@byline/host-tanstack-start 5.0.0 → 5.1.1

package/dist/admin-shell/chrome/admin-app-bar.d.ts

@@ -1,3 +1,10 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
 import { type CurrentAdminUser } from '../../server-fns/auth/index.js';
 interface AdminAppBarProps {
     user: CurrentAdminUser;

package/dist/admin-shell/chrome/admin-app-bar.js

@@ -22,13 +22,17 @@ function AdminAppBar({ user }) {
     const { breadCrumbSettings } = useBreadcrumbs();
     const { t } = useTranslation('byline-admin');
     const [signingOut, setSigningOut] = useState(false);
+    const [signOutError, setSignOutError] = useState(false);
     async function handleSignOut() {
         if (signingOut) return;
         setSigningOut(true);
+        setSignOutError(false);
         try {
             await adminSignOut();
-        } catch (err) {
-            console.warn('sign-out request failed', err);
+        } catch  {
+            setSignOutError(true);
+            setSigningOut(false);
+            return;
         }
         window.location.assign(getSignInRoutePath());
     }
@@ -62,6 +66,10 @@ function AdminAppBar({ user }) {
                             })
                         ]
                     }),
+                    signOutError && /*#__PURE__*/ jsx("span", {
+                        role: "alert",
+                        children: "Sign-out could not be confirmed. Please try again."
+                    }),
                     /*#__PURE__*/ jsx(Button, {
                         size: "xs",
                         intent: "secondary",

package/dist/admin-shell/chrome/optional-i18n-provider.d.ts

@@ -0,0 +1,29 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { type ReactNode } from 'react';
+/**
+ * Guarantees a translation context for chrome that can render *outside*
+ * the admin layout's `<I18nProvider>`.
+ *
+ * When a provider is already above us it is reused as-is, preserving the
+ * user's active locale. Only when none is present does this self-mount.
+ *
+ * Resilient by design: components using this are the ones shown when
+ * something has already gone wrong, so throwing here would mask the real
+ * condition. If the admin config can't be read it falls back to an
+ * English-default provider with an empty bundle — with a provider always
+ * present, `useTranslation` never throws, and a missing key renders as the
+ * raw key rather than crashing (see `I18nProvider`'s `onMissing`).
+ *
+ * `route-error.tsx` carries its own equivalent copy of this logic; it was
+ * left in place deliberately rather than refactored alongside an unrelated
+ * change, and can adopt this component whenever that file is next touched.
+ */
+export declare function OptionalI18nProvider({ children }: {
+    children: ReactNode;
+}): import("react").JSX.Element;

package/dist/admin-shell/chrome/optional-i18n-provider.js

@@ -0,0 +1,24 @@
+import { Fragment, jsx } from "react/jsx-runtime";
+import { useContext } from "react";
+import { getAdminConfig } from "@byline/core";
+import { I18nContext, I18nProvider } from "@byline/i18n/react";
+function OptionalI18nProvider({ children }) {
+    if (null != useContext(I18nContext)) return /*#__PURE__*/ jsx(Fragment, {
+        children: children
+    });
+    let bundle = {};
+    let locale = 'en';
+    try {
+        const { i18n } = getAdminConfig();
+        bundle = i18n.translations ?? {};
+        locale = i18n.admin.defaultLocale;
+    } catch  {}
+    return /*#__PURE__*/ jsx(I18nProvider, {
+        bundle: bundle,
+        activeLocale: locale,
+        defaultLocale: locale,
+        localeDefinitions: [],
+        children: children
+    });
+}
+export { OptionalI18nProvider };

package/dist/admin-shell/chrome/session-change-boundary.d.ts

@@ -0,0 +1,14 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { type ReactNode } from 'react';
+import { type CurrentAdminUser } from '../../server-fns/auth/current-user.js';
+/** Blocks the page until the user explicitly acknowledges freshly verified login identity. */
+export declare function SessionChangeBoundary({ user, children, }: {
+    user?: CurrentAdminUser;
+    children: ReactNode;
+}): string | number | bigint | boolean | import("react").JSX.Element | Iterable<ReactNode> | Promise<string | number | bigint | boolean | Iterable<ReactNode> | import("react").ReactElement<unknown, string | import("react").JSXElementConstructor<any>> | import("react").ReactPortal | null | undefined> | null | undefined;

