From 8d16657907281406d8e69c3e0c1da4678206dcfe Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 23 Feb 2026 16:46:10 +0100
Subject: [PATCH 01/41] add monaco editor and simple trino client

---
 e2e/smoke.spec.ts                             |   5 +-
 e2e/trino.spec.ts                             | 252 +++++++++++++
 messages/de.json                              |  22 +-
 messages/en.json                              |  22 +-
 package-lock.json                             |  48 ++-
 package.json                                  |   6 +-
 src/lib/components/editor/MonacoEditor.svelte |  73 ++++
 src/lib/components/layout/Sidebar.svelte      |   4 +-
 src/routes/(app)/+layout.svelte               |   3 +-
 src/routes/(app)/trino/+page.svelte           | 351 ++++++++++++++++++
 src/routes/api/trino/query/+server.ts         | 211 +++++++++++
 11 files changed, 984 insertions(+), 13 deletions(-)
 create mode 100644 e2e/trino.spec.ts
 create mode 100644 src/lib/components/editor/MonacoEditor.svelte
 create mode 100644 src/routes/(app)/trino/+page.svelte
 create mode 100644 src/routes/api/trino/query/+server.ts

diff --git a/e2e/smoke.spec.ts b/e2e/smoke.spec.ts
index bcc29f04..2aa710b4 100644
--- a/e2e/smoke.spec.ts
+++ b/e2e/smoke.spec.ts
@@ -20,9 +20,10 @@ test.describe('Smoke tests', () => {
     // Dashboard content is rendered
     await expect(page.getByText('Welcome back')).toBeVisible();
 
-    // Trino nav item is present but disabled
+    // Trino nav item is present and navigable
     const trinoLink = page.getByRole('link', { name: 'Trino' });
-    await expect(trinoLink).toHaveAttribute('aria-disabled', 'true');
+    await expect(trinoLink).toBeVisible();
+    await expect(trinoLink).not.toHaveAttribute('aria-disabled', 'true');
   });
 
   test('theme toggle switches between light and dark', async ({ page }) => {
diff --git a/e2e/trino.spec.ts b/e2e/trino.spec.ts
new file mode 100644
index 00000000..77afb1d0
--- /dev/null
+++ b/e2e/trino.spec.ts
@@ -0,0 +1,252 @@
+import { test, expect, type Page } from '@playwright/test';
+
+const COLUMNS = [
+  { name: 'id', type: 'integer' },
+  { name: 'name', type: 'varchar' }
+];
+
+// In SvelteKit + Vite dev mode, the `load` event fires before all dynamic module
+// imports finish. Svelte 5 attaches event handlers only after those imports
+// complete (hydration). Poll for the theme key — the layout writes it on mount —
+// as a reliable signal that the app is fully hydrated and interactive.
+async function waitForHydration(page: Page) {
+  await expect
+    .poll(() => page.evaluate(() => localStorage.getItem('theme')))
+    .toMatch(/^(light|dark)$/);
+}
+
+test.describe('Trino query editor', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(async ({ page }) => {
+    // Pre-populate localStorage so the connection config and SQL are ready without
+    // user interaction — addInitScript runs before any page scripts execute.
+    await page.addInitScript(() => {
+      localStorage.setItem('trino_url', 'http://trino.example.com:8080');
+      localStorage.setItem('trino_auth_type', 'none');
+      localStorage.setItem('trino_sql', 'SELECT id, name FROM users');
+    });
+  });
+
+  test('page renders with editor and results sections', async ({ page }) => {
+    await page.goto('/trino');
+
+    await expect(page.getByRole('heading', { name: 'Trino' })).toBeVisible();
+    await expect(page.getByText('SQL editor')).toBeVisible();
+    await expect(page.getByText('Query results')).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Run query' })).toBeVisible();
+    await expect(page.getByText('No results')).toBeVisible();
+  });
+
+  test('Trino nav item is active when on /trino', async ({ page }) => {
+    await page.goto('/trino');
+
+    const trinoLink = page.getByRole('link', { name: 'Trino' });
+    await expect(trinoLink).toHaveAttribute('aria-current', 'page');
+  });
+
+  test('running a query displays the results table', async ({ page }) => {
+    await page.route('**/api/trino/query', async (route) => {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({
+          queryId: 'q1',
+          columns: COLUMNS,
+          rows: [
+            [1, 'Alice'],
+            [2, 'Bob'],
+            [3, 'Carol']
+          ],
+          hasMore: false,
+          totalRows: 3
+        })
+      });
+    });
+
+    await page.goto('/trino');
+    await waitForHydration(page);
+    await page.getByRole('button', { name: 'Run query' }).click();
+
+    const table = page.getByRole('table', { name: 'Query results' });
+    await expect(table).toBeVisible();
+    await expect(table.getByRole('columnheader', { name: 'id' })).toBeVisible();
+    await expect(table.getByRole('columnheader', { name: 'name' })).toBeVisible();
+    await expect(table.getByRole('cell', { name: '1' })).toBeVisible();
+    await expect(table.getByRole('cell', { name: 'Alice' })).toBeVisible();
+    await expect(page.getByText('Rows 1–3 of 3')).toBeVisible();
+  });
+
+  test('Ctrl+Enter triggers query execution', async ({ page }) => {
+    let called = false;
+    await page.route('**/api/trino/query', async (route) => {
+      called = true;
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({
+          queryId: 'q1',
+          columns: COLUMNS,
+          rows: [[1, 'Alice']],
+          hasMore: false,
+          totalRows: 1
+        })
+      });
+    });
+
+    await page.goto('/trino');
+    await waitForHydration(page);
+    await page.keyboard.press('Control+Enter');
+
+    await expect.poll(() => called).toBe(true);
+    await expect(page.getByRole('table', { name: 'Query results' })).toBeVisible();
+  });
+
+  test('query error is shown in an alert', async ({ page }) => {
+    await page.route('**/api/trino/query', async (route) => {
+      await route.fulfill({
+        status: 400,
+        contentType: 'application/json',
+        body: JSON.stringify({ error: 'syntax error at position 7' })
+      });
+    });
+
+    await page.goto('/trino');
+    await waitForHydration(page);
+    await page.getByRole('button', { name: 'Run query' }).click();
+
+    // Monaco also renders role="alert" nodes for its own accessibility — filter by content.
+    const alert = page.getByRole('alert').filter({ hasText: 'Query error' });
+    await expect(alert).toBeVisible();
+    await expect(alert.getByText('syntax error at position 7')).toBeVisible();
+  });
+
+  test('pagination navigates between pages', async ({ page }) => {
+    const allRows = Array.from({ length: 30 }, (_, i) => [i + 1, `Row ${i + 1}`]);
+
+    await page.route('**/api/trino/query', async (route) => {
+      const body = JSON.parse((await route.request().postData()) ?? '{}');
+      const pg: number = body.page ?? 0;
+      const ps = 25;
+      const slice = allRows.slice(pg * ps, pg * ps + ps);
+
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({
+          queryId: 'q-pages',
+          columns: COLUMNS,
+          rows: slice,
+          hasMore: (pg + 1) * ps < allRows.length,
+          totalRows: allRows.length
+        })
+      });
+    });
+
+    await page.goto('/trino');
+    await waitForHydration(page);
+    await page.getByRole('button', { name: 'Run query' }).click();
+
+    await expect(page.getByText('Rows 1–25 of 30')).toBeVisible();
+
+    const nextBtn = page.getByRole('button', { name: 'Next page' });
+    const prevBtn = page.getByRole('button', { name: 'Previous page' });
+    await expect(prevBtn).toBeDisabled();
+    await expect(nextBtn).toBeEnabled();
+
+    await nextBtn.click();
+    await expect(page.getByText('Rows 26–30 of 30')).toBeVisible();
+    await expect(prevBtn).toBeEnabled();
+    await expect(nextBtn).toBeDisabled();
+
+    await prevBtn.click();
+    await expect(page.getByText('Rows 1–25 of 30')).toBeVisible();
+  });
+
+  test('session expired shows correct message', async ({ page }) => {
+    let call = 0;
+    await page.route('**/api/trino/query', async (route) => {
+      call++;
+      if (call === 1) {
+        await route.fulfill({
+          status: 200,
+          contentType: 'application/json',
+          body: JSON.stringify({
+            queryId: 'exp-id',
+            columns: COLUMNS,
+            rows: [[1, 'Alice']],
+            hasMore: true,
+            totalRows: 50
+          })
+        });
+      } else {
+        await route.fulfill({
+          status: 404,
+          contentType: 'application/json',
+          body: JSON.stringify({ error: 'session_expired' })
+        });
+      }
+    });
+
+    await page.goto('/trino');
+    await waitForHydration(page);
+    await page.getByRole('button', { name: 'Run query' }).click();
+    await expect(page.getByRole('table')).toBeVisible();
+
+    await page.getByRole('button', { name: 'Next page' }).click();
+
+    const alert = page.getByRole('alert').filter({ hasText: 'Query session expired' });
+    await expect(alert).toBeVisible();
+  });
+
+  test('connection section expands to reveal URL and auth controls', async ({ page }) => {
+    await page.goto('/trino');
+
+    // The DaisyUI collapse uses a visually-hidden checkbox as its toggle.
+    await page.getByRole('checkbox', { name: 'Connection' }).check({ force: true });
+
+    const urlInput = page.getByRole('textbox', { name: 'URL' });
+    await expect(urlInput).toBeVisible();
+    await expect(urlInput).toHaveValue('http://trino.example.com:8080');
+  });
+
+  test('switching to basic auth reveals credential fields', async ({ page }) => {
+    await page.goto('/trino');
+    await page.getByRole('checkbox', { name: 'Connection' }).check({ force: true });
+
+    // No credentials visible for 'none' auth
+    await expect(page.getByLabel('Username')).not.toBeVisible();
+    await expect(page.getByLabel('Password')).not.toBeVisible();
+
+    // Switch to basic auth
+    await page.getByRole('radio', { name: 'Basic' }).check({ force: true });
+
+    await expect(page.getByLabel('Username')).toBeVisible();
+    await expect(page.getByLabel('Password')).toBeVisible();
+  });
+
+  test('null cell values render as italic null placeholder', async ({ page }) => {
+    await page.route('**/api/trino/query', async (route) => {
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({
+          queryId: 'q-null',
+          columns: [{ name: 'value', type: 'varchar' }],
+          rows: [[null], ['hello']],
+          hasMore: false,
+          totalRows: 2
+        })
+      });
+    });
+
+    await page.goto('/trino');
+    await waitForHydration(page);
+    await page.getByRole('button', { name: 'Run query' }).click();
+
+    const table = page.getByRole('table');
+    await expect(table).toBeVisible();
+    await expect(table.getByText('null')).toBeVisible();
+    await expect(table.getByText('hello')).toBeVisible();
+  });
+});
diff --git a/messages/de.json b/messages/de.json
index 9b3b2158..979e2548 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -33,8 +33,28 @@
   "page_title_dashboard": "Dashboard",
   "page_title_default": "Stackable",
   "page_title_suffix": "Stackable",
+  "page_title_trino": "Trino",
   "setup_steps_label": "Einrichtungsschritte",
   "language_label": "Sprache",
   "language_en": "English",
-  "language_de": "Deutsch"
+  "language_de": "Deutsch",
+  "trino_run_query": "Abfrage ausführen",
+  "trino_results_empty": "Keine Ergebnisse",
+  "trino_query_error": "Abfragefehler",
+  "trino_running": "Wird ausgeführt...",
+  "trino_connection_url_placeholder": "https://trino.example.com:8443",
+  "trino_editor_label": "SQL-Editor",
+  "trino_results_label": "Abfrageergebnisse",
+  "trino_rows_range": "Zeilen {start}–{end} von {total}",
+  "trino_session_expired": "Abfragesitzung abgelaufen – bitte Abfrage erneut ausführen.",
+  "trino_page_size": "Zeilen pro Seite",
+  "trino_prev_page": "Vorherige Seite",
+  "trino_next_page": "Nächste Seite",
+  "trino_connection_label": "Verbindung",
+  "trino_connection_url": "URL",
+  "trino_connection_auth": "Authentifizierung",
+  "trino_auth_none": "Keine",
+  "trino_auth_basic": "Basic",
+  "trino_auth_username": "Benutzername",
+  "trino_auth_password": "Passwort"
 }
diff --git a/messages/en.json b/messages/en.json
index ca545214..98683629 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -33,8 +33,28 @@
   "page_title_dashboard": "Dashboard",
   "page_title_default": "Stackable",
   "page_title_suffix": "Stackable",
+  "page_title_trino": "Trino",
   "setup_steps_label": "Setup steps",
   "language_label": "Language",
   "language_en": "English",
-  "language_de": "Deutsch"
+  "language_de": "Deutsch",
+  "trino_run_query": "Run query",
+  "trino_results_empty": "No results",
+  "trino_query_error": "Query error",
+  "trino_running": "Running...",
+  "trino_connection_url_placeholder": "https://trino.example.com:8443",
+  "trino_editor_label": "SQL editor",
+  "trino_results_label": "Query results",
+  "trino_rows_range": "Rows {start}–{end} of {total}",
+  "trino_session_expired": "Query session expired — please re-run the query.",
+  "trino_page_size": "Rows per page",
+  "trino_prev_page": "Previous page",
+  "trino_next_page": "Next page",
+  "trino_connection_label": "Connection",
+  "trino_connection_url": "URL",
+  "trino_connection_auth": "Auth",
+  "trino_auth_none": "No auth",
+  "trino_auth_basic": "Basic",
+  "trino_auth_username": "Username",
+  "trino_auth_password": "Password"
 }
diff --git a/package-lock.json b/package-lock.json
index 26db3387..8b661b6e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,7 +8,9 @@
       "name": "@stackable/stackable-ui",
       "version": "0.0.1",
       "dependencies": {
-        "@internationalized/date": "^3.11.0"
+        "@internationalized/date": "^3.11.0",
+        "monaco-editor": "^0.55.1",
+        "undici": "^7.22.0"
       },
       "devDependencies": {
         "@eslint/compat": "^2.0.2",
@@ -19,7 +21,7 @@
         "@sveltejs/kit": "^2.51.0",
         "@sveltejs/vite-plugin-svelte": "^6.2.4",
         "@tailwindcss/vite": "^4.1.18",
-        "@types/node": "^24",
+        "@types/node": "^24.10.13",
         "daisyui": "^5.5.18",
         "eslint": "^9.39.2",
         "eslint-config-prettier": "^10.1.8",
@@ -1490,7 +1492,7 @@
       "version": "2.0.7",
       "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
       "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@types/validator": {
@@ -2266,6 +2268,15 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/dompurify": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.2.7.tgz",
+      "integrity": "sha512-WhL/YuveyGXJaerVlMYGWhvQswa7myDG17P7Vu65EWC05o8vfeNbvNf4d/BOvH99+ZW+LlQsc1GDKMa1vNK6dw==",
+      "license": "(MPL-2.0 OR Apache-2.0)",
+      "optionalDependencies": {
+        "@types/trusted-types": "^2.0.7"
+      }
+    },
     "node_modules/effect": {
       "version": "3.19.17",
       "resolved": "https://registry.npmjs.org/effect/-/effect-3.19.17.tgz",
@@ -3362,6 +3373,18 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/marked": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-14.0.0.tgz",
+      "integrity": "sha512-uIj4+faQ+MgHgwUW1l2PsPglZLOLOT1uErt06dAPtx2kjteLAkbsd/0FiYg/MGS+i7ZKLb7w2WClxHkzOOuryQ==",
+      "license": "MIT",
+      "bin": {
+        "marked": "bin/marked.js"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
     "node_modules/mdn-data": {
       "version": "2.23.0",
       "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.23.0.tgz",
@@ -3399,6 +3422,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/monaco-editor": {
+      "version": "0.55.1",
+      "resolved": "https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.55.1.tgz",
+      "integrity": "sha512-jz4x+TJNFHwHtwuV9vA9rMujcZRb0CEilTEwG2rRSpe/A7Jdkuj8xPKttCgOh+v/lkHy7HsZ64oj+q3xoAFl9A==",
+      "license": "MIT",
+      "dependencies": {
+        "dompurify": "3.2.7",
+        "marked": "14.0.0"
+      }
+    },
     "node_modules/mri": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/mri/-/mri-1.2.0.tgz",
@@ -4568,6 +4601,15 @@
         "typescript": ">=4.8.4 <6.0.0"
       }
     },
+    "node_modules/undici": {
+      "version": "7.22.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.22.0.tgz",
+      "integrity": "sha512-RqslV2Us5BrllB+JeiZnK4peryVTndy9Dnqq62S3yYRRTj0tFQCwEniUy2167skdGOy3vqRzEvl1Dm4sV2ReDg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.18.1"
+      }
+    },
     "node_modules/undici-types": {
       "version": "7.16.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
diff --git a/package.json b/package.json
index 9e4aa540..c2022bb3 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "@sveltejs/kit": "^2.51.0",
     "@sveltejs/vite-plugin-svelte": "^6.2.4",
     "@tailwindcss/vite": "^4.1.18",
-    "@types/node": "^24",
+    "@types/node": "^24.10.13",
     "daisyui": "^5.5.18",
     "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.1.8",
@@ -44,6 +44,8 @@
     "zod": "^4.3.6"
   },
   "dependencies": {
-    "@internationalized/date": "^3.11.0"
+    "@internationalized/date": "^3.11.0",
+    "monaco-editor": "^0.55.1",
+    "undici": "^7.22.0"
   }
 }
diff --git a/src/lib/components/editor/MonacoEditor.svelte b/src/lib/components/editor/MonacoEditor.svelte
new file mode 100644
index 00000000..4a75a366
--- /dev/null
+++ b/src/lib/components/editor/MonacoEditor.svelte
@@ -0,0 +1,73 @@
+<script lang="ts">
+  import { onMount, onDestroy } from 'svelte';
+  import { browser } from '$app/environment';
+
+  let {
+    value = $bindable(),
+    language = 'sql'
+  }: {
+    value?: string;
+    language?: string;
+  } = $props();
+
+  let container: HTMLDivElement;
+  let editor: import('monaco-editor').editor.IStandaloneCodeEditor | undefined;
+  let monaco: typeof import('monaco-editor') | undefined;
+  let observer: MutationObserver | undefined;
+
+  // Start loading in parallel with the rest of the page — not deferred to onMount.
+  // Guarded by `browser` because SvelteKit evaluates component scripts on the server too.
+  const workerImport = browser
+    ? import('monaco-editor/esm/vs/editor/editor.worker?worker')
+    : null;
+  const monacoImport = browser ? import('monaco-editor') : null;
+
+  // Detect current theme from DaisyUI data-theme attribute
+  function getMonacoTheme(): string {
+    if (!browser) return 'vs-dark';
+    return document.documentElement.dataset.theme === 'dark' ? 'vs-dark' : 'vs';
+  }
+
+  onMount(async () => {
+    // By the time onMount fires the imports are likely already resolved.
+    const EditorWorker = (await workerImport!).default;
+    self.MonacoEnvironment = {
+      getWorker: () => new EditorWorker()
+    };
+
+    monaco = await monacoImport!;
+
+    editor = monaco.editor.create(container, {
+      value,
+      language,
+      theme: getMonacoTheme(),
+      minimap: { enabled: false },
+      fontSize: 14,
+      lineNumbers: 'on',
+      scrollBeyondLastLine: false,
+      automaticLayout: true,
+      padding: { top: 12, bottom: 12 },
+      wordWrap: 'on'
+    });
+
+    editor.onDidChangeModelContent(() => {
+      value = editor!.getValue();
+    });
+
+    // Watch for theme changes
+    observer = new MutationObserver(() => {
+      monaco?.editor.setTheme(getMonacoTheme());
+    });
+    observer.observe(document.documentElement, {
+      attributes: true,
+      attributeFilter: ['data-theme']
+    });
+  });
+
+  onDestroy(() => {
+    observer?.disconnect();
+    editor?.dispose();
+  });
+</script>
+
+<div bind:this={container} class="h-full w-full"></div>
diff --git a/src/lib/components/layout/Sidebar.svelte b/src/lib/components/layout/Sidebar.svelte
index 9653898e..b0a9eaff 100644
--- a/src/lib/components/layout/Sidebar.svelte
+++ b/src/lib/components/layout/Sidebar.svelte
@@ -34,9 +34,7 @@
         {
           label: m.nav_trino(),
           href: '/trino',
-          icon: 'database',
-          badge: m.nav_badge_soon(),
-          disabled: true
+          icon: 'database'
         }
       ]
     }
diff --git a/src/routes/(app)/+layout.svelte b/src/routes/(app)/+layout.svelte
index 09ab9a1f..6509644a 100644
--- a/src/routes/(app)/+layout.svelte
+++ b/src/routes/(app)/+layout.svelte
@@ -10,7 +10,8 @@
   let mobileOpen = $state(false);
 
   const pageTitles: Record<string, () => string> = {
-    '/': m.page_title_dashboard
+    '/': m.page_title_dashboard,
+    '/trino': m.page_title_trino
   };
 
   let title = $derived((pageTitles[page.url.pathname] ?? m.page_title_default)());
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
new file mode 100644
index 00000000..ae317790
--- /dev/null
+++ b/src/routes/(app)/trino/+page.svelte
@@ -0,0 +1,351 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import MonacoEditor from '$lib/components/editor/MonacoEditor.svelte';
+
+  const uid = $props.id();
+
+  const PAGE_SIZES = [25, 50, 100];
+
+  function ls(key: string, fallback: string): string {
+    try {
+      return localStorage.getItem(key) ?? fallback;
+    } catch {
+      return fallback;
+    }
+  }
+
+  let connectionUrl = $state(ls('trino_url', ''));
+  let authType = $state<'none' | 'basic'>(ls('trino_auth_type', 'none') as 'none' | 'basic');
+  let authUsername = $state(ls('trino_username', ''));
+  let authPassword = $state(ls('trino_password', ''));
+
+  let sql = $state(ls('trino_sql', 'SELECT 1'));
+  let running = $state(false);
+  let columns = $state<{ name: string; type: string }[]>([]);
+  let rows = $state<unknown[][]>([]);
+  let error = $state<string | null>(null);
+  let page = $state(0);
+  let pageSize = $state(25);
+  let hasMore = $state(false);
+  let queryId = $state<string | null>(null);
+  let totalRows = $state<number | null>(null);
+
+  let connectionSummary = $derived(() => {
+    const host = connectionUrl ? connectionUrl.replace(/^https?:\/\//, '').replace(/\/$/, '') : '—';
+    const auth = authType === 'basic' ? m.trino_auth_basic() : m.trino_auth_none();
+    return `${host} · ${auth}`;
+  });
+
+  // Persist connection config and invalidate query cache on change.
+  $effect(() => {
+    localStorage.setItem('trino_url', connectionUrl);
+    localStorage.setItem('trino_auth_type', authType);
+    localStorage.setItem('trino_username', authUsername);
+    localStorage.setItem('trino_password', authPassword);
+    queryId = null;
+  });
+
+  // Persist SQL query.
+  $effect(() => {
+    localStorage.setItem('trino_sql', sql);
+  });
+
+  let rowStart = $derived(page * pageSize + 1);
+  let rowEnd = $derived(page * pageSize + rows.length);
+
+  function buildConnection() {
+    return {
+      url: connectionUrl,
+      auth:
+        authType === 'basic'
+          ? { type: 'basic' as const, username: authUsername, password: authPassword }
+          : { type: 'none' as const }
+    };
+  }
+
+  async function fetchResults(isNewQuery: boolean) {
+    if (running) return;
+    running = true;
+    error = null;
+    hasMore = false;
+
+    if (isNewQuery) {
+      columns = [];
+      rows = [];
+      queryId = null;
+      totalRows = null;
+    }
+
+    try {
+      const body =
+        queryId && !isNewQuery
+          ? { queryId, page, pageSize }
+          : { sql, page, pageSize, connection: buildConnection() };
+
+      const res = await fetch('/api/trino/query', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body)
+      });
+
+      const data = await res.json();
+
+      if (data.error === 'session_expired') {
+        error = m.trino_session_expired();
+        queryId = null;
+      } else if (data.error) {
+        error = data.error;
+      } else {
+        queryId = data.queryId ?? null;
+        columns = data.columns ?? [];
+        rows = data.rows ?? [];
+        hasMore = data.hasMore ?? false;
+        totalRows = data.totalRows ?? null;
+      }
+    } catch (err) {
+      error = err instanceof Error ? err.message : 'Unknown error';
+    } finally {
+      running = false;
+    }
+  }
+
+  function handleKeydown(event: KeyboardEvent) {
+    if ((event.ctrlKey || event.metaKey) && event.key === 'Enter') {
+      page = 0;
+      fetchResults(true);
+    }
+  }
+
+  function handleRunClick() {
+    page = 0;
+    fetchResults(true);
+  }
+
+  function goToPrevPage() {
+    page -= 1;
+    fetchResults(false);
+  }
+
+  function goToNextPage() {
+    page += 1;
+    fetchResults(false);
+  }
+
+  function handlePageSizeChange(event: Event) {
+    pageSize = parseInt((event.target as HTMLSelectElement).value, 10);
+    page = 0;
+    fetchResults(false);
+  }
+</script>
+
+<svelte:window onkeydown={handleKeydown} />
+
+<div class="flex h-full flex-col gap-4">
+  <!-- Connection config section -->
+  <div class="bg-base-100 border-base-300 collapse rounded-xl border">
+    <input type="checkbox" class="peer" aria-label={m.trino_connection_label()} />
+    <div
+      class="collapse-title text-base-content flex items-center justify-between pr-4 text-sm font-medium"
+    >
+      <span>{m.trino_connection_label()}</span>
+      <span class="text-base-content/50 font-mono text-xs">{connectionSummary()}</span>
+    </div>
+    <div class="collapse-content flex flex-col gap-4">
+      <!-- URL -->
+      <div class="flex flex-col gap-1">
+        <label for="{uid}-conn-url" class="label text-sm">
+          {m.trino_connection_url()}
+        </label>
+        <input
+          id="{uid}-conn-url"
+          type="url"
+          class="input input-sm w-full font-mono"
+          placeholder={m.trino_connection_url_placeholder()}
+          bind:value={connectionUrl}
+        />
+      </div>
+
+      <!-- Auth type toggle -->
+      <div class="flex flex-col gap-1">
+        <span class="label text-sm">{m.trino_connection_auth()}</span>
+        <div class="join" role="group" aria-label={m.trino_connection_auth()}>
+          <input
+            id="{uid}-auth-none"
+            class="join-item btn btn-sm"
+            type="radio"
+            name="{uid}-auth"
+            aria-label={m.trino_auth_none()}
+            value="none"
+            bind:group={authType}
+          />
+          <input
+            id="{uid}-auth-basic"
+            class="join-item btn btn-sm"
+            type="radio"
+            name="{uid}-auth"
+            aria-label={m.trino_auth_basic()}
+            value="basic"
+            bind:group={authType}
+          />
+        </div>
+      </div>
+
+      <!-- Basic auth credentials -->
+      {#if authType === 'basic'}
+        <div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
+          <div class="flex flex-col gap-1">
+            <label for="{uid}-auth-username" class="label text-sm">
+              {m.trino_auth_username()}
+            </label>
+            <input
+              id="{uid}-auth-username"
+              type="text"
+              class="input input-sm font-mono"
+              autocomplete="username"
+              bind:value={authUsername}
+            />
+          </div>
+          <div class="flex flex-col gap-1">
+            <label for="{uid}-auth-password" class="label text-sm">
+              {m.trino_auth_password()}
+            </label>
+            <input
+              id="{uid}-auth-password"
+              type="password"
+              class="input input-sm font-mono"
+              autocomplete="current-password"
+              bind:value={authPassword}
+            />
+          </div>
+        </div>
+      {/if}
+    </div>
+  </div>
+
+  <!-- Editor section -->
+  <div class="bg-base-100 border-base-300 flex flex-col rounded-xl border">
+    <div class="border-base-300 flex items-center justify-between border-b px-4 py-2">
+      <span class="text-base-content/60 text-sm font-medium">{m.trino_editor_label()}</span>
+      <button
+        class="btn btn-primary btn-sm"
+        onclick={handleRunClick}
+        disabled={running}
+        aria-label={m.trino_run_query()}
+      >
+        {#if running}
+          <span class="loading loading-spinner loading-xs"></span>
+          {m.trino_running()}
+        {:else}
+          {m.trino_run_query()}
+          <kbd class="kbd kbd-sm opacity-60">Ctrl+↵</kbd>
+        {/if}
+      </button>
+    </div>
+    <div class="h-64">
+      <MonacoEditor bind:value={sql} language="sql" />
+    </div>
+  </div>
+
+  <!-- Results section -->
+  <div class="bg-base-100 border-base-300 flex min-h-0 flex-1 flex-col rounded-xl border">
+    <div class="border-base-300 flex items-center border-b px-4 py-2">
+      <span class="text-base-content/60 text-sm font-medium">{m.trino_results_label()}</span>
+      {#if rows.length > 0 && totalRows !== null}
+        <span class="text-base-content/40 ml-2 text-xs">
+          {m.trino_rows_range({ start: rowStart, end: rowEnd, total: totalRows })}
+        </span>
+      {/if}
+    </div>
+
+    <div class="min-h-0 flex-1 overflow-auto p-4">
+      {#if error}
+        <div class="alert alert-error" role="alert">
+          <svg
+            class="h-5 w-5 shrink-0"
+            aria-hidden="true"
+            viewBox="0 0 24 24"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="1.5"
+          >
+            <circle cx="12" cy="12" r="10" />
+            <path d="M12 8v4m0 4h.01" />
+          </svg>
+          <div>
+            <p class="font-semibold">{m.trino_query_error()}</p>
+            <p class="text-sm opacity-80">{error}</p>
+          </div>
+        </div>
+      {:else if columns.length > 0}
+        <div class="overflow-x-auto" class:opacity-50={running}>
+          <table class="table-sm table-zebra table" aria-label={m.trino_results_label()}>
+            <thead>
+              <tr>
+                {#each columns as col (col.name)}
+                  <th scope="col" class="whitespace-nowrap">{col.name}</th>
+                {/each}
+              </tr>
+            </thead>
+            <tbody>
+              {#each rows as row, rowIdx (rowIdx)}
+                <tr>
+                  {#each row as cell, cellIdx (cellIdx)}
+                    <td class="font-mono text-xs whitespace-nowrap">
+                      {#if cell === null}
+                        <span class="text-base-content/50 italic">null</span>
+                      {:else}
+                        {String(cell)}
+                      {/if}
+                    </td>
+                  {/each}
+                </tr>
+              {/each}
+            </tbody>
+          </table>
+        </div>
+      {:else if !running}
+        <p class="text-base-content/40 py-8 text-center text-sm">{m.trino_results_empty()}</p>
+      {/if}
+    </div>
+
+    {#if columns.length > 0}
+      <div class="border-base-300 flex items-center justify-between border-t px-4 py-3">
+        <div class="join">
+          <button
+            class="btn btn-sm join-item"
+            onclick={goToPrevPage}
+            disabled={page === 0 || running}
+            aria-label={m.trino_prev_page()}
+          >
+            ‹
+          </button>
+          <button
+            class="btn btn-sm join-item"
+            onclick={goToNextPage}
+            disabled={!hasMore || running}
+            aria-label={m.trino_next_page()}
+          >
+            ›
+          </button>
+        </div>
+
+        <div class="flex items-center gap-3">
+          <label for="{uid}-page-size" class="text-base-content/60 text-sm whitespace-nowrap">
+            {m.trino_page_size()}
+          </label>
+          <select
+            id="{uid}-page-size"
+            class="select select-sm"
+            value={pageSize}
+            onchange={handlePageSizeChange}
+            disabled={running}
+          >
+            {#each PAGE_SIZES as size (size)}
+              <option value={size}>{size}</option>
+            {/each}
+          </select>
+        </div>
+      </div>
+    {/if}
+  </div>
+</div>
diff --git a/src/routes/api/trino/query/+server.ts b/src/routes/api/trino/query/+server.ts
new file mode 100644
index 00000000..d4f1776a
--- /dev/null
+++ b/src/routes/api/trino/query/+server.ts
@@ -0,0 +1,211 @@
+import { json } from '@sveltejs/kit';
+import { Agent, fetch as undiciFetch } from 'undici';
+import type { RequestHandler } from './$types';
+
+const POLL_TIMEOUT_MS = 30_000;
+const MAX_CACHED_ROWS = 100_000;
+const CACHE_TTL_MS = 5 * 60 * 1000;
+
+const agent = new Agent({
+  connect: { rejectUnauthorized: false }
+});
+
+interface TrinoColumn {
+  name: string;
+  type: string;
+}
+
+interface TrinoResponse {
+  id?: string;
+  nextUri?: string;
+  columns?: TrinoColumn[];
+  data?: unknown[][];
+  stats?: { state: string };
+  error?: { message: string; errorCode: number };
+}
+
+interface CacheEntry {
+  columns: TrinoColumn[];
+  rows: unknown[][];
+  createdAt: number;
+}
+
+type AuthConfig = { type: 'none' } | { type: 'basic'; username: string; password: string };
+
+interface ConnectionConfig {
+  url: string;
+  auth: AuthConfig;
+}
+
+const queryCache = new Map<string, CacheEntry>();
+
+function evictStale() {
+  const cutoff = Date.now() - CACHE_TTL_MS;
+  for (const [id, entry] of queryCache) {
+    if (entry.createdAt < cutoff) queryCache.delete(id);
+  }
+}
+
+function buildAuthHeaders(auth: AuthConfig): Record<string, string> {
+  if (auth.type === 'basic') {
+    const encoded = Buffer.from(`${auth.username}:${auth.password}`).toString('base64');
+    return {
+      'X-Trino-User': auth.username,
+      Authorization: `Basic ${encoded}`
+    };
+  }
+  return { 'X-Trino-User': 'anonymous' };
+}
+
+async function trinoFetch(
+  url: string,
+  auth: AuthConfig,
+  options?: RequestInit
+): Promise<TrinoResponse> {
+  const res = await undiciFetch(url, {
+    ...options,
+    dispatcher: agent,
+    headers: {
+      ...buildAuthHeaders(auth),
+      'X-Trino-Source': 'stackable-ui',
+      ...(options?.headers ?? {})
+    }
+  } as Parameters<typeof undiciFetch>[1]);
+
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`Trino HTTP ${res.status}: ${text}`);
+  }
+
+  return res.json() as Promise<TrinoResponse>;
+}
+
+function parseConnection(raw: unknown): ConnectionConfig | null {
+  if (!raw || typeof raw !== 'object') return null;
+  const conn = raw as Record<string, unknown>;
+  const url = conn.url;
+  if (typeof url !== 'string' || (!url.startsWith('http://') && !url.startsWith('https://'))) {
+    return null;
+  }
+  const auth = conn.auth as Record<string, unknown> | undefined;
+  if (!auth || typeof auth !== 'object') return null;
+  if (auth.type === 'none') {
+    return { url, auth: { type: 'none' } };
+  }
+  if (
+    auth.type === 'basic' &&
+    typeof auth.username === 'string' &&
+    typeof auth.password === 'string'
+  ) {
+    return { url, auth: { type: 'basic', username: auth.username, password: auth.password } };
+  }
+  return null;
+}
+
+const ALLOWED_PAGE_SIZES = new Set([25, 50, 100]);
+
+export const POST: RequestHandler = async ({ request }) => {
+  const body = await request.json();
+  const pageSize: number = ALLOWED_PAGE_SIZES.has(body.pageSize) ? body.pageSize : 25;
+  const page: number = typeof body.page === 'number' && body.page >= 0 ? Math.floor(body.page) : 0;
+
+  // Pagination: slice from server-side cache, no Trino re-execution.
+  if (typeof body.queryId === 'string' && body.queryId) {
+    const cached = queryCache.get(body.queryId);
+    if (!cached) {
+      console.info('[trino] cache miss for queryId=%s (session expired)', body.queryId);
+      return json({ error: 'session_expired' }, { status: 404 });
+    }
+    const start = page * pageSize;
+    console.debug('[trino] cache hit queryId=%s page=%d pageSize=%d', body.queryId, page, pageSize);
+    return json({
+      queryId: body.queryId,
+      columns: cached.columns,
+      rows: cached.rows.slice(start, start + pageSize),
+      hasMore: start + pageSize < cached.rows.length,
+      totalRows: cached.rows.length
+    });
+  }
+
+  // New query execution — connection config required.
+  const { sql } = body;
+  if (!sql?.trim()) {
+    return json({ error: 'No SQL provided' }, { status: 400 });
+  }
+
+  const connection = parseConnection(body.connection);
+  if (!connection) {
+    return json(
+      {
+        error:
+          'Invalid or missing connection config. Provide connection.url (http/https) and connection.auth.'
+      },
+      { status: 400 }
+    );
+  }
+
+  evictStale();
+
+  const start = Date.now();
+  console.info('[trino] executing query on %s', connection.url);
+
+  const deadline = start + POLL_TIMEOUT_MS;
+  let columns: TrinoColumn[] = [];
+  let rows: unknown[][] = [];
+
+  try {
+    let response = await trinoFetch(`${connection.url}/v1/statement`, connection.auth, {
+      method: 'POST',
+      body: sql.replace(/;\s*$/, '').trim(),
+      headers: { 'Content-Type': 'text/plain' }
+    });
+
+    if (response.error) {
+      console.info('[trino] query error: %s', response.error.message);
+      return json({ error: response.error.message }, { status: 400 });
+    }
+
+    if (response.columns) columns = response.columns;
+    if (response.data) rows = rows.concat(response.data);
+
+    while (response.nextUri && rows.length < MAX_CACHED_ROWS) {
+      if (Date.now() > deadline) {
+        console.info('[trino] query timed out after %dms on %s', POLL_TIMEOUT_MS, connection.url);
+        return json({ error: 'Query timed out after 30 seconds' }, { status: 408 });
+      }
+
+      response = await trinoFetch(response.nextUri, connection.auth);
+
+      if (response.error) {
+        console.info('[trino] query error: %s', response.error.message);
+        return json({ error: response.error.message }, { status: 400 });
+      }
+
+      if (response.columns && columns.length === 0) columns = response.columns;
+      if (response.data) rows = rows.concat(response.data);
+    }
+
+    const queryId = crypto.randomUUID();
+    queryCache.set(queryId, { columns, rows, createdAt: Date.now() });
+
+    console.info(
+      '[trino] query complete: %d rows, %d cols, %dms, queryId=%s',
+      rows.length,
+      columns.length,
+      Date.now() - start,
+      queryId
+    );
+
+    return json({
+      queryId,
+      columns,
+      rows: rows.slice(0, pageSize),
+      hasMore: rows.length > pageSize,
+      totalRows: rows.length
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : 'Unknown error';
+    console.error('[trino] unexpected error on %s: %s', connection.url, message);
+    return json({ error: message }, { status: 500 });
+  }
+};

From 132bcb6220898c9f42769f3f69d4933eddea483b Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 23 Feb 2026 17:07:58 +0100
Subject: [PATCH 02/41] fix: run query shortcut not working when editor is
 selected

---
 src/lib/components/editor/MonacoEditor.svelte | 13 ++++++++++++-
 src/routes/(app)/trino/+page.svelte           |  2 +-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/lib/components/editor/MonacoEditor.svelte b/src/lib/components/editor/MonacoEditor.svelte
index 4a75a366..162e316a 100644
--- a/src/lib/components/editor/MonacoEditor.svelte
+++ b/src/lib/components/editor/MonacoEditor.svelte
@@ -4,10 +4,12 @@
 
   let {
     value = $bindable(),
-    language = 'sql'
+    language = 'sql',
+    onExecute
   }: {
     value?: string;
     language?: string;
+    onExecute?: () => void;
   } = $props();
 
   let container: HTMLDivElement;
@@ -54,6 +56,15 @@
       value = editor!.getValue();
     });
 
+    if (onExecute) {
+      editor.addAction({
+        id: 'execute-query',
+        label: 'Execute Query',
+        keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.Enter],
+        run: onExecute
+      });
+    }
+
     // Watch for theme changes
     observer = new MutationObserver(() => {
       monaco?.editor.setTheme(getMonacoTheme());
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index ae317790..756ce90a 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -242,7 +242,7 @@
       </button>
     </div>
     <div class="h-64">
-      <MonacoEditor bind:value={sql} language="sql" />
+      <MonacoEditor bind:value={sql} language="sql" onExecute={handleRunClick} />
     </div>
   </div>
 

From da4c2c116c9d0ac91c5ff7fb04f147bd2ae377d5 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Wed, 25 Feb 2026 14:00:27 +0100
Subject: [PATCH 03/41] wip: add oidc authentication with better-auth

---
 .env.example                                  |  18 +-
 .github/workflows/pr_checks.yaml              |  14 +
 .gitignore                                    |   1 +
 .../helm/stackable-ui/templates/_helpers.tpl  |  11 +
 .../stackable-ui/templates/configmap.yaml     |   5 +-
 .../stackable-ui/templates/deployment.yaml    |  36 +
 deploy/helm/stackable-ui/templates/pvc.yaml   |  17 +
 .../helm/stackable-ui/templates/secret.yaml   |   2 +
 deploy/helm/stackable-ui/values.yaml          |  32 +
 e2e/auth.setup.ts                             |  26 +
 e2e/auth.spec.ts                              |  56 ++
 messages/de.json                              |   7 +-
 messages/en.json                              |   7 +-
 package-lock.json                             | 764 ++++++++++++++++--
 package.json                                  |   5 +-
 playwright.config.ts                          |  26 +-
 src/app.d.ts                                  |   7 +-
 src/hooks.server.ts                           |  28 +-
 src/lib/auth-client.ts                        |   6 +
 src/lib/components/layout/Header.svelte       |  78 +-
 src/lib/server/auth.ts                        |  35 +
 src/routes/(app)/+layout.server.ts            |   5 +
 src/routes/(app)/+layout.svelte               |   9 +-
 src/routes/auth/login/+page.server.ts         |  12 +
 src/routes/auth/login/+page.svelte            |  86 ++
 src/routes/auth/logout/+page.server.ts        |   8 +
 26 files changed, 1216 insertions(+), 85 deletions(-)
 create mode 100644 deploy/helm/stackable-ui/templates/pvc.yaml
 create mode 100644 e2e/auth.setup.ts
 create mode 100644 e2e/auth.spec.ts
 create mode 100644 src/lib/auth-client.ts
 create mode 100644 src/lib/server/auth.ts
 create mode 100644 src/routes/auth/login/+page.server.ts
 create mode 100644 src/routes/auth/login/+page.svelte
 create mode 100644 src/routes/auth/logout/+page.server.ts

diff --git a/.env.example b/.env.example
index a5e7686d..22280e9e 100644
--- a/.env.example
+++ b/.env.example
@@ -1 +1,17 @@
-# Add project environment variables here when needed.
+# Better Auth configuration
+# A long random secret used to sign sessions and tokens (min 32 characters)
+BETTER_AUTH_SECRET=change-me-to-a-long-random-secret-min-32-chars
+
+# The publicly accessible base URL of this application
+BETTER_AUTH_URL=http://localhost:5173
+
+# OIDC provider configuration (Keycloak, Entra ID, or any compliant OIDC provider)
+# The issuer URL — Better Auth appends /.well-known/openid-configuration automatically
+AUTH_ISSUER=https://your-idp.example.com/realms/your-realm
+
+# The client ID and secret registered in your OIDC provider
+AUTH_CLIENT_ID=stackable-ui
+AUTH_CLIENT_SECRET=your-client-secret
+
+# SQLite database path (must be on a persistent volume in Kubernetes)
+DATABASE_PATH=/data/auth.db
diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml
index 2f7d897b..16cdeb49 100644
--- a/.github/workflows/pr_checks.yaml
+++ b/.github/workflows/pr_checks.yaml
@@ -52,6 +52,12 @@ jobs:
     runs-on: ubuntu-latest
     env:
       PLAYWRIGHT_BASE_URL: http://localhost:4173
+      BETTER_AUTH_URL: http://localhost:4173
+      BETTER_AUTH_SECRET: ci-secret-for-testing-only-not-production
+      AUTH_ISSUER: http://localhost:8080/default
+      AUTH_CLIENT_ID: stackable-ui
+      AUTH_CLIENT_SECRET: ci-client-secret
+      DATABASE_PATH: /tmp/auth-test.db
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -70,6 +76,14 @@ jobs:
       - name: Install Playwright browsers
         run: npx playwright install --with-deps chromium firefox
 
+      - name: Start mock OAuth2 server
+        run: |
+          docker run -d \
+            --name mock-oauth2 \
+            -p 8080:8080 \
+            ghcr.io/navikt/mock-oauth2-server:2.1.10
+          timeout 30 bash -c 'until curl -sf http://localhost:8080/default/.well-known/openid-configuration > /dev/null; do sleep 1; done'
+
       - name: Build application
         run: npm run build
 
diff --git a/.gitignore b/.gitignore
index 0b40116e..04b6c398 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,6 +30,7 @@ dist/
 
 # Playwright
 e2e/test-results
+e2e/.auth
 # Paraglide
 src/lib/paraglide
 project.inlang/cache/
diff --git a/deploy/helm/stackable-ui/templates/_helpers.tpl b/deploy/helm/stackable-ui/templates/_helpers.tpl
index 80e8388b..517552a9 100644
--- a/deploy/helm/stackable-ui/templates/_helpers.tpl
+++ b/deploy/helm/stackable-ui/templates/_helpers.tpl
@@ -74,6 +74,17 @@ Generate session secret
 {{- end }}
 {{- end }}
 
+{{/*
+Generate Better Auth secret
+*/}}
+{{- define "stackable-ui.betterAuthSecret" -}}
+{{- if .Values.auth.secret }}
+{{- .Values.auth.secret }}
+{{- else }}
+{{- randAlphaNum 64 }}
+{{- end }}
+{{- end }}
+
 {{/*
 Image name
 */}}
diff --git a/deploy/helm/stackable-ui/templates/configmap.yaml b/deploy/helm/stackable-ui/templates/configmap.yaml
index c90a91bd..26c8a47d 100644
--- a/deploy/helm/stackable-ui/templates/configmap.yaml
+++ b/deploy/helm/stackable-ui/templates/configmap.yaml
@@ -4,4 +4,7 @@ metadata:
   name: {{ include "stackable-ui.fullname" . }}
   labels:
     {{- include "stackable-ui.labels" . | nindent 4 }}
-data: {}
+data:
+  auth-issuer: {{ .Values.auth.issuer | quote }}
+  auth-client-id: {{ .Values.auth.clientId | quote }}
+  better-auth-url: {{ .Values.auth.url | quote }}
diff --git a/deploy/helm/stackable-ui/templates/deployment.yaml b/deploy/helm/stackable-ui/templates/deployment.yaml
index 4e784f0c..e9ccebe7 100644
--- a/deploy/helm/stackable-ui/templates/deployment.yaml
+++ b/deploy/helm/stackable-ui/templates/deployment.yaml
@@ -63,12 +63,48 @@ spec:
                 secretKeyRef:
                   name: {{ include "stackable-ui.fullname" . }}
                   key: session-secret
+            - name: BETTER_AUTH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "stackable-ui.fullname" . }}
+                  key: better-auth-secret
+            - name: AUTH_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "stackable-ui.fullname" . }}
+                  key: oidc-client-secret
+            - name: BETTER_AUTH_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "stackable-ui.fullname" . }}
+                  key: better-auth-url
+            - name: AUTH_ISSUER
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "stackable-ui.fullname" . }}
+                  key: auth-issuer
+            - name: AUTH_CLIENT_ID
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "stackable-ui.fullname" . }}
+                  key: auth-client-id
+            - name: DATABASE_PATH
+              value: {{ .Values.config.databasePath | quote }}
           volumeMounts:
             - name: tmp
               mountPath: /tmp
+            - name: data
+              mountPath: /data
       volumes:
         - name: tmp
           emptyDir: {}
+        - name: data
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{ else }}{{ include "stackable-ui.fullname" . }}-data{{ end }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/deploy/helm/stackable-ui/templates/pvc.yaml b/deploy/helm/stackable-ui/templates/pvc.yaml
new file mode 100644
index 00000000..a1f9235b
--- /dev/null
+++ b/deploy/helm/stackable-ui/templates/pvc.yaml
@@ -0,0 +1,17 @@
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "stackable-ui.fullname" . }}-data
+  labels:
+    {{- include "stackable-ui.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+  {{- with .Values.persistence.storageClassName }}
+  storageClassName: {{ . }}
+  {{- end }}
+{{- end }}
diff --git a/deploy/helm/stackable-ui/templates/secret.yaml b/deploy/helm/stackable-ui/templates/secret.yaml
index 646678c6..daaf4ba7 100644
--- a/deploy/helm/stackable-ui/templates/secret.yaml
+++ b/deploy/helm/stackable-ui/templates/secret.yaml
@@ -7,3 +7,5 @@ metadata:
 type: Opaque
 stringData:
   session-secret: {{ include "stackable-ui.sessionSecret" . | quote }}
+  better-auth-secret: {{ include "stackable-ui.betterAuthSecret" . | quote }}
+  oidc-client-secret: {{ .Values.auth.clientSecret | quote }}
diff --git a/deploy/helm/stackable-ui/values.yaml b/deploy/helm/stackable-ui/values.yaml
index e4a68488..4ba2a577 100644
--- a/deploy/helm/stackable-ui/values.yaml
+++ b/deploy/helm/stackable-ui/values.yaml
@@ -1,6 +1,8 @@
 ---
 # Default values for stackable-ui
 
+# NOTE: SQLite requires a single writer. Keep replicaCount at 1 when
+# persistence.enabled is true to avoid concurrent-write corruption.
 replicaCount: 1
 
 image:
@@ -113,6 +115,36 @@ affinity: {}
 config:
   # Node.js environment
   nodeEnv: production
+  # SQLite database path inside the container (should be on the persistence volume)
+  databasePath: "/data/auth.db"
 
