[monarcode]

Summary

This release adds sessions kept on the server for TanStack Start, Next.js 16 and React Router framework mode. The signed-in page renders on the first response, and the refresh token never reaches the browser. It also rewrites the README, adds guides for TanStack Router and React Router, and adds an example app built with Effect and effetch.

Server rendering

• @monarcode/session-kit/server: createServerAuth keeps both tokens and the user in an encrypted httpOnly cookie (AES-256-GCM through Web Crypto, with rotatable secrets). It refreshes on the server and shares one refresh between parallel requests.
• createMirrorAuth: the browser client for that session. It starts from the session the server rendered, so there is no initializing state, and works with the hooks, the router guards, createAuthFetch and sessionBearer.
• TanStack Start: sessionHydration and loadSession in ./tanstack-start, and startJar() in ./tanstack-start/server.
• Next.js 16, App Router: nextJar and proxyJar in ./next.
• React Router framework mode: cookieJarMiddleware and routerJar in ./react-router/server.
• useMirrorAuth in ./react: one hook for every server-rendering framework. It creates the browser client and keeps it in step with the server.

Each framework has a guide in docs/ and an example app. docs/server-sessions.md covers what the three share.

Other additions

• createAuthFetch takes optional: signed out, a request is sent without Authorization instead of rejecting with UNAUTHENTICATED.
• examples/tanstack-start-spa-effetch: the TanStack Start SPA app written with Effect Schema, an effetch client with sessionBearer, one runtime, and effetch-query.

Docs

• README rewrite. It now reads from the start: why the package exists, a one-file example, how it works, a "Getting started" that needs no router, a summary of each adapter, and an "Effect and effetch" section. The reference half lists every client method, option and error code in tables, with a compiled example per topic, and ends with "Common questions".
• New guides: docs/tanstack-router.md (including layouts around guarded pages and TanStack Start in SPA mode) and docs/react-router.md (declarative, data and framework ssr: false modes).
• Other HTTP clients: the README shows axios interceptors and ky hooks built on auth.credentials.
• Header badges: tree-shakeable, provenance, and a "works with" row.
• Docs check: README excerpts marked <!-- from: docs/guide.md --> must match the guide they come from, and guides can compile against the README's Getting started files.

Breaking changes

• The @monarcode/effetch peer range is now ^0.1.0-rc.2, up from rc.1.
• AuthFetchClient now includes state. Any createAuth client still fits; a hand-written object needs state too.
• Auth.layer accepts a createMirrorAuth client, so AuthServiceClient's signIn is optional. Auth.signIn dies with INVALID_OPTIONS for a client without one.

Fixes

• Auth.signIn and Auth.updateUser call the client's methods as methods, so a class-based client keeps its this.
• The mirror client renews past a cached token that has expired.
• The session cookie is capped at two chunks.
• Refresh failures are shared across requests on the server, and Next's jars are paired.
• React Router saves a refresh begun before the response, and refuses one after it.