@tanstack/start-client-core 1.168.2 → 1.169.0

package/dist/esm/createCsrfMiddleware.d.ts

@@ -0,0 +1,46 @@
+import { RequestMiddlewareAfterServer, RequestServerOptions } from './createMiddleware.js';
+import { Register } from '@tanstack/router-core';
+export declare const csrfSymbol: unique symbol;
+export type CsrfSecFetchSite = 'same-origin' | 'same-site' | 'cross-site' | 'none';
+export type CsrfMatcher<TValue, TRegister = Register, TMiddlewares = unknown> = TValue | Array<TValue> | ((value: TValue | (string & {}), ctx: RequestServerOptions<TRegister, TMiddlewares>) => boolean | Promise<boolean>);
+export interface CsrfMiddlewareOptions<TRegister = Register, TMiddlewares = unknown> {
+    /**
+     * Return `true` to validate this request, or `false` to skip validation.
+     *
+     * @default undefined, which validates every request handled by this middleware.
+     */
+    filter?: (ctx: RequestServerOptions<TRegister, TMiddlewares>) => boolean | Promise<boolean>;
+    /**
+     * Allowed Origin values. Defaults to the trusted request origin.
+     */
+    origin?: CsrfMatcher<string, TRegister, TMiddlewares>;
+    /**
+     * Allowed Sec-Fetch-Site values.
+     *
+     * @default 'same-origin'
+     */
+    secFetchSite?: CsrfMatcher<CsrfSecFetchSite, TRegister, TMiddlewares>;
+    /**
+     * Whether to use Referer as a fallback when Sec-Fetch-Site and Origin are absent.
+     *
+     * @default true
+     */
+    referer?: boolean | ((referer: string, ctx: RequestServerOptions<TRegister, TMiddlewares>) => boolean | Promise<boolean>);
+    /**
+     * Allow requests when Sec-Fetch-Site, Origin, and Referer are all missing.
+     *
+     * @default false
+     */
+    allowRequestsWithoutOriginCheck?: boolean;
+    /**
+     * Optional response returned when CSRF validation fails.
+     *
+     * @default new Response('Forbidden', { status: 403 })
+     */
+    failureResponse?: Response | ((ctx: RequestServerOptions<TRegister, TMiddlewares>) => Response | Promise<Response>);
+}
+type CreateCsrfMiddleware = <TRegister, TMiddlewares>(opts?: CsrfMiddlewareOptions<TRegister, TMiddlewares>) => RequestMiddlewareAfterServer<{}, undefined, undefined>;
+export declare const createCsrfMiddleware: CreateCsrfMiddleware;
+export declare function isCsrfRequestAllowed<TRegister, TMiddlewares>(opts: CsrfMiddlewareOptions<TRegister, TMiddlewares>, ctx: RequestServerOptions<TRegister, TMiddlewares>): Promise<boolean>;
+export declare function getCsrfRequestValidationResult<TRegister, TMiddlewares>(opts: CsrfMiddlewareOptions<TRegister, TMiddlewares>, ctx: RequestServerOptions<TRegister, TMiddlewares>): Promise<boolean | undefined>;
+export {};

package/dist/esm/createCsrfMiddleware.js

@@ -0,0 +1,63 @@
+import { createMiddleware } from "./createMiddleware.js";
+import { createIsomorphicFn } from "@tanstack/start-fn-stubs";
+//#region src/createCsrfMiddleware.ts
+var csrfSymbol = Symbol.for("tanstack-start:csrf-middleware");
+var innerCreateCsrfMiddleware = (opts = {}) => {
+	const middleware = createMiddleware().server(async (ctx) => {
+		const csrfCtx = ctx;
+		if (opts.filter && !await opts.filter(csrfCtx)) return ctx.next();
+		if (await isCsrfRequestAllowed(opts, csrfCtx)) return ctx.next();
+		return getFailureResponse(opts, csrfCtx);
+	});
+	if (process.env.NODE_ENV !== "production") Object.defineProperty(middleware, csrfSymbol, { value: true });
+	return middleware;
+};
+var createCsrfMiddleware = createIsomorphicFn().server(innerCreateCsrfMiddleware);
+async function isCsrfRequestAllowed(opts, ctx) {
+	const result = await getCsrfRequestValidationResult(opts, ctx);
+	return result === true || result === void 0 && opts.allowRequestsWithoutOriginCheck === true;
+}
+async function getCsrfRequestValidationResult(opts, ctx) {
+	const fetchSite = ctx.request.headers.get("Sec-Fetch-Site");
+	if (fetchSite !== null) return matchValue(opts.secFetchSite ?? "same-origin", fetchSite, ctx);
+	const origin = ctx.request.headers.get("Origin");
+	if (origin !== null) {
+		if (opts.origin) return matchValue(opts.origin, origin, ctx);
+		return origin === new URL(ctx.request.url).origin;
+	}
+	const referer = ctx.request.headers.get("Referer");
+	if (referer === null || opts.referer === false) return;
+	if (typeof opts.referer === "function") return opts.referer(referer, ctx);
+	if (opts.origin) {
+		const refererOrigin = getOriginFromUrl(referer);
+		return refererOrigin !== void 0 && matchValue(opts.origin, refererOrigin, ctx);
+	}
+	return isRefererSameOrigin(referer, new URL(ctx.request.url).origin);
+}
+async function matchValue(matcher, value, ctx) {
+	if (typeof matcher === "function") return matcher(value, ctx);
+	if (Array.isArray(matcher)) return matcher.includes(value);
+	return value === matcher;
+}
+function getOriginFromUrl(url) {
+	try {
+		return new URL(url).origin;
+	} catch {
+		return;
+	}
+}
+function isRefererSameOrigin(referer, requestOrigin) {
+	if (referer === requestOrigin) return true;
+	if (!referer.startsWith(requestOrigin)) return false;
+	if (referer.length === requestOrigin.length) return true;
+	const code = referer.charCodeAt(requestOrigin.length);
+	return code === 47 || code === 63 || code === 35;
+}
+async function getFailureResponse(opts, ctx) {
+	if (typeof opts.failureResponse === "function") return opts.failureResponse(ctx);
+	return opts.failureResponse?.clone() ?? new Response("Forbidden", { status: 403 });
+}
+//#endregion
+export { createCsrfMiddleware, csrfSymbol, getCsrfRequestValidationResult, isCsrfRequestAllowed };
+
+//# sourceMappingURL=createCsrfMiddleware.js.map

