better-ship 0.44.0 → 0.46.0

package/dist/posthog/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","names":[],"sources":["../../src/infrastructure/posthog/server.ts"],"mappings":";;;;;;iBAiBiB;WACN;WACA;WACA;WACA,YAAY,SAAS;WACrB,UAAU,KACjB;aAGS,UAAU,KAAK,YAAY;;;;qBAK3B,mCAAmC;;WAMnC,SAAS;mBACD;;WALV,SAAS;UAEX;;SASA,OAAO,QAAQ,yBAAyB;;EAqB/C,SAAS,oBAAoB,aAAa;;EAO1C,MAAM,oBAAoB;;EAK1B,MACE,cACA,YAAY,mCACZ,QAAQ;;EAMV,eACE,cACA,YAAY,mCACZ,QAAQ;UAKF"}
+{"version":3,"file":"server.d.ts","names":[],"sources":["../../src/infrastructure/posthog/server.ts"],"mappings":";;;;;;iBAkBiB;WACN;WACA;WACA;WACA,YAAY,SAAS;WACrB,UAAU,KACjB;aAGS,UAAU,KAAK,YAAY;;;;qBAK3B,mCAAmC;;WAMnC,SAAS;mBACD;;WALV,SAAS;UAEX;;SASA,OAAO,QAAQ,yBAAyB;;EAqB/C,SAAS,oBAAoB,aAAa;;EAO1C,MAAM,oBAAoB;;EAK1B,MACE,cACA,YAAY,mCACZ,QAAQ;;EAMV,eACE,cACA,YAAY,mCACZ,QAAQ;UAKF"}

package/dist/posthog/server.js

@@ -1,5 +1,6 @@
 import { nt as MissingConfigurationError } from "../core-CGj1ukXV.js";
 import { t as PostHogMetricsService } from "../metrics-CWv37yf9.js";
+import { t as currentPostHogSession } from "../request-session-Qe_Q_u9G.js";
 import { v5, validate } from "uuid";
 import { PostHog } from "posthog-node";
 
@@ -60,7 +61,11 @@ var PostHogAnalyticsService = class PostHogAnalyticsService {
 		this.capture(name, properties, target, "anonymous");
 	}
 	capture(name, eventProperties, target, profile) {
-		const properties = { ...eventProperties };
+		const sessionId = currentPostHogSession();
+		const properties = sessionId ? {
+			$session_id: sessionId,
+			...eventProperties
+		} : { ...eventProperties };
 		const payload = {
 			distinctId: target.distinctId,
 			event: name,

