@byline/cli 5.0.0 → 5.1.1

package/dist/phases/wire/server-ts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-ts.d.ts","sourceRoot":"","sources":["../../../src/phases/wire/server-ts.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAiB,MAAM,aAAa,CAAA;AAQzD,eAAO,MAAM,YAAY,EAAE,OAS1B,CAAA"}
+{"version":3,"file":"server-ts.d.ts","sourceRoot":"","sources":["../../../src/phases/wire/server-ts.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAiB,MAAM,aAAa,CAAA;AAezD,eAAO,MAAM,YAAY,EAAE,OAS1B,CAAA"}

package/dist/phases/wire/server-ts.js

@@ -1,13 +1,20 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { Project } from 'ts-morph';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { Project, SyntaxKind } from 'ts-morph';
 const REL = 'src/server.ts';
 const IMPORT_SPECIFIER = '../byline/server.config';
 const SNIPPET = `// Initialize Byline server config (DB adapter, etc.) before handling any requests.
 import '${IMPORT_SPECIFIER}'
+import { getBylineCore } from '@byline/core'
+import { startBylineScheduler } from '@byline/core/scheduler'
+declare global {
+  // biome-ignore lint: globalThis augmentation requires var rather than let
+  var __bylineSchedulerController__: ReturnType<typeof startBylineScheduler> | undefined
+}
+globalThis.__bylineSchedulerController__ ??= startBylineScheduler(getBylineCore())
 `;
 export const wireServerTs = {
     key: 'server-ts',
-    title: `Inject side-effect import into ${REL}`,
+    title: `Initialize Byline and start its scheduler in ${REL}`,
     async preview(ctx) {
         return run(ctx, true);
     },
@@ -21,29 +28,77 @@ async function run(ctx, dryRun) {
         return { status: 'blocked', message: `${REL} not found — host phase should have caught this` };
     }
     const text = readFileSync(path, 'utf8');
-    if (hasImport(text, IMPORT_SPECIFIER)) {
-        return { status: 'skipped', message: `${REL}: side-effect import already present` };
-    }
-    if (dryRun) {
-        return { status: 'done', message: `${REL}: will inject \`import '${IMPORT_SPECIFIER}'\`` };
-    }
-    const project = new Project({ useInMemoryFileSystem: false, skipAddingFilesFromTsConfig: true });
+    const project = new Project({ useInMemoryFileSystem: true, skipAddingFilesFromTsConfig: true });
     let source;
     try {
-        source = project.addSourceFileAtPath(path);
+        source = project.createSourceFile('server.ts', text);
     }
     catch (_e) {
         return {
             status: 'manual',
-            message: `${REL}: could not parse — please add the import manually`,
+            message: `${REL}: could not parse — please wire initialization and scheduler manually`,
             snippet: SNIPPET,
         };
     }
-    // Place the side-effect import at the very top of the imports block so the
-    // Byline runtime is registered before any other module side effects fire.
-    source.insertImportDeclaration(0, { moduleSpecifier: IMPORT_SPECIFIER });
-    source.saveSync();
-    return { status: 'done', message: `${REL}: injected \`import '${IMPORT_SPECIFIER}'\`` };
+    let changed = false;
+    if (!hasImport(text, IMPORT_SPECIFIER)) {
+        source.insertImportDeclaration(0, { moduleSpecifier: IMPORT_SPECIFIER });
+        changed = true;
+    }
+    const schedulerImport = source
+        .getImportDeclarations()
+        .find((declaration) => declaration.getModuleSpecifierValue() === '@byline/core/scheduler');
+    const schedulerName = schedulerImport
+        ?.getNamedImports()
+        .find((item) => item.getName() === 'startBylineScheduler');
+    const localSchedulerName = schedulerName?.getAliasNode()?.getText() ?? schedulerName?.getName() ?? 'startBylineScheduler';
+    const alreadyStarted = schedulerName !== undefined &&
+        source
+            .getDescendantsOfKind(SyntaxKind.CallExpression)
+            .some((call) => call.getExpression().getText() === localSchedulerName);
+    if (!alreadyStarted) {
+        const coreGetter = ensureImport(source, '@byline/core', 'getBylineCore');
+        const scheduler = ensureImport(source, '@byline/core/scheduler', 'startBylineScheduler');
+        const declaration = source
+            .getDescendantsOfKind(SyntaxKind.VariableDeclaration)
+            .some((item) => item.getName() === '__bylineSchedulerController__');
+        source.addStatements(`
+// Host-owned lifetime: config imports from seeds/migrations remain inert.
+${declaration
+            ? ''
+            : `declare global {
+  // biome-ignore lint: globalThis augmentation requires var rather than let
+  var __bylineSchedulerController__: ReturnType<typeof ${scheduler}> | undefined
+}`}
+globalThis.__bylineSchedulerController__ ??= ${scheduler}(${coreGetter}())
+`);
+        changed = true;
+    }
+    if (!changed)
+        return {
+            status: 'skipped',
+            message: `${REL}: Byline initialization and scheduler already present`,
+        };
+    if (!dryRun) {
+        writeFileSync(path, source.getFullText());
+    }
+    return {
+        status: 'done',
+        message: `${REL}: ${dryRun ? 'will wire' : 'wired'} Byline initialization and scheduler`,
+    };
+}
+function ensureImport(source, moduleSpecifier, name) {
+    const declaration = source
+        .getImportDeclarations()
+        .find((item) => item.getModuleSpecifierValue() === moduleSpecifier && !item.isTypeOnly());
+    const existing = declaration?.getNamedImports().find((item) => item.getName() === name);
+    if (existing)
+        return existing.getAliasNode()?.getText() ?? existing.getName();
+    if (declaration)
+        declaration.addNamedImport(name);
+    else
+        source.addImportDeclaration({ moduleSpecifier, namedImports: [name] });
+    return name;
 }
 function hasImport(source, specifier) {
     // Match either form: with or without `.ts` extension, single or double quote.

