@byline/host-tanstack-start 6.7.2 → 6.8.0

package/dist/server-fns/auth/passkeys.js

@@ -0,0 +1,238 @@
+import { createServerFn } from "@tanstack/react-start";
+import { getRequest, setResponseHeader } from "@tanstack/react-start/server";
+import { ERR_SESSION_CHANGED, ERR_UNAUTHENTICATED, isAdminAuth } from "@byline/auth";
+import { clearPreviewCookie, clearSessionCookies, getAdminRequestContext, readAccessTokenCookie, readRefreshTokenCookie, setSessionCookies } from "@byline/client/server";
+import { getServerConfig } from "@byline/core";
+import { z } from "zod";
+import { bylineCore } from "../../integrations/byline-core.js";
+import { adminSessionMiddleware, adminSessionMutationMiddleware } from "../../integrations/session-middleware.js";
+import { wasPasskeyBodyChecked } from "../../integrations/sign-in-body.js";
+import { withPasskeyAdmission } from "./passkey-admission.js";
+import { reconcileLocaleAfterSignIn } from "./reconcile-locale.js";
+const session = z.object({
+    expectedSessionId: z.uuid()
+});
+const bearer = z.string().regex(/^[A-Za-z0-9_-]{43}$/);
+const action = z.discriminatedUnion('purpose', [
+    z.object({
+        purpose: z.literal('enroll')
+    }).strict(),
+    z.object({
+        purpose: z.literal('remove'),
+        targetUserId: z.uuid(),
+        credentialRecordId: z.uuid()
+    }).strict()
+]);
+const passkeys_name = z.string().trim().min(1).max(80);
+function validate(schema) {
+    return (input)=>{
+        const parsed = schema.safeParse(input);
+        if (!parsed.success) throw new Response('Invalid passkey input', {
+            status: 400,
+            headers: {
+                'Cache-Control': 'no-store'
+            }
+        });
+        return parsed.data;
+    };
+}
+function configuredProvider() {
+    setResponseHeader('Cache-Control', 'no-store');
+    const config = getServerConfig();
+    const provider = config.sessionProvider;
+    if (!config.passkeys || provider?.capabilities?.passkeys !== true || !provider.passkeys) throw new Response('Passkeys are not enabled', {
+        status: 404,
+        headers: {
+            'Cache-Control': 'no-store'
+        }
+    });
+    return provider.passkeys;
+}
+async function currentSession(expectedSessionId) {
+    const auth = await getAdminRequestContext();
+    if (auth.sessionId !== expectedSessionId) throw ERR_SESSION_CHANGED({
+        message: 'session changed before passkey operation'
+    });
+    const accessToken = readAccessTokenCookie();
+    if (!accessToken) throw ERR_UNAUTHENTICATED({
+        message: 'access credential missing'
+    });
+    return {
+        accessToken,
+        expectedSessionId
+    };
+}
+function admitted(purpose, work, expectedSessionId) {
+    const provider = configuredProvider();
+    const config = getServerConfig();
+    const request = getRequest();
+    return withPasskeyAdmission({
+        provider,
+        purpose,
+        request,
+        bodyChecked: wasPasskeyBodyChecked(request, 'password-proof' === purpose),
+        protection: config.passkeyRequests,
+        ...'password-proof' === purpose ? {
+            password: {
+                protection: config.passwordSignIn,
+                resolveActorEmail: async ()=>{
+                    const auth = await getAdminRequestContext();
+                    if (!auth.actor || !expectedSessionId || auth.sessionId !== expectedSessionId) throw ERR_SESSION_CHANGED({
+                        message: 'session changed before password proof'
+                    });
+                    const user = await bylineCore().adminStore?.adminUsers.getById(auth.actor.id);
+                    if (!user) throw ERR_UNAUTHENTICATED({
+                        message: 'account unavailable'
+                    });
+                    return user.email;
+                }
+            }
+        } : {},
+        work: ({ ip })=>work(provider, {
+                ip,
+                userAgent: request.headers.get('user-agent')?.slice(0, 512)
+            })
+    });
+}
+const getPasskeyCapability = createServerFn({
+    method: 'GET'
+}).handler(async ()=>{
+    setResponseHeader('Cache-Control', 'no-store');
+    const config = getServerConfig();
+    return {
+        enabled: !!(config.passkeys && config.sessionProvider?.capabilities?.passkeys && config.sessionProvider.passkeys)
+    };
+});
