@byline/host-tanstack-start 5.0.0 → 5.1.1

package/dist/server-fns/analytics/queries.js

@@ -2,9 +2,12 @@ import { createServerFn } from "@tanstack/react-start";
 import { assertAdminActor, requireAdminActor } from "@byline/admin";
 import { ANALYTICS_ABILITIES } from "@byline/admin/analytics";
 import { getAdminRequestContext } from "@byline/client/server";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
 const getAnalyticsRuntime = createServerFn({
     method: 'GET'
-}).handler(async ()=>{
+}).middleware([
+    adminSessionMiddleware
+]).handler(async ()=>{
     const context = await getAdminRequestContext();
     requireAdminActor(context, 'reading analytics runtime state');
     const { isAnalyticsRegistered } = await import("@byline/analytics");
@@ -14,35 +17,45 @@ const getAnalyticsRuntime = createServerFn({
 });
 const getAnalyticsSummary = createServerFn({
     method: 'GET'
-}).validator((input)=>input).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(async ({ data })=>{
     await assertAnalyticsRead();
     const { getAnalytics } = await import("@byline/analytics");
     return getAnalytics().getSummary(data);
 });
 const getAnalyticsReportCoverage = createServerFn({
     method: 'GET'
-}).handler(async ()=>{
+}).middleware([
+    adminSessionMiddleware
+]).handler(async ()=>{
     await assertAnalyticsRead();
     const { getAnalytics } = await import("@byline/analytics");
     return getAnalytics().getReportCoverage();
 });
 const getAnalyticsTop = createServerFn({
     method: 'GET'
-}).validator((input)=>input).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(async ({ data })=>{
     await assertAnalyticsRead();
     const { getAnalytics } = await import("@byline/analytics");
     return getAnalytics().getTopPaths(data);
 });
 const getAnalyticsReferrers = createServerFn({
     method: 'GET'
-}).validator((input)=>input).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(async ({ data })=>{
     await assertAnalyticsRead();
     const { getAnalytics } = await import("@byline/analytics");
     return getAnalytics().getReferrers(data);
 });
 const getAnalyticsCountries = createServerFn({
     method: 'GET'
-}).validator((input)=>input).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(async ({ data })=>{
     await assertAnalyticsRead();
     const { getAnalytics } = await import("@byline/analytics");
     return getAnalytics().getCountries(data);

package/dist/server-fns/auth/current-user.d.ts

@@ -6,6 +6,7 @@
  * Copyright (c) Infonomic Company Limited
  */
 export interface CurrentAdminUser {
+    sessionId: string;
     id: string;
     email: string;
     given_name: string | null;

package/dist/server-fns/auth/current-user.js

@@ -5,11 +5,12 @@ import { bylineCore } from "../../integrations/byline-core.js";
 const getCurrentAdminUser = createServerFn({
     method: 'GET'
 }).handler(async ()=>{
-    const { actor } = await getAdminRequestContext();
+    const { actor, sessionId } = await getAdminRequestContext();
     if (!actor) throw new Error('unexpected null actor after getAdminRequestContext');
     const row = await bylineCore().adminStore?.adminUsers.getById(actor.id);
     if (!row) throw new Error('admin user not found for current session');
     return {
+        sessionId: sessionId,
         id: row.id,
         email: row.email,
         given_name: row.given_name,
@@ -23,8 +24,9 @@ const getCurrentAdminUserSoft = createServerFn({
 }).handler(async ()=>{
     try {
         let actor;
+        let sessionId;
         try {
-            ({ actor } = await getAdminRequestContext());
+            ({ actor, sessionId } = await getAdminRequestContext());
         } catch (err) {
             if (err instanceof AuthError) return null;
             throw err;
@@ -33,6 +35,7 @@ const getCurrentAdminUserSoft = createServerFn({
         const row = await bylineCore().adminStore?.adminUsers.getById(actor.id);
         if (!row) return null;
         return {
+            sessionId: sessionId,
             id: row.id,
             email: row.email,
             given_name: row.given_name,

package/dist/server-fns/auth/renew.d.ts

@@ -0,0 +1,13 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Explicit renewal only. Global CSRF protection applies before this POST handler. */
+export declare const renewAdminSession: import("@tanstack/react-start").OptionalFetcher<undefined, (value: unknown) => {
+    expectedSessionId?: string;
+}, Promise<{
+    sessionId: string;
+}>>;

