@molecule/app-http 1.4.0 → 1.5.0

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-10-19T22:40:45.495Z
+Generated: 2026-10-25T20:03:35.125Z
 -->
 
 # @molecule/app-http
@@ -135,14 +135,53 @@ interface HttpClient {
 
   /**
    * Sets the authorization token.
+   *
+   * A static token: every request carries it until the next `setAuthToken` call. A client
+   * that has a {@link HttpClient.setAuthTokenResolver | resolver} (registered through
+   * `@molecule/app-http`'s `setAuthTokenSource`) ignores this value when it assembles a
+   * request — the resolver IS the session, and reading it per request is what keeps a
+   * session adopted without an auth event from sending the previous account's bearer. Once
+   * the resolver is removed, the static token is sent again.
    */
   setAuthToken(token: string | null): void
 
   /**
-   * Returns the current authorization token, or `null` if not set.
+   * Returns the token the client applies to its next request: the resolver's answer when one
+   * is registered, else the static token from `setAuthToken`.
    */
   getAuthToken(): string | null
 
+  /**
+   * Registers the LIVE token resolver every request of this client reads, or clears it with
+   * `null`.
+   *
+   * `@molecule/app-http`'s `setAuthTokenSource()` calls this on every client it bonds, and the
+   * client MUST consult the resolver again each time it assembles a request (and report it from
+   * `getAuthToken()`). A session can change with no auth event and no observable state change —
+   * `authClient.setSession()` with the same profile data, or the OAuth callback's
+   * `setAccessToken()` — so a token pushed only at bond time or on `login`/`logout` events
+   * leaves every later request carrying the PREVIOUS session's bearer while the UI shows the
+   * new one.
+   *
+   * The resolved token takes the static token's place, with the same precedence: an
+   * `Authorization` header passed per request or in the client's default headers wins over it
+   * exactly where it won over a static token in this transport.
+   *
+   * A resolver that returns `null` (or `undefined`) means "this session has no body token": the
+   * request carries no `Authorization` header of the client's own. A cookie-session API issues
+   * no bearer, and the server prefers the header over the fresh cookie, so a kept bearer
+   * authenticates as the prior — possibly deleted — session.
+   *
+   * Optional, so an implementation written against the previous interface still conforms.
+   * `setAuthTokenSource()` follows such a client through a request interceptor instead, pushing
+   * the source with `setAuthToken` before each request: that request carries the change only
+   * when the transport applies its token after running its interceptors, so a transport that
+   * applies it earlier sends a session adopted mid-page from the following request on.
+   *
+   * @param resolver - Returns the current access token (or null/undefined), or `null` to clear.
+   */
+  setAuthTokenResolver?(resolver: AuthTokenResolver | null): void
+
   /**
    * Registers a handler for authentication errors (401).
    *
@@ -159,7 +198,10 @@ HTTP client configuration.
 ```typescript
 interface HttpClientConfig {
   /**
-   * Base URL for all requests.
+   * Base URL for all requests: a path (`/api`) or an absolute URL
+   * (`https://api.example.com/api`). A request path that already starts with the base's
+   * path (`/api/users`) is not prefixed again, and a URL with its own host (`https://…`,
+   * `//cdn…`) is requested as written.
    */
   baseURL?: string
 
@@ -417,6 +459,19 @@ interface HttpResponse<T = unknown> {
 
 ### Types
 
+#### `AuthTokenResolver`
+
+A live access-token resolver: called once per request, it returns the token the session
+holds NOW (`null`/`undefined` when the session carries no body token — a cookie-session API).
+
+`@molecule/app-http`'s `setAuthTokenSource()` installs one on every client it bonds, so the
+app's auth bond decides the bearer and the client resolves it per request instead of holding
+a copy that a session adopted mid-page can leave stale.
+
+```typescript
+type AuthTokenResolver = () => string | null | undefined
+```
+
 #### `RequestInterceptor`
 
 Intercepts outgoing requests to modify headers, URL, or body
@@ -771,27 +826,41 @@ function unwrapSingle(res: unknown): T | null
 
 #### `setAuthTokenSource(source)`
 
-Registers the token source a newly bonded client is hydrated from, or clears
-it with `null`.
+Registers the token source every bonded client reads on EACH request, or removes it with
+`null`.
+
+Every client that receives the source — the one bonded now, any bonded later, and the
+fallback {@link getClient} returns while none is bonded — is hydrated from `source()` and
+reads it again for every request: through {@link HttpClient.setAuthTokenResolver} where the
+client implements it (`createFetchClient`, `@molecule/app-http-axios` from 1.2.0), else
+through a request interceptor that pushes it with `setAuthToken`, which a transport applying
+its token after its interceptors sends on that same request and one applying it before them
+from the next request on. So a restored session reaches a client bonded after the auth setup
+(which holds no client reference), and a session adopted later with no auth event
+(`setSession`, `setAccessToken`) never leaves the previous account's bearer on the wire.
+
+A source that returns `null` means "no body token": the client sends no `Authorization`
+header of its own (see {@link HttpClient.setAuthTokenResolver} for why a kept bearer is a
+bug). A header passed per request or in a client's default headers keeps the precedence that
+client's transport gives it over the client's token.
 
-The source is read once per bond: the client bonded AFTER this call (and the
-one bonded now, if any) receives `source()` through `setAuthToken`. That is
-what carries a restored session's token into a client the auth setup ran
-before — the setup does not need to hold a client reference at all.
+A replaced source is followed from the next request on. Removing it (`null`) leaves the
+bonded client (and the fallback) on the token the source returned at that moment, as a
+static token that `setAuthToken` controls from then on.
 
 ```typescript
-function setAuthTokenSource(source: (() => string | null | undefined) | null): void
+function setAuthTokenSource(source: AuthTokenResolver | null): void
 ```
 
-- `source` — Returns the current access token (null when signed out), or `null` to clear.
+- `source` — Returns the current access token (null when signed out), or `null` to remove it.
 
 #### `setClient(client)`
 
 Registers an HTTP client as the active singleton.
 
 A registered `setAuthTokenSource` token source is applied to the client
-here, so a client bonded after the auth setup still carries the restored
-session's token.
+here, so a client bonded after the auth setup resolves the restored
+session's token on every request it makes.
 
 ```typescript
 function setClient(client: HttpClient): void
@@ -813,6 +882,8 @@ prefix, so the fallback only runs in an app that never bonded one.
 Returning it WITHOUT bonding is what keeps a later `setClient()` authoritative: a
 caller that captured this fallback early does not make it the app's client, so the
 scaffold's client (and its token source) still takes effect for every later call.
+The fallback follows a registered `setAuthTokenSource` source like a bonded client
+does, so an app that bonds no client at all still sends the current session.
 
 ```typescript
 function getClient(): HttpClient
@@ -949,7 +1020,7 @@ Two mistakes that break in preview/production (seen in real imported apps):
 - **`getClient()` itself knows no baseURL.** The fallback client it mints when nothing is
   bonded has `baseURL: ''`, so `getClient().get('/articles')` requests the PAGE origin — in
   dev the Vite server answers its own `index.html` with a 200, and the HTML arrives as
-  `data` (xr-molecule-flash-m126 lost 6.5 minutes to that). A scaffold bonds
+  `data`, and the API then validates none of the fields it was sent. A scaffold bonds
   `'/api'`; an app that builds its own client must pass `{ baseURL }`.
 - **The client is PUBLIC — never put a secret in it.** Anything the browser sends (an API
   key, a service-role / `sk_…` key, a signing secret) is visible to every user. Secrets
@@ -975,8 +1046,11 @@ module registers its own: `setAuthGate(() => session.whenRestored())`.
 Waiting for the restore does NOT attach the token: a client created beside the auth bond needs
 `createDefaultHttpClientWithAuthBearer({ baseURL, getToken: () => authClient.getAccessToken(),
 authScheme })` from `@molecule/app-bonds-default-react` (or an auth client built with
-`createDefaultAuthClientWithHttpSync`, which mirrors the token into the bonded client), because
-`setAuthGate` alone sends no `Authorization` header.
+`createDefaultAuthClientWithHttpSync`, which registers the auth client's token source with
+`setAuthTokenSource`: the client reads it on each request, so a session adopted mid-page by
+`setSession()` or an OAuth callback's `setAccessToken()` is sent instead of the previous
+account's token — `setAuthTokenSource` says which request first carries it on a transport
+without `setAuthTokenResolver`), because `setAuthGate` alone sends no `Authorization` header.
 
 **The gate never holds its own restore's request.** A request the settle function issues
 while it runs (its call reaches this client before the function awaits anything) is part of

package/dist/auth-gate.d.ts

@@ -7,8 +7,8 @@
  * answers for an anonymous viewer — `following: false` on a user you follow.
  * It is invisible on localhost, where the restore wins the race against the
  * first effect, and appears over the network as soon as the restore takes one
- * round trip: X1 xr-molecule-flash-m95 spent ~25 min chasing this as "database
- * leftovers" on the deployed URL.
+ * round trip: on a deployed URL it reads as stale server data rather than as a
+ * request that left without its header.
  *
  * So the auth bond registers a gate here (`setAuthGate`) and every request
  * waits for it (`awaitAuthGate`) — the race is impossible to write by hand.
@@ -31,11 +31,10 @@
  *
  * `awaitAuthGate` holds every request while the gate is pending — except the ones the gate's
  * settle function issues itself. Those are part of the restore it is waiting for; holding them
- * makes the gate wait on itself, and nothing but the timeout releases anything (X1
- * xr-molecule-flash-m97 and xr-molecule-flash-m173 both lost minutes to this: an app
+ * makes the gate wait on itself, and nothing but the timeout releases anything: an app
  * registering `setAuthGate(() => restoreSession())` over a restore that fetched through the
- * same client, every page held for the full bound, and 917 `GET /api/user` requests named by
- * one console line). So `setAuthGate(() => restoreSession())` works as written when
+ * same client holds every page for the full bound, and one console line can name hundreds of
+ * `GET /api/user` requests. So `setAuthGate(() => restoreSession())` works as written when
  * `restoreSession` calls the gated client.
