@djangocfg/api 2.1.565 → 2.1.567

package/dist/index.d.cts

@@ -23,6 +23,22 @@ type SessionSnapshot = {
  * Terminal-401 subscribers. Unlike the single `onUnauthorized` slot these
  * compose: each registration returns its own unsubscribe, so StrictMode
  * double-mounts and multiple packages can't clobber each other.
+ *
+ * THE SET LIVES ON `globalThis`, and it has to.
+ *
+ * An app that generates its own SDK gets its own compiled copy of this file,
+ * while `AuthProvider` comes from `@djangocfg/api/dist` — a second copy, with
+ * its own module scope. Tokens survive that split because both copies read the
+ * same storage keys and wake each other through `SESSION_SYNC_EVENT`; a plain
+ * module-level `Set` does not. So the app's copy raised the terminal 401 into
+ * an empty set while the provider sat subscribed to the other one, and the
+ * redirect `AuthContext` calls "the ONE exit" never fired: the cabinet kept
+ * polling a dead session and the customer watched the console fill with 401s
+ * instead of being sent to sign in. Carapis reported ten of them.
+ *
+ * Keyed by `ACCESS_KEY` for the same reason `SESSION_SYNC_EVENT` is: two
+ * stores configured against different token keys are different sessions and
+ * must not share subscribers.
  */
 type SessionExpiredHandler = (response: Response) => void;
 /**

package/dist/index.d.ts

@@ -23,6 +23,22 @@ type SessionSnapshot = {
  * Terminal-401 subscribers. Unlike the single `onUnauthorized` slot these
  * compose: each registration returns its own unsubscribe, so StrictMode
  * double-mounts and multiple packages can't clobber each other.
+ *
+ * THE SET LIVES ON `globalThis`, and it has to.
+ *
+ * An app that generates its own SDK gets its own compiled copy of this file,
+ * while `AuthProvider` comes from `@djangocfg/api/dist` — a second copy, with
+ * its own module scope. Tokens survive that split because both copies read the
+ * same storage keys and wake each other through `SESSION_SYNC_EVENT`; a plain
+ * module-level `Set` does not. So the app's copy raised the terminal 401 into
+ * an empty set while the provider sat subscribed to the other one, and the
+ * redirect `AuthContext` calls "the ONE exit" never fired: the cabinet kept
+ * polling a dead session and the customer watched the console fill with 401s
+ * instead of being sent to sign in. Carapis reported ten of them.
+ *
+ * Keyed by `ACCESS_KEY` for the same reason `SESSION_SYNC_EVENT` is: two
+ * stores configured against different token keys are different sessions and
+ * must not share subscribers.
  */
 type SessionExpiredHandler = (response: Response) => void;
 /**

package/dist/index.mjs

@@ -155,11 +155,10 @@ var _storageMode = "localStorage";
 var _storage = backendFor(_storageMode);
 function detectLocale() {
   try {
-    if (typeof document !== "undefined") {
-      const m = document.cookie.match(/(?:^|;\s*)NEXT_LOCALE=([^;]*)/);
-      const locale = m?.[1];
-      if (locale !== void 0) return decodeURIComponent(locale);
-    }
+    if (typeof document === "undefined") return null;
+    const m = document.cookie.match(/(?:^|;\s*)NEXT_LOCALE=([^;]*)/);
+    const locale = m?.[1];
+    if (locale !== void 0) return decodeURIComponent(locale);
     if (typeof navigator !== "undefined" && navigator.language) {
       return navigator.language;
     }
@@ -291,7 +290,15 @@ function ensureStorageSync() {
   window.addEventListener(SESSION_SYNC_EVENT, () => notifySessionChanged());
 }
 __name(ensureStorageSync, "ensureStorageSync");
-var _sessionExpiredHandlers = /* @__PURE__ */ new Set();
+var SESSION_EXPIRED_REGISTRY = `cfg-auth:expired-handlers:${ACCESS_KEY}`;
+var _sessionExpiredHandlers = (() => {
+  const g = globalThis;
+  const existing = g[SESSION_EXPIRED_REGISTRY];
+  if (existing instanceof Set) return existing;
+  const created = /* @__PURE__ */ new Set();
+  g[SESSION_EXPIRED_REGISTRY] = created;
+  return created;
+})();
 var _client = null;
 function pushClientConfig() {
   if (!_client) return;