@clianta/sdk 1.6.6 → 1.6.8

package/dist/clianta.umd.js

@@ -1,5 +1,5 @@
 /*!
- * Clianta SDK v1.6.6
+ * Clianta SDK v1.6.8
  * (c) 2026 Clianta
  * Released under the MIT License.
  */
@@ -15,7 +15,7 @@
      * @see SDK_VERSION in core/config.ts
      */
     /** SDK Version */
-    const SDK_VERSION = '1.6.6';
+    const SDK_VERSION = '1.6.7';
     /** Default API endpoint — reads from env or falls back to localhost */
     const getDefaultApiEndpoint = () => {
         // Next.js (process.env)
@@ -2248,114 +2248,183 @@
     }
 
     /**
-     * Clianta SDK - Auto-Identify Plugin
-     * Automatically detects logged-in users by checking JWT tokens in
-     * cookies, localStorage, and sessionStorage. Works with any auth provider:
-     * Clerk, Firebase, Auth0, Supabase, NextAuth, Passport, custom JWT, etc.
+     * Clianta SDK - Auto-Identify Plugin (Production)
      *
-     * How it works:
-     * 1. On init + periodically, scans for JWT tokens
-     * 2. Decodes the JWT payload (base64, no secret needed)
-     * 3. Extracts email/name from standard JWT claims
-     * 4. Calls tracker.identify() automatically
+     * Automatically detects logged-in users across ANY auth system:
+     *   - Window globals: Clerk, Firebase, Auth0, Supabase, __clianta_user
+     *   - JWT tokens in cookies (decoded client-side)
+     *   - JSON/JWT in localStorage & sessionStorage (guarded recursive deep-scan)
+     *   - Real-time storage change detection via `storage` event
+     *   - NextAuth session probing (only when NextAuth signals detected)
+     *
+     * Production safeguards:
+     *   - No monkey-patching of window.fetch or XMLHttpRequest
+     *   - Size-limited storage scanning (skips values > 50KB)
+     *   - Depth & key-count limited recursion (max 4 levels, 20 keys/level)
+     *   - Proper email regex validation
+     *   - Exponential backoff polling (2s → 5s → 10s → 30s)
+     *   - Zero console errors from probing
+     *
+     * Works universally: Next.js, Vite, CRA, Nuxt, SvelteKit, Remix,
+     * Astro, plain HTML, Zustand, Redux, Pinia, MobX, or any custom auth.
      *
      * @see SDK_VERSION in core/config.ts
      */
-    /** Known auth cookie patterns and their JWT locations */
+    // ────────────────────────────────────────────────
+    // Constants
+    // ────────────────────────────────────────────────
+    /** Max recursion depth for JSON scanning */
+    const MAX_SCAN_DEPTH = 4;
+    /** Max object keys to inspect per recursion level */
+    const MAX_KEYS_PER_LEVEL = 20;
+    /** Max storage value size to parse (bytes) — skip large blobs */
+    const MAX_STORAGE_VALUE_SIZE = 50000;
+    /** Proper email regex — must have user@domain.tld (2+ char TLD) */
+    const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/;
+    /** Known auth cookie name patterns */
     const AUTH_COOKIE_PATTERNS = [
-        // Clerk
-        '__session',
-        '__clerk_db_jwt',
-        // NextAuth
-        'next-auth.session-token',
-        '__Secure-next-auth.session-token',
-        // Supabase
+        // Provider-specific
+        '__session', '__clerk_db_jwt',
+        'next-auth.session-token', '__Secure-next-auth.session-token',
         'sb-access-token',
-        // Auth0
         'auth0.is.authenticated',
-        // Firebase — uses localStorage, handled separately
-        // Generic patterns
-        'token',
-        'jwt',
-        'access_token',
-        'session_token',
-        'auth_token',
-        'id_token',
+        // Keycloak
+        'KEYCLOAK_SESSION', 'KEYCLOAK_IDENTITY', 'KC_RESTART',
+        // Generic
+        'token', 'jwt', 'access_token', 'session_token', 'auth_token', 'id_token',
     ];
-    /** localStorage/sessionStorage key patterns for auth tokens */
+    /** localStorage/sessionStorage key patterns */
     const STORAGE_KEY_PATTERNS = [
-        // Supabase
-        'sb-',
-        'supabase.auth.',
-        // Firebase
-        'firebase:authUser:',
-        // Auth0
-        'auth0spajs',
-        '@@auth0spajs@@',
+        // Provider-specific
+        'sb-', 'supabase.auth.', 'firebase:authUser:', 'auth0spajs', '@@auth0spajs@@',
+        // Microsoft MSAL
+        'msal.', 'msal.account',
+        // AWS Cognito / Amplify