  *
  * "Issued by the gate" means issued while the settle function is running: this package's
@@ -44,7 +43,7 @@
  * read, a `Promise.resolve()`) and only then calls the client issues its request from a later
  * continuation, which nothing can attribute to the gate — browsers ship no async-context API
  * (`AsyncContext`/`AsyncLocalStorage`) to ask, and releasing requests merely because the gate is
- * pending would drop exactly the first-paint requests the gate exists to hold (m95). A provider
+ * pending would drop exactly the first-paint requests the gate exists to hold. A provider
  * whose request pipeline awaits the gate in a scheduled interceptor (the Axios bond) reaches it
  * a microtask after the settle function returns, outside the window, for the same reason. Such a
  * request must pass `skipAuthGate: true` (`RequestConfig.skipAuthGate`), and a timeout with

package/dist/auth-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-gate.d.ts","sourceRoot":"","sources":["../src/auth-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAkEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAG,IAIhE,CAAA;AA8ED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,GAAU,UAAU,eAAe,KAAG,OAAO,CAAC,IAAI,CAwC3E,CAAA"}
+{"version":3,"file":"auth-gate.d.ts","sourceRoot":"","sources":["../src/auth-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAkEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAG,IAIhE,CAAA;AA8ED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,GAAU,UAAU,eAAe,KAAG,OAAO,CAAC,IAAI,CAwC3E,CAAA"}

package/dist/auth-gate.js

@@ -7,8 +7,8 @@
  * answers for an anonymous viewer — `following: false` on a user you follow.
  * It is invisible on localhost, where the restore wins the race against the
  * first effect, and appears over the network as soon as the restore takes one
- * round trip: X1 xr-molecule-flash-m95 spent ~25 min chasing this as "database
- * leftovers" on the deployed URL.
+ * round trip: on a deployed URL it reads as stale server data rather than as a
+ * request that left without its header.
  *
  * So the auth bond registers a gate here (`setAuthGate`) and every request
  * waits for it (`awaitAuthGate`) — the race is impossible to write by hand.
@@ -31,11 +31,10 @@
  *
  * `awaitAuthGate` holds every request while the gate is pending — except the ones the gate's
  * settle function issues itself. Those are part of the restore it is waiting for; holding them
- * makes the gate wait on itself, and nothing but the timeout releases anything (X1
- * xr-molecule-flash-m97 and xr-molecule-flash-m173 both lost minutes to this: an app
+ * makes the gate wait on itself, and nothing but the timeout releases anything: an app
  * registering `setAuthGate(() => restoreSession())` over a restore that fetched through the
- * same client, every page held for the full bound, and 917 `GET /api/user` requests named by
- * one console line). So `setAuthGate(() => restoreSession())` works as written when
+ * same client holds every page for the full bound, and one console line can name hundreds of
+ * `GET /api/user` requests. So `setAuthGate(() => restoreSession())` works as written when
  * `restoreSession` calls the gated client.
  *
  * "Issued by the gate" means issued while the settle function is running: this package's
@@ -44,7 +43,7 @@
  * read, a `Promise.resolve()`) and only then calls the client issues its request from a later
  * continuation, which nothing can attribute to the gate — browsers ship no async-context API
  * (`AsyncContext`/`AsyncLocalStorage`) to ask, and releasing requests merely because the gate is
- * pending would drop exactly the first-paint requests the gate exists to hold (m95). A provider
+ * pending would drop exactly the first-paint requests the gate exists to hold. A provider
  * whose request pipeline awaits the gate in a scheduled interceptor (the Axios bond) reaches it
  * a microtask after the settle function returns, outside the window, for the same reason. Such a
  * request must pass `skipAuthGate: true` (`RequestConfig.skipAuthGate`), and a timeout with
@@ -75,7 +74,7 @@ let reportedStall = null;
  * that arrives while the gate is pending.
  *
  * Without it each held request re-invokes the gate, and a gate that issues a request on every
- * call floods the network: the m97 shape measured 855 `fetch` calls for one page (`task-auth-
+ * call floods the network: the shape measured 855 `fetch` calls for one page (`task-auth-
  * gate-deadlock.report.md`). `null` when no invocation is in flight; `setAuthGate` clears it
  * so a re-registered gate is never shared with the old one's waiters.
  */
@@ -161,7 +160,7 @@ const describeRequest = (request) => request?.method || request?.url
  * The report is console output, and every reader of it truncates: molecule-dev's route walk
  * keeps the first 200 characters of a console error, so the sentence naming the fix has to
  * come first — and the request list is capped so the message stays readable when a deadlocked
- * gate has held hundreds of requests (xr-molecule-flash-m173: 917 `GET /api/user`).
+ * gate has held hundreds of requests (one deadlocked gate named 917 `GET /api/user` calls).
  */
 const MAX_NAMED_HELD_REQUESTS = 5;
 /**
@@ -170,8 +169,8 @@ const MAX_NAMED_HELD_REQUESTS = 5;
  * deployed URL reads as "the site is slow", which is what the gate itself was added for.
  *
  * Leads with the cause and the fix, then names at most `MAX_NAMED_HELD_REQUESTS` distinct
- * requests and counts the rest: an unbounded join buried the fix clause behind 900 names in
- * xr-molecule-flash-m173, and no reader of the line ever reached it.
+ * requests and counts the rest: an unbounded join buries the fix clause behind 900 names,
+ * and no reader of the line ever reaches it.
  */
 const reportStalledGate = (stuck) => {
     if (reportedStall === stuck)

package/dist/auth-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-gate.js","sourceRoot":"","sources":["../src/auth-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAIhD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;AAEhC,iFAAiF;AACjF,IAAI,IAAI,GAAiC,IAAI,CAAA;AAE7C;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE9C;;;;;;;GAOG;AACH,IAAI,aAAa,GAAiC,IAAI,CAAA;AAEtD;;;;;;;;GAQG;AACH,IAAI,YAAY,GAAyB,IAAI,CAAA;AAE7C;;;;;;;GAOG;AACH,IAAI,YAAY,GAAG,KAAK,CAAA;AAExB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAkC,EAAQ,EAAE;IACtE,IAAI,GAAG,IAAI,CAAA;IACX,YAAY,GAAG,IAAI,CAAA;IACnB,aAAa,GAAG,IAAI,CAAA;AACtB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,OAAyB,EAAU,EAAE,CAC5D,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,GAAG;IAC7B,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;IAC5D,CAAC,CAAC,WAAW,CAAA;AAEjB;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAEjC;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,CAAC,KAA0B,EAAQ,EAAE;IAC7D,IAAI,aAAa,KAAK,KAAK;QAAE,OAAM;IACnC,aAAa,GAAG,KAAK,CAAA;IACrB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAA;IACrD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAA;IAC7C,MAAM,CAAC,KAAK,CACV,qFAAqF;QACnF,uFAAuF;QACvF,oCAAoC,YAAY,CAAC,IAAI,kBAAkB;QACvE,GAAG,eAAe,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QACpE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAC9C,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG,CAAC,OAA4B,EAAiB,EAAE;IACjE,IAAI,YAAY;QAAE,OAAO,YAAY,CAAA;IAErC,IAAI,UAAyB,CAAA;IAC7B,YAAY,GAAG,IAAI,CAAA;IACnB,IAAI,CAAC;QACH,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAA;IACxC,CAAC;YAAS,CAAC;QACT,YAAY,GAAG,KAAK,CAAA;IACtB,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;YAChF,KAAK;SACN,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,YAAY,GAAG,MAAM,CAAA;IACrB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACpB,IAAI,YAAY,KAAK,MAAM;YAAE,YAAY,GAAG,IAAI,CAAA;IAClD,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAyB,EAAiB,EAAE;IAC9E,wFAAwF;IACxF,gDAAgD;IAChD,IAAI,OAAO,EAAE,YAAY;QAAE,OAAM;IAEjC,MAAM,OAAO,GAAG,IAAI,CAAA;IACpB,IAAI,CAAC,OAAO;QAAE,OAAM;IAEpB,0FAA0F;IAC1F,yDAAyD;IACzD,IAAI,YAAY;QAAE,OAAM;IAExB,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAA;IACpC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;IAEjD,IAAI,KAAgD,CAAA;IACpD,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,wFAAwF;YACxF,iFAAiF;YACjF,0BAA0B;YAC1B,UAAU,CAAC,OAAO,CAAC;YACnB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,QAAQ,GAAG,IAAI,CAAA;oBACf,mFAAmF;oBACnF,iBAAiB,CAAC,OAAO,CAAC,CAAA;oBAC1B,OAAO,EAAE,CAAA;gBACX,CAAC,EAAE,eAAe,CAAC,CAAA;YACrB,CAAC,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAC9B,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;IAED,yFAAyF;IACzF,8EAA8E;IAC9E,IAAI,CAAC,QAAQ,IAAI,aAAa,KAAK,OAAO;QAAE,aAAa,GAAG,IAAI,CAAA;AAClE,CAAC,CAAA"}
+{"version":3,"file":"auth-gate.js","sourceRoot":"","sources":["../src/auth-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAIhD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;AAEhC,iFAAiF;AACjF,IAAI,IAAI,GAAiC,IAAI,CAAA;AAE7C;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE9C;;;;;;;GAOG;AACH,IAAI,aAAa,GAAiC,IAAI,CAAA;AAEtD;;;;;;;;GAQG;AACH,IAAI,YAAY,GAAyB,IAAI,CAAA;AAE7C;;;;;;;GAOG;AACH,IAAI,YAAY,GAAG,KAAK,CAAA;AAExB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAkC,EAAQ,EAAE;IACtE,IAAI,GAAG,IAAI,CAAA;IACX,YAAY,GAAG,IAAI,CAAA;IACnB,aAAa,GAAG,IAAI,CAAA;AACtB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,OAAyB,EAAU,EAAE,CAC5D,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,GAAG;IAC7B,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;IAC5D,CAAC,CAAC,WAAW,CAAA;AAEjB;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAEjC;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,CAAC,KAA0B,EAAQ,EAAE;IAC7D,IAAI,aAAa,KAAK,KAAK;QAAE,OAAM;IACnC,aAAa,GAAG,KAAK,CAAA;IACrB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAA;IACrD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAA;IAC7C,MAAM,CAAC,KAAK,CACV,qFAAqF;QACnF,uFAAuF;QACvF,oCAAoC,YAAY,CAAC,IAAI,kBAAkB;QACvE,GAAG,eAAe,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QACpE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAC9C,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG,CAAC,OAA4B,EAAiB,EAAE;IACjE,IAAI,YAAY;QAAE,OAAO,YAAY,CAAA;IAErC,IAAI,UAAyB,CAAA;IAC7B,YAAY,GAAG,IAAI,CAAA;IACnB,IAAI,CAAC;QACH,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAA;IACxC,CAAC;YAAS,CAAC;QACT,YAAY,GAAG,KAAK,CAAA;IACtB,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;YAChF,KAAK;SACN,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,YAAY,GAAG,MAAM,CAAA;IACrB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACpB,IAAI,YAAY,KAAK,MAAM;YAAE,YAAY,GAAG,IAAI,CAAA;IAClD,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAyB,EAAiB,EAAE;IAC9E,wFAAwF;IACxF,gDAAgD;IAChD,IAAI,OAAO,EAAE,YAAY;QAAE,OAAM;IAEjC,MAAM,OAAO,GAAG,IAAI,CAAA;IACpB,IAAI,CAAC,OAAO;QAAE,OAAM;IAEpB,0FAA0F;IAC1F,yDAAyD;IACzD,IAAI,YAAY;QAAE,OAAM;IAExB,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAA;IACpC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;IAEjD,IAAI,KAAgD,CAAA;IACpD,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,wFAAwF;YACxF,iFAAiF;YACjF,0BAA0B;YAC1B,UAAU,CAAC,OAAO,CAAC;YACnB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,QAAQ,GAAG,IAAI,CAAA;oBACf,mFAAmF;oBACnF,iBAAiB,CAAC,OAAO,CAAC,CAAA;oBAC1B,OAAO,EAAE,CAAA;gBACX,CAAC,EAAE,eAAe,CAAC,CAAA;YACrB,CAAC,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAC9B,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;IAED,yFAAyF;IACzF,8EAA8E;IAC9E,IAAI,CAAC,QAAQ,IAAI,aAAa,KAAK,OAAO;QAAE,aAAa,GAAG,IAAI,CAAA;AAClE,CAAC,CAAA"}

package/dist/client.d.ts

@@ -8,6 +8,15 @@
 import type { ErrorInterceptor, RequestInterceptor, ResponseInterceptor } from './interceptors.js';
 import type { RetryOptions } from './retry.js';
 import type { FullRequestConfig, HttpResponse, RequestConfig } from './types.js';
+/**
+ * A live access-token resolver: called once per request, it returns the token the session
+ * holds NOW (`null`/`undefined` when the session carries no body token — a cookie-session API).
