@molecule/app-http 1.1.6 → 1.2.1

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-10-18T09:07:54.160Z
+Generated: 2026-10-18T17:46:02.937Z
 -->
 
 # @molecule/app-http
@@ -219,11 +219,15 @@ interface RequestConfig {
   /**
    * Send this request WITHOUT waiting for the session restore (the auth gate).
    *
-   * A request the gate itself depends on must set this. A gate registered with
-   * `setAuthGate` that waits for a session restore whose own request goes through this
-   * client otherwise waits on itself: the gate holds the restore's request, the restore's
-   * promise never settles, and every request on the page stalls until the gate times out —
-   * so pass `skipAuthGate: true` on the restore's own request:
+   * A request the gate's restore issues from a LATER continuation must set this. The gate
+   * recognizes a request the settle function issues while it runs and never holds it — this
+   * package's client awaits the gate before anything else, so a `restoreSession()` that calls
+   * it directly does not deadlock. But a restore that awaits something else first
+   * (`await storage.get()`), then calls the client, reaches `awaitAuthGate` after that window:
+   * the gate then waits on itself, and every request on the page stalls until the gate times
+   * out (3 s) — so pass `skipAuthGate: true` on that request. A provider that awaits the gate
+   * inside a scheduled interceptor (the Axios bond) also reaches it after the window, so its
+   * restore's request needs the opt-out.
    *
    * ```typescript
    * // the request the gate's restore makes, through the same client the gate holds back
@@ -232,7 +236,8 @@ interface RequestConfig {
    *
    * `@molecule/app-auth`'s own restore does not need it — it sends its request with
    * `fetch`, not through this client. An app with its own session store that registers a
-   * gate with `setAuthGate` does.
+   * gate with `setAuthGate` does not need it either when its restore calls the client
+   * directly.
    */
   skipAuthGate?: boolean
 
@@ -423,10 +428,20 @@ template auth that is `() => authClient.whenRestored()`, which resolves
 immediately when no restore is in flight, so registering it never makes a
 request wait longer than the restore it was about to race anyway.
 
-A gate whose restore sends its OWN request through the gated client deadlocks — the
-gate holds the request it is waiting for. That request must pass `skipAuthGate: true`
-(see `RequestConfig.skipAuthGate`); `@molecule/app-auth`'s own restore does not
-need it because it uses `fetch` rather than the bonded client.
+Waiting for the restore does NOT attach its token: a separately created HTTP
+client needs `createDefaultHttpClientWithAuthBearer({ baseURL,
+getToken: () => authClient.getAccessToken(), authScheme })` from
+`@molecule/app-bonds-default-react` (or the auth client built with
+`createDefaultAuthClientWithHttpSync`, which mirrors the token into the
+bonded client) plus `setAuthGate(() => authClient.whenRestored())`.
+
+The restore's own requests are never held: a request the settle function issues while it
+runs goes out immediately, so `setAuthGate(() => restoreSession())` cannot deadlock even
+when `restoreSession` calls the gated client. A restore that awaits something else first
+(a storage read, a `Promise.resolve()`) issues its request from a later continuation, which
+the gate cannot recognize — that request needs `skipAuthGate: true` (see
+`RequestConfig.skipAuthGate`). `@molecule/app-auth`'s own restore needs neither because it
+uses `fetch` rather than the bonded client.
 
 ```typescript
 function setAuthGate(next: (() => Promise<void>) | null): void
@@ -525,10 +540,30 @@ function unwrapSingle(res: unknown): T | null
 
 **Returns:** The typed resource `T`, or `null` when the response shape indicates "no resource" (including the various empty envelopes above).
 
+#### `setAuthTokenSource(source)`
+
+Registers the token source a newly bonded client is hydrated from, or clears
+it with `null`.
+
+The source is read once per bond: the client bonded AFTER this call (and the
+one bonded now, if any) receives `source()` through `setAuthToken`. That is
+what carries a restored session's token into a client the auth setup ran
+before — the setup does not need to hold a client reference at all.
+
+```typescript
+function setAuthTokenSource(source: (() => string | null | undefined) | null): void
+```
+
+- `source` — Returns the current access token (null when signed out), or `null` to clear.
+
 #### `setClient(client)`
 
 Registers an HTTP client as the active singleton.
 
+A registered `setAuthTokenSource` token source is applied to the client
+here, so a client bonded after the auth setup still carries the restored
+session's token.
+
 ```typescript
 function setClient(client: HttpClient): void
 ```
@@ -537,8 +572,8 @@ function setClient(client: HttpClient): void
 
 #### `getClient()`
 
-Retrieves the bonded HTTP client. If none is bonded, automatically
-creates a default fetch-based client.
+Retrieves the bonded HTTP client. If none is bonded, returns a module-level
+fetch-based fallback — it is NOT bonded.
 
 The fallback has NO `baseURL` — a core cannot know an app's API prefix. A relative
 call then resolves against the page origin, where a dev server answers its own HTML
@@ -546,11 +581,15 @@ shell with a 200. It warns once so the misconfiguration is named instead of show
 as a crash three components later; a scaffold bonds the shared client with its API
 prefix, so the fallback only runs in an app that never bonded one.
 
+Returning it WITHOUT bonding is what keeps a later `setClient()` authoritative: a
+caller that captured this fallback early does not make it the app's client, so the
+scaffold's client (and its token source) still takes effect for every later call.
+
 ```typescript
 function getClient(): HttpClient
 ```
 
-**Returns:** The active HTTP client instance.
+**Returns:** The active HTTP client, or the unbonded fallback when none is bonded.
 
 #### `get(url, config)`
 
@@ -702,13 +741,15 @@ authScheme })` from `@molecule/app-bonds-default-react` (or an auth client built
 `createDefaultAuthClientWithHttpSync`, which mirrors the token into the bonded client), because
 `setAuthGate` alone sends no `Authorization` header.