+        'CognitoIdentityServiceProvider', 'amplify-signin-with-hostedUI',
+        // Keycloak
+        'kc-callback-',
+        // State managers
+        'persist:', '-storage',
         // Generic
-        'token',
-        'jwt',
-        'auth',
-        'user',
-        'session',
+        'token', 'jwt', 'auth', 'user', 'session', 'credential', 'account',
+    ];
+    /** JWT/user object fields containing email */
+    const EMAIL_CLAIMS = ['email', 'sub', 'preferred_username', 'user_email', 'mail', 'emailAddress', 'e_mail'];
+    /** Full name fields */
+    const NAME_CLAIMS = ['name', 'full_name', 'display_name', 'displayName'];
+    /** First name fields */
+    const FIRST_NAME_CLAIMS = ['given_name', 'first_name', 'firstName', 'fname'];
+    /** Last name fields */
+    const LAST_NAME_CLAIMS = ['family_name', 'last_name', 'lastName', 'lname'];
+    /** Polling schedule: exponential backoff (ms) */
+    const POLL_SCHEDULE = [
+        2000, // 2s — first check (auth providers need time to init)
+        5000, // 5s — second check
+        10000, // 10s
+        10000, // 10s
+        30000, // 30s — slower from here
+        30000, // 30s
+        30000, // 30s
+        60000, // 1m
+        60000, // 1m
+        60000, // 1m — stop after ~4 min total
     ];
-    /** Standard JWT claim fields for email */
-    const EMAIL_CLAIMS = ['email', 'sub', 'preferred_username', 'user_email', 'mail'];
-    const NAME_CLAIMS = ['name', 'full_name', 'display_name', 'given_name'];
-    const FIRST_NAME_CLAIMS = ['given_name', 'first_name', 'firstName'];
-    const LAST_NAME_CLAIMS = ['family_name', 'last_name', 'lastName'];
     class AutoIdentifyPlugin extends BasePlugin {
         constructor() {
             super(...arguments);
             this.name = 'autoIdentify';
-            this.checkInterval = null;
+            this.pollTimeouts = [];
             this.identifiedEmail = null;
-            this.checkCount = 0;
-            this.MAX_CHECKS = 30; // Stop checking after ~5 minutes
-            this.CHECK_INTERVAL_MS = 10000; // Check every 10 seconds
+            this.storageHandler = null;
+            this.sessionProbed = false;
         }
         init(tracker) {
             super.init(tracker);
             if (typeof window === 'undefined')
                 return;
-            // First check after 2 seconds (give auth providers time to init)
-            setTimeout(() => {
-                try {
-                    this.checkForAuthUser();
-                }
-                catch { /* silently fail */ }
-            }, 2000);
-            // Then check periodically
-            this.checkInterval = setInterval(() => {
-                this.checkCount++;
-                if (this.checkCount >= this.MAX_CHECKS) {
-                    if (this.checkInterval) {
-                        clearInterval(this.checkInterval);
-                        this.checkInterval = null;
-                    }
-                    return;
-                }
-                try {
-                    this.checkForAuthUser();
-                }
-                catch { /* silently fail */ }
-            }, this.CHECK_INTERVAL_MS);
+            // Schedule poll checks with exponential backoff
+            this.schedulePollChecks();
+            // Listen for storage changes (real-time detection of login/logout)
+            this.listenForStorageChanges();
         }
         destroy() {
-            if (this.checkInterval) {
-                clearInterval(this.checkInterval);
-                this.checkInterval = null;
+            // Clear all scheduled polls
+            for (const t of this.pollTimeouts)
+                clearTimeout(t);
+            this.pollTimeouts = [];
+            // Remove storage listener
+            if (this.storageHandler && typeof window !== 'undefined') {
+                window.removeEventListener('storage', this.storageHandler);
+                this.storageHandler = null;
             }
             super.destroy();
         }
+        // ════════════════════════════════════════════════
+        // SCHEDULING
+        // ════════════════════════════════════════════════
         /**
-         * Main check — scan all sources for auth tokens
+         * Schedule poll checks with exponential backoff.
