@molecule/app-auth 1.0.0

package/LICENSE

@@ -0,0 +1,115 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work.
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship.
+
+      "Contribution" shall mean any work of authorship, including the
+      original version of the Work and any modifications or additions
+      to that Work, that is intentionally submitted to the Licensor for
+      inclusion in the Work by the copyright owner or by an individual or
+      Legal Entity authorized to submit on behalf of the copyright owner.
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      patent license to make, have made, use, offer to sell, sell, import,
+      and otherwise transfer the Work.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.
+
+   8. Limitation of Liability. In no event and under no legal theory shall
+      any Contributor be liable to You for damages.
+
+   9. Accepting Warranty or Additional Liability.
+
+   Copyright 2026 Molecule Dev, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/client.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Auth client creation and management.
+ *
+ * Provides the JWT-based auth client implementation.
+ *
+ * @module
+ */
+import type { AuthClient, AuthClientConfig, UserProfile } from './types.js';
+/**
+ * Creates a simple JWT-based auth client.
+ *
+ * This is a basic implementation that can be extended or replaced
+ * with more sophisticated auth providers.
+ *
+ * @param config - Auth client configuration including endpoints, storage, and refresh settings.
+ * @returns A fully configured `AuthClient` instance.
+ */
+export declare const createJWTAuthClient: <T extends UserProfile = UserProfile>(config?: AuthClientConfig) => AuthClient<T>;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAShB,WAAW,EACZ,MAAM,YAAY,CAAA;AA6BnB;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,SAAS,WAAW,GAAG,WAAW,EACrE,SAAQ,gBAAqB,KAC5B,UAAU,CAAC,CAAC,CAmbd,CAAA"}

package/dist/client.js

@@ -0,0 +1,413 @@
+/**
+ * Auth client creation and management.
+ *
+ * Provides the JWT-based auth client implementation.
+ *
+ * @module
+ */
+import { I18nError } from '@molecule/app-i18n';
+import { getLogger } from '@molecule/app-logger';
+import { createTokenStorage, getTokenExpiration, isTokenExpired } from './token.js';
+/**
+ * Whether this app is running inside a CROSS-SITE iframe — i.e. the molecule.dev
+ * live preview (the app at `127.0.0.1:<port>` embedded in the `localhost:3000`
+ * IDE). This mirrors the server's cross-site-preview decision (see
+ * `@molecule/api-resource-user` `getAuthCookieOptions`): in that case the server
+ * issues the `mol_auth` hint as `Secure; SameSite=None; Partitioned`, and a
+ * Partitioned cookie can only be deleted by a Set-Cookie / `document.cookie`
+ * write that ALSO carries Partitioned. A top-level document (the IDE itself, a
+ * normally-deployed app, or local `vite dev`) sets a plain `Lax` hint that the
+ * bare deletion already matches — so we must NOT append the cross-site attrs
+ * there (they would target the wrong cookie jar and miss the real cookie).
+ *
+ * Comparing `window.self !== window.top` is reference-only, so it never throws
+ * on a cross-origin embed.
+ *
+ * @returns `true` when embedded in a (cross-site) iframe, `false` at top level.
+ */
+const isCrossSitePreviewFrame = () => {
+    try {
+        return typeof window !== 'undefined' && window.self !== window.top;
+    }
+    catch (_error) {
+        // A cross-origin frame can, in rare engines, throw on `window.top` access —
+        // if we can't tell, assume top-level (the safe default matching a Lax hint).
+        return false;
+    }
+};
+/**
+ * Creates a simple JWT-based auth client.
+ *
+ * This is a basic implementation that can be extended or replaced
+ * with more sophisticated auth providers.
+ *
+ * @param config - Auth client configuration including endpoints, storage, and refresh settings.
+ * @returns A fully configured `AuthClient` instance.
