@antelopejs/dms-frontend 0.5.5 → 0.6.0

package/templates/vue/ssr-renderer.ts

@@ -2,23 +2,29 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { createInertiaApp } from "@inertiajs/vue3";
 import { createHead, renderSSRHead } from "@unhead/vue/server";
 import { renderToString } from "@vue/server-renderer";
-import { createSSRApp, h } from "vue";
+import { stringify } from "devalue";
+import { createSSRApp, h, readonly } from "vue";
+import { appConfigs } from "./app-configs.generated";
 import {
+  DMS_PAYLOAD_ID,
   type DmsServerFetch,
   SSR_ASYNC_COMPONENTS_ID,
   configureDmsApp,
   resolveDmsInertiaPage,
-  serializeDmsAsyncData,
   trackDmsAsyncComponents,
 } from "./app-runtime";
 import {
   type DmsErrorData,
   type DmsFrontendRuntime,
+  type DmsInertiaPage,
   type DmsPageProps,
+  type DmsPayload,
   createDmsFrontendRuntime,
   hasDmsPage,
+  pageErrorData,
   preloadDmsPage,
   resolveDmsAccessRedirect,
+  serializeDmsPayload,
   setDmsServerRuntimeResolver,
   setupFrontendModules,
   trackDmsServerScopes,
@@ -26,6 +32,8 @@ import {
 import { frontendModules } from "./frontend-modules.generated";
 import {
   SSR_ICONS_ID,
+  collectDmsIconSymbols,
+  dmsIconSprite,
   serializeDmsIcons,
   trackDmsIcons,
 } from "./icon-hydration";
@@ -59,7 +67,6 @@ interface DmsSsrContext {
   teleports?: Record<string, string>;
 }
 
-const SSR_ASYNC_DATA_ID = "dms-ssr-async-data";
 // Holds the runtime rather than being it: every socket, timer and promise a
 // render starts keeps this store for its whole life, and a pooled backend
 // connection then serving an SSE stream lives for hours. Emptied once the
@@ -68,13 +75,38 @@ const runtimeStorage = new AsyncLocalStorage<{
   runtime?: DmsFrontendRuntime;
 }>();
 setDmsServerRuntimeResolver(() => runtimeStorage.getStore()?.runtime);
+/** Set while an async data handler runs: its requests are transferred. */
+const asyncDataHandlerStorage = new AsyncLocalStorage<boolean>();
 
-function asyncDataScript(runtime: DmsFrontendRuntime): string {
-  const value = JSON.stringify(serializeDmsAsyncData(runtime)).replaceAll(
-    "<",
-    "\\u003c",
-  );
-  return `<script id="${SSR_ASYNC_DATA_ID}" type="application/json">${value}</script>`;
+/**
+ * The payload in devalue's format, which keeps what JSON cannot (a Set, a
+ * Date). A value it cannot write, such as a class instance a transform
+ * returned, is left out rather than failing the page: the browser starts over
+ * for that key, as it did before the key was transferred.
+ */
+function stringifyPayload(payload: DmsPayload): string {
+  try {
+    return stringify(payload);
+  } catch {
+    const kept: DmsPayload = { data: {}, errors: {}, state: {} };
+    for (const part of ["data", "errors", "state"] as const)
+      for (const [key, value] of Object.entries(payload[part]))
+        try {
+          stringify(value);
+          kept[part][key] = value as never;
+        } catch (error) {
+          console.error(`DMS payload: "${key}" cannot be serialized`, error);
+        }
+    return stringify(kept);
+  }
+}
+
+function payloadScript(payload: DmsPayload): string {
+  // Escaped like Inertia's page object, so that no value can end the script.
+  const value = stringifyPayload(payload)
+    .replaceAll("/", "\\/")
+    .replaceAll("<", "\\u003c");
+  return `<script id="${DMS_PAYLOAD_ID}" type="application/json">${value}</script>`;
 }
 
 function asyncComponentsScript(names: Set<string>): string {
@@ -90,7 +122,7 @@ function iconsScript(names: Set<string>): string {
   return `<script id="${SSR_ICONS_ID}" type="application/json">${value}</script>`;
 }
 