+         * Much lighter than setInterval — each check is self-contained.
          */
+        schedulePollChecks() {
+            let cumulativeDelay = 0;
+            for (let i = 0; i < POLL_SCHEDULE.length; i++) {
+                cumulativeDelay += POLL_SCHEDULE[i];
+                const timeout = setTimeout(() => {
+                    if (this.identifiedEmail)
+                        return; // Already identified, skip
+                    try {
+                        this.checkForAuthUser();
+                    }
+                    catch { /* silently fail */ }
+                    // On the 4th check (~27s), probe NextAuth if signals detected
+                    if (i === 3 && !this.sessionProbed) {
+                        this.sessionProbed = true;
+                        this.guardedSessionProbe();
+                    }
+                }, cumulativeDelay);
+                this.pollTimeouts.push(timeout);
+            }
+        }
+        /**
+         * Listen for `storage` events — fired when another tab or the app
+         * modifies localStorage. Enables real-time detection after login.
+         */
+        listenForStorageChanges() {
+            this.storageHandler = (event) => {
+                if (this.identifiedEmail)
+                    return; // Already identified
+                if (!event.key || !event.newValue)
+                    return;
+                const keyLower = event.key.toLowerCase();
+                const isAuthKey = STORAGE_KEY_PATTERNS.some(p => keyLower.includes(p.toLowerCase()));
+                if (!isAuthKey)
+                    return;
+                // Auth-related storage changed — run a check
+                try {
+                    this.checkForAuthUser();
+                }
+                catch { /* silently fail */ }
+            };
+            window.addEventListener('storage', this.storageHandler);
+        }
+        // ════════════════════════════════════════════════
+        // MAIN CHECK — scan all sources (priority order)
+        // ════════════════════════════════════════════════
         checkForAuthUser() {
             if (!this.tracker || this.identifiedEmail)
                 return;
+            // 0. Check well-known auth provider globals (most reliable, zero overhead)
+            try {
+                const providerUser = this.checkAuthProviders();
+                if (providerUser) {
+                    this.identifyUser(providerUser);
+                    return;
+                }
+            }
+            catch { /* provider check failed */ }
+            // 1. Check cookies for JWTs
             try {
-                // 1. Check cookies for JWTs
                 const cookieUser = this.checkCookies();
                 if (cookieUser) {
                     this.identifyUser(cookieUser);
@@ -2363,8 +2432,8 @@
                 }
             }
             catch { /* cookie access blocked */ }
+            // 2. Check localStorage (guarded deep scan)
             try {
-                // 2. Check localStorage
                 if (typeof localStorage !== 'undefined') {
                     const localUser = this.checkStorage(localStorage);
                     if (localUser) {
@@ -2374,8 +2443,8 @@
                 }
             }
             catch { /* localStorage access blocked */ }
+            // 3. Check sessionStorage (guarded deep scan)
             try {
-                // 3. Check sessionStorage
                 if (typeof sessionStorage !== 'undefined') {
                     const sessionUser = this.checkStorage(sessionStorage);
                     if (sessionUser) {
@@ -2386,9 +2455,168 @@
             }
             catch { /* sessionStorage access blocked */ }
         }
-        /**
-         * Identify the user and stop checking
-         */
+        // ════════════════════════════════════════════════
+        // AUTH PROVIDER GLOBALS
+        // ════════════════════════════════════════════════
+        checkAuthProviders() {
+            const win = window;
+            // ─── Clerk ───
+            try {
+                const clerkUser = win.Clerk?.user;
+                if (clerkUser) {
+                    const email = clerkUser.primaryEmailAddress?.emailAddress
+                        || clerkUser.emailAddresses?.[0]?.emailAddress;
+                    if (email && this.isValidEmail(email)) {
+                        return {
+                            email,