+ */
+export const createJWTAuthClient = (config = {}) => {
+    const { baseURL = '', loginEndpoint = '/auth/login', logoutEndpoint = '/users/logout', registerEndpoint = '/auth/register', refreshEndpoint = '/auth/refresh', profileEndpoint = '/auth/profile', forgotPasswordEndpoint = '/auth/password/reset', resetPasswordEndpoint = '/auth/password/reset/confirm', changePasswordEndpoint = '/auth/password/change', currentUserEndpoint = '/users/me', storagePrefix = 'molecule:auth:', storage = 'memory', autoRefresh = true, refreshBuffer = 60, } = config;
+    const logger = getLogger('auth');
+    const tokenStorage = createTokenStorage(storage, storagePrefix);
+    const stateListeners = new Set();
+    const eventListeners = new Set();
+    let refreshTimer = null;
+    let state = {
+        initialized: false,
+        authenticated: false,
+        user: null,
+        loading: false,
+        error: null,
+    };
+    const notify = () => {
+        stateListeners.forEach((callback) => callback(state));
+    };
+    const emitEvent = (event) => {
+        eventListeners.forEach((listener) => listener(event));
+    };
+    const setState = (updates) => {
+        state = { ...state, ...updates };
+        notify();
+    };
+    const scheduleRefresh = () => {
+        if (!autoRefresh)
+            return;
+        const token = tokenStorage.getAccessToken();
+        if (!token)
+            return;
+        const expiresAt = getTokenExpiration(token);
+        if (!expiresAt)
+            return;
+        const refreshTime = expiresAt - refreshBuffer * 1000 - Date.now();
+        if (refreshTime <= 0)
+            return;
+        if (refreshTimer) {
+            clearTimeout(refreshTimer);
+        }
+        refreshTimer = setTimeout(() => {
+            client.refresh().catch((err) => {
+                logger.warn('Token refresh failed, logging out', err);
+                client.logout();
+            });
+        }, refreshTime);
+    };
+    const fetchAPI = async (endpoint, options = {}) => {
+        const url = baseURL + endpoint;
+        const headers = {
+            'Content-Type': 'application/json',
+            ...options.headers,
+        };
+        const token = tokenStorage.getAccessToken();
+        if (token) {
+            headers['Authorization'] = `Bearer ${token}`;
+        }
+        // 'include' so httpOnly session cookies flow when the API is on another
+        // origin (fetch defaults to 'same-origin', which silently DROPS the login
+        // Set-Cookie cross-origin and breaks session restore). Safe both ways:
+        // same-origin behaves identically, and the fleet CORS bond pairs a strict
+        // origin allowlist with credentials:true. True cross-SITE deployments
+        // additionally need SameSite=None cookies — a server deployment concern.
+        const response = await fetch(url, {
+            credentials: 'include',
+            ...options,
+            headers,
+        });
+        if (!response.ok) {
+            const body = await response.json().catch(() => ({}));
+            const key = body.errorKey ?? 'auth.error.requestFailed';
+            const fallback = body.error ?? body.message ?? 'Request failed';
+            throw new I18nError(key, undefined, fallback);
+        }
+        const data = await response.json();
+        // Compatibility shim: many @molecule/api-resource-* handlers (notably
+        // the user resource) wrap the entity under `props` rather than `user`
+        // (the auth-client's expected shape). Surface either so login/register
+        // populate state correctly regardless of the API's wrapper convention.
+        if (data && typeof data === 'object' && data.user === undefined && data.props !== undefined) {
+            data.user = data.props;
+        }
+        return data;
+    };
+    // [M1-1] Session restore from the httpOnly cookie. The bearer token is held
+    // in memory (a localStorage copy is XSS-exfiltratable, so it is forbidden)
+    // and is therefore lost on a full page load — but the httpOnly session cookie
+    // persists. Probe the current-user endpoint with credentials; if the cookie
+    // is still valid the server returns the user, and we re-establish the
+    // authenticated session WITHOUT the token ever being exposed to JavaScript.
+    //
+    // GATE on the non-httpOnly `mol_auth` presence hint (set by the server
+    // alongside the httpOnly token): only probe when a session plausibly exists.
+    // Without this gate, every anonymous caller would fire a guaranteed-401
+    // request (extra API call + console error). A forged hint only costs one
+    // harmless 401.
+    //
+    // Shared by initialize() (reload/deep-link restore) and refresh() (see the
+    // no-refresh-token fallback there).
