@djangocfg/api 2.1.565 → 2.1.566

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/api",
-  "version": "2.1.565",
+  "version": "2.1.566",
   "description": "Auto-generated TypeScript API client with React hooks, SWR integration, and Zod validation for Django REST Framework backends",
   "keywords": [
     "django",
@@ -85,7 +85,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@djangocfg/typescript-config": "^2.1.565",
+    "@djangocfg/typescript-config": "^2.1.566",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^25.9.5",
     "@types/react": "19.2.15",

package/src/_api/generated/_cfg_accounts/schemas/OAuthAuthorizeRequestRequest.ts

@@ -5,8 +5,8 @@
 import { z } from "zod";
 
 export const OAuthAuthorizeRequestRequestSchema = z.object({
-  redirect_uri: z.string().optional(),
-  source_url: z.string().optional(),
+  redirect_uri: z.url().optional(),
+  source_url: z.url().optional(),
 });
 
 export type OAuthAuthorizeRequestRequest = z.infer<typeof OAuthAuthorizeRequestRequestSchema>;

package/src/_api/generated/_cfg_accounts/schemas/OAuthAuthorizeResponse.ts

@@ -5,7 +5,7 @@
 import { z } from "zod";
 
 export const OAuthAuthorizeResponseSchema = z.object({
-  authorization_url: z.string(),
+  authorization_url: z.url(),
   state: z.string(),
 });
 

package/src/_api/generated/_cfg_accounts/schemas/OAuthCallbackRequestRequest.ts

@@ -7,7 +7,7 @@ import { z } from "zod";
 export const OAuthCallbackRequestRequestSchema = z.object({
   code: z.string().min(10).max(500),
   state: z.string().min(20).max(100),
-  redirect_uri: z.string().optional(),
+  redirect_uri: z.url().optional(),
   remember_me: z.boolean().default(false).optional(),
 });
 

package/src/_api/generated/_cfg_accounts/schemas/OAuthConnection.ts

@@ -11,7 +11,7 @@ export const OAuthConnectionSchema = z.object({
   provider_display: z.string(),
   provider_username: z.string(),
   provider_email: z.email(),
-  provider_avatar_url: z.string(),
+  provider_avatar_url: z.url(),
   connected_at: z.string().datetime({ offset: true }),
   last_login_at: z.string().datetime({ offset: true }),
 });

package/src/_api/generated/_cfg_accounts/schemas/OTPRequestRequest.ts

@@ -6,7 +6,7 @@ import { z } from "zod";
 
 export const OTPRequestRequestSchema = z.object({
   identifier: z.string().min(1),
-  source_url: z.string().optional(),
+  source_url: z.url().optional(),
   marketing_consent: z.boolean().nullable().optional(),
   consent_disclosure_version: z.string().max(64).optional(),
 });

package/src/_api/generated/_cfg_accounts/schemas/OTPVerifyRequest.ts

@@ -7,7 +7,7 @@ import { z } from "zod";
 export const OTPVerifyRequestSchema = z.object({
   identifier: z.string().min(1),
   otp: z.string().min(4).max(4),
-  source_url: z.string().optional(),
+  source_url: z.url().optional(),
   remember_me: z.boolean().default(false).optional(),
 });
 

package/src/_api/generated/_cfg_accounts/schemas/User.ts

@@ -17,7 +17,7 @@ export const UserSchema = z.object({
   position: z.string().max(100).nullable().optional(),
   language: z.string().max(10).nullable().optional(),
   timezone: z.string().max(64).nullable().optional(),
-  avatar: z.string().nullable(),
+  avatar: z.url().nullable(),
   is_staff: z.boolean(),
   is_superuser: z.boolean(),
   date_joined: z.string().datetime({ offset: true }),

package/src/_api/generated/_cfg_accounts/schemas/WebmailLink.ts

@@ -8,7 +8,7 @@ import { WebmailLinkProviderEnumSchema } from "./WebmailLinkProviderEnum";
 export const WebmailLinkSchema = z.object({
   provider: WebmailLinkProviderEnumSchema,
   provider_name: z.string(),
-  url: z.string(),
+  url: z.url(),
   is_search: z.boolean(),
 });
 