-await setupFrontendModules(frontendModules);
+await setupFrontendModules(frontendModules, appConfigs);
 
 export function isDmsFrontendPage(path: string): boolean {
   return hasDmsPage(path);
@@ -111,6 +143,12 @@ export async function renderDmsPage(
     true,
     requestCookies,
   );
+  runtime.runAsyncDataHandler = (run) => asyncDataHandlerStorage.run(true, run);
+  runtime.inAsyncDataHandler = () =>
+    asyncDataHandlerStorage.getStore() === true;
+  runtime.devWarnings = import.meta.env.DEV;
+  // The page Inertia's app sets as it starts, held by the request's runtime.
+  runtime.inertiaPage = readonly({ flash: {}, ...page }) as DmsInertiaPage;
   const store = { runtime };
   try {
     return await runtimeStorage.run(store, () =>
@@ -133,14 +171,23 @@ async function renderDmsPageWithRuntime(
     const ssrContext: DmsSsrContext = {};
     let asyncComponents = new Set<string>();
     let icons = new Set<string>();
+    let iconSymbols = new Map<string, string>();
+    let payload: DmsPayload = { data: {}, errors: {}, state: {} };
     const inertiaResult = await createInertiaApp({
       page,
-      render: (app) => renderToString(app, ssrContext),
+      // Read as the HTML is complete: data a run settles afterwards was never
+      // rendered, and the browser must not hydrate the page with it.
+      render: async (app) => {
+        const html = await renderToString(app, ssrContext);
+        payload = serializeDmsPayload(runtime);
+        return html;
+      },
       resolve: resolveDmsInertiaPage,
       async setup({ App, props, plugin }) {
         const app = createSSRApp({ render: () => h(App, props) });
         asyncComponents = trackDmsAsyncComponents(app);
         icons = trackDmsIcons(app);
+        iconSymbols = collectDmsIconSymbols(app);
         stopScopes = trackDmsServerScopes(app);
         const configured = await configureDmsApp({
           app,
@@ -174,13 +221,7 @@ async function renderDmsPageWithRuntime(
       // the DMS error page describes in the visitor's language; the technical
       // cause only reaches the server log.
       if (!expected) console.error("DMS page render failed", failure);
-      const error = expected
-        ? {
-            statusCode: failure.statusCode,
-            message: failure.message,
-            statusMessage: failure.statusMessage,
-          }
-        : { statusCode: 500 };
+      const error = expected ? pageErrorData(failure) : { statusCode: 500 };
       return renderDmsPage(
         { ...page, props: { ...page.props, error } },
         serverFetch,
@@ -190,7 +231,7 @@ async function renderDmsPageWithRuntime(
     const renderedHead = await renderSSRHead(head);
     return {
       error: page.props.error,
-      body: `${inertiaResult.body}${asyncDataScript(runtime)}${asyncComponentsScript(asyncComponents)}${iconsScript(icons)}`,
+      body: `${inertiaResult.body}${dmsIconSprite(iconSymbols)}${payloadScript(payload)}${asyncComponentsScript(asyncComponents)}${iconsScript(icons)}`,
       head: {
         bodyAttrs: renderedHead.bodyAttrs,
         headTags: `${inertiaResult.head.join("")}${renderedHead.headTags}`,

package/templates/vue/tsconfig.json

@@ -16,7 +16,8 @@
   "files": [
     "globals.d.ts",
     "auto-imports.d.ts",
-    "frontend-modules.generated.ts"
+    "frontend-modules.generated.ts",
+    "app-configs.generated.ts"
   ],
   "include": ["frontend-modules/**/*.ts", "frontend-modules/**/*.vue"],
   "exclude": [

package/templates/vue/ui-app-config.ts

@@ -1,13 +1,21 @@
 import { defu } from "defu";
 
-type PlainRecord = Record<string, unknown>;
+export type PlainRecord = Record<string, unknown>;
 
 interface MergeState {
   pristine: PlainRecord;
   mergedFrom: object | null;
 }
 
-function isPlainRecord(value: unknown): value is PlainRecord {
+interface MergeOptions {
+  /**
+   * The DMS config was merged before and has changed since, in place: its
+   * identity alone cannot tell.
+   */
+  isChanged?: boolean;
+}
+
+export function isPlainRecord(value: unknown): value is PlainRecord {
   return (
     typeof value === "object" &&
     value !== null &&
@@ -15,7 +23,8 @@ function isPlainRecord(value: unknown): value is PlainRecord {
   );
 }
 