 # Session secret for signing cookies (auto-generated if not provided)
 sessionSecret: ""
+
+# Better Auth configuration
+auth:
+  # The publicly accessible base URL of this application (used for OIDC callback URLs)
+  # Required. Example: https://stackable-ui.example.com
+  url: ""
+  # Better Auth secret — long random string (min 32 chars). Auto-generated if not provided.
+  secret: ""
+  # OIDC provider issuer URL (without /.well-known/openid-configuration suffix)
+  # Required. Example: https://your-idp.example.com/realms/your-realm
+  issuer: ""
+  # Client ID registered in the OIDC provider
+  # Required.
+  clientId: ""
+  # Client secret registered in the OIDC provider
+  # Required.
+  clientSecret: ""
+
+# SQLite persistence for the Better Auth database.
+# NOTE: Requires replicaCount: 1 — SQLite does not support concurrent writes from multiple pods.
+persistence:
+  enabled: true
+  size: 1Gi
+  # Storage class name. Leave empty to use the cluster default.
+  storageClassName: ""
+  accessMode: ReadWriteOnce
+  # Set to reuse an existing PVC instead of creating a new one.
+  existingClaim: ""
diff --git a/e2e/auth.setup.ts b/e2e/auth.setup.ts
new file mode 100644
index 00000000..7da33b08
--- /dev/null
+++ b/e2e/auth.setup.ts
@@ -0,0 +1,26 @@
+import { test as setup, expect } from '@playwright/test';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const authFile = path.join(__dirname, '.auth/user.json');
+
+setup('authenticate via mock OIDC', async ({ page }) => {
+  // Navigate to the app — auth guard redirects to /auth/login
+  await page.goto('/');
+  await expect(page).toHaveURL(/\/auth\/login/);
+
+  // Click "Sign in with SSO"
+  await page.getByRole('button', { name: /sign in with sso/i }).click();
+
+  // mock-oauth2-server presents a simple username form (input[name="username"], no label text)
+  await page.locator('input[name="username"]').fill('testuser');
+  await page.locator('input[type="submit"]').click();
+
+  // Should land back on the app dashboard
+  await expect(page).toHaveURL('/');
+  await expect(page.getByRole('heading', { name: 'Dashboard' })).toBeVisible();
+
+  // Save authenticated storage state
+  await page.context().storageState({ path: authFile });
+});
diff --git a/e2e/auth.spec.ts b/e2e/auth.spec.ts
new file mode 100644
index 00000000..48981f03
--- /dev/null
+++ b/e2e/auth.spec.ts
@@ -0,0 +1,56 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('Authentication', () => {
+  test.use({ locale: 'en-US' });
+
+  test('unauthenticated access redirects to login page', async ({ browser }) => {
+    // Use a fresh context with no saved session
+    const context = await browser.newContext();
+    const page = await context.newPage();
+
+    await page.goto('/');
+    await expect(page).toHaveURL(/\/auth\/login/);
+    await expect(page.getByRole('heading', { name: 'Sign in to Stackable' })).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Sign in with SSO' })).toBeVisible();
+
+    await context.close();
+  });
+
+  test('login page preserves redirectTo query parameter', async ({ browser }) => {
+    const context = await browser.newContext();
+    const page = await context.newPage();
+
+    await page.goto('/some-page?foo=bar');
+    await expect(page).toHaveURL(/\/auth\/login\?redirectTo=/);
+
+    await context.close();
+  });
+
+  test('authenticated user sees dashboard', async ({ page }) => {
+    await page.goto('/');
+    await expect(page).toHaveURL('/');
+    await expect(page.getByRole('heading', { name: 'Dashboard' })).toBeVisible();
+  });
+
+  test('user menu shows sign out option', async ({ page }) => {
+    await page.goto('/');
+
+    const userMenuButton = page.getByRole('button', { name: 'User menu' });
+    await expect(userMenuButton).toBeVisible();
+
+    await userMenuButton.click();
+
+    const signOutLink = page.getByRole('link', { name: 'Sign out' });
+    await expect(signOutLink).toBeVisible();
+    await expect(signOutLink).toHaveAttribute('href', '/auth/logout');
+  });
+
+  test('sign out redirects to login page', async ({ page }) => {
+    await page.goto('/');
+    await page.getByRole('button', { name: 'User menu' }).click();
+    await page.getByRole('link', { name: 'Sign out' }).click();
+
+    await expect(page).toHaveURL(/\/auth\/login/);
+    await expect(page.getByRole('button', { name: 'Sign in with SSO' })).toBeVisible();
+  });
+});
diff --git a/messages/de.json b/messages/de.json
index 9b3b2158..0225119a 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -36,5 +36,10 @@
   "setup_steps_label": "Einrichtungsschritte",
   "language_label": "Sprache",
   "language_en": "English",
-  "language_de": "Deutsch"
+  "language_de": "Deutsch",
+  "auth_login_title": "Bei Stackable anmelden",
+  "auth_login_subtitle": "Verwenden Sie den SSO-Anbieter Ihrer Organisation, um auf die Plattform zuzugreifen.",
+  "auth_login_button": "Mit SSO anmelden",
+  "auth_login_error": "Anmeldung fehlgeschlagen. Bitte versuchen Sie es erneut.",
+  "header_sign_out": "Abmelden"
 }
diff --git a/messages/en.json b/messages/en.json
index ca545214..205def61 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -36,5 +36,10 @@
   "setup_steps_label": "Setup steps",
   "language_label": "Language",
   "language_en": "English",
-  "language_de": "Deutsch"
+  "language_de": "Deutsch",
+  "auth_login_title": "Sign in to Stackable",
+  "auth_login_subtitle": "Use your organisation's SSO provider to access the platform.",
+  "auth_login_button": "Sign in with SSO",
+  "auth_login_error": "Sign-in failed. Please try again.",
+  "header_sign_out": "Sign out"
 }
diff --git a/package-lock.json b/package-lock.json
index f9ba3250..df2f59d4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,7 +8,9 @@
       "name": "@stackable/stackable-ui",
       "version": "0.0.1",
       "dependencies": {
-        "@internationalized/date": "^3.11.0"
+        "@internationalized/date": "^3.11.0",
+        "better-auth": "^1.4.19",
+        "better-sqlite3": "^12.6.2"
       },
       "devDependencies": {
         "@eslint/compat": "^2.0.2",
@@ -19,6 +21,7 @@
         "@sveltejs/kit": "^2.51.0",
         "@sveltejs/vite-plugin-svelte": "^6.2.4",
         "@tailwindcss/vite": "^4.1.18",
+        "@types/better-sqlite3": "^7.6.13",
         "@types/node": "^24",
         "daisyui": "^5.5.18",
         "eslint": "^9.39.2",
@@ -70,6 +73,17 @@
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@better-auth/utils": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.3.0.tgz",
+      "integrity": "sha512-W+Adw6ZA6mgvnSnhOki270rwJ42t4XzSK6YWGF//BbVXL6SwCLWfyzBc1lN2m/4RM28KubdBKQ4X5VMoLRNPQw==",
+      "license": "MIT"
+    },
+    "node_modules/@better-fetch/fetch": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/@better-fetch/fetch/-/fetch-1.1.21.tgz",
+      "integrity": "sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A=="
+    },
     "node_modules/@eslint-community/eslint-utils": {
       "version": "4.9.1",
       "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
@@ -426,7 +440,7 @@
       "version": "0.3.13",
       "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
       "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/sourcemap-codec": "^1.5.0",
@@ -437,7 +451,7 @@
       "version": "2.3.5",
       "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
       "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/gen-mapping": "^0.3.5",
@@ -448,7 +462,7 @@
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
       "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=6.0.0"
@@ -458,14 +472,14 @@
       "version": "1.5.5",
       "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
       "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@jridgewell/trace-mapping": {
       "version": "0.3.31",
       "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
       "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/resolve-uri": "^3.1.0",
@@ -512,6 +526,30 @@
       "dev": true,
       "license": "Apache-2.0"
     },
+    "node_modules/@noble/ciphers": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-2.1.1.tgz",
+      "integrity": "sha512-bysYuiVfhxNJuldNXlFEitTVdNnYUc+XNJZd7Qm2a5j1vZHgY+fazadNFWFaMK/2vye0JVlxV3gHmC0WDfAOQw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@noble/hashes": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.0.1.tgz",
+      "integrity": "sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
     "node_modules/@pkgr/core": {
       "version": "0.2.9",
       "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
@@ -545,7 +583,7 @@
       "version": "1.0.0-next.29",
       "resolved": "https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.29.tgz",
       "integrity": "sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@poppinss/macroable": {
@@ -1050,14 +1088,13 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
       "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/@sveltejs/acorn-typescript": {
       "version": "1.0.9",
       "resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.9.tgz",
       "integrity": "sha512-lVJX6qEgs/4DOcRTpo56tmKzVPtoWAaVbL4hfO7t7NVwl9AAXzQR6cihesW1BmNMPl+bK6dreu2sOKBP2Q9CIA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "peerDependencies": {
         "acorn": "^8.9.0"
@@ -1083,7 +1120,7 @@
       "version": "2.52.0",
       "resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.52.0.tgz",
       "integrity": "sha512-zG+HmJuSF7eC0e7xt2htlOcEMAdEtlVdb7+gAr+ef08EhtwUsjLxcAwBgUCJY3/5p08OVOxVZti91WfXeuLvsg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.0.0",
@@ -1126,14 +1163,14 @@
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.0.1.tgz",
       "integrity": "sha512-n7Z7dXZhJbwuAHhNzkTti6Aw9QDDjZtm3JTpTGATIdNzdQz5GuFs22w90BcvF4INfnrL5xrX3oGsuqO5Dx3A1Q==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@sveltejs/vite-plugin-svelte": {
       "version": "6.2.4",
       "resolved": "https://registry.npmjs.org/@sveltejs/vite-plugin-svelte/-/vite-plugin-svelte-6.2.4.tgz",
       "integrity": "sha512-ou/d51QSdTyN26D7h6dSpusAKaZkAiGM55/AKYi+9AGZw7q85hElbjK3kEyzXHhLSnRISHOYzVge6x0jRZ7DXA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@sveltejs/vite-plugin-svelte-inspector": "^5.0.0",
@@ -1154,7 +1191,7 @@
       "version": "5.0.2",
       "resolved": "https://registry.npmjs.org/@sveltejs/vite-plugin-svelte-inspector/-/vite-plugin-svelte-inspector-5.0.2.tgz",
       "integrity": "sha512-TZzRTcEtZffICSAoZGkPSl6Etsj2torOVrx6Uw0KpXxrec9Gg6jFWQ60Q3+LmNGfZSxHRCZL7vXVZIWmuV50Ig==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "obug": "^2.1.0"
@@ -1449,18 +1486,28 @@
         "vite": "^5.2.0 || ^6 || ^7"
       }
     },
+    "node_modules/@types/better-sqlite3": {
+      "version": "7.6.13",
+      "resolved": "https://registry.npmjs.org/@types/better-sqlite3/-/better-sqlite3-7.6.13.tgz",
+      "integrity": "sha512-NMv9ASNARoKksWtsq/SHakpYAYnhBrQgGD8zkLYk/jaK8jUGn08CfEdTRgYhMypUQAfzSP8W6gNLe0q19/t4VA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
     "node_modules/@types/cookie": {
       "version": "0.6.0",
       "resolved": "https://registry.npmjs.org/@types/cookie/-/cookie-0.6.0.tgz",
       "integrity": "sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@types/estree": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
       "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@types/json-schema": {
@@ -1491,7 +1538,7 @@
       "version": "2.0.7",
       "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
       "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@types/validator": {
@@ -1852,7 +1899,7 @@
       "version": "8.15.0",
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "bin": {
         "acorn": "bin/acorn"
@@ -1915,7 +1962,7 @@
       "version": "5.3.2",
       "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.2.tgz",
       "integrity": "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "engines": {
         "node": ">= 0.4"
@@ -1956,7 +2003,7 @@
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
       "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "engines": {
         "node": ">= 0.4"
@@ -1969,6 +2016,218 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/better-auth": {
+      "version": "1.4.19",
+      "resolved": "https://registry.npmjs.org/better-auth/-/better-auth-1.4.19.tgz",
+      "integrity": "sha512-3RlZJcA0+NH25wYD85vpIGwW9oSTuEmLIaGbT8zg41w/Pa2hVWHKedjoUHHJtnzkBXzDb+CShkLnSw7IThDdqQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@better-auth/core": "1.4.19",
+        "@better-auth/telemetry": "1.4.19",
+        "@better-auth/utils": "0.3.0",
+        "@better-fetch/fetch": "1.1.21",
+        "@noble/ciphers": "^2.0.0",
+        "@noble/hashes": "^2.0.0",
+        "better-call": "1.1.8",
+        "defu": "^6.1.4",
+        "jose": "^6.1.0",
+        "kysely": "^0.28.5",
+        "nanostores": "^1.0.1",
+        "zod": "^4.3.5"
+      },
+      "peerDependencies": {
+        "@lynx-js/react": "*",
+        "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0",
+        "@sveltejs/kit": "^2.0.0",
+        "@tanstack/react-start": "^1.0.0",
+        "@tanstack/solid-start": "^1.0.0",
+        "better-sqlite3": "^12.0.0",
+        "drizzle-kit": ">=0.31.4",
+        "drizzle-orm": ">=0.41.0",
+        "mongodb": "^6.0.0 || ^7.0.0",
+        "mysql2": "^3.0.0",
+        "next": "^14.0.0 || ^15.0.0 || ^16.0.0",
+        "pg": "^8.0.0",
+        "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0",
+        "react": "^18.0.0 || ^19.0.0",
+        "react-dom": "^18.0.0 || ^19.0.0",
+        "solid-js": "^1.0.0",
+        "svelte": "^4.0.0 || ^5.0.0",
+        "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0",
+        "vue": "^3.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@lynx-js/react": {
+          "optional": true
+        },
+        "@prisma/client": {
+          "optional": true
+        },
+        "@sveltejs/kit": {
+          "optional": true
+        },
+        "@tanstack/react-start": {
+          "optional": true
+        },
+        "@tanstack/solid-start": {
+          "optional": true
+        },
+        "better-sqlite3": {
+          "optional": true
+        },
+        "drizzle-kit": {
+          "optional": true
+        },
+        "drizzle-orm": {
+          "optional": true
+        },
+        "mongodb": {
+          "optional": true
+        },
+        "mysql2": {
+          "optional": true
+        },
+        "next": {
+          "optional": true
+        },
+        "pg": {
+          "optional": true
+        },
+        "prisma": {
+          "optional": true
+        },
+        "react": {
+          "optional": true
+        },
+        "react-dom": {
+          "optional": true
+        },
+        "solid-js": {
+          "optional": true
+        },
+        "svelte": {
+          "optional": true
+        },
+        "vitest": {
+          "optional": true
+        },
+        "vue": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/better-auth/node_modules/@better-auth/core": {
+      "version": "1.4.19",
+      "resolved": "https://registry.npmjs.org/@better-auth/core/-/core-1.4.19.tgz",
+      "integrity": "sha512-uADLHG1jc5BnEJi7f6ijUN5DmPPRSj++7m/G19z3UqA3MVCo4Y4t1MMa4IIxLCqGDFv22drdfxescgW+HnIowA==",
+      "dependencies": {
+        "@standard-schema/spec": "^1.0.0",
+        "zod": "^4.3.5"
+      },
+      "peerDependencies": {
+        "@better-auth/utils": "0.3.0",
+        "@better-fetch/fetch": "1.1.21",
+        "better-call": "1.1.8",
+        "jose": "^6.1.0",
+        "kysely": "^0.28.5",
+        "nanostores": "^1.0.1"
+      }
+    },
+    "node_modules/better-auth/node_modules/@better-auth/telemetry": {
+      "version": "1.4.19",
+      "resolved": "https://registry.npmjs.org/@better-auth/telemetry/-/telemetry-1.4.19.tgz",
+      "integrity": "sha512-ApGNS7olCTtDpKF8Ow3Z+jvFAirOj7c4RyFUpu8axklh3mH57ndpfUAUjhgA8UVoaaH/mnm/Tl884BlqiewLyw==",
+      "dependencies": {
+        "@better-auth/utils": "0.3.0",
+        "@better-fetch/fetch": "1.1.21"
+      },
+      "peerDependencies": {
+        "@better-auth/core": "1.4.19"
+      }
+    },
+    "node_modules/better-auth/node_modules/kysely": {
+      "version": "0.28.11",
+      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.11.tgz",
+      "integrity": "sha512-zpGIFg0HuoC893rIjYX1BETkVWdDnzTzF5e0kWXJFg5lE0k1/LfNWBejrcnOFu8Q2Rfq/hTDTU7XLUM8QOrpzg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/better-call": {
+      "version": "1.1.8",
+      "resolved": "https://registry.npmjs.org/better-call/-/better-call-1.1.8.tgz",
+      "integrity": "sha512-XMQ2rs6FNXasGNfMjzbyroSwKwYbZ/T3IxruSS6U2MJRsSYh3wYtG3o6H00ZlKZ/C/UPOAD97tqgQJNsxyeTXw==",
+      "license": "MIT",
+      "dependencies": {
+        "@better-auth/utils": "^0.3.0",
+        "@better-fetch/fetch": "^1.1.4",
+        "rou3": "^0.7.10",
+        "set-cookie-parser": "^2.7.1"
+      },
+      "peerDependencies": {
+        "zod": "^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "zod": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/better-sqlite3": {
+      "version": "12.6.2",
+      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.6.2.tgz",
+      "integrity": "sha512-8VYKM3MjCa9WcaSAI3hzwhmyHVlH8tiGFwf0RlTsZPWJ1I5MkzjiudCo4KC4DxOaL/53A5B1sI/IbldNFDbsKA==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "bindings": "^1.5.0",
+        "prebuild-install": "^7.1.1"
+      },
+      "engines": {
+        "node": "20.x || 22.x || 23.x || 24.x || 25.x"
+      }
+    },
+    "node_modules/bindings": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
+      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
+      "license": "MIT",
+      "dependencies": {
+        "file-uri-to-path": "1.0.0"
+      }
+    },
+    "node_modules/bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
+      }
+    },
     "node_modules/brace-expansion": {
       "version": "1.1.12",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
@@ -1980,6 +2239,30 @@
         "concat-map": "0.0.1"
       }
     },
+    "node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
+      }
+    },
     "node_modules/callsites": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
@@ -2037,6 +2320,12 @@
         "url": "https://paulmillr.com/funding/"
       }
     },
+    "node_modules/chownr": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "license": "ISC"
+    },
     "node_modules/class-validator": {
       "version": "0.14.3",
       "resolved": "https://registry.npmjs.org/class-validator/-/class-validator-0.14.3.tgz",
@@ -2054,7 +2343,7 @@
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
       "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -2133,7 +2422,7 @@
       "version": "0.6.0",
       "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
       "integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -2210,6 +2499,21 @@
         }
       }
     },
+    "node_modules/decompress-response": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
+      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+      "license": "MIT",
+      "dependencies": {
+        "mimic-response": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/dedent": {
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.5.1.tgz",
@@ -2225,6 +2529,15 @@
         }
       }
     },
+    "node_modules/deep-extend": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
     "node_modules/deep-is": {
       "version": "0.1.4",
       "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
@@ -2236,17 +2549,22 @@
       "version": "4.3.1",
       "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
       "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
       }
     },
+    "node_modules/defu": {
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.4.tgz",
+      "integrity": "sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==",
+      "license": "MIT"
+    },
     "node_modules/detect-libc": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
       "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "dev": true,
       "license": "Apache-2.0",
       "engines": {
         "node": ">=8"
@@ -2256,7 +2574,7 @@
       "version": "5.6.2",
       "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.6.2.tgz",
       "integrity": "sha512-nPRkjWzzDQlsejL1WVifk5rvcFi/y1onBRxjaFMjZeR9mFpqu2gmAZ9xUB9/IEanEP/vBtGeGganC/GO1fmufg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/dlv": {
@@ -2279,6 +2597,15 @@
         "fast-check": "^3.23.1"
       }
     },
+    "node_modules/end-of-stream": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
+      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
+      "license": "MIT",
+      "dependencies": {
+        "once": "^1.4.0"
+      }
+    },
     "node_modules/enhanced-resolve": {
       "version": "5.19.0",
       "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.19.0.tgz",
@@ -2512,7 +2839,7 @@
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/esm-env/-/esm-env-1.2.2.tgz",
       "integrity": "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/espree": {
@@ -2564,7 +2891,7 @@
       "version": "2.2.3",
       "resolved": "https://registry.npmjs.org/esrap/-/esrap-2.2.3.tgz",
       "integrity": "sha512-8fOS+GIGCQZl/ZIlhl59htOlms6U8NvX6ZYgYHpRU/b6tVSh3uHkOHZikl3D4cMbYM0JlpBe+p/BkZEi8J9XIQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/sourcemap-codec": "^1.4.15"
@@ -2610,6 +2937,15 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/expand-template": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
+      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
+      "license": "(MIT OR WTFPL)",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/fast-check": {
       "version": "3.23.2",
       "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-3.23.2.tgz",
@@ -2659,7 +2995,7 @@
       "version": "6.5.0",
       "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
       "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=12.0.0"
@@ -2686,6 +3022,12 @@
         "node": ">=16.0.0"
       }
     },
+    "node_modules/file-uri-to-path": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
+      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
+      "license": "MIT"
+    },
     "node_modules/find-up": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
@@ -2724,6 +3066,12 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/fs-constants": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
+      "license": "MIT"
+    },
     "node_modules/fsevents": {
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
@@ -2749,6 +3097,12 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/github-from-package": {
+      "version": "0.0.0",
+      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
+      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
+      "license": "MIT"
+    },
     "node_modules/glob-parent": {
       "version": "6.0.2",
       "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
@@ -2815,6 +3169,26 @@
         "human-id": "dist/cli.js"
       }
     },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
     "node_modules/ignore": {
       "version": "5.3.2",
       "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
@@ -2852,6 +3226,18 @@
         "node": ">=0.8.19"
       }
     },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "license": "ISC"
+    },
     "node_modules/is-core-module": {
       "version": "2.16.1",
       "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz",
@@ -2940,6 +3326,15 @@
         "@sideway/pinpoint": "^2.0.0"
       }
     },
+    "node_modules/jose": {
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.1.3.tgz",
+      "integrity": "sha512-0TpaTfihd4QMNwrz/ob2Bp7X04yuxJkjRGi4aKmOqwhov54i6u79oCv7T+C7lo70MKH6BesI3vscD1yb/yzKXQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
     "node_modules/js-sha256": {
       "version": "0.11.1",
       "resolved": "https://registry.npmjs.org/js-sha256/-/js-sha256-0.11.1.tgz",
@@ -3023,7 +3418,7 @@
       "version": "4.1.5",
       "resolved": "https://registry.npmjs.org/kleur/-/kleur-4.1.5.tgz",
       "integrity": "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -3343,7 +3738,7 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/locate-character/-/locate-character-3.0.0.tgz",
       "integrity": "sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/locate-path": {
@@ -3373,7 +3768,7 @@
       "version": "0.30.21",
       "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
       "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/sourcemap-codec": "^1.5.5"
@@ -3393,6 +3788,18 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/mimic-response": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
+      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/minimatch": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
@@ -3410,17 +3817,22 @@
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
       "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
-      "dev": true,
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/mkdirp-classic": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
+      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
+      "license": "MIT"
+    },
     "node_modules/mri": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/mri/-/mri-1.2.0.tgz",
       "integrity": "sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=4"
@@ -3430,7 +3842,7 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/mrmime/-/mrmime-2.0.1.tgz",
       "integrity": "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -3447,7 +3859,7 @@
       "version": "3.3.11",
       "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
       "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
-      "dev": true,
+      "devOptional": true,
       "funding": [
         {
           "type": "github",
@@ -3462,6 +3874,27 @@
         "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
       }
     },
+    "node_modules/nanostores": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/nanostores/-/nanostores-1.1.0.tgz",
+      "integrity": "sha512-yJBmDJr18xy47dbNVlHcgdPrulSn1nhSE6Ns9vTG+Nx9VPT6iV1MD6aQFp/t52zpf82FhLLTXAXr30NuCnxvwA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": "^20.0.0 || >=22.0.0"
+      }
+    },
+    "node_modules/napi-build-utils": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
+      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
+      "license": "MIT"
+    },
     "node_modules/natural-compare": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
@@ -3469,6 +3902,18 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/node-abi": {
+      "version": "3.87.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.87.0.tgz",
+      "integrity": "sha512-+CGM1L1CgmtheLcBuleyYOn7NWPVu0s0EJH2C4puxgEZb9h8QpR9G2dBfZJOAUhi7VQxuBPMd0hiISWcTyiYyQ==",
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/normalize-url": {
       "version": "8.1.1",
       "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-8.1.1.tgz",
@@ -3487,13 +3932,22 @@
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz",
       "integrity": "sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==",
-      "dev": true,
+      "devOptional": true,
       "funding": [
         "https://github.com/sponsors/sxzz",
         "https://opencollective.com/debug"
       ],
       "license": "MIT"
     },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
     "node_modules/optionator": {
       "version": "0.9.4",
       "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
@@ -3588,14 +4042,14 @@
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
       "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
-      "dev": true,
+      "devOptional": true,
       "license": "ISC"
     },
     "node_modules/picomatch": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -3640,7 +4094,7 @@
       "version": "8.5.6",
       "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
       "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
-      "dev": true,
+      "devOptional": true,
       "funding": [
         {
           "type": "opencollective",
@@ -3773,6 +4227,33 @@
         "node": ">=4"
       }
     },
+    "node_modules/prebuild-install": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
+      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
+      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
+      "license": "MIT",
+      "dependencies": {
+        "detect-libc": "^2.0.0",
+        "expand-template": "^2.0.3",
+        "github-from-package": "0.0.0",
+        "minimist": "^1.2.3",
+        "mkdirp-classic": "^0.5.3",
+        "napi-build-utils": "^2.0.0",
+        "node-abi": "^3.3.0",
+        "pump": "^3.0.0",
+        "rc": "^1.2.7",
+        "simple-get": "^4.0.0",
+        "tar-fs": "^2.0.0",
+        "tunnel-agent": "^0.6.0"
+      },
+      "bin": {
+        "prebuild-install": "bin.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/prelude-ls": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
@@ -3897,6 +4378,16 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/pump": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.3.tgz",
+      "integrity": "sha512-todwxLMY7/heScKmntwQG8CXVkWUOdYxIvY2s0VWAAMh/nd8SoYiRaKjlr7+iCs984f2P8zvrfWcDDYVb73NfA==",
+      "license": "MIT",
+      "dependencies": {
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
+      }
+    },
     "node_modules/punycode": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
@@ -3925,6 +4416,44 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/rc": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
+      "dependencies": {
+        "deep-extend": "^0.6.0",
+        "ini": "~1.3.0",
+        "minimist": "^1.2.0",
+        "strip-json-comments": "~2.0.1"
+      },
+      "bin": {
+        "rc": "cli.js"
+      }
+    },
+    "node_modules/rc/node_modules/strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/readdirp": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
@@ -3984,7 +4513,7 @@
       "version": "4.57.1",
       "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.57.1.tgz",
       "integrity": "sha512-oQL6lgK3e2QZeQ7gcgIkS2YZPg5slw37hYufJ3edKlfQSGGm8ICoxswK15ntSzF/a8+h7ekRy7k7oWc3BQ7y8A==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@types/estree": "1.0.8"
@@ -4025,11 +4554,17 @@
         "fsevents": "~2.3.2"
       }
     },
+    "node_modules/rou3": {
+      "version": "0.7.12",
+      "resolved": "https://registry.npmjs.org/rou3/-/rou3-0.7.12.tgz",
+      "integrity": "sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg==",
+      "license": "MIT"
+    },
     "node_modules/sade": {
       "version": "1.8.1",
       "resolved": "https://registry.npmjs.org/sade/-/sade-1.8.1.tgz",
       "integrity": "sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "mri": "^1.1.0"
@@ -4038,6 +4573,26 @@
         "node": ">=6"
       }
     },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/safe-regex": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/safe-regex/-/safe-regex-2.1.1.tgz",
@@ -4052,7 +4607,6 @@
       "version": "7.7.4",
       "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
       "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
-      "dev": true,
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -4061,6 +4615,12 @@
         "node": ">=10"
       }
     },
+    "node_modules/set-cookie-parser": {
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-2.7.2.tgz",
+      "integrity": "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==",
+      "license": "MIT"
+    },
     "node_modules/shebang-command": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
@@ -4084,11 +4644,56 @@
         "node": ">=8"
       }
     },
+    "node_modules/simple-concat": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
+      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/simple-get": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
+      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decompress-response": "^6.0.0",
+        "once": "^1.3.1",
+        "simple-concat": "^1.0.0"
+      }
+    },
     "node_modules/sirv": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/sirv/-/sirv-3.0.2.tgz",
       "integrity": "sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@polka/url": "^1.0.0-next.24",
@@ -4103,7 +4708,7 @@
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
       "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
-      "dev": true,
+      "devOptional": true,
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -4121,6 +4726,15 @@
         "kysely": "*"
       }
     },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
     "node_modules/strip-bom": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
@@ -4185,7 +4799,7 @@
       "version": "5.51.2",
       "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.51.2.tgz",
       "integrity": "sha512-AqApqNOxVS97V4Ko9UHTHeSuDJrwauJhZpLDs1gYD8Jk48ntCSWD7NxKje+fnGn5Ja1O3u2FzQZHPdifQjXe3w==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/remapping": "^2.3.4",
@@ -4267,7 +4881,7 @@
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-3.0.3.tgz",
       "integrity": "sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@types/estree": "^1.0.6"
@@ -4421,6 +5035,34 @@
         "url": "https://opencollective.com/webpack"
       }
     },
+    "node_modules/tar-fs": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
+      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "chownr": "^1.1.1",
+        "mkdirp-classic": "^0.5.2",
+        "pump": "^3.0.0",
+        "tar-stream": "^2.1.4"
+      }
+    },
+    "node_modules/tar-stream": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
+      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "bl": "^4.0.3",
+        "end-of-stream": "^1.4.1",
+        "fs-constants": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/tiny-case": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/tiny-case/-/tiny-case-1.0.3.tgz",
@@ -4433,7 +5075,7 @@
       "version": "0.2.15",
       "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
       "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "fdir": "^6.5.0",
@@ -4458,7 +5100,7 @@
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/totalist/-/totalist-3.0.1.tgz",
       "integrity": "sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -4532,6 +5174,18 @@
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
       "license": "0BSD"
     },
+    "node_modules/tunnel-agent": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
+      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/type-check": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
@@ -4649,7 +5303,6 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
       "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/uuid": {
@@ -4696,7 +5349,7 @@
       "version": "7.3.1",
       "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.1.tgz",
       "integrity": "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "esbuild": "^0.27.0",
@@ -5213,7 +5866,7 @@
       "version": "0.27.3",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.3.tgz",
       "integrity": "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==",
-      "dev": true,
+      "devOptional": true,
       "hasInstallScript": true,
       "license": "MIT",
       "bin": {
@@ -5270,7 +5923,7 @@
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/vitefu/-/vitefu-1.1.1.tgz",
       "integrity": "sha512-B/Fegf3i8zh0yFbpzZ21amWzHmuNlLlmJT6n7bu5e+pCHUKQIfXSYokrqOBGEMMe9UG2sostKQF9mml/vYaWJQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "workspaces": [
         "tests/deps/*",
@@ -5319,6 +5972,12 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC"
+    },
     "node_modules/yocto-queue": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
@@ -5350,14 +6009,13 @@
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/zimmerframe/-/zimmerframe-1.1.4.tgz",
       "integrity": "sha512-B58NGBEoc8Y9MWWCQGl/gq9xBCe4IiKM0a2x7GZdQKOW5Exr8S1W24J6OgM1njK8xCRGvAJIL/MxXHf6SkmQKQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/zod": {
       "version": "4.3.6",
       "resolved": "https://registry.npmjs.org/zod/-/zod-4.3.6.tgz",
       "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
-      "dev": true,
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
diff --git a/package.json b/package.json
index f0cf943d..8a5ae9c3 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,7 @@
     "@sveltejs/kit": "^2.51.0",
     "@sveltejs/vite-plugin-svelte": "^6.2.4",
     "@tailwindcss/vite": "^4.1.18",
+    "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^24",
     "daisyui": "^5.5.18",
     "eslint": "^9.39.2",
@@ -45,6 +46,8 @@
     "zod": "^4.3.6"
   },
   "dependencies": {
-    "@internationalized/date": "^3.11.0"
+    "@internationalized/date": "^3.11.0",
+    "better-auth": "^1.4.19",
+    "better-sqlite3": "^12.6.2"
   }
 }
diff --git a/playwright.config.ts b/playwright.config.ts
index dd4d1175..cde53514 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -19,18 +19,30 @@ export default defineConfig({
   },
   projects: [
     {
-      name: 'firefox',
+      name: 'setup',
+      testMatch: /auth\.setup\.ts/,
       use: {
-        browserName: 'firefox',
+        browserName: 'chromium',
         viewport: { width: 1280, height: 720 }
       }
     },
+    {
+      name: 'firefox',
+      use: {
+        browserName: 'firefox',
+        viewport: { width: 1280, height: 720 },
+        storageState: 'e2e/.auth/user.json'
+      },
+      dependencies: ['setup']
+    },
     {
       name: 'chromium',
       use: {
         browserName: 'chromium',
-        viewport: { width: 1280, height: 720 }
-      }
+        viewport: { width: 1280, height: 720 },
+        storageState: 'e2e/.auth/user.json'
+      },
+      dependencies: ['setup']
     },
     {
       name: 'mobile',
@@ -38,8 +50,10 @@ export default defineConfig({
         browserName: 'chromium',
         viewport: { width: 393, height: 851 },
         isMobile: true,
-        hasTouch: true
-      }
+        hasTouch: true,
+        storageState: 'e2e/.auth/user.json'
+      },
+      dependencies: ['setup']
     }
   ]
 });
diff --git a/src/app.d.ts b/src/app.d.ts
index 77dbca69..4b7fbdd7 100644
--- a/src/app.d.ts
+++ b/src/app.d.ts
@@ -1,10 +1,15 @@
 // See https://svelte.dev/docs/kit/types#app.d.ts
 // for information about these interfaces
 
+import type { auth } from '$lib/server/auth';
+
 declare global {
   namespace App {
     // interface Error {}
-    // interface Locals {}
+    interface Locals {
+      user: typeof auth.$Infer.Session.user | null;
+      session: typeof auth.$Infer.Session.session | null;
+    }
     // interface PageData {}
     // interface PageState {}
     // interface Platform {}
diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index a8be42a8..54ad98f3 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -1,6 +1,9 @@
 import { paraglideMiddleware } from '$lib/paraglide/server';
-import { type Handle } from '@sveltejs/kit';
+import { building } from '$app/environment';
+import { redirect, type Handle } from '@sveltejs/kit';
 import { sequence } from '@sveltejs/kit/hooks';
+import { svelteKitHandler } from 'better-auth/svelte-kit';
+import { auth } from '$lib/server/auth';
 
 const handleParaglide: Handle = ({ event, resolve }) =>
   paraglideMiddleware(event.request, ({ request, locale }) => {
@@ -11,6 +14,23 @@ const handleParaglide: Handle = ({ event, resolve }) =>
     });
   });
 
-// Each function acts as a middleware, receiving the request handle
-// And returning a handle which gets passed to the next function
-export const handle = sequence(handleParaglide);
+const handleAuth: Handle = ({ event, resolve }) =>
+  svelteKitHandler({ event, resolve, auth, building });
+
+const PUBLIC_PATHS = ['/auth/login', '/auth/logout', '/api/auth'];
+
+const handleAuthGuard: Handle = async ({ event, resolve }) => {
+  const session = await auth.api.getSession({ headers: event.request.headers });
+  event.locals.user = session?.user ?? null;
+  event.locals.session = session?.session ?? null;
+
+  const isPublic = PUBLIC_PATHS.some((p) => event.url.pathname.startsWith(p));
+  if (!isPublic && !event.locals.user) {
+    const redirectTo = encodeURIComponent(event.url.pathname + event.url.search);
+    throw redirect(302, `/auth/login?redirectTo=${redirectTo}`);
+  }
+
+  return resolve(event);
+};
+
+export const handle = sequence(handleParaglide, handleAuth, handleAuthGuard);
diff --git a/src/lib/auth-client.ts b/src/lib/auth-client.ts
new file mode 100644
index 00000000..a6f0fb40
--- /dev/null
+++ b/src/lib/auth-client.ts
@@ -0,0 +1,6 @@
+import { createAuthClient } from 'better-auth/svelte';
+import { genericOAuthClient } from 'better-auth/client/plugins';
+
+export const authClient = createAuthClient({
+  plugins: [genericOAuthClient()]
+});
diff --git a/src/lib/components/layout/Header.svelte b/src/lib/components/layout/Header.svelte
index 63a440d8..06e09187 100644
--- a/src/lib/components/layout/Header.svelte
+++ b/src/lib/components/layout/Header.svelte
@@ -2,16 +2,32 @@
   import * as m from '$lib/paraglide/messages.js';
   import LanguageSwitcher from './LanguageSwitcher.svelte';
   import ThemeToggle from './ThemeToggle.svelte';
+  import type { auth } from '$lib/server/auth';
+
+  type User = typeof auth.$Infer.Session.user | null;
 
   let {
     title = m.page_title_dashboard(),
     mobileOpen = false,
+    user = null,
     onToggleMobile
   }: {
     title?: string;
     mobileOpen?: boolean;
+    user?: User;
     onToggleMobile?: () => void;
   } = $props();
+
+  const initials = $derived(
+    user?.name
+      ? user.name
+          .split(' ')
+          .map((n) => n[0])
+          .join('')
+          .toUpperCase()
+          .slice(0, 2)
+      : '?'
+  );
 </script>
 
 <header
@@ -46,22 +62,56 @@
   <div class="flex items-center gap-1">
     <LanguageSwitcher />
     <ThemeToggle />
-    <button class="btn btn-ghost btn-circle" aria-label={m.header_user_menu()}>
-      <span class="bg-primary/10 flex h-8 w-8 items-center justify-center rounded-full">
-        <svg
-          class="text-primary h-4 w-4"
+    <button
+      class="btn btn-ghost btn-circle"
+      aria-label={m.header_user_menu()}
+      popovertarget="user-menu"
+      style="anchor-name:--user-menu"
+    >
+      {#if user?.image}
+        <img src={user.image} alt={user.name ?? ''} class="h-8 w-8 rounded-full object-cover" />
+      {:else}
+        <span
+          class="bg-primary/10 text-primary flex h-8 w-8 items-center justify-center rounded-full text-xs font-semibold"
           aria-hidden="true"
-          viewBox="0 0 24 24"
-          fill="none"
-          stroke="currentColor"
-          stroke-width="1.5"
-          stroke-linecap="round"
-          stroke-linejoin="round"
         >
-          <circle cx="12" cy="8" r="4" />
-          <path d="M20 21a8 8 0 0 0-16 0" />
-        </svg>
-      </span>
+          {initials}
+        </span>
+      {/if}
     </button>
   </div>
 </header>
+
+<ul
+  class="dropdown dropdown-end menu bg-base-100 border-base-300 w-56 rounded-lg border p-1 shadow-lg"
+  popover
+  id="user-menu"
+  style="position-anchor:--user-menu"
+>
+  {#if user}
+    <li class="px-3 py-2">
+      <p class="text-base-content truncate text-sm font-semibold">{user.name}</p>
+      <p class="text-base-content/60 truncate text-xs">{user.email}</p>
+    </li>
+    <li><hr class="border-base-300 my-1" /></li>
+  {/if}
+  <li>
+    <a href="/auth/logout" class="text-sm">
+      <svg
+        class="h-4 w-4"
+        aria-hidden="true"
+        viewBox="0 0 24 24"
+        fill="none"
+        stroke="currentColor"
+        stroke-width="1.5"
+        stroke-linecap="round"
+        stroke-linejoin="round"
+      >
+        <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4" />
+        <polyline points="16 17 21 12 16 7" />
+        <line x1="21" y1="12" x2="9" y2="12" />
+      </svg>
+      {m.header_sign_out()}
+    </a>
+  </li>
+</ul>
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
new file mode 100644
index 00000000..9fce993c
--- /dev/null
+++ b/src/lib/server/auth.ts
@@ -0,0 +1,35 @@
+import { betterAuth } from 'better-auth';
+import { genericOAuth } from 'better-auth/plugins';
+import Database from 'better-sqlite3';
+import { env } from '$env/dynamic/private';
+
+export const auth = betterAuth({
+  secret: env.BETTER_AUTH_SECRET,
+  baseURL: env.BETTER_AUTH_URL,
+  database: new Database(env.DATABASE_PATH ?? '/data/auth.db'),
+  session: {
+    cookieCache: { enabled: true, maxAge: 5 * 60 }
+  },
+  plugins: [
+    genericOAuth({
+      config: [
+        {
+          providerId: 'oidc',
+          discoveryUrl: `${env.AUTH_ISSUER}/.well-known/openid-configuration`,
+          clientId: env.AUTH_CLIENT_ID,
+          clientSecret: env.AUTH_CLIENT_SECRET,
+          scopes: ['openid', 'profile', 'email'],
+          pkce: true,
+          mapProfileToUser: async (profile) => {
+            const fullName = [profile.given_name, profile.family_name].filter(Boolean).join(' ');
+            return {
+              name: profile.name || fullName || profile.preferred_username || profile.email,
+              email: profile.email || profile.preferred_username,
+              image: profile.picture || null
+            };
+          }
+        }
+      ]
+    })
+  ]
+});
diff --git a/src/routes/(app)/+layout.server.ts b/src/routes/(app)/+layout.server.ts
index e69de29b..c77935c7 100644
--- a/src/routes/(app)/+layout.server.ts
+++ b/src/routes/(app)/+layout.server.ts
@@ -0,0 +1,5 @@
+import type { LayoutServerLoad } from './$types';
+
+export const load: LayoutServerLoad = async ({ locals }) => {
+  return { user: locals.user };
+};
diff --git a/src/routes/(app)/+layout.svelte b/src/routes/(app)/+layout.svelte
index 09ab9a1f..71ea3515 100644
--- a/src/routes/(app)/+layout.svelte
+++ b/src/routes/(app)/+layout.svelte
@@ -4,7 +4,7 @@
   import Sidebar from '$lib/components/layout/Sidebar.svelte';
   import Header from '$lib/components/layout/Header.svelte';
 
-  let { children } = $props();
+  let { children, data } = $props();
 
   let sidebarCollapsed = $state(false);
   let mobileOpen = $state(false);
@@ -24,7 +24,12 @@
   <Sidebar bind:collapsed={sidebarCollapsed} bind:mobileOpen />
 
   <div class="flex min-w-0 flex-1 flex-col">
-    <Header {title} {mobileOpen} onToggleMobile={() => (mobileOpen = !mobileOpen)} />
+    <Header
+      {title}
+      {mobileOpen}
+      user={data.user}
+      onToggleMobile={() => (mobileOpen = !mobileOpen)}
+    />
 
     <main class="bg-base-200 flex-1 overflow-auto p-6">
       {@render children()}
diff --git a/src/routes/auth/login/+page.server.ts b/src/routes/auth/login/+page.server.ts
new file mode 100644
index 00000000..3e438def
--- /dev/null
+++ b/src/routes/auth/login/+page.server.ts
@@ -0,0 +1,12 @@
+import { redirect } from '@sveltejs/kit';
+import type { PageServerLoad } from './$types';
+
+export const load: PageServerLoad = async ({ locals, url }) => {
+  if (locals.user) {
+    throw redirect(302, '/');
+  }
+
+  const redirectTo = url.searchParams.get('redirectTo') ?? '/';
+
+  return { redirectTo };
+};
diff --git a/src/routes/auth/login/+page.svelte b/src/routes/auth/login/+page.svelte
new file mode 100644
index 00000000..7398269a
--- /dev/null
+++ b/src/routes/auth/login/+page.svelte
@@ -0,0 +1,86 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import { authClient } from '$lib/auth-client.js';
+
+  let { data } = $props();
+
+  let loading = $state(false);
+  let error = $state<string | null>(null);
+
+  async function handleSignIn() {
+    loading = true;
+    error = null;
+
+    const result = await authClient.signIn.oauth2({
+      providerId: 'oidc',
+      callbackURL: data.redirectTo
+    });
+
+    if (result?.error) {
+      error = m.auth_login_error();
+      loading = false;
+    }
+  }
+</script>
+
+<svelte:head>
+  <title>{m.auth_login_title()} | {m.page_title_suffix()}</title>
+</svelte:head>
+
+<div class="bg-base-200 flex min-h-dvh items-center justify-center p-4">
+  <div class="card bg-base-100 border-base-300 w-full max-w-sm border shadow-xl">
+    <div class="card-body items-center text-center">
+      <div class="mb-2">
+        <svg
+          class="text-primary mx-auto h-12 w-12"
+          aria-hidden="true"
+          viewBox="0 0 24 24"
+          fill="none"
+          stroke="currentColor"
+          stroke-width="1.5"
+          stroke-linecap="round"
+          stroke-linejoin="round"
+        >
+          <rect x="3" y="11" width="18" height="11" rx="2" ry="2" />
+          <path d="M7 11V7a5 5 0 0 1 10 0v4" />
+        </svg>
+      </div>
+
+      <h1 class="card-title text-2xl">{m.auth_login_title()}</h1>
+      <p class="text-base-content/60 text-sm">{m.auth_login_subtitle()}</p>
+
+      {#if error}
+        <div role="alert" class="alert alert-error mt-2 w-full text-sm">
+          <svg
+            class="h-4 w-4 shrink-0"
+            aria-hidden="true"
+            viewBox="0 0 24 24"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="2"
+            stroke-linecap="round"
+            stroke-linejoin="round"
+          >
+            <circle cx="12" cy="12" r="10" />
+            <path d="M12 8v4m0 4h.01" />
+          </svg>
+          <span>{error}</span>
+        </div>
+      {/if}
+
+      <div class="card-actions mt-4 w-full">
+        <button
+          class="btn btn-primary w-full"
+          onclick={handleSignIn}
+          disabled={loading}
+          aria-busy={loading}
+        >
+          {#if loading}
+            <span class="loading loading-spinner loading-sm" aria-hidden="true"></span>
+          {/if}
+          {m.auth_login_button()}
+        </button>
+      </div>
+    </div>
+  </div>
+</div>
diff --git a/src/routes/auth/logout/+page.server.ts b/src/routes/auth/logout/+page.server.ts
new file mode 100644
index 00000000..f40704cd
--- /dev/null
+++ b/src/routes/auth/logout/+page.server.ts
@@ -0,0 +1,8 @@
+import { redirect } from '@sveltejs/kit';
+import type { PageServerLoad } from './$types';
+import { auth } from '$lib/server/auth';
+
+export const load: PageServerLoad = async ({ request }) => {
+  await auth.api.signOut({ headers: request.headers });
+  throw redirect(302, '/auth/login');
+};

From 0d0bcaf4847351b78a9d3e3b6369f3c341c5db6e Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Wed, 25 Feb 2026 14:20:30 +0100
Subject: [PATCH 04/41] fix invisible Enter symbol on button

---
 src/routes/(app)/trino/+page.svelte | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index 756ce90a..a1c34dbc 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -237,7 +237,7 @@
           {m.trino_running()}
         {:else}
           {m.trino_run_query()}
-          <kbd class="kbd kbd-sm opacity-60">Ctrl+↵</kbd>
+          <kbd class="kbd kbd-sm text-base-content opacity-60">Ctrl+↵</kbd>
         {/if}
       </button>
     </div>

From b018079f8cd2624404e7277ab65ab1b000245d3e Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Wed, 25 Feb 2026 14:34:41 +0100
Subject: [PATCH 05/41] replace per-component theme detection with shared
 reactive state

---
 src/lib/components/editor/MonacoEditor.svelte | 26 +++++++------------
 src/lib/theme.svelte.ts                       |  3 +++
 src/routes/+layout.svelte                     | 10 +++++++
 3 files changed, 22 insertions(+), 17 deletions(-)
 create mode 100644 src/lib/theme.svelte.ts

diff --git a/src/lib/components/editor/MonacoEditor.svelte b/src/lib/components/editor/MonacoEditor.svelte
index 162e316a..3932af87 100644
--- a/src/lib/components/editor/MonacoEditor.svelte
+++ b/src/lib/components/editor/MonacoEditor.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
   import { onMount, onDestroy } from 'svelte';
   import { browser } from '$app/environment';
+  import { theme } from '$lib/theme.svelte';
 
   let {
     value = $bindable(),
@@ -14,8 +15,7 @@
 
   let container: HTMLDivElement;
   let editor: import('monaco-editor').editor.IStandaloneCodeEditor | undefined;
-  let monaco: typeof import('monaco-editor') | undefined;
-  let observer: MutationObserver | undefined;
+  let monaco = $state<typeof import('monaco-editor') | undefined>(undefined);
 
   // Start loading in parallel with the rest of the page — not deferred to onMount.
   // Guarded by `browser` because SvelteKit evaluates component scripts on the server too.
@@ -24,12 +24,14 @@
     : null;
   const monacoImport = browser ? import('monaco-editor') : null;
 
-  // Detect current theme from DaisyUI data-theme attribute
-  function getMonacoTheme(): string {
-    if (!browser) return 'vs-dark';
-    return document.documentElement.dataset.theme === 'dark' ? 'vs-dark' : 'vs';
+  function toMonacoTheme(t: string): string {
+    return t === 'dark' ? 'vs-dark' : 'vs';
   }
 