package/dist/esm/createCsrfMiddleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCsrfMiddleware.js","names":[],"sources":["../../src/createCsrfMiddleware.ts"],"sourcesContent":["import { createIsomorphicFn } from '@tanstack/start-fn-stubs'\nimport { createMiddleware } from './createMiddleware'\nimport type {\n  RequestMiddlewareAfterServer,\n  RequestServerOptions,\n} from './createMiddleware'\nimport type { Register } from '@tanstack/router-core'\n\nexport const csrfSymbol = Symbol.for('tanstack-start:csrf-middleware')\n\nexport type CsrfSecFetchSite =\n  | 'same-origin'\n  | 'same-site'\n  | 'cross-site'\n  | 'none'\n\nexport type CsrfMatcher<TValue, TRegister = Register, TMiddlewares = unknown> =\n  | TValue\n  | Array<TValue>\n  | ((\n      value: TValue | (string & {}),\n      ctx: RequestServerOptions<TRegister, TMiddlewares>,\n    ) => boolean | Promise<boolean>)\n\nexport interface CsrfMiddlewareOptions<\n  TRegister = Register,\n  TMiddlewares = unknown,\n> {\n  /**\n   * Return `true` to validate this request, or `false` to skip validation.\n   *\n   * @default undefined, which validates every request handled by this middleware.\n   */\n  filter?: (\n    ctx: RequestServerOptions<TRegister, TMiddlewares>,\n  ) => boolean | Promise<boolean>\n  /**\n   * Allowed Origin values. Defaults to the trusted request origin.\n   */\n  origin?: CsrfMatcher<string, TRegister, TMiddlewares>\n  /**\n   * Allowed Sec-Fetch-Site values.\n   *\n   * @default 'same-origin'\n   */\n  secFetchSite?: CsrfMatcher<CsrfSecFetchSite, TRegister, TMiddlewares>\n  /**\n   * Whether to use Referer as a fallback when Sec-Fetch-Site and Origin are absent.\n   *\n   * @default true\n   */\n  referer?:\n    | boolean\n    | ((\n        referer: string,\n        ctx: RequestServerOptions<TRegister, TMiddlewares>,\n      ) => boolean | Promise<boolean>)\n  /**\n   * Allow requests when Sec-Fetch-Site, Origin, and Referer are all missing.\n   *\n   * @default false\n   */\n  allowRequestsWithoutOriginCheck?: boolean\n  /**\n   * Optional response returned when CSRF validation fails.\n   *\n   * @default new Response('Forbidden', { status: 403 })\n   */\n  failureResponse?:\n    | Response\n    | ((\n        ctx: RequestServerOptions<TRegister, TMiddlewares>,\n      ) => Response | Promise<Response>)\n}\n\ntype CreateCsrfMiddleware = <TRegister, TMiddlewares>(\n  opts?: CsrfMiddlewareOptions<TRegister, TMiddlewares>,\n) => RequestMiddlewareAfterServer<{}, undefined, undefined>\n\nconst innerCreateCsrfMiddleware: CreateCsrfMiddleware = (opts = {}) => {\n  const middleware = createMiddleware().server(async (ctx) => {\n    const csrfCtx = ctx as RequestServerOptions<any, any>\n\n    if (opts.filter && !(await opts.filter(csrfCtx))) {\n      return ctx.next()\n    }\n\n    if (await isCsrfRequestAllowed(opts, csrfCtx)) {\n      return ctx.next()\n    }\n\n    return getFailureResponse(opts, csrfCtx)\n  })\n\n  if (process.env.NODE_ENV !== 'production') {\n    Object.defineProperty(middleware, csrfSymbol, { value: true })\n  }\n\n  return middleware\n}\n\nexport const createCsrfMiddleware: CreateCsrfMiddleware =\n  createIsomorphicFn().server(innerCreateCsrfMiddleware) as CreateCsrfMiddleware\n\nexport async function isCsrfRequestAllowed<TRegister, TMiddlewares>(\n  opts: CsrfMiddlewareOptions<TRegister, TMiddlewares>,\n  ctx: RequestServerOptions<TRegister, TMiddlewares>,\n): Promise<boolean> {\n  const result = await getCsrfRequestValidationResult(opts, ctx)\n  return (\n    result === true ||\n    (result === undefined && opts.allowRequestsWithoutOriginCheck === true)\n  )\n}\n\nexport async function getCsrfRequestValidationResult<TRegister, TMiddlewares>(\n  opts: CsrfMiddlewareOptions<TRegister, TMiddlewares>,\n  ctx: RequestServerOptions<TRegister, TMiddlewares>,\n): Promise<boolean | undefined> {\n  const fetchSite = ctx.request.headers.get('Sec-Fetch-Site')\n  if (fetchSite !== null) {\n    return matchValue(opts.secFetchSite ?? 'same-origin', fetchSite, ctx)\n  }\n\n  const origin = ctx.request.headers.get('Origin')\n  if (origin !== null) {\n    if (opts.origin) {\n      return matchValue(opts.origin, origin, ctx)\n    }\n\n    return origin === new URL(ctx.request.url).origin\n  }\n\n  const referer = ctx.request.headers.get('Referer')\n  if (referer === null || opts.referer === false) {\n    return undefined\n  }\n\n  if (typeof opts.referer === 'function') {\n    return opts.referer(referer, ctx)\n  }\n\n  if (opts.origin) {\n    const refererOrigin = getOriginFromUrl(referer)\n    return (\n      refererOrigin !== undefined && matchValue(opts.origin, refererOrigin, ctx)\n    )\n  }\n\n  return isRefererSameOrigin(referer, new URL(ctx.request.url).origin)\n}\n\nasync function matchValue<TValue extends string, TRegister, TMiddlewares>(\n  matcher: CsrfMatcher<TValue, TRegister, TMiddlewares>,\n  value: string,\n  ctx: RequestServerOptions<TRegister, TMiddlewares>,\n): Promise<boolean> {\n  if (typeof matcher === 'function') {\n    return matcher(value, ctx)\n  }\n\n  if (Array.isArray(matcher)) {\n    // typescript is dumb for array.includes()\n    return matcher.includes(value as TValue)\n  }\n\n  return value === matcher\n}\n\nfunction getOriginFromUrl(url: string): string | undefined {\n  try {\n    return new URL(url).origin\n  } catch {\n    return undefined\n  }\n}\n\nfunction isRefererSameOrigin(referer: string, requestOrigin: string): boolean {\n  if (referer === requestOrigin) return true\n  if (!referer.startsWith(requestOrigin)) return false\n  if (referer.length === requestOrigin.length) return true\n  const code = referer.charCodeAt(requestOrigin.length)\n  return code === 47 /* '/' */ || code === 63 /* '?' */ || code === 35 /* '#' */\n}\n\nasync function getFailureResponse<TRegister, TMiddlewares>(\n  opts: CsrfMiddlewareOptions<TRegister, TMiddlewares>,\n  ctx: RequestServerOptions<TRegister, TMiddlewares>,\n): Promise<Response> {\n  if (typeof opts.failureResponse === 'function') {\n    return opts.failureResponse(ctx)\n  }\n\n  return (\n    opts.failureResponse?.clone() ?? new Response('Forbidden', { status: 403 })\n  )\n}\n"],"mappings":";;;AAQA,IAAa,aAAa,OAAO,IAAI,iCAAiC;AAuEtE,IAAM,6BAAmD,OAAO,EAAE,KAAK;CACrE,MAAM,aAAa,kBAAkB,CAAC,OAAO,OAAO,QAAQ;EAC1D,MAAM,UAAU;AAEhB,MAAI,KAAK,UAAU,CAAE,MAAM,KAAK,OAAO,QAAQ,CAC7C,QAAO,IAAI,MAAM;AAGnB,MAAI,MAAM,qBAAqB,MAAM,QAAQ,CAC3C,QAAO,IAAI,MAAM;AAGnB,SAAO,mBAAmB,MAAM,QAAQ;GACxC;AAEF,KAAA,QAAA,IAAA,aAA6B,aAC3B,QAAO,eAAe,YAAY,YAAY,EAAE,OAAO,MAAM,CAAC;AAGhE,QAAO;;AAGT,IAAa,uBACX,oBAAoB,CAAC,OAAO,0BAA0B;AAExD,eAAsB,qBACpB,MACA,KACkB;CAClB,MAAM,SAAS,MAAM,+BAA+B,MAAM,IAAI;AAC9D,QACE,WAAW,QACV,WAAW,KAAA,KAAa,KAAK,oCAAoC;;AAItE,eAAsB,+BACpB,MACA,KAC8B;CAC9B,MAAM,YAAY,IAAI,QAAQ,QAAQ,IAAI,iBAAiB;AAC3D,KAAI,cAAc,KAChB,QAAO,WAAW,KAAK,gBAAgB,eAAe,WAAW,IAAI;CAGvE,MAAM,SAAS,IAAI,QAAQ,QAAQ,IAAI,SAAS;AAChD,KAAI,WAAW,MAAM;AACnB,MAAI,KAAK,OACP,QAAO,WAAW,KAAK,QAAQ,QAAQ,IAAI;AAG7C,SAAO,WAAW,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC;;CAG7C,MAAM,UAAU,IAAI,QAAQ,QAAQ,IAAI,UAAU;AAClD,KAAI,YAAY,QAAQ,KAAK,YAAY,MACvC;AAGF,KAAI,OAAO,KAAK,YAAY,WAC1B,QAAO,KAAK,QAAQ,SAAS,IAAI;AAGnC,KAAI,KAAK,QAAQ;EACf,MAAM,gBAAgB,iBAAiB,QAAQ;AAC/C,SACE,kBAAkB,KAAA,KAAa,WAAW,KAAK,QAAQ,eAAe,IAAI;;AAI9E,QAAO,oBAAoB,SAAS,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC,OAAO;;AAGtE,eAAe,WACb,SACA,OACA,KACkB;AAClB,KAAI,OAAO,YAAY,WACrB,QAAO,QAAQ,OAAO,IAAI;AAG5B,KAAI,MAAM,QAAQ,QAAQ,CAExB,QAAO,QAAQ,SAAS,MAAgB;AAG1C,QAAO,UAAU;;AAGnB,SAAS,iBAAiB,KAAiC;AACzD,KAAI;AACF,SAAO,IAAI,IAAI,IAAI,CAAC;SACd;AACN;;;AAIJ,SAAS,oBAAoB,SAAiB,eAAgC;AAC5E,KAAI,YAAY,cAAe,QAAO;AACtC,KAAI,CAAC,QAAQ,WAAW,cAAc,CAAE,QAAO;AAC/C,KAAI,QAAQ,WAAW,cAAc,OAAQ,QAAO;CACpD,MAAM,OAAO,QAAQ,WAAW,cAAc,OAAO;AACrD,QAAO,SAAS,MAAgB,SAAS,MAAgB,SAAS;;AAGpE,eAAe,mBACb,MACA,KACmB;AACnB,KAAI,OAAO,KAAK,oBAAoB,WAClC,QAAO,KAAK,gBAAgB,IAAI;AAGlC,QACE,KAAK,iBAAiB,OAAO,IAAI,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,CAAC"}

package/dist/esm/createMiddleware.d.ts

@@ -171,6 +171,10 @@ export interface RequestServerOptions<TRegister, TMiddlewares> {
     pathname: string;
     context: Expand<AssignAllServerRequestContext<TRegister, TMiddlewares>>;
     next: RequestServerNextFn<TRegister, TMiddlewares>;
+    /**
+     * Type of Start handler currently processing this request.
+     */
+    handlerType: 'serverFn' | 'router';
     /**
      * Metadata about the server function being invoked.
      * This is only present when the request is handling a server function call.

