@molecule/app-http 1.1.5 → 1.2.0

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-10-17T19:12:43.116Z
+Generated: 2026-10-18T09:50:54.298Z
 -->
 
 # @molecule/app-http
@@ -525,10 +525,30 @@ function unwrapSingle(res: unknown): T | null
 
 **Returns:** The typed resource `T`, or `null` when the response shape indicates "no resource" (including the various empty envelopes above).
 
+#### `setAuthTokenSource(source)`
+
+Registers the token source a newly bonded client is hydrated from, or clears
+it with `null`.
+
+The source is read once per bond: the client bonded AFTER this call (and the
+one bonded now, if any) receives `source()` through `setAuthToken`. That is
+what carries a restored session's token into a client the auth setup ran
+before — the setup does not need to hold a client reference at all.
+
+```typescript
+function setAuthTokenSource(source: (() => string | null | undefined) | null): void
+```
+
+- `source` — Returns the current access token (null when signed out), or `null` to clear.
+
 #### `setClient(client)`
 
 Registers an HTTP client as the active singleton.
 
+A registered `setAuthTokenSource` token source is applied to the client
+here, so a client bonded after the auth setup still carries the restored
+session's token.
+
 ```typescript
 function setClient(client: HttpClient): void
 ```
@@ -537,8 +557,8 @@ function setClient(client: HttpClient): void
 
 #### `getClient()`
 
-Retrieves the bonded HTTP client. If none is bonded, automatically
-creates a default fetch-based client.
+Retrieves the bonded HTTP client. If none is bonded, returns a module-level
+fetch-based fallback — it is NOT bonded.
 
 The fallback has NO `baseURL` — a core cannot know an app's API prefix. A relative
 call then resolves against the page origin, where a dev server answers its own HTML
@@ -546,11 +566,15 @@ shell with a 200. It warns once so the misconfiguration is named instead of show
 as a crash three components later; a scaffold bonds the shared client with its API
 prefix, so the fallback only runs in an app that never bonded one.
 
+Returning it WITHOUT bonding is what keeps a later `setClient()` authoritative: a
+caller that captured this fallback early does not make it the app's client, so the
+scaffold's client (and its token source) still takes effect for every later call.
+
 ```typescript
 function getClient(): HttpClient
 ```
 
-**Returns:** The active HTTP client instance.
+**Returns:** The active HTTP client, or the unbonded fallback when none is bonded.
 
 #### `get(url, config)`
 
@@ -696,6 +720,11 @@ that fetches viewer-dependent data on mount (a profile's `following` flag, a fee
 bond registers that wait with `setAuthGate`; apps that bond auth through
 `@molecule/app-bonds-default-react` get it without doing anything. An app with its own session
 module registers its own: `setAuthGate(() => session.whenRestored())`.
+Waiting for the restore does NOT attach the token: a client created beside the auth bond needs
+`createDefaultHttpClientWithAuthBearer({ baseURL, getToken: () => authClient.getAccessToken(),
+authScheme })` from `@molecule/app-bonds-default-react` (or an auth client built with
+`createDefaultAuthClientWithHttpSync`, which mirrors the token into the bonded client), because
+`setAuthGate` alone sends no `Authorization` header.
 
 **A request the gate itself depends on must opt out of it: pass `skipAuthGate: true`.** A gate
 that waits for a session restore whose own request goes through this client waits on itself —

package/dist/auth-gate.d.ts

@@ -15,6 +15,13 @@
  * `@molecule/app-bonds-default-react`'s auth helpers register the gate for
  * apps that bond auth, so an app does not have to get it right itself.
  *
+ * Waiting for the restore does NOT attach its token: a separately created HTTP
+ * client needs `createDefaultHttpClientWithAuthBearer({ baseURL,
+ * getToken: () => authClient.getAccessToken(), authScheme })` from
+ * `@molecule/app-bonds-default-react` (or the auth client built with
+ * `createDefaultAuthClientWithHttpSync`, which mirrors the token into the
+ * bonded client) plus `setAuthGate(() => authClient.whenRestored())`.
+ *
  * The gate is module-level, not per client, on purpose: the client an app ends
  * up using is often created AFTER the auth bond ran (`setupAuthDefault()` then
  * `setupHttpDefault()`), and a gate installed on the throwaway client the auth

