@byline/host-tanstack-start 4.0.0 → 4.1.0

package/src/server-fns/collections/tree.ts

@@ -16,10 +16,10 @@
 
 import { createServerFn } from '@tanstack/react-start'
 
+import { getAdminBylineClient } from '@byline/client/server'
 import { createReadContext, ERR_NOT_FOUND, getLogger } from '@byline/core'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
-import { getAdminBylineClient } from '../../integrations/byline-client.js'
 import { placeAdminTreeNode, removeAdminTreeNode } from './tree-mutation.js'
 import { getAdminTreeParent, getAdminUnplacedTreeDocuments } from './tree-read.js'
 

package/src/server-fns/collections/update.ts

@@ -8,12 +8,12 @@
 
 import { createServerFn } from '@tanstack/react-start'
 
+import { getAdminRequestContext } from '@byline/client/server'
 import { ERR_NOT_FOUND, getLogger, getServerConfig } from '@byline/core'
 import type { DocumentPatch } from '@byline/core/patches'
 import type { DocumentLifecycleContext } from '@byline/core/services'
 import { updateDocumentSystemFields, updateDocumentWithPatches } from '@byline/core/services'
 
-import { getAdminRequestContext } from '../../auth/auth-context.js'
 import { ensureCollection } from '../../integrations/api-utils.js'
 
 // ---------------------------------------------------------------------------

package/src/server-fns/collections/upload.ts

@@ -1,5 +1,6 @@
 import { createServerFn } from '@tanstack/react-start'
 
+import { getAdminRequestContext } from '@byline/client/server'
 import type {
   CollectionDefinition,
   FieldUploadContext,
@@ -12,7 +13,6 @@ import { extractImageMeta, generateImageVariants, isBypassMimeType } from '@byli
 import { getLogger, withLogContext } from '@byline/core/logger'
 import { uploadField as coreUploadField } from '@byline/core/services'
 
-import { getAdminRequestContext } from '../../auth/auth-context.js'
 import { ensureCollection } from '../../integrations/api-utils.js'
 
 /**

package/src/server-fns/i18n/set-locale.ts

@@ -30,8 +30,8 @@ import { createServerFn } from '@tanstack/react-start'
 import type { AccountResponse } from '@byline/admin/admin-account'
 import { setPreferredLocaleCommand } from '@byline/admin/admin-account'
 import { AuthError, AuthErrorCodes } from '@byline/auth'
+import { getAdminRequestContext } from '@byline/client/server'
 
-import { getAdminRequestContext } from '../../auth/auth-context.js'
 import { clearAdminLocaleCookie, setAdminLocaleCookie } from '../../i18n/locale-cookie.js'
 import { bylineCore } from '../../integrations/byline-core.js'
 

package/src/server-fns/preview/disable.ts

@@ -16,7 +16,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 
-import { clearPreviewCookie } from '../../auth/preview-cookies.js'
+import { clearPreviewCookie } from '@byline/client/server'
 
 export const disablePreviewModeFn = createServerFn({ method: 'POST' }).handler(async () => {
   clearPreviewCookie()

package/src/server-fns/preview/enable.ts

@@ -17,8 +17,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 
-import { getAdminRequestContext } from '../../auth/auth-context.js'
-import { setPreviewCookie } from '../../auth/preview-cookies.js'
+import { getAdminRequestContext, setPreviewCookie } from '@byline/client/server'
 
 export const enablePreviewModeFn = createServerFn({ method: 'POST' }).handler(async () => {
   await getAdminRequestContext()

package/src/server-fns/preview/state.ts

@@ -23,7 +23,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 
-import { readPreviewCookie } from '../../auth/preview-cookies.js'
+import { readPreviewCookie } from '@byline/client/server'
 
 export const getPreviewStateFn = createServerFn({ method: 'GET' }).handler(async () => {
   return { preview: readPreviewCookie() }

