@molecule/app-auth 3.2.0 → 3.2.2

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-11-01T10:12:16.667Z
+Generated: 2026-11-02T21:26:16.657Z
 -->
 
 # @molecule/app-auth
@@ -55,6 +55,13 @@ createBrowserStorageAdapter() }))`, or `createDefaultAuthClient(authConfig)`
 from `@molecule/app-bonds-default-react`, then call `initialize()`. The bond's
 HTTP-sync variants also register `whenRestored()` as the request gate.
 
+Sharing `tokenKey` with the bonded client does not make another context or
+provider an adapter. A context with copied `user` and `status`, local token
+helpers, or a separate restore effect is still a second session store, even
+when it uses the same storage key. Keep view adapters and debug bridges beside
+the bond, but have them read the bonded client or framework binding instead of
+mirroring session state.
+
 **`initialize()` restores a cached token AND user BEFORE the first render.**
 That restore is synchronous and costs no request. Cookie-only and token-only
 restoration need an asynchronous current-user request. An HttpOnly
@@ -1635,6 +1642,25 @@ Peer dependencies:
 - `@molecule/app-i18n`
 - `@molecule/app-logger`
 
+**Synchronous getters for application integrations.** Read the shared client
+synchronously when an integration needs the raw token, auth state and current user.
+These reads create no second store: `getAccessToken()`
+returns the token, `getState().status` includes `unavailable`, and `getUser()` reads
+the mapped profile. The configured `tokenKey` also applies to these getters.
+Keep an integration's response shape local; do not persist another token or user.
+
+```typescript
+import { getClient } from '@molecule/app-auth'
+const readSession = () => {
+  const client = getClient()
+  return {
+    status: client.getState().status,
+    user: client.getUser(),
+    accessToken: client.getAccessToken(),
+  }
+}
+```
+
 - **An API with its own auth envelope keeps this client.** `requestBody` wraps the
   login/register payload (`(kind, p) => ({ user: p })`), `mapAuthResponse` reads the
   token and user out of the answer — keeping the wire bearer OUT of the profile,

package/dist/index.d.ts

@@ -45,6 +45,13 @@
  * from `@molecule/app-bonds-default-react`, then call `initialize()`. The bond's
  * HTTP-sync variants also register `whenRestored()` as the request gate.
  *
+ * Sharing `tokenKey` with the bonded client does not make another context or
+ * provider an adapter. A context with copied `user` and `status`, local token
+ * helpers, or a separate restore effect is still a second session store, even
+ * when it uses the same storage key. Keep view adapters and debug bridges beside
+ * the bond, but have them read the bonded client or framework binding instead of
+ * mirroring session state.
+ *
  * **`initialize()` restores a cached token AND user BEFORE the first render.**
  * That restore is synchronous and costs no request. Cookie-only and token-only
  * restoration need an asynchronous current-user request. An HttpOnly
@@ -304,6 +311,25 @@
  * `RequestConfig.skipAuthGate` in `@molecule/app-http`.
  *
  * @remarks
+ * **Synchronous getters for application integrations.** Read the shared client
+ * synchronously when an integration needs the raw token, auth state and current user.
+ * These reads create no second store: `getAccessToken()`
+ * returns the token, `getState().status` includes `unavailable`, and `getUser()` reads
+ * the mapped profile. The configured `tokenKey` also applies to these getters.
+ * Keep an integration's response shape local; do not persist another token or user.
+ *
+ * ```typescript
+ * import { getClient } from '@molecule/app-auth'
+ * const readSession = () => {
+ *   const client = getClient()
+ *   return {
+ *     status: client.getState().status,
+ *     user: client.getUser(),
+ *     accessToken: client.getAccessToken(),
+ *   }
+ * }
+ * ```
+ *
  * - **An API with its own auth envelope keeps this client.** `requestBody` wraps the
  *   login/register payload (`(kind, p) => ({ user: p })`), `mapAuthResponse` reads the
  *   token and user out of the answer — keeping the wire bearer OUT of the profile,

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgbG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0cG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/index.js

@@ -45,6 +45,13 @@
  * from `@molecule/app-bonds-default-react`, then call `initialize()`. The bond's
  * HTTP-sync variants also register `whenRestored()` as the request gate.
  *
+ * Sharing `tokenKey` with the bonded client does not make another context or
+ * provider an adapter. A context with copied `user` and `status`, local token
+ * helpers, or a separate restore effect is still a second session store, even
+ * when it uses the same storage key. Keep view adapters and debug bridges beside
+ * the bond, but have them read the bonded client or framework binding instead of
+ * mirroring session state.
+ *
  * **`initialize()` restores a cached token AND user BEFORE the first render.**
  * That restore is synchronous and costs no request. Cookie-only and token-only
  * restoration need an asynchronous current-user request. An HttpOnly
@@ -304,6 +311,25 @@
  * `RequestConfig.skipAuthGate` in `@molecule/app-http`.
  *
  * @remarks
+ * **Synchronous getters for application integrations.** Read the shared client
+ * synchronously when an integration needs the raw token, auth state and current user.
+ * These reads create no second store: `getAccessToken()`
+ * returns the token, `getState().status` includes `unavailable`, and `getUser()` reads
+ * the mapped profile. The configured `tokenKey` also applies to these getters.
+ * Keep an integration's response shape local; do not persist another token or user.
+ *
+ * ```typescript
+ * import { getClient } from '@molecule/app-auth'
+ * const readSession = () => {
+ *   const client = getClient()
+ *   return {
+ *     status: client.getState().status,
+ *     user: client.getUser(),
+ *     accessToken: client.getAccessToken(),
+ *   }
+ * }
+ * ```
+ *
  * - **An API with its own auth envelope keeps this client.** `requestBody` wraps the
  *   login/register payload (`(kind, p) => ({ user: p })`), `mapAuthResponse` reads the
  *   token and user out of the answer — keeping the wire bearer OUT of the profile,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgbG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0cG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-auth",
-  "version": "3.2.0",
+  "version": "3.2.2",
   "description": "Client-side authentication interface for molecule.dev",
   "type": "module",
   "main": "dist/index.js",