@molecule/app-auth 3.3.0 → 3.3.1

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-11-07T05:06:43.040Z
+Generated: 2026-11-08T00:30:10.378Z
 -->
 
 # @molecule/app-auth
@@ -121,6 +121,13 @@ guards read this same `status`: wait only while it is `'loading'` — that
 status means "no decision yet", so an auth request in flight
 (`state.loading`) keeps the decided status and does not unmount a
 Login/Register page mid-request.
+Use the framework's shared route guard when available. For React Router,
+`AuthGuard` from `@molecule/app-ui-react` wraps protected routes with
+`<Route element={<AuthGuard />}>`. It restores lazily, waits only while
+`status === 'loading'`, and redirects only on `'unauthenticated'`.
+`'unavailable'` retains a session candidate and must not redirect to login.
+Do not replace this guard with `!isAuthenticated` or
+`status !== 'authenticated'`, or poll the session before painting the form.
 `validateSession()` is the background re-check that produces the last two: call
 it after the first render — a 401 or 403 clears the token (`'unauthenticated'`),
 while a network failure, a 5xx, or a 404 from a wrong `currentUserEndpoint`
@@ -1541,7 +1548,8 @@ by one. A box you can't check is an integration bug to fix — not a skip:
       `user: null`, tokens cleared); afterward every protected screen redirects
       back to login.
 - [ ] Visiting a protected route while logged OUT redirects to login (the
-      guard reads `isAuthenticated()`), and after authenticating you land back on
+      guard redirects only on `status === 'unauthenticated'`, after the initial
+      `'loading'` decision), and after authenticating you land back on
       the originally-requested screen rather than a generic home.
 - [ ] The session survives a FULL page reload: after login, hard-reload → you
       stay signed in (the profile/sign-out UI a signed-in visitor sees is still

package/dist/index.d.ts

@@ -111,6 +111,13 @@
  * status means "no decision yet", so an auth request in flight
  * (`state.loading`) keeps the decided status and does not unmount a
  * Login/Register page mid-request.
+ * Use the framework's shared route guard when available. For React Router,
+ * `AuthGuard` from `@molecule/app-ui-react` wraps protected routes with
+ * `<Route element={<AuthGuard />}>`. It restores lazily, waits only while
+ * `status === 'loading'`, and redirects only on `'unauthenticated'`.
+ * `'unavailable'` retains a session candidate and must not redirect to login.
+ * Do not replace this guard with `!isAuthenticated` or
+ * `status !== 'authenticated'`, or poll the session before painting the form.
  * `validateSession()` is the background re-check that produces the last two: call
  * it after the first render — a 401 or 403 clears the token (`'unauthenticated'`),
  * while a network failure, a 5xx, or a 404 from a wrong `currentUserEndpoint`
@@ -434,7 +441,8 @@
  *   `user: null`, tokens cleared); afterward every protected screen redirects
  *   back to login.
  * - [ ] Visiting a protected route while logged OUT redirects to login (the
- *   guard reads `isAuthenticated()`), and after authenticating you land back on
+ *   guard redirects only on `status === 'unauthenticated'`, after the initial
+ *   `'loading'` decision), and after authenticating you land back on
  *   the originally-requested screen rather than a generic home.
  * - [ ] The session survives a FULL page reload: after login, hard-reload → you
  *   stay signed in (the profile/sign-out UI a signed-in visitor sees is still

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6cG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqdG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/index.js

@@ -111,6 +111,13 @@
  * status means "no decision yet", so an auth request in flight
  * (`state.loading`) keeps the decided status and does not unmount a
  * Login/Register page mid-request.
+ * Use the framework's shared route guard when available. For React Router,
+ * `AuthGuard` from `@molecule/app-ui-react` wraps protected routes with
+ * `<Route element={<AuthGuard />}>`. It restores lazily, waits only while
+ * `status === 'loading'`, and redirects only on `'unauthenticated'`.
+ * `'unavailable'` retains a session candidate and must not redirect to login.
+ * Do not replace this guard with `!isAuthenticated` or
+ * `status !== 'authenticated'`, or poll the session before painting the form.
  * `validateSession()` is the background re-check that produces the last two: call
  * it after the first render — a 401 or 403 clears the token (`'unauthenticated'`),
  * while a network failure, a 5xx, or a 404 from a wrong `currentUserEndpoint`
@@ -434,7 +441,8 @@
  *   `user: null`, tokens cleared); afterward every protected screen redirects
  *   back to login.
  * - [ ] Visiting a protected route while logged OUT redirects to login (the
- *   guard reads `isAuthenticated()`), and after authenticating you land back on
+ *   guard redirects only on `status === 'unauthenticated'`, after the initial
+ *   `'loading'` decision), and after authenticating you land back on
  *   the originally-requested screen rather than a generic home.
  * - [ ] The session survives a FULL page reload: after login, hard-reload → you
  *   stay signed in (the profile/sign-out UI a signed-in visitor sees is still

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6cG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqdG;AAEH,cAAc,sBAAsB,CAAA;AACpC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-auth",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "description": "Client-side authentication interface for molecule.dev",
   "type": "module",
   "main": "dist/index.js",
@@ -35,7 +35,7 @@
   },
   "devDependencies": {
     "@molecule/app-bond": "1.0.5",
-    "@molecule/app-http": "1.5.6",
+    "@molecule/app-http": "1.5.7",
     "@molecule/app-i18n": "1.1.2",
     "@molecule/app-logger": "1.0.5",
     "@types/node": "26.6.5",