package/dist/auth/auth-context.d.ts

@@ -1,50 +0,0 @@
-/**
- * This Source Code is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * Copyright (c) Infonomic Company Limited
- */
-/**
- * Request-scoped auth context for admin server functions.
- *
- * Reads the session cookies, verifies the access token, transparently
- * refreshes when needed, and returns a `RequestContext` carrying the
- * authenticated `AdminAuth`. Every admin server fn calls this as its
- * first step — it is the single point where the admin transport boundary
- * meets the actor/ability machinery.
- *
- * Flow, in order:
- *
- *   1. Read the access cookie.
- *   2. If present, try `sessionProvider.verifyAccessToken`. On success,
- *      return the context — no DB write, no cookie churn.
- *   3. On verify failure (or missing access cookie), read the refresh
- *      cookie. If present, call `sessionProvider.refreshSession` — this
- *      rotates the refresh token atomically and issues a new access
- *      token. Write both fresh cookies to the response.
- *   4. Verify the new access token (populate the actor) and return the
- *      context.
- *   5. Any failure along the way clears both cookies so the browser
- *      stops sending a session the server has already rejected, and
- *      throws `ERR_UNAUTHENTICATED`.
- *
- * Burns a refresh-token rotation only when the access token actually
- * fails verification — not on every request. The "one session" UX is
- * the consequence of this helper working invisibly behind each call.
- *
- * Resolution is memoized per request (`oncePerRequest`): every call within
- * one logical request returns the same `RequestContext` instance — same
- * actor snapshot, same `requestId`. Two invariants depend on this:
- *
- *   - The read-authorization layer binds each `ReadContext` to one
- *     immutable authority token that includes `requestId`; a fresh id per
- *     call makes any two reads sharing a `ReadContext` (the admin tree
- *     view, hook-threaded nested reads) throw
- *     'ReadContext cannot be reused across request authorities'.
- *   - The refresh path rotates the refresh token; a second unmemoized call
- *     in the same request would re-run the dance against the
- *     already-rotated cookie and sign the admin out.
- */
-import { type RequestContext } from '@byline/auth';
-export declare function getAdminRequestContext(): Promise<RequestContext>;

package/dist/auth/auth-context.js

@@ -1,61 +0,0 @@
-import { ERR_UNAUTHENTICATED } from "@byline/auth";
-import { getServerConfig } from "@byline/core";
-import { v7 } from "uuid";
-import { clearSessionCookies, readAccessTokenCookie, readRefreshTokenCookie, setSessionCookies } from "./auth-cookies.js";
-import { oncePerRequest } from "./request-scope.js";
-function requireSessionProvider() {
-    const provider = getServerConfig().sessionProvider;
-    if (!provider) throw new Error("No sessionProvider configured on ServerConfig. Construct a JwtSessionProvider in your server config and pass it to initBylineCore().");
-    return provider;
-}
-async function getAdminRequestContext() {
-    return oncePerRequest('byline:admin-request-context', resolveAdminRequestContext);
-}
-async function resolveAdminRequestContext() {
-    const provider = requireSessionProvider();
-    const accessToken = readAccessTokenCookie();
-    if (accessToken) try {
-        const { actor } = await provider.verifyAccessToken(accessToken);
-        return {
-            actor,
-            requestId: v7(),
-            readMode: 'any'
-        };
-    } catch  {}
-    const refreshToken = readRefreshTokenCookie();
-    if (!refreshToken) {
-        if (accessToken) clearSessionCookies();
-        throw ERR_UNAUTHENTICATED({
-            message: 'no admin session'
-        });
-    }
-    let refreshed;
-    try {
-        refreshed = await provider.refreshSession({
-            refreshToken
-        });
-    } catch (err) {
-        clearSessionCookies();
-        throw ERR_UNAUTHENTICATED({
-            message: 'admin session could not be refreshed',
-            cause: err
-        });
-    }
-    setSessionCookies(refreshed);
-    let verified;
-    try {
-        verified = await provider.verifyAccessToken(refreshed.accessToken);
-    } catch (err) {
-        clearSessionCookies();
-        throw ERR_UNAUTHENTICATED({
-            message: 'refreshed access token did not verify',
-            cause: err
-        });
-    }
-    return {
-        actor: verified.actor,
-        requestId: v7(),
-        readMode: 'any'
-    };
-}
-export { getAdminRequestContext };

package/dist/auth/auth-cookies.d.ts

@@ -1,34 +0,0 @@
-/**
- * This Source Code is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * Copyright (c) Infonomic Company Limited
- */
-export declare const ACCESS_TOKEN_COOKIE = "byline_access_token";
-export declare const REFRESH_TOKEN_COOKIE = "byline_refresh_token";
-/** Read the access-token cookie. Returns undefined when not present. */
-export declare function readAccessTokenCookie(): string | undefined;
-/** Read the refresh-token cookie. Returns undefined when not present. */
-export declare function readRefreshTokenCookie(): string | undefined;
-export interface SessionCookieTokens {
-    accessToken: string;
-    refreshToken: string;
-    accessTokenExpiresAt: Date;
-    refreshTokenExpiresAt: Date;
-}
-/**
- * Write both access and refresh cookies. Called after sign-in and after
- * every transparent refresh in `getAdminRequestContext()`.
- *
- * `maxAge` is derived from each token's own expiry claim so the browser
- * drops the cookies at the same moment the server would reject them —
- * saves round trips when the refresh token has fully expired.
- */
-export declare function setSessionCookies(tokens: SessionCookieTokens): void;
-/**
- * Clear both session cookies. Called on sign-out and on any auth failure
- * during `getAdminRequestContext()` (ensures the browser does not keep
- * trying a token that the server has already rejected).
- */
-export declare function clearSessionCookies(): void;

