser@0.2.7: {}
 
-  is-core-module@2.17.0:
-    dependencies:
-      hasown: 2.0.4
-
   is-extglob@2.1.1: {}
 
   is-glob@4.0.3:
     dependencies:
       is-extglob: 2.1.1
 
-  is-module@1.0.0: {}
-
-  is-reference@1.2.1:
-    dependencies:
-      '@types/estree': 1.0.9
-
   is-reference@3.0.3:
     dependencies:
       '@types/estree': 1.0.9
@@ -3545,8 +3178,6 @@ snapshots:
     dependencies:
       json-buffer: 3.0.1
 
-  kleur@4.1.5: {}
-
   known-css-properties@0.37.0: {}
 
   kysely@0.29.8: {}
@@ -3630,6 +3261,10 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.6.0
 
+  magic-string@1.4.5:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.6.0
+
   magicast@0.5.5:
     dependencies:
       '@babel/parser': 7.29.9
@@ -3688,8 +3323,6 @@ snapshots:
 
   path-key@3.1.1: {}
 
-  path-parse@1.0.7: {}
-
   pathe@2.0.3: {}
 
   picocolors@1.1.1: {}
@@ -3747,10 +3380,10 @@ snapshots:
 
   prelude-ls@1.2.1: {}
 
-  prettier-plugin-svelte@3.5.2(prettier@3.8.3)(svelte@5.56.0(@typescript-eslint/types@8.60.0)):
+  prettier-plugin-svelte@3.5.2(prettier@3.8.3)(svelte@5.57.3(@typescript-eslint/types@8.60.0)):
     dependencies:
       prettier: 3.8.3
-      svelte: 5.56.0(@typescript-eslint/types@8.60.0)
+      svelte: 5.57.3(@typescript-eslint/types@8.60.0)
 
   prettier@3.8.3: {}
 
@@ -3760,13 +3393,6 @@ snapshots:
 
   readdirp@4.1.2: {}
 
-  resolve@1.22.13:
-    dependencies:
-      es-errors: 1.3.0
-      is-core-module: 2.17.0
-      path-parse: 1.0.7
-      supports-preserve-symlinks-flag: 1.0.0
-
   rolldown@1.0.3:
     dependencies:
       '@oxc-project/types': 0.133.0
@@ -3788,48 +3414,16 @@ snapshots:
       '@rolldown/binding-win32-arm64-msvc': 1.0.3
       '@rolldown/binding-win32-x64-msvc': 1.0.3
 
-  rollup@4.64.7:
-    dependencies:
-      '@types/estree': 1.0.9
-    optionalDependencies:
-      '@napi-rs/lzma-linux-x64-gnu': 1.5.1
-      '@rollup/rollup-android-arm-eabi': 4.64.7
-      '@rollup/rollup-android-arm64': 4.64.7
-      '@rollup/rollup-darwin-arm64': 4.64.7
-      '@rollup/rollup-darwin-x64': 4.64.7
-      '@rollup/rollup-freebsd-arm64': 4.64.7
-      '@rollup/rollup-freebsd-x64': 4.64.7
-      '@rollup/rollup-linux-arm-gnueabihf': 4.64.7
-      '@rollup/rollup-linux-arm-musleabihf': 4.64.7
-      '@rollup/rollup-linux-arm64-gnu': 4.64.7
-      '@rollup/rollup-linux-arm64-musl': 4.64.7
-      '@rollup/rollup-linux-loong64-gnu': 4.64.7
-      '@rollup/rollup-linux-loong64-musl': 4.64.7
-      '@rollup/rollup-linux-ppc64-gnu': 4.64.7
-      '@rollup/rollup-linux-ppc64-musl': 4.64.7
-      '@rollup/rollup-linux-riscv64-gnu': 4.64.7
-      '@rollup/rollup-linux-riscv64-musl': 4.64.7
-      '@rollup/rollup-linux-s390x-gnu': 4.64.7
-      '@rollup/rollup-linux-x64-gnu': 4.64.7
-      '@rollup/rollup-linux-x64-musl': 4.64.7
-      '@rollup/rollup-openbsd-x64': 4.64.7
-      '@rollup/rollup-openharmony-arm64': 4.64.7
-      '@rollup/rollup-win32-arm64-msvc': 4.64.7
-      '@rollup/rollup-win32-ia32-msvc': 4.64.7
-      '@rollup/rollup-win32-x64-gnu': 4.64.7
-      '@rollup/rollup-win32-x64-msvc': 4.64.7
-      fsevents: 2.3.3
-
   rou3@0.9.2: {}
 
-  runed@0.35.1(@sveltejs/kit@2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0)):
+  runed@0.35.1(@sveltejs/kit@3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0)):
     dependencies:
       dequal: 2.0.3
       esm-env: 1.2.2
       lz-string: 1.5.0
-      svelte: 5.56.0(@typescript-eslint/types@8.60.0)
+      svelte: 5.57.3(@typescript-eslint/types@8.60.0)
     optionalDependencies:
-      '@sveltejs/kit': 2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
+      '@sveltejs/kit': 3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1))
 
   sade@1.8.1:
     dependencies:
@@ -3871,21 +3465,20 @@ snapshots:
     dependencies:
       has-flag: 4.0.0
 
-  supports-preserve-symlinks-flag@1.0.0: {}
-
-  svelte-check@4.4.8(picomatch@4.0.7)(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3):
+  svelte-check@4.7.7(picomatch@4.0.7)(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
+      '@sveltejs/load-config': 0.2.3
       chokidar: 4.0.3
       fdir: 6.5.0(picomatch@4.0.7)
       picocolors: 1.1.1
       sade: 1.8.1
-      svelte: 5.56.0(@typescript-eslint/types@8.60.0)
+      svelte: 5.57.3(@typescript-eslint/types@8.60.0)
       typescript: 6.0.3
     transitivePeerDependencies:
       - picomatch
 
-  svelte-eslint-parser@1.9.0(svelte@5.56.0(@typescript-eslint/types@8.60.0)):
+  svelte-eslint-parser@1.9.0(svelte@5.57.3(@typescript-eslint/types@8.60.0)):
     dependencies:
       eslint-scope: 8.4.0
       eslint-visitor-keys: 4.2.1
@@ -3895,24 +3488,23 @@ snapshots:
       postcss-selector-parser: 7.1.6
       semver: 7.8.5
     optionalDependencies:
-      svelte: 5.56.0(@typescript-eslint/types@8.60.0)
+      svelte: 5.57.3(@typescript-eslint/types@8.60.0)
 
-  svelte-toolbelt@0.10.6(@sveltejs/kit@2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0)):
+  svelte-toolbelt@0.10.6(@sveltejs/kit@3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0)):
     dependencies:
       clsx: 2.1.1
-      runed: 0.35.1(@sveltejs/kit@2.70.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.56.0(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.56.0(@typescript-eslint/types@8.60.0))
+      runed: 0.35.1(@sveltejs/kit@3.1.1(@sveltejs/vite-plugin-svelte@7.1.2(svelte@5.57.3(@typescript-eslint/types@8.60.0))(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))(typescript@6.0.3)(vite@8.0.16(@types/node@24.12.4)(esbuild@0.28.2)(yaml@2.9.1)))(svelte@5.57.3(@typescript-eslint/types@8.60.0))
       style-to-object: 1.0.14
-      svelte: 5.56.0(@typescript-eslint/types@8.60.0)
+      svelte: 5.57.3(@typescript-eslint/types@8.60.0)
     transitivePeerDependencies:
       - '@sveltejs/kit'
 
