@molecule/app-auth 1.2.1 → 1.3.0

package/README.md

@@ -3,15 +3,11 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-10-16T00:48:55.816Z
+Generated: 2026-10-17T00:26:05.724Z
 -->
 
 # @molecule/app-auth
 
-> **Auto-generated, AI-first package reference** for the [molecule.dev](https://molecule.dev) ecosystem.
-> It is written to be read by coding agents as much as by people, and is generated from this
-> package's source — edit `src/index.ts` JSDoc, not this file.
-
 Client-side authentication interface for molecule.dev.
 
 Provides a unified auth API that works across different auth strategies
@@ -21,6 +17,10 @@ client; `setClient`/`getClient` bond it; `login`/`logout`/`register`/
 bindings (e.g. `AuthProvider`/`useAuth` in `@molecule/app-react`) wrap the
 same client.
 
+> **Auto-generated, AI-first package reference** for the [molecule.dev](https://molecule.dev) ecosystem.
+> It is written to be read by coding agents as much as by people, and is generated from this
+> package's source — edit `src/index.ts` JSDoc, not this file.
+
 ## Quick Start
 
 ```typescript
@@ -50,6 +50,30 @@ npm install @molecule/app-auth @molecule/app-bond @molecule/app-i18n @molecule/a
 
 ### Interfaces
 
+#### `BrowserStorageAdapterOptions`
+
+How {@link createBrowserStorageAdapter} picks the store it writes to.
+
+```typescript
+interface BrowserStorageAdapterOptions {
+  /**
+   * The Web Storage area to persist to (default `'local'`).
+   *
+   * `'session'` is the narrower choice: a reload keeps the session, closing the
+   * tab ends it. Pick it when the app only has to survive navigations within one
+   * session — which is all a `page.reload()` asks for.
+   */
+  kind?: BrowserStorageKind
+  /**
+   * A store to use instead of resolving `window.localStorage` /
+   * `window.sessionStorage` (a test double, a namespaced wrapper, or the
+   * `Storage` object another library exposes). Anything with `getItem`/
+   * `setItem`/`removeItem` does.
+   */
+  storage?: StorageAdapter
+}
+```
+
 #### `UserProfile`
 
 User profile information.
@@ -342,6 +366,28 @@ interface AuthClient<T = UserProfile> {
    */
   initialize(): Promise<void>
 
+  /**
+   * Resolves when the session restore started by `initialize()` has settled — the point
+   * after which the client knows whether this visitor is signed in.
+   *
+   * Resolves IMMEDIATELY when no restore is in flight: before `initialize()` is ever
+   * called, and after it has finished. A restore that failed resolves too (it settled the
+   * question), so an HTTP client can await this before every request without risking one
+   * held forever. That is what makes the fetch-before-restore race impossible: a page that
+   * fetches viewer-dependent data on mount waits here instead of going out anonymously
+   * (see `setAuthGate` in `@molecule/app-http`).
+   *
+   * Optional: a provider that restores no session has nothing to wait for. Without it, an
+   * HTTP client bonded to that provider sends first-paint requests unauthenticated.
+   *
+   * A provider whose restore sends a request THROUGH the gated HTTP client must send that
+   * request with `skipAuthGate: true` (`RequestConfig` in `@molecule/app-http`): the gate
+   * waits on this promise, so holding the restore's own request makes the gate wait on
+   * itself and stalls every request it holds until it times out. `createJWTAuthClient`'s
+   * restore does not need it — it uses `fetch`, not the bonded client.
+   */
+  whenRestored?(): Promise<void>
+
   /**
    * Subscribes to auth state changes.
    */
@@ -421,10 +467,10 @@ interface AuthClientConfig {
 
   /**
    * Current-user endpoint for session restore (default `/users/me`). Called by
-   * `initialize()` with credentials to re-establish the session from the
-   * httpOnly cookie after a full page load — the only way to stay logged in when
-   * the bearer token is held in memory (the secure default; a localStorage copy
-   * is XSS-exfiltratable). Must return the user (as `user` or `props`).
+   * `initialize()` with credentials to re-establish the session after a full page
+   * load when the token did not survive the reload itself — i.e. when `storage` is
+   * `'memory'` and the API sets an httpOnly session cookie. Must return the user
+   * (as `user` or `props`).
    */
   currentUserEndpoint?: string
 
@@ -460,23 +506,35 @@ interface AuthClientConfig {
   mapAuthResponse?: (data: unknown) => AuthResult<UserProfile>
 
   /**
-   * Token storage type or custom storage adapter.
-   * - 'memory': In-memory storage (lost on page refresh)
-   * - StorageAdapter: Custom storage implementation (e.g., from `@molecule/app-storage`)
+   * Where the access/refresh token and the cached user are kept — the field that
+   * decides whether a page reload keeps the user signed in.
+   *
+   * - `'memory'` (the client's default): a process-local store, lost on reload.
+   *   Correct when the API sets an httpOnly session cookie, which `initialize()`
+   *   then restores through {@link AuthClientConfig.currentUserEndpoint} — the
+   *   strongest configuration, because no script can read the cookie.
+   * - a `StorageAdapter`: the token survives the reload itself. The browser
+   *   adapter is `createBrowserStorageAdapter()` (from `@molecule/app-auth`), and it
+   *   is what the scaffold's `authConfig` passes. A bearer token in Web Storage is
+   *   readable by any script on the origin, so an XSS can steal it; see that
+   *   function's `@remarks` for the trade and for the cookie alternative.
+   *
+   * Any adapter with `getItem`/`setItem`/`removeItem` works — the methods are
+   * SYNCHRONOUS, so the async `@molecule/app-storage` provider
+   * (`getProvider()`, whose `get()` returns a Promise) is NOT one: wrap the
+   * `Storage` object it was built on (`createBrowserStorageAdapter({ storage })`),
+   * or store a different way.
    *
    * @example
    * ```typescript
-   * // Use in-memory storage
-   * storage: 'memory'
+   * import { createBrowserStorageAdapter } from '@molecule/app-auth'
    *
-   * // Use custom storage from `@molecule/app-storage`
-   * import { getProvider } from '@molecule/app-storage'
-   * const storageProvider = getProvider()
-   * storage: {
-   *   getItem: (key) => storageProvider.get(key),
-   *   setItem: (key, value) => storageProvider.set(key, value),
-   *   removeItem: (key) => storageProvider.remove(key),
-   * }
+   * // A reload keeps the session (the scaffold's own default):
+   * storage: createBrowserStorageAdapter()
+   * // Only this tab's lifetime, at a narrower exposure than localStorage:
+   * storage: createBrowserStorageAdapter({ kind: 'session' })
+   * // An httpOnly cookie session instead — memory only, the stronger route:
+   * storage: 'memory'
    * ```
    */
   storage?: 'memory' | StorageAdapter
@@ -552,6 +610,16 @@ interface TokenStorage {
 
 ### Types
 
+#### `BrowserStorageKind`
+
+Which Web Storage area {@link createBrowserStorageAdapter} persists to:
+`'local'` is `window.localStorage` (survives a reload AND the tab closing),
+`'session'` is `window.sessionStorage` (survives a reload, dies with the tab).
+
+```typescript
+type BrowserStorageKind = 'local' | 'session'
+```
+
 #### `AuthEvent`
 
 Auth event types.
@@ -575,6 +643,41 @@ type AuthEventListener = (event: AuthEvent) => void
 
 ### Functions
 
+#### `createBrowserStorageAdapter(options)`
+
+The auth client's `StorageAdapter` over the browser's Web Storage.
+
+Pass it as `AuthClientConfig.storage` to keep the session across a page reload:
+the client's default (`'memory'`) is lost on reload, and re-establishing the
+session then needs a credential that survived — this adapter, or an httpOnly
+session cookie the API sets (see the security note below).
+
+```ts
+import { createJWTAuthClient, createBrowserStorageAdapter } from '@molecule/app-auth'
+
+const authClient = createJWTAuthClient({
+  baseURL: '/api',
+  storage: createBrowserStorageAdapter(), // a reload keeps the user signed in
+})
+```
+
+The scaffold's `authConfig` already passes it, so a scaffolded app survives a
+reload out of the box; each of these replaces that default:
+
+```ts
+storage: 'memory' // memory only: pair it with an httpOnly cookie session
+storage: createBrowserStorageAdapter({ kind: 'session' }) // survives a reload, dies with the tab
+storage: { getItem: (k) => …, setItem: (k, v) => …, removeItem: (k) => … } // your own
+```
+
+```typescript
+function createBrowserStorageAdapter(options?: BrowserStorageAdapterOptions): StorageAdapter
+```
+
+- `options` — Which Web Storage area to use, or a store to use directly.
+
+**Returns:** A synchronous `StorageAdapter` bound to that store.
+
 #### `createJWTAuthClient(config)`
 
 Creates a simple JWT-based auth client.
@@ -627,7 +730,7 @@ Creates a token storage implementation backed by either in-memory
 storage or a custom `StorageAdapter`.
 
 ```typescript
-function createTokenStorage(storage?: 'memory' | StorageAdapter, prefix?: string): TokenStorage
+function createTokenStorage(storage?: StorageAdapter | 'memory', prefix?: string): TokenStorage
 ```
 
 - `storage` — `'memory'` for in-memory storage (lost on refresh), or a `StorageAdapter` for persistent storage.
@@ -746,19 +849,43 @@ Peer dependencies:
 - **An API with its own auth envelope keeps this client.** `requestBody` wraps the
   login/register payload (`(kind, p) => ({ user: p })`), `mapAuthResponse` reads the
   token and user out of the answer (`(d) => ({ accessToken: d.user.token, user: d.user })`),
-  and `authScheme: 'Token'` sends `Authorization: Token <jwt>`. Do not hand-write an
-  auth client for a spec like RealWorld.
-- **A page reload "logging the user out" is the config default, not a bug.**
-  Token storage defaults to `'memory'` (the secure default — a localStorage
-  bearer token is XSS-exfiltratable). Staying signed in across reloads works
-  by calling `client.initialize()` once at startup: it re-fetches
-  `currentUserEndpoint` (default `/users/me`) with the httpOnly cookie the
-  API set at login. Wire `initialize()`; do NOT "fix" reload-logout by
-  copying tokens into localStorage.