package/dist/admin-shell/chrome/session-change-boundary.js

@@ -0,0 +1,119 @@
+import { jsx, jsxs } from "react/jsx-runtime";
+import { useEffect, useState, useSyncExternalStore } from "react";
+import { useTranslation } from "@byline/i18n/react";
+import { Button } from "@byline/ui/react";
+import clsx from "clsx";
+import { acceptSession, expectedSession, flagSessionChanged, observeSession, sessionEpoch, sessionIsChanged, startSessionNotifications, subscribeSessionChange } from "../../integrations/session-coordination.js";
+import { getSignInRoutePath } from "../../routes/sign-in-path.js";
+import { getCurrentAdminUser } from "../../server-fns/auth/current-user.js";
+import { OptionalI18nProvider } from "./optional-i18n-provider.js";
+import session_change_boundary_module from "./session-change-boundary.module.js";
+function SessionChangeBoundary({ user, children }) {
+    const epoch = useSyncExternalStore(subscribeSessionChange, sessionEpoch, ()=>0);
+    const changed = sessionIsChanged();
+    const [current, setCurrent] = useState(user);
+    const [error, setError] = useState();
+    const [busy, setBusy] = useState(false);
+    const mismatch = "u" > typeof window && !!user && !!expectedSession() && expectedSession() !== user.sessionId;
+    useEffect(()=>{
+        startSessionNotifications();
+        if (user) try {
+            observeSession(user.sessionId);
+        } catch  {}
+    }, [
+        user
+    ]);
+    useEffect(()=>{
+        if (!changed && !mismatch) return;
+        getCurrentAdminUser().then((verified)=>{
+            if (sessionEpoch() !== epoch) return;
+            setCurrent(verified);
+            setError(void 0);
+        }).catch(()=>setError('sessionChange.errors.unavailable'));
+    }, [
+        changed,
+        mismatch,
+        epoch
+    ]);
+    if (!changed && !mismatch) return children;
+    async function acknowledge() {
+        setBusy(true);
+        try {
+            const verified = await getCurrentAdminUser();
+            if (!current || current.sessionId !== verified.sessionId) {
+                setCurrent(verified);
+                setError('sessionChange.errors.changedAgain');
+                return;
+            }
+            acceptSession(verified.sessionId);
+            window.location.reload();
+        } catch  {
+            flagSessionChanged();
+            setError('sessionChange.errors.unverifiable');
+        } finally{
+            setBusy(false);
+        }
+    }
+    return /*#__PURE__*/ jsx(OptionalI18nProvider, {
+        children: /*#__PURE__*/ jsx(SessionChangeInterstitial, {
+            current: current,
+            errorKey: error,
+            busy: busy,
+            onAcknowledge: acknowledge
+        })
+    });
+}
+function SessionChangeInterstitial({ current, errorKey, busy, onAcknowledge }) {
+    const { t } = useTranslation('byline-admin');
+    return /*#__PURE__*/ jsx("main", {
+        className: clsx('byline-session-change', session_change_boundary_module.main),
+        role: "alertdialog",
+        "aria-modal": "true",
+        "aria-labelledby": "session-change-title",
+        children: /*#__PURE__*/ jsxs("div", {
+            className: clsx('byline-session-change-card', session_change_boundary_module.card),
+            children: [
+                /*#__PURE__*/ jsx("h1", {
+                    id: "session-change-title",
+                    className: clsx('byline-session-change-title', session_change_boundary_module.title),
+                    children: t('sessionChange.title')
+                }),
+                /*#__PURE__*/ jsx("p", {
+                    className: clsx('byline-session-change-body', session_change_boundary_module.body),
+                    children: t('sessionChange.body')
+                }),
+                current && /*#__PURE__*/ jsx("p", {
+                    className: clsx('byline-session-change-account', session_change_boundary_module.account),
+                    children: t('sessionChange.activeAccount', {
+                        email: current.email
+                    })
+                }),
+                errorKey && /*#__PURE__*/ jsx("p", {
+                    className: clsx('byline-session-change-error', session_change_boundary_module.error),
+                    role: "alert",
+                    children: t(errorKey)
+                }),
+                /*#__PURE__*/ jsxs("div", {
+                    className: clsx('byline-session-change-actions', session_change_boundary_module.actions),
+                    children: [
+                        /*#__PURE__*/ jsx(Button, {
+                            type: "button",
+                            disabled: busy || !current,
+                            onClick: onAcknowledge,
+                            children: t('sessionChange.continue')
+                        }),
+                        /*#__PURE__*/ jsx(Button, {
+                            variant: "outlined",
+                            intent: "noeffect",
+                            render: /*#__PURE__*/ jsx("a", {
+                                href: `${getSignInRoutePath()}?reauthenticate=1`
+                            }),
+                            children: t('sessionChange.signInAgain')
+                        })
+                    ]
+                })
+            ]
+        })
+    });
+}
+export { SessionChangeBoundary };