package/dist/server-fns/auth/renew.js

@@ -0,0 +1,45 @@
+import { createServerFn } from "@tanstack/react-start";
+import { setResponseHeader } from "@tanstack/react-start/server";
+import { AuthError, ERR_SESSION_CHANGED, ERR_UNAUTHENTICATED } from "@byline/auth";
+import { readAccessTokenCookie, readRefreshTokenCookie, setSessionCookies } from "@byline/client/server";
+import { getServerConfig } from "@byline/core";
+const renewAdminSession = createServerFn({
+    method: 'POST'
+}).validator((value)=>{
+    if (null == value) return {};
+    if ('object' != typeof value) throw new Error('Invalid renewal input');
+    const sid = value.expectedSessionId;
+    if (void 0 !== sid && ('string' != typeof sid || !sid || sid.length > 256)) throw new Error('Invalid login identity');
+    return {
+        expectedSessionId: sid
+    };
+}).handler(async ({ data })=>{
+    setResponseHeader('Cache-Control', 'no-store');
+    const provider = getServerConfig().sessionProvider;
+    if (!provider) throw new Error('no sessionProvider configured');
+    const access = readAccessTokenCookie();
+    if (access) try {
+        const verified = await provider.verifyAccessToken(access);
+        if (data.expectedSessionId && data.expectedSessionId !== verified.sessionId) throw ERR_SESSION_CHANGED({
+            message: 'session changed'
+        });
+        return {
+            sessionId: verified.sessionId
+        };
+    } catch (error) {
+        if (!(error instanceof AuthError) || 'ERR_ACCESS_EXPIRED' !== error.code) throw error;
+    }
+    const refreshToken = readRefreshTokenCookie();
+    if (!refreshToken) throw ERR_UNAUTHENTICATED({
+        message: 'no session to renew'
+    });
+    const tokens = await provider.refreshSession({
+        refreshToken,
+        expectedSessionId: data.expectedSessionId
+    });
+    setSessionCookies(tokens);
+    return {
+        sessionId: tokens.sessionId
+    };
+});
+export { renewAdminSession };

package/dist/server-fns/auth/sign-in.d.ts

@@ -11,8 +11,9 @@ export interface SignInInput {
 }
 export interface SignInResult {
     userId: string;
+    sessionId: string;
 }
-export declare const adminSignIn: import("@tanstack/react-start").RequiredFetcher<undefined, (input: SignInInput) => {
+export declare const adminSignIn: import("@tanstack/react-start").OptionalFetcher<undefined, (input: unknown) => {
     email: string;
     password: string;
 }, Promise<SignInResult>>;

