@byline/host-tanstack-start 3.20.4 → 4.0.0

package/src/admin-shell/collections/tree-list.tsx

@@ -7,7 +7,7 @@
  */
 
 import type React from 'react'
-import { useEffect, useMemo, useState } from 'react'
+import { useEffect, useMemo, useRef, useState } from 'react'
 import { useRouter } from '@tanstack/react-router'
 
 import { renderFormatted, StatusBadge } from '@byline/admin/react'
@@ -41,6 +41,12 @@ import {
 } from '@dnd-kit/sortable'
 import cx from 'classnames'
 
+import { getAdminRoutePath } from '../../routes/admin-path.js'
+import {
+  createAdminTreeMoveController,
+  getAdminTreeMoveUiEffects,
+  shouldSyncAdminTreeRows,
+} from '../../server-fns/collections/tree-mutation.js'
 import { Link } from '../chrome/loose-router.js'
 import { TableHeadingCellSortable } from '../chrome/th-sortable.js'
 import { formatNumber } from '../chrome/utils.js'
@@ -59,7 +65,6 @@ export type TreeMoveFn = (params: {
   afterDocumentId: string | null
 }) => Promise<unknown>
 
-// biome-ignore lint/suspicious/noExplicitAny: tree rows carry heterogeneous fields
 function getColumnValue(row: CollectionTreeRow, fieldName: string): any {
   if (row.fields && fieldName in row.fields) return row.fields[fieldName]
   return (row as Record<string, any>)[fieldName]
@@ -73,19 +78,20 @@ function getColumnValue(row: CollectionTreeRow, fieldName: string): any {
  */
 function SortableTreeRow({
   id,
-  depth,
   dragging,
+  disabled,
   dragHandleLabel,
   children,
 }: {
   id: string
-  depth: number
   dragging: boolean
+  disabled: boolean
   dragHandleLabel: string
   children: React.ReactNode
 }) {
   const { setNodeRef, attributes, listeners, transform, transition, isDragging } = useSortable({
     id,
+    disabled,
   })
   const style: React.CSSProperties = {
     transform: transform ? `translate3d(0, ${transform.y}px, 0)` : undefined,
@@ -103,6 +109,7 @@ function SortableTreeRow({
       <td className={cx('byline-tree-list-drag-cell', styles.dragCell)}>
         <button
           type="button"
+          disabled={disabled}
           className={cx('byline-tree-list-drag-handle', styles.dragHandle)}
           aria-label={dragHandleLabel}
           {...attributes}
@@ -149,8 +156,12 @@ export const TreeListView = ({
   // back). Mirrors the flat-list reorder pattern.
   const [localPlaced, setLocalPlaced] = useState(() => rows.filter((r) => !r.unplaced))
   const [isMoving, setIsMoving] = useState(false)
+  const [moveController] = useState(() => createAdminTreeMoveController())
+  const preserveOptimisticForRows = useRef<CollectionTreeRow[] | null>(null)
   useEffect(() => {
-    if (!isMoving) setLocalPlaced(rows.filter((r) => !r.unplaced))
+    if (!shouldSyncAdminTreeRows(rows, preserveOptimisticForRows.current, isMoving)) return
+    preserveOptimisticForRows.current = null
+    setLocalPlaced(rows.filter((r) => !r.unplaced))
   }, [rows, isMoving])
 
   const [activeId, setActiveId] = useState<string | null>(null)
@@ -174,11 +185,17 @@ export const TreeListView = ({
     setOffsetLeft(0)
   }
 
-  const handleDragStart = ({ active }: DragStartEvent) => setActiveId(String(active.id))
+  const handleDragStart = ({ active }: DragStartEvent) => {
+    if (!moveController.isMoving()) setActiveId(String(active.id))
+  }
   const handleDragMove = ({ delta }: DragMoveEvent) => setOffsetLeft(delta.x)
   const handleDragOver = ({ over }: DragOverEvent) => setOverId(over ? String(over.id) : null)
 
   const handleDragEnd = async ({ active, over }: DragEndEvent) => {
+    if (moveController.isMoving()) {
+      resetDnd()
+      return
+    }
     const proj =
       over != null
         ? getTreeProjection(localPlaced, String(active.id), String(over.id), offsetLeft, INDENT)
@@ -197,24 +214,60 @@ export const TreeListView = ({
 
