@byline/host-tanstack-start 4.19.0 → 5.1.0

package/dist/server-fns/auth/current-user.d.ts

@@ -6,6 +6,7 @@
  * Copyright (c) Infonomic Company Limited
  */
 export interface CurrentAdminUser {
+    sessionId: string;
     id: string;
     email: string;
     given_name: string | null;

package/dist/server-fns/auth/current-user.js

@@ -5,11 +5,12 @@ import { bylineCore } from "../../integrations/byline-core.js";
 const getCurrentAdminUser = createServerFn({
     method: 'GET'
 }).handler(async ()=>{
-    const { actor } = await getAdminRequestContext();
+    const { actor, sessionId } = await getAdminRequestContext();
     if (!actor) throw new Error('unexpected null actor after getAdminRequestContext');
     const row = await bylineCore().adminStore?.adminUsers.getById(actor.id);
     if (!row) throw new Error('admin user not found for current session');
     return {
+        sessionId: sessionId,
         id: row.id,
         email: row.email,
         given_name: row.given_name,
@@ -23,8 +24,9 @@ const getCurrentAdminUserSoft = createServerFn({
 }).handler(async ()=>{
     try {
         let actor;
+        let sessionId;
         try {
-            ({ actor } = await getAdminRequestContext());
+            ({ actor, sessionId } = await getAdminRequestContext());
         } catch (err) {
             if (err instanceof AuthError) return null;
             throw err;
@@ -33,6 +35,7 @@ const getCurrentAdminUserSoft = createServerFn({
         const row = await bylineCore().adminStore?.adminUsers.getById(actor.id);
         if (!row) return null;
         return {
+            sessionId: sessionId,
             id: row.id,
             email: row.email,
             given_name: row.given_name,

package/dist/server-fns/auth/renew.d.ts

@@ -0,0 +1,13 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Explicit renewal only. Global CSRF protection applies before this POST handler. */
+export declare const renewAdminSession: import("@tanstack/react-start").OptionalFetcher<undefined, (value: unknown) => {
+    expectedSessionId?: string;
+}, Promise<{
+    sessionId: string;
+}>>;

package/dist/server-fns/auth/renew.js

@@ -0,0 +1,45 @@
+import { createServerFn } from "@tanstack/react-start";
+import { setResponseHeader } from "@tanstack/react-start/server";
+import { AuthError, ERR_SESSION_CHANGED, ERR_UNAUTHENTICATED } from "@byline/auth";
+import { readAccessTokenCookie, readRefreshTokenCookie, setSessionCookies } from "@byline/client/server";
+import { getServerConfig } from "@byline/core";
+const renewAdminSession = createServerFn({
+    method: 'POST'
+}).validator((value)=>{
+    if (null == value) return {};
+    if ('object' != typeof value) throw new Error('Invalid renewal input');
+    const sid = value.expectedSessionId;
+    if (void 0 !== sid && ('string' != typeof sid || !sid || sid.length > 256)) throw new Error('Invalid login identity');
+    return {
+        expectedSessionId: sid
+    };
+}).handler(async ({ data })=>{
+    setResponseHeader('Cache-Control', 'no-store');
+    const provider = getServerConfig().sessionProvider;
+    if (!provider) throw new Error('no sessionProvider configured');
+    const access = readAccessTokenCookie();
+    if (access) try {
+        const verified = await provider.verifyAccessToken(access);
+        if (data.expectedSessionId && data.expectedSessionId !== verified.sessionId) throw ERR_SESSION_CHANGED({
+            message: 'session changed'
+        });
+        return {
+            sessionId: verified.sessionId
+        };
+    } catch (error) {
+        if (!(error instanceof AuthError) || 'ERR_ACCESS_EXPIRED' !== error.code) throw error;
+    }
+    const refreshToken = readRefreshTokenCookie();
+    if (!refreshToken) throw ERR_UNAUTHENTICATED({
+        message: 'no session to renew'
+    });
+    const tokens = await provider.refreshSession({
+        refreshToken,
+        expectedSessionId: data.expectedSessionId
+    });
+    setSessionCookies(tokens);
+    return {
+        sessionId: tokens.sessionId
+    };
+});
+export { renewAdminSession };