package/dist/posthog/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","names":["isUuid","uuidv5"],"sources":["../../src/infrastructure/posthog/server.ts"],"sourcesContent":["import { PostHog, type PostHogOptions } from 'posthog-node'\nimport { validate as isUuid, v5 as uuidv5 } from 'uuid'\n\nimport type { AnalyticsService } from '@/application'\nimport {\n  MissingConfigurationError,\n  type AnalyticsEventInput,\n  type AnalyticsProperties,\n  type AnalyticsTarget,\n} from '@/core'\n\nimport { PostHogMetricsService } from './metrics.ts'\n\n// Fixed forever: changing it changes every derived UUID, so PostHog would keep a repeat.\nconst EVENT_ID_NAMESPACE = '53d7af30-65cb-4176-b2c9-f1ed42367ab1'\n\n/** Deployment values and SDK options; the runtime owns delivery promises. */\nexport interface PostHogAnalyticsConfig {\n  readonly apiKey: string\n  readonly environment: string\n  readonly source: string\n  readonly waitUntil: (promise: Promise<unknown>) => void\n  readonly options?: Omit<\n    PostHogOptions,\n    'waitUntil' | 'flushAt' | 'flushInterval' | 'metrics' | 'disabled'\n  > & {\n    readonly metrics?: Omit<NonNullable<PostHogOptions['metrics']>, 'serviceName' | 'environment'>\n  }\n}\n\n/** Worker analytics ported from Typist; disabled applications select Porte's NULL_ANALYTICS instead. */\nexport class PostHogAnalyticsService implements AnalyticsService {\n  /** Metrics share this service's SDK client and delivery lifetime. */\n  readonly metrics: PostHogMetricsService\n\n  private constructor(\n    /** Raw SDK access for integrations such as PostHog AI tracing. */\n    readonly posthog: PostHog,\n    private readonly waitUntil: (promise: Promise<unknown>) => void,\n  ) {\n    this.metrics = new PostHogMetricsService(posthog, waitUntil)\n  }\n\n  /** Construct once per Worker invocation; a blank key throws MissingConfigurationError. */\n  static create(config: PostHogAnalyticsConfig): PostHogAnalyticsService {\n    const apiKey = config.apiKey.trim()\n    if (apiKey.length === 0) throw new MissingConfigurationError('POSTHOG_API_KEY')\n    const client = new PostHog(apiKey, {\n      host: 'https://us.i.posthog.com',\n      ...config.options,\n      flushAt: 1,\n      flushInterval: 0,\n      waitUntil: config.waitUntil,\n      metrics: {\n        ...config.options?.metrics,\n        environment: config.environment,\n        serviceName: config.source,\n      },\n    })\n    // The SDK applies in-memory super properties synchronously before this promise resolves.\n    void client.register({ environment: config.environment, source: config.source })\n    return new PostHogAnalyticsService(client, config.waitUntil)\n  }\n\n  /** Schedule person properties; the SDK's waitUntil option protects queued delivery. */\n  identify(distinctId: string, properties?: AnalyticsProperties): void {\n    const payload: Parameters<PostHog['identify']>[0] = { distinctId }\n    if (properties !== undefined) payload.properties = properties\n    this.posthog.identify(payload)\n  }\n\n  /** Schedule an irreversible person merge; only alias IDs the application proves belong to one person. */\n  alias(distinctId: string, previousDistinctId: string): void {\n    this.waitUntil(this.posthog.aliasImmediate({ distinctId, alias: previousDistinctId }))\n  }\n\n  /** Schedule an event; without an event ID the SDK sets a new UUID and the capture time. */\n  track(\n    name: string,\n    properties: AnalyticsEventInput['properties'],\n    target: AnalyticsTarget,\n  ): void {\n    this.capture(name, properties, target, 'person')\n  }\n\n  /** Schedule an event without creating a person profile for an attempt or resource ID. */\n  trackAnonymous(\n    name: string,\n    properties: AnalyticsEventInput['properties'],\n    target: AnalyticsTarget,\n  ): void {\n    this.capture(name, properties, target, 'anonymous')\n  }\n\n  private capture(\n    name: string,\n    eventProperties: AnalyticsEventInput['properties'],\n    target: AnalyticsTarget,\n    profile: 'person' | 'anonymous',\n  ): void {\n    const properties = { ...eventProperties }\n    const payload: Parameters<PostHog['captureImmediate']>[0] = {\n      distinctId: target.distinctId,\n      event: name,\n      properties,\n    }\n    if (profile === 'anonymous')\n      payload.properties = { ...properties, $process_person_profile: false }\n    if (target.eventId !== undefined) {\n      // PostHog drops a repeat only when its uuid and timestamp match the first event.\n      payload.uuid = isUuid(target.eventId)\n        ? target.eventId\n        : uuidv5(target.eventId, EVENT_ID_NAMESPACE)\n      payload.timestamp = new Date(target.occurredAt)\n    }\n    this.waitUntil(this.posthog.captureImmediate(payload))\n  }\n}\n"],"mappings":";;;;;;AAcA,MAAM,qBAAqB;;AAiB3B,IAAa,0BAAb,MAAa,wBAAoD;CAMpD;CACQ;;CALnB,AAAS;CAET,AAAQ,YAEN,AAAS,SACT,AAAiB,WACjB;EAFS;EACQ;EAEjB,KAAK,UAAU,IAAI,sBAAsB,SAAS,SAAS;CAC7D;;CAGA,OAAO,OAAO,QAAyD;EACrE,MAAM,SAAS,OAAO,OAAO,KAAK;EAClC,IAAI,OAAO,WAAW,GAAG,MAAM,IAAI,0BAA0B,iBAAiB;EAC9E,MAAM,SAAS,IAAI,QAAQ,QAAQ;GACjC,MAAM;GACN,GAAG,OAAO;GACV,SAAS;GACT,eAAe;GACf,WAAW,OAAO;GAClB,SAAS;IACP,GAAG,OAAO,SAAS;IACnB,aAAa,OAAO;IACpB,aAAa,OAAO;GACtB;EACF,CAAC;EAED,AAAK,OAAO,SAAS;GAAE,aAAa,OAAO;GAAa,QAAQ,OAAO;EAAO,CAAC;EAC/E,OAAO,IAAI,wBAAwB,QAAQ,OAAO,SAAS;CAC7D;;CAGA,SAAS,YAAoB,YAAwC;EACnE,MAAM,UAA8C,EAAE,WAAW;EACjE,IAAI,eAAe,QAAW,QAAQ,aAAa;EACnD,KAAK,QAAQ,SAAS,OAAO;CAC/B;;CAGA,MAAM,YAAoB,oBAAkC;EAC1D,KAAK,UAAU,KAAK,QAAQ,eAAe;GAAE;GAAY,OAAO;EAAmB,CAAC,CAAC;CACvF;;CAGA,MACE,MACA,YACA,QACM;EACN,KAAK,QAAQ,MAAM,YAAY,QAAQ,QAAQ;CACjD;;CAGA,eACE,MACA,YACA,QACM;EACN,KAAK,QAAQ,MAAM,YAAY,QAAQ,WAAW;CACpD;CAEA,AAAQ,QACN,MACA,iBACA,QACA,SACM;EACN,MAAM,aAAa,EAAE,GAAG,gBAAgB;EACxC,MAAM,UAAsD;GAC1D,YAAY,OAAO;GACnB,OAAO;GACP;EACF;EACA,IAAI,YAAY,aACd,QAAQ,aAAa;GAAE,GAAG;GAAY,yBAAyB;EAAM;EACvE,IAAI,OAAO,YAAY,QAAW;GAEhC,QAAQ,OAAOA,SAAO,OAAO,OAAO,IAChC,OAAO,UACPC,GAAO,OAAO,SAAS,kBAAkB;GAC7C,QAAQ,YAAY,IAAI,KAAK,OAAO,UAAU;EAChD;EACA,KAAK,UAAU,KAAK,QAAQ,iBAAiB,OAAO,CAAC;CACvD;AACF"}
+{"version":3,"file":"server.js","names":["isUuid","uuidv5"],"sources":["../../src/infrastructure/posthog/server.ts"],"sourcesContent":["import { PostHog, type PostHogOptions } from 'posthog-node'\nimport { validate as isUuid, v5 as uuidv5 } from 'uuid'\n\nimport type { AnalyticsService } from '@/application'\nimport {\n  MissingConfigurationError,\n  type AnalyticsEventInput,\n  type AnalyticsProperties,\n  type AnalyticsTarget,\n} from '@/core'\n\nimport { PostHogMetricsService } from './metrics.ts'\nimport { currentPostHogSession } from './request-session.ts'\n\n// Fixed forever: changing it changes every derived UUID, so PostHog would keep a repeat.\nconst EVENT_ID_NAMESPACE = '53d7af30-65cb-4176-b2c9-f1ed42367ab1'\n\n/** Deployment values and SDK options; the runtime owns delivery promises. */\nexport interface PostHogAnalyticsConfig {\n  readonly apiKey: string\n  readonly environment: string\n  readonly source: string\n  readonly waitUntil: (promise: Promise<unknown>) => void\n  readonly options?: Omit<\n    PostHogOptions,\n    'waitUntil' | 'flushAt' | 'flushInterval' | 'metrics' | 'disabled'\n  > & {\n    readonly metrics?: Omit<NonNullable<PostHogOptions['metrics']>, 'serviceName' | 'environment'>\n  }\n}\n\n/** Worker analytics ported from Typist; disabled applications select Porte's NULL_ANALYTICS instead. */\nexport class PostHogAnalyticsService implements AnalyticsService {\n  /** Metrics share this service's SDK client and delivery lifetime. */\n  readonly metrics: PostHogMetricsService\n\n  private constructor(\n    /** Raw SDK access for integrations such as PostHog AI tracing. */\n    readonly posthog: PostHog,\n    private readonly waitUntil: (promise: Promise<unknown>) => void,\n  ) {\n    this.metrics = new PostHogMetricsService(posthog, waitUntil)\n  }\n\n  /** Construct once per Worker invocation; a blank key throws MissingConfigurationError. */\n  static create(config: PostHogAnalyticsConfig): PostHogAnalyticsService {\n    const apiKey = config.apiKey.trim()\n    if (apiKey.length === 0) throw new MissingConfigurationError('POSTHOG_API_KEY')\n    const client = new PostHog(apiKey, {\n      host: 'https://us.i.posthog.com',\n      ...config.options,\n      flushAt: 1,\n      flushInterval: 0,\n      waitUntil: config.waitUntil,\n      metrics: {\n        ...config.options?.metrics,\n        environment: config.environment,\n        serviceName: config.source,\n      },\n    })\n    // The SDK applies in-memory super properties synchronously before this promise resolves.\n    void client.register({ environment: config.environment, source: config.source })\n    return new PostHogAnalyticsService(client, config.waitUntil)\n  }\n\n  /** Schedule person properties; the SDK's waitUntil option protects queued delivery. */\n  identify(distinctId: string, properties?: AnalyticsProperties): void {\n    const payload: Parameters<PostHog['identify']>[0] = { distinctId }\n    if (properties !== undefined) payload.properties = properties\n    this.posthog.identify(payload)\n  }\n\n  /** Schedule an irreversible person merge; only alias IDs the application proves belong to one person. */\n  alias(distinctId: string, previousDistinctId: string): void {\n    this.waitUntil(this.posthog.aliasImmediate({ distinctId, alias: previousDistinctId }))\n  }\n\n  /** Schedule an event; without an event ID the SDK sets a new UUID and the capture time. */\n  track(\n    name: string,\n    properties: AnalyticsEventInput['properties'],\n    target: AnalyticsTarget,\n  ): void {\n    this.capture(name, properties, target, 'person')\n  }\n\n  /** Schedule an event without creating a person profile for an attempt or resource ID. */\n  trackAnonymous(\n    name: string,\n    properties: AnalyticsEventInput['properties'],\n    target: AnalyticsTarget,\n  ): void {\n    this.capture(name, properties, target, 'anonymous')\n  }\n\n  private capture(\n    name: string,\n    eventProperties: AnalyticsEventInput['properties'],\n    target: AnalyticsTarget,\n    profile: 'person' | 'anonymous',\n  ): void {\n    const sessionId = currentPostHogSession()\n    // An application's own `$session_id` wins over the request's.\n    const properties = sessionId\n      ? { $session_id: sessionId, ...eventProperties }\n      : { ...eventProperties }\n    const payload: Parameters<PostHog['captureImmediate']>[0] = {\n      distinctId: target.distinctId,\n      event: name,\n      properties,\n    }\n    if (profile === 'anonymous')\n      payload.properties = { ...properties, $process_person_profile: false }\n    if (target.eventId !== undefined) {\n      // PostHog drops a repeat only when its uuid and timestamp match the first event.\n      payload.uuid = isUuid(target.eventId)\n        ? target.eventId\n        : uuidv5(target.eventId, EVENT_ID_NAMESPACE)\n      payload.timestamp = new Date(target.occurredAt)\n    }\n    this.waitUntil(this.posthog.captureImmediate(payload))\n  }\n}\n"],"mappings":";;;;;;;AAeA,MAAM,qBAAqB;;AAiB3B,IAAa,0BAAb,MAAa,wBAAoD;CAMpD;CACQ;;CALnB,AAAS;CAET,AAAQ,YAEN,AAAS,SACT,AAAiB,WACjB;EAFS;EACQ;EAEjB,KAAK,UAAU,IAAI,sBAAsB,SAAS,SAAS;CAC7D;;CAGA,OAAO,OAAO,QAAyD;EACrE,MAAM,SAAS,OAAO,OAAO,KAAK;EAClC,IAAI,OAAO,WAAW,GAAG,MAAM,IAAI,0BAA0B,iBAAiB;EAC9E,MAAM,SAAS,IAAI,QAAQ,QAAQ;GACjC,MAAM;GACN,GAAG,OAAO;GACV,SAAS;GACT,eAAe;GACf,WAAW,OAAO;GAClB,SAAS;IACP,GAAG,OAAO,SAAS;IACnB,aAAa,OAAO;IACpB,aAAa,OAAO;GACtB;EACF,CAAC;EAED,AAAK,OAAO,SAAS;GAAE,aAAa,OAAO;GAAa,QAAQ,OAAO;EAAO,CAAC;EAC/E,OAAO,IAAI,wBAAwB,QAAQ,OAAO,SAAS;CAC7D;;CAGA,SAAS,YAAoB,YAAwC;EACnE,MAAM,UAA8C,EAAE,WAAW;EACjE,IAAI,eAAe,QAAW,QAAQ,aAAa;EACnD,KAAK,QAAQ,SAAS,OAAO;CAC/B;;CAGA,MAAM,YAAoB,oBAAkC;EAC1D,KAAK,UAAU,KAAK,QAAQ,eAAe;GAAE;GAAY,OAAO;EAAmB,CAAC,CAAC;CACvF;;CAGA,MACE,MACA,YACA,QACM;EACN,KAAK,QAAQ,MAAM,YAAY,QAAQ,QAAQ;CACjD;;CAGA,eACE,MACA,YACA,QACM;EACN,KAAK,QAAQ,MAAM,YAAY,QAAQ,WAAW;CACpD;CAEA,AAAQ,QACN,MACA,iBACA,QACA,SACM;EACN,MAAM,YAAY,sBAAsB;EAExC,MAAM,aAAa,YACf;GAAE,aAAa;GAAW,GAAG;EAAgB,IAC7C,EAAE,GAAG,gBAAgB;EACzB,MAAM,UAAsD;GAC1D,YAAY,OAAO;GACnB,OAAO;GACP;EACF;EACA,IAAI,YAAY,aACd,QAAQ,aAAa;GAAE,GAAG;GAAY,yBAAyB;EAAM;EACvE,IAAI,OAAO,YAAY,QAAW;GAEhC,QAAQ,OAAOA,SAAO,OAAO,OAAO,IAChC,OAAO,UACPC,GAAO,OAAO,SAAS,kBAAkB;GAC7C,QAAQ,YAAY,IAAI,KAAK,OAAO,UAAU;EAChD;EACA,KAAK,UAAU,KAAK,QAAQ,iBAAiB,OAAO,CAAC;CACvD;AACF"}

package/dist/posthog/tanstack.d.ts

@@ -0,0 +1,9 @@
+//#region src/infrastructure/posthog/tanstack.d.ts
+/**
+ * Link Worker events to the browser session that sent the request.
+ * Register it in `requestMiddleware`. Each `PostHogAnalyticsService` event in that request then
+ * gets `$session_id`. A request without the header, and queue, cron, and Workflow code, add nothing.
+ */
+export declare const posthogRequestMiddleware: import("@tanstack/react-start").RequestMiddlewareAfterServer<{}, undefined, undefined>;
+//#endregion
+//# sourceMappingURL=tanstack.d.ts.map

package/dist/posthog/tanstack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tanstack.d.ts","names":[],"sources":["../../src/infrastructure/posthog/tanstack.ts"],"mappings":";;;;;;qBAUa,0DAAwB"}

package/dist/posthog/tanstack.js

@@ -0,0 +1,19 @@
+import { createMiddleware } from "@tanstack/react-start";
+
+//#region src/infrastructure/posthog/tanstack.ts
+const SESSION_HEADER = "x-posthog-session-id";
+/**
+* Link Worker events to the browser session that sent the request.
+* Register it in `requestMiddleware`. Each `PostHogAnalyticsService` event in that request then
+* gets `$session_id`. A request without the header, and queue, cron, and Workflow code, add nothing.
+*/
+const posthogRequestMiddleware = createMiddleware({ type: "request" }).server(async ({ request, next }) => {
+	const sessionId = request.headers.get(SESSION_HEADER)?.trim();
+	if (!sessionId) return next();
+	const { runWithPostHogSession } = await import("../request-session-D1r9ZvcS.js");
+	return runWithPostHogSession(sessionId, () => next());
+});
+
+//#endregion
+export { posthogRequestMiddleware };
+//# sourceMappingURL=tanstack.js.map

