@molecule/app-bonds-default-react 1.1.5 → 2.0.0

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-10-19T21:59:14.074Z
+Generated: 2026-10-24T08:39:00.105Z
 -->
 
 # @molecule/app-bonds-default-react
@@ -33,7 +33,11 @@ React fleet stack, replacing the byte-identical per-app files:
 - Auth/http factories — `createDefaultAuthClient(authConfig)` returns
   `{ authClient, setupAuthDefault }`; the `...WithHttpSync` /
   `...WithFetchClient` variants also keep the bonded http client's bearer
-  token in sync with auth events.
+  token in sync with auth events. All three accept any JSON object profile
+  (`createDefaultAuthClient<SessionUser>(config)` for an API whose user has no
+  `id`) and fall back to `UserProfile` — with its `id: string` — when no type
+  argument is given. The profile is never inferred from `authConfig`, so an
+  untyped call keeps the default contract.
 
 > **Auto-generated, AI-first package reference** for the [molecule.dev](https://molecule.dev) ecosystem.
 > It is written to be read by coding agents as much as by people, and is generated from this
@@ -129,8 +133,29 @@ Replaces the 16-line per-app `bonds/auth-default.ts` that 93 fleet
 apps shipped byte-identically. Apps pass their own `authConfig`
 (which lives in `src/config.ts`).
 
+`TUser` is the profile the app's pages read, and may be any JSON object type —
+including a profile with NO `id` (`{ username, email, bio, image }`), exactly
+like the factory beneath this wrapper. Never add a synthetic `id` to satisfy a
+type: nothing in the client reads it, and the fabricated value then travels into
+storage, `getUser()` and every page. Omit the type parameter and the default is
+`UserProfile`, whose `id: string` stays required — the profile is never inferred
+from `authConfig` (no member of it, and not from an annotated config variable),
+so an untyped wrapper call keeps the default contract.
+
+Type the config with the SAME type (`const authConfig: AuthClientConfig<MyUser> = { … }`)
+so its `mapAuthResponse` is checked against `MyUser`, and name that type at the
+call (`createDefaultAuthClient<MyUser>(authConfig)`): a mapper that omits a
+required custom field then fails at that call instead of shipping a signed-in
+page that reads `undefined`. An annotated config alone does not supply the type
+argument — that is a 1.8 caller shape this major changes (see
+`AuthClientConfig`'s migration note in `@molecule/app-auth`).
+
+`TRegister` is the app's own registration fields (`{ username: string }` for a
+
+_(description truncated — read the full text in `node_modules/@molecule/app-bonds-default-react/dist/auth.d.ts`.)_
+
 ```typescript
-function createDefaultAuthClient(authConfig: AuthClientConfig<TUser>): {
+function createDefaultAuthClient(authConfig: NoInfer<AuthClientConfigOptions<TUser>>): {
   authClient: AuthClient<TUser, TRegister>
   setupAuthDefault: () => void
 }
@@ -144,6 +169,9 @@ Variant of `createDefaultAuthClient` that also keeps the bonded
 client must carry the JWT on every request — without this wiring,
 authed endpoints return 401 after page reloads or token refresh.
 
+The profile type is `createDefaultAuthClient`'s: a JSON object type of named
+fields (see `AuthProfileShape`), including an app profile with no `id`.
+
 Hydrates the HTTP client's token from the persisted auth state
 on setup, then listens for auth events to keep them aligned, and holds
 requests until the session restore settles so a page effect that fetches
@@ -157,7 +185,7 @@ with no `Authorization` header). The source is applied to the client WHENEVER it
 bonded, so setup order no longer decides whether the first request is authorized.
 
 ```typescript
-function createDefaultAuthClientWithHttpSync(authConfig: AuthClientConfig<TUser>): {
+function createDefaultAuthClientWithHttpSync(authConfig: NoInfer<AuthClientConfigOptions<TUser>>): {
   authClient: AuthClient<TUser, TRegister>
   setupAuthDefault: () => void
 }
@@ -185,9 +213,12 @@ Requests are also held until the session restore settles (see
 {@link registerAuthGate}), so a page that fetches viewer-dependent data on
 mount cannot race it and answer for an anonymous viewer.
 
