@djangocfg/api 2.1.449 → 2.1.452

package/dist/auth.d.cts

@@ -634,7 +634,9 @@ interface UseAutoAuthOptions {
 }
 /**
  * Hook for automatic authentication from URL query parameters
- * Detects OTP from URL and triggers callback
+ * Detects OTP from URL and triggers callback.
+ * (Path normalization / allow-list matching live in ../utils/path so they can
+ * be unit-tested independently of the hook.)
  */
 declare const useAutoAuth: (options?: UseAutoAuthOptions) => {
     isReady: boolean;
@@ -951,6 +953,8 @@ interface UseTokenRefreshOptions {
 }
 /**
  * Hook for proactive automatic token refresh.
+ * (JWT expiry helpers live in ../utils/jwt so they can be unit-tested and
+ * reused by the auth-bootstrap validation path.)
  */
 declare function useTokenRefresh(options?: UseTokenRefreshOptions): {
     refreshToken: () => Promise<boolean>;
@@ -1002,6 +1006,107 @@ declare const validateEmail: (email: string) => boolean;
  */
 declare const formatAuthError: (error: any) => string;
 
+/**
+ * Pure auth-guard state resolution.
+ *
+ * This is the decision that produced the "stuck on Authenticating…" bug: given
+ * the auth state, should the UI show a preloader, redirect to login, or render
+ * the protected content? Extracted from useAuthGuard (which lives in a package
+ * with no test infra) so the branching can be unit-tested in isolation — the
+ * hook just wires React state (mounted / isRedirecting) into these functions.
+ *
+ * Invariant that fixes the bug: once auth is resolved (`authLoading === false`)
+ * and the user is unauthenticated, `isLoading` must become false so the guard
+ * redirects to the form instead of spinning forever.
+ */
+interface GuardInput {
+    /** First client render matches SSR (preloader) until mounted, to avoid hydration mismatch. */
+    mounted: boolean;
+    /** Whether this route requires authentication. */
+    requireAuth: boolean;
+    /** AuthContext still resolving initial state. */
+    authLoading: boolean;
+    /** A redirect to the auth page is in flight. */
+    isRedirecting: boolean;
+    /** User currently has a (valid-looking) session. */
+    isAuthenticated: boolean;
+}
+/**
+ * True while the guard should render a preloader rather than the protected
+ * content. Mirrors useAuthGuard's formula exactly.
+ */
+declare function resolveGuardIsLoading(s: GuardInput): boolean;
+/**
+ * Whether the guard should trigger a redirect to the auth page. Only once
+ * mounted, on a protected route, after auth resolved, when unauthenticated and
+ * not already redirecting. This is the branch that must fire for a dead session.
+ */
+declare function shouldRedirectToAuth(s: GuardInput): boolean;
+/** The effective authenticated flag the guard exposes to consumers. */
+declare function resolveGuardIsAuthenticated(s: Pick<GuardInput, 'requireAuth' | 'isAuthenticated'>): boolean;
+/**
+ * Delay (ms from `now`) until `isAuthenticated` should next be re-evaluated,
+ * given the access/refresh expiry timestamps (ms epoch, or null if absent).
+ *
+ * `isAuthenticated` is derived from token `exp`, so it can change with no event
+ * to trigger a recompute — a tab left open silently crosses an expiry boundary.
+ * We schedule a wake-up at the SOONEST future expiry (the next moment the answer
+ * could flip), plus a 1s cushion so we re-check strictly after the inclusive
+ * boundary. Returns null when nothing live remains to expire (no timer needed).
+ * Callers should clamp the result to the platform setTimeout ceiling.
+ */
+declare function nextAuthEvaluationDelay(accessExp: number | null, refreshExp: number | null, now: number): number | null;
+
+/**
+ * JWT inspection helpers (browser-safe, dependency-free).
+ *
+ * These decode ONLY the `exp` claim to reason about token freshness on the
+ * client. They do NOT verify the signature — that is the server's job. The
+ * point is purely to avoid firing doomed requests with a token we can already
+ * see is malformed or expired, and to let auth bootstrap collapse a dead
+ * session to the login form instead of hanging on a preloader.
+ *
+ * A JWT that cannot be decoded is treated as EXPIRED/invalid (fail-closed):
+ * better to re-authenticate than to loop on 401s with garbage in storage.
+ */
+/**
+ * Extract the `exp` claim (epoch ms), or null if the token is undecodable or
+ * has no numeric `exp`.
+ */
+declare function getTokenExpiry(token: string | null | undefined): number | null;
+/**
+ * True when the token is missing, malformed, or already past its `exp`.
+ * `skewMs` treats a token expiring within the skew window as already expired
+ * (default 0). Fail-closed: an undecodable token is considered expired.
+ */
+declare function isTokenExpired(token: string | null | undefined, skewMs?: number, now?: number): boolean;
+/**
+ * True when a valid token exists but expires within `thresholdMs` (used by the
+ * proactive refresher). A missing/undecodable token returns false here — that
+ * case is handled by the "expired" path, not the "expiring soon" path.
+ */
+declare function isTokenExpiringSoon(token: string | null | undefined, thresholdMs: number, now?: number): boolean;
+
+/**
+ * Path normalization for auth routing.
+ *
+ * next-intl may keep a 2-letter locale prefix in the URL (e.g. `/ru/auth`), and
+ * paths arrive with or without trailing slashes. To match a pathname against a
+ * fixed allow-list (like `['/auth']`) reliably, strip the locale segment and
+ * trailing slashes first. Extracted from useAutoAuth so it can be unit-tested
+ * and reused.
+ */
+/**
+ * Strip a leading 2-letter locale segment and trailing slashes.
+ * '/ru/auth/' → '/auth', '/auth' → '/auth', '/' → '/', '' → ''.
+ */
+declare const normalizePath: (path: string | null | undefined) => string;
+/**
+ * True when `pathname` (after locale/slash normalization) is one of the allowed
+ * paths, or nested under one of them (`/auth` matches `/auth/callback`).
+ */
+declare const isAllowedAuthPath: (pathname: string | null | undefined, allowedPaths: string[]) => boolean;
+
 declare const logger: consola.ConsolaInstance;
 /**
  * Auth-specific logger
@@ -1051,4 +1156,4 @@ declare const Analytics: {
     setUser(userId: string): void;
 };
 