package/dist/posthog/tanstack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tanstack.js","names":[],"sources":["../../src/infrastructure/posthog/tanstack.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start'\n\n// posthog-js sends this header when the browser sets `tracing_headers` for the application host.\nconst SESSION_HEADER = 'x-posthog-session-id'\n\n/**\n * Link Worker events to the browser session that sent the request.\n * Register it in `requestMiddleware`. Each `PostHogAnalyticsService` event in that request then\n * gets `$session_id`. A request without the header, and queue, cron, and Workflow code, add nothing.\n */\nexport const posthogRequestMiddleware = createMiddleware({ type: 'request' }).server(\n  async ({ request, next }) => {\n    const sessionId = request.headers.get(SESSION_HEADER)?.trim()\n    if (!sessionId) return next()\n    // The browser evaluates this module, so the Node async scope loads inside `.server()`.\n    const { runWithPostHogSession } = await import('./request-session.ts')\n    return runWithPostHogSession(sessionId, () => next())\n  },\n)\n"],"mappings":";;;AAGA,MAAM,iBAAiB;;;;;;AAOvB,MAAa,2BAA2B,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAC5E,OAAO,EAAE,SAAS,WAAW;CAC3B,MAAM,YAAY,QAAQ,QAAQ,IAAI,cAAc,CAAC,EAAE,KAAK;CAC5D,IAAI,CAAC,WAAW,OAAO,KAAK;CAE5B,MAAM,EAAE,0BAA0B,MAAM,OAAO;CAC/C,OAAO,sBAAsB,iBAAiB,KAAK,CAAC;AACtD,CACF"}

package/dist/request-session-D1r9ZvcS.js

@@ -0,0 +1,3 @@
+import { n as runWithPostHogSession, t as currentPostHogSession } from "./request-session-Qe_Q_u9G.js";
+
+export { runWithPostHogSession };

package/dist/request-session-Qe_Q_u9G.js

@@ -0,0 +1,16 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+//#region src/infrastructure/posthog/request-session.ts
+const storage = new AsyncLocalStorage();
+/** Run the rest of one request with the browser's PostHog session ID. */
+function runWithPostHogSession(sessionId, work) {
+	return storage.run(sessionId, work);
+}
+/** The current request's PostHog session ID, or undefined outside such a request. */
+function currentPostHogSession() {
+	return storage.getStore();
+}
+
+//#endregion
+export { runWithPostHogSession as n, currentPostHogSession as t };
+//# sourceMappingURL=request-session-Qe_Q_u9G.js.map

package/dist/request-session-Qe_Q_u9G.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-session-Qe_Q_u9G.js","names":[],"sources":["../src/infrastructure/posthog/request-session.ts"],"sourcesContent":["import { AsyncLocalStorage } from 'node:async_hooks'\n\n// One async scope per request keeps each browser session ID apart from concurrent requests.\nconst storage = new AsyncLocalStorage<string>()\n\n/** Run the rest of one request with the browser's PostHog session ID. */\nexport function runWithPostHogSession<T>(sessionId: string, work: () => T): T {\n  return storage.run(sessionId, work)\n}\n\n/** The current request's PostHog session ID, or undefined outside such a request. */\nexport function currentPostHogSession(): string | undefined {\n  return storage.getStore()\n}\n"],"mappings":";;;AAGA,MAAM,UAAU,IAAI,kBAA0B;;AAG9C,SAAgB,sBAAyB,WAAmB,MAAkB;CAC5E,OAAO,QAAQ,IAAI,WAAW,IAAI;AACpC;;AAGA,SAAgB,wBAA4C;CAC1D,OAAO,QAAQ,SAAS;AAC1B"}

package/dist/tanstack.d.ts

@@ -97,6 +97,18 @@ export declare function createErrorMiddleware<Entries>(options: ErrorMiddlewareO
   toHttpErrorResponse: (cause: unknown) => Response;
 };
 //#endregion
+//#region src/infrastructure/tanstack/csrf.middleware.d.ts
+/** A public site origin that differs from the request URL. */
+type CsrfMiddlewareOptions = {
+  readonly origin?: string;
+};
+/**
+ * Refuse a server function call that does not come from this site.
+ * Register the result in `requestMiddleware`. A custom start instance replaces TanStack's default check.
+ * A refusal logs `csrf_refused` and returns HTTP 403. This function does not throw.
+ */
+export declare function createCsrfMiddleware(options?: CsrfMiddlewareOptions): import("@tanstack/react-start").RequestMiddlewareAfterServer<{}, undefined, undefined>;
+//#endregion
 //#region src/infrastructure/tanstack/function-tracing.middleware.d.ts
 /**
  * Run one server function call in a child span named for that function.
@@ -105,5 +117,5 @@ export declare function createErrorMiddleware<Entries>(options: ErrorMiddlewareO
  */
 export declare function createFunctionTracingMiddleware(getTracing: (context: RequestContext) => Tracing): import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, undefined, undefined, undefined>;
 //#endregion
-export type { AuthContext, AuthCookieSource, AuthMiddlewareOptions, AuthSession, AuthenticatedContext, ErrorMiddlewareOptions, RequiredAuthContext };
+export type { AuthContext, AuthCookieSource, AuthMiddlewareOptions, AuthSession, AuthenticatedContext, CsrfMiddlewareOptions, ErrorMiddlewareOptions, RequiredAuthContext };
 //# sourceMappingURL=tanstack.d.ts.map

package/dist/tanstack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tanstack.d.ts","names":[],"sources":["../src/infrastructure/tanstack/request-context.ts","../src/infrastructure/tanstack/auth.middleware.ts","../src/infrastructure/tanstack/error.middleware.ts","../src/infrastructure/tanstack/function-tracing.middleware.ts"],"mappings":";;;;;;;;;;KAQY,iBAAiB;EAAmB;IAAU,sBAAsB;;IAC5E;;;;KCEQ;WACD;aAAiB;;WACjB;aAAoB;;;;KAInB,oBAAoB,gBAAgB;WACrC,MAAM;WACN,SAAS;;;KAIR,YAAY,gBAAgB,eACpC,oBAAoB;WAET;WACA;;;KAIH,qBAAqB,gBAAgB;WACtC,MAAM;WACN,SAAS;WACT,gBAAgB;;;KAIf,sBAAsB,gBAAgB;WACvC,UAAU,SAAS;aACjB;eACE,aAAa;QAAW,SAAS;YAAc,QAAQ;;;;WAI3D,mBAAmB,SAAS,qBAAqB;;;;;;;wBAc5C,qBAAqB,gBAAgB,aACnD,SAAS,sBAAsB;;;;;;;;KChDrB;WACD,UAAU;aAAmB,aAAa;;;;KAIzC,uBAAuB;WACxB,QAAQ,WAAW;;WAEnB;;WAEA,UAAU,SAAS,mBAAmB;;;;;;wBAOjC,sBAAsB,SAAS,SAAS,uBAAuB;;;;;;;;;;;;;;;;;;;;;wBCnB/D,gCAAgC,aAAa,SAAS,mBAAmB,0CAAO"}
+{"version":3,"file":"tanstack.d.ts","names":[],"sources":["../src/infrastructure/tanstack/request-context.ts","../src/infrastructure/tanstack/auth.middleware.ts","../src/infrastructure/tanstack/error.middleware.ts","../src/infrastructure/tanstack/csrf.middleware.ts","../src/infrastructure/tanstack/function-tracing.middleware.ts"],"mappings":";;;;;;;;;;KAQY,iBAAiB;EAAmB;IAAU,sBAAsB;;IAC5E;;;;KCEQ;WACD;aAAiB;;WACjB;aAAoB;;;;KAInB,oBAAoB,gBAAgB;WACrC,MAAM;WACN,SAAS;;;KAIR,YAAY,gBAAgB,eACpC,oBAAoB;WAET;WACA;;;KAIH,qBAAqB,gBAAgB;WACtC,MAAM;WACN,SAAS;WACT,gBAAgB;;;KAIf,sBAAsB,gBAAgB;WACvC,UAAU,SAAS;aACjB;eACE,aAAa;QAAW,SAAS;YAAc,QAAQ;;;;WAI3D,mBAAmB,SAAS,qBAAqB;;;;;;;wBAc5C,qBAAqB,gBAAgB,aACnD,SAAS,sBAAsB;;;;;;;;KChDrB;WACD,UAAU;aAAmB,aAAa;;;;KAIzC,uBAAuB;WACxB,QAAQ,WAAW;;WAEnB;;WAEA,UAAU,SAAS,mBAAmB;;;;;;wBAOjC,sBAAsB,SAAS,SAAS,uBAAuB;;;;;;;;;;;;;;;;;KCtBnE;WACD;;;;;;;wBAQK,qBAAqB,UAAS,wDAA0B;;;;;;;;wBCNxD,gCAAgC,aAAa,SAAS,mBAAmB,0CAAO"}

package/dist/tanstack.js

@@ -4,11 +4,11 @@ import { n as withSpan } from "./tracing-C_7B_odV.js";
 import { z } from "zod";
 import { getReasonPhrase } from "http-status-codes";
 import { isNotFound, isRedirect, redirect } from "@tanstack/react-router";
-import { createMiddleware } from "@tanstack/react-start";
+import { createCsrfMiddleware as createCsrfMiddleware$1, createMiddleware } from "@tanstack/react-start";
 import { getSessionCookie, parseCookies } from "better-auth/cookies";
 
 //#region src/infrastructure/tanstack/auth.middleware.ts
-const logger$1 = createLogger("auth-middleware");
+const logger$2 = createLogger("auth-middleware");
 const requestHeaders = async () => {
 	const { getRequestHeaders } = await import("@tanstack/react-start/server");
 	return getRequestHeaders();
@@ -33,7 +33,7 @@ function createAuthMiddleware(options) {
 			const headers = await requestHeaders();
 			resolved = await options.getAuth(context).api.getSession({ headers });
 		} catch (error) {
-			logger$1.error("get_session_failed", { error });
+			logger$2.error("get_session_failed", { error });
 			resolved = null;
 		}
 		if (resolved === null) return next({ context: {
@@ -77,7 +77,7 @@ function createAuthMiddleware(options) {
 
 //#endregion
 //#region src/infrastructure/tanstack/resolve-failure.ts
-const logger = createLogger("error-boundary");
+const logger$1 = createLogger("error-boundary");
 const SerializedIssuesSchema = z.array(z.object({
 	message: z.string(),
 	path: z.array(z.union([z.string(), z.number()]))
@@ -103,14 +103,14 @@ function resolveFailure(table, cause) {
 	const failure = reconstructValidationError(cause) ?? cause;
 	const resolved = table.resolve(failure);
 	if (resolved !== null) {
-		logger.warn("handled_error", {
+		logger$1.warn("handled_error", {
 			tag: resolved.payload._tag,
 			status: resolved.status
 		});
 		return resolved;
 	}
 	const classification = failure instanceof AppError ? failure.classification : "unknown";
-	logger.error("unexpected_error", {
+	logger$1.error("unexpected_error", {
 		error: failure,
 		classification
 	});
@@ -231,6 +231,36 @@ function createErrorMiddleware(options) {
 	};
 }
 