-function clonePlain<T>(value: T): T {
+/** A deep copy of the records and arrays in `value`, sharing anything else. */
+export function clonePlain<T>(value: T): T {
   if (Array.isArray(value)) return value.map(clonePlain) as T;
   if (!isPlainRecord(value)) return value;
   return Object.fromEntries(
@@ -35,20 +44,23 @@ function replaceInPlace(target: PlainRecord, source: PlainRecord): void {
  * Each DMS config is merged once, so arrays that defu concatenates never pile
  * up across renders. A new DMS config, after a development reload, replaces
  * the previous merge: Nuxt UI's object is reset to its own values first, so
- * changed and removed keys both reach the next server render.
+ * changed and removed keys both reach the next server render. So does a DMS
+ * config a layer's edited app config changed in place, in the browser, once
+ * the caller says so.
  */
 export function createUiAppConfigMerger(): (
   uiAppConfig: PlainRecord,
   dmsAppConfig: object,
+  options?: MergeOptions,
 ) => void {
   const states = new WeakMap<object, MergeState>();
-  return (uiAppConfig, dmsAppConfig) => {
+  return (uiAppConfig, dmsAppConfig, { isChanged = false } = {}) => {
     let state = states.get(uiAppConfig);
     if (state === undefined) {
       state = { pristine: clonePlain({ ...uiAppConfig }), mergedFrom: null };
       states.set(uiAppConfig, state);
     }
-    if (state.mergedFrom === dmsAppConfig) return;
+    if (state.mergedFrom === dmsAppConfig && !isChanged) return;
     replaceInPlace(
       uiAppConfig,
       defu(clonePlain(dmsAppConfig), clonePlain(state.pristine)),

package/templates/vue/ui-inertia-page.mjs

@@ -0,0 +1,37 @@
+// Nuxt UI reads Inertia's page (`usePage()`) for its links and route stub.
+// Inertia's page is module state, shared by the concurrent requests of a
+// server: a render could read another request's URL. Nuxt UI's files read
+// the DMS's per-request page instead, and the build fails if one reads
+// Inertia's in a form this rewrite does not know, rather than letting the
+// leak come back unnoticed with a Nuxt UI release.
+
+const INERTIA_PAGE_IMPORT =
+  /import\s*\{\s*usePage\s*\}\s*from\s*["']@inertiajs\/vue3["']/g;
+const DMS_PAGE_IMPORT =
+  'import { useDmsInertiaPage as usePage } from "#dms/frontend-module"';
+/** Any import of `usePage` from Inertia, aliased or among other names. */
+const ANY_INERTIA_PAGE_IMPORT =
+  /import\s*\{[^}]*\busePage\b[^}]*\}\s*from\s*["']@inertiajs\/vue3["']|import\s*\*\s*as\s+\w+\s+from\s*["']@inertiajs\/vue3["']/;
+
+/**
+ * The rewrite, as a Vite plugin.
+ *
+ * @param isNuxtUiFile `(id) => boolean`, whether a module is Nuxt UI's
+ */
+export function uiInertiaPage(isNuxtUiFile) {
+  return {
+    name: "dms-ui-inertia-page",
+    enforce: "pre",
+    transform(code, id) {
+      if (!isNuxtUiFile(id) || !code.includes("@inertiajs/vue3")) return null;
+      const rewritten = code.replace(INERTIA_PAGE_IMPORT, DMS_PAGE_IMPORT);
+      if (ANY_INERTIA_PAGE_IMPORT.test(rewritten))
+        this.error(
+          `${id} reads Inertia's page in a form the DMS does not rewrite: ` +
+            "a server render could read another request's URL. Update " +
+            "ui-inertia-page.mjs for this Nuxt UI release.",
+        );
+      return rewritten === code ? null : { code: rewritten, map: null };
+    },
+  };
+}

package/templates/vue/vite.config.ts

@@ -9,6 +9,8 @@ import {
   normalizePath,
   type Plugin,
 } from "vite";
+import { rejectServerSourcesInClient } from "./client-server-guard.mjs";
+import { uiInertiaPage } from "./ui-inertia-page.mjs";
 import { autoImportDirectories } from "./frontend-build-loader";
 import { frontendBuilds } from "./frontend-builds.generated";
 import { orderHeadForFirstPaint } from "./head-order.mjs";
@@ -123,10 +125,22 @@ const uiInertiaLinkImport = resolve(
   __dirname,
   "node_modules/@nuxt/ui/dist/runtime/vue/overrides/inertia/Link.vue",
 );
+/**
+ * Nuxt UI's Link and route stub read Inertia's page to know the current URL.
+ * Inertia keeps a single page for the whole process, written by each server
+ * render as it starts: a link rendered after an await could take another
+ * request's URL to set its active state. Their `usePage()` is the DMS one,
+ * which gives the page of the request being rendered.
+ */
+const isNuxtUiFile = (id: string) =>
+  normalizePath(id).includes("/node_modules/@nuxt/ui/");
 