-export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type OTPRequestResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, logger, setCachedProfile, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthGuard, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSessionStorage, useTokenRefresh, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, getTokenExpiry, hasValidCache, isAllowedAuthPath, isTokenExpired, isTokenExpiringSoon, logger, nextAuthEvaluationDelay, normalizePath, resolveGuardIsAuthenticated, resolveGuardIsLoading, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthGuard, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSessionStorage, useTokenRefresh, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, validateEmail, validateIdentifier };

package/dist/auth.d.ts

@@ -634,7 +634,9 @@ interface UseAutoAuthOptions {
 }
 /**
  * Hook for automatic authentication from URL query parameters
- * Detects OTP from URL and triggers callback
+ * Detects OTP from URL and triggers callback.
+ * (Path normalization / allow-list matching live in ../utils/path so they can
+ * be unit-tested independently of the hook.)
  */
 declare const useAutoAuth: (options?: UseAutoAuthOptions) => {
     isReady: boolean;
@@ -951,6 +953,8 @@ interface UseTokenRefreshOptions {
 }
 /**
  * Hook for proactive automatic token refresh.
+ * (JWT expiry helpers live in ../utils/jwt so they can be unit-tested and
+ * reused by the auth-bootstrap validation path.)
  */
 declare function useTokenRefresh(options?: UseTokenRefreshOptions): {
     refreshToken: () => Promise<boolean>;
@@ -1002,6 +1006,107 @@ declare const validateEmail: (email: string) => boolean;
  */
 declare const formatAuthError: (error: any) => string;
 