package/dist/phases/wire/server-ts.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-ts.js","sourceRoot":"","sources":["../../../src/phases/wire/server-ts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAElD,OAAO,EAAE,OAAO,EAAmB,MAAM,UAAU,CAAA;AAKnD,MAAM,GAAG,GAAG,eAAe,CAAA;AAC3B,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;AAClD,MAAM,OAAO,GAAG;UACN,gBAAgB;CACzB,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAY;IACnC,GAAG,EAAE,WAAW;IAChB,KAAK,EAAE,kCAAkC,GAAG,EAAE;IAC9C,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,OAAO,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvB,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,GAAG;QACb,OAAO,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;CACF,CAAA;AAED,KAAK,UAAU,GAAG,CAAC,GAAY,EAAE,MAAe;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,GAAG,iDAAiD,EAAE,CAAA;IAChG,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,IAAI,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,GAAG,sCAAsC,EAAE,CAAA;IACrF,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,2BAA2B,gBAAgB,KAAK,EAAE,CAAA;IAC5F,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAA;IAChG,IAAI,MAAkB,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,GAAG,GAAG,oDAAoD;YACnE,OAAO,EAAE,OAAO;SACjB,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,CAAC,uBAAuB,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACxE,MAAM,CAAC,QAAQ,EAAE,CAAA;IAEjB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,wBAAwB,gBAAgB,KAAK,EAAE,CAAA;AACzF,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,SAAiB;IAClD,8EAA8E;IAC9E,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,iBAAiB,OAAO,gBAAgB,CAAC,CAAA;IAC/D,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AACxB,CAAC"}
+{"version":3,"file":"server-ts.js","sourceRoot":"","sources":["../../../src/phases/wire/server-ts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAEjE,OAAO,EAAE,OAAO,EAAmB,UAAU,EAAE,MAAM,UAAU,CAAA;AAK/D,MAAM,GAAG,GAAG,eAAe,CAAA;AAC3B,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;AAClD,MAAM,OAAO,GAAG;UACN,gBAAgB;;;;;;;;CAQzB,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAY;IACnC,GAAG,EAAE,WAAW;IAChB,KAAK,EAAE,gDAAgD,GAAG,EAAE;IAC5D,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,OAAO,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvB,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,GAAG;QACb,OAAO,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;CACF,CAAA;AAED,KAAK,UAAU,GAAG,CAAC,GAAY,EAAE,MAAe;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,GAAG,iDAAiD,EAAE,CAAA;IAChG,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/F,IAAI,MAAkB,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,GAAG,GAAG,uEAAuE;YACtF,OAAO,EAAE,OAAO;SACjB,CAAA;IACH,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,uBAAuB,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACxE,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,MAAM,eAAe,GAAG,MAAM;SAC3B,qBAAqB,EAAE;SACvB,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,uBAAuB,EAAE,KAAK,wBAAwB,CAAC,CAAA;IAC5F,MAAM,aAAa,GAAG,eAAe;QACnC,EAAE,eAAe,EAAE;SAClB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,sBAAsB,CAAC,CAAA;IAC5D,MAAM,kBAAkB,GACtB,aAAa,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,aAAa,EAAE,OAAO,EAAE,IAAI,sBAAsB,CAAA;IAChG,MAAM,cAAc,GAClB,aAAa,KAAK,SAAS;QAC3B,MAAM;aACH,oBAAoB,CAAC,UAAU,CAAC,cAAc,CAAC;aAC/C,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,KAAK,kBAAkB,CAAC,CAAA;IAC1E,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,CAAC,CAAA;QACxE,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,wBAAwB,EAAE,sBAAsB,CAAC,CAAA;QACxF,MAAM,WAAW,GAAG,MAAM;aACvB,oBAAoB,CAAC,UAAU,CAAC,mBAAmB,CAAC;aACpD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,+BAA+B,CAAC,CAAA;QACrE,MAAM,CAAC,aAAa,CAAC;;EAGvB,WAAW;YACT,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;;yDAEmD,SAAS;EAElE;+CAC+C,SAAS,IAAI,UAAU;CACrE,CAAC,CAAA;QACE,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,IAAI,CAAC,OAAO;QACV,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,GAAG,GAAG,uDAAuD;SACvE,CAAA;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,sCAAsC;KACzF,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB,EAAE,eAAuB,EAAE,IAAY;IAC7E,MAAM,WAAW,GAAG,MAAM;SACvB,qBAAqB,EAAE;SACvB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,eAAe,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;IAC3F,MAAM,QAAQ,GAAG,WAAW,EAAE,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,CAAA;IACvF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAA;IAC7E,IAAI,WAAW;QAAE,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;;QAC5C,MAAM,CAAC,oBAAoB,CAAC,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC3E,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,SAAiB;IAClD,8EAA8E;IAC9E,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,iBAAiB,OAAO,gBAAgB,CAAC,CAAA;IAC/D,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AACxB,CAAC"}

package/dist/phases/wire/server-ts.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=server-ts.test.d.ts.map

package/dist/phases/wire/server-ts.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-ts.test.d.ts","sourceRoot":"","sources":["../../../src/phases/wire/server-ts.test.ts"],"names":[],"mappings":""}

package/dist/phases/wire/server-ts.test.js

@@ -0,0 +1,37 @@
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { afterEach, describe, expect, it } from 'vitest';
+import { createTestContext } from '../../test-helpers.js';
+import { wireServerTs } from './server-ts.js';
+const contexts = [];
+afterEach(() => {
+    for (const ctx of contexts.splice(0))
+        rmSync(ctx.cwd, { recursive: true, force: true });
+});
+function fixture(text) {
+    const ctx = createTestContext();
+    contexts.push(ctx);
+    mkdirSync(ctx.resolve('src'), { recursive: true });
+    writeFileSync(ctx.resolve('src/server.ts'), text);
+    return ctx;
+}
+describe('host scheduler wiring', () => {
+    it('upgrades an existing config import, preserves the handler, and is idempotent', async () => {
+        const ctx = fixture("import '../byline/server.config.ts'\nexport default handler");
+        const original = readFileSync(ctx.resolve('src/server.ts'), 'utf8');
+        expect((await wireServerTs.preview(ctx)).status).toBe('done');
+        expect(readFileSync(ctx.resolve('src/server.ts'), 'utf8')).toBe(original);
+        expect((await wireServerTs.apply(ctx)).status).toBe('done');
+        const text = readFileSync(ctx.resolve('src/server.ts'), 'utf8');
+        expect(text).toContain('globalThis.__bylineSchedulerController__ ??= startBylineScheduler(getBylineCore())');
+        expect(text).toContain('export default handler');
+        expect((await wireServerTs.apply(ctx)).status).toBe('skipped');
+        expect(readFileSync(ctx.resolve('src/server.ts'), 'utf8')).toBe(text);
+    });
+    it('preserves an existing aliased scheduler startup', async () => {
+        const text = "import '../byline/server.config'\nimport { startBylineScheduler as start } from '@byline/core/scheduler'\nstart(core, { concurrency: 2 })";
+        const ctx = fixture(text);
+        expect((await wireServerTs.apply(ctx)).status).toBe('skipped');
+        expect(readFileSync(ctx.resolve('src/server.ts'), 'utf8')).toBe(text);
+    });
+});
+//# sourceMappingURL=server-ts.test.js.map

package/dist/phases/wire/server-ts.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-ts.test.js","sourceRoot":"","sources":["../../../src/phases/wire/server-ts.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAExE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAG7C,MAAM,QAAQ,GAAc,EAAE,CAAA;AAC9B,SAAS,CAAC,GAAG,EAAE;IACb,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACzF,CAAC,CAAC,CAAA;AACF,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAA;IAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClB,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAA;IACjD,OAAO,GAAG,CAAA;AACZ,CAAC;AACD,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,GAAG,GAAG,OAAO,CAAC,6DAA6D,CAAC,CAAA;QAClF,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,CAAA;QACnE,MAAM,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC7D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACzE,MAAM,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC3D,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,CAAA;QAC/D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CACpB,oFAAoF,CACrF,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAA;QAChD,MAAM,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC9D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,GACR,2IAA2I,CAAA;QAC7I,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QACzB,MAAM,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC9D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/phases/wire/start-ts.d.ts