package/dist/admin-shell/chrome/session-change-boundary.module.js

@@ -0,0 +1,11 @@
+import "./session-change-boundary_module.css";
+const session_change_boundary_module = {
+    main: "main-MNvpLI",
+    card: "card-BMYD6l",
+    title: "title-N8HIe4",
+    body: "body-WE9gi2",
+    account: "account-ZFcz_R",
+    error: "error-GXrBRW",
+    actions: "actions-O152EZ"
+};
+export default session_change_boundary_module;

package/dist/admin-shell/chrome/session-change-boundary.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};

package/dist/admin-shell/chrome/session-change-boundary_module.css

@@ -0,0 +1,81 @@
+:is(.main-MNvpLI, .byline-session-change) {
+  justify-content: center;
+  align-items: center;
+  min-height: 100dvh;
+  padding: 1.5rem 1.5rem calc(1.5rem + 12vh);
+  display: flex;
+}
+
+:is(.card-BMYD6l, .byline-session-change-card) {
+  border: var(--border-width-thin) var(--border-style-solid) var(--gray-100);
+  border-radius: var(--border-radius-md);
+  background-color: var(--canvas-25);
+  flex-direction: column;
+  gap: .75rem;
+  width: 100%;
+  max-width: 30rem;
+  padding: 1.5rem;
+  display: flex;
+}
+
+:is(:is([data-theme="dark"], .dark) .card-BMYD6l, :is([data-theme="dark"], .dark) .byline-session-change-card) {
+  border-color: var(--gray-700);
+  background-color: var(--canvas-800);
+}
+
+:is(.title-N8HIe4, .byline-session-change-title) {
+  font-size: var(--font-size-xl);
+  font-weight: var(--font-weight-semibold);
+  line-height: var(--line-height-snug);
+  letter-spacing: var(--letter-spacing-tight);
+  color: var(--gray-900);
+  margin: 0;
+}
+
+:is(:is([data-theme="dark"], .dark) .title-N8HIe4, :is([data-theme="dark"], .dark) .byline-session-change-title) {
+  color: var(--gray-100);
+}
+
+:is(.body-WE9gi2, .byline-session-change-body) {
+  font-size: var(--font-size-sm);
+  line-height: var(--line-height-relaxed);
+  color: var(--gray-700);
+  margin: 0;
+}
+
+:is(:is([data-theme="dark"], .dark) .body-WE9gi2, :is([data-theme="dark"], .dark) .byline-session-change-body) {
+  color: var(--gray-400);
+}
+
+:is(.account-ZFcz_R, .byline-session-change-account) {
+  font-size: var(--font-size-sm);
+  font-weight: var(--font-weight-medium);
+  line-height: var(--line-height-normal);
+  color: var(--gray-900);
+  overflow-wrap: anywhere;
+  margin: 0;
+}
+
+:is(:is([data-theme="dark"], .dark) .account-ZFcz_R, :is([data-theme="dark"], .dark) .byline-session-change-account) {
+  color: var(--gray-100);
+}
+
+:is(.error-GXrBRW, .byline-session-change-error) {
+  font-size: var(--font-size-sm);
+  line-height: var(--line-height-relaxed);
+  color: var(--red-600);
+  margin: 0;
+}
+
+:is(:is([data-theme="dark"], .dark) .error-GXrBRW, :is([data-theme="dark"], .dark) .byline-session-change-error) {
+  color: var(--red-400);
+}
+
+:is(.actions-O152EZ, .byline-session-change-actions) {
+  flex-wrap: wrap;
+  align-items: center;
+  gap: .75rem;
+  margin-top: .25rem;
+  display: flex;
+}
+