package/dist/esm/createMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"createMiddleware.js","names":[],"sources":["../../src/createMiddleware.ts"],"sourcesContent":["import type { StartInstanceOptions } from './createStart'\nimport type {\n  AnyServerFn,\n  ConstrainValidator,\n  CustomFetch,\n  Method,\n} from './createServerFn'\nimport type { ClientFnMeta, ServerFnMeta } from './constants'\nimport type {\n  AnyContext,\n  Assign,\n  Constrain,\n  Expand,\n  IntersectAssign,\n  Register,\n  ResolveValidatorInput,\n  ResolveValidatorOutput,\n  ValidateSerializableInput,\n} from '@tanstack/router-core'\n\nexport type CreateMiddlewareFn<TRegister> = <TType extends MiddlewareType>(\n  options?: {\n    type?: TType\n  },\n  __opts?: FunctionMiddlewareOptions<\n    TRegister,\n    unknown,\n    undefined,\n    undefined,\n    undefined\n  >,\n) => CreateMiddlewareResult<TRegister, TType>\n\nexport const createMiddleware: CreateMiddlewareFn<{}> = (options, __opts) => {\n  const resolvedOptions = {\n    type: 'request',\n    ...(__opts || options),\n  }\n\n  return {\n    options: resolvedOptions,\n    middleware: (middleware: any) => {\n      return createMiddleware(\n        {} as any,\n        Object.assign(resolvedOptions, { middleware }),\n      ) as any\n    },\n    inputValidator: (inputValidator: any) => {\n      return createMiddleware(\n        {} as any,\n        Object.assign(resolvedOptions, { inputValidator }),\n      ) as any\n    },\n    client: (client: any) => {\n      return createMiddleware(\n        {} as any,\n        Object.assign(resolvedOptions, { client }),\n      ) as any\n    },\n    server: (server: any) => {\n      return createMiddleware(\n        {} as any,\n        Object.assign(resolvedOptions, { server }),\n      ) as any\n    },\n  } as any\n}\n\nexport type MiddlewareType = 'request' | 'function'\n\nexport type CreateMiddlewareResult<\n  TRegister,\n  TType extends MiddlewareType,\n> = 'request' extends TType\n  ? RequestMiddleware<TRegister>\n  : FunctionMiddleware<TRegister>\n\nexport interface FunctionMiddleware<\n  TRegister,\n> extends FunctionMiddlewareAfterMiddleware<TRegister, unknown> {\n  middleware: <const TNewMiddlewares = undefined>(\n    middlewares: Constrain<\n      TNewMiddlewares,\n      ReadonlyArray<AnyRequestMiddleware | AnyFunctionMiddleware>\n    >,\n  ) => FunctionMiddlewareAfterMiddleware<TRegister, TNewMiddlewares>\n}\n\nexport interface FunctionMiddlewareAfterMiddleware<TRegister, TMiddlewares>\n  extends\n    FunctionMiddlewareWithTypes<\n      TRegister,\n      TMiddlewares,\n      undefined,\n      undefined,\n      undefined,\n      undefined,\n      undefined\n    >,\n    FunctionMiddlewareServer<\n      TRegister,\n      TMiddlewares,\n      undefined,\n      undefined,\n      undefined\n    >,\n    FunctionMiddlewareClient<TRegister, TMiddlewares, undefined>,\n    FunctionMiddlewareValidator<TRegister, TMiddlewares> {}\n\nexport interface FunctionMiddlewareWithTypes<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TServerContext,\n  TServerSendContext,\n  TClientContext,\n  TClientSendContext,\n> {\n  '~types': FunctionMiddlewareTypes<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TServerContext,\n    TServerSendContext,\n    TClientContext,\n    TClientSendContext\n  >\n  options: FunctionMiddlewareOptions<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TServerContext,\n    TClientContext\n  >\n}\n\nexport interface FunctionMiddlewareTypes<\n  in out TRegister,\n  in out TMiddlewares,\n  in out TInputValidator,\n  in out TServerContext,\n  in out TServerSendContext,\n  in out TClientContext,\n  in out TClientSendContext,\n> {\n  type: 'function'\n  middlewares: TMiddlewares\n  input: ResolveValidatorInput<TInputValidator>\n  allInput: IntersectAllValidatorInputs<TMiddlewares, TInputValidator>\n  output: ResolveValidatorOutput<TInputValidator>\n  allOutput: IntersectAllValidatorOutputs<TMiddlewares, TInputValidator>\n  clientContext: TClientContext\n  allClientContextBeforeNext: AssignAllClientContextBeforeNext<\n    TMiddlewares,\n    TClientContext\n  >\n  allClientContextAfterNext: AssignAllClientContextAfterNext<\n    TMiddlewares,\n    TClientContext,\n    TClientSendContext\n  >\n  serverContext: TServerContext\n  serverSendContext: TServerSendContext\n  allServerSendContext: AssignAllServerSendContext<\n    TMiddlewares,\n    TServerSendContext\n  >\n  allServerContext: AssignAllServerFnContext<\n    TRegister,\n    TMiddlewares,\n    TServerSendContext,\n    TServerContext\n  >\n  clientSendContext: TClientSendContext\n  allClientSendContext: AssignAllClientSendContext<\n    TMiddlewares,\n    TClientSendContext\n  >\n  inputValidator: TInputValidator\n}\n\n/**\n * Recursively resolve the input type produced by a sequence of middleware\n */\nexport type IntersectAllValidatorInputs<TMiddlewares, TInputValidator> =\n  unknown extends TInputValidator\n    ? TInputValidator\n    : TInputValidator extends undefined\n      ? IntersectAllMiddleware<TMiddlewares, 'allInput'>\n      : IntersectAssign<\n          IntersectAllMiddleware<TMiddlewares, 'allInput'>,\n          ResolveValidatorInput<TInputValidator>\n        >\n\nexport type IntersectAllMiddleware<\n  TMiddlewares,\n  TType extends\n    | keyof AnyFunctionMiddleware['~types']\n    | keyof AnyRequestMiddleware['~types']\n    | keyof AnyServerFn['~types'],\n  TAcc = undefined,\n> = TMiddlewares extends readonly [infer TMiddleware, ...infer TRest]\n  ? TMiddleware extends\n      | AnyFunctionMiddleware\n      | AnyRequestMiddleware\n      | AnyServerFn\n    ? IntersectAllMiddleware<\n        TRest,\n        TType,\n        IntersectAssign<\n          TAcc,\n          TMiddleware['~types'][TType & keyof TMiddleware['~types']]\n        >\n      >\n    : TAcc\n  : TAcc\n\nexport type AnyFunctionMiddleware = FunctionMiddlewareWithTypes<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>\n\n/**\n * Recursively merge the output type produced by a sequence of middleware\n */\nexport type IntersectAllValidatorOutputs<TMiddlewares, TInputValidator> =\n  unknown extends TInputValidator\n    ? TInputValidator\n    : TInputValidator extends undefined\n      ? IntersectAllMiddleware<TMiddlewares, 'allOutput'>\n      : IntersectAssign<\n          IntersectAllMiddleware<TMiddlewares, 'allOutput'>,\n          Awaited<ResolveValidatorOutput<TInputValidator>>\n        >\n\n/**\n * Recursively resolve the client context type produced by a sequence of middleware\n */\nexport type AssignAllClientContextBeforeNext<\n  TMiddlewares,\n  TClientContext = undefined,\n> = unknown extends TClientContext\n  ? TClientContext\n  : Assign<\n      AssignAllMiddleware<TMiddlewares, 'allClientContextBeforeNext'>,\n      TClientContext\n    >\n\nexport type AssignAllMiddleware<\n  TMiddlewares,\n  TType extends\n    | keyof AnyFunctionMiddleware['~types']\n    | keyof AnyRequestMiddleware['~types']\n    | keyof AnyServerFn['~types'],\n  TAcc = undefined,\n> = TMiddlewares extends readonly [infer TMiddleware, ...infer TRest]\n  ? TMiddleware extends\n      | AnyFunctionMiddleware\n      | AnyRequestMiddleware\n      | AnyServerFn\n    ? AssignAllMiddleware<\n        TRest,\n        TType,\n        Assign<TAcc, TMiddleware['~types'][TType & keyof TMiddleware['~types']]>\n      >\n    : TAcc\n  : TAcc\n\nexport type AssignAllClientContextAfterNext<\n  TMiddlewares,\n  TClientContext = undefined,\n  TSendContext = undefined,\n> = unknown extends TClientContext\n  ? Assign<TClientContext, TSendContext>\n  : Assign<\n      AssignAllMiddleware<TMiddlewares, 'allClientContextAfterNext'>,\n      Assign<TClientContext, TSendContext>\n    >\n\nexport type AssignAllServerSendContext<\n  TMiddlewares,\n  TSendContext = undefined,\n> = unknown extends TSendContext\n  ? TSendContext\n  : Assign<\n      AssignAllMiddleware<TMiddlewares, 'allServerSendContext'>,\n      TSendContext\n    >\n\nexport type AssignAllServerRequestContext<\n  TRegister,\n  TMiddlewares,\n  TSendContext = undefined,\n  TServerContext = undefined,\n> = Assign<\n  // Fetch Request Context\n  GlobalFetchRequestContext,\n  Assign<\n    GlobalServerRequestContext<TRegister>,\n    __AssignAllServerRequestContext<TMiddlewares, TSendContext, TServerContext>\n  >\n>\n\n// export type GlobalFetchRequestContext<TRegister> = AnyContext\nexport type GlobalFetchRequestContext = Register extends {\n  server: { requestContext: infer TRequestContext }\n}\n  ? TRequestContext\n  : AnyContext\n\nexport type GlobalServerRequestContext<TRegister> = TRegister extends {\n  config: StartInstanceOptions<any, any, infer TRequestMiddlewares, any>\n}\n  ? AssignAllMiddleware<TRequestMiddlewares, 'allServerContext'>\n  : AnyContext\n\ntype __AssignAllServerRequestContext<\n  TMiddlewares,\n  TSendContext = undefined,\n  TServerContext = undefined,\n> = unknown extends TSendContext\n  ? Assign<TSendContext, TServerContext>\n  : Assign<\n      AssignAllMiddleware<TMiddlewares, 'allServerContext'>,\n      Assign<TSendContext, TServerContext>\n    >\n\nexport type AssignAllServerFnContext<\n  TRegister,\n  TMiddlewares,\n  TSendContext = undefined,\n  TServerContext = undefined,\n> = Assign<\n  GlobalFetchRequestContext,\n  Assign<\n    GlobalServerRequestContext<TRegister>, // TODO: This enabled global middleware\n    // type inference, but creates a circular types issue. No idea how to fix this.\n    // AnyContext,\n    Assign<\n      GlobalServerFnContext<TRegister>, // TODO: This enabled global middleware\n      // type inference, but creates a circular types issue. No idea how to fix this.