+  and `authScheme: 'Token'` sends `Authorization: Token <jwt>` — both are fields of the
+  `AuthClientConfig` the client is CONSTRUCTED with
+  (`setClient(createJWTAuthClient({ authScheme: 'Token', … }))` in the auth bond), not
+  properties of a client that already exists. Do not hand-write an auth client for a spec
+  like RealWorld.
+- **Whether a reload keeps the user signed in is `AuthClientConfig.storage`,
+  and one of the two routes must be wired.** The client's own default is
+  `'memory'`, which is lost on reload, so a session survives one only by
+  having a credential that survived: (1) `storage: createBrowserStorageAdapter()`
+  — the browser's `localStorage`, what a scaffolded app's `authConfig` passes
+  (see `@molecule/app-auth`'s `createBrowserStorageAdapter` for the trade: Web
+  Storage is script-readable, so an XSS can steal the token), or (2) an
+  httpOnly session cookie the API sets at login, which `initialize()` restores
+  through `currentUserEndpoint` (default `/users/me`) — the stronger option
+  wherever the API supports it, and what `@molecule/api-resource-user` issues.
+  Wire `initialize()` once at startup either way. Do NOT hand-roll a token
+  store beside the client for this: it is a config field.
 - **Endpoint defaults must match your API's real routes** (`/auth/login`,
   `/auth/register`, `/auth/refresh`, `/users/logout`, `/users/me`, …).
   Align them via `createJWTAuthClient({ baseURL, ...endpoints })` — never by
   hand-editing fetch calls in components.
+- **Do not fetch viewer-dependent data before the restore settles.** A component
+  effect that runs on mount fires while `initialize()` is still restoring, so its
+  request leaves without the `Authorization` header and the server answers for an
+  anonymous viewer — a followed user renders "Follow", a saved item renders unsaved.
+  On localhost the restore usually wins this race; over the network it does not, so
+  the bug appears only on the deployed URL. Two ways out: gate the fetch on the auth
+  state being settled (`state.initialized`), or let the HTTP client do it — bond the
+  auth client through `@molecule/app-bonds-default-react`, which registers
+  `whenRestored()` as the http gate so every request waits for the restore.
+- **Your own session store's gate must exempt its restore's own request.** This client
+  restores with `fetch`, so the gate registered over it never holds the restore. A store
+  that restores THROUGH the bonded HTTP client and registers that restore as the gate
+  (`setAuthGate(() => store.whenSettled())`) waits on itself unless the restore's request
+  passes `skipAuthGate: true` — otherwise the gate holds the very request it is waiting
+  for, and every request it holds stalls until the gate times out. See
+  `RequestConfig.skipAuthGate` in `@molecule/app-http`.
 - Client-side auth state is UX only — the server enforces authorization on
   every request; hiding a screen is not protection.
 
@@ -788,22 +915,27 @@ by one. A box you can't check is an integration bug to fix — not a skip:
 - [ ] Visiting a protected route while logged OUT redirects to login (the
       guard reads `isAuthenticated()`), and after authenticating you land back on
       the originally-requested screen rather than a generic home.
-- [ ] The session survives a FULL page reload: after login, hard-reload →
-      `initialize()` restores it from the httpOnly cookie (via
-      `currentUserEndpoint`, default `/users/me`) and you stay signed in — you are
-      NOT bounced to login. (The in-memory bearer token is dropped by design; the
-      cookie restore is what keeps you in — do not "fix" this by writing the token
-      to localStorage.)
+- [ ] The session survives a FULL page reload: after login, hard-reload → you
+      stay signed in (the profile/sign-out UI a signed-in visitor sees is still
+      there), and you are NOT bounced to login. Which route does it is the app's
+      `AuthClientConfig.storage`: the scaffold's `createBrowserStorageAdapter()` keeps
+      the token in the browser, an httpOnly session cookie is restored by
+      `initialize()` through `currentUserEndpoint` (default `/users/me`). If the
+      app has neither — `storage` left at `'memory'` against an API that sets no
+      cookie — this box cannot be checked, and the fix is the config, not a token
+      store written beside the client.
 - [ ] Password reset round-trips: `requestPasswordReset({ email })` then
       `confirmPasswordReset({ token, password })` with the emailed token, after
       which `login()` with the NEW password succeeds and the OLD password no
       longer works.
 - [ ] Authorization holds: a signed-in user only ever reads/edits their OWN
       record (`getUser()` is the caller's profile, never another user's); the
-      bearer token lives in memory only — it is never written to
-      localStorage / sessionStorage where another script could read it; and an
-      expired/invalid token fails closed — the app re-authenticates (`refresh()`
-      or `logout()`), never silently serving another user's data.
+      token's storage is the deliberate choice `AuthClientConfig.storage` names —
+      if it is Web Storage (the scaffold default, which a reload requires when the
+      API sets no cookie), say so in the app's own words rather than leaving a
+      second, undocumented store beside it; and an expired/invalid token fails
+      closed — the app re-authenticates (`refresh()` or `logout()`), never
+      silently serving another user's data.
 
 ## Translations
 

package/dist/browser-storage.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The browser `StorageAdapter` for the auth client's token storage.
+ *
+ * @module
+ */
+import type { StorageAdapter } from './types.js';
+/**
+ * Which Web Storage area {@link createBrowserStorageAdapter} persists to:
+ * `'local'` is `window.localStorage` (survives a reload AND the tab closing),
+ * `'session'` is `window.sessionStorage` (survives a reload, dies with the tab).
+ */
+export type BrowserStorageKind = 'local' | 'session';
+/** How {@link createBrowserStorageAdapter} picks the store it writes to. */
+export interface BrowserStorageAdapterOptions {
+    /**
+     * The Web Storage area to persist to (default `'local'`).
+     *
+     * `'session'` is the narrower choice: a reload keeps the session, closing the
+     * tab ends it. Pick it when the app only has to survive navigations within one
+     * session — which is all a `page.reload()` asks for.
+     */
+    kind?: BrowserStorageKind;
+    /**
+     * A store to use instead of resolving `window.localStorage` /
+     * `window.sessionStorage` (a test double, a namespaced wrapper, or the
+     * `Storage` object another library exposes). Anything with `getItem`/
+     * `setItem`/`removeItem` does.
+     */
+    storage?: StorageAdapter;
+}
+/**
+ * The auth client's `StorageAdapter` over the browser's Web Storage.
+ *
+ * Pass it as `AuthClientConfig.storage` to keep the session across a page reload:
+ * the client's default (`'memory'`) is lost on reload, and re-establishing the
+ * session then needs a credential that survived — this adapter, or an httpOnly
+ * session cookie the API sets (see the security note below).
+ *
+ * ```ts
+ * import { createJWTAuthClient, createBrowserStorageAdapter } from '@molecule/app-auth'
+ *
+ * const authClient = createJWTAuthClient({
+ *   baseURL: '/api',
+ *   storage: createBrowserStorageAdapter(), // a reload keeps the user signed in
+ * })
+ * ```
+ *
+ * The scaffold's `authConfig` already passes it, so a scaffolded app survives a
+ * reload out of the box; each of these replaces that default:
+ *
+ * ```ts
+ * storage: 'memory' // memory only: pair it with an httpOnly cookie session
+ * storage: createBrowserStorageAdapter({ kind: 'session' }) // survives a reload, dies with the tab
+ * storage: { getItem: (k) => …, setItem: (k, v) => …, removeItem: (k) => … } // your own
+ * ```
+ *
+ * @remarks
+ * - **The trade, stated plainly.** A bearer token in Web Storage is readable by
+ *   any script on the origin, so one XSS is one token theft — an account takeover
+ *   for the token's whole lifetime, and `localStorage` keeps the copy after the
+ *   tab closes. This is the model the RealWorld suite's own specs write
+ *   (`localStorage.setItem('jwtToken', …)` before a reload) and the reason this
+ *   adapter exists.
+ * - **An httpOnly cookie session is STRONGER, and is the first choice wherever
+ *   your API supports it.** Script cannot read an httpOnly cookie, so an XSS
+ *   cannot exfiltrate the credential; the token stays in memory and
+ *   `initialize()` restores the session through `currentUserEndpoint`
+ *   (`@molecule/api-resource-user` issues exactly this cookie — that is why the
+ *   client's default is `'memory'`). If the API sets one, `storage: 'memory'` is
+ *   the strongest configuration. If it does not and you cannot change it, keep
+ *   the token's lifetime short and rotate it on refresh.
+ * - **`kind: 'session'` narrows the window** to the tab's lifetime at the cost of
+ *   losing the session in a new tab; `'local'` is the default because a reload is
+ *   the requirement it exists for, and a fresh tab is the same person.
+ * - **Unavailable storage degrades to memory; it never throws.** SSR (`window`
+ *   undefined), a private/blocked store and a full quota all fall back to a
+ *   process-local store — so a login still succeeds and the session simply does
+ *   not survive the next page load. A warning names the failure. Do not read a
+ *   successful `setItem` as a guarantee of persistence; a caller that needs one
+ *   must probe the store itself.
+ * - **The keys are the client's own** (`storagePrefix`, default
+ *   `molecule:auth:`, plus `accessToken` / `refreshToken` / `user`); this adapter
+ *   adds no prefix and stores nothing of its own.
+ *
+ * @param options - Which Web Storage area to use, or a store to use directly.
+ * @returns A synchronous `StorageAdapter` bound to that store.
+ */
+export declare const createBrowserStorageAdapter: (options?: BrowserStorageAdapterOptions) => StorageAdapter;
+//# sourceMappingURL=browser-storage.d.ts.map

package/dist/browser-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-storage.d.ts","sourceRoot":"","sources":["../src/browser-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,SAAS,CAAA;AAEpD,4EAA4E;AAC5E,MAAM,WAAW,4BAA4B;IAC3C;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,kBAAkB,CAAA;IACzB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAA;CACzB;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,2BAA2B,GACtC,UAAS,4BAAiC,KACzC,cA6EF,CAAA"}

package/dist/browser-storage.js

@@ -0,0 +1,163 @@
+/**
+ * The browser `StorageAdapter` for the auth client's token storage.