     setLocalPlaced(next)
     setIsMoving(true)
-    try {
-      await onMove({
-        documentId,
-        parentDocumentId: proj.parentId,
-        beforeDocumentId: proj.beforeId,
-        afterDocumentId: proj.afterId,
-      })
-      await router.invalidate()
-    } catch {
+    const outcome = await moveController.execute(
+      () =>
+        onMove({
+          documentId,
+          parentDocumentId: proj.parentId,
+          beforeDocumentId: proj.beforeId,
+          afterDocumentId: proj.afterId,
+        }),
+      () => router.invalidate()
+    )
+
+    if (outcome.status === 'suppressed') {
       setLocalPlaced(current)
+      setIsMoving(moveController.isMoving())
+      return
+    }
+
+    const effects = getAdminTreeMoveUiEffects(outcome)
+    if (effects.rollback) setLocalPlaced(current)
+
+    if (effects.structuralFailure != null) {
+      const conflict = effects.structuralFailure === 'conflict'
       toastManager.add({
-        title: t('collections.list.reorderFailedToast'),
-        description: t('collections.list.reorderFailedDescription'),
+        title: t(
+          conflict ? 'collections.list.treeConflictToast' : 'collections.list.reorderFailedToast'
+        ),
+        description: t(
+          conflict
+            ? 'collections.list.treeConflictDescription'
+            : 'collections.list.reorderFailedDescription'
+        ),
         data: { intent: 'danger', iconType: 'danger', icon: true, close: true },
       })
-    } finally {
-      setIsMoving(false)
     }
+
+    if (effects.committedHookWarning) {
+      toastManager.add({
+        title: t('collections.list.treeHookFailedToast'),
+        description: t('collections.list.treeHookFailedDescription'),
+        data: { intent: 'warning', iconType: 'warning', icon: true, close: true },
+      })
+    }
+
+    if (effects.refreshWarning) {
+      toastManager.add({
+        title: t('collections.list.treeRefreshFailedToast'),
+        description: t('collections.list.treeRefreshFailedDescription'),
+        data: { intent: 'warning', iconType: 'warning', icon: true, close: true },
+      })
+    }
+
+    if (effects.preserveOptimistic) preserveOptimisticForRows.current = rows
+
+    setIsMoving(false)
   }
 
   const renderCells = (row: CollectionTreeRow, depth: number) =>
@@ -240,7 +293,7 @@ export const TreeListView = ({
                 </span>
               )}
               <Link
-                to={'/admin/collections/$collection/$id' as never}
+                to={getAdminRoutePath('collections', '$collection', '$id')}
                 params={{ collection, id: row.id }}
               >
                 {column.formatter
@@ -277,7 +330,10 @@ export const TreeListView = ({
           <IconButton
             aria-label={t('collections.list.createAriaLabel')}
             render={
-              <Link to={'/admin/collections/$collection/create' as never} params={{ collection }} />
+              <Link
+                to={getAdminRoutePath('collections', '$collection', 'create')}
+                params={{ collection }}
+              />
             }
           >
             <PlusIcon height="18px" width="18px" svgClassName="stroke-white" />
@@ -323,8 +379,8 @@ export const TreeListView = ({
                       <SortableTreeRow
                         key={row.id}
                         id={row.id}
-                        depth={depth}
                         dragging={row.id === activeId}
+                        disabled={isMoving}
                         dragHandleLabel={t('collections.list.dragHandleAriaLabel')}
                       >
                         {renderCells(row, depth)}

package/src/admin-shell/collections/view-menu.tsx

@@ -13,6 +13,7 @@ import { useTranslation } from '@byline/i18n/react'
 import { Button, HistoryIcon, IconButton, Label, Select } from '@byline/ui/react'
 import cx from 'classnames'
 