+                            firstName: clerkUser.firstName || undefined,
+                            lastName: clerkUser.lastName || undefined,
+                        };
+                    }
+                }
+            }
+            catch { /* Clerk not available */ }
+            // ─── Firebase Auth ───
+            try {
+                const fbAuth = win.firebase?.auth?.();
+                const fbUser = fbAuth?.currentUser;
+                if (fbUser?.email && this.isValidEmail(fbUser.email)) {
+                    const parts = (fbUser.displayName || '').split(' ');
+                    return {
+                        email: fbUser.email,
+                        firstName: parts[0] || undefined,
+                        lastName: parts.slice(1).join(' ') || undefined,
+                    };
+                }
+            }
+            catch { /* Firebase not available */ }
+            // ─── Supabase ───
+            try {
+                const sbClient = win.__SUPABASE_CLIENT__ || win.supabase;
+                if (sbClient?.auth) {
+                    const session = sbClient.auth.session?.() || sbClient.auth.getSession?.();
+                    const user = session?.data?.session?.user || session?.user;
+                    if (user?.email && this.isValidEmail(user.email)) {
+                        const meta = user.user_metadata || {};
+                        return {
+                            email: user.email,
+                            firstName: meta.first_name || meta.full_name?.split(' ')[0] || undefined,
+                            lastName: meta.last_name || meta.full_name?.split(' ').slice(1).join(' ') || undefined,
+                        };
+                    }
+                }
+            }
+            catch { /* Supabase not available */ }
+            // ─── Auth0 SPA ───
+            try {
+                const auth0 = win.__auth0Client || win.auth0Client;
+                if (auth0?.isAuthenticated?.()) {
+                    const user = auth0.getUser?.();
+                    if (user?.email && this.isValidEmail(user.email)) {
+                        return {
+                            email: user.email,
+                            firstName: user.given_name || user.name?.split(' ')[0] || undefined,
+                            lastName: user.family_name || user.name?.split(' ').slice(1).join(' ') || undefined,
+                        };
+                    }
+                }
+            }
+            catch { /* Auth0 not available */ }
+            // ─── Google Identity Services (Google OAuth / Sign In With Google) ───
+            // GIS stores the credential JWT from the callback; also check gapi
+            try {
+                const gisCredential = win.__google_credential_response?.credential;
+                if (gisCredential && typeof gisCredential === 'string') {
+                    const user = this.extractUserFromToken(gisCredential);
+                    if (user)
+                        return user;
+                }
+                // Legacy gapi.auth2
+                const gapiUser = win.gapi?.auth2?.getAuthInstance?.()?.currentUser?.get?.();
+                const profile = gapiUser?.getBasicProfile?.();
+                if (profile) {
+                    const email = profile.getEmail?.();
+                    if (email && this.isValidEmail(email)) {
+                        return {
+                            email,
+                            firstName: profile.getGivenName?.() || undefined,
+                            lastName: profile.getFamilyName?.() || undefined,
+                        };
+                    }
+                }
+            }
+            catch { /* Google auth not available */ }
+            // ─── Microsoft MSAL (Microsoft OAuth / Azure AD) ───
+            // MSAL stores account info in window.msalInstance or PublicClientApplication
+            try {
+                const msalInstance = win.msalInstance || win.__msalInstance;
+                if (msalInstance) {
+                    const accounts = msalInstance.getAllAccounts?.() || [];
+                    const account = accounts[0];
+                    if (account?.username && this.isValidEmail(account.username)) {
+                        const nameParts = (account.name || '').split(' ');
+                        return {
+                            email: account.username,
+                            firstName: nameParts[0] || undefined,