+/**
+ * Pure auth-guard state resolution.
+ *
+ * This is the decision that produced the "stuck on Authenticating…" bug: given
+ * the auth state, should the UI show a preloader, redirect to login, or render
+ * the protected content? Extracted from useAuthGuard (which lives in a package
+ * with no test infra) so the branching can be unit-tested in isolation — the
+ * hook just wires React state (mounted / isRedirecting) into these functions.
+ *
+ * Invariant that fixes the bug: once auth is resolved (`authLoading === false`)
+ * and the user is unauthenticated, `isLoading` must become false so the guard
+ * redirects to the form instead of spinning forever.
+ */
+interface GuardInput {
+    /** First client render matches SSR (preloader) until mounted, to avoid hydration mismatch. */
+    mounted: boolean;
+    /** Whether this route requires authentication. */
+    requireAuth: boolean;
+    /** AuthContext still resolving initial state. */
+    authLoading: boolean;
+    /** A redirect to the auth page is in flight. */
+    isRedirecting: boolean;
+    /** User currently has a (valid-looking) session. */
+    isAuthenticated: boolean;
+}
+/**
+ * True while the guard should render a preloader rather than the protected
+ * content. Mirrors useAuthGuard's formula exactly.
+ */
+declare function resolveGuardIsLoading(s: GuardInput): boolean;
+/**
+ * Whether the guard should trigger a redirect to the auth page. Only once
+ * mounted, on a protected route, after auth resolved, when unauthenticated and
+ * not already redirecting. This is the branch that must fire for a dead session.
+ */
+declare function shouldRedirectToAuth(s: GuardInput): boolean;
+/** The effective authenticated flag the guard exposes to consumers. */
+declare function resolveGuardIsAuthenticated(s: Pick<GuardInput, 'requireAuth' | 'isAuthenticated'>): boolean;
+/**
+ * Delay (ms from `now`) until `isAuthenticated` should next be re-evaluated,
+ * given the access/refresh expiry timestamps (ms epoch, or null if absent).
+ *
+ * `isAuthenticated` is derived from token `exp`, so it can change with no event
+ * to trigger a recompute — a tab left open silently crosses an expiry boundary.
+ * We schedule a wake-up at the SOONEST future expiry (the next moment the answer
+ * could flip), plus a 1s cushion so we re-check strictly after the inclusive
+ * boundary. Returns null when nothing live remains to expire (no timer needed).
+ * Callers should clamp the result to the platform setTimeout ceiling.
+ */
+declare function nextAuthEvaluationDelay(accessExp: number | null, refreshExp: number | null, now: number): number | null;
+
+/**
+ * JWT inspection helpers (browser-safe, dependency-free).
+ *
+ * These decode ONLY the `exp` claim to reason about token freshness on the
+ * client. They do NOT verify the signature — that is the server's job. The
+ * point is purely to avoid firing doomed requests with a token we can already
+ * see is malformed or expired, and to let auth bootstrap collapse a dead
+ * session to the login form instead of hanging on a preloader.
+ *
+ * A JWT that cannot be decoded is treated as EXPIRED/invalid (fail-closed):
+ * better to re-authenticate than to loop on 401s with garbage in storage.
+ */
+/**
+ * Extract the `exp` claim (epoch ms), or null if the token is undecodable or
+ * has no numeric `exp`.
+ */
+declare function getTokenExpiry(token: string | null | undefined): number | null;
+/**
+ * True when the token is missing, malformed, or already past its `exp`.
+ * `skewMs` treats a token expiring within the skew window as already expired
+ * (default 0). Fail-closed: an undecodable token is considered expired.
+ */
+declare function isTokenExpired(token: string | null | undefined, skewMs?: number, now?: number): boolean;
+/**
+ * True when a valid token exists but expires within `thresholdMs` (used by the
+ * proactive refresher). A missing/undecodable token returns false here — that
+ * case is handled by the "expired" path, not the "expiring soon" path.
+ */
+declare function isTokenExpiringSoon(token: string | null | undefined, thresholdMs: number, now?: number): boolean;
+
+/**
+ * Path normalization for auth routing.
+ *
+ * next-intl may keep a 2-letter locale prefix in the URL (e.g. `/ru/auth`), and
+ * paths arrive with or without trailing slashes. To match a pathname against a
+ * fixed allow-list (like `['/auth']`) reliably, strip the locale segment and
+ * trailing slashes first. Extracted from useAutoAuth so it can be unit-tested
+ * and reused.
+ */
+/**
+ * Strip a leading 2-letter locale segment and trailing slashes.
+ * '/ru/auth/' → '/auth', '/auth' → '/auth', '/' → '/', '' → ''.
+ */
+declare const normalizePath: (path: string | null | undefined) => string;
+/**
+ * True when `pathname` (after locale/slash normalization) is one of the allowed
+ * paths, or nested under one of them (`/auth` matches `/auth/callback`).
+ */
+declare const isAllowedAuthPath: (pathname: string | null | undefined, allowedPaths: string[]) => boolean;
+
 declare const logger: consola.ConsolaInstance;
 /**
  * Auth-specific logger
@@ -1051,4 +1156,4 @@ declare const Analytics: {
     setUser(userId: string): void;
 };
 