+    const restoreFromSessionCookie = async () => {
+        const hasSessionHint = typeof document !== 'undefined' && /(?:^|;\s*)mol_auth=1(?:;|$)/.test(document.cookie);
+        if (!hasSessionHint)
+            return null;
+        try {
+            const result = await fetchAPI(currentUserEndpoint, {
+                method: 'GET',
+                credentials: 'include',
+            });
+            const restoredUser = (result?.user ?? null);
+            if (restoredUser) {
+                tokenStorage.setUser(restoredUser);
+                setState({ authenticated: true, user: restoredUser });
+                return restoredUser;
+            }
+        }
+        catch (_error) {
+            // No valid session cookie (401) or no current-user endpoint — remain
+            // logged out. This is an expected path for anonymous visitors.
+        }
+        return null;
+    };
+    const client = {
+        getState: () => state,
+        isAuthenticated: () => state.authenticated,
+        getUser: () => state.user,
+        setUser: (user) => {
+            tokenStorage.setUser(user);
+            setState({ user });
+        },
+        getAccessToken: () => tokenStorage.getAccessToken(),
+        setAccessToken: (token) => {
+            tokenStorage.setAccessToken(token);
+        },
+        getRefreshToken: () => tokenStorage.getRefreshToken(),
+        async login(credentials) {
+            setState({ loading: true, error: null });
+            try {
+                const result = await fetchAPI(loginEndpoint, {
+                    method: 'POST',
+                    body: JSON.stringify(credentials),
+                });
+                // Two-factor gate: the server answered 206 `{ twoFactorRequired: true }`
+                // — no tokens/user issued. Surface the result WITHOUT marking the
+                // session authenticated; the caller re-prompts for the TOTP and retries.
+                if (result.twoFactorRequired) {
+                    setState({ loading: false });
+                    return result;
+                }
+                tokenStorage.setAccessToken(result.accessToken || null);
+                tokenStorage.setRefreshToken(result.refreshToken || null);
+                tokenStorage.setUser(result.user);
+                setState({
+                    loading: false,
+                    authenticated: true,
+                    user: result.user,
+                });
+                logger.debug('User logged in');
+                emitEvent({ type: 'login', user: result.user });
+                scheduleRefresh();
+                return result;
+            }
+            catch (err) {
+                const error = err instanceof Error ? err.message : 'Login failed';
+                setState({ loading: false, error });
+                emitEvent({ type: 'error', error });
+                throw err;
+            }
+        },
+        async logout() {
+            setState({ loading: true });
+            try {
+                // [M1-1] The persistent credential is the httpOnly session cookie, not
+                // the in-memory bearer token. The bearer does not survive a page reload
+                // (after a reload `initialize()` restores `authenticated` from the cookie
+                // but cannot repopulate the in-memory token), so guarding the server
+                // logout on `token` alone meant a reloaded session could never log out
+                // server-side and the httpOnly cookie lived on. Call the endpoint
+                // whenever we believe a session exists — token OR restored-authenticated —
+                // and send `credentials` so the cookie authenticates the device
+                // revocation and the server clears the httpOnly cookie.
+                const token = tokenStorage.getAccessToken();
+                if (logoutEndpoint && (token || state.authenticated)) {
+                    await fetchAPI(logoutEndpoint, { method: 'POST', credentials: 'include' }).catch((err) => {
+                        logger.debug('Logout endpoint call failed (non-critical)', err);
+                    });
+                }
+            }
+            finally {
+                if (refreshTimer) {
+                    clearTimeout(refreshTimer);
+                    refreshTimer = null;
+                }
+                tokenStorage.clear();
+                // [M1-1] Drop the non-httpOnly session-presence hint so initialize()
+                // won't probe for cookie-restore on the next load even if the server
+                // logout call didn't complete (the server clears it too, on success).
+                // The deletion must MATCH the attributes the server SET the hint with, or
+                // it targets the wrong cookie jar and the stale hint survives. Only the
+                // cross-site live-preview iframe issues `mol_auth` as `Secure;
+                // SameSite=None; Partitioned` (a Partitioned cookie can only be deleted by
+                // a write that ALSO carries Partitioned); a top-level document sets a plain
+                // `Lax` hint the bare deletion already matches.
