@molecule/app-bonds-default-react 1.1.3 → 1.1.5

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-10-18T09:50:35.607Z
+Generated: 2026-10-19T21:59:14.074Z
 -->
 
 # @molecule/app-bonds-default-react
@@ -130,7 +130,7 @@ apps shipped byte-identically. Apps pass their own `authConfig`
 (which lives in `src/config.ts`).
 
 ```typescript
-function createDefaultAuthClient(authConfig: AuthClientConfig): {
+function createDefaultAuthClient(authConfig: AuthClientConfig<TUser>): {
   authClient: AuthClient<TUser, TRegister>
   setupAuthDefault: () => void
 }
@@ -157,7 +157,7 @@ with no `Authorization` header). The source is applied to the client WHENEVER it
 bonded, so setup order no longer decides whether the first request is authorized.
 
 ```typescript
-function createDefaultAuthClientWithHttpSync(authConfig: AuthClientConfig): {
+function createDefaultAuthClientWithHttpSync(authConfig: AuthClientConfig<TUser>): {
   authClient: AuthClient<TUser, TRegister>
   setupAuthDefault: () => void
 }
@@ -170,6 +170,14 @@ given `baseURL` (so molecule pkg `useGet('/path')` calls hit
 `${baseURL}/path` instead of the SPA's catch-all route), AND keeps
 its bearer token in sync with auth events.
 
+The auth client restores a stored token AND user SYNCHRONOUSLY, so the first
+render is the signed-in UI — do not gate a protected page (or a provider of
+yours) on a current-user request. This bond registers `whenRestored()` as the
+HTTP gate, so requests still wait for the background restore/verification to
+settle; only `useAuth().status === 'loading'` means "no decision yet"
+(xr-molecule-flash-m177: a page that waited on its own `/me` paid a round trip
+on every navigation).
+
 Used by apps where molecule packages render pricing / billing /
 other authed JSON-fetching screens that need both behaviors.
 
@@ -179,7 +187,7 @@ mount cannot race it and answer for an anonymous viewer.
 
 ```typescript
 function createDefaultAuthClientWithFetchClient(
-  authConfig: AuthClientConfig,
+  authConfig: AuthClientConfig<TUser>,
   fetchClientOptions: { baseURL: string; withCredentials?: boolean },
 ): { authClient: AuthClient<TUser, TRegister>; setupAuthDefault: () => void }
 ```

package/dist/auth.d.ts

@@ -1,4 +1,4 @@
-import type { AuthClient, AuthClientConfig, UserProfile } from '@molecule/app-auth';
+import type { AuthClient, AuthClientConfig, RegisterExtraShape, UserProfile } from '@molecule/app-auth';
 import type { HttpClient } from '@molecule/app-http';
 /**
  * Builds the default fetch-based HTTP client + wires it into
@@ -69,8 +69,14 @@ export declare function createDefaultHttpClientWithAuthBearer(opts: {
  * `TRegister` is the app's own registration fields (`{ username: string }` for a
  * RealWorld-shaped API), passed on to `@molecule/app-auth`'s factory so
  * `authClient.register({ username, email, password })` type-checks with no cast.
+ *
+ * `TUser` is the profile the app's pages read. Type the config with the SAME
+ * type (`const authConfig: AuthClientConfig<MyUser> = { … }`) so its
+ * `mapAuthResponse` is checked against `MyUser`: a mapper that omits a required
+ * custom field then fails at the `createDefaultAuthClient<MyUser>(authConfig)`
+ * call instead of shipping a signed-in page that reads `undefined`.
  */
-export declare function createDefaultAuthClient<TUser extends UserProfile = UserProfile, TRegister extends Record<string, unknown> = Record<never, never>>(authConfig: AuthClientConfig): {
+export declare function createDefaultAuthClient<TUser extends UserProfile = UserProfile, TRegister extends RegisterExtraShape<TRegister> = Record<never, never>>(authConfig: AuthClientConfig<TUser>): {
     authClient: AuthClient<TUser, TRegister>;
     setupAuthDefault: () => void;
 };
@@ -93,7 +99,7 @@ export declare function createDefaultAuthClient<TUser extends UserProfile = User
  * with no `Authorization` header). The source is applied to the client WHENEVER it is
  * bonded, so setup order no longer decides whether the first request is authorized.
  */
-export declare function createDefaultAuthClientWithHttpSync<TUser extends UserProfile = UserProfile, TRegister extends Record<string, unknown> = Record<never, never>>(authConfig: AuthClientConfig): {
+export declare function createDefaultAuthClientWithHttpSync<TUser extends UserProfile = UserProfile, TRegister extends RegisterExtraShape<TRegister> = Record<never, never>>(authConfig: AuthClientConfig<TUser>): {
     authClient: AuthClient<TUser, TRegister>;
     setupAuthDefault: () => void;
 };
@@ -103,6 +109,14 @@ export declare function createDefaultAuthClientWithHttpSync<TUser extends UserPr
  * `${baseURL}/path` instead of the SPA's catch-all route), AND keeps
  * its bearer token in sync with auth events.
  *
+ * The auth client restores a stored token AND user SYNCHRONOUSLY, so the first
+ * render is the signed-in UI — do not gate a protected page (or a provider of
+ * yours) on a current-user request. This bond registers `whenRestored()` as the
+ * HTTP gate, so requests still wait for the background restore/verification to
+ * settle; only `useAuth().status === 'loading'` means "no decision yet"
+ * (xr-molecule-flash-m177: a page that waited on its own `/me` paid a round trip
+ * on every navigation).
+ *
  * Used by apps where molecule packages render pricing / billing /
  * other authed JSON-fetching screens that need both behaviors.
  *
@@ -110,7 +124,7 @@ export declare function createDefaultAuthClientWithHttpSync<TUser extends UserPr
  * {@link registerAuthGate}), so a page that fetches viewer-dependent data on
  * mount cannot race it and answer for an anonymous viewer.
  */
-export declare function createDefaultAuthClientWithFetchClient<TUser extends UserProfile = UserProfile, TRegister extends Record<string, unknown> = Record<never, never>>(authConfig: AuthClientConfig, fetchClientOptions: {
+export declare function createDefaultAuthClientWithFetchClient<TUser extends UserProfile = UserProfile, TRegister extends RegisterExtraShape<TRegister> = Record<never, never>>(authConfig: AuthClientConfig<TUser>, fetchClientOptions: {
     baseURL: string;
     withCredentials?: boolean;
 }): {