+The profile type is `createDefaultAuthClient`'s: a JSON object type of named
+fields (see `AuthProfileShape`), including an app profile with no `id`.
+
 ```typescript
 function createDefaultAuthClientWithFetchClient(
-  authConfig: AuthClientConfig<TUser>,
+  authConfig: NoInfer<AuthClientConfigOptions<TUser>>,
   fetchClientOptions: { baseURL: string; withCredentials?: boolean },
 ): { authClient: AuthClient<TUser, TRegister>; setupAuthDefault: () => void }
 ```
@@ -312,7 +343,7 @@ function setupAllDefaultBonds(): void
 
 Peer dependencies:
 
-- `@molecule/app-auth` ^1.0.1
+- `@molecule/app-auth` ^2.0.0
 - `@molecule/app-charts` ^1.0.1
 - `@molecule/app-charts-chartjs` ^1.0.1
 - `@molecule/app-client-search` ^1.0.0

package/dist/auth.d.ts

@@ -1,4 +1,4 @@
-import type { AuthClient, AuthClientConfig, RegisterExtraShape, UserProfile } from '@molecule/app-auth';
+import type { AuthClient, AuthClientConfigOptions, AuthProfileConstraint, RegisterExtraShape, UserProfile } from '@molecule/app-auth';
 import type { HttpClient } from '@molecule/app-http';
 /**
  * Builds the default fetch-based HTTP client + wires it into
@@ -56,6 +56,27 @@ export declare function createDefaultHttpClientWithAuthBearer(opts: {
  * apps shipped byte-identically. Apps pass their own `authConfig`
  * (which lives in `src/config.ts`).
  *
+ * `TUser` is the profile the app's pages read, and may be any JSON object type —
+ * including a profile with NO `id` (`{ username, email, bio, image }`), exactly
+ * like the factory beneath this wrapper. Never add a synthetic `id` to satisfy a
+ * type: nothing in the client reads it, and the fabricated value then travels into
+ * storage, `getUser()` and every page. Omit the type parameter and the default is
+ * `UserProfile`, whose `id: string` stays required — the profile is never inferred
+ * from `authConfig` (no member of it, and not from an annotated config variable),
+ * so an untyped wrapper call keeps the default contract.
+ *
+ * Type the config with the SAME type (`const authConfig: AuthClientConfig<MyUser> = { … }`)
+ * so its `mapAuthResponse` is checked against `MyUser`, and name that type at the
+ * call (`createDefaultAuthClient<MyUser>(authConfig)`): a mapper that omits a
+ * required custom field then fails at that call instead of shipping a signed-in
+ * page that reads `undefined`. An annotated config alone does not supply the type
+ * argument — that is a 1.8 caller shape this major changes (see
+ * `AuthClientConfig`'s migration note in `@molecule/app-auth`).
+ *
+ * `TRegister` is the app's own registration fields (`{ username: string }` for a
+ * RealWorld-shaped API), passed on to `@molecule/app-auth`'s factory so
+ * `authClient.register({ username, email, password })` type-checks with no cast.
+ *
  * @example
  * ```ts
  * // bonds/auth-default.ts
@@ -65,18 +86,8 @@ export declare function createDefaultHttpClientWithAuthBearer(opts: {
  * export const { authClient, setupAuthDefault } =
  *   createDefaultAuthClient(authConfig)
  * ```
- *
- * `TRegister` is the app's own registration fields (`{ username: string }` for a
- * RealWorld-shaped API), passed on to `@molecule/app-auth`'s factory so
- * `authClient.register({ username, email, password })` type-checks with no cast.
- *
- * `TUser` is the profile the app's pages read. Type the config with the SAME