+//#endregion
+//#region src/infrastructure/tanstack/csrf.middleware.ts
+const logger = createLogger("csrf");
+/**
+* Refuse a server function call that does not come from this site.
+* Register the result in `requestMiddleware`. A custom start instance replaces TanStack's default check.
+* A refusal logs `csrf_refused` and returns HTTP 403. This function does not throw.
+*/
+function createCsrfMiddleware(options = {}) {
+	const filter = ({ handlerType }) => handlerType === "serverFn";
+	const failureResponse = ({ request }) => {
+		logger.warn("csrf_refused", {
+			url: request.url,
+			origin: request.headers.get("Origin"),
+			secFetchSite: request.headers.get("Sec-Fetch-Site"),
+			referer: request.headers.get("Referer")
+		});
+		return new Response("Forbidden", { status: 403 });
+	};
+	if (options.origin === void 0) return createCsrfMiddleware$1({
+		filter,
+		failureResponse
+	});
+	return createCsrfMiddleware$1({
+		filter,
+		failureResponse,
+		origin: options.origin
+	});
+}
+
 //#endregion
 //#region src/infrastructure/tanstack/function-tracing.middleware.ts
 /**
@@ -246,5 +276,5 @@ function createFunctionTracingMiddleware(getTracing) {
 }
 
 //#endregion
-export { createAuthMiddleware, createErrorMiddleware, createFunctionTracingMiddleware };
+export { createAuthMiddleware, createCsrfMiddleware, createErrorMiddleware, createFunctionTracingMiddleware };
 //# sourceMappingURL=tanstack.js.map