\n      // AnyContext,/\n      __AssignAllServerFnContext<TMiddlewares, TSendContext, TServerContext>\n    >\n  >\n>\n\ntype GlobalServerFnContext<TRegister> = TRegister extends {\n  config: StartInstanceOptions<any, any, any, infer TFunctionMiddlewares>\n}\n  ? AssignAllMiddleware<TFunctionMiddlewares, 'allServerContext'>\n  : AnyContext\n\ntype __AssignAllServerFnContext<\n  TMiddlewares,\n  TSendContext = undefined,\n  TServerContext = undefined,\n> = unknown extends TSendContext\n  ? Assign<TSendContext, TServerContext>\n  : Assign<\n      AssignAllMiddleware<TMiddlewares, 'allServerContext'>,\n      Assign<TSendContext, TServerContext>\n    >\n\nexport type AssignAllClientSendContext<\n  TMiddlewares,\n  TSendContext = undefined,\n> = unknown extends TSendContext\n  ? TSendContext\n  : Assign<\n      AssignAllMiddleware<TMiddlewares, 'allClientSendContext'>,\n      TSendContext\n    >\n\nexport interface FunctionMiddlewareOptions<\n  in out TRegister,\n  in out TMiddlewares,\n  in out TInputValidator,\n  in out TServerContext,\n  in out TClientContext,\n> {\n  middleware?: TMiddlewares\n  inputValidator?: ConstrainValidator<TRegister, 'GET', TInputValidator>\n  client?: FunctionMiddlewareClientFn<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TServerContext,\n    TClientContext\n  >\n  server?: FunctionMiddlewareServerFn<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TServerContext,\n    unknown,\n    unknown\n  >\n}\n\nexport type FunctionMiddlewareClientNextFn<TRegister, TMiddlewares> = <\n  TSendContext = undefined,\n  TNewClientContext = undefined,\n>(ctx?: {\n  context?: TNewClientContext\n  sendContext?: ValidateSerializableInput<TRegister, TSendContext>\n  headers?: HeadersInit\n  fetch?: CustomFetch\n}) => Promise<\n  FunctionClientResultWithContext<TMiddlewares, TSendContext, TNewClientContext>\n>\n\nexport interface FunctionMiddlewareServer<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TServerSendContext,\n  TClientContext,\n> {\n  server: <TNewServerContext = undefined, TSendContext = undefined>(\n    server: FunctionMiddlewareServerFn<\n      TRegister,\n      TMiddlewares,\n      TInputValidator,\n      TServerSendContext,\n      TNewServerContext,\n      TSendContext\n    >,\n  ) => FunctionMiddlewareAfterServer<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TNewServerContext,\n    TServerSendContext,\n    TClientContext,\n    TSendContext\n  >\n}\n\nexport type FunctionMiddlewareServerFn<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TServerSendContext,\n  TNewServerContext,\n  TSendContext,\n> = (\n  options: FunctionMiddlewareServerFnOptions<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TServerSendContext\n  >,\n) => FunctionMiddlewareServerFnResult<\n  TRegister,\n  TMiddlewares,\n  TServerSendContext,\n  TNewServerContext,\n  TSendContext\n>\n\nexport type FunctionMiddlewareServerNextFn<\n  TRegister,\n  TMiddlewares,\n  TServerSendContext,\n> = <TNewServerContext = undefined, TSendContext = undefined>(ctx?: {\n  context?: TNewServerContext\n  sendContext?: ValidateSerializableInput<TRegister, TSendContext>\n}) => Promise<\n  FunctionServerResultWithContext<\n    TRegister,\n    TMiddlewares,\n    TServerSendContext,\n    TNewServerContext,\n    TSendContext\n  >\n>\n\nexport type FunctionServerResultWithContext<\n  in out TRegister,\n  in out TMiddlewares,\n  in out TServerSendContext,\n  in out TServerContext,\n  in out TSendContext,\n> = {\n  'use functions must return the result of next()': true\n  '~types': {\n    context: TServerContext\n    sendContext: TSendContext\n  }\n  context: Expand<\n    AssignAllServerFnContext<\n      TRegister,\n      TMiddlewares,\n      TServerSendContext,\n      TServerContext\n    >\n  >\n  sendContext: Expand<AssignAllClientSendContext<TMiddlewares, TSendContext>>\n}\n\nexport interface FunctionMiddlewareServerFnOptions<\n  in out TRegister,\n  in out TMiddlewares,\n  in out TInputValidator,\n  in out TServerSendContext,\n> {\n  data: Expand<IntersectAllValidatorOutputs<TMiddlewares, TInputValidator>>\n  context: Expand<\n    AssignAllServerFnContext<TRegister, TMiddlewares, TServerSendContext>\n  >\n  next: FunctionMiddlewareServerNextFn<\n    TRegister,\n    TMiddlewares,\n    TServerSendContext\n  >\n  method: Method\n  serverFnMeta: ServerFnMeta\n  signal: AbortSignal\n}\n\nexport type FunctionMiddlewareServerFnResult<\n  TRegister,\n  TMiddlewares,\n  TServerSendContext,\n  TServerContext,\n  TSendContext,\n> =\n  | Promise<\n      FunctionServerResultWithContext<\n        TRegister,\n        TMiddlewares,\n        TServerSendContext,\n        TServerContext,\n        TSendContext\n      >\n    >\n  | FunctionServerResultWithContext<\n      TRegister,\n      TMiddlewares,\n      TServerSendContext,\n      TServerContext,\n      TSendContext\n    >\n\nexport interface FunctionMiddlewareAfterServer<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TServerContext,\n  TServerSendContext,\n  TClientContext,\n  TClientSendContext,\n> extends FunctionMiddlewareWithTypes<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TServerContext,\n  TServerSendContext,\n  TClientContext,\n  TClientSendContext\n> {}\n\nexport interface FunctionMiddlewareClient<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n> {\n  client: <TSendServerContext = undefined, TNewClientContext = undefined>(\n    client: FunctionMiddlewareClientFn<\n      TRegister,\n      TMiddlewares,\n      TInputValidator,\n      TSendServerContext,\n      TNewClientContext\n    >,\n  ) => FunctionMiddlewareAfterClient<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TSendServerContext,\n    TNewClientContext\n  >\n}\n\nexport type FunctionMiddlewareClientFn<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TSendContext,\n  TClientContext,\n> = (\n  options: FunctionMiddlewareClientFnOptions<\n    TRegister,\n    TMiddlewares,\n    TInputValidator\n  >,\n) => FunctionMiddlewareClientFnResult<\n  TMiddlewares,\n  TSendContext,\n  TClientContext\n>\n\nexport interface FunctionMiddlewareClientFnOptions<\n  in out TRegister,\n  in out TMiddlewares,\n  in out TInputValidator,\n> {\n  data: Expand<IntersectAllValidatorInputs<TMiddlewares, TInputValidator>>\n  context: Expand<AssignAllClientContextBeforeNext<TMiddlewares>>\n  sendContext: Expand<AssignAllServerSendContext<TMiddlewares>>\n  method: Method\n  signal: AbortSignal\n  serverFnMeta: ClientFnMeta\n  next: FunctionMiddlewareClientNextFn<TRegister, TMiddlewares>\n  filename: string\n  fetch?: CustomFetch\n}\n\nexport type FunctionMiddlewareClientFnResult<\n  TMiddlewares,\n  TSendContext,\n  TClientContext,\n> =\n  | Promise<\n      FunctionClientResultWithContext<\n        TMiddlewares,\n        TSendContext,\n        TClientContext\n      >\n    >\n  | FunctionClientResultWithContext<TMiddlewares, TSendContext, TClientContext>\n\nexport type FunctionClientResultWithContext<\n  in out TMiddlewares,\n  in out TSendContext,\n  in out TClientContext,\n> = {\n  'use functions must return the result of next()': true\n  context: Expand<AssignAllClientContextAfterNext<TMiddlewares, TClientContext>>\n  sendContext: Expand<AssignAllServerSendContext<TMiddlewares, TSendContext>>\n  headers: HeadersInit\n  fetch?: CustomFetch\n}\n\nexport interface FunctionMiddlewareAfterClient<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TServerSendContext,\n  TClientContext,\n>\n  extends\n    FunctionMiddlewareWithTypes<\n      TRegister,\n      TMiddlewares,\n      TInputValidator,\n      undefined,\n      TServerSendContext,\n      TClientContext,\n      undefined\n    >,\n    FunctionMiddlewareServer<\n      TRegister,\n      TMiddlewares,\n      TInputValidator,\n      TServerSendContext,\n      TClientContext\n    > {}\n\nexport interface FunctionMiddlewareValidator<TRegister, TMiddlewares> {\n  inputValidator: <TNewValidator>(\n    inputValidator: ConstrainValidator<TRegister, 'GET', TNewValidator>,\n  ) => FunctionMiddlewareAfterValidator<TRegister, TMiddlewares, TNewValidator>\n}\n\nexport interface FunctionMiddlewareAfterValidator<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n>\n  extends\n    FunctionMiddlewareWithTypes<\n      TRegister,\n      TMiddlewares,\n      TInputValidator,\n      undefined,\n      undefined,\n      undefined,\n      undefined\n    >,\n    FunctionMiddlewareServer<\n      TRegister,\n      TMiddlewares,\n      TInputValidator,\n      undefined,\n      undefined\n    >,\n    FunctionMiddlewareClient<TRegister, TMiddlewares, TInputValidator> {}\n\nexport interface RequestMiddleware<\n  TRegister,\n> extends RequestMiddlewareAfterMiddleware<TRegister, undefined> {\n  middleware: <const TMiddlewares = undefined>(\n    middlewares: Constrain<TMiddlewares, ReadonlyArray<AnyRequestMiddleware>>,\n  ) => RequestMiddlewareAfterMiddleware<TRegister, TMiddlewares>\n}\n\nexport type AnyRequestMiddleware = RequestMiddlewareWithTypes<any, any, any>\n\nexport interface RequestMiddlewareWithTypes<\n  TRegister,\n  TMiddlewares,\n  TServerContext,\n> {\n  '~types': RequestMiddlewareTypes<TRegister, TMiddlewares, TServerContext>\n  options: RequestMiddlewareOptions<TRegister, TMiddlewares, TServerContext>\n}\n\nexport interface RequestMiddlewareOptions<\n  in out TRegister,\n  in out TMiddlewares,\n  in out TServerContext,\n> {\n  middleware?: TMiddlewares\n  server?: RequestServerFn<TRegister, TMiddlewares, TServerContext>\n}\nexport interface RequestMiddlewareTypes<\n  TRegister,\n  TMiddlewares,\n  TServerContext,\n> {\n  type: 'request'\n  // this only exists so we can use request middlewares in server functions\n  allInput: undefined\n  // this only exists so we can use request middlewares in server functions\n  allOutput: undefined\n  middlewares: TMiddlewares\n  serverContext: TServerContext\n  allServerContext: AssignAllServerRequestContext<\n    TRegister,\n    TMiddlewares,\n    undefined,\n    TServerContext\n  >\n}\n\nexport interface RequestMiddlewareAfterMiddleware<TRegister, TMiddlewares>\n  extends\n    RequestMiddlewareWithTypes<TRegister, TMiddlewares, undefined>,\n    RequestMiddlewareServer<TRegister, TMiddlewares> {}\n\nexport interface RequestMiddlewareServer<TRegister, TMiddlewares> {\n  server: <TServerContext = undefined>(\n    fn: RequestServerFn<TRegister, TMiddlewares, TServerContext>,\n  ) => RequestMiddlewareAfterServer<TRegister, TMiddlewares, TServerContext>\n}\n\nexport type RequestServerFn<TRegister, TMiddlewares, TServerContext> = (\n  options: RequestServerOptions<TRegister, TMiddlewares>,\n) => RequestMiddlewareServerFnResult<TRegister, TMiddlewares, TServerContext>\n\nexport interface RequestServerOptions<TRegister, TMiddlewares> {\n  request: Request\n  pathname: string\n  context: Expand<AssignAllServerRequestContext<TRegister, TMiddlewares>>\n  next: RequestServerNextFn<TRegister, TMiddlewares>\n  /**\n   * Metadata about the server function being invoked.\n   * This is only present when the request is handling a server function call.\n   * For regular page requests, this will be undefined.\n   */\n  serverFnMeta?: ServerFnMeta\n}\n\nexport type RequestServerNextFn<TRegister, TMiddlewares> = <\n  TServerContext = undefined,\n>(\n  options?: RequestServerNextFnOptions<TServerContext>,\n) => RequestServerNextFnResult<TRegister, TMiddlewares, TServerContext>\n\nexport interface RequestServerNextFnOptions<TServerContext> {\n  context?: TServerContext\n}\n\nexport type RequestServerNextFnResult<TRegister, TMiddlewares, TServerContext> =\n  | Promise<RequestServerResult<TRegister, TMiddlewares, TServerContext>>\n  | RequestServerResult<TRegister, TMiddlewares, TServerContext>\n\nexport type RequestMiddlewareServerFnResult<\n  TRegister,\n  TMiddlewares,\n  TServerContext,\n> =\n  | Promise<\n      RequestServerResult<TRegister, TMiddlewares, TServerContext> | Response\n    >\n  | RequestServerResult<TRegister, TMiddlewares, TServerContext>\n  | Response\n\nexport interface RequestServerResult<TRegister, TMiddlewares, TServerContext> {\n  request: Request\n  pathname: string\n  context: Expand<\n    AssignAllServerRequestContext<\n      TRegister,\n      TMiddlewares,\n      undefined,\n      TServerContext\n    >\n  >\n  response: Response\n}\n\nexport interface RequestMiddlewareAfterServer<\n  TRegister,\n  TMiddlewares,\n  TServerContext,\n> extends RequestMiddlewareWithTypes<TRegister, TMiddlewares, TServerContext> {}\n"],"mappings":";AAiCA,IAAa,oBAA4C,SAAS,WAAW;CAC3E,MAAM,kBAAkB;EACtB,MAAM;EACN,GAAI,UAAU;EACf;AAED,QAAO;EACL,SAAS;EACT,aAAa,eAAoB;AAC/B,UAAO,iBACL,EAAE,EACF,OAAO,OAAO,iBAAiB,EAAE,YAAY,CAAC,CAC/C;;EAEH,iBAAiB,mBAAwB;AACvC,UAAO,iBACL,EAAE,EACF,OAAO,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,CACnD;;EAEH,SAAS,WAAgB;AACvB,UAAO,iBACL,EAAE,EACF,OAAO,OAAO,iBAAiB,EAAE,QAAQ,CAAC,CAC3C;;EAEH,SAAS,WAAgB;AACvB,UAAO,iBACL,EAAE,EACF,OAAO,OAAO,iBAAiB,EAAE,QAAQ,CAAC,CAC3C;;EAEJ"}
