@molecule/app-bonds-default-react 1.1.2 → 1.1.4

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-10-16T23:54:35.164Z
+Generated: 2026-10-19T21:59:14.074Z
 -->
 
 # @molecule/app-bonds-default-react
@@ -130,8 +130,8 @@ apps shipped byte-identically. Apps pass their own `authConfig`
 (which lives in `src/config.ts`).
 
 ```typescript
-function createDefaultAuthClient(authConfig: AuthClientConfig): {
-  authClient: AuthClient<TUser>
+function createDefaultAuthClient(authConfig: AuthClientConfig<TUser>): {
+  authClient: AuthClient<TUser, TRegister>
   setupAuthDefault: () => void
 }
 ```
@@ -149,9 +149,16 @@ on setup, then listens for auth events to keep them aligned, and holds
 requests until the session restore settles so a page effect that fetches
 viewer-dependent data on mount cannot race it (see {@link registerAuthGate}).
 
+The hydrated token is delivered through `@molecule/app-http`'s token source, not
+through a client read at setup: the scaffold wires auth BEFORE http, so a client
+read here is the unbonded fallback and the restored session's token would land on a
+client nothing sends through (xr-molecule-flash-m156 — a reload sent every request
+with no `Authorization` header). The source is applied to the client WHENEVER it is
+bonded, so setup order no longer decides whether the first request is authorized.
+
 ```typescript
-function createDefaultAuthClientWithHttpSync(authConfig: AuthClientConfig): {
-  authClient: AuthClient<TUser>
+function createDefaultAuthClientWithHttpSync(authConfig: AuthClientConfig<TUser>): {
+  authClient: AuthClient<TUser, TRegister>
   setupAuthDefault: () => void
 }
 ```
@@ -163,6 +170,14 @@ given `baseURL` (so molecule pkg `useGet('/path')` calls hit
 `${baseURL}/path` instead of the SPA's catch-all route), AND keeps
 its bearer token in sync with auth events.
 
+The auth client restores a stored token AND user SYNCHRONOUSLY, so the first
+render is the signed-in UI — do not gate a protected page (or a provider of
+yours) on a current-user request. This bond registers `whenRestored()` as the
+HTTP gate, so requests still wait for the background restore/verification to
+settle; only `useAuth().status === 'loading'` means "no decision yet"
+(xr-molecule-flash-m177: a page that waited on its own `/me` paid a round trip
+on every navigation).
+
 Used by apps where molecule packages render pricing / billing /
 other authed JSON-fetching screens that need both behaviors.
 
@@ -172,9 +187,9 @@ mount cannot race it and answer for an anonymous viewer.
 
 ```typescript
 function createDefaultAuthClientWithFetchClient(
-  authConfig: AuthClientConfig,
+  authConfig: AuthClientConfig<TUser>,
   fetchClientOptions: { baseURL: string; withCredentials?: boolean },
-): { authClient: AuthClient<TUser>; setupAuthDefault: () => void }
+): { authClient: AuthClient<TUser, TRegister>; setupAuthDefault: () => void }
 ```
 