package/dist/server-fns/auth/sign-in.js

@@ -1,36 +1,107 @@
 import { createServerFn } from "@tanstack/react-start";
-import { getRequestHeader } from "@tanstack/react-start/server";
-import { setSessionCookies } from "@byline/client/server";
+import { getRequest, getRequestHeader } from "@tanstack/react-start/server";
+import { readAccessTokenCookie, readRefreshTokenCookie, setSessionCookies } from "@byline/client/server";
 import { getServerConfig } from "@byline/core";
+import { passwordSignInSchema } from "@byline/core/validation";
 import { readAdminLocaleCookie } from "../../i18n/locale-cookie.js";
 import { bylineCore } from "../../integrations/byline-core.js";
+import { normalizeClientIp } from "../../integrations/client-ip.js";
+import { wasSignInBodyChecked } from "../../integrations/sign-in-body.js";
 const adminSignIn = createServerFn({
     method: 'POST'
 }).validator((input)=>{
-    if ('string' != typeof input?.email || 0 === input.email.length) throw new Error('email is required');
-    if ('string' != typeof input?.password || 0 === input.password.length) throw new Error('password is required');
-    return {
-        email: input.email,
-        password: input.password
-    };
+    const parsed = passwordSignInSchema.safeParse(input);
+    if (!parsed.success) throw new Response('Invalid sign-in input', {
+        status: 400
+    });
+    return parsed.data;
 }).handler(async ({ data })=>{
     const provider = getServerConfig().sessionProvider;
     if (!provider) throw new Error('no sessionProvider configured');
-    const userAgent = getRequestHeader('user-agent') ?? void 0;
-    const forwardedFor = getRequestHeader('x-forwarded-for') ?? void 0;
-    const ip = forwardedFor?.split(',')[0]?.trim() || void 0;
-    const result = await provider.signInWithPassword({
-        email: data.email,
-        password: data.password,
-        userAgent,
-        ip
+    const request = getRequest();
+    const protection = getServerConfig().passwordSignIn;
+    if (!wasSignInBodyChecked(request)) throw new Response('Password sign-in request middleware is not configured', {
+        status: 503
+    });
+    if (!protection) throw new Response('Password sign-in protection is not configured', {
+        status: 503
     });
+    const userAgent = getRequestHeader('user-agent')?.slice(0, 512);
+    let ip;
+    try {
+        ip = normalizeClientIp(await protection.resolveClientIp(request));
+    } catch  {
+        throw new Response('Client address unavailable', {
+            status: 503
+        });
+    }
+    if (!ip) throw new Response('Client address unavailable', {
+        status: 503
+    });
+    const tooMany = (seconds)=>new Response('Too many sign-in attempts', {
+            status: 429,
+            headers: {
+                'Retry-After': String(seconds),
+                'Cache-Control': 'no-store'
+            }
+        });
+    let release;
+    try {
+        release = await protection.limiter.acquire();
+    } catch  {
+        throw new Response('Sign-in temporarily unavailable', {
+            status: 503
+        });
+    }
+    if (!release) throw tooMany(1);
+    const recordResult = (outcome)=>{
+        try {
+            protection.limiter.recordResult?.({
+                email: data.email,
+                ip
+            }, outcome);
+        } catch  {}
+    };
+    const result = await (async ()=>{
+        try {
+            let admission;
+            try {
+                admission = await protection.limiter.consume({
+                    email: data.email,
+                    ip
+                });
+            } catch  {
+                throw new Response('Sign-in temporarily unavailable', {
+                    status: 503
+                });
+            }
+            if (!admission.allowed) throw tooMany(admission.retryAfterSeconds);
+            try {
+                const result = await provider.signInWithPassword({
+                    previousAccessToken: readAccessTokenCookie(),
+                    previousRefreshToken: readRefreshTokenCookie(),
+                    email: data.email,
+                    password: data.password,
+                    userAgent,
+                    ip
+                });
+                recordResult('success');
+                return result;
+            } catch (error) {
+                recordResult('failure');
+                throw error;
+            }
+        } finally{
+            release();
+        }
+    })();
     setSessionCookies(result);
     try {
         await reconcileLocaleAfterSignIn(result.actor.id);
     } catch  {}
     return {
-        userId: result.actor.id
+        userId: result.actor.id,
+        sessionId: result.sessionId
     };
 });
 async function reconcileLocaleAfterSignIn(adminUserId) {

package/dist/server-fns/auth/sign-out.d.ts

@@ -5,6 +5,8 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-export declare const adminSignOut: import("@tanstack/react-start").OptionalFetcher<undefined, undefined, Promise<{
+export declare const adminSignOut: import("@tanstack/react-start").OptionalFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterClient<{}, unknown, undefined, {
+    expectedSessionId: string | null;
+}, undefined>], undefined, Promise<{
     status: 'ok';
 }>>;

package/dist/server-fns/auth/sign-out.js

@@ -1,14 +1,46 @@
-import { createServerFn } from "@tanstack/react-start";
-import { clearPreviewCookie, clearSessionCookies, readRefreshTokenCookie } from "@byline/client/server";
+import { createMiddleware, createServerFn } from "@tanstack/react-start";
+import { ERR_SESSION_CHANGED } from "@byline/auth";
+import { clearPreviewCookie, clearSessionCookies, readAccessTokenCookie, readRefreshTokenCookie } from "@byline/client/server";
 import { getServerConfig } from "@byline/core";
+import { coordinateAuthAction, flagSessionChanged, notifySessionAction, sessionSnapshot } from "../../integrations/session-coordination.js";
+const signOutBoundary = createMiddleware({
+    type: 'function'
+}).client(async ({ next })=>{
+    const snapshot = sessionSnapshot();
+    return coordinateAuthAction(async ()=>{
+        try {
+            const result = await next({
+                sendContext: {
+                    expectedSessionId: snapshot.sessionId
+                }
+            });
+            notifySessionAction();
+            return result;
+        } catch (error) {
+            if (error?.code === 'ERR_SESSION_CHANGED') flagSessionChanged();
+            throw error;
+        }
+    });
+});
 const adminSignOut = createServerFn({
     method: 'POST'
-}).handler(async ()=>{
+}).middleware([
+    signOutBoundary
+]).handler(async ({ context })=>{
     const provider = getServerConfig().sessionProvider;
     const refreshToken = readRefreshTokenCookie();
-    if (provider && refreshToken) try {
-        await provider.revokeSession(refreshToken);
-    } catch  {}
+    const accessToken = readAccessTokenCookie();
+    if (refreshToken || accessToken) {
+        if (!provider) throw new Error('no sessionProvider configured');
+        if (!context.expectedSessionId) throw ERR_SESSION_CHANGED({
+            message: 'logout requires the page login identity'
+        });
+        await provider.revokeSession({
+            refreshToken,
+            accessToken,
+            expectedSessionId: context.expectedSessionId
+        });
+    }
     clearSessionCookies();
     clearPreviewCookie();
     return {