package/dist/server-fns/auth/sign-in.d.ts

@@ -11,8 +11,9 @@ export interface SignInInput {
 }
 export interface SignInResult {
     userId: string;
+    sessionId: string;
 }
-export declare const adminSignIn: import("@tanstack/react-start").RequiredFetcher<undefined, (input: SignInInput) => {
+export declare const adminSignIn: import("@tanstack/react-start").OptionalFetcher<undefined, (input: unknown) => {
     email: string;
     password: string;
 }, Promise<SignInResult>>;

package/dist/server-fns/auth/sign-in.js

@@ -1,36 +1,107 @@
 import { createServerFn } from "@tanstack/react-start";
-import { getRequestHeader } from "@tanstack/react-start/server";
-import { setSessionCookies } from "@byline/client/server";
+import { getRequest, getRequestHeader } from "@tanstack/react-start/server";
+import { readAccessTokenCookie, readRefreshTokenCookie, setSessionCookies } from "@byline/client/server";
 import { getServerConfig } from "@byline/core";
+import { passwordSignInSchema } from "@byline/core/validation";
 import { readAdminLocaleCookie } from "../../i18n/locale-cookie.js";
 import { bylineCore } from "../../integrations/byline-core.js";
+import { normalizeClientIp } from "../../integrations/client-ip.js";
+import { wasSignInBodyChecked } from "../../integrations/sign-in-body.js";
 const adminSignIn = createServerFn({
     method: 'POST'
 }).validator((input)=>{
-    if ('string' != typeof input?.email || 0 === input.email.length) throw new Error('email is required');
-    if ('string' != typeof input?.password || 0 === input.password.length) throw new Error('password is required');
-    return {
-        email: input.email,
-        password: input.password
-    };
+    const parsed = passwordSignInSchema.safeParse(input);
+    if (!parsed.success) throw new Response('Invalid sign-in input', {
+        status: 400
+    });
+    return parsed.data;
 }).handler(async ({ data })=>{
     const provider = getServerConfig().sessionProvider;
     if (!provider) throw new Error('no sessionProvider configured');
-    const userAgent = getRequestHeader('user-agent') ?? void 0;
-    const forwardedFor = getRequestHeader('x-forwarded-for') ?? void 0;
-    const ip = forwardedFor?.split(',')[0]?.trim() || void 0;
-    const result = await provider.signInWithPassword({
-        email: data.email,
-        password: data.password,
-        userAgent,
-        ip
+    const request = getRequest();
+    const protection = getServerConfig().passwordSignIn;
+    if (!wasSignInBodyChecked(request)) throw new Response('Password sign-in request middleware is not configured', {
+        status: 503
+    });
+    if (!protection) throw new Response('Password sign-in protection is not configured', {
+        status: 503
     });
+    const userAgent = getRequestHeader('user-agent')?.slice(0, 512);
+    let ip;
+    try {
+        ip = normalizeClientIp(await protection.resolveClientIp(request));
+    } catch  {
+        throw new Response('Client address unavailable', {
+            status: 503
+        });
+    }
+    if (!ip) throw new Response('Client address unavailable', {
+        status: 503
+    });
+    const tooMany = (seconds)=>new Response('Too many sign-in attempts', {
+            status: 429,
+            headers: {
+                'Retry-After': String(seconds),
+                'Cache-Control': 'no-store'
+            }
+        });
+    let release;
+    try {
+        release = await protection.limiter.acquire();
+    } catch  {
+        throw new Response('Sign-in temporarily unavailable', {
+            status: 503
+        });
+    }
+    if (!release) throw tooMany(1);
+    const recordResult = (outcome)=>{
+        try {
+            protection.limiter.recordResult?.({
+                email: data.email,
+                ip
+            }, outcome);
+        } catch  {}
+    };
+    const result = await (async ()=>{
+        try {
+            let admission;
+            try {
+                admission = await protection.limiter.consume({
+                    email: data.email,
+                    ip
+                });
+            } catch  {
+                throw new Response('Sign-in temporarily unavailable', {
+                    status: 503
+                });
+            }
+            if (!admission.allowed) throw tooMany(admission.retryAfterSeconds);
+            try {
+                const result = await provider.signInWithPassword({
+                    previousAccessToken: readAccessTokenCookie(),
+                    previousRefreshToken: readRefreshTokenCookie(),
+                    email: data.email,
+                    password: data.password,
+                    userAgent,
+                    ip
+                });
+                recordResult('success');
+                return result;
+            } catch (error) {
+                recordResult('failure');
+                throw error;
+            }
+        } finally{
+            release();
+        }
+    })();
     setSessionCookies(result);
     try {
         await reconcileLocaleAfterSignIn(result.actor.id);
     } catch  {}
     return {
-        userId: result.actor.id
+        userId: result.actor.id,
+        sessionId: result.sessionId
     };
 });
 async function reconcileLocaleAfterSignIn(adminUserId) {