 #### `bootstrapApp(opts)`

package/dist/auth.d.ts

@@ -65,9 +65,19 @@ export declare function createDefaultHttpClientWithAuthBearer(opts: {
  * export const { authClient, setupAuthDefault } =
  *   createDefaultAuthClient(authConfig)
  * ```
+ *
+ * `TRegister` is the app's own registration fields (`{ username: string }` for a
+ * RealWorld-shaped API), passed on to `@molecule/app-auth`'s factory so
+ * `authClient.register({ username, email, password })` type-checks with no cast.
+ *
+ * `TUser` is the profile the app's pages read. Type the config with the SAME
+ * type (`const authConfig: AuthClientConfig<MyUser> = { … }`) so its
+ * `mapAuthResponse` is checked against `MyUser`: a mapper that omits a required
+ * custom field then fails at the `createDefaultAuthClient<MyUser>(authConfig)`
+ * call instead of shipping a signed-in page that reads `undefined`.
  */
-export declare function createDefaultAuthClient<TUser extends UserProfile = UserProfile>(authConfig: AuthClientConfig): {
-    authClient: AuthClient<TUser>;
+export declare function createDefaultAuthClient<TUser extends UserProfile = UserProfile, TRegister extends Record<string, unknown> = Record<never, never>>(authConfig: AuthClientConfig<TUser>): {
+    authClient: AuthClient<TUser, TRegister>;
     setupAuthDefault: () => void;
 };
 /**
@@ -81,9 +91,16 @@ export declare function createDefaultAuthClient<TUser extends UserProfile = User
  * on setup, then listens for auth events to keep them aligned, and holds
  * requests until the session restore settles so a page effect that fetches
  * viewer-dependent data on mount cannot race it (see {@link registerAuthGate}).
+ *
+ * The hydrated token is delivered through `@molecule/app-http`'s token source, not
+ * through a client read at setup: the scaffold wires auth BEFORE http, so a client
+ * read here is the unbonded fallback and the restored session's token would land on a
+ * client nothing sends through (xr-molecule-flash-m156 — a reload sent every request
+ * with no `Authorization` header). The source is applied to the client WHENEVER it is
+ * bonded, so setup order no longer decides whether the first request is authorized.
  */
-export declare function createDefaultAuthClientWithHttpSync<TUser extends UserProfile = UserProfile>(authConfig: AuthClientConfig): {
-    authClient: AuthClient<TUser>;
+export declare function createDefaultAuthClientWithHttpSync<TUser extends UserProfile = UserProfile, TRegister extends Record<string, unknown> = Record<never, never>>(authConfig: AuthClientConfig<TUser>): {
+    authClient: AuthClient<TUser, TRegister>;
     setupAuthDefault: () => void;
 };
 /**
@@ -92,6 +109,14 @@ export declare function createDefaultAuthClientWithHttpSync<TUser extends UserPr
  * `${baseURL}/path` instead of the SPA's catch-all route), AND keeps
  * its bearer token in sync with auth events.
  *
+ * The auth client restores a stored token AND user SYNCHRONOUSLY, so the first
+ * render is the signed-in UI — do not gate a protected page (or a provider of
+ * yours) on a current-user request. This bond registers `whenRestored()` as the
+ * HTTP gate, so requests still wait for the background restore/verification to
+ * settle; only `useAuth().status === 'loading'` means "no decision yet"
+ * (xr-molecule-flash-m177: a page that waited on its own `/me` paid a round trip
+ * on every navigation).
+ *
  * Used by apps where molecule packages render pricing / billing /
  * other authed JSON-fetching screens that need both behaviors.
  *
@@ -99,11 +124,11 @@ export declare function createDefaultAuthClientWithHttpSync<TUser extends UserPr
  * {@link registerAuthGate}), so a page that fetches viewer-dependent data on
  * mount cannot race it and answer for an anonymous viewer.
  */
-export declare function createDefaultAuthClientWithFetchClient<TUser extends UserProfile = UserProfile>(authConfig: AuthClientConfig, fetchClientOptions: {
+export declare function createDefaultAuthClientWithFetchClient<TUser extends UserProfile = UserProfile, TRegister extends Record<string, unknown> = Record<never, never>>(authConfig: AuthClientConfig<TUser>, fetchClientOptions: {
     baseURL: string;
     withCredentials?: boolean;
 }): {
-    authClient: AuthClient<TUser>;
+    authClient: AuthClient<TUser, TRegister>;
     setupAuthDefault: () => void;
 };