+  $effect(() => {
+    monaco?.editor.setTheme(toMonacoTheme(theme.current));
+  });
+
   onMount(async () => {
     // By the time onMount fires the imports are likely already resolved.
     const EditorWorker = (await workerImport!).default;
@@ -42,7 +44,7 @@
     editor = monaco.editor.create(container, {
       value,
       language,
-      theme: getMonacoTheme(),
+      theme: toMonacoTheme(theme.current),
       minimap: { enabled: false },
       fontSize: 14,
       lineNumbers: 'on',
@@ -64,19 +66,9 @@
         run: onExecute
       });
     }
-
-    // Watch for theme changes
-    observer = new MutationObserver(() => {
-      monaco?.editor.setTheme(getMonacoTheme());
-    });
-    observer.observe(document.documentElement, {
-      attributes: true,
-      attributeFilter: ['data-theme']
-    });
   });
 
   onDestroy(() => {
-    observer?.disconnect();
     editor?.dispose();
   });
 </script>
diff --git a/src/lib/theme.svelte.ts b/src/lib/theme.svelte.ts
new file mode 100644
index 00000000..fba15341
--- /dev/null
+++ b/src/lib/theme.svelte.ts
@@ -0,0 +1,3 @@
+import { browser } from '$app/environment';
+
+export const theme = $state({ current: browser ? (document.documentElement.dataset.theme ?? 'dark') : 'dark' });
diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte
index 5d83456e..5a33388c 100644
--- a/src/routes/+layout.svelte
+++ b/src/routes/+layout.svelte
@@ -1,7 +1,17 @@
 <script lang="ts">
   import '../app.css';
+  import { onMount } from 'svelte';
+  import { theme } from '$lib/theme.svelte';
 
   let { children } = $props();
+
+  onMount(() => {
+    const observer = new MutationObserver(() => {
+      theme.current = document.documentElement.dataset.theme ?? 'dark';
+    });
+    observer.observe(document.documentElement, { attributes: true, attributeFilter: ['data-theme'] });
+    return () => observer.disconnect();
+  });
 </script>
 
 {@render children()}

From 398394274a6f11a09b696d05a0c9584618883ac1 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Wed, 25 Feb 2026 14:44:37 +0100
Subject: [PATCH 06/41] Add missing i18n message

---
 messages/de.json                    | 3 ++-
 messages/en.json                    | 3 ++-
 src/routes/(app)/trino/+page.svelte | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index 979e2548..526912cf 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -56,5 +56,6 @@
   "trino_auth_none": "Keine",
   "trino_auth_basic": "Basic",
   "trino_auth_username": "Benutzername",
-  "trino_auth_password": "Passwort"
+  "trino_auth_password": "Passwort",
+  "trino_unknown_error": "Unbekannter Fehler"
 }
diff --git a/messages/en.json b/messages/en.json
index 98683629..5c22111b 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -56,5 +56,6 @@
   "trino_auth_none": "No auth",
   "trino_auth_basic": "Basic",
   "trino_auth_username": "Username",
-  "trino_auth_password": "Password"
+  "trino_auth_password": "Password",
+  "trino_unknown_error": "Unknown error"
 }
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index a1c34dbc..fc3aa90f 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -103,7 +103,7 @@
         totalRows = data.totalRows ?? null;
       }
     } catch (err) {
-      error = err instanceof Error ? err.message : 'Unknown error';
+      error = err instanceof Error ? err.message : m.trino_unknown_error();
     } finally {
       running = false;
     }

From 3aa197a4c2e48047c81bcb73fecba262bc9919ea Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Wed, 25 Feb 2026 15:09:42 +0100
Subject: [PATCH 07/41] Remove undici & skip tls validation in dev through env

---
 .env.development                      |  4 ++++
 package-lock.json                     | 12 +-----------
 package.json                          |  3 +--
 src/routes/api/trino/query/+server.ts | 10 ++--------
 4 files changed, 8 insertions(+), 21 deletions(-)
 create mode 100644 .env.development

diff --git a/.env.development b/.env.development
new file mode 100644
index 00000000..ca62220a
--- /dev/null
+++ b/.env.development
@@ -0,0 +1,4 @@
+# Disable TLS certificate verification for development (e.g. self-signed Trino certs).
+# This file is committed and loaded automatically in dev mode.
+# Never set this in production.
+NODE_TLS_REJECT_UNAUTHORIZED=0
diff --git a/package-lock.json b/package-lock.json
index 8b661b6e..3de9d112 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,8 +9,7 @@
       "version": "0.0.1",
       "dependencies": {
         "@internationalized/date": "^3.11.0",
-        "monaco-editor": "^0.55.1",
-        "undici": "^7.22.0"
+        "monaco-editor": "^0.55.1"
       },
       "devDependencies": {
         "@eslint/compat": "^2.0.2",
@@ -4601,15 +4600,6 @@
         "typescript": ">=4.8.4 <6.0.0"
       }
     },
-    "node_modules/undici": {
-      "version": "7.22.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.22.0.tgz",
-      "integrity": "sha512-RqslV2Us5BrllB+JeiZnK4peryVTndy9Dnqq62S3yYRRTj0tFQCwEniUy2167skdGOy3vqRzEvl1Dm4sV2ReDg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.18.1"
-      }
-    },
     "node_modules/undici-types": {
       "version": "7.16.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
diff --git a/package.json b/package.json
index c2022bb3..b5039491 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,6 @@
   },
   "dependencies": {
     "@internationalized/date": "^3.11.0",
-    "monaco-editor": "^0.55.1",
-    "undici": "^7.22.0"
+    "monaco-editor": "^0.55.1"
   }
 }
diff --git a/src/routes/api/trino/query/+server.ts b/src/routes/api/trino/query/+server.ts
index d4f1776a..4745ce32 100644
--- a/src/routes/api/trino/query/+server.ts
+++ b/src/routes/api/trino/query/+server.ts
@@ -1,15 +1,10 @@
 import { json } from '@sveltejs/kit';
-import { Agent, fetch as undiciFetch } from 'undici';
 import type { RequestHandler } from './$types';
 
 const POLL_TIMEOUT_MS = 30_000;
 const MAX_CACHED_ROWS = 100_000;
 const CACHE_TTL_MS = 5 * 60 * 1000;
 
-const agent = new Agent({
-  connect: { rejectUnauthorized: false }
-});
-
 interface TrinoColumn {
   name: string;
   type: string;
@@ -62,15 +57,14 @@ async function trinoFetch(
   auth: AuthConfig,
   options?: RequestInit
 ): Promise<TrinoResponse> {
-  const res = await undiciFetch(url, {
+  const res = await fetch(url, {
     ...options,
-    dispatcher: agent,
     headers: {
       ...buildAuthHeaders(auth),
       'X-Trino-Source': 'stackable-ui',
       ...(options?.headers ?? {})
     }
-  } as Parameters<typeof undiciFetch>[1]);
+  });
 
   if (!res.ok) {
     const text = await res.text();

From 8e6f3338a4cce66dc0cc54f99f62287a9ee3b1c5 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Wed, 25 Feb 2026 15:18:11 +0100
Subject: [PATCH 08/41] Document tech debt in new file

---
 AGENTS.md    |  5 ++++
 TECH_DEBT.md | 71 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 76 insertions(+)
 create mode 100644 TECH_DEBT.md

