@molecule/app-auth 1.5.2 → 1.5.4

package/dist/index.d.ts

@@ -46,9 +46,19 @@
  * **`getState().status` is the session state to render, in one value.**
  * `'loading'` (no decision yet) → `'authenticated'` / `'unauthenticated'`, and
  * `'unavailable'` when a stored session exists but the server could not confirm it.
+ * **A stored token AND a stored user make the FIRST render `'authenticated'`**:
+ * `initialize()` sets that state synchronously, before any request, and every
+ * verification settles behind that render. Never hold the first paint on
+ * `validateSession()` or a `/me` request of your own — a protected page then pays
+ * an API round trip on every navigation (xr-molecule-flash-m177: ~30 full page
+ * loads in one pagination spec; its four tests sat at 15.0–15.9 s of a 15 s
+ * budget and the grader timed two out). Route guards read this same `status`:
+ * wait only while it is `'loading'`.
  * `validateSession()` is the background re-check that produces the last two: call
- * it after the first render — a 4xx clears the token (`'unauthenticated'`), a
- * network failure or 5xx KEEPS it (`'unavailable'`, retryable). Do not build a
+ * it after the first render — a 401 or 403 clears the token (`'unauthenticated'`),
+ * while a network failure, a 5xx, or a 404 from a wrong `currentUserEndpoint`
+ * KEEPS the token and the user (`'unavailable'`, retryable; the 404 error names
+ * `currentUserEndpoint`). Do not build a
  * `validating`/`unavailable` flag beside the client: a second module-level state
  * plus its own listener set is a second session store, and it drifts from the
  * client's.
@@ -62,10 +72,27 @@
  * (`validateSession()` clears it) or the user logs out. `autoRefresh: true`
  * against such an API is harmless but pointless — leave it `false`.
  *
+ * **Seeding a session from an exchange the app runs itself: `setSession()`.** When an OAuth
+ * redirect or the app's own sign-in endpoint has already issued the token and returned the
+ * user, `setSession({ accessToken, user })` stores both and flips the client to
+ * `authenticated` in one update, so every hook reading the shared client is signed in at once
+ * (a form's own sign-in code wrote the token and the user with `setAccessToken`/`setUser`,
+ * which change their field only — the UI stayed signed out and nine browser assertions timed
+ * out, xr-molecule-flash-m178). `setAccessToken()` and `setUser()` are field setters, not a
+ * sign-in: neither sets `authenticated`.
+ *
+ * **A background verification that returns an unchanged user changes nothing.** When
+ * `validateSession()` (or a reload's restore) answers with the same profile data the client
+ * already holds, the client keeps the SAME user object and does not notify subscribers — so an
+ * effect seeded from `user` does not re-run, and a form it fills keeps what has been typed.
+ * Seed such a form once (on its first load), never on every `user` identity.
+ *
  * **A token another tool reads at its own key is a CONFIG field, not a mirror.**
  * An e2e suite or host page that expects `localStorage.jwtToken` (the RealWorld
- * specs do) is satisfied by `tokenKey: 'jwtToken'` with
- * `storage: createBrowserStorageAdapter()`; writing the token into that key from a
+ * specs do) is satisfied by `tokenKey: 'jwtToken'` — in a browser the client's
+ * storage default is already `createBrowserStorageAdapter()`, so with an explicit
+ * `'memory'` store you must also pass
+ * `storage: createBrowserStorageAdapter()`. Writing the token into that key from a
  * subscription beside the client is a second store. In React, `useAuth()` from
  * `@molecule/app-react` returns the client's `state` (with `status`), `user` and
  * `isAuthenticated`; the token is `useAuthClient().getAccessToken()`.
@@ -83,7 +110,11 @@
  * - **An API with its own auth envelope keeps this client.** `requestBody` wraps the
  *   login/register payload (`(kind, p) => ({ user: p })`), `mapAuthResponse` reads the
  *   token and user out of the answer (`(d) => ({ accessToken: d.user.token, user: d.user })`),
- *   and `authScheme: 'Token'` sends `Authorization: Token <jwt>` — both are fields of the
+ *   and `authScheme: 'Token'` sends `Authorization: Token <jwt>`. `mapAuthResponse` is the
+ *   ONE user-shape adapter: the client applies it to every answer that carries a user (login,
+ *   register, `validateSession()`, the cookie restore, a token refresh, `updateProfile()`), so
+ *   the adapted profile survives a reload instead of being replaced by the raw wire user.