package/dist/tanstack.js.map

@@ -1 +1 @@
-{"version":3,"file":"tanstack.js","names":["logger"],"sources":["../src/infrastructure/tanstack/auth.middleware.ts","../src/infrastructure/tanstack/resolve-failure.ts","../src/infrastructure/tanstack/http-error-response.ts","../src/infrastructure/tanstack/session-cookies.ts","../src/infrastructure/tanstack/to-error-payload.ts","../src/infrastructure/tanstack/error.middleware.ts","../src/infrastructure/tanstack/function-tracing.middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start'\nimport { getSessionCookie } from 'better-auth/cookies'\n\nimport { AuthenticationError, StaleSessionError, createLogger } from '@/core'\n\nimport { applyObservabilityUser } from '../../application/request-user.ts'\nimport type { RequestContext } from './request-context.ts'\n\nconst logger = createLogger('auth-middleware')\n\n/** The fields middleware reads; generic callers retain every additional session and user field. */\nexport type AuthSession = {\n  readonly user: { readonly id: string }\n  readonly session: { readonly id: string }\n}\n\n/** Authenticated context retains the application's complete user and session types. */\nexport type RequiredAuthContext<Session extends AuthSession> = {\n  readonly user: Session['user']\n  readonly session: Session['session']\n}\n\n/** Optional authentication supplies both fields together or neither field. */\nexport type AuthContext<Session extends AuthSession> =\n  | RequiredAuthContext<Session>\n  | {\n      readonly user: undefined\n      readonly session: undefined\n    }\n\n/** A resolved session and the request context that produced it. */\nexport type AuthenticatedContext<Session extends AuthSession> = {\n  readonly user: Session['user']\n  readonly session: Session['session']\n  readonly requestContext: RequestContext\n}\n\n/** Select the current request's Better Auth instance from TanStack's registered context. */\nexport type AuthMiddlewareOptions<Session extends AuthSession> = {\n  readonly getAuth: (context: RequestContext) => {\n    readonly api: {\n      readonly getSession: (options: { headers: Headers }) => Promise<Session | null>\n    }\n  }\n  /** Runs after a session resolves and before the handler. A guest or a failed lookup does not call it. */\n  readonly onAuthenticated?: (context: AuthenticatedContext<Session>) => void\n}\n\n// The server entry loads react-dom/server; the browser evaluates this module, so it loads lazily inside `.server()`.\nconst requestHeaders = async () => {\n  const { getRequestHeaders } = await import('@tanstack/react-start/server')\n  return getRequestHeaders()\n}\n\n/**\n * Preserve Porte's function and request middleware contracts with application-owned services.\n * Optional lookup failures log once and continue as guests. Required lookup failures propagate.\n * A resolved session applies `{ id }` on the observability hook, then runs `onAuthenticated`, before the handler.\n */\nexport function createAuthMiddleware<Session extends AuthSession>(\n  options: AuthMiddlewareOptions<Session>,\n) {\n  function notifyAuthenticated(requestContext: RequestContext, resolved: Session): void {\n    applyObservabilityUser({ id: resolved.user.id })\n    options.onAuthenticated?.({\n      user: resolved.user,\n      session: resolved.session,\n      requestContext,\n    })\n  }\n  const extractAuth = createMiddleware({ type: 'function' }).server<AuthContext<Session>>(\n    async ({ next, context }) => {\n      let resolved: Session | null\n      try {\n        const headers = await requestHeaders()\n        resolved = await options.getAuth(context).api.getSession({ headers })\n      } catch (error) {\n        logger.error('get_session_failed', { error })\n        resolved = null\n      }\n      if (resolved === null)\n        return next<AuthContext<Session>>({ context: { user: undefined, session: undefined } })\n      notifyAuthenticated(context, resolved)\n      return next<AuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n\n  async function resolveRequiredSession(\n    context: RequestContext,\n    headers: Headers,\n  ): Promise<Session> {\n    const resolved = await options.getAuth(context).api.getSession({ headers })\n    if (resolved === null) {\n      if (getSessionCookie(headers)) throw new StaleSessionError()\n      throw new AuthenticationError()\n    }\n    return resolved\n  }\n\n  const requireAuth = createMiddleware({ type: 'function' }).server(async ({ next, context }) => {\n    const resolved = await resolveRequiredSession(context, await requestHeaders())\n    notifyAuthenticated(context, resolved)\n    return next<RequiredAuthContext<Session>>({\n      context: { user: resolved.user, session: resolved.session },\n    })\n  })\n  const requireAuthRequest = createMiddleware({ type: 'request' }).server(\n    async ({ request, next, context }) => {\n      const resolved = await resolveRequiredSession(context, request.headers)\n      notifyAuthenticated(context, resolved)\n      return next<RequiredAuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n  return { extractAuth, requireAuth, requireAuthRequest }\n}\n","import { z } from 'zod'\n\nimport {\n  AppError,\n  ValidationError,\n  createLogger,\n  type ErrorTable,\n  type ResolvedError,\n} from '@/core'\nimport type { ErrorPayloadOf } from '@/core'\n\nconst logger = createLogger('error-boundary')\n\n// TanStack serializes a validator's issues into `Error.message` as JSON.\nconst SerializedIssuesSchema = z\n  .array(z.object({ message: z.string(), path: z.array(z.union([z.string(), z.number()])) }))\n  .min(1)\n\n// A live ZodError keeps `.issues`. TanStack leaves only JSON in `Error.message`.\nfunction reconstructValidationError(cause: unknown): ValidationError | null {\n  if (cause instanceof z.ZodError) return ValidationError.fromZod(cause)\n  if (!(cause instanceof Error)) return null\n  let message: unknown\n  try {\n    message = JSON.parse(cause.message)\n  } catch {\n    return null\n  }\n  const parsed = SerializedIssuesSchema.safeParse(message)\n  return parsed.success ? ValidationError.fromIssues(parsed.data) : null\n}\n\n/**\n * Resolve one failure through the table or fall back to the generic replacement, and log it once.\n * A thrown ZodError, or issues serialized into an error message, becomes a ValidationError first.\n * Both transport converters call this, so one rule decides the log level: mapped is a warning, unmapped is an error with the cause.\n */\nexport function resolveFailure<Entries>(\n  table: ErrorTable<Entries>,\n  cause: unknown,\n): ResolvedError<ErrorPayloadOf<ErrorTable<Entries>>> {\n  const failure = reconstructValidationError(cause) ?? cause\n  const resolved = table.resolve(failure)\n  if (resolved !== null) {\n    logger.warn('handled_error', {\n      tag: resolved.payload._tag,\n      status: resolved.status,\n    })\n    return resolved\n  }\n  const classification = failure instanceof AppError ? failure.classification : 'unknown'\n  logger.error('unexpected_error', { error: failure, classification })\n  return table.fallback(failure)\n}\n","import { getReasonPhrase } from 'http-status-codes'\nimport { z } from 'zod'\n\nimport type { ErrorTable, ProblemDetails } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n// A known delay becomes the header; a null delay sends no header.\nconst RetryAfterSchema = z.object({ retryAfter: z.number() })\n\n/**\n * Build the API route converter for one error table.\n * The body is RFC 9457 problem details; public fields become extension members.\n */\nexport function createHttpErrorResponseConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toHttpErrorResponse(cause: unknown): Response {\n    const { status, payload } = resolveFailure(table, cause)\n    const { _tag, message, ...fields } = payload\n    const body: ProblemDetails = {\n      type: 'about:blank',\n      title: getReasonPhrase(status),\n      detail: message,\n      ...fields,\n    }\n    const headers = new Headers({ 'Content-Type': 'application/problem+json' })\n    const retry = RetryAfterSchema.safeParse(payload)\n    if (retry.success) headers.set('Retry-After', String(retry.data.retryAfter))\n    return Response.json(body, { status, headers })\n  }\n}\n","import type { deleteCookie } from '@tanstack/react-start/server'\nimport type { BetterAuthCookies } from 'better-auth'\nimport { parseCookies } from 'better-auth/cookies'\n\ntype AuthCookie = BetterAuthCookies['sessionToken']\ntype DeleteCookieOptions = NonNullable<Parameters<typeof deleteCookie>[1]>\n\n/**\n * Delete the session, session cache, account cache, and remember-me cookies of one instance.\n * Chunks present on the request go too. Names and attributes come from the instance, so custom prefixes and domain cookies clear.\n */\nexport async function clearStaleSessionCookies(cookies: BetterAuthCookies): Promise<void> {\n  // The server entry loads react-dom/server; the browser evaluates this module, so it loads lazily here.\n  const server = await import('@tanstack/react-start/server')\n  const present = [...parseCookies(server.getRequestHeaders().get('cookie') ?? '').keys()]\n  const definitions = [\n    cookies.sessionToken,\n    cookies.sessionData,\n    cookies.accountData,\n    cookies.dontRememberToken,\n  ]\n  for (const cookie of definitions) {\n    // Better Auth names a chunk `${name}.${index}`, so a missed chunk would resurrect the value.\n    const chunks = present.filter((name) => name.startsWith(`${cookie.name}.`))\n    for (const name of new Set([cookie.name, ...chunks]))\n      server.deleteCookie(name, deletionOf(cookie.attributes))\n  }\n}\n\nfunction deletionOf(attributes: AuthCookie['attributes']): DeleteCookieOptions {\n  // Better Auth sets `/` and the secure flag at runtime; the types leave both optional.\n  const options: DeleteCookieOptions = {\n    path: attributes.path ?? '/',\n    secure: attributes.secure ?? false,\n  }\n  if (attributes.domain !== undefined) options.domain = attributes.domain\n  return options\n}\n","import type { ErrorPayloadOf, ErrorTable } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n/**\n * Build the server-function converter for one error table.\n * The result is a plain object, because only own data survives serialization.\n */\nexport function createErrorPayloadConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toErrorPayload(cause: unknown): ErrorPayloadOf<ErrorTable<Entries>> {\n    return resolveFailure(table, cause).payload\n  }\n}\n","import { isNotFound, isRedirect, redirect } from '@tanstack/react-router'\nimport { createMiddleware } from '@tanstack/react-start'\nimport type { BetterAuthCookies } from 'better-auth'\n\nimport { StaleSessionError, type ErrorTable } from '@/core'\n\nimport { createHttpErrorResponseConverter } from './http-error-response.ts'\nimport type { RequestContext } from './request-context.ts'\nimport { clearStaleSessionCookies } from './session-cookies.ts'\nimport { createErrorPayloadConverter } from './to-error-payload.ts'\n\n/** The part of a Better Auth instance the boundary reads: its computed cookie definitions. */\nexport type AuthCookieSource = {\n  readonly $context: Promise<{ readonly authCookies: BetterAuthCookies }>\n}\n\n/** The application's error table, its stale-session redirect, and its Better Auth instance. */\nexport type ErrorMiddlewareOptions<Entries> = {\n  readonly errors: ErrorTable<Entries>\n  /** The path a server function redirects to for a stale session, with any search string. */\n  readonly signIn: string\n  /** Select the request's Better Auth instance; its cookie definitions say what to clear. */\n  readonly getAuth: (context: RequestContext) => AuthCookieSource\n}\n\n/**\n * Build both transport boundaries from one error table.\n * Register `functionErrorMiddleware` globally. Put `routeErrorMiddleware` first in an API route's `server.middleware`.\n */\nexport function createErrorMiddleware<Entries>(options: ErrorMiddlewareOptions<Entries>) {\n  const toErrorPayload = createErrorPayloadConverter(options.errors)\n  const toHttpErrorResponse = createHttpErrorResponseConverter(options.errors)\n\n  async function clearSession(context: RequestContext): Promise<void> {\n    const { authCookies } = await options.getAuth(context).$context\n    await clearStaleSessionCookies(authCookies)\n  }\n\n  async function handleFunctionError(cause: unknown, context: RequestContext): Promise<never> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) {\n      await clearSession(context)\n      // oxlint-disable-next-line typescript/only-throw-error -- Router redirects by throwing this.\n      throw redirect({ href: options.signIn })\n    }\n    // oxlint-disable-next-line typescript/only-throw-error -- The client rejects with this and reads its tag.\n    throw toErrorPayload(cause)\n  }\n\n  // A route answers 401 instead of a redirect because fetch would follow it into the HTML shell.\n  async function handleRouteError(cause: unknown, context: RequestContext): Promise<Response> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) await clearSession(context)\n    return toHttpErrorResponse(cause)\n  }\n\n  const functionErrorMiddleware = createMiddleware({ type: 'function' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleFunctionError(cause, context)\n      }\n    },\n  )\n\n  const routeErrorMiddleware = createMiddleware({ type: 'request' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleRouteError(cause, context)\n      }\n    },\n  )\n\n  return { functionErrorMiddleware, routeErrorMiddleware, toErrorPayload, toHttpErrorResponse }\n}\n","import { createMiddleware } from '@tanstack/react-start'\n\nimport { withSpan } from '../cloudflare/tracing.ts'\nimport type { RequestContext } from './request-context.ts'\n\n/**\n * Run one server function call in a child span named for that function.