@molecule/app-auth 1.2.2 → 1.3.1

package/README.md

@@ -3,15 +3,11 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-10-16T21:58:38.432Z
+Generated: 2026-10-17T07:07:31.667Z
 -->
 
 # @molecule/app-auth
 
-> **Auto-generated, AI-first package reference** for the [molecule.dev](https://molecule.dev) ecosystem.
-> It is written to be read by coding agents as much as by people, and is generated from this
-> package's source — edit `src/index.ts` JSDoc, not this file.
-
 Client-side authentication interface for molecule.dev.
 
 Provides a unified auth API that works across different auth strategies
@@ -21,6 +17,10 @@ client; `setClient`/`getClient` bond it; `login`/`logout`/`register`/
 bindings (e.g. `AuthProvider`/`useAuth` in `@molecule/app-react`) wrap the
 same client.
 
+> **Auto-generated, AI-first package reference** for the [molecule.dev](https://molecule.dev) ecosystem.
+> It is written to be read by coding agents as much as by people, and is generated from this
+> package's source — edit `src/index.ts` JSDoc, not this file.
+
 ## Quick Start
 
 ```typescript
@@ -50,6 +50,30 @@ npm install @molecule/app-auth @molecule/app-bond @molecule/app-i18n @molecule/a
 
 ### Interfaces
 
+#### `BrowserStorageAdapterOptions`
+
+How {@link createBrowserStorageAdapter} picks the store it writes to.
+
+```typescript
+interface BrowserStorageAdapterOptions {
+  /**
+   * The Web Storage area to persist to (default `'local'`).
+   *
+   * `'session'` is the narrower choice: a reload keeps the session, closing the
+   * tab ends it. Pick it when the app only has to survive navigations within one
+   * session — which is all a `page.reload()` asks for.
+   */
+  kind?: BrowserStorageKind
+  /**
+   * A store to use instead of resolving `window.localStorage` /
+   * `window.sessionStorage` (a test double, a namespaced wrapper, or the
+   * `Storage` object another library exposes). Anything with `getItem`/
+   * `setItem`/`removeItem` does.
+   */
+  storage?: StorageAdapter
+}
+```
+
 #### `UserProfile`
 
 User profile information.
@@ -355,6 +379,12 @@ interface AuthClient<T = UserProfile> {
    *
    * Optional: a provider that restores no session has nothing to wait for. Without it, an
    * HTTP client bonded to that provider sends first-paint requests unauthenticated.
+   *
+   * A provider whose restore sends a request THROUGH the gated HTTP client must send that
+   * request with `skipAuthGate: true` (`RequestConfig` in `@molecule/app-http`): the gate
+   * waits on this promise, so holding the restore's own request makes the gate wait on
+   * itself and stalls every request it holds until it times out. `createJWTAuthClient`'s
+   * restore does not need it — it uses `fetch`, not the bonded client.
    */
   whenRestored?(): Promise<void>
 
@@ -437,10 +467,10 @@ interface AuthClientConfig {
 
   /**
    * Current-user endpoint for session restore (default `/users/me`). Called by
-   * `initialize()` with credentials to re-establish the session from the
-   * httpOnly cookie after a full page load — the only way to stay logged in when
-   * the bearer token is held in memory (the secure default; a localStorage copy
-   * is XSS-exfiltratable). Must return the user (as `user` or `props`).
+   * `initialize()` with credentials to re-establish the session after a full page
+   * load when the token did not survive the reload itself — i.e. when `storage` is
+   * `'memory'` and the API sets an httpOnly session cookie. Must return the user
+   * (as `user` or `props`).
    */
   currentUserEndpoint?: string
 
@@ -476,23 +506,36 @@ interface AuthClientConfig {
   mapAuthResponse?: (data: unknown) => AuthResult<UserProfile>
 
   /**
-   * Token storage type or custom storage adapter.
-   * - 'memory': In-memory storage (lost on page refresh)
-   * - StorageAdapter: Custom storage implementation (e.g., from `@molecule/app-storage`)
+   * Where the access/refresh token and the cached user are kept — the field that
+   * decides whether a page reload keeps the user signed in.
+   *
+   * - `'memory'` (the client's default): a process-local store, lost on reload.
+   *   Correct when the API sets an httpOnly session cookie, which `initialize()`
+   *   then restores through {@link AuthClientConfig.currentUserEndpoint} — the
+   *   strongest configuration, because no script can read the cookie.
+   * - a `StorageAdapter`: the token survives the reload itself. The browser
+   *   adapter is `createBrowserStorageAdapter()` (from `@molecule/app-auth`), and
+   *   the scaffold's generated auth bond (`src/bonds/auth-default.ts`) passes it;
+   *   `src/config.ts` leaves `storage` out on purpose. A bearer token in Web
+   *   Storage is readable by any script on the origin, so an XSS can steal it; see
+   *   that function's `@remarks` for the trade and for the cookie alternative.
+   *
+   * Any adapter with `getItem`/`setItem`/`removeItem` works — the methods are
+   * SYNCHRONOUS, so the async `@molecule/app-storage` provider
+   * (`getProvider()`, whose `get()` returns a Promise) is NOT one: wrap the
+   * `Storage` object it was built on (`createBrowserStorageAdapter({ storage })`),
+   * or store a different way.
    *
    * @example
    * ```typescript
-   * // Use in-memory storage
-   * storage: 'memory'
+   * import { createBrowserStorageAdapter } from '@molecule/app-auth'
    *
-   * // Use custom storage from `@molecule/app-storage`
-   * import { getProvider } from '@molecule/app-storage'
-   * const storageProvider = getProvider()
-   * storage: {
-   *   getItem: (key) => storageProvider.get(key),
-   *   setItem: (key, value) => storageProvider.set(key, value),
-   *   removeItem: (key) => storageProvider.remove(key),
-   * }
+   * // A reload keeps the session (the scaffold's own default):
+   * storage: createBrowserStorageAdapter()
+   * // Only this tab's lifetime, at a narrower exposure than localStorage:
+   * storage: createBrowserStorageAdapter({ kind: 'session' })
+   * // An httpOnly cookie session instead — memory only, the stronger route:
+   * storage: 'memory'
    * ```
    */
   storage?: 'memory' | StorageAdapter
@@ -568,6 +611,16 @@ interface TokenStorage {
 
 ### Types
 
+#### `BrowserStorageKind`
+
+Which Web Storage area {@link createBrowserStorageAdapter} persists to:
+`'local'` is `window.localStorage` (survives a reload AND the tab closing),
+`'session'` is `window.sessionStorage` (survives a reload, dies with the tab).