@@ -1,3 +1,10 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
 import type { SubEdit } from './shared.js';
 export declare const wireStartTs: SubEdit;
 //# sourceMappingURL=start-ts.d.ts.map

package/dist/phases/wire/start-ts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start-ts.d.ts","sourceRoot":"","sources":["../../../src/phases/wire/start-ts.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAiB,MAAM,aAAa,CAAA;AAczD,eAAO,MAAM,WAAW,EAAE,OASzB,CAAA"}
+{"version":3,"file":"start-ts.d.ts","sourceRoot":"","sources":["../../../src/phases/wire/start-ts.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH,OAAO,KAAK,EAAE,OAAO,EAAiB,MAAM,aAAa,CAAA;AAiBzD,eAAO,MAAM,WAAW,EAAE,OASzB,CAAA"}

package/dist/phases/wire/start-ts.js

@@ -1,14 +1,24 @@
-import { existsSync, readFileSync } from 'node:fs';
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { existsSync } from 'node:fs';
 import { Node, Project, SyntaxKind, } from 'ts-morph';
 const REL = 'src/start.ts';
 const ADAPTER_NAME = 'bylineCodedErrorAdapter';
 const ADAPTER_MODULE = '@byline/host-tanstack-start/integrations/start-errors';
-const SNIPPET = `import { createStart } from '@tanstack/react-start'
+const SNIPPET = `import { createCsrfMiddleware, createStart } from '@tanstack/react-start'
 
 import { ${ADAPTER_NAME} } from '${ADAPTER_MODULE}'
+import { passwordSignInMiddleware } from '@byline/host-tanstack-start/integrations/sign-in-middleware'
+import { sessionRequestMiddleware } from '@byline/host-tanstack-start/integrations/session-request-middleware'
 
 export const startInstance = createStart(() => ({
   serializationAdapters: [${ADAPTER_NAME}],
+  requestMiddleware: [createCsrfMiddleware({ filter: (ctx) => ctx.handlerType === 'serverFn' }), sessionRequestMiddleware, passwordSignInMiddleware],
 }))
 `;
 export const wireStartTs = {
@@ -26,13 +36,6 @@ async function run(ctx, dryRun) {
     if (!existsSync(path)) {
         return { status: 'blocked', message: `${REL} not found — host phase should have caught this` };
     }
-    const text = readFileSync(path, 'utf8');
-    // Cheap pre-check: if the adapter identifier is already referenced anywhere,
-    // assume the wiring is in place. Avoids a full AST round-trip on the common
-    // case where wire has already been run.
-    if (text.includes(ADAPTER_NAME)) {
-        return { status: 'skipped', message: `${REL}: ${ADAPTER_NAME} already registered` };
-    }
     const project = new Project({ useInMemoryFileSystem: false, skipAddingFilesFromTsConfig: true });
     let source;
     try {
@@ -49,13 +52,76 @@ async function run(ctx, dryRun) {
     if (!optionsLiteral) {
         return manualBail(`${REL}: \`createStart\` factory does not return an inline object literal — cannot safely auto-edit`);
     }
+    const middlewareProp = optionsLiteral.getProperty('requestMiddleware');
+    if (middlewareProp &&
+        (!Node.isPropertyAssignment(middlewareProp) ||
+            !Node.isArrayLiteralExpression(middlewareProp.getInitializer()))) {
+        return manualBail(`${REL}: requestMiddleware must be an inline array for safe editing`);
+    }
+    const arr = middlewareProp && Node.isPropertyAssignment(middlewareProp)
+        ? middlewareProp.getInitializerIfKindOrThrow(SyntaxKind.ArrayLiteralExpression)
+        : undefined;
+    const hasCsrf = arr?.getElements().some((el) => {
+        const expression = Node.isIdentifier(el)
+            ? source.getVariableDeclaration(el.getText())?.getInitializer()
+            : el;
+        return (expression &&
+            Node.isCallExpression(expression) &&
+            expression.getExpression().getText() === 'createCsrfMiddleware');
+    }) ?? false;
+    const hasSessionGuard = arr?.getElements().some((el) => el.getText() === 'sessionRequestMiddleware') ?? false;
+    const hasBodyGuard = arr?.getElements().some((el) => el.getText() === 'passwordSignInMiddleware') ?? false;
+    const adapterProp = optionsLiteral.getProperty('serializationAdapters');
+    const hasAdapter = adapterProp &&
+        Node.isPropertyAssignment(adapterProp) &&
+        adapterProp
+            .getInitializerIfKind(SyntaxKind.ArrayLiteralExpression)
+            ?.getElements()
+            .some((el) => el.getText() === ADAPTER_NAME);
+    if (hasCsrf && hasBodyGuard && hasSessionGuard && hasAdapter) {
+        return {
+            status: 'skipped',
+            message: `${REL}: sign-in protection and error serialization already registered`,
+        };
+    }
     if (dryRun) {
         return {
             status: 'done',
-            message: `${REL}: will add ${ADAPTER_NAME} to serializationAdapters`,
+            message: `${REL}: will register sign-in protection and error serialization`,
         };
     }
     ensureImport(source);
+    for (const [moduleSpecifier, name] of [
+        ['@byline/host-tanstack-start/integrations/sign-in-middleware', 'passwordSignInMiddleware'],
+        ['@tanstack/react-start', 'createCsrfMiddleware'],
+        [
+            '@byline/host-tanstack-start/integrations/session-request-middleware',
+            'sessionRequestMiddleware',
+        ],
+    ]) {
+        const declaration = source
+            .getImportDeclarations()
+            .find((d) => d.getModuleSpecifierValue() === moduleSpecifier);
+        if (!declaration)
+            source.addImportDeclaration({ moduleSpecifier: moduleSpecifier, namedImports: [name] });
+        else if (!declaration.getNamedImports().some((n) => n.getText() === name))
+            declaration.addNamedImport(name);
+    }
+    const csrf = "createCsrfMiddleware({ filter: (ctx) => ctx.handlerType === 'serverFn' })";
+    if (!arr) {
+        optionsLiteral.addPropertyAssignment({
+            name: 'requestMiddleware',
+            initializer: `[${csrf}, sessionRequestMiddleware, passwordSignInMiddleware]`,
+        });
+    }
+    else {
+        if (!hasCsrf)
+            arr.insertElement(0, csrf);
+        if (!hasSessionGuard)
+            arr.addElement('sessionRequestMiddleware');
+        if (!hasBodyGuard)
+            arr.addElement('passwordSignInMiddleware');
+    }
     ensureAdapterInOptions(optionsLiteral);
     source.saveSync();
     return { status: 'done', message: `${REL}: registered ${ADAPTER_NAME}` };