 export default defineConfig({
   logLevel,
   plugins: [
+    // Fails a client build that imports a dms.server.ts or a file under a
+    // module's server/ directory, however it is imported.
+    rejectServerSourcesInClient(moduleRoots),
     {
       name: "dms-ui-inertia-link",
       enforce: "pre",
@@ -134,6 +148,7 @@ export default defineConfig({
         return id === uiLinkImport ? uiInertiaLinkImport : null;
       },
     },
+    uiInertiaPage(isNuxtUiFile),
     vue(),
     ui({
       router: "inertia",
@@ -157,25 +172,28 @@ export default defineConfig({
             // path that cannot exist. Keep it POSIX.
             [normalizePath(resolve(__dirname, "frontend-module.ts"))]: [
               "$fetch",
-              "abortNavigation",
-              "clearError",
-              "createError",
-              "defineAppConfig",
+              "abortDmsNavigation",
+              "clearDmsError",
+              "createDmsError",
+              "dmsRequestKey",
+              "defineDmsAppConfig",
               "defineDmsPlugin",
               "defineDmsMiddleware",
               "defineDmsPageMeta",
               "navigateDms",
-              "prefetchComponents",
-              "preloadComponents",
+              "preloadDmsComponents",
               "refreshDmsData",
-              "showError",
+              "refreshDmsPageData",
+              "setDmsAsyncDataScope",
+              "showDmsError",
               "useDmsAsyncData",
+              "useDmsData",
               "useDmsCookie",
               "useDmsFetch",
               "useHead",
               "useI18n",
-              "useError",
-              "useDmsLazyAsyncData",
+              "useDmsError",
+              "useDmsPagedData",
               "useDmsPageLoading",
               "useDmsApp",
               "useDmsRoute",
@@ -186,7 +204,7 @@ export default defineConfig({
               "useDmsAppConfig",
               "DmsClientOnly",
               "DmsLink",
-              "useUserSession",
+              "useDmsUserSession",
             ],
           },
         ],
@@ -202,6 +220,9 @@ export default defineConfig({
     dedupe: ["vue", "reka-ui", "@nuxt/ui", "@vueuse/core", "@iconify/vue"],
     alias: {
       "#dms/frontend-module": resolve(__dirname, "frontend-module.ts"),
+      // For the server's development loader only: no browser module imports
+      // a `dms.server.ts`.
+      "#dms/server": resolve(__dirname, "server-module.ts"),
       "#build/nuxt-icon-client-bundle": "virtual:nuxt-ui-icons",
       "#shortcuts-aggregated": resolve(
         __dirname,

package/templates/vue/vite.email.config.ts

@@ -69,7 +69,7 @@ export default defineConfig({
           [normalizePath(resolve(__dirname, "email-runtime.ts"))]: [
             "useDmsAppConfig",
             "useDmsRuntimeConfig",
-            "defineAppConfig",
+            "defineDmsAppConfig",
           ],
         },
       ],