+                if (typeof document !== 'undefined') {
+                    const previewAttrs = isCrossSitePreviewFrame()
+                        ? '; Secure; SameSite=None; Partitioned'
+                        : '';
+                    document.cookie = `mol_auth=; Max-Age=0; path=/${previewAttrs}`;
+                }
+                setState({
+                    loading: false,
+                    authenticated: false,
+                    user: null,
+                });
+                logger.debug('User logged out');
+                emitEvent({ type: 'logout' });
+            }
+        },
+        async register(data) {
+            setState({ loading: true, error: null });
+            try {
+                const result = await fetchAPI(registerEndpoint, {
+                    method: 'POST',
+                    body: JSON.stringify(data),
+                });
+                tokenStorage.setAccessToken(result.accessToken || null);
+                tokenStorage.setRefreshToken(result.refreshToken || null);
+                tokenStorage.setUser(result.user);
+                setState({
+                    loading: false,
+                    authenticated: true,
+                    user: result.user,
+                });
+                emitEvent({ type: 'register', user: result.user });
+                scheduleRefresh();
+                return result;
+            }
+            catch (err) {
+                const error = err instanceof Error ? err.message : 'Registration failed';
+                setState({ loading: false, error });
+                emitEvent({ type: 'error', error });
+                throw err;
+            }
+        },
+        async refresh() {
+            const refreshToken = tokenStorage.getRefreshToken();
+            if (!refreshToken) {
+                // Cookie-session APIs (the @molecule/api-resource-user model) issue NO
+                // refresh token at all — login/register return only { accessToken, user }
+                // and the durable credential is the httpOnly session cookie. For them,
+                // "refresh" means re-deriving the session from that cookie, exactly like
+                // initialize()'s restore. Without this fallback every post-auth refresh
+                // (the auth modal's finishAuth, the upgrade-tab focus-return) threw
+                // 'No refresh token available' — which silently aborted the modal's
+                // signup/login flow right after the account was created.
+                const restoredUser = await restoreFromSessionCookie();
+                if (restoredUser) {
+                    emitEvent({ type: 'refresh' });
+                    return { user: restoredUser };
+                }
+                throw new I18nError('auth.error.noRefreshToken', undefined, 'No refresh token available');
+            }
+            const result = await fetchAPI(refreshEndpoint, {
+                method: 'POST',
+                body: JSON.stringify({ refreshToken }),
+            });
+            tokenStorage.setAccessToken(result.accessToken || null);
+            if (result.refreshToken) {
+                tokenStorage.setRefreshToken(result.refreshToken);
+            }
+            tokenStorage.setUser(result.user);
+            setState({
+                authenticated: true,
+                user: result.user,
+            });
+            emitEvent({ type: 'refresh' });
+            scheduleRefresh();
+            return result;
+        },
+        async requestPasswordReset(data) {
+            await fetchAPI(forgotPasswordEndpoint, {
+                method: 'POST',
+                body: JSON.stringify(data),
+            });
+        },
+        async confirmPasswordReset(data) {
+            await fetchAPI(resetPasswordEndpoint, {
+                method: 'POST',
+                body: JSON.stringify(data),
+            });
+        },
+        async updateProfile(data) {
+            const result = await fetchAPI(profileEndpoint, {
+                method: 'PATCH',
+                body: JSON.stringify(data),
+            });
+            tokenStorage.setUser(result);
+            setState({ user: result });
+            return result;
+        },
+        async changePassword(oldPassword, newPassword) {
+            // Server handler (@molecule/api-resource-user `updatePassword`)
+            // reads `currentPassword`; legacy callers passed `oldPassword`,
+            // so accept either name in the hook signature but translate to
+            // the canonical `currentPassword` field when sending.