+ *   Both are fields of the
  *   `AuthClientConfig` the client is CONSTRUCTED with
  *   (`setClient(createJWTAuthClient({ authScheme: 'Token', … }))` in the auth bond), not
  *   properties of a client that already exists. Do not hand-write an auth client for a spec
@@ -161,12 +192,12 @@
  * - [ ] The session survives a FULL page reload: after login, hard-reload → you
  *   stay signed in (the profile/sign-out UI a signed-in visitor sees is still
  *   there), and you are NOT bounced to login. Which route does it is the app's
- *   `AuthClientConfig.storage`: the scaffold's `createBrowserStorageAdapter()` keeps
- *   the token in the browser, an httpOnly session cookie is restored by
- *   `initialize()` through `currentUserEndpoint` (default `/users/me`). If the
- *   app has neither — `storage` left at `'memory'` against an API that sets no
- *   cookie — this box cannot be checked, and the fix is the config, not a token
- *   store written beside the client.
+ *   `AuthClientConfig.storage`: in a browser the client defaults to
+ *   `createBrowserStorageAdapter()`, which keeps the token there; an httpOnly
+ *   session cookie is restored by `initialize()` through `currentUserEndpoint`
+ *   (default `/users/me`). If the app sets `storage: 'memory'` explicitly against
+ *   an API that sets no cookie, this box cannot be checked, and the fix is the
+ *   config, not a token store written beside the client.
  * - [ ] Password reset round-trips: `requestPasswordReset({ email })` then
  *   `confirmPasswordReset({ token, password })` with the emailed token, after
  *   which `login()` with the NEW password succeeds and the OLD password no

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuLG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsNG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/index.js

@@ -46,9 +46,19 @@
  * **`getState().status` is the session state to render, in one value.**
  * `'loading'` (no decision yet) → `'authenticated'` / `'unauthenticated'`, and
  * `'unavailable'` when a stored session exists but the server could not confirm it.
+ * **A stored token AND a stored user make the FIRST render `'authenticated'`**:
+ * `initialize()` sets that state synchronously, before any request, and every
+ * verification settles behind that render. Never hold the first paint on
+ * `validateSession()` or a `/me` request of your own — a protected page then pays
+ * an API round trip on every navigation (xr-molecule-flash-m177: ~30 full page
+ * loads in one pagination spec; its four tests sat at 15.0–15.9 s of a 15 s
+ * budget and the grader timed two out). Route guards read this same `status`:
+ * wait only while it is `'loading'`.
  * `validateSession()` is the background re-check that produces the last two: call
- * it after the first render — a 4xx clears the token (`'unauthenticated'`), a
- * network failure or 5xx KEEPS it (`'unavailable'`, retryable). Do not build a
+ * it after the first render — a 401 or 403 clears the token (`'unauthenticated'`),
+ * while a network failure, a 5xx, or a 404 from a wrong `currentUserEndpoint`
+ * KEEPS the token and the user (`'unavailable'`, retryable; the 404 error names
+ * `currentUserEndpoint`). Do not build a
  * `validating`/`unavailable` flag beside the client: a second module-level state
  * plus its own listener set is a second session store, and it drifts from the
  * client's.
@@ -62,10 +72,27 @@
  * (`validateSession()` clears it) or the user logs out. `autoRefresh: true`
  * against such an API is harmless but pointless — leave it `false`.
  *
+ * **Seeding a session from an exchange the app runs itself: `setSession()`.** When an OAuth
+ * redirect or the app's own sign-in endpoint has already issued the token and returned the
+ * user, `setSession({ accessToken, user })` stores both and flips the client to
+ * `authenticated` in one update, so every hook reading the shared client is signed in at once
+ * (a form's own sign-in code wrote the token and the user with `setAccessToken`/`setUser`,
+ * which change their field only — the UI stayed signed out and nine browser assertions timed
+ * out, xr-molecule-flash-m178). `setAccessToken()` and `setUser()` are field setters, not a
+ * sign-in: neither sets `authenticated`.