-  svelte@5.56.0(@typescript-eslint/types@8.60.0):
+  svelte@5.57.3(@typescript-eslint/types@8.60.0):
     dependencies:
       '@jridgewell/remapping': 2.3.5
       '@jridgewell/sourcemap-codec': 1.6.0
       '@sveltejs/acorn-typescript': 1.0.13(acorn@8.19.0)
       '@types/estree': 1.0.9
-      '@types/trusted-types': 2.0.7
       acorn: 8.19.0
       aria-query: 5.3.1
       axobject-query: 4.1.0
@@ -3971,7 +3563,7 @@ snapshots:
 
   undici-types@7.16.0: {}
 
-  unplugin-icons@23.0.1(svelte@5.56.0(@typescript-eslint/types@8.60.0)):
+  unplugin-icons@23.0.1(svelte@5.57.3(@typescript-eslint/types@8.60.0)):
     dependencies:
       '@antfu/install-pkg': 1.1.0
       '@iconify/utils': 3.1.7
@@ -3979,7 +3571,7 @@ snapshots:
       obug: 2.2.1
       unplugin: 2.3.11
     optionalDependencies:
-      svelte: 5.56.0(@typescript-eslint/types@8.60.0)
+      svelte: 5.57.3(@typescript-eslint/types@8.60.0)
 
   unplugin@2.3.11:
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index ff1bb71..bfb440b 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -10,8 +10,9 @@ catalog:
   '@eslint/js': 10.0.1
   '@iconify-json/ph': 1.2.2
   '@playwright/test': 1.61.1
-  '@sveltejs/adapter-node': 5.5.4
-  '@sveltejs/kit': 2.70.1
+  '@sveltejs/adapter-node': 6.0.1
+  '@sveltejs/kit': 3.1.1
+  '@sveltejs/load-config': 0.2.2
   '@sveltejs/vite-plugin-svelte': 7.1.2
   '@types/node': 24.12.4
   '@vitest/coverage-v8': 4.1.7
@@ -24,8 +25,8 @@ catalog:
   globals: 17.6.0
   prettier: 3.8.3
   prettier-plugin-svelte: 3.5.2
-  svelte: 5.56.0
-  svelte-check: 4.4.8
+  svelte: 5.57.3
+  svelte-check: 4.7.7
   typescript: 6.0.3
   typescript-eslint: 8.60.0
   unplugin-icons: 23.0.1
-- 
2.54.0


From 5e9c949801c5a4c57d27e785dffc715d54df8cba Mon Sep 17 00:00:00 2001
From: eleith <eleith@noreply.git.eleith.com>
Date: Tue, 3 Nov 2026 06:54:26 -0800
Subject: [PATCH 3/4] Adopt SvelteKit 3 APIs

---
 .changeset/web-framework-upgrade.md           |  2 +-
 apps/web/e2e/bookmark-logo-fallback.e2e.ts    | 29 +++---
 apps/web/e2e/bookmark-logos.e2e.ts            |  5 +-
 apps/web/e2e/configured-images.e2e.ts         | 10 ++-
 apps/web/e2e/details-dialog.e2e.ts            |  6 +-
 apps/web/e2e/directory.e2e.ts                 | 16 ++--
 apps/web/e2e/search.e2e.ts                    | 12 +++
 apps/web/e2e/site-header-logo.e2e.ts          |  2 +-
 apps/web/src/app.d.ts                         |  1 -
 .../lib/components/ConfigUpdateNotice.svelte  |  5 +-
 .../bookmarks/BookmarkDetailsDialog.svelte    |  9 +-
 apps/web/src/lib/server/auth/access.test.ts   |  8 +-
 apps/web/src/lib/server/auth/access.ts        |  9 +-
 apps/web/src/lib/server/auth/actions.ts       | 10 +--
 .../(endpoints)/config/version/+server.ts     |  4 +-
 apps/web/src/routes/(protected)/+page.svelte  | 90 ++++++++++++-------
 apps/web/src/routes/(protected)/page.test.ts  |  5 +-
 .../routes/(public)/favicon/server.test.ts    | 13 +--
 .../src/routes/(public)/healthz/+server.ts    |  7 +-
 .../(public)/images/og.png/server.test.ts     | 33 +++----
 .../src/routes/(public)/logo/server.test.ts   | 13 +--
 .../(public)/public/[...file]/server.test.ts  | 19 ++--
 .../routes/(public)/schema.json/+server.ts    |  3 +-
 23 files changed, 195 insertions(+), 116 deletions(-)

diff --git a/.changeset/web-framework-upgrade.md b/.changeset/web-framework-upgrade.md
index 6d6f130..40a3c2e 100644
--- a/.changeset/web-framework-upgrade.md
+++ b/.changeset/web-framework-upgrade.md
@@ -2,4 +2,4 @@
 '@directory/web': patch
 ---
 