 
-**A request the gate itself depends on must opt out of it: pass `skipAuthGate: true`.** A gate
-that waits for a session restore whose own request goes through this client waits on itself —
-that request is held by the gate waiting for it, so the restore never settles and every request
-the gate holds stalls until it times out (3 s). The request that restores the session for a gate
-you registered yourself is therefore written
-`http.get(currentUserEndpoint, { skipAuthGate: true })`; `@molecule/app-auth`'s own restore does
-not need it (it calls `fetch`, not this client).
+**The gate never holds its own restore's request.** A request the settle function issues
+while it runs (its call reaches this client before the function awaits anything) is part of
+the restore it is waiting for, so it goes out immediately — `setAuthGate(() =>
+restoreSession())` does not deadlock even when `restoreSession` uses this client. A restore
+that awaits something else first and only then calls the client reaches it after that
+window, and that request must opt out of the gate: `http.get(currentUserEndpoint, {
+skipAuthGate: true })`. Without the opt-out the gate waits on itself, the restore never
+settles, and every request the gate holds stalls until it times out (3 s).
+`@molecule/app-auth`'s own restore does not need it (it calls `fetch`, not this client).
 
 ## Translations
 

package/dist/auth-gate.d.ts

@@ -27,24 +27,28 @@
  * `setupHttpDefault()`), and a gate installed on the throwaway client the auth
  * bond saw would be silently lost.
  *
- * ## A request the gate is waiting for must opt out
- *
- * `awaitAuthGate` holds every request while the gate is pending — including one the gate
- * itself depends on. A gate that waits for a session restore whose own request goes through
- * the SAME client waits on itself: the restore's `GET /users/me` is held by the gate, the
- * restore's promise cannot settle, and nothing but the timeout releases anything (X1
- * xr-molecule-flash-m97 lost ~4 min to exactly this — an app registering
- * `setAuthGate(() => whenSettled())` over a restore that fetched through its own client, with
- * every request stalling the full bound and only a console warning to show for it). So a
- * request the gate's restore makes must pass `skipAuthGate: true`
- * (`RequestConfig.skipAuthGate`).
- *
- * Which held request is the gate's own is NOT detectable here: the gate is arbitrary code
- * returning a promise, so a request cannot be attributed to the async chain that awaits it —
- * and browsers have no async-context API (`AsyncContext` is not shipped) to ask. Releasing
- * requests merely because the gate is pending and they carry no token would drop exactly the
- * first-paint requests the gate exists to hold. The opt-out is therefore the fix, and a
- * timeout with requests held is reported as an error naming it.
+ * ## The gate's own restore requests are never held
+ *
+ * `awaitAuthGate` holds every request while the gate is pending — except the ones the gate's
+ * settle function issues itself. Those are part of the restore it is waiting for; holding them
+ * makes the gate wait on itself, and nothing but the timeout releases anything (X1
+ * xr-molecule-flash-m97 and xr-molecule-flash-m173 both lost minutes to this: an app
+ * registering `setAuthGate(() => restoreSession())` over a restore that fetched through the
+ * same client, every page held for the full bound, and 917 `GET /api/user` requests named by
+ * one console line). So `setAuthGate(() => restoreSession())` works as written when
+ * `restoreSession` calls the gated client.
+ *
+ * "Issued by the gate" means issued while the settle function is running: this package's
+ * fetch client awaits the gate before anything else, so a restore's call is made in the settle
+ * function's own synchronous execution. A restore that awaits something else first (a storage
+ * read, a `Promise.resolve()`) and only then calls the client issues its request from a later
+ * continuation, which nothing can attribute to the gate — browsers ship no async-context API
+ * (`AsyncContext`/`AsyncLocalStorage`) to ask, and releasing requests merely because the gate is
+ * pending would drop exactly the first-paint requests the gate exists to hold (m95). A provider
+ * whose request pipeline awaits the gate in a scheduled interceptor (the Axios bond) reaches it
+ * a microtask after the settle function returns, outside the window, for the same reason. Such a
+ * request must pass `skipAuthGate: true` (`RequestConfig.skipAuthGate`), and a timeout with
+ * requests held is reported at error level naming it.
  *
  * @module
  */
@@ -58,10 +62,20 @@ import type { AuthGateRequest } from './types.js';
  * immediately when no restore is in flight, so registering it never makes a
  * request wait longer than the restore it was about to race anyway.
  *
- * A gate whose restore sends its OWN request through the gated client deadlocks — the
- * gate holds the request it is waiting for. That request must pass `skipAuthGate: true`
- * (see `RequestConfig.skipAuthGate`); `@molecule/app-auth`'s own restore does not
- * need it because it uses `fetch` rather than the bonded client.
+ * Waiting for the restore does NOT attach its token: a separately created HTTP
+ * client needs `createDefaultHttpClientWithAuthBearer({ baseURL,
+ * getToken: () => authClient.getAccessToken(), authScheme })` from
+ * `@molecule/app-bonds-default-react` (or the auth client built with
+ * `createDefaultAuthClientWithHttpSync`, which mirrors the token into the
+ * bonded client) plus `setAuthGate(() => authClient.whenRestored())`.
+ *
+ * The restore's own requests are never held: a request the settle function issues while it
+ * runs goes out immediately, so `setAuthGate(() => restoreSession())` cannot deadlock even
+ * when `restoreSession` calls the gated client. A restore that awaits something else first
+ * (a storage read, a `Promise.resolve()`) issues its request from a later continuation, which
+ * the gate cannot recognize — that request needs `skipAuthGate: true` (see
+ * `RequestConfig.skipAuthGate`). `@molecule/app-auth`'s own restore needs neither because it
+ * uses `fetch` rather than the bonded client.
  *
  * @param next - The gate, or `null` to clear a previously registered one.
  *

package/dist/auth-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-gate.d.ts","sourceRoot":"","sources":["../src/auth-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AA6CjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAG,IAGhE,CAAA;AA6BD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,GAAU,UAAU,eAAe,KAAG,OAAO,CAAC,IAAI,CAuC3E,CAAA"}
+{"version":3,"file":"auth-gate.d.ts","sourceRoot":"","sources":["../src/auth-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAkEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAG,IAIhE,CAAA;AA8ED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,GAAU,UAAU,eAAe,KAAG,OAAO,CAAC,IAAI,CAwC3E,CAAA"}

package/dist/auth-gate.js

@@ -27,24 +27,28 @@
  * `setupHttpDefault()`), and a gate installed on the throwaway client the auth
  * bond saw would be silently lost.