+{"version":3,"file":"createMiddleware.js","names":[],"sources":["../../src/createMiddleware.ts"],"sourcesContent":["import type { StartInstanceOptions } from './createStart'\nimport type {\n  AnyServerFn,\n  ConstrainValidator,\n  CustomFetch,\n  Method,\n} from './createServerFn'\nimport type { ClientFnMeta, ServerFnMeta } from './constants'\nimport type {\n  AnyContext,\n  Assign,\n  Constrain,\n  Expand,\n  IntersectAssign,\n  Register,\n  ResolveValidatorInput,\n  ResolveValidatorOutput,\n  ValidateSerializableInput,\n} from '@tanstack/router-core'\n\nexport type CreateMiddlewareFn<TRegister> = <TType extends MiddlewareType>(\n  options?: {\n    type?: TType\n  },\n  __opts?: FunctionMiddlewareOptions<\n    TRegister,\n    unknown,\n    undefined,\n    undefined,\n    undefined\n  >,\n) => CreateMiddlewareResult<TRegister, TType>\n\nexport const createMiddleware: CreateMiddlewareFn<{}> = (options, __opts) => {\n  const resolvedOptions = {\n    type: 'request',\n    ...(__opts || options),\n  }\n\n  return {\n    options: resolvedOptions,\n    middleware: (middleware: any) => {\n      return createMiddleware(\n        {} as any,\n        Object.assign(resolvedOptions, { middleware }),\n      ) as any\n    },\n    inputValidator: (inputValidator: any) => {\n      return createMiddleware(\n        {} as any,\n        Object.assign(resolvedOptions, { inputValidator }),\n      ) as any\n    },\n    client: (client: any) => {\n      return createMiddleware(\n        {} as any,\n        Object.assign(resolvedOptions, { client }),\n      ) as any\n    },\n    server: (server: any) => {\n      return createMiddleware(\n        {} as any,\n        Object.assign(resolvedOptions, { server }),\n      ) as any\n    },\n  } as any\n}\n\nexport type MiddlewareType = 'request' | 'function'\n\nexport type CreateMiddlewareResult<\n  TRegister,\n  TType extends MiddlewareType,\n> = 'request' extends TType\n  ? RequestMiddleware<TRegister>\n  : FunctionMiddleware<TRegister>\n\nexport interface FunctionMiddleware<\n  TRegister,\n> extends FunctionMiddlewareAfterMiddleware<TRegister, unknown> {\n  middleware: <const TNewMiddlewares = undefined>(\n    middlewares: Constrain<\n      TNewMiddlewares,\n      ReadonlyArray<AnyRequestMiddleware | AnyFunctionMiddleware>\n    >,\n  ) => FunctionMiddlewareAfterMiddleware<TRegister, TNewMiddlewares>\n}\n\nexport interface FunctionMiddlewareAfterMiddleware<TRegister, TMiddlewares>\n  extends\n    FunctionMiddlewareWithTypes<\n      TRegister,\n      TMiddlewares,\n      undefined,\n      undefined,\n      undefined,\n      undefined,\n      undefined\n    >,\n    FunctionMiddlewareServer<\n      TRegister,\n      TMiddlewares,\n      undefined,\n      undefined,\n      undefined\n    >,\n    FunctionMiddlewareClient<TRegister, TMiddlewares, undefined>,\n    FunctionMiddlewareValidator<TRegister, TMiddlewares> {}\n\nexport interface FunctionMiddlewareWithTypes<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TServerContext,\n  TServerSendContext,\n  TClientContext,\n  TClientSendContext,\n> {\n  '~types': FunctionMiddlewareTypes<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TServerContext,\n    TServerSendContext,\n    TClientContext,\n    TClientSendContext\n  >\n  options: FunctionMiddlewareOptions<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TServerContext,\n    TClientContext\n  >\n}\n\nexport interface FunctionMiddlewareTypes<\n  in out TRegister,\n  in out TMiddlewares,\n  in out TInputValidator,\n  in out TServerContext,\n  in out TServerSendContext,\n  in out TClientContext,\n  in out TClientSendContext,\n> {\n  type: 'function'\n  middlewares: TMiddlewares\n  input: ResolveValidatorInput<TInputValidator>\n  allInput: IntersectAllValidatorInputs<TMiddlewares, TInputValidator>\n  output: ResolveValidatorOutput<TInputValidator>\n  allOutput: IntersectAllValidatorOutputs<TMiddlewares, TInputValidator>\n  clientContext: TClientContext\n  allClientContextBeforeNext: AssignAllClientContextBeforeNext<\n    TMiddlewares,\n    TClientContext\n  >\n  allClientContextAfterNext: AssignAllClientContextAfterNext<\n    TMiddlewares,\n    TClientContext,\n    TClientSendContext\n  >\n  serverContext: TServerContext\n  serverSendContext: TServerSendContext\n  allServerSendContext: AssignAllServerSendContext<\n    TMiddlewares,\n    TServerSendContext\n  >\n  allServerContext: AssignAllServerFnContext<\n    TRegister,\n    TMiddlewares,\n    TServerSendContext,\n    TServerContext\n  >\n  clientSendContext: TClientSendContext\n  allClientSendContext: AssignAllClientSendContext<\n    TMiddlewares,\n    TClientSendContext\n  >\n  inputValidator: TInputValidator\n}\n\n/**\n * Recursively resolve the input type produced by a sequence of middleware\n */\nexport type IntersectAllValidatorInputs<TMiddlewares, TInputValidator> =\n  unknown extends TInputValidator\n    ? TInputValidator\n    : TInputValidator extends undefined\n      ? IntersectAllMiddleware<TMiddlewares, 'allInput'>\n      : IntersectAssign<\n          IntersectAllMiddleware<TMiddlewares, 'allInput'>,\n          ResolveValidatorInput<TInputValidator>\n        >\n\nexport type IntersectAllMiddleware<\n  TMiddlewares,\n  TType extends\n    | keyof AnyFunctionMiddleware['~types']\n    | keyof AnyRequestMiddleware['~types']\n    | keyof AnyServerFn['~types'],\n  TAcc = undefined,\n> = TMiddlewares extends readonly [infer TMiddleware, ...infer TRest]\n  ? TMiddleware extends\n      | AnyFunctionMiddleware\n      | AnyRequestMiddleware\n      | AnyServerFn\n    ? IntersectAllMiddleware<\n        TRest,\n        TType,\n        IntersectAssign<\n          TAcc,\n          TMiddleware['~types'][TType & keyof TMiddleware['~types']]\n        >\n      >\n    : TAcc\n  : TAcc\n\nexport type AnyFunctionMiddleware = FunctionMiddlewareWithTypes<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>\n\n/**\n * Recursively merge the output type produced by a sequence of middleware\n */\nexport type IntersectAllValidatorOutputs<TMiddlewares, TInputValidator> =\n  unknown extends TInputValidator\n    ? TInputValidator\n    : TInputValidator extends undefined\n      ? IntersectAllMiddleware<TMiddlewares, 'allOutput'>\n      : IntersectAssign<\n          IntersectAllMiddleware<TMiddlewares, 'allOutput'>,\n          Awaited<ResolveValidatorOutput<TInputValidator>>\n        >\n\n/**\n * Recursively resolve the client context type produced by a sequence of middleware\n */\nexport type AssignAllClientContextBeforeNext<\n  TMiddlewares,\n  TClientContext = undefined,\n> = unknown extends TClientContext\n  ? TClientContext\n  : Assign<\n      AssignAllMiddleware<TMiddlewares, 'allClientContextBeforeNext'>,\n      TClientContext\n    >\n\nexport type AssignAllMiddleware<\n  TMiddlewares,\n  TType extends\n    | keyof AnyFunctionMiddleware['~types']\n    | keyof AnyRequestMiddleware['~types']\n    | keyof AnyServerFn['~types'],\n  TAcc = undefined,\n> = TMiddlewares extends readonly [infer TMiddleware, ...infer TRest]\n  ? TMiddleware extends\n      | AnyFunctionMiddleware\n      | AnyRequestMiddleware\n      | AnyServerFn\n    ? AssignAllMiddleware<\n        TRest,\n        TType,\n        Assign<TAcc, TMiddleware['~types'][TType & keyof TMiddleware['~types']]>\n      >\n    : TAcc\n  : TAcc\n\nexport type AssignAllClientContextAfterNext<\n  TMiddlewares,\n  TClientContext = undefined,\n  TSendContext = undefined,\n> = unknown extends TClientContext\n  ? Assign<TClientContext, TSendContext>\n  : Assign<\n      AssignAllMiddleware<TMiddlewares, 'allClientContextAfterNext'>,\n      Assign<TClientContext, TSendContext>\n    >\n\nexport type AssignAllServerSendContext<\n  TMiddlewares,\n  TSendContext = undefined,\n> = unknown extends TSendContext\n  ? TSendContext\n  : Assign<\n      AssignAllMiddleware<TMiddlewares, 'allServerSendContext'>,\n      TSendContext\n    >\n\nexport type AssignAllServerRequestContext<\n  TRegister,\n  TMiddlewares,\n  TSendContext = undefined,\n  TServerContext = undefined,\n> = Assign<\n  // Fetch Request Context\n  GlobalFetchRequestContext,\n  Assign<\n    GlobalServerRequestContext<TRegister>,\n    __AssignAllServerRequestContext<TMiddlewares, TSendContext, TServerContext>\n  >\n>\n\n// export type GlobalFetchRequestContext<TRegister> = AnyContext\nexport type GlobalFetchRequestContext = Register extends {\n  server: { requestContext: infer TRequestContext }\n}\n  ? TRequestContext\n  : AnyContext\n\nexport type GlobalServerRequestContext<TRegister> = TRegister extends {\n  config: StartInstanceOptions<any, any, infer TRequestMiddlewares, any>\n}\n  ? AssignAllMiddleware<TRequestMiddlewares, 'allServerContext'>\n  : AnyContext\n\ntype __AssignAllServerRequestContext<\n  TMiddlewares,\n  TSendContext = undefined,\n  TServerContext = undefined,\n> = unknown extends TSendContext\n  ? Assign<TSendContext, TServerContext>\n  : Assign<\n      AssignAllMiddleware<TMiddlewares, 'allServerContext'>,\n      Assign<TSendContext, TServerContext>\n    >\n\nexport type AssignAllServerFnContext<\n  TRegister,\n  TMiddlewares,\n  TSendContext = undefined,\n  TServerContext = undefined,\n> = Assign<\n  GlobalFetchRequestContext,\n  Assign<\n    GlobalServerRequestContext<TRegister>, // TODO: This enabled global middleware\n    // type inference, but creates a circular types issue. No idea how to fix this.\n    // AnyContext,\n    Assign<\n      GlobalServerFnContext<TRegister>, // TODO: This enabled global middleware\n      // type inference, but creates a circular types issue. No idea how to fix this.\n      // AnyContext,/\n      __AssignAllServerFnContext<TMiddlewares, TSendContext, TServerContext>\n    >\n  >\n>\n\ntype GlobalServerFnContext<TRegister> = TRegister extends {\n  config: StartInstanceOptions<any, any, any, infer TFunctionMiddlewares>\n}\n  ? AssignAllMiddleware<TFunctionMiddlewares, 'allServerContext'>\n  : AnyContext\n\ntype __AssignAllServerFnContext<\n  TMiddlewares,\n  TSendContext = undefined,\n  TServerContext = undefined,\n> = unknown extends TSendContext\n  ? Assign<TSendContext, TServerContext>\n  : Assign<\n      AssignAllMiddleware<TMiddlewares, 'allServerContext'>,\n      Assign<TSendContext, TServerContext>\n    >\n\nexport type AssignAllClientSendContext<\n  TMiddlewares,\n  TSendContext = undefined,\n> = unknown extends TSendContext\n  ? TSendContext\n  : Assign<\n      AssignAllMiddleware<TMiddlewares, 'allClientSendContext'>,\n      TSendContext\n    >\n\nexport interface FunctionMiddlewareOptions<\n  in out TRegister,\n  in out TMiddlewares,\n  in out TInputValidator,\n  in out TServerContext,\n  in out TClientContext,\n> {\n  middleware?: TMiddlewares\n  inputValidator?: ConstrainValidator<TRegister, 'GET', TInputValidator>\n  client?: FunctionMiddlewareClientFn<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TServerContext,\n    TClientContext\n  >\n  server?: FunctionMiddlewareServerFn<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TServerContext,\n    unknown,\n    unknown\n  >\n}\n\nexport type FunctionMiddlewareClientNextFn<TRegister, TMiddlewares> = <\n  TSendContext = undefined,\n  TNewClientContext = undefined,\n>(ctx?: {\n  context?: TNewClientContext\n  sendContext?: ValidateSerializableInput<TRegister, TSendContext>\n  headers?: HeadersInit\n  fetch?: