0.1.0 alpha.1

.editorconfig

@@ -0,0 +1,14 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = tab
+indent_size = tab
+tab_width = 3
+trim_trailing_whitespace = true
+max_line_length = 80
+
+[*.md]
+trim_trailing_whitespace = false

.github/workflows/ci.yml

@@ -1,41 +1,44 @@
 name: CI
 
+env:
+   HUSKY: 0
+
 on:
-  push:
-    branches: [main]
-  pull_request:
+   push:
+      branches: [main]
+   pull_request:
 
 permissions:
-  contents: read
+   contents: read
 
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+   group: ci-${{ github.workflow }}-${{ github.ref }}
+   cancel-in-progress: true
 
 jobs:
-  check:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v7
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@v6
-        with:
-          version: 10.12.1
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v7
-        with:
-          node-version: 24
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Build and test
-        run: pnpm run check
-
-      - name: Verify package tarball
-        run: pnpm --config.ignore-scripts=true pack --pack-destination "$RUNNER_TEMP/session-kit-pack"
+   check:
+      runs-on: ubuntu-latest
+      timeout-minutes: 10
+      steps:
+         - name: Check out repository
+           uses: actions/checkout@v7
+
+         - name: Set up pnpm
+           uses: pnpm/action-setup@v6
+           with:
+              version: 10.12.1
+
+         - name: Set up Node.js
+           uses: actions/setup-node@v7
+           with:
+              node-version: 24
+              cache: pnpm
+
+         - name: Install dependencies
+           run: pnpm install --frozen-lockfile
+
+         - name: Build and test
+           run: pnpm run check
+
+         - name: Verify package tarball
+           run: pnpm --config.ignore-scripts=true pack --pack-destination "$RUNNER_TEMP/session-kit-pack"

.github/workflows/release.yml

@@ -0,0 +1,102 @@
+name: Release alpha
+
+env:
+   HUSKY: 0
+
+on:
+   workflow_dispatch:
+      inputs:
+         version:
+            description: Alpha version already committed in package.json (without v)
+            required: true
+            type: string
+
+permissions:
+   contents: read
+
+concurrency:
+   group: session-kit-release
+   cancel-in-progress: false
+
+jobs:
+   prepare:
+      runs-on: ubuntu-latest
+      timeout-minutes: 15
+      steps:
+         - name: Require main
+           env:
+              RELEASE_REF: ${{ github.ref }}
+           run: test "$RELEASE_REF" = refs/heads/main
+         - name: Check out release commit
+           uses: actions/checkout@v7
+           with:
+              fetch-depth: 0
+         - name: Set up pnpm
+           uses: pnpm/action-setup@v6
+           with:
+              version: 10.12.1
+         - name: Set up Node.js
+           uses: actions/setup-node@v7
+           with:
+              node-version: 24
+              package-manager-cache: false
+         - name: Validate version and release notes
+           env:
+              RELEASE_VERSION: ${{ inputs.version }}
+           run: |
+              node scripts/prepare-release.mjs "$RELEASE_VERSION" "$RUNNER_TEMP/release" --check-registry
+              if git show-ref --verify --quiet "refs/tags/v$RELEASE_VERSION"; then
+                echo "The release tag already exists."
+                exit 1
+              fi
+         - name: Install dependencies
+           run: pnpm install --frozen-lockfile
+         - name: Build and test
+           run: pnpm run check
+         - name: Pack verified build
+           run: pnpm --config.ignore-scripts=true pack --pack-destination "$RUNNER_TEMP/release"
+         - name: Save release artifact
+           uses: actions/upload-artifact@v7
+           with:
+              name: session-kit-release
+              path: ${{ runner.temp }}/release/
+              if-no-files-found: error
+              retention-days: 14
+
+   publish:
+      needs: prepare
+      runs-on: ubuntu-latest
+      timeout-minutes: 10
+      permissions:
+         contents: write
+         id-token: write
+      steps:
+         - name: Set up Node.js
+           uses: actions/setup-node@v7
+           with:
+              node-version: 24
+              package-manager-cache: false
+         - name: Download verified release artifact
+           uses: actions/download-artifact@v8
+           with:
+              name: session-kit-release
+              path: ${{ runner.temp }}/release
+         - name: Check npm supports trusted publishing
+           run: |
+              node --input-type=module -e 'import { execFileSync } from "node:child_process"; const [major, minor, patch] = execFileSync("npm", ["--version"], { encoding: "utf8" }).trim().split(".").map(Number); if (!(major > 11 || (major === 11 && (minor > 5 || (minor === 5 && patch >= 1))))) throw new Error("npm >=11.5.1 is required");'
+         - name: Publish alpha to npm
+           env:
+              RELEASE_VERSION: ${{ inputs.version }}
+           run: npm publish "$RUNNER_TEMP/release/monarcode-session-kit-$RELEASE_VERSION.tgz" --tag next --access public --ignore-scripts
+         - name: Create GitHub prerelease and tag
+           env:
+              GH_TOKEN: ${{ github.token }}
+              GH_REPO: ${{ github.repository }}
+              RELEASE_VERSION: ${{ inputs.version }}
+              RELEASE_COMMIT: ${{ github.sha }}
+           run: |
+              gh release create "v$RELEASE_VERSION" \
+                --target "$RELEASE_COMMIT" \
+                --title "v$RELEASE_VERSION" \
+                --prerelease --latest=false \
+                --notes-file "$RUNNER_TEMP/release/release-notes.md"