package/dist/auth-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-gate.d.ts","sourceRoot":"","sources":["../src/auth-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AA6CjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAG,IAGhE,CAAA;AA6BD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,GAAU,UAAU,eAAe,KAAG,OAAO,CAAC,IAAI,CAuC3E,CAAA"}
+{"version":3,"file":"auth-gate.d.ts","sourceRoot":"","sources":["../src/auth-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AA6CjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAG,IAGhE,CAAA;AA6BD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,GAAU,UAAU,eAAe,KAAG,OAAO,CAAC,IAAI,CAuC3E,CAAA"}

package/dist/auth-gate.js

@@ -15,6 +15,13 @@
  * `@molecule/app-bonds-default-react`'s auth helpers register the gate for
  * apps that bond auth, so an app does not have to get it right itself.
  *
+ * Waiting for the restore does NOT attach its token: a separately created HTTP
+ * client needs `createDefaultHttpClientWithAuthBearer({ baseURL,
+ * getToken: () => authClient.getAccessToken(), authScheme })` from
+ * `@molecule/app-bonds-default-react` (or the auth client built with
+ * `createDefaultAuthClientWithHttpSync`, which mirrors the token into the
+ * bonded client) plus `setAuthGate(() => authClient.whenRestored())`.
+ *
  * The gate is module-level, not per client, on purpose: the client an app ends
  * up using is often created AFTER the auth bond ran (`setupAuthDefault()` then
  * `setupHttpDefault()`), and a gate installed on the throwaway client the auth