package/dist/admin-shell/chrome/sign-in-page.d.ts

@@ -7,6 +7,7 @@
  */
 import type { LocaleCode } from '@byline/i18n';
 interface SignInPageProps {
+    reauthenticate?: boolean;
     redirectTo: string;
     activeLocale: LocaleCode;
     homeUrl?: string;
@@ -31,5 +32,5 @@ interface SignInPageProps {
  * Threads an optional host-owned `homeUrl` into `SignInForm` so the form's
  * action row can render a plain "Home" link beside the submit button.
  */
-export declare function SignInPage({ redirectTo, activeLocale, homeUrl }: SignInPageProps): import("react").JSX.Element;
+export declare function SignInPage({ redirectTo, activeLocale, homeUrl, reauthenticate, }: SignInPageProps): import("react").JSX.Element;
 export {};

package/dist/admin-shell/chrome/sign-in-page.js

@@ -1,4 +1,5 @@
 import { jsx, jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from "react";
 import { SignInForm } from "@byline/admin/auth/components/sign-in-form";
 import { BylineAdminServicesProvider } from "@byline/admin/services";
 import { getAdminConfig } from "@byline/core";
@@ -6,9 +7,44 @@ import { I18nProvider, LanguageMenu } from "@byline/i18n/react";
 import clsx from "clsx";
 import { buildLocaleDefinitions } from "../../i18n/locale-definitions.js";
 import { bylineAdminServices } from "../../integrations/byline-admin-services.js";
+import { coordinateAuthAction, expectedSession, flagSessionChanged, observeSession, renewSingleFlight } from "../../integrations/session-coordination.js";
+import { renewAdminSession } from "../../server-fns/auth/renew.js";
 import { setAdminLocaleFn } from "../../server-fns/i18n/index.js";
+import { SessionChangeBoundary } from "./session-change-boundary.js";
 import sign_in_page_module from "./sign-in-page.module.js";
-function SignInPage({ redirectTo, activeLocale, homeUrl }) {
+function SignInPage({ redirectTo, activeLocale, homeUrl, reauthenticate = false }) {
+    const [checking, setChecking] = useState(!reauthenticate);
+    const [bootstrapError, setBootstrapError] = useState(false);
+    useEffect(()=>{
+        if (reauthenticate) return;
+        let active = true;
+        renewSingleFlight(()=>coordinateAuthAction(async ()=>{
+                const result = await renewAdminSession({
+                    data: {
+                        expectedSessionId: expectedSession() ?? void 0
+                    }
+                });
+                observeSession(result.sessionId);
+            })).then(()=>{
+            if (active) window.location.replace(redirectTo);
+        }).catch((error)=>{
+            if (error?.code === 'ERR_SESSION_CHANGED') flagSessionChanged();
+            else if (![
+                'ERR_UNAUTHENTICATED',
+                'ERR_INVALID_TOKEN',
+                'ERR_REVOKED_TOKEN',
+                'ERR_ACCOUNT_DISABLED'
+            ].includes(error?.code)) setBootstrapError(true);
+        }).finally(()=>{
+            if (active) setChecking(false);
+        });
+        return ()=>{
+            active = false;
+        };
+    }, [
+        redirectTo,
+        reauthenticate
+    ]);
     const { i18n } = getAdminConfig();
     const localeDefinitions = buildLocaleDefinitions(i18n.admin.locales, i18n.admin.localeDefinitions);
     const handleSetLocale = async (next)=>{
@@ -19,7 +55,7 @@ function SignInPage({ redirectTo, activeLocale, homeUrl }) {
         });
         window.location.reload();
     };
-    return /*#__PURE__*/ jsx(I18nProvider, {
+    const content = /*#__PURE__*/ jsx(I18nProvider, {
         bundle: i18n.translations ?? {},
         activeLocale: activeLocale,
         defaultLocale: i18n.admin.defaultLocale,
@@ -30,13 +66,31 @@ function SignInPage({ redirectTo, activeLocale, homeUrl }) {
             children: /*#__PURE__*/ jsxs("main", {
                 className: clsx('byline-sign-in-page', sign_in_page_module.main),
                 children: [
+                    /*#__PURE__*/ jsx("noscript", {
+                        children: "JavaScript is required to sign in or renew your admin session."
+                    }),
                     /*#__PURE__*/ jsx("div", {
                         className: clsx('byline-sign-in-page-bar', sign_in_page_module.bar),
                         children: /*#__PURE__*/ jsx(LanguageMenu, {})
                     }),
                     /*#__PURE__*/ jsx("div", {
                         className: clsx('byline-sign-in-page-inner', sign_in_page_module.inner),
-                        children: /*#__PURE__*/ jsx(SignInForm, {
+                        children: bootstrapError ? /*#__PURE__*/ jsxs("div", {
+                            role: "alert",
+                            children: [
+                                /*#__PURE__*/ jsx("p", {
+                                    children: "Unable to check your session. Please try again."
+                                }),
+                                /*#__PURE__*/ jsx("button", {
+                                    type: "button",
+                                    onClick: ()=>window.location.reload(),
+                                    children: "Try again"
+                                })
+                            ]
+                        }) : checking ? /*#__PURE__*/ jsx("p", {
+                            role: "status",
+                            children: "Checking your session…"
+                        }) : /*#__PURE__*/ jsx(SignInForm, {
                             redirectTo: redirectTo,
                             homeUrl: homeUrl
                         })
@@ -45,5 +99,8 @@ function SignInPage({ redirectTo, activeLocale, homeUrl }) {
             })
         })
     });
+    return reauthenticate ? content : /*#__PURE__*/ jsx(SessionChangeBoundary, {
+        children: content
+    });
 }
 export { SignInPage };