+import { getAdminRoutePath } from '../../routes/admin-path.js'
 import { useNavigate } from '../chrome/loose-router.js'
 import { PreviewLink } from './preview-link.js'
 import styles from './view-menu.module.css'
@@ -86,7 +87,7 @@ export const ViewMenu = ({
   useEffect(() => {
     if (activeView === 'edit' && locale === 'all') {
       navigate({
-        to: '/admin/collections/$collection/$id' as never,
+        to: getAdminRoutePath('collections', '$collection', '$id'),
         params: { collection, id: documentId },
         search: (prev: Record<string, unknown>) => ({
           ...prev,
@@ -103,19 +104,19 @@ export const ViewMenu = ({
     const search = (prev: Record<string, unknown>) => ({ ...prev, locale: value })
     if (activeView === 'api') {
       navigate({
-        to: '/admin/collections/$collection/$id/api' as never,
+        to: getAdminRoutePath('collections', '$collection', '$id', 'api'),
         params: { collection, id: documentId },
         search: search as never,
       })
     } else if (activeView === 'history') {
       navigate({
-        to: '/admin/collections/$collection/$id/history' as never,
+        to: getAdminRoutePath('collections', '$collection', '$id', 'history'),
         params: { collection, id: documentId },
         search: search as never,
       })
     } else {
       navigate({
-        to: '/admin/collections/$collection/$id' as never,
+        to: getAdminRoutePath('collections', '$collection', '$id'),
         params: { collection, id: documentId },
         search: search as never,
       })
@@ -127,7 +128,7 @@ export const ViewMenu = ({
     const n = Number.parseInt(value, 10)
     const nextDepth = Number.isFinite(n) ? Math.max(0, Math.min(3, n)) : 0
     navigate({
-      to: '/admin/collections/$collection/$id/api' as never,
+      to: getAdminRoutePath('collections', '$collection', '$id', 'api'),
       params: { collection, id: documentId },
       // Store 0 as undefined so the URL stays clean when the user picks
       // "no populate" — avoids `?depth=0` in bookmarks / share links.
@@ -201,7 +202,7 @@ export const ViewMenu = ({
         variant={activeView === 'history' ? 'filled' : 'text'}
         onClick={() =>
           navigate({
-            to: '/admin/collections/$collection/$id/history' as never,
+            to: getAdminRoutePath('collections', '$collection', '$id', 'history'),
             params: { collection, id: documentId },
             search: locale ? { locale } : {},
           })
@@ -215,7 +216,7 @@ export const ViewMenu = ({
         className={cx('byline-view-menu-button', styles.button)}
         onClick={() =>
           navigate({
-            to: '/admin/collections/$collection/$id' as never,
+            to: getAdminRoutePath('collections', '$collection', '$id'),
             params: { collection, id: documentId },
             search: locale ? { locale } : {},
           })
@@ -229,7 +230,7 @@ export const ViewMenu = ({
         className={cx('byline-view-menu-button', styles.button)}
         onClick={() =>
           navigate({
-            to: '/admin/collections/$collection/$id/api' as never,
+            to: getAdminRoutePath('collections', '$collection', '$id', 'api'),
             params: { collection, id: documentId },
             search: locale ? { locale } : {},
           })

package/src/auth/auth-context.test.node.ts

@@ -28,6 +28,7 @@ const mocks = vi.hoisted(() => ({
   getCookie: vi.fn(),
   setCookie: vi.fn(),
   getRequestHeader: vi.fn(),
+  getRequest: vi.fn(),
 }))
 
 vi.mock('@byline/core', async () => {
@@ -47,6 +48,7 @@ vi.mock('@tanstack/react-start/server', () => ({
   getCookie: mocks.getCookie,
   setCookie: mocks.setCookie,
   getRequestHeader: mocks.getRequestHeader,
+  getRequest: mocks.getRequest,
 }))
 
 const { verifyAccessToken, refreshSession, getCookie, setCookie } = mocks
@@ -70,6 +72,12 @@ function stubActor() {
 describe('getAdminRequestContext', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    // Default: no Start request in scope, so every call resolves fresh.
+    // The per-request memoization tests below override this with a
+    // stable request object.
+    mocks.getRequest.mockImplementation(() => {
+      throw new Error('No StartEvent found in AsyncLocalStorage')
+    })
   })
 