package/dist/phases/wire/start-ts.js.map

@@ -1 +1 @@
-{"version":3,"file":"start-ts.js","sourceRoot":"","sources":["../../../src/phases/wire/start-ts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAElD,OAAO,EAGL,IAAI,EAEJ,OAAO,EAEP,UAAU,GACX,MAAM,UAAU,CAAA;AAKjB,MAAM,GAAG,GAAG,cAAc,CAAA;AAC1B,MAAM,YAAY,GAAG,yBAAyB,CAAA;AAC9C,MAAM,cAAc,GAAG,uDAAuD,CAAA;AAC9E,MAAM,OAAO,GAAG;;WAEL,YAAY,YAAY,cAAc;;;4BAGrB,YAAY;;CAEvC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAY;IAClC,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,YAAY,YAAY,OAAO,GAAG,EAAE;IAC3C,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,OAAO,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvB,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,GAAG;QACb,OAAO,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;CACF,CAAA;AAED,KAAK,UAAU,GAAG,CAAC,GAAY,EAAE,MAAe;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,GAAG,iDAAiD,EAAE,CAAA;IAChG,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,6EAA6E;IAC7E,4EAA4E;IAC5E,wCAAwC;IACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,GAAG,KAAK,YAAY,qBAAqB,EAAE,CAAA;IACrF,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAA;IAChG,IAAI,MAAkB,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IACnD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC,GAAG,GAAG,sCAAsC,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,cAAc,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAAA;IACjE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,UAAU,CACf,GAAG,GAAG,8FAA8F,CACrG,CAAA;IACH,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,GAAG,cAAc,YAAY,2BAA2B;SACrE,CAAA;IACH,CAAC;IAED,YAAY,CAAC,MAAM,CAAC,CAAA;IACpB,sBAAsB,CAAC,cAAc,CAAC,CAAA;IACtC,MAAM,CAAC,QAAQ,EAAE,CAAA;IAEjB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,gBAAgB,YAAY,EAAE,EAAE,CAAA;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AACxD,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAkB;IAC7C,sEAAsE;IACtE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,oBAAoB,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAA;QACjC,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,aAAa;YAAE,OAAO,IAAI,CAAA;IACnD,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAoB;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAE9B,wBAAwB;IACxB,2FAA2F;IAC3F,kFAAkF;IAClF,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QAC9B,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAA;YAClC,IAAI,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACrD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7D,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,EAAE,CAAA;gBAChC,IAAI,IAAI,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAA;gBAC7D,IAAI,IAAI,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAA;oBAClC,IAAI,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;wBAAE,OAAO,KAAK,CAAA;gBACzD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB;IACtC,MAAM,QAAQ,GAAG,MAAM;SACpB,qBAAqB,EAAE;SACvB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,EAAE,KAAK,cAAc,CAAC,CAAA;IAC9D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,YAAY,CAAC,CAAA;QACpF,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,CAAA;QACnD,OAAM;IACR,CAAC;IACD,8DAA8D;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAA;IAC9C,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC,MAAM,EAAE;QAC7C,eAAe,EAAE,cAAc;QAC/B,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAA;IACzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,qBAAqB,CAAC;YAC5B,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,IAAI,YAAY,GAAG;SACjC,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAM;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;IAClC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC;QAAE,OAAM;IACzD,oBAAoB,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA2B;IACvD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,YAAY,CAAC,CAAA;IAC7E,IAAI,OAAO;QAAE,OAAM;IACnB,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;AAC9B,CAAC"}
+{"version":3,"file":"start-ts.js","sourceRoot":"","sources":["../../../src/phases/wire/start-ts.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEpC,OAAO,EAGL,IAAI,EAEJ,OAAO,EAEP,UAAU,GACX,MAAM,UAAU,CAAA;AAKjB,MAAM,GAAG,GAAG,cAAc,CAAA;AAC1B,MAAM,YAAY,GAAG,yBAAyB,CAAA;AAC9C,MAAM,cAAc,GAAG,uDAAuD,CAAA;AAC9E,MAAM,OAAO,GAAG;;WAEL,YAAY,YAAY,cAAc;;;;;4BAKrB,YAAY;;;CAGvC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAY;IAClC,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,YAAY,YAAY,OAAO,GAAG,EAAE;IAC3C,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,OAAO,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvB,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,GAAG;QACb,OAAO,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;CACF,CAAA;AAED,KAAK,UAAU,GAAG,CAAC,GAAY,EAAE,MAAe;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,GAAG,iDAAiD,EAAE,CAAA;IAChG,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAA;IAChG,IAAI,MAAkB,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IACnD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC,GAAG,GAAG,sCAAsC,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,cAAc,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAAA;IACjE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,UAAU,CACf,GAAG,GAAG,8FAA8F,CACrG,CAAA;IACH,CAAC;IAED,MAAM,cAAc,GAAG,cAAc,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAA;IACtE,IACE,cAAc;QACd,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC;YACzC,CAAC,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC,CAAC,EAClE,CAAC;QACD,OAAO,UAAU,CAAC,GAAG,GAAG,8DAA8D,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,GAAG,GACP,cAAc,IAAI,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC;QACzD,CAAC,CAAC,cAAc,CAAC,2BAA2B,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAC/E,CAAC,CAAC,SAAS,CAAA;IACf,MAAM,OAAO,GACX,GAAG,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE;YAC/D,CAAC,CAAC,EAAE,CAAA;QACN,OAAO,CACL,UAAU;YACV,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;YACjC,UAAU,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,KAAK,sBAAsB,CAChE,CAAA;IACH,CAAC,CAAC,IAAI,KAAK,CAAA;IACb,MAAM,eAAe,GACnB,GAAG,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,0BAA0B,CAAC,IAAI,KAAK,CAAA;IACvF,MAAM,YAAY,GAChB,GAAG,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,0BAA0B,CAAC,IAAI,KAAK,CAAA;IACvF,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAA;IACvE,MAAM,UAAU,GACd,WAAW;QACX,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC;QACtC,WAAW;aACR,oBAAoB,CAAC,UAAU,CAAC,sBAAsB,CAAC;YACxD,EAAE,WAAW,EAAE;aACd,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,YAAY,CAAC,CAAA;IAChD,IAAI,OAAO,IAAI,YAAY,IAAI,eAAe,IAAI,UAAU,EAAE,CAAC;QAC7D,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,GAAG,GAAG,iEAAiE;SACjF,CAAA;IACH,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,GAAG,4DAA4D;SAC5E,CAAA;IACH,CAAC;IAED,YAAY,CAAC,MAAM,CAAC,CAAA;IACpB,KAAK,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI;QACpC,CAAC,6DAA6D,EAAE,0BAA0B,CAAC;QAC3F,CAAC,uBAAuB,EAAE,sBAAsB,CAAC;QACjD;YACE,qEAAqE;YACrE,0BAA0B;SAC3B;KACF,EAAE,CAAC;QACF,MAAM,WAAW,GAAG,MAAM;aACvB,qBAAqB,EAAE;aACvB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,EAAE,KAAK,eAAe,CAAC,CAAA;QAC/D,IAAI,CAAC,WAAW;YACd,MAAM,CAAC,oBAAoB,CAAC,EAAE,eAAe,EAAE,eAAgB,EAAE,YAAY,EAAE,CAAC,IAAK,CAAC,EAAE,CAAC,CAAA;aACtF,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC;YACvE,WAAW,CAAC,cAAc,CAAC,IAAK,CAAC,CAAA;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,2EAA2E,CAAA;IACxF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,cAAc,CAAC,qBAAqB,CAAC;YACnC,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,IAAI,IAAI,uDAAuD;SAC7E,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,OAAO;YAAE,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QACxC,IAAI,CAAC,eAAe;YAAE,GAAG,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAA;QAChE,IAAI,CAAC,YAAY;YAAE,GAAG,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAA;IAC/D,CAAC;IACD,sBAAsB,CAAC,cAAc,CAAC,CAAA;IACtC,MAAM,CAAC,QAAQ,EAAE,CAAA;IAEjB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,gBAAgB,YAAY,EAAE,EAAE,CAAA;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AACxD,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAkB;IAC7C,sEAAsE;IACtE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,oBAAoB,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAA;QACjC,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,aAAa;YAAE,OAAO,IAAI,CAAA;IACnD,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAoB;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAE9B,wBAAwB;IACxB,2FAA2F;IAC3F,kFAAkF;IAClF,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QAC9B,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAA;YAClC,IAAI,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACrD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7D,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,EAAE,CAAA;gBAChC,IAAI,IAAI,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAA;gBAC7D,IAAI,IAAI,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAA;oBAClC,IAAI,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;wBAAE,OAAO,KAAK,CAAA;gBACzD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB;IACtC,MAAM,QAAQ,GAAG,MAAM;SACpB,qBAAqB,EAAE;SACvB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,EAAE,KAAK,cAAc,CAAC,CAAA;IAC9D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,YAAY,CAAC,CAAA;QACpF,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,CAAA;QACnD,OAAM;IACR,CAAC;IACD,8DAA8D;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAA;IAC9C,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC,MAAM,EAAE;QAC7C,eAAe,EAAE,cAAc;QAC/B,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAA;IACzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,qBAAqB,CAAC;YAC5B,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,IAAI,YAAY,GAAG;SACjC,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAM;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;IAClC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC;QAAE,OAAM;IACzD,oBAAoB,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA2B;IACvD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,YAAY,CAAC,CAAA;IAC7E,IAAI,OAAO;QAAE,OAAM;IACnB,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;AAC9B,CAAC"}