+ *
+ * **A background verification that returns an unchanged user changes nothing.** When
+ * `validateSession()` (or a reload's restore) answers with the same profile data the client
+ * already holds, the client keeps the SAME user object and does not notify subscribers — so an
+ * effect seeded from `user` does not re-run, and a form it fills keeps what has been typed.
+ * Seed such a form once (on its first load), never on every `user` identity.
+ *
  * **A token another tool reads at its own key is a CONFIG field, not a mirror.**
  * An e2e suite or host page that expects `localStorage.jwtToken` (the RealWorld
- * specs do) is satisfied by `tokenKey: 'jwtToken'` with
- * `storage: createBrowserStorageAdapter()`; writing the token into that key from a
+ * specs do) is satisfied by `tokenKey: 'jwtToken'` — in a browser the client's
+ * storage default is already `createBrowserStorageAdapter()`, so with an explicit
+ * `'memory'` store you must also pass
+ * `storage: createBrowserStorageAdapter()`. Writing the token into that key from a
  * subscription beside the client is a second store. In React, `useAuth()` from
  * `@molecule/app-react` returns the client's `state` (with `status`), `user` and
  * `isAuthenticated`; the token is `useAuthClient().getAccessToken()`.
@@ -83,7 +110,11 @@
  * - **An API with its own auth envelope keeps this client.** `requestBody` wraps the
  *   login/register payload (`(kind, p) => ({ user: p })`), `mapAuthResponse` reads the
  *   token and user out of the answer (`(d) => ({ accessToken: d.user.token, user: d.user })`),
- *   and `authScheme: 'Token'` sends `Authorization: Token <jwt>` — both are fields of the
+ *   and `authScheme: 'Token'` sends `Authorization: Token <jwt>`. `mapAuthResponse` is the
+ *   ONE user-shape adapter: the client applies it to every answer that carries a user (login,
+ *   register, `validateSession()`, the cookie restore, a token refresh, `updateProfile()`), so
+ *   the adapted profile survives a reload instead of being replaced by the raw wire user.
+ *   Both are fields of the
  *   `AuthClientConfig` the client is CONSTRUCTED with
  *   (`setClient(createJWTAuthClient({ authScheme: 'Token', … }))` in the auth bond), not
  *   properties of a client that already exists. Do not hand-write an auth client for a spec
@@ -161,12 +192,12 @@
  * - [ ] The session survives a FULL page reload: after login, hard-reload → you
  *   stay signed in (the profile/sign-out UI a signed-in visitor sees is still
  *   there), and you are NOT bounced to login. Which route does it is the app's
- *   `AuthClientConfig.storage`: the scaffold's `createBrowserStorageAdapter()` keeps
- *   the token in the browser, an httpOnly session cookie is restored by
- *   `initialize()` through `currentUserEndpoint` (default `/users/me`). If the
- *   app has neither — `storage` left at `'memory'` against an API that sets no
- *   cookie — this box cannot be checked, and the fix is the config, not a token
- *   store written beside the client.
+ *   `AuthClientConfig.storage`: in a browser the client defaults to
+ *   `createBrowserStorageAdapter()`, which keeps the token there; an httpOnly
+ *   session cookie is restored by `initialize()` through `currentUserEndpoint`
+ *   (default `/users/me`). If the app sets `storage: 'memory'` explicitly against
+ *   an API that sets no cookie, this box cannot be checked, and the fix is the
+ *   config, not a token store written beside the client.
