@byline/host-tanstack-start 5.0.0 → 5.1.0

package/dist/admin-shell/chrome/admin-app-bar.d.ts

@@ -1,3 +1,10 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
 import { type CurrentAdminUser } from '../../server-fns/auth/index.js';
 interface AdminAppBarProps {
     user: CurrentAdminUser;

package/dist/admin-shell/chrome/admin-app-bar.js

@@ -22,13 +22,17 @@ function AdminAppBar({ user }) {
     const { breadCrumbSettings } = useBreadcrumbs();
     const { t } = useTranslation('byline-admin');
     const [signingOut, setSigningOut] = useState(false);
+    const [signOutError, setSignOutError] = useState(false);
     async function handleSignOut() {
         if (signingOut) return;
         setSigningOut(true);
+        setSignOutError(false);
         try {
             await adminSignOut();
-        } catch (err) {
-            console.warn('sign-out request failed', err);
+        } catch  {
+            setSignOutError(true);
+            setSigningOut(false);
+            return;
         }
         window.location.assign(getSignInRoutePath());
     }
@@ -62,6 +66,10 @@ function AdminAppBar({ user }) {
                             })
                         ]
                     }),
+                    signOutError && /*#__PURE__*/ jsx("span", {
+                        role: "alert",
+                        children: "Sign-out could not be confirmed. Please try again."
+                    }),
                     /*#__PURE__*/ jsx(Button, {
                         size: "xs",
                         intent: "secondary",

package/dist/admin-shell/chrome/session-change-boundary.d.ts

@@ -0,0 +1,14 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { type ReactNode } from 'react';
+import { type CurrentAdminUser } from '../../server-fns/auth/current-user.js';
+/** Blocks the page until the user explicitly acknowledges freshly verified login identity. */
+export declare function SessionChangeBoundary({ user, children, }: {
+    user?: CurrentAdminUser;
+    children: ReactNode;
+}): string | number | bigint | boolean | import("react").JSX.Element | Iterable<ReactNode> | Promise<string | number | bigint | boolean | Iterable<ReactNode> | import("react").ReactElement<unknown, string | import("react").JSXElementConstructor<any>> | import("react").ReactPortal | null | undefined> | null | undefined;

package/dist/admin-shell/chrome/session-change-boundary.js

@@ -0,0 +1,87 @@
+import { jsx, jsxs } from "react/jsx-runtime";
+import { useEffect, useState, useSyncExternalStore } from "react";
+import { acceptSession, expectedSession, flagSessionChanged, observeSession, sessionEpoch, sessionIsChanged, startSessionNotifications, subscribeSessionChange } from "../../integrations/session-coordination.js";
+import { getSignInRoutePath } from "../../routes/sign-in-path.js";
+import { getCurrentAdminUser } from "../../server-fns/auth/current-user.js";
+function SessionChangeBoundary({ user, children }) {
+    const epoch = useSyncExternalStore(subscribeSessionChange, sessionEpoch, ()=>0);
+    const changed = sessionIsChanged();
+    const [current, setCurrent] = useState(user);
+    const [error, setError] = useState();
+    const [busy, setBusy] = useState(false);
+    const mismatch = "u" > typeof window && !!user && !!expectedSession() && expectedSession() !== user.sessionId;
+    useEffect(()=>{
+        startSessionNotifications();
+        if (user) try {
+            observeSession(user.sessionId);
+        } catch  {}
+    }, [
+        user
+    ]);
+    useEffect(()=>{
+        if (!changed && !mismatch) return;
+        getCurrentAdminUser().then((verified)=>{
+            if (sessionEpoch() !== epoch) return;
+            setCurrent(verified);
+            setError(void 0);
+        }).catch(()=>setError('The session is no longer available. Please sign in again.'));
+    }, [
+        changed,
+        mismatch,
+        epoch
+    ]);
+    if (!changed && !mismatch) return children;
+    async function acknowledge() {
+        setBusy(true);
+        try {
+            const verified = await getCurrentAdminUser();
+            if (!current || current.sessionId !== verified.sessionId) {
+                setCurrent(verified);
+                setError('The active session changed again. Review the account before continuing.');
+                return;
+            }
+            acceptSession(verified.sessionId);
+            window.location.reload();
+        } catch  {
+            flagSessionChanged();
+            setError('Unable to verify the active session. Please sign in again.');
+        } finally{
+            setBusy(false);
+        }
+    }
+    return /*#__PURE__*/ jsxs("main", {
+        role: "alertdialog",
+        "aria-modal": "true",
+        "aria-labelledby": "session-change-title",
+        children: [
+            /*#__PURE__*/ jsx("h1", {
+                id: "session-change-title",
+                children: "Your session has changed"
+            }),
+            /*#__PURE__*/ jsx("p", {
+                children: "Your previous work has not been retried. Check the active account before continuing."
+            }),
+            current && /*#__PURE__*/ jsxs("p", {
+                children: [
+                    "Active account: ",
+                    current.email
+                ]
+            }),
+            error && /*#__PURE__*/ jsx("p", {
+                role: "alert",
+                children: error
+            }),
+            /*#__PURE__*/ jsx("button", {
+                type: "button",
+                disabled: busy || !current,
+                onClick: acknowledge,
+                children: "Continue as this account"
+            }),
+            /*#__PURE__*/ jsx("a", {
+                href: `${getSignInRoutePath()}?reauthenticate=1`,
+                children: "Sign in again"
+            })
+        ]
+    });
+}
+export { SessionChangeBoundary };

