@molecule/app-react 1.11.0 → 2.0.0

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-10-25T09:04:08.240Z
+Generated: 2026-10-25T20:03:36.228Z
 -->
 
 # @molecule/app-react
@@ -250,9 +250,12 @@ interface AuthClient<T = UserProfile, TRegister extends RegisterExtraShape<TRegi
     confirmPasswordReset(data: PasswordResetConfirm): Promise<void>;
     /**
      * Updates the current user's profile.
-     * Returns the saved response. If the session is explicitly replaced or ended
-     * while the request is pending, that response does not replace the current
-     * session's user or persisted cache.
+     * Returns the saved profile: the answer applied onto the signed-in user field
+     * by field, with or without an `id` — a field it carries replaces the value
+     * (`null` clears it), one it omits or leaves `undefined` is kept, so a field
+     * cleared by omission must arrive as `null`. A non-object answer is returned
+     * as it came. An answer for a replaced or ended session leaves the current one
+     * untouched.
      */
     updateProfile(data: Partial<T>): Promise<T>;
     /**
@@ -308,9 +311,6 @@ interface AuthClient<T = UserProfile, TRegister extends RegisterExtraShape<TRegi
      * Resolves when the session restore started by `initialize()` has settled — the point
      * after which the client knows whether this visitor is signed in.
      *
-     * Resolves IMMEDIATELY when no restore is in flight: before `initialize()` is ever
-     * called, and after it has finished. A restore that failed resolves too (it settled the
-     * question), so an HTTP client can await this before every request without risking one
 // … truncated — the full declaration is in node_modules/@molecule/app-react/dist
 ```
 
@@ -518,12 +518,50 @@ interface HttpClient {
   addErrorInterceptor(interceptor: ErrorInterceptor): () => void
   /**
    * Sets the authorization token.
+   *
+   * A static token: every request carries it until the next `setAuthToken` call. A client
+   * that has a {@link HttpClient.setAuthTokenResolver | resolver} (registered through
+   * `@molecule/app-http`'s `setAuthTokenSource`) ignores this value when it assembles a
+   * request — the resolver IS the session, and reading it per request is what keeps a
+   * session adopted without an auth event from sending the previous account's bearer. Once
+   * the resolver is removed, the static token is sent again.
    */
   setAuthToken(token: string | null): void
   /**
-   * Returns the current authorization token, or `null` if not set.
+   * Returns the token the client applies to its next request: the resolver's answer when one
+   * is registered, else the static token from `setAuthToken`.
    */
   getAuthToken(): string | null
+  /**
+   * Registers the LIVE token resolver every request of this client reads, or clears it with
+   * `null`.
+   *
+   * `@molecule/app-http`'s `setAuthTokenSource()` calls this on every client it bonds, and the
+   * client MUST consult the resolver again each time it assembles a request (and report it from
+   * `getAuthToken()`). A session can change with no auth event and no observable state change —
+   * `authClient.setSession()` with the same profile data, or the OAuth callback's
+   * `setAccessToken()` — so a token pushed only at bond time or on `login`/`logout` events
+   * leaves every later request carrying the PREVIOUS session's bearer while the UI shows the
+   * new one.
+   *
+   * The resolved token takes the static token's place, with the same precedence: an
+   * `Authorization` header passed per request or in the client's default headers wins over it
+   * exactly where it won over a static token in this transport.
+   *
+   * A resolver that returns `null` (or `undefined`) means "this session has no body token": the
+   * request carries no `Authorization` header of the client's own. A cookie-session API issues
+   * no bearer, and the server prefers the header over the fresh cookie, so a kept bearer
+   * authenticates as the prior — possibly deleted — session.
+   *
+   * Optional, so an implementation written against the previous interface still conforms.
+   * `setAuthTokenSource()` follows such a client through a request interceptor instead, pushing
+   * the source with `setAuthToken` before each request: that request carries the change only
+   * when the transport applies its token after running its interceptors, so a transport that
+   * applies it earlier sends a session adopted mid-page from the following request on.
+   *
+   * @param resolver - Returns the current access token (or null/undefined), or `null` to clear.
+   */
+  setAuthTokenResolver?(resolver: AuthTokenResolver | null): void
   /**
    * Registers a handler for authentication errors (401).
    *
@@ -1418,7 +1456,7 @@ interface UseAuthResult<
    *
    * `setUser` alone does NOT sign the client in, and `setAccessToken` changes
    * storage only — using those two for a caller-issued session leaves every
-   * `authenticated` read signed out (xr-molecule-flash-m178).
+   * `authenticated` read signed out.
    */
   setSession: AuthClient<T>['setSession']
   isAuthenticated: boolean
@@ -3148,7 +3186,7 @@ const PreviewContext: Context<PreviewProvider | null>
 
 Peer dependencies:
 
-- `@molecule/app-auth` ^1.0.1 || ^2.0.0
+- `@molecule/app-auth` ^3.0.0
 - `@molecule/app-ai-models` ^1.0.1
 - `@molecule/app-forms` ^1.0.1
 - `@molecule/app-utilities` ^1.0.1

package/dist/types.d.ts

@@ -161,7 +161,7 @@ export interface UseAuthResult<T = unknown, TRegister extends RegisterExtraShape
      *
      * `setUser` alone does NOT sign the client in, and `setAccessToken` changes
      * storage only — using those two for a caller-issued session leaves every
-     * `authenticated` read signed out (xr-molecule-flash-m178).
+     * `authenticated` read signed out.
      */
     setSession: AuthClient<T>['setSession'];
     isAuthenticated: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-react",
-  "version": "1.11.0",
+  "version": "2.0.0",
   "description": "React framework bindings for molecule.dev",
   "type": "module",
   "main": "dist/index.js",
@@ -23,7 +23,7 @@
     "node": ">=20"
   },
   "peerDependencies": {
-    "@molecule/app-auth": "^1.0.1 || ^2.0.0",
+    "@molecule/app-auth": "^3.0.0",
     "@molecule/app-ai-models": "^1.0.1",
     "@molecule/app-forms": "^1.0.1",
     "@molecule/app-utilities": "^1.0.1",
@@ -61,7 +61,7 @@
   },
   "devDependencies": {
     "@molecule/app-ai-models": "1.4.3",
-    "@molecule/app-bonds-default-react": "2.0.0",
+    "@molecule/app-bonds-default-react": "3.0.0",
     "@molecule/app-i18n": "1.1.0",
     "@testing-library/dom": "10.4.2",
     "@testing-library/react": "16.3.3",