/**
 * In-memory token storage.
 *
 * Access token is kept in memory only (never persisted to localStorage /
 * sessionStorage) to reduce XSS exposure. The refresh token is handled by the
 * backend (HttpOnly cookie), so the client never touches it directly.
 */
let accessToken: string | null = null;

export const tokenStorage = {
  get: (): string | null => accessToken,
  set: (token: string): void => {
    accessToken = token;
  },
  clear: (): void => {
    accessToken = null;
  },
};