+const passkeySignInOptions = createServerFn({
+    method: 'POST'
+}).validator(validate(z.object({}).strict())).handler(async ()=>admitted('sign-in-options', (provider, metadata)=>provider.signInOptions(metadata)));
+const passkeySignIn = createServerFn({
+    method: 'POST'
+}).validator(validate(z.object({
+    ceremonyId: bearer,
+    response: z.unknown()
+}).strict())).handler(async ({ data })=>admitted('sign-in', async (provider, metadata)=>{
+        const result = await provider.verifySignIn({
+            ...data,
+            ...metadata,
+            previousAccessToken: readAccessTokenCookie(),
+            previousRefreshToken: readRefreshTokenCookie()
+        });
+        setSessionCookies(result);
+        try {
+            await reconcileLocaleAfterSignIn(result.actor.id);
+        } catch  {}
+        return {
+            userId: result.actor.id,
+            sessionId: result.sessionId
+        };
+    }));
+const passkeyPasswordProof = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    password: z.string().min(1).max(128),
+    action: action
+}).strict())).handler(async ({ data })=>admitted('password-proof', async (provider)=>provider.passwordProof({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        }), data.expectedSessionId));
+const passkeyProofOptions = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    action: action
+}).strict())).handler(async ({ data })=>admitted('proof-options', async (provider)=>provider.proofOptions({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        })));
+const passkeyProof = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    ceremonyId: bearer,
+    response: z.unknown()
+}).strict())).handler(async ({ data })=>admitted('proof', async (provider)=>provider.verifyProof({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        })));
+const passkeyEnrollmentOptions = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    grantId: bearer
+}).strict())).handler(async ({ data })=>admitted('enrollment-options', async (provider)=>provider.enrollmentOptions({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        })));
+const passkeyEnrollment = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    ceremonyId: bearer,
+    response: z.unknown(),
+    name: passkeys_name
+}).strict())).handler(async ({ data })=>admitted('enrollment', async (provider)=>provider.verifyEnrollment({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        })));
+const passkeyList = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    targetUserId: z.uuid().optional()
+}).strict())).handler(async ({ data })=>admitted('list', async (provider)=>provider.listCredentials({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        })));
+const passkeyRename = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    credentialRecordId: z.uuid(),
+    name: passkeys_name
+}).strict())).handler(async ({ data })=>admitted('rename', async (provider)=>provider.renameCredential({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        })));
+const passkeyRemove = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMutationMiddleware
+]).validator(validate(session.extend({
+    grantId: bearer
+}).strict())).handler(async ({ data })=>admitted('remove', async (provider)=>{
+        const result = await provider.removeCredential({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        });
+        if (result.signedOut) {
+            clearSessionCookies();
+            clearPreviewCookie();
+        }
+        return result;
+    }));
+const passkeyManagementContext = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.strict())).handler(async ({ data })=>admitted('list', async ()=>{
+        await currentSession(data.expectedSessionId);
+        const { actor } = await getAdminRequestContext();
+        if (!isAdminAuth(actor)) throw ERR_UNAUTHENTICATED({
+            message: 'admin login required'
+        });
+        return {
+            id: actor.id,
+            isSuperAdmin: actor.isSuperAdmin,
+            canManagePasskeys: actor.hasAbility('admin.users.managePasskeys')
+        };
+    }));
+export { getPasskeyCapability, passkeyEnrollment, passkeyEnrollmentOptions, passkeyList, passkeyManagementContext, passkeyPasswordProof, passkeyProof, passkeyProofOptions, passkeyRemove, passkeyRename, passkeySignIn, passkeySignInOptions };