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAsCpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE;IAC1D,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG;IACF,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAoBA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,EAC7E,UAAU,EAAE,gBAAgB,GAC3B;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAA;IAC7B,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mCAAmC,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,EACzF,UAAU,EAAE,gBAAgB,GAC3B;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAA;IAC7B,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA2BA;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sCAAsC,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,EAC5F,UAAU,EAAE,gBAAgB,EAC5B,kBAAkB,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACjE;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAA;IAC7B,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA2BA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAuCpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE;IAC1D,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG;IACF,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAoBA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEhE,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAClC;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEhE,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAClC;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA4BA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sCAAsC,CACpD,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEhE,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,EACnC,kBAAkB,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACjE;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA2BA"}

package/dist/auth.js

@@ -1,5 +1,5 @@
 import { createJWTAuthClient, setClient } from '@molecule/app-auth';
-import { createFetchClient, getClient as getHttpClient, setAuthGate, setClient as setHttpClient, } from '@molecule/app-http';
+import { createFetchClient, getClient as getHttpClient, setAuthGate, setAuthTokenSource as setHttpAuthTokenSource, setClient as setHttpClient, } from '@molecule/app-http';
 /**
  * Holds every HTTP request until this auth client's session restore has settled.
  *
@@ -101,6 +101,16 @@ export function createDefaultHttpClientWithAuthBearer(opts) {
  * export const { authClient, setupAuthDefault } =
  *   createDefaultAuthClient(authConfig)
  * ```
+ *
+ * `TRegister` is the app's own registration fields (`{ username: string }` for a
+ * RealWorld-shaped API), passed on to `@molecule/app-auth`'s factory so
+ * `authClient.register({ username, email, password })` type-checks with no cast.
+ *
+ * `TUser` is the profile the app's pages read. Type the config with the SAME
+ * type (`const authConfig: AuthClientConfig<MyUser> = { … }`) so its
+ * `mapAuthResponse` is checked against `MyUser`: a mapper that omits a required
+ * custom field then fails at the `createDefaultAuthClient<MyUser>(authConfig)`
+ * call instead of shipping a signed-in page that reads `undefined`.
  */
 export function createDefaultAuthClient(authConfig) {
     const authClient = createJWTAuthClient(authConfig);
@@ -120,6 +130,13 @@ export function createDefaultAuthClient(authConfig) {
  * on setup, then listens for auth events to keep them aligned, and holds
  * requests until the session restore settles so a page effect that fetches
  * viewer-dependent data on mount cannot race it (see {@link registerAuthGate}).
+ *
+ * The hydrated token is delivered through `@molecule/app-http`'s token source, not
+ * through a client read at setup: the scaffold wires auth BEFORE http, so a client
+ * read here is the unbonded fallback and the restored session's token would land on a
+ * client nothing sends through (xr-molecule-flash-m156 — a reload sent every request
+ * with no `Authorization` header). The source is applied to the client WHENEVER it is
+ * bonded, so setup order no longer decides whether the first request is authorized.
  */
 export function createDefaultAuthClientWithHttpSync(authConfig) {
     const authClient = createJWTAuthClient(authConfig);
@@ -130,10 +147,11 @@ export function createDefaultAuthClientWithHttpSync(authConfig) {
             // Requests made while the session is still restoring wait for it, so a page
             // effect that fetches viewer-dependent data on mount cannot race the restore.
             registerAuthGate(authClient);
-            const initialToken = authClient.getAccessToken();
-            if (initialToken) {
-                getHttpClient().setAuthToken(initialToken);
-            }
+            // Resolve the HTTP client per sync, never once here. `setClient` runs this