+ *
+ * `@molecule/app-http`'s `setAuthTokenSource()` installs one on every client it bonds, so the
+ * app's auth bond decides the bearer and the client resolves it per request instead of holding
+ * a copy that a session adopted mid-page can leave stale.
+ */
+export type AuthTokenResolver = () => string | null | undefined;
 /**
  * HTTP client interface.
  *
@@ -68,12 +77,50 @@ export interface HttpClient {
     addErrorInterceptor(interceptor: ErrorInterceptor): () => void;
     /**
      * Sets the authorization token.
+     *
+     * A static token: every request carries it until the next `setAuthToken` call. A client
+     * that has a {@link HttpClient.setAuthTokenResolver | resolver} (registered through
+     * `@molecule/app-http`'s `setAuthTokenSource`) ignores this value when it assembles a
+     * request — the resolver IS the session, and reading it per request is what keeps a
+     * session adopted without an auth event from sending the previous account's bearer. Once
+     * the resolver is removed, the static token is sent again.
      */
     setAuthToken(token: string | null): void;
     /**
-     * Returns the current authorization token, or `null` if not set.
+     * Returns the token the client applies to its next request: the resolver's answer when one
+     * is registered, else the static token from `setAuthToken`.
      */
     getAuthToken(): string | null;
+    /**
+     * Registers the LIVE token resolver every request of this client reads, or clears it with
+     * `null`.
+     *
+     * `@molecule/app-http`'s `setAuthTokenSource()` calls this on every client it bonds, and the
+     * client MUST consult the resolver again each time it assembles a request (and report it from
+     * `getAuthToken()`). A session can change with no auth event and no observable state change —
+     * `authClient.setSession()` with the same profile data, or the OAuth callback's
+     * `setAccessToken()` — so a token pushed only at bond time or on `login`/`logout` events
+     * leaves every later request carrying the PREVIOUS session's bearer while the UI shows the
+     * new one.
+     *
+     * The resolved token takes the static token's place, with the same precedence: an
+     * `Authorization` header passed per request or in the client's default headers wins over it
+     * exactly where it won over a static token in this transport.
+     *
+     * A resolver that returns `null` (or `undefined`) means "this session has no body token": the
+     * request carries no `Authorization` header of the client's own. A cookie-session API issues
+     * no bearer, and the server prefers the header over the fresh cookie, so a kept bearer
+     * authenticates as the prior — possibly deleted — session.
+     *
+     * Optional, so an implementation written against the previous interface still conforms.
+     * `setAuthTokenSource()` follows such a client through a request interceptor instead, pushing
+     * the source with `setAuthToken` before each request: that request carries the change only
+     * when the transport applies its token after running its interceptors, so a transport that
+     * applies it earlier sends a session adopted mid-page from the following request on.
+     *
+     * @param resolver - Returns the current access token (or null/undefined), or `null` to clear.
+     */
+    setAuthTokenResolver?(resolver: AuthTokenResolver | null): void;
     /**
      * Registers a handler for authentication errors (401).
      *
@@ -86,7 +133,10 @@ export interface HttpClient {
  */
 export interface HttpClientConfig {
     /**
-     * Base URL for all requests.
+     * Base URL for all requests: a path (`/api`) or an absolute URL
+     * (`https://api.example.com/api`). A request path that already starts with the base's
+     * path (`/api/users`) is not prefixed again, and a URL with its own host (`https://…`,
+     * `//cdn…`) is requested as written.
      */
     baseURL?: string;
     /**

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAEhF;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEtC;;;OAGG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAEzE;;OAEG;IACH,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAE/E;;;;OAIG;IACH,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAEhG;;;OAGG;IACH,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAE/F;;;OAGG;IACH,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAEjG;;OAEG;IACH,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAElF;;;OAGG;IACH,qBAAqB,CAAC,WAAW,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAAA;IAElE;;;OAGG;IACH,sBAAsB,CAAC,WAAW,EAAE,mBAAmB,GAAG,MAAM,IAAI,CAAA;IAEpE;;;OAGG;IACH,mBAAmB,CAAC,WAAW,EAAE,gBAAgB,GAAG,MAAM,IAAI,CAAA;IAE9D;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAExC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI,CAAA;IAE7B;;;;OAIG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAA;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEvC;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IAEzB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,KAAK,CAAA;CAC7B"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAEhF;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;AAE/D;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEtC;;;OAGG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAEzE;;OAEG;IACH,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAE/E;;;;OAIG;IACH,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAEhG;;;OAGG;IACH,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAE/F;;;OAGG;IACH,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAEjG;;OAEG;IACH,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAElF;;;OAGG;IACH,qBAAqB,CAAC,WAAW,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAAA;IAElE;;;OAGG;IACH,sBAAsB,CAAC,WAAW,EAAE,mBAAmB,GAAG,MAAM,IAAI,CAAA;IAEpE;;;OAGG;IACH,mBAAmB,CAAC,WAAW,EAAE,gBAAgB,GAAG,MAAM,IAAI,CAAA;IAE9D;;;;;;;;;OASG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAExC;;;OAGG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI,CAAA;IAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,oBAAoB,CAAC,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAA;IAE/D;;;;OAIG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAA;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEvC;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IAEzB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,KAAK,CAAA;CAC7B"}

package/dist/index.d.ts

@@ -49,7 +49,7 @@
  * - **`getClient()` itself knows no baseURL.** The fallback client it mints when nothing is
  *   bonded has `baseURL: ''`, so `getClient().get('/articles')` requests the PAGE origin — in
  *   dev the Vite server answers its own `index.html` with a 200, and the HTML arrives as
- *   `data` (xr-molecule-flash-m126 lost 6.5 minutes to that). A scaffold bonds
+ *   `data`, and the API then validates none of the fields it was sent. A scaffold bonds
  *   `'/api'`; an app that builds its own client must pass `{ baseURL }`.
  * - **The client is PUBLIC — never put a secret in it.** Anything the browser sends (an API
  *   key, a service-role / `sk_…` key, a signing secret) is visible to every user. Secrets
@@ -75,8 +75,11 @@
  * Waiting for the restore does NOT attach the token: a client created beside the auth bond needs
  * `createDefaultHttpClientWithAuthBearer({ baseURL, getToken: () => authClient.getAccessToken(),
  * authScheme })` from `@molecule/app-bonds-default-react` (or an auth client built with
- * `createDefaultAuthClientWithHttpSync`, which mirrors the token into the bonded client), because
- * `setAuthGate` alone sends no `Authorization` header.
+ * `createDefaultAuthClientWithHttpSync`, which registers the auth client's token source with
+ * `setAuthTokenSource`: the client reads it on each request, so a session adopted mid-page by
+ * `setSession()` or an OAuth callback's `setAccessToken()` is sent instead of the previous
+ * account's token — `setAuthTokenSource` says which request first carries it on a transport
+ * without `setAuthTokenResolver`), because `setAuthGate` alone sends no `Authorization` header.
  *
  * **The gate never holds its own restore's request.** A request the settle function issues
  * while it runs (its call reaches this client before the function awaits anything) is part of

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsGG;AAEH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AAEH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA"}

package/dist/index.js

@@ -49,7 +49,7 @@
  * - **`getClient()` itself knows no baseURL.** The fallback client it mints when nothing is
  *   bonded has `baseURL: ''`, so `getClient().get('/articles')` requests the PAGE origin — in
  *   dev the Vite server answers its own `index.html` with a 200, and the HTML arrives as
- *   `data` (xr-molecule-flash-m126 lost 6.5 minutes to that). A scaffold bonds
+ *   `data`, and the API then validates none of the fields it was sent. A scaffold bonds
  *   `'/api'`; an app that builds its own client must pass `{ baseURL }`.
  * - **The client is PUBLIC — never put a secret in it.** Anything the browser sends (an API
  *   key, a service-role / `sk_…` key, a signing secret) is visible to every user. Secrets
@@ -75,8 +75,11 @@
  * Waiting for the restore does NOT attach the token: a client created beside the auth bond needs
  * `createDefaultHttpClientWithAuthBearer({ baseURL, getToken: () => authClient.getAccessToken(),
  * authScheme })` from `@molecule/app-bonds-default-react` (or an auth client built with
- * `createDefaultAuthClientWithHttpSync`, which mirrors the token into the bonded client), because
- * `setAuthGate` alone sends no `Authorization` header.