-export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type OTPRequestResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, logger, setCachedProfile, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthGuard, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSessionStorage, useTokenRefresh, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, getTokenExpiry, hasValidCache, isAllowedAuthPath, isTokenExpired, isTokenExpiringSoon, logger, nextAuthEvaluationDelay, normalizePath, resolveGuardIsAuthenticated, resolveGuardIsLoading, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthGuard, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSessionStorage, useTokenRefresh, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, validateEmail, validateIdentifier };

package/dist/auth.mjs

@@ -286,21 +286,28 @@ var authLogger = logger.withTag("auth");
 // src/auth/hooks/useAutoAuth.ts
 import { usePathname as usePathname2 } from "next/navigation";
 import { useEffect as useEffect3, useRef as useRef3 } from "react";
+
+// src/auth/utils/path.ts
 var normalizePath = /* @__PURE__ */ __name((path) => {
   if (!path) return "";
   const withoutLocale = path.replace(/^\/[a-z]{2}(?=\/|$)/, "");
   const trimmed = withoutLocale.replace(/\/+$/, "");
   return trimmed || "/";
 }, "normalizePath");
+var isAllowedAuthPath = /* @__PURE__ */ __name((pathname, allowedPaths) => {
+  const normalized = normalizePath(pathname);
+  return allowedPaths.some(
+    (p) => normalized === p || normalized.startsWith(p + "/")
+  );
+}, "isAllowedAuthPath");
+
+// src/auth/hooks/useAutoAuth.ts
 var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
   const { onOTPDetected, cleanupUrl = true, allowedPaths = ["/auth"] } = options;
   const queryParams = useQueryParams();
   const pathname = usePathname2();
   const router = useCfgRouter();
-  const normalizedPath = normalizePath(pathname);
-  const isAllowedPath = allowedPaths.some(
-    (path) => normalizedPath === path || normalizedPath.startsWith(path + "/")
-  );
+  const isAllowedPath = isAllowedAuthPath(pathname, allowedPaths);
   const queryOtp = queryParams.get("otp") || "";
   const queryEmail = queryParams.get("email") || void 0;
   const hasOTP = !!queryOtp;
@@ -3802,24 +3809,45 @@ function triggerRefresh() {
 }
 __name(triggerRefresh, "triggerRefresh");
 
-// src/auth/hooks/useTokenRefresh.ts
-var TOKEN_REFRESH_THRESHOLD_MS = 10 * 60 * 1e3;
-var CHECK_INTERVAL_MS = 5 * 60 * 1e3;
-function getTokenExpiry(token) {
+// src/auth/utils/jwt.ts
+function decodeSegment(segment) {
   try {
-    const payload = JSON.parse(atob(token.split(".")[1]));
-    return payload.exp * 1e3;
+    const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+    if (typeof atob !== "function") return null;
+    const json = atob(base64);
+    return JSON.parse(json);
   } catch {
     return null;
   }
 }
+__name(decodeSegment, "decodeSegment");
+function getTokenExpiry(token) {
+  if (!token || typeof token !== "string") return null;
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const payload = decodeSegment(parts[1]);
+  if (!payload || typeof payload !== "object") return null;
+  const exp = payload.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+  return exp * 1e3;
+}
 __name(getTokenExpiry, "getTokenExpiry");
-function isTokenExpiringSoon(token, thresholdMs) {
+function isTokenExpired(token, skewMs = 0, now = Date.now()) {
+  const expiry = getTokenExpiry(token);
+  if (expiry === null) return true;
+  return expiry - skewMs <= now;
+}
+__name(isTokenExpired, "isTokenExpired");
+function isTokenExpiringSoon(token, thresholdMs, now = Date.now()) {
   const expiry = getTokenExpiry(token);
-  if (!expiry) return false;
-  return expiry - Date.now() < thresholdMs;
+  if (expiry === null) return false;
+  return expiry - now < thresholdMs;
 }
 __name(isTokenExpiringSoon, "isTokenExpiringSoon");
+
+// src/auth/hooks/useTokenRefresh.ts
+var TOKEN_REFRESH_THRESHOLD_MS = 10 * 60 * 1e3;
+var CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function useTokenRefresh(options = {}) {
   const { enabled = true, onRefresh, onRefreshError } = options;
   const refreshToken = useCallback9(async () => {
@@ -3919,6 +3947,30 @@ var useDeleteAccount = /* @__PURE__ */ __name(() => {
   };
 }, "useDeleteAccount");
 