package/dist/phases/wire/start-ts.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};
+//# sourceMappingURL=start-ts.test.d.ts.map

package/dist/phases/wire/start-ts.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-ts.test.d.ts","sourceRoot":"","sources":["../../../src/phases/wire/start-ts.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/phases/wire/start-ts.test.js

@@ -0,0 +1,50 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { afterEach, describe, expect, it } from 'vitest';
+import { createTestContext } from '../../test-helpers.js';
+import { wireStartTs } from './start-ts.js';
+const contexts = [];
+afterEach(() => {
+    for (const ctx of contexts.splice(0))
+        rmSync(ctx.cwd, { recursive: true, force: true });
+});
+function fixture(options) {
+    const ctx = createTestContext();
+    contexts.push(ctx);
+    mkdirSync(ctx.resolve('src'), { recursive: true });
+    writeFileSync(ctx.resolve('src/start.ts'), `import { createStart, createCsrfMiddleware } from '@tanstack/react-start'
+import { bylineCodedErrorAdapter } from '@byline/host-tanstack-start/integrations/start-errors'
+const csrf = createCsrfMiddleware({filter: ctx => ctx.handlerType === 'serverFn'})
+export const startInstance = createStart(() => (${options}))`);
+    return ctx;
+}
+describe('Start sign-in middleware wiring', () => {
+    it('upgrades existing serialization-only wiring and is idempotent', async () => {
+        const ctx = fixture('{serializationAdapters:[bylineCodedErrorAdapter]}');
+        expect((await wireStartTs.apply(ctx)).status).toBe('done');
+        const text = readFileSync(ctx.resolve('src/start.ts'), 'utf8');
+        expect(text).toContain('requestMiddleware: [createCsrfMiddleware(');
+        expect(text).toContain('passwordSignInMiddleware]');
+        expect((await wireStartTs.apply(ctx)).status).toBe('skipped');
+        expect(readFileSync(ctx.resolve('src/start.ts'), 'utf8')).toBe(text);
+    });
+    it('preserves existing CSRF and unrelated middleware', async () => {
+        const ctx = fixture('{serializationAdapters:[bylineCodedErrorAdapter],requestMiddleware:[csrf, custom]}');
+        expect((await wireStartTs.apply(ctx)).status).toBe('done');
+        expect(readFileSync(ctx.resolve('src/start.ts'), 'utf8')).toContain('[csrf, custom, sessionRequestMiddleware, passwordSignInMiddleware]');
+    });
+    it('leaves computed middleware configuration for manual wiring', async () => {
+        const ctx = fixture('{requestMiddleware: buildMiddleware()}');
+        const original = readFileSync(ctx.resolve('src/start.ts'), 'utf8');
+        expect((await wireStartTs.preview(ctx)).status).toBe('manual');
+        expect((await wireStartTs.apply(ctx)).status).toBe('manual');
+        expect(readFileSync(ctx.resolve('src/start.ts'), 'utf8')).toBe(original);
+    });
+});
+//# sourceMappingURL=start-ts.test.js.map

package/dist/phases/wire/start-ts.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-ts.test.js","sourceRoot":"","sources":["../../../src/phases/wire/start-ts.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAExE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAG3C,MAAM,QAAQ,GAAc,EAAE,CAAA;AAC9B,SAAS,CAAC,GAAG,EAAE;IACb,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACzF,CAAC,CAAC,CAAA;AACF,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAA;IAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClB,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,aAAa,CACX,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAC3B;;;kDAG8C,OAAO,IAAI,CAC1D,CAAA;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AACD,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,mDAAmD,CAAC,CAAA;QACxE,MAAM,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAA;QAC9D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAA;QACnE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAA;QACnD,MAAM,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC7D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,GAAG,GAAG,OAAO,CACjB,oFAAoF,CACrF,CAAA;QACD,MAAM,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CACjE,oEAAoE,CACrE,CAAA;IACH,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,wCAAwC,CAAC,CAAA;QAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAA;QAClE,MAAM,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC9D,MAAM,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC5D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/templates/dialects/mysql/byline/server.config.ts