  * - [ ] Password reset round-trips: `requestPasswordReset({ email })` then
  *   `confirmPasswordReset({ token, password })` with the emailed token, after
  *   which `login()` with the NEW password succeeds and the OLD password no

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuLG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsNG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/token.d.ts

@@ -19,7 +19,8 @@ import type { StorageAdapter, TokenStorage } from './types.js';
  *
  * @example
  * ```typescript
- * // In-memory storage (the client's default)
+ * // In-memory storage (this factory's default; the client's browser default is
+ * // createBrowserStorageAdapter — pass `'memory'` there for a cookie session)
  * const storage = createTokenStorage('memory')
  *
  * // The browser's persistent storage — a reload keeps the session

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AAE3E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAS,QAAQ,GAAG,cAAyB,EAC7C,SAAQ,MAAyB,EACjC,WAAW,MAAM,KAChB,YAsEF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,MAAM,KAAG,CAAC,GAAG,IAWzE,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,gBAAe,MAAU,KAAG,OAMzE,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,MAAM,GAAG,IAI3D,CAAA"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AAE3E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAS,QAAQ,GAAG,cAAyB,EAC7C,SAAQ,MAAyB,EACjC,WAAW,MAAM,KAChB,YAsEF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,MAAM,KAAG,CAAC,GAAG,IAWzE,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,gBAAe,MAAU,KAAG,OAMzE,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,MAAM,GAAG,IAI3D,CAAA"}

package/dist/token.js

@@ -18,7 +18,8 @@
  *
  * @example
  * ```typescript
- * // In-memory storage (the client's default)
+ * // In-memory storage (this factory's default; the client's browser default is
+ * // createBrowserStorageAdapter — pass `'memory'` there for a cookie session)
  * const storage = createTokenStorage('memory')
  *
  * // The browser's persistent storage — a reload keeps the session

package/dist/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,UAAqC,QAAQ,EAC7C,SAAiB,gBAAgB,EACjC,QAAiB,EACH,EAAE;IAChB,MAAM,WAAW,GAAkC,EAAE,CAAA;IAErD,4BAA4B;IAC5B,IAAI,OAAO,GAA0B,IAAI,CAAA;IACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,GAAG,OAAO,CAAA;IACnB,CAAC;IAED,MAAM,cAAc,GAAG,GAAW,EAAE,CAAC,QAAQ,IAAI,GAAG,MAAM,aAAa,CAAA;IAEvE,MAAM,GAAG,GAAG,CAAC,GAAW,EAAiB,EAAE;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;IACjC,CAAC,CAAA;IAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAoB,EAAQ,EAAE;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAC1B,CAAC;IACH,CAAC,CAAA;IAED,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,aAAa,GAAG,GAAkB,EAAE;QACxC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAA;QACrD,OAAO,WAAW,CAAC,WAAW,IAAI,IAAI,CAAA;IACxC,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,CAAC,KAAoB,EAAQ,EAAE;QACnD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAA;;gBACnD,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,KAAK,CAAC,CAAA;QAC/C,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,WAAW,GAAG,KAAK,CAAA;QACjC,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,cAAc,EAAE,aAAa;QAC7B,cAAc,EAAE,aAAa;QAC7B,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC;QAC1C,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC;QACtD,OAAO,EAAE,GAA8B,EAAE;YACvC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;YACxB,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YACtB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAA;YAC9B,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,2EAA2E;gBAC3E,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAkB,IAAc,EAAE,EAAE;YAC3C,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACjD,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,aAAa,CAAC,IAAI,CAAC,CAAA;YACnB,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;YACzB,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACnB,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAA8B,KAAa,EAAY,EAAE;IAC/E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QACnE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAA;IACjC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,sFAAsF;QACtF,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,gBAAwB,CAAC,EAAW,EAAE;IAClF,MAAM,OAAO,GAAG,QAAQ,CAAmB,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAA;IAC7C,OAAO,GAAG,IAAI,SAAS,CAAA;AACzB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAiB,EAAE;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAmB,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACzC,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;AAC3B,CAAC,CAAA"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,UAAqC,QAAQ,EAC7C,SAAiB,gBAAgB,EACjC,QAAiB,EACH,EAAE;IAChB,MAAM,WAAW,GAAkC,EAAE,CAAA;IAErD,4BAA4B;IAC5B,IAAI,OAAO,GAA0B,IAAI,CAAA;IACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,GAAG,OAAO,CAAA;IACnB,CAAC;IAED,MAAM,cAAc,GAAG,GAAW,EAAE,CAAC,QAAQ,IAAI,GAAG,MAAM,aAAa,CAAA;IAEvE,MAAM,GAAG,GAAG,CAAC,GAAW,EAAiB,EAAE;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;IACjC,CAAC,CAAA;IAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAoB,EAAQ,EAAE;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAC1B,CAAC;IACH,CAAC,CAAA;IAED,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,aAAa,GAAG,GAAkB,EAAE;QACxC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAA;QACrD,OAAO,WAAW,CAAC,WAAW,IAAI,IAAI,CAAA;IACxC,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,CAAC,KAAoB,EAAQ,EAAE;QACnD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAA;;gBACnD,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,KAAK,CAAC,CAAA;QAC/C,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,WAAW,GAAG,KAAK,CAAA;QACjC,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,cAAc,EAAE,aAAa;QAC7B,cAAc,EAAE,aAAa;QAC7B,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC;QAC1C,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC;QACtD,OAAO,EAAE,GAA8B,EAAE;YACvC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;YACxB,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YACtB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAA;YAC9B,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,2EAA2E;gBAC3E,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAkB,IAAc,EAAE,EAAE;YAC3C,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACjD,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,aAAa,CAAC,IAAI,CAAC,CAAA;YACnB,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;YACzB,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACnB,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAA8B,KAAa,EAAY,EAAE;IAC/E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QACnE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAA;IACjC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,sFAAsF;QACtF,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,gBAAwB,CAAC,EAAW,EAAE;IAClF,MAAM,OAAO,GAAG,QAAQ,CAAmB,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAA;IAC7C,OAAO,GAAG,IAAI,SAAS,CAAA;AACzB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAiB,EAAE;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAmB,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACzC,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;AAC3B,CAAC,CAAA"}

package/dist/types.d.ts

@@ -210,6 +210,21 @@ export type AuthEvent = {
  * Callback invoked when an authentication event occurs (login, logout, etc.).
  */
 export type AuthEventListener = (event: AuthEvent) => void;
+/**
+ * A complete session an exchange outside the client has already established — an OAuth
+ * code→token redirect, or the app's own sign-in endpoint. {@link AuthClient.setSession} adopts
+ * it in one update: the token and the user are stored and the client becomes `authenticated`.
+ *
+ * @template T - The user profile the API returns.
+ */
+export interface AuthSessionSeed<T = UserProfile> {
+    /** The access token the exchange issued. */
+    accessToken: string;
+    /** The profile that token belongs to, as the API returned it. */
+    user: T;
+    /** A refresh token, when the exchange issued one; omitted leaves the stored one untouched. */
+    refreshToken?: string | null;
+}
 /**
  * Auth client interface that all auth bond packages must implement.
  * Provides login/logout/register flows, token management, profile
@@ -237,6 +252,11 @@ export interface AuthClient<T = UserProfile, TRegister extends Record<string, un
      * hitting the network. Intended for local refreshes after a per-app
      * mutation (e.g., the user just PATCHed their own profile and the
      * server returned the canonical row). Does NOT change tokens.
+     *
+     * This does not sign the client in: `authenticated` and `status` are
+     * unchanged, so an anonymous client stays anonymous. Use
+     * {@link login} / {@link register} for a credential exchange, or
+     * {@link setSession} when the token was issued outside the client.
      */
     setUser(user: T | null): void;
     /**
@@ -244,13 +264,32 @@ export interface AuthClient<T = UserProfile, TRegister extends Record<string, un
      */
     getAccessToken(): string | null;
     /**
-     * Stores the access token in the configured token storage adapter (in-memory
-     * by default). Use this to seed the token after an out-of-band exchange (e.g.
-     * the OAuth code→token redirect) instead of writing to `localStorage` directly,
-     * which would violate the in-memory-default storage contract and make the bearer
-     * token JS-readable (XSS-exfiltratable). Pass `null` to clear it.
+     * Stores the access token in the configured token storage adapter (in a
+     * browser, Web Storage; `'memory'` where no browser store exists). Use this
+     * to seed the token after an out-of-band exchange (e.g. the OAuth
+     * code→token redirect) instead of writing to `localStorage` directly,
+     * which would violate the storage contract and make a stored bearer token
+     * JS-readable (XSS-exfiltratable). Pass `null` to clear it.
+     *
+     * This changes token storage only; it does not sign the client in
+     * (`authenticated` and `status` are unchanged). Use {@link login} /
+     * {@link register} for a credential exchange, or call {@link setSession}
+     * with the token and the user to establish an already-issued session.
      */
     setAccessToken(token: string | null): void;
+    /**
+     * Adopts a session an out-of-band exchange already established: stores the
+     * access token (and the refresh token when given), caches the user, and
+     * sets the COMPLETE state — `initialized`, `authenticated`, `status:
+     * 'authenticated'`, no error — in one update, with one subscriber
+     * notification. Every hook reading the shared client sees the user as
+     * signed in immediately.