+
+```typescript
+type BrowserStorageKind = 'local' | 'session'
+```
+
 #### `AuthEvent`
 
 Auth event types.
@@ -591,6 +644,41 @@ type AuthEventListener = (event: AuthEvent) => void
 
 ### Functions
 
+#### `createBrowserStorageAdapter(options)`
+
+The auth client's `StorageAdapter` over the browser's Web Storage.
+
+Pass it as `AuthClientConfig.storage` to keep the session across a page reload:
+the client's default (`'memory'`) is lost on reload, and re-establishing the
+session then needs a credential that survived — this adapter, or an httpOnly
+session cookie the API sets (see the security note below).
+
+```ts
+import { createJWTAuthClient, createBrowserStorageAdapter } from '@molecule/app-auth'
+
+const authClient = createJWTAuthClient({
+  baseURL: '/api',
+  storage: createBrowserStorageAdapter(), // a reload keeps the user signed in
+})
+```
+
+The scaffold's `authConfig` already passes it, so a scaffolded app survives a
+reload out of the box; each of these replaces that default:
+
+```ts
+storage: 'memory' // memory only: pair it with an httpOnly cookie session
+storage: createBrowserStorageAdapter({ kind: 'session' }) // survives a reload, dies with the tab
+storage: { getItem: (k) => …, setItem: (k, v) => …, removeItem: (k) => … } // your own
+```
+
+```typescript
+function createBrowserStorageAdapter(options?: BrowserStorageAdapterOptions): StorageAdapter
+```
+
+- `options` — Which Web Storage area to use, or a store to use directly.
+
+**Returns:** A synchronous `StorageAdapter` bound to that store.
+
 #### `createJWTAuthClient(config)`
 
 Creates a simple JWT-based auth client.
@@ -643,7 +731,7 @@ Creates a token storage implementation backed by either in-memory
 storage or a custom `StorageAdapter`.
 
 ```typescript
-function createTokenStorage(storage?: 'memory' | StorageAdapter, prefix?: string): TokenStorage
+function createTokenStorage(storage?: StorageAdapter | 'memory', prefix?: string): TokenStorage
 ```
 
 - `storage` — `'memory'` for in-memory storage (lost on refresh), or a `StorageAdapter` for persistent storage.
@@ -762,15 +850,23 @@ Peer dependencies:
 - **An API with its own auth envelope keeps this client.** `requestBody` wraps the
   login/register payload (`(kind, p) => ({ user: p })`), `mapAuthResponse` reads the
   token and user out of the answer (`(d) => ({ accessToken: d.user.token, user: d.user })`),
-  and `authScheme: 'Token'` sends `Authorization: Token <jwt>`. Do not hand-write an
-  auth client for a spec like RealWorld.
-- **A page reload "logging the user out" is the config default, not a bug.**
-  Token storage defaults to `'memory'` (the secure default — a localStorage
-  bearer token is XSS-exfiltratable). Staying signed in across reloads works
-  by calling `client.initialize()` once at startup: it re-fetches
-  `currentUserEndpoint` (default `/users/me`) with the httpOnly cookie the
-  API set at login. Wire `initialize()`; do NOT "fix" reload-logout by
-  copying tokens into localStorage.
+  and `authScheme: 'Token'` sends `Authorization: Token <jwt>` — both are fields of the
+  `AuthClientConfig` the client is CONSTRUCTED with
+  (`setClient(createJWTAuthClient({ authScheme: 'Token', … }))` in the auth bond), not
+  properties of a client that already exists. Do not hand-write an auth client for a spec
+  like RealWorld.
+- **Whether a reload keeps the user signed in is `AuthClientConfig.storage`,
+  and one of the two routes must be wired.** The client's own default is
+  `'memory'`, which is lost on reload, so a session survives one only by
+  having a credential that survived: (1) `storage: createBrowserStorageAdapter()`
+  — the browser's `localStorage`, what a scaffolded app's `authConfig` passes
+  (see `@molecule/app-auth`'s `createBrowserStorageAdapter` for the trade: Web
+  Storage is script-readable, so an XSS can steal the token), or (2) an
+  httpOnly session cookie the API sets at login, which `initialize()` restores
+  through `currentUserEndpoint` (default `/users/me`) — the stronger option
+  wherever the API supports it, and what `@molecule/api-resource-user` issues.
+  Wire `initialize()` once at startup either way. Do NOT hand-roll a token
+  store beside the client for this: it is a config field.
 - **Endpoint defaults must match your API's real routes** (`/auth/login`,
   `/auth/register`, `/auth/refresh`, `/users/logout`, `/users/me`, …).
   Align them via `createJWTAuthClient({ baseURL, ...endpoints })` — never by
@@ -784,6 +880,13 @@ Peer dependencies:
   state being settled (`state.initialized`), or let the HTTP client do it — bond the
   auth client through `@molecule/app-bonds-default-react`, which registers
   `whenRestored()` as the http gate so every request waits for the restore.
+- **Your own session store's gate must exempt its restore's own request.** This client
+  restores with `fetch`, so the gate registered over it never holds the restore. A store
+  that restores THROUGH the bonded HTTP client and registers that restore as the gate
+  (`setAuthGate(() => store.whenSettled())`) waits on itself unless the restore's request
+  passes `skipAuthGate: true` — otherwise the gate holds the very request it is waiting
+  for, and every request it holds stalls until the gate times out. See
+  `RequestConfig.skipAuthGate` in `@molecule/app-http`.
 - Client-side auth state is UX only — the server enforces authorization on
   every request; hiding a screen is not protection.
 
@@ -813,22 +916,27 @@ by one. A box you can't check is an integration bug to fix — not a skip:
 - [ ] Visiting a protected route while logged OUT redirects to login (the
       guard reads `isAuthenticated()`), and after authenticating you land back on
       the originally-requested screen rather than a generic home.
-- [ ] The session survives a FULL page reload: after login, hard-reload →
-      `initialize()` restores it from the httpOnly cookie (via
-      `currentUserEndpoint`, default `/users/me`) and you stay signed in — you are
-      NOT bounced to login. (The in-memory bearer token is dropped by design; the
-      cookie restore is what keeps you in — do not "fix" this by writing the token
-      to localStorage.)
+- [ ] The session survives a FULL page reload: after login, hard-reload → you
+      stay signed in (the profile/sign-out UI a signed-in visitor sees is still
+      there), and you are NOT bounced to login. Which route does it is the app's
+      `AuthClientConfig.storage`: the scaffold's `createBrowserStorageAdapter()` keeps
+      the token in the browser, an httpOnly session cookie is restored by
+      `initialize()` through `currentUserEndpoint` (default `/users/me`). If the
+      app has neither — `storage` left at `'memory'` against an API that sets no
+      cookie — this box cannot be checked, and the fix is the config, not a token
+      store written beside the client.