+ *
+ * @module
+ */
+import { getLogger } from '@molecule/app-logger';
+/** Best-effort logger: a missing logger bond must never break token storage. */
+const warn = (message, error) => {
+    try {
+        const logger = getLogger('auth');
+        if (error === undefined)
+            logger.warn(message);
+        else
+            logger.warn(message, { error });
+    }
+    catch (_error) {
+        // No logger bonded (a bare unit test, an SSR boot before the app's bonds):
+        // logging is not this adapter's contract, and throwing here would take the
+        // session down with it.
+    }
+};
+/**
+ * The auth client's `StorageAdapter` over the browser's Web Storage.
+ *
+ * Pass it as `AuthClientConfig.storage` to keep the session across a page reload:
+ * the client's default (`'memory'`) is lost on reload, and re-establishing the
+ * session then needs a credential that survived — this adapter, or an httpOnly
+ * session cookie the API sets (see the security note below).
+ *
+ * ```ts
+ * import { createJWTAuthClient, createBrowserStorageAdapter } from '@molecule/app-auth'
+ *
+ * const authClient = createJWTAuthClient({
+ *   baseURL: '/api',
+ *   storage: createBrowserStorageAdapter(), // a reload keeps the user signed in
+ * })
+ * ```
+ *
+ * The scaffold's `authConfig` already passes it, so a scaffolded app survives a
+ * reload out of the box; each of these replaces that default:
+ *
+ * ```ts
+ * storage: 'memory' // memory only: pair it with an httpOnly cookie session
+ * storage: createBrowserStorageAdapter({ kind: 'session' }) // survives a reload, dies with the tab
+ * storage: { getItem: (k) => …, setItem: (k, v) => …, removeItem: (k) => … } // your own
+ * ```
+ *
+ * @remarks
+ * - **The trade, stated plainly.** A bearer token in Web Storage is readable by
+ *   any script on the origin, so one XSS is one token theft — an account takeover
+ *   for the token's whole lifetime, and `localStorage` keeps the copy after the
+ *   tab closes. This is the model the RealWorld suite's own specs write
+ *   (`localStorage.setItem('jwtToken', …)` before a reload) and the reason this
+ *   adapter exists.
+ * - **An httpOnly cookie session is STRONGER, and is the first choice wherever
+ *   your API supports it.** Script cannot read an httpOnly cookie, so an XSS
+ *   cannot exfiltrate the credential; the token stays in memory and
+ *   `initialize()` restores the session through `currentUserEndpoint`
+ *   (`@molecule/api-resource-user` issues exactly this cookie — that is why the
+ *   client's default is `'memory'`). If the API sets one, `storage: 'memory'` is
+ *   the strongest configuration. If it does not and you cannot change it, keep
+ *   the token's lifetime short and rotate it on refresh.
+ * - **`kind: 'session'` narrows the window** to the tab's lifetime at the cost of
+ *   losing the session in a new tab; `'local'` is the default because a reload is
+ *   the requirement it exists for, and a fresh tab is the same person.
+ * - **Unavailable storage degrades to memory; it never throws.** SSR (`window`
+ *   undefined), a private/blocked store and a full quota all fall back to a
+ *   process-local store — so a login still succeeds and the session simply does
+ *   not survive the next page load. A warning names the failure. Do not read a
+ *   successful `setItem` as a guarantee of persistence; a caller that needs one
+ *   must probe the store itself.
+ * - **The keys are the client's own** (`storagePrefix`, default
+ *   `molecule:auth:`, plus `accessToken` / `refreshToken` / `user`); this adapter
+ *   adds no prefix and stores nothing of its own.
+ *
+ * @param options - Which Web Storage area to use, or a store to use directly.
+ * @returns A synchronous `StorageAdapter` bound to that store.
+ */
+export const createBrowserStorageAdapter = (options = {}) => {
+    const { kind = 'local', storage } = options;
+    // The fallback store: one Map per adapter, so an unusable Web Storage area
+    // still behaves like a store for the lifetime of the page.
+    const memory = new Map();
+    /** The store once it has answered, `null` while it is unusable (re-probed each call). */
+    let resolved;
+    /** The unusable-store warning is worth saying once, not on every token read. */
+    let warned = false;
+    const resolve = () => {
+        if (storage)
+            return storage;
+        if (resolved !== undefined && resolved !== null)
+            return resolved;
+        try {
+            const areas = globalThis;
+            const web = kind === 'session' ? areas.sessionStorage : areas.localStorage;
+            if (web) {
+                // A store can be PRESENT and still unusable (a blocked third-party
+                // context, a private mode): touching it throws, so probe before trusting it.
+                const probe = '__molecule_auth_probe__';
+                web.setItem(probe, probe);
+                web.removeItem(probe);
+                resolved = web;
+                return web;
+            }
+        }
+        catch (error) {
+            if (!warned) {
+                warned = true;
+                warn(`The ${kind} Web Storage area is not usable; keeping auth tokens in memory`, error);
+            }
+        }
+        // Not cached: a store that appears later (the app booting before its DOM is
+        // ready) is still picked up by the next call.
+        return null;
+    };
+    return {
+        getItem: (key) => {
+            const store = resolve();
+            if (!store)
+                return memory.get(key) ?? null;
+            try {
+                // A write that fell back to memory (a full or blocked store) is still
+                // this session's value: the store simply never received it.
+                return store.getItem(key) ?? memory.get(key) ?? null;
+            }
+            catch (error) {
+                warn('Reading a stored auth value failed; falling back to memory', error);
+                return memory.get(key) ?? null;
+            }
+        },
+        setItem: (key, value) => {
+            const store = resolve();
+            if (!store) {
+                memory.set(key, value);
+                return;
+            }
+            try {
+                store.setItem(key, value);
+                memory.delete(key);
+            }
+            catch (error) {
+                // A quota-full or blocked store must not fail a login: keep the value for
+                // this page's lifetime and say so. The session is lost on reload, which is
+                // the state the app was in before this adapter existed.
+                warn('Storing an auth value failed; keeping it in memory for this page', error);
+                memory.set(key, value);
+            }
+        },
+        removeItem: (key) => {
+            memory.delete(key);
+            const store = resolve();
+            if (!store)
+                return;
+            try {
+                store.removeItem(key);
+            }
+            catch (error) {
+                warn('Clearing a stored auth value failed', error);
+            }
+        },
+    };
+};
+//# sourceMappingURL=browser-storage.js.map

package/dist/browser-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-storage.js","sourceRoot":"","sources":["../src/browser-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AA8BhD,gFAAgF;AAChF,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,KAAe,EAAQ,EAAE;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;;YACxC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,2EAA2E;QAC3E,2EAA2E;QAC3E,wBAAwB;IAC1B,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,UAAwC,EAAE,EAC1B,EAAE;IAClB,MAAM,EAAE,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC3C,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,yFAAyF;IACzF,IAAI,QAA2C,CAAA;IAC/C,gFAAgF;IAChF,IAAI,MAAM,GAAG,KAAK,CAAA;IAElB,MAAM,OAAO,GAAG,GAA0B,EAAE;QAC1C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAC3B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAA;QAChE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,UAAmE,CAAA;YACjF,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAA;YAC1E,IAAI,GAAG,EAAE,CAAC;gBACR,mEAAmE;gBACnE,6EAA6E;gBAC7E,MAAM,KAAK,GAAG,yBAAyB,CAAA;gBACvC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;gBACzB,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;gBACrB,QAAQ,GAAG,GAAG,CAAA;gBACd,OAAO,GAAG,CAAA;YACZ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,IAAI,CAAA;gBACb,IAAI,CAAC,OAAO,IAAI,gEAAgE,EAAE,KAAK,CAAC,CAAA;YAC1F,CAAC;QACH,CAAC;QACD,4EAA4E;QAC5E,8CAA8C;QAC9C,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,OAAO,EAAE,CAAA;YACvB,IAAI,CAAC,KAAK;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YAC1C,IAAI,CAAC;gBACH,sEAAsE;gBACtE,4DAA4D;gBAC5D,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,4DAA4D,EAAE,KAAK,CAAC,CAAA;gBACzE,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YAChC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,KAAK,GAAG,OAAO,EAAE,CAAA;YACvB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACtB,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACzB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,0EAA0E;gBAC1E,2EAA2E;gBAC3E,wDAAwD;gBACxD,IAAI,CAAC,kEAAkE,EAAE,KAAK,CAAC,CAAA;gBAC/E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;QACD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAClB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAClB,MAAM,KAAK,GAAG,OAAO,EAAE,CAAA;YACvB,IAAI,CAAC,KAAK;gBAAE,OAAM;YAClB,IAAI,CAAC;gBACH,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAA;YACpD,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAShB,WAAW,EACZ,MAAM,YAAY,CAAA;AA4CnB;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,SAAS,WAAW,GAAG,WAAW,EACrE,SAAQ,gBAAqB,KAC5B,UAAU,CAAC,CAAC,CAgcd,CAAA"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAShB,WAAW,EACZ,MAAM,YAAY,CAAA;AA4CnB;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,SAAS,WAAW,GAAG,WAAW,EACrE,SAAQ,gBAAqB,KAC5B,UAAU,CAAC,CAAC,CAudd,CAAA"}

package/dist/client.js

@@ -66,6 +66,11 @@ export const createJWTAuthClient = (config = {}) => {
     const stateListeners = new Set();
     const eventListeners = new Set();
     let refreshTimer = null;
+    // [m95] The session restore `initialize()` started, or null when none is running.
+    // Assigned SYNCHRONOUSLY, before that call's first await, so a component effect
+    // running in the same tick (bootstrapApp calls initialize() and then renders)
+    // already sees the restore and its HTTP requests wait for it (`whenRestored`).