+     *
+     * This is the way to seed an OAuth/custom sign-in. Calling
+     * {@link setAccessToken} and {@link setUser} instead does NOT sign the
+     * client in.
+     */
+    setSession(session: AuthSessionSeed<T>): void;
     /**
      * Gets the refresh token.
      */
@@ -290,6 +329,19 @@ export interface AuthClient<T = UserProfile, TRegister extends Record<string, un
     changePassword(oldPassword: string, newPassword: string): Promise<void>;
     /**
      * Initializes auth state (e.g., from stored tokens).
+     *
+     * With a stored token AND a stored user it marks the session `'authenticated'`
+     * SYNCHRONOUSLY — before its first `await` — so the first render is the
+     * signed-in UI and no page waits on a verification round trip. Any check
+     * (a refresh, the cookie-restore probe) settles behind that render, and only an
+     * explicit 401/403 ends the session; a network/5xx/404 failure keeps it and
+     * reports `'unavailable'`. With no stored user the client stays `'loading'`
+     * until the cookie restore decides.
+     *
+     * Do not put this call (or a `/me` request of your own) in front of the first
+     * render, and do not render a loading screen over a session it just restored:
+     * `whenRestored()` already resolves as soon as the restore has settled, and the
+     * HTTP gate built on it holds requests for exactly that window.
      */
     initialize(): Promise<void>;
     /**
@@ -300,11 +352,13 @@ export interface AuthClient<T = UserProfile, TRegister extends Record<string, un
      *
      * - The server confirms the user: the session is refreshed and {@link AuthState.status}
      *   stays `'authenticated'`.
-     * - The server answers 4xx: the token is dead — the stored session is cleared and
-     *   the status becomes `'unauthenticated'`.
-     * - The server cannot answer (network failure or 5xx): the session is KEPT and the
-     *   status becomes `'unavailable'`, so the app can retry instead of signing the
-     *   user out over a bad connection.
+     * - The server answers 401 or 403: the token is dead — the stored session is
+     *   cleared and the status becomes `'unauthenticated'`.
+     * - The server cannot confirm the session — a network failure, a 5xx, or a 404
+     *   from a misconfigured {@link AuthClientConfig.currentUserEndpoint}: the
+     *   session (token AND user) is KEPT and the status becomes `'unavailable'`, so
+     *   the app can retry instead of signing the user out over a bad connection or a
+     *   route that does not exist. The 404 error names `currentUserEndpoint`.
      *
      * Do not hand-write this beside the client: a parallel token/user store for a
      * "validating"/"unavailable" flag is the race this method removes.
@@ -393,11 +447,17 @@ export interface AuthClientConfig {
      */
     profileEndpoint?: string;
     /**
-     * Current-user endpoint for session restore (default `/users/me`). Called by
-     * `initialize()` with credentials to re-establish the session after a full page
-     * load when the token did not survive the reload itself — i.e. when `storage` is
-     * `'memory'` and the API sets an httpOnly session cookie. Must return the user
-     * (as `user` or `props`).
+     * The API route that returns the signed-in user (default `/users/me`). Called
+     * with credentials by `initialize()` to re-establish the session after a full
+     * page load when the token did not survive the reload itself — i.e. when
+     * `storage` is `'memory'` and the API sets an httpOnly session cookie — and by
+     * {@link AuthClient.validateSession} on every reload to confirm a stored token
+     * is still valid. Must return the user (as `user` or `props`).
+     *
+     * Set it whenever the app serves its own current-user route: a wrong value
+     * answers 404, which `validateSession` reports as `'unavailable'` and keeps the
+     * stored token instead of signing the user out — but the session then stays
+     * unconfirmed.
      */
     currentUserEndpoint?: string;
     /**
@@ -413,6 +473,12 @@ export interface AuthClientConfig {
      * second library, a host page — instead of mirroring the token into
      * `localStorage` beside the client. The refresh token and the cached user keep
      * the prefix.
+     *
+     * In a browser the client's storage default is {@link createBrowserStorageAdapter},
+     * so `tokenKey` alone writes the token to exactly that key and a reload keeps
+     * the session. An EXPLICIT `storage: 'memory'` beside it warns at construction:
+     * the value then lives in a process-local Map nothing outside this client can
+     * read, and a reload signs the user out.