package/dist/auth-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-gate.js","sourceRoot":"","sources":["../src/auth-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAIhD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;AAEhC,iFAAiF;AACjF,IAAI,IAAI,GAAiC,IAAI,CAAA;AAE7C;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE9C;;;;;;;GAOG;AACH,IAAI,aAAa,GAAiC,IAAI,CAAA;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAkC,EAAQ,EAAE;IACtE,IAAI,GAAG,IAAI,CAAA;IACX,aAAa,GAAG,IAAI,CAAA;AACtB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,OAAyB,EAAU,EAAE,CAC5D,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,GAAG;IAC7B,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;IAC5D,CAAC,CAAC,WAAW,CAAA;AAEjB;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,KAA0B,EAAQ,EAAE;IAC7D,IAAI,aAAa,KAAK,KAAK;QAAE,OAAM;IACnC,aAAa,GAAG,KAAK,CAAA;IACrB,MAAM,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClD,MAAM,CAAC,KAAK,CACV,uCAAuC,eAAe,UAAU,YAAY,CAAC,IAAI,cAAc;QAC7F,oBAAoB,IAAI,mEAAmE;QAC3F,6FAA6F;QAC7F,uFAAuF;QACvF,sDAAsD,CACzD,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAyB,EAAiB,EAAE;IAC9E,wFAAwF;IACxF,gDAAgD;IAChD,IAAI,OAAO,EAAE,YAAY;QAAE,OAAM;IAEjC,MAAM,OAAO,GAAG,IAAI,CAAA;IACpB,IAAI,CAAC,OAAO;QAAE,OAAM;IAEpB,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAA;IACpC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;IAEjD,IAAI,KAAgD,CAAA;IACpD,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,4FAA4F;YAC5F,2FAA2F;YAC3F,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxC,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;oBAChF,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC,CAAC;YACF,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,QAAQ,GAAG,IAAI,CAAA;oBACf,mFAAmF;oBACnF,iBAAiB,CAAC,OAAO,CAAC,CAAA;oBAC1B,OAAO,EAAE,CAAA;gBACX,CAAC,EAAE,eAAe,CAAC,CAAA;YACrB,CAAC,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAC9B,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;IAED,yFAAyF;IACzF,8EAA8E;IAC9E,IAAI,CAAC,QAAQ,IAAI,aAAa,KAAK,OAAO;QAAE,aAAa,GAAG,IAAI,CAAA;AAClE,CAAC,CAAA"}
+{"version":3,"file":"auth-gate.js","sourceRoot":"","sources":["../src/auth-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAIhD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;AAEhC,iFAAiF;AACjF,IAAI,IAAI,GAAiC,IAAI,CAAA;AAE7C;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE9C;;;;;;;GAOG;AACH,IAAI,aAAa,GAAiC,IAAI,CAAA;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAkC,EAAQ,EAAE;IACtE,IAAI,GAAG,IAAI,CAAA;IACX,aAAa,GAAG,IAAI,CAAA;AACtB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,OAAyB,EAAU,EAAE,CAC5D,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,GAAG;IAC7B,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;IAC5D,CAAC,CAAC,WAAW,CAAA;AAEjB;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,KAA0B,EAAQ,EAAE;IAC7D,IAAI,aAAa,KAAK,KAAK;QAAE,OAAM;IACnC,aAAa,GAAG,KAAK,CAAA;IACrB,MAAM,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClD,MAAM,CAAC,KAAK,CACV,uCAAuC,eAAe,UAAU,YAAY,CAAC,IAAI,cAAc;QAC7F,oBAAoB,IAAI,mEAAmE;QAC3F,6FAA6F;QAC7F,uFAAuF;QACvF,sDAAsD,CACzD,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAyB,EAAiB,EAAE;IAC9E,wFAAwF;IACxF,gDAAgD;IAChD,IAAI,OAAO,EAAE,YAAY;QAAE,OAAM;IAEjC,MAAM,OAAO,GAAG,IAAI,CAAA;IACpB,IAAI,CAAC,OAAO;QAAE,OAAM;IAEpB,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAA;IACpC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;IAEjD,IAAI,KAAgD,CAAA;IACpD,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,4FAA4F;YAC5F,2FAA2F;YAC3F,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxC,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;oBAChF,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC,CAAC;YACF,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,QAAQ,GAAG,IAAI,CAAA;oBACf,mFAAmF;oBACnF,iBAAiB,CAAC,OAAO,CAAC,CAAA;oBAC1B,OAAO,EAAE,CAAA;gBACX,CAAC,EAAE,eAAe,CAAC,CAAA;YACrB,CAAC,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAC9B,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;IAED,yFAAyF;IACzF,8EAA8E;IAC9E,IAAI,CAAC,QAAQ,IAAI,aAAa,KAAK,OAAO;QAAE,aAAa,GAAG,IAAI,CAAA;AAClE,CAAC,CAAA"}

package/dist/index.d.ts

@@ -72,6 +72,11 @@
  * bond registers that wait with `setAuthGate`; apps that bond auth through
  * `@molecule/app-bonds-default-react` get it without doing anything. An app with its own session
  * module registers its own: `setAuthGate(() => session.whenRestored())`.
+ * Waiting for the restore does NOT attach the token: a client created beside the auth bond needs
+ * `createDefaultHttpClientWithAuthBearer({ baseURL, getToken: () => authClient.getAccessToken(),
+ * authScheme })` from `@molecule/app-bonds-default-react` (or an auth client built with
+ * `createDefaultAuthClientWithHttpSync`, which mirrors the token into the bonded client), because
+ * `setAuthGate` alone sends no `Authorization` header.
  *
  * **A request the gate itself depends on must opt out of it: pass `skipAuthGate: true`.** A gate
  * that waits for a session restore whose own request goes through this client waits on itself —

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAEH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA"}

package/dist/index.js

@@ -72,6 +72,11 @@
  * bond registers that wait with `setAuthGate`; apps that bond auth through
  * `@molecule/app-bonds-default-react` get it without doing anything. An app with its own session
  * module registers its own: `setAuthGate(() => session.whenRestored())`.
+ * Waiting for the restore does NOT attach the token: a client created beside the auth bond needs
+ * `createDefaultHttpClientWithAuthBearer({ baseURL, getToken: () => authClient.getAccessToken(),
+ * authScheme })` from `@molecule/app-bonds-default-react` (or an auth client built with
+ * `createDefaultAuthClientWithHttpSync`, which mirrors the token into the bonded client), because
+ * `setAuthGate` alone sends no `Authorization` header.
  *
  * **A request the gate itself depends on must opt out of it: pass `skipAuthGate: true`.** A gate
  * that waits for a session restore whose own request goes through this client waits on itself —