package/dist/server-fns/auth/reconcile-locale.d.ts

@@ -0,0 +1,20 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * Apply the `byline_admin_lng` cookie to `admin_users.preferred_locale`
+ * when the two diverge after sign-in. No-op when:
+ *
+ *   - The cookie is unset (the cascade falls through to the existing
+ *     column / Accept-Language / default anyway).
+ *   - The cookie carries a locale outside `i18n.admin.locales`
+ *     (stale value pointing at a removed locale — let the resolver
+ *     fall through cleanly).
+ *   - No admin store is configured (headless tooling paths).
+ *   - The stored value already matches the cookie.
+ */
+export declare function reconcileLocaleAfterSignIn(adminUserId: string): Promise<void>;

package/dist/server-fns/auth/reconcile-locale.js

@@ -0,0 +1,16 @@
+import { readAdminLocaleCookie } from "../../i18n/locale-cookie.js";
+import { bylineCore } from "../../integrations/byline-core.js";
+async function reconcileLocaleAfterSignIn(adminUserId) {
+    const cookieLocale = readAdminLocaleCookie();
+    if (null == cookieLocale) return;
+    const core = bylineCore();
+    const locales = core.config.i18n.admin.locales;
+    if (!locales.includes(cookieLocale)) return;
+    const adminStore = core.adminStore;
+    if (null == adminStore) return;
+    const row = await adminStore.adminUsers.getById(adminUserId);
+    if (!row) return;
+    if (row.preferred_locale === cookieLocale) return;
+    await adminStore.adminUsers.setPreferredLocale(adminUserId, cookieLocale);
+}
+export { reconcileLocaleAfterSignIn };

package/dist/server-fns/auth/sign-in.js

@@ -3,10 +3,9 @@ import { getRequest, getRequestHeader } from "@tanstack/react-start/server";
 import { readAccessTokenCookie, readRefreshTokenCookie, setSessionCookies } from "@byline/client/server";
 import { getServerConfig } from "@byline/core";
 import { passwordSignInSchema } from "@byline/core/validation";
-import { readAdminLocaleCookie } from "../../i18n/locale-cookie.js";
-import { bylineCore } from "../../integrations/byline-core.js";
 import { normalizeClientIp } from "../../integrations/client-ip.js";
 import { wasSignInBodyChecked } from "../../integrations/sign-in-body.js";
+import { reconcileLocaleAfterSignIn } from "./reconcile-locale.js";
 const adminSignIn = createServerFn({
     method: 'POST'
 }).validator((input)=>{
@@ -104,17 +103,4 @@ const adminSignIn = createServerFn({
         sessionId: result.sessionId
     };
 });
-async function reconcileLocaleAfterSignIn(adminUserId) {
-    const cookieLocale = readAdminLocaleCookie();
-    if (null == cookieLocale) return;
-    const core = bylineCore();
-    const locales = core.config.i18n.admin.locales;
-    if (!locales.includes(cookieLocale)) return;
-    const adminStore = core.adminStore;
-    if (null == adminStore) return;
-    const row = await adminStore.adminUsers.getById(adminUserId);
-    if (!row) return;
-    if (row.preferred_locale === cookieLocale) return;
-    await adminStore.adminUsers.setPreferredLocale(adminUserId, cookieLocale);
-}
 export { adminSignIn };

package/package.json

@@ -3,9 +3,9 @@
   "private": false,
   "type": "module",
   "license": "MPL-2.0",
-  "version": "6.7.2",
+  "version": "6.8.0",
   "engines": {
-    "node": ">=20.9.0"
+    "node": ">=22.22.2"
   },
   "description": "TanStack Start host adapter for Byline CMS — server fns, auth context, integration glue, admin shell, and route factories",
   "keywords": [
@@ -119,15 +119,15 @@
     }
   },
   "dependencies": {
-    "@byline/admin": "6.7.2",
-    "@byline/ai": "6.7.2",
-    "@byline/analytics": "6.7.2",
-    "@byline/analytics-agent": "6.7.2",
-    "@byline/auth": "6.7.2",
-    "@byline/client": "6.7.2",
-    "@byline/core": "6.7.2",
-    "@byline/i18n": "6.7.2",
-    "@byline/ui": "6.7.2",
+    "@byline/admin": "6.8.0",
+    "@byline/ai": "6.8.0",
+    "@byline/analytics": "6.8.0",
+    "@byline/analytics-agent": "6.8.0",
+    "@byline/auth": "6.8.0",
+    "@byline/client": "6.8.0",
+    "@byline/core": "6.8.0",
+    "@byline/i18n": "6.8.0",
+    "@byline/ui": "6.8.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "clsx": "^2.1.1",

