feat: rewrite around HttpOnly server sessions

Author: akosidencio

.DS_Store

@@ -0,0 +1,6 @@
+# The example apps carry their own eslint configs and their own node_modules.
+# Linting them from the library root fails on configs that aren't installed here.
+examples/
+
+dist/
+node_modules/

.eslintignore

@@ -1,4 +1,9 @@
 {
+    "root": true,
+    "ignorePatterns": [
+        "dist/",
+        "examples/"
+    ],
     "env": {
         "browser": true,
         "es2021": true,
@@ -7,6 +12,7 @@
     "extends": [
         "eslint:recommended",
         "plugin:react/recommended",
+        "plugin:react-hooks/recommended",
         "plugin:@typescript-eslint/recommended"
     ],
     "parser": "@typescript-eslint/parser",
@@ -19,6 +25,7 @@
     },
     "plugins": [
         "react",
+        "react-hooks",
         "@typescript-eslint"
     ],
     "settings": {

.eslintrc.json

@@ -2,35 +2,34 @@ name: CI
 on:
   push:
     branches:
+      # `main` must stay here: release.yml is gated on a successful CI run for
+      # main, so dropping it would leave releases unable to ever fire.
       - main
+      - dev
   pull_request:
 
 jobs:
-  lint:
+  verify:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v2
-        with:
-          version: 9
+      # No `version:` — action-setup reads the `packageManager` field in
+      # package.json, so CI cannot drift from the lockfile's pnpm major.
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: 22
           cache: 'pnpm'
       - run: pnpm install --frozen-lockfile
-      - run: pnpm lint
-      # - run: pnpm tsc --noEmit # Uncomment when strict mode is fully clean
 
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v2
-        with:
-          version: 9
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 18
-          cache: 'pnpm'
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm test
+      - name: Lint
+        run: pnpm lint
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Unit tests
+        run: pnpm test:unit
+
+      - name: Build
+        run: pnpm build

.github/workflows/ci.yml

@@ -1,6 +1,12 @@
 name: Release
+
+# Gated on CI. `needs:` only works inside a single workflow, so this waits for
+# the CI run on main to finish and refuses to publish unless it went green.
 on:
-  push:
+  workflow_run:
+    workflows: ['CI']
+    types:
+      - completed
     branches:
       - main
 
@@ -12,21 +18,24 @@ permissions:
 
 jobs:
   release:
+    if: github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: pnpm/action-setup@v2
-        with:
-          version: 9
+          ref: main
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: 22
           registry-url: 'https://registry.npmjs.org'
+          cache: 'pnpm'
       - run: pnpm install --frozen-lockfile
       - run: git config --global user.name "github-actions[bot]"
       - run: git config --global user.email "github-actions[bot]@users.noreply.github.com"
+      # `prepublishOnly` re-runs lint, typecheck, tests and build before the
+      # tarball is uploaded, so a broken tree cannot reach npm.
       - run: pnpm release-it --ci
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -1,4 +1,18 @@
-npm-debug.log
+# dependencies
 node_modules
+
+# build output
 build/*
 dist
+
+# caches
+.jest-cache
+*.tsbuildinfo
+
+# logs
+npm-debug.log
+yarn-error.log
+*.log
+
+# os / editor
+.DS_Store