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAEH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA"}

package/dist/utilities.d.ts

@@ -1,17 +1,39 @@
 /**
  * HTTP bond accessor and convenience request functions.
  *
- * If no custom client is bonded, a fetch-based client is auto-created
- * on first access. Provides `get`, `post`, `put`, `patch`, and `del`
- * shorthand functions that delegate to the bonded client.
+ * If no custom client is bonded, a fetch-based client is returned — it is NOT
+ * bonded, so a client bonded later is what every subsequent call sees.
+ * Provides `get`, `post`, `put`, `patch`, and `del` shorthand functions that
+ * delegate to the bonded client.
  *
  * @module
  */
 import type { HttpClient } from './client.js';
 import type { HttpResponse, RequestConfig } from './types.js';
+/**
+ * Registers the token source a newly bonded client is hydrated from, or clears
+ * it with `null`.
+ *
+ * The source is read once per bond: the client bonded AFTER this call (and the
+ * one bonded now, if any) receives `source()` through `setAuthToken`. That is
+ * what carries a restored session's token into a client the auth setup ran
+ * before — the setup does not need to hold a client reference at all.
+ *
+ * @param source - Returns the current access token (null when signed out), or `null` to clear.
+ *
+ * @example
+ * ```typescript
+ * setAuthTokenSource(() => authClient.getAccessToken())
+ * ```
+ */
+export declare const setAuthTokenSource: (source: (() => string | null | undefined) | null) => void;
 /**
  * Registers an HTTP client as the active singleton.
  *
+ * A registered `setAuthTokenSource` token source is applied to the client
+ * here, so a client bonded after the auth setup still carries the restored
+ * session's token.
+ *
  * @param client - The HTTP client implementation to bond.
  *
  * @example
@@ -22,8 +44,8 @@ import type { HttpResponse, RequestConfig } from './types.js';
  */
 export declare const setClient: (client: HttpClient) => void;
 /**
- * Retrieves the bonded HTTP client. If none is bonded, automatically
- * creates a default fetch-based client.
+ * Retrieves the bonded HTTP client. If none is bonded, returns a module-level
+ * fetch-based fallback — it is NOT bonded.
  *
  * The fallback has NO `baseURL` — a core cannot know an app's API prefix. A relative
  * call then resolves against the page origin, where a dev server answers its own HTML
@@ -31,7 +53,11 @@ export declare const setClient: (client: HttpClient) => void;
  * as a crash three components later; a scaffold bonds the shared client with its API
  * prefix, so the fallback only runs in an app that never bonded one.
  *
- * @returns The active HTTP client instance.
+ * Returning it WITHOUT bonding is what keeps a later `setClient()` authoritative: a
+ * caller that captured this fallback early does not make it the app's client, so the
+ * scaffold's client (and its token source) still takes effect for every later call.
+ *
+ * @returns The active HTTP client, or the unbonded fallback when none is bonded.
  */
 export declare const getClient: () => HttpClient;
 /**

package/dist/utilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAO7D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,GAAI,QAAQ,UAAU,KAAG,IAE9C,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,QAAO,UAa5B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAC7D,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,GAAG,OAAO,EAC9B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA2C,CAAA;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAC7B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA0C,CAAA;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,KAAK,GAAI,CAAC,GAAG,OAAO,EAC/B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA4C,CAAA;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAC1D,CAAA;AAEpC;;;GAGG;AACH,eAAO,MAAM,WAAW,mBAA4D,CAAA"}
+{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AA6B7D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,CAAC,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,IAAI,KAAG,IAIrF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,GAAI,QAAQ,UAAU,KAAG,IAG9C,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,QAAO,UAY5B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAC7D,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,GAAG,OAAO,EAC9B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA2C,CAAA;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAC7B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA0C,CAAA;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,KAAK,GAAI,CAAC,GAAG,OAAO,EAC/B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA4C,CAAA;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAC1D,CAAA;AAEpC;;;GAGG;AACH,eAAO,MAAM,WAAW,mBAA4D,CAAA"}