+    let restoreInFlight = null;
     let state = {
         initialized: false,
         authenticated: false,
@@ -195,6 +200,41 @@ export const createJWTAuthClient = (config = {}) => {
         }
         return null;
     };
+    // The body of `initialize()`, kept separate so the client can record the in-flight
+    // promise SYNCHRONOUSLY (see `restoreInFlight`): a caller that awaits `initialize()`
+    // still sees a rejection, while `whenRestored()` hands out a promise that resolves.
+    const initializeSession = async () => {
+        const token = tokenStorage.getAccessToken();
+        const user = tokenStorage.getUser();
+        if (token && user) {
+            if (!isTokenExpired(token)) {
+                setState({
+                    initialized: true,
+                    authenticated: true,
+                    user,
+                });
+                scheduleRefresh();
+                return;
+            }
+            // Token expired, try to refresh
+            const refreshToken = tokenStorage.getRefreshToken();
+            if (refreshToken) {
+                try {
+                    await client.refresh();
+                    setState({ initialized: true });
+                    return;
+                }
+                catch (err) {
+                    logger.warn('Initial token refresh failed', err);
+                    tokenStorage.clear();
+                }
+            }
+        }
+        // [M1-1] Cookie-restore — this is what keeps a refresh / deep-link logged
+        // in under the in-memory-token model. See restoreFromSessionCookie above.
+        await restoreFromSessionCookie();
+        setState({ initialized: true });
+    };
     const client = {
         getState: () => state,
         isAuthenticated: () => state.authenticated,
@@ -373,36 +413,18 @@ export const createJWTAuthClient = (config = {}) => {
             });
         },
         async initialize() {
-            const token = tokenStorage.getAccessToken();
-            const user = tokenStorage.getUser();
-            if (token && user) {
-                if (!isTokenExpired(token)) {
-                    setState({
-                        initialized: true,
-                        authenticated: true,
-                        user,
-                    });
-                    scheduleRefresh();
-                    return;
-                }
-                // Token expired, try to refresh
-                const refreshToken = tokenStorage.getRefreshToken();
-                if (refreshToken) {
-                    try {
-                        await this.refresh();
-                        setState({ initialized: true });
-                        return;
-                    }
-                    catch (err) {
-                        logger.warn('Initial token refresh failed', err);
-                        tokenStorage.clear();
-                    }
-                }
-            }
-            // [M1-1] Cookie-restore — this is what keeps a refresh / deep-link logged
-            // in under the in-memory-token model. See restoreFromSessionCookie above.
-            await restoreFromSessionCookie();
-            setState({ initialized: true });
+            // Record BEFORE awaiting, so a component effect that runs in the same tick as
+            // this call (bootstrapApp calls initialize() and then renders) already sees a
+            // restore in flight and holds its requests for it (see whenRestored below).
+            const inFlight = initializeSession();
+            restoreInFlight = inFlight;
+            await inFlight;
+        },
+        whenRestored() {
+            // Resolve, never reject: this is awaited before every authenticated request, so a
+            // restore that failed must not turn into a rejected request — the request goes out
+            // unauthenticated instead (the same outcome as not waiting at all).
+            return restoreInFlight ? restoreInFlight.catch(() => undefined) : Promise.resolve();
         },
         subscribe(callback) {
             stateListeners.add(callback);

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEhD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAenF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,uBAAuB,GAAG,GAAY,EAAE;IAC5C,IAAI,CAAC;QACH,OAAO,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,CAAA;IACpE,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,4EAA4E;QAC5E,6EAA6E;QAC7E,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,GAAS,EAAE;IACxC,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAM;IAC3C,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5F,QAAQ,CAAC,MAAM,GAAG,+BAA+B,YAAY,EAAE,CAAA;AACjE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,SAA2B,EAAE,EACd,EAAE;IACjB,MAAM,EACJ,OAAO,GAAG,EAAE,EACZ,aAAa,GAAG,aAAa,EAC7B,cAAc,GAAG,eAAe,EAChC,gBAAgB,GAAG,gBAAgB,EACnC,eAAe,GAAG,eAAe,EACjC,eAAe,GAAG,eAAe,EACjC,sBAAsB,GAAG,sBAAsB,EAC/C,qBAAqB,GAAG,8BAA8B,EACtD,sBAAsB,GAAG,uBAAuB,EAChD,mBAAmB,GAAG,WAAW,EACjC,aAAa,GAAG,gBAAgB,EAChC,OAAO,GAAG,QAAQ,EAClB,iBAAiB,EACjB,WAAW,GAAG,IAAI,EAClB,aAAa,GAAG,EAAE,GACnB,GAAG,MAAM,CAAA;IAEV,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAChC,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAiC,CAAA;IAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqB,CAAA;IACnD,IAAI,YAAY,GAAyC,IAAI,CAAA;IAE7D,IAAI,KAAK,GAAiB;QACxB,WAAW,EAAE,KAAK;QAClB,aAAa,EAAE,KAAK;QACpB,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,IAAI;KACZ,CAAA;IAED,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,KAAgB,EAAQ,EAAE;QAC3C,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,CAAC,OAA8B,EAAQ,EAAE;QACxD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,CAAA;QAChC,MAAM,EAAE,CAAA;IACV,CAAC,CAAA;IAED,MAAM,eAAe,GAAG,GAAS,EAAE;QACjC,IAAI,CAAC,WAAW;YAAE,OAAM;QAExB,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAA;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAM;QAElB,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,CAAC,SAAS;YAAE,OAAM;QAEtB,MAAM,WAAW,GAAG,SAAS,GAAG,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACjE,IAAI,WAAW,IAAI,CAAC;YAAE,OAAM;QAE5B,IAAI,YAAY,EAAE,CAAC;YACjB,YAAY,CAAC,YAAY,CAAC,CAAA;QAC5B,CAAC;QAED,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC7B,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAA;gBACrD,MAAM,CAAC,MAAM,EAAE,CAAA;YACjB,CAAC,CAAC,CAAA;QACJ,CAAC,EAAE,WAAW,CAAC,CAAA;IACjB,CAAC,CAAA;IAED,4EAA4E;IAC5E,MAAM,SAAS,GAAG,CAAC,IAA0B,EAAE,OAAe,EAAW,EAAE,CACzE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,OAAkC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAC7F,MAAM,SAAS,GAAG,CAAC,IAAa,EAAiB,EAAE,CACjD,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAkB,CAAA;IAEjF,MAAM,QAAQ,GAAG,KAAK,EAAK,QAAgB,EAAE,UAAuB,EAAE,EAAc,EAAE;QACpF,MAAM,GAAG,GAAG,OAAO,GAAG,QAAQ,CAAA;QAC9B,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,GAAI,OAAO,CAAC,OAAkC;SAC/C,CAAA;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAA;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,eAAe,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAA;QACxE,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,WAAW,EAAE,SAAS;YACtB,GAAG,OAAO;YACV,OAAO;SACR,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YACpD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,0BAA0B,CAAA;YACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAA;YAC/D,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC/C,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5F,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,EAAE;IACF,uEAAuE;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,gBAAgB;IAChB,EAAE;IACF,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,wBAAwB,GAAG,KAAK,IAAuB,EAAE;QAC7D,MAAM,cAAc,GAClB,OAAO,QAAQ,KAAK,WAAW,IAAI,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACxF,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAe,mBAAmB,EAAE;gBAC/D,MAAM,EAAE,KAAK;gBACb,WAAW,EAAE,SAAS;aACvB,CAAC,CAAA;YACF,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAa,CAAA;YACvD,IAAI,YAAY,IAAI,iBAAiB,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1E,wEAAwE;gBACxE,wEAAwE;gBACxE,qEAAqE;gBACrE,oEAAoE;gBACpE,yCAAyC;gBACzC,sBAAsB,EAAE,CAAA;gBACxB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBAClC,QAAQ,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAA;gBACrD,OAAO,YAAY,CAAA;YACrB,CAAC;QACH,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,qEAAqE;YACrE,wEAAwE;YACxE,oEAAoE;YACpE,uEAAuE;YACvE,6DAA6D;YAC7D,sBAAsB,EAAE,CAAA;QAC1B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,MAAM,GAAkB;QAC5B,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;QAErB,eAAe,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa;QAE1C,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI;QAEzB,OAAO,EAAE,CAAC,IAAc,EAAE,EAAE;YAC1B,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC1B,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACpB,CAAC;QAED,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE;QAEnD,cAAc,EAAE,CAAC,KAAoB,EAAE,EAAE;YACvC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QACpC,CAAC;QAED,eAAe,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE;QAErD,KAAK,CAAC,KAAK,CAAC,WAA6B;YACvC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAExC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,SAAS,CACtB,MAAM,QAAQ,CAAU,aAAa,EAAE;oBACrC,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;iBACtD,CAAC,CACH,CAAA;gBAED,yEAAyE;gBACzE,kEAAkE;gBAClE,yEAAyE;gBACzE,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBAC7B,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;oBAC5B,OAAO,MAAM,CAAA;gBACf,CAAC;gBAED,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;gBACvD,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,CAAA;gBACzD,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAEjC,QAAQ,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE,IAAI;oBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAA;gBAEF,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;gBAC9B,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC/C,eAAe,EAAE,CAAA;gBAEjB,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAA;gBACjE,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM;YACV,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YAE3B,IAAI,CAAC;gBACH,uEAAuE;gBACvE,wEAAwE;gBACxE,0EAA0E;gBAC1E,qEAAqE;gBACrE,uEAAuE;gBACvE,kEAAkE;gBAClE,2EAA2E;gBAC3E,gEAAgE;gBAChE,wDAAwD;gBACxD,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAA;gBAC3C,IAAI,cAAc,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;oBACrD,MAAM,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAC9E,CAAC,GAAG,EAAE,EAAE;wBACN,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAA;oBACjE,CAAC,CACF,CAAA;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,IAAI,YAAY,EAAE,CAAC;oBACjB,YAAY,CAAC,YAAY,CAAC,CAAA;oBAC1B,YAAY,GAAG,IAAI,CAAA;gBACrB,CAAC;gBAED,YAAY,CAAC,KAAK,EAAE,CAAA;gBACpB,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,sBAAsB,EAAE,CAAA;gBACxB,QAAQ,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE,KAAK;oBACpB,IAAI,EAAE,IAAI;iBACX,CAAC,CAAA;gBACF,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;gBAC/B,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAkB;YAC/B,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAExC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,SAAS,CACtB,MAAM,QAAQ,CAAU,gBAAgB,EAAE;oBACxC,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;iBAClD,CAAC,CACH,CAAA;gBAED,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;gBACvD,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,CAAA;gBACzD,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAEjC,QAAQ,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE,IAAI;oBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAA;gBAEF,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;gBAClD,eAAe,EAAE,CAAA;gBAEjB,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAA;gBACxE,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO;YACX,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,EAAE,CAAA;YACnD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,uEAAuE;gBACvE,0EAA0E;gBAC1E,uEAAuE;gBACvE,yEAAyE;gBACzE,wEAAwE;gBACxE,oEAAoE;gBACpE,oEAAoE;gBACpE,yDAAyD;gBACzD,MAAM,YAAY,GAAG,MAAM,wBAAwB,EAAE,CAAA;gBACrD,IAAI,YAAY,EAAE,CAAC;oBACjB,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;oBAC9B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;gBAC/B,CAAC;gBACD,MAAM,IAAI,SAAS,CAAC,2BAA2B,EAAE,SAAS,EAAE,4BAA4B,CAAC,CAAA;YAC3F,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAgB,eAAe,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;aACvC,CAAC,CAAA;YAEF,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;YACvD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxB,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YACnD,CAAC;YACD,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAEjC,QAAQ,CAAC;gBACP,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAA;YAEF,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;YAC9B,eAAe,EAAE,CAAA;YAEjB,OAAO,MAAM,CAAA;QACf,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,IAA0B;YACnD,MAAM,QAAQ,CAAC,sBAAsB,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,IAA0B;YACnD,MAAM,QAAQ,CAAC,qBAAqB,EAAE;gBACpC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,IAAgB;YAClC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAI,eAAe,EAAE;gBAChD,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAA;YAEF,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YAC5B,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YAE1B,OAAO,MAAM,CAAA;QACf,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,WAAmB;YAC3D,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,sDAAsD;YACtD,MAAM,QAAQ,CAAC,sBAAsB,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;aACpE,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,UAAU;YACd,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAA;YAC3C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAK,CAAA;YAEtC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC3B,QAAQ,CAAC;wBACP,WAAW,EAAE,IAAI;wBACjB,aAAa,EAAE,IAAI;wBACnB,IAAI;qBACL,CAAC,CAAA;oBACF,eAAe,EAAE,CAAA;oBACjB,OAAM;gBACR,CAAC;gBAED,gCAAgC;gBAChC,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,EAAE,CAAA;gBACnD,IAAI,YAAY,EAAE,CAAC;oBACjB,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;wBACpB,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;wBAC/B,OAAM;oBACR,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;wBAChD,YAAY,CAAC,KAAK,EAAE,CAAA;oBACtB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,wBAAwB,EAAE,CAAA;YAChC,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QACjC,CAAC;QAED,SAAS,CAAC,QAAuC;YAC/C,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5B,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QAED,YAAY,CAAC,QAAuC;YAClD,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5B,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QAED,QAAQ;YACN,OAAO,YAAY,CAAC,cAAc,EAAE,CAAA;QACtC,CAAC;QAED,gBAAgB,CAAC,QAA2B;YAC1C,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5B,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QAED,OAAO;YACL,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,YAAY,CAAC,CAAA;gBAC1B,YAAY,GAAG,IAAI,CAAA;YACrB,CAAC;YACD,cAAc,CAAC,KAAK,EAAE,CAAA;YACtB,cAAc,CAAC,KAAK,EAAE,CAAA;QACxB,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEhD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAenF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,uBAAuB,GAAG,GAAY,EAAE;IAC5C,IAAI,CAAC;QACH,OAAO,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,CAAA;IACpE,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,4EAA4E;QAC5E,6EAA6E;QAC7E,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,GAAS,EAAE;IACxC,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAM;IAC3C,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5F,QAAQ,CAAC,MAAM,GAAG,+BAA+B,YAAY,EAAE,CAAA;AACjE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,SAA2B,EAAE,EACd,EAAE;IACjB,MAAM,EACJ,OAAO,GAAG,EAAE,EACZ,aAAa,GAAG,aAAa,EAC7B,cAAc,GAAG,eAAe,EAChC,gBAAgB,GAAG,gBAAgB,EACnC,eAAe,GAAG,eAAe,EACjC,eAAe,GAAG,eAAe,EACjC,sBAAsB,GAAG,sBAAsB,EAC/C,qBAAqB,GAAG,8BAA8B,EACtD,sBAAsB,GAAG,uBAAuB,EAChD,mBAAmB,GAAG,WAAW,EACjC,aAAa,GAAG,gBAAgB,EAChC,OAAO,GAAG,QAAQ,EAClB,iBAAiB,EACjB,WAAW,GAAG,IAAI,EAClB,aAAa,GAAG,EAAE,GACnB,GAAG,MAAM,CAAA;IAEV,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAChC,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAiC,CAAA;IAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqB,CAAA;IACnD,IAAI,YAAY,GAAyC,IAAI,CAAA;IAC7D,kFAAkF;IAClF,gFAAgF;IAChF,8EAA8E;IAC9E,+EAA+E;IAC/E,IAAI,eAAe,GAAyB,IAAI,CAAA;IAEhD,IAAI,KAAK,GAAiB;QACxB,WAAW,EAAE,KAAK;QAClB,aAAa,EAAE,KAAK;QACpB,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,IAAI;KACZ,CAAA;IAED,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,KAAgB,EAAQ,EAAE;QAC3C,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,CAAC,OAA8B,EAAQ,EAAE;QACxD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,CAAA;QAChC,MAAM,EAAE,CAAA;IACV,CAAC,CAAA;IAED,MAAM,eAAe,GAAG,GAAS,EAAE;QACjC,IAAI,CAAC,WAAW;YAAE,OAAM;QAExB,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAA;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAM;QAElB,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,CAAC,SAAS;YAAE,OAAM;QAEtB,MAAM,WAAW,GAAG,SAAS,GAAG,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACjE,IAAI,WAAW,IAAI,CAAC;YAAE,OAAM;QAE5B,IAAI,YAAY,EAAE,CAAC;YACjB,YAAY,CAAC,YAAY,CAAC,CAAA;QAC5B,CAAC;QAED,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC7B,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAA;gBACrD,MAAM,CAAC,MAAM,EAAE,CAAA;YACjB,CAAC,CAAC,CAAA;QACJ,CAAC,EAAE,WAAW,CAAC,CAAA;IACjB,CAAC,CAAA;IAED,4EAA4E;IAC5E,MAAM,SAAS,GAAG,CAAC,IAA0B,EAAE,OAAe,EAAW,EAAE,CACzE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,OAAkC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAC7F,MAAM,SAAS,GAAG,CAAC,IAAa,EAAiB,EAAE,CACjD,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAkB,CAAA;IAEjF,MAAM,QAAQ,GAAG,KAAK,EAAK,QAAgB,EAAE,UAAuB,EAAE,EAAc,EAAE;QACpF,MAAM,GAAG,GAAG,OAAO,GAAG,QAAQ,CAAA;QAC9B,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,GAAI,OAAO,CAAC,OAAkC;SAC/C,CAAA;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAA;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,eAAe,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAA;QACxE,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,WAAW,EAAE,SAAS;YACtB,GAAG,OAAO;YACV,OAAO;SACR,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YACpD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,0BAA0B,CAAA;YACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAA;YAC/D,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC/C,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5F,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,EAAE;IACF,uEAAuE;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,gBAAgB;IAChB,EAAE;IACF,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,wBAAwB,GAAG,KAAK,IAAuB,EAAE;QAC7D,MAAM,cAAc,GAClB,OAAO,QAAQ,KAAK,WAAW,IAAI,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACxF,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAe,mBAAmB,EAAE;gBAC/D,MAAM,EAAE,KAAK;gBACb,WAAW,EAAE,SAAS;aACvB,CAAC,CAAA;YACF,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAa,CAAA;YACvD,IAAI,YAAY,IAAI,iBAAiB,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1E,wEAAwE;gBACxE,wEAAwE;gBACxE,qEAAqE;gBACrE,oEAAoE;gBACpE,yCAAyC;gBACzC,sBAAsB,EAAE,CAAA;gBACxB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBAClC,QAAQ,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAA;gBACrD,OAAO,YAAY,CAAA;YACrB,CAAC;QACH,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,qEAAqE;YACrE,wEAAwE;YACxE,oEAAoE;YACpE,uEAAuE;YACvE,6DAA6D;YAC7D,sBAAsB,EAAE,CAAA;QAC1B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,mFAAmF;IACnF,qFAAqF;IACrF,oFAAoF;IACpF,MAAM,iBAAiB,GAAG,KAAK,IAAmB,EAAE;QAClD,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAA;QAC3C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAK,CAAA;QAEtC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC;oBACP,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,IAAI;oBACnB,IAAI;iBACL,CAAC,CAAA;gBACF,eAAe,EAAE,CAAA;gBACjB,OAAM;YACR,CAAC;YAED,gCAAgC;YAChC,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,EAAE,CAAA;YACnD,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;oBACtB,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;oBAC/B,OAAM;gBACR,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;oBAChD,YAAY,CAAC,KAAK,EAAE,CAAA;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,wBAAwB,EAAE,CAAA;QAChC,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC,CAAA;IAED,MAAM,MAAM,GAAkB;QAC5B,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;QACrB,eAAe,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa;QAE1C,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI;QAEzB,OAAO,EAAE,CAAC,IAAc,EAAE,EAAE;YAC1B,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC1B,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACpB,CAAC;QAED,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE;QAEnD,cAAc,EAAE,CAAC,KAAoB,EAAE,EAAE;YACvC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QACpC,CAAC;QAED,eAAe,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE;QAErD,KAAK,CAAC,KAAK,CAAC,WAA6B;YACvC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAExC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,SAAS,CACtB,MAAM,QAAQ,CAAU,aAAa,EAAE;oBACrC,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;iBACtD,CAAC,CACH,CAAA;gBAED,yEAAyE;gBACzE,kEAAkE;gBAClE,yEAAyE;gBACzE,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBAC7B,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;oBAC5B,OAAO,MAAM,CAAA;gBACf,CAAC;gBAED,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;gBACvD,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,CAAA;gBACzD,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAEjC,QAAQ,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE,IAAI;oBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAA;gBAEF,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;gBAC9B,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC/C,eAAe,EAAE,CAAA;gBAEjB,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAA;gBACjE,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM;YACV,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YAE3B,IAAI,CAAC;gBACH,uEAAuE;gBACvE,wEAAwE;gBACxE,0EAA0E;gBAC1E,qEAAqE;gBACrE,uEAAuE;gBACvE,kEAAkE;gBAClE,2EAA2E;gBAC3E,gEAAgE;gBAChE,wDAAwD;gBACxD,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAA;gBAC3C,IAAI,cAAc,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;oBACrD,MAAM,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAC9E,CAAC,GAAG,EAAE,EAAE;wBACN,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAA;oBACjE,CAAC,CACF,CAAA;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,IAAI,YAAY,EAAE,CAAC;oBACjB,YAAY,CAAC,YAAY,CAAC,CAAA;oBAC1B,YAAY,GAAG,IAAI,CAAA;gBACrB,CAAC;gBAED,YAAY,CAAC,KAAK,EAAE,CAAA;gBACpB,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,sBAAsB,EAAE,CAAA;gBACxB,QAAQ,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE,KAAK;oBACpB,IAAI,EAAE,IAAI;iBACX,CAAC,CAAA;gBACF,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;gBAC/B,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAkB;YAC/B,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAExC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,SAAS,CACtB,MAAM,QAAQ,CAAU,gBAAgB,EAAE;oBACxC,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;iBAClD,CAAC,CACH,CAAA;gBAED,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;gBACvD,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,CAAA;gBACzD,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAEjC,QAAQ,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE,IAAI;oBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAA;gBAEF,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;gBAClD,eAAe,EAAE,CAAA;gBAEjB,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAA;gBACxE,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO;YACX,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,EAAE,CAAA;YACnD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,uEAAuE;gBACvE,0EAA0E;gBAC1E,uEAAuE;gBACvE,yEAAyE;gBACzE,wEAAwE;gBACxE,oEAAoE;gBACpE,oEAAoE;gBACpE,yDAAyD;gBACzD,MAAM,YAAY,GAAG,MAAM,wBAAwB,EAAE,CAAA;gBACrD,IAAI,YAAY,EAAE,CAAC;oBACjB,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;oBAC9B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;gBAC/B,CAAC;gBACD,MAAM,IAAI,SAAS,CAAC,2BAA2B,EAAE,SAAS,EAAE,4BAA4B,CAAC,CAAA;YAC3F,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAgB,eAAe,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;aACvC,CAAC,CAAA;YAEF,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;YACvD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxB,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YACnD,CAAC;YACD,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAEjC,QAAQ,CAAC;gBACP,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAA;YAEF,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;YAC9B,eAAe,EAAE,CAAA;YAEjB,OAAO,MAAM,CAAA;QACf,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,IAA0B;YACnD,MAAM,QAAQ,CAAC,sBAAsB,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,IAA0B;YACnD,MAAM,QAAQ,CAAC,qBAAqB,EAAE;gBACpC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,IAAgB;YAClC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAI,eAAe,EAAE;gBAChD,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAA;YAEF,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YAC5B,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YAE1B,OAAO,MAAM,CAAA;QACf,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,WAAmB;YAC3D,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,sDAAsD;YACtD,MAAM,QAAQ,CAAC,sBAAsB,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;aACpE,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,UAAU;YACd,8EAA8E;YAC9E,8EAA8E;YAC9E,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;YACpC,eAAe,GAAG,QAAQ,CAAA;YAC1B,MAAM,QAAQ,CAAA;QAChB,CAAC;QAED,YAAY;YACV,kFAAkF;YAClF,mFAAmF;YACnF,oEAAoE;YACpE,OAAO,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;QACrF,CAAC;QAED,SAAS,CAAC,QAAuC;YAC/C,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5B,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QAED,YAAY,CAAC,QAAuC;YAClD,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5B,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QAED,QAAQ;YACN,OAAO,YAAY,CAAC,cAAc,EAAE,CAAA;QACtC,CAAC;QAED,gBAAgB,CAAC,QAA2B;YAC1C,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5B,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QAED,OAAO;YACL,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,YAAY,CAAC,CAAA;gBAC1B,YAAY,GAAG,IAAI,CAAA;YACrB,CAAC;YACD,cAAc,CAAC,KAAK,EAAE,CAAA;YACtB,cAAc,CAAC,KAAK,EAAE,CAAA;QACxB,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/dist/index.d.ts

@@ -12,19 +12,43 @@
  * - **An API with its own auth envelope keeps this client.** `requestBody` wraps the
  *   login/register payload (`(kind, p) => ({ user: p })`), `mapAuthResponse` reads the
  *   token and user out of the answer (`(d) => ({ accessToken: d.user.token, user: d.user })`),
- *   and `authScheme: 'Token'` sends `Authorization: Token <jwt>`. Do not hand-write an
- *   auth client for a spec like RealWorld.
- * - **A page reload "logging the user out" is the config default, not a bug.**
- *   Token storage defaults to `'memory'` (the secure default — a localStorage
- *   bearer token is XSS-exfiltratable). Staying signed in across reloads works
- *   by calling `client.initialize()` once at startup: it re-fetches
- *   `currentUserEndpoint` (default `/users/me`) with the httpOnly cookie the
- *   API set at login. Wire `initialize()`; do NOT "fix" reload-logout by
- *   copying tokens into localStorage.
+ *   and `authScheme: 'Token'` sends `Authorization: Token <jwt>` — both are fields of the
+ *   `AuthClientConfig` the client is CONSTRUCTED with
+ *   (`setClient(createJWTAuthClient({ authScheme: 'Token', … }))` in the auth bond), not
+ *   properties of a client that already exists. Do not hand-write an auth client for a spec
+ *   like RealWorld.
+ * - **Whether a reload keeps the user signed in is `AuthClientConfig.storage`,
+ *   and one of the two routes must be wired.** The client's own default is
+ *   `'memory'`, which is lost on reload, so a session survives one only by
+ *   having a credential that survived: (1) `storage: createBrowserStorageAdapter()`
+ *   — the browser's `localStorage`, what a scaffolded app's `authConfig` passes
+ *   (see `@molecule/app-auth`'s `createBrowserStorageAdapter` for the trade: Web
+ *   Storage is script-readable, so an XSS can steal the token), or (2) an
+ *   httpOnly session cookie the API sets at login, which `initialize()` restores
+ *   through `currentUserEndpoint` (default `/users/me`) — the stronger option
+ *   wherever the API supports it, and what `@molecule/api-resource-user` issues.
+ *   Wire `initialize()` once at startup either way. Do NOT hand-roll a token
+ *   store beside the client for this: it is a config field.
  * - **Endpoint defaults must match your API's real routes** (`/auth/login`,
  *   `/auth/register`, `/auth/refresh`, `/users/logout`, `/users/me`, …).
  *   Align them via `createJWTAuthClient({ baseURL, ...endpoints })` — never by
  *   hand-editing fetch calls in components.
+ * - **Do not fetch viewer-dependent data before the restore settles.** A component
+ *   effect that runs on mount fires while `initialize()` is still restoring, so its
+ *   request leaves without the `Authorization` header and the server answers for an
+ *   anonymous viewer — a followed user renders "Follow", a saved item renders unsaved.
+ *   On localhost the restore usually wins this race; over the network it does not, so
+ *   the bug appears only on the deployed URL. Two ways out: gate the fetch on the auth
+ *   state being settled (`state.initialized`), or let the HTTP client do it — bond the
+ *   auth client through `@molecule/app-bonds-default-react`, which registers
+ *   `whenRestored()` as the http gate so every request waits for the restore.
+ * - **Your own session store's gate must exempt its restore's own request.** This client
+ *   restores with `fetch`, so the gate registered over it never holds the restore. A store
+ *   that restores THROUGH the bonded HTTP client and registers that restore as the gate
+ *   (`setAuthGate(() => store.whenSettled())`) waits on itself unless the restore's request
+ *   passes `skipAuthGate: true` — otherwise the gate holds the very request it is waiting
+ *   for, and every request it holds stalls until the gate times out. See
+ *   `RequestConfig.skipAuthGate` in `@molecule/app-http`.
  * - Client-side auth state is UX only — the server enforces authorization on
  *   every request; hiding a screen is not protection.
  *
@@ -66,25 +90,31 @@
  * - [ ] Visiting a protected route while logged OUT redirects to login (the
  *   guard reads `isAuthenticated()`), and after authenticating you land back on
  *   the originally-requested screen rather than a generic home.
- * - [ ] The session survives a FULL page reload: after login, hard-reload →
- *   `initialize()` restores it from the httpOnly cookie (via
- *   `currentUserEndpoint`, default `/users/me`) and you stay signed in — you are
- *   NOT bounced to login. (The in-memory bearer token is dropped by design; the
- *   cookie restore is what keeps you in — do not "fix" this by writing the token
- *   to localStorage.)
+ * - [ ] The session survives a FULL page reload: after login, hard-reload → you
+ *   stay signed in (the profile/sign-out UI a signed-in visitor sees is still
+ *   there), and you are NOT bounced to login. Which route does it is the app's
+ *   `AuthClientConfig.storage`: the scaffold's `createBrowserStorageAdapter()` keeps
+ *   the token in the browser, an httpOnly session cookie is restored by
+ *   `initialize()` through `currentUserEndpoint` (default `/users/me`). If the
+ *   app has neither — `storage` left at `'memory'` against an API that sets no
+ *   cookie — this box cannot be checked, and the fix is the config, not a token
+ *   store written beside the client.
  * - [ ] Password reset round-trips: `requestPasswordReset({ email })` then
  *   `confirmPasswordReset({ token, password })` with the emailed token, after
  *   which `login()` with the NEW password succeeds and the OLD password no
  *   longer works.