   afterEach(() => {
@@ -212,4 +220,83 @@ describe('getAdminRequestContext', () => {
     const clears = setCookie.mock.calls.filter((c) => c[2]?.maxAge === 0)
     expect(clears.length).toBe(2)
   })
+
+  describe('per-request memoization', () => {
+    it('returns the same context instance — and requestId — for every call in one request', async () => {
+      mocks.getRequest.mockReturnValue({ id: 'request-a' })
+      cookiesReturn({
+        byline_access_token: 'valid-access',
+        byline_refresh_token: 'some-refresh',
+      })
+      verifyAccessToken.mockResolvedValue({ actor: stubActor() })
+
+      const first = await getAdminRequestContext()
+      const second = await getAdminRequestContext()
+
+      // Reads sharing a ReadContext bind one request authority; the token
+      // includes requestId, so it must be stable within a request.
+      expect(second).toBe(first)
+      expect(second.requestId).toBe(first.requestId)
+      expect(verifyAccessToken).toHaveBeenCalledTimes(1)
+    })
+
+    it('resolves independently across different requests', async () => {
+      cookiesReturn({
+        byline_access_token: 'valid-access',
+        byline_refresh_token: 'some-refresh',
+      })
+      verifyAccessToken.mockResolvedValue({ actor: stubActor() })
+
+      mocks.getRequest.mockReturnValue({ id: 'request-a' })
+      const first = await getAdminRequestContext()
+      mocks.getRequest.mockReturnValue({ id: 'request-b' })
+      const second = await getAdminRequestContext()
+
+      expect(second).not.toBe(first)
+      expect(second.requestId).not.toBe(first.requestId)
+      expect(verifyAccessToken).toHaveBeenCalledTimes(2)
+    })
+
+    it('burns at most one refresh rotation per request', async () => {
+      mocks.getRequest.mockReturnValue({ id: 'request-a' })
+      cookiesReturn({
+        byline_access_token: 'stale-access',
+        byline_refresh_token: 'valid-refresh',
+      })
+      const actor = stubActor()
+      verifyAccessToken.mockRejectedValueOnce(new Error('expired')).mockResolvedValueOnce({ actor })
+      refreshSession.mockResolvedValueOnce({
+        accessToken: 'fresh-access',
+        refreshToken: 'fresh-refresh',
+        accessTokenExpiresAt: new Date(Date.now() + 15 * 60_000),
+        refreshTokenExpiresAt: new Date(Date.now() + 30 * 24 * 60 * 60_000),
+      })
+
+      const first = await getAdminRequestContext()
+      // A second unmemoized call would re-run the refresh dance against the
+      // request's stale cookie — now already rotated — and sign the admin out.
+      const second = await getAdminRequestContext()
+
+      expect(second).toBe(first)
+      expect(refreshSession).toHaveBeenCalledTimes(1)
+    })
+
+    it('memoizes the unauthenticated rejection within one request', async () => {
+      mocks.getRequest.mockReturnValue({ id: 'request-a' })
+      cookiesReturn({
+        byline_access_token: 'stale',
+        byline_refresh_token: 'bad-refresh',
+      })
+      verifyAccessToken.mockRejectedValue(new Error('expired'))
+      refreshSession.mockRejectedValue(new Error('revoked'))
+
+      await expect(getAdminRequestContext()).rejects.toMatchObject({
+        code: AuthErrorCodes.UNAUTHENTICATED,
+      })
+      await expect(getAdminRequestContext()).rejects.toMatchObject({
+        code: AuthErrorCodes.UNAUTHENTICATED,
+      })
+      expect(refreshSession).toHaveBeenCalledTimes(1)
+    })
+  })
 })

package/src/auth/auth-context.ts

@@ -33,6 +33,19 @@
  * Burns a refresh-token rotation only when the access token actually
  * fails verification — not on every request. The "one session" UX is
  * the consequence of this helper working invisibly behind each call.
+ *
+ * Resolution is memoized per request (`oncePerRequest`): every call within
+ * one logical request returns the same `RequestContext` instance — same
+ * actor snapshot, same `requestId`. Two invariants depend on this:
+ *
+ *   - The read-authorization layer binds each `ReadContext` to one
+ *     immutable authority token that includes `requestId`; a fresh id per
+ *     call makes any two reads sharing a `ReadContext` (the admin tree
+ *     view, hook-threaded nested reads) throw
+ *     'ReadContext cannot be reused across request authorities'.
+ *   - The refresh path rotates the refresh token; a second unmemoized call
+ *     in the same request would re-run the dance against the
+ *     already-rotated cookie and sign the admin out.
  */
 
 import { ERR_UNAUTHENTICATED, type RequestContext } from '@byline/auth'
@@ -45,6 +58,7 @@ import {
   readRefreshTokenCookie,
   setSessionCookies,
 } from './auth-cookies.js'
+import { oncePerRequest } from './request-scope.js'
 
 function requireSessionProvider() {
   const provider = getServerConfig().sessionProvider
@@ -58,6 +72,10 @@ function requireSessionProvider() {
 }
 
 export async function getAdminRequestContext(): Promise<RequestContext> {
+  return oncePerRequest('byline:admin-request-context', resolveAdminRequestContext)
+}
+
+async function resolveAdminRequestContext(): Promise<RequestContext> {
   const provider = requireSessionProvider()
 
   const accessToken = readAccessTokenCookie()