package/dist/utilities.js

@@ -1,9 +1,10 @@
 /**
  * HTTP bond accessor and convenience request functions.
  *
- * If no custom client is bonded, a fetch-based client is auto-created
- * on first access. Provides `get`, `post`, `put`, `patch`, and `del`
- * shorthand functions that delegate to the bonded client.
+ * If no custom client is bonded, a fetch-based client is returned — it is NOT
+ * bonded, so a client bonded later is what every subsequent call sees.
+ * Provides `get`, `post`, `put`, `patch`, and `del` shorthand functions that
+ * delegate to the bonded client.
  *
  * @module
  */
@@ -13,9 +14,55 @@ import { createFetchClient } from './provider.js';
 const BOND_TYPE = 'http-client';
 /** One warning per page load is enough to name a missing bond. */
 let warnedAboutFallback = false;
+/**
+ * The client `getClient()` returns while nothing is bonded.
+ *
+ * Module-level and deliberately NEVER bonded: bonding it made the fallback the
+ * page's shared client, so a caller that read `getClient()` before
+ * `setClient()` captured a no-baseURL client that every later `setClient()`
+ * could not reach — the app's real client was bonded and the caller's token
+ * sync kept writing into the orphan, so every request went out bare
+ * (xr-molecule-flash-m156, 401 `token is missing` after a reload).
+ */
+let unbondedFallback = null;
+/**
+ * The auth client whose token every HTTP client starts with, or null.
+ *
+ * `setClient` applies it at bond time, which is the only moment that can reach a
+ * client created AFTER the auth setup ran — the scaffold wires auth before http,
+ * so the auth bond's initial token had no client to land on
+ * (`createDefaultAuthClientWithHttpSync` in `@molecule/app-bonds-default-react`).
+ */
+let authTokenSource = null;
+/**
+ * Registers the token source a newly bonded client is hydrated from, or clears
+ * it with `null`.
+ *
+ * The source is read once per bond: the client bonded AFTER this call (and the
+ * one bonded now, if any) receives `source()` through `setAuthToken`. That is
+ * what carries a restored session's token into a client the auth setup ran
+ * before — the setup does not need to hold a client reference at all.
+ *
+ * @param source - Returns the current access token (null when signed out), or `null` to clear.
+ *
+ * @example
+ * ```typescript
+ * setAuthTokenSource(() => authClient.getAccessToken())
+ * ```
+ */
+export const setAuthTokenSource = (source) => {
+    authTokenSource = source;
+    const bonded = bondGet(BOND_TYPE);
+    if (bonded && source)
+        bonded.setAuthToken(source() ?? null);
+};
 /**
  * Registers an HTTP client as the active singleton.
  *
+ * A registered `setAuthTokenSource` token source is applied to the client
+ * here, so a client bonded after the auth setup still carries the restored
+ * session's token.
+ *
  * @param client - The HTTP client implementation to bond.
  *
  * @example
@@ -26,10 +73,12 @@ let warnedAboutFallback = false;
  */
 export const setClient = (client) => {
     bond(BOND_TYPE, client);
+    if (authTokenSource)
+        client.setAuthToken(authTokenSource() ?? null);
 };
 /**
- * Retrieves the bonded HTTP client. If none is bonded, automatically
- * creates a default fetch-based client.
+ * Retrieves the bonded HTTP client. If none is bonded, returns a module-level
+ * fetch-based fallback — it is NOT bonded.
  *
  * The fallback has NO `baseURL` — a core cannot know an app's API prefix. A relative
  * call then resolves against the page origin, where a dev server answers its own HTML
@@ -37,20 +86,24 @@ export const setClient = (client) => {
  * as a crash three components later; a scaffold bonds the shared client with its API
  * prefix, so the fallback only runs in an app that never bonded one.
  *
- * @returns The active HTTP client instance.
+ * Returning it WITHOUT bonding is what keeps a later `setClient()` authoritative: a
+ * caller that captured this fallback early does not make it the app's client, so the
+ * scaffold's client (and its token source) still takes effect for every later call.
+ *
+ * @returns The active HTTP client, or the unbonded fallback when none is bonded.
  */
 export const getClient = () => {
     const existing = bondGet(BOND_TYPE);
     if (existing)
         return existing;
-    const fallback = createFetchClient();
-    bond(BOND_TYPE, fallback);
+    if (!unbondedFallback)
+        unbondedFallback = createFetchClient();
     if (!warnedAboutFallback) {
         warnedAboutFallback = true;
         getLogger('http').warn('@molecule/app-http: no client is bonded — requests go to the page origin with no baseURL. ' +
             "Bond one: setClient(createFetchClient({ baseURL: '/api' })).");
     }
-    return fallback;
+    return unbondedFallback;
 };
 /**
  * Makes a GET request using the bonded HTTP client.