 - [ ] Password reset round-trips: `requestPasswordReset({ email })` then
       `confirmPasswordReset({ token, password })` with the emailed token, after
       which `login()` with the NEW password succeeds and the OLD password no
       longer works.
 - [ ] Authorization holds: a signed-in user only ever reads/edits their OWN
       record (`getUser()` is the caller's profile, never another user's); the
-      bearer token lives in memory only — it is never written to
-      localStorage / sessionStorage where another script could read it; and an
-      expired/invalid token fails closed — the app re-authenticates (`refresh()`
-      or `logout()`), never silently serving another user's data.
+      token's storage is the deliberate choice `AuthClientConfig.storage` names —
+      if it is Web Storage (the scaffold default, which a reload requires when the
+      API sets no cookie), say so in the app's own words rather than leaving a
+      second, undocumented store beside it; and an expired/invalid token fails
+      closed — the app re-authenticates (`refresh()` or `logout()`), never
+      silently serving another user's data.
 
 ## Translations
 

package/dist/browser-storage.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The browser `StorageAdapter` for the auth client's token storage.
+ *
+ * @module
+ */
+import type { StorageAdapter } from './types.js';
+/**
+ * Which Web Storage area {@link createBrowserStorageAdapter} persists to:
+ * `'local'` is `window.localStorage` (survives a reload AND the tab closing),
+ * `'session'` is `window.sessionStorage` (survives a reload, dies with the tab).
+ */
+export type BrowserStorageKind = 'local' | 'session';
+/** How {@link createBrowserStorageAdapter} picks the store it writes to. */
+export interface BrowserStorageAdapterOptions {
+    /**
+     * The Web Storage area to persist to (default `'local'`).
+     *
+     * `'session'` is the narrower choice: a reload keeps the session, closing the
+     * tab ends it. Pick it when the app only has to survive navigations within one
+     * session — which is all a `page.reload()` asks for.
+     */
+    kind?: BrowserStorageKind;
+    /**
+     * A store to use instead of resolving `window.localStorage` /
+     * `window.sessionStorage` (a test double, a namespaced wrapper, or the
+     * `Storage` object another library exposes). Anything with `getItem`/
+     * `setItem`/`removeItem` does.
+     */
+    storage?: StorageAdapter;
+}
+/**
+ * The auth client's `StorageAdapter` over the browser's Web Storage.
+ *
+ * Pass it as `AuthClientConfig.storage` to keep the session across a page reload:
+ * the client's default (`'memory'`) is lost on reload, and re-establishing the
+ * session then needs a credential that survived — this adapter, or an httpOnly
+ * session cookie the API sets (see the security note below).
+ *
+ * ```ts
+ * import { createJWTAuthClient, createBrowserStorageAdapter } from '@molecule/app-auth'
+ *
+ * const authClient = createJWTAuthClient({
+ *   baseURL: '/api',
+ *   storage: createBrowserStorageAdapter(), // a reload keeps the user signed in
+ * })
+ * ```
+ *
+ * The scaffold's `authConfig` already passes it, so a scaffolded app survives a
+ * reload out of the box; each of these replaces that default:
+ *
+ * ```ts
+ * storage: 'memory' // memory only: pair it with an httpOnly cookie session
+ * storage: createBrowserStorageAdapter({ kind: 'session' }) // survives a reload, dies with the tab
+ * storage: { getItem: (k) => …, setItem: (k, v) => …, removeItem: (k) => … } // your own
+ * ```
+ *
+ * @remarks
+ * - **The trade, stated plainly.** A bearer token in Web Storage is readable by
+ *   any script on the origin, so one XSS is one token theft — an account takeover
+ *   for the token's whole lifetime, and `localStorage` keeps the copy after the
+ *   tab closes. This is the model the RealWorld suite's own specs write
+ *   (`localStorage.setItem('jwtToken', …)` before a reload) and the reason this
+ *   adapter exists.
+ * - **An httpOnly cookie session is STRONGER, and is the first choice wherever
+ *   your API supports it.** Script cannot read an httpOnly cookie, so an XSS
+ *   cannot exfiltrate the credential; the token stays in memory and
+ *   `initialize()` restores the session through `currentUserEndpoint`
+ *   (`@molecule/api-resource-user` issues exactly this cookie — that is why the
+ *   client's default is `'memory'`). If the API sets one, `storage: 'memory'` is
+ *   the strongest configuration. If it does not and you cannot change it, keep
+ *   the token's lifetime short and rotate it on refresh.
+ * - **`kind: 'session'` narrows the window** to the tab's lifetime at the cost of
+ *   losing the session in a new tab; `'local'` is the default because a reload is
+ *   the requirement it exists for, and a fresh tab is the same person.
+ * - **Unavailable storage degrades to memory; it never throws.** SSR (`window`
+ *   undefined), a private/blocked store and a full quota all fall back to a
+ *   process-local store — so a login still succeeds and the session simply does
+ *   not survive the next page load. A warning names the failure. Do not read a
+ *   successful `setItem` as a guarantee of persistence; a caller that needs one
+ *   must probe the store itself.
+ * - **The keys are the client's own** (`storagePrefix`, default
+ *   `molecule:auth:`, plus `accessToken` / `refreshToken` / `user`); this adapter
+ *   adds no prefix and stores nothing of its own.
+ *
+ * @param options - Which Web Storage area to use, or a store to use directly.
+ * @returns A synchronous `StorageAdapter` bound to that store.
+ */
+export declare const createBrowserStorageAdapter: (options?: BrowserStorageAdapterOptions) => StorageAdapter;
+//# sourceMappingURL=browser-storage.d.ts.map

package/dist/browser-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-storage.d.ts","sourceRoot":"","sources":["../src/browser-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,SAAS,CAAA;AAEpD,4EAA4E;AAC5E,MAAM,WAAW,4BAA4B;IAC3C;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,kBAAkB,CAAA;IACzB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAA;CACzB;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,2BAA2B,GACtC,UAAS,4BAAiC,KACzC,cA6EF,CAAA"}

package/dist/browser-storage.js

@@ -0,0 +1,163 @@
+/**
+ * The browser `StorageAdapter` for the auth client's token storage.