package/dist/server-fns/auth/sign-out.d.ts

@@ -5,6 +5,8 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-export declare const adminSignOut: import("@tanstack/react-start").OptionalFetcher<undefined, undefined, Promise<{
+export declare const adminSignOut: import("@tanstack/react-start").OptionalFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterClient<{}, unknown, undefined, {
+    expectedSessionId: string | null;
+}, undefined>], undefined, Promise<{
     status: 'ok';
 }>>;

package/dist/server-fns/auth/sign-out.js

@@ -1,14 +1,46 @@
-import { createServerFn } from "@tanstack/react-start";
-import { clearPreviewCookie, clearSessionCookies, readRefreshTokenCookie } from "@byline/client/server";
+import { createMiddleware, createServerFn } from "@tanstack/react-start";
+import { ERR_SESSION_CHANGED } from "@byline/auth";
+import { clearPreviewCookie, clearSessionCookies, readAccessTokenCookie, readRefreshTokenCookie } from "@byline/client/server";
 import { getServerConfig } from "@byline/core";
+import { coordinateAuthAction, flagSessionChanged, notifySessionAction, sessionSnapshot } from "../../integrations/session-coordination.js";
+const signOutBoundary = createMiddleware({
+    type: 'function'
+}).client(async ({ next })=>{
+    const snapshot = sessionSnapshot();
+    return coordinateAuthAction(async ()=>{
+        try {
+            const result = await next({
+                sendContext: {
+                    expectedSessionId: snapshot.sessionId
+                }
+            });
+            notifySessionAction();
+            return result;
+        } catch (error) {
+            if (error?.code === 'ERR_SESSION_CHANGED') flagSessionChanged();
+            throw error;
+        }
+    });
+});
 const adminSignOut = createServerFn({
     method: 'POST'
-}).handler(async ()=>{
+}).middleware([
+    signOutBoundary
+]).handler(async ({ context })=>{
     const provider = getServerConfig().sessionProvider;
     const refreshToken = readRefreshTokenCookie();
-    if (provider && refreshToken) try {
-        await provider.revokeSession(refreshToken);
-    } catch  {}
+    const accessToken = readAccessTokenCookie();
+    if (refreshToken || accessToken) {
+        if (!provider) throw new Error('no sessionProvider configured');
+        if (!context.expectedSessionId) throw ERR_SESSION_CHANGED({
+            message: 'logout requires the page login identity'
+        });
+        await provider.revokeSession({
+            refreshToken,
+            accessToken,
+            expectedSessionId: context.expectedSessionId
+        });
+    }
     clearSessionCookies();
     clearPreviewCookie();
     return {