package/templates/vue/vite.server.config.ts

@@ -0,0 +1,57 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { basename, resolve } from "node:path";
+import { defineConfig, type LogLevel } from "vite";
+
+interface FrontendModuleRegistryEntry {
+  id: string;
+  root: string;
+}
+
+interface FrontendModuleRegistry {
+  modules: FrontendModuleRegistryEntry[];
+}
+
+const registry = JSON.parse(
+  readFileSync(resolve(__dirname, "generated-frontend-modules.json"), "utf8"),
+) as FrontendModuleRegistry;
+const moduleAliases = Object.fromEntries(
+  registry.modules.map((module) => [`@frontend/${module.id}`, module.root]),
+);
+const stableModuleAliases = Object.fromEntries(
+  [...registry.modules].reverse().flatMap((module) => {
+    const layersRoot = resolve(module.root, "layers");
+    if (existsSync(layersRoot)) {
+      return readdirSync(layersRoot).map((name) => [
+        `#${name}`,
+        resolve(layersRoot, name),
+      ]);
+    }
+    const moduleName = basename(module.root).replace(/^.*__/, "");
+    return [[`#${moduleName}`, module.root]];
+  }),
+);
+
+/** Set by `ajs dms build`, as in vite.config.ts. */
+const logLevel = (process.env.DMS_VITE_LOG_LEVEL ?? "info") as LogLevel;
+
+/**
+ * The modules' server entries (`dms.server.ts`) and what they import, for the
+ * production server. No Vue plugin and no auto-imports: server code imports
+ * what it uses, and never the application's own code. npm dependencies stay
+ * external and load from the workspace's `node_modules`, as for `dist/ssr`.
+ */
+export default defineConfig({
+  logLevel,
+  resolve: {
+    alias: {
+      "#dms/server": resolve(__dirname, "server-module.ts"),
+      ...stableModuleAliases,
+      ...moduleAliases,
+    },
+  },
+  build: {
+    outDir: "dist/server-modules",
+    ssr: "server-modules.generated.ts",
+    emptyOutDir: true,
+  },
+});