- * type (`const authConfig: AuthClientConfig<MyUser> = { … }`) so its
- * `mapAuthResponse` is checked against `MyUser`: a mapper that omits a required
- * custom field then fails at the `createDefaultAuthClient<MyUser>(authConfig)`
- * call instead of shipping a signed-in page that reads `undefined`.
  */
-export declare function createDefaultAuthClient<TUser extends UserProfile = UserProfile, TRegister extends RegisterExtraShape<TRegister> = Record<never, never>>(authConfig: AuthClientConfig<TUser>): {
+export declare function createDefaultAuthClient<TUser extends AuthProfileConstraint<TUser> = UserProfile, TRegister extends RegisterExtraShape<TRegister> = Record<never, never>>(authConfig: NoInfer<AuthClientConfigOptions<TUser>>): {
     authClient: AuthClient<TUser, TRegister>;
     setupAuthDefault: () => void;
 };
@@ -87,6 +98,9 @@ export declare function createDefaultAuthClient<TUser extends UserProfile = User
  * client must carry the JWT on every request — without this wiring,
  * authed endpoints return 401 after page reloads or token refresh.
  *
+ * The profile type is `createDefaultAuthClient`'s: a JSON object type of named
+ * fields (see `AuthProfileShape`), including an app profile with no `id`.
+ *
  * Hydrates the HTTP client's token from the persisted auth state
  * on setup, then listens for auth events to keep them aligned, and holds
  * requests until the session restore settles so a page effect that fetches
@@ -99,7 +113,7 @@ export declare function createDefaultAuthClient<TUser extends UserProfile = User
  * with no `Authorization` header). The source is applied to the client WHENEVER it is
  * bonded, so setup order no longer decides whether the first request is authorized.
  */
-export declare function createDefaultAuthClientWithHttpSync<TUser extends UserProfile = UserProfile, TRegister extends RegisterExtraShape<TRegister> = Record<never, never>>(authConfig: AuthClientConfig<TUser>): {
+export declare function createDefaultAuthClientWithHttpSync<TUser extends AuthProfileConstraint<TUser> = UserProfile, TRegister extends RegisterExtraShape<TRegister> = Record<never, never>>(authConfig: NoInfer<AuthClientConfigOptions<TUser>>): {
     authClient: AuthClient<TUser, TRegister>;
     setupAuthDefault: () => void;
 };
@@ -123,8 +137,11 @@ export declare function createDefaultAuthClientWithHttpSync<TUser extends UserPr
  * Requests are also held until the session restore settles (see
  * {@link registerAuthGate}), so a page that fetches viewer-dependent data on
  * mount cannot race it and answer for an anonymous viewer.
+ *
+ * The profile type is `createDefaultAuthClient`'s: a JSON object type of named
+ * fields (see `AuthProfileShape`), including an app profile with no `id`.
  */
-export declare function createDefaultAuthClientWithFetchClient<TUser extends UserProfile = UserProfile, TRegister extends RegisterExtraShape<TRegister> = Record<never, never>>(authConfig: AuthClientConfig<TUser>, fetchClientOptions: {
+export declare function createDefaultAuthClientWithFetchClient<TUser extends AuthProfileConstraint<TUser> = UserProfile, TRegister extends RegisterExtraShape<TRegister> = Record<never, never>>(authConfig: NoInfer<AuthClientConfigOptions<TUser>>, fetchClientOptions: {
     baseURL: string;
     withCredentials?: boolean;
 }): {