CustomFetch\n}) => Promise<\n  FunctionClientResultWithContext<TMiddlewares, TSendContext, TNewClientContext>\n>\n\nexport interface FunctionMiddlewareServer<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TServerSendContext,\n  TClientContext,\n> {\n  server: <TNewServerContext = undefined, TSendContext = undefined>(\n    server: FunctionMiddlewareServerFn<\n      TRegister,\n      TMiddlewares,\n      TInputValidator,\n      TServerSendContext,\n      TNewServerContext,\n      TSendContext\n    >,\n  ) => FunctionMiddlewareAfterServer<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TNewServerContext,\n    TServerSendContext,\n    TClientContext,\n    TSendContext\n  >\n}\n\nexport type FunctionMiddlewareServerFn<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TServerSendContext,\n  TNewServerContext,\n  TSendContext,\n> = (\n  options: FunctionMiddlewareServerFnOptions<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TServerSendContext\n  >,\n) => FunctionMiddlewareServerFnResult<\n  TRegister,\n  TMiddlewares,\n  TServerSendContext,\n  TNewServerContext,\n  TSendContext\n>\n\nexport type FunctionMiddlewareServerNextFn<\n  TRegister,\n  TMiddlewares,\n  TServerSendContext,\n> = <TNewServerContext = undefined, TSendContext = undefined>(ctx?: {\n  context?: TNewServerContext\n  sendContext?: ValidateSerializableInput<TRegister, TSendContext>\n}) => Promise<\n  FunctionServerResultWithContext<\n    TRegister,\n    TMiddlewares,\n    TServerSendContext,\n    TNewServerContext,\n    TSendContext\n  >\n>\n\nexport type FunctionServerResultWithContext<\n  in out TRegister,\n  in out TMiddlewares,\n  in out TServerSendContext,\n  in out TServerContext,\n  in out TSendContext,\n> = {\n  'use functions must return the result of next()': true\n  '~types': {\n    context: TServerContext\n    sendContext: TSendContext\n  }\n  context: Expand<\n    AssignAllServerFnContext<\n      TRegister,\n      TMiddlewares,\n      TServerSendContext,\n      TServerContext\n    >\n  >\n  sendContext: Expand<AssignAllClientSendContext<TMiddlewares, TSendContext>>\n}\n\nexport interface FunctionMiddlewareServerFnOptions<\n  in out TRegister,\n  in out TMiddlewares,\n  in out TInputValidator,\n  in out TServerSendContext,\n> {\n  data: Expand<IntersectAllValidatorOutputs<TMiddlewares, TInputValidator>>\n  context: Expand<\n    AssignAllServerFnContext<TRegister, TMiddlewares, TServerSendContext>\n  >\n  next: FunctionMiddlewareServerNextFn<\n    TRegister,\n    TMiddlewares,\n    TServerSendContext\n  >\n  method: Method\n  serverFnMeta: ServerFnMeta\n  signal: AbortSignal\n}\n\nexport type FunctionMiddlewareServerFnResult<\n  TRegister,\n  TMiddlewares,\n  TServerSendContext,\n  TServerContext,\n  TSendContext,\n> =\n  | Promise<\n      FunctionServerResultWithContext<\n        TRegister,\n        TMiddlewares,\n        TServerSendContext,\n        TServerContext,\n        TSendContext\n      >\n    >\n  | FunctionServerResultWithContext<\n      TRegister,\n      TMiddlewares,\n      TServerSendContext,\n      TServerContext,\n      TSendContext\n    >\n\nexport interface FunctionMiddlewareAfterServer<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TServerContext,\n  TServerSendContext,\n  TClientContext,\n  TClientSendContext,\n> extends FunctionMiddlewareWithTypes<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TServerContext,\n  TServerSendContext,\n  TClientContext,\n  TClientSendContext\n> {}\n\nexport interface FunctionMiddlewareClient<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n> {\n  client: <TSendServerContext = undefined, TNewClientContext = undefined>(\n    client: FunctionMiddlewareClientFn<\n      TRegister,\n      TMiddlewares,\n      TInputValidator,\n      TSendServerContext,\n      TNewClientContext\n    >,\n  ) => FunctionMiddlewareAfterClient<\n    TRegister,\n    TMiddlewares,\n    TInputValidator,\n    TSendServerContext,\n    TNewClientContext\n  >\n}\n\nexport type FunctionMiddlewareClientFn<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TSendContext,\n  TClientContext,\n> = (\n  options: FunctionMiddlewareClientFnOptions<\n    TRegister,\n    TMiddlewares,\n    TInputValidator\n  >,\n) => FunctionMiddlewareClientFnResult<\n  TMiddlewares,\n  TSendContext,\n  TClientContext\n>\n\nexport interface FunctionMiddlewareClientFnOptions<\n  in out TRegister,\n  in out TMiddlewares,\n  in out TInputValidator,\n> {\n  data: Expand<IntersectAllValidatorInputs<TMiddlewares, TInputValidator>>\n  context: Expand<AssignAllClientContextBeforeNext<TMiddlewares>>\n  sendContext: Expand<AssignAllServerSendContext<TMiddlewares>>\n  method: Method\n  signal: AbortSignal\n  serverFnMeta: ClientFnMeta\n  next: FunctionMiddlewareClientNextFn<TRegister, TMiddlewares>\n  filename: string\n  fetch?: CustomFetch\n}\n\nexport type FunctionMiddlewareClientFnResult<\n  TMiddlewares,\n  TSendContext,\n  TClientContext,\n> =\n  | Promise<\n      FunctionClientResultWithContext<\n        TMiddlewares,\n        TSendContext,\n        TClientContext\n      >\n    >\n  | FunctionClientResultWithContext<TMiddlewares, TSendContext, TClientContext>\n\nexport type FunctionClientResultWithContext<\n  in out TMiddlewares,\n  in out TSendContext,\n  in out TClientContext,\n> = {\n  'use functions must return the result of next()': true\n  context: Expand<AssignAllClientContextAfterNext<TMiddlewares, TClientContext>>\n  sendContext: Expand<AssignAllServerSendContext<TMiddlewares, TSendContext>>\n  headers: HeadersInit\n  fetch?: CustomFetch\n}\n\nexport interface FunctionMiddlewareAfterClient<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n  TServerSendContext,\n  TClientContext,\n>\n  extends\n    FunctionMiddlewareWithTypes<\n      TRegister,\n      TMiddlewares,\n      TInputValidator,\n      undefined,\n      TServerSendContext,\n      TClientContext,\n      undefined\n    >,\n    FunctionMiddlewareServer<\n      TRegister,\n      TMiddlewares,\n      TInputValidator,\n      TServerSendContext,\n      TClientContext\n    > {}\n\nexport interface FunctionMiddlewareValidator<TRegister, TMiddlewares> {\n  inputValidator: <TNewValidator>(\n    inputValidator: ConstrainValidator<TRegister, 'GET', TNewValidator>,\n  ) => FunctionMiddlewareAfterValidator<TRegister, TMiddlewares, TNewValidator>\n}\n\nexport interface FunctionMiddlewareAfterValidator<\n  TRegister,\n  TMiddlewares,\n  TInputValidator,\n>\n  extends\n    FunctionMiddlewareWithTypes<\n      TRegister,\n      TMiddlewares,\n      TInputValidator,\n      undefined,\n      undefined,\n      undefined,\n      undefined\n    >,\n    FunctionMiddlewareServer<\n      TRegister,\n      TMiddlewares,\n      TInputValidator,\n      undefined,\n      undefined\n    >,\n    FunctionMiddlewareClient<TRegister, TMiddlewares, TInputValidator> {}\n\nexport interface RequestMiddleware<\n  TRegister,\n> extends RequestMiddlewareAfterMiddleware<TRegister, undefined> {\n  middleware: <const TMiddlewares = undefined>(\n    middlewares: Constrain<TMiddlewares, ReadonlyArray<AnyRequestMiddleware>>,\n  ) => RequestMiddlewareAfterMiddleware<TRegister, TMiddlewares>\n}\n\nexport type AnyRequestMiddleware = RequestMiddlewareWithTypes<any, any, any>\n\nexport interface RequestMiddlewareWithTypes<\n  TRegister,\n  TMiddlewares,\n  TServerContext,\n> {\n  '~types': RequestMiddlewareTypes<TRegister, TMiddlewares, TServerContext>\n  options: RequestMiddlewareOptions<TRegister, TMiddlewares, TServerContext>\n}\n\nexport interface RequestMiddlewareOptions<\n  in out TRegister,\n  in out TMiddlewares,\n  in out TServerContext,\n> {\n  middleware?: TMiddlewares\n  server?: RequestServerFn<TRegister, TMiddlewares, TServerContext>\n}\nexport interface RequestMiddlewareTypes<\n  TRegister,\n  TMiddlewares,\n  TServerContext,\n> {\n  type: 'request'\n  // this only exists so we can use request middlewares in server functions\n  allInput: undefined\n  // this only exists so we can use request middlewares in server functions\n  allOutput: undefined\n  middlewares: TMiddlewares\n  serverContext: TServerContext\n  allServerContext: AssignAllServerRequestContext<\n    TRegister,\n    TMiddlewares,\n    undefined,\n    TServerContext\n  >\n}\n\nexport interface RequestMiddlewareAfterMiddleware<TRegister, TMiddlewares>\n  extends\n    RequestMiddlewareWithTypes<TRegister, TMiddlewares, undefined>,\n    RequestMiddlewareServer<TRegister, TMiddlewares> {}\n\nexport interface RequestMiddlewareServer<TRegister, TMiddlewares> {\n  server: <TServerContext = undefined>(\n    fn: RequestServerFn<TRegister, TMiddlewares, TServerContext>,\n  ) => RequestMiddlewareAfterServer<TRegister, TMiddlewares, TServerContext>\n}\n\nexport type RequestServerFn<TRegister, TMiddlewares, TServerContext> = (\n  options: RequestServerOptions<TRegister, TMiddlewares>,\n) => RequestMiddlewareServerFnResult<TRegister, TMiddlewares, TServerContext>\n\nexport interface RequestServerOptions<TRegister, TMiddlewares> {\n  request: Request\n  pathname: string\n  context: Expand<AssignAllServerRequestContext<TRegister, TMiddlewares>>\n  next: RequestServerNextFn<TRegister, TMiddlewares>\n  /**\n   * Type of Start handler currently processing this request.\n   */\n  handlerType: 'serverFn' | 'router'\n  /**\n   * Metadata about the server function being invoked.\n   * This is only present when the request is handling a server function call.\n   * For regular page requests, this will be undefined.\n   */\n  serverFnMeta?: ServerFnMeta\n}\n\nexport type RequestServerNextFn<TRegister, TMiddlewares> = <\n  TServerContext = undefined,\n>(\n  options?: RequestServerNextFnOptions<TServerContext>,\n) => RequestServerNextFnResult<TRegister, TMiddlewares, TServerContext>\n\nexport interface RequestServerNextFnOptions<TServerContext> {\n  context?: TServerContext\n}\n\nexport type RequestServerNextFnResult<TRegister, TMiddlewares, TServerContext> =\n  | Promise<RequestServerResult<TRegister, TMiddlewares, TServerContext>>\n  | RequestServerResult<TRegister, TMiddlewares, TServerContext>\n\nexport type RequestMiddlewareServerFnResult<\n  TRegister,\n  TMiddlewares,\n  TServerContext,\n> =\n  | Promise<\n      RequestServerResult<TRegister, TMiddlewares, TServerContext> | Response\n    >\n  | RequestServerResult<TRegister, TMiddlewares, TServerContext>\n  | Response\n\nexport interface RequestServerResult<TRegister, TMiddlewares, TServerContext> {\n  request: Request\n  pathname: string\n  context: Expand<\n    AssignAllServerRequestContext<\n      TRegister,\n      TMiddlewares,\n      undefined,\n      TServerContext\n    >\n  >\n  response: Response\n}\n\nexport interface RequestMiddlewareAfterServer<\n  TRegister,\n  TMiddlewares,\n  TServerContext,\n> extends RequestMiddlewareWithTypes<TRegister, TMiddlewares, TServerContext> {}\n"],"mappings":";AAiCA,IAAa,oBAA4C,SAAS,WAAW;CAC3E,MAAM,kBAAkB;EACtB,MAAM;EACN,GAAI,UAAU;EACf;AAED,QAAO;EACL,SAAS;EACT,aAAa,eAAoB;AAC/B,UAAO,iBACL,EAAE,EACF,OAAO,OAAO,iBAAiB,EAAE,YAAY,CAAC,CAC/C;;EAEH,iBAAiB,mBAAwB;AACvC,UAAO,iBACL,EAAE,EACF,OAAO,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,CACnD;;EAEH,SAAS,WAAgB;AACvB,UAAO,iBACL,EAAE,EACF,OAAO,OAAO,iBAAiB,EAAE,QAAQ,CAAC,CAC3C;;EAEH,SAAS,WAAgB;AACvB,UAAO,iBACL,EAAE,EACF,OAAO,OAAO,iBAAiB,EAAE,QAAQ,CAAC,CAC3C;;EAEJ"}

