@byline/client 5.1.2 → 5.1.3

package/dist/server/session-cookies.d.ts

@@ -18,8 +18,8 @@ export interface SessionCookieTokens {
     refreshTokenExpiresAt: Date;
 }
 /**
- * Write both access and refresh cookies. Called after sign-in and after
- * every transparent refresh in `getAdminRequestContext()`.
+ * Write both access and refresh cookies. Called after a successful sign-in
+ * and after a confirmed rotation in the explicit renewal server fn.
  *
  * `maxAge` is derived from each token's own expiry claim so the browser
  * drops the cookies at the same moment the server would reject them —
@@ -27,8 +27,9 @@ export interface SessionCookieTokens {
  */
 export declare function setSessionCookies(tokens: SessionCookieTokens): void;
 /**
- * Clear both session cookies. Called on sign-out and on any auth failure
- * during `getAdminRequestContext()` (ensures the browser does not keep
- * trying a token that the server has already rejected).
+ * Clear both session cookies. Called only after a confirmed sign-out or a
+ * successful self-service password change. Authentication and renewal
+ * failures deliberately do not clear cookies: a late failure response must
+ * not erase credentials that a concurrent renewal or sign-in just installed.
  */
 export declare function clearSessionCookies(): void;

package/dist/server/session-cookies.js

@@ -11,13 +11,15 @@
  * Two separate httpOnly cookies, one for each token half:
  *
  *   - `byline_access_token`  — short-lived JWT; sent on every request.
- *   - `byline_refresh_token` — long-lived opaque string; sent back only
- *                              when the access cookie is missing or
- *                              expired, to mint a new access token.
+ *   - `byline_refresh_token` — long-lived opaque string; consumed only by
+ *                              the explicit renewal endpoint to mint a
+ *                              replacement access token.
  *
- * Presenting "one session" to the user is a function of the middleware —
- * `getAdminRequestContext()` transparently refreshes the access cookie
- * using the refresh cookie, so the UI layer doesn't have to care.
+ * Renewal is explicit, not implicit. `getAdminRequestContext()` only
+ * verifies the access cookie and never writes or clears cookies; the
+ * browser transport calls the host's CSRF-protected renewal server fn
+ * after a pre-handler `ERR_ACCESS_EXPIRED` outcome, and that endpoint is
+ * the only place refresh rotation writes new cookies.
  *
  * All cookies set here use:
  *   - `httpOnly: true`   — inaccessible to JavaScript (XSS-hardened).
@@ -44,8 +46,8 @@ export function readRefreshTokenCookie() {
     return getHostRequestBridge().getCookie(REFRESH_TOKEN_COOKIE);
 }
 /**
- * Write both access and refresh cookies. Called after sign-in and after
- * every transparent refresh in `getAdminRequestContext()`.
+ * Write both access and refresh cookies. Called after a successful sign-in
+ * and after a confirmed rotation in the explicit renewal server fn.
  *
  * `maxAge` is derived from each token's own expiry claim so the browser
  * drops the cookies at the same moment the server would reject them —
@@ -72,9 +74,10 @@ export function setSessionCookies(tokens) {
     });
 }
 /**
- * Clear both session cookies. Called on sign-out and on any auth failure
- * during `getAdminRequestContext()` (ensures the browser does not keep
- * trying a token that the server has already rejected).
+ * Clear both session cookies. Called only after a confirmed sign-out or a
+ * successful self-service password change. Authentication and renewal
+ * failures deliberately do not clear cookies: a late failure response must
+ * not erase credentials that a concurrent renewal or sign-in just installed.
  */
 export function clearSessionCookies() {
     const bridge = getHostRequestBridge();

package/package.json

@@ -2,7 +2,7 @@
   "name": "@byline/client",
   "private": false,
   "license": "MPL-2.0",
-  "version": "5.1.2",
+  "version": "5.1.3",
   "engines": {
     "node": ">=20.9.0"
   },
@@ -44,8 +44,8 @@
   ],
   "dependencies": {
     "uuid": "^14.0.2",
-    "@byline/auth": "5.1.2",
-    "@byline/core": "5.1.2"
+    "@byline/auth": "5.1.3",
+    "@byline/core": "5.1.3"
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.12",
@@ -57,8 +57,8 @@
     "tsc-alias": "^1.9.4",
     "typescript": "^7.0.2",
     "vitest": "^5.0.0",
-    "@byline/db-postgres": "5.1.2",
-    "@byline/search-postgres": "5.1.2"
+    "@byline/search-postgres": "5.1.3",
+    "@byline/db-postgres": "5.1.3"
   },
   "publishConfig": {
     "access": "public",