+ * `createDefaultAuthClientWithHttpSync`, which registers the auth client's token source with
+ * `setAuthTokenSource`: the client reads it on each request, so a session adopted mid-page by
+ * `setSession()` or an OAuth callback's `setAccessToken()` is sent instead of the previous
+ * account's token — `setAuthTokenSource` says which request first carries it on a transport
+ * without `setAuthTokenResolver`), because `setAuthGate` alone sends no `Authorization` header.
  *
  * **The gate never holds its own restore's request.** A request the settle function issues
  * while it runs (its call reaches this client before the function awaits anything) is part of

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsGG;AAEH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AAEH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA"}

package/dist/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAc/D;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAQ,gBAAqB,KAAG,UA8ajE,CAAA"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAqB,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AA4ClF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAQ,gBAAqB,KAAG,UAqbjE,CAAA"}

package/dist/provider.js

@@ -16,6 +16,34 @@ function sleep(ms) {
 }
 /** A response whose body is an HTML document, not JSON. */
 const HTML_CONTENT_TYPE = /^text\/html\b/i;
+/** A URL that names its own host: a scheme (`https://`) or protocol-relative (`//cdn…`). */
+const ABSOLUTE_URL = /^([a-z][a-z\d+\-.]*:)?\/\//i;
+/** The scheme and host of an absolute baseURL (`https://host:8443`); nothing for a path. */
+const BASE_AUTHORITY = /^([a-z][a-z\d+\-.]*:)?\/\/[^/?#]*/i;
+/**
+ * The URL a request goes to under the client's baseURL.
+ *
+ * A URL that names its own host is used as written. Callers (e.g.
+ * `@molecule/app-billing-react` hooks) pass absolute `/api/...` paths whether or not a
+ * baseURL is bonded, so a path that already starts with the baseURL's path — `/api/users`
+ * under `/api` or under `https://host/api` — is the full path and is not prefixed a second
+ * time. Any other URL is joined onto the baseURL with exactly one `/`, as Axios joins them.
+ *
+ * @param baseURL - The client's baseURL.
+ * @param url - The request URL.
+ * @returns The URL to fetch.
+ */
+function joinBaseURL(baseURL, url) {
+    if (!baseURL || ABSOLUTE_URL.test(url))
+        return url;
+    const base = baseURL.replace(/\/+$/, '');
+    const authority = BASE_AUTHORITY.exec(base)?.[0] ?? '';
+    const basePath = base.slice(authority.length);
+    if (basePath && url.startsWith(basePath) && /^(?:$|[/?#])/.test(url.slice(basePath.length))) {
+        return authority + url;
+    }
+    return url ? `${base}/${url.replace(/^\/+/, '')}` : baseURL;
+}
 /**
  * Creates a fetch-based HTTP client using the native Fetch API.
  *
@@ -29,10 +57,18 @@ const HTML_CONTENT_TYPE = /^text\/html\b/i;
 export const createFetchClient = (config = {}) => {
     const logger = getLogger('http');
     let authToken = null;
+    // The app's live session token, installed by `setAuthTokenSource()` through `setClient()`.
+    // It is read per request, never stored: a session adopted without an auth event
+    // (`setSession`, the OAuth callback's `setAccessToken`) changes the token with no event and,
+    // when the profile data is unchanged, no state notification either — a stored copy would keep
+    // sending the previous account's bearer.
+    let authTokenResolver = null;
     const requestInterceptors = [];
     const responseInterceptors = [];
     const errorInterceptors = [];
     const authErrorHandlers = new Set();
+    /** The bearer this request carries: the resolver's answer, else the static token. */
+    const resolveAuthToken = () => authTokenResolver ? (authTokenResolver() ?? null) : authToken;
     // Track whether the document is currently navigating / unloading.
     // Browser tears down in-flight fetch()es on navigation as
     // `TypeError: Failed to fetch`, which is indistinguishable from a
@@ -69,16 +105,7 @@ export const createFetchClient = (config = {}) => {
                 finalConfig = await interceptor(finalConfig);
             }
             // Build URL
-            let url = finalConfig.url;
-            if (client.baseURL && !url.startsWith('http://') && !url.startsWith('https://')) {
-                // Guard against double-prefixing: callers (e.g. @molecule/app-billing-react
-                // hooks) pass absolute `/api/...` paths whether or not a baseURL is bonded.
-                // If the URL already starts with the bonded baseURL, leave it alone.
-                const prefix = client.baseURL.endsWith('/') ? client.baseURL : client.baseURL + '/';
-                if (!url.startsWith(prefix) && url !== client.baseURL) {
-                    url = client.baseURL + url;
-                }
-            }
+            let url = joinBaseURL(client.baseURL, finalConfig.url);
             // Add query params
             if (finalConfig.params) {
                 const params = new URLSearchParams();
@@ -97,9 +124,11 @@ export const createFetchClient = (config = {}) => {
                 ...client.defaultHeaders,
                 ...finalConfig.headers,
             };
-            // Add auth token
-            if (authToken) {
-                headers['Authorization'] = `${config.authScheme ?? 'Bearer'} ${authToken}`;
+            // Add auth token. Resolved HERE, after the gate: the session this request belongs to is
+            // the one the restore settled on, and it cannot have changed since a copy was taken.
+            const token = resolveAuthToken();
+            if (token) {
+                headers['Authorization'] = `${config.authScheme ?? 'Bearer'} ${token}`;
             }
             // Add content-type for JSON
             if (finalConfig.data && !headers['Content-Type']) {
@@ -358,8 +387,11 @@ export const createFetchClient = (config = {}) => {
         setAuthToken(token) {
             authToken = token;
         },
+        setAuthTokenResolver(resolver) {
+            authTokenResolver = resolver;
+        },
         getAuthToken() {
-            return authToken;
+            return resolveAuthToken();
         },
         onAuthError(handler) {
             authErrorHandlers.add(handler);

package/dist/provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAG9C,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAE7D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEtC,gCAAgC;AAChC,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,gBAAgB,CAAA;AAE1C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAA2B,EAAE,EAAc,EAAE;IAC7E,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,SAAS,GAAkB,IAAI,CAAA;IACnC,MAAM,mBAAmB,GAAyB,EAAE,CAAA;IACpD,MAAM,oBAAoB,GAA0B,EAAE,CAAA;IACtD,MAAM,iBAAiB,GAAuB,EAAE,CAAA;IAChD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAc,CAAA;IAE/C,kEAAkE;IAClE,0DAA0D;IAC1D,kEAAkE;IAClE,uEAAuE;IACvE,oEAAoE;IACpE,2CAA2C;IAC3C,IAAI,oBAAoB,GAAG,KAAK,CAAA;IAChC,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QACnF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,oBAAoB,GAAG,IAAI,CAAA;YAC3B,gEAAgE;YAChE,8DAA8D;YAC9D,2DAA2D;YAC3D,UAAU,CAAC,GAAG,EAAE;gBACd,oBAAoB,GAAG,KAAK,CAAA;YAC9B,CAAC,EAAE,IAAI,CAAC,CAAA;QACV,CAAC,CAAA;QACD,MAAM,CAAC,gBAAgB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;QAChD,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,MAAM,GAAe;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;QAE3C,KAAK,CAAC,OAAO,CAAc,aAAgC;YACzD,4EAA4E;YAC5E,2EAA2E;YAC3E,2EAA2E;YAC3E,sFAAsF;YACtF,6DAA6D;YAC7D,MAAM,aAAa,CAAC,aAAa,CAAC,CAAA;YAElC,6BAA6B;YAC7B,IAAI,WAAW,GAAG,EAAE,GAAG,aAAa,EAAE,CAAA;YACtC,KAAK,MAAM,WAAW,IAAI,mBAAmB,EAAE,CAAC;gBAC9C,WAAW,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAA;YAC9C,CAAC;YAED,YAAY;YACZ,IAAI,GAAG,GAAG,WAAW,CAAC,GAAG,CAAA;YACzB,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChF,4EAA4E;gBAC5E,4EAA4E;gBAC5E,qEAAqE;gBACrE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAA;gBACnF,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;oBACtD,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,GAAG,CAAA;gBAC5B,CAAC;YACH,CAAC;YAED,mBAAmB;YACnB,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;gBACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;oBACnC,CAAC;gBACH,CAAC;gBACD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;gBACrC,IAAI,WAAW,EAAE,CAAC;oBAChB,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,WAAW,CAAA;gBACtD,CAAC;YACH,CAAC;YAED,gBAAgB;YAChB,MAAM,OAAO,GAA2B;gBACtC,GAAG,MAAM,CAAC,cAAc;gBACxB,GAAG,WAAW,CAAC,OAAO;aACvB,CAAA;YAED,iBAAiB;YACjB,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,eAAe,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAA;YAC5E,CAAC;YAED,4BAA4B;YAC5B,IAAI,WAAW,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjD,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;YAC9C,CAAC;YAED,sBAAsB;YACtB,MAAM,YAAY,GAAgB;gBAChC,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,OAAO;gBACP,WAAW,EACT,CAAC,WAAW,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa;gBACrF,MAAM,EAAE,WAAW,CAAC,MAAM;aAC3B,CAAA;YAED,WAAW;YACX,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;gBACrB,IAAI,WAAW,CAAC,IAAI,YAAY,QAAQ,IAAI,WAAW,CAAC,IAAI,YAAY,IAAI,EAAE,CAAC;oBAC7E,YAAY,CAAC,IAAI,GAAG,WAAW,CAAC,IAAgB,CAAA;oBAChD,mEAAmE;oBACnE,IAAI,WAAW,CAAC,IAAI,YAAY,QAAQ,EAAE,CAAC;wBACzC,OAAO,OAAO,CAAC,cAAc,CAAC,CAAA;oBAChC,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;gBACtD,CAAC;YACH,CAAC;YAED,sCAAsC;YACtC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAA;YACrD,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAA;YAEtD,uEAAuE;YACvE,qEAAqE;YACrE,oEAAoE;YACpE,kEAAkE;YAClE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;gBAClC,8DAA8D;gBAC9D,gDAAgD;gBAChD,IAAI,SAAoD,CAAA;gBACxD,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;oBACnC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;oBACxC,YAAY,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;oBACvC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAA;gBAC3D,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;oBAEpD,IAAI,SAAS,EAAE,CAAC;wBACd,YAAY,CAAC,SAAS,CAAC,CAAA;oBACzB,CAAC;oBAED,yBAAyB;oBACzB,MAAM,eAAe,GAA2B,EAAE,CAAA;oBAClD,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;wBAC3C,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;oBAC9B,CAAC,CAAC,CAAA;oBAEF,sBAAsB;oBACtB,IAAI,IAAO,CAAA;oBACX,MAAM,YAAY,GAAG,WAAW,CAAC,YAAY,IAAI,MAAM,CAAA;oBAEvD,QAAQ,YAAY,EAAE,CAAC;wBACrB,KAAK,MAAM;4BACT,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAM,CAAA;4BACxC,MAAK;wBACP,KAAK,MAAM;4BACT,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAM,CAAA;4BACxC,MAAK;wBACP,KAAK,aAAa;4BAChB,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,WAAW,EAAE,CAAM,CAAA;4BAC/C,MAAK;wBACP,KAAK,MAAM,CAAC;wBACZ,OAAO,CAAC,CAAC,CAAC;4BACR,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAA;4BACvC,IAAI,CAAC;gCACH,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;4BACvC,CAAC;4BAAC,OAAO,MAAM,EAAE,CAAC;gCAChB,kEAAkE;gCAClE,sEAAsE;gCACtE,wCAAwC;gCACxC,EAAE;gCACF,sEAAsE;gCACtE,wEAAwE;gCACxE,0EAA0E;gCAC1E,yEAAyE;gCACzE,sEAAsE;gCACtE,6DAA6D;gCAC7D,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;gCACnE,IAAI,aAAa,CAAC,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;oCAC5D,MAAM,IAAI,SAAS,CACjB,GAAG,WAAW,CAAC,MAAM,IAAI,GAAG,aAAa,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc;wCAC9E,8EAA8E;wCAC9E,4EAA4E,EAC9E,aAAa,CAAC,MAAM,EACpB;wCACE,IAAI,EAAE,IAAS;wCACf,MAAM,EAAE,aAAa,CAAC,MAAM;wCAC5B,UAAU,EAAE,aAAa,CAAC,UAAU;wCACpC,OAAO,EAAE,eAAe;wCACxB,MAAM,EAAE,WAAW;qCACpB,EACD,WAAW,EACX,0BAA0B,CAC3B,CAAA;gCACH,CAAC;gCACD,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAA;gCACzD,IAAI,GAAG,IAAS,CAAA;4BAClB,CAAC;4BACD,MAAK;wBACP,CAAC;oBACH,CAAC;oBAED,IAAI,QAAQ,GAAoB;wBAC9B,IAAI;wBACJ,MAAM,EAAE,aAAa,CAAC,MAAM;wBAC5B,UAAU,EAAE,aAAa,CAAC,UAAU;wBACpC,OAAO,EAAE,eAAe;wBACxB,MAAM,EAAE,WAAW;qBACpB,CAAA;oBAED,4BAA4B;oBAC5B,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;wBACtB,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;wBACxE,MAAM,KAAK,GAAG,IAAI,SAAS,CACzB,CAAC,CACC,0BAA0B,EAC1B,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,EAChC,EAAE,YAAY,EAAE,8BAA8B,aAAa,CAAC,MAAM,EAAE,EAAE,CACvE,EACD,aAAa,CAAC,MAAM,EACpB,QAAQ,EACR,WAAW,EACX,0BAA0B,CAC3B,CAAA;wBAED,qBAAqB;wBACrB,IAAI,aAAa,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;4BACjC,iBAAiB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;wBACnD,CAAC;wBAED,IACE,kBAAkB,CAAC;4BACjB,MAAM,EAAE,WAAW,CAAC,MAAM;4BAC1B,OAAO;4BACP,MAAM,EAAE,aAAa,CAAC,MAAM;4BAC5B,OAAO;4BACP,YAAY,EAAE,KAAK,CAAC,OAAO;4BAC3B,OAAO,EAAE,YAAY;yBACtB,CAAC,EACF,CAAC;4BACD,MAAM,KAAK,CACT,YAAY,CACV,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,EACrD,OAAO,EACP,YAAY,CACb,CACF,CAAA;4BACD,SAAQ;wBACV,CAAC;wBAED,2BAA2B;wBAC3B,IAAI,UAAU,GAAG,KAAK,CAAA;wBACtB,KAAK,MAAM,WAAW,IAAI,iBAAiB,EAAE,CAAC;4BAC5C,UAAU,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,CAAA;wBAC5C,CAAC;wBAED,MAAM,UAAU,CAAA;oBAClB,CAAC;oBAED,8BAA8B;oBAC9B,KAAK,MAAM,WAAW,IAAI,oBAAoB,EAAE,CAAC;wBAC/C,QAAQ,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAoB,CAAA;oBAC7D,CAAC;oBAED,OAAO,QAAQ,CAAA;gBACjB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,SAAS,EAAE,CAAC;wBACd,YAAY,CAAC,SAAS,CAAC,CAAA;oBACzB,CAAC;oBAED,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;wBAC7B,MAAM,GAAG,CAAA;oBACX,CAAC;oBAED,8DAA8D;oBAC9D,+DAA+D;oBAC/D,8BAA8B;oBAC9B,EAAE;oBACF,gDAAgD;oBAChD,2DAA2D;oBAC3D,+DAA+D;oBAC/D,6DAA6D;oBAC7D,gEAAgE;oBAChE,8DAA8D;oBAC9D,8CAA8C;oBAC9C,EAAE;oBACF,+DAA+D;oBAC/D,+CAA+C;oBAC/C,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;oBACtD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;oBACpD,MAAM,OAAO,GACX,OAAO,KAAK,YAAY;wBACxB,CAAC,OAAO,YAAY,KAAK,WAAW;4BAClC,GAAG,YAAY,YAAY;4BAC3B,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;wBAC5B,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBAE5C,MAAM,SAAS,GACb,OAAO,QAAQ,KAAK,WAAW;wBAC/B,CAAC,QAAQ,CAAC,eAAe,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,CAAA;oBACrE,MAAM,WAAW,GACf,CAAC,OAAO;wBACR,OAAO,KAAK,WAAW;wBACvB,6CAA6C,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC1D,CAAC,SAAS,IAAI,oBAAoB,CAAC,CAAA;oBAErC,IAAI,OAAO,EAAE,CAAC;wBACZ,2BAA2B;oBAC7B,CAAC;yBAAM,IAAI,WAAW,EAAE,CAAC;wBACvB,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;oBACjF,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;oBAC7D,CAAC;oBACD,yEAAyE;oBACzE,2EAA2E;oBAC3E,4EAA4E;oBAC5E,0EAA0E;oBAC1E,yEAAyE;oBACzE,MAAM,OAAO,GAAG,OAAO,IAAI,WAAW,CAAA;oBACtC,MAAM,KAAK,GAAG,IAAI,SAAS,CACzB,GAAG,YAAY,KAAK;wBAClB,CAAC,CAAC,GAAG,CAAC,OAAO;wBACb,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,SAAS,EAAE;4BACvE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe;yBAC5D,CAAC,EACN,CAAC,EACD,SAAS,EACT,WAAW,EACX,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAC1D,OAAO,CACR,CAAA;oBAED,IACE,kBAAkB,CAAC;wBACjB,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,OAAO;wBACP,MAAM,EAAE,CAAC;wBACT,OAAO;wBACP,YAAY,EAAE,MAAM;wBACpB,OAAO;wBACP,OAAO,EAAE,YAAY;qBACtB,CAAC,EACF,CAAC;wBACD,MAAM,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;wBAC3D,SAAQ;oBACV,CAAC;oBAED,2BAA2B;oBAC3B,IAAI,UAAU,GAAG,KAAK,CAAA;oBACtB,KAAK,MAAM,WAAW,IAAI,iBAAiB,EAAE,CAAC;wBAC5C,UAAU,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,CAAA;oBAC5C,CAAC;oBAED,MAAM,UAAU,CAAA;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,GAAG,CAAc,GAAW,EAAE,aAA6B;YACzD,OAAO,MAAM,CAAC,OAAO,CAAI,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,CACF,GAAW,EACX,IAAc,EACd,aAA6B;YAE7B,OAAO,MAAM,CAAC,OAAO,CAAI,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3E,CAAC;QAED,GAAG,CACD,GAAW,EACX,IAAc,EACd,aAA6B;YAE7B,OAAO,MAAM,CAAC,OAAO,CAAI,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,KAAK,CACH,GAAW,EACX,IAAc,EACd,aAA6B;YAE7B,OAAO,MAAM,CAAC,OAAO,CAAI,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5E,CAAC;QAED,MAAM,CAAc,GAAW,EAAE,aAA6B;YAC5D,OAAO,MAAM,CAAC,OAAO,CAAI,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACvE,CAAC;QAED,qBAAqB,CAAC,WAA+B;YACnD,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACrC,OAAO,GAAG,EAAE;gBACV,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBACtD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjB,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;gBACtC,CAAC;YACH,CAAC,CAAA;QACH,CAAC;QAED,sBAAsB,CAAC,WAAgC;YACrD,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACtC,OAAO,GAAG,EAAE;gBACV,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBACvD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjB,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;gBACvC,CAAC;YACH,CAAC,CAAA;QACH,CAAC;QAED,mBAAmB,CAAC,WAA6B;YAC/C,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACnC,OAAO,GAAG,EAAE;gBACV,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBACpD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjB,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;gBACpC,CAAC;YACH,CAAC,CAAA;QACH,CAAC;QAED,YAAY,CAAC,KAAoB;YAC/B,SAAS,GAAG,KAAK,CAAA;QACnB,CAAC;QAED,YAAY;YACV,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,WAAW,CAAC,OAAmB;YAC7B,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC9B,OAAO,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAChD,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAG9C,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAE7D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEtC,gCAAgC;AAChC,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,gBAAgB,CAAA;AAE1C,4FAA4F;AAC5F,MAAM,YAAY,GAAG,6BAA6B,CAAA;AAElD,4FAA4F;AAC5F,MAAM,cAAc,GAAG,oCAAoC,CAAA;AAE3D;;;;;;;;;;;;GAYG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,GAAW;IAC/C,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAA;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7C,IAAI,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5F,OAAO,SAAS,GAAG,GAAG,CAAA;IACxB,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;AAC7D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAA2B,EAAE,EAAc,EAAE;IAC7E,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,SAAS,GAAkB,IAAI,CAAA;IACnC,2FAA2F;IAC3F,gFAAgF;IAChF,6FAA6F;IAC7F,8FAA8F;IAC9F,yCAAyC;IACzC,IAAI,iBAAiB,GAA6B,IAAI,CAAA;IACtD,MAAM,mBAAmB,GAAyB,EAAE,CAAA;IACpD,MAAM,oBAAoB,GAA0B,EAAE,CAAA;IACtD,MAAM,iBAAiB,GAAuB,EAAE,CAAA;IAChD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAc,CAAA;IAE/C,qFAAqF;IACrF,MAAM,gBAAgB,GAAG,GAAkB,EAAE,CAC3C,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAE/D,kEAAkE;IAClE,0DAA0D;IAC1D,kEAAkE;IAClE,uEAAuE;IACvE,oEAAoE;IACpE,2CAA2C;IAC3C,IAAI,oBAAoB,GAAG,KAAK,CAAA;IAChC,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QACnF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,oBAAoB,GAAG,IAAI,CAAA;YAC3B,gEAAgE;YAChE,8DAA8D;YAC9D,2DAA2D;YAC3D,UAAU,CAAC,GAAG,EAAE;gBACd,oBAAoB,GAAG,KAAK,CAAA;YAC9B,CAAC,EAAE,IAAI,CAAC,CAAA;QACV,CAAC,CAAA;QACD,MAAM,CAAC,gBAAgB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;QAChD,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,MAAM,GAAe;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;QAE3C,KAAK,CAAC,OAAO,CAAc,aAAgC;YACzD,4EAA4E;YAC5E,2EAA2E;YAC3E,2EAA2E;YAC3E,sFAAsF;YACtF,6DAA6D;YAC7D,MAAM,aAAa,CAAC,aAAa,CAAC,CAAA;YAElC,6BAA6B;YAC7B,IAAI,WAAW,GAAG,EAAE,GAAG,aAAa,EAAE,CAAA;YACtC,KAAK,MAAM,WAAW,IAAI,mBAAmB,EAAE,CAAC;gBAC9C,WAAW,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAA;YAC9C,CAAC;YAED,YAAY;YACZ,IAAI,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAA;YAEtD,mBAAmB;YACnB,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;gBACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;oBACnC,CAAC;gBACH,CAAC;gBACD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;gBACrC,IAAI,WAAW,EAAE,CAAC;oBAChB,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,WAAW,CAAA;gBACtD,CAAC;YACH,CAAC;YAED,gBAAgB;YAChB,MAAM,OAAO,GAA2B;gBACtC,GAAG,MAAM,CAAC,cAAc;gBACxB,GAAG,WAAW,CAAC,OAAO;aACvB,CAAA;YAED,wFAAwF;YACxF,qFAAqF;YACrF,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAA;YAChC,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,eAAe,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAA;YACxE,CAAC;YAED,4BAA4B;YAC5B,IAAI,WAAW,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjD,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;YAC9C,CAAC;YAED,sBAAsB;YACtB,MAAM,YAAY,GAAgB;gBAChC,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,OAAO;gBACP,WAAW,EACT,CAAC,WAAW,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa;gBACrF,MAAM,EAAE,WAAW,CAAC,MAAM;aAC3B,CAAA;YAED,WAAW;YACX,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;gBACrB,IAAI,WAAW,CAAC,IAAI,YAAY,QAAQ,IAAI,WAAW,CAAC,IAAI,YAAY,IAAI,EAAE,CAAC;oBAC7E,YAAY,CAAC,IAAI,GAAG,WAAW,CAAC,IAAgB,CAAA;oBAChD,mEAAmE;oBACnE,IAAI,WAAW,CAAC,IAAI,YAAY,QAAQ,EAAE,CAAC;wBACzC,OAAO,OAAO,CAAC,cAAc,CAAC,CAAA;oBAChC,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;gBACtD,CAAC;YACH,CAAC;YAED,sCAAsC;YACtC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAA;YACrD,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAA;YAEtD,uEAAuE;YACvE,qEAAqE;YACrE,oEAAoE;YACpE,kEAAkE;YAClE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;gBAClC,8DAA8D;gBAC9D,gDAAgD;gBAChD,IAAI,SAAoD,CAAA;gBACxD,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;oBACnC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;oBACxC,YAAY,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;oBACvC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAA;gBAC3D,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;oBAEpD,IAAI,SAAS,EAAE,CAAC;wBACd,YAAY,CAAC,SAAS,CAAC,CAAA;oBACzB,CAAC;oBAED,yBAAyB;oBACzB,MAAM,eAAe,GAA2B,EAAE,CAAA;oBAClD,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;wBAC3C,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;oBAC9B,CAAC,CAAC,CAAA;oBAEF,sBAAsB;oBACtB,IAAI,IAAO,CAAA;oBACX,MAAM,YAAY,GAAG,WAAW,CAAC,YAAY,IAAI,MAAM,CAAA;oBAEvD,QAAQ,YAAY,EAAE,CAAC;wBACrB,KAAK,MAAM;4BACT,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAM,CAAA;4BACxC,MAAK;wBACP,KAAK,MAAM;4BACT,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAM,CAAA;4BACxC,MAAK;wBACP,KAAK,aAAa;4BAChB,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,WAAW,EAAE,CAAM,CAAA;4BAC/C,MAAK;wBACP,KAAK,MAAM,CAAC;wBACZ,OAAO,CAAC,CAAC,CAAC;4BACR,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAA;4BACvC,IAAI,CAAC;gCACH,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;4BACvC,CAAC;4BAAC,OAAO,MAAM,EAAE,CAAC;gCAChB,kEAAkE;gCAClE,sEAAsE;gCACtE,wCAAwC;gCACxC,EAAE;gCACF,sEAAsE;gCACtE,wEAAwE;gCACxE,0EAA0E;gCAC1E,yEAAyE;gCACzE,sEAAsE;gCACtE,6DAA6D;gCAC7D,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;gCACnE,IAAI,aAAa,CAAC,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;oCAC5D,MAAM,IAAI,SAAS,CACjB,GAAG,WAAW,CAAC,MAAM,IAAI,GAAG,aAAa,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc;wCAC9E,8EAA8E;wCAC9E,4EAA4E,EAC9E,aAAa,CAAC,MAAM,EACpB;wCACE,IAAI,EAAE,IAAS;wCACf,MAAM,EAAE,aAAa,CAAC,MAAM;wCAC5B,UAAU,EAAE,aAAa,CAAC,UAAU;wCACpC,OAAO,EAAE,eAAe;wCACxB,MAAM,EAAE,WAAW;qCACpB,EACD,WAAW,EACX,0BAA0B,CAC3B,CAAA;gCACH,CAAC;gCACD,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAA;gCACzD,IAAI,GAAG,IAAS,CAAA;4BAClB,CAAC;4BACD,MAAK;wBACP,CAAC;oBACH,CAAC;oBAED,IAAI,QAAQ,GAAoB;wBAC9B,IAAI;wBACJ,MAAM,EAAE,aAAa,CAAC,MAAM;wBAC5B,UAAU,EAAE,aAAa,CAAC,UAAU;wBACpC,OAAO,EAAE,eAAe;wBACxB,MAAM,EAAE,WAAW;qBACpB,CAAA;oBAED,4BAA4B;oBAC5B,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;wBACtB,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;wBACxE,MAAM,KAAK,GAAG,IAAI,SAAS,CACzB,CAAC,CACC,0BAA0B,EAC1B,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,EAChC,EAAE,YAAY,EAAE,8BAA8B,aAAa,CAAC,MAAM,EAAE,EAAE,CACvE,EACD,aAAa,CAAC,MAAM,EACpB,QAAQ,EACR,WAAW,EACX,0BAA0B,CAC3B,CAAA;wBAED,qBAAqB;wBACrB,IAAI,aAAa,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;4BACjC,iBAAiB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;wBACnD,CAAC;wBAED,IACE,kBAAkB,CAAC;4BACjB,MAAM,EAAE,WAAW,CAAC,MAAM;4BAC1B,OAAO;4BACP,MAAM,EAAE,aAAa,CAAC,MAAM;4BAC5B,OAAO;4BACP,YAAY,EAAE,KAAK,CAAC,OAAO;4BAC3B,OAAO,EAAE,YAAY;yBACtB,CAAC,EACF,CAAC;4BACD,MAAM,KAAK,CACT,YAAY,CACV,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,EACrD,OAAO,EACP,YAAY,CACb,CACF,CAAA;4BACD,SAAQ;wBACV,CAAC;wBAED,2BAA2B;wBAC3B,IAAI,UAAU,GAAG,KAAK,CAAA;wBACtB,KAAK,MAAM,WAAW,IAAI,iBAAiB,EAAE,CAAC;4BAC5C,UAAU,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,CAAA;wBAC5C,CAAC;wBAED,MAAM,UAAU,CAAA;oBAClB,CAAC;oBAED,8BAA8B;oBAC9B,KAAK,MAAM,WAAW,IAAI,oBAAoB,EAAE,CAAC;wBAC/C,QAAQ,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAoB,CAAA;oBAC7D,CAAC;oBAED,OAAO,QAAQ,CAAA;gBACjB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,SAAS,EAAE,CAAC;wBACd,YAAY,CAAC,SAAS,CAAC,CAAA;oBACzB,CAAC;oBAED,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;wBAC7B,MAAM,GAAG,CAAA;oBACX,CAAC;oBAED,8DAA8D;oBAC9D,+DAA+D;oBAC/D,8BAA8B;oBAC9B,EAAE;oBACF,gDAAgD;oBAChD,2DAA2D;oBAC3D,+DAA+D;oBAC/D,6DAA6D;oBAC7D,gEAAgE;oBAChE,8DAA8D;oBAC9D,8CAA8C;oBAC9C,EAAE;oBACF,+DAA+D;oBAC/D,+CAA+C;oBAC/C,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;oBACtD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;oBACpD,MAAM,OAAO,GACX,OAAO,KAAK,YAAY;wBACxB,CAAC,OAAO,YAAY,KAAK,WAAW;4BAClC,GAAG,YAAY,YAAY;4BAC3B,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;wBAC5B,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBAE5C,MAAM,SAAS,GACb,OAAO,QAAQ,KAAK,WAAW;wBAC/B,CAAC,QAAQ,CAAC,eAAe,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,CAAA;oBACrE,MAAM,WAAW,GACf,CAAC,OAAO;wBACR,OAAO,KAAK,WAAW;wBACvB,6CAA6C,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC1D,CAAC,SAAS,IAAI,oBAAoB,CAAC,CAAA;oBAErC,IAAI,OAAO,EAAE,CAAC;wBACZ,2BAA2B;oBAC7B,CAAC;yBAAM,IAAI,WAAW,EAAE,CAAC;wBACvB,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;oBACjF,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;oBAC7D,CAAC;oBACD,yEAAyE;oBACzE,2EAA2E;oBAC3E,4EAA4E;oBAC5E,0EAA0E;oBAC1E,yEAAyE;oBACzE,MAAM,OAAO,GAAG,OAAO,IAAI,WAAW,CAAA;oBACtC,MAAM,KAAK,GAAG,IAAI,SAAS,CACzB,GAAG,YAAY,KAAK;wBAClB,CAAC,CAAC,GAAG,CAAC,OAAO;wBACb,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,SAAS,EAAE;4BACvE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe;yBAC5D,CAAC,EACN,CAAC,EACD,SAAS,EACT,WAAW,EACX,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAC1D,OAAO,CACR,CAAA;oBAED,IACE,kBAAkB,CAAC;wBACjB,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,OAAO;wBACP,MAAM,EAAE,CAAC;wBACT,OAAO;wBACP,YAAY,EAAE,MAAM;wBACpB,OAAO;wBACP,OAAO,EAAE,YAAY;qBACtB,CAAC,EACF,CAAC;wBACD,MAAM,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;wBAC3D,SAAQ;oBACV,CAAC;oBAED,2BAA2B;oBAC3B,IAAI,UAAU,GAAG,KAAK,CAAA;oBACtB,KAAK,MAAM,WAAW,IAAI,iBAAiB,EAAE,CAAC;wBAC5C,UAAU,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,CAAA;oBAC5C,CAAC;oBAED,MAAM,UAAU,CAAA;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,GAAG,CAAc,GAAW,EAAE,aAA6B;YACzD,OAAO,MAAM,CAAC,OAAO,CAAI,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,CACF,GAAW,EACX,IAAc,EACd,aAA6B;YAE7B,OAAO,MAAM,CAAC,OAAO,CAAI,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3E,CAAC;QAED,GAAG,CACD,GAAW,EACX,IAAc,EACd,aAA6B;YAE7B,OAAO,MAAM,CAAC,OAAO,CAAI,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,KAAK,CACH,GAAW,EACX,IAAc,EACd,aAA6B;YAE7B,OAAO,MAAM,CAAC,OAAO,CAAI,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5E,CAAC;QAED,MAAM,CAAc,GAAW,EAAE,aAA6B;YAC5D,OAAO,MAAM,CAAC,OAAO,CAAI,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACvE,CAAC;QAED,qBAAqB,CAAC,WAA+B;YACnD,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACrC,OAAO,GAAG,EAAE;gBACV,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBACtD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjB,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;gBACtC,CAAC;YACH,CAAC,CAAA;QACH,CAAC;QAED,sBAAsB,CAAC,WAAgC;YACrD,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACtC,OAAO,GAAG,EAAE;gBACV,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBACvD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjB,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;gBACvC,CAAC;YACH,CAAC,CAAA;QACH,CAAC;QAED,mBAAmB,CAAC,WAA6B;YAC/C,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACnC,OAAO,GAAG,EAAE;gBACV,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBACpD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjB,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;gBACpC,CAAC;YACH,CAAC,CAAA;QACH,CAAC;QAED,YAAY,CAAC,KAAoB;YAC/B,SAAS,GAAG,KAAK,CAAA;QACnB,CAAC;QAED,oBAAoB,CAAC,QAAkC;YACrD,iBAAiB,GAAG,QAAQ,CAAA;QAC9B,CAAC;QAED,YAAY;YACV,OAAO,gBAAgB,EAAE,CAAA;QAC3B,CAAC;QAED,WAAW,CAAC,OAAmB;YAC7B,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC9B,OAAO,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAChD,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/dist/utilities.d.ts