\n * Ported from Suparelay `tracing.middleware.ts`. `getTracing` runs on each request.\n * A handler rejection is not a span exception, and this middleware does not log.\n */\nexport function createFunctionTracingMiddleware(getTracing: (context: RequestContext) => Tracing) {\n  return createMiddleware({ type: 'function' }).server(({ context, serverFnMeta, next }) =>\n    withSpan(\n      getTracing(context),\n      `server_fn ${serverFnMeta.name}`,\n      {\n        'code.function.name': serverFnMeta.name,\n        'code.file.path': serverFnMeta.filename,\n      },\n      () => next(),\n    ),\n  )\n}\n"],"mappings":";;;;;;;;;;AAQA,MAAMA,WAAS,aAAa,iBAAiB;AAyC7C,MAAM,iBAAiB,YAAY;CACjC,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAC3C,OAAO,kBAAkB;AAC3B;;;;;;AAOA,SAAgB,qBACd,SACA;CACA,SAAS,oBAAoB,gBAAgC,UAAyB;EACpF,uBAAuB,EAAE,IAAI,SAAS,KAAK,GAAG,CAAC;EAC/C,QAAQ,kBAAkB;GACxB,MAAM,SAAS;GACf,SAAS,SAAS;GAClB;EACF,CAAC;CACH;CACA,MAAM,cAAc,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACzD,OAAO,EAAE,MAAM,cAAc;EAC3B,IAAI;EACJ,IAAI;GACF,MAAM,UAAU,MAAM,eAAe;GACrC,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,QAAQ,CAAC;EACtE,SAAS,OAAO;GACd,SAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC;GAC5C,WAAW;EACb;EACA,IAAI,aAAa,MACf,OAAO,KAA2B,EAAE,SAAS;GAAE,MAAM;GAAW,SAAS;EAAU,EAAE,CAAC;EACxF,oBAAoB,SAAS,QAAQ;EACrC,OAAO,KAA2B,EAChC,SAAS;GAAE,MAAM,SAAS;GAAM,SAAS,SAAS;EAAQ,EAC5D,CAAC;CACH,CACF;CAEA,eAAe,uBACb,SACA,SACkB;EAClB,MAAM,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,QAAQ,CAAC;EAC1E,IAAI,aAAa,MAAM;GACrB,IAAI,iBAAiB,OAAO,GAAG,MAAM,IAAI,kBAAkB;GAC3D,MAAM,IAAI,oBAAoB;EAChC;EACA,OAAO;CACT;CAkBA,OAAO;EAAE;EAAa,aAhBF,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,MAAM,cAAc;GAC7F,MAAM,WAAW,MAAM,uBAAuB,SAAS,MAAM,eAAe,CAAC;GAC7E,oBAAoB,SAAS,QAAQ;GACrC,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CAUgC;EAAG,oBATR,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAC/D,OAAO,EAAE,SAAS,MAAM,cAAc;GACpC,MAAM,WAAW,MAAM,uBAAuB,SAAS,QAAQ,OAAO;GACtE,oBAAoB,SAAS,QAAQ;GACrC,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CAEkD;CAAE;AACxD;;;;AC3GA,MAAM,SAAS,aAAa,gBAAgB;AAG5C,MAAM,yBAAyB,EAC5B,MAAM,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAAE,CAAC,CAAC,CAAC,CAC1F,IAAI,CAAC;AAGR,SAAS,2BAA2B,OAAwC;CAC1E,IAAI,iBAAiB,EAAE,UAAU,OAAO,gBAAgB,QAAQ,KAAK;CACrE,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CACtC,IAAI;CACJ,IAAI;EACF,UAAU,KAAK,MAAM,MAAM,OAAO;CACpC,QAAQ;EACN,OAAO;CACT;CACA,MAAM,SAAS,uBAAuB,UAAU,OAAO;CACvD,OAAO,OAAO,UAAU,gBAAgB,WAAW,OAAO,IAAI,IAAI;AACpE;;;;;;AAOA,SAAgB,eACd,OACA,OACoD;CACpD,MAAM,UAAU,2BAA2B,KAAK,KAAK;CACrD,MAAM,WAAW,MAAM,QAAQ,OAAO;CACtC,IAAI,aAAa,MAAM;EACrB,OAAO,KAAK,iBAAiB;GAC3B,KAAK,SAAS,QAAQ;GACtB,QAAQ,SAAS;EACnB,CAAC;EACD,OAAO;CACT;CACA,MAAM,iBAAiB,mBAAmB,WAAW,QAAQ,iBAAiB;CAC9E,OAAO,MAAM,oBAAoB;EAAE,OAAO;EAAS;CAAe,CAAC;CACnE,OAAO,MAAM,SAAS,OAAO;AAC/B;;;;AC7CA,MAAM,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;;;;;AAM5D,SAAgB,iCAA0C,OAA4B;CACpF,OAAO,SAAS,oBAAoB,OAA0B;EAC5D,MAAM,EAAE,QAAQ,YAAY,eAAe,OAAO,KAAK;EACvD,MAAM,EAAE,MAAM,SAAS,GAAG,WAAW;EACrC,MAAM,OAAuB;GAC3B,MAAM;GACN,OAAO,gBAAgB,MAAM;GAC7B,QAAQ;GACR,GAAG;EACL;EACA,MAAM,UAAU,IAAI,QAAQ,EAAE,gBAAgB,2BAA2B,CAAC;EAC1E,MAAM,QAAQ,iBAAiB,UAAU,OAAO;EAChD,IAAI,MAAM,SAAS,QAAQ,IAAI,eAAe,OAAO,MAAM,KAAK,UAAU,CAAC;EAC3E,OAAO,SAAS,KAAK,MAAM;GAAE;GAAQ;EAAQ,CAAC;CAChD;AACF;;;;;;;;AClBA,eAAsB,yBAAyB,SAA2C;CAExF,MAAM,SAAS,MAAM,OAAO;CAC5B,MAAM,UAAU,CAAC,GAAG,aAAa,OAAO,kBAAkB,CAAC,CAAC,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;CACvF,MAAM,cAAc;EAClB,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ;CACV;CACA,KAAK,MAAM,UAAU,aAAa;EAEhC,MAAM,SAAS,QAAQ,QAAQ,SAAS,KAAK,WAAW,GAAG,OAAO,KAAK,EAAE,CAAC;EAC1E,KAAK,MAAM,wBAAQ,IAAI,IAAI,CAAC,OAAO,MAAM,GAAG,MAAM,CAAC,GACjD,OAAO,aAAa,MAAM,WAAW,OAAO,UAAU,CAAC;CAC3D;AACF;AAEA,SAAS,WAAW,YAA2D;CAE7E,MAAM,UAA+B;EACnC,MAAM,WAAW,QAAQ;EACzB,QAAQ,WAAW,UAAU;CAC/B;CACA,IAAI,WAAW,WAAW,QAAW,QAAQ,SAAS,WAAW;CACjE,OAAO;AACT;;;;;;;;AC7BA,SAAgB,4BAAqC,OAA4B;CAC/E,OAAO,SAAS,eAAe,OAAqD;EAClF,OAAO,eAAe,OAAO,KAAK,CAAC,CAAC;CACtC;AACF;;;;;;;;ACiBA,SAAgB,sBAA+B,SAA0C;CACvF,MAAM,iBAAiB,4BAA4B,QAAQ,MAAM;CACjE,MAAM,sBAAsB,iCAAiC,QAAQ,MAAM;CAE3E,eAAe,aAAa,SAAwC;EAClE,MAAM,EAAE,gBAAgB,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC;EACvD,MAAM,yBAAyB,WAAW;CAC5C;CAEA,eAAe,oBAAoB,OAAgB,SAAyC;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB;GACtC,MAAM,aAAa,OAAO;GAE1B,MAAM,SAAS,EAAE,MAAM,QAAQ,OAAO,CAAC;EACzC;EAEA,MAAM,eAAe,KAAK;CAC5B;CAGA,eAAe,iBAAiB,OAAgB,SAA4C;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB,MAAM,aAAa,OAAO;EAClE,OAAO,oBAAoB,KAAK;CAClC;CAsBA,OAAO;EAAE,yBApBuB,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACrE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,oBAAoB,OAAO,OAAO;GAC3C;EACF,CAa6B;EAAG,sBAVL,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OACjE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,iBAAiB,OAAO,OAAO;GACxC;EACF,CAGmD;EAAG;EAAgB;CAAoB;AAC9F;;;;;;;;;ACrEA,SAAgB,gCAAgC,YAAkD;CAChG,OAAO,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,cAAc,WAC7E,SACE,WAAW,OAAO,GAClB,aAAa,aAAa,QAC1B;EACE,sBAAsB,aAAa;EACnC,kBAAkB,aAAa;CACjC,SACM,KAAK,CACb,CACF;AACF"}
+{"version":3,"file":"tanstack.js","names":["logger","logger","createTanStackCsrfMiddleware"],"sources":["../src/infrastructure/tanstack/auth.middleware.ts","../src/infrastructure/tanstack/resolve-failure.ts","../src/infrastructure/tanstack/http-error-response.ts","../src/infrastructure/tanstack/session-cookies.ts","../src/infrastructure/tanstack/to-error-payload.ts","../src/infrastructure/tanstack/error.middleware.ts","../src/infrastructure/tanstack/csrf.middleware.ts","../src/infrastructure/tanstack/function-tracing.middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start'\nimport { getSessionCookie } from 'better-auth/cookies'\n\nimport { AuthenticationError, StaleSessionError, createLogger } from '@/core'\n\nimport { applyObservabilityUser } from '../../application/request-user.ts'\nimport type { RequestContext } from './request-context.ts'\n\nconst logger = createLogger('auth-middleware')\n\n/** The fields middleware reads; generic callers retain every additional session and user field. */\nexport type AuthSession = {\n  readonly user: { readonly id: string }\n  readonly session: { readonly id: string }\n}\n\n/** Authenticated context retains the application's complete user and session types. */\nexport type RequiredAuthContext<Session extends AuthSession> = {\n  readonly user: Session['user']\n  readonly session: Session['session']\n}\n\n/** Optional authentication supplies both fields together or neither field. */\nexport type AuthContext<Session extends AuthSession> =\n  | RequiredAuthContext<Session>\n  | {\n      readonly user: undefined\n      readonly session: undefined\n    }\n\n/** A resolved session and the request context that produced it. */\nexport type AuthenticatedContext<Session extends AuthSession> = {\n  readonly user: Session['user']\n  readonly session: Session['session']\n  readonly requestContext: RequestContext\n}\n\n/** Select the current request's Better Auth instance from TanStack's registered context. */\nexport type AuthMiddlewareOptions<Session extends AuthSession> = {\n  readonly getAuth: (context: RequestContext) => {\n    readonly api: {\n      readonly getSession: (options: { headers: Headers }) => Promise<Session | null>\n    }\n  }\n  /** Runs after a session resolves and before the handler. A guest or a failed lookup does not call it. */\n  readonly onAuthenticated?: (context: AuthenticatedContext<Session>) => void\n}\n\n// The server entry loads react-dom/server; the browser evaluates this module, so it loads lazily inside `.server()`.\nconst requestHeaders = async () => {\n  const { getRequestHeaders } = await import('@tanstack/react-start/server')\n  return getRequestHeaders()\n}\n\n/**\n * Preserve Porte's function and request middleware contracts with application-owned services.\n * Optional lookup failures log once and continue as guests. Required lookup failures propagate.\n * A resolved session applies `{ id }` on the observability hook, then runs `onAuthenticated`, before the handler.\n */\nexport function createAuthMiddleware<Session extends AuthSession>(\n  options: AuthMiddlewareOptions<Session>,\n) {\n  function notifyAuthenticated(requestContext: RequestContext, resolved: Session): void {\n    applyObservabilityUser({ id: resolved.user.id })\n    options.onAuthenticated?.({\n      user: resolved.user,\n      session: resolved.session,\n      requestContext,\n    })\n  }\n  const extractAuth = createMiddleware({ type: 'function' }).server<AuthContext<Session>>(\n    async ({ next, context }) => {\n      let resolved: Session | null\n      try {\n        const headers = await requestHeaders()\n        resolved = await options.getAuth(context).api.getSession({ headers })\n      } catch (error) {\n        logger.error('get_session_failed', { error })\n        resolved = null\n      }\n      if (resolved === null)\n        return next<AuthContext<Session>>({ context: { user: undefined, session: undefined } })\n      notifyAuthenticated(context, resolved)\n      return next<AuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n\n  async function resolveRequiredSession(\n    context: RequestContext,\n    headers: Headers,\n  ): Promise<Session> {\n    const resolved = await options.getAuth(context).api.getSession({ headers })\n    if (resolved === null) {\n      if (getSessionCookie(headers)) throw new StaleSessionError()\n      throw new AuthenticationError()\n    }\n    return resolved\n  }\n\n  const requireAuth = createMiddleware({ type: 'function' }).server(async ({ next, context }) => {\n    const resolved = await resolveRequiredSession(context, await requestHeaders())\n    notifyAuthenticated(context, resolved)\n    return next<RequiredAuthContext<Session>>({\n      context: { user: resolved.user, session: resolved.session },\n    })\n  })\n  const requireAuthRequest = createMiddleware({ type: 'request' }).server(\n    async ({ request, next, context }) => {\n      const resolved = await resolveRequiredSession(context, request.headers)\n      notifyAuthenticated(context, resolved)\n      return next<RequiredAuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n  return { extractAuth, requireAuth, requireAuthRequest }\n}\n","import { z } from 'zod'\n\nimport {\n  AppError,\n  ValidationError,\n  createLogger,\n  type ErrorTable,\n  type ResolvedError,\n} from '@/core'\nimport type { ErrorPayloadOf } from '@/core'\n\nconst logger = createLogger('error-boundary')\n\n// TanStack serializes a validator's issues into `Error.message` as JSON.\nconst SerializedIssuesSchema = z\n  .array(z.object({ message: z.string(), path: z.array(z.union([z.string(), z.number()])) }))\n  .min(1)\n\n// A live ZodError keeps `.issues`. TanStack leaves only JSON in `Error.message`.\nfunction reconstructValidationError(cause: unknown): ValidationError | null {\n  if (cause instanceof z.ZodError) return ValidationError.fromZod(cause)\n  if (!(cause instanceof Error)) return null\n  let message: unknown\n  try {\n    message = JSON.parse(cause.message)\n  } catch {\n    return null\n  }\n  const parsed = SerializedIssuesSchema.safeParse(message)\n  return parsed.success ? ValidationError.fromIssues(parsed.data) : null\n}\n\n/**\n * Resolve one failure through the table or fall back to the generic replacement, and log it once.\n * A thrown ZodError, or issues serialized into an error message, becomes a ValidationError first.\n * Both transport converters call this, so one rule decides the log level: mapped is a warning, unmapped is an error with the cause.\n */\nexport function resolveFailure<Entries>(\n  table: ErrorTable<Entries>,\n  cause: unknown,\n): ResolvedError<ErrorPayloadOf<ErrorTable<Entries>>> {\n  const failure = reconstructValidationError(cause) ?? cause\n  const resolved = table.resolve(failure)\n  if (resolved !== null) {\n    logger.warn('handled_error', {\n      tag: resolved.payload._tag,\n      status: resolved.status,\n    })\n    return resolved\n  }\n  const classification = failure instanceof AppError ? failure.classification : 'unknown'\n  logger.error('unexpected_error', { error: failure, classification })\n  return table.fallback(failure)\n}\n","import { getReasonPhrase } from 'http-status-codes'\nimport { z } from 'zod'\n\nimport type { ErrorTable, ProblemDetails } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n// A known delay becomes the header; a null delay sends no header.\nconst RetryAfterSchema = z.object({ retryAfter: z.number() })\n\n/**\n * Build the API route converter for one error table.\n * The body is RFC 9457 problem details; public fields become extension members.\n */\nexport function createHttpErrorResponseConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toHttpErrorResponse(cause: unknown): Response {\n    const { status, payload } = resolveFailure(table, cause)\n    const { _tag, message, ...fields } = payload\n    const body: ProblemDetails = {\n      type: 'about:blank',\n      title: getReasonPhrase(status),\n      detail: message,\n      ...fields,\n    }\n    const headers = new Headers({ 'Content-Type': 'application/problem+json' })\n    const retry = RetryAfterSchema.safeParse(payload)\n    if (retry.success) headers.set('Retry-After', String(retry.data.retryAfter))\n    return Response.json(body, { status, headers })\n  }\n}\n","import type { deleteCookie } from '@tanstack/react-start/server'\nimport type { BetterAuthCookies } from 'better-auth'\nimport { parseCookies } from 'better-auth/cookies'\n\ntype AuthCookie = BetterAuthCookies['sessionToken']\ntype DeleteCookieOptions = NonNullable<Parameters<typeof deleteCookie>[1]>\n\n/**\n * Delete the session, session cache, account cache, and remember-me cookies of one instance.