      */
     tokenKey?: string;
     /**
@@ -449,9 +515,23 @@ export interface AuthClientConfig {
      */
     requestBody?: (kind: 'login' | 'register', payload: Record<string, unknown>) => unknown;
     /**
-     * Turn the API's login/register answer into the client's
+     * Turn an answer that carries a user into the client's
      * `{ accessToken, refreshToken?, user }` (default: the answer as given).
      * RealWorld, for example: `(data) => ({ accessToken: data.user.token, user: data.user })`.
+     *
+     * It is the ONE user-shape adapter, and the client applies it on EVERY path
+     * that adopts a user from an API answer — `login()`, `register()`,
+     * `validateSession()`, the cookie restore `initialize()`/`refresh()` run, the
+     * token-refresh answer, and `updateProfile()`. Those answers carry the raw wire
+     * user (a current-user route typically answers a bare `{ user }`), so applying
+     * the same mapping is what keeps the adapted profile after a reload instead of
+     * replacing it with the unadapted one (xr-molecule-flash-m184). A mapper that
+     * cannot read a given answer (it throws, or returns no `user`) leaves that
+     * answer's user as it came.
+     *
+     * It is NOT applied to `setSession()` or `setUser()`: those receive a profile
+     * the caller already built in this client's shape, not a wire answer.
+     *
      * @param data - The parsed response body.
      * @returns The auth result.
      */
@@ -460,19 +540,21 @@ export interface AuthClientConfig {
      * Where the access/refresh token and the cached user are kept — the field that
      * decides whether a page reload keeps the user signed in.
      *
-     * **In-memory is the secure default.** `'memory'` is a process-local store, lost
-     * on reload. It is correct when the API sets an httpOnly session cookie, which
-     * `initialize()` then restores through {@link AuthClientConfig.currentUserEndpoint}
-     * — the strongest configuration, because no script can read the cookie.
+     * **In a browser the default is `createBrowserStorageAdapter()` (Web Storage)**,
+     * so a reload keeps the session with no wiring of its own; outside a browser
+     * (SSR, a Node test) the default is `'memory'`. Pass `'memory'` EXPLICITLY when
+     * the API sets an httpOnly session cookie and you do not want a script-readable
+     * copy: `'memory'` is a process-local store, and `initialize()` then restores
+     * through {@link AuthClientConfig.currentUserEndpoint} — the strongest
+     * configuration, because no script can read the cookie.
      *
-     * **An app whose external contract requires a token in storage opts in
-     * EXPLICITLY, with these two fields together.** A supplied e2e suite (the
-     * RealWorld specs read `localStorage.jwtToken` in `SELECTORS.md`), a host page
-     * or a second library can require the token at its own key: then set
-     * `storage: createBrowserStorageAdapter()` and `tokenKey: 'jwtToken'`, and the
-     * session (token AND user) is restored synchronously in `initialize()` — with no
-     * store of your own. `tokenKey` places the access token at that exact key; the
-     * refresh token and the cached user keep `storagePrefix`.
+     * **An app whose external contract requires the token at a specific key** — a
+     * supplied e2e suite (the RealWorld specs read `localStorage.jwtToken` in
+     * `SELECTORS.md`), a host page, a second library — sets `tokenKey: 'jwtToken'`;
+     * in a browser that is enough, because the default store is Web Storage. The
+     * session (token AND user) is then restored synchronously in `initialize()` —
+     * with no store of your own. `tokenKey` places the access token at that exact
+     * key; the refresh token and the cached user keep `storagePrefix`.