+ *
+ * @module
+ */
+import { getLogger } from '@molecule/app-logger';
+/** Best-effort logger: a missing logger bond must never break token storage. */
+const warn = (message, error) => {
+    try {
+        const logger = getLogger('auth');
+        if (error === undefined)
+            logger.warn(message);
+        else
+            logger.warn(message, { error });
+    }
+    catch (_error) {
+        // No logger bonded (a bare unit test, an SSR boot before the app's bonds):
+        // logging is not this adapter's contract, and throwing here would take the
+        // session down with it.
+    }
+};
+/**
+ * The auth client's `StorageAdapter` over the browser's Web Storage.
+ *
+ * Pass it as `AuthClientConfig.storage` to keep the session across a page reload:
+ * the client's default (`'memory'`) is lost on reload, and re-establishing the
+ * session then needs a credential that survived — this adapter, or an httpOnly
+ * session cookie the API sets (see the security note below).
+ *
+ * ```ts
+ * import { createJWTAuthClient, createBrowserStorageAdapter } from '@molecule/app-auth'
+ *
+ * const authClient = createJWTAuthClient({
+ *   baseURL: '/api',
+ *   storage: createBrowserStorageAdapter(), // a reload keeps the user signed in
+ * })
+ * ```
+ *
+ * The scaffold's `authConfig` already passes it, so a scaffolded app survives a
+ * reload out of the box; each of these replaces that default:
+ *
+ * ```ts
+ * storage: 'memory' // memory only: pair it with an httpOnly cookie session
+ * storage: createBrowserStorageAdapter({ kind: 'session' }) // survives a reload, dies with the tab
+ * storage: { getItem: (k) => …, setItem: (k, v) => …, removeItem: (k) => … } // your own
+ * ```
+ *
+ * @remarks
+ * - **The trade, stated plainly.** A bearer token in Web Storage is readable by
+ *   any script on the origin, so one XSS is one token theft — an account takeover
+ *   for the token's whole lifetime, and `localStorage` keeps the copy after the
+ *   tab closes. This is the model the RealWorld suite's own specs write
+ *   (`localStorage.setItem('jwtToken', …)` before a reload) and the reason this
+ *   adapter exists.
+ * - **An httpOnly cookie session is STRONGER, and is the first choice wherever
+ *   your API supports it.** Script cannot read an httpOnly cookie, so an XSS
+ *   cannot exfiltrate the credential; the token stays in memory and
+ *   `initialize()` restores the session through `currentUserEndpoint`
+ *   (`@molecule/api-resource-user` issues exactly this cookie — that is why the
+ *   client's default is `'memory'`). If the API sets one, `storage: 'memory'` is
+ *   the strongest configuration. If it does not and you cannot change it, keep
+ *   the token's lifetime short and rotate it on refresh.
+ * - **`kind: 'session'` narrows the window** to the tab's lifetime at the cost of
+ *   losing the session in a new tab; `'local'` is the default because a reload is
+ *   the requirement it exists for, and a fresh tab is the same person.
+ * - **Unavailable storage degrades to memory; it never throws.** SSR (`window`
+ *   undefined), a private/blocked store and a full quota all fall back to a
+ *   process-local store — so a login still succeeds and the session simply does
+ *   not survive the next page load. A warning names the failure. Do not read a
+ *   successful `setItem` as a guarantee of persistence; a caller that needs one
+ *   must probe the store itself.
+ * - **The keys are the client's own** (`storagePrefix`, default
+ *   `molecule:auth:`, plus `accessToken` / `refreshToken` / `user`); this adapter
+ *   adds no prefix and stores nothing of its own.
+ *
+ * @param options - Which Web Storage area to use, or a store to use directly.
+ * @returns A synchronous `StorageAdapter` bound to that store.
+ */
+export const createBrowserStorageAdapter = (options = {}) => {
+    const { kind = 'local', storage } = options;
+    // The fallback store: one Map per adapter, so an unusable Web Storage area
+    // still behaves like a store for the lifetime of the page.
+    const memory = new Map();
+    /** The store once it has answered, `null` while it is unusable (re-probed each call). */
+    let resolved;
+    /** The unusable-store warning is worth saying once, not on every token read. */
+    let warned = false;
+    const resolve = () => {
+        if (storage)
+            return storage;
+        if (resolved !== undefined && resolved !== null)
+            return resolved;
+        try {
+            const areas = globalThis;
+            const web = kind === 'session' ? areas.sessionStorage : areas.localStorage;
+            if (web) {
+                // A store can be PRESENT and still unusable (a blocked third-party
+                // context, a private mode): touching it throws, so probe before trusting it.
+                const probe = '__molecule_auth_probe__';
+                web.setItem(probe, probe);
+                web.removeItem(probe);
+                resolved = web;
+                return web;
+            }
+        }
+        catch (error) {
+            if (!warned) {
+                warned = true;
+                warn(`The ${kind} Web Storage area is not usable; keeping auth tokens in memory`, error);
+            }
+        }
+        // Not cached: a store that appears later (the app booting before its DOM is
+        // ready) is still picked up by the next call.
+        return null;
+    };
+    return {
+        getItem: (key) => {
+            const store = resolve();
+            if (!store)
+                return memory.get(key) ?? null;
+            try {
+                // A write that fell back to memory (a full or blocked store) is still
+                // this session's value: the store simply never received it.
+                return store.getItem(key) ?? memory.get(key) ?? null;
+            }
+            catch (error) {
+                warn('Reading a stored auth value failed; falling back to memory', error);
+                return memory.get(key) ?? null;
+            }
+        },
+        setItem: (key, value) => {
+            const store = resolve();
+            if (!store) {
+                memory.set(key, value);
+                return;
+            }
+            try {
+                store.setItem(key, value);
+                memory.delete(key);
+            }
+            catch (error) {
+                // A quota-full or blocked store must not fail a login: keep the value for
+                // this page's lifetime and say so. The session is lost on reload, which is
+                // the state the app was in before this adapter existed.