  * - [ ] Authorization holds: a signed-in user only ever reads/edits their OWN
  *   record (`getUser()` is the caller's profile, never another user's); the
- *   bearer token lives in memory only — it is never written to
- *   localStorage / sessionStorage where another script could read it; and an
- *   expired/invalid token fails closed — the app re-authenticates (`refresh()`
- *   or `logout()`), never silently serving another user's data.
+ *   token's storage is the deliberate choice `AuthClientConfig.storage` names —
+ *   if it is Web Storage (the scaffold default, which a reload requires when the
+ *   API sets no cookie), say so in the app's own words rather than leaving a
+ *   second, undocumented store beside it; and an expired/invalid token fails
+ *   closed — the app re-authenticates (`refresh()` or `logout()`), never
+ *   silently serving another user's data.
  *
  * @module
  */
+export * from './browser-storage.js';
 export * from './client.js';
 export * from './provider.js';
 export * from './token.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmHG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/index.js

@@ -12,19 +12,43 @@
  * - **An API with its own auth envelope keeps this client.** `requestBody` wraps the
  *   login/register payload (`(kind, p) => ({ user: p })`), `mapAuthResponse` reads the
  *   token and user out of the answer (`(d) => ({ accessToken: d.user.token, user: d.user })`),
- *   and `authScheme: 'Token'` sends `Authorization: Token <jwt>`. Do not hand-write an
- *   auth client for a spec like RealWorld.
- * - **A page reload "logging the user out" is the config default, not a bug.**
- *   Token storage defaults to `'memory'` (the secure default — a localStorage
- *   bearer token is XSS-exfiltratable). Staying signed in across reloads works
- *   by calling `client.initialize()` once at startup: it re-fetches
- *   `currentUserEndpoint` (default `/users/me`) with the httpOnly cookie the
- *   API set at login. Wire `initialize()`; do NOT "fix" reload-logout by
- *   copying tokens into localStorage.
+ *   and `authScheme: 'Token'` sends `Authorization: Token <jwt>` — both are fields of the
+ *   `AuthClientConfig` the client is CONSTRUCTED with
+ *   (`setClient(createJWTAuthClient({ authScheme: 'Token', … }))` in the auth bond), not
+ *   properties of a client that already exists. Do not hand-write an auth client for a spec
+ *   like RealWorld.
+ * - **Whether a reload keeps the user signed in is `AuthClientConfig.storage`,
+ *   and one of the two routes must be wired.** The client's own default is
+ *   `'memory'`, which is lost on reload, so a session survives one only by
+ *   having a credential that survived: (1) `storage: createBrowserStorageAdapter()`
+ *   — the browser's `localStorage`, what a scaffolded app's `authConfig` passes
+ *   (see `@molecule/app-auth`'s `createBrowserStorageAdapter` for the trade: Web
+ *   Storage is script-readable, so an XSS can steal the token), or (2) an
+ *   httpOnly session cookie the API sets at login, which `initialize()` restores
+ *   through `currentUserEndpoint` (default `/users/me`) — the stronger option
+ *   wherever the API supports it, and what `@molecule/api-resource-user` issues.
+ *   Wire `initialize()` once at startup either way. Do NOT hand-roll a token
+ *   store beside the client for this: it is a config field.
  * - **Endpoint defaults must match your API's real routes** (`/auth/login`,
  *   `/auth/register`, `/auth/refresh`, `/users/logout`, `/users/me`, …).
  *   Align them via `createJWTAuthClient({ baseURL, ...endpoints })` — never by
  *   hand-editing fetch calls in components.
+ * - **Do not fetch viewer-dependent data before the restore settles.** A component
+ *   effect that runs on mount fires while `initialize()` is still restoring, so its
+ *   request leaves without the `Authorization` header and the server answers for an
+ *   anonymous viewer — a followed user renders "Follow", a saved item renders unsaved.
+ *   On localhost the restore usually wins this race; over the network it does not, so
+ *   the bug appears only on the deployed URL. Two ways out: gate the fetch on the auth
+ *   state being settled (`state.initialized`), or let the HTTP client do it — bond the
+ *   auth client through `@molecule/app-bonds-default-react`, which registers
+ *   `whenRestored()` as the http gate so every request waits for the restore.
+ * - **Your own session store's gate must exempt its restore's own request.** This client
+ *   restores with `fetch`, so the gate registered over it never holds the restore. A store
+ *   that restores THROUGH the bonded HTTP client and registers that restore as the gate
+ *   (`setAuthGate(() => store.whenSettled())`) waits on itself unless the restore's request
+ *   passes `skipAuthGate: true` — otherwise the gate holds the very request it is waiting
+ *   for, and every request it holds stalls until the gate times out. See
+ *   `RequestConfig.skipAuthGate` in `@molecule/app-http`.
  * - Client-side auth state is UX only — the server enforces authorization on
  *   every request; hiding a screen is not protection.
  *
@@ -66,25 +90,31 @@
  * - [ ] Visiting a protected route while logged OUT redirects to login (the
  *   guard reads `isAuthenticated()`), and after authenticating you land back on
  *   the originally-requested screen rather than a generic home.
- * - [ ] The session survives a FULL page reload: after login, hard-reload →
- *   `initialize()` restores it from the httpOnly cookie (via
- *   `currentUserEndpoint`, default `/users/me`) and you stay signed in — you are
- *   NOT bounced to login. (The in-memory bearer token is dropped by design; the
- *   cookie restore is what keeps you in — do not "fix" this by writing the token
- *   to localStorage.)
+ * - [ ] The session survives a FULL page reload: after login, hard-reload → you
+ *   stay signed in (the profile/sign-out UI a signed-in visitor sees is still
+ *   there), and you are NOT bounced to login. Which route does it is the app's
+ *   `AuthClientConfig.storage`: the scaffold's `createBrowserStorageAdapter()` keeps
+ *   the token in the browser, an httpOnly session cookie is restored by
+ *   `initialize()` through `currentUserEndpoint` (default `/users/me`). If the
+ *   app has neither — `storage` left at `'memory'` against an API that sets no
+ *   cookie — this box cannot be checked, and the fix is the config, not a token
+ *   store written beside the client.
  * - [ ] Password reset round-trips: `requestPasswordReset({ email })` then
  *   `confirmPasswordReset({ token, password })` with the emailed token, after
  *   which `login()` with the NEW password succeeds and the OLD password no
  *   longer works.
  * - [ ] Authorization holds: a signed-in user only ever reads/edits their OWN
  *   record (`getUser()` is the caller's profile, never another user's); the
- *   bearer token lives in memory only — it is never written to
- *   localStorage / sessionStorage where another script could read it; and an
- *   expired/invalid token fails closed — the app re-authenticates (`refresh()`
- *   or `logout()`), never silently serving another user's data.
+ *   token's storage is the deliberate choice `AuthClientConfig.storage` names —
+ *   if it is Web Storage (the scaffold default, which a reload requires when the
+ *   API sets no cookie), say so in the app's own words rather than leaving a
+ *   second, undocumented store beside it; and an expired/invalid token fails
+ *   closed — the app re-authenticates (`refresh()` or `logout()`), never
+ *   silently serving another user's data.
  *
  * @module
  */
+export * from './browser-storage.js';
 export * from './client.js';
 export * from './provider.js';
 export * from './token.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmHG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/token.d.ts

@@ -17,17 +17,12 @@ import type { StorageAdapter, TokenStorage } from './types.js';
  *
  * @example
  * ```typescript
- * // In-memory storage (default)
+ * // In-memory storage (the client's default)
  * const storage = createTokenStorage('memory')
  *
- * // Custom storage adapter from @molecule/app-storage
- * import { getProvider } from '@molecule/app-storage'
- * const provider = getProvider()
- * const storage = createTokenStorage({
- *   getItem: (key) => provider.get(key),
- *   setItem: (key, value) => provider.set(key, value),
- *   removeItem: (key) => provider.remove(key),
- * })
+ * // The browser's persistent storage — a reload keeps the session
+ * import { createBrowserStorageAdapter } from '@molecule/app-auth'
+ * const storage = createTokenStorage(createBrowserStorageAdapter())
  * ```
  */
 export declare const createTokenStorage: (storage?: "memory" | StorageAdapter, prefix?: string) => TokenStorage;

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AAE3E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAS,QAAQ,GAAG,cAAyB,EAC7C,SAAQ,MAAyB,KAChC,YAoDF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,MAAM,KAAG,CAAC,GAAG,IAWzE,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,gBAAe,MAAU,KAAG,OAMzE,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,MAAM,GAAG,IAI3D,CAAA"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAS,QAAQ,GAAG,cAAyB,EAC7C,SAAQ,MAAyB,KAChC,YAoDF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,MAAM,KAAG,CAAC,GAAG,IAWzE,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,gBAAe,MAAU,KAAG,OAMzE,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,MAAM,GAAG,IAI3D,CAAA"}

package/dist/token.js

@@ -16,17 +16,12 @@
  *
  * @example
  * ```typescript
- * // In-memory storage (default)
+ * // In-memory storage (the client's default)
  * const storage = createTokenStorage('memory')
  *
- * // Custom storage adapter from @molecule/app-storage
- * import { getProvider } from '@molecule/app-storage'
- * const provider = getProvider()
- * const storage = createTokenStorage({
- *   getItem: (key) => provider.get(key),
- *   setItem: (key, value) => provider.set(key, value),
- *   removeItem: (key) => provider.remove(key),
- * })
+ * // The browser's persistent storage — a reload keeps the session
+ * import { createBrowserStorageAdapter } from '@molecule/app-auth'
+ * const storage = createTokenStorage(createBrowserStorageAdapter())
  * ```
  */
 export const createTokenStorage = (storage = 'memory', prefix = 'molecule:auth:') => {

package/dist/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,UAAqC,QAAQ,EAC7C,SAAiB,gBAAgB,EACnB,EAAE;IAChB,MAAM,WAAW,GAAkC,EAAE,CAAA;IAErD,4BAA4B;IAC5B,IAAI,OAAO,GAA0B,IAAI,CAAA;IACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,GAAG,OAAO,CAAA;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAiB,EAAE;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;IACjC,CAAC,CAAA;IAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAoB,EAAQ,EAAE;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAC1B,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;QACxC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC;QACpD,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC;QAC1C,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC;QACtD,OAAO,EAAE,GAA8B,EAAE;YACvC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;YACxB,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YACtB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAA;YAC9B,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,2EAA2E;gBAC3E,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAkB,IAAc,EAAE,EAAE;YAC3C,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACjD,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;YACxB,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;YACzB,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACnB,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAA8B,KAAa,EAAY,EAAE;IAC/E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QACnE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAA;IACjC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,sFAAsF;QACtF,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,gBAAwB,CAAC,EAAW,EAAE;IAClF,MAAM,OAAO,GAAG,QAAQ,CAAmB,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAA;IAC7C,OAAO,GAAG,IAAI,SAAS,CAAA;AACzB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAiB,EAAE;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAmB,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACzC,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;AAC3B,CAAC,CAAA"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,UAAqC,QAAQ,EAC7C,SAAiB,gBAAgB,EACnB,EAAE;IAChB,MAAM,WAAW,GAAkC,EAAE,CAAA;IAErD,4BAA4B;IAC5B,IAAI,OAAO,GAA0B,IAAI,CAAA;IACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,GAAG,OAAO,CAAA;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAiB,EAAE;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;IACjC,CAAC,CAAA;IAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAoB,EAAQ,EAAE;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAC1B,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;QACxC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC;QACpD,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC;QAC1C,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC;QACtD,OAAO,EAAE,GAA8B,EAAE;YACvC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;YACxB,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YACtB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAA;YAC9B,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,2EAA2E;gBAC3E,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAkB,IAAc,EAAE,EAAE;YAC3C,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACjD,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;YACxB,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;YACzB,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACnB,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAA8B,KAAa,EAAY,EAAE;IAC/E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QACnE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAA;IACjC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,sFAAsF;QACtF,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,gBAAwB,CAAC,EAAW,EAAE;IAClF,MAAM,OAAO,GAAG,QAAQ,CAAmB,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAA;IAC7C,OAAO,GAAG,IAAI,SAAS,CAAA;AACzB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAiB,EAAE;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAmB,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACzC,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;AAC3B,CAAC,CAAA"}

package/dist/types.d.ts

@@ -250,6 +250,27 @@ export interface AuthClient<T = UserProfile> {
      * Initializes auth state (e.g., from stored tokens).