package/dist/server-fns/collections/audit.d.ts

@@ -30,7 +30,9 @@ export interface AuditLogEntryDto {
     after: string | string[] | null;
     occurredAt: string;
 }
-export declare const getCollectionDocumentAuditLog: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+export declare const getCollectionDocumentAuditLog: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
     collection: string;
     id: string;
     params?: AuditLogSearchParams;

package/dist/server-fns/collections/audit.js

@@ -2,10 +2,13 @@ import { createServerFn } from "@tanstack/react-start";
 import { getAdminBylineClient } from "@byline/client/server";
 import { ERR_NOT_FOUND, getLogger } from "@byline/core";
 import { ensureCollection } from "../../integrations/api-utils.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
 import { resolveActorLabels } from "./actors.js";
 const getCollectionDocumentAuditLog = createServerFn({
     method: 'GET'
-}).validator((input)=>input).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(async ({ data })=>{
     const { collection: path, id, params } = data;
     const config = await ensureCollection(path);
     if (!config) throw ERR_NOT_FOUND({

package/dist/server-fns/collections/copy-to-locale.d.ts

@@ -16,13 +16,17 @@ import { type CollectionDocumentCommittedHookFailureResponse } from './save-outc
  * `assertActorCanPerform('update')` runs inside the service; auth
  * failures propagate to TanStack Start's transport layer.
  */
-export declare const copyDocumentToLocale: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+export declare const copyDocumentToLocale: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
+    expectedRevision: number;
     collection: string;
     id: string;
     sourceLocale: string;
     targetLocale: string;
     overwrite: boolean;
 }) => {
+    expectedRevision: number;
     collection: string;
     id: string;
     sourceLocale: string;

package/dist/server-fns/collections/copy-to-locale.js

@@ -3,10 +3,14 @@ import { getAdminRequestContext } from "@byline/client/server";
 import { ERR_NOT_FOUND, getLogger, getServerConfig } from "@byline/core";
 import { copyToLocale } from "@byline/core/services";
 import { ensureCollection } from "../../integrations/api-utils.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
+import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { toCommittedDocumentHookFailureResponse } from "./save-outcome.js";
 const copyDocumentToLocale = createServerFn({
     method: 'POST'
-}).validator((input)=>input).handler(async ({ data: input })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
     const { collection: path, id, sourceLocale, targetLocale, overwrite } = input;
     const logger = getLogger();
     const config = await ensureCollection(path);
@@ -31,6 +35,7 @@ const copyDocumentToLocale = createServerFn({
     try {
         return await copyToLocale(ctx, {
             documentId: id,
+            expectedRevision: input.expectedRevision,
             sourceLocale,
             targetLocale,
             overwrite
@@ -40,5 +45,5 @@ const copyDocumentToLocale = createServerFn({
         if (null != committedFailure) return committedFailure;
         throw error;
     }
-});
+}));
 export { copyDocumentToLocale };

package/dist/server-fns/collections/create.d.ts

@@ -5,7 +5,9 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-export declare const createCollectionDocument: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+export declare const createCollectionDocument: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
     collection: string;
     data: any;
     locale?: string;
@@ -21,4 +23,5 @@ export declare const createCollectionDocument: import("@tanstack/react-start").R
     status: 'ok';
     documentId: string;
     documentVersionId: string;
+    revision: number;
 }>>;

package/dist/server-fns/collections/create.js

@@ -3,10 +3,14 @@ import { getAdminRequestContext } from "@byline/client/server";
 import { ERR_NOT_FOUND, getLogger, getServerConfig } from "@byline/core";
 import { createDocument } from "@byline/core/services";
 import { ensureCollection } from "../../integrations/api-utils.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
+import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { toCommittedDocumentHookFailureResponse } from "./save-outcome.js";
 const createCollectionDocument = createServerFn({
     method: 'POST'
-}).validator((input)=>input).handler(async ({ data: input })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
     const { collection: path, data: documentData, locale, path: explicitPath, availableLocales } = input;
     const logger = getLogger();
     const config = await ensureCollection(path);
@@ -45,7 +49,8 @@ const createCollectionDocument = createServerFn({
     return {
         status: 'ok',
         documentId: result.documentId,
-        documentVersionId: result.documentVersionId
+        documentVersionId: result.documentVersionId,
+        revision: result.revision
     };
-});
+}));
 export { createCollectionDocument };