+                            lastName: nameParts.slice(1).join(' ') || undefined,
+                        };
+                    }
+                }
+            }
+            catch { /* MSAL not available */ }
+            // ─── AWS Cognito / Amplify ───
+            try {
+                // Amplify v6+
+                const amplifyUser = win.aws_amplify_currentUser || win.__amplify_user;
+                if (amplifyUser?.signInDetails?.loginId && this.isValidEmail(amplifyUser.signInDetails.loginId)) {
+                    return {
+                        email: amplifyUser.signInDetails.loginId,
+                        firstName: amplifyUser.attributes?.given_name || undefined,
+                        lastName: amplifyUser.attributes?.family_name || undefined,
+                    };
+                }
+                // Check Cognito localStorage keys directly
+                if (typeof localStorage !== 'undefined') {
+                    const cognitoUser = this.checkCognitoStorage();
+                    if (cognitoUser)
+                        return cognitoUser;
+                }
+            }
+            catch { /* Cognito/Amplify not available */ }
+            // ─── Keycloak ───
+            try {
+                const keycloak = win.keycloak || win.Keycloak;
+                if (keycloak?.authenticated && keycloak.tokenParsed) {
+                    const claims = keycloak.tokenParsed;
+                    const email = claims.email || claims.preferred_username;
+                    if (email && this.isValidEmail(email)) {
+                        return {
+                            email,
+                            firstName: claims.given_name || undefined,
+                            lastName: claims.family_name || undefined,
+                        };
+                    }
+                }
+            }
+            catch { /* Keycloak not available */ }
+            // ─── Global clianta identify hook ───
+            // Any auth system can set: window.__clianta_user = { email, firstName, lastName }
+            try {
+                const manualUser = win.__clianta_user;
+                if (manualUser?.email && typeof manualUser.email === 'string' && this.isValidEmail(manualUser.email)) {
+                    return {
+                        email: manualUser.email,
+                        firstName: manualUser.firstName || undefined,
+                        lastName: manualUser.lastName || undefined,
+                    };
+                }
+            }
+            catch { /* manual user not set */ }
+            return null;
+        }
+        // ════════════════════════════════════════════════
+        // IDENTIFY USER
+        // ════════════════════════════════════════════════
         identifyUser(user) {
             if (!this.tracker || this.identifiedEmail === user.email)
                 return;
@@ -2397,15 +2625,14 @@
                 firstName: user.firstName,
                 lastName: user.lastName,
             });
-            // Stop interval — we found the user
-            if (this.checkInterval) {
-                clearInterval(this.checkInterval);
-                this.checkInterval = null;
-            }
-        }
-        /**
-         * Scan cookies for JWT tokens
-         */
+            // Cancel all remaining polls — we found the user
+            for (const t of this.pollTimeouts)
+                clearTimeout(t);
+            this.pollTimeouts = [];
+        }
+        // ════════════════════════════════════════════════
+        // COOKIE SCANNING
+        // ════════════════════════════════════════════════
         checkCookies() {
             if (typeof document === 'undefined')
                 return null;
@@ -2415,7 +2642,6 @@
                     const [name, ...valueParts] = cookie.split('=');
                     const value = valueParts.join('=');
                     const cookieName = name.trim().toLowerCase();
-                    // Check if this cookie matches known auth patterns
                     const isAuthCookie = AUTH_COOKIE_PATTERNS.some(pattern => cookieName.includes(pattern.toLowerCase()));
                     if (isAuthCookie && value) {
                         const user = this.extractUserFromToken(decodeURIComponent(value));
@@ -2425,13 +2651,13 @@
                 }
             }
             catch {
-                // Cookie access may fail in some environments
+                // Cookie access may fail (cross-origin iframe, etc.)