@@ -14,7 +14,9 @@
  */
 
 import { type AdminStore, registerAdminAbilities } from '@byline/admin'
-import { JwtSessionProvider } from '@byline/admin/auth'
+import { createPasswordSignInLimiter, JwtSessionProvider } from '@byline/admin/auth'
+import { getRequestIP } from '@tanstack/react-start/server'
+import { createClientIpResolver } from '@byline/host-tanstack-start/integrations/client-ip'
 import { getAdminBylineClient } from '@byline/client/server'
 import { type BylineCore, initBylineCore } from '@byline/core'
 import { mysqlAdapter } from '@byline/db-mysql'
@@ -67,6 +69,8 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     )
   }
 
+  const signInLimiter = createPasswordSignInLimiter(adminStore.signInRateLimits, signingSecret)
+
   const sessionProvider = new JwtSessionProvider({
     store: adminStore,
     signingSecret,
@@ -86,6 +90,16 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
       baseUrl: '/uploads',
     }),
     sessionProvider,
+    recurringTasks: [signInLimiter.cleanupTask],
+    passwordSignIn: {
+      limiter: signInLimiter,
+      resolveClientIp: createClientIpResolver({
+        // Opt in only when the proxy overwrites this header and direct access is blocked.
+        trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
+        resolvePeerIp: () => getRequestIP() ??
+          (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
+      }),
+    },
     fields: {
       richText: {
         embed: lexicalEditorEmbedServer({ getClient: getAdminBylineClient }),

package/dist/templates/dialects/mysql/byline-examples/server.config.ts

@@ -11,7 +11,9 @@
  */
 
 import { type AdminStore, registerAdminAbilities } from '@byline/admin'
-import { JwtSessionProvider } from '@byline/admin/auth'
+import { createPasswordSignInLimiter, JwtSessionProvider } from '@byline/admin/auth'
+import { getRequestIP } from '@tanstack/react-start/server'
+import { createClientIpResolver } from '@byline/host-tanstack-start/integrations/client-ip'
 import { getAdminBylineClient } from '@byline/client/server'
 import { type BylineCore, initBylineCore } from '@byline/core'
 import { mysqlAdapter } from '@byline/db-mysql'
@@ -75,6 +77,8 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     )
   }
 
+  const signInLimiter = createPasswordSignInLimiter(adminStore.signInRateLimits, signingSecret)
+
   const sessionProvider = new JwtSessionProvider({
     store: adminStore,
     signingSecret,
@@ -94,6 +98,16 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
       baseUrl: '/uploads',
     }),
     sessionProvider,
+    recurringTasks: [signInLimiter.cleanupTask],
+    passwordSignIn: {
+      limiter: signInLimiter,
+      resolveClientIp: createClientIpResolver({
+        // Opt in only when the proxy overwrites this header and direct access is blocked.
+        trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
+        resolvePeerIp: () => getRequestIP() ??
+          (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
+      }),
+    },
     fields: {
       richText: {
         embed: lexicalEditorEmbedServer({ getClient: getAdminBylineClient }),

package/dist/templates/dialects/postgres/byline/server.config.ts

@@ -18,7 +18,9 @@
  */
 
 import { type AdminStore, registerAdminAbilities } from '@byline/admin'
-import { JwtSessionProvider } from '@byline/admin/auth'
+import { createPasswordSignInLimiter, JwtSessionProvider } from '@byline/admin/auth'
+import { getRequestIP } from '@tanstack/react-start/server'
+import { createClientIpResolver } from '@byline/host-tanstack-start/integrations/client-ip'
 import { type BylineCore, initBylineCore } from '@byline/core'
 import { pgAdapter } from '@byline/db-postgres'
 import { createAdminStore } from '@byline/db-postgres/admin'
@@ -82,6 +84,8 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     )
   }
 
+  const signInLimiter = createPasswordSignInLimiter(adminStore.signInRateLimits, signingSecret)
+
   const sessionProvider = new JwtSessionProvider({
     store: adminStore,
     signingSecret,
@@ -136,6 +140,16 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     //   cacheControl: 'public, max-age=31536000, immutable',
     // }),
     sessionProvider,
+    recurringTasks: [signInLimiter.cleanupTask],
+    passwordSignIn: {
+      limiter: signInLimiter,
+      resolveClientIp: createClientIpResolver({
+        // Opt in only when the proxy overwrites this header and direct access is blocked.
+        trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
+        resolvePeerIp: () => getRequestIP() ??
+          (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
+      }),
+    },
     fields: {
       richText: {
         embed: lexicalEditorEmbedServer({ getClient: getAdminBylineClient }),

package/dist/templates/dialects/postgres/byline-examples/server.config.ts

@@ -15,7 +15,9 @@
  */
 
 import { type AdminStore, registerAdminAbilities } from '@byline/admin'
-import { JwtSessionProvider } from '@byline/admin/auth'
+import { createPasswordSignInLimiter, JwtSessionProvider } from '@byline/admin/auth'
+import { getRequestIP } from '@tanstack/react-start/server'
+import { createClientIpResolver } from '@byline/host-tanstack-start/integrations/client-ip'
 import { type BylineCore, initBylineCore } from '@byline/core'
 import { pgAdapter } from '@byline/db-postgres'
 import { createAdminStore } from '@byline/db-postgres/admin'
@@ -130,6 +132,8 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     )
   }
 
+  const signInLimiter = createPasswordSignInLimiter(adminStore.signInRateLimits, signingSecret)
+
   const sessionProvider = new JwtSessionProvider({
     store: adminStore,
     signingSecret,
@@ -190,6 +194,16 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     //   cacheControl: 'public, max-age=31536000, immutable',
     // }),
     sessionProvider,
+    recurringTasks: [signInLimiter.cleanupTask],
+    passwordSignIn: {
+      limiter: signInLimiter,
+      resolveClientIp: createClientIpResolver({
+        // Opt in only when the proxy overwrites this header and direct access is blocked.
+        trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
+        resolvePeerIp: () => getRequestIP() ??
+          (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
+      }),
+    },
     fields: {
       // Server-side richtext adapter — refreshes embedded relation
       // envelopes (link `{ title, path }`, inline-image `{ title, altText,

package/dist/templates/migrations/mysql/{0000_pale_bastion.sql → 0000_kind_exodus.sql}