\n * Chunks present on the request go too. Names and attributes come from the instance, so custom prefixes and domain cookies clear.\n */\nexport async function clearStaleSessionCookies(cookies: BetterAuthCookies): Promise<void> {\n  // The server entry loads react-dom/server; the browser evaluates this module, so it loads lazily here.\n  const server = await import('@tanstack/react-start/server')\n  const present = [...parseCookies(server.getRequestHeaders().get('cookie') ?? '').keys()]\n  const definitions = [\n    cookies.sessionToken,\n    cookies.sessionData,\n    cookies.accountData,\n    cookies.dontRememberToken,\n  ]\n  for (const cookie of definitions) {\n    // Better Auth names a chunk `${name}.${index}`, so a missed chunk would resurrect the value.\n    const chunks = present.filter((name) => name.startsWith(`${cookie.name}.`))\n    for (const name of new Set([cookie.name, ...chunks]))\n      server.deleteCookie(name, deletionOf(cookie.attributes))\n  }\n}\n\nfunction deletionOf(attributes: AuthCookie['attributes']): DeleteCookieOptions {\n  // Better Auth sets `/` and the secure flag at runtime; the types leave both optional.\n  const options: DeleteCookieOptions = {\n    path: attributes.path ?? '/',\n    secure: attributes.secure ?? false,\n  }\n  if (attributes.domain !== undefined) options.domain = attributes.domain\n  return options\n}\n","import type { ErrorPayloadOf, ErrorTable } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n/**\n * Build the server-function converter for one error table.\n * The result is a plain object, because only own data survives serialization.\n */\nexport function createErrorPayloadConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toErrorPayload(cause: unknown): ErrorPayloadOf<ErrorTable<Entries>> {\n    return resolveFailure(table, cause).payload\n  }\n}\n","import { isNotFound, isRedirect, redirect } from '@tanstack/react-router'\nimport { createMiddleware } from '@tanstack/react-start'\nimport type { BetterAuthCookies } from 'better-auth'\n\nimport { StaleSessionError, type ErrorTable } from '@/core'\n\nimport { createHttpErrorResponseConverter } from './http-error-response.ts'\nimport type { RequestContext } from './request-context.ts'\nimport { clearStaleSessionCookies } from './session-cookies.ts'\nimport { createErrorPayloadConverter } from './to-error-payload.ts'\n\n/** The part of a Better Auth instance the boundary reads: its computed cookie definitions. */\nexport type AuthCookieSource = {\n  readonly $context: Promise<{ readonly authCookies: BetterAuthCookies }>\n}\n\n/** The application's error table, its stale-session redirect, and its Better Auth instance. */\nexport type ErrorMiddlewareOptions<Entries> = {\n  readonly errors: ErrorTable<Entries>\n  /** The path a server function redirects to for a stale session, with any search string. */\n  readonly signIn: string\n  /** Select the request's Better Auth instance; its cookie definitions say what to clear. */\n  readonly getAuth: (context: RequestContext) => AuthCookieSource\n}\n\n/**\n * Build both transport boundaries from one error table.\n * Register `functionErrorMiddleware` globally. Put `routeErrorMiddleware` first in an API route's `server.middleware`.\n */\nexport function createErrorMiddleware<Entries>(options: ErrorMiddlewareOptions<Entries>) {\n  const toErrorPayload = createErrorPayloadConverter(options.errors)\n  const toHttpErrorResponse = createHttpErrorResponseConverter(options.errors)\n\n  async function clearSession(context: RequestContext): Promise<void> {\n    const { authCookies } = await options.getAuth(context).$context\n    await clearStaleSessionCookies(authCookies)\n  }\n\n  async function handleFunctionError(cause: unknown, context: RequestContext): Promise<never> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) {\n      await clearSession(context)\n      // oxlint-disable-next-line typescript/only-throw-error -- Router redirects by throwing this.\n      throw redirect({ href: options.signIn })\n    }\n    // oxlint-disable-next-line typescript/only-throw-error -- The client rejects with this and reads its tag.\n    throw toErrorPayload(cause)\n  }\n\n  // A route answers 401 instead of a redirect because fetch would follow it into the HTML shell.\n  async function handleRouteError(cause: unknown, context: RequestContext): Promise<Response> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) await clearSession(context)\n    return toHttpErrorResponse(cause)\n  }\n\n  const functionErrorMiddleware = createMiddleware({ type: 'function' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleFunctionError(cause, context)\n      }\n    },\n  )\n\n  const routeErrorMiddleware = createMiddleware({ type: 'request' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleRouteError(cause, context)\n      }\n    },\n  )\n\n  return { functionErrorMiddleware, routeErrorMiddleware, toErrorPayload, toHttpErrorResponse }\n}\n","import { createCsrfMiddleware as createTanStackCsrfMiddleware } from '@tanstack/react-start'\n\nimport { createLogger } from '@/core'\n\nconst logger = createLogger('csrf')\n\n/** A public site origin that differs from the request URL. */\nexport type CsrfMiddlewareOptions = {\n  readonly origin?: string\n}\n\n/**\n * Refuse a server function call that does not come from this site.\n * Register the result in `requestMiddleware`. A custom start instance replaces TanStack's default check.\n * A refusal logs `csrf_refused` and returns HTTP 403. This function does not throw.\n */\nexport function createCsrfMiddleware(options: CsrfMiddlewareOptions = {}) {\n  // A page request has no same-origin proof. Start's own default check skips it too.\n  const filter = ({ handlerType }: { handlerType: 'serverFn' | 'router' }) =>\n    handlerType === 'serverFn'\n  // A refusal never reaches the error middleware, so this boundary logs what the check saw.\n  const failureResponse = ({ request }: { request: Request }) => {\n    logger.warn('csrf_refused', {\n      url: request.url,\n      origin: request.headers.get('Origin'),\n      secFetchSite: request.headers.get('Sec-Fetch-Site'),\n      referer: request.headers.get('Referer'),\n    })\n    return new Response('Forbidden', { status: 403 })\n  }\n  if (options.origin === undefined) return createTanStackCsrfMiddleware({ filter, failureResponse })\n  return createTanStackCsrfMiddleware({ filter, failureResponse, origin: options.origin })\n}\n","import { createMiddleware } from '@tanstack/react-start'\n\nimport { withSpan } from '../cloudflare/tracing.ts'\nimport type { RequestContext } from './request-context.ts'\n\n/**\n * Run one server function call in a child span named for that function.\n * Ported from Suparelay `tracing.middleware.ts`. `getTracing` runs on each request.\n * A handler rejection is not a span exception, and this middleware does not log.\n */\nexport function createFunctionTracingMiddleware(getTracing: (context: RequestContext) => Tracing) {\n  return createMiddleware({ type: 'function' }).server(({ context, serverFnMeta, next }) =>\n    withSpan(\n      getTracing(context),\n      `server_fn ${serverFnMeta.name}`,\n      {\n        'code.function.name': serverFnMeta.name,\n        'code.file.path': serverFnMeta.filename,\n      },\n      () => next(),\n    ),\n  )\n}\n"],"mappings":";;;;;;;;;;AAQA,MAAMA,WAAS,aAAa,iBAAiB;AAyC7C,MAAM,iBAAiB,YAAY;CACjC,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAC3C,OAAO,kBAAkB;AAC3B;;;;;;AAOA,SAAgB,qBACd,SACA;CACA,SAAS,oBAAoB,gBAAgC,UAAyB;EACpF,uBAAuB,EAAE,IAAI,SAAS,KAAK,GAAG,CAAC;EAC/C,QAAQ,kBAAkB;GACxB,MAAM,SAAS;GACf,SAAS,SAAS;GAClB;EACF,CAAC;CACH;CACA,MAAM,cAAc,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACzD,OAAO,EAAE,MAAM,cAAc;EAC3B,IAAI;EACJ,IAAI;GACF,MAAM,UAAU,MAAM,eAAe;GACrC,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,QAAQ,CAAC;EACtE,SAAS,OAAO;GACd,SAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC;GAC5C,WAAW;EACb;EACA,IAAI,aAAa,MACf,OAAO,KAA2B,EAAE,SAAS;GAAE,MAAM;GAAW,SAAS;EAAU,EAAE,CAAC;EACxF,oBAAoB,SAAS,QAAQ;EACrC,OAAO,KAA2B,EAChC,SAAS;GAAE,MAAM,SAAS;GAAM,SAAS,SAAS;EAAQ,EAC5D,CAAC;CACH,CACF;CAEA,eAAe,uBACb,SACA,SACkB;EAClB,MAAM,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,QAAQ,CAAC;EAC1E,IAAI,aAAa,MAAM;GACrB,IAAI,iBAAiB,OAAO,GAAG,MAAM,IAAI,kBAAkB;GAC3D,MAAM,IAAI,oBAAoB;EAChC;EACA,OAAO;CACT;CAkBA,OAAO;EAAE;EAAa,aAhBF,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,MAAM,cAAc;GAC7F,MAAM,WAAW,MAAM,uBAAuB,SAAS,MAAM,eAAe,CAAC;GAC7E,oBAAoB,SAAS,QAAQ;GACrC,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CAUgC;EAAG,oBATR,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAC/D,OAAO,EAAE,SAAS,MAAM,cAAc;GACpC,MAAM,WAAW,MAAM,uBAAuB,SAAS,QAAQ,OAAO;GACtE,oBAAoB,SAAS,QAAQ;GACrC,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CAEkD;CAAE;AACxD;;;;AC3GA,MAAMC,WAAS,aAAa,gBAAgB;AAG5C,MAAM,yBAAyB,EAC5B,MAAM,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAAE,CAAC,CAAC,CAAC,CAC1F,IAAI,CAAC;AAGR,SAAS,2BAA2B,OAAwC;CAC1E,IAAI,iBAAiB,EAAE,UAAU,OAAO,gBAAgB,QAAQ,KAAK;CACrE,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CACtC,IAAI;CACJ,IAAI;EACF,UAAU,KAAK,MAAM,MAAM,OAAO;CACpC,QAAQ;EACN,OAAO;CACT;CACA,MAAM,SAAS,uBAAuB,UAAU,OAAO;CACvD,OAAO,OAAO,UAAU,gBAAgB,WAAW,OAAO,IAAI,IAAI;AACpE;;;;;;AAOA,SAAgB,eACd,OACA,OACoD;CACpD,MAAM,UAAU,2BAA2B,KAAK,KAAK;CACrD,MAAM,WAAW,MAAM,QAAQ,OAAO;CACtC,IAAI,aAAa,MAAM;EACrB,SAAO,KAAK,iBAAiB;GAC3B,KAAK,SAAS,QAAQ;GACtB,QAAQ,SAAS;EACnB,CAAC;EACD,OAAO;CACT;CACA,MAAM,iBAAiB,mBAAmB,WAAW,QAAQ,iBAAiB;CAC9E,SAAO,MAAM,oBAAoB;EAAE,OAAO;EAAS;CAAe,CAAC;CACnE,OAAO,MAAM,SAAS,OAAO;AAC/B;;;;AC7CA,MAAM,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;;;;;AAM5D,SAAgB,iCAA0C,OAA4B;CACpF,OAAO,SAAS,oBAAoB,OAA0B;EAC5D,MAAM,EAAE,QAAQ,YAAY,eAAe,OAAO,KAAK;EACvD,MAAM,EAAE,MAAM,SAAS,GAAG,WAAW;EACrC,MAAM,OAAuB;GAC3B,MAAM;GACN,OAAO,gBAAgB,MAAM;GAC7B,QAAQ;GACR,GAAG;EACL;EACA,MAAM,UAAU,IAAI,QAAQ,EAAE,gBAAgB,2BAA2B,CAAC;EAC1E,MAAM,QAAQ,iBAAiB,UAAU,OAAO;EAChD,IAAI,MAAM,SAAS,QAAQ,IAAI,eAAe,OAAO,MAAM,KAAK,UAAU,CAAC;EAC3E,OAAO,SAAS,KAAK,MAAM;GAAE;GAAQ;EAAQ,CAAC;CAChD;AACF;;;;;;;;AClBA,eAAsB,yBAAyB,SAA2C;CAExF,MAAM,SAAS,MAAM,OAAO;CAC5B,MAAM,UAAU,CAAC,GAAG,aAAa,OAAO,kBAAkB,CAAC,CAAC,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;CACvF,MAAM,cAAc;EAClB,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ;CACV;CACA,KAAK,MAAM,UAAU,aAAa;EAEhC,MAAM,SAAS,QAAQ,QAAQ,SAAS,KAAK,WAAW,GAAG,OAAO,KAAK,EAAE,CAAC;EAC1E,KAAK,MAAM,wBAAQ,IAAI,IAAI,CAAC,OAAO,MAAM,GAAG,MAAM,CAAC,GACjD,OAAO,aAAa,MAAM,WAAW,OAAO,UAAU,CAAC;CAC3D;AACF;AAEA,SAAS,WAAW,YAA2D;CAE7E,MAAM,UAA+B;EACnC,MAAM,WAAW,QAAQ;EACzB,QAAQ,WAAW,UAAU;CAC/B;CACA,IAAI,WAAW,WAAW,QAAW,QAAQ,SAAS,WAAW;CACjE,OAAO;AACT;;;;;;;;AC7BA,SAAgB,4BAAqC,OAA4B;CAC/E,OAAO,SAAS,eAAe,OAAqD;EAClF,OAAO,eAAe,OAAO,KAAK,CAAC,CAAC;CACtC;AACF;;;;;;;;ACiBA,SAAgB,sBAA+B,SAA0C;CACvF,MAAM,iBAAiB,4BAA4B,QAAQ,MAAM;CACjE,MAAM,sBAAsB,iCAAiC,QAAQ,MAAM;CAE3E,eAAe,aAAa,SAAwC;EAClE,MAAM,EAAE,gBAAgB,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC;EACvD,MAAM,yBAAyB,WAAW;CAC5C;CAEA,eAAe,oBAAoB,OAAgB,SAAyC;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB;GACtC,MAAM,aAAa,OAAO;GAE1B,MAAM,SAAS,EAAE,MAAM,QAAQ,OAAO,CAAC;EACzC;EAEA,MAAM,eAAe,KAAK;CAC5B;CAGA,eAAe,iBAAiB,OAAgB,SAA4C;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB,MAAM,aAAa,OAAO;EAClE,OAAO,oBAAoB,KAAK;CAClC;CAsBA,OAAO;EAAE,yBApBuB,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACrE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,oBAAoB,OAAO,OAAO;GAC3C;EACF,CAa6B;EAAG,sBAVL,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OACjE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,iBAAiB,OAAO,OAAO;GACxC;EACF,CAGmD;EAAG;EAAgB;CAAoB;AAC9F;;;;AC3EA,MAAM,SAAS,aAAa,MAAM;;;;;;AAYlC,SAAgB,qBAAqB,UAAiC,CAAC,GAAG;CAExE,MAAM,UAAU,EAAE,kBAChB,gBAAgB;CAElB,MAAM,mBAAmB,EAAE,cAAoC;EAC7D,OAAO,KAAK,gBAAgB;GAC1B,KAAK,QAAQ;GACb,QAAQ,QAAQ,QAAQ,IAAI,QAAQ;GACpC,cAAc,QAAQ,QAAQ,IAAI,gBAAgB;GAClD,SAAS,QAAQ,QAAQ,IAAI,SAAS;EACxC,CAAC;EACD,OAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;CAClD;CACA,IAAI,QAAQ,WAAW,QAAW,OAAOC,uBAA6B;EAAE;EAAQ;CAAgB,CAAC;CACjG,OAAOA,uBAA6B;EAAE;EAAQ;EAAiB,QAAQ,QAAQ;CAAO,CAAC;AACzF;;;;;;;;;ACtBA,SAAgB,gCAAgC,YAAkD;CAChG,OAAO,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,cAAc,WAC7E,SACE,WAAW,OAAO,GAClB,aAAa,aAAa,QAC1B;EACE,sBAAsB,aAAa;EACnC,kBAAkB,aAAa;CACjC,SACM,KAAK,CACb,CACF;AACF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://www.schemastore.org/package.json",
   "name": "better-ship",
-  "version": "0.44.0",
+  "version": "0.46.0",
   "description": "Foundation for applications on Cloudflare Workers: logger, errors, message bus, infrastructure adapters, and UI primitives",
   "license": "Apache-2.0",
   "repository": {
@@ -52,6 +52,7 @@
     "./posthog/metrics": "./dist/posthog/metrics.js",
     "./posthog/proxy": "./dist/posthog/proxy.js",
     "./posthog/server": "./dist/posthog/server.js",
+    "./posthog/tanstack": "./dist/posthog/tanstack.js",
     "./resend": "./dist/resend.js",
     "./sentry/client": "./dist/sentry/client.js",
     "./sentry/server": "./dist/sentry/server.js",

