@molecule/app-bonds-default-react 3.0.0 → 3.0.2

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-10-25T20:03:32.757Z
+Generated: 2026-11-04T14:20:04.598Z
 -->
 
 # @molecule/app-bonds-default-react
@@ -39,6 +39,17 @@ React fleet stack, replacing the byte-identical per-app files:
   argument is given. The profile is never inferred from `authConfig`, so an
   untyped call keeps the default contract.
 
+**What this client already handles**
+
+- `getAccessToken()` returns a stored token during restore; only 401/403 ends
+  the session, while network/5xx failures retain it.
+- `tokenKey`/`storagePrefix`, `authScheme`, `mapAuthResponse`,
+  `currentUserEndpoint`, and `profileEndpoint`/`profileUpdateMethod` adapt the API.
+- `logout()` settles local sign-out; `refresh()` uses a stored refresh token.
+
+This factory adds no render gate: `AuthProvider` renders children immediately.
+The HTTP-sync variants gate requests during restore, not rendering.
+
 > **Auto-generated, AI-first package reference** for the [molecule.dev](https://molecule.dev) ecosystem.
 > It is written to be read by coding agents as much as by people, and is generated from this
 > package's source — edit `src/index.ts` JSDoc, not this file.
@@ -72,6 +83,24 @@ bootstrapApp({
 })
 ```
 
+Adapt a nested token and `Token` header without another session store.
+
+```ts
+import { createDefaultAuthClient } from '@molecule/app-bonds-default-react'
+
+const { authClient, setupAuthDefault } = createDefaultAuthClient({
+  tokenKey: 'app.jwt',
+  authScheme: 'Token',
+  currentUserEndpoint: '/user',
+  profileEndpoint: '/user',
+  profileUpdateMethod: 'PUT',
+  mapAuthResponse: (data) => {
+    const { token, ...user } = (data as { user: { token: string; id: string } }).user
+    return { accessToken: token, user }
+  },
+})
+```
+
 ## Type
 
 `feature`
@@ -123,8 +152,18 @@ function createDefaultHttpClientWithAuthBearer(opts: {
   withCredentials?: boolean
   stripApiPrefix?: boolean
   getToken: () => string | null | undefined
+  /**
+   * The scheme of the `Authorization` header the token from `getToken()` is sent
+   * with: `Bearer` (default), or what the API expects, e.g. `Token` for an API
+   * that reads `Authorization: Token <jwt>`. Pass it to this constructor — the
+   * same option `@molecule/app-http`'s client config calls `authScheme`, and not
+   * a property of the client that comes back.
+   */
   authScheme?: string
-}): { httpClient: HttpClient; setupHttpDefault: () => void }
+}): {
+  httpClient: HttpClient
+  setupHttpDefault: () => void
+}
 ```
 
 #### `createDefaultAuthClient(authConfig)`
@@ -149,12 +188,18 @@ page that reads `undefined`. An annotated config alone does not supply the type
 argument — that is a 1.8 caller shape this major changes (see
 `AuthClientConfig`'s migration note in `@molecule/app-auth`).
 
-`TRegister` is the app's own registration fields (`{ username: string }` for a
-RealWorld-shaped API), passed on to `@molecule/app-auth`'s factory so
+`TRegister` is the app's own extra registration fields (for example
+`{ username: string }`), passed on to `@molecule/app-auth`'s factory so
 `authClient.register({ username, email, password })` type-checks with no cast.
+See the module guidance for the lifecycle and API adaptations already included.
 
 ```typescript
-function createDefaultAuthClient(authConfig: NoInfer<AuthClientConfigOptions<TUser>>): {
+function createDefaultAuthClient<
+  TUser extends AuthProfileConstraint<TUser> = UserProfile,
+  TRegister extends RegisterExtraShape<TRegister> = Record<never, never>,
+>(
+  authConfig: NoInfer<AuthClientConfigOptions<TUser>>,
+): {
   authClient: AuthClient<TUser, TRegister>
   setupAuthDefault: () => void
 }
@@ -186,7 +231,12 @@ The profile type is `createDefaultAuthClient`'s: a JSON object type of named
 fields (see `AuthProfileShape`), including an app profile with no `id`.
 