package/dist/auth/auth-cookies.js

@@ -1,46 +0,0 @@
-import { getCookie, setCookie } from "@tanstack/react-start/server";
-const ACCESS_TOKEN_COOKIE = 'byline_access_token';
-const REFRESH_TOKEN_COOKIE = 'byline_refresh_token';
-const IS_PROD = 'production' === process.env.NODE_ENV;
-function readAccessTokenCookie() {
-    return getCookie(ACCESS_TOKEN_COOKIE);
-}
-function readRefreshTokenCookie() {
-    return getCookie(REFRESH_TOKEN_COOKIE);
-}
-function setSessionCookies(tokens) {
-    const now = Date.now();
-    const accessMaxAgeSeconds = Math.max(0, Math.floor((tokens.accessTokenExpiresAt.getTime() - now) / 1000));
-    const refreshMaxAgeSeconds = Math.max(0, Math.floor((tokens.refreshTokenExpiresAt.getTime() - now) / 1000));
-    setCookie(ACCESS_TOKEN_COOKIE, tokens.accessToken, {
-        httpOnly: true,
-        sameSite: 'lax',
-        secure: IS_PROD,
-        path: '/',
-        maxAge: accessMaxAgeSeconds
-    });
-    setCookie(REFRESH_TOKEN_COOKIE, tokens.refreshToken, {
-        httpOnly: true,
-        sameSite: 'lax',
-        secure: IS_PROD,
-        path: '/',
-        maxAge: refreshMaxAgeSeconds
-    });
-}
-function clearSessionCookies() {
-    setCookie(ACCESS_TOKEN_COOKIE, '', {
-        httpOnly: true,
-        sameSite: 'lax',
-        secure: IS_PROD,
-        path: '/',
-        maxAge: 0
-    });
-    setCookie(REFRESH_TOKEN_COOKIE, '', {
-        httpOnly: true,
-        sameSite: 'lax',
-        secure: IS_PROD,
-        path: '/',
-        maxAge: 0
-    });
-}
-export { ACCESS_TOKEN_COOKIE, REFRESH_TOKEN_COOKIE, clearSessionCookies, readAccessTokenCookie, readRefreshTokenCookie, setSessionCookies };

package/dist/auth/preview-cookies.d.ts

@@ -1,19 +0,0 @@
-/**
- * This Source Code is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * Copyright (c) Infonomic Company Limited
- */
-export declare const PREVIEW_COOKIE = "byline_preview";
-/** True iff the preview cookie is currently set on the request. */
-export declare function readPreviewCookie(): boolean;
-/**
- * Write the preview cookie. Callers should ensure the request is from a
- * valid admin session before invoking — the cookie itself is just a flag
- * and carries no proof of authorisation. See `enablePreviewModeFn` for
- * the canonical entry point.
- */
-export declare function setPreviewCookie(): void;
-/** Clear the preview cookie. Safe to call from any context. */
-export declare function clearPreviewCookie(): void;

package/dist/auth/preview-cookies.js

@@ -1,26 +0,0 @@
-import { getCookie, setCookie } from "@tanstack/react-start/server";
-const PREVIEW_COOKIE = 'byline_preview';
-const PREVIEW_MAX_AGE_SECONDS = 86400;
-const IS_PROD = 'production' === process.env.NODE_ENV;
-function readPreviewCookie() {
-    return '1' === getCookie(PREVIEW_COOKIE);
-}
-function setPreviewCookie() {
-    setCookie(PREVIEW_COOKIE, '1', {
-        httpOnly: true,
-        sameSite: 'lax',
-        secure: IS_PROD,
-        path: '/',
-        maxAge: PREVIEW_MAX_AGE_SECONDS
-    });
-}
-function clearPreviewCookie() {
-    setCookie(PREVIEW_COOKIE, '', {
-        httpOnly: true,
-        sameSite: 'lax',
-        secure: IS_PROD,
-        path: '/',
-        maxAge: 0
-    });
-}
-export { PREVIEW_COOKIE, clearPreviewCookie, readPreviewCookie, setPreviewCookie };