-Upgrade the web app to SvelteKit 3 while keeping `site.url` runtime-configured.
+Upgrade the web app to SvelteKit 3, preserving runtime `site.url`, native sign-in and bookmark navigation.
diff --git a/apps/web/e2e/bookmark-logo-fallback.e2e.ts b/apps/web/e2e/bookmark-logo-fallback.e2e.ts
index e746735..78a5096 100644
--- a/apps/web/e2e/bookmark-logo-fallback.e2e.ts
+++ b/apps/web/e2e/bookmark-logo-fallback.e2e.ts
@@ -99,7 +99,9 @@ for (const view of ['card', 'details'] as const) {
 			await page.goto(`${server.url}/${view === 'details' ? '?link=broken' : ''}`, {
 				waitUntil: 'commit'
 			});
-			const cardImage = page.locator('a[href="/?link=broken"] img');
+			const cardImage = page
+				.getByRole('link', { name: 'Broken primary', exact: true })
+				.locator('img');
 			await expect(cardImage).toHaveAttribute('src', '/public/primary-a.svg');
 			await expectBroken(cardImage);
 			await expect.poll(() => heldJavaScript).toBe(true);
@@ -266,16 +268,23 @@ test('without JavaScript, good images decode and broken images leave card and de
 			['default', 'Omitted primary'],
 			['other', 'Other broken primary']
 		]) {
-			const card = page.locator(`a[href="/?link=${id}"]`);
-			await expect(card).toContainText(title!);
-			await expect(card).toHaveAttribute('data-sveltekit-preload-data', 'off');
+			const card = page.getByRole('link', { name: title!, exact: true });
+			await expect(card).toHaveJSProperty('href', `${server.url}/?link=${id}`);
+			await expect(card).toHaveAttribute('data-sveltekit-preload-data', 'false');
 		}
-		const broken = page.locator('a[href="/?link=broken"] img');
+		const brokenLink = page.getByRole('link', { name: 'Broken primary', exact: true });
+		const broken = brokenLink.locator('img');
 		await expect(broken).toHaveAttribute('src', '/public/primary-a.svg');
 		await expectBroken(broken);
-		await expectDecoded(page.locator('a[href="/?link=valid"] img'), '/public/valid.svg');
-		await expectDecoded(page.locator('a[href="/?link=default"] img'), '/bookmarks/default/logo');
-		await page.locator('a[href="/?link=broken"]').click();
+		await expectDecoded(
+			page.getByRole('link', { name: 'Valid primary', exact: true }).locator('img'),
+			'/public/valid.svg'
+		);
+		await expectDecoded(
+			page.getByRole('link', { name: 'Omitted primary', exact: true }).locator('img'),
+			'/bookmarks/default/logo'
+		);
+		await brokenLink.click();
 		const details = page.getByRole('region', { name: 'Broken primary', exact: true });
 		await expect(details.locator('img')).toHaveAttribute('src', '/public/primary-a.svg');
 		await expectBroken(details.locator('img'));
@@ -299,9 +308,9 @@ test('without JavaScript, good images decode and broken images leave card and de
 		await expect(url).toBeVisible();
 		await expect(url).toHaveValue('https://broken.example.test');
 		await expect(url).toHaveJSProperty('readOnly', true);
-		await page.locator('a[href="/?link=valid"]').click();
+		await page.getByRole('link', { name: 'Valid primary', exact: true }).click();
 		await expectDecoded(page.locator('section.details img'), '/public/valid.svg');
-		await page.locator('a[href="/?link=default"]').click();
+		await page.getByRole('link', { name: 'Omitted primary', exact: true }).click();
 		await expectDecoded(page.locator('section.details img'), '/bookmarks/default/logo');
 		await page.getByRole('link', { name: 'Back to directory' }).click();
 		await expect(page).toHaveURL(`${server.url}/`);
diff --git a/apps/web/e2e/bookmark-logos.e2e.ts b/apps/web/e2e/bookmark-logos.e2e.ts
index 581ea9e..3b0fed2 100644
--- a/apps/web/e2e/bookmark-logos.e2e.ts
+++ b/apps/web/e2e/bookmark-logos.e2e.ts
@@ -26,14 +26,15 @@ test('bookmark logos render on cards and details without JavaScript and follow a
 		await server.ready();
 		const page = await context.newPage();
 		await page.goto(server.url);
-		const card = page.locator('a[href="/?link=photos"] img');
+		const photos = page.getByRole('link', { name: 'Family Photos', exact: true });
+		const card = photos.locator('img');
 		await expect(card).toHaveAttribute('src', '/bookmarks/photos/logo');
 		await expect(card).toHaveAttribute('width', '64');
 		await expect(card).toHaveAttribute('height', '64');
 		await expect
 			.poll(() => card.evaluate((image) => (image as HTMLImageElement).naturalWidth))
 			.toBeGreaterThan(0);
-		await page.locator('a[href="/?link=photos"]').click();
+		await photos.click();
 		const details = page.getByRole('region', { name: 'Family Photos', exact: true });
 		await expect(details.locator('img')).toHaveAttribute('src', '/bookmarks/photos/logo');
 		expect(await (await server.fetch('/bookmarks/photos/logo')).text()).toContain('>FP</text>');
diff --git a/apps/web/e2e/configured-images.e2e.ts b/apps/web/e2e/configured-images.e2e.ts
index e6ede25..ec41751 100644
--- a/apps/web/e2e/configured-images.e2e.ts
+++ b/apps/web/e2e/configured-images.e2e.ts
@@ -281,7 +281,11 @@ test('open mode serves contained images regardless of references, with MIME and
 				expectPrivateHeaders(response);
 			}
 		}
-		expect((await server.fetch('/public/photo.svg', { method: 'POST' })).status).toBe(405);
+		const unsupported = await server.fetch('/public/photo.svg', {
+			method: 'POST',
+			headers: { origin: server.origin }
+		});
+		expect(unsupported.status).toBe(405);
 		const generated = await server.fetch('/bookmarks/photos/logo');
 		expect(generated.status).toBe(200);
 		expectPrivateHeaders(generated);
@@ -413,13 +417,13 @@ test('existing SSR cards and details render mounted logos and omitted-path bookm
 			['router', '/bookmarks/router/logo'],
 			['thumbnail', '/public/photo.png']
 		] as const) {
-			const image = page.locator(`a[href="/?link=${id}"] img`);
+			const image = page.locator(`a[href$="?link=${id}"] img`);
 			await expect(image).toHaveAttribute('src', path);
 			await expect
 				.poll(() => image.evaluate((node) => (node as HTMLImageElement).naturalWidth))
 				.toBeGreaterThan(0);
 		}
-		await page.locator('a[href="/?link=photos"]').click();
+		await page.getByRole('link', { name: 'Photos', exact: true }).click();
 		const details = page
 			.getByRole('region', { name: 'Photos', exact: true })
 			.locator('img[src="/public/photo.svg"]');
diff --git a/apps/web/e2e/details-dialog.e2e.ts b/apps/web/e2e/details-dialog.e2e.ts
index 8ae540a..22e0617 100644
--- a/apps/web/e2e/details-dialog.e2e.ts
+++ b/apps/web/e2e/details-dialog.e2e.ts
@@ -172,10 +172,12 @@ test('blocked client boot keeps controls disabled and native grid navigation usa
 	await page.goto(server.url);
 	await expect(page.getByRole('searchbox', { name: 'Search', exact: true })).toBeDisabled();
 	await expect(page.getByRole('button', { name: /theme/ })).toBeDisabled();
-	await page.locator('a[href="/?link=beta"]').click();
+	const beta = page.getByRole('link', { name: 'Beta service', exact: true });
+	await expect(beta).toHaveJSProperty('href', `${server.url}/?link=beta`);
+	await beta.click();
 	await expect(page).toHaveURL(`${server.url}/?link=beta`);
 	await expect(page.getByRole('dialog')).toHaveCount(0);
-	await page.locator('a[href="/?link=alpha"]').click();
+	await page.getByRole('link', { name: 'Alpha service', exact: true }).click();
 	await expect(page).toHaveURL(`${server.url}/?link=alpha`);
 	await expect(page.locator('.tile')).toHaveCount(2);
 });
diff --git a/apps/web/e2e/directory.e2e.ts b/apps/web/e2e/directory.e2e.ts
index 35a8eff..36c921e 100644
--- a/apps/web/e2e/directory.e2e.ts
+++ b/apps/web/e2e/directory.e2e.ts
@@ -49,15 +49,13 @@ test('groups, bookmark titles and plain details work without JavaScript', async
 			['router', 'Router'],
 			['notes', 'Household notes']
 		]) {
-			const link = page.locator(`a[href="/?link=${id}"]`);
-			await expect(link).toContainText(label!);
-			await expect(link).toHaveAttribute('data-sveltekit-preload-data', 'off');
+			const link = page.getByRole('link', { name: label!, exact: true });
+			await expect(link).toHaveJSProperty('href', `${server.url}/?link=${id}`);
+			await expect(link).toHaveAttribute('data-sveltekit-preload-data', 'false');
 		}
-		await expect(page.locator('a[href="/?link=photos"] img')).toHaveAttribute(
-			'src',
-			'/bookmarks/photos/logo'
-		);
-		await page.locator('a[href="/?link=photos"]').click();
+		const photos = page.getByRole('link', { name: 'Photos', exact: true });
+		await expect(photos.locator('img')).toHaveAttribute('src', '/bookmarks/photos/logo');
+		await photos.click();
 		await expect(page).toHaveURL(`${server.url}/?link=photos`);
 		await expect(page.getByRole('heading', { name: 'Photos', exact: true })).toBeVisible();
 		const details = page.getByRole('region', { name: 'Photos', exact: true });
@@ -80,7 +78,7 @@ test('groups, bookmark titles and plain details work without JavaScript', async
 		await expect(tags).toHaveCount(1);
 		await expect(tags.getByRole('listitem')).toHaveText(['login', 'internal', 'admin']);
 		await expect(tags.getByRole('listitem').last()).toHaveAccessibleName('admin only');
-		await expect(page.locator('a[href="/?link=photos"]')).toBeVisible();
+		await expect(page.getByRole('link', { name: 'Photos', exact: true })).toBeVisible();
 	} finally {
 		await context.close();
 		expect(await server.stop()).toEqual({ code: 0, signal: null });
diff --git a/apps/web/e2e/search.e2e.ts b/apps/web/e2e/search.e2e.ts
index 470ba6e..239d4fe 100644
--- a/apps/web/e2e/search.e2e.ts
+++ b/apps/web/e2e/search.e2e.ts
@@ -47,6 +47,18 @@ test('search finds a bookmark, opens its details and clears back to browsing', a
 	await expect(results.getByRole('link')).toHaveCount(1);
 	await expect(results.getByRole('link')).toContainText('Family photos');
 	await expect(page).toHaveURL(`${server.url}/?q=photos`);
+	// Async shallow routing must not rewrite an in-place edit or move its caret to the end.
+	await search.press('End');
+	await search.press('ArrowLeft');
+	await search.press('x');
+	await expect(search).toHaveValue('photoxs');
+	await expect(page).toHaveURL(`${server.url}/?q=photoxs`);
+	await expect(search).toBeFocused();
+	await expect(search).toHaveJSProperty('selectionStart', 6);
+	await expect(search).toHaveJSProperty('selectionEnd', 6);
+	await search.press('Backspace');
+	await expect(search).toHaveValue('photos');
+	await expect(page).toHaveURL(`${server.url}/?q=photos`);
 	await page.reload();
 	await expect(search).toHaveValue('photos');
 	await expect(results.getByRole('link')).toHaveCount(1);
diff --git a/apps/web/e2e/site-header-logo.e2e.ts b/apps/web/e2e/site-header-logo.e2e.ts
index 6b8653f..c17560d 100644
--- a/apps/web/e2e/site-header-logo.e2e.ts
+++ b/apps/web/e2e/site-header-logo.e2e.ts
@@ -122,7 +122,7 @@ test('without JavaScript a broken configured header leaves title and native navi
 		await expect(page.locator('header img')).toHaveAttribute('src', sourceA);
 		await expectBroken(page.locator('header img'));
 		await expect(page.locator('header h1')).toHaveText(title);
-		await page.locator('a[href="/?link=book"]').click();
+		await page.locator('a[href$="?link=book"]').click();
 		await expect(page).toHaveURL(`${app.url}/?link=book`);
 		await expect(page.locator('header .description')).toHaveText(siteDescription);
 	} finally {
diff --git a/apps/web/src/app.d.ts b/apps/web/src/app.d.ts
index 2cfb567..fd020c1 100644
--- a/apps/web/src/app.d.ts
+++ b/apps/web/src/app.d.ts
@@ -15,7 +15,6 @@ declare global {
 		}
 