+            await fetchAPI(changePasswordEndpoint, {
+                method: 'POST',
+                body: JSON.stringify({ currentPassword: oldPassword, newPassword }),
+            });
+        },
+        async initialize() {
+            const token = tokenStorage.getAccessToken();
+            const user = tokenStorage.getUser();
+            if (token && user) {
+                if (!isTokenExpired(token)) {
+                    setState({
+                        initialized: true,
+                        authenticated: true,
+                        user,
+                    });
+                    scheduleRefresh();
+                    return;
+                }
+                // Token expired, try to refresh
+                const refreshToken = tokenStorage.getRefreshToken();
+                if (refreshToken) {
+                    try {
+                        await this.refresh();
+                        setState({ initialized: true });
+                        return;
+                    }
+                    catch (err) {
+                        logger.warn('Initial token refresh failed', err);
+                        tokenStorage.clear();
+                    }
+                }
+            }
+            // [M1-1] Cookie-restore — this is what keeps a refresh / deep-link logged
+            // in under the in-memory-token model. See restoreFromSessionCookie above.
+            await restoreFromSessionCookie();
+            setState({ initialized: true });
+        },
+        subscribe(callback) {
+            stateListeners.add(callback);
+            return () => stateListeners.delete(callback);
+        },
+        onAuthChange(callback) {
+            stateListeners.add(callback);
+            return () => stateListeners.delete(callback);
+        },
+        getToken() {
+            return tokenStorage.getAccessToken();
+        },
+        addEventListener(listener) {
+            eventListeners.add(listener);
+            return () => eventListeners.delete(listener);
+        },
+        destroy() {
+            if (refreshTimer) {
+                clearTimeout(refreshTimer);
+                refreshTimer = null;
+            }
+            stateListeners.clear();
+            eventListeners.clear();
+        },
+    };
+    return client;
+};
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEhD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAenF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,uBAAuB,GAAG,GAAY,EAAE;IAC5C,IAAI,CAAC;QACH,OAAO,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,CAAA;IACpE,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,4EAA4E;QAC5E,6EAA6E;QAC7E,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,SAA2B,EAAE,EACd,EAAE;IACjB,MAAM,EACJ,OAAO,GAAG,EAAE,EACZ,aAAa,GAAG,aAAa,EAC7B,cAAc,GAAG,eAAe,EAChC,gBAAgB,GAAG,gBAAgB,EACnC,eAAe,GAAG,eAAe,EACjC,eAAe,GAAG,eAAe,EACjC,sBAAsB,GAAG,sBAAsB,EAC/C,qBAAqB,GAAG,8BAA8B,EACtD,sBAAsB,GAAG,uBAAuB,EAChD,mBAAmB,GAAG,WAAW,EACjC,aAAa,GAAG,gBAAgB,EAChC,OAAO,GAAG,QAAQ,EAClB,WAAW,GAAG,IAAI,EAClB,aAAa,GAAG,EAAE,GACnB,GAAG,MAAM,CAAA;IAEV,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAChC,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAiC,CAAA;IAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqB,CAAA;IACnD,IAAI,YAAY,GAAyC,IAAI,CAAA;IAE7D,IAAI,KAAK,GAAiB;QACxB,WAAW,EAAE,KAAK;QAClB,aAAa,EAAE,KAAK;QACpB,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,IAAI;KACZ,CAAA;IAED,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,KAAgB,EAAQ,EAAE;QAC3C,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,CAAC,OAA8B,EAAQ,EAAE;QACxD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,CAAA;QAChC,MAAM,EAAE,CAAA;IACV,CAAC,CAAA;IAED,MAAM,eAAe,GAAG,GAAS,EAAE;QACjC,IAAI,CAAC,WAAW;YAAE,OAAM;QAExB,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAA;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAM;QAElB,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,CAAC,SAAS;YAAE,OAAM;QAEtB,MAAM,WAAW,GAAG,SAAS,GAAG,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACjE,IAAI,WAAW,IAAI,CAAC;YAAE,OAAM;QAE5B,IAAI,YAAY,EAAE,CAAC;YACjB,YAAY,CAAC,YAAY,CAAC,CAAA;QAC5B,CAAC;QAED,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC7B,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAA;gBACrD,MAAM,CAAC,MAAM,EAAE,CAAA;YACjB,CAAC,CAAC,CAAA;QACJ,CAAC,EAAE,WAAW,CAAC,CAAA;IACjB,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,KAAK,EAAK,QAAgB,EAAE,UAAuB,EAAE,EAAc,EAAE;QACpF,MAAM,GAAG,GAAG,OAAO,GAAG,QAAQ,CAAA;QAC9B,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,GAAI,OAAO,CAAC,OAAkC;SAC/C,CAAA;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAA;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAA;QAC9C,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,WAAW,EAAE,SAAS;YACtB,GAAG,OAAO;YACV,OAAO;SACR,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YACpD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,0BAA0B,CAAA;YACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAA;YAC/D,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC/C,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5F,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,EAAE;IACF,uEAAuE;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,gBAAgB;IAChB,EAAE;IACF,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,wBAAwB,GAAG,KAAK,IAAuB,EAAE;QAC7D,MAAM,cAAc,GAClB,OAAO,QAAQ,KAAK,WAAW,IAAI,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACxF,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAe,mBAAmB,EAAE;gBAC/D,MAAM,EAAE,KAAK;gBACb,WAAW,EAAE,SAAS;aACvB,CAAC,CAAA;YACF,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAa,CAAA;YACvD,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBAClC,QAAQ,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAA;gBACrD,OAAO,YAAY,CAAA;YACrB,CAAC;QACH,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,qEAAqE;YACrE,+DAA+D;QACjE,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,MAAM,GAAkB;QAC5B,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;QAErB,eAAe,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa;QAE1C,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI;QAEzB,OAAO,EAAE,CAAC,IAAc,EAAE,EAAE;YAC1B,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC1B,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACpB,CAAC;QAED,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE;QAEnD,cAAc,EAAE,CAAC,KAAoB,EAAE,EAAE;YACvC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QACpC,CAAC;QAED,eAAe,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE;QAErD,KAAK,CAAC,KAAK,CAAC,WAA6B;YACvC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAExC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAgB,aAAa,EAAE;oBAC1D,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;iBAClC,CAAC,CAAA;gBAEF,yEAAyE;gBACzE,kEAAkE;gBAClE,yEAAyE;gBACzE,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBAC7B,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;oBAC5B,OAAO,MAAM,CAAA;gBACf,CAAC;gBAED,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;gBACvD,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,CAAA;gBACzD,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAEjC,QAAQ,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE,IAAI;oBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAA;gBAEF,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;gBAC9B,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC/C,eAAe,EAAE,CAAA;gBAEjB,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAA;gBACjE,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM;YACV,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YAE3B,IAAI,CAAC;gBACH,uEAAuE;gBACvE,wEAAwE;gBACxE,0EAA0E;gBAC1E,qEAAqE;gBACrE,uEAAuE;gBACvE,kEAAkE;gBAClE,2EAA2E;gBAC3E,gEAAgE;gBAChE,wDAAwD;gBACxD,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAA;gBAC3C,IAAI,cAAc,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;oBACrD,MAAM,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAC9E,CAAC,GAAG,EAAE,EAAE;wBACN,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAA;oBACjE,CAAC,CACF,CAAA;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,IAAI,YAAY,EAAE,CAAC;oBACjB,YAAY,CAAC,YAAY,CAAC,CAAA;oBAC1B,YAAY,GAAG,IAAI,CAAA;gBACrB,CAAC;gBAED,YAAY,CAAC,KAAK,EAAE,CAAA;gBACpB,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,0EAA0E;gBAC1E,wEAAwE;gBACxE,+DAA+D;gBAC/D,2EAA2E;gBAC3E,4EAA4E;gBAC5E,gDAAgD;gBAChD,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACpC,MAAM,YAAY,GAAG,uBAAuB,EAAE;wBAC5C,CAAC,CAAC,sCAAsC;wBACxC,CAAC,CAAC,EAAE,CAAA;oBACN,QAAQ,CAAC,MAAM,GAAG,+BAA+B,YAAY,EAAE,CAAA;gBACjE,CAAC;gBACD,QAAQ,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE,KAAK;oBACpB,IAAI,EAAE,IAAI;iBACX,CAAC,CAAA;gBACF,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;gBAC/B,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAkB;YAC/B,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAExC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAgB,gBAAgB,EAAE;oBAC7D,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC3B,CAAC,CAAA;gBAEF,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;gBACvD,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,CAAA;gBACzD,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAEjC,QAAQ,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE,IAAI;oBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAA;gBAEF,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;gBAClD,eAAe,EAAE,CAAA;gBAEjB,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAA;gBACxE,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO;YACX,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,EAAE,CAAA;YACnD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,uEAAuE;gBACvE,0EAA0E;gBAC1E,uEAAuE;gBACvE,yEAAyE;gBACzE,wEAAwE;gBACxE,oEAAoE;gBACpE,oEAAoE;gBACpE,yDAAyD;gBACzD,MAAM,YAAY,GAAG,MAAM,wBAAwB,EAAE,CAAA;gBACrD,IAAI,YAAY,EAAE,CAAC;oBACjB,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;oBAC9B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;gBAC/B,CAAC;gBACD,MAAM,IAAI,SAAS,CAAC,2BAA2B,EAAE,SAAS,EAAE,4BAA4B,CAAC,CAAA;YAC3F,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAgB,eAAe,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;aACvC,CAAC,CAAA;YAEF,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;YACvD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxB,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YACnD,CAAC;YACD,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAEjC,QAAQ,CAAC;gBACP,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAA;YAEF,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;YAC9B,eAAe,EAAE,CAAA;YAEjB,OAAO,MAAM,CAAA;QACf,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,IAA0B;YACnD,MAAM,QAAQ,CAAC,sBAAsB,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,IAA0B;YACnD,MAAM,QAAQ,CAAC,qBAAqB,EAAE;gBACpC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,IAAgB;YAClC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAI,eAAe,EAAE;gBAChD,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAA;YAEF,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YAC5B,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YAE1B,OAAO,MAAM,CAAA;QACf,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,WAAmB;YAC3D,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,sDAAsD;YACtD,MAAM,QAAQ,CAAC,sBAAsB,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;aACpE,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,UAAU;YACd,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAA;YAC3C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAK,CAAA;YAEtC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC3B,QAAQ,CAAC;wBACP,WAAW,EAAE,IAAI;wBACjB,aAAa,EAAE,IAAI;wBACnB,IAAI;qBACL,CAAC,CAAA;oBACF,eAAe,EAAE,CAAA;oBACjB,OAAM;gBACR,CAAC;gBAED,gCAAgC;gBAChC,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,EAAE,CAAA;gBACnD,IAAI,YAAY,EAAE,CAAC;oBACjB,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;wBACpB,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;wBAC/B,OAAM;oBACR,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;wBAChD,YAAY,CAAC,KAAK,EAAE,CAAA;oBACtB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,wBAAwB,EAAE,CAAA;YAChC,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QACjC,CAAC;QAED,SAAS,CAAC,QAAuC;YAC/C,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5B,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QAED,YAAY,CAAC,QAAuC;YAClD,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5B,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QAED,QAAQ;YACN,OAAO,YAAY,CAAC,cAAc,EAAE,CAAA;QACtC,CAAC;QAED,gBAAgB,CAAC,QAA2B;YAC1C,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5B,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QAED,OAAO;YACL,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,YAAY,CAAC,CAAA;gBAC1B,YAAY,GAAG,IAAI,CAAA;YACrB,CAAC;YACD,cAAc,CAAC,KAAK,EAAE,CAAA;YACtB,cAAc,CAAC,KAAK,EAAE,CAAA;QACxB,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Client-side authentication interface for molecule.dev.
+ *
+ * Provides a unified auth API that works across different auth strategies
+ * (JWT, session, OAuth, etc.): `createJWTAuthClient` builds a fetch-based
+ * client; `setClient`/`getClient` bond it; `login`/`logout`/`register`/
+ * `isAuthenticated`/`getUser` delegate to the bonded client. Framework
+ * bindings (e.g. `AuthProvider`/`useAuth` in `@molecule/app-react`) wrap the
+ * same client.