@@ -1,3 +1,12 @@
+CREATE TABLE `byline_admin_login_sessions` (
+	`id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+	`admin_user_id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+	`session_version` int NOT NULL,
+	`expires_at` datetime(6) NOT NULL,
+	`revoked_at` datetime(6),
+	CONSTRAINT `byline_admin_login_sessions_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
 CREATE TABLE `byline_admin_permissions` (
 	`id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
 	`vid` int NOT NULL DEFAULT 1,
@@ -12,7 +21,9 @@ CREATE TABLE `byline_admin_permissions` (
 CREATE TABLE `byline_admin_refresh_tokens` (
 	`id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
 	`admin_user_id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+	`sid` char(36) CHARACTER SET ascii COLLATE ascii_bin,
 	`token_hash` varchar(64) NOT NULL,
+	`session_version` int NOT NULL DEFAULT -1,
 	`issued_at` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
 	`expires_at` datetime(6) NOT NULL,
 	`revoked_at` datetime(6),
@@ -46,6 +57,13 @@ CREATE TABLE `byline_admin_roles` (
 	CONSTRAINT `byline_admin_roles_machine_name_unique` UNIQUE(`machine_name`)
 );
 --> statement-breakpoint
+CREATE TABLE `byline_admin_sign_in_rate_limits` (
+	`key` varchar(64) NOT NULL,
+	`attempts` int NOT NULL,
+	`expires_at` datetime(3) NOT NULL,
+	CONSTRAINT `byline_admin_sign_in_rate_limits_key` PRIMARY KEY(`key`)
+);
+--> statement-breakpoint
 CREATE TABLE `byline_admin_user_preferences` (
 	`user_id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
 	`scope` varchar(255) NOT NULL,
@@ -57,6 +75,7 @@ CREATE TABLE `byline_admin_user_preferences` (
 --> statement-breakpoint
 CREATE TABLE `byline_admin_users` (
 	`id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+	`session_version` int NOT NULL DEFAULT 0,
 	`vid` int NOT NULL DEFAULT 1,
 	`given_name` varchar(100),
 	`family_name` varchar(100),
@@ -377,7 +396,9 @@ CREATE TABLE `byline_store_text` (
 	CONSTRAINT `unique_text_field` UNIQUE(`document_version_id`,`field_path`,`locale`)
 );
 --> statement-breakpoint
+ALTER TABLE `byline_admin_login_sessions` ADD CONSTRAINT `fk_admin_login_sessions_user` FOREIGN KEY (`admin_user_id`) REFERENCES `byline_admin_users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_admin_permissions` ADD CONSTRAINT `fk_admin_permissions_admin_role_id` FOREIGN KEY (`admin_role_id`) REFERENCES `byline_admin_roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `byline_admin_refresh_tokens` ADD CONSTRAINT `fk_admin_refresh_tokens_sid` FOREIGN KEY (`sid`) REFERENCES `byline_admin_login_sessions`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_admin_refresh_tokens` ADD CONSTRAINT `fk_admin_refresh_tokens_admin_user_id` FOREIGN KEY (`admin_user_id`) REFERENCES `byline_admin_users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_admin_role_admin_user` ADD CONSTRAINT `fk_admin_role_admin_user_admin_role_id` FOREIGN KEY (`admin_role_id`) REFERENCES `byline_admin_roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_admin_role_admin_user` ADD CONSTRAINT `fk_admin_role_admin_user_admin_user_id` FOREIGN KEY (`admin_user_id`) REFERENCES `byline_admin_users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
@@ -414,11 +435,14 @@ ALTER TABLE `byline_store_relation` ADD CONSTRAINT `fk_store_relation_target_col
 ALTER TABLE `byline_singleton_documents` ADD CONSTRAINT `fk_singleton_documents_document` FOREIGN KEY (`collection_id`,`document_id`) REFERENCES `byline_documents`(`collection_id`,`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_store_text` ADD CONSTRAINT `fk_store_text_document_version_id` FOREIGN KEY (`document_version_id`) REFERENCES `byline_document_versions`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_store_text` ADD CONSTRAINT `fk_store_text_collection_id` FOREIGN KEY (`collection_id`) REFERENCES `byline_collections`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_admin_login_sessions_user` ON `byline_admin_login_sessions` (`admin_user_id`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_permissions_role` ON `byline_admin_permissions` (`admin_role_id`);--> statement-breakpoint
+CREATE INDEX `idx_admin_refresh_tokens_sid` ON `byline_admin_refresh_tokens` (`sid`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_refresh_tokens_user` ON `byline_admin_refresh_tokens` (`admin_user_id`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_refresh_tokens_token_hash` ON `byline_admin_refresh_tokens` (`token_hash`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_role_admin_user_user` ON `byline_admin_role_admin_user` (`admin_user_id`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_roles_machine_name` ON `byline_admin_roles` (`machine_name`);--> statement-breakpoint
+CREATE INDEX `idx_admin_sign_in_rate_limits_expiry` ON `byline_admin_sign_in_rate_limits` (`expires_at`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_users_email` ON `byline_admin_users` (`email`);--> statement-breakpoint
 CREATE INDEX `idx_audit_log_document_id` ON `byline_audit_log` (`document_id`,`id`);--> statement-breakpoint
 CREATE INDEX `idx_audit_log_actor_id` ON `byline_audit_log` (`actor_id`,`id`);--> statement-breakpoint

package/dist/templates/migrations/mysql/meta/_journal.json

@@ -5,8 +5,8 @@
     {
       "idx": 0,
       "version": "5",
-      "when": 1788642356080,
-      "tag": "0000_pale_bastion",
+      "when": 1788879988783,
+      "tag": "0000_kind_exodus",
       "breakpoints": true
     }
   ]

package/dist/templates/migrations/postgres/{0000_yielding_vulture.sql → 0000_lively_talisman.sql}