package/dist/admin-shell/chrome/session-change-boundary.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};

package/dist/admin-shell/chrome/sign-in-page.d.ts

@@ -7,6 +7,7 @@
  */
 import type { LocaleCode } from '@byline/i18n';
 interface SignInPageProps {
+    reauthenticate?: boolean;
     redirectTo: string;
     activeLocale: LocaleCode;
     homeUrl?: string;
@@ -31,5 +32,5 @@ interface SignInPageProps {
  * Threads an optional host-owned `homeUrl` into `SignInForm` so the form's
  * action row can render a plain "Home" link beside the submit button.
  */
-export declare function SignInPage({ redirectTo, activeLocale, homeUrl }: SignInPageProps): import("react").JSX.Element;
+export declare function SignInPage({ redirectTo, activeLocale, homeUrl, reauthenticate, }: SignInPageProps): import("react").JSX.Element;
 export {};

package/dist/admin-shell/chrome/sign-in-page.js

@@ -1,4 +1,5 @@
 import { jsx, jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from "react";
 import { SignInForm } from "@byline/admin/auth/components/sign-in-form";
 import { BylineAdminServicesProvider } from "@byline/admin/services";
 import { getAdminConfig } from "@byline/core";
@@ -6,9 +7,44 @@ import { I18nProvider, LanguageMenu } from "@byline/i18n/react";
 import clsx from "clsx";
 import { buildLocaleDefinitions } from "../../i18n/locale-definitions.js";
 import { bylineAdminServices } from "../../integrations/byline-admin-services.js";
+import { coordinateAuthAction, expectedSession, flagSessionChanged, observeSession, renewSingleFlight } from "../../integrations/session-coordination.js";
+import { renewAdminSession } from "../../server-fns/auth/renew.js";
 import { setAdminLocaleFn } from "../../server-fns/i18n/index.js";
+import { SessionChangeBoundary } from "./session-change-boundary.js";
 import sign_in_page_module from "./sign-in-page.module.js";
-function SignInPage({ redirectTo, activeLocale, homeUrl }) {
+function SignInPage({ redirectTo, activeLocale, homeUrl, reauthenticate = false }) {
+    const [checking, setChecking] = useState(!reauthenticate);
+    const [bootstrapError, setBootstrapError] = useState(false);
+    useEffect(()=>{
+        if (reauthenticate) return;
+        let active = true;
+        renewSingleFlight(()=>coordinateAuthAction(async ()=>{
+                const result = await renewAdminSession({
+                    data: {
+                        expectedSessionId: expectedSession() ?? void 0
+                    }
+                });
+                observeSession(result.sessionId);
+            })).then(()=>{
+            if (active) window.location.replace(redirectTo);
+        }).catch((error)=>{
+            if (error?.code === 'ERR_SESSION_CHANGED') flagSessionChanged();
+            else if (![
+                'ERR_UNAUTHENTICATED',
+                'ERR_INVALID_TOKEN',
+                'ERR_REVOKED_TOKEN',
+                'ERR_ACCOUNT_DISABLED'
+            ].includes(error?.code)) setBootstrapError(true);
+        }).finally(()=>{
+            if (active) setChecking(false);
+        });
+        return ()=>{
+            active = false;
+        };
+    }, [
+        redirectTo,
+        reauthenticate
+    ]);
     const { i18n } = getAdminConfig();
     const localeDefinitions = buildLocaleDefinitions(i18n.admin.locales, i18n.admin.localeDefinitions);
     const handleSetLocale = async (next)=>{
@@ -19,7 +55,7 @@ function SignInPage({ redirectTo, activeLocale, homeUrl }) {
         });
         window.location.reload();
     };
-    return /*#__PURE__*/ jsx(I18nProvider, {