package/src/auth/request-scope.test.node.ts

@@ -0,0 +1,93 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * Unit coverage for per-request memoization. Mocks the Start runtime's
+ * `getRequest` so "which request am I in" can be simulated: a stable
+ * object per request, or a throw when running outside a request.
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  getRequest: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: mocks.getRequest,
+}))
+
+import { oncePerRequest } from './request-scope.js'
+
+describe('oncePerRequest', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.getRequest.mockImplementation(() => {
+      throw new Error('No StartEvent found in AsyncLocalStorage')
+    })
+  })
+
+  it('resolves the factory once per request per key', async () => {
+    mocks.getRequest.mockReturnValue({ id: 'request-a' })
+    const factory = vi.fn(async () => ({ token: Math.random() }))
+
+    const first = await oncePerRequest('ctx', factory)
+    const second = await oncePerRequest('ctx', factory)
+
+    expect(second).toBe(first)
+    expect(factory).toHaveBeenCalledTimes(1)
+  })
+
+  it('keys memoization by request identity', async () => {
+    const requestA = { id: 'a' }
+    const requestB = { id: 'b' }
+    const factory = vi.fn(async () => ({ token: Math.random() }))
+
+    mocks.getRequest.mockReturnValue(requestA)
+    const first = await oncePerRequest('ctx', factory)
+    mocks.getRequest.mockReturnValue(requestB)
+    const second = await oncePerRequest('ctx', factory)
+
+    expect(second).not.toBe(first)
+    expect(factory).toHaveBeenCalledTimes(2)
+  })
+
+  it('isolates entries by key within one request', async () => {
+    mocks.getRequest.mockReturnValue({ id: 'request-a' })
+    const admin = vi.fn(async () => 'admin-context')
+    const publicCtx = vi.fn(async () => 'public-context')
+
+    await expect(oncePerRequest('admin', admin)).resolves.toBe('admin-context')
+    await expect(oncePerRequest('public', publicCtx)).resolves.toBe('public-context')
+    await expect(oncePerRequest('admin', admin)).resolves.toBe('admin-context')
+
+    expect(admin).toHaveBeenCalledTimes(1)
+    expect(publicCtx).toHaveBeenCalledTimes(1)
+  })
+
+  it('memoizes rejections for the remainder of the request', async () => {
+    mocks.getRequest.mockReturnValue({ id: 'request-a' })
+    const factory = vi.fn(async () => {
+      throw new Error('no admin session')
+    })
+
+    await expect(oncePerRequest('ctx', factory)).rejects.toThrow('no admin session')
+    await expect(oncePerRequest('ctx', factory)).rejects.toThrow('no admin session')
+    expect(factory).toHaveBeenCalledTimes(1)
+  })
+
+  it('runs unmemoized outside the Start runtime', async () => {
+    const factory = vi.fn(async () => ({ token: Math.random() }))
+
+    const first = await oncePerRequest('ctx', factory)
+    const second = await oncePerRequest('ctx', factory)
+
+    expect(second).not.toBe(first)
+    expect(factory).toHaveBeenCalledTimes(2)
+  })
+})

package/src/auth/request-scope.ts

@@ -0,0 +1,62 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * Per-request memoization for `RequestContext` factories.
+ *
+ * `RequestContext.requestId` is documented as "per logical request", and
+ * the read-authorization layer binds every `ReadContext` to one immutable
+ * request authority whose token includes that id. A factory that mints a
+ * fresh context per call breaks both contracts as soon as two reads share
+ * a `ReadContext` (the admin tree view, hook-threaded nested reads):
+ * the second bind sees a different authority token and throws
+ * 'ReadContext cannot be reused across request authorities'.
+ *
+ * Memoizing on the current Start request makes every context factory
+ * request-stable. It also means at most one session verification — and at
+ * most one refresh-token rotation — per request, instead of one per call.
+ */
+
+import { getRequest } from '@tanstack/react-start/server'
+
+const requestScopes = new WeakMap<object, Map<string, Promise<unknown>>>()
+
+/**
+ * Resolve `factory` at most once per HTTP request for a given `key`. The
+ * returned promise is memoized on the current Start request — rejections
+ * included, since a request's cookies cannot change mid-flight and retrying
+ * a failed refresh would burn a second rotation on an already-rotated
+ * token. Outside the Start runtime (seed scripts, unit tests, background
+ * jobs) there is no request to key on and the factory runs unmemoized.
+ */
+export function oncePerRequest<T>(key: string, factory: () => Promise<T>): Promise<T> {
+  const request = currentRequest()
+  if (!request) return factory()
+
+  let scope = requestScopes.get(request)
+  if (!scope) {
+    scope = new Map()
+    requestScopes.set(request, scope)
+  }
+
+  const existing = scope.get(key)
+  if (existing) return existing as Promise<T>
+
+  const pending = factory()
+  scope.set(key, pending)
+  return pending
+}
+
+function currentRequest(): object | undefined {
+  try {
+    return getRequest()
+  } catch {
+    // No StartEvent in AsyncLocalStorage — running outside a request.
+    return undefined
+  }
+}

package/src/integrations/abilities.tsx

@@ -38,15 +38,25 @@
 import type React from 'react'
 import { useRouteContext } from '@tanstack/react-router'
 
