@djangocfg/api 2.1.455 → 2.1.457

package/dist/auth.mjs

@@ -12,905 +12,1077 @@ var AUTH_CONSTANTS = {
   BACKUP_CODE_MAX_LENGTH: 12
 };
 
-// src/auth/utils/env.ts
-var isDev = process.env.NODE_ENV === "development";
-var isBrowser = typeof window !== "undefined";
-var isStaticBuild = process.env.NEXT_PUBLIC_STATIC_BUILD === "true";
-var dpopEnabled = process.env.NEXT_PUBLIC_DPOP_ENABLED === "true";
-
 // src/auth/context/AuthContext.tsx
 import { usePathname as usePathname3 } from "next/navigation";
 import {
   createContext as createContext2,
   memo as memo2,
-  useCallback as useCallback12,
+  useCallback as useCallback11,
   useContext as useContext2,
-  useEffect as useEffect9,
+  useEffect as useEffect7,
   useMemo as useMemo3,
   useRef as useRef6,
-  useState as useState12
+  useState as useState11
 } from "react";
-import { SWRConfig } from "swr";
 
-// src/auth/hooks/useCfgRouter.ts
-import { useRouter as useNextRouter } from "next/navigation";
-import { useCallback, useMemo } from "react";
-function getBasePath() {
-  if (typeof process === "undefined") {
-    return "";
+// src/_api/generated/helpers/errors.ts
+var APIError = class extends Error {
+  constructor(statusCode, statusText, response, url, message) {
+    super(message || `HTTP ${statusCode}: ${statusText}`);
+    this.statusCode = statusCode;
+    this.statusText = statusText;
+    this.response = response;
+    this.url = url;
+    this.name = "APIError";
   }
-  return process.env.NEXT_PUBLIC_BASE_PATH || "";
-}
-__name(getBasePath, "getBasePath");
-function withBasePath(path, basePath) {
-  if (!basePath) {
-    return path;
+  static {
+    __name(this, "APIError");
   }
-  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
-  const normalizedBasePath = basePath.replace(/\/$/, "");
-  return `${normalizedBasePath}${normalizedPath}`;
+  get details() {
+    if (typeof this.response === "object" && this.response !== null) {
+      return this.response;
+    }
+    return null;
+  }
+  get fieldErrors() {
+    const details = this.details;
+    if (!details) return null;
+    const fieldErrors = {};
+    for (const [key, value] of Object.entries(details)) {
+      if (Array.isArray(value)) fieldErrors[key] = value;
+    }
+    return Object.keys(fieldErrors).length > 0 ? fieldErrors : null;
+  }
+  get errorMessage() {
+    const details = this.details;
+    if (!details) return this.message;
+    if (details.detail) {
+      return Array.isArray(details.detail) ? details.detail.join(", ") : String(details.detail);
+    }
+    if (details.error) return String(details.error);
+    if (details.message) return String(details.message);
+    const fieldErrors = this.fieldErrors;
+    if (fieldErrors) {
+      const firstField = Object.keys(fieldErrors)[0];
+      if (firstField) return `${firstField}: ${fieldErrors[firstField]?.join(", ")}`;
+    }
+    return this.message;
+  }
+  get isValidationError() {
+    return this.statusCode === 400;
+  }
+  get isAuthError() {
+    return this.statusCode === 401;
+  }
+  get isPermissionError() {
+    return this.statusCode === 403;
+  }
+  get isNotFoundError() {
+    return this.statusCode === 404;
+  }
+  get isServerError() {
+    return this.statusCode >= 500 && this.statusCode < 600;
+  }
+};
+
+// src/_api/generated/helpers/auth.ts
+var ACCESS_KEY = "cfg.access_token";
+var REFRESH_KEY = "cfg.refresh_token";
+var API_KEY_KEY = "cfg.api_key";
+var isBrowser = typeof window !== "undefined";
+var localStorageBackend = {
+  get(key) {
+    if (!isBrowser) return null;
+    try {
+      return window.localStorage.getItem(key);
+    } catch {
+      return null;
+    }
+  },
+  set(key, value) {
+    if (!isBrowser) return;