+    const content = /*#__PURE__*/ jsx(I18nProvider, {
         bundle: i18n.translations ?? {},
         activeLocale: activeLocale,
         defaultLocale: i18n.admin.defaultLocale,
@@ -30,13 +66,31 @@ function SignInPage({ redirectTo, activeLocale, homeUrl }) {
             children: /*#__PURE__*/ jsxs("main", {
                 className: clsx('byline-sign-in-page', sign_in_page_module.main),
                 children: [
+                    /*#__PURE__*/ jsx("noscript", {
+                        children: "JavaScript is required to sign in or renew your admin session."
+                    }),
                     /*#__PURE__*/ jsx("div", {
                         className: clsx('byline-sign-in-page-bar', sign_in_page_module.bar),
                         children: /*#__PURE__*/ jsx(LanguageMenu, {})
                     }),
                     /*#__PURE__*/ jsx("div", {
                         className: clsx('byline-sign-in-page-inner', sign_in_page_module.inner),
-                        children: /*#__PURE__*/ jsx(SignInForm, {
+                        children: bootstrapError ? /*#__PURE__*/ jsxs("div", {
+                            role: "alert",
+                            children: [
+                                /*#__PURE__*/ jsx("p", {
+                                    children: "Unable to check your session. Please try again."
+                                }),
+                                /*#__PURE__*/ jsx("button", {
+                                    type: "button",
+                                    onClick: ()=>window.location.reload(),
+                                    children: "Try again"
+                                })
+                            ]
+                        }) : checking ? /*#__PURE__*/ jsx("p", {
+                            role: "status",
+                            children: "Checking your session…"
+                        }) : /*#__PURE__*/ jsx(SignInForm, {
                             redirectTo: redirectTo,
                             homeUrl: homeUrl
                         })
@@ -45,5 +99,8 @@ function SignInPage({ redirectTo, activeLocale, homeUrl }) {
             })
         })
     });
+    return reauthenticate ? content : /*#__PURE__*/ jsx(SessionChangeBoundary, {
+        children: content
+    });
 }
 export { SignInPage };

package/dist/integrations/byline-admin-services.js

@@ -5,13 +5,19 @@ import { createAdminUser, setAdminUserPassword, setUserRoles, updateAdminUser }
 import { adminSignIn } from "../server-fns/auth/index.js";
 import { getCollectionDocumentVersion } from "../server-fns/collections/get.js";
 import { setAdminLocaleFn } from "../server-fns/i18n/index.js";
+import { acceptSession, coordinateAuthAction, notifySessionAction } from "./session-coordination.js";
 const byline_admin_services_getCollectionDocumentVersion = async (collection, documentId, versionId, locale)=>{
     const result = await getCollectionDocumentVersion(collection, documentId, versionId, locale);
     if (null == result) throw new Error(`Document version not found: collection=${collection} document=${documentId} version=${versionId}`);
     return result;
 };
 const bylineAdminServices = {
-    adminSignIn: adminSignIn,
+    adminSignIn: async (args)=>{
+        const result = await coordinateAuthAction(()=>adminSignIn(args));
+        acceptSession(result.sessionId);
+        notifySessionAction();
+        return result;
+    },
     updateAccount: updateAccount,
     changeAccountPassword: changeAccountPassword,
     setAdminLocale: setAdminLocaleFn,