-/** Route id of the admin shell — the layout route that owns `user` on context. */
-const ADMIN_ROUTE_ID = '/_byline/admin' as const
+import { getAdminRouteId } from '../routes/admin-path.js'
+
+interface AbilityRouteContext {
+  user: {
+    is_super_admin: boolean
+    abilities: string[]
+  }
+}
+
+function useAbilityRouteContext(): AbilityRouteContext {
+  return useRouteContext({ from: getAdminRouteId() as never }) as AbilityRouteContext
+}
 
 /**
  * `true` when the current admin holds the given ability (or is a
  * super-admin). Cosmetic — see file-level docstring.
  */
 export function useAbility(ability: string): boolean {
-  const { user } = useRouteContext({ from: ADMIN_ROUTE_ID })
+  const { user } = useAbilityRouteContext()
   if (user.is_super_admin) return true
   return user.abilities.includes(ability)
 }
@@ -62,7 +72,7 @@ export function useAbilities(): {
   hasAny: (abilities: readonly string[]) => boolean
   isSuperAdmin: boolean
 } {
-  const { user } = useRouteContext({ from: ADMIN_ROUTE_ID })
+  const { user } = useAbilityRouteContext()
   const has = (ability: string): boolean => user.is_super_admin || user.abilities.includes(ability)
   const hasAny = (abilities: readonly string[]): boolean =>
     user.is_super_admin || abilities.some((key) => user.abilities.includes(key))

package/src/integrations/byline-client.ts

@@ -31,10 +31,12 @@ export function getAdminBylineClient(): BylineClient {
   if (cachedClient) return cachedClient
   cachedClient = createBylineClient({
     config: getServerConfig(),
-    // Resolved per-call so each server fn picks up the actor from the
-    // current request's session cookies. `getAdminRequestContext` runs the
-    // refresh dance on its own and throws `ERR_UNAUTHENTICATED` when no
-    // session is present — the client surfaces the throw verbatim.
+    // Resolved from the current request's session cookies, memoized per
+    // request: every read in one request binds the same context instance
+    // (and requestId), which the ReadContext authority check requires.
+    // `getAdminRequestContext` runs the refresh dance on its own and throws
+    // `ERR_UNAUTHENTICATED` when no session is present — the client
+    // surfaces the throw verbatim.
     requestContext: getAdminRequestContext,
   })
   return cachedClient

package/src/integrations/byline-public-client.ts

@@ -33,21 +33,35 @@
  * process lifetime.
  *
  * Companion: `getAdminBylineClient` in `./byline-client.ts` for the
- * admin webapp's authenticated reads (resolves a fresh `RequestContext`
- * from session cookies on every call).
+ * admin webapp's authenticated reads (resolves the `RequestContext`
+ * from session cookies, memoized per request).
  */
 
-import { createRequestContext } from '@byline/auth'
+import { createRequestContext, type RequestContext } from '@byline/auth'
 import { type BylineClient, createBylineClient } from '@byline/client'
 import { getServerConfig } from '@byline/core'
 
+import { oncePerRequest } from '../auth/request-scope.js'
+
+/**
+ * Anonymous, published-only context — memoized per request so the
+ * context (and its requestId) is stable across every read in one
+ * request: reads sharing a ReadContext must bind a single request
+ * authority.
+ */
+export function resolvePublicRequestContext(): Promise<RequestContext> {
+  return oncePerRequest('byline:public-request-context', async () =>
+    createRequestContext({ readMode: 'published' })
+  )
+}
+
 let cachedClient: BylineClient | undefined
 
 export function getPublicBylineClient(): BylineClient {
   if (cachedClient) return cachedClient
   cachedClient = createBylineClient({
     config: getServerConfig(),
-    requestContext: () => createRequestContext({ readMode: 'published' }),
+    requestContext: resolvePublicRequestContext,
   })
   return cachedClient
 }