diff --git a/AGENTS.md b/AGENTS.md
index b8783f8d..9d61e3d9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -34,8 +34,13 @@ This is a **single SvelteKit application** (not a monorepo).
 ├── static/               # Static assets
 ├── Dockerfile            # Production container image
 └── CLAUDE.md             # AI assistant instructions
+└── TECH_DEBT.md          # Known tech debt and deferred security concerns
 ```
 
+## Tech Debt
+
+When introducing shortcuts, known issues, or deferred security work, add an entry to `TECH_DEBT.md`. Keep entries concise: what the issue is, why it is acceptable now, and what the correct long-term fix is.
+
 ## Development Guidelines
 
 ### Browser Compatibility
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
new file mode 100644
index 00000000..0728eb69
--- /dev/null
+++ b/TECH_DEBT.md
@@ -0,0 +1,71 @@
+# Tech Debt
+
+Tracked issues that are acceptable at the current early stage but must be addressed before production.
+
+---
+
+## Security
+
+### No authentication or authorisation on the Trino API route
+**File:** `src/routes/api/trino/query/+server.ts`, `src/hooks.server.ts`
+
+The `/api/trino/query` endpoint is completely unauthenticated. Any request — from any origin — can execute arbitrary SQL against any Trino instance. OIDC authentication is planned (env vars are wired up, `hooks.server.ts` has the right structure) but not yet implemented. Until auth middleware is in place there is also no per-user rate limiting or query quota.
+
+---
+
+### Trino credentials stored in localStorage
+**File:** `src/routes/(app)/trino/+page.svelte:41–44`
+
+Username and password are persisted in plaintext localStorage. This is convenient for development (survives page reloads) but violates credential storage best practices — localStorage is accessible to any script on the page and visible in DevTools. Long-term the connection config should be stored server-side (tied to the authenticated session), with credentials never leaving the server after initial setup.
+
+---
+
+### Credentials sent in every request body
+**File:** `src/routes/(app)/trino/+page.svelte:82–84`
+
+Because there is no server-side session yet, connection credentials (including password) are included in the JSON body of every `/api/trino/query` POST. Once server-side sessions exist the client should send only a session token, not raw credentials.
+
+---
+
+### Raw upstream error messages returned to the client
+**File:** `src/routes/api/trino/query/+server.ts:165, 181, 209`
+
+Trino error messages and Node.js exception messages are returned to the browser without any sanitisation. Trino errors may expose schema details, table names, or internal query plans. These should be classified (query error vs. infrastructure error) and sanitised before being surfaced to users.
+
+---
+
+## API & Validation
+
+### API route request body not validated with Zod
+**File:** `src/routes/api/trino/query/+server.ts:83–103`
+
+`parseConnection` uses manual `typeof` checks instead of a Zod schema. The AGENTS.md guidelines require Zod for all validation. Additionally, `request.json()` is called without a try/catch — a malformed JSON body will throw an unhandled error rather than returning a 400.
+
+---
+
+### In-memory query cache has no total size bound
+**File:** `src/routes/api/trino/query/+server.ts:40–47`
+
+Each cached query can hold up to `MAX_CACHED_ROWS` (100 000) rows. `evictStale()` is only called when a new query arrives, not on a timer, so a long idle period followed by many concurrent queries could accumulate significant memory before eviction runs. Needs a bounded cache (e.g. LRU with a memory cap) and a periodic eviction timer.
+
+---
+
+### Displayed results not cleared on connection change
+**File:** `src/routes/(app)/trino/+page.svelte:40–46`
+
+The `$effect` that persists connection settings only resets `queryId`, not `rows`, `columns`, or `error`. After switching to a different Trino instance the previous result set remains visible until a new query is run, which is confusing.
+
+---
+
+## Infrastructure
+
+### No Content Security Policy headers
+
+No CSP headers are set anywhere. This leaves the app exposed to XSS in ways that a strict CSP would mitigate. Should be added in a SvelteKit hook once the app stabilises.
+
+---
+
+### `allowedHosts: true` in Vite config
+**File:** `vite.config.ts`
+
+The dev server accepts requests from any host. This enables DNS rebinding attacks against local development environments. Should be restricted to `localhost` / `127.0.0.1` unless remote dev access is explicitly needed.

From 94f2fdc06712f9cd216b71fda2536820c25bb56f Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Wed, 25 Feb 2026 15:32:50 +0100
Subject: [PATCH 09/41] disable all TLS validation when running as dev server

---
 .env.development                      | 4 ----
 src/hooks.server.ts                   | 6 ++++++
 src/routes/api/trino/query/+server.ts | 3 ++-
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/.env.development b/.env.development
index ca62220a..e69de29b 100644
--- a/.env.development
+++ b/.env.development
@@ -1,4 +0,0 @@
-# Disable TLS certificate verification for development (e.g. self-signed Trino certs).
-# This file is committed and loaded automatically in dev mode.
-# Never set this in production.
-NODE_TLS_REJECT_UNAUTHORIZED=0
diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index a8be42a8..2aa8f57d 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -1,6 +1,12 @@
 import { paraglideMiddleware } from '$lib/paraglide/server';
 import { type Handle } from '@sveltejs/kit';
 import { sequence } from '@sveltejs/kit/hooks';
+import { dev } from '$app/environment';
+
+// Allow self-signed TLS certificates in development (e.g. local Trino with self-signed certs).
+if (dev) {
+  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+}
 
 const handleParaglide: Handle = ({ event, resolve }) =>
   paraglideMiddleware(event.request, ({ request, locale }) => {
diff --git a/src/routes/api/trino/query/+server.ts b/src/routes/api/trino/query/+server.ts
index 4745ce32..91a191e1 100644
--- a/src/routes/api/trino/query/+server.ts
+++ b/src/routes/api/trino/query/+server.ts
@@ -199,7 +199,8 @@ export const POST: RequestHandler = async ({ request }) => {
     });
   } catch (err) {
     const message = err instanceof Error ? err.message : 'Unknown error';
-    console.error('[trino] unexpected error on %s: %s', connection.url, message);
+    const cause = err instanceof Error ? err.cause : undefined;
+    console.error('[trino] unexpected error on %s: %s', connection.url, message, cause ?? '');
     return json({ error: message }, { status: 500 });
   }
 };

From 3c9bec445f1867babfa293e1c05a157b1a39faf3 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Wed, 25 Feb 2026 17:26:11 +0100
Subject: [PATCH 10/41] Use pino for logs and add missing i18n

---
 messages/de.json                      |  5 ++-
 messages/en.json                      |  5 ++-
 src/routes/api/trino/query/+server.ts | 47 ++++++++++++---------------
 3 files changed, 28 insertions(+), 29 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index 526912cf..3766154d 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -57,5 +57,8 @@
   "trino_auth_basic": "Basic",
   "trino_auth_username": "Benutzername",
   "trino_auth_password": "Passwort",
-  "trino_unknown_error": "Unbekannter Fehler"
+  "trino_unknown_error": "Unbekannter Fehler",
+  "trino_no_sql": "Keine SQL-Abfrage angegeben",
+  "trino_invalid_connection": "Die Verbindungskonfiguration ist ungültig oder fehlt. Bitte eine gültige URL und Authentifizierungsmethode angeben.",
+  "trino_query_timeout": "Abfrage nach 30 Sekunden abgebrochen"
 }
diff --git a/messages/en.json b/messages/en.json
index 5c22111b..17fd1fda 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -57,5 +57,8 @@
   "trino_auth_basic": "Basic",
   "trino_auth_username": "Username",
   "trino_auth_password": "Password",
-  "trino_unknown_error": "Unknown error"
+  "trino_unknown_error": "Unknown error",
+  "trino_no_sql": "No SQL provided",
+  "trino_invalid_connection": "The connection configuration is invalid or missing. Please provide a valid URL and authentication method.",
+  "trino_query_timeout": "Query timed out after 30 seconds"
 }
diff --git a/src/routes/api/trino/query/+server.ts b/src/routes/api/trino/query/+server.ts
index 91a191e1..10b78035 100644
--- a/src/routes/api/trino/query/+server.ts
+++ b/src/routes/api/trino/query/+server.ts
@@ -1,4 +1,5 @@
 import { json } from '@sveltejs/kit';
+import * as m from '$lib/paraglide/messages.js';
 import type { RequestHandler } from './$types';
 
 const POLL_TIMEOUT_MS = 30_000;
@@ -98,7 +99,9 @@ function parseConnection(raw: unknown): ConnectionConfig | null {
 
 const ALLOWED_PAGE_SIZES = new Set([25, 50, 100]);
 
-export const POST: RequestHandler = async ({ request }) => {
+export const POST: RequestHandler = async ({ request, locals }) => {
+  const log = locals.logger;
+
   const body = await request.json();
   const pageSize: number = ALLOWED_PAGE_SIZES.has(body.pageSize) ? body.pageSize : 25;
   const page: number = typeof body.page === 'number' && body.page >= 0 ? Math.floor(body.page) : 0;
@@ -107,11 +110,11 @@ export const POST: RequestHandler = async ({ request }) => {
   if (typeof body.queryId === 'string' && body.queryId) {
     const cached = queryCache.get(body.queryId);
     if (!cached) {
-      console.info('[trino] cache miss for queryId=%s (session expired)', body.queryId);
+      log.info({ query_id: body.queryId }, 'cache miss (session expired)');
       return json({ error: 'session_expired' }, { status: 404 });
     }
     const start = page * pageSize;
-    console.debug('[trino] cache hit queryId=%s page=%d pageSize=%d', body.queryId, page, pageSize);
+    log.debug({ query_id: body.queryId, page, page_size: pageSize }, 'cache hit');
     return json({
       queryId: body.queryId,
       columns: cached.columns,
@@ -124,26 +127,20 @@ export const POST: RequestHandler = async ({ request }) => {
   // New query execution — connection config required.
   const { sql } = body;
   if (!sql?.trim()) {
-    return json({ error: 'No SQL provided' }, { status: 400 });
+    return json({ error: m.trino_no_sql() }, { status: 400 });
   }
 
   const connection = parseConnection(body.connection);
   if (!connection) {
-    return json(
-      {
-        error:
-          'Invalid or missing connection config. Provide connection.url (http/https) and connection.auth.'
-      },
-      { status: 400 }
-    );
+    return json({ error: m.trino_invalid_connection() }, { status: 400 });
   }
 
   evictStale();
 
-  const start = Date.now();
-  console.info('[trino] executing query on %s', connection.url);
+  const queryStart = Date.now();
+  log.info({ trino_url: connection.url }, 'executing query');
 
-  const deadline = start + POLL_TIMEOUT_MS;
+  const deadline = queryStart + POLL_TIMEOUT_MS;
   let columns: TrinoColumn[] = [];
   let rows: unknown[][] = [];
 
@@ -155,7 +152,7 @@ export const POST: RequestHandler = async ({ request }) => {
     });
 
     if (response.error) {
-      console.info('[trino] query error: %s', response.error.message);
+      log.info({ err: response.error }, 'query error');
       return json({ error: response.error.message }, { status: 400 });
     }
 
@@ -164,14 +161,14 @@ export const POST: RequestHandler = async ({ request }) => {
 
     while (response.nextUri && rows.length < MAX_CACHED_ROWS) {
       if (Date.now() > deadline) {
-        console.info('[trino] query timed out after %dms on %s', POLL_TIMEOUT_MS, connection.url);
-        return json({ error: 'Query timed out after 30 seconds' }, { status: 408 });
+        log.info({ trino_url: connection.url, timeout_ms: POLL_TIMEOUT_MS }, 'query timed out');
+        return json({ error: m.trino_query_timeout() }, { status: 408 });
       }
 
       response = await trinoFetch(response.nextUri, connection.auth);
 
       if (response.error) {
-        console.info('[trino] query error: %s', response.error.message);
+        log.info({ err: response.error }, 'query error');
         return json({ error: response.error.message }, { status: 400 });
       }
 
@@ -182,12 +179,9 @@ export const POST: RequestHandler = async ({ request }) => {
     const queryId = crypto.randomUUID();
     queryCache.set(queryId, { columns, rows, createdAt: Date.now() });
 
-    console.info(
-      '[trino] query complete: %d rows, %d cols, %dms, queryId=%s',
-      rows.length,
-      columns.length,
-      Date.now() - start,
-      queryId
+    log.info(
+      { query_id: queryId, rows: rows.length, cols: columns.length, duration_ms: Date.now() - queryStart },
+      'query complete'
     );
 
     return json({
@@ -198,9 +192,8 @@ export const POST: RequestHandler = async ({ request }) => {
       totalRows: rows.length
     });
   } catch (err) {
-    const message = err instanceof Error ? err.message : 'Unknown error';
-    const cause = err instanceof Error ? err.cause : undefined;
-    console.error('[trino] unexpected error on %s: %s', connection.url, message, cause ?? '');
+    log.error({ err, trino_url: connection.url }, 'unexpected error');
+    const message = err instanceof Error ? err.message : m.trino_unknown_error();
     return json({ error: message }, { status: 500 });
   }
 };

From 033bf567d6554a32fdbda31c56d2882a38056ca4 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Thu, 26 Feb 2026 21:22:14 +0100
Subject: [PATCH 11/41] Move trino query execution to server-side form action

---
 e2e/trino.spec.ts                      | 302 +++++++++---------
 messages/de.json                       |   1 +
 messages/en.json                       |   1 +
 src/lib/server/trino.ts                |  69 +++++
 src/routes/(app)/trino/+page.server.ts | 134 ++++++++
 src/routes/(app)/trino/+page.svelte    | 407 ++++++++++++++-----------
 src/routes/(app)/trino/schemas.ts      |  30 ++
 src/routes/api/trino/query/+server.ts  | 199 ------------
 8 files changed, 626 insertions(+), 517 deletions(-)
 create mode 100644 src/lib/server/trino.ts
 create mode 100644 src/routes/(app)/trino/+page.server.ts
 create mode 100644 src/routes/(app)/trino/schemas.ts
 delete mode 100644 src/routes/api/trino/query/+server.ts

diff --git a/e2e/trino.spec.ts b/e2e/trino.spec.ts
index 77afb1d0..cffebbcb 100644
--- a/e2e/trino.spec.ts
+++ b/e2e/trino.spec.ts
@@ -1,4 +1,6 @@
 import { test, expect, type Page } from '@playwright/test';
+import * as http from 'node:http';
+import type { AddressInfo } from 'node:net';
 
 const COLUMNS = [
   { name: 'id', type: 'integer' },
@@ -15,6 +17,26 @@ async function waitForHydration(page: Page) {
     .toMatch(/^(light|dark)$/);
 }
 
+// Starts a lightweight HTTP server that acts as a mock Trino endpoint.
+// The server action fetches `{trino_url}/v1/statement` from the SvelteKit server
+// (Node.js), so we need a real TCP server reachable by the server process.
+// page.route() only intercepts browser-side requests and cannot mock server-side
+// Node.js fetch calls.
+async function startMockTrinoServer(
+  handler: (req: http.IncomingMessage, res: http.ServerResponse) => void
+): Promise<{ url: string; stop: () => Promise<void> }> {
+  const server = http.createServer(handler);
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const port = (server.address() as AddressInfo).port;
+  return {
+    url: `http://127.0.0.1:${port}`,
+    stop: () =>
+      new Promise<void>((resolve, reject) =>
+        server.close((err) => (err ? reject(err) : resolve()))
+      )
+  };
+}
+
 test.describe('Trino query editor', () => {
   test.use({ locale: 'en-US' });
 
@@ -46,161 +68,147 @@ test.describe('Trino query editor', () => {
   });
 
   test('running a query displays the results table', async ({ page }) => {
-    await page.route('**/api/trino/query', async (route) => {
-      await route.fulfill({
-        status: 200,
-        contentType: 'application/json',
-        body: JSON.stringify({
-          queryId: 'q1',
+    const { url, stop } = await startMockTrinoServer((_req, res) => {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(
+        JSON.stringify({
+          id: 'test-query-id',
           columns: COLUMNS,
-          rows: [
+          data: [
             [1, 'Alice'],
             [2, 'Bob'],
             [3, 'Carol']
           ],
-          hasMore: false,
-          totalRows: 3
+          stats: { state: 'FINISHED' }
         })
-      });
+      );
     });
-
-    await page.goto('/trino');
-    await waitForHydration(page);
-    await page.getByRole('button', { name: 'Run query' }).click();
-
-    const table = page.getByRole('table', { name: 'Query results' });
-    await expect(table).toBeVisible();
-    await expect(table.getByRole('columnheader', { name: 'id' })).toBeVisible();
-    await expect(table.getByRole('columnheader', { name: 'name' })).toBeVisible();
-    await expect(table.getByRole('cell', { name: '1' })).toBeVisible();
-    await expect(table.getByRole('cell', { name: 'Alice' })).toBeVisible();
-    await expect(page.getByText('Rows 1–3 of 3')).toBeVisible();
+    await page.addInitScript((trinoUrl) => {
+      localStorage.setItem('trino_url', trinoUrl);
+    }, url);
+
+    try {
+      await page.goto('/trino');
+      await waitForHydration(page);
+      await page.getByRole('button', { name: 'Run query' }).click();
+
+      const table = page.getByRole('table', { name: 'Query results' });
+      await expect(table).toBeVisible();
+      await expect(table.getByRole('columnheader', { name: 'id' })).toBeVisible();
+      await expect(table.getByRole('columnheader', { name: 'name' })).toBeVisible();
+      await expect(table.getByRole('cell', { name: '1' })).toBeVisible();
+      await expect(table.getByRole('cell', { name: 'Alice' })).toBeVisible();
+      await expect(page.getByText('Rows 1–3 of 3')).toBeVisible();
+    } finally {
+      await stop();
+    }
   });
 
   test('Ctrl+Enter triggers query execution', async ({ page }) => {
     let called = false;
-    await page.route('**/api/trino/query', async (route) => {
+    const { url, stop } = await startMockTrinoServer((_req, res) => {
       called = true;
-      await route.fulfill({
-        status: 200,
-        contentType: 'application/json',
-        body: JSON.stringify({
-          queryId: 'q1',
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(
+        JSON.stringify({
+          id: 'q1',
           columns: COLUMNS,
-          rows: [[1, 'Alice']],
-          hasMore: false,
-          totalRows: 1
+          data: [[1, 'Alice']],
+          stats: { state: 'FINISHED' }
         })
-      });
+      );
     });
-
-    await page.goto('/trino');
-    await waitForHydration(page);
-    await page.keyboard.press('Control+Enter');
-
-    await expect.poll(() => called).toBe(true);
-    await expect(page.getByRole('table', { name: 'Query results' })).toBeVisible();
+    await page.addInitScript((trinoUrl) => {
+      localStorage.setItem('trino_url', trinoUrl);
+    }, url);
+
+    try {
+      await page.goto('/trino');
+      await waitForHydration(page);
+      await page.keyboard.press('Control+Enter');
+
+      await expect.poll(() => called).toBe(true);
+      await expect(page.getByRole('table', { name: 'Query results' })).toBeVisible();
+    } finally {
+      await stop();
+    }
   });
 
   test('query error is shown in an alert', async ({ page }) => {
-    await page.route('**/api/trino/query', async (route) => {
-      await route.fulfill({
-        status: 400,
-        contentType: 'application/json',
-        body: JSON.stringify({ error: 'syntax error at position 7' })
-      });
+    const { url, stop } = await startMockTrinoServer((_req, res) => {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(
+        JSON.stringify({
+          id: 'q-err',
+          error: { message: 'syntax error at position 7', errorCode: 1 },
+          stats: { state: 'FAILED' }
+        })
+      );
     });
-
-    await page.goto('/trino');
-    await waitForHydration(page);
-    await page.getByRole('button', { name: 'Run query' }).click();
-
-    // Monaco also renders role="alert" nodes for its own accessibility — filter by content.
-    const alert = page.getByRole('alert').filter({ hasText: 'Query error' });
-    await expect(alert).toBeVisible();
-    await expect(alert.getByText('syntax error at position 7')).toBeVisible();
+    await page.addInitScript((trinoUrl) => {
+      localStorage.setItem('trino_url', trinoUrl);
+    }, url);
+
+    try {
+      await page.goto('/trino');
+      await waitForHydration(page);
+      await page.getByRole('button', { name: 'Run query' }).click();
+
+      // Monaco also renders role="alert" nodes for its own accessibility — filter by content.
+      const alert = page.getByRole('alert').filter({ hasText: 'Query error' });
+      await expect(alert).toBeVisible();
+      await expect(alert.getByText('syntax error at position 7')).toBeVisible();
+    } finally {
+      await stop();
+    }
   });
 
   test('pagination navigates between pages', async ({ page }) => {
+    // The server action caches all rows after the first query;
+    // prev/next page requests are served from the cache without hitting Trino again.
     const allRows = Array.from({ length: 30 }, (_, i) => [i + 1, `Row ${i + 1}`]);
-
-    await page.route('**/api/trino/query', async (route) => {
-      const body = JSON.parse((await route.request().postData()) ?? '{}');
-      const pg: number = body.page ?? 0;
-      const ps = 25;
-      const slice = allRows.slice(pg * ps, pg * ps + ps);
-
-      await route.fulfill({
-        status: 200,
-        contentType: 'application/json',
-        body: JSON.stringify({
-          queryId: 'q-pages',
+    const { url, stop } = await startMockTrinoServer((_req, res) => {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(
+        JSON.stringify({
+          id: 'q-pages',
           columns: COLUMNS,
-          rows: slice,
-          hasMore: (pg + 1) * ps < allRows.length,
-          totalRows: allRows.length
+          data: allRows,
+          stats: { state: 'FINISHED' }
         })
-      });
-    });
-
-    await page.goto('/trino');
-    await waitForHydration(page);
-    await page.getByRole('button', { name: 'Run query' }).click();
-
-    await expect(page.getByText('Rows 1–25 of 30')).toBeVisible();
-
-    const nextBtn = page.getByRole('button', { name: 'Next page' });
-    const prevBtn = page.getByRole('button', { name: 'Previous page' });
-    await expect(prevBtn).toBeDisabled();
-    await expect(nextBtn).toBeEnabled();
-
-    await nextBtn.click();
-    await expect(page.getByText('Rows 26–30 of 30')).toBeVisible();
-    await expect(prevBtn).toBeEnabled();
-    await expect(nextBtn).toBeDisabled();
-
-    await prevBtn.click();
-    await expect(page.getByText('Rows 1–25 of 30')).toBeVisible();
-  });
-
-  test('session expired shows correct message', async ({ page }) => {
-    let call = 0;
-    await page.route('**/api/trino/query', async (route) => {
-      call++;
-      if (call === 1) {
-        await route.fulfill({
-          status: 200,
-          contentType: 'application/json',
-          body: JSON.stringify({
-            queryId: 'exp-id',
-            columns: COLUMNS,
-            rows: [[1, 'Alice']],
-            hasMore: true,
-            totalRows: 50
-          })
-        });
-      } else {
-        await route.fulfill({
-          status: 404,
-          contentType: 'application/json',
-          body: JSON.stringify({ error: 'session_expired' })
-        });
-      }
+      );
     });
-
-    await page.goto('/trino');
-    await waitForHydration(page);
-    await page.getByRole('button', { name: 'Run query' }).click();
-    await expect(page.getByRole('table')).toBeVisible();
-
-    await page.getByRole('button', { name: 'Next page' }).click();
-
-    const alert = page.getByRole('alert').filter({ hasText: 'Query session expired' });
-    await expect(alert).toBeVisible();
+    await page.addInitScript((trinoUrl) => {
+      localStorage.setItem('trino_url', trinoUrl);
+    }, url);
+
+    try {
+      await page.goto('/trino');
+      await waitForHydration(page);
+      await page.getByRole('button', { name: 'Run query' }).click();
+
+      await expect(page.getByText('Rows 1–25 of 30')).toBeVisible();
+
+      const nextBtn = page.getByRole('button', { name: 'Next page' });
+      const prevBtn = page.getByRole('button', { name: 'Previous page' });
+      await expect(prevBtn).toBeDisabled();
+      await expect(nextBtn).toBeEnabled();
+
+      await nextBtn.click();
+      await expect(page.getByText('Rows 26–30 of 30')).toBeVisible();
+      await expect(prevBtn).toBeEnabled();
+      await expect(nextBtn).toBeDisabled();
+
+      await prevBtn.click();
+      await expect(page.getByText('Rows 1–25 of 30')).toBeVisible();
+    } finally {
+      await stop();
+    }
   });
 
   test('connection section expands to reveal URL and auth controls', async ({ page }) => {
     await page.goto('/trino');
+    await waitForHydration(page);
 
     // The DaisyUI collapse uses a visually-hidden checkbox as its toggle.
     await page.getByRole('checkbox', { name: 'Connection' }).check({ force: true });
@@ -212,6 +220,7 @@ test.describe('Trino query editor', () => {
 
   test('switching to basic auth reveals credential fields', async ({ page }) => {
     await page.goto('/trino');
+    await waitForHydration(page);
     await page.getByRole('checkbox', { name: 'Connection' }).check({ force: true });
 
     // No credentials visible for 'none' auth
@@ -226,27 +235,32 @@ test.describe('Trino query editor', () => {
   });
 
   test('null cell values render as italic null placeholder', async ({ page }) => {
-    await page.route('**/api/trino/query', async (route) => {
-      await route.fulfill({
-        status: 200,
-        contentType: 'application/json',
-        body: JSON.stringify({
-          queryId: 'q-null',
+    const { url, stop } = await startMockTrinoServer((_req, res) => {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(
+        JSON.stringify({
+          id: 'q-null',
           columns: [{ name: 'value', type: 'varchar' }],
-          rows: [[null], ['hello']],
-          hasMore: false,
-          totalRows: 2
+          data: [[null], ['hello']],
+          stats: { state: 'FINISHED' }
         })
-      });
+      );
     });
-
-    await page.goto('/trino');
-    await waitForHydration(page);
-    await page.getByRole('button', { name: 'Run query' }).click();
-
-    const table = page.getByRole('table');
-    await expect(table).toBeVisible();
-    await expect(table.getByText('null')).toBeVisible();
-    await expect(table.getByText('hello')).toBeVisible();
+    await page.addInitScript((trinoUrl) => {
+      localStorage.setItem('trino_url', trinoUrl);
+    }, url);
+
+    try {
+      await page.goto('/trino');
+      await waitForHydration(page);
+      await page.getByRole('button', { name: 'Run query' }).click();
+
+      const table = page.getByRole('table');
+      await expect(table).toBeVisible();
+      await expect(table.getByText('null')).toBeVisible();
+      await expect(table.getByText('hello')).toBeVisible();
+    } finally {
+      await stop();
+    }
   });
 });
diff --git a/messages/de.json b/messages/de.json
index 3766154d..25853685 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -51,6 +51,7 @@
   "trino_prev_page": "Vorherige Seite",
   "trino_next_page": "Nächste Seite",
   "trino_connection_label": "Verbindung",
+  "trino_connection_error": "Bitte konfigurieren Sie eine gültige Verbindungs-URL.",
   "trino_connection_url": "URL",
   "trino_connection_auth": "Authentifizierung",
   "trino_auth_none": "Keine",
diff --git a/messages/en.json b/messages/en.json
index 17fd1fda..536029d5 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -51,6 +51,7 @@
   "trino_prev_page": "Previous page",
   "trino_next_page": "Next page",
   "trino_connection_label": "Connection",
+  "trino_connection_error": "Please configure a valid connection URL.",
   "trino_connection_url": "URL",
   "trino_connection_auth": "Auth",
   "trino_auth_none": "No auth",
diff --git a/src/lib/server/trino.ts b/src/lib/server/trino.ts
new file mode 100644
index 00000000..66a89c7f
--- /dev/null
+++ b/src/lib/server/trino.ts
@@ -0,0 +1,69 @@
+export interface TrinoColumn {
+  name: string;
+  type: string;
+}
+
+export interface TrinoResponse {
+  id?: string;
+  nextUri?: string;
+  columns?: TrinoColumn[];
+  data?: unknown[][];
+  stats?: { state: string };
+  error?: { message: string; errorCode: number };
+}
+
+export interface CacheEntry {
+  columns: TrinoColumn[];
+  rows: unknown[][];
+  createdAt: number;
+}
+
+export type AuthConfig =
+  | { type: 'none' }
+  | { type: 'basic'; username: string; password: string };
+
+export const POLL_TIMEOUT_MS = 30_000;
+export const MAX_CACHED_ROWS = 100_000;
+export const CACHE_TTL_MS = 5 * 60 * 1000;
+
+export const queryCache = new Map<string, CacheEntry>();
+
+export function evictStale() {
+  const cutoff = Date.now() - CACHE_TTL_MS;
+  for (const [id, entry] of queryCache) {
+    if (entry.createdAt < cutoff) queryCache.delete(id);
+  }
+}
+
+export function buildAuthHeaders(auth: AuthConfig): Record<string, string> {
+  if (auth.type === 'basic') {
+    const encoded = Buffer.from(`${auth.username}:${auth.password}`).toString('base64');
+    return {
+      'X-Trino-User': auth.username,
+      Authorization: `Basic ${encoded}`
+    };
+  }
+  return { 'X-Trino-User': 'anonymous' };
+}
+
+export async function trinoFetch(
+  url: string,
+  auth: AuthConfig,
+  options?: RequestInit
+): Promise<TrinoResponse> {
+  const res = await fetch(url, {
+    ...options,
+    headers: {
+      ...buildAuthHeaders(auth),
+      'X-Trino-Source': 'stackable-ui',
+      ...(options?.headers ?? {})
+    }
+  });
+
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`Trino HTTP ${res.status}: ${text}`);
+  }
+
+  return res.json() as Promise<TrinoResponse>;
+}
diff --git a/src/routes/(app)/trino/+page.server.ts b/src/routes/(app)/trino/+page.server.ts
new file mode 100644
index 00000000..29503e2d
--- /dev/null
+++ b/src/routes/(app)/trino/+page.server.ts
@@ -0,0 +1,134 @@
+import { fail } from '@sveltejs/kit';
+import { superValidate, message } from 'sveltekit-superforms';
+import { zod4 as zod } from 'sveltekit-superforms/adapters';
+import * as m from '$lib/paraglide/messages.js';
+import {
+  trinoFetch,
+  evictStale,
+  queryCache,
+  POLL_TIMEOUT_MS,
+  MAX_CACHED_ROWS,
+  type AuthConfig,
+  type TrinoColumn
+} from '$lib/server/trino.js';
+import { QuerySchema, PaginateSchema, type FormMessage } from './schemas.js';
+import type { Actions, PageServerLoad } from './$types';
+
+export const load: PageServerLoad = async ({ locals }) => {
+  locals.logger.debug('loading Trino page');
+  const [queryForm, paginateForm] = await Promise.all([
+    superValidate(zod(QuerySchema)),
+    superValidate(zod(PaginateSchema))
+  ]);
+  return { queryForm, paginateForm };
+};
+
+export const actions: Actions = {
+  query: async ({ request, locals }) => {
+    const log = locals.logger;
+    const form = await superValidate(request, zod(QuerySchema));
+
+    if (!form.valid) {
+      log.debug({ errors: form.errors }, 'query form validation failed');
+      return fail(400, { form });
+    }
+
+    const { sql, pageSize, connectionUrl, authType, authUsername, authPassword } = form.data;
+    const auth: AuthConfig =
+      authType === 'basic'
+        ? { type: 'basic', username: authUsername, password: authPassword }
+        : { type: 'none' };
+
+    evictStale();
+
+    const queryStart = Date.now();
+    log.info({ trino_url: connectionUrl }, 'executing query');
+
+    const deadline = queryStart + POLL_TIMEOUT_MS;
+    let columns: TrinoColumn[] = [];
+    let rows: unknown[][] = [];
+
+    try {
+      let response = await trinoFetch(`${connectionUrl}/v1/statement`, auth, {
+        method: 'POST',
+        body: sql.replace(/;\s*$/, '').trim(),
+        headers: { 'Content-Type': 'text/plain' }
+      });
+
+      if (response.error) {
+        log.info({ err: response.error }, 'query error');
+        return message(form, { type: 'error', message: response.error.message } satisfies FormMessage, { status: 400 });
+      }
+
+      if (response.columns) columns = response.columns;
+      if (response.data) rows = rows.concat(response.data);
+
+      while (response.nextUri && rows.length < MAX_CACHED_ROWS) {
+        if (Date.now() > deadline) {
+          log.info({ trino_url: connectionUrl, timeout_ms: POLL_TIMEOUT_MS }, 'query timed out');
+          return message(form, { type: 'error', message: m.trino_query_timeout() } satisfies FormMessage, { status: 408 });
+        }
+
+        response = await trinoFetch(response.nextUri, auth);
+
+        if (response.error) {
+          log.info({ err: response.error }, 'query error');
+          return message(form, { type: 'error', message: response.error.message } satisfies FormMessage, { status: 400 });
+        }
+
+        if (response.columns && columns.length === 0) columns = response.columns;
+        if (response.data) rows = rows.concat(response.data);
+      }
+
+      const queryId = crypto.randomUUID();
+      queryCache.set(queryId, { columns, rows, createdAt: Date.now() });
+
+      log.info(
+        { query_id: queryId, rows: rows.length, cols: columns.length, duration_ms: Date.now() - queryStart },
+        'query complete'
+      );
+
+      return message(form, {
+        type: 'result',
+        queryId,
+        columns,
+        rows: rows.slice(0, pageSize),
+        hasMore: rows.length > pageSize,
+        totalRows: rows.length
+      } satisfies FormMessage);
+    } catch (err) {
+      log.error({ err, trino_url: connectionUrl }, 'unexpected error');
+      const msg = err instanceof Error ? err.message : m.trino_unknown_error();
+      return message(form, { type: 'error', message: msg } satisfies FormMessage, { status: 500 });
+    }
+  },
+
+  paginate: async ({ request, locals }) => {
+    const log = locals.logger;
+    const form = await superValidate(request, zod(PaginateSchema));
+
+    if (!form.valid) {
+      return fail(400, { form });
+    }
+
+    const { queryId, page, pageSize } = form.data;
+    const cached = queryCache.get(queryId);
+
+    if (!cached) {
+      log.info({ query_id: queryId }, 'cache miss (session expired)');
+      return message(form, { type: 'error', message: 'session_expired' } satisfies FormMessage, { status: 404 });
+    }
+
+    const start = page * pageSize;
+    log.debug({ query_id: queryId, page, page_size: pageSize }, 'cache hit');
+
+    return message(form, {
+      type: 'result',
+      queryId,
+      columns: cached.columns,
+      rows: cached.rows.slice(start, start + pageSize),
+      hasMore: start + pageSize < cached.rows.length,
+      totalRows: cached.rows.length
+    } satisfies FormMessage);
+  }
+};
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index fc3aa90f..332c4c9a 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -1,9 +1,13 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
   import MonacoEditor from '$lib/components/editor/MonacoEditor.svelte';
+  import { superForm } from 'sveltekit-superforms';
+  import type { PageData } from './$types';
+  import type { FormMessage } from './schemas.js';
 
-  const uid = $props.id();
+  let { data }: { data: PageData } = $props();
 
+  const uid = $props.id();
   const PAGE_SIZES = [25, 50, 100];
 
   function ls(key: string, fallback: string): string {
@@ -14,29 +18,88 @@
     }
   }
 
+  // Connection config and SQL — local state persisted to localStorage.
   let connectionUrl = $state(ls('trino_url', ''));
   let authType = $state<'none' | 'basic'>(ls('trino_auth_type', 'none') as 'none' | 'basic');
   let authUsername = $state(ls('trino_username', ''));
   let authPassword = $state(ls('trino_password', ''));
-
   let sql = $state(ls('trino_sql', 'SELECT 1'));
-  let running = $state(false);
+  let pageSize = $state<25 | 50 | 100>(25);
+
+  // Query result state — updated from form messages.
   let columns = $state<{ name: string; type: string }[]>([]);
   let rows = $state<unknown[][]>([]);
-  let error = $state<string | null>(null);
-  let page = $state(0);
-  let pageSize = $state(25);
+  let queryError = $state<string | null>(null);
+  let currentPage = $state(0);
   let hasMore = $state(false);
   let queryId = $state<string | null>(null);
   let totalRows = $state<number | null>(null);
+  let connectionOpen = $state(false);
 
-  let connectionSummary = $derived(() => {
-    const host = connectionUrl ? connectionUrl.replace(/^https?:\/\//, '').replace(/\/$/, '') : '—';
-    const auth = authType === 'basic' ? m.trino_auth_basic() : m.trino_auth_none();
-    return `${host} · ${auth}`;
+  // Query form — submits connection config + SQL as hidden inputs (FormData).
+  const {
+    enhance: queryEnhance,
+    submitting: querySubmitting,
+    errors: queryErrors
+  } = superForm(data.queryForm, {
+    onSubmit() {
+      queryError = null;
+      columns = [];
+      rows = [];
+      queryId = null;
+      totalRows = null;
+      currentPage = 0;
+      connectionOpen = false;
+    },
+    onUpdated({ form }) {
+      // Validation errors for connection fields — open the section so the user can see them.
+      if (form.errors.connectionUrl) {
+        connectionOpen = true;
+        queryError = m.trino_connection_error();
+        return;
+      }
+      const msg = form.message as FormMessage | undefined;
+      if (!msg) return;
+      if (msg.type === 'result') {
+        queryId = msg.queryId;
+        columns = msg.columns;
+        rows = msg.rows;
+        hasMore = msg.hasMore;
+        totalRows = msg.totalRows;
+      } else {
+        queryError =
+          msg.message === 'session_expired' ? m.trino_session_expired() : msg.message;
+      }
+    }
   });
 
-  // Persist connection config and invalidate query cache on change.
+  // Paginate form — submits as JSON so store values are used directly.
+  const {
+    form: paginateFormData,
+    enhance: paginateEnhance,
+    submitting: paginateSubmitting
+  } = superForm(data.paginateForm, {
+    dataType: 'json',
+    onUpdated({ form }) {
+      const msg = form.message as FormMessage | undefined;
+      if (!msg) return;
+      if (msg.type === 'result') {
+        columns = msg.columns;
+        rows = msg.rows;
+        hasMore = msg.hasMore;
+        totalRows = msg.totalRows;
+        queryError = null;
+      } else {
+        queryError =
+          msg.message === 'session_expired' ? m.trino_session_expired() : msg.message;
+        if (msg.message === 'session_expired') queryId = null;
+      }
+    }
+  });
+
+  const running = $derived($querySubmitting || $paginateSubmitting);
+
+  // Persist connection config; invalidate queryId on change.
   $effect(() => {
     localStorage.setItem('trino_url', connectionUrl);
     localStorage.setItem('trino_auth_type', authType);
@@ -45,206 +108,202 @@
     queryId = null;
   });
 
-  // Persist SQL query.
+  // Persist SQL.
   $effect(() => {
     localStorage.setItem('trino_sql', sql);
   });
 
-  let rowStart = $derived(page * pageSize + 1);
-  let rowEnd = $derived(page * pageSize + rows.length);
-
-  function buildConnection() {
-    return {
-      url: connectionUrl,
-      auth:
-        authType === 'basic'
-          ? { type: 'basic' as const, username: authUsername, password: authPassword }
-          : { type: 'none' as const }
-    };
-  }
-
-  async function fetchResults(isNewQuery: boolean) {
-    if (running) return;
-    running = true;
-    error = null;
-    hasMore = false;
-
-    if (isNewQuery) {
-      columns = [];
-      rows = [];
-      queryId = null;
-      totalRows = null;
-    }
-
-    try {
-      const body =
-        queryId && !isNewQuery
-          ? { queryId, page, pageSize }
-          : { sql, page, pageSize, connection: buildConnection() };
-
-      const res = await fetch('/api/trino/query', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(body)
-      });
+  const connectionSummary = $derived(() => {
+    const host = connectionUrl ? connectionUrl.replace(/^https?:\/\//, '').replace(/\/$/, '') : '—';
+    const auth = authType === 'basic' ? m.trino_auth_basic() : m.trino_auth_none();
+    return `${host} · ${auth}`;
+  });
 
-      const data = await res.json();
+  const rowStart = $derived(currentPage * pageSize + 1);
+  const rowEnd = $derived(currentPage * pageSize + rows.length);
 
-      if (data.error === 'session_expired') {
-        error = m.trino_session_expired();
-        queryId = null;
-      } else if (data.error) {
-        error = data.error;
-      } else {
-        queryId = data.queryId ?? null;
-        columns = data.columns ?? [];
-        rows = data.rows ?? [];
-        hasMore = data.hasMore ?? false;
-        totalRows = data.totalRows ?? null;
-      }
-    } catch (err) {
-      error = err instanceof Error ? err.message : m.trino_unknown_error();
-    } finally {
-      running = false;
-    }
-  }
+  let queryFormEl = $state<HTMLFormElement | undefined>(undefined);
+  let paginateFormEl = $state<HTMLFormElement | undefined>(undefined);
 
   function handleKeydown(event: KeyboardEvent) {
     if ((event.ctrlKey || event.metaKey) && event.key === 'Enter') {
-      page = 0;
-      fetchResults(true);
+      queryFormEl?.requestSubmit();
     }
   }
 
-  function handleRunClick() {
-    page = 0;
-    fetchResults(true);
-  }
-
   function goToPrevPage() {
-    page -= 1;
-    fetchResults(false);
+    const prevPage = currentPage - 1;
+    $paginateFormData.queryId = queryId!;
+    $paginateFormData.page = prevPage;
+    $paginateFormData.pageSize = pageSize;
+    currentPage = prevPage;
+    paginateFormEl?.requestSubmit();
   }
 
   function goToNextPage() {
-    page += 1;
-    fetchResults(false);
+    const nextPage = currentPage + 1;
+    $paginateFormData.queryId = queryId!;
+    $paginateFormData.page = nextPage;
+    $paginateFormData.pageSize = pageSize;
+    currentPage = nextPage;
+    paginateFormEl?.requestSubmit();
   }
 
   function handlePageSizeChange(event: Event) {
-    pageSize = parseInt((event.target as HTMLSelectElement).value, 10);
-    page = 0;
-    fetchResults(false);
+    pageSize = parseInt((event.target as HTMLSelectElement).value, 10) as 25 | 50 | 100;
+    if (queryId) {
+      $paginateFormData.queryId = queryId;
+      $paginateFormData.page = 0;
+      $paginateFormData.pageSize = pageSize;
+      currentPage = 0;
+      paginateFormEl?.requestSubmit();
+    }
   }
 </script>
 
 <svelte:window onkeydown={handleKeydown} />
 
 <div class="flex h-full flex-col gap-4">
-  <!-- Connection config section -->
-  <div class="bg-base-100 border-base-300 collapse rounded-xl border">
-    <input type="checkbox" class="peer" aria-label={m.trino_connection_label()} />
-    <div
-      class="collapse-title text-base-content flex items-center justify-between pr-4 text-sm font-medium"
-    >
-      <span>{m.trino_connection_label()}</span>
-      <span class="text-base-content/50 font-mono text-xs">{connectionSummary()}</span>
-    </div>
-    <div class="collapse-content flex flex-col gap-4">
-      <!-- URL -->
-      <div class="flex flex-col gap-1">
-        <label for="{uid}-conn-url" class="label text-sm">
-          {m.trino_connection_url()}
-        </label>
-        <input
-          id="{uid}-conn-url"
-          type="url"
-          class="input input-sm w-full font-mono"
-          placeholder={m.trino_connection_url_placeholder()}
-          bind:value={connectionUrl}
-        />
-      </div>
+  <!-- Query form: wraps connection config + editor -->
+  <form method="POST" action="?/query" use:queryEnhance bind:this={queryFormEl}>
+    <!-- Hidden inputs carry localStorage state to the server action -->
+    <input type="hidden" name="sql" value={sql} />
+    <input type="hidden" name="pageSize" value={pageSize} />
+    <input type="hidden" name="connectionUrl" value={connectionUrl} />
+    <input type="hidden" name="authType" value={authType} />
+    <input type="hidden" name="authUsername" value={authUsername} />
+    <input type="hidden" name="authPassword" value={authPassword} />
 
-      <!-- Auth type toggle -->
-      <div class="flex flex-col gap-1">
-        <span class="label text-sm">{m.trino_connection_auth()}</span>
-        <div class="join" role="group" aria-label={m.trino_connection_auth()}>
-          <input
-            id="{uid}-auth-none"
-            class="join-item btn btn-sm"
-            type="radio"
-            name="{uid}-auth"
-            aria-label={m.trino_auth_none()}
-            value="none"
-            bind:group={authType}
-          />
+    <!-- Connection config section -->
+    <div class="bg-base-100 border-base-300 collapse rounded-xl border">
+      <input
+        type="checkbox"
+        class="peer"
+        aria-label={m.trino_connection_label()}
+        bind:checked={connectionOpen}
+      />
+      <div
+        class="collapse-title text-base-content flex items-center justify-between pr-4 text-sm font-medium"
+      >
+        <span>{m.trino_connection_label()}</span>
+        <span class="text-base-content/50 font-mono text-xs">{connectionSummary()}</span>
+      </div>
+      <div class="collapse-content flex flex-col gap-4">
+        <!-- URL -->
+        <div class="flex flex-col gap-1">
+          <label for="{uid}-conn-url" class="label text-sm">
+            {m.trino_connection_url()}
+          </label>
           <input
-            id="{uid}-auth-basic"
-            class="join-item btn btn-sm"
-            type="radio"
-            name="{uid}-auth"
-            aria-label={m.trino_auth_basic()}
-            value="basic"
-            bind:group={authType}
+            id="{uid}-conn-url"
+            type="url"
+            class="input input-sm w-full font-mono"
+            class:input-error={$queryErrors.connectionUrl}
+            placeholder={m.trino_connection_url_placeholder()}
+            bind:value={connectionUrl}
           />
+          {#if $queryErrors.connectionUrl}
+            <p class="text-error text-xs">{$queryErrors.connectionUrl?.join(' ')}</p>
+          {/if}
         </div>
-      </div>
 
-      <!-- Basic auth credentials -->
-      {#if authType === 'basic'}
-        <div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
-          <div class="flex flex-col gap-1">
-            <label for="{uid}-auth-username" class="label text-sm">
-              {m.trino_auth_username()}
-            </label>
+        <!-- Auth type toggle -->
+        <div class="flex flex-col gap-1">
+          <span class="label text-sm">{m.trino_connection_auth()}</span>
+          <div class="join" role="group" aria-label={m.trino_connection_auth()}>
             <input
-              id="{uid}-auth-username"
-              type="text"
-              class="input input-sm font-mono"
-              autocomplete="username"
-              bind:value={authUsername}
+              id="{uid}-auth-none"
+              class="join-item btn btn-sm"
+              type="radio"
+              name="{uid}-auth"
+              aria-label={m.trino_auth_none()}
+              value="none"
+              bind:group={authType}
             />
-          </div>
-          <div class="flex flex-col gap-1">
-            <label for="{uid}-auth-password" class="label text-sm">
-              {m.trino_auth_password()}
-            </label>
             <input
-              id="{uid}-auth-password"
-              type="password"
-              class="input input-sm font-mono"
-              autocomplete="current-password"
-              bind:value={authPassword}
+              id="{uid}-auth-basic"
+              class="join-item btn btn-sm"
+              type="radio"
+              name="{uid}-auth"
+              aria-label={m.trino_auth_basic()}
+              value="basic"
+              bind:group={authType}
             />
           </div>
         </div>
-      {/if}
-    </div>
-  </div>
 
-  <!-- Editor section -->
-  <div class="bg-base-100 border-base-300 flex flex-col rounded-xl border">
-    <div class="border-base-300 flex items-center justify-between border-b px-4 py-2">
-      <span class="text-base-content/60 text-sm font-medium">{m.trino_editor_label()}</span>
-      <button
-        class="btn btn-primary btn-sm"
-        onclick={handleRunClick}
-        disabled={running}
-        aria-label={m.trino_run_query()}
-      >
-        {#if running}
-          <span class="loading loading-spinner loading-xs"></span>
-          {m.trino_running()}
-        {:else}
-          {m.trino_run_query()}
-          <kbd class="kbd kbd-sm text-base-content opacity-60">Ctrl+↵</kbd>
+        <!-- Basic auth credentials -->
+        {#if authType === 'basic'}
+          <div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
+            <div class="flex flex-col gap-1">
+              <label for="{uid}-auth-username" class="label text-sm">
+                {m.trino_auth_username()}
+              </label>
+              <input
+                id="{uid}-auth-username"
+                type="text"
+                class="input input-sm font-mono"
+                autocomplete="username"
+                bind:value={authUsername}
+              />
+            </div>
+            <div class="flex flex-col gap-1">
+              <label for="{uid}-auth-password" class="label text-sm">
+                {m.trino_auth_password()}
+              </label>
+              <input
+                id="{uid}-auth-password"
+                type="password"
+                class="input input-sm font-mono"
+                autocomplete="current-password"
+                bind:value={authPassword}
+              />
+            </div>
+          </div>
         {/if}
-      </button>
+      </div>
     </div>
-    <div class="h-64">
-      <MonacoEditor bind:value={sql} language="sql" onExecute={handleRunClick} />
+
+    <!-- Editor section -->
+    <div class="bg-base-100 border-base-300 mt-4 flex flex-col rounded-xl border">
+      <div class="border-base-300 flex items-center justify-between border-b px-4 py-2">
+        <span class="text-base-content/60 text-sm font-medium">{m.trino_editor_label()}</span>
+        <button
+          type="submit"
+          class="btn btn-primary btn-sm"
+          disabled={running}
+          aria-label={m.trino_run_query()}
+        >
+          {#if running}
+            <span class="loading loading-spinner loading-xs"></span>
+            {m.trino_running()}
+          {:else}
+            {m.trino_run_query()}
+            <kbd class="kbd kbd-sm text-base-content opacity-60">Ctrl+↵</kbd>
+          {/if}
+        </button>
+      </div>
+      <div class="h-64">
+        <MonacoEditor
+          bind:value={sql}
+          language="sql"
+          onExecute={() => queryFormEl?.requestSubmit()}
+        />
+      </div>
     </div>
-  </div>
+  </form>
+
+  <!-- Hidden paginate form — buttons in the results section submit this via requestSubmit(). -->
+  <form
+    method="POST"
+    action="?/paginate"
+    use:paginateEnhance
+    bind:this={paginateFormEl}
+    class="sr-only"
+    aria-hidden="true"
+  >
+    <button type="submit">{m.trino_next_page()}</button>
+  </form>
 
   <!-- Results section -->
   <div class="bg-base-100 border-base-300 flex min-h-0 flex-1 flex-col rounded-xl border">
@@ -258,7 +317,7 @@
     </div>
 
     <div class="min-h-0 flex-1 overflow-auto p-4">
-      {#if error}
+      {#if queryError}
         <div class="alert alert-error" role="alert">
           <svg
             class="h-5 w-5 shrink-0"
@@ -273,7 +332,7 @@
           </svg>
           <div>
             <p class="font-semibold">{m.trino_query_error()}</p>
-            <p class="text-sm opacity-80">{error}</p>
+            <p class="text-sm opacity-80">{queryError}</p>
           </div>
         </div>
       {:else if columns.length > 0}
@@ -314,7 +373,7 @@
           <button
             class="btn btn-sm join-item"
             onclick={goToPrevPage}
-            disabled={page === 0 || running}
+            disabled={currentPage === 0 || running}
             aria-label={m.trino_prev_page()}
           >
             ‹
diff --git a/src/routes/(app)/trino/schemas.ts b/src/routes/(app)/trino/schemas.ts
new file mode 100644
index 00000000..d66fa9c3
--- /dev/null
+++ b/src/routes/(app)/trino/schemas.ts
@@ -0,0 +1,30 @@
+import { z } from 'zod';
+
+export const ALLOWED_PAGE_SIZES = [25, 50, 100] as const;
+export type PageSize = 25 | 50 | 100;
+
+export const QuerySchema = z.object({
+  sql: z.string().min(1),
+  pageSize: z.coerce.number().default(25),
+  connectionUrl: z.string().url(),
+  authType: z.enum(['none', 'basic']).default('none'),
+  authUsername: z.string().default(''),
+  authPassword: z.string().default('')
+});
+
+export const PaginateSchema = z.object({
+  queryId: z.string().min(1),
+  page: z.coerce.number().int().nonnegative().default(0),
+  pageSize: z.coerce.number().default(25)
+});
+
+export type FormMessage =
+  | {
+      type: 'result';
+      queryId: string;
+      columns: { name: string; type: string }[];
+      rows: unknown[][];
+      hasMore: boolean;
+      totalRows: number;
+    }
+  | { type: 'error'; message: string };
diff --git a/src/routes/api/trino/query/+server.ts b/src/routes/api/trino/query/+server.ts
deleted file mode 100644
index 10b78035..00000000
--- a/src/routes/api/trino/query/+server.ts
+++ /dev/null
@@ -1,199 +0,0 @@
-import { json } from '@sveltejs/kit';
-import * as m from '$lib/paraglide/messages.js';
-import type { RequestHandler } from './$types';
-
-const POLL_TIMEOUT_MS = 30_000;
-const MAX_CACHED_ROWS = 100_000;
-const CACHE_TTL_MS = 5 * 60 * 1000;
-
-interface TrinoColumn {
-  name: string;
-  type: string;
-}
-
-interface TrinoResponse {
-  id?: string;
-  nextUri?: string;
-  columns?: TrinoColumn[];
-  data?: unknown[][];
-  stats?: { state: string };
-  error?: { message: string; errorCode: number };
-}
-
-interface CacheEntry {
-  columns: TrinoColumn[];
-  rows: unknown[][];
-  createdAt: number;
-}
-
-type AuthConfig = { type: 'none' } | { type: 'basic'; username: string; password: string };
-
-interface ConnectionConfig {
-  url: string;
-  auth: AuthConfig;
-}
-
-const queryCache = new Map<string, CacheEntry>();
-
-function evictStale() {
-  const cutoff = Date.now() - CACHE_TTL_MS;
-  for (const [id, entry] of queryCache) {
-    if (entry.createdAt < cutoff) queryCache.delete(id);
-  }
-}
-
-function buildAuthHeaders(auth: AuthConfig): Record<string, string> {
-  if (auth.type === 'basic') {
-    const encoded = Buffer.from(`${auth.username}:${auth.password}`).toString('base64');
-    return {
-      'X-Trino-User': auth.username,
-      Authorization: `Basic ${encoded}`
-    };
-  }
-  return { 'X-Trino-User': 'anonymous' };
-}
-
-async function trinoFetch(
-  url: string,
-  auth: AuthConfig,
-  options?: RequestInit
-): Promise<TrinoResponse> {
-  const res = await fetch(url, {
-    ...options,
-    headers: {
-      ...buildAuthHeaders(auth),
-      'X-Trino-Source': 'stackable-ui',
-      ...(options?.headers ?? {})
-    }
-  });
-
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`Trino HTTP ${res.status}: ${text}`);
-  }
-
-  return res.json() as Promise<TrinoResponse>;
-}
-
-function parseConnection(raw: unknown): ConnectionConfig | null {
-  if (!raw || typeof raw !== 'object') return null;
-  const conn = raw as Record<string, unknown>;
-  const url = conn.url;
-  if (typeof url !== 'string' || (!url.startsWith('http://') && !url.startsWith('https://'))) {
-    return null;
-  }
-  const auth = conn.auth as Record<string, unknown> | undefined;
-  if (!auth || typeof auth !== 'object') return null;
-  if (auth.type === 'none') {
-    return { url, auth: { type: 'none' } };
-  }
-  if (
-    auth.type === 'basic' &&
-    typeof auth.username === 'string' &&
-    typeof auth.password === 'string'
-  ) {
-    return { url, auth: { type: 'basic', username: auth.username, password: auth.password } };
-  }
-  return null;
-}
-
-const ALLOWED_PAGE_SIZES = new Set([25, 50, 100]);
-
-export const POST: RequestHandler = async ({ request, locals }) => {
-  const log = locals.logger;
-
-  const body = await request.json();
-  const pageSize: number = ALLOWED_PAGE_SIZES.has(body.pageSize) ? body.pageSize : 25;
-  const page: number = typeof body.page === 'number' && body.page >= 0 ? Math.floor(body.page) : 0;
-
-  // Pagination: slice from server-side cache, no Trino re-execution.
-  if (typeof body.queryId === 'string' && body.queryId) {
-    const cached = queryCache.get(body.queryId);
-    if (!cached) {
-      log.info({ query_id: body.queryId }, 'cache miss (session expired)');
-      return json({ error: 'session_expired' }, { status: 404 });
-    }
-    const start = page * pageSize;
-    log.debug({ query_id: body.queryId, page, page_size: pageSize }, 'cache hit');
-    return json({
-      queryId: body.queryId,
-      columns: cached.columns,
-      rows: cached.rows.slice(start, start + pageSize),
-      hasMore: start + pageSize < cached.rows.length,
-      totalRows: cached.rows.length
-    });
-  }
-
-  // New query execution — connection config required.
-  const { sql } = body;
-  if (!sql?.trim()) {
-    return json({ error: m.trino_no_sql() }, { status: 400 });
-  }
-
-  const connection = parseConnection(body.connection);
-  if (!connection) {
-    return json({ error: m.trino_invalid_connection() }, { status: 400 });
-  }
-
-  evictStale();
-
-  const queryStart = Date.now();
-  log.info({ trino_url: connection.url }, 'executing query');
-
-  const deadline = queryStart + POLL_TIMEOUT_MS;
-  let columns: TrinoColumn[] = [];
-  let rows: unknown[][] = [];
-
-  try {
-    let response = await trinoFetch(`${connection.url}/v1/statement`, connection.auth, {
-      method: 'POST',
-      body: sql.replace(/;\s*$/, '').trim(),
-      headers: { 'Content-Type': 'text/plain' }
-    });
-
-    if (response.error) {
-      log.info({ err: response.error }, 'query error');
-      return json({ error: response.error.message }, { status: 400 });
-    }
-
-    if (response.columns) columns = response.columns;
-    if (response.data) rows = rows.concat(response.data);
-
-    while (response.nextUri && rows.length < MAX_CACHED_ROWS) {
-      if (Date.now() > deadline) {
-        log.info({ trino_url: connection.url, timeout_ms: POLL_TIMEOUT_MS }, 'query timed out');
-        return json({ error: m.trino_query_timeout() }, { status: 408 });
-      }
-
-      response = await trinoFetch(response.nextUri, connection.auth);
-
-      if (response.error) {
-        log.info({ err: response.error }, 'query error');
-        return json({ error: response.error.message }, { status: 400 });
-      }
-
-      if (response.columns && columns.length === 0) columns = response.columns;
-      if (response.data) rows = rows.concat(response.data);
-    }
-
-    const queryId = crypto.randomUUID();
-    queryCache.set(queryId, { columns, rows, createdAt: Date.now() });
-
-    log.info(
-      { query_id: queryId, rows: rows.length, cols: columns.length, duration_ms: Date.now() - queryStart },
-      'query complete'
-    );
-
-    return json({
-      queryId,
-      columns,
-      rows: rows.slice(0, pageSize),
-      hasMore: rows.length > pageSize,
-      totalRows: rows.length
-    });
-  } catch (err) {
-    log.error({ err, trino_url: connection.url }, 'unexpected error');
-    const message = err instanceof Error ? err.message : m.trino_unknown_error();
-    return json({ error: message }, { status: 500 });
-  }
-};

From 50160144c15aed47ddc073b07bf2b10b212fbee2 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Thu, 26 Feb 2026 21:35:40 +0100
Subject: [PATCH 12/41] Replace localStorage-polling hydration check with
 body.hydrated class

---
 e2e/helpers.ts            | 11 +++++++++++
 e2e/i18n.spec.ts          |  5 ++---
 e2e/smoke.spec.ts         |  5 ++---
 e2e/trino.spec.ts         | 13 ++-----------
 src/routes/+layout.svelte |  2 ++
 5 files changed, 19 insertions(+), 17 deletions(-)
 create mode 100644 e2e/helpers.ts

diff --git a/e2e/helpers.ts b/e2e/helpers.ts
new file mode 100644
index 00000000..42d1957d
--- /dev/null
+++ b/e2e/helpers.ts
@@ -0,0 +1,11 @@
+import type { Page } from '@playwright/test';
+
+/**
+ * Wait for SvelteKit client-side hydration to complete.
+ *
+ * The root layout adds a `hydrated` class to `<body>` inside `onMount`,
+ * which fires after hydration finishes and the app is fully interactive.
+ */
+export async function waitForHydration(page: Page) {
+  await page.locator('body.hydrated').waitFor();
+}
diff --git a/e2e/i18n.spec.ts b/e2e/i18n.spec.ts
index e8044d1b..e9a9a99c 100644
--- a/e2e/i18n.spec.ts
+++ b/e2e/i18n.spec.ts
@@ -1,4 +1,5 @@
 import { test, expect } from '@playwright/test';
+import { waitForHydration } from './helpers';
 
 test.describe('Internationalisation', () => {
   test.use({ locale: 'en-US' });
@@ -31,9 +32,7 @@ test.describe('Internationalisation', () => {
     await expect(page.locator('html')).toHaveAttribute('lang', 'en');
 
     // Wait for client hydration; locale switch relies on an attached click handler.
-    await expect
-      .poll(() => page.evaluate(() => localStorage.getItem('theme')))
-      .toMatch(/^(light|dark)$/);
+    await waitForHydration(page);
 
     await page.getByRole('button', { name: 'Language' }).click();
     const englishOption = page.locator('#lang-switcher button[lang="en"]');
diff --git a/e2e/smoke.spec.ts b/e2e/smoke.spec.ts
index 2aa710b4..77e97478 100644
--- a/e2e/smoke.spec.ts
+++ b/e2e/smoke.spec.ts
@@ -1,4 +1,5 @@
 import { test, expect } from '@playwright/test';
+import { waitForHydration } from './helpers';
 
 test.describe('Smoke tests', () => {
   test.use({ locale: 'en-US' });
@@ -35,9 +36,7 @@ test.describe('Smoke tests', () => {
     });
 
     // Wait for client hydration/theme initialisation before interacting.
-    await expect
-      .poll(() => page.evaluate(() => localStorage.getItem('theme')))
-      .toMatch(/^(light|dark)$/);
+    await waitForHydration(page);
     await expect(html).toHaveAttribute('data-theme', /^(light|dark)$/);
     await expect(toggle).toBeVisible();
 
diff --git a/e2e/trino.spec.ts b/e2e/trino.spec.ts
index cffebbcb..d212181d 100644
--- a/e2e/trino.spec.ts
+++ b/e2e/trino.spec.ts
@@ -1,22 +1,13 @@
-import { test, expect, type Page } from '@playwright/test';
+import { test, expect } from '@playwright/test';
 import * as http from 'node:http';
 import type { AddressInfo } from 'node:net';
+import { waitForHydration } from './helpers';
 
 const COLUMNS = [
   { name: 'id', type: 'integer' },
   { name: 'name', type: 'varchar' }
 ];
 
-// In SvelteKit + Vite dev mode, the `load` event fires before all dynamic module
-// imports finish. Svelte 5 attaches event handlers only after those imports
-// complete (hydration). Poll for the theme key — the layout writes it on mount —
-// as a reliable signal that the app is fully hydrated and interactive.
-async function waitForHydration(page: Page) {
-  await expect
-    .poll(() => page.evaluate(() => localStorage.getItem('theme')))
-    .toMatch(/^(light|dark)$/);
-}
-
 // Starts a lightweight HTTP server that acts as a mock Trino endpoint.
 // The server action fetches `{trino_url}/v1/statement` from the SvelteKit server
 // (Node.js), so we need a real TCP server reachable by the server process.
diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte
index 5a33388c..277fe8ab 100644
--- a/src/routes/+layout.svelte
+++ b/src/routes/+layout.svelte
@@ -6,6 +6,8 @@
   let { children } = $props();
 
   onMount(() => {
+    document.body.classList.add('hydrated');
+
     const observer = new MutationObserver(() => {
       theme.current = document.documentElement.dataset.theme ?? 'dark';
     });

From d068f2b89c288201a49b0af4c689f494d15089af Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Fri, 27 Feb 2026 13:45:34 +0100
Subject: [PATCH 13/41] Add authentication with OIDC using static config
 through envs

---
 .env.development                         |  6 ++
 .env.example                             | 19 +++----
 .gitignore                               |  1 +
 AGENTS.md                                | 39 +++++++++++++
 dev/keycloak-setup.sh                    | 72 ++++++++++++++++++++++++
 dev/keycloak.yaml                        | 40 +++++++++++++
 package-lock.json                        | 19 ++++---
 package.json                             |  2 +-
 src/lib/components/layout/Sidebar.svelte | 28 +++++----
 src/lib/server/auth.ts                   | 22 +++++---
 src/routes/(app)/+layout.svelte          |  2 +-
 src/routes/auth/logout/+page.server.ts   |  3 +-
 12 files changed, 212 insertions(+), 41 deletions(-)
 create mode 100755 dev/keycloak-setup.sh
 create mode 100644 dev/keycloak.yaml

diff --git a/.env.development b/.env.development
index e69de29b..cc3cacd8 100644
--- a/.env.development
+++ b/.env.development
@@ -0,0 +1,6 @@
+STACKABLE_UI_SQLITE_PATH=.data/auth.db
+STACKABLE_UI_OIDC_DISCOVERY_URL=http://172.18.0.2:30080/realms/stackable/.well-known/openid-configuration
+STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
+STACKABLE_UI_OIDC_CLIENT_SECRET=dxrO7CkZBo1dP9ksi74YiEe9eOhXlt0A
+STACKABLE_UI_SESSION_SECRET=3e19091b882c3f115ddac9a0be3ad3257476a719cc9a83f26abb22a0ccd9a895
+STACKABLE_UI_BASE_URL=http://localhost:5173
diff --git a/.env.example b/.env.example
index 7b935512..a444ae5f 100644
--- a/.env.example
+++ b/.env.example
@@ -1,21 +1,18 @@
-# Better Auth configuration
 # A long random secret used to sign sessions and tokens (min 32 characters)
-BETTER_AUTH_SECRET=change-me-to-a-long-random-secret-min-32-chars
+STACKABLE_UI_SESSION_SECRET=change-me-to-a-long-random-secret-min-32-chars
 
 # The publicly accessible base URL of this application
-BETTER_AUTH_URL=http://localhost:5173
+STACKABLE_UI_BASE_URL=http://localhost:5173
 
-# OIDC provider configuration (Keycloak, Entra ID, or any compliant OIDC provider)
-# The issuer URL — Better Auth appends /.well-known/openid-configuration automatically
-AUTH_ISSUER=https://your-idp.example.com/realms/your-realm
+# OIDC discovery URL (Keycloak, Entra ID, or any compliant OIDC provider)
+STACKABLE_UI_OIDC_DISCOVERY_URL=https://your-idp.example.com/realms/your-realm/.well-known/openid-configuration
 
 # The client ID and secret registered in your OIDC provider
-AUTH_CLIENT_ID=stackable-ui
-AUTH_CLIENT_SECRET=your-client-secret
+STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
+STACKABLE_UI_OIDC_CLIENT_SECRET=your-client-secret
 
-# SQLite database path (must be on a persistent volume in Kubernetes)
-DATABASE_PATH=/data/auth.db
-# Add project environment variables here when needed.
+# Path to the SQLite database file (must be on a persistent volume in Kubernetes)
+STACKABLE_UI_SQLITE_PATH=/data/auth.db
 
 # Logging
 # LOG_LEVEL=debug    # Minimum log level (debug, info, warn, error). Default: debug in dev, info in prod.
diff --git a/.gitignore b/.gitignore
index 04b6c398..a0aca393 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,3 +34,4 @@ e2e/.auth
 # Paraglide
 src/lib/paraglide
 project.inlang/cache/
+.data/
diff --git a/AGENTS.md b/AGENTS.md
index 439cbdcc..1ee649a4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -152,6 +152,45 @@ The application uses **Paraglide-JS v2** for type-safe, compiler-based internati
 - **No hardcoded strings**: Never hardcode user-visible strings in `.svelte` files. This includes text content, `aria-label`, `title`, `placeholder`, and `alt` attributes.
 - **Adding new strings**: Add the key to both `messages/en.json` and `messages/de.json`, then run `npx @inlang/paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide` to regenerate typed message functions.
 
+## Local Authentication Setup
+
+The app uses generic OIDC via **better-auth**. For local development, run a Keycloak instance on a kind cluster:
+
+### 1. Start Keycloak
+
+```bash
+kubectl apply -f dev/keycloak.yaml
+```
+
+### 2. Create realm, client, and test users
+
+```bash
+./dev/keycloak-setup.sh
+```
+
+This creates the `stackable` realm, a `stackable-ui` client, and two test users (`alice`/`alicealice`, `bob`/`bobbob`). It prints the env vars to add to `.env.development`.
+
+### 3. Configure `.env.development`
+
+Copy the output from the setup script into `.env.development`. It should look like:
+
+```env
+STACKABLE_UI_SQLITE_PATH=.data/auth.db
+STACKABLE_UI_OIDC_DISCOVERY_URL=http://<kind-node-ip>:30080/realms/stackable/.well-known/openid-configuration
+STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
+STACKABLE_UI_OIDC_CLIENT_SECRET=<from setup script>
+STACKABLE_UI_SESSION_SECRET=<from setup script>
+STACKABLE_UI_BASE_URL=http://localhost:5173
+```
+
+### 4. Run database migrations
+
+```bash
+set -a && source .env.development && set +a && npx @better-auth/cli@latest migrate --yes
+```
+
+This creates the SQLite tables (`user`, `session`, `account`, `verification`) in `.data/auth.db`.
+
 ## Commands
 
 ### Development
diff --git a/dev/keycloak-setup.sh b/dev/keycloak-setup.sh
new file mode 100755
index 00000000..3ace3867
--- /dev/null
+++ b/dev/keycloak-setup.sh
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Sets up a local Keycloak realm and client for development OIDC testing.
+# Keycloak is expected to be running via dev/keycloak.yaml on a kind cluster.
+set -euo pipefail
+
+echo "Waiting for Keycloak to be ready..."
+kubectl wait --for=condition=available deployment/keycloak --timeout=120s
+
+POD=$(kubectl get pod -l app=keycloak -o jsonpath='{.items[0].metadata.name}')
+
+kcadm() {
+  kubectl exec "$POD" -- /opt/keycloak/bin/kcadm.sh "$@"
+}
+
+echo "Logging in..."
+kcadm config credentials \
+  --server http://localhost:8080 \
+  --realm master \
+  --user admin \
+  --password admin
+
+echo "Creating realm 'stackable'..."
+kcadm create realms \
+  -s realm=stackable \
+  -s enabled=true
+
+echo "Creating client 'stackable-ui'..."
+CLIENT_UUID=$(kcadm create clients \
+  -r stackable \
+  -s clientId=stackable-ui \
+  -s enabled=true \
+  -s protocol=openid-connect \
+  -s publicClient=false \
+  -s standardFlowEnabled=true \
+  -s directAccessGrantsEnabled=false \
+  -s 'redirectUris=["http://localhost:5173/*"]' \
+  -s 'webOrigins=["http://localhost:5173"]' \
+  -i)
+
+create_user() {
+  local username=$1 password=$2 first=$3 last=$4
+  echo "Creating user '$username'..."
+  kcadm create users \
+    -r stackable \
+    -s username="$username" \
+    -s email="$username@example.com" \
+    -s firstName="$first" \
+    -s lastName="$last" \
+    -s enabled=true
+  kcadm set-password \
+    -r stackable \
+    --username "$username" \
+    --new-password "$password"
+}
+
+create_user alice alicealice Alice Example
+create_user bob   bobbob    Bob   Example
+
+echo "Fetching client secret..."
+SECRET=$(kcadm get clients/"$CLIENT_UUID"/client-secret -r stackable --fields value \
+  | grep '"value"' | sed 's/.*: *"\(.*\)".*/\1/')
+
+echo ""
+echo "Done. Add to .env.development:"
+echo ""
+echo "STACKABLE_UI_OIDC_DISCOVERY_URL=http://172.18.0.2:30080/realms/stackable/.well-known/openid-configuration"
+echo "STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui"
+echo "STACKABLE_UI_OIDC_CLIENT_SECRET=$SECRET"
+echo "STACKABLE_UI_SESSION_SECRET=$(openssl rand -hex 32)"
+echo "STACKABLE_UI_BASE_URL=http://localhost:5173"
+echo ""
+echo "Test users: alice/alicealice  bob/bobbob"
diff --git a/dev/keycloak.yaml b/dev/keycloak.yaml
new file mode 100644
index 00000000..028cce73
--- /dev/null
+++ b/dev/keycloak.yaml
@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keycloak
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: keycloak
+  template:
+    metadata:
+      labels:
+        app: keycloak
+    spec:
+      containers:
+        - name: keycloak
+          image: quay.io/keycloak/keycloak:26.1
+          args: ["start-dev"]
+          env:
+            - name: KC_BOOTSTRAP_ADMIN_USERNAME
+              value: admin
+            - name: KC_BOOTSTRAP_ADMIN_PASSWORD
+              value: admin
+          ports:
+            - containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak
+  namespace: default
+spec:
+  type: NodePort
+  selector:
+    app: keycloak
+  ports:
+    - port: 8080
+      targetPort: 8080
+      nodePort: 30080
diff --git a/package-lock.json b/package-lock.json
index f8144ac9..0fad163f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -45,7 +45,7 @@
         "typescript-eslint": "^8.56.1",
         "vite": "^7.3.1",
         "vitest": "^4.0.18",
-        "vitest-browser-svelte": "^2.0.2",
+        "vitest-browser-svelte": "2.0.1",
         "zod": "^4.3.6"
       }
     },
@@ -6192,16 +6192,17 @@
       }
     },
     "node_modules/vitest-browser-svelte": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/vitest-browser-svelte/-/vitest-browser-svelte-2.0.2.tgz",
-      "integrity": "sha512-OLJVYoIYflwToFIy3s41pZ9mVp6dwXfYd8IIsWoc57g8DyN3SxsNJ5GB1xWFPxLFlKM+1MPExjPxLaqdELrfRQ==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/vitest-browser-svelte/-/vitest-browser-svelte-2.0.1.tgz",
+      "integrity": "sha512-z7GFio7vxaOolY+xwPUMEKuwL4KcPzB8+bepA9F0Phqag/TJ4j7IAGSwm4Y/FBh7KznsP+7aEIllMay0qDpFXw==",
       "dev": true,
       "license": "MIT",
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "svelte": "^3 || ^4 || ^5 || ^5.0.0-next.0",
+        "vitest": "^4.0.0"
       }
     },
     "node_modules/webpack-virtual-modules": {
diff --git a/package.json b/package.json
index 5d85d09c..26973238 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "typescript-eslint": "^8.56.1",
     "vite": "^7.3.1",
     "vitest": "^4.0.18",
-    "vitest-browser-svelte": "^2.0.2",
+    "vitest-browser-svelte": "2.0.1",
     "zod": "^4.3.6"
   },
   "dependencies": {
diff --git a/src/lib/components/layout/Sidebar.svelte b/src/lib/components/layout/Sidebar.svelte
index b0a9eaff..c312f979 100644
--- a/src/lib/components/layout/Sidebar.svelte
+++ b/src/lib/components/layout/Sidebar.svelte
@@ -4,10 +4,12 @@
 
   let {
     collapsed = $bindable(false),
-    mobileOpen = $bindable(false)
+    mobileOpen = $bindable(false),
+    authenticated = false
   }: {
     collapsed?: boolean;
     mobileOpen?: boolean;
+    authenticated?: boolean;
   } = $props();
 
   type NavItem = {
@@ -28,16 +30,20 @@
       title: m.nav_platform(),
       items: [{ label: m.nav_dashboard(), href: '/', icon: 'dashboard' }]
     },
-    {
-      title: m.nav_data_tools(),
-      items: [
-        {
-          label: m.nav_trino(),
-          href: '/trino',
-          icon: 'database'
-        }
-      ]
-    }
+    ...(authenticated
+      ? [
+          {
+            title: m.nav_data_tools(),
+            items: [
+              {
+                label: m.nav_trino(),
+                href: '/trino',
+                icon: 'database'
+              }
+            ]
+          }
+        ]
+      : [])
   ]);
 
   function isActive(href: string): boolean {
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index 9fce993c..517da483 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -1,12 +1,20 @@
 import { betterAuth } from 'better-auth';
 import { genericOAuth } from 'better-auth/plugins';
 import Database from 'better-sqlite3';
-import { env } from '$env/dynamic/private';
+
+// Use SvelteKit's $env when available, fall back to process.env for the
+// better-auth CLI which imports this file outside of SvelteKit via jiti.
+let env: Record<string, string | undefined>;
+try {
+  env = (await import('$env/dynamic/private')).env;
+} catch {
+  env = process.env as Record<string, string | undefined>;
+}
 
 export const auth = betterAuth({
-  secret: env.BETTER_AUTH_SECRET,
-  baseURL: env.BETTER_AUTH_URL,
-  database: new Database(env.DATABASE_PATH ?? '/data/auth.db'),
+  secret: env.STACKABLE_UI_SESSION_SECRET,
+  baseURL: env.STACKABLE_UI_BASE_URL,
+  database: new Database(env.STACKABLE_UI_SQLITE_PATH ?? '.data/auth.db'),
   session: {
     cookieCache: { enabled: true, maxAge: 5 * 60 }
   },
@@ -15,9 +23,9 @@ export const auth = betterAuth({
       config: [
         {
           providerId: 'oidc',
-          discoveryUrl: `${env.AUTH_ISSUER}/.well-known/openid-configuration`,
-          clientId: env.AUTH_CLIENT_ID,
-          clientSecret: env.AUTH_CLIENT_SECRET,
+          discoveryUrl: env.STACKABLE_UI_OIDC_DISCOVERY_URL,
+          clientId: env.STACKABLE_UI_OIDC_CLIENT_ID!,
+          clientSecret: env.STACKABLE_UI_OIDC_CLIENT_SECRET!,
           scopes: ['openid', 'profile', 'email'],
           pkce: true,
           mapProfileToUser: async (profile) => {
diff --git a/src/routes/(app)/+layout.svelte b/src/routes/(app)/+layout.svelte
index 28d640d8..a8a8ef28 100644
--- a/src/routes/(app)/+layout.svelte
+++ b/src/routes/(app)/+layout.svelte
@@ -22,7 +22,7 @@
 </svelte:head>
 
 <div class="bg-base-100 flex h-dvh overflow-hidden">
-  <Sidebar bind:collapsed={sidebarCollapsed} bind:mobileOpen />
+  <Sidebar bind:collapsed={sidebarCollapsed} bind:mobileOpen authenticated={!!data.user} />
 
   <div class="flex min-w-0 flex-1 flex-col">
     <Header
diff --git a/src/routes/auth/logout/+page.server.ts b/src/routes/auth/logout/+page.server.ts
index f40704cd..642da743 100644
--- a/src/routes/auth/logout/+page.server.ts
+++ b/src/routes/auth/logout/+page.server.ts
@@ -2,7 +2,8 @@ import { redirect } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
 import { auth } from '$lib/server/auth';
 
-export const load: PageServerLoad = async ({ request }) => {
+export const load: PageServerLoad = async ({ request, cookies }) => {
   await auth.api.signOut({ headers: request.headers });
+  cookies.delete('better-auth.session_token', { path: '/' });
   throw redirect(302, '/auth/login');
 };

From 52353880658b1f0df93ce7182bb2de65a60edc1b Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 2 Mar 2026 15:13:23 +0100
Subject: [PATCH 14/41] Add dev setup script with Keycloak OIDC for Trino and
 mock OIDC for e2e tests

---
 .env.test                                     |   6 +
 .prettierignore                               |   1 +
 TECH_DEBT.md                                  |   8 +
 dev/keycloak-setup.sh                         |  72 --
 dev/keycloak.yaml                             |   3 +-
 dev/setup.sh                                  | 200 ++++
 dev/trino.yaml                                | 118 +++
 e2e/auth.setup.ts                             |  10 +-
 e2e/auth.spec.ts                              |   6 +-
 e2e/global-setup.ts                           |  20 +
 e2e/global-teardown.ts                        |   9 +
 e2e/i18n.spec.ts                              |  26 +-
 e2e/mock-oidc-server.ts                       |  44 +
 e2e/trino.spec.ts                             |  14 +-
 messages/de.json                              |   4 +-
 messages/en.json                              |   4 +-
 package-lock.json                             | 894 +++++++++++++++++-
 package.json                                  |   1 +
 playwright.config.ts                          |   9 +-
 src/lib/components/editor/MonacoEditor.svelte |   4 +-
 src/lib/server/trino.ts                       |  23 +-
 src/lib/theme.svelte.ts                       |   4 +-
 src/routes/(app)/page.svelte.spec.ts          |   2 +-
 src/routes/(app)/trino/+page.server.ts        |  38 +-
 src/routes/(app)/trino/+page.svelte           |  28 +-
 src/routes/(app)/trino/schemas.ts             |   6 +-
 src/routes/+layout.svelte                     |   5 +-
 27 files changed, 1433 insertions(+), 126 deletions(-)
 create mode 100644 .env.test
 delete mode 100755 dev/keycloak-setup.sh
 create mode 100755 dev/setup.sh
 create mode 100644 dev/trino.yaml
 create mode 100644 e2e/global-setup.ts
 create mode 100644 e2e/global-teardown.ts
 create mode 100644 e2e/mock-oidc-server.ts

diff --git a/.env.test b/.env.test
new file mode 100644
index 00000000..1341ec14
--- /dev/null
+++ b/.env.test
@@ -0,0 +1,6 @@
+STACKABLE_UI_SQLITE_PATH=.data/test-auth.db
+STACKABLE_UI_OIDC_CLIENT_ID=mock-client
+STACKABLE_UI_OIDC_CLIENT_SECRET=mock-secret
+STACKABLE_UI_OIDC_DISCOVERY_URL=http://localhost:9090/.well-known/openid-configuration
+STACKABLE_UI_SESSION_SECRET=e2e-test-session-secret-that-is-long-enough
+STACKABLE_UI_BASE_URL=http://localhost:4173
diff --git a/.prettierignore b/.prettierignore
index 665afb42..29fb1f1d 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -11,6 +11,7 @@ dist/
 build/
 .output/
 e2e/test-results/
+e2e/.auth/
 src/lib/paraglide/
 project.inlang/
 
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index 0728eb69..88998f8b 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -7,6 +7,7 @@ Tracked issues that are acceptable at the current early stage but must be addres
 ## Security
 
 ### No authentication or authorisation on the Trino API route
+
 **File:** `src/routes/api/trino/query/+server.ts`, `src/hooks.server.ts`
 
 The `/api/trino/query` endpoint is completely unauthenticated. Any request — from any origin — can execute arbitrary SQL against any Trino instance. OIDC authentication is planned (env vars are wired up, `hooks.server.ts` has the right structure) but not yet implemented. Until auth middleware is in place there is also no per-user rate limiting or query quota.
@@ -14,6 +15,7 @@ The `/api/trino/query` endpoint is completely unauthenticated. Any request — f
 ---
 
 ### Trino credentials stored in localStorage
+
 **File:** `src/routes/(app)/trino/+page.svelte:41–44`
 
 Username and password are persisted in plaintext localStorage. This is convenient for development (survives page reloads) but violates credential storage best practices — localStorage is accessible to any script on the page and visible in DevTools. Long-term the connection config should be stored server-side (tied to the authenticated session), with credentials never leaving the server after initial setup.
@@ -21,6 +23,7 @@ Username and password are persisted in plaintext localStorage. This is convenien
 ---
 
 ### Credentials sent in every request body
+
 **File:** `src/routes/(app)/trino/+page.svelte:82–84`
 
 Because there is no server-side session yet, connection credentials (including password) are included in the JSON body of every `/api/trino/query` POST. Once server-side sessions exist the client should send only a session token, not raw credentials.
@@ -28,6 +31,7 @@ Because there is no server-side session yet, connection credentials (including p
 ---
 
 ### Raw upstream error messages returned to the client
+
 **File:** `src/routes/api/trino/query/+server.ts:165, 181, 209`
 
 Trino error messages and Node.js exception messages are returned to the browser without any sanitisation. Trino errors may expose schema details, table names, or internal query plans. These should be classified (query error vs. infrastructure error) and sanitised before being surfaced to users.
@@ -37,6 +41,7 @@ Trino error messages and Node.js exception messages are returned to the browser
 ## API & Validation
 
 ### API route request body not validated with Zod
+
 **File:** `src/routes/api/trino/query/+server.ts:83–103`
 
 `parseConnection` uses manual `typeof` checks instead of a Zod schema. The AGENTS.md guidelines require Zod for all validation. Additionally, `request.json()` is called without a try/catch — a malformed JSON body will throw an unhandled error rather than returning a 400.
@@ -44,6 +49,7 @@ Trino error messages and Node.js exception messages are returned to the browser
 ---
 
 ### In-memory query cache has no total size bound
+
 **File:** `src/routes/api/trino/query/+server.ts:40–47`
 
 Each cached query can hold up to `MAX_CACHED_ROWS` (100 000) rows. `evictStale()` is only called when a new query arrives, not on a timer, so a long idle period followed by many concurrent queries could accumulate significant memory before eviction runs. Needs a bounded cache (e.g. LRU with a memory cap) and a periodic eviction timer.
@@ -51,6 +57,7 @@ Each cached query can hold up to `MAX_CACHED_ROWS` (100 000) rows. `evictStale()
 ---
 
 ### Displayed results not cleared on connection change
+
 **File:** `src/routes/(app)/trino/+page.svelte:40–46`
 
 The `$effect` that persists connection settings only resets `queryId`, not `rows`, `columns`, or `error`. After switching to a different Trino instance the previous result set remains visible until a new query is run, which is confusing.
@@ -66,6 +73,7 @@ No CSP headers are set anywhere. This leaves the app exposed to XSS in ways that
 ---
 
 ### `allowedHosts: true` in Vite config
+
 **File:** `vite.config.ts`
 
 The dev server accepts requests from any host. This enables DNS rebinding attacks against local development environments. Should be restricted to `localhost` / `127.0.0.1` unless remote dev access is explicitly needed.
diff --git a/dev/keycloak-setup.sh b/dev/keycloak-setup.sh
deleted file mode 100755
index 3ace3867..00000000
--- a/dev/keycloak-setup.sh
+++ /dev/null
@@ -1,72 +0,0 @@
-#!/usr/bin/env bash
-# Sets up a local Keycloak realm and client for development OIDC testing.
-# Keycloak is expected to be running via dev/keycloak.yaml on a kind cluster.
-set -euo pipefail
-
-echo "Waiting for Keycloak to be ready..."
-kubectl wait --for=condition=available deployment/keycloak --timeout=120s
-
-POD=$(kubectl get pod -l app=keycloak -o jsonpath='{.items[0].metadata.name}')
-
-kcadm() {
-  kubectl exec "$POD" -- /opt/keycloak/bin/kcadm.sh "$@"
-}
-
-echo "Logging in..."
-kcadm config credentials \
-  --server http://localhost:8080 \
-  --realm master \
-  --user admin \
-  --password admin
-
-echo "Creating realm 'stackable'..."
-kcadm create realms \
-  -s realm=stackable \
-  -s enabled=true
-
-echo "Creating client 'stackable-ui'..."
-CLIENT_UUID=$(kcadm create clients \
-  -r stackable \
-  -s clientId=stackable-ui \
-  -s enabled=true \
-  -s protocol=openid-connect \
-  -s publicClient=false \
-  -s standardFlowEnabled=true \
-  -s directAccessGrantsEnabled=false \
-  -s 'redirectUris=["http://localhost:5173/*"]' \
-  -s 'webOrigins=["http://localhost:5173"]' \
-  -i)
-
-create_user() {
-  local username=$1 password=$2 first=$3 last=$4
-  echo "Creating user '$username'..."
-  kcadm create users \
-    -r stackable \
-    -s username="$username" \
-    -s email="$username@example.com" \
-    -s firstName="$first" \
-    -s lastName="$last" \
-    -s enabled=true
-  kcadm set-password \
-    -r stackable \
-    --username "$username" \
-    --new-password "$password"
-}
-
-create_user alice alicealice Alice Example
-create_user bob   bobbob    Bob   Example
-
-echo "Fetching client secret..."
-SECRET=$(kcadm get clients/"$CLIENT_UUID"/client-secret -r stackable --fields value \
-  | grep '"value"' | sed 's/.*: *"\(.*\)".*/\1/')
-
-echo ""
-echo "Done. Add to .env.development:"
-echo ""
-echo "STACKABLE_UI_OIDC_DISCOVERY_URL=http://172.18.0.2:30080/realms/stackable/.well-known/openid-configuration"
-echo "STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui"
-echo "STACKABLE_UI_OIDC_CLIENT_SECRET=$SECRET"
-echo "STACKABLE_UI_SESSION_SECRET=$(openssl rand -hex 32)"
-echo "STACKABLE_UI_BASE_URL=http://localhost:5173"
-echo ""
-echo "Test users: alice/alicealice  bob/bobbob"
diff --git a/dev/keycloak.yaml b/dev/keycloak.yaml
index 028cce73..b072ae8f 100644
--- a/dev/keycloak.yaml
+++ b/dev/keycloak.yaml
@@ -1,3 +1,4 @@
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -16,7 +17,7 @@ spec:
       containers:
         - name: keycloak
           image: quay.io/keycloak/keycloak:26.1
-          args: ["start-dev"]
+          args: ['start-dev']
           env:
             - name: KC_BOOTSTRAP_ADMIN_USERNAME
               value: admin
diff --git a/dev/setup.sh b/dev/setup.sh
new file mode 100755
index 00000000..5fabf956
--- /dev/null
+++ b/dev/setup.sh
@@ -0,0 +1,200 @@
+#!/usr/bin/env bash
+# Sets up the full local dev environment on a kind cluster.
+# Assumes: kind cluster is running, kubectl context points to it.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+ENV_FILE="$PROJECT_DIR/.env.development"
+
+echo "=== Stackable UI dev environment setup ==="
+echo ""
+
+# ------------------------------------------------------------------
+# 1. Install npm dependencies if needed
+# ------------------------------------------------------------------
+if [ ! -d "$PROJECT_DIR/node_modules" ]; then
+  echo "Installing npm dependencies..."
+  (cd "$PROJECT_DIR" && npm install)
+else
+  echo "npm dependencies already installed, skipping."
+fi
+
+# ------------------------------------------------------------------
+# 2. Install Stackable operators
+# ------------------------------------------------------------------
+echo ""
+echo "Installing Stackable operators (commons, listener, secret, trino)..."
+stackablectl operator install commons listener secret trino
+
+# ------------------------------------------------------------------
+# 3. Deploy Keycloak
+# ------------------------------------------------------------------
+echo ""
+echo "Deploying Keycloak..."
+kubectl apply -f "$SCRIPT_DIR/keycloak.yaml"
+
+# ------------------------------------------------------------------
+# 4. Wait for Keycloak and configure realm/client/users
+# ------------------------------------------------------------------
+echo ""
+echo "Waiting for Keycloak deployment to be available..."
+kubectl wait --for=condition=available deployment/keycloak --timeout=120s
+
+POD=$(kubectl get pod -l app=keycloak -o jsonpath='{.items[0].metadata.name}')
+NODE_IP=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
+if [ -z "$NODE_IP" ]; then
+  echo "ERROR: Could not detect kind node IP."
+  exit 1
+fi
+echo "Node IP: $NODE_IP"
+
+# ------------------------------------------------------------------
+# 5. Deploy Trino (after node IP is known, trino.yaml is a template)
+# ------------------------------------------------------------------
+echo ""
+echo "Deploying Trino..."
+sed "s/\${NODE_IP}/$NODE_IP/g" "$SCRIPT_DIR/trino.yaml" | kubectl apply -f -
+
+echo "Waiting for Keycloak to accept connections"
+until curl -sf "http://${NODE_IP}:30080/realms/master" >/dev/null 2>&1; do
+  sleep 2
+done
+
+kcadm() {
+  kubectl exec "$POD" -- /opt/keycloak/bin/kcadm.sh "$@"
+}
+
+# Check if realm already exists
+if kcadm get realms/stackable --fields realm 2>/dev/null | grep -q '"stackable"'; then
+  echo "Realm 'stackable' already exists, skipping Keycloak configuration."
+  # Still need to fetch the client secret
+  CLIENT_UUID=$(kcadm get clients -r stackable --fields id,clientId \
+    | grep -B1 '"stackable-ui"' | grep '"id"' | sed 's/.*: *"\(.*\)".*/\1/')
+  SECRET=$(kcadm get clients/"$CLIENT_UUID"/client-secret -r stackable --fields value \
+    | grep '"value"' | sed 's/.*: *"\(.*\)".*/\1/')
+else
+  echo "Logging into Keycloak admin CLI..."
+  kcadm config credentials \
+    --server http://localhost:8080 \
+    --realm master \
+    --user admin \
+    --password admin
+
+  echo "Creating realm 'stackable'..."
+  kcadm create realms \
+    -s realm=stackable \
+    -s enabled=true
+
+  echo "Creating client 'stackable-ui'..."
+  CLIENT_UUID=$(kcadm create clients \
+    -r stackable \
+    -s clientId=stackable-ui \
+    -s enabled=true \
+    -s protocol=openid-connect \
+    -s publicClient=false \
+    -s standardFlowEnabled=true \
+    -s directAccessGrantsEnabled=false \
+    -s 'redirectUris=["*"]' \
+    -s 'webOrigins=["*"]' \
+    -i)
+
+  echo "Creating client 'trino'..."
+  kcadm create clients \
+    -r stackable \
+    -s clientId=trino \
+    -s enabled=true \
+    -s protocol=openid-connect \
+    -s publicClient=false \
+    -s standardFlowEnabled=true \
+    -s directAccessGrantsEnabled=false \
+    -s secret=trino-oidc-dev \
+    -s 'redirectUris=["*"]' \
+    -s 'webOrigins=["*"]'
+
+  create_user() {
+    local username=$1 password=$2 first=$3 last=$4
+    echo "Creating user '$username'..."
+    kcadm create users \
+      -r stackable \
+      -s username="$username" \
+      -s email="$username@example.com" \
+      -s firstName="$first" \
+      -s lastName="$last" \
+      -s enabled=true
+    kcadm set-password \
+      -r stackable \
+      --username "$username" \
+      --new-password "$password"
+  }
+
+  create_user alice alicealice Alice Example
+  create_user bob   bobbob    Bob   Example
+
+  echo "Fetching client secret..."
+  SECRET=$(kcadm get clients/"$CLIENT_UUID"/client-secret -r stackable --fields value \
+    | grep '"value"' | sed 's/.*: *"\(.*\)".*/\1/')
+fi
+
+# ------------------------------------------------------------------
+# 7. Write .env.development
+# ------------------------------------------------------------------
+echo ""
+SESSION_SECRET=$(openssl rand -hex 32)
+
+if [ -f "$ENV_FILE" ]; then
+  echo "Backing up existing .env.development to .env.development.bak"
+  cp "$ENV_FILE" "$ENV_FILE.bak"
+fi
+
+cat > "$ENV_FILE" <<EOF
+STACKABLE_UI_SQLITE_PATH=.data/auth.db
+STACKABLE_UI_OIDC_DISCOVERY_URL=http://${NODE_IP}:30080/realms/stackable/.well-known/openid-configuration
+STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
+STACKABLE_UI_OIDC_CLIENT_SECRET=${SECRET}
+STACKABLE_UI_SESSION_SECRET=${SESSION_SECRET}
+STACKABLE_UI_BASE_URL=http://localhost:5173
+EOF
+
+echo "Wrote $ENV_FILE"
+
+# ------------------------------------------------------------------
+# 8. Run database migrations
+# ------------------------------------------------------------------
+echo ""
+echo "Resetting auth database..."
+rm -f "$PROJECT_DIR/.data/auth.db"
+echo "Running database migrations..."
+# shellcheck source=/dev/null
+(cd "$PROJECT_DIR" && set -a && source "$ENV_FILE" && set +a && npx @better-auth/cli@latest migrate --yes)
+
+# ------------------------------------------------------------------
+# 9. Wait for Trino to be ready
+# ------------------------------------------------------------------
+echo ""
+echo "Waiting for Trino to be ready..."
+kubectl rollout status statefulset/trino-coordinator-default --timeout=300s
+
+TRINO_PORT=$(kubectl get svc trino-coordinator -o jsonpath='{.spec.ports[0].nodePort}')
+echo "Trino endpoint: https://${NODE_IP}:${TRINO_PORT}"
+
+# ------------------------------------------------------------------
+# Done
+# ------------------------------------------------------------------
+echo ""
+echo "=== Setup complete ==="
+echo ""
+echo "Start the dev server with:  npm run dev"
+echo ""
+echo "Keycloak:       http://${NODE_IP}:30080"
+echo "  Admin:        admin / admin"
+echo ""
+echo "Trino endpoint: https://${NODE_IP}:${TRINO_PORT}"
+echo ""
+echo "Trino static credentials (for connection config):"
+echo "  Username: stackable-ui"
+echo "  Password: stackable-ui-dev"
+echo ""
+echo "Test users (OIDC):"
+echo "  alice / alicealice"
+echo "  bob   / bobbob"
diff --git a/dev/trino.yaml b/dev/trino.yaml
new file mode 100644
index 00000000..651ce20e
--- /dev/null
+++ b/dev/trino.yaml
@@ -0,0 +1,118 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: trino-static-users
+  namespace: default
+stringData:
+  # Service account used by Stackable UI to connect to Trino.
+  stackable-ui: stackable-ui-dev
+---
+apiVersion: authentication.stackable.tech/v1alpha1
+kind: AuthenticationClass
+metadata:
+  name: trino-static
+spec:
+  provider:
+    static:
+      userCredentialsSecret:
+        name: trino-static-users
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: trino-oidc-client
+  namespace: default
+stringData:
+  clientId: trino
+  clientSecret: trino-oidc-dev
+---
+apiVersion: authentication.stackable.tech/v1alpha1
+kind: AuthenticationClass
+metadata:
+  name: trino-oidc
+spec:
+  provider:
+    oidc:
+      hostname: ${NODE_IP}
+      port: 30080
+      rootPath: /realms/stackable
+      scopes:
+        - openid
+        - profile
+        - email
+      principalClaim: preferred_username
+---
+apiVersion: trino.stackable.tech/v1alpha1
+kind: TrinoCatalog
+metadata:
+  name: tpch
+  namespace: default
+  labels:
+    trino: trino
+spec:
+  connector:
+    tpch: {}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trino-access-control
+  namespace: default
+data:
+  rules.json: |
+    {
+      "impersonation": [
+        {
+          "original_user": "stackable-ui",
+          "new_user": ".*",
+          "allow": true
+        }
+      ]
+    }
+---
+apiVersion: trino.stackable.tech/v1alpha1
+kind: TrinoCluster
+metadata:
+  name: trino
+  namespace: default
+spec:
+  image:
+    productVersion: '477'
+  clusterConfig:
+    catalogLabelSelector:
+      matchLabels:
+        trino: trino
+    authentication:
+      - authenticationClass: trino-static
+      - authenticationClass: trino-oidc
+        oidc:
+          clientCredentialsSecret: trino-oidc-client
+    tls:
+      serverSecretClass: tls
+  coordinators:
+    roleConfig:
+      listenerClass: external-unstable
+    configOverrides:
+      access-control.properties:
+        access-control.name: file
+        security.config-file: /stackable/access-control/rules.json
+    podOverrides:
+      spec:
+        volumes:
+          - name: access-control
+            configMap:
+              name: trino-access-control
+        containers:
+          - name: trino
+            volumeMounts:
+              - name: access-control
+                mountPath: /stackable/access-control
+                readOnly: true
+    roleGroups:
+      default:
+        replicas: 1
+  workers:
+    roleGroups:
+      default:
+        replicas: 1
diff --git a/e2e/auth.setup.ts b/e2e/auth.setup.ts
index 7da33b08..4410c563 100644
--- a/e2e/auth.setup.ts
+++ b/e2e/auth.setup.ts
@@ -1,6 +1,7 @@
 import { test as setup, expect } from '@playwright/test';
 import path from 'path';
 import { fileURLToPath } from 'url';
+import { waitForHydration } from './helpers.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const authFile = path.join(__dirname, '.auth/user.json');
@@ -10,14 +11,13 @@ setup('authenticate via mock OIDC', async ({ page }) => {
   await page.goto('/');
   await expect(page).toHaveURL(/\/auth\/login/);
 
+  // Wait for hydration so the button's onclick handler is attached
+  await waitForHydration(page);
+
   // Click "Sign in with SSO"
   await page.getByRole('button', { name: /sign in with sso/i }).click();
 
-  // mock-oauth2-server presents a simple username form (input[name="username"], no label text)