      *
      * A bearer token in Web Storage is readable by any script on the origin, so an
      * XSS can steal it; see {@link createBrowserStorageAdapter}'s `@remarks` for the
@@ -490,14 +572,13 @@ export interface AuthClientConfig {
      * ```typescript
      * import { createBrowserStorageAdapter } from '@molecule/app-auth'
      *
-     * // A suite/host page reads the token at its own key — the opt-in:
+     * // A suite/host page reads the token at its own key (the browser default
+     * // already stores it; `storage` is shown for an explicit choice):
      * storage: createBrowserStorageAdapter()
      * tokenKey: 'jwtToken'
-     * // A reload keeps the session at this client's own keys:
-     * storage: createBrowserStorageAdapter()
      * // Only this tab's lifetime, at a narrower exposure than localStorage:
      * storage: createBrowserStorageAdapter({ kind: 'session' })
-     * // An httpOnly cookie session instead — memory only, the stronger route:
+     * // An httpOnly cookie session — keep the bearer out of script-reachable storage:
      * storage: 'memory'
      * ```
      */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IAEV;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,YAAY,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;IACxF;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,GAAG,MAAM,CAAA;AAEV;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,WAAW;IACzC;;OAEG;IACH,IAAI,EAAE,CAAC,CAAA;IAEP;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,eAAe,GAAG,iBAAiB,GAAG,aAAa,CAAA;AAExF;;GAEG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,WAAW;IACxC;;;OAGG;IACH,MAAM,EAAE,UAAU,CAAA;IAElB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAA;IAEpB;;OAEG;IACH,aAAa,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IAEd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAA;AAE1D;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU,CACzB,CAAC,GAAG,WAAW,EACf,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;IAEhE;;OAEG;IACH,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAAA;IAExB;;OAEG;IACH,eAAe,IAAI,OAAO,CAAA;IAE1B;;OAEG;IACH,OAAO,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAE1C;;OAEG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAEhC;;OAEG;IACH,KAAK,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAE5D;;OAEG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAE/D;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAEjC;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAE3C;;OAEG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvE;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,eAAe,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9B;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;IAE9D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;IAEjE;;OAEG;IACH,QAAQ,CAAC,IAAI,MAAM,GAAG,IAAI,CAAA;IAE1B;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAA;IAEzD;;OAEG;IACH,OAAO,IAAI,IAAI,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACnC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAA;IAEvF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,UAAU,CAAC,WAAW,CAAC,CAAA;IAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAA;IAEnC;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAA;IAElD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B;;OAEG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAE9B;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IAEzB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAC1C,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAChC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAC3C,OAAO,CAAC,CAAC,GAAG,WAAW,KAAK,CAAC,GAAG,IAAI,CAAA;IACpC,OAAO,CAAC,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAC9C,KAAK,IAAI,IAAI,CAAA;CACd"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IAEV;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,YAAY,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;IACxF;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,GAAG,MAAM,CAAA;AAEV;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,WAAW;IACzC;;OAEG;IACH,IAAI,EAAE,CAAC,CAAA;IAEP;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,eAAe,GAAG,iBAAiB,GAAG,aAAa,CAAA;AAExF;;GAEG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,WAAW;IACxC;;;OAGG;IACH,MAAM,EAAE,UAAU,CAAA;IAElB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAA;IAEpB;;OAEG;IACH,aAAa,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IAEd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,WAAW;IAC9C,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IACnB,iEAAiE;IACjE,IAAI,EAAE,CAAC,CAAA;IACP,8FAA8F;IAC9F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU,CACzB,CAAC,GAAG,WAAW,EACf,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;IAEhE;;OAEG;IACH,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAAA;IAExB;;OAEG;IACH,eAAe,IAAI,OAAO,CAAA;IAE1B;;OAEG;IACH,OAAO,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAE1C;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IAE7C;;OAEG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAEhC;;OAEG;IACH,KAAK,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAE5D;;OAEG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAE/D;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAEjC;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAE3C;;OAEG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvE;;;;;;;;;;;;;;;OAeG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,eAAe,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9B;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;IAE9D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;IAEjE;;OAEG;IACH,QAAQ,CAAC,IAAI,MAAM,GAAG,IAAI,CAAA;IAE1B;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAA;IAEzD;;OAEG;IACH,OAAO,IAAI,IAAI,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACnC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAA;IAEvF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,UAAU,CAAC,WAAW,CAAC,CAAA;IAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAA;IAEnC;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAA;IAElD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B;;OAEG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAE9B;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IAEzB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAC1C,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAChC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAC3C,OAAO,CAAC,CAAC,GAAG,WAAW,KAAK,CAAC,GAAG,IAAI,CAAA;IACpC,OAAO,CAAC,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAC9C,KAAK,IAAI,IAAI,CAAA;CACd"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-auth",
-  "version": "1.5.2",
+  "version": "1.5.4",
   "description": "Client-side authentication interface for molecule.dev",
   "type": "module",
   "main": "dist/index.js",