@@ -8,31 +8,45 @@
  *
  * @module
  */
-import type { HttpClient } from './client.js';
+import type { AuthTokenResolver, HttpClient } from './client.js';
 import type { HttpResponse, RequestConfig } from './types.js';
 /**
- * Registers the token source a newly bonded client is hydrated from, or clears
- * it with `null`.
- *
- * The source is read once per bond: the client bonded AFTER this call (and the
- * one bonded now, if any) receives `source()` through `setAuthToken`. That is
- * what carries a restored session's token into a client the auth setup ran
- * before — the setup does not need to hold a client reference at all.
- *
- * @param source - Returns the current access token (null when signed out), or `null` to clear.
+ * Registers the token source every bonded client reads on EACH request, or removes it with
+ * `null`.
+ *
+ * Every client that receives the source — the one bonded now, any bonded later, and the
+ * fallback {@link getClient} returns while none is bonded — is hydrated from `source()` and
+ * reads it again for every request: through {@link HttpClient.setAuthTokenResolver} where the
+ * client implements it (`createFetchClient`, `@molecule/app-http-axios` from 1.2.0), else
+ * through a request interceptor that pushes it with `setAuthToken`, which a transport applying
+ * its token after its interceptors sends on that same request and one applying it before them
+ * from the next request on. So a restored session reaches a client bonded after the auth setup
+ * (which holds no client reference), and a session adopted later with no auth event
+ * (`setSession`, `setAccessToken`) never leaves the previous account's bearer on the wire.
+ *
+ * A source that returns `null` means "no body token": the client sends no `Authorization`
+ * header of its own (see {@link HttpClient.setAuthTokenResolver} for why a kept bearer is a
+ * bug). A header passed per request or in a client's default headers keeps the precedence that
+ * client's transport gives it over the client's token.
+ *
+ * A replaced source is followed from the next request on. Removing it (`null`) leaves the
+ * bonded client (and the fallback) on the token the source returned at that moment, as a
+ * static token that `setAuthToken` controls from then on.
+ *
+ * @param source - Returns the current access token (null when signed out), or `null` to remove it.
  *
  * @example
  * ```typescript
  * setAuthTokenSource(() => authClient.getAccessToken())
  * ```
  */
-export declare const setAuthTokenSource: (source: (() => string | null | undefined) | null) => void;
+export declare const setAuthTokenSource: (source: AuthTokenResolver | null) => void;
 /**
  * Registers an HTTP client as the active singleton.
  *
  * A registered `setAuthTokenSource` token source is applied to the client
- * here, so a client bonded after the auth setup still carries the restored
- * session's token.
+ * here, so a client bonded after the auth setup resolves the restored
+ * session's token on every request it makes.
  *
  * @param client - The HTTP client implementation to bond.
  *
@@ -56,6 +70,8 @@ export declare const setClient: (client: HttpClient) => void;
  * Returning it WITHOUT bonding is what keeps a later `setClient()` authoritative: a
  * caller that captured this fallback early does not make it the app's client, so the
  * scaffold's client (and its token source) still takes effect for every later call.
+ * The fallback follows a registered `setAuthTokenSource` source like a bonded client
+ * does, so an app that bonds no client at all still sends the current session.
  *
  * @returns The active HTTP client, or the unbonded fallback when none is bonded.
  */

package/dist/utilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AA6B7D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,CAAC,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,IAAI,KAAG,IAIrF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,GAAI,QAAQ,UAAU,KAAG,IAG9C,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,QAAO,UAY5B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAC7D,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,GAAG,OAAO,EAC9B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA2C,CAAA;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAC7B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA0C,CAAA;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,KAAK,GAAI,CAAC,GAAG,OAAO,EAC/B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA4C,CAAA;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAC1D,CAAA;AAEpC;;;GAGG;AACH,eAAO,MAAM,WAAW,mBAA4D,CAAA"}
+{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAEhE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAgF7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,iBAAiB,GAAG,IAAI,KAAG,IAQrE,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,GAAI,QAAQ,UAAU,KAAG,IAG9C,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,SAAS,QAAO,UAe5B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAC7D,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,GAAG,OAAO,EAC9B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA2C,CAAA;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAC7B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA0C,CAAA;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,KAAK,GAAI,CAAC,GAAG,OAAO,EAC/B,KAAK,MAAM,EACX,OAAO,OAAO,EACd,SAAS,aAAa,KACrB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAA4C,CAAA;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,OAAO,EAAE,KAAK,MAAM,EAAE,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAC1D,CAAA;AAEpC;;;GAGG;AACH,eAAO,MAAM,WAAW,mBAA4D,CAAA"}

package/dist/utilities.js

@@ -22,28 +22,90 @@ let warnedAboutFallback = false;
  * `setClient()` captured a no-baseURL client that every later `setClient()`
  * could not reach — the app's real client was bonded and the caller's token
  * sync kept writing into the orphan, so every request went out bare
- * (xr-molecule-flash-m156, 401 `token is missing` after a reload).
+ * (a 401 `token is missing` after a reload).
  */
 let unbondedFallback = null;
 /**
- * The auth client whose token every HTTP client starts with, or null.
- *
- * `setClient` applies it at bond time, which is the only moment that can reach a
- * client created AFTER the auth setup ran — the scaffold wires auth before http,
- * so the auth bond's initial token had no client to land on
- * (`createDefaultAuthClientWithHttpSync` in `@molecule/app-bonds-default-react`).
+ * The auth client whose token every HTTP client the app bonds resolves on every request,
+ * or null.
+ *
+ * `setClient` installs it, which is the only moment that can reach a client created AFTER
+ * the auth setup ran — the scaffold wires auth before http, so the auth bond's initial
+ * token had no client to land on (`createDefaultAuthClientWithHttpSync` in
+ * `@molecule/app-bonds-default-react`). The client then reads the source itself for each
+ * request instead of holding a token copied at bond time: a session adopted mid-page —
+ * `setSession()`, the OAuth callback's `setAccessToken()` — changes the token with no auth
+ * event and, when the profile data is unchanged, with no state notification either, so a
+ * copy would keep sending the previous account's bearer.
  */
 let authTokenSource = null;
 /**
- * Registers the token source a newly bonded client is hydrated from, or clears
- * it with `null`.
- *
- * The source is read once per bond: the client bonded AFTER this call (and the
- * one bonded now, if any) receives `source()` through `setAuthToken`. That is
- * what carries a restored session's token into a client the auth setup ran
- * before — the setup does not need to hold a client reference at all.