+                warn('Storing an auth value failed; keeping it in memory for this page', error);
+                memory.set(key, value);
+            }
+        },
+        removeItem: (key) => {
+            memory.delete(key);
+            const store = resolve();
+            if (!store)
+                return;
+            try {
+                store.removeItem(key);
+            }
+            catch (error) {
+                warn('Clearing a stored auth value failed', error);
+            }
+        },
+    };
+};
+//# sourceMappingURL=browser-storage.js.map

package/dist/browser-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-storage.js","sourceRoot":"","sources":["../src/browser-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AA8BhD,gFAAgF;AAChF,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,KAAe,EAAQ,EAAE;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;;YACxC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,2EAA2E;QAC3E,2EAA2E;QAC3E,wBAAwB;IAC1B,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,UAAwC,EAAE,EAC1B,EAAE;IAClB,MAAM,EAAE,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC3C,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,yFAAyF;IACzF,IAAI,QAA2C,CAAA;IAC/C,gFAAgF;IAChF,IAAI,MAAM,GAAG,KAAK,CAAA;IAElB,MAAM,OAAO,GAAG,GAA0B,EAAE;QAC1C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAC3B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAA;QAChE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,UAAmE,CAAA;YACjF,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAA;YAC1E,IAAI,GAAG,EAAE,CAAC;gBACR,mEAAmE;gBACnE,6EAA6E;gBAC7E,MAAM,KAAK,GAAG,yBAAyB,CAAA;gBACvC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;gBACzB,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;gBACrB,QAAQ,GAAG,GAAG,CAAA;gBACd,OAAO,GAAG,CAAA;YACZ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,IAAI,CAAA;gBACb,IAAI,CAAC,OAAO,IAAI,gEAAgE,EAAE,KAAK,CAAC,CAAA;YAC1F,CAAC;QACH,CAAC;QACD,4EAA4E;QAC5E,8CAA8C;QAC9C,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,OAAO,EAAE,CAAA;YACvB,IAAI,CAAC,KAAK;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YAC1C,IAAI,CAAC;gBACH,sEAAsE;gBACtE,4DAA4D;gBAC5D,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,4DAA4D,EAAE,KAAK,CAAC,CAAA;gBACzE,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YAChC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,KAAK,GAAG,OAAO,EAAE,CAAA;YACvB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACtB,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACzB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,0EAA0E;gBAC1E,2EAA2E;gBAC3E,wDAAwD;gBACxD,IAAI,CAAC,kEAAkE,EAAE,KAAK,CAAC,CAAA;gBAC/E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;QACD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAClB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAClB,MAAM,KAAK,GAAG,OAAO,EAAE,CAAA;YACvB,IAAI,CAAC,KAAK;gBAAE,OAAM;YAClB,IAAI,CAAC;gBACH,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAA;YACpD,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/index.d.ts

@@ -12,15 +12,23 @@
  * - **An API with its own auth envelope keeps this client.** `requestBody` wraps the
  *   login/register payload (`(kind, p) => ({ user: p })`), `mapAuthResponse` reads the
  *   token and user out of the answer (`(d) => ({ accessToken: d.user.token, user: d.user })`),
- *   and `authScheme: 'Token'` sends `Authorization: Token <jwt>`. Do not hand-write an
- *   auth client for a spec like RealWorld.
- * - **A page reload "logging the user out" is the config default, not a bug.**
- *   Token storage defaults to `'memory'` (the secure default — a localStorage
- *   bearer token is XSS-exfiltratable). Staying signed in across reloads works
- *   by calling `client.initialize()` once at startup: it re-fetches
- *   `currentUserEndpoint` (default `/users/me`) with the httpOnly cookie the
- *   API set at login. Wire `initialize()`; do NOT "fix" reload-logout by
- *   copying tokens into localStorage.
+ *   and `authScheme: 'Token'` sends `Authorization: Token <jwt>` — both are fields of the
+ *   `AuthClientConfig` the client is CONSTRUCTED with
+ *   (`setClient(createJWTAuthClient({ authScheme: 'Token', … }))` in the auth bond), not
+ *   properties of a client that already exists. Do not hand-write an auth client for a spec
+ *   like RealWorld.
+ * - **Whether a reload keeps the user signed in is `AuthClientConfig.storage`,
+ *   and one of the two routes must be wired.** The client's own default is
+ *   `'memory'`, which is lost on reload, so a session survives one only by
+ *   having a credential that survived: (1) `storage: createBrowserStorageAdapter()`
+ *   — the browser's `localStorage`, what a scaffolded app's `authConfig` passes
+ *   (see `@molecule/app-auth`'s `createBrowserStorageAdapter` for the trade: Web
+ *   Storage is script-readable, so an XSS can steal the token), or (2) an
+ *   httpOnly session cookie the API sets at login, which `initialize()` restores
+ *   through `currentUserEndpoint` (default `/users/me`) — the stronger option
+ *   wherever the API supports it, and what `@molecule/api-resource-user` issues.
+ *   Wire `initialize()` once at startup either way. Do NOT hand-roll a token
+ *   store beside the client for this: it is a config field.
  * - **Endpoint defaults must match your API's real routes** (`/auth/login`,
  *   `/auth/register`, `/auth/refresh`, `/users/logout`, `/users/me`, …).
  *   Align them via `createJWTAuthClient({ baseURL, ...endpoints })` — never by
@@ -34,6 +42,13 @@
  *   state being settled (`state.initialized`), or let the HTTP client do it — bond the
  *   auth client through `@molecule/app-bonds-default-react`, which registers
  *   `whenRestored()` as the http gate so every request waits for the restore.
+ * - **Your own session store's gate must exempt its restore's own request.** This client
+ *   restores with `fetch`, so the gate registered over it never holds the restore. A store
+ *   that restores THROUGH the bonded HTTP client and registers that restore as the gate
+ *   (`setAuthGate(() => store.whenSettled())`) waits on itself unless the restore's request
+ *   passes `skipAuthGate: true` — otherwise the gate holds the very request it is waiting
+ *   for, and every request it holds stalls until the gate times out. See
+ *   `RequestConfig.skipAuthGate` in `@molecule/app-http`.
  * - Client-side auth state is UX only — the server enforces authorization on
  *   every request; hiding a screen is not protection.
  *
@@ -75,25 +90,31 @@
  * - [ ] Visiting a protected route while logged OUT redirects to login (the
  *   guard reads `isAuthenticated()`), and after authenticating you land back on
  *   the originally-requested screen rather than a generic home.
- * - [ ] The session survives a FULL page reload: after login, hard-reload →
- *   `initialize()` restores it from the httpOnly cookie (via
- *   `currentUserEndpoint`, default `/users/me`) and you stay signed in — you are
- *   NOT bounced to login. (The in-memory bearer token is dropped by design; the
- *   cookie restore is what keeps you in — do not "fix" this by writing the token
- *   to localStorage.)
+ * - [ ] The session survives a FULL page reload: after login, hard-reload → you
+ *   stay signed in (the profile/sign-out UI a signed-in visitor sees is still
+ *   there), and you are NOT bounced to login. Which route does it is the app's
+ *   `AuthClientConfig.storage`: the scaffold's `createBrowserStorageAdapter()` keeps
+ *   the token in the browser, an httpOnly session cookie is restored by
+ *   `initialize()` through `currentUserEndpoint` (default `/users/me`). If the
+ *   app has neither — `storage` left at `'memory'` against an API that sets no
+ *   cookie — this box cannot be checked, and the fix is the config, not a token
+ *   store written beside the client.
