initial

src/api/tokenStorage.ts

@@ -0,0 +1,18 @@
+/**
+ * In-memory token storage.
+ *
+ * Access token is kept in memory only (never persisted to localStorage /
+ * sessionStorage) to reduce XSS exposure. The refresh token is handled by the
+ * backend (HttpOnly cookie), so the client never touches it directly.
+ */
+let accessToken: string | null = null;
+
+export const tokenStorage = {
+  get: (): string | null => accessToken,
+  set: (token: string): void => {
+    accessToken = token;
+  },
+  clear: (): void => {
+    accessToken = null;
+  },
+};