 		interface PageState {
-			directoryQuery?: string;
 			directoryDetail?: { id: string; fromGrid: boolean } | null;
 		}
 
diff --git a/apps/web/src/lib/components/ConfigUpdateNotice.svelte b/apps/web/src/lib/components/ConfigUpdateNotice.svelte
index a9b62b1..a7f59aa 100644
--- a/apps/web/src/lib/components/ConfigUpdateNotice.svelte
+++ b/apps/web/src/lib/components/ConfigUpdateNotice.svelte
@@ -15,10 +15,7 @@
 	let retryDelay = checkInterval;
 
 	$effect(() => {
-		// Kit shallow navigation updates page.state, not page.url.
-		void page.state;
-		void page.url;
-		const currentURL = new SvelteURL(window.location.href);
+		const currentURL = new SvelteURL((page.shallow?.url ?? page.url).href);
 		currentURL.hash = '';
 		refreshHref = currentURL.href;
 	});
diff --git a/apps/web/src/lib/components/bookmarks/BookmarkDetailsDialog.svelte b/apps/web/src/lib/components/bookmarks/BookmarkDetailsDialog.svelte
index 2813e86..2c858e1 100644
--- a/apps/web/src/lib/components/bookmarks/BookmarkDetailsDialog.svelte
+++ b/apps/web/src/lib/components/bookmarks/BookmarkDetailsDialog.svelte
@@ -24,7 +24,7 @@
 		openLinksInNewTab: boolean;
 		hasPrevious: boolean;
 		hasNext: boolean;
-		onNavigate: (step: -1 | 1) => void;
+		onNavigate: (step: -1 | 1) => Promise<void>;
 		onClose: () => void;
 		onClosed: () => void;
 		onFilterSelect: (query: string) => void;
@@ -51,8 +51,13 @@
 	async function navigate(event: MouseEvent, step: -1 | 1) {
 		const button = event.currentTarget as HTMLButtonElement;
 		const hadFocus = button === document.activeElement;
-		onNavigate(step);
+		try {
+			await onNavigate(step);
+		} catch {
+			return;
+		}
 		await tick();
+		if (!link || !button.isConnected) return;
 		if (scrollContent) scrollContent.scrollTop = 0;
 		if (hadFocus && button.disabled) {
 			(step === 1 ? previousButton : nextButton)?.focus({ preventScroll: true });
diff --git a/apps/web/src/lib/server/auth/access.test.ts b/apps/web/src/lib/server/auth/access.test.ts
index 959a75e..9a93df9 100644
--- a/apps/web/src/lib/server/auth/access.test.ts
+++ b/apps/web/src/lib/server/auth/access.test.ts
@@ -99,9 +99,11 @@ it('rejects either inconsistent request origin before resolving a route', async
 	for (const replaceRequest of [false, true]) {
 		const input = requestFor('/');
 		const foreign = new URL('https://another.example/');
-		if (replaceRequest) input.event.request = new Request(foreign);
-		else input.event.url = foreign;
-		expect((await protectAuthRequest(input, policy)).status).toBe(403);
+		const event = {
+			...input.event,
+			...(replaceRequest ? { request: new Request(foreign) } : { url: foreign })
+		};
+		expect((await protectAuthRequest({ ...input, event }, policy)).status).toBe(403);
 		expect(input.resolve).not.toHaveBeenCalled();
 	}
 });
diff --git a/apps/web/src/lib/server/auth/access.ts b/apps/web/src/lib/server/auth/access.ts
index 3d58fe9..97c86b8 100644
--- a/apps/web/src/lib/server/auth/access.ts
+++ b/apps/web/src/lib/server/auth/access.ts
@@ -65,7 +65,7 @@ export async function requireSignIn(
 ): Promise<Response> {
 	event.locals.session = null;
 	const routeId = event.route.id ?? '';
-	const publicRoute = routeId === '/(public)' || routeId.startsWith('/(public)/');
+	const publicRoute = isInGroup(routeId, '/(public)');
 	if (publicRoute) return resolve(event);
 	try {
 		event.locals.session = await event.locals.auth();
@@ -74,8 +74,7 @@ export async function requireSignIn(
 		return denied(401);
 	}
 	if (event.locals.session?.user) return resolve(event);
-	const endpoint =
-		routeId === '/(protected)/(endpoints)' || routeId.startsWith('/(protected)/(endpoints)/');
+	const endpoint = isInGroup(routeId, '/(protected)/(endpoints)');
 	if (!endpoint && isHtmlNavigation(event)) {
 		const callbackUrl = localRedirect(event.url.pathname + event.url.search, policy.origin);
 		return new Response(null, {
@@ -86,6 +85,10 @@ export async function requireSignIn(
 	return denied(401);
 }
 