package/dist/esm/index.d.ts

@@ -7,6 +7,8 @@ export { createServerFn } from './createServerFn.js';
 export { createMiddleware, type IntersectAllValidatorInputs, type IntersectAllValidatorOutputs, type FunctionMiddlewareServerFn, type AnyFunctionMiddleware, type FunctionMiddlewareOptions, type FunctionMiddlewareWithTypes, type FunctionMiddlewareValidator, type FunctionMiddlewareServer, type FunctionMiddlewareAfterClient, type FunctionMiddlewareAfterServer, type FunctionMiddleware, type FunctionMiddlewareAfterMiddleware, type FunctionMiddlewareClientFnOptions, type FunctionMiddlewareClientFnResult, type FunctionMiddlewareClientNextFn, type FunctionClientResultWithContext, type AssignAllClientContextBeforeNext, type AssignAllMiddleware, type FunctionMiddlewareAfterValidator, type FunctionMiddlewareClientFn, type FunctionMiddlewareServerFnResult, type FunctionMiddlewareClient, type FunctionMiddlewareServerFnOptions, type FunctionMiddlewareServerNextFn, type FunctionServerResultWithContext, type AnyRequestMiddleware, type RequestMiddlewareOptions, type RequestMiddlewareWithTypes, type RequestMiddlewareServer, type RequestMiddlewareAfterServer, type RequestMiddleware, type RequestMiddlewareAfterMiddleware, type RequestServerFn, type RequestMiddlewareServerFnResult, type RequestServerOptions, type RequestServerNextFn, type RequestServerNextFnOptions, type RequestServerResult, } from './createMiddleware.js';
 export type { CompiledFetcherFnOptions, CompiledFetcherFn, CustomFetch, Fetcher, RscStream, FetcherBaseOptions, ServerFn, ServerFnCtx, ServerFnOptions, ServerFnStrict, ServerFnStrictInput, ServerFnStrictOutput, MiddlewareFn, ServerFnMiddlewareOptions, ServerFnMiddlewareResult, ServerFnBuilder, ServerFnBaseOptions, NextFn, Method, OptionalFetcher, RequiredFetcher, } from './createServerFn.js';
 export { execValidator, flattenMiddlewares, executeMiddleware, } from './createServerFn.js';
+export { createCsrfMiddleware, csrfSymbol, getCsrfRequestValidationResult, isCsrfRequestAllowed, } from './createCsrfMiddleware.js';
+export type { CsrfMatcher, CsrfMiddlewareOptions, CsrfSecFetchSite, } from './createCsrfMiddleware.js';
 export { TSS_FORMDATA_CONTEXT, TSS_SERVER_FUNCTION, TSS_CONTENT_TYPE_FRAMED, TSS_CONTENT_TYPE_FRAMED_VERSIONED, TSS_FRAMED_PROTOCOL_VERSION, FrameType, FRAME_HEADER_SIZE, X_TSS_SERIALIZED, X_TSS_RAW_RESPONSE, X_TSS_CONTEXT, validateFramedProtocolVersion, } from './constants.js';
 export type { FrameType as FrameTypeValue, ClientFnMeta, ServerFnMeta, } from './constants.js';
 export type * from './serverRoute.js';

package/dist/esm/index.js

@@ -2,6 +2,7 @@ import { FRAME_HEADER_SIZE, FrameType, TSS_CONTENT_TYPE_FRAMED, TSS_CONTENT_TYPE
 import { createNullProtoObject, safeObjectMerge } from "./safeObjectMerge.js";
 import { createServerFn, execValidator, executeMiddleware, flattenMiddlewares } from "./createServerFn.js";
 import { createMiddleware } from "./createMiddleware.js";
+import { createCsrfMiddleware, csrfSymbol, getCsrfRequestValidationResult, isCsrfRequestAllowed } from "./createCsrfMiddleware.js";
 import { createStart } from "./createStart.js";
 import { getRouterInstance } from "./getRouterInstance.js";
 import { getDefaultSerovalPlugins } from "./getDefaultSerovalPlugins.js";
@@ -10,4 +11,4 @@ import { trackPostProcessPromise } from "./client-rpc/serverFnFetcher.js";
 import { hydrate, json, mergeHeaders } from "@tanstack/router-core/ssr/client";
 import { RawStream } from "@tanstack/router-core";
 import { createClientOnlyFn, createIsomorphicFn, createServerOnlyFn } from "@tanstack/start-fn-stubs";
-export { FRAME_HEADER_SIZE, FrameType, RawStream, TSS_CONTENT_TYPE_FRAMED, TSS_CONTENT_TYPE_FRAMED_VERSIONED, TSS_FORMDATA_CONTEXT, TSS_FRAMED_PROTOCOL_VERSION, TSS_SERVER_FUNCTION, X_TSS_CONTEXT, X_TSS_RAW_RESPONSE, X_TSS_SERIALIZED, createClientOnlyFn, createIsomorphicFn, createMiddleware, createNullProtoObject, createServerFn, createServerOnlyFn, createStart, execValidator, executeMiddleware, flattenMiddlewares, getDefaultSerovalPlugins, getGlobalStartContext, getRouterInstance, hydrate, json, mergeHeaders, safeObjectMerge, trackPostProcessPromise, validateFramedProtocolVersion };
+export { FRAME_HEADER_SIZE, FrameType, RawStream, TSS_CONTENT_TYPE_FRAMED, TSS_CONTENT_TYPE_FRAMED_VERSIONED, TSS_FORMDATA_CONTEXT, TSS_FRAMED_PROTOCOL_VERSION, TSS_SERVER_FUNCTION, X_TSS_CONTEXT, X_TSS_RAW_RESPONSE, X_TSS_SERIALIZED, createClientOnlyFn, createCsrfMiddleware, createIsomorphicFn, createMiddleware, createNullProtoObject, createServerFn, createServerOnlyFn, createStart, csrfSymbol, execValidator, executeMiddleware, flattenMiddlewares, getCsrfRequestValidationResult, getDefaultSerovalPlugins, getGlobalStartContext, getRouterInstance, hydrate, isCsrfRequestAllowed, json, mergeHeaders, safeObjectMerge, trackPostProcessPromise, validateFramedProtocolVersion };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tanstack/start-client-core",
-  "version": "1.168.2",
+  "version": "1.169.0",
   "description": "Modern and scalable routing for React applications",
   "author": "Tanner Linsley",
   "license": "MIT",
@@ -70,9 +70,9 @@
   },
   "dependencies": {
     "seroval": "^1.5.4",
-    "@tanstack/router-core": "1.169.2",
-    "@tanstack/start-fn-stubs": "1.161.6",
-    "@tanstack/start-storage-context": "1.166.35"
+    "@tanstack/router-core": "1.170.0",
+    "@tanstack/start-fn-stubs": "1.162.0",
+    "@tanstack/start-storage-context": "1.167.0"
   },
   "devDependencies": {
     "vite": "*",