package/src/_api/generated/_cfg_totp/schemas/TotpVerifyUser.ts

@@ -17,7 +17,7 @@ export const TotpVerifyUserSchema = z.object({
   position: z.string().max(100).nullable().optional(),
   language: z.string().max(10).nullable().optional(),
   timezone: z.string().max(64).nullable().optional(),
-  avatar: z.string().nullable(),
+  avatar: z.url().nullable(),
   is_staff: z.boolean(),
   is_superuser: z.boolean(),
   date_joined: z.string().datetime({ offset: true }),

package/src/_api/generated/helpers/auth.ts

@@ -105,11 +105,24 @@ let _storage: KVStore = backendFor(_storageMode);
 /** Detect locale from `NEXT_LOCALE` cookie or `navigator.language`. */
 function detectLocale(): string | null {
   try {
-    if (typeof document !== 'undefined') {
-      const m = document.cookie.match(/(?:^|;\s*)NEXT_LOCALE=([^;]*)/);
-      const locale = m?.[1];
-      if (locale !== undefined) return decodeURIComponent(locale);
-    }
+    // BROWSER ONLY, and `document` is what decides that.
+    //
+    // `navigator` used to be the browser test and no longer is: Node 18+
+    // defines `navigator.language`, so on a server this returned the HOST's
+    // locale — `en-US` on most machines — and every server-rendered request
+    // carried `Accept-Language: en-US` no matter which locale the page was
+    // being rendered for. A valid header stating the wrong thing, which is
+    // worse than none: nothing looks broken.
+    //
+    // A server caller that knows its locale passes it explicitly with
+    // `setLocale()`. There is nothing here to detect it FROM — the request is
+    // the framework's, not this module's.
+    if (typeof document === 'undefined') return null;
+
+    const m = document.cookie.match(/(?:^|;\s*)NEXT_LOCALE=([^;]*)/);
+    const locale = m?.[1];
+    if (locale !== undefined) return decodeURIComponent(locale);
+
     if (typeof navigator !== 'undefined' && navigator.language) {
       return navigator.language;
     }
@@ -300,9 +313,37 @@ function ensureStorageSync(): void {
  * Terminal-401 subscribers. Unlike the single `onUnauthorized` slot these
  * compose: each registration returns its own unsubscribe, so StrictMode
  * double-mounts and multiple packages can't clobber each other.
+ *
+ * THE SET LIVES ON `globalThis`, and it has to.
+ *
+ * An app that generates its own SDK gets its own compiled copy of this file,
+ * while `AuthProvider` comes from `@djangocfg/api/dist` — a second copy, with
+ * its own module scope. Tokens survive that split because both copies read the
+ * same storage keys and wake each other through `SESSION_SYNC_EVENT`; a plain
+ * module-level `Set` does not. So the app's copy raised the terminal 401 into
+ * an empty set while the provider sat subscribed to the other one, and the
+ * redirect `AuthContext` calls "the ONE exit" never fired: the cabinet kept
+ * polling a dead session and the customer watched the console fill with 401s
+ * instead of being sent to sign in. Carapis reported ten of them.
+ *
+ * Keyed by `ACCESS_KEY` for the same reason `SESSION_SYNC_EVENT` is: two
+ * stores configured against different token keys are different sessions and
+ * must not share subscribers.
  */
 type SessionExpiredHandler = (response: Response) => void;
-const _sessionExpiredHandlers = new Set<SessionExpiredHandler>();
+
+const SESSION_EXPIRED_REGISTRY = `cfg-auth:expired-handlers:${ACCESS_KEY}`;
+
+const _sessionExpiredHandlers: Set<SessionExpiredHandler> = (() => {
+  // No browser guard: Node/SSR has a `globalThis` too, the registry is
+  // per-realm either way, and a server render simply never fires.
+  const g = globalThis as Record<string, unknown>;
+  const existing = g[SESSION_EXPIRED_REGISTRY];
+  if (existing instanceof Set) return existing as Set<SessionExpiredHandler>;
+  const created = new Set<SessionExpiredHandler>();
+  g[SESSION_EXPIRED_REGISTRY] = created;
+  return created;
+})();
 
 /**
  * Captured reference to the shared Hey API client. Set exactly once by