package/dist/server-fns/collections/delete-locale.d.ts

@@ -17,11 +17,15 @@ import { type CollectionDocumentCommittedHookFailureResponse } from './save-outc
  * the service; auth and validation failures propagate to TanStack Start's
  * transport layer.
  */
-export declare const deleteDocumentLocale: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+export declare const deleteDocumentLocale: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
+    expectedRevision: number;
     collection: string;
     id: string;
     locale: string;
 }) => {
+    expectedRevision: number;
     collection: string;
     id: string;
     locale: string;

package/dist/server-fns/collections/delete-locale.js

@@ -3,10 +3,14 @@ import { getAdminRequestContext } from "@byline/client/server";
 import { ERR_NOT_FOUND, getLogger, getServerConfig } from "@byline/core";
 import { deleteLocale } from "@byline/core/services";
 import { ensureCollection } from "../../integrations/api-utils.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
+import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { toCommittedDocumentHookFailureResponse } from "./save-outcome.js";
 const deleteDocumentLocale = createServerFn({
     method: 'POST'
-}).validator((input)=>input).handler(async ({ data: input })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
     const { collection: path, id, locale } = input;
     const logger = getLogger();
     const config = await ensureCollection(path);
@@ -31,6 +35,7 @@ const deleteDocumentLocale = createServerFn({
     try {
         return await deleteLocale(ctx, {
             documentId: id,
+            expectedRevision: input.expectedRevision,
             locale
         });
     } catch (error) {
@@ -38,5 +43,5 @@ const deleteDocumentLocale = createServerFn({
         if (null != committedFailure) return committedFailure;
         throw error;
     }
-});
+}));
 export { deleteDocumentLocale };

package/dist/server-fns/collections/delete-outcome.d.ts

@@ -5,26 +5,30 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-import type { DeleteDocumentResult, DeleteDocumentSideEffectCode, DeleteDocumentSideEffectPhase } from '@byline/core';
+import type { DeleteDocumentResult, DeleteDocumentSideEffectCode, DeleteDocumentSideEffectPhase, StructuralMutationReceipt } from '@byline/core';
 export type DeleteDocumentPublicSideEffectPhase = DeleteDocumentSideEffectPhase | 'unknown';
 export type DeleteDocumentPublicSideEffectCode = DeleteDocumentSideEffectCode;
 export interface DeleteDocumentPublicSideEffectFailure {
     phase: DeleteDocumentPublicSideEffectPhase;
     code: DeleteDocumentPublicSideEffectCode;
 }
-export type DeleteDocumentResponse = {
+export type DeleteDocumentResponse = StructuralMutationReceipt & ({
     status: 'ok';
+    documentId: string;
+    revision: number;
     deletedVersionCount: number;
     outcome: 'committed';
     sideEffectFailures: [];
 } | {
     status: 'ok';
+    documentId: string;
+    revision: number;
     deletedVersionCount: number;
     outcome: 'committed-with-side-effect-failures';
     sideEffectFailures: [
         DeleteDocumentPublicSideEffectFailure,
         ...DeleteDocumentPublicSideEffectFailure[]
     ];
-};
+});
 export declare function toDeleteDocumentResponse(result: DeleteDocumentResult): DeleteDocumentResponse;
 export declare function hasDeleteSideEffectFailures(result: Pick<DeleteDocumentResult, 'outcome'>): boolean;

package/dist/server-fns/collections/delete-outcome.js

@@ -20,6 +20,10 @@ function toDeleteDocumentResponse(result) {
     const [firstFailure, ...remainingFailures] = result.sideEffectFailures;
     return {
         status: 'ok',
+        documentId: result.documentId,
+        revision: result.revision,
+        affectedDocuments: result.affectedDocuments,
+        scheduledPublicationsNeedReconfirmation: result.scheduledPublicationsNeedReconfirmation,
         deletedVersionCount: result.deletedVersionCount,
         outcome: result.outcome,
         sideEffectFailures: [