+function isInGroup(routeId: string, group: string): boolean {
+	return routeId === group || routeId.startsWith(`${group}/`);
+}
+
 function isUnsafeMethod(event: RequestEvent): boolean {
 	return !['GET', 'HEAD', 'OPTIONS'].includes(event.request.method);
 }
diff --git a/apps/web/src/lib/server/auth/actions.ts b/apps/web/src/lib/server/auth/actions.ts
index afd1e37..530b9e9 100644
--- a/apps/web/src/lib/server/auth/actions.ts
+++ b/apps/web/src/lib/server/auth/actions.ts
@@ -40,7 +40,7 @@ export async function signInAction(
 			if (!['https:', 'http:'].includes(destination.protocol)) {
 				throw new Error('Invalid authentication destination.');
 			}
-			redirect(303, destination.href);
+			redirect(303, destination.href, { external: true });
 		}
 		redirect(303, callbackUrl);
 	} catch (failure) {
@@ -86,10 +86,10 @@ async function submitAuth(
 	);
 	// The same native cookie helpers used by sveltekitCookies, without bypassing the router.
 	for (const [name, attributes] of parseSetCookieHeader(response.headers.get('set-cookie') ?? '')) {
-		event.cookies.set(name, attributes.value, {
-			...toCookieOptions(attributes),
-			path: attributes.path || '/'
-		});
+		const options = Object.fromEntries(
+			Object.entries(toCookieOptions(attributes)).filter(([, value]) => value !== undefined)
+		);
+		event.cookies.set(name, attributes.value, { ...options, path: attributes.path || '/' });
 	}
 	return response;
 }
diff --git a/apps/web/src/routes/(protected)/(endpoints)/config/version/+server.ts b/apps/web/src/routes/(protected)/(endpoints)/config/version/+server.ts
index 2ddc2ca..c1cb3fc 100644
--- a/apps/web/src/routes/(protected)/(endpoints)/config/version/+server.ts
+++ b/apps/web/src/routes/(protected)/(endpoints)/config/version/+server.ts
@@ -1,7 +1,7 @@
-import { json, type RequestHandler } from '@sveltejs/kit';
+import type { RequestHandler } from '@sveltejs/kit';
 
 export const GET = (({ locals }) =>
-	json(
+	Response.json(
 		{ snapshotId: locals.snapshot.display.snapshotId },
 		{ headers: { 'cache-control': 'private, no-store' } }
 	)) satisfies RequestHandler;
diff --git a/apps/web/src/routes/(protected)/+page.svelte b/apps/web/src/routes/(protected)/+page.svelte
index 23e726c..d89ce0f 100644
--- a/apps/web/src/routes/(protected)/+page.svelte
+++ b/apps/web/src/routes/(protected)/+page.svelte
@@ -3,6 +3,7 @@
 	import { SvelteURLSearchParams } from 'svelte/reactivity';
 	import IconSignOut from 'virtual:icons/ph/sign-out';
 	import { beforeNavigate, goto } from '$app/navigation';
+	import { resolve } from '$app/paths';
 	import { page } from '$app/state';
 	import BookmarkLogo from '#lib/components/bookmarks/BookmarkLogo.svelte';
 	import BookmarkDetails from '#lib/components/bookmarks/BookmarkDetails.svelte';
@@ -18,8 +19,10 @@
 
 	let { data }: { data: PageData } = $props();
 
-	// Kit shallow routing updates page.state, not page.url.
-	const searchQuery = $derived(page.state.directoryQuery ?? page.url.searchParams.get('q') ?? '');
+	const currentURL = $derived(page.shallow?.url ?? page.url);
+	let pendingSearchQuery = $state<string>();
+	let searchNavigation = 0;
+	const searchQuery = $derived(pendingSearchQuery ?? currentURL.searchParams.get('q') ?? '');
 	let searchResults = $state<SearchResult[] | null>(null);
 	let searchStatus = $state<'idle' | 'loading' | 'ready' | 'failed'>('idle');
 	let searchInput = $state<HTMLInputElement>();
@@ -39,7 +42,7 @@
 	const directoryURL = $derived.by(() => {
 		const parameters = new SvelteURLSearchParams();
 		if (searchQuery) parameters.set('q', searchQuery);
-		return parameters.size ? `/?${parameters}` : '/';
+		return parameters.size ? resolve(`?${parameters}`) : resolve('');
 	});
 	const selectedGroup = $derived(
 		data.directory.groups.find((group) => group.links.some((link) => link.id === selectedId))
@@ -61,22 +64,29 @@
 
 	function setSearchQuery(query: string) {
 		if (query === searchQuery) return;
+		// Function-bound inputs must update before asynchronous route resolution finishes.
+		pendingSearchQuery = query;
+		const navigation = ++searchNavigation;
 		const parameters = new SvelteURLSearchParams();
 		if (selectedId !== null) parameters.set('link', selectedId);
 		if (query) parameters.set('q', query);
-		const url = parameters.size ? `/?${parameters}` : '/';
-		// eslint-disable-next-line svelte/no-navigation-without-resolve -- Query URLs stay absolute in this root-only directory.
-		goto(url, {
-			shallow: true,
-			replace: true,
-			state: { ...page.state, directoryQuery: query }
-		});
+		const url = parameters.size ? resolve(`?${parameters}`) : resolve('');
+		void goto(url, { shallow: true, replace: true, state: page.state }).then(
+			() => {
+				if (navigation === searchNavigation) pendingSearchQuery = undefined;
+			},
+			() => {
+				if (navigation !== searchNavigation) return;
+				pendingSearchQuery = undefined;
+				window.location.replace(url);
+			}
+		);
 	}
 
 	function detailURL(id: string) {
 		const parameters = new SvelteURLSearchParams({ link: id });
 		if (searchQuery) parameters.set('q', searchQuery);
-		return `/?${parameters}`;
+		return resolve(`?${parameters}`);
 	}
 
 	function findBookmarkTile(id: string) {
@@ -142,20 +152,20 @@
 		returnTile = tile;
 		pendingFilterQuery = undefined;
 		isClosingDetails = false;
-		// eslint-disable-next-line svelte/no-navigation-without-resolve -- This absolute href comes from the real tile anchor.
-		goto(href, {
+		void goto(href, {
 			shallow: true,
 			state: { ...page.state, directoryDetail: { id, fromGrid: true } }
+		}).catch(() => {
+			window.location.href = href;
 		});
 	}
 