 ```typescript
-function createDefaultAuthClientWithHttpSync(authConfig: NoInfer<AuthClientConfigOptions<TUser>>): {
+function createDefaultAuthClientWithHttpSync<
+  TUser extends AuthProfileConstraint<TUser> = UserProfile,
+  TRegister extends RegisterExtraShape<TRegister> = Record<never, never>,
+>(
+  authConfig: NoInfer<AuthClientConfigOptions<TUser>>,
+): {
   authClient: AuthClient<TUser, TRegister>
   setupAuthDefault: () => void
 }
@@ -221,10 +271,16 @@ The profile type is `createDefaultAuthClient`'s: a JSON object type of named
 fields (see `AuthProfileShape`), including an app profile with no `id`.
 
 ```typescript
-function createDefaultAuthClientWithFetchClient(
+function createDefaultAuthClientWithFetchClient<
+  TUser extends AuthProfileConstraint<TUser> = UserProfile,
+  TRegister extends RegisterExtraShape<TRegister> = Record<never, never>,
+>(
   authConfig: NoInfer<AuthClientConfigOptions<TUser>>,
   fetchClientOptions: { baseURL: string; withCredentials?: boolean },
-): { authClient: AuthClient<TUser, TRegister>; setupAuthDefault: () => void }
+): {
+  authClient: AuthClient<TUser, TRegister>
+  setupAuthDefault: () => void
+}
 ```
 
 #### `bootstrapApp(opts)`
@@ -250,7 +306,7 @@ function bootstrapApp(opts: {
 Returns (and lazily constructs) the shared default CSS-variables theme provider.
 
 ```typescript
-function getDefaultThemeProvider(): ThemeProvider
+function getDefaultThemeProvider(): ReturnType<typeof createCSSVariablesThemeProvider>
 ```
 
 #### `setupAppFontsArimo()`

package/dist/auth.d.ts

@@ -72,9 +72,10 @@ export declare function createDefaultHttpClientWithAuthBearer(opts: {
  * argument — that is a 1.8 caller shape this major changes (see
  * `AuthClientConfig`'s migration note in `@molecule/app-auth`).
  *
- * `TRegister` is the app's own registration fields (`{ username: string }` for a
- * RealWorld-shaped API), passed on to `@molecule/app-auth`'s factory so
+ * `TRegister` is the app's own extra registration fields (for example
+ * `{ username: string }`), passed on to `@molecule/app-auth`'s factory so
  * `authClient.register({ username, email, password })` type-checks with no cast.
+ * See the module guidance for the lifecycle and API adaptations already included.
  *
  * @example
  * ```ts

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,uBAAuB,EAEvB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACZ,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAsCpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE;IAC1D,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG;IACF,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAuBA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,GAClD;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,GAClD;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAkCA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,sCAAsC,CACpD,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,EACnD,kBAAkB,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACjE;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAmCA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,uBAAuB,EAEvB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACZ,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAsCpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE;IAC1D,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG;IACF,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAuBA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,GAClD;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,GAClD;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAkCA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,sCAAsC,CACpD,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,EACnD,kBAAkB,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACjE;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAmCA"}

package/dist/auth.js

@@ -3,12 +3,12 @@ import { createFetchClient, getClient as getHttpClient, setAuthGate, setAuthToke
 /**
  * Holds every HTTP request until this auth client's session restore has settled.
  *
- * Without it a page effect that fires on mount (fetching a profile's `following`
- * flag, a feed, a `favorited` state) sends its request before `initialize()` has
+ * Without it a page effect that fires on mount (fetching account settings, a
+ * dashboard, or a saved-item state) sends its request before `initialize()` has
  * restored the session, so it leaves with no `Authorization` header and the server
  * answers for an anonymous viewer. Localhost usually hides it — the restore wins
  * the race against the first effect there — and the deployed URL exposes it, where a
- * "Follow" button on a followed user reads as stale database state.
+ * saved item reads as unsaved because the request lacked its session.
  *
  * `whenRestored()` resolves immediately when no restore is in flight, so a request
  * made after boot never waits at all; it holds only while the restore is actually
@@ -110,9 +110,10 @@ export function createDefaultHttpClientWithAuthBearer(opts) {
  * argument — that is a 1.8 caller shape this major changes (see
  * `AuthClientConfig`'s migration note in `@molecule/app-auth`).
  *
- * `TRegister` is the app's own registration fields (`{ username: string }` for a
- * RealWorld-shaped API), passed on to `@molecule/app-auth`'s factory so
+ * `TRegister` is the app's own extra registration fields (for example
+ * `{ username: string }`), passed on to `@molecule/app-auth`'s factory so
  * `authClient.register({ username, email, password })` type-checks with no cast.
+ * See the module guidance for the lifecycle and API adaptations already included.
  *
  * @example
  * ```ts
@@ -231,7 +232,7 @@ export function createDefaultAuthClientWithFetchClient(authConfig, fetchClientOp
             });
             // Registered BEFORE the bond: `setHttpClient` applies the restored session's
             // token, and the same source reaches any client an app bonds later instead of
-            // this one (xr-molecule-flash-m156 — a client captured at setup cannot). The
+            // this one. A client captured at setup cannot track later replacements. The
             // client resolves the source on every request, so a session adopted by
             // `setSession()` or `setAccessToken()` after this point is sent immediately.
             setHttpAuthTokenSource(() => authClient.getAccessToken());