+            // source, so the token reaches the client the scaffold bonds later as well as
+            // one already bonded; a client kept from this moment would be the throwaway
+            // fallback the later `setHttpDefault()` replaces.
+            setHttpAuthTokenSource(() => authClient.getAccessToken());
             authClient.addEventListener((event) => {
                 if (event.type === 'login' || event.type === 'register' || event.type === 'refresh') {
                     // Mirror the auth client's token EXACTLY — including null. Cookie-session
@@ -156,6 +174,14 @@ export function createDefaultAuthClientWithHttpSync(authConfig) {
  * `${baseURL}/path` instead of the SPA's catch-all route), AND keeps
  * its bearer token in sync with auth events.
  *
+ * The auth client restores a stored token AND user SYNCHRONOUSLY, so the first
+ * render is the signed-in UI — do not gate a protected page (or a provider of
+ * yours) on a current-user request. This bond registers `whenRestored()` as the
+ * HTTP gate, so requests still wait for the background restore/verification to
+ * settle; only `useAuth().status === 'loading'` means "no decision yet"
+ * (xr-molecule-flash-m177: a page that waited on its own `/me` paid a round trip
+ * on every navigation).
+ *
  * Used by apps where molecule packages render pricing / billing /
  * other authed JSON-fetching screens that need both behaviors.
  *
@@ -172,13 +198,13 @@ export function createDefaultAuthClientWithFetchClient(authConfig, fetchClientOp
                 baseURL: fetchClientOptions.baseURL,
                 withCredentials: fetchClientOptions.withCredentials ?? true,
             });
+            // Registered BEFORE the bond: `setHttpClient` applies the restored session's
+            // token, and the same source reaches any client an app bonds later instead of
+            // this one (xr-molecule-flash-m156 — a client captured at setup cannot).
+            setHttpAuthTokenSource(() => authClient.getAccessToken());
             setHttpClient(httpClient);
             setClient(authClient);
             registerAuthGate(authClient);
-            const initialToken = authClient.getAccessToken();
-            if (initialToken) {
-                httpClient.setAuthToken(initialToken);
-            }
             authClient.addEventListener((event) => {
                 if (event.type === 'login' || event.type === 'register' || event.type === 'refresh') {
                     // Mirror the token exactly, including null — see the identical note in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-bonds-default-react",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "Default app-side bond wirings for React+Tailwind+react-router+localStorage+Arimo font+molecule icons. 5 setup functions consolidating 665 byte-identical per-app bond wiring files across the fleet.",
   "homepage": "https://www.molecule.dev/packages/app-bonds-default-react",
   "type": "module",
@@ -38,7 +38,7 @@
     "directory": "packages/app/infrastructure/bonds-default-react"
   },
   "devDependencies": {
-    "@molecule/app-auth": "1.3.0",
+    "@molecule/app-auth": "1.5.7",
     "@molecule/app-charts-chartjs": "1.0.2",
     "@molecule/app-client-search": "1.0.2",
     "@molecule/app-client-search-minisearch": "1.0.3",
@@ -48,16 +48,16 @@
     "@molecule/app-command-palette-cmdk": "1.0.2",
     "@molecule/app-drag-drop": "1.0.2",
     "@molecule/app-drag-drop-dndkit": "1.0.2",
-    "@molecule/app-fonts": "1.1.0",
-    "@molecule/app-fonts-arimo": "1.0.2",
-    "@molecule/app-http": "1.1.3",
+    "@molecule/app-fonts": "1.2.1",
+    "@molecule/app-fonts-arimo": "1.0.3",
+    "@molecule/app-http": "1.4.0",
     "@molecule/app-icons": "1.0.2",
     "@molecule/app-icons-molecule": "1.0.2",
     "@molecule/app-keyboard-shortcuts": "1.0.2",
     "@molecule/app-keyboard-shortcuts-hotkeys": "1.0.2",
     "@molecule/app-maps-leaflet": "1.0.2",
-    "@molecule/app-realtime": "1.0.2",
-    "@molecule/app-realtime-socketio": "1.0.2",
+    "@molecule/app-realtime": "1.0.3",
+    "@molecule/app-realtime-socketio": "1.1.0",
     "@molecule/app-routing": "1.0.3",
     "@molecule/app-routing-react-router": "1.0.2",
     "@molecule/app-state": "1.0.3",
@@ -65,7 +65,7 @@
     "@molecule/app-storage-localstorage": "1.0.2",
     "@molecule/app-theme": "1.0.3",
     "@molecule/app-theme-css-variables": "1.0.3",
-    "@molecule/app-ui": "1.3.6",
+    "@molecule/app-ui": "1.3.7",
     "@molecule/app-ui-tailwind": "1.2.6",
     "@molecule/app-video-hls": "1.0.2",
     "@molecule/app-virtual-scroll": "1.0.2",