  *
- * ## A request the gate is waiting for must opt out
- *
- * `awaitAuthGate` holds every request while the gate is pending — including one the gate
- * itself depends on. A gate that waits for a session restore whose own request goes through
- * the SAME client waits on itself: the restore's `GET /users/me` is held by the gate, the
- * restore's promise cannot settle, and nothing but the timeout releases anything (X1
- * xr-molecule-flash-m97 lost ~4 min to exactly this — an app registering
- * `setAuthGate(() => whenSettled())` over a restore that fetched through its own client, with
- * every request stalling the full bound and only a console warning to show for it). So a
- * request the gate's restore makes must pass `skipAuthGate: true`
- * (`RequestConfig.skipAuthGate`).
- *
- * Which held request is the gate's own is NOT detectable here: the gate is arbitrary code
- * returning a promise, so a request cannot be attributed to the async chain that awaits it —
- * and browsers have no async-context API (`AsyncContext` is not shipped) to ask. Releasing
- * requests merely because the gate is pending and they carry no token would drop exactly the
- * first-paint requests the gate exists to hold. The opt-out is therefore the fix, and a
- * timeout with requests held is reported as an error naming it.
+ * ## The gate's own restore requests are never held
+ *
+ * `awaitAuthGate` holds every request while the gate is pending — except the ones the gate's
+ * settle function issues itself. Those are part of the restore it is waiting for; holding them
+ * makes the gate wait on itself, and nothing but the timeout releases anything (X1
+ * xr-molecule-flash-m97 and xr-molecule-flash-m173 both lost minutes to this: an app
+ * registering `setAuthGate(() => restoreSession())` over a restore that fetched through the
+ * same client, every page held for the full bound, and 917 `GET /api/user` requests named by
+ * one console line). So `setAuthGate(() => restoreSession())` works as written when
+ * `restoreSession` calls the gated client.
+ *
+ * "Issued by the gate" means issued while the settle function is running: this package's
+ * fetch client awaits the gate before anything else, so a restore's call is made in the settle
+ * function's own synchronous execution. A restore that awaits something else first (a storage
+ * read, a `Promise.resolve()`) and only then calls the client issues its request from a later
+ * continuation, which nothing can attribute to the gate — browsers ship no async-context API
+ * (`AsyncContext`/`AsyncLocalStorage`) to ask, and releasing requests merely because the gate is
+ * pending would drop exactly the first-paint requests the gate exists to hold (m95). A provider
+ * whose request pipeline awaits the gate in a scheduled interceptor (the Axios bond) reaches it
+ * a microtask after the settle function returns, outside the window, for the same reason. Such a
+ * request must pass `skipAuthGate: true` (`RequestConfig.skipAuthGate`), and a timeout with
+ * requests held is reported at error level naming it.
  *
  * @module
  */
@@ -66,6 +70,25 @@ const heldRequests = new Map();
  * gates. Cleared when the same gate later releases a request normally.
  */
 let reportedStall = null;
+/**
+ * The settle-function invocation requests are currently waiting on, shared by every request
+ * that arrives while the gate is pending.
+ *
+ * Without it each held request re-invokes the gate, and a gate that issues a request on every
+ * call floods the network: the m97 shape measured 855 `fetch` calls for one page (`task-auth-
+ * gate-deadlock.report.md`). `null` when no invocation is in flight; `setAuthGate` clears it
+ * so a re-registered gate is never shared with the old one's waiters.
+ */
+let inFlightGate = null;
+/**
+ * True only while the gate's settle function is executing synchronously.
+ *
+ * A request that reaches `awaitAuthGate` in this window was issued BY the restore — the fetch
+ * client's `request()` awaits the gate before anything else, so the call is made in the settle
+ * function's own execution. Holding it would make the gate wait on itself (see the module
+ * doc); requests issued after the function awaits something else are held as usual.
+ */
+let gateSettling = false;
 /**
  * How long a request may be held by the gate before it is sent anyway.
  *
@@ -96,10 +119,20 @@ const GATE_TIMEOUT_MS = 3_000;
  * immediately when no restore is in flight, so registering it never makes a
  * request wait longer than the restore it was about to race anyway.
  *
- * A gate whose restore sends its OWN request through the gated client deadlocks — the
- * gate holds the request it is waiting for. That request must pass `skipAuthGate: true`
- * (see `RequestConfig.skipAuthGate`); `@molecule/app-auth`'s own restore does not
- * need it because it uses `fetch` rather than the bonded client.
+ * Waiting for the restore does NOT attach its token: a separately created HTTP
+ * client needs `createDefaultHttpClientWithAuthBearer({ baseURL,
+ * getToken: () => authClient.getAccessToken(), authScheme })` from
+ * `@molecule/app-bonds-default-react` (or the auth client built with
+ * `createDefaultAuthClientWithHttpSync`, which mirrors the token into the
+ * bonded client) plus `setAuthGate(() => authClient.whenRestored())`.
+ *
+ * The restore's own requests are never held: a request the settle function issues while it
+ * runs goes out immediately, so `setAuthGate(() => restoreSession())` cannot deadlock even
+ * when `restoreSession` calls the gated client. A restore that awaits something else first
+ * (a storage read, a `Promise.resolve()`) issues its request from a later continuation, which
+ * the gate cannot recognize — that request needs `skipAuthGate: true` (see
+ * `RequestConfig.skipAuthGate`). `@molecule/app-auth`'s own restore needs neither because it
+ * uses `fetch` rather than the bonded client.
  *
  * @param next - The gate, or `null` to clear a previously registered one.