      */
     initialize(): Promise<void>;
+    /**
+     * Resolves when the session restore started by `initialize()` has settled — the point
+     * after which the client knows whether this visitor is signed in.
+     *
+     * Resolves IMMEDIATELY when no restore is in flight: before `initialize()` is ever
+     * called, and after it has finished. A restore that failed resolves too (it settled the
+     * question), so an HTTP client can await this before every request without risking one
+     * held forever. That is what makes the fetch-before-restore race impossible: a page that
+     * fetches viewer-dependent data on mount waits here instead of going out anonymously
+     * (see `setAuthGate` in `@molecule/app-http`).
+     *
+     * Optional: a provider that restores no session has nothing to wait for. Without it, an
+     * HTTP client bonded to that provider sends first-paint requests unauthenticated.
+     *
+     * A provider whose restore sends a request THROUGH the gated HTTP client must send that
+     * request with `skipAuthGate: true` (`RequestConfig` in `@molecule/app-http`): the gate
+     * waits on this promise, so holding the restore's own request makes the gate wait on
+     * itself and stalls every request it holds until it times out. `createJWTAuthClient`'s
+     * restore does not need it — it uses `fetch`, not the bonded client.
+     */
+    whenRestored?(): Promise<void>;
     /**
      * Subscribes to auth state changes.
      */
@@ -311,10 +332,10 @@ export interface AuthClientConfig {
     profileEndpoint?: string;
     /**
      * Current-user endpoint for session restore (default `/users/me`). Called by
-     * `initialize()` with credentials to re-establish the session from the
-     * httpOnly cookie after a full page load — the only way to stay logged in when
-     * the bearer token is held in memory (the secure default; a localStorage copy
-     * is XSS-exfiltratable). Must return the user (as `user` or `props`).
+     * `initialize()` with credentials to re-establish the session after a full page
+     * load when the token did not survive the reload itself — i.e. when `storage` is
+     * `'memory'` and the API sets an httpOnly session cookie. Must return the user
+     * (as `user` or `props`).
      */
     currentUserEndpoint?: string;
     /**
@@ -345,23 +366,35 @@ export interface AuthClientConfig {
      */
     mapAuthResponse?: (data: unknown) => AuthResult<UserProfile>;
     /**
-     * Token storage type or custom storage adapter.
-     * - 'memory': In-memory storage (lost on page refresh)
-     * - StorageAdapter: Custom storage implementation (e.g., from `@molecule/app-storage`)
+     * Where the access/refresh token and the cached user are kept — the field that
+     * decides whether a page reload keeps the user signed in.
+     *
+     * - `'memory'` (the client's default): a process-local store, lost on reload.
+     *   Correct when the API sets an httpOnly session cookie, which `initialize()`
+     *   then restores through {@link AuthClientConfig.currentUserEndpoint} — the
+     *   strongest configuration, because no script can read the cookie.
+     * - a `StorageAdapter`: the token survives the reload itself. The browser
+     *   adapter is `createBrowserStorageAdapter()` (from `@molecule/app-auth`), and it
+     *   is what the scaffold's `authConfig` passes. A bearer token in Web Storage is
+     *   readable by any script on the origin, so an XSS can steal it; see that
+     *   function's `@remarks` for the trade and for the cookie alternative.
+     *
+     * Any adapter with `getItem`/`setItem`/`removeItem` works — the methods are
+     * SYNCHRONOUS, so the async `@molecule/app-storage` provider
+     * (`getProvider()`, whose `get()` returns a Promise) is NOT one: wrap the
+     * `Storage` object it was built on (`createBrowserStorageAdapter({ storage })`),
+     * or store a different way.
      *
      * @example
      * ```typescript
-     * // Use in-memory storage
-     * storage: 'memory'
+     * import { createBrowserStorageAdapter } from '@molecule/app-auth'
      *
-     * // Use custom storage from `@molecule/app-storage`
-     * import { getProvider } from '@molecule/app-storage'
-     * const storageProvider = getProvider()
-     * storage: {
-     *   getItem: (key) => storageProvider.get(key),
-     *   setItem: (key, value) => storageProvider.set(key, value),
-     *   removeItem: (key) => storageProvider.remove(key),
-     * }
+     * // A reload keeps the session (the scaffold's own default):
+     * storage: createBrowserStorageAdapter()
+     * // Only this tab's lifetime, at a narrower exposure than localStorage:
+     * storage: createBrowserStorageAdapter({ kind: 'session' })
+     * // An httpOnly cookie session instead — memory only, the stronger route:
+     * storage: 'memory'
      * ```
      */
     storage?: 'memory' | StorageAdapter;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IAEV;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,WAAW;IACzC;;OAEG;IACH,IAAI,EAAE,CAAC,CAAA;IAEP;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,WAAW;IACxC;;OAEG;IACH,WAAW,EAAE,OAAO,CAAA;IAEpB;;OAEG;IACH,aAAa,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IAEd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAA;AAE1D;;;;GAIG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,WAAW;IACzC;;OAEG;IACH,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAAA;IAExB;;OAEG;IACH,eAAe,IAAI,OAAO,CAAA;IAE1B;;OAEG;IACH,OAAO,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAE1C;;OAEG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAEhC;;OAEG;IACH,KAAK,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAE5D;;OAEG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAEpD;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAEjC;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAE3C;;OAEG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvE;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3B;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;IAE9D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;IAEjE;;OAEG;IACH,QAAQ,CAAC,IAAI,MAAM,GAAG,IAAI,CAAA;IAE1B;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAA;IAEzD;;OAEG;IACH,OAAO,IAAI,IAAI,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACnC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAA;IAEvF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,UAAU,CAAC,WAAW,CAAC,CAAA;IAE5D;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAA;IAEnC;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAA;IAElD;;OAEG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B;;OAEG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAE9B;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IAEzB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAC1C,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAChC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAC3C,OAAO,CAAC,CAAC,GAAG,WAAW,KAAK,CAAC,GAAG,IAAI,CAAA;IACpC,OAAO,CAAC,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAC9C,KAAK,IAAI,IAAI,CAAA;CACd"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IAEV;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,WAAW;IACzC;;OAEG;IACH,IAAI,EAAE,CAAC,CAAA;IAEP;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,WAAW;IACxC;;OAEG;IACH,WAAW,EAAE,OAAO,CAAA;IAEpB;;OAEG;IACH,aAAa,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IAEd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAA;AAE1D;;;;GAIG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,WAAW;IACzC;;OAEG;IACH,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAAA;IAExB;;OAEG;IACH,eAAe,IAAI,OAAO,CAAA;IAE1B;;OAEG;IACH,OAAO,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAE1C;;OAEG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAEhC;;OAEG;IACH,KAAK,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAE5D;;OAEG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAEpD;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAEjC;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAE3C;;OAEG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvE;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9B;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;IAE9D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;IAEjE;;OAEG;IACH,QAAQ,CAAC,IAAI,MAAM,GAAG,IAAI,CAAA;IAE1B;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAA;IAEzD;;OAEG;IACH,OAAO,IAAI,IAAI,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACnC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAA;IAEvF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,UAAU,CAAC,WAAW,CAAC,CAAA;IAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAA;IAEnC;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAA;IAElD;;OAEG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B;;OAEG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAE9B;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IAEzB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAC1C,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAChC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAC3C,OAAO,CAAC,CAAC,GAAG,WAAW,KAAK,CAAC,GAAG,IAAI,CAAA;IACpC,OAAO,CAAC,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAC9C,KAAK,IAAI,IAAI,CAAA;CACd"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-auth",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Client-side authentication interface for molecule.dev",
   "type": "module",
   "main": "dist/index.js",