-	function navigateDetails(step: -1 | 1) {
+	async function navigateDetails(step: -1 | 1): Promise<void> {
 		if (isClosingDetails || detailIndex < 0) return;
 		const id = detailOrder[detailIndex + step];
 		if (!id) return;
 		returnTile = findBookmarkTile(id);
-		// eslint-disable-next-line svelte/no-navigation-without-resolve -- Root-only URLs must stay absolute.
-		goto(detailURL(id), {
+		return goto(detailURL(id), {
 			shallow: true,
 			replace: true,
 			state: {
@@ -165,19 +175,28 @@
 		});
 	}
 
-	function closeDetails() {
+	async function closeDetails() {
 		if (isClosingDetails) return;
 		isClosingDetails = true;
 		if (page.state.directoryDetail?.fromGrid) {
 			history.back();
 			return;
 		}
-		// eslint-disable-next-line svelte/no-navigation-without-resolve -- Root-only URLs must stay absolute.
-		goto(directoryURL, {
-			shallow: true,
-			replace: true,
-			state: { ...page.state, directoryDetail: null }
-		});
+		try {
+			await goto(directoryURL, {
+				shallow: true,
+				replace: true,
+				state: { ...page.state, directoryDetail: null }
+			});
+		} catch {
+			return;
+		} finally {
+			// A rejected or cancelled navigation leaves the current dialog available to retry.
+			if (selectedLink) {
+				isClosingDetails = false;
+				pendingFilterQuery = undefined;
+			}
+		}
 	}
 
 	function selectDetailFilter(query: string) {
@@ -211,8 +230,21 @@
 		directoryHeading?.focus({ preventScroll: true });
 	}
 
-	beforeNavigate(({ shallow, type }) => {
-		if (shallow && type === 'goto') return;
+	beforeNavigate((navigation) => {
+		if (navigation.shallow && navigation.type === 'goto') return;
+
+		searchNavigation++;
+		pendingSearchQuery = undefined;
+		// Kit may reconstruct this Back traversal after a query followed by a reload.
+		const returningFromGrid =
+			navigation.shallow &&
+			navigation.type === 'popstate' &&
+			navigation.delta === -1 &&
+			isClosingDetails &&
+			page.state.directoryDetail?.fromGrid &&
+			navigation.to?.route?.id === '/(protected)' &&
+			navigation.to.url.href === new URL(directoryURL, currentURL.href).href;
+		if (returningFromGrid) return;
 
 		isClosingDetails = false;
 		pendingFilterQuery = undefined;
@@ -283,8 +315,8 @@
 	{:else if selectedLink}
 		<noscript>
 			<section class="details" aria-labelledby="link-details-title">
-				<!-- eslint-disable-next-line svelte/no-navigation-without-resolve -- Root-only URLs must stay absolute in SSR. -->
-				<a class="back" href={directoryURL} data-sveltekit-preload-data="off">Back to directory</a>
+				<a class="back" href={directoryURL} data-sveltekit-preload-data="false">Back to directory</a
+				>
 				<BookmarkDetails
 					link={selectedLink}
 					groupLabel={selectedGroup?.label}
@@ -295,11 +327,10 @@
 	{/if}
 
 	{#snippet tile(link: DisplayLink, groupLabel: string | undefined, filtered = false)}
-		<!-- eslint-disable svelte/no-navigation-without-resolve -- Root-only URLs must stay absolute in SSR. -->
 		<a
 			class="tile"
 			href={detailURL(link.id)}
-			data-sveltekit-preload-data="off"
+			data-sveltekit-preload-data="false"
 			onkeydown={filtered ? navigateResults : undefined}
 			onclick={(event) => openDetails(event, link.id)}
 		>
@@ -309,7 +340,6 @@
 				<small class="group-caption">{groupLabel}</small>
 			{/if}
 		</a>
-		<!-- eslint-enable svelte/no-navigation-without-resolve -->
 	{/snippet}
 
 	<div class="search-feedback">
diff --git a/apps/web/src/routes/(protected)/page.test.ts b/apps/web/src/routes/(protected)/page.test.ts
index 1489ede..6c5c126 100644
--- a/apps/web/src/routes/(protected)/page.test.ts
+++ b/apps/web/src/routes/(protected)/page.test.ts
@@ -50,7 +50,10 @@ function eventFor(query = '', withAuth = false) {
 	>[0];
 }
 
-const notFound = expect.objectContaining({ status: 404, body: { message: 'Not found' } });
+const notFound = expect.objectContaining({
+	status: 404,
+	body: expect.objectContaining({ message: 'Not found' })
+});
 
 describe('directory page data', () => {
 	it('returns exactly the prepared display, selection and signed-in boolean in no-auth mode', () => {
diff --git a/apps/web/src/routes/(public)/favicon/server.test.ts b/apps/web/src/routes/(public)/favicon/server.test.ts
index bfddca9..ed70394 100644
--- a/apps/web/src/routes/(public)/favicon/server.test.ts
+++ b/apps/web/src/routes/(public)/favicon/server.test.ts
@@ -80,11 +80,14 @@ describe('public favicon alias', () => {
 			'/favicon?source=%252e%252e%252fsecret.svg',
 			'/favicon/other.svg?favicon_path=/public/other.svg'
 		]) {
-			const request = event('GET');
-			request.url = new URL(path, 'http://localhost');
-			request.request = new Request(request.url, {
-				headers: { 'x-public-dir': '/outside', range: 'bytes=0-1', 'if-none-match': '*' }
-			});
+			const url = new URL(path, 'http://localhost');
+			const request = {
+				...event('GET'),
+				url,
+				request: new Request(url, {
+					headers: { 'x-public-dir': '/outside', range: 'bytes=0-1', 'if-none-match': '*' }
+				})
+			};
 			expect((await GET(request)).status).toBe(200);
 		}
 		expect(readMountedImage).toHaveBeenCalledTimes(3);
diff --git a/apps/web/src/routes/(public)/healthz/+server.ts b/apps/web/src/routes/(public)/healthz/+server.ts
index 68732cf..84578bb 100644
--- a/apps/web/src/routes/(public)/healthz/+server.ts
+++ b/apps/web/src/routes/(public)/healthz/+server.ts
@@ -1,4 +1,7 @@
-import { json, type RequestHandler } from '@sveltejs/kit';
+import type { RequestHandler } from '@sveltejs/kit';
 