  *
@@ -112,6 +145,7 @@ const GATE_TIMEOUT_MS = 3_000;
  */
 export const setAuthGate = (next) => {
     gate = next;
+    inFlightGate = null;
     reportedStall = null;
 };
 /**
@@ -121,21 +155,69 @@ export const setAuthGate = (next) => {
 const describeRequest = (request) => request?.method || request?.url
     ? `${request?.method ?? 'GET'} ${request?.url ?? ''}`.trim()
     : 'a request';
+/**
+ * How many held request names the stalled-gate report prints before summarizing the rest.
+ *
+ * The report is console output, and every reader of it truncates: molecule-dev's route walk
+ * keeps the first 200 characters of a console error, so the sentence naming the fix has to
+ * come first — and the request list is capped so the message stays readable when a deadlocked
+ * gate has held hundreds of requests (xr-molecule-flash-m173: 917 `GET /api/user`).
+ */
+const MAX_NAMED_HELD_REQUESTS = 5;
 /**
  * Reports a gate that timed out while holding requests: once per stuck gate, at error level
  * so it reaches the page's error console and any error transport — a console warning on a
  * deployed URL reads as "the site is slow", which is what the gate itself was added for.
+ *
+ * Leads with the cause and the fix, then names at most `MAX_NAMED_HELD_REQUESTS` distinct
+ * requests and counts the rest: an unbounded join buried the fix clause behind 900 names in
+ * xr-molecule-flash-m173, and no reader of the line ever reached it.
  */
 const reportStalledGate = (stuck) => {
     if (reportedStall === stuck)
         return;
     reportedStall = stuck;
-    const held = [...heldRequests.values()].join(', ');
-    logger.error(`The auth gate has not settled after ${GATE_TIMEOUT_MS}ms and ${heldRequests.size} request(s) ` +
-        `were held by it (${held}); sending them without waiting. If the gate waits for a session ` +
-        `restore that makes its own request through this HTTP client, that request is being held by ` +
-        `the gate waiting for it: send it with \`skipAuthGate: true\`, or clear the gate with ` +
-        `\`setAuthGate(null)\` if nothing restores a session.`);
+    const names = [...new Set(heldRequests.values())];
+    const shown = names.slice(0, MAX_NAMED_HELD_REQUESTS);
+    const more = heldRequests.size - shown.length;
+    logger.error(`The auth gate is waiting on itself: its restore's request is held by it. Send that ` +
+        `request with \`skipAuthGate: true\`, or clear the gate with \`setAuthGate(null)\` if ` +
+        `nothing restores a session. Held ${heldRequests.size} request(s) for ` +
+        `${GATE_TIMEOUT_MS}ms${shown.length ? `: ${shown.join(', ')}` : ''}` +
+        `${more > 0 ? ` (and ${more} more)` : ''}.`);
+};
+/**
+ * Starts the gate's settle function — once, shared by every request that arrives while it is
+ * pending — turning a rejection (or a synchronous throw) into a logged warning so a failed
+ * restore releases its waiters instead of rejecting them.
+ *
+ * `gateSettling` is true only for the function's synchronous execution: the IIFE runs
+ * `current()` up to its first `await` before this call returns, and any request the restore
+ * issues there (the gated client's `request()` awaits the gate before anything else) bypasses
+ * the gate instead of waiting on the invocation it belongs to.
+ */
+const invokeGate = (current) => {
+    if (inFlightGate)
+        return inFlightGate;
+    let invocation;
+    gateSettling = true;
+    try {
+        invocation = (async () => current())();
+    }
+    finally {
+        gateSettling = false;
+    }
+    const shared = invocation.catch((error) => {
+        logger.warn('The auth gate rejected; sending the request without waiting for it', {
+            error,
+        });
+    });
+    inFlightGate = shared;
+    void shared.then(() => {
+        if (inFlightGate === shared)
+            inFlightGate = null;
+    });
+    return shared;
 };
 /**
  * Awaits the registered gate, if any. Every HTTP provider calls this before it
@@ -160,19 +242,20 @@ export const awaitAuthGate = async (request) => {
     const current = gate;
     if (!current)
         return;
+    // Issued while the gate's settle function is running: part of the restore it is settling,
+    // never held by it. See `invokeGate` and the module doc.
+    if (gateSettling)
+        return;
     const token = Symbol('held-request');
     heldRequests.set(token, describeRequest(request));
     let timer;
     let timedOut = false;
     try {
         await Promise.race([
-            // `(async () => current())()` also turns a gate that throws SYNCHRONOUSLY into a rejection:
-            // a gate is someone else's code, and no shape of it may reject the request it was holding.
-            (async () => current())().catch((error) => {
-                logger.warn('The auth gate rejected; sending the request without waiting for it', {
-                    error,
-                });
-            }),
+            // One invocation, shared: `invokeGate` also turns a gate that throws SYNCHRONOUSLY into
+            // a rejection — a gate is someone else's code, and no shape of it may reject the
+            // request it was holding.