-  await page.locator('input[name="username"]').fill('testuser');
-  await page.locator('input[type="submit"]').click();
-
-  // Should land back on the app dashboard
+  // Mock OIDC server auto-redirects — no form interaction needed
   await expect(page).toHaveURL('/');
   await expect(page.getByRole('heading', { name: 'Dashboard' })).toBeVisible();
 
diff --git a/e2e/auth.spec.ts b/e2e/auth.spec.ts
index 48981f03..c40abcff 100644
--- a/e2e/auth.spec.ts
+++ b/e2e/auth.spec.ts
@@ -4,8 +4,8 @@ test.describe('Authentication', () => {
   test.use({ locale: 'en-US' });
 
   test('unauthenticated access redirects to login page', async ({ browser }) => {
-    // Use a fresh context with no saved session
-    const context = await browser.newContext();
+    // Use a fresh context with explicitly empty storage state (no session cookies)
+    const context = await browser.newContext({ storageState: { cookies: [], origins: [] } });
     const page = await context.newPage();
 
     await page.goto('/');
@@ -17,7 +17,7 @@ test.describe('Authentication', () => {
   });
 
   test('login page preserves redirectTo query parameter', async ({ browser }) => {
-    const context = await browser.newContext();
+    const context = await browser.newContext({ storageState: { cookies: [], origins: [] } });
     const page = await context.newPage();
 
     await page.goto('/some-page?foo=bar');
diff --git a/e2e/global-setup.ts b/e2e/global-setup.ts
new file mode 100644
index 00000000..704884e5
--- /dev/null
+++ b/e2e/global-setup.ts
@@ -0,0 +1,20 @@
+import path from 'path';
+import { execSync } from 'child_process';
+import { fileURLToPath } from 'url';
+import { startMockOidc } from './mock-oidc-server.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+export default async function globalSetup() {
+  await startMockOidc();
+
+  // Run database migration with test env vars
+  execSync('npx @better-auth/cli@latest migrate --yes', {
+    cwd: path.join(__dirname, '..'),
+    env: {
+      ...process.env,
+      STACKABLE_UI_SQLITE_PATH: '.data/test-auth.db'
+    },
+    stdio: 'inherit'
+  });
+}
diff --git a/e2e/global-teardown.ts b/e2e/global-teardown.ts
new file mode 100644
index 00000000..e727e800
--- /dev/null
+++ b/e2e/global-teardown.ts
@@ -0,0 +1,9 @@
+import { rm } from 'node:fs/promises';
+import { stopMockOidc } from './mock-oidc-server.js';
+
+const TEST_DB = '.data/test-auth.db';
+
+export default async function globalTeardown() {
+  await stopMockOidc();
+  await rm(TEST_DB, { force: true });
+}
diff --git a/e2e/i18n.spec.ts b/e2e/i18n.spec.ts
index e9a9a99c..4840de40 100644
--- a/e2e/i18n.spec.ts
+++ b/e2e/i18n.spec.ts
@@ -1,6 +1,21 @@
 import { test, expect } from '@playwright/test';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
 import { waitForHydration } from './helpers';
 
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const authFile = path.join(__dirname, '.auth/user.json');
+
+/** Load the saved auth storage state, optionally stripping the locale cookie. */
+function loadAuthState({ withoutLocale = false } = {}) {
+  const state = JSON.parse(fs.readFileSync(authFile, 'utf-8'));
+  if (withoutLocale) {
+    state.cookies = state.cookies.filter((c: { name: string }) => c.name !== 'PARAGLIDE_LOCALE');
+  }
+  return state;
+}
+
 test.describe('Internationalisation', () => {
   test.use({ locale: 'en-US' });
 
@@ -17,9 +32,10 @@ test.describe('Internationalisation', () => {
   });
 
   test('language switcher changes to German', async ({ page, context, baseURL }) => {
-    const resolvedBaseURL = baseURL ?? 'http://localhost:5173';
+    const resolvedBaseURL = baseURL ?? 'http://localhost:4173';
 
-    await context.clearCookies();
+    // Only clear the locale cookie, keeping auth cookies intact
+    await context.clearCookies({ name: 'PARAGLIDE_LOCALE' });
     await context.addCookies([
       {
         name: 'PARAGLIDE_LOCALE',
@@ -76,9 +92,11 @@ test.describe('Internationalisation', () => {
   });
 
   test('Accept-Language header respected for first visit', async ({ browser }) => {
-    // Create a context with German Accept-Language
+    // Create a context with German Accept-Language but no locale cookie,
+    // so paraglide falls back to the Accept-Language header
     const context = await browser.newContext({
-      locale: 'de-DE'
+      locale: 'de-DE',
+      storageState: loadAuthState({ withoutLocale: true })
     });
     const page = await context.newPage();
 
diff --git a/e2e/mock-oidc-server.ts b/e2e/mock-oidc-server.ts
new file mode 100644
index 00000000..2b218ba1
--- /dev/null
+++ b/e2e/mock-oidc-server.ts
@@ -0,0 +1,44 @@
+import { OAuth2Server } from 'oauth2-mock-server';
+
+export const MOCK_OIDC_PORT = 9090;
+export const ISSUER_URL = `http://localhost:${MOCK_OIDC_PORT}`;
+export const DISCOVERY_URL = `${ISSUER_URL}/.well-known/openid-configuration`;
+
+let server: OAuth2Server | null = null;
+
+export async function startMockOidc(): Promise<string> {
+  server = new OAuth2Server();
+
+  await server.issuer.keys.generate('RS256');
+
+  // Add OIDC profile claims to every issued token
+  server.service.on('beforeTokenSigning', (token) => {
+    token.payload.sub = 'mock-user-001';
+    token.payload.name = 'Test User';
+    token.payload.email = 'testuser@example.com';
+    token.payload.preferred_username = 'testuser';
+  });
+
+  // Return the same claims from the userinfo endpoint
+  server.service.on('beforeUserinfo', (response) => {
+    response.body = {
+      sub: 'mock-user-001',
+      name: 'Test User',
+      email: 'testuser@example.com',
+      preferred_username: 'testuser'
+    };
+  });
+
+  await server.start(MOCK_OIDC_PORT, 'localhost');
+  console.log(`Mock OIDC server started at ${ISSUER_URL}`);
+
+  return ISSUER_URL;
+}
+
+export async function stopMockOidc(): Promise<void> {
+  if (server) {
+    await server.stop();
+    server = null;
+    console.log('Mock OIDC server stopped');
+  }
+}
diff --git a/e2e/trino.spec.ts b/e2e/trino.spec.ts
index d212181d..a2cc10e6 100644
--- a/e2e/trino.spec.ts
+++ b/e2e/trino.spec.ts
@@ -22,9 +22,7 @@ async function startMockTrinoServer(
   return {
     url: `http://127.0.0.1:${port}`,
     stop: () =>
-      new Promise<void>((resolve, reject) =>
-        server.close((err) => (err ? reject(err) : resolve()))
-      )
+      new Promise<void>((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())))
   };
 }
 
@@ -209,6 +207,14 @@ test.describe('Trino query editor', () => {
     await expect(urlInput).toHaveValue('http://trino.example.com:8080');
   });
 
+  test('impersonation toggle is visible in connection config', async ({ page }) => {
+    await page.goto('/trino');
+    await waitForHydration(page);
+    await page.getByRole('checkbox', { name: 'Connection' }).check({ force: true });
+
+    await expect(page.getByLabel('User impersonation')).toBeVisible();
+  });
+
   test('switching to basic auth reveals credential fields', async ({ page }) => {
     await page.goto('/trino');
     await waitForHydration(page);
@@ -219,7 +225,7 @@ test.describe('Trino query editor', () => {
     await expect(page.getByLabel('Password')).not.toBeVisible();
 
     // Switch to basic auth
-    await page.getByRole('radio', { name: 'Basic' }).check({ force: true });
+    await page.getByRole('radio', { name: 'Basic' }).click({ force: true });
 
     await expect(page.getByLabel('Username')).toBeVisible();
     await expect(page.getByLabel('Password')).toBeVisible();
diff --git a/messages/de.json b/messages/de.json
index a0f72271..d9876dca 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -66,5 +66,7 @@
   "trino_unknown_error": "Unbekannter Fehler",
   "trino_no_sql": "Keine SQL-Abfrage angegeben",
   "trino_invalid_connection": "Die Verbindungskonfiguration ist ungültig oder fehlt. Bitte eine gültige URL und Authentifizierungsmethode angeben.",
-  "trino_query_timeout": "Abfrage nach 30 Sekunden abgebrochen"
+  "trino_query_timeout": "Abfrage nach 30 Sekunden abgebrochen",
+  "trino_impersonation": "Benutzer-Impersonierung",
+  "trino_impersonation_description": "Abfragen als {user} über das Dienstkonto ausführen"
 }
diff --git a/messages/en.json b/messages/en.json
index 87596d25..30f2aae5 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -66,5 +66,7 @@
   "trino_unknown_error": "Unknown error",
   "trino_no_sql": "No SQL provided",
   "trino_invalid_connection": "The connection configuration is invalid or missing. Please provide a valid URL and authentication method.",
-  "trino_query_timeout": "Query timed out after 30 seconds"
+  "trino_query_timeout": "Query timed out after 30 seconds",
+  "trino_impersonation": "User impersonation",
+  "trino_impersonation_description": "Run queries as {user} via the service account"
 }
diff --git a/package-lock.json b/package-lock.json
index 0fad163f..e13e31ea 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -33,6 +33,7 @@
         "eslint-plugin-security": "^4.0.0",
         "eslint-plugin-svelte": "^3.15.0",
         "globals": "^16.5.0",
+        "oauth2-mock-server": "^8.2.2",
         "pino-pretty": "^13.1.3",
         "prettier": "^3.8.1",
         "prettier-plugin-svelte": "^3.5.0",
@@ -2105,6 +2106,20 @@
         "url": "https://opencollective.com/vitest"
       }
     },
+    "node_modules/accepts": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
+      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mime-types": "^3.0.0",
+        "negotiator": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/acorn": {
       "version": "8.15.0",
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
@@ -2265,6 +2280,26 @@
       ],
       "license": "MIT"
     },
+    "node_modules/basic-auth": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/basic-auth/-/basic-auth-2.0.1.tgz",
+      "integrity": "sha512-NF+epuEdnUYVlGuhaxbbq+dvJttwLnGY+YixlXlME5KpQ5W3CnXA5cVTneY3SPbPDRkcjMbifrwmFYcClgOZeg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "5.1.2"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/basic-auth/node_modules/safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/better-auth": {
       "version": "1.4.19",
       "resolved": "https://registry.npmjs.org/better-auth/-/better-auth-1.4.19.tgz",
@@ -2457,6 +2492,31 @@
         "readable-stream": "^3.4.0"
       }
     },
+    "node_modules/body-parser": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz",
+      "integrity": "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "^3.1.2",
+        "content-type": "^1.0.5",
+        "debug": "^4.4.3",
+        "http-errors": "^2.0.0",
+        "iconv-lite": "^0.7.0",
+        "on-finished": "^2.4.1",
+        "qs": "^6.14.1",
+        "raw-body": "^3.0.1",
+        "type-is": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/brace-expansion": {
       "version": "1.1.12",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
@@ -2492,6 +2552,47 @@
         "ieee754": "^1.1.13"
       }
     },
+    "node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
+      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "get-intrinsic": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/callsites": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
@@ -2664,6 +2765,30 @@
         "node": "^14.18.0 || >=16.10.0"
       }
     },
+    "node_modules/content-disposition": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.0.1.tgz",
+      "integrity": "sha512-oIXISMynqSqm241k6kcQ5UwttDILMK4BiurCfGEREw6+X9jkkpEe5T9FZaApyLGGOnFuyMWZpdolTXMtvEJ08Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/content-type": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
+      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/cookie": {
       "version": "0.6.0",
       "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
@@ -2674,6 +2799,16 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/cookie-signature": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
+      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.6.0"
+      }
+    },
     "node_modules/core-util-is": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
@@ -2681,6 +2816,24 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/cors": {
+      "version": "2.8.6",
+      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
+      "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "object-assign": "^4",
+        "vary": "^1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
@@ -2817,6 +2970,16 @@
       "integrity": "sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==",
       "license": "MIT"
     },
+    "node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/detect-libc": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
@@ -2850,6 +3013,28 @@
         "@types/trusted-types": "^2.0.7"
       }
     },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/effect": {
       "version": "3.19.19",
       "resolved": "https://registry.npmjs.org/effect/-/effect-3.19.19.tgz",
@@ -2862,6 +3047,16 @@
         "fast-check": "^3.23.1"
       }
     },
+    "node_modules/encodeurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/end-of-stream": {
       "version": "1.4.5",
       "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
@@ -2885,6 +3080,26 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/es-module-lexer": {
       "version": "1.7.0",
       "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz",
@@ -2892,6 +3107,26 @@
       "devOptional": true,
       "license": "MIT"
     },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/escape-string-regexp": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
@@ -3209,6 +3444,16 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/expand-template": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
@@ -3228,6 +3473,60 @@
         "node": ">=12.0.0"
       }
     },
+    "node_modules/express": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
+      "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "accepts": "^2.0.0",
+        "body-parser": "^2.2.1",
+        "content-disposition": "^1.0.0",
+        "content-type": "^1.0.5",
+        "cookie": "^0.7.1",
+        "cookie-signature": "^1.2.1",
+        "debug": "^4.4.0",
+        "depd": "^2.0.0",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "etag": "^1.8.1",
+        "finalhandler": "^2.1.0",
+        "fresh": "^2.0.0",
+        "http-errors": "^2.0.0",
+        "merge-descriptors": "^2.0.0",
+        "mime-types": "^3.0.0",
+        "on-finished": "^2.4.1",
+        "once": "^1.4.0",
+        "parseurl": "^1.3.3",
+        "proxy-addr": "^2.0.7",
+        "qs": "^6.14.0",
+        "range-parser": "^1.2.1",
+        "router": "^2.2.0",
+        "send": "^1.1.0",
+        "serve-static": "^2.2.0",
+        "statuses": "^2.0.1",
+        "type-is": "^2.0.1",
+        "vary": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/express/node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/fast-check": {
       "version": "3.23.2",
       "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-3.23.2.tgz",
@@ -3324,6 +3623,28 @@
       "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
       "license": "MIT"
     },
+    "node_modules/finalhandler": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
+      "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.0",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "on-finished": "^2.4.1",
+        "parseurl": "^1.3.3",
+        "statuses": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/find-up": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
@@ -3362,6 +3683,26 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/fresh": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
+      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/fs-constants": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
@@ -3393,6 +3734,45 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/github-from-package": {
       "version": "0.0.0",
       "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
@@ -3425,6 +3805,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/graceful-fs": {
       "version": "4.2.11",
       "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
@@ -3442,6 +3835,19 @@
         "node": ">=8"
       }
     },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/hasown": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
@@ -3462,6 +3868,27 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/human-id": {
       "version": "4.1.3",
       "resolved": "https://registry.npmjs.org/human-id/-/human-id-4.1.3.tgz",
@@ -3472,6 +3899,23 @@
         "human-id": "dist/cli.js"
       }
     },
+    "node_modules/iconv-lite": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
+      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/ieee754": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
@@ -3541,6 +3985,16 @@
       "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
       "license": "ISC"
     },
+    "node_modules/ipaddr.js": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
     "node_modules/is-core-module": {
       "version": "2.16.1",
       "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz",
@@ -3580,10 +4034,30 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/is-module": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-module/-/is-module-1.0.0.tgz",
-      "integrity": "sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g==",
+    "node_modules/is-module": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-module/-/is-module-1.0.0.tgz",
+      "integrity": "sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/is-plain-obj": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-4.1.0.tgz",
+      "integrity": "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/is-promise": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
+      "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -4099,6 +4573,16 @@
         "node": ">= 18"
       }
     },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/mdn-data": {
       "version": "2.23.0",
       "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.23.0.tgz",
@@ -4106,6 +4590,16 @@
       "dev": true,
       "license": "CC0-1.0"
     },
+    "node_modules/media-typer": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz",
+      "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/memoize-weak": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/memoize-weak/-/memoize-weak-1.0.2.tgz",
@@ -4113,6 +4607,46 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/merge-descriptors": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
+      "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.54.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
+      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
+      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "^1.54.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/mimic-response": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
@@ -4237,6 +4771,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/negotiator": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
+      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/node-abi": {
       "version": "3.87.0",
       "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.87.0.tgz",
@@ -4263,6 +4807,49 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/oauth2-mock-server": {
+      "version": "8.2.2",
+      "resolved": "https://registry.npmjs.org/oauth2-mock-server/-/oauth2-mock-server-8.2.2.tgz",
+      "integrity": "sha512-ZjMFtomGM4q1DflxEJpq2WVtSLbOjqlJYkkuGWdq9nL3oAbDExamFyhDN/bUqcooCHWeI0n99K/NU+gXEZLNiA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "basic-auth": "^2.0.1",
+        "cors": "^2.8.6",
+        "express": "^5.2.1",
+        "is-plain-obj": "^4.1.0",
+        "jose": "^6.1.3"
+      },
+      "bin": {
+        "oauth2-mock-server": "dist/oauth2-mock-server.js"
+      },
+      "engines": {
+        "node": "^20.19 || ^22.12 || ^24"
+      }
+    },
+    "node_modules/object-assign": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/object-inspect": {
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/obug": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz",
@@ -4283,6 +4870,19 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/on-finished": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ee-first": "1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/once": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
@@ -4355,6 +4955,16 @@
         "node": ">=6"
       }
     },
+    "node_modules/parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/path-exists": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
@@ -4382,6 +4992,17 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/path-to-regexp": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.3.0.tgz",
+      "integrity": "sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/pathe": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
@@ -4843,6 +5464,20 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/proxy-addr": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
     "node_modules/pump": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.3.tgz",
@@ -4881,12 +5516,54 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/qs": {
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.0.tgz",
+      "integrity": "sha512-mAZTtNCeetKMH+pSjrb76NAM8V9a05I9aBZOHztWy/UqcJdQYNsf59vrRKWnojAT9Y+GbIvoTBC++CPHqpDBhQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "side-channel": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/quick-format-unescaped": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/quick-format-unescaped/-/quick-format-unescaped-4.0.4.tgz",
       "integrity": "sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==",
       "license": "MIT"
     },
+    "node_modules/range-parser": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
+      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/raw-body": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
+      "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.7.0",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
     "node_modules/rc": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
@@ -5040,6 +5717,23 @@
       "integrity": "sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg==",
       "license": "MIT"
     },
+    "node_modules/router": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
+      "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.0",
+        "depd": "^2.0.0",
+        "is-promise": "^4.0.0",
+        "parseurl": "^1.3.3",
+        "path-to-regexp": "^8.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
     "node_modules/sade": {
       "version": "1.8.1",
       "resolved": "https://registry.npmjs.org/sade/-/sade-1.8.1.tgz",
@@ -5092,6 +5786,13 @@
         "node": ">=10"
       }
     },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/secure-json-parse": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/secure-json-parse/-/secure-json-parse-4.1.0.tgz",
@@ -5121,12 +5822,66 @@
         "node": ">=10"
       }
     },
+    "node_modules/send": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
+      "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "etag": "^1.8.1",
+        "fresh": "^2.0.0",
+        "http-errors": "^2.0.1",
+        "mime-types": "^3.0.2",
+        "ms": "^2.1.3",
+        "on-finished": "^2.4.1",
+        "range-parser": "^1.2.1",
+        "statuses": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/serve-static": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
+      "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "parseurl": "^1.3.3",
+        "send": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/set-cookie-parser": {
       "version": "2.7.2",
       "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-2.7.2.tgz",
       "integrity": "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==",
       "license": "MIT"
     },
+    "node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/shebang-command": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
@@ -5150,6 +5905,82 @@
         "node": ">=8"
       }
     },
+    "node_modules/side-channel": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3",
+        "side-channel-list": "^1.0.0",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
+      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/siginfo": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
@@ -5264,6 +6095,16 @@
       "devOptional": true,
       "license": "MIT"
     },
+    "node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/std-env": {
       "version": "3.10.0",
       "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz",
@@ -5674,6 +6515,16 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
     "node_modules/toposort": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/toposort/-/toposort-2.0.2.tgz",
@@ -5799,6 +6650,21 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/type-is": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz",
+      "integrity": "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "content-type": "^1.0.5",
+        "media-typer": "^1.1.0",
+        "mime-types": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/typebox": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/typebox/-/typebox-1.1.1.tgz",
@@ -5852,6 +6718,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/unplugin": {
       "version": "2.3.11",
       "resolved": "https://registry.npmjs.org/unplugin/-/unplugin-2.3.11.tgz",
@@ -5931,6 +6807,16 @@
         "node": ">= 0.10"
       }
     },
+    "node_modules/vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/vite": {
       "version": "7.3.1",
       "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.1.tgz",
diff --git a/package.json b/package.json
index 26973238..e6094a0b 100644
--- a/package.json
+++ b/package.json
@@ -35,6 +35,7 @@
     "eslint-plugin-security": "^4.0.0",
     "eslint-plugin-svelte": "^3.15.0",
     "globals": "^16.5.0",
+    "oauth2-mock-server": "^8.2.2",
     "pino-pretty": "^13.1.3",
     "prettier": "^3.8.1",
     "prettier-plugin-svelte": "^3.5.0",
diff --git a/playwright.config.ts b/playwright.config.ts
index cde53514..2bbb6004 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -3,11 +3,13 @@ import path from 'path';
 import { fileURLToPath } from 'url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const baseURL = process.env.PLAYWRIGHT_BASE_URL ?? 'http://localhost:5173';
+const baseURL = process.env.PLAYWRIGHT_BASE_URL ?? 'http://localhost:4173';
 
 export default defineConfig({
   testDir: path.join(__dirname, 'e2e'),
   outputDir: path.join(__dirname, 'e2e/test-results'),
+  globalSetup: path.join(__dirname, 'e2e/global-setup.ts'),
+  globalTeardown: path.join(__dirname, 'e2e/global-teardown.ts'),
   timeout: 30_000,
   expect: {
     timeout: 10_000
@@ -17,6 +19,11 @@ export default defineConfig({
     trace: 'retain-on-failure',
     video: 'retain-on-failure'
   },
+  webServer: {
+    command: `npm run dev -- --mode test --port 4173`,
+    url: baseURL,
+    reuseExistingServer: false
+  },
   projects: [
     {
       name: 'setup',
diff --git a/src/lib/components/editor/MonacoEditor.svelte b/src/lib/components/editor/MonacoEditor.svelte
index 3932af87..76fff58d 100644
--- a/src/lib/components/editor/MonacoEditor.svelte
+++ b/src/lib/components/editor/MonacoEditor.svelte
@@ -19,9 +19,7 @@
 
   // Start loading in parallel with the rest of the page — not deferred to onMount.
   // Guarded by `browser` because SvelteKit evaluates component scripts on the server too.
-  const workerImport = browser
-    ? import('monaco-editor/esm/vs/editor/editor.worker?worker')
-    : null;
+  const workerImport = browser ? import('monaco-editor/esm/vs/editor/editor.worker?worker') : null;
   const monacoImport = browser ? import('monaco-editor') : null;
 
   function toMonacoTheme(t: string): string {
diff --git a/src/lib/server/trino.ts b/src/lib/server/trino.ts
index 66a89c7f..fbc4989f 100644
--- a/src/lib/server/trino.ts
+++ b/src/lib/server/trino.ts
@@ -18,9 +18,7 @@ export interface CacheEntry {
   createdAt: number;
 }
 
-export type AuthConfig =
-  | { type: 'none' }
-  | { type: 'basic'; username: string; password: string };
+export type AuthConfig = { type: 'none' } | { type: 'basic'; username: string; password: string };
 
 export const POLL_TIMEOUT_MS = 30_000;
 export const MAX_CACHED_ROWS = 100_000;
@@ -49,15 +47,20 @@ export function buildAuthHeaders(auth: AuthConfig): Record<string, string> {
 export async function trinoFetch(
   url: string,
   auth: AuthConfig,
-  options?: RequestInit
+  options?: RequestInit & { impersonateUser?: string }
 ): Promise<TrinoResponse> {
+  const { impersonateUser, ...fetchOptions } = options ?? {};
+  const headers: Record<string, string> = {
+    ...buildAuthHeaders(auth),
+    'X-Trino-Source': 'stackable-ui',
+    ...((fetchOptions.headers as Record<string, string>) ?? {})
+  };
+  if (impersonateUser) {
+    headers['X-Trino-User'] = impersonateUser;
+  }
   const res = await fetch(url, {
-    ...options,
-    headers: {
-      ...buildAuthHeaders(auth),
-      'X-Trino-Source': 'stackable-ui',
-      ...(options?.headers ?? {})
-    }
+    ...fetchOptions,
+    headers
   });
 
   if (!res.ok) {
diff --git a/src/lib/theme.svelte.ts b/src/lib/theme.svelte.ts
index fba15341..de0939e1 100644
--- a/src/lib/theme.svelte.ts
+++ b/src/lib/theme.svelte.ts
@@ -1,3 +1,5 @@
 import { browser } from '$app/environment';
 
-export const theme = $state({ current: browser ? (document.documentElement.dataset.theme ?? 'dark') : 'dark' });
+export const theme = $state({
+  current: browser ? (document.documentElement.dataset.theme ?? 'dark') : 'dark'
+});
diff --git a/src/routes/(app)/page.svelte.spec.ts b/src/routes/(app)/page.svelte.spec.ts
index 9de8e119..be017c8c 100644
--- a/src/routes/(app)/page.svelte.spec.ts
+++ b/src/routes/(app)/page.svelte.spec.ts
@@ -4,7 +4,7 @@ import { render } from 'vitest-browser-svelte';
 import Page from './+page.svelte';
 
 const renderPage = () =>
-  render(Page, { params: {}, data: { serviceCount: 0, healthy: true }, form: null });
+  render(Page, { params: {}, data: { user: null, serviceCount: 0, healthy: true }, form: null });
 
 describe('/(app)/+page.svelte', () => {
   it('should render the welcome heading', async () => {
diff --git a/src/routes/(app)/trino/+page.server.ts b/src/routes/(app)/trino/+page.server.ts
index 29503e2d..67c2a2cb 100644
--- a/src/routes/(app)/trino/+page.server.ts
+++ b/src/routes/(app)/trino/+page.server.ts
@@ -33,11 +33,13 @@ export const actions: Actions = {
       return fail(400, { form });
     }
 
-    const { sql, pageSize, connectionUrl, authType, authUsername, authPassword } = form.data;
+    const { sql, pageSize, connectionUrl, authType, authUsername, authPassword, impersonation } =
+      form.data;
     const auth: AuthConfig =
       authType === 'basic'
         ? { type: 'basic', username: authUsername, password: authPassword }
         : { type: 'none' };
+    const impersonateUser = impersonation && locals.user?.name ? locals.user.name : undefined;
 
     evictStale();
 
@@ -52,12 +54,17 @@ export const actions: Actions = {
       let response = await trinoFetch(`${connectionUrl}/v1/statement`, auth, {
         method: 'POST',
         body: sql.replace(/;\s*$/, '').trim(),
-        headers: { 'Content-Type': 'text/plain' }
+        headers: { 'Content-Type': 'text/plain' },
+        impersonateUser
       });
 
       if (response.error) {
         log.info({ err: response.error }, 'query error');
-        return message(form, { type: 'error', message: response.error.message } satisfies FormMessage, { status: 400 });
+        return message(
+          form,
+          { type: 'error', message: response.error.message } satisfies FormMessage,
+          { status: 400 }
+        );
       }
 
       if (response.columns) columns = response.columns;
@@ -66,14 +73,22 @@ export const actions: Actions = {
       while (response.nextUri && rows.length < MAX_CACHED_ROWS) {
         if (Date.now() > deadline) {
           log.info({ trino_url: connectionUrl, timeout_ms: POLL_TIMEOUT_MS }, 'query timed out');
-          return message(form, { type: 'error', message: m.trino_query_timeout() } satisfies FormMessage, { status: 408 });
+          return message(
+            form,
+            { type: 'error', message: m.trino_query_timeout() } satisfies FormMessage,
+            { status: 408 }
+          );
         }
 
-        response = await trinoFetch(response.nextUri, auth);
+        response = await trinoFetch(response.nextUri, auth, { impersonateUser });
 
         if (response.error) {
           log.info({ err: response.error }, 'query error');
-          return message(form, { type: 'error', message: response.error.message } satisfies FormMessage, { status: 400 });
+          return message(
+            form,
+            { type: 'error', message: response.error.message } satisfies FormMessage,
+            { status: 400 }
+          );
         }
 
         if (response.columns && columns.length === 0) columns = response.columns;
@@ -84,7 +99,12 @@ export const actions: Actions = {
       queryCache.set(queryId, { columns, rows, createdAt: Date.now() });
 
       log.info(
-        { query_id: queryId, rows: rows.length, cols: columns.length, duration_ms: Date.now() - queryStart },
+        {
+          query_id: queryId,
+          rows: rows.length,
+          cols: columns.length,
+          duration_ms: Date.now() - queryStart
+        },
         'query complete'
       );
 
@@ -116,7 +136,9 @@ export const actions: Actions = {
 
     if (!cached) {
       log.info({ query_id: queryId }, 'cache miss (session expired)');
-      return message(form, { type: 'error', message: 'session_expired' } satisfies FormMessage, { status: 404 });
+      return message(form, { type: 'error', message: 'session_expired' } satisfies FormMessage, {
+        status: 404
+      });
     }
 
     const start = page * pageSize;
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index 332c4c9a..49a0791f 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -23,6 +23,7 @@
   let authType = $state<'none' | 'basic'>(ls('trino_auth_type', 'none') as 'none' | 'basic');
   let authUsername = $state(ls('trino_username', ''));
   let authPassword = $state(ls('trino_password', ''));
+  let impersonation = $state(ls('trino_impersonation', 'false') === 'true');
   let sql = $state(ls('trino_sql', 'SELECT 1'));
   let pageSize = $state<25 | 50 | 100>(25);
 
@@ -49,7 +50,6 @@
       queryId = null;
       totalRows = null;
       currentPage = 0;
-      connectionOpen = false;
     },
     onUpdated({ form }) {
       // Validation errors for connection fields — open the section so the user can see them.
@@ -67,8 +67,7 @@
         hasMore = msg.hasMore;
         totalRows = msg.totalRows;
       } else {
-        queryError =
-          msg.message === 'session_expired' ? m.trino_session_expired() : msg.message;
+        queryError = msg.message === 'session_expired' ? m.trino_session_expired() : msg.message;
       }
     }
   });
@@ -90,8 +89,7 @@
         totalRows = msg.totalRows;
         queryError = null;
       } else {
-        queryError =
-          msg.message === 'session_expired' ? m.trino_session_expired() : msg.message;
+        queryError = msg.message === 'session_expired' ? m.trino_session_expired() : msg.message;
         if (msg.message === 'session_expired') queryId = null;
       }
     }
@@ -105,6 +103,7 @@
     localStorage.setItem('trino_auth_type', authType);
     localStorage.setItem('trino_username', authUsername);
     localStorage.setItem('trino_password', authPassword);
+    localStorage.setItem('trino_impersonation', String(impersonation));
     queryId = null;
   });
 
@@ -173,6 +172,7 @@
     <input type="hidden" name="authType" value={authType} />
     <input type="hidden" name="authUsername" value={authUsername} />
     <input type="hidden" name="authPassword" value={authPassword} />
+    <input type="hidden" name="impersonation" value={impersonation} />
 
     <!-- Connection config section -->
     <div class="bg-base-100 border-base-300 collapse rounded-xl border">
@@ -261,6 +261,24 @@
             </div>
           </div>
         {/if}
+
+        <!-- User impersonation -->
+        {#if data.user?.name}
+          <div class="flex items-center gap-3">
+            <input
+              id="{uid}-impersonation"
+              type="checkbox"
+              class="toggle toggle-sm"
+              bind:checked={impersonation}
+            />
+            <label for="{uid}-impersonation" class="flex flex-col">
+              <span class="text-sm">{m.trino_impersonation()}</span>
+              <span class="text-base-content/50 text-xs">
+                {m.trino_impersonation_description({ user: data.user.name })}
+              </span>
+            </label>
+          </div>
+        {/if}
       </div>
     </div>
 
diff --git a/src/routes/(app)/trino/schemas.ts b/src/routes/(app)/trino/schemas.ts
index d66fa9c3..e88456d0 100644
--- a/src/routes/(app)/trino/schemas.ts
+++ b/src/routes/(app)/trino/schemas.ts
@@ -9,7 +9,11 @@ export const QuerySchema = z.object({
   connectionUrl: z.string().url(),
   authType: z.enum(['none', 'basic']).default('none'),
   authUsername: z.string().default(''),
-  authPassword: z.string().default('')
+  authPassword: z.string().default(''),
+  impersonation: z
+    .string()
+    .default('false')
+    .transform((v) => v === 'true')
 });
 
 export const PaginateSchema = z.object({
diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte
index 277fe8ab..3b77780c 100644
--- a/src/routes/+layout.svelte
+++ b/src/routes/+layout.svelte
@@ -11,7 +11,10 @@
     const observer = new MutationObserver(() => {
       theme.current = document.documentElement.dataset.theme ?? 'dark';
     });
-    observer.observe(document.documentElement, { attributes: true, attributeFilter: ['data-theme'] });
+    observer.observe(document.documentElement, {
+      attributes: true,
+      attributeFilter: ['data-theme']
+    });
     return () => observer.disconnect();
   });
 </script>

From 7891715e64325e3ecf36f2bd1b865e8fe9b8d404 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 2 Mar 2026 16:37:56 +0100
Subject: [PATCH 15/41] Switch Trino query form to JSON dataType

---
 .env.development                        |   6 --
 .gitignore                              |   2 +
 src/lib/components/layout/Header.svelte |   6 +-
 src/routes/(app)/trino/+page.server.ts  |  41 ++++-----
 src/routes/(app)/trino/+page.svelte     | 116 ++++++++++++++----------
 src/routes/(app)/trino/schemas.ts       |   5 +-
 src/routes/auth/logout/+page.server.ts  |   8 +-
 7 files changed, 98 insertions(+), 86 deletions(-)
 delete mode 100644 .env.development

diff --git a/.env.development b/.env.development
deleted file mode 100644
index cc3cacd8..00000000
--- a/.env.development
+++ /dev/null
@@ -1,6 +0,0 @@
-STACKABLE_UI_SQLITE_PATH=.data/auth.db
-STACKABLE_UI_OIDC_DISCOVERY_URL=http://172.18.0.2:30080/realms/stackable/.well-known/openid-configuration
-STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
-STACKABLE_UI_OIDC_CLIENT_SECRET=dxrO7CkZBo1dP9ksi74YiEe9eOhXlt0A
-STACKABLE_UI_SESSION_SECRET=3e19091b882c3f115ddac9a0be3ad3257476a719cc9a83f26abb22a0ccd9a895
-STACKABLE_UI_BASE_URL=http://localhost:5173
diff --git a/.gitignore b/.gitignore
index a0aca393..aa194a00 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,6 +14,8 @@ Thumbs.db
 
 # Env
 .env
+.env.development
+.env.development.bak
 !.env.example
 !.env.test
 
diff --git a/src/lib/components/layout/Header.svelte b/src/lib/components/layout/Header.svelte
index 06e09187..243e6d35 100644
--- a/src/lib/components/layout/Header.svelte
+++ b/src/lib/components/layout/Header.svelte
@@ -2,9 +2,9 @@
   import * as m from '$lib/paraglide/messages.js';
   import LanguageSwitcher from './LanguageSwitcher.svelte';
   import ThemeToggle from './ThemeToggle.svelte';
-  import type { auth } from '$lib/server/auth';
+  import { authClient } from '$lib/auth-client';
 
-  type User = typeof auth.$Infer.Session.user | null;
+  type User = typeof authClient.$Infer.Session.user;
 
   let {
     title = m.page_title_dashboard(),
@@ -14,7 +14,7 @@
   }: {
     title?: string;
     mobileOpen?: boolean;
-    user?: User;
+    user?: User | null;
     onToggleMobile?: () => void;
   } = $props();
 
diff --git a/src/routes/(app)/trino/+page.server.ts b/src/routes/(app)/trino/+page.server.ts
index 67c2a2cb..5df717f3 100644
--- a/src/routes/(app)/trino/+page.server.ts
+++ b/src/routes/(app)/trino/+page.server.ts
@@ -9,7 +9,8 @@ import {
   POLL_TIMEOUT_MS,
   MAX_CACHED_ROWS,
   type AuthConfig,
-  type TrinoColumn
+  type TrinoColumn,
+  type TrinoResponse
 } from '$lib/server/trino.js';
 import { QuerySchema, PaginateSchema, type FormMessage } from './schemas.js';
 import type { Actions, PageServerLoad } from './$types';
@@ -48,29 +49,17 @@ export const actions: Actions = {
 
     const deadline = queryStart + POLL_TIMEOUT_MS;
     let columns: TrinoColumn[] = [];
-    let rows: unknown[][] = [];
+    const rows: unknown[][] = [];
+    let nextUri: string | undefined = `${connectionUrl}/v1/statement`;
+    let fetchOptions: RequestInit & { impersonateUser?: string } = {
+      method: 'POST',
+      body: sql.replace(/;\s*$/, '').trim(),
+      headers: { 'Content-Type': 'text/plain' },
+      impersonateUser
+    };
 
     try {
-      let response = await trinoFetch(`${connectionUrl}/v1/statement`, auth, {
-        method: 'POST',
-        body: sql.replace(/;\s*$/, '').trim(),
-        headers: { 'Content-Type': 'text/plain' },
-        impersonateUser
-      });
-
-      if (response.error) {
-        log.info({ err: response.error }, 'query error');
-        return message(
-          form,
-          { type: 'error', message: response.error.message } satisfies FormMessage,
-          { status: 400 }
-        );
-      }
-
-      if (response.columns) columns = response.columns;
-      if (response.data) rows = rows.concat(response.data);
-
-      while (response.nextUri && rows.length < MAX_CACHED_ROWS) {
+      while (nextUri && rows.length < MAX_CACHED_ROWS) {
         if (Date.now() > deadline) {
           log.info({ trino_url: connectionUrl, timeout_ms: POLL_TIMEOUT_MS }, 'query timed out');
           return message(
@@ -80,7 +69,7 @@ export const actions: Actions = {
           );
         }
 
-        response = await trinoFetch(response.nextUri, auth, { impersonateUser });
+        const response: TrinoResponse = await trinoFetch(nextUri, auth, fetchOptions);
 
         if (response.error) {
           log.info({ err: response.error }, 'query error');
@@ -92,7 +81,11 @@ export const actions: Actions = {
         }
 
         if (response.columns && columns.length === 0) columns = response.columns;
-        if (response.data) rows = rows.concat(response.data);
+        if (response.data) rows.push(...response.data);
+
+        nextUri = response.nextUri;
+        // Subsequent requests are GETs to the nextUri
+        fetchOptions = { impersonateUser };
       }
 
       const queryId = crypto.randomUUID();
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index 49a0791f..b76b490d 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+  import { onMount } from 'svelte';
   import * as m from '$lib/paraglide/messages.js';
   import MonacoEditor from '$lib/components/editor/MonacoEditor.svelte';
   import { superForm } from 'sveltekit-superforms';
@@ -18,15 +19,6 @@
     }
   }
 
-  // Connection config and SQL — local state persisted to localStorage.
-  let connectionUrl = $state(ls('trino_url', ''));
-  let authType = $state<'none' | 'basic'>(ls('trino_auth_type', 'none') as 'none' | 'basic');
-  let authUsername = $state(ls('trino_username', ''));
-  let authPassword = $state(ls('trino_password', ''));
-  let impersonation = $state(ls('trino_impersonation', 'false') === 'true');
-  let sql = $state(ls('trino_sql', 'SELECT 1'));
-  let pageSize = $state<25 | 50 | 100>(25);
-
   // Query result state — updated from form messages.
   let columns = $state<{ name: string; type: string }[]>([]);
   let rows = $state<unknown[][]>([]);
@@ -37,12 +29,17 @@
   let totalRows = $state<number | null>(null);
   let connectionOpen = $state(false);
 
-  // Query form — submits connection config + SQL as hidden inputs (FormData).
+  // Connection fingerprint used when the last query ran — null until first query.
+  let queriedConnKey = $state<string | null>(null);
+
+  // Query form
   const {
+    form: queryFormData,
     enhance: queryEnhance,
     submitting: querySubmitting,
     errors: queryErrors
   } = superForm(data.queryForm, {
+    dataType: 'json',
     onSubmit() {
       queryError = null;
       columns = [];
@@ -50,9 +47,9 @@
       queryId = null;
       totalRows = null;
       currentPage = 0;
+      queriedConnKey = connKey();
     },
     onUpdated({ form }) {
-      // Validation errors for connection fields — open the section so the user can see them.
       if (form.errors.connectionUrl) {
         connectionOpen = true;
         queryError = m.trino_connection_error();
@@ -72,7 +69,7 @@
     }
   });
 
-  // Paginate form — submits as JSON so store values are used directly.
+  // Paginate form
   const {
     form: paginateFormData,
     enhance: paginateEnhance,
@@ -95,31 +92,67 @@
     }
   });
 
+  let hydrated = $state(false);
+
+  onMount(() => {
+    $queryFormData.connectionUrl = ls('trino_url', '');
+    $queryFormData.authType = ls('trino_auth_type', 'none') as 'none' | 'basic';
+    $queryFormData.authUsername = ls('trino_username', '');
+    $queryFormData.authPassword = ls('trino_password', '');
+    $queryFormData.impersonation = ls('trino_impersonation', 'false') === 'true';
+    $queryFormData.sql = ls('trino_sql', 'SELECT 1');
+    $queryFormData.pageSize = parseInt(ls('trino_page_size', '25'), 10) as 25 | 50 | 100;
+    hydrated = true;
+  });
+
   const running = $derived($querySubmitting || $paginateSubmitting);
 
-  // Persist connection config; invalidate queryId on change.
+  const connKey = $derived(() => {
+    const { connectionUrl, authType, authUsername, authPassword, impersonation } = $queryFormData;
+    return `${connectionUrl}\0${authType}\0${authUsername}\0${authPassword}\0${impersonation}`;
+  });
+
+  // Invalidate results when connection settings change after a query.
+  $effect(() => {
+    const key = connKey();
+    if (queriedConnKey && key !== queriedConnKey) {
+      columns = [];
+      rows = [];
+      queryError = null;
+      queryId = null;
+      totalRows = null;
+      currentPage = 0;
+      hasMore = false;
+      queriedConnKey = null;
+    }
+  });
+
+  // Persist connection config & SQL.
   $effect(() => {
+    const { connectionUrl, authType, authUsername, authPassword, impersonation, sql, pageSize } =
+      $queryFormData;
+
+    if (!hydrated) return;
+
     localStorage.setItem('trino_url', connectionUrl);
     localStorage.setItem('trino_auth_type', authType);
     localStorage.setItem('trino_username', authUsername);
     localStorage.setItem('trino_password', authPassword);
     localStorage.setItem('trino_impersonation', String(impersonation));
-    queryId = null;
-  });
-
-  // Persist SQL.
-  $effect(() => {
     localStorage.setItem('trino_sql', sql);
+    localStorage.setItem('trino_page_size', String(pageSize));
   });
 
   const connectionSummary = $derived(() => {
-    const host = connectionUrl ? connectionUrl.replace(/^https?:\/\//, '').replace(/\/$/, '') : '—';
-    const auth = authType === 'basic' ? m.trino_auth_basic() : m.trino_auth_none();
+    const host = $queryFormData.connectionUrl
+      ? $queryFormData.connectionUrl.replace(/^https?:\/\//, '').replace(/\/$/, '')
+      : '—';
+    const auth = $queryFormData.authType === 'basic' ? m.trino_auth_basic() : m.trino_auth_none();
     return `${host} · ${auth}`;
   });
 
-  const rowStart = $derived(currentPage * pageSize + 1);
-  const rowEnd = $derived(currentPage * pageSize + rows.length);
+  const rowStart = $derived(currentPage * $queryFormData.pageSize + 1);
+  const rowEnd = $derived(currentPage * $queryFormData.pageSize + rows.length);
 
   let queryFormEl = $state<HTMLFormElement | undefined>(undefined);
   let paginateFormEl = $state<HTMLFormElement | undefined>(undefined);
@@ -134,7 +167,7 @@
     const prevPage = currentPage - 1;
     $paginateFormData.queryId = queryId!;
     $paginateFormData.page = prevPage;
-    $paginateFormData.pageSize = pageSize;
+    $paginateFormData.pageSize = $queryFormData.pageSize;
     currentPage = prevPage;
     paginateFormEl?.requestSubmit();
   }
@@ -143,17 +176,18 @@
     const nextPage = currentPage + 1;
     $paginateFormData.queryId = queryId!;
     $paginateFormData.page = nextPage;
-    $paginateFormData.pageSize = pageSize;
+    $paginateFormData.pageSize = $queryFormData.pageSize;
     currentPage = nextPage;
     paginateFormEl?.requestSubmit();
   }
 
   function handlePageSizeChange(event: Event) {
-    pageSize = parseInt((event.target as HTMLSelectElement).value, 10) as 25 | 50 | 100;
+    const size = parseInt((event.target as HTMLSelectElement).value, 10) as 25 | 50 | 100;
+    $queryFormData.pageSize = size;
     if (queryId) {
       $paginateFormData.queryId = queryId;
       $paginateFormData.page = 0;
-      $paginateFormData.pageSize = pageSize;
+      $paginateFormData.pageSize = size;
       currentPage = 0;
       paginateFormEl?.requestSubmit();
     }
@@ -163,17 +197,7 @@
 <svelte:window onkeydown={handleKeydown} />
 
 <div class="flex h-full flex-col gap-4">
-  <!-- Query form: wraps connection config + editor -->
   <form method="POST" action="?/query" use:queryEnhance bind:this={queryFormEl}>
-    <!-- Hidden inputs carry localStorage state to the server action -->
-    <input type="hidden" name="sql" value={sql} />
-    <input type="hidden" name="pageSize" value={pageSize} />
-    <input type="hidden" name="connectionUrl" value={connectionUrl} />
-    <input type="hidden" name="authType" value={authType} />
-    <input type="hidden" name="authUsername" value={authUsername} />
-    <input type="hidden" name="authPassword" value={authPassword} />
-    <input type="hidden" name="impersonation" value={impersonation} />
-
     <!-- Connection config section -->
     <div class="bg-base-100 border-base-300 collapse rounded-xl border">
       <input
@@ -200,7 +224,7 @@
             class="input input-sm w-full font-mono"
             class:input-error={$queryErrors.connectionUrl}
             placeholder={m.trino_connection_url_placeholder()}
-            bind:value={connectionUrl}
+            bind:value={$queryFormData.connectionUrl}
           />
           {#if $queryErrors.connectionUrl}
             <p class="text-error text-xs">{$queryErrors.connectionUrl?.join(' ')}</p>
@@ -218,7 +242,7 @@
               name="{uid}-auth"
               aria-label={m.trino_auth_none()}
               value="none"
-              bind:group={authType}
+              bind:group={$queryFormData.authType}
             />
             <input
               id="{uid}-auth-basic"
@@ -227,13 +251,13 @@
               name="{uid}-auth"
               aria-label={m.trino_auth_basic()}
               value="basic"
-              bind:group={authType}
+              bind:group={$queryFormData.authType}
             />
           </div>
         </div>
 
         <!-- Basic auth credentials -->
-        {#if authType === 'basic'}
+        {#if $queryFormData.authType === 'basic'}
           <div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
             <div class="flex flex-col gap-1">
               <label for="{uid}-auth-username" class="label text-sm">
@@ -244,7 +268,7 @@
                 type="text"
                 class="input input-sm font-mono"
                 autocomplete="username"
-                bind:value={authUsername}
+                bind:value={$queryFormData.authUsername}
               />
             </div>
             <div class="flex flex-col gap-1">
@@ -256,7 +280,7 @@
                 type="password"
                 class="input input-sm font-mono"
                 autocomplete="current-password"
-                bind:value={authPassword}
+                bind:value={$queryFormData.authPassword}
               />
             </div>
           </div>
@@ -269,7 +293,7 @@
               id="{uid}-impersonation"
               type="checkbox"
               class="toggle toggle-sm"
-              bind:checked={impersonation}
+              bind:checked={$queryFormData.impersonation}
             />
             <label for="{uid}-impersonation" class="flex flex-col">
               <span class="text-sm">{m.trino_impersonation()}</span>
@@ -303,7 +327,7 @@
       </div>
       <div class="h-64">
         <MonacoEditor
-          bind:value={sql}
+          bind:value={$queryFormData.sql}
           language="sql"
           onExecute={() => queryFormEl?.requestSubmit()}
         />
@@ -311,7 +335,7 @@
     </div>
   </form>
 
-  <!-- Hidden paginate form — buttons in the results section submit this via requestSubmit(). -->
+  <!-- Hidden paginate form -->
   <form
     method="POST"
     action="?/paginate"
@@ -413,7 +437,7 @@
           <select
             id="{uid}-page-size"
             class="select select-sm"
-            value={pageSize}
+            value={$queryFormData.pageSize}
             onchange={handlePageSizeChange}
             disabled={running}
           >
diff --git a/src/routes/(app)/trino/schemas.ts b/src/routes/(app)/trino/schemas.ts
index e88456d0..749618ec 100644
--- a/src/routes/(app)/trino/schemas.ts
+++ b/src/routes/(app)/trino/schemas.ts
@@ -10,10 +10,7 @@ export const QuerySchema = z.object({
   authType: z.enum(['none', 'basic']).default('none'),
   authUsername: z.string().default(''),
   authPassword: z.string().default(''),
-  impersonation: z
-    .string()
-    .default('false')
-    .transform((v) => v === 'true')
+  impersonation: z.boolean().default(false)
 });
 
 export const PaginateSchema = z.object({
diff --git a/src/routes/auth/logout/+page.server.ts b/src/routes/auth/logout/+page.server.ts
index 642da743..8a53d7b7 100644
--- a/src/routes/auth/logout/+page.server.ts
+++ b/src/routes/auth/logout/+page.server.ts
@@ -2,8 +2,10 @@ import { redirect } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
 import { auth } from '$lib/server/auth';
 
-export const load: PageServerLoad = async ({ request, cookies }) => {
-  await auth.api.signOut({ headers: request.headers });
-  cookies.delete('better-auth.session_token', { path: '/' });
+export const load: PageServerLoad = async ({ request, locals, cookies }) => {
+  if (locals.session) {
+    await auth.api.signOut({ headers: request.headers });
+    cookies.delete('better-auth.session_token', { path: '/' });
+  }
   throw redirect(302, '/auth/login');
 };

From 997a76efae2d323d81c914290a73a58e6c415232 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 2 Mar 2026 17:18:33 +0100
Subject: [PATCH 16/41] fix feedback from AI review

---
 .github/workflows/pr_checks.yaml              | 24 -----
 TECH_DEBT.md                                  |  8 ++
 .../helm/stackable-ui/templates/_helpers.tpl  | 11 ---
 .../stackable-ui/templates/configmap.yaml     |  6 +-
 .../stackable-ui/templates/deployment.yaml    | 23 ++---
 .../helm/stackable-ui/templates/secret.yaml   |  1 -
 deploy/helm/stackable-ui/values.yaml          | 12 +--
 src/app.d.ts                                  |  9 --
 src/lib/components/layout/Header.svelte       | 97 +++++++++----------
 src/lib/server/auth.ts                        | 46 +++++++--
 src/routes/(app)/trino/+page.server.ts        |  3 +-
 src/routes/(app)/trino/+page.svelte           |  6 +-
 src/routes/auth/login/+page.server.ts         |  9 +-
 src/routes/auth/logout/+page.server.ts        | 11 ++-
 14 files changed, 134 insertions(+), 132 deletions(-)

diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml
index 16cdeb49..7891c544 100644
--- a/.github/workflows/pr_checks.yaml
+++ b/.github/workflows/pr_checks.yaml
@@ -50,14 +50,6 @@ jobs:
   tests:
     name: E2E Tests
     runs-on: ubuntu-latest
-    env:
-      PLAYWRIGHT_BASE_URL: http://localhost:4173
-      BETTER_AUTH_URL: http://localhost:4173
-      BETTER_AUTH_SECRET: ci-secret-for-testing-only-not-production
-      AUTH_ISSUER: http://localhost:8080/default
-      AUTH_CLIENT_ID: stackable-ui
-      AUTH_CLIENT_SECRET: ci-client-secret
-      DATABASE_PATH: /tmp/auth-test.db
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -76,21 +68,5 @@ jobs:
       - name: Install Playwright browsers
         run: npx playwright install --with-deps chromium firefox
 
-      - name: Start mock OAuth2 server
-        run: |
-          docker run -d \
-            --name mock-oauth2 \
-            -p 8080:8080 \
-            ghcr.io/navikt/mock-oauth2-server:2.1.10
-          timeout 30 bash -c 'until curl -sf http://localhost:8080/default/.well-known/openid-configuration > /dev/null; do sleep 1; done'
-
-      - name: Build application
-        run: npm run build
-
-      - name: Start application
-        run: |
-          npm run preview &
-          timeout 60 bash -c 'until curl -sf http://localhost:4173 > /dev/null; do sleep 1; done'
-
       - name: Run E2E tests
         run: npm run test:e2e
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index 88998f8b..1dbc88e7 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -38,6 +38,14 @@ Trino error messages and Node.js exception messages are returned to the browser
 
 ---
 
+### SQLite session store prevents horizontal scaling
+
+**File:** `src/lib/server/auth.ts`, `deploy/helm/stackable-ui/values.yaml`
+
+better-auth uses SQLite (via better-sqlite3) for session and user storage. SQLite only supports a single writer, so the deployment is limited to `replicaCount: 1`. A single pod failure means complete downtime with no failover. The long-term fix is to switch to PostgreSQL or a stateless session store (JWT/Redis) to allow horizontal scaling.
+
+---
+
 ## API & Validation
 
 ### API route request body not validated with Zod
diff --git a/deploy/helm/stackable-ui/templates/_helpers.tpl b/deploy/helm/stackable-ui/templates/_helpers.tpl
index 517552a9..80e8388b 100644
--- a/deploy/helm/stackable-ui/templates/_helpers.tpl
+++ b/deploy/helm/stackable-ui/templates/_helpers.tpl
@@ -74,17 +74,6 @@ Generate session secret
 {{- end }}
 {{- end }}
 
-{{/*
-Generate Better Auth secret
-*/}}
-{{- define "stackable-ui.betterAuthSecret" -}}
-{{- if .Values.auth.secret }}
-{{- .Values.auth.secret }}
-{{- else }}
-{{- randAlphaNum 64 }}
-{{- end }}
-{{- end }}
-
 {{/*
 Image name
 */}}
diff --git a/deploy/helm/stackable-ui/templates/configmap.yaml b/deploy/helm/stackable-ui/templates/configmap.yaml
index 26c8a47d..4423e0c7 100644
--- a/deploy/helm/stackable-ui/templates/configmap.yaml
+++ b/deploy/helm/stackable-ui/templates/configmap.yaml
@@ -5,6 +5,6 @@ metadata:
   labels:
     {{- include "stackable-ui.labels" . | nindent 4 }}
 data:
-  auth-issuer: {{ .Values.auth.issuer | quote }}
-  auth-client-id: {{ .Values.auth.clientId | quote }}
-  better-auth-url: {{ .Values.auth.url | quote }}
+  oidc-discovery-url: {{ .Values.auth.discoveryUrl | quote }}
+  oidc-client-id: {{ .Values.auth.clientId | quote }}
+  base-url: {{ .Values.auth.baseUrl | quote }}
diff --git a/deploy/helm/stackable-ui/templates/deployment.yaml b/deploy/helm/stackable-ui/templates/deployment.yaml
index e9ccebe7..99785146 100644
--- a/deploy/helm/stackable-ui/templates/deployment.yaml
+++ b/deploy/helm/stackable-ui/templates/deployment.yaml
@@ -58,37 +58,32 @@ spec:
               value: {{ .Values.config.nodeEnv | quote }}
             - name: PORT
               value: {{ .Values.service.targetPort | quote }}
-            - name: SESSION_SECRET
+            - name: STACKABLE_UI_SESSION_SECRET
               valueFrom:
                 secretKeyRef:
                   name: {{ include "stackable-ui.fullname" . }}
                   key: session-secret
-            - name: BETTER_AUTH_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "stackable-ui.fullname" . }}
-                  key: better-auth-secret
-            - name: AUTH_CLIENT_SECRET
+            - name: STACKABLE_UI_OIDC_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
                   name: {{ include "stackable-ui.fullname" . }}
                   key: oidc-client-secret
-            - name: BETTER_AUTH_URL
+            - name: STACKABLE_UI_BASE_URL
               valueFrom:
                 configMapKeyRef:
                   name: {{ include "stackable-ui.fullname" . }}
-                  key: better-auth-url
-            - name: AUTH_ISSUER
+                  key: base-url
+            - name: STACKABLE_UI_OIDC_DISCOVERY_URL
               valueFrom:
                 configMapKeyRef:
                   name: {{ include "stackable-ui.fullname" . }}
-                  key: auth-issuer
-            - name: AUTH_CLIENT_ID
+                  key: oidc-discovery-url
+            - name: STACKABLE_UI_OIDC_CLIENT_ID
               valueFrom:
                 configMapKeyRef:
                   name: {{ include "stackable-ui.fullname" . }}
-                  key: auth-client-id
-            - name: DATABASE_PATH
+                  key: oidc-client-id
+            - name: STACKABLE_UI_SQLITE_PATH
               value: {{ .Values.config.databasePath | quote }}
           volumeMounts:
             - name: tmp
diff --git a/deploy/helm/stackable-ui/templates/secret.yaml b/deploy/helm/stackable-ui/templates/secret.yaml
index daaf4ba7..47c003da 100644
--- a/deploy/helm/stackable-ui/templates/secret.yaml
+++ b/deploy/helm/stackable-ui/templates/secret.yaml
@@ -7,5 +7,4 @@ metadata:
 type: Opaque
 stringData:
   session-secret: {{ include "stackable-ui.sessionSecret" . | quote }}
-  better-auth-secret: {{ include "stackable-ui.betterAuthSecret" . | quote }}
   oidc-client-secret: {{ .Values.auth.clientSecret | quote }}
diff --git a/deploy/helm/stackable-ui/values.yaml b/deploy/helm/stackable-ui/values.yaml
index 4ba2a577..5879a9d7 100644
--- a/deploy/helm/stackable-ui/values.yaml
+++ b/deploy/helm/stackable-ui/values.yaml
@@ -121,16 +121,14 @@ config:
 # Session secret for signing cookies (auto-generated if not provided)
 sessionSecret: ""
 
-# Better Auth configuration
+# OIDC authentication configuration
 auth:
   # The publicly accessible base URL of this application (used for OIDC callback URLs)
   # Required. Example: https://stackable-ui.example.com
-  url: ""
-  # Better Auth secret — long random string (min 32 chars). Auto-generated if not provided.
-  secret: ""
-  # OIDC provider issuer URL (without /.well-known/openid-configuration suffix)
-  # Required. Example: https://your-idp.example.com/realms/your-realm
-  issuer: ""
+  baseUrl: ""
+  # OIDC discovery URL (the full .well-known/openid-configuration URL)
+  # Required. Example: https://your-idp.example.com/realms/your-realm/.well-known/openid-configuration
+  discoveryUrl: ""
   # Client ID registered in the OIDC provider
   # Required.
   clientId: ""
diff --git a/src/app.d.ts b/src/app.d.ts
index 00fc6063..e5a74c6e 100644
--- a/src/app.d.ts
+++ b/src/app.d.ts
@@ -18,15 +18,6 @@ declare global {
     // interface PageState {}
     // interface Platform {}
   }
-
-  namespace svelteHTML {
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    interface HTMLAttributes<T> {
-      popover?: boolean | '' | 'auto' | 'manual';
-      popovertarget?: string;
-      popovertargetaction?: 'show' | 'hide' | 'toggle';
-    }
-  }
 }
 
 export {};
diff --git a/src/lib/components/layout/Header.svelte b/src/lib/components/layout/Header.svelte
index 243e6d35..1e6070bf 100644
--- a/src/lib/components/layout/Header.svelte
+++ b/src/lib/components/layout/Header.svelte
@@ -62,56 +62,51 @@
   <div class="flex items-center gap-1">
     <LanguageSwitcher />
     <ThemeToggle />
-    <button
-      class="btn btn-ghost btn-circle"
-      aria-label={m.header_user_menu()}
-      popovertarget="user-menu"
-      style="anchor-name:--user-menu"
-    >
-      {#if user?.image}
-        <img src={user.image} alt={user.name ?? ''} class="h-8 w-8 rounded-full object-cover" />
-      {:else}
-        <span
-          class="bg-primary/10 text-primary flex h-8 w-8 items-center justify-center rounded-full text-xs font-semibold"
-          aria-hidden="true"
-        >
-          {initials}
-        </span>
-      {/if}
-    </button>
+    <div class="dropdown dropdown-end">
+      <button tabindex="0" class="btn btn-ghost btn-circle" aria-label={m.header_user_menu()}>
+        {#if user?.image}
+          <img src={user.image} alt={user.name ?? ''} class="h-8 w-8 rounded-full object-cover" />
+        {:else}
+          <span
+            class="bg-primary/10 text-primary flex h-8 w-8 items-center justify-center rounded-full text-xs font-semibold"
+            aria-hidden="true"
+          >
+            {initials}
+          </span>
+        {/if}
+      </button>
+      <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
+      <ul
+        tabindex="0"
+        class="dropdown-content menu bg-base-100 border-base-300 z-10 w-56 rounded-lg border p-1 shadow-lg"
+      >
+        {#if user}
+          <li class="px-3 py-2">
+            <p class="text-base-content truncate text-sm font-semibold">{user.name}</p>
+            <p class="text-base-content/60 truncate text-xs">{user.email}</p>
+          </li>
+          <li><hr class="border-base-300 my-1" /></li>
+        {/if}
+        <li>
+          <a href="/auth/logout" class="text-sm">
+            <svg
+              class="h-4 w-4"
+              aria-hidden="true"
+              viewBox="0 0 24 24"
+              fill="none"
+              stroke="currentColor"
+              stroke-width="1.5"
+              stroke-linecap="round"
+              stroke-linejoin="round"
+            >
+              <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4" />
+              <polyline points="16 17 21 12 16 7" />
+              <line x1="21" y1="12" x2="9" y2="12" />
+            </svg>
+            {m.header_sign_out()}
+          </a>
+        </li>
+      </ul>
+    </div>
   </div>
 </header>
-
-<ul
-  class="dropdown dropdown-end menu bg-base-100 border-base-300 w-56 rounded-lg border p-1 shadow-lg"
-  popover
-  id="user-menu"
-  style="position-anchor:--user-menu"
->
-  {#if user}
-    <li class="px-3 py-2">
-      <p class="text-base-content truncate text-sm font-semibold">{user.name}</p>
-      <p class="text-base-content/60 truncate text-xs">{user.email}</p>
-    </li>
-    <li><hr class="border-base-300 my-1" /></li>
-  {/if}
-  <li>
-    <a href="/auth/logout" class="text-sm">
-      <svg
-        class="h-4 w-4"
-        aria-hidden="true"
-        viewBox="0 0 24 24"
-        fill="none"
-        stroke="currentColor"
-        stroke-width="1.5"
-        stroke-linecap="round"
-        stroke-linejoin="round"
-      >
-        <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4" />
-        <polyline points="16 17 21 12 16 7" />
-        <line x1="21" y1="12" x2="9" y2="12" />
-      </svg>
-      {m.header_sign_out()}
-    </a>
-  </li>
-</ul>
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index 517da483..371a8185 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -11,21 +11,52 @@ try {
   env = process.env as Record<string, string | undefined>;
 }
 
+function requireEnv(name: string): string {
+  const value = env[name];
+  if (!value) {
+    throw new Error(`Missing required environment variable: ${name}`);
+  }
+  return value;
+}
+
+// Cache the OIDC discovery metadata (fetched once at startup) so the
+// end_session_endpoint is available for logout without a per-request fetch.
+export let oidcEndSessionEndpoint: string | undefined;
+
+const discoveryUrl = requireEnv('STACKABLE_UI_OIDC_DISCOVERY_URL');
+
+try {
+  const res = await fetch(discoveryUrl);
+  const discovery = await res.json();
+  oidcEndSessionEndpoint = discovery.end_session_endpoint;
+} catch {
+  // Discovery fetch may fail during CLI migrations or when the IdP is
+  // unreachable at startup. Logout will fall back to local-only sign-out.
+}
+
 export const auth = betterAuth({
-  secret: env.STACKABLE_UI_SESSION_SECRET,
-  baseURL: env.STACKABLE_UI_BASE_URL,
-  database: new Database(env.STACKABLE_UI_SQLITE_PATH ?? '.data/auth.db'),
+  secret: requireEnv('STACKABLE_UI_SESSION_SECRET'),
+  baseURL: requireEnv('STACKABLE_UI_BASE_URL'),
+  database: new Database(requireEnv('STACKABLE_UI_SQLITE_PATH')),
   session: {
     cookieCache: { enabled: true, maxAge: 5 * 60 }
   },
+  user: {
+    additionalFields: {
+      username: {
+        type: 'string',
+        required: false
+      }
+    }
+  },
   plugins: [
     genericOAuth({
       config: [
         {
           providerId: 'oidc',
-          discoveryUrl: env.STACKABLE_UI_OIDC_DISCOVERY_URL,
-          clientId: env.STACKABLE_UI_OIDC_CLIENT_ID!,
-          clientSecret: env.STACKABLE_UI_OIDC_CLIENT_SECRET!,
+          discoveryUrl: requireEnv('STACKABLE_UI_OIDC_DISCOVERY_URL'),
+          clientId: requireEnv('STACKABLE_UI_OIDC_CLIENT_ID'),
+          clientSecret: requireEnv('STACKABLE_UI_OIDC_CLIENT_SECRET'),
           scopes: ['openid', 'profile', 'email'],
           pkce: true,
           mapProfileToUser: async (profile) => {
@@ -33,7 +64,8 @@ export const auth = betterAuth({
             return {
               name: profile.name || fullName || profile.preferred_username || profile.email,
               email: profile.email || profile.preferred_username,
-              image: profile.picture || null
+              image: profile.picture || null,
+              username: profile.preferred_username || profile.email
             };
           }
         }
diff --git a/src/routes/(app)/trino/+page.server.ts b/src/routes/(app)/trino/+page.server.ts
index 5df717f3..897b14ba 100644
--- a/src/routes/(app)/trino/+page.server.ts
+++ b/src/routes/(app)/trino/+page.server.ts
@@ -40,7 +40,8 @@ export const actions: Actions = {
       authType === 'basic'
         ? { type: 'basic', username: authUsername, password: authPassword }
         : { type: 'none' };
-    const impersonateUser = impersonation && locals.user?.name ? locals.user.name : undefined;
+    const impersonateUser =
+      impersonation && locals.user?.username ? locals.user.username : undefined;
 
     evictStale();
 
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index b76b490d..c44f129f 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -40,6 +40,8 @@
     errors: queryErrors
   } = superForm(data.queryForm, {
     dataType: 'json',
+    invalidateAll: false,
+    resetForm: false,
     onSubmit() {
       queryError = null;
       columns = [];
@@ -287,7 +289,7 @@
         {/if}
 
         <!-- User impersonation -->
-        {#if data.user?.name}
+        {#if data.user?.username}
           <div class="flex items-center gap-3">
             <input
               id="{uid}-impersonation"
@@ -298,7 +300,7 @@
             <label for="{uid}-impersonation" class="flex flex-col">
               <span class="text-sm">{m.trino_impersonation()}</span>
               <span class="text-base-content/50 text-xs">
-                {m.trino_impersonation_description({ user: data.user.name })}
+                {m.trino_impersonation_description({ user: data.user.username })}
               </span>
             </label>
           </div>
diff --git a/src/routes/auth/login/+page.server.ts b/src/routes/auth/login/+page.server.ts
index 3e438def..9f376d6e 100644
--- a/src/routes/auth/login/+page.server.ts
+++ b/src/routes/auth/login/+page.server.ts
@@ -1,12 +1,19 @@
 import { redirect } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
 
+function sanitiseRedirectTo(value: string | null): string {
+  if (!value || !value.startsWith('/') || value.startsWith('//')) {
+    return '/';
+  }
+  return value;
+}
+
 export const load: PageServerLoad = async ({ locals, url }) => {
   if (locals.user) {
     throw redirect(302, '/');
   }
 
-  const redirectTo = url.searchParams.get('redirectTo') ?? '/';
+  const redirectTo = sanitiseRedirectTo(url.searchParams.get('redirectTo'));
 
   return { redirectTo };
 };
diff --git a/src/routes/auth/logout/+page.server.ts b/src/routes/auth/logout/+page.server.ts
index 8a53d7b7..23aeaf55 100644
--- a/src/routes/auth/logout/+page.server.ts
+++ b/src/routes/auth/logout/+page.server.ts
@@ -1,11 +1,20 @@
 import { redirect } from '@sveltejs/kit';
+import { env } from '$env/dynamic/private';
 import type { PageServerLoad } from './$types';
-import { auth } from '$lib/server/auth';
+import { auth, oidcEndSessionEndpoint } from '$lib/server/auth';
 
 export const load: PageServerLoad = async ({ request, locals, cookies }) => {
   if (locals.session) {
     await auth.api.signOut({ headers: request.headers });
     cookies.delete('better-auth.session_token', { path: '/' });
   }
+
+  // RP-initiated logout: redirect to the IdP so the SSO session is terminated
+  if (oidcEndSessionEndpoint) {
+    const url = new URL(oidcEndSessionEndpoint);
+    url.searchParams.set('post_logout_redirect_uri', `${env.STACKABLE_UI_BASE_URL}/auth/login`);
+    throw redirect(302, url.toString());
+  }
+
   throw redirect(302, '/auth/login');
 };

From 8341ae1bb63097b632ae24b366b888a14cbf55e4 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 2 Mar 2026 17:20:41 +0100
Subject: [PATCH 17/41] make claim used for username configurable via env

---
 .env.example                                       | 3 +++
 deploy/helm/stackable-ui/templates/deployment.yaml | 4 ++++
 deploy/helm/stackable-ui/values.yaml               | 2 ++
 src/lib/server/auth.ts                             | 3 ++-
 4 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index a444ae5f..7ed7939d 100644
--- a/.env.example
+++ b/.env.example
@@ -11,6 +11,9 @@ STACKABLE_UI_OIDC_DISCOVERY_URL=https://your-idp.example.com/realms/your-realm/.
 STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
 STACKABLE_UI_OIDC_CLIENT_SECRET=your-client-secret
 
+# OIDC claim used as the username for Trino impersonation (default: preferred_username)
+# STACKABLE_UI_OIDC_USERNAME_CLAIM=preferred_username
+
 # Path to the SQLite database file (must be on a persistent volume in Kubernetes)
 STACKABLE_UI_SQLITE_PATH=/data/auth.db
 
diff --git a/deploy/helm/stackable-ui/templates/deployment.yaml b/deploy/helm/stackable-ui/templates/deployment.yaml
index 99785146..9011b143 100644
--- a/deploy/helm/stackable-ui/templates/deployment.yaml
+++ b/deploy/helm/stackable-ui/templates/deployment.yaml
@@ -85,6 +85,10 @@ spec:
                   key: oidc-client-id
             - name: STACKABLE_UI_SQLITE_PATH
               value: {{ .Values.config.databasePath | quote }}
+            {{- if .Values.auth.usernameClaim }}
+            - name: STACKABLE_UI_OIDC_USERNAME_CLAIM
+              value: {{ .Values.auth.usernameClaim | quote }}
+            {{- end }}
           volumeMounts:
             - name: tmp
               mountPath: /tmp
diff --git a/deploy/helm/stackable-ui/values.yaml b/deploy/helm/stackable-ui/values.yaml
index 5879a9d7..a3776718 100644
--- a/deploy/helm/stackable-ui/values.yaml
+++ b/deploy/helm/stackable-ui/values.yaml
@@ -135,6 +135,8 @@ auth:
   # Client secret registered in the OIDC provider
   # Required.
   clientSecret: ""
+  # OIDC claim used as the username for Trino impersonation (default: preferred_username)
+  usernameClaim: ""
 
 # SQLite persistence for the Better Auth database.
 # NOTE: Requires replicaCount: 1 — SQLite does not support concurrent writes from multiple pods.
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index 371a8185..a5ec69b0 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -24,6 +24,7 @@ function requireEnv(name: string): string {
 export let oidcEndSessionEndpoint: string | undefined;
 
 const discoveryUrl = requireEnv('STACKABLE_UI_OIDC_DISCOVERY_URL');
+const usernameClaim = env.STACKABLE_UI_OIDC_USERNAME_CLAIM ?? 'preferred_username';
 
 try {
   const res = await fetch(discoveryUrl);
@@ -65,7 +66,7 @@ export const auth = betterAuth({
               name: profile.name || fullName || profile.preferred_username || profile.email,
               email: profile.email || profile.preferred_username,
               image: profile.picture || null,
-              username: profile.preferred_username || profile.email
+              username: profile[usernameClaim] || profile.preferred_username || profile.email
             };
           }
         }

From c0bfd9a2899f5c5c29acbe2a3af0c41e8df10ca1 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 2 Mar 2026 17:30:46 +0100
Subject: [PATCH 18/41] Update package-lock.json

---
 package-lock.json | 448 ++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 396 insertions(+), 52 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e13e31ea..863d8df5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -91,6 +91,390 @@
       "resolved": "https://registry.npmjs.org/@better-fetch/fetch/-/fetch-1.1.21.tgz",
       "integrity": "sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A=="
     },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
+      "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz",
+      "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz",
+      "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz",
+      "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz",
+      "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz",
+      "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz",
+      "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz",
+      "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz",
+      "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz",
+      "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz",
+      "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==",
+      "cpu": [
+        "loong64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz",
+      "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==",
+      "cpu": [
+        "mips64el"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz",
+      "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz",
+      "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz",
+      "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==",
+      "cpu": [
+        "s390x"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.3.tgz",
+      "integrity": "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz",
+      "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz",
+      "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz",
+      "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz",
+      "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz",
+      "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@eslint-community/eslint-utils": {
       "version": "4.9.1",
       "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
@@ -710,7 +1094,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -724,7 +1107,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -738,7 +1120,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -752,7 +1133,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -766,7 +1146,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -780,7 +1159,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -794,7 +1172,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -808,7 +1185,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -822,7 +1198,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -836,7 +1211,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -850,7 +1224,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -864,7 +1237,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -878,7 +1250,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -892,7 +1263,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -906,7 +1276,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -920,7 +1289,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -934,7 +1302,6 @@
       "cpu": [
         "s390x"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -948,7 +1315,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -962,7 +1328,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -976,7 +1341,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -990,7 +1354,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1004,7 +1367,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1018,7 +1380,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1032,7 +1393,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1046,7 +1406,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1551,7 +1910,7 @@
       "version": "24.10.13",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.10.13.tgz",
       "integrity": "sha512-oH72nZRfDv9lADUBSo104Aq7gPHpQZc4BTx38r9xf9pg5LfP6EzSyH2n7qFmmxRQXh7YlUXODcYsg6PuTDSxGg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "undici-types": "~7.16.0"
@@ -1942,7 +2301,7 @@
       "version": "4.0.18",
       "resolved": "https://registry.npmjs.org/@vitest/browser/-/browser-4.0.18.tgz",
       "integrity": "sha512-gVQqh7paBz3gC+ZdcCmNSWJMk70IUjDeVqi+5m5vYpEHsIwRgw3Y545jljtajhkekIpIp5Gg8oK7bctgY0E2Ng==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@vitest/mocker": "4.0.18",
@@ -1965,7 +2324,7 @@
       "version": "4.0.18",
       "resolved": "https://registry.npmjs.org/@vitest/browser-playwright/-/browser-playwright-4.0.18.tgz",
       "integrity": "sha512-gfajTHVCiwpxRj1qh0Sh/5bbGLG4F/ZH/V9xvFVoFddpITfMta9YGow0W6ZpTTORv2vdJuz9TnrNSmjKvpOf4g==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@vitest/browser": "4.0.18",
@@ -3713,7 +4072,6 @@
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
       "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -4082,7 +4440,7 @@
       "version": "2.6.1",
       "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
       "integrity": "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "bin": {
         "jiti": "lib/jiti-cli.mjs"
@@ -4254,7 +4612,7 @@
       "version": "1.31.1",
       "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.31.1.tgz",
       "integrity": "sha512-l51N2r93WmGUye3WuFoN5k10zyvrVs0qfKBhyC5ogUQ6Ew6JUSswh78mbSO+IU3nTWsyOArqPCcShdQSadghBQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MPL-2.0",
       "dependencies": {
         "detect-libc": "^2.0.3"
@@ -4287,7 +4645,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4308,7 +4665,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4329,7 +4685,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4350,7 +4705,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4371,7 +4725,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4392,7 +4745,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4413,7 +4765,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4434,7 +4785,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4455,7 +4805,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4476,7 +4825,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4497,7 +4845,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -5109,7 +5456,7 @@
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/pixelmatch/-/pixelmatch-7.1.0.tgz",
       "integrity": "sha512-1wrVzJ2STrpmONHKBy228LM1b84msXDUoAzVEl0R8Mz4Ce6EPr+IVtxm8+yvrqLYMHswREkjYFaMxnyGnaY3Ng==",
-      "dev": true,
+      "devOptional": true,
       "license": "ISC",
       "dependencies": {
         "pngjs": "^7.0.0"
@@ -5122,7 +5469,7 @@
       "version": "1.58.2",
       "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
       "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "playwright-core": "1.58.2"
@@ -5141,7 +5488,7 @@
       "version": "1.58.2",
       "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
       "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "bin": {
         "playwright-core": "cli.js"
@@ -5154,7 +5501,7 @@
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-7.0.0.tgz",
       "integrity": "sha512-LKWqWJRhstyYo9pGvgor/ivk2w94eSjE3RGVuzLGlr3NmD8bf7RcYGze1mNdEHRP6TRP6rMuDHk5t44hnTRyow==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=14.19.0"
@@ -6677,7 +7024,7 @@
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "bin": {
         "tsc": "bin/tsc",
@@ -6715,7 +7062,7 @@
       "version": "7.16.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
       "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/unpipe": {
@@ -6899,7 +7246,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6916,7 +7262,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6972,7 +7317,6 @@
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
       "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -7151,7 +7495,7 @@
       "version": "8.19.0",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
       "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

From d9459bddb742facb0935b8f5b233f1d3ab7a5579 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 2 Mar 2026 20:07:32 +0100
Subject: [PATCH 19/41] fix CI checks

---
 docker/Dockerfile   | 11 ++++++++++-
 e2e/global-setup.ts |  4 ++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index a0def829..703e8c21 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -56,7 +56,16 @@ COPY messages/ ./messages/
 COPY svelte.config.js tsconfig.json vite.config.ts ./
 
 # Build the application
-RUN npm run build
+# Dummy values satisfy the module-level env validation in auth.ts during the
+# SvelteKit build. They are never used at runtime — real values are injected
+# via Kubernetes env vars / .env files.
+RUN STACKABLE_UI_SESSION_SECRET=build-placeholder \
+    STACKABLE_UI_BASE_URL=http://localhost \
+    STACKABLE_UI_OIDC_DISCOVERY_URL=http://localhost \
+    STACKABLE_UI_OIDC_CLIENT_ID=build \
+    STACKABLE_UI_OIDC_CLIENT_SECRET=build \
+    STACKABLE_UI_SQLITE_PATH=/tmp/build.db \
+    npm run build
 
 # Install only production dependencies
 RUN --mount=type=cache,target=/root/.npm npm ci --omit dev
diff --git a/e2e/global-setup.ts b/e2e/global-setup.ts
index 704884e5..b4f2c8a0 100644
--- a/e2e/global-setup.ts
+++ b/e2e/global-setup.ts
@@ -1,5 +1,6 @@
 import path from 'path';
 import { execSync } from 'child_process';
+import { mkdirSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { startMockOidc } from './mock-oidc-server.js';
 
@@ -8,6 +9,9 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 export default async function globalSetup() {
   await startMockOidc();
 
+  // Ensure the .data directory exists for the SQLite database
+  mkdirSync(path.join(__dirname, '..', '.data'), { recursive: true });
+
   // Run database migration with test env vars
   execSync('npx @better-auth/cli@latest migrate --yes', {
     cwd: path.join(__dirname, '..'),

From 1cba644ef3bbe9e62219520a9737b861d8b1dbb4 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Tue, 3 Mar 2026 12:06:46 +0100
Subject: [PATCH 20/41] fix ci errors

---
 .data/.gitkeep                      |  0
 .gitignore                          |  3 +-
 docker/Dockerfile                   | 11 +---
 e2e/global-setup.ts                 | 25 +++++---
 e2e/global-teardown.ts              |  2 -
 e2e/start-mock-oidc.ts              |  3 +
 playwright.config.ts                | 17 ++++--
 src/lib/server/auth.ts              | 90 +++++++++++++++--------------
 src/routes/(app)/trino/+page.svelte |  1 +
 9 files changed, 84 insertions(+), 68 deletions(-)
 create mode 100644 .data/.gitkeep
 create mode 100644 e2e/start-mock-oidc.ts

diff --git a/.data/.gitkeep b/.data/.gitkeep
new file mode 100644
index 00000000..e69de29b
diff --git a/.gitignore b/.gitignore
index aa194a00..554bfdc6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,4 +36,5 @@ e2e/.auth
 # Paraglide
 src/lib/paraglide
 project.inlang/cache/
-.data/
+.data/*
+!.data/.gitkeep
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 703e8c21..a0def829 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -56,16 +56,7 @@ COPY messages/ ./messages/
 COPY svelte.config.js tsconfig.json vite.config.ts ./
 
 # Build the application
-# Dummy values satisfy the module-level env validation in auth.ts during the
-# SvelteKit build. They are never used at runtime — real values are injected
-# via Kubernetes env vars / .env files.
-RUN STACKABLE_UI_SESSION_SECRET=build-placeholder \
-    STACKABLE_UI_BASE_URL=http://localhost \
-    STACKABLE_UI_OIDC_DISCOVERY_URL=http://localhost \
-    STACKABLE_UI_OIDC_CLIENT_ID=build \
-    STACKABLE_UI_OIDC_CLIENT_SECRET=build \
-    STACKABLE_UI_SQLITE_PATH=/tmp/build.db \
-    npm run build
+RUN npm run build
 
 # Install only production dependencies
 RUN --mount=type=cache,target=/root/.npm npm ci --omit dev
diff --git a/e2e/global-setup.ts b/e2e/global-setup.ts
index b4f2c8a0..eb2d6be3 100644
--- a/e2e/global-setup.ts
+++ b/e2e/global-setup.ts
@@ -1,23 +1,32 @@
 import path from 'path';
 import { execSync } from 'child_process';
-import { mkdirSync } from 'fs';
+import { readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
-import { startMockOidc } from './mock-oidc-server.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
-export default async function globalSetup() {
-  await startMockOidc();
+function parseEnvFile(filePath: string): Record<string, string> {
+  const content = readFileSync(filePath, 'utf-8');
+  const vars: Record<string, string> = {};
+  for (const line of content.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const eqIndex = trimmed.indexOf('=');
+    if (eqIndex === -1) continue;
+    vars[trimmed.slice(0, eqIndex)] = trimmed.slice(eqIndex + 1);
+  }
+  return vars;
+}
 
-  // Ensure the .data directory exists for the SQLite database
-  mkdirSync(path.join(__dirname, '..', '.data'), { recursive: true });
+export default async function globalSetup() {
+  const testEnv = parseEnvFile(path.join(__dirname, '..', '.env.test'));
 
-  // Run database migration with test env vars
+  // Run database migration with all test env vars so the OIDC plugin tables are created
   execSync('npx @better-auth/cli@latest migrate --yes', {
     cwd: path.join(__dirname, '..'),
     env: {
       ...process.env,
-      STACKABLE_UI_SQLITE_PATH: '.data/test-auth.db'
+      ...testEnv
     },
     stdio: 'inherit'
   });
diff --git a/e2e/global-teardown.ts b/e2e/global-teardown.ts
index e727e800..bc76c08f 100644
--- a/e2e/global-teardown.ts
+++ b/e2e/global-teardown.ts
@@ -1,9 +1,7 @@
 import { rm } from 'node:fs/promises';
-import { stopMockOidc } from './mock-oidc-server.js';
 
 const TEST_DB = '.data/test-auth.db';
 
 export default async function globalTeardown() {
-  await stopMockOidc();
   await rm(TEST_DB, { force: true });
 }
diff --git a/e2e/start-mock-oidc.ts b/e2e/start-mock-oidc.ts
new file mode 100644
index 00000000..2ae30587
--- /dev/null
+++ b/e2e/start-mock-oidc.ts
@@ -0,0 +1,3 @@
+import { startMockOidc } from './mock-oidc-server.js';
+
+await startMockOidc();
diff --git a/playwright.config.ts b/playwright.config.ts
index 2bbb6004..a9607d8d 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -19,11 +19,18 @@ export default defineConfig({
     trace: 'retain-on-failure',
     video: 'retain-on-failure'
   },
-  webServer: {
-    command: `npm run dev -- --mode test --port 4173`,
-    url: baseURL,
-    reuseExistingServer: false
-  },
+  webServer: [
+    {
+      command: 'npx tsx e2e/start-mock-oidc.ts',
+      url: 'http://localhost:9090/.well-known/openid-configuration',
+      reuseExistingServer: false
+    },
+    {
+      command: `npm run dev -- --mode test --port 4173`,
+      url: baseURL,
+      reuseExistingServer: false
+    }
+  ],
   projects: [
     {
       name: 'setup',
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index a5ec69b0..bd1d24ac 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -11,34 +11,36 @@ try {
   env = process.env as Record<string, string | undefined>;
 }
 
-function requireEnv(name: string): string {
-  const value = env[name];
-  if (!value) {
-    throw new Error(`Missing required environment variable: ${name}`);
-  }
-  return value;
-}
+const usernameClaim = env.STACKABLE_UI_OIDC_USERNAME_CLAIM ?? 'preferred_username';
+
+// OIDC is enabled only when all required OIDC env vars are present.
+const oidcEnabled = !!(
+  env.STACKABLE_UI_OIDC_DISCOVERY_URL &&
+  env.STACKABLE_UI_OIDC_CLIENT_ID &&
+  env.STACKABLE_UI_OIDC_CLIENT_SECRET
+);
 
 // Cache the OIDC discovery metadata (fetched once at startup) so the
 // end_session_endpoint is available for logout without a per-request fetch.
 export let oidcEndSessionEndpoint: string | undefined;
 
-const discoveryUrl = requireEnv('STACKABLE_UI_OIDC_DISCOVERY_URL');
-const usernameClaim = env.STACKABLE_UI_OIDC_USERNAME_CLAIM ?? 'preferred_username';
-
-try {
-  const res = await fetch(discoveryUrl);
-  const discovery = await res.json();
-  oidcEndSessionEndpoint = discovery.end_session_endpoint;
-} catch {
-  // Discovery fetch may fail during CLI migrations or when the IdP is
-  // unreachable at startup. Logout will fall back to local-only sign-out.
+if (oidcEnabled) {
+  try {
+    const res = await fetch(env.STACKABLE_UI_OIDC_DISCOVERY_URL!);
+    const discovery = await res.json();
+    oidcEndSessionEndpoint = discovery.end_session_endpoint;
+  } catch (err) {
+    console.warn(
+      'Failed to fetch OIDC discovery for end_session_endpoint, logout will be local-only:',
+      err
+    );
+  }
 }
 
 export const auth = betterAuth({
-  secret: requireEnv('STACKABLE_UI_SESSION_SECRET'),
-  baseURL: requireEnv('STACKABLE_UI_BASE_URL'),
-  database: new Database(requireEnv('STACKABLE_UI_SQLITE_PATH')),
+  secret: env.STACKABLE_UI_SESSION_SECRET,
+  baseURL: env.STACKABLE_UI_BASE_URL,
+  database: new Database(env.STACKABLE_UI_SQLITE_PATH ?? '.data/auth.db'),
   session: {
     cookieCache: { enabled: true, maxAge: 5 * 60 }
   },
@@ -50,27 +52,31 @@ export const auth = betterAuth({
       }
     }
   },
-  plugins: [
-    genericOAuth({
-      config: [
-        {
-          providerId: 'oidc',
-          discoveryUrl: requireEnv('STACKABLE_UI_OIDC_DISCOVERY_URL'),
-          clientId: requireEnv('STACKABLE_UI_OIDC_CLIENT_ID'),
-          clientSecret: requireEnv('STACKABLE_UI_OIDC_CLIENT_SECRET'),
-          scopes: ['openid', 'profile', 'email'],
-          pkce: true,
-          mapProfileToUser: async (profile) => {
-            const fullName = [profile.given_name, profile.family_name].filter(Boolean).join(' ');
-            return {
-              name: profile.name || fullName || profile.preferred_username || profile.email,
-              email: profile.email || profile.preferred_username,
-              image: profile.picture || null,
-              username: profile[usernameClaim] || profile.preferred_username || profile.email
-            };
-          }
-        }
+  plugins: oidcEnabled
+    ? [
+        genericOAuth({
+          config: [
+            {
+              providerId: 'oidc',
+              discoveryUrl: env.STACKABLE_UI_OIDC_DISCOVERY_URL,
+              clientId: env.STACKABLE_UI_OIDC_CLIENT_ID!,
+              clientSecret: env.STACKABLE_UI_OIDC_CLIENT_SECRET!,
+              scopes: ['openid', 'profile', 'email'],
+              pkce: true,
+              mapProfileToUser: async (profile) => {
+                const fullName = [profile.given_name, profile.family_name]
+                  .filter(Boolean)
+                  .join(' ');
+                return {
+                  name: profile.name || fullName || profile.preferred_username || profile.email,
+                  email: profile.email || profile.preferred_username,
+                  image: profile.picture || null,
+                  username: profile[usernameClaim] || profile.preferred_username || profile.email
+                };
+              }
+            }
+          ]
+        })
       ]
-    })
-  ]
+    : []
 });
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index c44f129f..40081bec 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -78,6 +78,7 @@
     submitting: paginateSubmitting
   } = superForm(data.paginateForm, {
     dataType: 'json',
+    invalidateAll: false,
     onUpdated({ form }) {
       const msg = form.message as FormMessage | undefined;
       if (!msg) return;

From d17a61a30b6a2f74ad2bacfc9a3007e41a48363f Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Tue, 3 Mar 2026 14:53:12 +0100
Subject: [PATCH 21/41] Add note about dev/setup.sh to AGENTS.md

---
 AGENTS.md | 39 ++++-----------------------------------
 1 file changed, 4 insertions(+), 35 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 1ee649a4..32b595ae 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -152,47 +152,16 @@ The application uses **Paraglide-JS v2** for type-safe, compiler-based internati
 - **No hardcoded strings**: Never hardcode user-visible strings in `.svelte` files. This includes text content, `aria-label`, `title`, `placeholder`, and `alt` attributes.
 - **Adding new strings**: Add the key to both `messages/en.json` and `messages/de.json`, then run `npx @inlang/paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide` to regenerate typed message functions.
 
-## Local Authentication Setup
-
-The app uses generic OIDC via **better-auth**. For local development, run a Keycloak instance on a kind cluster:
-
-### 1. Start Keycloak
-
-```bash
-kubectl apply -f dev/keycloak.yaml
-```
-
-### 2. Create realm, client, and test users
-
-```bash
-./dev/keycloak-setup.sh
-```
-
-This creates the `stackable` realm, a `stackable-ui` client, and two test users (`alice`/`alicealice`, `bob`/`bobbob`). It prints the env vars to add to `.env.development`.
-
-### 3. Configure `.env.development`
-
-Copy the output from the setup script into `.env.development`. It should look like:
+## Commands
 
-```env
-STACKABLE_UI_SQLITE_PATH=.data/auth.db
-STACKABLE_UI_OIDC_DISCOVERY_URL=http://<kind-node-ip>:30080/realms/stackable/.well-known/openid-configuration
-STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
-STACKABLE_UI_OIDC_CLIENT_SECRET=<from setup script>
-STACKABLE_UI_SESSION_SECRET=<from setup script>
-STACKABLE_UI_BASE_URL=http://localhost:5173
-```
+### Local Setup
 
-### 4. Run database migrations
+For a pre-configured local dev environment using OIDC, deploy & configure Keycloak and Trino on a kind cluster:
 