             }
             return null;
         }
-        /**
-         * Scan localStorage or sessionStorage for auth tokens
-         */
+        // ════════════════════════════════════════════════
+        // STORAGE SCANNING (GUARDED DEEP RECURSIVE)
+        // ════════════════════════════════════════════════
         checkStorage(storage) {
             try {
                 for (let i = 0; i < storage.length; i++) {
@@ -2444,16 +2670,19 @@
                         const value = storage.getItem(key);
                         if (!value)
                             continue;
+                        // Size guard — skip values larger than 50KB
+                        if (value.length > MAX_STORAGE_VALUE_SIZE)
+                            continue;
                         // Try as direct JWT
                         const user = this.extractUserFromToken(value);
                         if (user)
                             return user;
-                        // Try as JSON containing a token
+                        // Try as JSON — guarded deep recursive scan
                         try {
                             const json = JSON.parse(value);
-                            const user = this.extractUserFromJson(json);
-                            if (user)
-                                return user;
+                            const jsonUser = this.deepScanForUser(json, 0);
+                            if (jsonUser)
+                                return jsonUser;
                         }
                         catch {
                             // Not JSON, skip
@@ -2466,11 +2695,63 @@
             }
             return null;
         }
+        // ════════════════════════════════════════════════
+        // DEEP RECURSIVE SCANNING (guarded)
+        // ════════════════════════════════════════════════
         /**
-         * Try to extract user info from a JWT token string
+         * Recursively scan a JSON object for user data.
+         * Guards: max depth (4), max keys per level (20), no array traversal.
+         *
+         * Handles ANY nesting pattern:
+         *   - Zustand persist: { state: { user: { email } } }
+         *   - Redux persist:   { auth: { user: { email } } }
+         *   - Pinia:           { auth: { userData: { email } } }
+         *   - NextAuth:        { user: { email }, expires: ... }
+         *   - Direct:          { email, name }
+         */
+        deepScanForUser(data, depth) {
+            if (depth > MAX_SCAN_DEPTH || !data || typeof data !== 'object' || Array.isArray(data)) {
+                return null;
+            }
+            const obj = data;
+            const keys = Object.keys(obj);
+            // 1. Try direct extraction at this level
+            const user = this.extractUserFromClaims(obj);
+            if (user)
+                return user;
+            // Guard: limit keys scanned per level
+            const keysToScan = keys.slice(0, MAX_KEYS_PER_LEVEL);
+            // 2. Check for JWT strings at this level
+            for (const key of keysToScan) {
+                const val = obj[key];
+                if (typeof val === 'string' && val.length > 30 && val.length < 4000) {
+                    // Only check strings that could plausibly be JWTs (30-4000 chars)
+                    const dotCount = (val.match(/\./g) || []).length;
+                    if (dotCount === 2) {
+                        const tokenUser = this.extractUserFromToken(val);
+                        if (tokenUser)
+                            return tokenUser;
+                    }
+                }
+            }
+            // 3. Recurse into nested objects
+            for (const key of keysToScan) {
+                const val = obj[key];
+                if (val && typeof val === 'object' && !Array.isArray(val)) {
+                    const nestedUser = this.deepScanForUser(val, depth + 1);
+                    if (nestedUser)
+                        return nestedUser;
+                }