+            invokeGate(current),
             new Promise((resolve) => {
                 timer = setTimeout(() => {
                     timedOut = true;

package/dist/auth-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-gate.js","sourceRoot":"","sources":["../src/auth-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAIhD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;AAEhC,iFAAiF;AACjF,IAAI,IAAI,GAAiC,IAAI,CAAA;AAE7C;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE9C;;;;;;;GAOG;AACH,IAAI,aAAa,GAAiC,IAAI,CAAA;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAkC,EAAQ,EAAE;IACtE,IAAI,GAAG,IAAI,CAAA;IACX,aAAa,GAAG,IAAI,CAAA;AACtB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,OAAyB,EAAU,EAAE,CAC5D,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,GAAG;IAC7B,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;IAC5D,CAAC,CAAC,WAAW,CAAA;AAEjB;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,KAA0B,EAAQ,EAAE;IAC7D,IAAI,aAAa,KAAK,KAAK;QAAE,OAAM;IACnC,aAAa,GAAG,KAAK,CAAA;IACrB,MAAM,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClD,MAAM,CAAC,KAAK,CACV,uCAAuC,eAAe,UAAU,YAAY,CAAC,IAAI,cAAc;QAC7F,oBAAoB,IAAI,mEAAmE;QAC3F,6FAA6F;QAC7F,uFAAuF;QACvF,sDAAsD,CACzD,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAyB,EAAiB,EAAE;IAC9E,wFAAwF;IACxF,gDAAgD;IAChD,IAAI,OAAO,EAAE,YAAY;QAAE,OAAM;IAEjC,MAAM,OAAO,GAAG,IAAI,CAAA;IACpB,IAAI,CAAC,OAAO;QAAE,OAAM;IAEpB,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAA;IACpC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;IAEjD,IAAI,KAAgD,CAAA;IACpD,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,4FAA4F;YAC5F,2FAA2F;YAC3F,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxC,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;oBAChF,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC,CAAC;YACF,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,QAAQ,GAAG,IAAI,CAAA;oBACf,mFAAmF;oBACnF,iBAAiB,CAAC,OAAO,CAAC,CAAA;oBAC1B,OAAO,EAAE,CAAA;gBACX,CAAC,EAAE,eAAe,CAAC,CAAA;YACrB,CAAC,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAC9B,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;IAED,yFAAyF;IACzF,8EAA8E;IAC9E,IAAI,CAAC,QAAQ,IAAI,aAAa,KAAK,OAAO;QAAE,aAAa,GAAG,IAAI,CAAA;AAClE,CAAC,CAAA"}
+{"version":3,"file":"auth-gate.js","sourceRoot":"","sources":["../src/auth-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAIhD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;AAEhC,iFAAiF;AACjF,IAAI,IAAI,GAAiC,IAAI,CAAA;AAE7C;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE9C;;;;;;;GAOG;AACH,IAAI,aAAa,GAAiC,IAAI,CAAA;AAEtD;;;;;;;;GAQG;AACH,IAAI,YAAY,GAAyB,IAAI,CAAA;AAE7C;;;;;;;GAOG;AACH,IAAI,YAAY,GAAG,KAAK,CAAA;AAExB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAkC,EAAQ,EAAE;IACtE,IAAI,GAAG,IAAI,CAAA;IACX,YAAY,GAAG,IAAI,CAAA;IACnB,aAAa,GAAG,IAAI,CAAA;AACtB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,OAAyB,EAAU,EAAE,CAC5D,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,GAAG;IAC7B,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;IAC5D,CAAC,CAAC,WAAW,CAAA;AAEjB;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAEjC;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,CAAC,KAA0B,EAAQ,EAAE;IAC7D,IAAI,aAAa,KAAK,KAAK;QAAE,OAAM;IACnC,aAAa,GAAG,KAAK,CAAA;IACrB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAA;IACrD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAA;IAC7C,MAAM,CAAC,KAAK,CACV,qFAAqF;QACnF,uFAAuF;QACvF,oCAAoC,YAAY,CAAC,IAAI,kBAAkB;QACvE,GAAG,eAAe,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QACpE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAC9C,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG,CAAC,OAA4B,EAAiB,EAAE;IACjE,IAAI,YAAY;QAAE,OAAO,YAAY,CAAA;IAErC,IAAI,UAAyB,CAAA;IAC7B,YAAY,GAAG,IAAI,CAAA;IACnB,IAAI,CAAC;QACH,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAA;IACxC,CAAC;YAAS,CAAC;QACT,YAAY,GAAG,KAAK,CAAA;IACtB,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;YAChF,KAAK;SACN,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,YAAY,GAAG,MAAM,CAAA;IACrB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACpB,IAAI,YAAY,KAAK,MAAM;YAAE,YAAY,GAAG,IAAI,CAAA;IAClD,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAyB,EAAiB,EAAE;IAC9E,wFAAwF;IACxF,gDAAgD;IAChD,IAAI,OAAO,EAAE,YAAY;QAAE,OAAM;IAEjC,MAAM,OAAO,GAAG,IAAI,CAAA;IACpB,IAAI,CAAC,OAAO;QAAE,OAAM;IAEpB,0FAA0F;IAC1F,yDAAyD;IACzD,IAAI,YAAY;QAAE,OAAM;IAExB,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAA;IACpC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;IAEjD,IAAI,KAAgD,CAAA;IACpD,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,wFAAwF;YACxF,iFAAiF;YACjF,0BAA0B;YAC1B,UAAU,CAAC,OAAO,CAAC;YACnB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,QAAQ,GAAG,IAAI,CAAA;oBACf,mFAAmF;oBACnF,iBAAiB,CAAC,OAAO,CAAC,CAAA;oBAC1B,OAAO,EAAE,CAAA;gBACX,CAAC,EAAE,eAAe,CAAC,CAAA;YACrB,CAAC,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAC9B,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;IAED,yFAAyF;IACzF,8EAA8E;IAC9E,IAAI,CAAC,QAAQ,IAAI,aAAa,KAAK,OAAO;QAAE,aAAa,GAAG,IAAI,CAAA;AAClE,CAAC,CAAA"}

package/dist/index.d.ts

@@ -78,13 +78,15 @@
  * `createDefaultAuthClientWithHttpSync`, which mirrors the token into the bonded client), because
  * `setAuthGate` alone sends no `Authorization` header.
  *
- * **A request the gate itself depends on must opt out of it: pass `skipAuthGate: true`.** A gate
- * that waits for a session restore whose own request goes through this client waits on itself —
- * that request is held by the gate waiting for it, so the restore never settles and every request
- * the gate holds stalls until it times out (3 s). The request that restores the session for a gate
- * you registered yourself is therefore written
- * `http.get(currentUserEndpoint, { skipAuthGate: true })`; `@molecule/app-auth`'s own restore does
- * not need it (it calls `fetch`, not this client).
+ * **The gate never holds its own restore's request.** A request the settle function issues
+ * while it runs (its call reaches this client before the function awaits anything) is part of
+ * the restore it is waiting for, so it goes out immediately — `setAuthGate(() =>
+ * restoreSession())` does not deadlock even when `restoreSession` uses this client. A restore
+ * that awaits something else first and only then calls the client reaches it after that
+ * window, and that request must opt out of the gate: `http.get(currentUserEndpoint, {
+ * skipAuthGate: true })`. Without the opt-out the gate waits on itself, the restore never
+ * settles, and every request the gate holds stalls until it times out (3 s).