+// src/auth/utils/guard.ts
+function resolveGuardIsLoading(s) {
+  if (!s.mounted) return true;
+  if (!s.requireAuth) return false;
+  return s.authLoading || s.isRedirecting || !s.isAuthenticated;
+}
+__name(resolveGuardIsLoading, "resolveGuardIsLoading");
+function shouldRedirectToAuth(s) {
+  return s.mounted && s.requireAuth && !s.authLoading && !s.isAuthenticated && !s.isRedirecting;
+}
+__name(shouldRedirectToAuth, "shouldRedirectToAuth");
+function resolveGuardIsAuthenticated(s) {
+  return !s.requireAuth || s.isAuthenticated;
+}
+__name(resolveGuardIsAuthenticated, "resolveGuardIsAuthenticated");
+function nextAuthEvaluationDelay(accessExp, refreshExp, now) {
+  const future = [accessExp, refreshExp].filter(
+    (d) => d !== null && d > now
+  );
+  if (future.length === 0) return null;
+  return Math.max(0, Math.min(...future) - now) + 1e3;
+}
+__name(nextAuthEvaluationDelay, "nextAuthEvaluationDelay");
+
 // src/auth/context/AccountsContext.tsx
 import {
   createContext,
@@ -4683,6 +4735,20 @@ var hasValidTokens = /* @__PURE__ */ __name(() => {
   if (typeof window === "undefined") return false;
   return CfgAccountsApi.isAuthenticated();
 }, "hasValidTokens");
+var isSessionDeadOnBootstrap = /* @__PURE__ */ __name((accessToken, refreshToken, now = Date.now()) => {
+  const accessDead = isTokenExpired(accessToken, 0, now);
+  if (!accessDead) return false;
+  const refreshDead = isTokenExpired(refreshToken, 0, now);
+  return refreshDead;
+}, "isSessionDeadOnBootstrap");
+var isSessionAlive = /* @__PURE__ */ __name((now = Date.now()) => {
+  if (typeof window === "undefined") return false;
+  return !isSessionDeadOnBootstrap(
+    CfgAccountsApi.getToken(),
+    CfgAccountsApi.getRefreshToken(),
+    now
+  );
+}, "isSessionAlive");
 var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const accounts = useAccountsContext();
   ensureRefreshHandler();
@@ -4698,19 +4764,24 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     return true;
   });
   const [initialized, setInitialized] = useState12(false);
+  const [authTick, setAuthTick] = useState12(0);
+  const bumpAuthTick = useCallback12(() => setAuthTick((t) => t + 1), []);
+  useEffect9(() => {
+    if (typeof window === "undefined") return;
+    const delay = nextAuthEvaluationDelay(
+      getTokenExpiry(CfgAccountsApi.getToken()),
+      getTokenExpiry(CfgAccountsApi.getRefreshToken()),
+      Date.now()
+    );
+    if (delay === null) return;
+    const timer = setTimeout(bumpAuthTick, Math.min(delay, 2e9));
+    return () => clearTimeout(timer);
+  }, [authTick, bumpAuthTick]);
+  const onUnauthorizedRef = useRef6(false);
   const router = useCfgRouter();
   const pathname = usePathname3();
   const queryParams = useQueryParams();
   const [storedEmail, setStoredEmail, clearStoredEmail] = useLocalStorage(EMAIL_STORAGE_KEY, null);
-  useTokenRefresh({
-    enabled: true,
-    onRefresh: /* @__PURE__ */ __name((newToken) => {
-      authLogger.info("Token auto-refreshed successfully");
-    }, "onRefresh"),
-    onRefreshError: /* @__PURE__ */ __name((error) => {
-      authLogger.warn("Token auto-refresh failed:", error.message);
-    }, "onRefreshError")
-  });
   const user = accounts.profile;
   const userRef = useRef6(user);
   const configRef = useRef6(config);
@@ -4727,7 +4798,23 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     clearProfileCache();
     setInitialized(true);
     setIsLoading(false);
-  }, []);
+    bumpAuthTick();
+  }, [bumpAuthTick]);
+  const handleProactiveRefreshError = useCallback12((error) => {
+    authLogger.warn("Proactive token refresh failed \u2014 session is dead, redirecting to login:", error.message);
+    if (onUnauthorizedRef.current) return;
+    onUnauthorizedRef.current = true;