package/dist/server-fns/collections/delete.d.ts

@@ -5,10 +5,14 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-export declare const deleteDocument: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+export declare const deleteDocument: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
+    expectedRevision: number;
     collection: string;
     id: string;
 }) => {
+    expectedRevision: number;
     collection: string;
     id: string;
 }, Promise<import("./delete-outcome.js").DeleteDocumentResponse>>;

package/dist/server-fns/collections/delete.js

@@ -3,10 +3,14 @@ import { getAdminRequestContext } from "@byline/client/server";
 import { ERR_NOT_FOUND, getLogger, getServerConfig, getUploadFields } from "@byline/core";
 import { deleteDocument } from "@byline/core/services";
 import { ensureCollection } from "../../integrations/api-utils.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
+import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { toDeleteDocumentResponse } from "./delete-outcome.js";
 const delete_deleteDocument = createServerFn({
     method: 'POST'
-}).validator((input)=>input).handler(async ({ data: input })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
     const { collection: path, id } = input;
     const logger = getLogger();
     const config = await ensureCollection(path);
@@ -35,8 +39,9 @@ const delete_deleteDocument = createServerFn({
         requestContext: await getAdminRequestContext()
     };
     const result = await deleteDocument(ctx, {
-        documentId: id
+        documentId: id,
+        expectedRevision: input.expectedRevision
     });
     return toDeleteDocumentResponse(result);
-});
+}));
 export { delete_deleteDocument as deleteDocument };

package/dist/server-fns/collections/duplicate.d.ts

@@ -18,10 +18,14 @@ import { type CollectionDocumentCommittedHookFailureResponse } from './save-outc
  * `assertActorCanPerform(..., 'create')`; any auth failure propagates to
  * TanStack Start's transport layer for the client to branch on.
  */
-export declare const duplicateCollectionDocument: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+export declare const duplicateCollectionDocument: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
+    expectedRevision: number;
     collection: string;
     id: string;
 }) => {
+    expectedRevision: number;
     collection: string;
     id: string;
 }, Promise<CollectionDocumentCommittedHookFailureResponse | DuplicateDocumentResult>>;

package/dist/server-fns/collections/duplicate.js

@@ -3,10 +3,14 @@ import { getAdminRequestContext } from "@byline/client/server";
 import { ERR_NOT_FOUND, getLogger, getServerConfig } from "@byline/core";
 import { duplicateDocument } from "@byline/core/services";
 import { ensureCollection } from "../../integrations/api-utils.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
+import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { toCommittedDocumentHookFailureResponse } from "./save-outcome.js";
 const duplicateCollectionDocument = createServerFn({
     method: 'POST'
-}).validator((input)=>input).handler(async ({ data: input })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
     const { collection: path, id: sourceDocumentId } = input;
     const logger = getLogger();
     const config = await ensureCollection(path);
@@ -30,12 +34,13 @@ const duplicateCollectionDocument = createServerFn({
     };
     try {
         return await duplicateDocument(ctx, {
-            sourceDocumentId
+            sourceDocumentId,
+            expectedRevision: input.expectedRevision
         });
     } catch (error) {
         const committedFailure = toCommittedDocumentHookFailureResponse(error);
         if (null != committedFailure) return committedFailure;
         throw error;
     }
-});
+}));
 export { duplicateCollectionDocument };

package/dist/server-fns/collections/get.d.ts

@@ -16,6 +16,7 @@
  * `{target_document_id, target_collection_id}` refs.
  */
 export declare function getCollectionDocument(collection: string, id: string, locale?: string, depth?: number, populateRelations?: boolean): Promise<{
+    revision: number;
     _publishedVersion: Record<string, any> | null;
     _restoreWarnings?: string[] | undefined;
     availableLocales?: string[] | undefined;