+ * `@molecule/app-auth`'s own restore does not need it (it calls `fetch`, not this client).
  *
  * @module
  */

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAEH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AAEH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA"}

package/dist/index.js

@@ -78,13 +78,15 @@
  * `createDefaultAuthClientWithHttpSync`, which mirrors the token into the bonded client), because
  * `setAuthGate` alone sends no `Authorization` header.
  *
- * **A request the gate itself depends on must opt out of it: pass `skipAuthGate: true`.** A gate
- * that waits for a session restore whose own request goes through this client waits on itself —
- * that request is held by the gate waiting for it, so the restore never settles and every request
- * the gate holds stalls until it times out (3 s). The request that restores the session for a gate
- * you registered yourself is therefore written
- * `http.get(currentUserEndpoint, { skipAuthGate: true })`; `@molecule/app-auth`'s own restore does
- * not need it (it calls `fetch`, not this client).
+ * **The gate never holds its own restore's request.** A request the settle function issues
+ * while it runs (its call reaches this client before the function awaits anything) is part of
+ * the restore it is waiting for, so it goes out immediately — `setAuthGate(() =>
+ * restoreSession())` does not deadlock even when `restoreSession` uses this client. A restore
+ * that awaits something else first and only then calls the client reaches it after that
+ * window, and that request must opt out of the gate: `http.get(currentUserEndpoint, {
+ * skipAuthGate: true })`. Without the opt-out the gate waits on itself, the restore never
+ * settles, and every request the gate holds stalls until it times out (3 s).
+ * `@molecule/app-auth`'s own restore does not need it (it calls `fetch`, not this client).
  *
  * @module
  */

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAEH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AAEH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA"}

package/dist/types.d.ts

@@ -30,11 +30,15 @@ export interface RequestConfig {
     /**
      * Send this request WITHOUT waiting for the session restore (the auth gate).
      *
-     * A request the gate itself depends on must set this. A gate registered with
-     * `setAuthGate` that waits for a session restore whose own request goes through this
-     * client otherwise waits on itself: the gate holds the restore's request, the restore's
-     * promise never settles, and every request on the page stalls until the gate times out —
-     * so pass `skipAuthGate: true` on the restore's own request:
+     * A request the gate's restore issues from a LATER continuation must set this. The gate
+     * recognizes a request the settle function issues while it runs and never holds it — this
+     * package's client awaits the gate before anything else, so a `restoreSession()` that calls
+     * it directly does not deadlock. But a restore that awaits something else first
+     * (`await storage.get()`), then calls the client, reaches `awaitAuthGate` after that window:
+     * the gate then waits on itself, and every request on the page stalls until the gate times
+     * out (3 s) — so pass `skipAuthGate: true` on that request. A provider that awaits the gate
+     * inside a scheduled interceptor (the Axios bond) also reaches it after the window, so its
+     * restore's request needs the opt-out.
      *
      * ```typescript
      * // the request the gate's restore makes, through the same client the gate holds back
@@ -43,7 +47,8 @@ export interface RequestConfig {
      *
      * `@molecule/app-auth`'s own restore does not need it — it sends its request with
      * `fetch`, not through this client. An app with its own session store that registers a
-     * gate with `setAuthGate` does.
+     * gate with `setAuthGate` does not need it either when its restore calls the client
+     * directly.
      */
     skipAuthGate?: boolean;
     /**

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;AAEzF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEhC;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAA;IAE9D;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IAEzB;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,aAAa,CAAA;IAEvD;;OAEG;IACH,MAAM,CAAC,EAAE,WAAW,CAAA;IAEpB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IAEd;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD;;OAEG;IACH,MAAM,EAAE,UAAU,CAAA;IAElB;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IAEX;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC;;OAEG;IACH,IAAI,EAAE,CAAC,CAAA;IAEP;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAA;IAElB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE/B;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAA;CAC1B;AAED;;GAEG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAGzB,MAAM,EAAE,MAAM;IACd,QAAQ,CAAC,EAAE,YAAY;IACvB,MAAM,CAAC,EAAE,iBAAiB;IAC1B,QAAQ,CAAC,EAAE,MAAM;gBAJxB,OAAO,EAAE,MAAM,EACR,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,YAAY,YAAA,EACvB,MAAM,CAAC,EAAE,iBAAiB,YAAA,EAC1B,QAAQ,CAAC,EAAE,MAAM,YAAA;CAK3B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;AAEzF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEhC;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAA;IAE9D;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IAEzB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,aAAa,CAAA;IAEvD;;OAEG;IACH,MAAM,CAAC,EAAE,WAAW,CAAA;IAEpB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IAEd;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD;;OAEG;IACH,MAAM,EAAE,UAAU,CAAA;IAElB;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IAEX;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC;;OAEG;IACH,IAAI,EAAE,CAAC,CAAA;IAEP;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAA;IAElB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE/B;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAA;CAC1B;AAED;;GAEG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAGzB,MAAM,EAAE,MAAM;IACd,QAAQ,CAAC,EAAE,YAAY;IACvB,MAAM,CAAC,EAAE,iBAAiB;IAC1B,QAAQ,CAAC,EAAE,MAAM;gBAJxB,OAAO,EAAE,MAAM,EACR,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,YAAY,YAAA,EACvB,MAAM,CAAC,EAAE,iBAAiB,YAAA,EAC1B,QAAQ,CAAC,EAAE,MAAM,YAAA;CAK3B"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwJH;;GAEG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGzB;IACA;IACA;IACA;IALT,YACE,OAAe,EACR,MAAc,EACd,QAAuB,EACvB,MAA0B,EAC1B,QAAiB;QAExB,KAAK,CAAC,OAAO,CAAC,CAAA;QALP,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAe;QACvB,WAAM,GAAN,MAAM,CAAoB;QAC1B,aAAQ,GAAR,QAAQ,CAAS;QAGxB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAA;IACzB,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA6JH;;GAEG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGzB;IACA;IACA;IACA;IALT,YACE,OAAe,EACR,MAAc,EACd,QAAuB,EACvB,MAA0B,EAC1B,QAAiB;QAExB,KAAK,CAAC,OAAO,CAAC,CAAA;QALP,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAe;QACvB,WAAM,GAAN,MAAM,CAAoB;QAC1B,aAAQ,GAAR,QAAQ,CAAS;QAGxB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAA;IACzB,CAAC;CACF"}

package/dist/utilities.d.ts

@@ -1,17 +1,39 @@
 /**
  * HTTP bond accessor and convenience request functions.