package/dist/auth/request-scope.d.ts

@@ -1,16 +0,0 @@
-/**
- * This Source Code is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * Copyright (c) Infonomic Company Limited
- */
-/**
- * Resolve `factory` at most once per HTTP request for a given `key`. The
- * returned promise is memoized on the current Start request — rejections
- * included, since a request's cookies cannot change mid-flight and retrying
- * a failed refresh would burn a second rotation on an already-rotated
- * token. Outside the Start runtime (seed scripts, unit tests, background
- * jobs) there is no request to key on and the factory runs unmemoized.
- */
-export declare function oncePerRequest<T>(key: string, factory: () => Promise<T>): Promise<T>;

package/dist/auth/request-scope.js

@@ -1,24 +0,0 @@
-import { getRequest } from "@tanstack/react-start/server";
-const requestScopes = new WeakMap();
-function oncePerRequest(key, factory) {
-    const request = currentRequest();
-    if (!request) return factory();
-    let scope = requestScopes.get(request);
-    if (!scope) {
-        scope = new Map();
-        requestScopes.set(request, scope);
-    }
-    const existing = scope.get(key);
-    if (existing) return existing;
-    const pending = factory();
-    scope.set(key, pending);
-    return pending;
-}
-function currentRequest() {
-    try {
-        return getRequest();
-    } catch  {
-        return;
-    }
-}
-export { oncePerRequest };

package/dist/integrations/byline-client.d.ts

@@ -1,24 +0,0 @@
-/**
- * This Source Code is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * Copyright (c) Infonomic Company Limited
- */
-import { type BylineClient } from '@byline/client';
-export declare function getAdminBylineClient(): BylineClient;
-/**
- * A `BylineClient` bound to an explicit super-admin context — for
- * **system / background** work that is not scoped to an HTTP request:
- * lifecycle-hook search indexing, maintenance scripts, seeds, migrations.
- *
- * Unlike {@link getAdminBylineClient}, this does **not** read session
- * cookies, so it works outside the TanStack Start server runtime (a bare
- * `tsx` script, a seed, a test). Reaching for the request-scoped client in
- * a lifecycle hook couples that hook to the live server and throws
- * `No StartEvent found in AsyncLocalStorage` from any out-of-band write
- * path. Indexing is maintenance, not a user action — it reads the published
- * view and bypasses `beforeRead` — so the super-admin context is both
- * correct and runtime-agnostic. The context is auditable by its stable id.
- */
-export declare function getSystemBylineClient(): BylineClient;

package/dist/integrations/byline-client.js

@@ -1,25 +0,0 @@
-import { createSuperAdminContext } from "@byline/auth";
-import { createBylineClient } from "@byline/client";
-import { getServerConfig } from "@byline/core";
-import { getAdminRequestContext } from "../auth/auth-context.js";
-let cachedClient;
-function getAdminBylineClient() {
-    if (cachedClient) return cachedClient;
-    cachedClient = createBylineClient({
-        config: getServerConfig(),
-        requestContext: getAdminRequestContext
-    });
-    return cachedClient;
-}
-let cachedSystemClient;
-function getSystemBylineClient() {
-    if (cachedSystemClient) return cachedSystemClient;
-    cachedSystemClient = createBylineClient({
-        config: getServerConfig(),
-        requestContext: createSuperAdminContext({
-            id: 'byline-system-client'
-        })
-    });
-    return cachedSystemClient;
-}
-export { getAdminBylineClient, getSystemBylineClient };