+            }
+            return null;
+        }
+        // ════════════════════════════════════════════════
+        // TOKEN & CLAIMS EXTRACTION
+        // ════════════════════════════════════════════════
+        /**
+         * Try to extract user info from a JWT token string (header.payload.signature)
          */
         extractUserFromToken(token) {
-            // JWT format: header.payload.signature
             const parts = token.split('.');
             if (parts.length !== 3)
                 return null;
@@ -2483,48 +2764,29 @@
             }
         }
         /**
-         * Extract user info from a JSON object (e.g., Firebase auth user stored in localStorage)
-         */
-        extractUserFromJson(data) {
-            if (!data || typeof data !== 'object')
-                return null;
-            // Direct user object
-            const user = this.extractUserFromClaims(data);
-            if (user)
-                return user;
-            // Nested: { user: { email } } or { data: { user: { email } } }
-            for (const key of ['user', 'data', 'session', 'currentUser', 'authUser', 'access_token', 'token']) {
-                if (data[key]) {
-                    if (typeof data[key] === 'string') {
-                        // Might be a JWT inside JSON
-                        const tokenUser = this.extractUserFromToken(data[key]);
-                        if (tokenUser)
-                            return tokenUser;
-                    }
-                    else if (typeof data[key] === 'object') {
-                        const nestedUser = this.extractUserFromClaims(data[key]);
-                        if (nestedUser)
-                            return nestedUser;
-                    }
-                }
-            }
-            return null;
-        }
-        /**
-         * Extract user from JWT claims or user object
+         * Extract user from JWT claims or user-like object.
+         * Uses proper email regex validation.
          */
         extractUserFromClaims(claims) {
             if (!claims || typeof claims !== 'object')
                 return null;
-            // Find email
+            // Find email — check standard claim fields
             let email = null;
             for (const claim of EMAIL_CLAIMS) {
                 const value = claims[claim];
-                if (value && typeof value === 'string' && value.includes('@') && value.includes('.')) {
+                if (value && typeof value === 'string' && this.isValidEmail(value)) {
                     email = value;
                     break;
                 }
             }
+            // Check nested email objects (Clerk pattern)
+            if (!email) {
+                const nestedEmail = claims.primaryEmailAddress?.emailAddress
+                    || claims.emailAddresses?.[0]?.emailAddress;
+                if (nestedEmail && typeof nestedEmail === 'string' && this.isValidEmail(nestedEmail)) {
+                    email = nestedEmail;
+                }
+            }
             if (!email)
                 return null;
             // Find name
@@ -2542,7 +2804,7 @@
                     break;
                 }
             }
-            // If no first/last name, try full name
+            // Try full name if no first/last found
             if (!firstName) {
                 for (const claim of NAME_CLAIMS) {
                     if (claims[claim] && typeof claims[claim] === 'string') {
@@ -2555,6 +2817,117 @@
             }
             return { email, firstName, lastName };
         }
+        // ════════════════════════════════════════════════
+        // GUARDED SESSION PROBING (NextAuth only)
+        // ════════════════════════════════════════════════
+        /**
+         * Probe NextAuth session endpoint ONLY if NextAuth signals are present.
+         * Signals: `next-auth.session-token` cookie, `__NEXTAUTH` or `__NEXT_DATA__` globals.
+         * This prevents unnecessary 404 errors on non-NextAuth sites.