  *
- * If no custom client is bonded, a fetch-based client is auto-created
- * on first access. Provides `get`, `post`, `put`, `patch`, and `del`
- * shorthand functions that delegate to the bonded client.
+ * If no custom client is bonded, a fetch-based client is returned — it is NOT
+ * bonded, so a client bonded later is what every subsequent call sees.
+ * Provides `get`, `post`, `put`, `patch`, and `del` shorthand functions that
+ * delegate to the bonded client.
  *
  * @module
  */
 import type { HttpClient } from './client.js';
 import type { HttpResponse, RequestConfig } from './types.js';
+/**
+ * Registers the token source a newly bonded client is hydrated from, or clears
+ * it with `null`.
+ *
+ * The source is read once per bond: the client bonded AFTER this call (and the
+ * one bonded now, if any) receives `source()` through `setAuthToken`. That is
+ * what carries a restored session's token into a client the auth setup ran
+ * before — the setup does not need to hold a client reference at all.
+ *
+ * @param source - Returns the current access token (null when signed out), or `null` to clear.
+ *
+ * @example
+ * ```typescript
+ * setAuthTokenSource(() => authClient.getAccessToken())
+ * ```
+ */
+export declare const setAuthTokenSource: (source: (() => string | null | undefined) | null) => void;
 /**
  * Registers an HTTP client as the active singleton.
  *
+ * A registered `setAuthTokenSource` token source is applied to the client
+ * here, so a client bonded after the auth setup still carries the restored
+ * session's token.
+ *
  * @param client - The HTTP client implementation to bond.
  *
  * @example
@@ -22,8 +44,8 @@ import type { HttpResponse, RequestConfig } from './types.js';
  */
 export declare const setClient: (client: HttpClient) => void;
 /**
- * Retrieves the bonded HTTP client. If none is bonded, automatically
- * creates a default fetch-based client.
+ * Retrieves the bonded HTTP client. If none is bonded, returns a module-level
+ * fetch-based fallback — it is NOT bonded.
  *
  * The fallback has NO `baseURL` — a core cannot know an app's API prefix. A relative
  * call then resolves against the page origin, where a dev server answers its own HTML
@@ -31,7 +53,11 @@ export declare const setClient: (client: HttpClient) => void;
  * as a crash three components later; a scaffold bonds the shared client with its API
  * prefix, so the fallback only runs in an app that never bonded one.
  *
- * @returns The active HTTP client instance.
+ * Returning it WITHOUT bonding is what keeps a later `setClient()` authoritative: a
+ * caller that captured this fallback early does not make it the app's client, so the
+ * scaffold's client (and its token source) still takes effect for every later call.
+ *
+ * @returns The active HTTP client, or the unbonded fallback when none is bonded.
  */
 export declare const getClient: () => HttpClient;
 /**

package/dist/utilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAO7D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,GAAI,QAAQ,UAAU,KAAG,IAE9C,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,QAAO,UAa5B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAC7D,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,GAAG,OAAO,EAC9B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA2C,CAAA;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAC7B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA0C,CAAA;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,KAAK,GAAI,CAAC,GAAG,OAAO,EAC/B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA4C,CAAA;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAC1D,CAAA;AAEpC;;;GAGG;AACH,eAAO,MAAM,WAAW,mBAA4D,CAAA"}
+{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AA6B7D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,CAAC,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,IAAI,KAAG,IAIrF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,GAAI,QAAQ,UAAU,KAAG,IAG9C,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,QAAO,UAY5B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAC7D,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,GAAG,OAAO,EAC9B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA2C,CAAA;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAC7B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA0C,CAAA;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,KAAK,GAAI,CAAC,GAAG,OAAO,EAC/B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA4C,CAAA;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAC1D,CAAA;AAEpC;;;GAGG;AACH,eAAO,MAAM,WAAW,mBAA4D,CAAA"}

package/dist/utilities.js

@@ -1,9 +1,10 @@
 /**
  * HTTP bond accessor and convenience request functions.
  *
- * If no custom client is bonded, a fetch-based client is auto-created
- * on first access. Provides `get`, `post`, `put`, `patch`, and `del`
- * shorthand functions that delegate to the bonded client.
+ * If no custom client is bonded, a fetch-based client is returned — it is NOT
+ * bonded, so a client bonded later is what every subsequent call sees.
+ * Provides `get`, `post`, `put`, `patch`, and `del` shorthand functions that
+ * delegate to the bonded client.
  *
  * @module
  */
@@ -13,9 +14,55 @@ import { createFetchClient } from './provider.js';
 const BOND_TYPE = 'http-client';
 /** One warning per page load is enough to name a missing bond. */
 let warnedAboutFallback = false;
+/**
+ * The client `getClient()` returns while nothing is bonded.
+ *
+ * Module-level and deliberately NEVER bonded: bonding it made the fallback the
+ * page's shared client, so a caller that read `getClient()` before
+ * `setClient()` captured a no-baseURL client that every later `setClient()`
+ * could not reach — the app's real client was bonded and the caller's token
+ * sync kept writing into the orphan, so every request went out bare
+ * (xr-molecule-flash-m156, 401 `token is missing` after a reload).
+ */
+let unbondedFallback = null;
+/**
+ * The auth client whose token every HTTP client starts with, or null.