package/dist/integrations/byline-admin-services.js

@@ -5,13 +5,19 @@ import { createAdminUser, setAdminUserPassword, setUserRoles, updateAdminUser }
 import { adminSignIn } from "../server-fns/auth/index.js";
 import { getCollectionDocumentVersion } from "../server-fns/collections/get.js";
 import { setAdminLocaleFn } from "../server-fns/i18n/index.js";
+import { acceptSession, coordinateAuthAction, notifySessionAction } from "./session-coordination.js";
 const byline_admin_services_getCollectionDocumentVersion = async (collection, documentId, versionId, locale)=>{
     const result = await getCollectionDocumentVersion(collection, documentId, versionId, locale);
     if (null == result) throw new Error(`Document version not found: collection=${collection} document=${documentId} version=${versionId}`);
     return result;
 };
 const bylineAdminServices = {
-    adminSignIn: adminSignIn,
+    adminSignIn: async (args)=>{
+        const result = await coordinateAuthAction(()=>adminSignIn(args));
+        acceptSession(result.sessionId);
+        notifySessionAction();
+        return result;
+    },
     updateAccount: updateAccount,
     changeAccountPassword: changeAccountPassword,
     setAdminLocale: setAdminLocaleFn,

package/dist/integrations/client-ip.d.ts

@@ -0,0 +1,19 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { ClientIpResolver } from '@byline/auth';
+/** Normalize equivalent IPv6 spellings and IPv4-mapped IPv6 before choosing a rate-limit key. */
+export declare function normalizeClientIp(value: string | null | undefined): string | null;
+/**
+ * Configure either a direct peer resolver or an explicitly trusted proxy header.
+ * Header mode requires the deployment to overwrite that header and block proxy bypass.
+ * Never falls back from a missing/invalid trusted header to another client-supplied header.
+ */
+export declare function createClientIpResolver(options: {
+    trustedProxyHeader?: string;
+    resolvePeerIp: ClientIpResolver;
+}): ClientIpResolver;

package/dist/integrations/client-ip.js

@@ -0,0 +1,34 @@
+import { isIP } from "node:net";
+function normalizeClientIp(value) {
+    if (!value || value.length > 64) return null;
+    const ip = value.trim();
+    if (4 === isIP(ip)) return ip;
+    if (6 !== isIP(ip) || ip.includes('%')) return null;
+    const normalized = new URL(`http://[${ip}]/`).hostname.slice(1, -1);
+    const mapped = /^::ffff:([0-9a-f]+):([0-9a-f]+)$/.exec(normalized);
+    if (mapped) {
+        const high = Number.parseInt(mapped[1], 16);
+        const low = Number.parseInt(mapped[2], 16);
+        return [
+            high >>> 8,
+            255 & high,
+            low >>> 8,
+            255 & low
+        ].join('.');
+    }
+    return normalized;
+}
+function createClientIpResolver(options) {
+    const header = options.trustedProxyHeader;
+    if (void 0 !== header && !/^[a-z0-9-]+$/i.test(header)) throw new Error('Invalid trusted IP header');
+    let lastDiagnostic = -1 / 0;
+    return async (request)=>{
+        const ip = normalizeClientIp(void 0 === header ? await options.resolvePeerIp(request) : request.headers.get(header));
+        if (!ip && performance.now() - lastDiagnostic >= 60000) {
+            lastDiagnostic = performance.now();
+            console.warn('[byline:client-ip] No valid single client IP; check the configured peer resolver or trusted proxy header.');
+        }
+        return ip;
+    };
+}
+export { createClientIpResolver, normalizeClientIp };