+ *
+ * @remarks
+ * - **A page reload "logging the user out" is the config default, not a bug.**
+ *   Token storage defaults to `'memory'` (the secure default — a localStorage
+ *   bearer token is XSS-exfiltratable). Staying signed in across reloads works
+ *   by calling `client.initialize()` once at startup: it re-fetches
+ *   `currentUserEndpoint` (default `/users/me`) with the httpOnly cookie the
+ *   API set at login. Wire `initialize()`; do NOT "fix" reload-logout by
+ *   copying tokens into localStorage.
+ * - **Endpoint defaults must match your API's real routes** (`/auth/login`,
+ *   `/auth/register`, `/auth/refresh`, `/users/logout`, `/users/me`, …).
+ *   Align them via `createJWTAuthClient({ baseURL, ...endpoints })` — never by
+ *   hand-editing fetch calls in components.
+ * - Client-side auth state is UX only — the server enforces authorization on
+ *   every request; hiding a screen is not protection.
+ *
+ * @example
+ * ```typescript
+ * import { createJWTAuthClient, setClient } from '@molecule/app-auth'
+ *
+ * const client = createJWTAuthClient({ baseURL: '/api' })
+ * setClient(client)
+ * await client.initialize() // restore the session from the httpOnly cookie
+ *
+ * // anywhere in the app
+ * import { getUser, isAuthenticated, login, logout } from '@molecule/app-auth'
+ * await login({ email, password })
+ * if (isAuthenticated()) console.log(getUser()?.email)
+ * ```
+ *
+ * @e2e
+ * Integration checklist — drive the real UI (live preview, no mocks), adapt
+ * each item to this app's actual screens/flows, and check every box off one
+ * by one. A box you can't check is an integration bug to fix — not a skip:
+ * - [ ] Logging in with VALID credentials on the real login screen resolves
+ *   `login()` and flips AuthState to `authenticated: true` with `getUser()`
+ *   returning the actual UserProfile — the UI shows that user's own `email` /
+ *   `name` / `avatar`, never a placeholder or a different account.
+ * - [ ] A WRONG password shows a visible error (AuthState `error` is set and
+ *   the promise rejects) and establishes NO session: `isAuthenticated()` stays
+ *   false and no protected screen becomes reachable.
+ * - [ ] Registering through the sign-up form calls `register()`, creates the
+ *   account, and lands authenticated (`authenticated: true`, `user` populated)
+ *   on the app's post-signup screen — not back on the login form. If the flow
+ *   shows an email-verification / "check your inbox" step, it must be genuinely
+ *   backed (this client's `register()` returns an authenticated session
+ *   directly and exposes no verify method) — never a dead screen the auth
+ *   contract cannot advance past.
+ * - [ ] Logout calls `logout()` and clears the session (`authenticated: false`,
+ *   `user: null`, tokens cleared); afterward every protected screen redirects
+ *   back to login.
+ * - [ ] Visiting a protected route while logged OUT redirects to login (the
+ *   guard reads `isAuthenticated()`), and after authenticating you land back on
+ *   the originally-requested screen rather than a generic home.
+ * - [ ] The session survives a FULL page reload: after login, hard-reload →
+ *   `initialize()` restores it from the httpOnly cookie (via
+ *   `currentUserEndpoint`, default `/users/me`) and you stay signed in — you are
+ *   NOT bounced to login. (The in-memory bearer token is dropped by design; the
+ *   cookie restore is what keeps you in — do not "fix" this by writing the token
+ *   to localStorage.)
+ * - [ ] Password reset round-trips: `requestPasswordReset({ email })` then
+ *   `confirmPasswordReset({ token, password })` with the emailed token, after
+ *   which `login()` with the NEW password succeeds and the OLD password no
+ *   longer works.
+ * - [ ] Authorization holds: a signed-in user only ever reads/edits their OWN
+ *   record (`getUser()` is the caller's profile, never another user's); the
+ *   bearer token lives in memory only — it is never written to
+ *   localStorage / sessionStorage where another script could read it; and an
+ *   expired/invalid token fails closed — the app re-authenticates (`refresh()`
+ *   or `logout()`), never silently serving another user's data.
+ *
+ * @module
+ */
+export * from './client.js';
+export * from './provider.js';
+export * from './token.js';
+export * from './types.js';
+export * from './utilities.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAEH,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}