+ *
+ * `setClient` applies it at bond time, which is the only moment that can reach a
+ * client created AFTER the auth setup ran — the scaffold wires auth before http,
+ * so the auth bond's initial token had no client to land on
+ * (`createDefaultAuthClientWithHttpSync` in `@molecule/app-bonds-default-react`).
+ */
+let authTokenSource = null;
+/**
+ * Registers the token source a newly bonded client is hydrated from, or clears
+ * it with `null`.
+ *
+ * The source is read once per bond: the client bonded AFTER this call (and the
+ * one bonded now, if any) receives `source()` through `setAuthToken`. That is
+ * what carries a restored session's token into a client the auth setup ran
+ * before — the setup does not need to hold a client reference at all.
+ *
+ * @param source - Returns the current access token (null when signed out), or `null` to clear.
+ *
+ * @example
+ * ```typescript
+ * setAuthTokenSource(() => authClient.getAccessToken())
+ * ```
+ */
+export const setAuthTokenSource = (source) => {
+    authTokenSource = source;
+    const bonded = bondGet(BOND_TYPE);
+    if (bonded && source)
+        bonded.setAuthToken(source() ?? null);
+};
 /**
  * Registers an HTTP client as the active singleton.
  *
+ * A registered `setAuthTokenSource` token source is applied to the client
+ * here, so a client bonded after the auth setup still carries the restored
+ * session's token.
+ *
  * @param client - The HTTP client implementation to bond.
  *
  * @example
@@ -26,10 +73,12 @@ let warnedAboutFallback = false;
  */
 export const setClient = (client) => {
     bond(BOND_TYPE, client);
+    if (authTokenSource)
+        client.setAuthToken(authTokenSource() ?? null);
 };
 /**
- * Retrieves the bonded HTTP client. If none is bonded, automatically
- * creates a default fetch-based client.
+ * Retrieves the bonded HTTP client. If none is bonded, returns a module-level
+ * fetch-based fallback — it is NOT bonded.
  *
  * The fallback has NO `baseURL` — a core cannot know an app's API prefix. A relative
  * call then resolves against the page origin, where a dev server answers its own HTML
@@ -37,20 +86,24 @@ export const setClient = (client) => {
  * as a crash three components later; a scaffold bonds the shared client with its API
  * prefix, so the fallback only runs in an app that never bonded one.
  *
- * @returns The active HTTP client instance.
+ * Returning it WITHOUT bonding is what keeps a later `setClient()` authoritative: a
+ * caller that captured this fallback early does not make it the app's client, so the
+ * scaffold's client (and its token source) still takes effect for every later call.
+ *
+ * @returns The active HTTP client, or the unbonded fallback when none is bonded.
  */
 export const getClient = () => {
     const existing = bondGet(BOND_TYPE);
     if (existing)
         return existing;
-    const fallback = createFetchClient();
-    bond(BOND_TYPE, fallback);
+    if (!unbondedFallback)
+        unbondedFallback = createFetchClient();
     if (!warnedAboutFallback) {
         warnedAboutFallback = true;
         getLogger('http').warn('@molecule/app-http: no client is bonded — requests go to the page origin with no baseURL. ' +
             "Bond one: setClient(createFetchClient({ baseURL: '/api' })).");
     }
-    return fallback;
+    return unbondedFallback;
 };
 /**
  * Makes a GET request using the bonded HTTP client.

package/dist/utilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"utilities.js","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAGhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAGjD,MAAM,SAAS,GAAG,aAAa,CAAA;AAE/B,kEAAkE;AAClE,IAAI,mBAAmB,GAAG,KAAK,CAAA;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACpD,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;AACzB,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAe,EAAE;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAa,SAAS,CAAC,CAAA;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACzB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,IAAI,CAAA;QAC1B,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CACpB,4FAA4F;YAC1F,8DAA8D,CACjE,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAc,GAAW,EAAE,MAAsB,EAA4B,EAAE,CAChG,SAAS,EAAE,CAAC,GAAG,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAErE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAc,GAAW,EAAE,MAAsB,EAA4B,EAAE,CAChG,SAAS,EAAE,CAAC,MAAM,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA"}
+{"version":3,"file":"utilities.js","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAGhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAGjD,MAAM,SAAS,GAAG,aAAa,CAAA;AAE/B,kEAAkE;AAClE,IAAI,mBAAmB,GAAG,KAAK,CAAA;AAE/B;;;;;;;;;GASG;AACH,IAAI,gBAAgB,GAAsB,IAAI,CAAA;AAE9C;;;;;;;GAOG;AACH,IAAI,eAAe,GAA6C,IAAI,CAAA;AAEpE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAgD,EAAQ,EAAE;IAC3F,eAAe,GAAG,MAAM,CAAA;IACxB,MAAM,MAAM,GAAG,OAAO,CAAa,SAAS,CAAC,CAAA;IAC7C,IAAI,MAAM,IAAI,MAAM;QAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAA;AAC7D,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACpD,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACvB,IAAI,eAAe;QAAE,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,IAAI,CAAC,CAAA;AACrE,CAAC,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAe,EAAE;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAa,SAAS,CAAC,CAAA;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,CAAC,gBAAgB;QAAE,gBAAgB,GAAG,iBAAiB,EAAE,CAAA;IAC7D,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,IAAI,CAAA;QAC1B,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CACpB,4FAA4F;YAC1F,8DAA8D,CACjE,CAAA;IACH,CAAC;IACD,OAAO,gBAAgB,CAAA;AACzB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAc,GAAW,EAAE,MAAsB,EAA4B,EAAE,CAChG,SAAS,EAAE,CAAC,GAAG,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAErE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAc,GAAW,EAAE,MAAsB,EAA4B,EAAE,CAChG,SAAS,EAAE,CAAC,MAAM,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-http",
-  "version": "1.1.6",
+  "version": "1.2.1",
   "description": "Client HTTP interface for molecule.dev",
   "type": "module",
   "main": "dist/index.js",