package/dist/integrations/client-ip.d.ts

@@ -0,0 +1,19 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { ClientIpResolver } from '@byline/auth';
+/** Normalize equivalent IPv6 spellings and IPv4-mapped IPv6 before choosing a rate-limit key. */
+export declare function normalizeClientIp(value: string | null | undefined): string | null;
+/**
+ * Configure either a direct peer resolver or an explicitly trusted proxy header.
+ * Header mode requires the deployment to overwrite that header and block proxy bypass.
+ * Never falls back from a missing/invalid trusted header to another client-supplied header.
+ */
+export declare function createClientIpResolver(options: {
+    trustedProxyHeader?: string;
+    resolvePeerIp: ClientIpResolver;
+}): ClientIpResolver;

package/dist/integrations/client-ip.js

@@ -0,0 +1,34 @@
+import { isIP } from "node:net";
+function normalizeClientIp(value) {
+    if (!value || value.length > 64) return null;
+    const ip = value.trim();
+    if (4 === isIP(ip)) return ip;
+    if (6 !== isIP(ip) || ip.includes('%')) return null;
+    const normalized = new URL(`http://[${ip}]/`).hostname.slice(1, -1);
+    const mapped = /^::ffff:([0-9a-f]+):([0-9a-f]+)$/.exec(normalized);
+    if (mapped) {
+        const high = Number.parseInt(mapped[1], 16);
+        const low = Number.parseInt(mapped[2], 16);
+        return [
+            high >>> 8,
+            255 & high,
+            low >>> 8,
+            255 & low
+        ].join('.');
+    }
+    return normalized;
+}
+function createClientIpResolver(options) {
+    const header = options.trustedProxyHeader;
+    if (void 0 !== header && !/^[a-z0-9-]+$/i.test(header)) throw new Error('Invalid trusted IP header');
+    let lastDiagnostic = -1 / 0;
+    return async (request)=>{
+        const ip = normalizeClientIp(void 0 === header ? await options.resolvePeerIp(request) : request.headers.get(header));
+        if (!ip && performance.now() - lastDiagnostic >= 60000) {
+            lastDiagnostic = performance.now();
+            console.warn('[byline:client-ip] No valid single client IP; check the configured peer resolver or trusted proxy header.');
+        }
+        return ip;
+    };
+}
+export { createClientIpResolver, normalizeClientIp };

package/dist/integrations/session-coordination.d.ts

@@ -0,0 +1,24 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export declare const sessionChangedError: () => Error;
+export declare function expectedSession(): string | null;
+export declare function sessionSnapshot(): {
+    sessionId: string | null;
+    epoch: number;
+};
+export declare function requireUnchanged(snapshot: ReturnType<typeof sessionSnapshot>): void;
+export declare function flagSessionChanged(): void;
+export declare function acceptSession(sessionId: string): void;
+export declare function observeSession(sessionId: string): void;
+export declare function sessionEpoch(): number;
+export declare function sessionIsChanged(): boolean;
+export declare function subscribeSessionChange(listener: () => void): () => void;
+export declare function renewSingleFlight(work: () => Promise<void>): Promise<void>;
+export declare function coordinateAuthAction<T>(work: () => Promise<T>): Promise<T>;
+export declare function startSessionNotifications(): void;
+export declare function notifySessionAction(): void;