package/dist/server-fns/collections/audit.d.ts

@@ -30,7 +30,9 @@ export interface AuditLogEntryDto {
     after: string | string[] | null;
     occurredAt: string;
 }
-export declare const getCollectionDocumentAuditLog: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+export declare const getCollectionDocumentAuditLog: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
     collection: string;
     id: string;
     params?: AuditLogSearchParams;

package/dist/server-fns/collections/audit.js

@@ -2,10 +2,13 @@ import { createServerFn } from "@tanstack/react-start";
 import { getAdminBylineClient } from "@byline/client/server";
 import { ERR_NOT_FOUND, getLogger } from "@byline/core";
 import { ensureCollection } from "../../integrations/api-utils.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
 import { resolveActorLabels } from "./actors.js";
 const getCollectionDocumentAuditLog = createServerFn({
     method: 'GET'
-}).validator((input)=>input).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(async ({ data })=>{
     const { collection: path, id, params } = data;
     const config = await ensureCollection(path);
     if (!config) throw ERR_NOT_FOUND({

package/dist/server-fns/collections/copy-to-locale.d.ts

@@ -1,3 +1,10 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
 import type { CopyToLocaleResult } from '@byline/core/services';
 import { type CollectionDocumentCommittedHookFailureResponse } from './save-outcome.js';
 /**
@@ -9,7 +16,9 @@ import { type CollectionDocumentCommittedHookFailureResponse } from './save-outc
  * `assertActorCanPerform('update')` runs inside the service; auth
  * failures propagate to TanStack Start's transport layer.
  */
-export declare const copyDocumentToLocale: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+export declare const copyDocumentToLocale: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
     expectedRevision: number;
     collection: string;
     id: string;

package/dist/server-fns/collections/copy-to-locale.js

@@ -1,13 +1,16 @@
-import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { createServerFn } from "@tanstack/react-start";
 import { getAdminRequestContext } from "@byline/client/server";
 import { ERR_NOT_FOUND, getLogger, getServerConfig } from "@byline/core";
 import { copyToLocale } from "@byline/core/services";
 import { ensureCollection } from "../../integrations/api-utils.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
+import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { toCommittedDocumentHookFailureResponse } from "./save-outcome.js";
 const copyDocumentToLocale = createServerFn({
     method: 'POST'
-}).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
     const { collection: path, id, sourceLocale, targetLocale, overwrite } = input;
     const logger = getLogger();
     const config = await ensureCollection(path);

package/dist/server-fns/collections/create.d.ts

@@ -1,4 +1,13 @@
-export declare const createCollectionDocument: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export declare const createCollectionDocument: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
     collection: string;
     data: any;
     locale?: string;

package/dist/server-fns/collections/create.js

@@ -1,13 +1,16 @@
-import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { createServerFn } from "@tanstack/react-start";
 import { getAdminRequestContext } from "@byline/client/server";
 import { ERR_NOT_FOUND, getLogger, getServerConfig } from "@byline/core";
 import { createDocument } from "@byline/core/services";
 import { ensureCollection } from "../../integrations/api-utils.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
+import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { toCommittedDocumentHookFailureResponse } from "./save-outcome.js";
 const createCollectionDocument = createServerFn({
     method: 'POST'
-}).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
     const { collection: path, data: documentData, locale, path: explicitPath, availableLocales } = input;
     const logger = getLogger();
     const config = await ensureCollection(path);

package/dist/server-fns/collections/delete-locale.d.ts

@@ -1,3 +1,10 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
 import type { DeleteLocaleResult } from '@byline/core/services';
 import { type CollectionDocumentCommittedHookFailureResponse } from './save-outcome.js';
 /**
@@ -10,7 +17,9 @@ import { type CollectionDocumentCommittedHookFailureResponse } from './save-outc
  * the service; auth and validation failures propagate to TanStack Start's
  * transport layer.
  */
-export declare const deleteDocumentLocale: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+export declare const deleteDocumentLocale: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
     expectedRevision: number;
     collection: string;
     id: string;