package/dist/index.d.ts

@@ -30,6 +30,16 @@
  *   argument is given. The profile is never inferred from `authConfig`, so an
  *   untyped call keeps the default contract.
  *
+ * **What this client already handles**
+ * - `getAccessToken()` returns a stored token during restore; only 401/403 ends
+ *   the session, while network/5xx failures retain it.
+ * - `tokenKey`/`storagePrefix`, `authScheme`, `mapAuthResponse`,
+ *   `currentUserEndpoint`, and `profileEndpoint`/`profileUpdateMethod` adapt the API.
+ * - `logout()` settles local sign-out; `refresh()` uses a stored refresh token.
+ *
+ * This factory adds no render gate: `AuthProvider` renders children immediately.
+ * The HTTP-sync variants gate requests during restore, not rendering.
+ *
  * @example
  * ```tsx
  * // src/main.tsx
@@ -59,6 +69,23 @@
  * })
  * ```
  *
+ * @example Adapt a nested token and `Token` header without another session store.
+ * ```ts
+ * import { createDefaultAuthClient } from '@molecule/app-bonds-default-react'
+ *
+ * const { authClient, setupAuthDefault } = createDefaultAuthClient({
+ *   tokenKey: 'app.jwt',
+ *   authScheme: 'Token',
+ *   currentUserEndpoint: '/user',
+ *   profileEndpoint: '/user',
+ *   profileUpdateMethod: 'PUT',
+ *   mapAuthResponse: (data) => {
+ *     const { token, ...user } = (data as { user: { token: string; id: string } }).user
+ *     return { accessToken: token, user }
+ *   },
+ * })
+ * ```
+ *
  * @remarks
  * - **Optional setups are NOT exported from the package root.** Import each from
  *   its own subpath — `@molecule/app-bonds-default-react/optional/maps-leaflet.js`,

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AAEH,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsHG;AAEH,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA"}