package/dist/integrations/session-coordination.js

@@ -0,0 +1,85 @@
+const storageKey = 'byline.expected-login';
+let expected = null;
+let epoch = 0;
+let changed = false;
+let renewal;
+const listeners = new Set();
+const sessionChangedError = ()=>new Error('Session changed. Acknowledge the active account before continuing.');
+function expectedSession() {
+    if ("u" < typeof window) return null;
+    if (!expected) expected = window.sessionStorage.getItem(storageKey);
+    return expected;
+}
+function sessionSnapshot() {
+    return {
+        sessionId: expectedSession(),
+        epoch: epoch
+    };
+}
+function requireUnchanged(snapshot) {
+    if (changed || snapshot.epoch !== epoch || snapshot.sessionId !== expectedSession()) throw sessionChangedError();
+}
+function flagSessionChanged() {
+    changed = true;
+    epoch++;
+    for (const listener of listeners)listener();
+}
+function acceptSession(sessionId) {
+    if ("u" < typeof window) return;
+    if ('string' != typeof sessionId || !sessionId) throw new Error('Provider omitted login identity');
+    window.sessionStorage.setItem(storageKey, sessionId);
+    expected = sessionId;
+    changed = false;
+    epoch++;
+    for (const listener of listeners)listener();
+}
+function observeSession(sessionId) {
+    const old = expectedSession();
+    if (old && old !== sessionId) {
+        flagSessionChanged();
+        throw sessionChangedError();
+    }
+    if (!old) acceptSession(sessionId);
+}
+function sessionEpoch() {
+    return epoch;
+}
+function sessionIsChanged() {
+    return changed;
+}
+function subscribeSessionChange(listener) {
+    listeners.add(listener);
+    return ()=>{
+        listeners.delete(listener);
+    };
+}
+function renewSingleFlight(work) {
+    if (!renewal) renewal = work().finally(()=>{
+        renewal = void 0;
+    });
+    return renewal;
+}
+let authQueue = Promise.resolve();
+function coordinateAuthAction(work) {
+    const run = authQueue.catch(()=>{}).then(async ()=>{
+        if ("u" > typeof navigator && navigator.locks) return navigator.locks.request('byline.auth', work);
+        return work();
+    });
+    authQueue = run;
+    return run;
+}
+let channel;
+function startSessionNotifications() {
+    if ("u" < typeof BroadcastChannel || channel) return;
+    channel = new BroadcastChannel('byline.session');
+    channel.onmessage = ()=>{
+        flagSessionChanged();
+    };
+}
+function notifySessionAction() {
+    startSessionNotifications();
+    channel?.postMessage({
+        type: 'session-changed'
+    });
+}
+export { acceptSession, coordinateAuthAction, expectedSession, flagSessionChanged, notifySessionAction, observeSession, renewSingleFlight, requireUnchanged, sessionChangedError, sessionEpoch, sessionIsChanged, sessionSnapshot, startSessionNotifications, subscribeSessionChange };

package/dist/integrations/session-middleware.d.ts

@@ -0,0 +1,11 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** The boundary owns the retry signal; handler errors cannot turn into retryable outcomes. */
+export declare const adminSessionMiddleware: import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>;