package/src/admin-shell/admin-roles/container.module.css

@@ -17,7 +17,7 @@
 :global(.byline-role-detail-card) {
   margin-bottom: 1.5rem;
   border: var(--border-width-thin) var(--border-style-solid) var(--gray-100);
-  border-radius: 0.125rem;
+  border-radius: var(--border-radius-sm);
   background-color: var(--canvas-25);
   padding: 1rem;
 }

package/src/admin-shell/admin-roles/delete.tsx

@@ -88,7 +88,7 @@ export function DeleteRole({ role, onClose }: DeleteRoleProps) {
       <div className={cx('byline-role-delete-actions', styles.actions)}>
         <Button
           type="button"
-          intent="secondary"
+          intent="noeffect"
           size="sm"
           onClick={onClose}
           disabled={pending}

package/src/admin-shell/admin-users/container.module.css

@@ -18,6 +18,7 @@
  *   .byline-admin-user-drawer-body    — drawer content container
  *   .byline-admin-user-drawer-scroll  — drawer scrollable inner viewport
  *   .byline-admin-user-modal          — modal container sizing
+ *   .byline-admin-user-account-link   — own-account link in the Passkeys card
  *   .byline-admin-user-modal-head     — modal header row
  */
 
@@ -50,7 +51,7 @@
   border: var(--border-width-thin) var(--border-style-solid) var(--gray-100);
   background-color: var(--canvas-25);
   padding: 1rem;
-  border-radius: 0.125rem;
+  border-radius: var(--border-radius-sm);
 }
 
 :is([data-theme="dark"], :global(.dark)) .section,
@@ -197,3 +198,8 @@
   justify-content: space-between;
   margin-bottom: 1rem;
 }
+
+.accountLink,
+:global(.byline-admin-user-account-link) {
+  text-decoration: underline;
+}

package/src/admin-shell/admin-users/container.tsx

@@ -15,6 +15,7 @@ import { useRouter } from '@tanstack/react-router'
 import { UserRoles } from '@byline/admin/admin-users/components/roles'
 import { SetPassword } from '@byline/admin/admin-users/components/set-password'
 import { UpdateUser } from '@byline/admin/admin-users/components/update'
+import { PasskeyManager } from '@byline/admin/auth/components/passkey-manager'
 import { LocalDateTime } from '@byline/admin/react'
 import { useTranslation } from '@byline/i18n/react'
 import {
@@ -28,6 +29,8 @@ import {
 } from '@byline/ui/react'
 import cx from 'clsx'
 
+import { getAdminRoutePath } from '../../routes/admin-path.js'
+import { Link } from '../chrome/loose-router.js'
 import styles from './container.module.css'
 import { DeleteUser } from './delete.js'
 import type { AdminRoleResponse } from '../../server-fns/admin-roles/index.js'
@@ -266,9 +269,7 @@ export function AccountContainer({ user, allRoles, initialUserRoles }: AccountCo
               </p>
             </div>
           </ContainerSection>
-        </div>
 
-        <div className={cx('byline-admin-user-column', styles.column)}>
           <ContainerSection
             title={t('adminUsers.detail.sections.roles')}
             onEdit={openDrawer('roles')}
@@ -289,7 +290,9 @@ export function AccountContainer({ user, allRoles, initialUserRoles }: AccountCo
               {t('adminUsers.detail.editRolesButton')}
             </Button>
           </ContainerSection>
+        </div>
 