  * - [ ] Password reset round-trips: `requestPasswordReset({ email })` then
  *   `confirmPasswordReset({ token, password })` with the emailed token, after
  *   which `login()` with the NEW password succeeds and the OLD password no
  *   longer works.
  * - [ ] Authorization holds: a signed-in user only ever reads/edits their OWN
  *   record (`getUser()` is the caller's profile, never another user's); the
- *   bearer token lives in memory only — it is never written to
- *   localStorage / sessionStorage where another script could read it; and an
- *   expired/invalid token fails closed — the app re-authenticates (`refresh()`
- *   or `logout()`), never silently serving another user's data.
+ *   token's storage is the deliberate choice `AuthClientConfig.storage` names —
+ *   if it is Web Storage (the scaffold default, which a reload requires when the
+ *   API sets no cookie), say so in the app's own words rather than leaving a
+ *   second, undocumented store beside it; and an expired/invalid token fails
+ *   closed — the app re-authenticates (`refresh()` or `logout()`), never
+ *   silently serving another user's data.
  *
  * @module
  */
+export * from './browser-storage.js';
 export * from './client.js';
 export * from './provider.js';
 export * from './token.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmHG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/index.js

@@ -12,15 +12,23 @@
  * - **An API with its own auth envelope keeps this client.** `requestBody` wraps the
  *   login/register payload (`(kind, p) => ({ user: p })`), `mapAuthResponse` reads the
  *   token and user out of the answer (`(d) => ({ accessToken: d.user.token, user: d.user })`),
- *   and `authScheme: 'Token'` sends `Authorization: Token <jwt>`. Do not hand-write an
- *   auth client for a spec like RealWorld.
- * - **A page reload "logging the user out" is the config default, not a bug.**
- *   Token storage defaults to `'memory'` (the secure default — a localStorage
- *   bearer token is XSS-exfiltratable). Staying signed in across reloads works
- *   by calling `client.initialize()` once at startup: it re-fetches
- *   `currentUserEndpoint` (default `/users/me`) with the httpOnly cookie the
- *   API set at login. Wire `initialize()`; do NOT "fix" reload-logout by
- *   copying tokens into localStorage.
+ *   and `authScheme: 'Token'` sends `Authorization: Token <jwt>` — both are fields of the
+ *   `AuthClientConfig` the client is CONSTRUCTED with
+ *   (`setClient(createJWTAuthClient({ authScheme: 'Token', … }))` in the auth bond), not
+ *   properties of a client that already exists. Do not hand-write an auth client for a spec
+ *   like RealWorld.
+ * - **Whether a reload keeps the user signed in is `AuthClientConfig.storage`,
+ *   and one of the two routes must be wired.** The client's own default is
+ *   `'memory'`, which is lost on reload, so a session survives one only by
+ *   having a credential that survived: (1) `storage: createBrowserStorageAdapter()`
+ *   — the browser's `localStorage`, what a scaffolded app's `authConfig` passes
+ *   (see `@molecule/app-auth`'s `createBrowserStorageAdapter` for the trade: Web
+ *   Storage is script-readable, so an XSS can steal the token), or (2) an
+ *   httpOnly session cookie the API sets at login, which `initialize()` restores
+ *   through `currentUserEndpoint` (default `/users/me`) — the stronger option
+ *   wherever the API supports it, and what `@molecule/api-resource-user` issues.
+ *   Wire `initialize()` once at startup either way. Do NOT hand-roll a token
+ *   store beside the client for this: it is a config field.
  * - **Endpoint defaults must match your API's real routes** (`/auth/login`,
  *   `/auth/register`, `/auth/refresh`, `/users/logout`, `/users/me`, …).
  *   Align them via `createJWTAuthClient({ baseURL, ...endpoints })` — never by
@@ -34,6 +42,13 @@
  *   state being settled (`state.initialized`), or let the HTTP client do it — bond the
  *   auth client through `@molecule/app-bonds-default-react`, which registers
  *   `whenRestored()` as the http gate so every request waits for the restore.
+ * - **Your own session store's gate must exempt its restore's own request.** This client
+ *   restores with `fetch`, so the gate registered over it never holds the restore. A store
+ *   that restores THROUGH the bonded HTTP client and registers that restore as the gate
+ *   (`setAuthGate(() => store.whenSettled())`) waits on itself unless the restore's request
+ *   passes `skipAuthGate: true` — otherwise the gate holds the very request it is waiting
+ *   for, and every request it holds stalls until the gate times out. See
+ *   `RequestConfig.skipAuthGate` in `@molecule/app-http`.
  * - Client-side auth state is UX only — the server enforces authorization on
  *   every request; hiding a screen is not protection.
  *
@@ -75,25 +90,31 @@
  * - [ ] Visiting a protected route while logged OUT redirects to login (the
  *   guard reads `isAuthenticated()`), and after authenticating you land back on
  *   the originally-requested screen rather than a generic home.
- * - [ ] The session survives a FULL page reload: after login, hard-reload →
- *   `initialize()` restores it from the httpOnly cookie (via
- *   `currentUserEndpoint`, default `/users/me`) and you stay signed in — you are
- *   NOT bounced to login. (The in-memory bearer token is dropped by design; the
- *   cookie restore is what keeps you in — do not "fix" this by writing the token
- *   to localStorage.)
+ * - [ ] The session survives a FULL page reload: after login, hard-reload → you
+ *   stay signed in (the profile/sign-out UI a signed-in visitor sees is still
+ *   there), and you are NOT bounced to login. Which route does it is the app's
+ *   `AuthClientConfig.storage`: the scaffold's `createBrowserStorageAdapter()` keeps
+ *   the token in the browser, an httpOnly session cookie is restored by
+ *   `initialize()` through `currentUserEndpoint` (default `/users/me`). If the
+ *   app has neither — `storage` left at `'memory'` against an API that sets no
+ *   cookie — this box cannot be checked, and the fix is the config, not a token
+ *   store written beside the client.
  * - [ ] Password reset round-trips: `requestPasswordReset({ email })` then
  *   `confirmPasswordReset({ token, password })` with the emailed token, after
  *   which `login()` with the NEW password succeeds and the OLD password no
  *   longer works.
  * - [ ] Authorization holds: a signed-in user only ever reads/edits their OWN
  *   record (`getUser()` is the caller's profile, never another user's); the
- *   bearer token lives in memory only — it is never written to
- *   localStorage / sessionStorage where another script could read it; and an
- *   expired/invalid token fails closed — the app re-authenticates (`refresh()`
- *   or `logout()`), never silently serving another user's data.