.husky/pre-commit

@@ -0,0 +1 @@
+pnpm run lint && pnpm run format:check

.oxfmtrc.json

@@ -0,0 +1,45 @@
+{
+	"$schema": "./node_modules/oxfmt/configuration_schema.json",
+	"semi": true,
+	"trailingComma": "all",
+	"singleQuote": false,
+	"jsxSingleQuote": false,
+	"printWidth": 80,
+	"tabWidth": 3,
+	"useTabs": true,
+	"arrowParens": "always",
+	"endOfLine": "lf",
+	"bracketSpacing": true,
+	"insertFinalNewline": true,
+	"ignorePatterns": [
+		"node_modules",
+		"dist",
+		"build",
+		".netlify",
+		"routeTree.gen.ts",
+		"*.gen.ts",
+		"coverage",
+		"templates/",
+		"scripts/"
+	],
+	"sortImports": {
+		"customGroups": [
+			{
+				"groupName": "react",
+				"selector": "external",
+				"elementNamePattern": ["react", "react-*"]
+			}
+		],
+		"groups": [
+			"builtin",
+			"react",
+			"external",
+			["internal", "subpath"],
+			["parent", "sibling", "index"],
+			"style",
+			"unknown"
+		],
+		"internalPattern": ["@/"],
+		"newlinesBetween": true
+	}
+}

.oxlintrc.json

@@ -0,0 +1,45 @@
+{
+	"$schema": "./node_modules/oxlint/configuration_schema.json",
+	"plugins": [
+		"react",
+		"import",
+		"jsx-a11y",
+		"promise",
+		"typescript",
+		"unicorn"
+	],
+	"env": {
+		"browser": true,
+		"node": true,
+		"es2025": true
+	},
+	"ignorePatterns": [
+		"**/node_modules/**",
+		"**/dist/**",
+		"**/build/**",
+		"**/.netlify/**",
+		"**/routeTree.gen.ts",
+		"**/*.gen.ts",
+		"**/coverage/**",
+		"**/templates/**",
+		"**/scripts/**"
+	],
+	"rules": {
+		"no-unused-vars": "off",
+		"typescript/no-unused-vars": [
+			"warn",
+			{
+				"fix": {
+					"imports": "safe-fix"
+				}
+			}
+		],
+		"import/no-cycle": "error",
+		"react/exhaustive-deps": "warn",
+		"jsx_a11y/anchor-is-valid": "off",
+		"jsx_a11y/click-events-have-key-events": "warn",
+		"jsx_a11y/label-has-associated-control": "warn",
+		"jsx_a11y/no-static-element-interactions": "warn",
+		"jsx_a11y/prefer-tag-over-role": "off"
+	}
+}

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.0-alpha.1
+
+### Changed
+
+- Tokens now persist in a `<name>:auth:tokens` localStorage entry instead of a
+  cookie, so browsers no longer attach access and refresh tokens to every
+  same-origin request. The profile remains in `<name>:auth:user`.
+- **Breaking:** the `cookieMaxAge` option is renamed `maxAge`.
+- The 3,800-character token budget is removed.
+
 ## 0.1.0-alpha.0
 
 This continues `@monarcode/tanstack-auth@0.1.0-alpha.0` with the same APIs and