package/dist/integrations/session-middleware.js

@@ -0,0 +1,94 @@
+import { createMiddleware } from "@tanstack/react-start";
+import { getRequest, setResponseHeader } from "@tanstack/react-start/server";
+import { AuthError, ERR_ACCESS_EXPIRED, ERR_SESSION_CHANGED, ERR_UNAUTHENTICATED } from "@byline/auth";
+import { getAdminRequestContext } from "@byline/client/server";
+import { renewAdminSession } from "../server-fns/auth/renew.js";
+import { coordinateAuthAction, flagSessionChanged, observeSession, renewSingleFlight, requireUnchanged, sessionSnapshot } from "./session-coordination.js";
+import { sessionRequestKind } from "./session-request-kind.js";
+const outcomeHeader = 'x-byline-auth-boundary';
+const adminSessionMiddleware = createMiddleware({
+    type: 'function'
+}).client(async ({ next })=>{
+    if ("u" < typeof window) return next({
+        sendContext: {
+            bylineExpectedSessionId: null
+        }
+    });
+    const snapshot = sessionSnapshot();
+    requireUnchanged(snapshot);
+    return next({
+        sendContext: {
+            bylineExpectedSessionId: snapshot.sessionId
+        },
+        fetch: async (input, init)=>{
+            const reusable = !(input instanceof Request) && !(init?.body instanceof ReadableStream);
+            let response = await fetch(input, init);
+            if ('changed' === response.headers.get(outcomeHeader)) {
+                flagSessionChanged();
+                throw ERR_SESSION_CHANGED({
+                    message: 'session changed'
+                });
+            }
+            if ('renew' === response.headers.get(outcomeHeader)) {
+                requireUnchanged(snapshot);
+                await renewSingleFlight(()=>coordinateAuthAction(async ()=>{
+                        const result = await renewAdminSession({
+                            data: {
+                                expectedSessionId: snapshot.sessionId ?? void 0
+                            }
+                        }).catch((error)=>{
+                            if (error?.code === 'ERR_SESSION_CHANGED') flagSessionChanged();
+                            throw error;
+                        });
+                        if (snapshot.sessionId && result.sessionId !== snapshot.sessionId) {
+                            flagSessionChanged();
+                            throw ERR_SESSION_CHANGED({
+                                message: 'session changed during renewal'
+                            });
+                        }
+                        observeSession(result.sessionId);
+                    }));
+                requireUnchanged(snapshot);
+                if (!reusable) throw ERR_ACCESS_EXPIRED({
+                    message: 'Session renewed. Please retry the operation.'
+                });
+                response = await fetch(input, init);
+                if ('changed' === response.headers.get(outcomeHeader)) flagSessionChanged();
+            }
+            requireUnchanged(snapshot);
+            return response;
+        }
+    });
+}).server(async ({ next, context, method })=>{
+    const kind = sessionRequestKind(getRequest());
+    if (!kind) throw new Error('sessionRequestMiddleware is not configured');
+    let auth;
+    try {
+        auth = await getAdminRequestContext();
+    } catch (error) {
+        if (error instanceof AuthError && 'ERR_ACCESS_EXPIRED' === error.code) setResponseHeader(outcomeHeader, 'renew');
+        throw error;
+    }
+    const expected = context.bylineExpectedSessionId;
+    if (('serverFn' === kind || 'GET' !== method) && (!expected || expected !== auth.sessionId)) {
+        setResponseHeader(outcomeHeader, 'changed');
+        throw ERR_SESSION_CHANGED({
+            message: 'session changed before operation'
+        });
+    }
+    if (!auth.sessionId) throw ERR_UNAUTHENTICATED({
+        message: 'provider omitted login identity'
+    });
+    try {
+        const result = await next();
+        const response = result.result;
+        if (response instanceof Response) response.headers.delete(outcomeHeader);
+        return result;
+    } catch (error) {
+        if (error instanceof Response) error.headers.delete(outcomeHeader);
+        throw error;
+    } finally{
+        setResponseHeader(outcomeHeader, 'handled');
+    }
+});
+export { adminSessionMiddleware };

package/dist/integrations/session-request-kind.d.ts

@@ -0,0 +1,9 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export declare function recordSessionRequestKind(request: object, kind: string): void;
+export declare function sessionRequestKind(request: object): string | undefined;

package/dist/integrations/session-request-kind.js

@@ -0,0 +1,10 @@
+const key = Symbol.for('byline.sessionRequestKinds');
+const kinds = globalThis[key] ?? new WeakMap();
+globalThis[key] = kinds;
+function recordSessionRequestKind(request, kind) {
+    kinds.set(request, kind);
+}
+function sessionRequestKind(request) {
+    return kinds.get(request);
+}
+export { recordSessionRequestKind, sessionRequestKind };

package/dist/integrations/session-request-middleware.d.ts

@@ -0,0 +1,9 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Register after CSRF. Classifies SSR separately from remotely invoked business functions. */
+export declare const sessionRequestMiddleware: import("@tanstack/react-start").RequestMiddlewareAfterServer<{}, undefined, undefined>;

package/dist/integrations/session-request-middleware.js

@@ -0,0 +1,7 @@
+import { createMiddleware } from "@tanstack/react-start";
+import { recordSessionRequestKind } from "./session-request-kind.js";
+const sessionRequestMiddleware = createMiddleware().server(async (ctx)=>{
+    recordSessionRequestKind(ctx.request, ctx.handlerType);
+    return ctx.next();
+});
+export { sessionRequestMiddleware };

package/dist/integrations/sign-in-body.d.ts

@@ -0,0 +1,12 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Limit the serialized RPC envelope, not just its eventual credential fields. */
+export declare const SIGN_IN_MAX_BODY_BYTES: number;
+export declare function wasSignInBodyChecked(request: Request): boolean;
+/** Read a bounded clone before Start parses the original. Never await tee cancellation. */
+export declare function checkSignInBody(request: Request): Promise<Response | undefined>;