package/dist/integrations/byline-public-client.d.ts

@@ -1,47 +0,0 @@
-/**
- * This Source Code is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * Copyright (c) Infonomic Company Limited
- */
-/**
- * The host's *public-read* `BylineClient` singleton — the strict
- * "preview-can-never-apply" sibling of `getViewerBylineClient`.
- *
- * Configured with `actor: null` and `readMode: 'published'`, full stop.
- * The `requestContext` factory does not consult the `byline_preview`
- * cookie or attempt any admin-session resolution, so an admin browsing
- * with preview mode on cannot accidentally elevate a read that flows
- * through this client. `assertActorCanPerform` permits the null actor
- * exactly on `read` with `readMode === 'published'`, which is what the
- * factory always returns.
- *
- * **Use this client for:**
- *   - RSS feeds, Atom feeds, sitemaps
- *   - JSON or other endpoints exposed to third-party consumers
- *   - any response that an upstream CDN / cache might serve to multiple
- *     visitors without keying off the `byline_preview` cookie
- *
- * **Use `getViewerBylineClient` instead for:**
- *   - user-facing public pages where an admin's preview-mode session
- *     should be honoured
- *
- * Both clients share the same module-scoped singleton pattern so the
- * SDK's per-instance `collectionRecordCache` is amortised across the
- * process lifetime.
- *
- * Companion: `getAdminBylineClient` in `./byline-client.ts` for the
- * admin webapp's authenticated reads (resolves the `RequestContext`
- * from session cookies, memoized per request).
- */
-import { type RequestContext } from '@byline/auth';
-import { type BylineClient } from '@byline/client';
-/**
- * Anonymous, published-only context — memoized per request so the
- * context (and its requestId) is stable across every read in one
- * request: reads sharing a ReadContext must bind a single request
- * authority.
- */
-export declare function resolvePublicRequestContext(): Promise<RequestContext>;
-export declare function getPublicBylineClient(): BylineClient;

package/dist/integrations/byline-public-client.js

@@ -1,19 +0,0 @@
-import { createRequestContext } from "@byline/auth";
-import { createBylineClient } from "@byline/client";
-import { getServerConfig } from "@byline/core";
-import { oncePerRequest } from "../auth/request-scope.js";
-function resolvePublicRequestContext() {
-    return oncePerRequest('byline:public-request-context', async ()=>createRequestContext({
-            readMode: 'published'
-        }));
-}
-let cachedClient;
-function getPublicBylineClient() {
-    if (cachedClient) return cachedClient;
-    cachedClient = createBylineClient({
-        config: getServerConfig(),
-        requestContext: resolvePublicRequestContext
-    });
-    return cachedClient;
-}
-export { getPublicBylineClient, resolvePublicRequestContext };

package/dist/integrations/byline-viewer-client.d.ts

@@ -1,26 +0,0 @@
-/**
- * This Source Code is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * Copyright (c) Infonomic Company Limited
- */
-import { type BylineClient } from '@byline/client';
-export declare function getViewerBylineClient(): BylineClient;
-/**
- * Preview-aware viewer context — memoized per request so every read in
- * one request binds the same context instance (and requestId): reads
- * sharing a ReadContext must resolve a single request authority.
- */
-export declare function resolveViewerRequestContext(): Promise<import("@byline/auth").RequestContext>;
-/**
- * Resolve whether the current request should surface non-published
- * versions. True iff the preview cookie is set **and** a valid admin
- * session resolves. Server fns call this once and pass the result to
- * `status: preview ? 'any' : 'published'` on the SDK read.
- *
- * Defensive by design: the cookie alone is not enough. A signed-out
- * browser carrying an old preview cookie still gets `false` here, which
- * keeps stray query strings or shared links from leaking drafts.
- */
-export declare function isPreviewActive(): Promise<boolean>;

package/dist/integrations/byline-viewer-client.js

@@ -1,44 +0,0 @@
-import { createRequestContext } from "@byline/auth";
-import { createBylineClient } from "@byline/client";
-import { getServerConfig } from "@byline/core";
-import { getAdminRequestContext } from "../auth/auth-context.js";
-import { readPreviewCookie } from "../auth/preview-cookies.js";
-import { oncePerRequest } from "../auth/request-scope.js";
-let cachedClient;
-function getViewerBylineClient() {
-    if (cachedClient) return cachedClient;
-    cachedClient = createBylineClient({
-        config: getServerConfig(),
-        requestContext: resolveViewerRequestContext
-    });
-    return cachedClient;
-}
-function resolveViewerRequestContext() {
-    return oncePerRequest('byline:viewer-request-context', resolveViewerContext);
-}
-async function resolveViewerContext() {
-    if (!readPreviewCookie()) return createRequestContext({
-        readMode: 'published'
-    });
-    try {
-        const ctx = await getAdminRequestContext();
-        return {
-            ...ctx,
-            readMode: 'any'
-        };
-    } catch  {
-        return createRequestContext({
-            readMode: 'published'
-        });
-    }
-}
-async function isPreviewActive() {
-    if (!readPreviewCookie()) return false;
-    try {
-        await getAdminRequestContext();
-        return true;
-    } catch  {
-        return false;
-    }
-}
-export { getViewerBylineClient, isPreviewActive, resolveViewerRequestContext };