 export const GET = (() =>
-	json({ status: 'ok' }, { headers: { 'cache-control': 'no-store' } })) satisfies RequestHandler;
+	Response.json(
+		{ status: 'ok' },
+		{ headers: { 'cache-control': 'no-store' } }
+	)) satisfies RequestHandler;
diff --git a/apps/web/src/routes/(public)/images/og.png/server.test.ts b/apps/web/src/routes/(public)/images/og.png/server.test.ts
index 17bb961..ecc6ab9 100644
--- a/apps/web/src/routes/(public)/images/og.png/server.test.ts
+++ b/apps/web/src/routes/(public)/images/og.png/server.test.ts
@@ -166,21 +166,24 @@ describe('public generated Open Graph image', () => {
 				'/images/og.png?favicon_path=/public/other.svg&og_image_path=/public/other.jpg&primary_light_color=%23fff&primary_dark_color=%23000',
 				'/images/other.png?source=%252e%252e%252fsecret.svg&title=OTHER'
 			]) {
-				const request = event(method);
-				request.url = new URL(path, 'http://attacker.example');
-				request.request = new Request(request.url, {
-					method,
-					headers: {
-						'x-public-dir': '/outside',
-						'x-favicon-path': '/public/other.svg',
-						'x-title': 'HEADER_TITLE',
-						'x-primary-light-color': '#fff',
-						'x-primary-dark-color': '#000',
-						accept: 'image/jpeg',
-						range: 'bytes=0-1',
-						'if-none-match': '*'
-					}
-				});
+				const url = new URL(path, 'http://attacker.example');
+				const request = {
+					...event(method),
+					url,
+					request: new Request(url, {
+						method,
+						headers: {
+							'x-public-dir': '/outside',
+							'x-favicon-path': '/public/other.svg',
+							'x-title': 'HEADER_TITLE',
+							'x-primary-light-color': '#fff',
+							'x-primary-dark-color': '#000',
+							accept: 'image/jpeg',
+							range: 'bytes=0-1',
+							'if-none-match': '*'
+						}
+					})
+				};
 				await expectPNG(await (method === 'HEAD' ? HEAD : GET)(request), method);
 			}
 			expect(vi.mocked(readMountedImage).mock.calls).toEqual(
diff --git a/apps/web/src/routes/(public)/logo/server.test.ts b/apps/web/src/routes/(public)/logo/server.test.ts
index e236e12..51d524b 100644
--- a/apps/web/src/routes/(public)/logo/server.test.ts
+++ b/apps/web/src/routes/(public)/logo/server.test.ts
@@ -80,11 +80,14 @@ describe('public selected-logo alias', () => {
 			'/logo?source=%252e%252e%252fsecret.svg',
 			'/logo/other.svg?logo_path=/public/other.svg'
 		]) {
-			const request = event('GET');
-			request.url = new URL(path, 'http://localhost');
-			request.request = new Request(request.url, {
-				headers: { 'x-public-dir': '/outside', range: 'bytes=0-1', 'if-none-match': '*' }
-			});
+			const url = new URL(path, 'http://localhost');
+			const request = {
+				...event('GET'),
+				url,
+				request: new Request(url, {
+					headers: { 'x-public-dir': '/outside', range: 'bytes=0-1', 'if-none-match': '*' }
+				})
+			};
 			expect((await GET(request)).status).toBe(200);
 		}
 		expect(readMountedImage).toHaveBeenCalledTimes(3);
diff --git a/apps/web/src/routes/(public)/public/[...file]/server.test.ts b/apps/web/src/routes/(public)/public/[...file]/server.test.ts
index b32c960..6268fa4 100644
--- a/apps/web/src/routes/(public)/public/[...file]/server.test.ts
+++ b/apps/web/src/routes/(public)/public/[...file]/server.test.ts
@@ -57,14 +57,17 @@ describe('public mounted image route', () => {
 	);
 
 	it('ignores conditional and range headers', async () => {
-		const request = event('icon.svg');
-		request.request = new Request(request.request, {
-			headers: {
-				'if-none-match': '*',
-				'if-modified-since': new Date().toUTCString(),
-				range: 'bytes=0-2'
-			}
-		});
+		const captured = event('icon.svg');
+		const request = {
+			...captured,
+			request: new Request(captured.request, {
+				headers: {
+					'if-none-match': '*',
+					'if-modified-since': new Date().toUTCString(),
+					range: 'bytes=0-2'
+				}
+			})
+		};
 		const response = await GET(request);
 		expect(response.status).toBe(200);
 		expect(await response.text()).toBe('<svg/>');
diff --git a/apps/web/src/routes/(public)/schema.json/+server.ts b/apps/web/src/routes/(public)/schema.json/+server.ts
index f239f4a..02308b9 100644
--- a/apps/web/src/routes/(public)/schema.json/+server.ts
+++ b/apps/web/src/routes/(public)/schema.json/+server.ts
@@ -1,8 +1,7 @@
-import { json } from '@sveltejs/kit';
 import editorSchema from '@directory/config/schema.json' with { type: 'json' };
 
 export function GET(): Response {
-	return json(editorSchema, {
+	return Response.json(editorSchema, {
 		headers: {
 			'content-type': 'application/schema+json; charset=utf-8',
 			'cache-control': 'no-store'
-- 
2.54.0


From 96729dceba76db76f79e9d6e13257b92613616e6 Mon Sep 17 00:00:00 2001
From: eleith <eleith@noreply.git.eleith.com>
Date: Tue, 3 Nov 2026 08:37:54 -0800
Subject: [PATCH 4/4] Complete SvelteKit 3 container migration

---
 .changeset/web-framework-upgrade.md |   2 +-
 apps/web/Dockerfile                 |   4 +-
 apps/web/MIGRATION_TASKS.md         | 141 ----------------------------
 apps/web/docker-compose.dev.yml     |   1 -
 4 files changed, 4 insertions(+), 144 deletions(-)
 delete mode 100644 apps/web/MIGRATION_TASKS.md

diff --git a/.changeset/web-framework-upgrade.md b/.changeset/web-framework-upgrade.md
index 40a3c2e..2f3977f 100644
--- a/.changeset/web-framework-upgrade.md
+++ b/.changeset/web-framework-upgrade.md
@@ -2,4 +2,4 @@
 '@directory/web': patch
 ---
 