@@ -1,3 +1,11 @@
+CREATE TABLE "byline_admin_login_sessions" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"admin_user_id" uuid NOT NULL,
+	"session_version" integer NOT NULL,
+	"expires_at" timestamp (6) with time zone NOT NULL,
+	"revoked_at" timestamp (6) with time zone
+);
+--> statement-breakpoint
 CREATE TABLE "byline_admin_permissions" (
 	"id" uuid PRIMARY KEY NOT NULL,
 	"vid" integer DEFAULT 1 NOT NULL,
@@ -11,7 +19,9 @@ CREATE TABLE "byline_admin_permissions" (
 CREATE TABLE "byline_admin_refresh_tokens" (
 	"id" uuid PRIMARY KEY NOT NULL,
 	"admin_user_id" uuid NOT NULL,
+	"sid" uuid,
 	"token_hash" varchar(64) NOT NULL,
+	"session_version" integer DEFAULT -1 NOT NULL,
 	"issued_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
 	"expires_at" timestamp (6) with time zone NOT NULL,
 	"revoked_at" timestamp (6) with time zone,
@@ -43,6 +53,12 @@ CREATE TABLE "byline_admin_roles" (
 	CONSTRAINT "byline_admin_roles_machine_name_unique" UNIQUE("machine_name")
 );
 --> statement-breakpoint
+CREATE TABLE "byline_admin_sign_in_rate_limits" (
+	"key" varchar(64) PRIMARY KEY NOT NULL,
+	"attempts" integer NOT NULL,
+	"expires_at" timestamp (3) with time zone NOT NULL
+);
+--> statement-breakpoint
 CREATE TABLE "byline_admin_user_preferences" (
 	"user_id" uuid NOT NULL,
 	"scope" varchar(255) NOT NULL,
@@ -54,6 +70,7 @@ CREATE TABLE "byline_admin_user_preferences" (
 --> statement-breakpoint
 CREATE TABLE "byline_admin_users" (
 	"id" uuid PRIMARY KEY NOT NULL,
+	"session_version" integer DEFAULT 0 NOT NULL,
 	"vid" integer DEFAULT 1 NOT NULL,
 	"given_name" varchar(100),
 	"family_name" varchar(100),
@@ -356,8 +373,10 @@ CREATE TABLE "byline_store_text" (
 	CONSTRAINT "unique_text_field" UNIQUE("document_version_id","field_path","locale")
 );
 --> statement-breakpoint
+ALTER TABLE "byline_admin_login_sessions" ADD CONSTRAINT "byline_admin_login_sessions_admin_user_id_byline_admin_users_id_fk" FOREIGN KEY ("admin_user_id") REFERENCES "public"."byline_admin_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_admin_permissions" ADD CONSTRAINT "byline_admin_permissions_admin_role_id_byline_admin_roles_id_fk" FOREIGN KEY ("admin_role_id") REFERENCES "public"."byline_admin_roles"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_admin_refresh_tokens" ADD CONSTRAINT "byline_admin_refresh_tokens_admin_user_id_byline_admin_users_id_fk" FOREIGN KEY ("admin_user_id") REFERENCES "public"."byline_admin_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "byline_admin_refresh_tokens" ADD CONSTRAINT "byline_admin_refresh_tokens_sid_byline_admin_login_sessions_id_fk" FOREIGN KEY ("sid") REFERENCES "public"."byline_admin_login_sessions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_admin_role_admin_user" ADD CONSTRAINT "byline_admin_role_admin_user_admin_role_id_byline_admin_roles_id_fk" FOREIGN KEY ("admin_role_id") REFERENCES "public"."byline_admin_roles"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_admin_role_admin_user" ADD CONSTRAINT "byline_admin_role_admin_user_admin_user_id_byline_admin_users_id_fk" FOREIGN KEY ("admin_user_id") REFERENCES "public"."byline_admin_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_admin_user_preferences" ADD CONSTRAINT "byline_admin_user_preferences_user_id_byline_admin_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."byline_admin_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
@@ -393,11 +412,14 @@ ALTER TABLE "byline_store_relation" ADD CONSTRAINT "byline_store_relation_target
 ALTER TABLE "byline_singleton_documents" ADD CONSTRAINT "fk_singleton_documents_document" FOREIGN KEY ("collection_id","document_id") REFERENCES "public"."byline_documents"("collection_id","id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_store_text" ADD CONSTRAINT "byline_store_text_document_version_id_byline_document_versions_id_fk" FOREIGN KEY ("document_version_id") REFERENCES "public"."byline_document_versions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_store_text" ADD CONSTRAINT "byline_store_text_collection_id_byline_collections_id_fk" FOREIGN KEY ("collection_id") REFERENCES "public"."byline_collections"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "idx_admin_login_sessions_user" ON "byline_admin_login_sessions" USING btree ("admin_user_id");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_permissions_role" ON "byline_admin_permissions" USING btree ("admin_role_id");--> statement-breakpoint
+CREATE INDEX "idx_admin_refresh_tokens_sid" ON "byline_admin_refresh_tokens" USING btree ("sid");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_refresh_tokens_user" ON "byline_admin_refresh_tokens" USING btree ("admin_user_id");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_refresh_tokens_token_hash" ON "byline_admin_refresh_tokens" USING btree ("token_hash");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_role_admin_user_user" ON "byline_admin_role_admin_user" USING btree ("admin_user_id");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_roles_machine_name" ON "byline_admin_roles" USING btree ("machine_name");--> statement-breakpoint
+CREATE INDEX "idx_admin_sign_in_rate_limits_expiry" ON "byline_admin_sign_in_rate_limits" USING btree ("expires_at");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_users_email" ON "byline_admin_users" USING btree ("email");--> statement-breakpoint
 CREATE INDEX "idx_audit_log_document_id" ON "byline_audit_log" USING btree ("document_id","id");--> statement-breakpoint
 CREATE INDEX "idx_audit_log_actor_id" ON "byline_audit_log" USING btree ("actor_id","id");--> statement-breakpoint

package/dist/templates/migrations/postgres/meta/_journal.json

@@ -5,8 +5,8 @@
     {
       "idx": 0,
       "version": "7",
-      "when": 1788642365591,
-      "tag": "0000_yielding_vulture",
+      "when": 1788880329240,
+      "tag": "0000_lively_talisman",
       "breakpoints": true
     }
   ]

package/package.json

@@ -2,7 +2,7 @@
   "name": "@byline/cli",
   "private": false,
   "license": "MPL-2.0",
-  "version": "5.0.0",
+  "version": "5.1.1",
   "engines": {
     "node": ">=20.9.0"
   },
@@ -33,14 +33,14 @@
     "dist"
   ],
   "dependencies": {
-    "@clack/prompts": "^1.7.0",
+    "@clack/prompts": "^1.8.0",
     "commander": "^15.0.0",
     "diff": "^9.0.0",
     "drizzle-orm": "^0.45.2",
     "execa": "^10.0.1",
     "jsonc-parser": "^3.3.1",
     "minimatch": "^10.2.6",
-    "mysql2": "^3.24.2",
+    "mysql2": "^3.24.4",
     "pg": "^8.23.0",
     "picocolors": "^1.1.1",
     "semver": "^7.8.5",
@@ -48,20 +48,20 @@
     "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.10",
+    "@biomejs/biome": "2.5.12",
     "@types/mdast": "^4.0.4",
-    "@types/node": "^26.4.0",
+    "@types/node": "^26.5.0",
     "@types/pg": "^8.23.1",
     "@types/semver": "^7.8.0",
     "dotenv": "^17.4.2",
     "mdast-util-to-string": "^4.0.0",
     "remark-gfm": "^4.0.1",
     "remark-parse": "^11.0.0",
-    "tsc-alias": "^1.9.2",
+    "tsc-alias": "^1.9.4",
     "typescript": "^7.0.2",
     "unified": "^11.0.5",
-    "vitest": "^4.1.11",
-    "@byline/core": "5.0.0"
+    "vitest": "^5.0.0",
+    "@byline/core": "5.1.1"
   },
   "publishConfig": {
     "access": "public",