Patch Changes
- b50c966: Expired sessions are detected whatever the transport, and handled once (#1905, from a consumer incident).
auth:expiredwas emitted only by the kernel's axios interceptor, so an app usingSdkStoragewith its own fetch-based client never detected expiry at all — the screen kept requesting with a dead token and stacked one error toast per attempt.EntityManagernow announces a 401 from any storage call, which coversApiStorage,MockApiStorage,SdkStorageand custom adapters alike. The handler runs once per session: it logs out, emitsauth:logout— which remounts the app — and redirects, so a page firing four requests that all 401 used to do that four times; the guard re-arms on the nextauth:loginand does not read your auth state, so emitting after clearing your own session still redirects. The axios interceptor no longer treats a 403 as an expired session: a 403 says the session is valid and this door is closed, and logging the user out sent them to sign in again for a permission they would not have afterwards — a loop, not an error; permission refusals stayapi:error. Finally,kernel.signalsis available from construction instead ofnulluntilcreateApp(), since wiring it right afternew Kernel()is the natural place andnull?.emit?.()fails silently.