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACZ,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAuCpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE;IAC1D,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG;IACF,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAoBA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAClC;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAClC;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA4BA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sCAAsC,CACpD,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,EACnC,kBAAkB,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACjE;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA2BA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,uBAAuB,EAEvB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACZ,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAuCpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE;IAC1D,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG;IACF,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAoBA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,GAClD;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,GAClD;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA4BA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sCAAsC,CACpD,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,EACnD,kBAAkB,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACjE;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA2BA"}

package/dist/auth.js

@@ -92,6 +92,27 @@ export function createDefaultHttpClientWithAuthBearer(opts) {
  * apps shipped byte-identically. Apps pass their own `authConfig`
  * (which lives in `src/config.ts`).
  *
+ * `TUser` is the profile the app's pages read, and may be any JSON object type —
+ * including a profile with NO `id` (`{ username, email, bio, image }`), exactly
+ * like the factory beneath this wrapper. Never add a synthetic `id` to satisfy a
+ * type: nothing in the client reads it, and the fabricated value then travels into
+ * storage, `getUser()` and every page. Omit the type parameter and the default is
+ * `UserProfile`, whose `id: string` stays required — the profile is never inferred
+ * from `authConfig` (no member of it, and not from an annotated config variable),
+ * so an untyped wrapper call keeps the default contract.
+ *
+ * Type the config with the SAME type (`const authConfig: AuthClientConfig<MyUser> = { … }`)
+ * so its `mapAuthResponse` is checked against `MyUser`, and name that type at the
+ * call (`createDefaultAuthClient<MyUser>(authConfig)`): a mapper that omits a
+ * required custom field then fails at that call instead of shipping a signed-in
+ * page that reads `undefined`. An annotated config alone does not supply the type
+ * argument — that is a 1.8 caller shape this major changes (see
+ * `AuthClientConfig`'s migration note in `@molecule/app-auth`).
+ *
+ * `TRegister` is the app's own registration fields (`{ username: string }` for a
+ * RealWorld-shaped API), passed on to `@molecule/app-auth`'s factory so
+ * `authClient.register({ username, email, password })` type-checks with no cast.
+ *
  * @example
  * ```ts
  * // bonds/auth-default.ts
@@ -101,16 +122,6 @@ export function createDefaultHttpClientWithAuthBearer(opts) {
  * export const { authClient, setupAuthDefault } =
  *   createDefaultAuthClient(authConfig)
  * ```
- *
- * `TRegister` is the app's own registration fields (`{ username: string }` for a
- * RealWorld-shaped API), passed on to `@molecule/app-auth`'s factory so
- * `authClient.register({ username, email, password })` type-checks with no cast.
- *
- * `TUser` is the profile the app's pages read. Type the config with the SAME
- * type (`const authConfig: AuthClientConfig<MyUser> = { … }`) so its
- * `mapAuthResponse` is checked against `MyUser`: a mapper that omits a required
- * custom field then fails at the `createDefaultAuthClient<MyUser>(authConfig)`
- * call instead of shipping a signed-in page that reads `undefined`.
  */
 export function createDefaultAuthClient(authConfig) {
     const authClient = createJWTAuthClient(authConfig);
@@ -126,6 +137,9 @@ export function createDefaultAuthClient(authConfig) {
  * client must carry the JWT on every request — without this wiring,
  * authed endpoints return 401 after page reloads or token refresh.
  *
+ * The profile type is `createDefaultAuthClient`'s: a JSON object type of named
+ * fields (see `AuthProfileShape`), including an app profile with no `id`.
+ *
  * Hydrates the HTTP client's token from the persisted auth state
  * on setup, then listens for auth events to keep them aligned, and holds
  * requests until the session restore settles so a page effect that fetches
@@ -188,6 +202,9 @@ export function createDefaultAuthClientWithHttpSync(authConfig) {
  * Requests are also held until the session restore settles (see
  * {@link registerAuthGate}), so a page that fetches viewer-dependent data on
  * mount cannot race it and answer for an anonymous viewer.
+ *
+ * The profile type is `createDefaultAuthClient`'s: a JSON object type of named
+ * fields (see `AuthProfileShape`), including an app profile with no `id`.
  */
 export function createDefaultAuthClientWithFetchClient(authConfig, fetchClientOptions) {
     const authClient = createJWTAuthClient(authConfig);

package/dist/index.d.ts

@@ -24,7 +24,11 @@
  * - Auth/http factories — `createDefaultAuthClient(authConfig)` returns
  *   `{ authClient, setupAuthDefault }`; the `...WithHttpSync` /
  *   `...WithFetchClient` variants also keep the bonded http client's bearer
- *   token in sync with auth events.
+ *   token in sync with auth events. All three accept any JSON object profile
+ *   (`createDefaultAuthClient<SessionUser>(config)` for an API whose user has no
+ *   `id`) and fall back to `UserProfile` — with its `id: string` — when no type
+ *   argument is given. The profile is never inferred from `authConfig`, so an
+ *   untyped call keeps the default contract.
  *
  * @example
  * ```tsx

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAEH,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AAEH,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA"}

package/dist/index.js

@@ -24,7 +24,11 @@
  * - Auth/http factories — `createDefaultAuthClient(authConfig)` returns
  *   `{ authClient, setupAuthDefault }`; the `...WithHttpSync` /
  *   `...WithFetchClient` variants also keep the bonded http client's bearer
- *   token in sync with auth events.
+ *   token in sync with auth events. All three accept any JSON object profile
+ *   (`createDefaultAuthClient<SessionUser>(config)` for an API whose user has no
+ *   `id`) and fall back to `UserProfile` — with its `id: string` — when no type
+ *   argument is given. The profile is never inferred from `authConfig`, so an
+ *   untyped call keeps the default contract.
  *
  * @example
  * ```tsx