package/dist/utilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"utilities.js","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAGhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAGjD,MAAM,SAAS,GAAG,aAAa,CAAA;AAE/B,kEAAkE;AAClE,IAAI,mBAAmB,GAAG,KAAK,CAAA;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACpD,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;AACzB,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAe,EAAE;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAa,SAAS,CAAC,CAAA;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACzB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,IAAI,CAAA;QAC1B,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CACpB,4FAA4F;YAC1F,8DAA8D,CACjE,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAc,GAAW,EAAE,MAAsB,EAA4B,EAAE,CAChG,SAAS,EAAE,CAAC,GAAG,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAErE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAc,GAAW,EAAE,MAAsB,EAA4B,EAAE,CAChG,SAAS,EAAE,CAAC,MAAM,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA"}
+{"version":3,"file":"utilities.js","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAGhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAGjD,MAAM,SAAS,GAAG,aAAa,CAAA;AAE/B,kEAAkE;AAClE,IAAI,mBAAmB,GAAG,KAAK,CAAA;AAE/B;;;;;;;;;GASG;AACH,IAAI,gBAAgB,GAAsB,IAAI,CAAA;AAE9C;;;;;;;GAOG;AACH,IAAI,eAAe,GAA6C,IAAI,CAAA;AAEpE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAgD,EAAQ,EAAE;IAC3F,eAAe,GAAG,MAAM,CAAA;IACxB,MAAM,MAAM,GAAG,OAAO,CAAa,SAAS,CAAC,CAAA;IAC7C,IAAI,MAAM,IAAI,MAAM;QAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAA;AAC7D,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACpD,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACvB,IAAI,eAAe;QAAE,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,IAAI,CAAC,CAAA;AACrE,CAAC,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAe,EAAE;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAa,SAAS,CAAC,CAAA;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,CAAC,gBAAgB;QAAE,gBAAgB,GAAG,iBAAiB,EAAE,CAAA;IAC7D,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,IAAI,CAAA;QAC1B,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CACpB,4FAA4F;YAC1F,8DAA8D,CACjE,CAAA;IACH,CAAC;IACD,OAAO,gBAAgB,CAAA;AACzB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAc,GAAW,EAAE,MAAsB,EAA4B,EAAE,CAChG,SAAS,EAAE,CAAC,GAAG,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAErE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAc,GAAW,EAAE,MAAsB,EAA4B,EAAE,CAChG,SAAS,EAAE,CAAC,MAAM,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-http",
-  "version": "1.1.5",
+  "version": "1.2.0",
   "description": "Client HTTP interface for molecule.dev",
   "type": "module",
   "main": "dist/index.js",
@@ -33,7 +33,7 @@
     "@molecule/app-logger": "^1.0.1"
   },
   "devDependencies": {
-    "@molecule/app-bond": "1.0.2",
+    "@molecule/app-bond": "1.0.3",
     "@molecule/app-i18n": "1.0.3",
     "@molecule/app-logger": "1.0.2",
     "@types/node": "26.1.2",