 ```bash
-set -a && source .env.development && set +a && npx @better-auth/cli@latest migrate --yes
+./dev/setup.sh           # Creates and configures Keycloak. Deploys Trino with OIDC authentication. Runs auth database migration. Writes to .env.development which is used by dev server.
 ```
 
-This creates the SQLite tables (`user`, `session`, `account`, `verification`) in `.data/auth.db`.
-
-## Commands
-
 ### Development
 
 ```bash

From 0b32ca6a5064278ec5e29193d9f762c7cab1b7f7 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Tue, 3 Mar 2026 14:53:52 +0100
Subject: [PATCH 22/41] Add missing Trino connection validation to tech debt

---
 TECH_DEBT.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index 1dbc88e7..3fd57160 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -72,6 +72,14 @@ The `$effect` that persists connection settings only resets `queryId`, not `rows
 
 ---
 
+### No validation that the connection target is a Trino instance
+
+**File:** `src/routes/(app)/trino/+page.server.ts`
+
+The query action sends whatever SQL the user provides to the configured connection URL without first verifying that the endpoint is actually a Trino instance. A user could point the URL at any HTTP server, and the app would blindly POST to it. We should validate new connections (e.g. by calling Trino's `/v1/info` endpoint) and reject URLs that do not respond as a Trino server.
+
+---
+
 ## Infrastructure
 
 ### No Content Security Policy headers

From 443c2859d694a471c6f48edc29069227ccaa1f08 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Wed, 4 Mar 2026 16:30:11 +0100
Subject: [PATCH 23/41] Remove password from connKey

---
 src/routes/(app)/trino/+page.svelte | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index 40081bec..9af00be4 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -111,8 +111,8 @@
   const running = $derived($querySubmitting || $paginateSubmitting);
 
   const connKey = $derived(() => {
-    const { connectionUrl, authType, authUsername, authPassword, impersonation } = $queryFormData;
-    return `${connectionUrl}\0${authType}\0${authUsername}\0${authPassword}\0${impersonation}`;
+    const { connectionUrl, authType, authUsername, impersonation } = $queryFormData;
+    return `${connectionUrl}\0${authType}\0${authUsername}\0${impersonation}`;
   });
 
   // Invalidate results when connection settings change after a query.

