feat: add TanStack Start integration

[drankou]

What this adds

@ory/tanstack-start — server helpers and request middleware for rendering @ory/elements-react in TanStack Start applications, plus a runnable example app (examples/tanstack-start).

• createOry(options) returns request-scoped server helpers: getLoginFlow, getRegistrationFlow, getRecoveryFlow, getVerificationFlow, getSettingsFlow, getLogoutFlow, getSession, getError, and getBrowserSdkUrl.
• createOryMiddleware(options) proxies Ory's browser endpoints (/self-service, /sessions/whoami, /ui, /.ory, /.well-known/ory) through the application origin so cookies stay first-party on cross-site setups — the same role as @ory/nextjs's middleware, implemented on standard Fetch Request/Response objects.

Design notes

• Feature parity with @ory/nextjs's App Router surface. Redirects are thrown TanStack redirect()s (303) so they serialize across the server-function boundary, and flow getters return Promise<Flow> rather than a nullable union.
• createServerFn wrappers stay in application source because the TanStack compiler transforms them there; the package exposes portable ({ request, params }) helpers instead. The README documents the pattern, including the /_serverFn authentication-gate pitfall.
• Configuration is explicit (sdkUrl, optional serverSdkUrl for a private Ory upstream, appUrl, projectApiToken) rather than env-var based, since TanStack Start has no NEXT_PUBLIC_ convention.
• getSession returns null only on 401 and rethrows other failures, so infrastructure errors don't render as logged-out users.
• Peer floors are TanStack Router 1.170.0 / Start 1.168.0 — the oldest release set the package's tests and build are verified against. The example pins an aged, soaked release set (1.170.18 / 1.168.32).

Testing

• 49 unit tests covering proxy behavior (header filtering, cookie domain rewriting, redirect and body URL rewriting, bodyless statuses), flow loading and expired-flow restarts, session/logout/error helpers; ~90% statement coverage. An api-extractor report is included and CI-checked.
• The example app typechecks and builds (Rsbuild + srvx). A Dockerfile mirrors the nextjs-app-router example's container recipe; the image was built and smoke-tested (SSR renders, static assets serve, /auth/login 303s into the Ory browser flow).

🤖 Generated with Claude Code

[vercel]

@drankou is attempting to deploy a commit to the ory Team on Vercel.

A member of the Team first needs to authorize it.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 23738d8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f67a6efa-735a-41d2-86af-9dd7cb63518b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 81.56028% with 52 lines in your changes missing coverage. Please review.
✅ Project coverage is 61.77%. Comparing base (f3fad4d) to head (23738d8).
⚠️ Report is 358 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main     #603       +/-   ##
===========================================
+ Coverage   42.43%   61.77%   +19.34%     
===========================================
  Files         136      190       +54     
  Lines        2008     4013     +2005     
  Branches      288      677      +389     
===========================================
+ Hits          852     2479     +1627     
- Misses       1149     1384      +235     
- Partials        7      150      +143     

Components	Coverage Δ
@ory/elements-react	60.06% <ø> (+23.27%)	⬆️
@ory/nextjs	61.51% <ø> (-4.47%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.