+        <div className={cx('byline-admin-user-column', styles.column)}>
           <ContainerSection
             title={t('adminUsers.detail.sections.password')}
             onEdit={openDrawer('set_password')}
@@ -303,6 +306,23 @@ export function AccountContainer({ user, allRoles, initialUserRoles }: AccountCo
             </Button>
           </ContainerSection>
 
+          <PasskeyManager
+            targetUserId={currentUser.id}
+            targetIsSuperAdmin={currentUser.is_super_admin}
+            section={ContainerSection}
+            ownAccountNotice={
+              <p className={cx('byline-admin-user-line-spaced', styles.lineSpaced)}>
+                {t('adminUsers.detail.passkeys.ownAccount')}{' '}
+                <Link
+                  to={getAdminRoutePath('account')}
+                  className={cx('byline-admin-user-account-link', styles.accountLink)}
+                >
+                  {t('adminUsers.detail.passkeys.openAccount')}
+                </Link>
+              </p>
+            }
+          />
+
           <ContainerSection title={t('adminUsers.detail.sections.delete')}>
             <p className={cx('byline-admin-user-line-spaced', styles.lineSpaced)}>
               {t('adminUsers.detail.delete.intro')}

package/src/admin-shell/admin-users/delete.tsx

@@ -100,7 +100,7 @@ export function DeleteUser({ user, onClose }: DeleteUserProps) {
       <div className={cx('byline-admin-user-delete-actions', styles.actions)}>
         <Button
           type="button"
-          intent="secondary"
+          intent="noeffect"
           size="sm"
           onClick={onClose}
           disabled={pending}

package/src/integrations/byline-admin-services.ts

@@ -36,6 +36,7 @@ import {
 import { adminSignIn } from '../server-fns/auth/index.js'
 import { getCollectionDocumentVersion as serverGetCollectionDocumentVersion } from '../server-fns/collections/get.js'
 import { setAdminLocaleFn } from '../server-fns/i18n/index.js'
+import { passkeyAdminServices } from './passkey-admin-services.js'
 import { acceptSession, coordinateAuthAction, notifySessionAction } from './session-coordination.js'
 
 /**
@@ -70,6 +71,8 @@ export const bylineAdminServices: BylineAdminServices = {
     return result
   },
 
+  passkeys: passkeyAdminServices,
+
   // Account self-service
   updateAccount,
   changeAccountPassword,

package/src/integrations/passkey-admin-services.ts

@@ -0,0 +1,85 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import type { PasskeyAdminServices } from '@byline/admin/services'
+
+import {
+  getPasskeyCapability,
+  passkeyEnrollment,
+  passkeyEnrollmentOptions,
+  passkeyList,
+  passkeyManagementContext,
+  passkeyPasswordProof,
+  passkeyProof,
+  passkeyProofOptions,
+  passkeyRemove,
+  passkeyRename,
+  passkeySignIn,
+  passkeySignInOptions,
+} from '../server-fns/auth/passkeys.js'
+import {
+  acceptSession,
+  coordinateAuthAction,
+  flagSessionChanged,
+  notifySessionAction,
+  requireUnchanged,
+  sessionChangedError,
+  sessionSnapshot,
+} from './session-coordination.js'
+
+export const passkeyAdminServices: PasskeyAdminServices = {
+  capability: () => getPasskeyCapability(),
+  captureLogin: (signIn = false) => {
+    const snapshot = sessionSnapshot()
+    const assertCurrent = () => {
+      if (!signIn) return requireUnchanged(snapshot)
+      // Explicit reauthentication may begin on an already flagged page, but any
+      // subsequent account change still invalidates this particular ceremony.
+      const current = sessionSnapshot()
+      if (current.epoch !== snapshot.epoch || current.sessionId !== snapshot.sessionId)
+        throw sessionChangedError()
+    }
+    assertCurrent()
+    return { expectedSessionId: snapshot.sessionId, assertCurrent }
+  },
+  managementContext: async (binding) => {
+    binding.assertCurrent()
+    if (!binding.expectedSessionId) throw sessionChangedError()
+    const actor = await passkeyManagementContext({
+      data: { expectedSessionId: binding.expectedSessionId },
+    })
+    binding.assertCurrent()
+    return actor
+  },
+  signInOptions: passkeySignInOptions,
+  signIn: (args, binding) =>
+    coordinateAuthAction(async () => {
+      binding.assertCurrent()
+      const result = await passkeySignIn(args)
+      acceptSession(result.sessionId)
+      notifySessionAction()
+      return result
+    }),
+  passwordProof: passkeyPasswordProof,
+  proofOptions: passkeyProofOptions,
+  proof: passkeyProof,
+  enrollmentOptions: passkeyEnrollmentOptions,
+  enrollment: passkeyEnrollment,
+  list: passkeyList,
+  rename: passkeyRename,
+  remove: async (args) => {
+    // The mutation middleware queues its fetch, including cookie application;
+    // it releases the queue before a pre-handler renewal can acquire it.
+    const result = await passkeyRemove(args)
+    if (result.signedOut) {
+      flagSessionChanged()
+      notifySessionAction()
+    }
+    return result
+  },
+}