From ddf25d5ac3e06e96270cf2fdb0ddf5b2c4796062 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Wed, 4 Mar 2026 17:03:22 +0100
Subject: [PATCH 24/41] remove broken authentication when oidc is diabled

---
 src/hooks.server.ts                      |  5 ++---
 src/lib/components/layout/Sidebar.svelte | 28 ++++++++++--------------
 src/lib/server/auth.ts                   |  2 +-
 src/routes/(app)/+layout.svelte          |  2 +-
 4 files changed, 15 insertions(+), 22 deletions(-)

diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index 35da5fb1..afb160ac 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -4,7 +4,7 @@ import { building, dev } from '$app/environment';
 import { redirect, type Handle, type HandleServerError } from '@sveltejs/kit';
 import { sequence } from '@sveltejs/kit/hooks';
 import { svelteKitHandler } from 'better-auth/svelte-kit';
-import { auth } from '$lib/server/auth';
+import { auth, oidcEnabled } from '$lib/server/auth';
 import { requestLogger, logger } from '$lib/server/logging';
 
 // Allow self-signed TLS certificates in development (e.g. local Trino with self-signed certs).
@@ -62,8 +62,7 @@ export const handle = sequence(
   requestLogger,
   handleMetrics,
   handleParaglide,
-  handleAuth,
-  handleAuthGuard
+  ...(oidcEnabled ? [handleAuth, handleAuthGuard] : [])
 );
 
 export const handleError: HandleServerError = ({ error, event, status, message }) => {
diff --git a/src/lib/components/layout/Sidebar.svelte b/src/lib/components/layout/Sidebar.svelte
index c312f979..b0a9eaff 100644
--- a/src/lib/components/layout/Sidebar.svelte
+++ b/src/lib/components/layout/Sidebar.svelte
@@ -4,12 +4,10 @@
 
   let {
     collapsed = $bindable(false),
-    mobileOpen = $bindable(false),
-    authenticated = false
+    mobileOpen = $bindable(false)
   }: {
     collapsed?: boolean;
     mobileOpen?: boolean;
-    authenticated?: boolean;
   } = $props();
 
   type NavItem = {
@@ -30,20 +28,16 @@
       title: m.nav_platform(),
       items: [{ label: m.nav_dashboard(), href: '/', icon: 'dashboard' }]
     },
-    ...(authenticated
-      ? [
-          {
-            title: m.nav_data_tools(),
-            items: [
-              {
-                label: m.nav_trino(),
-                href: '/trino',
-                icon: 'database'
-              }
-            ]
-          }
-        ]
-      : [])
+    {
+      title: m.nav_data_tools(),
+      items: [
+        {
+          label: m.nav_trino(),
+          href: '/trino',
+          icon: 'database'
+        }
+      ]
+    }
   ]);
 
   function isActive(href: string): boolean {
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index bd1d24ac..fd9b27b4 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -14,7 +14,7 @@ try {
 const usernameClaim = env.STACKABLE_UI_OIDC_USERNAME_CLAIM ?? 'preferred_username';
 
 // OIDC is enabled only when all required OIDC env vars are present.
-const oidcEnabled = !!(
+export const oidcEnabled = !!(
   env.STACKABLE_UI_OIDC_DISCOVERY_URL &&
   env.STACKABLE_UI_OIDC_CLIENT_ID &&
   env.STACKABLE_UI_OIDC_CLIENT_SECRET
diff --git a/src/routes/(app)/+layout.svelte b/src/routes/(app)/+layout.svelte
index a8a8ef28..28d640d8 100644
--- a/src/routes/(app)/+layout.svelte
+++ b/src/routes/(app)/+layout.svelte
@@ -22,7 +22,7 @@
 </svelte:head>
 
 <div class="bg-base-100 flex h-dvh overflow-hidden">
-  <Sidebar bind:collapsed={sidebarCollapsed} bind:mobileOpen authenticated={!!data.user} />
+  <Sidebar bind:collapsed={sidebarCollapsed} bind:mobileOpen />
 
   <div class="flex min-w-0 flex-1 flex-col">
     <Header

From 5c48758f5ed35cb7553b36df1f6ae4b777b48f2d Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Wed, 4 Mar 2026 17:23:55 +0100
Subject: [PATCH 25/41] fix UI bugs related to no-auth

---
 src/lib/components/layout/Header.svelte | 82 ++++++++++++-------------
 src/routes/auth/logout/+page.server.ts  |  5 +-
 2 files changed, 44 insertions(+), 43 deletions(-)

diff --git a/src/lib/components/layout/Header.svelte b/src/lib/components/layout/Header.svelte
index 1e6070bf..dbd087ef 100644
--- a/src/lib/components/layout/Header.svelte
+++ b/src/lib/components/layout/Header.svelte
@@ -62,51 +62,51 @@
   <div class="flex items-center gap-1">
     <LanguageSwitcher />
     <ThemeToggle />
-    <div class="dropdown dropdown-end">
-      <button tabindex="0" class="btn btn-ghost btn-circle" aria-label={m.header_user_menu()}>
-        {#if user?.image}
-          <img src={user.image} alt={user.name ?? ''} class="h-8 w-8 rounded-full object-cover" />
-        {:else}
-          <span
-            class="bg-primary/10 text-primary flex h-8 w-8 items-center justify-center rounded-full text-xs font-semibold"
-            aria-hidden="true"
-          >
-            {initials}
-          </span>
-        {/if}
-      </button>
-      <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
-      <ul
-        tabindex="0"
-        class="dropdown-content menu bg-base-100 border-base-300 z-10 w-56 rounded-lg border p-1 shadow-lg"
-      >
-        {#if user}
+    {#if user}
+      <div class="dropdown dropdown-end">
+        <button tabindex="0" class="btn btn-ghost btn-circle" aria-label={m.header_user_menu()}>
+          {#if user.image}
+            <img src={user.image} alt={user.name ?? ''} class="h-8 w-8 rounded-full object-cover" />
+          {:else}
+            <span
+              class="bg-primary/10 text-primary flex h-8 w-8 items-center justify-center rounded-full text-xs font-semibold"
+              aria-hidden="true"
+            >
+              {initials}
+            </span>
+          {/if}
+        </button>
+        <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
+        <ul
+          tabindex="0"
+          class="dropdown-content menu bg-base-100 border-base-300 z-10 w-56 rounded-lg border p-1 shadow-lg"
+        >
           <li class="px-3 py-2">
             <p class="text-base-content truncate text-sm font-semibold">{user.name}</p>
             <p class="text-base-content/60 truncate text-xs">{user.email}</p>
           </li>
           <li><hr class="border-base-300 my-1" /></li>
-        {/if}
-        <li>
-          <a href="/auth/logout" class="text-sm">
-            <svg
-              class="h-4 w-4"
-              aria-hidden="true"
-              viewBox="0 0 24 24"
-              fill="none"
-              stroke="currentColor"
-              stroke-width="1.5"
-              stroke-linecap="round"
-              stroke-linejoin="round"
-            >
-              <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4" />
-              <polyline points="16 17 21 12 16 7" />
-              <line x1="21" y1="12" x2="9" y2="12" />
-            </svg>
-            {m.header_sign_out()}
-          </a>
-        </li>
-      </ul>
-    </div>
+          <li>
+            <a href="/auth/logout" class="text-sm">
+              <svg
+                class="h-4 w-4"
+                aria-hidden="true"
+                viewBox="0 0 24 24"
+                fill="none"
+                stroke="currentColor"
+                stroke-width="1.5"
+                stroke-linecap="round"
+                stroke-linejoin="round"
+              >
+                <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4" />
+                <polyline points="16 17 21 12 16 7" />
+                <line x1="21" y1="12" x2="9" y2="12" />
+              </svg>
+              {m.header_sign_out()}
+            </a>
+          </li>
+        </ul>
+      </div>
+    {/if}
   </div>
 </header>
diff --git a/src/routes/auth/logout/+page.server.ts b/src/routes/auth/logout/+page.server.ts
index 23aeaf55..fd78e85e 100644
--- a/src/routes/auth/logout/+page.server.ts
+++ b/src/routes/auth/logout/+page.server.ts
@@ -1,7 +1,7 @@
 import { redirect } from '@sveltejs/kit';
 import { env } from '$env/dynamic/private';
 import type { PageServerLoad } from './$types';
-import { auth, oidcEndSessionEndpoint } from '$lib/server/auth';
+import { auth, oidcEnabled, oidcEndSessionEndpoint } from '$lib/server/auth';
 
 export const load: PageServerLoad = async ({ request, locals, cookies }) => {
   if (locals.session) {
@@ -16,5 +16,6 @@ export const load: PageServerLoad = async ({ request, locals, cookies }) => {
     throw redirect(302, url.toString());
   }
 
-  throw redirect(302, '/auth/login');
+  // When OIDC is disabled there is no login page, redirect to the home page.
+  throw redirect(302, oidcEnabled ? '/auth/login' : '/');
 };

From 014120217855ece2ef91b57f7a1361279eb4b2e5 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Wed, 4 Mar 2026 17:48:59 +0100
Subject: [PATCH 26/41] fix Docker build

---
 docker/Dockerfile | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index a0def829..4f7df1c6 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.16.0@sha256:b6afd42430b15f2d2a4c5a02b919e98a525b785b1aaff16747d2f623364e39b6
-# check=error=true
+# check=error=true;skip=SecretsUsedInArgOrEnv
 
 # Find the latest version at https://catalog.redhat.com/software/containers/ubi10/ubi-minimal
 # IMPORTANT: Make sure to use the "Manifest List Digest" that references the images for multiple architectures
@@ -55,6 +55,13 @@ COPY project.inlang/ ./project.inlang/
 COPY messages/ ./messages/
 COPY svelte.config.js tsconfig.json vite.config.ts ./
 
+# Create the default SQLite directory and set dummy env vars so the build's
+# SSR prerender phase can initialise better-auth without errors.
+# These are only used during the build and discarded with the builder stage.
+RUN mkdir -p .data
+ENV STACKABLE_UI_SESSION_SECRET="build-time-placeholder" \
+    STACKABLE_UI_BASE_URL="http://localhost:3000"
+
 # Build the application
 RUN npm run build
 

From 00015a18699c399dbab1c0ab5ee0da7c6495f761 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Thu, 5 Mar 2026 10:23:15 +0100
Subject: [PATCH 27/41] Add /metrics to public paths

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>
---
 src/hooks.server.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index afb160ac..05555369 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -42,7 +42,7 @@ const handleParaglide: Handle = ({ event, resolve }) =>
 const handleAuth: Handle = ({ event, resolve }) =>
   svelteKitHandler({ event, resolve, auth, building });
 
-const PUBLIC_PATHS = ['/auth/login', '/auth/logout', '/api/auth'];
+const PUBLIC_PATHS = ['/auth/login', '/auth/logout', '/api/auth', '/metrics'];
 
 const handleAuthGuard: Handle = async ({ event, resolve }) => {
   const session = await auth.api.getSession({ headers: event.request.headers });

From fcdb1d616747637f85af18631501de3730ae9ac5 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Thu, 5 Mar 2026 14:29:44 +0100
Subject: [PATCH 28/41] fix: use log instead of console

---
 .env.development       | 0
 src/lib/server/auth.ts | 9 ++++++---
 2 files changed, 6 insertions(+), 3 deletions(-)
 delete mode 100644 .env.development

diff --git a/.env.development b/.env.development
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index fd9b27b4..0113e4b5 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -1,6 +1,9 @@
 import { betterAuth } from 'better-auth';
 import { genericOAuth } from 'better-auth/plugins';
 import Database from 'better-sqlite3';
+import { logger } from '$lib/server/logging';
+
+const log = logger.child({ module: 'auth' });
 
 // Use SvelteKit's $env when available, fall back to process.env for the
 // better-auth CLI which imports this file outside of SvelteKit via jiti.
@@ -30,9 +33,9 @@ if (oidcEnabled) {
     const discovery = await res.json();
     oidcEndSessionEndpoint = discovery.end_session_endpoint;
   } catch (err) {
-    console.warn(
-      'Failed to fetch OIDC discovery for end_session_endpoint, logout will be local-only:',
-      err
+    log.warn(
+      { err },
+      'Failed to fetch OIDC discovery for end_session_endpoint, logout will be local-only'
     );
   }
 }

From d6644480592781544a4e42b15b59236072550c3e Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Thu, 5 Mar 2026 15:41:28 +0100
Subject: [PATCH 29/41] decouple logger from SvelteKit so it's importable
 outside the framework

---
 src/lib/server/logging/logger.ts | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/lib/server/logging/logger.ts b/src/lib/server/logging/logger.ts
index abc6bf8e..a49b8ee0 100644
--- a/src/lib/server/logging/logger.ts
+++ b/src/lib/server/logging/logger.ts
@@ -1,13 +1,18 @@
 import pino from 'pino';
-import { dev } from '$app/environment';
-import { env } from '$env/dynamic/private';
 import { redactionPaths, redactionCensor } from './redaction.js';
 import type { LoggingConfig } from './types.js';
 
+// Use process.env directly instead of SvelteKit's $app/environment and
+// $env/dynamic/private so the logger can be imported from any Node.js context
+// (e.g. the better-auth CLI which loads auth.ts outside of SvelteKit via jiti).
+// This is safe because the file lives under $lib/server/ which SvelteKit
+// already prevents from being imported client-side.
+const dev = process.env.NODE_ENV !== 'production';
+
 function resolveConfig(): LoggingConfig {
-  const level = env.LOG_LEVEL ?? (dev ? 'trace' : 'info');
-  const pretty = env.LOG_PRETTY === undefined ? dev : env.LOG_PRETTY === 'true';
-  const jsonLogFile = env.LOG_JSON_FILE || undefined;
+  const level = process.env.LOG_LEVEL ?? (dev ? 'trace' : 'info');
+  const pretty = process.env.LOG_PRETTY === undefined ? dev : process.env.LOG_PRETTY === 'true';
+  const jsonLogFile = process.env.LOG_JSON_FILE || undefined;
   return { level, pretty, jsonLogFile };
 }
 

From 2c4083aea69c62d055c8f0b46f69f26fe6b991f2 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Thu, 5 Mar 2026 15:47:42 +0100
Subject: [PATCH 30/41] pin @better-auth/cli as a dev dependency and stop using
 @latest in migration scripts

---
 dev/setup.sh        |    2 +-
 e2e/global-setup.ts |    2 +-
 package-lock.json   | 1746 +++++++++++++++++++++++++++++++++++++++++--
 package.json        |    1 +
 4 files changed, 1667 insertions(+), 84 deletions(-)

diff --git a/dev/setup.sh b/dev/setup.sh
index 5fabf956..cb3c9f6c 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -166,7 +166,7 @@ echo "Resetting auth database..."
 rm -f "$PROJECT_DIR/.data/auth.db"
 echo "Running database migrations..."
 # shellcheck source=/dev/null
-(cd "$PROJECT_DIR" && set -a && source "$ENV_FILE" && set +a && npx @better-auth/cli@latest migrate --yes)
+(cd "$PROJECT_DIR" && set -a && source "$ENV_FILE" && set +a && npx @better-auth/cli migrate --yes)
 
 # ------------------------------------------------------------------
 # 9. Wait for Trino to be ready
diff --git a/e2e/global-setup.ts b/e2e/global-setup.ts
index eb2d6be3..3ecca161 100644
--- a/e2e/global-setup.ts
+++ b/e2e/global-setup.ts
@@ -22,7 +22,7 @@ export default async function globalSetup() {
   const testEnv = parseEnvFile(path.join(__dirname, '..', '.env.test'));
 
   // Run database migration with all test env vars so the OIDC plugin tables are created
-  execSync('npx @better-auth/cli@latest migrate --yes', {
+  execSync('npx @better-auth/cli migrate --yes', {
     cwd: path.join(__dirname, '..'),
     env: {
       ...process.env,
diff --git a/package-lock.json b/package-lock.json
index 06af2a31..e1b53de0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -16,6 +16,7 @@
         "prom-client": "^15.1.3"
       },
       "devDependencies": {
+        "@better-auth/cli": "^1.4.19",
         "@eslint/compat": "^2.0.2",
         "@eslint/js": "^9.39.2",
         "@inlang/paraglide-js": "^2.12.0",
@@ -70,17 +71,671 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/@babel/code-frame": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
+      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-validator-identifier": "^7.28.5",
+        "js-tokens": "^4.0.0",
+        "picocolors": "^1.1.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/compat-data": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.0.tgz",
+      "integrity": "sha512-T1NCJqT/j9+cn8fvkt7jtwbLBfLC/1y1c7NtCeXFRgzGTsafi68MRv8yzkYSapBnFA6L3U2VSc02ciDzoAJhJg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/core": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
+      "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.0",
+        "@babel/generator": "^7.29.0",
+        "@babel/helper-compilation-targets": "^7.28.6",
+        "@babel/helper-module-transforms": "^7.28.6",
+        "@babel/helpers": "^7.28.6",
+        "@babel/parser": "^7.29.0",
+        "@babel/template": "^7.28.6",
+        "@babel/traverse": "^7.29.0",
+        "@babel/types": "^7.29.0",
+        "@jridgewell/remapping": "^2.3.5",
+        "convert-source-map": "^2.0.0",
+        "debug": "^4.1.0",
+        "gensync": "^1.0.0-beta.2",
+        "json5": "^2.2.3",
+        "semver": "^6.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/babel"
+      }
+    },
+    "node_modules/@babel/core/node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/@babel/generator": {
+      "version": "7.29.1",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
+      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.29.0",
+        "@babel/types": "^7.29.0",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
+        "jsesc": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-annotate-as-pure": {
+      "version": "7.27.3",
+      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.27.3.tgz",
+      "integrity": "sha512-fXSwMQqitTGeHLBC08Eq5yXz2m37E4pJX1qAU1+2cNedz/ifv/bVXft90VeSav5nFO61EcNgwr0aJxbyPaWBPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.27.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-compilation-targets": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
+      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/compat-data": "^7.28.6",
+        "@babel/helper-validator-option": "^7.27.1",
+        "browserslist": "^4.24.0",
+        "lru-cache": "^5.1.1",
+        "semver": "^6.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-compilation-targets/node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/@babel/helper-create-class-features-plugin": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.28.6.tgz",
+      "integrity": "sha512-dTOdvsjnG3xNT9Y0AUg1wAl38y+4Rl4sf9caSQZOXdNqVn+H+HbbJ4IyyHaIqNR6SW9oJpA/RuRjsjCw2IdIow==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.27.3",
+        "@babel/helper-member-expression-to-functions": "^7.28.5",
+        "@babel/helper-optimise-call-expression": "^7.27.1",
+        "@babel/helper-replace-supers": "^7.28.6",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1",
+        "@babel/traverse": "^7.28.6",
+        "semver": "^6.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-create-class-features-plugin/node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/@babel/helper-globals": {
+      "version": "7.28.0",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
+      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-member-expression-to-functions": {
+      "version": "7.28.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.28.5.tgz",
+      "integrity": "sha512-cwM7SBRZcPCLgl8a7cY0soT1SptSzAlMH39vwiRpOQkJlh53r5hdHwLSCZpQdVLT39sZt+CRpNwYG4Y2v77atg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/traverse": "^7.28.5",
+        "@babel/types": "^7.28.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-imports": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
+      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/traverse": "^7.28.6",
+        "@babel/types": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-transforms": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
+      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-module-imports": "^7.28.6",
+        "@babel/helper-validator-identifier": "^7.28.5",
+        "@babel/traverse": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-optimise-call-expression": {
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.27.1.tgz",
+      "integrity": "sha512-URMGH08NzYFhubNSGJrpUEphGKQwMQYBySzat5cAByY1/YgIRkULnIy3tAMeszlL/so2HbeilYloUmSpd7GdVw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.27.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-plugin-utils": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.28.6.tgz",
+      "integrity": "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-replace-supers": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.28.6.tgz",
+      "integrity": "sha512-mq8e+laIk94/yFec3DxSjCRD2Z0TAjhVbEJY3UQrlwVo15Lmt7C2wAUbK4bjnTs4APkwsYLTahXRraQXhb1WCg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-member-expression-to-functions": "^7.28.5",
+        "@babel/helper-optimise-call-expression": "^7.27.1",
+        "@babel/traverse": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-skip-transparent-expression-wrappers": {
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.27.1.tgz",
+      "integrity": "sha512-Tub4ZKEXqbPjXgWLl2+3JpQAYBJ8+ikpQ2Ocj/q/r0LwE3UhENh7EUabyHjz2kCEsrRY83ew2DQdHluuiDQFzg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/traverse": "^7.27.1",
+        "@babel/types": "^7.27.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-string-parser": {
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
+      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-identifier": {
+      "version": "7.28.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
+      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-option": {
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
+      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helpers": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.28.6.tgz",
+      "integrity": "sha512-xOBvwq86HHdB7WUDTfKfT/Vuxh7gElQ+Sfti2Cy6yIWNW05P8iUslOVcZ4/sKbE+/jQaukQAdz/gf3724kYdqw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/template": "^7.28.6",
+        "@babel/types": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/parser": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.0.tgz",
+      "integrity": "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.29.0"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-jsx": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.28.6.tgz",
+      "integrity": "sha512-wgEmr06G6sIpqr8YDwA2dSRTE3bJ+V0IfpzfSY3Lfgd7YWOaAdlykvJi13ZKBt8cZHfgH1IXN+CL656W3uUa4w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-typescript": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.28.6.tgz",
+      "integrity": "sha512-+nDNmQye7nlnuuHDboPbGm00Vqg3oO8niRRL27/4LYHUsHYh0zJ1xWOz0uRwNFmM1Avzk8wZbc6rdiYhomzv/A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-modules-commonjs": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.28.6.tgz",
+      "integrity": "sha512-jppVbf8IV9iWWwWTQIxJMAJCWBuuKx71475wHwYytrRGQ2CWiDvYlADQno3tcYpS/T2UUWFQp3nVtYfK/YBQrA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-module-transforms": "^7.28.6",
+        "@babel/helper-plugin-utils": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-react-display-name": {
+      "version": "7.28.0",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-display-name/-/plugin-transform-react-display-name-7.28.0.tgz",
+      "integrity": "sha512-D6Eujc2zMxKjfa4Zxl4GHMsmhKKZ9VpcqIchJLvwTxad9zWIYulwYItBovpDOoNLISpcZSXoDJ5gaGbQUDqViA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.27.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-react-jsx": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx/-/plugin-transform-react-jsx-7.28.6.tgz",
+      "integrity": "sha512-61bxqhiRfAACulXSLd/GxqmAedUSrRZIu/cbaT18T1CetkTmtDN15it7i80ru4DVqRK1WMxQhXs+Lf9kajm5Ow==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.27.3",
+        "@babel/helper-module-imports": "^7.28.6",
+        "@babel/helper-plugin-utils": "^7.28.6",
+        "@babel/plugin-syntax-jsx": "^7.28.6",
+        "@babel/types": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-react-jsx-development": {
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-development/-/plugin-transform-react-jsx-development-7.27.1.tgz",
+      "integrity": "sha512-ykDdF5yI4f1WrAolLqeF3hmYU12j9ntLQl/AOG1HAS21jxyg1Q0/J/tpREuYLfatGdGmXp/3yS0ZA76kOlVq9Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/plugin-transform-react-jsx": "^7.27.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-react-pure-annotations": {
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-pure-annotations/-/plugin-transform-react-pure-annotations-7.27.1.tgz",
+      "integrity": "sha512-JfuinvDOsD9FVMTHpzA/pBLisxpv1aSf+OIV8lgH3MuWrks19R27e6a6DipIg4aX1Zm9Wpb04p8wljfKrVSnPA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.27.1",
+        "@babel/helper-plugin-utils": "^7.27.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-typescript": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.28.6.tgz",
+      "integrity": "sha512-0YWL2RFxOqEm9Efk5PvreamxPME8OyY0wM5wh5lHjF+VtVhdneCWGzZeSqzOfiobVqQaNCd2z0tQvnI9DaPWPw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.27.3",
+        "@babel/helper-create-class-features-plugin": "^7.28.6",
+        "@babel/helper-plugin-utils": "^7.28.6",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1",
+        "@babel/plugin-syntax-typescript": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/preset-react": {
+      "version": "7.28.5",
+      "resolved": "https://registry.npmjs.org/@babel/preset-react/-/preset-react-7.28.5.tgz",
+      "integrity": "sha512-Z3J8vhRq7CeLjdC58jLv4lnZ5RKFUJWqH5emvxmv9Hv3BD1T9R/Im713R4MTKwvFaV74ejZ3sM01LyEKk4ugNQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.27.1",
+        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/plugin-transform-react-display-name": "^7.28.0",
+        "@babel/plugin-transform-react-jsx": "^7.27.1",
+        "@babel/plugin-transform-react-jsx-development": "^7.27.1",
+        "@babel/plugin-transform-react-pure-annotations": "^7.27.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/preset-typescript": {
+      "version": "7.28.5",
+      "resolved": "https://registry.npmjs.org/@babel/preset-typescript/-/preset-typescript-7.28.5.tgz",
+      "integrity": "sha512-+bQy5WOI2V6LJZpPVxY+yp66XdZ2yifu0Mc1aP5CQKgjn4QM5IN2i5fAZ4xKop47pr8rpVhiAeu+nDQa12C8+g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.27.1",
+        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/plugin-syntax-jsx": "^7.27.1",
+        "@babel/plugin-transform-modules-commonjs": "^7.27.1",
+        "@babel/plugin-transform-typescript": "^7.28.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
     "node_modules/@babel/runtime": {
       "version": "7.28.6",
       "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.6.tgz",
       "integrity": "sha512-05WQkdpL9COIMz4LjTxGpPNCdlpyimKppYNoJ5Di5EUObifl8t4tuLuUBBZEpoLYOmfvIWrsp9fCl0HoPRVTdA==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
+      "optional": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/template": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
+      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.28.6",
+        "@babel/parser": "^7.28.6",
+        "@babel/types": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/traverse": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
+      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.0",
+        "@babel/generator": "^7.29.0",
+        "@babel/helper-globals": "^7.28.0",
+        "@babel/parser": "^7.29.0",
+        "@babel/template": "^7.28.6",
+        "@babel/types": "^7.29.0",
+        "debug": "^4.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/types": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
+      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^7.27.1",
+        "@babel/helper-validator-identifier": "^7.28.5"
+      },
       "engines": {
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@better-auth/cli": {
+      "version": "1.4.19",
+      "resolved": "https://registry.npmjs.org/@better-auth/cli/-/cli-1.4.19.tgz",
+      "integrity": "sha512-kH1e+F8sPwcfEuhyNzFt3rdLo5SBTfw7a9m/hyMv1E7tk/yfsqOZRL0I5GR+Fkm0FJ7SoVA4LJREFV3S0Px8iA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/core": "^7.28.4",
+        "@babel/preset-react": "^7.27.1",
+        "@babel/preset-typescript": "^7.27.1",
+        "@better-auth/core": "1.4.19",
+        "@better-auth/telemetry": "1.4.19",
+        "@better-auth/utils": "0.3.0",
+        "@clack/prompts": "^0.11.0",
+        "@mrleebo/prisma-ast": "^0.13.0",
+        "@prisma/client": "^5.22.0",
+        "@types/pg": "^8.15.5",
+        "better-auth": "^1.4.19",
+        "better-sqlite3": "^12.2.0",
+        "c12": "^3.2.0",
+        "chalk": "^5.6.2",
+        "commander": "^12.1.0",
+        "dotenv": "^17.2.2",
+        "drizzle-orm": "^0.41.0",
+        "open": "^10.2.0",
+        "pg": "^8.16.3",
+        "prettier": "^3.6.2",
+        "prompts": "^2.4.2",
+        "semver": "^7.7.2",
+        "yocto-spinner": "^0.2.3",
+        "zod": "^4.3.5"
+      },
+      "bin": {
+        "better-auth": "dist/index.mjs"
+      }
+    },
+    "node_modules/@better-auth/cli/node_modules/@better-auth/core": {
+      "version": "1.4.19",
+      "resolved": "https://registry.npmjs.org/@better-auth/core/-/core-1.4.19.tgz",
+      "integrity": "sha512-uADLHG1jc5BnEJi7f6ijUN5DmPPRSj++7m/G19z3UqA3MVCo4Y4t1MMa4IIxLCqGDFv22drdfxescgW+HnIowA==",
+      "dev": true,
+      "dependencies": {
+        "@standard-schema/spec": "^1.0.0",
+        "zod": "^4.3.5"
+      },
+      "peerDependencies": {
+        "@better-auth/utils": "0.3.0",
+        "@better-fetch/fetch": "1.1.21",
+        "better-call": "1.1.8",
+        "jose": "^6.1.0",
+        "kysely": "^0.28.5",
+        "nanostores": "^1.0.1"
+      }
+    },
+    "node_modules/@better-auth/cli/node_modules/@better-auth/telemetry": {
+      "version": "1.4.19",
+      "resolved": "https://registry.npmjs.org/@better-auth/telemetry/-/telemetry-1.4.19.tgz",
+      "integrity": "sha512-ApGNS7olCTtDpKF8Ow3Z+jvFAirOj7c4RyFUpu8axklh3mH57ndpfUAUjhgA8UVoaaH/mnm/Tl884BlqiewLyw==",
+      "dev": true,
+      "dependencies": {
+        "@better-auth/utils": "0.3.0",
+        "@better-fetch/fetch": "1.1.21"
+      },
+      "peerDependencies": {
+        "@better-auth/core": "1.4.19"
+      }
+    },
+    "node_modules/@better-auth/cli/node_modules/chalk": {
+      "version": "5.6.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-5.6.2.tgz",
+      "integrity": "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.17.0 || ^14.13 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/@better-auth/cli/node_modules/commander": {
+      "version": "12.1.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-12.1.0.tgz",
+      "integrity": "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@better-auth/cli/node_modules/kysely": {
+      "version": "0.28.11",
+      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.11.tgz",
+      "integrity": "sha512-zpGIFg0HuoC893rIjYX1BETkVWdDnzTzF5e0kWXJFg5lE0k1/LfNWBejrcnOFu8Q2Rfq/hTDTU7XLUM8QOrpzg==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
     "node_modules/@better-auth/utils": {
       "version": "0.3.0",
       "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.3.0.tgz",
@@ -92,6 +747,66 @@
       "resolved": "https://registry.npmjs.org/@better-fetch/fetch/-/fetch-1.1.21.tgz",
       "integrity": "sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A=="
     },
+    "node_modules/@chevrotain/cst-dts-gen": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/cst-dts-gen/-/cst-dts-gen-10.5.0.tgz",
+      "integrity": "sha512-lhmC/FyqQ2o7pGK4Om+hzuDrm9rhFYIJ/AXoQBeongmn870Xeb0L6oGEiuR8nohFNL5sMaQEJWCxr1oIVIVXrw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@chevrotain/gast": "10.5.0",
+        "@chevrotain/types": "10.5.0",
+        "lodash": "4.17.21"
+      }
+    },
+    "node_modules/@chevrotain/gast": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/gast/-/gast-10.5.0.tgz",
+      "integrity": "sha512-pXdMJ9XeDAbgOWKuD1Fldz4ieCs6+nLNmyVhe2gZVqoO7v8HXuHYs5OV2EzUtbuai37TlOAQHrTDvxMnvMJz3A==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@chevrotain/types": "10.5.0",
+        "lodash": "4.17.21"
+      }
+    },
+    "node_modules/@chevrotain/types": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-10.5.0.tgz",
+      "integrity": "sha512-f1MAia0x/pAVPWH/T73BJVyO2XU5tI4/iE7cnxb7tqdNTNhQI3Uq3XkqcoteTmD4t1aM0LbHCJOhgIDn07kl2A==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
+    "node_modules/@chevrotain/utils": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/utils/-/utils-10.5.0.tgz",
+      "integrity": "sha512-hBzuU5+JjB2cqNZyszkDHZgOSrUUT8V3dhgRl8Q9Gp6dAj/H5+KILGjbhDpc3Iy9qmqlm/akuOI2ut9VUtzJxQ==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
+    "node_modules/@clack/core": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/@clack/core/-/core-0.5.0.tgz",
+      "integrity": "sha512-p3y0FIOwaYRUPRcMO7+dlmLh8PSRcrjuTndsiA0WAFbWES0mLZlrjVoBRZ9DzkPFJZG6KGkJmoEAY0ZcVWTkow==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "picocolors": "^1.0.0",
+        "sisteransi": "^1.0.5"
+      }
+    },
+    "node_modules/@clack/prompts": {
+      "version": "0.11.0",
+      "resolved": "https://registry.npmjs.org/@clack/prompts/-/prompts-0.11.0.tgz",
+      "integrity": "sha512-pMN5FcrEw9hUkZA4f+zLlzivQSeQf5dRGJjSUbvVYDLvpKCdQx5OaknvKzgbtXOizhP+SJJJjqEbOe55uKKfAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@clack/core": "0.5.0",
+        "picocolors": "^1.0.0",
+        "sisteransi": "^1.0.5"
+      }
+    },
     "node_modules/@esbuild/aix-ppc64": {
       "version": "0.27.3",
       "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
@@ -99,7 +814,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -116,7 +830,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -133,7 +846,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -150,7 +862,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -167,7 +878,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -184,7 +894,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -201,7 +910,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -218,7 +926,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -235,7 +942,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -252,7 +958,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -269,7 +974,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -286,7 +990,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -303,7 +1006,6 @@
       "cpu": [
         "mips64el"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -320,7 +1022,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -337,7 +1038,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -354,7 +1054,6 @@
       "cpu": [
         "s390x"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -371,7 +1070,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -388,7 +1086,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -405,7 +1102,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -422,7 +1118,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -439,7 +1134,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -456,7 +1150,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -473,7 +1166,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -490,7 +1182,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -942,6 +1633,20 @@
       "dev": true,
       "license": "Apache-2.0"
     },
+    "node_modules/@mrleebo/prisma-ast": {
+      "version": "0.13.1",
+      "resolved": "https://registry.npmjs.org/@mrleebo/prisma-ast/-/prisma-ast-0.13.1.tgz",
+      "integrity": "sha512-XyroGQXcHrZdvmrGJvsA9KNeOOgGMg1Vg9OlheUsBOSKznLMDl+YChxbkboRHvtFYJEMRYmlV3uoo/njCw05iw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "chevrotain": "^10.5.0",
+        "lilconfig": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
     "node_modules/@noble/ciphers": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-2.1.1.tgz",
@@ -1025,6 +1730,25 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/@prisma/client": {
+      "version": "5.22.0",
+      "resolved": "https://registry.npmjs.org/@prisma/client/-/client-5.22.0.tgz",
+      "integrity": "sha512-M0SVXfyHnQREBKxCgyo7sffrKttwE6R8PMq330MIUF0pTwjUhLbW84pFDlf06B27XyCR++VtjugEnIHdr07SVA==",
+      "devOptional": true,
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=16.13"
+      },
+      "peerDependencies": {
+        "prisma": "*"
+      },
+      "peerDependenciesMeta": {
+        "prisma": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@rollup/plugin-commonjs": {
       "version": "29.0.0",
       "resolved": "https://registry.npmjs.org/@rollup/plugin-commonjs/-/plugin-commonjs-29.0.0.tgz",
@@ -1128,7 +1852,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1142,7 +1865,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1156,7 +1878,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1170,7 +1891,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1184,7 +1904,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1198,7 +1917,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1212,7 +1930,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1226,7 +1943,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1240,7 +1956,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1254,7 +1969,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1268,7 +1982,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1282,7 +1995,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1296,7 +2008,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1310,7 +2021,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1324,7 +2034,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1338,7 +2047,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1352,7 +2060,6 @@
       "cpu": [
         "s390x"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1366,7 +2073,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1380,7 +2086,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1394,7 +2099,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1408,7 +2112,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1422,7 +2125,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1436,7 +2138,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1450,7 +2151,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1464,7 +2164,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1969,12 +2668,24 @@
       "version": "24.10.13",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.10.13.tgz",
       "integrity": "sha512-oH72nZRfDv9lADUBSo104Aq7gPHpQZc4BTx38r9xf9pg5LfP6EzSyH2n7qFmmxRQXh7YlUXODcYsg6PuTDSxGg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "undici-types": "~7.16.0"
       }
     },
+    "node_modules/@types/pg": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/@types/pg/-/pg-8.18.0.tgz",
+      "integrity": "sha512-gT+oueVQkqnj6ajGJXblFR4iavIXWsGAFCk3dP4Kki5+a9R4NMt0JARdk6s8cUKcfUoqP5dAtDSLU8xYUTFV+Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "pg-protocol": "*",
+        "pg-types": "^2.2.0"
+      }
+    },
     "node_modules/@types/resolve": {
       "version": "1.20.2",
       "resolved": "https://registry.npmjs.org/@types/resolve/-/resolve-1.20.2.tgz",
@@ -2360,7 +3071,7 @@
       "version": "4.0.18",
       "resolved": "https://registry.npmjs.org/@vitest/browser/-/browser-4.0.18.tgz",
       "integrity": "sha512-gVQqh7paBz3gC+ZdcCmNSWJMk70IUjDeVqi+5m5vYpEHsIwRgw3Y545jljtajhkekIpIp5Gg8oK7bctgY0E2Ng==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@vitest/mocker": "4.0.18",
@@ -2383,7 +3094,7 @@
       "version": "4.0.18",
       "resolved": "https://registry.npmjs.org/@vitest/browser-playwright/-/browser-playwright-4.0.18.tgz",
       "integrity": "sha512-gfajTHVCiwpxRj1qh0Sh/5bbGLG4F/ZH/V9xvFVoFddpITfMta9YGow0W6ZpTTORv2vdJuz9TnrNSmjKvpOf4g==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@vitest/browser": "4.0.18",
@@ -2698,6 +3409,19 @@
       ],
       "license": "MIT"
     },
+    "node_modules/baseline-browser-mapping": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.0.tgz",
+      "integrity": "sha512-lIyg0szRfYbiy67j9KN8IyeD7q7hcmqnJ1ddWmNt19ItGpNN64mnllmxUNFIOdOm6by97jlL6wfpTTJrmnjWAA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
     "node_modules/basic-auth": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/basic-auth/-/basic-auth-2.0.1.tgz",
@@ -2952,6 +3676,40 @@
         "concat-map": "0.0.1"
       }
     },
+    "node_modules/browserslist": {
+      "version": "4.28.1",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
+      "integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "baseline-browser-mapping": "^2.9.0",
+        "caniuse-lite": "^1.0.30001759",
+        "electron-to-chromium": "^1.5.263",
+        "node-releases": "^2.0.27",
+        "update-browserslist-db": "^1.2.0"
+      },
+      "bin": {
+        "browserslist": "cli.js"
+      },
+      "engines": {
+        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
+      }
+    },
     "node_modules/buffer": {
       "version": "5.7.1",
       "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
@@ -2976,14 +3734,89 @@
         "ieee754": "^1.1.13"
       }
     },
-    "node_modules/bytes": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
-      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+    "node_modules/bundle-name": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bundle-name/-/bundle-name-4.1.0.tgz",
+      "integrity": "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "run-applescript": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/c12": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/c12/-/c12-3.3.3.tgz",
+      "integrity": "sha512-750hTRvgBy5kcMNPdh95Qo+XUBeGo8C7nsKSmedDmaQI+E0r82DwHeM6vBewDe4rGFbnxoa4V9pw+sPh5+Iz8Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "chokidar": "^5.0.0",
+        "confbox": "^0.2.2",
+        "defu": "^6.1.4",
+        "dotenv": "^17.2.3",
+        "exsolve": "^1.0.8",
+        "giget": "^2.0.0",
+        "jiti": "^2.6.1",
+        "ohash": "^2.0.11",
+        "pathe": "^2.0.3",
+        "perfect-debounce": "^2.0.0",
+        "pkg-types": "^2.3.0",
+        "rc9": "^2.1.2"
+      },
+      "peerDependencies": {
+        "magicast": "*"
+      },
+      "peerDependenciesMeta": {
+        "magicast": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/c12/node_modules/chokidar": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-5.0.0.tgz",
+      "integrity": "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "readdirp": "^5.0.0"
+      },
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/c12/node_modules/readdirp": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-5.0.0.tgz",
+      "integrity": "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 0.8"
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "type": "individual",
+        "url": "https://paulmillr.com/funding/"
       }
     },
     "node_modules/call-bind-apply-helpers": {
@@ -3041,6 +3874,27 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/caniuse-lite": {
+      "version": "1.0.30001776",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001776.tgz",
+      "integrity": "sha512-sg01JDPzZ9jGshqKSckOQthXnYwOEP50jeVFhaSFbZcOy05TiuuaffDOfcwtCisJ9kNQuLBFibYywv2Bgm9osw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "CC-BY-4.0"
+    },
     "node_modules/chai": {
       "version": "6.2.2",
       "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
@@ -3068,6 +3922,21 @@
         "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
+    "node_modules/chevrotain": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/chevrotain/-/chevrotain-10.5.0.tgz",
+      "integrity": "sha512-Pkv5rBY3+CsHOYfV5g/Vs5JY9WTHHDEKOlohI2XeygaZhUeqhAlldZ8Hz9cRmxu709bvS08YzxHdTPHhffc13A==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@chevrotain/cst-dts-gen": "10.5.0",
+        "@chevrotain/gast": "10.5.0",
+        "@chevrotain/types": "10.5.0",
+        "@chevrotain/utils": "10.5.0",
+        "lodash": "4.17.21",
+        "regexp-to-ast": "0.5.0"
+      }
+    },
     "node_modules/chokidar": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz",
@@ -3090,6 +3959,16 @@
       "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
       "license": "ISC"
     },
+    "node_modules/citty": {
+      "version": "0.1.6",
+      "resolved": "https://registry.npmjs.org/citty/-/citty-0.1.6.tgz",
+      "integrity": "sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "consola": "^3.2.3"
+      }
+    },
     "node_modules/class-validator": {
       "version": "0.14.3",
       "resolved": "https://registry.npmjs.org/class-validator/-/class-validator-0.14.3.tgz",
@@ -3179,6 +4058,13 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/confbox": {
+      "version": "0.2.4",
+      "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.2.4.tgz",
+      "integrity": "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/consola": {
       "version": "3.4.0",
       "resolved": "https://registry.npmjs.org/consola/-/consola-3.4.0.tgz",
@@ -3213,6 +4099,13 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/convert-source-map": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/cookie": {
       "version": "0.6.0",
       "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
@@ -3388,6 +4281,49 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/default-browser": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/default-browser/-/default-browser-5.5.0.tgz",
+      "integrity": "sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "bundle-name": "^4.1.0",
+        "default-browser-id": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/default-browser-id": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/default-browser-id/-/default-browser-id-5.0.1.tgz",
+      "integrity": "sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/define-lazy-prop": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-3.0.0.tgz",
+      "integrity": "sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/defu": {
       "version": "6.1.4",
       "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.4.tgz",
@@ -3404,6 +4340,13 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/destr": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/destr/-/destr-2.0.5.tgz",
+      "integrity": "sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/detect-libc": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
@@ -3437,6 +4380,141 @@
         "@types/trusted-types": "^2.0.7"
       }
     },
+    "node_modules/dotenv": {
+      "version": "17.3.1",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.3.1.tgz",
+      "integrity": "sha512-IO8C/dzEb6O3F9/twg6ZLXz164a2fhTnEWb95H23Dm4OuN+92NmEAlTrupP9VW6Jm3sO26tQlqyvyi4CsnY9GA==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
+    "node_modules/drizzle-orm": {
+      "version": "0.41.0",
+      "resolved": "https://registry.npmjs.org/drizzle-orm/-/drizzle-orm-0.41.0.tgz",
+      "integrity": "sha512-7A4ZxhHk9gdlXmTdPj/lREtP+3u8KvZ4yEN6MYVxBzZGex5Wtdc+CWSbu7btgF6TB0N+MNPrvW7RKBbxJchs/Q==",
+      "devOptional": true,
+      "license": "Apache-2.0",
+      "peerDependencies": {
+        "@aws-sdk/client-rds-data": ">=3",
+        "@cloudflare/workers-types": ">=4",
+        "@electric-sql/pglite": ">=0.2.0",
+        "@libsql/client": ">=0.10.0",
+        "@libsql/client-wasm": ">=0.10.0",
+        "@neondatabase/serverless": ">=0.10.0",
+        "@op-engineering/op-sqlite": ">=2",
+        "@opentelemetry/api": "^1.4.1",
+        "@planetscale/database": ">=1",
+        "@prisma/client": "*",
+        "@tidbcloud/serverless": "*",
+        "@types/better-sqlite3": "*",
+        "@types/pg": "*",
+        "@types/sql.js": "*",
+        "@vercel/postgres": ">=0.8.0",
+        "@xata.io/client": "*",
+        "better-sqlite3": ">=7",
+        "bun-types": "*",
+        "expo-sqlite": ">=14.0.0",
+        "gel": ">=2",
+        "knex": "*",
+        "kysely": "*",
+        "mysql2": ">=2",
+        "pg": ">=8",
+        "postgres": ">=3",
+        "sql.js": ">=1",
+        "sqlite3": ">=5"
+      },
+      "peerDependenciesMeta": {
+        "@aws-sdk/client-rds-data": {
+          "optional": true
+        },
+        "@cloudflare/workers-types": {
+          "optional": true
+        },
+        "@electric-sql/pglite": {
+          "optional": true
+        },
+        "@libsql/client": {
+          "optional": true
+        },
+        "@libsql/client-wasm": {
+          "optional": true
+        },
+        "@neondatabase/serverless": {
+          "optional": true
+        },
+        "@op-engineering/op-sqlite": {
+          "optional": true
+        },
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@planetscale/database": {
+          "optional": true
+        },
+        "@prisma/client": {
+          "optional": true
+        },
+        "@tidbcloud/serverless": {
+          "optional": true
+        },
+        "@types/better-sqlite3": {
+          "optional": true
+        },
+        "@types/pg": {
+          "optional": true
+        },
+        "@types/sql.js": {
+          "optional": true
+        },
+        "@vercel/postgres": {
+          "optional": true
+        },
+        "@xata.io/client": {
+          "optional": true
+        },
+        "better-sqlite3": {
+          "optional": true
+        },
+        "bun-types": {
+          "optional": true
+        },
+        "expo-sqlite": {
+          "optional": true
+        },
+        "gel": {
+          "optional": true
+        },
+        "knex": {
+          "optional": true
+        },
+        "kysely": {
+          "optional": true
+        },
+        "mysql2": {
+          "optional": true
+        },
+        "pg": {
+          "optional": true
+        },
+        "postgres": {
+          "optional": true
+        },
+        "prisma": {
+          "optional": true
+        },
+        "sql.js": {
+          "optional": true
+        },
+        "sqlite3": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
@@ -3471,6 +4549,13 @@
         "fast-check": "^3.23.1"
       }
     },
+    "node_modules/electron-to-chromium": {
+      "version": "1.5.307",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.307.tgz",
+      "integrity": "sha512-5z3uFKBWjiNR44nFcYdkcXjKMbg5KXNdciu7mhTPo9tB7NbqSNP2sSnGR+fqknZSCwKkBN+oxiiajWs4dT6ORg==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/encodeurl": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
@@ -3544,6 +4629,16 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/escalade": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
+      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/escape-html": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
@@ -3951,6 +5046,13 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/exsolve": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.0.8.tgz",
+      "integrity": "sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/fast-check": {
       "version": "3.23.2",
       "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-3.23.2.tgz",
@@ -4137,7 +5239,6 @@
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
       "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -4158,6 +5259,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/gensync": {
+      "version": "1.0.0-beta.2",
+      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
+      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
     "node_modules/get-intrinsic": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
@@ -4197,6 +5308,24 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/giget": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/giget/-/giget-2.0.0.tgz",
+      "integrity": "sha512-L5bGsVkxJbJgdnwyuheIunkGatUF/zssUoxxjACCseZYAVbaqdh9Tsmmlkl8vYan09H7sbvKt4pS8GqKLBrEzA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "citty": "^0.1.6",
+        "consola": "^3.4.0",
+        "defu": "^6.1.4",
+        "node-fetch-native": "^1.6.6",
+        "nypm": "^0.6.0",
+        "pathe": "^2.0.3"
+      },
+      "bin": {
+        "giget": "dist/cli.mjs"
+      }
+    },
     "node_modules/github-from-package": {
       "version": "0.0.0",
       "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
@@ -4435,6 +5564,22 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/is-docker": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-3.0.0.tgz",
+      "integrity": "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "is-docker": "cli.js"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/is-extglob": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
@@ -4458,6 +5603,25 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/is-inside-container": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-inside-container/-/is-inside-container-1.0.0.tgz",
+      "integrity": "sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-docker": "^3.0.0"
+      },
+      "bin": {
+        "is-inside-container": "cli.js"
+      },
+      "engines": {
+        "node": ">=14.16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/is-module": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/is-module/-/is-module-1.0.0.tgz",
@@ -4495,6 +5659,22 @@
         "@types/estree": "*"
       }
     },
+    "node_modules/is-wsl": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-3.1.1.tgz",
+      "integrity": "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-inside-container": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/isexe": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
@@ -4506,7 +5686,7 @@
       "version": "2.6.1",
       "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
       "integrity": "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "bin": {
         "jiti": "lib/jiti-cli.mjs"
@@ -4553,6 +5733,13 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/js-yaml": {
       "version": "4.1.1",
       "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
@@ -4566,6 +5753,19 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
+    "node_modules/jsesc": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
+      "integrity": "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "jsesc": "bin/jsesc"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/json-buffer": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
@@ -4678,7 +5878,7 @@
       "version": "1.31.1",
       "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.31.1.tgz",
       "integrity": "sha512-l51N2r93WmGUye3WuFoN5k10zyvrVs0qfKBhyC5ogUQ6Ew6JUSswh78mbSO+IU3nTWsyOArqPCcShdQSadghBQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MPL-2.0",
       "dependencies": {
         "detect-libc": "^2.0.3"
@@ -4711,7 +5911,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4732,7 +5931,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4753,7 +5951,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4774,7 +5971,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4795,7 +5991,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4816,7 +6011,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4837,7 +6031,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4858,7 +6051,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4879,7 +6071,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4900,7 +6091,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4921,7 +6111,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -4968,6 +6157,13 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/lodash": {
+      "version": "4.17.21",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/lodash.merge": {
       "version": "4.6.2",
       "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
@@ -4975,6 +6171,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/lru-cache": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
+      "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "yallist": "^3.0.2"
+      }
+    },
     "node_modules/magic-string": {
       "version": "0.30.21",
       "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
@@ -5217,6 +6423,20 @@
         "node": ">=10"
       }
     },
+    "node_modules/node-fetch-native": {
+      "version": "1.6.7",
+      "resolved": "https://registry.npmjs.org/node-fetch-native/-/node-fetch-native-1.6.7.tgz",
+      "integrity": "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/node-releases": {
+      "version": "2.0.36",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.36.tgz",
+      "integrity": "sha512-TdC8FSgHz8Mwtw9g5L4gR/Sh9XhSP/0DEkQxfEFXOpiul5IiHgHan2VhYYb6agDSfp4KuvltmGApc8HMgUrIkA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/normalize-url": {
       "version": "8.1.1",
       "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-8.1.1.tgz",
@@ -5231,6 +6451,31 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/nypm": {
+      "version": "0.6.5",
+      "resolved": "https://registry.npmjs.org/nypm/-/nypm-0.6.5.tgz",
+      "integrity": "sha512-K6AJy1GMVyfyMXRVB88700BJqNUkByijGJM8kEHpLdcAt+vSQAVfkWWHYzuRXHSY6xA2sNc5RjTj0p9rE2izVQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "citty": "^0.2.0",
+        "pathe": "^2.0.3",
+        "tinyexec": "^1.0.2"
+      },
+      "bin": {
+        "nypm": "dist/cli.mjs"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/nypm/node_modules/citty": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/citty/-/citty-0.2.1.tgz",
+      "integrity": "sha512-kEV95lFBhQgtogAPlQfJJ0WGVSokvLr/UEoFPiKKOXF7pl98HfUVUD0ejsuTCld/9xH9vogSywZ5KqHzXrZpqg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/oauth2-mock-server": {
       "version": "8.2.2",
       "resolved": "https://registry.npmjs.org/oauth2-mock-server/-/oauth2-mock-server-8.2.2.tgz",
@@ -5285,6 +6530,13 @@
       ],
       "license": "MIT"
     },
+    "node_modules/ohash": {
+      "version": "2.0.11",
+      "resolved": "https://registry.npmjs.org/ohash/-/ohash-2.0.11.tgz",
+      "integrity": "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/on-exit-leak-free": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/on-exit-leak-free/-/on-exit-leak-free-2.1.2.tgz",
@@ -5316,6 +6568,25 @@
         "wrappy": "1"
       }
     },
+    "node_modules/open": {
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/open/-/open-10.2.0.tgz",
+      "integrity": "sha512-YgBpdJHPyQ2UE5x+hlSXcnejzAvD0b22U2OuAP+8OnlJT+PjWPxtgmGqKKc+RgTM63U9gN0YzrYc71R2WT/hTA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "default-browser": "^5.2.1",
+        "define-lazy-prop": "^3.0.0",
+        "is-inside-container": "^1.0.0",
+        "wsl-utils": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/optionator": {
       "version": "0.9.4",
       "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
@@ -5434,6 +6705,110 @@
       "devOptional": true,
       "license": "MIT"
     },
+    "node_modules/perfect-debounce": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-2.1.0.tgz",
+      "integrity": "sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/pg": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/pg/-/pg-8.20.0.tgz",
+      "integrity": "sha512-ldhMxz2r8fl/6QkXnBD3CR9/xg694oT6DZQ2s6c/RI28OjtSOpxnPrUCGOBJ46RCUxcWdx3p6kw/xnDHjKvaRA==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "pg-connection-string": "^2.12.0",
+        "pg-pool": "^3.13.0",
+        "pg-protocol": "^1.13.0",
+        "pg-types": "2.2.0",
+        "pgpass": "1.0.5"
+      },
+      "engines": {
+        "node": ">= 16.0.0"
+      },
+      "optionalDependencies": {
+        "pg-cloudflare": "^1.3.0"
+      },
+      "peerDependencies": {
+        "pg-native": ">=3.0.1"
+      },
+      "peerDependenciesMeta": {
+        "pg-native": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/pg-cloudflare": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/pg-cloudflare/-/pg-cloudflare-1.3.0.tgz",
+      "integrity": "sha512-6lswVVSztmHiRtD6I8hw4qP/nDm1EJbKMRhf3HCYaqud7frGysPv7FYJ5noZQdhQtN2xJnimfMtvQq21pdbzyQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/pg-connection-string": {
+      "version": "2.12.0",
+      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.12.0.tgz",
+      "integrity": "sha512-U7qg+bpswf3Cs5xLzRqbXbQl85ng0mfSV/J0nnA31MCLgvEaAo7CIhmeyrmJpOr7o+zm0rXK+hNnT5l9RHkCkQ==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/pg-int8": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/pg-int8/-/pg-int8-1.0.1.tgz",
+      "integrity": "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==",
+      "devOptional": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/pg-pool": {
+      "version": "3.13.0",
+      "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.13.0.tgz",
+      "integrity": "sha512-gB+R+Xud1gLFuRD/QgOIgGOBE2KCQPaPwkzBBGC9oG69pHTkhQeIuejVIk3/cnDyX39av2AxomQiyPT13WKHQA==",
+      "devOptional": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "pg": ">=8.0"
+      }
+    },
+    "node_modules/pg-protocol": {
+      "version": "1.13.0",
+      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.13.0.tgz",
+      "integrity": "sha512-zzdvXfS6v89r6v7OcFCHfHlyG/wvry1ALxZo4LqgUoy7W9xhBDMaqOuMiF3qEV45VqsN6rdlcehHrfDtlCPc8w==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/pg-types": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/pg-types/-/pg-types-2.2.0.tgz",
+      "integrity": "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "pg-int8": "1.0.1",
+        "postgres-array": "~2.0.0",
+        "postgres-bytea": "~1.0.0",
+        "postgres-date": "~1.0.4",
+        "postgres-interval": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/pgpass": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/pgpass/-/pgpass-1.0.5.tgz",
+      "integrity": "sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "split2": "^4.1.0"
+      }
+    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -5533,7 +6908,7 @@
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/pixelmatch/-/pixelmatch-7.1.0.tgz",
       "integrity": "sha512-1wrVzJ2STrpmONHKBy228LM1b84msXDUoAzVEl0R8Mz4Ce6EPr+IVtxm8+yvrqLYMHswREkjYFaMxnyGnaY3Ng==",
-      "dev": true,
+      "devOptional": true,
       "license": "ISC",
       "dependencies": {
         "pngjs": "^7.0.0"
@@ -5542,11 +6917,23 @@
         "pixelmatch": "bin/pixelmatch"
       }
     },
+    "node_modules/pkg-types": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-2.3.0.tgz",
+      "integrity": "sha512-SIqCzDRg0s9npO5XQ3tNZioRY1uK06lA41ynBC1YmFTmnY6FjUjVt6s4LoADmwoig1qqD0oK8h1p/8mlMx8Oig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "confbox": "^0.2.2",
+        "exsolve": "^1.0.7",
+        "pathe": "^2.0.3"
+      }
+    },
     "node_modules/playwright": {
       "version": "1.58.2",
       "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
       "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "playwright-core": "1.58.2"
@@ -5565,7 +6952,7 @@
       "version": "1.58.2",
       "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
       "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "bin": {
         "playwright-core": "cli.js"
@@ -5578,7 +6965,7 @@
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-7.0.0.tgz",
       "integrity": "sha512-LKWqWJRhstyYo9pGvgor/ivk2w94eSjE3RGVuzLGlr3NmD8bf7RcYGze1mNdEHRP6TRP6rMuDHk5t44hnTRyow==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=14.19.0"
@@ -5721,6 +7108,49 @@
         "node": ">=4"
       }
     },
+    "node_modules/postgres-array": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
+      "integrity": "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/postgres-bytea": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/postgres-bytea/-/postgres-bytea-1.0.1.tgz",
+      "integrity": "sha512-5+5HqXnsZPE65IJZSMkZtURARZelel2oXUEO8rH83VS/hxH5vv1uHquPg5wZs8yMAfdv971IU+kcPUczi7NVBQ==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/postgres-date": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/postgres-date/-/postgres-date-1.0.7.tgz",
+      "integrity": "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/postgres-interval": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/postgres-interval/-/postgres-interval-1.2.0.tgz",
+      "integrity": "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "xtend": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/prebuild-install": {
       "version": "7.1.3",
       "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
@@ -5893,6 +7323,30 @@
         "node": "^16 || ^18 || >=20"
       }
     },
+    "node_modules/prompts": {
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/prompts/-/prompts-2.4.2.tgz",
+      "integrity": "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "kleur": "^3.0.3",
+        "sisteransi": "^1.0.5"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/prompts/node_modules/kleur": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/kleur/-/kleur-3.0.3.tgz",
+      "integrity": "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/property-expr": {
       "version": "2.0.6",
       "resolved": "https://registry.npmjs.org/property-expr/-/property-expr-2.0.6.tgz",
@@ -6025,6 +7479,17 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/rc9": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/rc9/-/rc9-2.1.2.tgz",
+      "integrity": "sha512-btXCnMmRIBINM2LDZoEmOogIZU7Qe7zn4BpomSKZ/ykbLObuBdvG+mFq11DL6fjH1DRwHhrlgtYWG96bJiC7Cg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "defu": "^6.1.4",
+        "destr": "^2.0.3"
+      }
+    },
     "node_modules/readable-stream": {
       "version": "3.6.2",
       "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
@@ -6062,6 +7527,13 @@
         "node": ">= 12.13.0"
       }
     },
+    "node_modules/regexp-to-ast": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/regexp-to-ast/-/regexp-to-ast-0.5.0.tgz",
+      "integrity": "sha512-tlbJqcMHnPKI9zSrystikWKwHkBqu2a/Sgw01h3zFjvYrMxEDYHzzoMZnUrbIfpTFEsoRnnviOXNCzFiSc54Qw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/regexp-tree": {
       "version": "0.1.27",
       "resolved": "https://registry.npmjs.org/regexp-tree/-/regexp-tree-0.1.27.tgz",
@@ -6171,6 +7643,19 @@
         "node": ">= 18"
       }
     },
+    "node_modules/run-applescript": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/run-applescript/-/run-applescript-7.1.0.tgz",
+      "integrity": "sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/sade": {
       "version": "1.8.1",
       "resolved": "https://registry.npmjs.org/sade/-/sade-1.8.1.tgz",
@@ -6485,6 +7970,13 @@
         "node": ">=18"
       }
     },
+    "node_modules/sisteransi": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
+      "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/sonic-boom": {
       "version": "4.2.1",
       "resolved": "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.1.tgz",
@@ -7123,7 +8615,7 @@
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "bin": {
         "tsc": "bin/tsc",
@@ -7161,7 +8653,7 @@
       "version": "7.16.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
       "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/unpipe": {
@@ -7190,6 +8682,37 @@
         "node": ">=18.12.0"
       }
     },
+    "node_modules/update-browserslist-db": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
+      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "escalade": "^3.2.0",
+        "picocolors": "^1.1.1"
+      },
+      "bin": {
+        "update-browserslist-db": "cli.js"
+      },
+      "peerDependencies": {
+        "browserslist": ">= 4.21.0"
+      }
+    },
     "node_modules/uri-js": {
       "version": "4.4.1",
       "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
@@ -7345,7 +8868,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -7362,7 +8884,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -7418,7 +8939,6 @@
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
       "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -7597,7 +9117,7 @@
       "version": "8.19.0",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
       "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -7615,6 +9135,39 @@
         }
       }
     },
+    "node_modules/wsl-utils": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/wsl-utils/-/wsl-utils-0.1.0.tgz",
+      "integrity": "sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-wsl": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/xtend": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
+      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.4"
+      }
+    },
+    "node_modules/yallist": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
+      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/yocto-queue": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
@@ -7628,6 +9181,35 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/yocto-spinner": {
+      "version": "0.2.3",
+      "resolved": "https://registry.npmjs.org/yocto-spinner/-/yocto-spinner-0.2.3.tgz",
+      "integrity": "sha512-sqBChb33loEnkoXte1bLg45bEBsOP9N1kzQh5JZNKj/0rik4zAPTNSAVPj3uQAdc6slYJ0Ksc403G2XgxsJQFQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "yoctocolors": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=18.19"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/yoctocolors": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/yoctocolors/-/yoctocolors-2.1.2.tgz",
+      "integrity": "sha512-CzhO+pFNo8ajLM2d2IW/R93ipy99LWjtwblvC1RsoSUMZgyLbYFr221TnSNT7GjGdYui6P459mw9JH/g/zW2ug==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/yup": {
       "version": "1.7.1",
       "resolved": "https://registry.npmjs.org/yup/-/yup-1.7.1.tgz",
diff --git a/package.json b/package.json
index 85cce092..942e871c 100644
--- a/package.json
+++ b/package.json
@@ -17,6 +17,7 @@
     "test:e2e:ui": "playwright test --ui"
   },
   "devDependencies": {
+    "@better-auth/cli": "^1.4.19",
     "@eslint/compat": "^2.0.2",
     "@eslint/js": "^9.39.2",
     "@inlang/paraglide-js": "^2.12.0",