+         */
+        async guardedSessionProbe() {
+            if (this.identifiedEmail)
+                return;
+            // Check for NextAuth signals before probing
+            const hasNextAuthCookie = typeof document !== 'undefined' &&
+                (document.cookie.includes('next-auth.session-token') ||
+                    document.cookie.includes('__Secure-next-auth.session-token'));
+            const hasNextAuthGlobal = typeof window !== 'undefined' &&
+                (window.__NEXTAUTH != null || window.__NEXT_DATA__ != null);
+            if (!hasNextAuthCookie && !hasNextAuthGlobal)
+                return;
+            // NextAuth detected — safe to probe /api/auth/session
+            try {
+                const response = await fetch('/api/auth/session', {
+                    method: 'GET',
+                    credentials: 'include',
+                    headers: { 'Accept': 'application/json' },
+                });
+                if (response.ok) {
+                    const body = await response.json();
+                    // NextAuth returns { user: { name, email, image }, expires }
+                    if (body && typeof body === 'object' && Object.keys(body).length > 0) {
+                        const user = this.deepScanForUser(body, 0);
+                        if (user) {
+                            this.identifyUser(user);
+                        }
+                    }
+                }
+            }
+            catch {
+                // Endpoint failed — silently ignore
+            }
+        }
+        // ════════════════════════════════════════════════
+        // AWS COGNITO STORAGE SCANNING
+        // ════════════════════════════════════════════════
+        /**
+         * Scan localStorage for AWS Cognito / Amplify user data.
+         * Cognito stores tokens under keys like:
+         *   CognitoIdentityServiceProvider.<clientId>.<username>.idToken
+         *   CognitoIdentityServiceProvider.<clientId>.<username>.userData
+         */
+        checkCognitoStorage() {
+            try {
+                for (let i = 0; i < localStorage.length; i++) {
+                    const key = localStorage.key(i);
+                    if (!key)
+                        continue;
+                    // Look for Cognito ID tokens (contain email in JWT claims)
+                    if (key.startsWith('CognitoIdentityServiceProvider.') && key.endsWith('.idToken')) {
+                        const value = localStorage.getItem(key);
+                        if (value && value.length < MAX_STORAGE_VALUE_SIZE) {
+                            const user = this.extractUserFromToken(value);
+                            if (user)
+                                return user;
+                        }
+                    }
+                    // Look for Cognito userData (JSON with email attribute)
+                    if (key.startsWith('CognitoIdentityServiceProvider.') && key.endsWith('.userData')) {
+                        const value = localStorage.getItem(key);
+                        if (value && value.length < MAX_STORAGE_VALUE_SIZE) {
+                            try {
+                                const data = JSON.parse(value);
+                                // Cognito userData format: { UserAttributes: [{ Name: 'email', Value: '...' }] }
+                                const attrs = data.UserAttributes || data.attributes || [];
+                                const emailAttr = attrs.find?.((a) => a.Name === 'email' || a.name === 'email');
+                                if (emailAttr?.Value && this.isValidEmail(emailAttr.Value)) {
+                                    const nameAttr = attrs.find?.((a) => a.Name === 'name' || a.name === 'name');
+                                    const givenNameAttr = attrs.find?.((a) => a.Name === 'given_name' || a.name === 'given_name');
+                                    const familyNameAttr = attrs.find?.((a) => a.Name === 'family_name' || a.name === 'family_name');
+                                    let firstName = givenNameAttr?.Value;
+                                    let lastName = familyNameAttr?.Value;
+                                    if (!firstName && nameAttr?.Value) {
+                                        const parts = nameAttr.Value.split(' ');
+                                        firstName = parts[0];
+                                        lastName = lastName || parts.slice(1).join(' ') || undefined;
+                                    }
+                                    return {
+                                        email: emailAttr.Value,
+                                        firstName: firstName || undefined,
+                                        lastName: lastName || undefined,
+                                    };
+                                }
+                            }
+                            catch { /* invalid JSON */ }
+                        }
+                    }
+                }
+            }
+            catch { /* storage access failed */ }
+            return null;
+        }
+        // ════════════════════════════════════════════════
+        // UTILITIES
+        // ════════════════════════════════════════════════
+        /**
+         * Validate email with proper regex.
+         * Rejects: user@v2.0, config@internal, tokens with @ signs.
+         * Accepts: user@domain.com, user@sub.domain.co.uk
+         */
+        isValidEmail(value) {
+            return EMAIL_REGEX.test(value);
+        }
     }
 
     /**