package/src/integrations/session-client.test.node.ts

@@ -119,3 +119,76 @@ describe('coordinated business resend', () => {
     expect(mocks.renew).toHaveBeenCalledOnce()
   })
 })
+
+describe('cookie mutation queue', () => {
+  const mutation = () =>
+    middleware.adminSessionMutationMiddleware.options.client?.({
+      next: (options: any) =>
+        options.fetch('http://localhost/remove', { method: 'POST', body: '{}' }),
+    } as any)
+  it('releases the auth queue before renewal, then queues the single safe resend', async () => {
+    const order: string[] = []
+    vi.stubGlobal('navigator', {
+      locks: {
+        request: async (_name: string, work: () => Promise<unknown>) => {
+          order.push('lock')
+          try {
+            return await work()
+          } finally {
+            order.push('unlock')
+          }
+        },
+      },
+    })
+    const fetch = vi
+      .fn()
+      .mockImplementationOnce(async () => {
+        order.push('expired')
+        return boundary('renew')
+      })
+      .mockImplementation(async () => {
+        order.push('handled')
+        return boundary('handled')
+      })
+    vi.stubGlobal('fetch', fetch)
+    mocks.renew.mockImplementation(async () => {
+      order.push('renew')
+      return { sessionId: 'A' }
+    })
+    await mutation()
+    expect(order).toEqual([
+      'lock',
+      'expired',
+      'unlock',
+      'lock',
+      'renew',
+      'unlock',
+      'lock',
+      'handled',
+      'unlock',
+    ])
+    expect(fetch).toHaveBeenCalledTimes(2)
+  })
+  it('rechecks identity after waiting for a competing auth action', async () => {
+    const fetch = vi.fn()
+    vi.stubGlobal('fetch', fetch)
+    const competing = coordination.coordinateAuthAction(async () => {
+      coordination.acceptSession('B')
+    })
+    const result = mutation()
+    await competing
+    await expect(result).rejects.toThrow('Session changed')
+    expect(fetch).not.toHaveBeenCalled()
+  })
+  it('does not replay a failed mutation after its handler started', async () => {
+    const fetch = vi
+      .fn()
+      .mockResolvedValue(
+        new Response('failed', { status: 500, headers: { 'x-byline-auth-boundary': 'handled' } })
+      )
+    vi.stubGlobal('fetch', fetch)
+    await mutation()
+    expect(fetch).toHaveBeenCalledOnce()
+    expect(mocks.renew).not.toHaveBeenCalled()
+  })
+})

package/src/integrations/session-coordination.ts

@@ -14,7 +14,9 @@ let changed = false
 let renewal: Promise<void> | undefined
 const listeners = new Set<() => void>()
 export const sessionChangedError = () =>
-  new Error('Session changed. Acknowledge the active account before continuing.')
+  Object.assign(new Error('Session changed. Acknowledge the active account before continuing.'), {
+    code: 'ERR_SESSION_CHANGED',
+  })
 export function expectedSession() {
   if (typeof window === 'undefined') return null
   if (!expected) expected = window.sessionStorage.getItem(storageKey)