From 99e60647614afd91a67b49e450e4ea664a1f8074 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Fri, 6 Mar 2026 14:29:44 +0100
Subject: [PATCH 31/41] remove OIDC RP-initiated logout to avoid terminating
 the user's entire SSO session

---
 src/lib/server/auth.ts                 | 20 --------------------
 src/routes/auth/logout/+page.server.ts | 14 ++++----------
 2 files changed, 4 insertions(+), 30 deletions(-)

diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index 0113e4b5..8928551c 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -1,9 +1,6 @@
 import { betterAuth } from 'better-auth';
 import { genericOAuth } from 'better-auth/plugins';
 import Database from 'better-sqlite3';
-import { logger } from '$lib/server/logging';
-
-const log = logger.child({ module: 'auth' });
 
 // Use SvelteKit's $env when available, fall back to process.env for the
 // better-auth CLI which imports this file outside of SvelteKit via jiti.
@@ -23,23 +20,6 @@ export const oidcEnabled = !!(
   env.STACKABLE_UI_OIDC_CLIENT_SECRET
 );
 
-// Cache the OIDC discovery metadata (fetched once at startup) so the
-// end_session_endpoint is available for logout without a per-request fetch.
-export let oidcEndSessionEndpoint: string | undefined;
-
-if (oidcEnabled) {
-  try {
-    const res = await fetch(env.STACKABLE_UI_OIDC_DISCOVERY_URL!);
-    const discovery = await res.json();
-    oidcEndSessionEndpoint = discovery.end_session_endpoint;
-  } catch (err) {
-    log.warn(
-      { err },
-      'Failed to fetch OIDC discovery for end_session_endpoint, logout will be local-only'
-    );
-  }
-}
-
 export const auth = betterAuth({
   secret: env.STACKABLE_UI_SESSION_SECRET,
   baseURL: env.STACKABLE_UI_BASE_URL,
diff --git a/src/routes/auth/logout/+page.server.ts b/src/routes/auth/logout/+page.server.ts
index fd78e85e..ad629e9f 100644
--- a/src/routes/auth/logout/+page.server.ts
+++ b/src/routes/auth/logout/+page.server.ts
@@ -1,7 +1,6 @@
 import { redirect } from '@sveltejs/kit';
-import { env } from '$env/dynamic/private';
 import type { PageServerLoad } from './$types';
-import { auth, oidcEnabled, oidcEndSessionEndpoint } from '$lib/server/auth';
+import { auth, oidcEnabled } from '$lib/server/auth';
 
 export const load: PageServerLoad = async ({ request, locals, cookies }) => {
   if (locals.session) {
@@ -9,13 +8,8 @@ export const load: PageServerLoad = async ({ request, locals, cookies }) => {
     cookies.delete('better-auth.session_token', { path: '/' });
   }
 
-  // RP-initiated logout: redirect to the IdP so the SSO session is terminated
-  if (oidcEndSessionEndpoint) {
-    const url = new URL(oidcEndSessionEndpoint);
-    url.searchParams.set('post_logout_redirect_uri', `${env.STACKABLE_UI_BASE_URL}/auth/login`);
-    throw redirect(302, url.toString());
-  }
-
-  // When OIDC is disabled there is no login page, redirect to the home page.
+  // Local-only logout: we intentionally do not call the IdP's end_session_endpoint
+  // because RP-initiated logout would terminate the user's entire SSO session,
+  // logging them out of all applications — not just this one.
   throw redirect(302, oidcEnabled ? '/auth/login' : '/');
 };

From 7c804458d8b26a8694dd351da0c49661b9b344ee Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Fri, 6 Mar 2026 15:17:10 +0100
Subject: [PATCH 32/41] improve code readibility

---
 src/lib/components/layout/ThemeToggle.svelte | 15 +++++-----
 src/lib/server/trino.ts                      |  8 +++---
 src/routes/(app)/trino/+page.server.ts       | 14 ++++++----
 src/routes/(app)/trino/+page.svelte          | 29 ++++++++++++--------
 4 files changed, 39 insertions(+), 27 deletions(-)

diff --git a/src/lib/components/layout/ThemeToggle.svelte b/src/lib/components/layout/ThemeToggle.svelte
index ae1063ea..d9ee82d5 100644
--- a/src/lib/components/layout/ThemeToggle.svelte
+++ b/src/lib/components/layout/ThemeToggle.svelte
@@ -2,13 +2,14 @@
   import { browser } from '$app/environment';
   import * as m from '$lib/paraglide/messages.js';
 
-  let dark = $state(
-    browser
-      ? localStorage.getItem('theme') === 'dark' ||
-          (!localStorage.getItem('theme') &&
-            window.matchMedia('(prefers-color-scheme: dark)').matches)
-      : false
-  );
+  function prefersDark(): boolean {
+    if (!browser) return false;
+    const stored = localStorage.getItem('theme');
+    if (stored) return stored === 'dark';
+    return window.matchMedia('(prefers-color-scheme: dark)').matches;
+  }
+
+  let dark = $state(prefersDark());
 
   $effect(() => {
     if (!browser) return;
diff --git a/src/lib/server/trino.ts b/src/lib/server/trino.ts
index fbc4989f..9c769e39 100644
--- a/src/lib/server/trino.ts
+++ b/src/lib/server/trino.ts
@@ -47,19 +47,19 @@ export function buildAuthHeaders(auth: AuthConfig): Record<string, string> {
 export async function trinoFetch(
   url: string,
   auth: AuthConfig,
-  options?: RequestInit & { impersonateUser?: string }
+  options?: RequestInit,
+  impersonateUser?: string
 ): Promise<TrinoResponse> {
-  const { impersonateUser, ...fetchOptions } = options ?? {};
   const headers: Record<string, string> = {
     ...buildAuthHeaders(auth),
     'X-Trino-Source': 'stackable-ui',
-    ...((fetchOptions.headers as Record<string, string>) ?? {})
+    ...((options?.headers as Record<string, string>) ?? {})
   };
   if (impersonateUser) {
     headers['X-Trino-User'] = impersonateUser;
   }
   const res = await fetch(url, {
-    ...fetchOptions,
+    ...options,
     headers
   });
 
diff --git a/src/routes/(app)/trino/+page.server.ts b/src/routes/(app)/trino/+page.server.ts
index 897b14ba..7dd38ca3 100644
--- a/src/routes/(app)/trino/+page.server.ts
+++ b/src/routes/(app)/trino/+page.server.ts
@@ -52,11 +52,10 @@ export const actions: Actions = {
     let columns: TrinoColumn[] = [];
     const rows: unknown[][] = [];
     let nextUri: string | undefined = `${connectionUrl}/v1/statement`;
-    let fetchOptions: RequestInit & { impersonateUser?: string } = {
+    let fetchOptions: RequestInit = {
       method: 'POST',
       body: sql.replace(/;\s*$/, '').trim(),
-      headers: { 'Content-Type': 'text/plain' },
-      impersonateUser
+      headers: { 'Content-Type': 'text/plain' }
     };
 
     try {
@@ -70,7 +69,12 @@ export const actions: Actions = {
           );
         }
 
-        const response: TrinoResponse = await trinoFetch(nextUri, auth, fetchOptions);
+        const response: TrinoResponse = await trinoFetch(
+          nextUri,
+          auth,
+          fetchOptions,
+          impersonateUser
+        );
 
         if (response.error) {
           log.info({ err: response.error }, 'query error');
@@ -86,7 +90,7 @@ export const actions: Actions = {
 
         nextUri = response.nextUri;
         // Subsequent requests are GETs to the nextUri
-        fetchOptions = { impersonateUser };
+        fetchOptions = {};
       }
 
       const queryId = crypto.randomUUID();
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index 9af00be4..ba668c28 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -11,7 +11,13 @@
   const uid = $props.id();
   const PAGE_SIZES = [25, 50, 100];
 
-  function ls(key: string, fallback: string): string {
+  /** Translate known error codes, pass through other messages as-is. */
+  function translateError(errorMessage: string): string {
+    if (errorMessage === 'session_expired') return m.trino_session_expired();
+    return errorMessage;
+  }
+
+  function getStoredValue(key: string, fallback: string): string {
     try {
       return localStorage.getItem(key) ?? fallback;
     } catch {
@@ -66,7 +72,7 @@
         hasMore = msg.hasMore;
         totalRows = msg.totalRows;
       } else {
-        queryError = msg.message === 'session_expired' ? m.trino_session_expired() : msg.message;
+        queryError = translateError(msg.message);
       }
     }
   });
@@ -89,7 +95,7 @@
         totalRows = msg.totalRows;
         queryError = null;
       } else {
-        queryError = msg.message === 'session_expired' ? m.trino_session_expired() : msg.message;
+        queryError = translateError(msg.message);
         if (msg.message === 'session_expired') queryId = null;
       }
     }
@@ -98,13 +104,14 @@
   let hydrated = $state(false);
 
   onMount(() => {
-    $queryFormData.connectionUrl = ls('trino_url', '');
-    $queryFormData.authType = ls('trino_auth_type', 'none') as 'none' | 'basic';
-    $queryFormData.authUsername = ls('trino_username', '');
-    $queryFormData.authPassword = ls('trino_password', '');
-    $queryFormData.impersonation = ls('trino_impersonation', 'false') === 'true';
-    $queryFormData.sql = ls('trino_sql', 'SELECT 1');
-    $queryFormData.pageSize = parseInt(ls('trino_page_size', '25'), 10) as 25 | 50 | 100;
+    $queryFormData.connectionUrl = getStoredValue('trino_url', '');
+    $queryFormData.authType = getStoredValue('trino_auth_type', 'none') as 'none' | 'basic';
+    $queryFormData.authUsername = getStoredValue('trino_username', '');
+    $queryFormData.authPassword = getStoredValue('trino_password', '');
+    $queryFormData.impersonation = getStoredValue('trino_impersonation', 'false') === 'true';
+    $queryFormData.sql = getStoredValue('trino_sql', 'SELECT 1');
+    const storedPageSize = parseInt(getStoredValue('trino_page_size', '25'), 10);
+    $queryFormData.pageSize = PAGE_SIZES.includes(storedPageSize) ? storedPageSize : 25;
     hydrated = true;
   });
 
@@ -112,7 +119,7 @@
 
   const connKey = $derived(() => {
     const { connectionUrl, authType, authUsername, impersonation } = $queryFormData;
-    return `${connectionUrl}\0${authType}\0${authUsername}\0${impersonation}`;
+    return [connectionUrl, authType, authUsername, impersonation].join('|');
   });
 
   // Invalidate results when connection settings change after a query.

From e8244a6646833515097ec5e3e8e89b91b5cfe20d Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 9 Mar 2026 14:38:18 +0100
Subject: [PATCH 33/41] use sveltekitCookies plugin to handle cookie management
 instead of manual deletion

---
 src/lib/server/auth.ts                 | 72 ++++++++++++++------------
 src/routes/auth/logout/+page.server.ts |  3 +-
 2 files changed, 39 insertions(+), 36 deletions(-)

diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index 8928551c..5f0617ad 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -1,15 +1,16 @@
 import { betterAuth } from 'better-auth';
 import { genericOAuth } from 'better-auth/plugins';
+import { sveltekitCookies } from 'better-auth/svelte-kit';
 import Database from 'better-sqlite3';
+import type { RequestEvent } from '@sveltejs/kit';
 
-// Use SvelteKit's $env when available, fall back to process.env for the
-// better-auth CLI which imports this file outside of SvelteKit via jiti.
-let env: Record<string, string | undefined>;
-try {
-  env = (await import('$env/dynamic/private')).env;
-} catch {
-  env = process.env as Record<string, string | undefined>;
-}
+// Dynamic imports with fallbacks for the better-auth CLI which imports this
+// file outside of SvelteKit via jiti.
+const envModule = await import('$env/dynamic/private').catch(() => null);
+const appServer = await import('$app/server').catch(() => null);
+
+const env = envModule?.env ?? (process.env as Record<string, string | undefined>);
+const getRequestEvent = appServer?.getRequestEvent ?? (() => undefined as unknown as RequestEvent);
 
 const usernameClaim = env.STACKABLE_UI_OIDC_USERNAME_CLAIM ?? 'preferred_username';
 
@@ -35,31 +36,34 @@ export const auth = betterAuth({
       }
     }
   },
-  plugins: oidcEnabled
-    ? [
-        genericOAuth({
-          config: [
-            {
-              providerId: 'oidc',
-              discoveryUrl: env.STACKABLE_UI_OIDC_DISCOVERY_URL,
-              clientId: env.STACKABLE_UI_OIDC_CLIENT_ID!,
-              clientSecret: env.STACKABLE_UI_OIDC_CLIENT_SECRET!,
-              scopes: ['openid', 'profile', 'email'],
-              pkce: true,
-              mapProfileToUser: async (profile) => {
-                const fullName = [profile.given_name, profile.family_name]
-                  .filter(Boolean)
-                  .join(' ');
-                return {
-                  name: profile.name || fullName || profile.preferred_username || profile.email,
-                  email: profile.email || profile.preferred_username,
-                  image: profile.picture || null,
-                  username: profile[usernameClaim] || profile.preferred_username || profile.email
-                };
+  plugins: [
+    sveltekitCookies(getRequestEvent),
+    ...(oidcEnabled
+      ? [
+          genericOAuth({
+            config: [
+              {
+                providerId: 'oidc',
+                discoveryUrl: env.STACKABLE_UI_OIDC_DISCOVERY_URL,
+                clientId: env.STACKABLE_UI_OIDC_CLIENT_ID!,
+                clientSecret: env.STACKABLE_UI_OIDC_CLIENT_SECRET!,
+                scopes: ['openid', 'profile', 'email'],
+                pkce: true,
+                mapProfileToUser: async (profile) => {
+                  const fullName = [profile.given_name, profile.family_name]
+                    .filter(Boolean)
+                    .join(' ');
+                  return {
+                    name: profile.name || fullName || profile.preferred_username || profile.email,
+                    email: profile.email || profile.preferred_username,
+                    image: profile.picture || null,
+                    username: profile[usernameClaim] || profile.preferred_username || profile.email
+                  };
+                }
               }
-            }
-          ]
-        })
-      ]
-    : []
+            ]
+          })
+        ]
+      : [])
+  ]
 });
diff --git a/src/routes/auth/logout/+page.server.ts b/src/routes/auth/logout/+page.server.ts
index ad629e9f..08c480bf 100644
--- a/src/routes/auth/logout/+page.server.ts
+++ b/src/routes/auth/logout/+page.server.ts
@@ -2,10 +2,9 @@ import { redirect } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
 import { auth, oidcEnabled } from '$lib/server/auth';
 
-export const load: PageServerLoad = async ({ request, locals, cookies }) => {
+export const load: PageServerLoad = async ({ request, locals }) => {
   if (locals.session) {
     await auth.api.signOut({ headers: request.headers });
-    cookies.delete('better-auth.session_token', { path: '/' });
   }
 
   // Local-only logout: we intentionally do not call the IdP's end_session_endpoint

From 7e7e20a2c7e85a5c410cc32921cbb54545cd1ca7 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 9 Mar 2026 15:09:25 +0100
Subject: [PATCH 34/41] enable better-auth openAPI plugin to expose API
 reference endpoints

---
 src/lib/server/auth.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index 5f0617ad..c936b8ef 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -1,5 +1,5 @@
 import { betterAuth } from 'better-auth';
-import { genericOAuth } from 'better-auth/plugins';
+import { genericOAuth, openAPI } from 'better-auth/plugins';
 import { sveltekitCookies } from 'better-auth/svelte-kit';
 import Database from 'better-sqlite3';
 import type { RequestEvent } from '@sveltejs/kit';
@@ -38,6 +38,7 @@ export const auth = betterAuth({
   },
   plugins: [
     sveltekitCookies(getRequestEvent),
+    openAPI(),
     ...(oidcEnabled
       ? [
           genericOAuth({

From e918a60cf7c4a1d0f66c8bfc13feb179726b62ef Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 9 Mar 2026 16:20:30 +0100
Subject: [PATCH 35/41] =?UTF-8?q?Replace=20(()=20=3D>=20=E2=80=A6)=20with?=
 =?UTF-8?q?=20.by()?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/routes/(app)/trino/+page.svelte | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index 02cd96e5..7bbcaf30 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -55,7 +55,7 @@
       queryId = null;
       totalRows = null;
       currentPage = 0;
-      queriedConnKey = connKey();
+      queriedConnKey = connKey;
     },
     onUpdated({ form }) {
       if (form.errors.connectionUrl) {
@@ -117,14 +117,14 @@
 
   const running = $derived($querySubmitting || $paginateSubmitting);
 
-  const connKey = $derived(() => {
+  const connKey = $derived.by(() => {
     const { connectionUrl, authType, authUsername, impersonation } = $queryFormData;
     return [connectionUrl, authType, authUsername, impersonation].join('|');
   });
 
   // Invalidate results when connection settings change after a query.
   $effect(() => {
-    const key = connKey();
+    const key = connKey;
     if (queriedConnKey && key !== queriedConnKey) {
       columns = [];
       rows = [];
@@ -153,7 +153,7 @@
     localStorage.setItem('trino_page_size', String(pageSize));
   });
 
-  const connectionSummary = $derived(() => {
+  const connectionSummary = $derived.by(() => {
     const host = $queryFormData.connectionUrl
       ? $queryFormData.connectionUrl.replace(/^https?:\/\//, '').replace(/\/$/, '')
       : '—';
@@ -220,7 +220,7 @@
         class="collapse-title text-base-content flex items-center justify-between pr-4 text-sm font-medium"
       >
         <span>{m.trino_connection_label()}</span>
-        <span class="text-base-content/50 font-mono text-xs">{connectionSummary()}</span>
+        <span class="text-base-content/50 font-mono text-xs">{connectionSummary}</span>
       </div>
       <div class="collapse-content flex flex-col gap-4">
         <!-- URL -->

From d6123c50cefaa6442605bbf14d25e106b95b728c Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 9 Mar 2026 16:33:38 +0100
Subject: [PATCH 36/41] fix build issue

---
 package-lock.json | 64 +++++++++++++----------------------------------
 package.json      |  5 +++-
 2 files changed, 22 insertions(+), 47 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 15240c25..19b1e2fc 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,7 +10,7 @@
       "dependencies": {
         "@internationalized/date": "^3.11.0",
         "antlr4ng": "^3.0.16",
-        "better-auth": "^1.4.19",
+        "better-auth": "^1.5.4",
         "better-sqlite3": "^12.6.2",
         "monaco-editor": "^0.55.1",
         "pino": "^10.3.1",
@@ -2699,13 +2699,6 @@
         }
       }
     },
-    "node_modules/@sveltejs/kit/node_modules/set-cookie-parser": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.0.1.tgz",
-      "integrity": "sha512-n7Z7dXZhJbwuAHhNzkTti6Aw9QDDjZtm3JTpTGATIdNzdQz5GuFs22w90BcvF4INfnrL5xrX3oGsuqO5Dx3A1Q==",
-      "devOptional": true,
-      "license": "MIT"
-    },
     "node_modules/@sveltejs/vite-plugin-svelte": {
       "version": "6.2.4",
       "resolved": "https://registry.npmjs.org/@sveltejs/vite-plugin-svelte/-/vite-plugin-svelte-6.2.4.tgz",
@@ -4121,26 +4114,6 @@
       "integrity": "sha512-+CGp4UmZSUrHHnpHhLPYu6cV+wSUSvVbZbNykxhUDocpVNTo9uFFxw/NqJlh1iC4wQ9HKKWGCKuZ5wUgS0v6Kg==",
       "license": "MIT"
     },
-    "node_modules/better-auth/node_modules/better-call": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/better-call/-/better-call-1.3.2.tgz",
-      "integrity": "sha512-4cZIfrerDsNTn3cm+MhLbUePN0gdwkhSXEuG7r/zuQ8c/H7iU0/jSK5TD3FW7U0MgKHce/8jGpPYNO4Ve+4NBw==",
-      "license": "MIT",
-      "dependencies": {
-        "@better-auth/utils": "^0.3.1",
-        "@better-fetch/fetch": "^1.1.21",
-        "rou3": "^0.7.12",
-        "set-cookie-parser": "^3.0.1"
-      },
-      "peerDependencies": {
-        "zod": "^4.0.0"
-      },
-      "peerDependenciesMeta": {
-        "zod": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/better-auth/node_modules/kysely": {
       "version": "0.28.11",
       "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.11.tgz",
@@ -4150,23 +4123,16 @@
         "node": ">=20.0.0"
       }
     },
-    "node_modules/better-auth/node_modules/set-cookie-parser": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.0.1.tgz",
-      "integrity": "sha512-n7Z7dXZhJbwuAHhNzkTti6Aw9QDDjZtm3JTpTGATIdNzdQz5GuFs22w90BcvF4INfnrL5xrX3oGsuqO5Dx3A1Q==",
-      "license": "MIT"
-    },
     "node_modules/better-call": {
-      "version": "1.1.8",
-      "resolved": "https://registry.npmjs.org/better-call/-/better-call-1.1.8.tgz",
-      "integrity": "sha512-XMQ2rs6FNXasGNfMjzbyroSwKwYbZ/T3IxruSS6U2MJRsSYh3wYtG3o6H00ZlKZ/C/UPOAD97tqgQJNsxyeTXw==",
-      "dev": true,
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/better-call/-/better-call-1.3.2.tgz",
+      "integrity": "sha512-4cZIfrerDsNTn3cm+MhLbUePN0gdwkhSXEuG7r/zuQ8c/H7iU0/jSK5TD3FW7U0MgKHce/8jGpPYNO4Ve+4NBw==",
       "license": "MIT",
       "dependencies": {
-        "@better-auth/utils": "^0.3.0",
-        "@better-fetch/fetch": "^1.1.4",
-        "rou3": "^0.7.10",
-        "set-cookie-parser": "^2.7.1"
+        "@better-auth/utils": "^0.3.1",
+        "@better-fetch/fetch": "^1.1.21",
+        "rou3": "^0.7.12",
+        "set-cookie-parser": "^3.0.1"
       },
       "peerDependencies": {
         "zod": "^4.0.0"
@@ -4177,6 +4143,12 @@
         }
       }
     },
+    "node_modules/better-call/node_modules/@better-auth/utils": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.3.1.tgz",
+      "integrity": "sha512-+CGp4UmZSUrHHnpHhLPYu6cV+wSUSvVbZbNykxhUDocpVNTo9uFFxw/NqJlh1iC4wQ9HKKWGCKuZ5wUgS0v6Kg==",
+      "license": "MIT"
+    },
     "node_modules/better-sqlite3": {
       "version": "12.6.2",
       "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.6.2.tgz",
@@ -7590,6 +7562,7 @@
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/pg-cloudflare/-/pg-cloudflare-1.3.0.tgz",
       "integrity": "sha512-6lswVVSztmHiRtD6I8hw4qP/nDm1EJbKMRhf3HCYaqud7frGysPv7FYJ5noZQdhQtN2xJnimfMtvQq21pdbzyQ==",
+      "dev": true,
       "license": "MIT",
       "optional": true
     },
@@ -8738,10 +8711,9 @@
       }
     },
     "node_modules/set-cookie-parser": {
-      "version": "2.7.2",
-      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-2.7.2.tgz",
-      "integrity": "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==",
-      "dev": true,
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.0.1.tgz",
+      "integrity": "sha512-n7Z7dXZhJbwuAHhNzkTti6Aw9QDDjZtm3JTpTGATIdNzdQz5GuFs22w90BcvF4INfnrL5xrX3oGsuqO5Dx3A1Q==",
       "license": "MIT"
     },
     "node_modules/setprototypeof": {
diff --git a/package.json b/package.json
index e77e5c13..30972b3b 100644
--- a/package.json
+++ b/package.json
@@ -57,10 +57,13 @@
   "dependencies": {
     "@internationalized/date": "^3.11.0",
     "antlr4ng": "^3.0.16",
-    "better-auth": "^1.4.19",
+    "better-auth": "^1.5.4",
     "better-sqlite3": "^12.6.2",
     "monaco-editor": "^0.55.1",
     "pino": "^10.3.1",
     "prom-client": "^15.1.3"
+  },
+  "overrides": {
+    "better-call": "1.3.2"
   }
 }

From 8fac34fa68efa2096c3ba028daffd515c23a2df7 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 9 Mar 2026 16:55:21 +0100
Subject: [PATCH 37/41] Scope build-time placeholder env vars to the RUN
 instruction instead of baking them into the layer

---
 docker/Dockerfile | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index 030230c9..602024c3 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.16.0@sha256:b6afd42430b15f2d2a4c5a02b919e98a525b785b1aaff16747d2f623364e39b6
-# check=error=true;skip=SecretsUsedInArgOrEnv
+# check=error=true
 
 # Find the latest version at https://catalog.redhat.com/software/containers/ubi10/ubi-minimal
 # IMPORTANT: Make sure to use the "Manifest List Digest" that references the images for multiple architectures
@@ -58,15 +58,13 @@ COPY project.inlang/ ./project.inlang/
 COPY messages/ ./messages/
 COPY svelte.config.js tsconfig.json vite.config.ts ./
 
-# Create the default SQLite directory and set dummy env vars so the build's
-# SSR prerender phase can initialise better-auth without errors.
-# These are only used during the build and discarded with the builder stage.
-RUN mkdir -p .data
-ENV STACKABLE_UI_SESSION_SECRET="build-time-placeholder" \
-    STACKABLE_UI_BASE_URL="http://localhost:3000"
-
-# Build the application
-RUN npm run build
+# Build the application. The dummy env vars let better-auth initialise during
+# SSR prerender; they are scoped to this single RUN and discarded with the
+# builder stage.
+RUN mkdir -p .data && \
+    STACKABLE_UI_SESSION_SECRET="build-time-placeholder" \
+    STACKABLE_UI_BASE_URL="http://localhost:3000" \
+    npm run build
 
 # Install only production dependencies; --ignore-scripts skips the prepare script
 # (which would fail because antlr-ng is a devDependency and not available here)

From a95dc3f1210d80eb0d6ad992149240a4d1f3b560 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 9 Mar 2026 17:12:01 +0100
Subject: [PATCH 38/41] Replace manual .env file parser with Node.js built-in
 process.loadEnvFile()

---
 e2e/global-setup.ts | 20 +-------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/e2e/global-setup.ts b/e2e/global-setup.ts
index 3ecca161..b85dc8f8 100644
--- a/e2e/global-setup.ts
+++ b/e2e/global-setup.ts
@@ -1,33 +1,15 @@
 import path from 'path';
 import { execSync } from 'child_process';
-import { readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
-function parseEnvFile(filePath: string): Record<string, string> {
-  const content = readFileSync(filePath, 'utf-8');
-  const vars: Record<string, string> = {};
-  for (const line of content.split('\n')) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) continue;
-    const eqIndex = trimmed.indexOf('=');
-    if (eqIndex === -1) continue;
-    vars[trimmed.slice(0, eqIndex)] = trimmed.slice(eqIndex + 1);
-  }
-  return vars;
-}
-
 export default async function globalSetup() {
-  const testEnv = parseEnvFile(path.join(__dirname, '..', '.env.test'));
+  process.loadEnvFile(path.join(__dirname, '..', '.env.test'));
 
   // Run database migration with all test env vars so the OIDC plugin tables are created
   execSync('npx @better-auth/cli migrate --yes', {
     cwd: path.join(__dirname, '..'),
-    env: {
-      ...process.env,
-      ...testEnv
-    },
     stdio: 'inherit'
   });
 }

From 7f8ada26e9d787f1511434e511e6604545ab76db Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Mon, 9 Mar 2026 17:30:34 +0100
Subject: [PATCH 39/41] Replace manual  polyfill with Node.js built-in  in E2E
 and Playwright config

---
 e2e/auth.setup.ts    |  4 +---
 e2e/global-setup.ts  |  7 ++-----
 e2e/i18n.spec.ts     |  4 +---
 playwright.config.ts | 10 ++++------
 4 files changed, 8 insertions(+), 17 deletions(-)

diff --git a/e2e/auth.setup.ts b/e2e/auth.setup.ts
index 4410c563..a5f94bc1 100644
--- a/e2e/auth.setup.ts
+++ b/e2e/auth.setup.ts
@@ -1,10 +1,8 @@
 import { test as setup, expect } from '@playwright/test';
 import path from 'path';
-import { fileURLToPath } from 'url';
 import { waitForHydration } from './helpers.js';
 
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const authFile = path.join(__dirname, '.auth/user.json');
+const authFile = path.join(import.meta.dirname, '.auth/user.json');
 
 setup('authenticate via mock OIDC', async ({ page }) => {
   // Navigate to the app — auth guard redirects to /auth/login
diff --git a/e2e/global-setup.ts b/e2e/global-setup.ts
index b85dc8f8..9a2640c3 100644
--- a/e2e/global-setup.ts
+++ b/e2e/global-setup.ts
@@ -1,15 +1,12 @@
 import path from 'path';
 import { execSync } from 'child_process';
-import { fileURLToPath } from 'url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 export default async function globalSetup() {
-  process.loadEnvFile(path.join(__dirname, '..', '.env.test'));
+  process.loadEnvFile(path.join(import.meta.dirname, '..', '.env.test'));
 
   // Run database migration with all test env vars so the OIDC plugin tables are created
   execSync('npx @better-auth/cli migrate --yes', {
-    cwd: path.join(__dirname, '..'),
+    cwd: path.join(import.meta.dirname, '..'),
     stdio: 'inherit'
   });
 }
diff --git a/e2e/i18n.spec.ts b/e2e/i18n.spec.ts
index 4840de40..83619c72 100644
--- a/e2e/i18n.spec.ts
+++ b/e2e/i18n.spec.ts
@@ -1,11 +1,9 @@
 import { test, expect } from '@playwright/test';
 import fs from 'fs';
 import path from 'path';
-import { fileURLToPath } from 'url';
 import { waitForHydration } from './helpers';
 
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const authFile = path.join(__dirname, '.auth/user.json');
+const authFile = path.join(import.meta.dirname, '.auth/user.json');
 
 /** Load the saved auth storage state, optionally stripping the locale cookie. */
 function loadAuthState({ withoutLocale = false } = {}) {
diff --git a/playwright.config.ts b/playwright.config.ts
index a9607d8d..840f0cd3 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -1,15 +1,13 @@
 import { defineConfig } from '@playwright/test';
 import path from 'path';
-import { fileURLToPath } from 'url';
 
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const baseURL = process.env.PLAYWRIGHT_BASE_URL ?? 'http://localhost:4173';
 
 export default defineConfig({
-  testDir: path.join(__dirname, 'e2e'),
-  outputDir: path.join(__dirname, 'e2e/test-results'),
-  globalSetup: path.join(__dirname, 'e2e/global-setup.ts'),
-  globalTeardown: path.join(__dirname, 'e2e/global-teardown.ts'),
+  testDir: path.join(import.meta.dirname, 'e2e'),
+  outputDir: path.join(import.meta.dirname, 'e2e/test-results'),
+  globalSetup: path.join(import.meta.dirname, 'e2e/global-setup.ts'),
+  globalTeardown: path.join(import.meta.dirname, 'e2e/global-teardown.ts'),
   timeout: 30_000,
   expect: {
     timeout: 10_000

From ad3131febae9291c90993459bb1c039c1146194a Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Tue, 10 Mar 2026 10:59:10 +0100
Subject: [PATCH 40/41] Add explanatory comment for the better-call version
 override in package.json

---
 package.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package.json b/package.json
index 30972b3b..7c974af1 100644
--- a/package.json
+++ b/package.json
@@ -63,6 +63,7 @@
     "pino": "^10.3.1",
     "prom-client": "^15.1.3"
   },
+  "//overrides": "Pin better-call to 1.3.2 because without this override npm hoists the older 1.1.8 (from @better-auth/cli's transitive tree) to the top level, breaking better-auth 1.5.4 which requires 1.3.2 at runtime.",
   "overrides": {
     "better-call": "1.3.2"
   }

From 14a0297911213afe08c5010918bbdc942c9177d8 Mon Sep 17 00:00:00 2001
From: Benedikt Labrenz <benedikt@labrenz.org>
Date: Tue, 10 Mar 2026 11:39:40 +0100
Subject: [PATCH 41/41] Revert vitest-browser-svelte to ^2.0.2

---
 package-lock.json | 24 ++++++++++++++++++++----
 package.json      |  2 +-
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 19b1e2fc..953f4fdf 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -50,7 +50,7 @@
         "typescript-eslint": "^8.56.1",
         "vite": "^7.3.1",
         "vitest": "^4.0.18",
-        "vitest-browser-svelte": "2.0.1",
+        "vitest-browser-svelte": "^2.0.2",
         "zod": "^4.3.6"
       }
     },
@@ -3019,6 +3019,19 @@
         "vite": "^5.2.0 || ^6 || ^7"
       }
     },
+    "node_modules/@testing-library/svelte-core": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@testing-library/svelte-core/-/svelte-core-1.0.0.tgz",
+      "integrity": "sha512-VkUePoLV6oOYwSUvX6ShA8KLnJqZiYMIbP2JW2t0GLWLkJxKGvuH5qrrZBV/X7cXFnLGuFQEC7RheYiZOW68KQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=16"
+      },
+      "peerDependencies": {
+        "svelte": "^3 || ^4 || ^5 || ^5.0.0-next.0"
+      }
+    },
     "node_modules/@types/better-sqlite3": {
       "version": "7.6.13",
       "resolved": "https://registry.npmjs.org/@types/better-sqlite3/-/better-sqlite3-7.6.13.tgz",
@@ -10062,11 +10075,14 @@
       }
     },
     "node_modules/vitest-browser-svelte": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/vitest-browser-svelte/-/vitest-browser-svelte-2.0.1.tgz",
-      "integrity": "sha512-z7GFio7vxaOolY+xwPUMEKuwL4KcPzB8+bepA9F0Phqag/TJ4j7IAGSwm4Y/FBh7KznsP+7aEIllMay0qDpFXw==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/vitest-browser-svelte/-/vitest-browser-svelte-2.0.2.tgz",
+      "integrity": "sha512-OLJVYoIYflwToFIy3s41pZ9mVp6dwXfYd8IIsWoc57g8DyN3SxsNJ5GB1xWFPxLFlKM+1MPExjPxLaqdELrfRQ==",
       "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "@testing-library/svelte-core": "^1.0.0"
+      },
       "funding": {
         "url": "https://opencollective.com/vitest"
       },
diff --git a/package.json b/package.json
index 7c974af1..2f9c6598 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "typescript-eslint": "^8.56.1",
     "vite": "^7.3.1",
     "vitest": "^4.0.18",
-    "vitest-browser-svelte": "2.0.1",
+    "vitest-browser-svelte": "^2.0.2",
     "zod": "^4.3.6"
   },
   "dependencies": {