package/templates/vue/server/auth/oauth.mjs

@@ -1,233 +0,0 @@
-import { timingSafeEqual } from "node:crypto";
-import { backend, json, UpstreamError } from "./backend.mjs";
-import { clientIp } from "./client-ip.mjs";
-import {
-  clearSealedCookie,
-  persistAccountSession,
-  readSealedCookie,
-  writeSealedCookie,
-} from "./session.mjs";
-
-const FLOW = "dms_oauth_flow";
-const HANDOFF = "dms_oauth_handoff";
-const COMPLETE = "/auth/oauth/complete";
-const OAUTH_ERROR = "error.oauth.";
-const FAILED = "error.oauth.failed";
-const FLOW_LIFETIME_MS = 10 * 60 * 1000;
-const RATE_WINDOW_MS = 60 * 1000;
-const RATE_LIMIT = 10;
-const MAX_RATE_LIMIT_CLIENTS = 10_000;
-const MAX_CALLBACK_PARAMETER_LENGTH = 2048;
-const attempts = new Map();
-
-export function resolveOAuthClientKey(request) {
-  return clientIp(request);
-}
-
-function sweepAttempts(now) {
-  for (const [key, window] of attempts) {
-    if (now - window.startedAt >= RATE_WINDOW_MS) attempts.delete(key);
-  }
-  while (attempts.size >= MAX_RATE_LIMIT_CLIENTS)
-    attempts.delete(attempts.keys().next().value);
-}
-
-export function hitOAuthRateLimitKey(key, now = Date.now()) {
-  sweepAttempts(now);
-  const window = attempts.get(key);
-  if (!window || now - window.startedAt >= RATE_WINDOW_MS) {
-    attempts.set(key, { count: 1, startedAt: now });
-    return true;
-  }
-  window.count += 1;
-  return window.count <= RATE_LIMIT;
-}
-
-function rateLimited(request, scope) {
-  const now = Date.now();
-  return !hitOAuthRateLimitKey(
-    `${scope}:${resolveOAuthClientKey(request)}`,
-    now,
-  );
-}
-
-export function isValidOAuthProvider(provider) {
-  return typeof provider === "string" && /^[a-z0-9-]{1,32}$/.test(provider);
-}
-
-function safePath(value) {
-  if (
-    typeof value !== "string" ||
-    !value.startsWith("/") ||
-    value.startsWith("//") ||
-    value.includes("\\")
-  )
-    return "";
-  try {
-    const decoded = decodeURIComponent(value);
-    return decoded.startsWith("//") || decoded.includes("\\") ? "" : value;
-  } catch {
-    return "";
-  }
-}
-
-function redirect(response, location) {
-  response.writeHead(302, { location });
-  response.end();
-}
-
-function errorRedirect(response, key) {
-  redirect(response, `/auth?oauth_error=${encodeURIComponent(key)}`);
-}
-
-// The backend's own OAuth key says why a provider sign-in failed; any other
-// failure keeps the generic one.
-function failureRedirect(response, error) {
-  errorRedirect(
-    response,
-    error instanceof UpstreamError && error.message.startsWith(OAUTH_ERROR)
-      ? error.message
-      : FAILED,
-  );
-}
-
-export async function oauthStart(request, response, provider, url) {
-  if (
-    !isValidOAuthProvider(provider) ||
-    request.headers["sec-fetch-site"] === "cross-site" ||
-    rateLimited(request, "start")
-  )
-    return errorRedirect(response, FAILED);
-  try {
-    const result = await backend(
-      `/api/auth/oauth/${provider}/authorize-url`,
-      request,
-      { relay: true },
-    );
-    writeSealedCookie(
-      response,
-      FLOW,
-      {
-        state: result.state,
-        expiresAt: Date.now() + FLOW_LIFETIME_MS,
-        redirect: safePath(url.searchParams.get("redirect")),
-        language: url.searchParams.get("language") ?? "",
-        invite: url.searchParams.get("invite") ?? "",
-      },
-      FLOW_LIFETIME_MS / 1000,
-    );
-    redirect(response, result.authorizeUrl);
-  } catch (error) {
-    failureRedirect(response, error);
-  }
-}
-
-function sameState(left, right) {
-  if (typeof left !== "string" || typeof right !== "string") return false;
-  const a = Buffer.from(left);
-  const b = Buffer.from(right);
-  return a.length === b.length && timingSafeEqual(a, b);
-}
-
-function validCallback(flow, url) {
-  const code = url.searchParams.get("code");
-  const state = url.searchParams.get("state");
-  return !(
-    !flow ||
-    flow.expiresAt < Date.now() ||
-    typeof code !== "string" ||
-    code.length > MAX_CALLBACK_PARAMETER_LENGTH ||
-    typeof state !== "string" ||
-    state.length > MAX_CALLBACK_PARAMETER_LENGTH ||
-    !sameState(state, flow.state)
-  );
-}
-
-function storeOAuthResult(request, response, provider, result) {
-  if (result.requires_2fa)
-    writeSealedCookie(
-      response,
-      HANDOFF,
-      { kind: "2fa", token: result.two_factor_token, methods: result.methods },
-      300,
-    );
-  else if (result.requires_tenant_assignment)
-    writeSealedCookie(
-      response,
-      HANDOFF,
-      { kind: "no-workspace", token: result.tenant_assignment_token, provider },
-      300,
-    );
-  else persistAccountSession(request, response, sessionFrom(result));
-}
-
-async function completeOAuth(request, response, provider, url, flow) {
-  try {
-    const result = await backend(
-      `/api/auth/oauth/${provider}/callback`,
-      request,
-      {
-        method: "POST",
-        relay: true,
-        body: {
-          code: url.searchParams.get("code"),
-          state: url.searchParams.get("state"),
-          state_cookie: flow.state,
-          language: flow.language || undefined,
-          invite: flow.invite || undefined,
-        },
-      },
-    );
-    storeOAuthResult(request, response, provider, result);
-    redirect(
-      response,
-      flow.redirect &&
-        !result.requires_2fa &&
-        !result.requires_tenant_assignment
-        ? `${COMPLETE}?redirect=${encodeURIComponent(flow.redirect)}`
-        : COMPLETE,
-    );
-  } catch (error) {
-    failureRedirect(response, error);
-  }
-}
-
-export async function oauthCallback(request, response, provider, url) {
-  if (!isValidOAuthProvider(provider) || rateLimited(request, "callback"))
-    return errorRedirect(response, FAILED);
-  const flow = readSealedCookie(request, FLOW);
-  clearSealedCookie(response, FLOW);
-  if (url.searchParams.has("error"))
-    return errorRedirect(response, "error.oauth.cancelled");
-  if (!validCallback(flow, url))
-    return errorRedirect(response, "error.oauth.invalid_state");
-  return completeOAuth(request, response, provider, url, flow);
-}
-
-export function oauthHandoff(request, response) {
-  const handoff = readSealedCookie(request, HANDOFF) ?? { kind: "none" };
-  clearSealedCookie(response, HANDOFF);
-  json(response, 200, handoff);
-}
-
-/**
- * The session a token pair opens.
- *
- * @param result Backend answer carrying the tokens and the user
- * @param persistent Whether the session outlives the browser
- */
-export function sessionFrom(result, persistent = true) {
-  const payload = JSON.parse(
-    Buffer.from(
-      result.access_token.split(".")[1] ?? "",
-      "base64url",
-    ).toString() || "{}",
-  );
-  return {
-    user: result.user,
-    accessToken: result.access_token,
-    refreshToken: result.refresh_token,
-    activeTenantId: payload.tenantId ?? "default",
-    persistent,
-  };
-}