package/dist/index.js

@@ -30,6 +30,16 @@
  *   argument is given. The profile is never inferred from `authConfig`, so an
  *   untyped call keeps the default contract.
  *
+ * **What this client already handles**
+ * - `getAccessToken()` returns a stored token during restore; only 401/403 ends
+ *   the session, while network/5xx failures retain it.
+ * - `tokenKey`/`storagePrefix`, `authScheme`, `mapAuthResponse`,
+ *   `currentUserEndpoint`, and `profileEndpoint`/`profileUpdateMethod` adapt the API.
+ * - `logout()` settles local sign-out; `refresh()` uses a stored refresh token.
+ *
+ * This factory adds no render gate: `AuthProvider` renders children immediately.
+ * The HTTP-sync variants gate requests during restore, not rendering.
+ *
  * @example
  * ```tsx
  * // src/main.tsx
@@ -59,6 +69,23 @@
  * })
  * ```
  *
+ * @example Adapt a nested token and `Token` header without another session store.
+ * ```ts
+ * import { createDefaultAuthClient } from '@molecule/app-bonds-default-react'
+ *
+ * const { authClient, setupAuthDefault } = createDefaultAuthClient({
+ *   tokenKey: 'app.jwt',
+ *   authScheme: 'Token',
+ *   currentUserEndpoint: '/user',
+ *   profileEndpoint: '/user',
+ *   profileUpdateMethod: 'PUT',
+ *   mapAuthResponse: (data) => {
+ *     const { token, ...user } = (data as { user: { token: string; id: string } }).user
+ *     return { accessToken: token, user }
+ *   },
+ * })
+ * ```
+ *
  * @remarks
  * - **Optional setups are NOT exported from the package root.** Import each from
  *   its own subpath — `@molecule/app-bonds-default-react/optional/maps-leaflet.js`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-bonds-default-react",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "Default app-side bond wirings for React+Tailwind+react-router+localStorage+Arimo font+molecule icons. 5 setup functions consolidating 665 byte-identical per-app bond wiring files across the fleet.",
   "homepage": "https://www.molecule.dev/packages/app-bonds-default-react",
   "type": "module",
@@ -39,37 +39,37 @@
     "directory": "packages/app/infrastructure/bonds-default-react"
   },
   "devDependencies": {
-    "@molecule/app-auth": "3.0.0",
+    "@molecule/app-auth": "3.2.4",
     "@molecule/app-charts-chartjs": "1.0.3",
-    "@molecule/app-client-search": "1.0.3",
+    "@molecule/app-client-search": "1.0.4",
     "@molecule/app-client-search-minisearch": "1.0.4",
     "@molecule/app-code-editor": "1.0.3",
-    "@molecule/app-code-editor-monaco": "1.0.4",
+    "@molecule/app-code-editor-monaco": "1.0.5",
     "@molecule/app-command-palette": "1.0.3",
     "@molecule/app-command-palette-cmdk": "1.0.3",
-    "@molecule/app-drag-drop": "1.0.3",
-    "@molecule/app-drag-drop-dndkit": "1.0.3",
+    "@molecule/app-drag-drop": "1.0.4",
+    "@molecule/app-drag-drop-dndkit": "1.0.4",
     "@molecule/app-fonts": "1.2.2",
     "@molecule/app-fonts-arimo": "1.0.5",
-    "@molecule/app-http": "1.5.0",
+    "@molecule/app-http": "1.5.4",
     "@molecule/app-icons": "1.0.3",
     "@molecule/app-icons-molecule": "1.0.3",
     "@molecule/app-keyboard-shortcuts": "1.0.3",
     "@molecule/app-keyboard-shortcuts-hotkeys": "1.0.3",
     "@molecule/app-maps-leaflet": "1.0.3",
     "@molecule/app-realtime": "1.0.4",
-    "@molecule/app-realtime-socketio": "1.1.1",
-    "@molecule/app-routing": "1.0.4",
-    "@molecule/app-routing-react-router": "1.1.2",
-    "@molecule/app-state": "1.0.4",
-    "@molecule/app-storage": "1.0.4",
-    "@molecule/app-storage-localstorage": "1.0.3",
+    "@molecule/app-realtime-socketio": "1.1.2",
+    "@molecule/app-routing": "1.0.5",
+    "@molecule/app-routing-react-router": "1.2.1",
+    "@molecule/app-state": "1.1.1",
+    "@molecule/app-storage": "1.1.0",
+    "@molecule/app-storage-localstorage": "1.1.0",
     "@molecule/app-theme": "1.0.4",
     "@molecule/app-theme-css-variables": "1.0.4",
-    "@molecule/app-ui": "1.3.8",
-    "@molecule/app-ui-tailwind": "1.2.7",
+    "@molecule/app-ui": "1.3.9",
+    "@molecule/app-ui-tailwind": "1.2.8",
     "@molecule/app-video-hls": "1.0.3",
-    "@molecule/app-virtual-scroll": "1.0.3",
+    "@molecule/app-virtual-scroll": "1.0.4",
     "@molecule/app-virtual-scroll-tanstack": "1.0.3",
     "@types/node": "26.6.5",
     "@types/react": "19.3.0",