package/src/createCsrfMiddleware.ts

@@ -0,0 +1,197 @@
+import { createIsomorphicFn } from '@tanstack/start-fn-stubs'
+import { createMiddleware } from './createMiddleware'
+import type {
+  RequestMiddlewareAfterServer,
+  RequestServerOptions,
+} from './createMiddleware'
+import type { Register } from '@tanstack/router-core'
+
+export const csrfSymbol = Symbol.for('tanstack-start:csrf-middleware')
+
+export type CsrfSecFetchSite =
+  | 'same-origin'
+  | 'same-site'
+  | 'cross-site'
+  | 'none'
+
+export type CsrfMatcher<TValue, TRegister = Register, TMiddlewares = unknown> =
+  | TValue
+  | Array<TValue>
+  | ((
+      value: TValue | (string & {}),
+      ctx: RequestServerOptions<TRegister, TMiddlewares>,
+    ) => boolean | Promise<boolean>)
+
+export interface CsrfMiddlewareOptions<
+  TRegister = Register,
+  TMiddlewares = unknown,
+> {
+  /**
+   * Return `true` to validate this request, or `false` to skip validation.
+   *
+   * @default undefined, which validates every request handled by this middleware.
+   */
+  filter?: (
+    ctx: RequestServerOptions<TRegister, TMiddlewares>,
+  ) => boolean | Promise<boolean>
+  /**
+   * Allowed Origin values. Defaults to the trusted request origin.
+   */
+  origin?: CsrfMatcher<string, TRegister, TMiddlewares>
+  /**
+   * Allowed Sec-Fetch-Site values.
+   *
+   * @default 'same-origin'
+   */
+  secFetchSite?: CsrfMatcher<CsrfSecFetchSite, TRegister, TMiddlewares>
+  /**
+   * Whether to use Referer as a fallback when Sec-Fetch-Site and Origin are absent.
+   *
+   * @default true
+   */
+  referer?:
+    | boolean
+    | ((
+        referer: string,
+        ctx: RequestServerOptions<TRegister, TMiddlewares>,
+      ) => boolean | Promise<boolean>)
+  /**
+   * Allow requests when Sec-Fetch-Site, Origin, and Referer are all missing.
+   *
+   * @default false
+   */
+  allowRequestsWithoutOriginCheck?: boolean
+  /**
+   * Optional response returned when CSRF validation fails.
+   *
+   * @default new Response('Forbidden', { status: 403 })
+   */
+  failureResponse?:
+    | Response
+    | ((
+        ctx: RequestServerOptions<TRegister, TMiddlewares>,
+      ) => Response | Promise<Response>)
+}
+
+type CreateCsrfMiddleware = <TRegister, TMiddlewares>(
+  opts?: CsrfMiddlewareOptions<TRegister, TMiddlewares>,
+) => RequestMiddlewareAfterServer<{}, undefined, undefined>
+
+const innerCreateCsrfMiddleware: CreateCsrfMiddleware = (opts = {}) => {
+  const middleware = createMiddleware().server(async (ctx) => {
+    const csrfCtx = ctx as RequestServerOptions<any, any>
+
+    if (opts.filter && !(await opts.filter(csrfCtx))) {
+      return ctx.next()
+    }
+
+    if (await isCsrfRequestAllowed(opts, csrfCtx)) {
+      return ctx.next()
+    }
+
+    return getFailureResponse(opts, csrfCtx)
+  })
+
+  if (process.env.NODE_ENV !== 'production') {
+    Object.defineProperty(middleware, csrfSymbol, { value: true })
+  }
+
+  return middleware
+}
+
+export const createCsrfMiddleware: CreateCsrfMiddleware =
+  createIsomorphicFn().server(innerCreateCsrfMiddleware) as CreateCsrfMiddleware
+
+export async function isCsrfRequestAllowed<TRegister, TMiddlewares>(
+  opts: CsrfMiddlewareOptions<TRegister, TMiddlewares>,
+  ctx: RequestServerOptions<TRegister, TMiddlewares>,
+): Promise<boolean> {
+  const result = await getCsrfRequestValidationResult(opts, ctx)
+  return (
+    result === true ||
+    (result === undefined && opts.allowRequestsWithoutOriginCheck === true)
+  )
+}
+
+export async function getCsrfRequestValidationResult<TRegister, TMiddlewares>(
+  opts: CsrfMiddlewareOptions<TRegister, TMiddlewares>,
+  ctx: RequestServerOptions<TRegister, TMiddlewares>,
+): Promise<boolean | undefined> {
+  const fetchSite = ctx.request.headers.get('Sec-Fetch-Site')
+  if (fetchSite !== null) {
+    return matchValue(opts.secFetchSite ?? 'same-origin', fetchSite, ctx)
+  }
+
+  const origin = ctx.request.headers.get('Origin')
+  if (origin !== null) {
+    if (opts.origin) {
+      return matchValue(opts.origin, origin, ctx)
+    }
+
+    return origin === new URL(ctx.request.url).origin
+  }
+
+  const referer = ctx.request.headers.get('Referer')
+  if (referer === null || opts.referer === false) {
+    return undefined
+  }
+
+  if (typeof opts.referer === 'function') {
+    return opts.referer(referer, ctx)
+  }
+
+  if (opts.origin) {
+    const refererOrigin = getOriginFromUrl(referer)
+    return (
+      refererOrigin !== undefined && matchValue(opts.origin, refererOrigin, ctx)
+    )
+  }
+
+  return isRefererSameOrigin(referer, new URL(ctx.request.url).origin)
+}
+
+async function matchValue<TValue extends string, TRegister, TMiddlewares>(
+  matcher: CsrfMatcher<TValue, TRegister, TMiddlewares>,
+  value: string,
+  ctx: RequestServerOptions<TRegister, TMiddlewares>,
+): Promise<boolean> {
+  if (typeof matcher === 'function') {
+    return matcher(value, ctx)
+  }
+
+  if (Array.isArray(matcher)) {
+    // typescript is dumb for array.includes()
+    return matcher.includes(value as TValue)
+  }
+
+  return value === matcher
+}
+
+function getOriginFromUrl(url: string): string | undefined {
+  try {
+    return new URL(url).origin
+  } catch {
+    return undefined
+  }
+}
+
+function isRefererSameOrigin(referer: string, requestOrigin: string): boolean {
+  if (referer === requestOrigin) return true
+  if (!referer.startsWith(requestOrigin)) return false
+  if (referer.length === requestOrigin.length) return true
+  const code = referer.charCodeAt(requestOrigin.length)
+  return code === 47 /* '/' */ || code === 63 /* '?' */ || code === 35 /* '#' */
+}
+
+async function getFailureResponse<TRegister, TMiddlewares>(
+  opts: CsrfMiddlewareOptions<TRegister, TMiddlewares>,
+  ctx: RequestServerOptions<TRegister, TMiddlewares>,
+): Promise<Response> {
+  if (typeof opts.failureResponse === 'function') {
+    return opts.failureResponse(ctx)
+  }
+
+  return (
+    opts.failureResponse?.clone() ?? new Response('Forbidden', { status: 403 })
+  )
+}

package/src/createMiddleware.ts

@@ -770,6 +770,10 @@ export interface RequestServerOptions<TRegister, TMiddlewares> {
   pathname: string
   context: Expand<AssignAllServerRequestContext<TRegister, TMiddlewares>>
   next: RequestServerNextFn<TRegister, TMiddlewares>
+  /**
+   * Type of Start handler currently processing this request.
+   */
+  handlerType: 'serverFn' | 'router'
   /**
    * Metadata about the server function being invoked.
    * This is only present when the request is handling a server function call.

package/src/index.tsx

@@ -84,6 +84,17 @@ export {
   flattenMiddlewares,
   executeMiddleware,
 } from './createServerFn'
+export {
+  createCsrfMiddleware,
+  csrfSymbol,
+  getCsrfRequestValidationResult,
+  isCsrfRequestAllowed,
+} from './createCsrfMiddleware'
+export type {
+  CsrfMatcher,
+  CsrfMiddlewareOptions,
+  CsrfSecFetchSite,
+} from './createCsrfMiddleware'
 
 export {
   TSS_FORMDATA_CONTEXT,

package/src/tests/createServerMiddleware.test-d.ts

@@ -675,6 +675,7 @@ test('createMiddleware with type request, no middleware or context', () => {
       next: RequestServerNextFn<{}, undefined>
       pathname: string
       context: undefined
+      handlerType: 'serverFn' | 'router'
       serverFnMeta?: ServerFnMeta
     }>()
 
@@ -698,6 +699,7 @@ test('createMiddleware with type request, no middleware with context', () => {
       next: RequestServerNextFn<{}, undefined>
       pathname: string
       context: undefined
+      handlerType: 'serverFn' | 'router'
       serverFnMeta?: ServerFnMeta
     }>()
 
@@ -722,6 +724,7 @@ test('createMiddleware with type request, middleware and context', () => {
         next: RequestServerNextFn<{}, undefined>
         pathname: string
         context: undefined
+        handlerType: 'serverFn' | 'router'
         serverFnMeta?: ServerFnMeta
       }>()
 
@@ -746,6 +749,7 @@ test('createMiddleware with type request, middleware and context', () => {
         next: RequestServerNextFn<{}, undefined>
         pathname: string
         context: { a: string }
+        handlerType: 'serverFn' | 'router'
         serverFnMeta?: ServerFnMeta
       }>()
 
@@ -769,6 +773,7 @@ test('createMiddleware with type request can return Response directly', () => {
       next: RequestServerNextFn<{}, undefined>
       pathname: string
       context: undefined
+      handlerType: 'serverFn' | 'router'
       serverFnMeta?: ServerFnMeta
     }>()
 
@@ -789,6 +794,7 @@ test('createMiddleware with type request can return Promise<Response>', () => {
       next: RequestServerNextFn<{}, undefined>
       pathname: string
       context: undefined
+      handlerType: 'serverFn' | 'router'
       serverFnMeta?: ServerFnMeta
     }>()
 
@@ -804,6 +810,7 @@ test('createMiddleware with type request can return sync Response', () => {
       next: RequestServerNextFn<{}, undefined>
       pathname: string
       context: undefined
+      handlerType: 'serverFn' | 'router'
       serverFnMeta?: ServerFnMeta
     }>()