package/dist/server-fns/collections/delete-locale.js

@@ -1,13 +1,16 @@
-import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { createServerFn } from "@tanstack/react-start";
 import { getAdminRequestContext } from "@byline/client/server";
 import { ERR_NOT_FOUND, getLogger, getServerConfig } from "@byline/core";
 import { deleteLocale } from "@byline/core/services";
 import { ensureCollection } from "../../integrations/api-utils.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
+import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { toCommittedDocumentHookFailureResponse } from "./save-outcome.js";
 const deleteDocumentLocale = createServerFn({
     method: 'POST'
-}).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
     const { collection: path, id, locale } = input;
     const logger = getLogger();
     const config = await ensureCollection(path);

package/dist/server-fns/collections/delete.d.ts

@@ -1,4 +1,13 @@
-export declare const deleteDocument: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export declare const deleteDocument: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
     expectedRevision: number;
     collection: string;
     id: string;

package/dist/server-fns/collections/delete.js

@@ -1,13 +1,16 @@
-import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { createServerFn } from "@tanstack/react-start";
 import { getAdminRequestContext } from "@byline/client/server";
 import { ERR_NOT_FOUND, getLogger, getServerConfig, getUploadFields } from "@byline/core";
 import { deleteDocument } from "@byline/core/services";
 import { ensureCollection } from "../../integrations/api-utils.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
+import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { toDeleteDocumentResponse } from "./delete-outcome.js";
 const delete_deleteDocument = createServerFn({
     method: 'POST'
-}).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
     const { collection: path, id } = input;
     const logger = getLogger();
     const config = await ensureCollection(path);

package/dist/server-fns/collections/duplicate.d.ts

@@ -1,3 +1,10 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
 import type { DuplicateDocumentResult } from '@byline/core/services';
 import { type CollectionDocumentCommittedHookFailureResponse } from './save-outcome.js';
 /**
@@ -11,7 +18,9 @@ import { type CollectionDocumentCommittedHookFailureResponse } from './save-outc
  * `assertActorCanPerform(..., 'create')`; any auth failure propagates to
  * TanStack Start's transport layer for the client to branch on.
  */
-export declare const duplicateCollectionDocument: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+export declare const duplicateCollectionDocument: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
     expectedRevision: number;
     collection: string;
     id: string;

package/dist/server-fns/collections/duplicate.js

@@ -1,13 +1,16 @@
-import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { createServerFn } from "@tanstack/react-start";
 import { getAdminRequestContext } from "@byline/client/server";
 import { ERR_NOT_FOUND, getLogger, getServerConfig } from "@byline/core";
 import { duplicateDocument } from "@byline/core/services";
 import { ensureCollection } from "../../integrations/api-utils.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
+import { withDocumentMutationErrors } from "../document-mutation-errors.js";
 import { toCommittedDocumentHookFailureResponse } from "./save-outcome.js";
 const duplicateCollectionDocument = createServerFn({
     method: 'POST'
-}).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(withDocumentMutationErrors(async ({ data: input })=>{
     const { collection: path, id: sourceDocumentId } = input;
     const logger = getLogger();
     const config = await ensureCollection(path);

package/dist/server-fns/collections/get.d.ts

@@ -1,3 +1,10 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
 /**
  * Fetch a single document by ID. Returns `null` when the document is not found
  * so callers can degrade gracefully (e.g. `notFound()`).

package/dist/server-fns/collections/get.js

@@ -1,13 +1,16 @@
-import { withEditableRevision } from "../editable-revision.js";
 import { createServerFn } from "@tanstack/react-start";
 import { getAdminBylineClient, getAdminRequestContext } from "@byline/client/server";
 import { BylineError, ERR_NOT_FOUND, ErrorCodes, documentAbilityKey, getCollectionSchemasForPath, getLogger, getServerConfig } from "@byline/core";
 import { ensureCollection } from "../../integrations/api-utils.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
 import { resolveAdminDocumentRead } from "../admin-document-presentation.js";
+import { withEditableRevision } from "../editable-revision.js";
 import { serialise } from "./utils.js";
 const getDocumentFn = createServerFn({
     method: 'GET'
-}).validator((input)=>input).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(async ({ data })=>{
     const { collection: path, id, locale, depth, populateRelations } = data;
     const logger = getLogger();
     const config = await ensureCollection(path);
@@ -88,7 +91,9 @@ const getDocumentFn = createServerFn({
 });
 const getDocumentByVersionFn = createServerFn({
     method: 'GET'
-}).validator((input)=>input).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(async ({ data })=>{
     const { collection: path, versionId, locale } = data;
     const resolvedLocale = locale ?? 'all';
     const logger = getLogger();