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-bonds-default-react",
-  "version": "1.1.5",
+  "version": "2.0.0",
   "description": "Default app-side bond wirings for React+Tailwind+react-router+localStorage+Arimo font+molecule icons. 5 setup functions consolidating 665 byte-identical per-app bond wiring files across the fleet.",
   "homepage": "https://www.molecule.dev/packages/app-bonds-default-react",
   "type": "module",
@@ -38,49 +38,49 @@
     "directory": "packages/app/infrastructure/bonds-default-react"
   },
   "devDependencies": {
-    "@molecule/app-auth": "1.5.9",
-    "@molecule/app-charts-chartjs": "1.0.2",
-    "@molecule/app-client-search": "1.0.2",
-    "@molecule/app-client-search-minisearch": "1.0.3",
-    "@molecule/app-code-editor": "1.0.2",
-    "@molecule/app-code-editor-monaco": "1.0.3",
-    "@molecule/app-command-palette": "1.0.2",
-    "@molecule/app-command-palette-cmdk": "1.0.2",
-    "@molecule/app-drag-drop": "1.0.2",
-    "@molecule/app-drag-drop-dndkit": "1.0.2",
-    "@molecule/app-fonts": "1.2.1",
-    "@molecule/app-fonts-arimo": "1.0.3",
-    "@molecule/app-http": "1.4.0",
-    "@molecule/app-icons": "1.0.2",
-    "@molecule/app-icons-molecule": "1.0.2",
-    "@molecule/app-keyboard-shortcuts": "1.0.2",
-    "@molecule/app-keyboard-shortcuts-hotkeys": "1.0.2",
-    "@molecule/app-maps-leaflet": "1.0.2",
-    "@molecule/app-realtime": "1.0.3",
-    "@molecule/app-realtime-socketio": "1.1.0",
-    "@molecule/app-routing": "1.0.3",
-    "@molecule/app-routing-react-router": "1.0.2",
-    "@molecule/app-state": "1.0.3",
-    "@molecule/app-storage": "1.0.2",
-    "@molecule/app-storage-localstorage": "1.0.2",
-    "@molecule/app-theme": "1.0.3",
-    "@molecule/app-theme-css-variables": "1.0.3",
-    "@molecule/app-ui": "1.3.7",
-    "@molecule/app-ui-tailwind": "1.2.6",
-    "@molecule/app-video-hls": "1.0.2",
-    "@molecule/app-virtual-scroll": "1.0.2",
-    "@molecule/app-virtual-scroll-tanstack": "1.0.2",
-    "@types/node": "26.1.2",
-    "@types/react": "19.2.17",
-    "@types/react-dom": "19.2.3",
-    "happy-dom": "20.11.1",
-    "react": "19.2.8",
-    "react-dom": "19.2.8",
+    "@molecule/app-auth": "2.0.0",
+    "@molecule/app-charts-chartjs": "1.0.3",
+    "@molecule/app-client-search": "1.0.3",
+    "@molecule/app-client-search-minisearch": "1.0.4",
+    "@molecule/app-code-editor": "1.0.3",
+    "@molecule/app-code-editor-monaco": "1.0.4",
+    "@molecule/app-command-palette": "1.0.3",
+    "@molecule/app-command-palette-cmdk": "1.0.3",
+    "@molecule/app-drag-drop": "1.0.3",
+    "@molecule/app-drag-drop-dndkit": "1.0.3",
+    "@molecule/app-fonts": "1.2.2",
+    "@molecule/app-fonts-arimo": "1.0.5",
+    "@molecule/app-http": "1.4.1",
+    "@molecule/app-icons": "1.0.3",
+    "@molecule/app-icons-molecule": "1.0.3",
+    "@molecule/app-keyboard-shortcuts": "1.0.3",
+    "@molecule/app-keyboard-shortcuts-hotkeys": "1.0.3",
+    "@molecule/app-maps-leaflet": "1.0.3",
+    "@molecule/app-realtime": "1.0.4",
+    "@molecule/app-realtime-socketio": "1.1.1",
+    "@molecule/app-routing": "1.0.4",
+    "@molecule/app-routing-react-router": "1.1.1",
+    "@molecule/app-state": "1.0.4",
+    "@molecule/app-storage": "1.0.4",
+    "@molecule/app-storage-localstorage": "1.0.3",
+    "@molecule/app-theme": "1.0.4",
+    "@molecule/app-theme-css-variables": "1.0.4",
+    "@molecule/app-ui": "1.3.8",
+    "@molecule/app-ui-tailwind": "1.2.7",
+    "@molecule/app-video-hls": "1.0.3",
+    "@molecule/app-virtual-scroll": "1.0.3",
+    "@molecule/app-virtual-scroll-tanstack": "1.0.3",
+    "@types/node": "26.6.5",
+    "@types/react": "19.3.0",
+    "@types/react-dom": "19.3.0",
+    "happy-dom": "21.0.4",
+    "react": "19.3.1",
+    "react-dom": "19.3.1",
     "typescript": "6.0.3",
-    "vitest": "4.1.11"
+    "vitest": "4.1.12"
   },
   "peerDependencies": {
-    "@molecule/app-auth": "^1.0.1",
+    "@molecule/app-auth": "^2.0.0",
     "@molecule/app-charts": "^1.0.1",
     "@molecule/app-charts-chartjs": "^1.0.1",
     "@molecule/app-client-search": "^1.0.0",