+ *   token's storage is the deliberate choice `AuthClientConfig.storage` names —
+ *   if it is Web Storage (the scaffold default, which a reload requires when the
+ *   API sets no cookie), say so in the app's own words rather than leaving a
+ *   second, undocumented store beside it; and an expired/invalid token fails
+ *   closed — the app re-authenticates (`refresh()` or `logout()`), never
+ *   silently serving another user's data.
  *
  * @module
  */
+export * from './browser-storage.js';
 export * from './client.js';
 export * from './provider.js';
 export * from './token.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmHG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/token.d.ts

@@ -17,17 +17,12 @@ import type { StorageAdapter, TokenStorage } from './types.js';
  *
  * @example
  * ```typescript
- * // In-memory storage (default)
+ * // In-memory storage (the client's default)
  * const storage = createTokenStorage('memory')
  *
- * // Custom storage adapter from @molecule/app-storage
- * import { getProvider } from '@molecule/app-storage'
- * const provider = getProvider()
- * const storage = createTokenStorage({
- *   getItem: (key) => provider.get(key),
- *   setItem: (key, value) => provider.set(key, value),
- *   removeItem: (key) => provider.remove(key),
- * })
+ * // The browser's persistent storage — a reload keeps the session
+ * import { createBrowserStorageAdapter } from '@molecule/app-auth'
+ * const storage = createTokenStorage(createBrowserStorageAdapter())
  * ```
  */
 export declare const createTokenStorage: (storage?: "memory" | StorageAdapter, prefix?: string) => TokenStorage;

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AAE3E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAS,QAAQ,GAAG,cAAyB,EAC7C,SAAQ,MAAyB,KAChC,YAoDF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,MAAM,KAAG,CAAC,GAAG,IAWzE,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,gBAAe,MAAU,KAAG,OAMzE,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,MAAM,GAAG,IAI3D,CAAA"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAS,QAAQ,GAAG,cAAyB,EAC7C,SAAQ,MAAyB,KAChC,YAoDF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,MAAM,KAAG,CAAC,GAAG,IAWzE,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,gBAAe,MAAU,KAAG,OAMzE,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,MAAM,GAAG,IAI3D,CAAA"}

package/dist/token.js

@@ -16,17 +16,12 @@
  *
  * @example
  * ```typescript
- * // In-memory storage (default)
+ * // In-memory storage (the client's default)
  * const storage = createTokenStorage('memory')
  *
- * // Custom storage adapter from @molecule/app-storage
- * import { getProvider } from '@molecule/app-storage'
- * const provider = getProvider()
- * const storage = createTokenStorage({
- *   getItem: (key) => provider.get(key),
- *   setItem: (key, value) => provider.set(key, value),
- *   removeItem: (key) => provider.remove(key),
- * })
+ * // The browser's persistent storage — a reload keeps the session
+ * import { createBrowserStorageAdapter } from '@molecule/app-auth'
+ * const storage = createTokenStorage(createBrowserStorageAdapter())
  * ```
  */
 export const createTokenStorage = (storage = 'memory', prefix = 'molecule:auth:') => {

package/dist/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,UAAqC,QAAQ,EAC7C,SAAiB,gBAAgB,EACnB,EAAE;IAChB,MAAM,WAAW,GAAkC,EAAE,CAAA;IAErD,4BAA4B;IAC5B,IAAI,OAAO,GAA0B,IAAI,CAAA;IACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,GAAG,OAAO,CAAA;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAiB,EAAE;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;IACjC,CAAC,CAAA;IAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAoB,EAAQ,EAAE;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAC1B,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;QACxC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC;QACpD,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC;QAC1C,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC;QACtD,OAAO,EAAE,GAA8B,EAAE;YACvC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;YACxB,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YACtB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAA;YAC9B,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,2EAA2E;gBAC3E,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAkB,IAAc,EAAE,EAAE;YAC3C,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACjD,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;YACxB,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;YACzB,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACnB,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAA8B,KAAa,EAAY,EAAE;IAC/E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QACnE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAA;IACjC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,sFAAsF;QACtF,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,gBAAwB,CAAC,EAAW,EAAE;IAClF,MAAM,OAAO,GAAG,QAAQ,CAAmB,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAA;IAC7C,OAAO,GAAG,IAAI,SAAS,CAAA;AACzB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAiB,EAAE;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAmB,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACzC,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;AAC3B,CAAC,CAAA"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,UAAqC,QAAQ,EAC7C,SAAiB,gBAAgB,EACnB,EAAE;IAChB,MAAM,WAAW,GAAkC,EAAE,CAAA;IAErD,4BAA4B;IAC5B,IAAI,OAAO,GAA0B,IAAI,CAAA;IACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,GAAG,OAAO,CAAA;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAiB,EAAE;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;IACjC,CAAC,CAAA;IAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAoB,EAAQ,EAAE;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAC1B,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;QACxC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC;QACpD,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC;QAC1C,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC;QACtD,OAAO,EAAE,GAA8B,EAAE;YACvC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;YACxB,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YACtB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAA;YAC9B,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,2EAA2E;gBAC3E,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAkB,IAAc,EAAE,EAAE;YAC3C,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACjD,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;YACxB,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;YACzB,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACnB,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAA8B,KAAa,EAAY,EAAE;IAC/E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QACnE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAA;IACjC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,sFAAsF;QACtF,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,gBAAwB,CAAC,EAAW,EAAE;IAClF,MAAM,OAAO,GAAG,QAAQ,CAAmB,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAA;IAC7C,OAAO,GAAG,IAAI,SAAS,CAAA;AACzB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAiB,EAAE;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAmB,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACzC,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;AAC3B,CAAC,CAAA"}

package/dist/types.d.ts

@@ -263,6 +263,12 @@ export interface AuthClient<T = UserProfile> {
      *
      * Optional: a provider that restores no session has nothing to wait for. Without it, an
      * HTTP client bonded to that provider sends first-paint requests unauthenticated.
+     *
+     * A provider whose restore sends a request THROUGH the gated HTTP client must send that
+     * request with `skipAuthGate: true` (`RequestConfig` in `@molecule/app-http`): the gate
+     * waits on this promise, so holding the restore's own request makes the gate wait on
+     * itself and stalls every request it holds until it times out. `createJWTAuthClient`'s
+     * restore does not need it — it uses `fetch`, not the bonded client.