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAuCpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE;IAC1D,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG;IACF,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAoBA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEhE,UAAU,EAAE,gBAAgB,GAC3B;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEhE,UAAU,EAAE,gBAAgB,GAC3B;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA4BA;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sCAAsC,CACpD,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEhE,UAAU,EAAE,gBAAgB,EAC5B,kBAAkB,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACjE;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA2BA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACZ,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAuCpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE;IAC1D,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG;IACF,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAoBA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAClC;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAClC;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA4BA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sCAAsC,CACpD,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,EACnC,kBAAkB,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACjE;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA2BA"}

package/dist/auth.js

@@ -105,6 +105,12 @@ export function createDefaultHttpClientWithAuthBearer(opts) {
  * `TRegister` is the app's own registration fields (`{ username: string }` for a
  * RealWorld-shaped API), passed on to `@molecule/app-auth`'s factory so
  * `authClient.register({ username, email, password })` type-checks with no cast.
+ *
+ * `TUser` is the profile the app's pages read. Type the config with the SAME
+ * type (`const authConfig: AuthClientConfig<MyUser> = { … }`) so its
+ * `mapAuthResponse` is checked against `MyUser`: a mapper that omits a required
+ * custom field then fails at the `createDefaultAuthClient<MyUser>(authConfig)`
+ * call instead of shipping a signed-in page that reads `undefined`.
  */
 export function createDefaultAuthClient(authConfig) {
     const authClient = createJWTAuthClient(authConfig);
@@ -168,6 +174,14 @@ export function createDefaultAuthClientWithHttpSync(authConfig) {
  * `${baseURL}/path` instead of the SPA's catch-all route), AND keeps
  * its bearer token in sync with auth events.
  *
+ * The auth client restores a stored token AND user SYNCHRONOUSLY, so the first
+ * render is the signed-in UI — do not gate a protected page (or a provider of
+ * yours) on a current-user request. This bond registers `whenRestored()` as the
+ * HTTP gate, so requests still wait for the background restore/verification to
+ * settle; only `useAuth().status === 'loading'` means "no decision yet"
+ * (xr-molecule-flash-m177: a page that waited on its own `/me` paid a round trip
+ * on every navigation).
+ *
  * Used by apps where molecule packages render pricing / billing /
  * other authed JSON-fetching screens that need both behaviors.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-bonds-default-react",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "description": "Default app-side bond wirings for React+Tailwind+react-router+localStorage+Arimo font+molecule icons. 5 setup functions consolidating 665 byte-identical per-app bond wiring files across the fleet.",
   "homepage": "https://www.molecule.dev/packages/app-bonds-default-react",
   "type": "module",
@@ -38,7 +38,7 @@
     "directory": "packages/app/infrastructure/bonds-default-react"
   },
   "devDependencies": {
-    "@molecule/app-auth": "1.5.2",
+    "@molecule/app-auth": "1.5.9",
     "@molecule/app-charts-chartjs": "1.0.2",
     "@molecule/app-client-search": "1.0.2",
     "@molecule/app-client-search-minisearch": "1.0.3",
@@ -50,14 +50,14 @@
     "@molecule/app-drag-drop-dndkit": "1.0.2",
     "@molecule/app-fonts": "1.2.1",
     "@molecule/app-fonts-arimo": "1.0.3",
-    "@molecule/app-http": "1.2.0",
+    "@molecule/app-http": "1.4.0",
     "@molecule/app-icons": "1.0.2",
     "@molecule/app-icons-molecule": "1.0.2",
     "@molecule/app-keyboard-shortcuts": "1.0.2",
     "@molecule/app-keyboard-shortcuts-hotkeys": "1.0.2",
     "@molecule/app-maps-leaflet": "1.0.2",
-    "@molecule/app-realtime": "1.0.2",
-    "@molecule/app-realtime-socketio": "1.0.2",
+    "@molecule/app-realtime": "1.0.3",
+    "@molecule/app-realtime-socketio": "1.1.0",
     "@molecule/app-routing": "1.0.3",
     "@molecule/app-routing-react-router": "1.0.2",
     "@molecule/app-state": "1.0.3",