- *
- * @param source - Returns the current access token (null when signed out), or `null` to clear.
+ * The source each client WITHOUT {@link HttpClient.setAuthTokenResolver} follows (a transport
+ * written against the previous interface), read by the request interceptor
+ * {@link applyAuthTokenSource} adds to that client once.
+ */
+const interceptedSources = new WeakMap();
+/**
+ * Gives one client the app's token source, or takes it away.
+ *
+ * A client that implements {@link HttpClient.setAuthTokenResolver} reads the source itself as
+ * it assembles each request. One that does not gets a request interceptor that pushes
+ * `source()` through `setAuthToken` before each of its requests: a transport that applies its
+ * token after running its interceptors (as `createFetchClient` does) sends the current session
+ * on that same request, and one that applies it before them (`@molecule/app-http-axios`
+ * before 1.2.0) from the following request on.
+ *
+ * Either way the client is hydrated now. Taking the source away leaves the client on the token
+ * the source returned at that moment, under `setAuthToken`'s control from then on — never on
+ * an older copy taken at bond time.
+ *
+ * @param client - The client receiving the source.
+ * @param source - The source to install, or `null` to take it away.
+ * @param previous - The source this call replaces or removes, if any.
+ */
+const applyAuthTokenSource = (client, source, previous) => {
+    if (client.setAuthTokenResolver) {
+        client.setAuthTokenResolver(source);
+    }
+    else {
+        if (!interceptedSources.has(client)) {
+            client.addRequestInterceptor((config) => {
+                const current = interceptedSources.get(client);
+                if (current)
+                    client.setAuthToken(current() ?? null);
+                return config;
+            });
+        }
+        interceptedSources.set(client, source);
+    }
+    const settled = source ?? previous;
+    if (settled)
+        client.setAuthToken(settled() ?? null);
+};
+/**
+ * Registers the token source every bonded client reads on EACH request, or removes it with
+ * `null`.
+ *
+ * Every client that receives the source — the one bonded now, any bonded later, and the
+ * fallback {@link getClient} returns while none is bonded — is hydrated from `source()` and
+ * reads it again for every request: through {@link HttpClient.setAuthTokenResolver} where the
+ * client implements it (`createFetchClient`, `@molecule/app-http-axios` from 1.2.0), else
+ * through a request interceptor that pushes it with `setAuthToken`, which a transport applying
+ * its token after its interceptors sends on that same request and one applying it before them
+ * from the next request on. So a restored session reaches a client bonded after the auth setup
+ * (which holds no client reference), and a session adopted later with no auth event
+ * (`setSession`, `setAccessToken`) never leaves the previous account's bearer on the wire.
+ *
+ * A source that returns `null` means "no body token": the client sends no `Authorization`
+ * header of its own (see {@link HttpClient.setAuthTokenResolver} for why a kept bearer is a
+ * bug). A header passed per request or in a client's default headers keeps the precedence that
+ * client's transport gives it over the client's token.
+ *
+ * A replaced source is followed from the next request on. Removing it (`null`) leaves the
+ * bonded client (and the fallback) on the token the source returned at that moment, as a
+ * static token that `setAuthToken` controls from then on.
+ *
+ * @param source - Returns the current access token (null when signed out), or `null` to remove it.
  *
  * @example
  * ```typescript
@@ -51,17 +113,21 @@ let authTokenSource = null;
  * ```
  */
 export const setAuthTokenSource = (source) => {
+    const previous = authTokenSource;
     authTokenSource = source;
     const bonded = bondGet(BOND_TYPE);
-    if (bonded && source)
-        bonded.setAuthToken(source() ?? null);
+    if (bonded)
+        applyAuthTokenSource(bonded, source, previous);
+    if (unbondedFallback && unbondedFallback !== bonded) {
+        applyAuthTokenSource(unbondedFallback, source, previous);
+    }
 };
 /**
  * Registers an HTTP client as the active singleton.
  *
  * A registered `setAuthTokenSource` token source is applied to the client
- * here, so a client bonded after the auth setup still carries the restored
- * session's token.
+ * here, so a client bonded after the auth setup resolves the restored
+ * session's token on every request it makes.
  *
  * @param client - The HTTP client implementation to bond.
  *
@@ -74,7 +140,7 @@ export const setAuthTokenSource = (source) => {
 export const setClient = (client) => {
     bond(BOND_TYPE, client);
     if (authTokenSource)
-        client.setAuthToken(authTokenSource() ?? null);
+        applyAuthTokenSource(client, authTokenSource, null);
 };
 /**
  * Retrieves the bonded HTTP client. If none is bonded, returns a module-level
@@ -89,6 +155,8 @@ export const setClient = (client) => {
  * Returning it WITHOUT bonding is what keeps a later `setClient()` authoritative: a
  * caller that captured this fallback early does not make it the app's client, so the
  * scaffold's client (and its token source) still takes effect for every later call.
+ * The fallback follows a registered `setAuthTokenSource` source like a bonded client
+ * does, so an app that bonds no client at all still sends the current session.
  *
  * @returns The active HTTP client, or the unbonded fallback when none is bonded.
  */
@@ -96,8 +164,11 @@ export const getClient = () => {
     const existing = bondGet(BOND_TYPE);
     if (existing)
         return existing;
-    if (!unbondedFallback)
+    if (!unbondedFallback) {
         unbondedFallback = createFetchClient();
+        if (authTokenSource)
+            applyAuthTokenSource(unbondedFallback, authTokenSource, null);
+    }
     if (!warnedAboutFallback) {
         warnedAboutFallback = true;
         getLogger('http').warn('@molecule/app-http: no client is bonded — requests go to the page origin with no baseURL. ' +

package/dist/utilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"utilities.js","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAGhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAGjD,MAAM,SAAS,GAAG,aAAa,CAAA;AAE/B,kEAAkE;AAClE,IAAI,mBAAmB,GAAG,KAAK,CAAA;AAE/B;;;;;;;;;GASG;AACH,IAAI,gBAAgB,GAAsB,IAAI,CAAA;AAE9C;;;;;;;GAOG;AACH,IAAI,eAAe,GAA6C,IAAI,CAAA;AAEpE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAgD,EAAQ,EAAE;IAC3F,eAAe,GAAG,MAAM,CAAA;IACxB,MAAM,MAAM,GAAG,OAAO,CAAa,SAAS,CAAC,CAAA;IAC7C,IAAI,MAAM,IAAI,MAAM;QAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAA;AAC7D,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACpD,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACvB,IAAI,eAAe;QAAE,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,IAAI,CAAC,CAAA;AACrE,CAAC,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAe,EAAE;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAa,SAAS,CAAC,CAAA;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,CAAC,gBAAgB;QAAE,gBAAgB,GAAG,iBAAiB,EAAE,CAAA;IAC7D,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,IAAI,CAAA;QAC1B,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CACpB,4FAA4F;YAC1F,8DAA8D,CACjE,CAAA;IACH,CAAC;IACD,OAAO,gBAAgB,CAAA;AACzB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAc,GAAW,EAAE,MAAsB,EAA4B,EAAE,CAChG,SAAS,EAAE,CAAC,GAAG,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAErE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAc,GAAW,EAAE,MAAsB,EAA4B,EAAE,CAChG,SAAS,EAAE,CAAC,MAAM,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA"}
+{"version":3,"file":"utilities.js","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAGhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAGjD,MAAM,SAAS,GAAG,aAAa,CAAA;AAE/B,kEAAkE;AAClE,IAAI,mBAAmB,GAAG,KAAK,CAAA;AAE/B;;;;;;;;;GASG;AACH,IAAI,gBAAgB,GAAsB,IAAI,CAAA;AAE9C;;;;;;;;;;;;GAYG;AACH,IAAI,eAAe,GAA6B,IAAI,CAAA;AAEpD;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,IAAI,OAAO,EAAwC,CAAA;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,oBAAoB,GAAG,CAC3B,MAAkB,EAClB,MAAgC,EAChC,QAAkC,EAC5B,EAAE;IACR,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,EAAE,EAAE;gBACtC,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBAC9C,IAAI,OAAO;oBAAE,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,CAAA;gBACnD,OAAO,MAAM,CAAA;YACf,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,QAAQ,CAAA;IAClC,IAAI,OAAO;QAAE,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,CAAA;AACrD,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAgC,EAAQ,EAAE;IAC3E,MAAM,QAAQ,GAAG,eAAe,CAAA;IAChC,eAAe,GAAG,MAAM,CAAA;IACxB,MAAM,MAAM,GAAG,OAAO,CAAa,SAAS,CAAC,CAAA;IAC7C,IAAI,MAAM;QAAE,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC1D,IAAI,gBAAgB,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;QACpD,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACpD,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACvB,IAAI,eAAe;QAAE,oBAAoB,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,CAAA;AAC1E,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAe,EAAE;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAa,SAAS,CAAC,CAAA;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,gBAAgB,GAAG,iBAAiB,EAAE,CAAA;QACtC,IAAI,eAAe;YAAE,oBAAoB,CAAC,gBAAgB,EAAE,eAAe,EAAE,IAAI,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,IAAI,CAAA;QAC1B,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CACpB,4FAA4F;YAC1F,8DAA8D,CACjE,CAAA;IACH,CAAC;IACD,OAAO,gBAAgB,CAAA;AACzB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAc,GAAW,EAAE,MAAsB,EAA4B,EAAE,CAChG,SAAS,EAAE,CAAC,GAAG,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAErE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,GAAW,EACX,IAAc,EACd,MAAsB,EACI,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,CAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAc,GAAW,EAAE,MAAsB,EAA4B,EAAE,CAChG,SAAS,EAAE,CAAC,MAAM,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-http",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Client HTTP interface for molecule.dev",
   "type": "module",
   "main": "dist/index.js",
@@ -34,11 +34,11 @@
   },
   "devDependencies": {
     "@molecule/app-bond": "1.0.3",
-    "@molecule/app-i18n": "1.0.3",
-    "@molecule/app-logger": "1.0.2",
-    "@types/node": "26.1.2",
+    "@molecule/app-i18n": "1.1.0",
+    "@molecule/app-logger": "1.0.3",
+    "@types/node": "26.6.5",
     "typescript": "6.0.3",
-    "vitest": "4.1.11"
+    "vitest": "4.1.12"
   },
   "repository": {
     "type": "git",