package/src/infrastructure/posthog/request-session.ts

@@ -0,0 +1,14 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
+
+// One async scope per request keeps each browser session ID apart from concurrent requests.
+const storage = new AsyncLocalStorage<string>()
+
+/** Run the rest of one request with the browser's PostHog session ID. */
+export function runWithPostHogSession<T>(sessionId: string, work: () => T): T {
+  return storage.run(sessionId, work)
+}
+
+/** The current request's PostHog session ID, or undefined outside such a request. */
+export function currentPostHogSession(): string | undefined {
+  return storage.getStore()
+}

package/src/infrastructure/posthog/server.ts

@@ -10,6 +10,7 @@ import {
 } from '@/core'
 
 import { PostHogMetricsService } from './metrics.ts'
+import { currentPostHogSession } from './request-session.ts'
 
 // Fixed forever: changing it changes every derived UUID, so PostHog would keep a repeat.
 const EVENT_ID_NAMESPACE = '53d7af30-65cb-4176-b2c9-f1ed42367ab1'
@@ -98,7 +99,11 @@ export class PostHogAnalyticsService implements AnalyticsService {
     target: AnalyticsTarget,
     profile: 'person' | 'anonymous',
   ): void {
-    const properties = { ...eventProperties }
+    const sessionId = currentPostHogSession()
+    // An application's own `$session_id` wins over the request's.
+    const properties = sessionId
+      ? { $session_id: sessionId, ...eventProperties }
+      : { ...eventProperties }
     const payload: Parameters<PostHog['captureImmediate']>[0] = {
       distinctId: target.distinctId,
       event: name,

package/src/infrastructure/posthog/tanstack.ts

@@ -0,0 +1,19 @@
+import { createMiddleware } from '@tanstack/react-start'
+
+// posthog-js sends this header when the browser sets `tracing_headers` for the application host.
+const SESSION_HEADER = 'x-posthog-session-id'
+
+/**
+ * Link Worker events to the browser session that sent the request.
+ * Register it in `requestMiddleware`. Each `PostHogAnalyticsService` event in that request then
+ * gets `$session_id`. A request without the header, and queue, cron, and Workflow code, add nothing.
+ */
+export const posthogRequestMiddleware = createMiddleware({ type: 'request' }).server(
+  async ({ request, next }) => {
+    const sessionId = request.headers.get(SESSION_HEADER)?.trim()
+    if (!sessionId) return next()
+    // The browser evaluates this module, so the Node async scope loads inside `.server()`.
+    const { runWithPostHogSession } = await import('./request-session.ts')
+    return runWithPostHogSession(sessionId, () => next())
+  },
+)

package/src/infrastructure/tanstack/csrf.middleware.ts

@@ -0,0 +1,33 @@
+import { createCsrfMiddleware as createTanStackCsrfMiddleware } from '@tanstack/react-start'
+
+import { createLogger } from '@/core'
+
+const logger = createLogger('csrf')
+
+/** A public site origin that differs from the request URL. */
+export type CsrfMiddlewareOptions = {
+  readonly origin?: string
+}
+
+/**
+ * Refuse a server function call that does not come from this site.
+ * Register the result in `requestMiddleware`. A custom start instance replaces TanStack's default check.
+ * A refusal logs `csrf_refused` and returns HTTP 403. This function does not throw.
+ */
+export function createCsrfMiddleware(options: CsrfMiddlewareOptions = {}) {
+  // A page request has no same-origin proof. Start's own default check skips it too.
+  const filter = ({ handlerType }: { handlerType: 'serverFn' | 'router' }) =>
+    handlerType === 'serverFn'
+  // A refusal never reaches the error middleware, so this boundary logs what the check saw.
+  const failureResponse = ({ request }: { request: Request }) => {
+    logger.warn('csrf_refused', {
+      url: request.url,
+      origin: request.headers.get('Origin'),
+      secFetchSite: request.headers.get('Sec-Fetch-Site'),
+      referer: request.headers.get('Referer'),
+    })
+    return new Response('Forbidden', { status: 403 })
+  }
+  if (options.origin === undefined) return createTanStackCsrfMiddleware({ filter, failureResponse })
+  return createTanStackCsrfMiddleware({ filter, failureResponse, origin: options.origin })
+}

package/src/infrastructure/tanstack/index.ts

@@ -11,4 +11,5 @@ export {
   type AuthCookieSource,
   type ErrorMiddlewareOptions,
 } from './error.middleware.ts'
+export { createCsrfMiddleware, type CsrfMiddlewareOptions } from './csrf.middleware.ts'
 export { createFunctionTracingMiddleware } from './function-tracing.middleware.ts'