-Upgrade the web app to SvelteKit 3, preserving runtime `site.url`, native sign-in and bookmark navigation.
+Upgrade the web app to SvelteKit 3, preserving runtime `site.url`, native sign-in, bookmark navigation and container workflows.
diff --git a/apps/web/Dockerfile b/apps/web/Dockerfile
index 798de18..2b56294 100644
--- a/apps/web/Dockerfile
+++ b/apps/web/Dockerfile
@@ -22,9 +22,11 @@ COPY . .
 RUN --mount=type=cache,id=pnpm-store,target=/home/app/store pnpm install --offline --frozen-lockfile
 # Only generated output and caches are writable; source binds stay read-only.
 RUN mkdir -p /m/packages/config/dist /m/apps/web/.svelte-kit \
+        '/m/apps/web/node_modules/$app' \
         /m/apps/web/node_modules/.vite /m/apps/web/node_modules/.vite-temp \
     && chown -R ${LOCAL_UID}:${LOCAL_GID} /home/app /m/packages/config/dist \
-        /m/apps/web/.svelte-kit /m/apps/web/node_modules/.vite /m/apps/web/node_modules/.vite-temp
+        /m/apps/web/.svelte-kit '/m/apps/web/node_modules/$app' \
+        /m/apps/web/node_modules/.vite /m/apps/web/node_modules/.vite-temp
 USER ${LOCAL_UID}:${LOCAL_GID}
 WORKDIR /m/apps/web
 EXPOSE 5173
diff --git a/apps/web/MIGRATION_TASKS.md b/apps/web/MIGRATION_TASKS.md
deleted file mode 100644
index a5ea753..0000000
--- a/apps/web/MIGRATION_TASKS.md
+++ /dev/null
@@ -1,141 +0,0 @@
-<!-- Generated by sv migrate sveltekit-3:collect-migration-instructions -->
-
-# SvelteKit 3 migration tasks
-
-Some migrations are uncommon, context-dependent, or disproportionately difficult to automate safely. This document lists them.
-
-The findings are intentionally broad and may include files that do not require changes.
-
-AI agents can work through the migration tasks below one at a time:
-
-1. Read the linked documentation or pull request before changing code.
-2. Inspect every listed file and its surrounding context.
-3. Ignore a finding when the file is not actually affected.
-4. Make the smallest necessary change. Do not perform unrelated refactors or introduce unnecessary abstractions.
-5. Ask the user when application intent cannot be inferred.
-6. Run the project's appropriate checks after editing.
-
-Also search the project for `@migration-task` comments. They may describe additional manual migration work that must be resolved.
-
-## Migration tasks
-
-### Review `goto` destinations
-
-`goto(...)` now rejects destinations that do not resolve to an application route.
-
-#### What to do
-
-Confirm each destination is an internal route. Use `window.location.href` for external browser navigation, and handle rejected dynamic destinations where they can fail to resolve.
-
-#### References
-
-- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#$app-navigation-goto-rejects-for-URLs-that-don't-resolve-to-a-route)
-
-#### Files to review
-
-- [ ] `src/routes/(protected)/+page.svelte`
-
-### Replace `invalidateAll` with `refreshAll`
-
-`invalidateAll` is deprecated in favor of `refreshAll`
-
-#### What to do
-
-Replace `invalidateAll()` with `refreshAll()`. Note that `refreshAll()` will keep `page.state` intact. Check if that has unwanted impact on the application; if yes point this out in a comment with steps to take instead of replacing that instance of `invalidateAll()`. Similarly, replace goto(..., { invalidateAll: true }) with goto(..., { refreshAll: true }).
-
-#### References
-
-- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#$app-navigation-invalidateAll-is-deprecated-in-favour-of-refreshAll)
-
-#### Files to review
-
-- [ ] `src/routes/(protected)/+page.svelte`
-
-### `data-sveltekit-*` uses `false` instead of `"off"`
-
-The `"off"` value for `data-sveltekit-*` link attributes has been removed in favour of `false`.
-
-#### What to do
-
-Replace `data-sveltekit-...="off"` with `data-sveltekit-...="false"`.
-
-#### References
-
-- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#Miscellaneous-data-sveltekit-uses-false-instead-of-'off')
-
-#### Files to review
-
-- [ ] `src/routes/(protected)/+page.svelte`
-
-### CORS for static assets in development is handled by Vite
-
-SvelteKit no longer sets `access-control-allow-origin: *` on every static asset request in development. CORS is now delegated to Vite's built-in middleware.
-
-#### What to do
-
-If you rely on cross-origin access to static assets in dev, configure it in your Vite config by adding server.cors.origin = "\*" to your config.
-
-#### References
-
-- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#Security-CORS-for-static-assets-in-development-is-handled-by-Vite)
-
-### `json` and `text` are deprecated
-
-The `json(...)` and `text(...)` helpers from `@sveltejs/kit` for generating responses are deprecated.
-
-#### What to do
-
-Use `Response.json(...)` and `new Response(text)` instead.
-
-#### References
-
-- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#sveltejs-kit-json-and-text-are-deprecated)
-
-#### Files to review
-
-- [ ] `src/hooks.server.test.ts`
-- [ ] `src/lib/server/auth/access.test.ts`
-- [ ] `src/lib/server/auth/index.test.ts`
-- [ ] `src/routes/(protected)/(endpoints)/config/version/+server.ts`
-- [ ] `src/routes/(public)/healthz/+server.ts`
-- [ ] `src/routes/(public)/schema.json/+server.ts`
-
-### Move adapter-node `ORIGIN` to `paths.origin`
-
-The adapter-node `ORIGIN` environment variable is removed.
-
-#### What to do
-
-Find where `ORIGIN` is set (`.env` files, scripts, hosting dashboard, ...) and move the public-facing origin to `paths.origin` in `sveltekit(...)`. Do not delete `ORIGIN`: it is ignored by adapter-node now and may have other uses.
-
-#### References
-
-- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#Adapters-adapter-node)
-
-### Review `redirect(...)` destinations for external URLs
-
-`redirect(...)` to an external URL now requires an `external` option.
-
-#### What to do
-
-The automatic migration only analyzes static URLs. Inspect each `redirect` call: if the destination can be an external URL at runtime, pass `{ external: true }` for a blanket allow, or `{ external: [...] }` for a list of permitted origins, or keep it as is when determining that this should only handle app-internal redirects.
-
-#### References
-
-- [Migrating to SvelteKit v3](https://svelte.dev/docs/kit/migrating-to-sveltekit-3#Miscellaneous-External-redirects-must-be-opted-into)
-
-#### Files to review
-
-- [ ] `src/hooks.server.test.ts`
-- [ ] `src/lib/server/auth/access.test.ts`
-- [ ] `src/lib/server/auth/actions.ts`
-- [ ] `src/routes/(protected)/+page.server.ts`
-- [ ] `src/routes/(public)/signin/+page.server.ts`
-
-## Final verification
-
-- [ ] Review every migration task and ignore any irrelevant findings.
-- [ ] Resolve remaining `@migration-task` comments.
-- [ ] Run the project's type checker and tests.
-- [ ] Build the project successfully.
-- [ ] Delete this file when all migration work is complete.
diff --git a/apps/web/docker-compose.dev.yml b/apps/web/docker-compose.dev.yml
index 3284ee1..02e3302 100644
--- a/apps/web/docker-compose.dev.yml
+++ b/apps/web/docker-compose.dev.yml
@@ -26,7 +26,6 @@ services:
       - ./static:/m/apps/web/static:ro
       - ./config:/m/apps/web/config:ro
       - ./public:/m/apps/web/public:ro
-      - ./svelte.config.js:/m/apps/web/svelte.config.js:ro
       - ./vite.config.ts:/m/apps/web/vite.config.ts:ro
       - ./tsconfig.json:/m/apps/web/tsconfig.json:ro
       - ../../packages/config/src:/m/packages/config/src:ro
-- 
2.54.0