      */
     whenRestored?(): Promise<void>;
     /**
@@ -326,10 +332,10 @@ export interface AuthClientConfig {
     profileEndpoint?: string;
     /**
      * Current-user endpoint for session restore (default `/users/me`). Called by
-     * `initialize()` with credentials to re-establish the session from the
-     * httpOnly cookie after a full page load — the only way to stay logged in when
-     * the bearer token is held in memory (the secure default; a localStorage copy
-     * is XSS-exfiltratable). Must return the user (as `user` or `props`).
+     * `initialize()` with credentials to re-establish the session after a full page
+     * load when the token did not survive the reload itself — i.e. when `storage` is
+     * `'memory'` and the API sets an httpOnly session cookie. Must return the user
+     * (as `user` or `props`).
      */
     currentUserEndpoint?: string;
     /**
@@ -360,23 +366,36 @@ export interface AuthClientConfig {
      */
     mapAuthResponse?: (data: unknown) => AuthResult<UserProfile>;
     /**
-     * Token storage type or custom storage adapter.
-     * - 'memory': In-memory storage (lost on page refresh)
-     * - StorageAdapter: Custom storage implementation (e.g., from `@molecule/app-storage`)
+     * Where the access/refresh token and the cached user are kept — the field that
+     * decides whether a page reload keeps the user signed in.
+     *
+     * - `'memory'` (the client's default): a process-local store, lost on reload.
+     *   Correct when the API sets an httpOnly session cookie, which `initialize()`
+     *   then restores through {@link AuthClientConfig.currentUserEndpoint} — the
+     *   strongest configuration, because no script can read the cookie.
+     * - a `StorageAdapter`: the token survives the reload itself. The browser
+     *   adapter is `createBrowserStorageAdapter()` (from `@molecule/app-auth`), and
+     *   the scaffold's generated auth bond (`src/bonds/auth-default.ts`) passes it;
+     *   `src/config.ts` leaves `storage` out on purpose. A bearer token in Web
+     *   Storage is readable by any script on the origin, so an XSS can steal it; see
+     *   that function's `@remarks` for the trade and for the cookie alternative.
+     *
+     * Any adapter with `getItem`/`setItem`/`removeItem` works — the methods are
+     * SYNCHRONOUS, so the async `@molecule/app-storage` provider
+     * (`getProvider()`, whose `get()` returns a Promise) is NOT one: wrap the
+     * `Storage` object it was built on (`createBrowserStorageAdapter({ storage })`),
+     * or store a different way.
      *
      * @example
      * ```typescript
-     * // Use in-memory storage
-     * storage: 'memory'
+     * import { createBrowserStorageAdapter } from '@molecule/app-auth'
      *
-     * // Use custom storage from `@molecule/app-storage`
-     * import { getProvider } from '@molecule/app-storage'
-     * const storageProvider = getProvider()
-     * storage: {
-     *   getItem: (key) => storageProvider.get(key),
-     *   setItem: (key, value) => storageProvider.set(key, value),
-     *   removeItem: (key) => storageProvider.remove(key),
-     * }
+     * // A reload keeps the session (the scaffold's own default):
+     * storage: createBrowserStorageAdapter()
+     * // Only this tab's lifetime, at a narrower exposure than localStorage:
+     * storage: createBrowserStorageAdapter({ kind: 'session' })
+     * // An httpOnly cookie session instead — memory only, the stronger route:
+     * storage: 'memory'
      * ```
      */
     storage?: 'memory' | StorageAdapter;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IAEV;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,WAAW;IACzC;;OAEG;IACH,IAAI,EAAE,CAAC,CAAA;IAEP;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,WAAW;IACxC;;OAEG;IACH,WAAW,EAAE,OAAO,CAAA;IAEpB;;OAEG;IACH,aAAa,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IAEd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAA;AAE1D;;;;GAIG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,WAAW;IACzC;;OAEG;IACH,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAAA;IAExB;;OAEG;IACH,eAAe,IAAI,OAAO,CAAA;IAE1B;;OAEG;IACH,OAAO,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAE1C;;OAEG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAEhC;;OAEG;IACH,KAAK,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAE5D;;OAEG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAEpD;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAEjC;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAE3C;;OAEG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvE;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3B;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9B;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;IAE9D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;IAEjE;;OAEG;IACH,QAAQ,CAAC,IAAI,MAAM,GAAG,IAAI,CAAA;IAE1B;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAA;IAEzD;;OAEG;IACH,OAAO,IAAI,IAAI,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACnC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAA;IAEvF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,UAAU,CAAC,WAAW,CAAC,CAAA;IAE5D;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAA;IAEnC;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAA;IAElD;;OAEG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B;;OAEG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAE9B;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IAEzB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAC1C,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAChC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAC3C,OAAO,CAAC,CAAC,GAAG,WAAW,KAAK,CAAC,GAAG,IAAI,CAAA;IACpC,OAAO,CAAC,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAC9C,KAAK,IAAI,IAAI,CAAA;CACd"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IAEV;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,WAAW;IACzC;;OAEG;IACH,IAAI,EAAE,CAAC,CAAA;IAEP;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,WAAW;IACxC;;OAEG;IACH,WAAW,EAAE,OAAO,CAAA;IAEpB;;OAEG;IACH,aAAa,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IAEd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAA;AAE1D;;;;GAIG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,WAAW;IACzC;;OAEG;IACH,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAAA;IAExB;;OAEG;IACH,eAAe,IAAI,OAAO,CAAA;IAE1B;;OAEG;IACH,OAAO,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAE1C;;OAEG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAEhC;;OAEG;IACH,KAAK,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAE5D;;OAEG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAEpD;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAEjC;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAE3C;;OAEG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvE;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9B;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;IAE9D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;IAEjE;;OAEG;IACH,QAAQ,CAAC,IAAI,MAAM,GAAG,IAAI,CAAA;IAE1B;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAA;IAEzD;;OAEG;IACH,OAAO,IAAI,IAAI,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACnC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAA;IAEvF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,UAAU,CAAC,WAAW,CAAC,CAAA;IAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAA;IAEnC;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAA;IAElD;;OAEG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B;;OAEG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAE9B;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IAEzB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAC1C,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAChC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAC3C,OAAO,CAAC,CAAC,GAAG,WAAW,KAAK,CAAC,GAAG,IAAI,CAAA;IACpC,OAAO,CAAC,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAC9C,KAAK,IAAI,IAAI,CAAA;CACd"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-auth",
-  "version": "1.2.2",
+  "version": "1.3.1",
   "description": "Client-side authentication interface for molecule.dev",
   "type": "module",
   "main": "dist/index.js",