package/dist/integrations/session-coordination.d.ts

@@ -0,0 +1,24 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export declare const sessionChangedError: () => Error;
+export declare function expectedSession(): string | null;
+export declare function sessionSnapshot(): {
+    sessionId: string | null;
+    epoch: number;
+};
+export declare function requireUnchanged(snapshot: ReturnType<typeof sessionSnapshot>): void;
+export declare function flagSessionChanged(): void;
+export declare function acceptSession(sessionId: string): void;
+export declare function observeSession(sessionId: string): void;
+export declare function sessionEpoch(): number;
+export declare function sessionIsChanged(): boolean;
+export declare function subscribeSessionChange(listener: () => void): () => void;
+export declare function renewSingleFlight(work: () => Promise<void>): Promise<void>;
+export declare function coordinateAuthAction<T>(work: () => Promise<T>): Promise<T>;
+export declare function startSessionNotifications(): void;
+export declare function notifySessionAction(): void;

package/dist/integrations/session-coordination.js

@@ -0,0 +1,85 @@
+const storageKey = 'byline.expected-login';
+let expected = null;
+let epoch = 0;
+let changed = false;
+let renewal;
+const listeners = new Set();
+const sessionChangedError = ()=>new Error('Session changed. Acknowledge the active account before continuing.');
+function expectedSession() {
+    if ("u" < typeof window) return null;
+    if (!expected) expected = window.sessionStorage.getItem(storageKey);
+    return expected;
+}
+function sessionSnapshot() {
+    return {
+        sessionId: expectedSession(),
+        epoch: epoch
+    };
+}
+function requireUnchanged(snapshot) {
+    if (changed || snapshot.epoch !== epoch || snapshot.sessionId !== expectedSession()) throw sessionChangedError();
+}
+function flagSessionChanged() {
+    changed = true;
+    epoch++;
+    for (const listener of listeners)listener();
+}
+function acceptSession(sessionId) {
+    if ("u" < typeof window) return;
+    if ('string' != typeof sessionId || !sessionId) throw new Error('Provider omitted login identity');
+    window.sessionStorage.setItem(storageKey, sessionId);
+    expected = sessionId;
+    changed = false;
+    epoch++;
+    for (const listener of listeners)listener();
+}
+function observeSession(sessionId) {
+    const old = expectedSession();
+    if (old && old !== sessionId) {
+        flagSessionChanged();
+        throw sessionChangedError();
+    }
+    if (!old) acceptSession(sessionId);
+}
+function sessionEpoch() {
+    return epoch;
+}
+function sessionIsChanged() {
+    return changed;
+}
+function subscribeSessionChange(listener) {
+    listeners.add(listener);
+    return ()=>{
+        listeners.delete(listener);
+    };
+}
+function renewSingleFlight(work) {
+    if (!renewal) renewal = work().finally(()=>{
+        renewal = void 0;
+    });
+    return renewal;
+}
+let authQueue = Promise.resolve();
+function coordinateAuthAction(work) {
+    const run = authQueue.catch(()=>{}).then(async ()=>{
+        if ("u" > typeof navigator && navigator.locks) return navigator.locks.request('byline.auth', work);
+        return work();
+    });
+    authQueue = run;
+    return run;
+}
+let channel;
+function startSessionNotifications() {
+    if ("u" < typeof BroadcastChannel || channel) return;
+    channel = new BroadcastChannel('byline.session');
+    channel.onmessage = ()=>{
+        flagSessionChanged();
+    };
+}
+function notifySessionAction() {
+    startSessionNotifications();
+    channel?.postMessage({
+        type: 'session-changed'
+    });
+}
+export { acceptSession, coordinateAuthAction, expectedSession, flagSessionChanged, notifySessionAction, observeSession, renewSingleFlight, requireUnchanged, sessionChangedError, sessionEpoch, sessionIsChanged, sessionSnapshot, startSessionNotifications, subscribeSessionChange };

package/dist/integrations/session-middleware.d.ts

@@ -0,0 +1,11 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** The boundary owns the retry signal; handler errors cannot turn into retryable outcomes. */
+export declare const adminSessionMiddleware: import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>;