+    clearAuthState("proactiveRefresh:failed");
+    const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
+    router.hardReplace(authCallbackUrl);
+  }, [clearAuthState, router]);
+  useTokenRefresh({
+    enabled: true,
+    onRefresh: /* @__PURE__ */ __name(() => {
+      authLogger.info("Token auto-refreshed successfully");
+    }, "onRefresh"),
+    onRefreshError: handleProactiveRefreshError
+  });
   const handleGlobalAuthError = useCallback12((error, context = "API Request") => {
     const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
     if (isAuthError) {
@@ -4740,6 +4827,20 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     }
     return false;
   }, [clearAuthState]);
+  useEffect9(() => {
+    const handler = /* @__PURE__ */ __name(() => {
+      if (onUnauthorizedRef.current) return;
+      onUnauthorizedRef.current = true;
+      authLogger.warn("Unrecoverable 401 (refresh failed) \u2014 clearing session and redirecting to login");
+      clearAuthState("onUnauthorized:401");
+      const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
+      router.hardReplace(authCallbackUrl);
+    }, "handler");
+    CfgAccountsApi.onUnauthorized(handler);
+    return () => {
+      CfgAccountsApi.onUnauthorized(null);
+    };
+  }, [clearAuthState, router]);
   const isAutoLoggingOutRef = useRef6(false);
   const swrOnError = useCallback12((error) => {
     const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
@@ -4804,6 +4905,11 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       authLogger.info("Token from API:", token ? `${token.substring(0, 20)}...` : "null");
       authLogger.info("Refresh token from API:", refreshToken2 ? `${refreshToken2.substring(0, 20)}...` : "null");
       authLogger.info("localStorage keys:", Object.keys(localStorage).filter((k) => k.includes("token") || k.includes("auth")));
+      if (!isInIframe && isSessionDeadOnBootstrap(token, refreshToken2)) {
+        authLogger.warn("Bootstrap: dead session in storage (access + refresh both unusable) \u2014 clearing and showing login");
+        clearAuthState("initializeAuth:deadSession");
+        return;
+      }
       const hasTokens = hasValidTokens();
       authLogger.info("Has tokens:", hasTokens);
       if (userRef.current) {
@@ -5060,8 +5166,13 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     () => ({
       user,
       isLoading,
-      // Consider authenticated if we have valid tokens, even without user profile
-      isAuthenticated: CfgAccountsApi.isAuthenticated(),
+      // Authenticated iff the session is locally alive (access valid OR a usable
+      // refresh token) — validated by `exp`, NOT by mere token presence. This is
+      // what makes the guard self-sufficient: an expired session reads as
+      // unauthenticated WITHOUT waiting for a server 401 (which CSP / a hung
+      // request / offline can swallow). `authTick` (in deps) forces recompute
+      // after tokens are cleared/set, since token state lives in storage.
+      isAuthenticated: isSessionAlive(),
       isAdminUser,
       loadCurrentProfile,
       checkAuthAndRedirect,
@@ -5086,6 +5197,8 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     [
       user,
       isLoading,
+      authTick,
+      // recompute isAuthenticated when tokens are cleared/set
       isAdminUser,
       loadCurrentProfile,
       checkAuthAndRedirect,
@@ -5208,9 +5321,18 @@ export {
   formatAuthError,
   getCacheMetadata,
   getCachedProfile,
+  getTokenExpiry,
   hasValidCache,
+  isAllowedAuthPath,
+  isTokenExpired,
+  isTokenExpiringSoon,
   logger,
+  nextAuthEvaluationDelay,
+  normalizePath,
+  resolveGuardIsAuthenticated,
+  resolveGuardIsLoading,
   setCachedProfile,
+  shouldRedirectToAuth,
   useAccountsContext,
   useAuth,
   useAuthForm,