+    try {
+      if (value === null) window.localStorage.removeItem(key);
+      else window.localStorage.setItem(key, value);
+    } catch {
+    }
+  }
+};
+var COOKIE_MAX_AGE = 60 * 60 * 24 * 30;
+var cookieBackend = {
+  get(key) {
+    if (!isBrowser) return null;
+    try {
+      const re = new RegExp(`(?:^|;\\s*)${encodeURIComponent(key)}=([^;]*)`);
+      const m = document.cookie.match(re);
+      return m ? decodeURIComponent(m[1]) : null;
+    } catch {
+      return null;
+    }
+  },
+  set(key, value) {
+    if (!isBrowser) return;
+    try {
+      const k = encodeURIComponent(key);
+      const secure = window.location.protocol === "https:" ? "; Secure" : "";
+      if (value === null) {
+        document.cookie = `${k}=; Path=/; Max-Age=0; SameSite=Lax${secure}`;
+      } else {
+        const v = encodeURIComponent(value);
+        document.cookie = `${k}=${v}; Path=/; Max-Age=${COOKIE_MAX_AGE}; SameSite=Lax${secure}`;
+      }
+    } catch {
+    }
+  }
+};
+var _storage = localStorageBackend;
+var _storageMode = "localStorage";
+function detectLocale() {
+  try {
+    if (typeof document !== "undefined") {
+      const m = document.cookie.match(/(?:^|;\s*)NEXT_LOCALE=([^;]*)/);
+      if (m) return decodeURIComponent(m[1]);
+    }
+    if (typeof navigator !== "undefined" && navigator.language) {
+      return navigator.language;
+    }
+  } catch {
+  }
+  return null;
 }
-__name(withBasePath, "withBasePath");
-function useCfgRouter() {
-  const router = useNextRouter();
-  const basePath = useMemo(() => getBasePath(), []);
-  const isStaticBuild2 = useMemo(() => {
-    return typeof process !== "undefined" && process.env.NEXT_PUBLIC_STATIC_BUILD === "true";
-  }, []);
-  const push = useCallback((href, options) => {
-    if (basePath) {
-      window.location.href = withBasePath(href, basePath);
-    } else {
-      router.push(href, options);
+__name(detectLocale, "detectLocale");
+function defaultBaseUrl() {
+  if (typeof window !== "undefined") {
+    try {
+      if (typeof process !== "undefined" && process.env) {
+        if (process.env.NEXT_PUBLIC_STATIC_BUILD === "true") return "";
+        if (process.env.NEXT_PUBLIC_API_PROXY_URL !== void 0)
+          return process.env.NEXT_PUBLIC_API_PROXY_URL;
+        return process.env.NEXT_PUBLIC_API_URL || "";
+      }
+    } catch {
     }
-  }, [router, basePath]);
-  const replace = useCallback((href, options) => {
-    if (basePath) {
-      window.location.replace(withBasePath(href, basePath));
-    } else {
-      router.replace(href, options);
+    return "";
+  }
+  try {
+    if (typeof process !== "undefined" && process.env) {
+      if (process.env.NEXT_PUBLIC_STATIC_BUILD === "true") return "";
+      return process.env.NEXT_PUBLIC_API_URL || "";
     }
-  }, [router, basePath]);
-  const hardPush = useCallback((href) => {
-    window.location.href = withBasePath(href, basePath);
-  }, [basePath]);
-  const hardReplace = useCallback((href) => {
-    window.location.replace(withBasePath(href, basePath));
-  }, [basePath]);
-  const prefetch = useCallback((href) => {
-    router.prefetch(href);
-  }, [router]);
-  const back = useCallback(() => {
-    router.back();
-  }, [router]);
-  const forward = useCallback(() => {
-    router.forward();
-  }, [router]);
-  const refresh = useCallback(() => {
-    router.refresh();
-  }, [router]);
+  } catch {
+  }
+  return "";
+}
+__name(defaultBaseUrl, "defaultBaseUrl");
+function defaultApiKey() {
+  try {
+    if (typeof process !== "undefined" && process.env?.NEXT_PUBLIC_API_KEY) {
+      return process.env.NEXT_PUBLIC_API_KEY;
+    }
+  } catch {
+  }
+  return null;
+}
+__name(defaultApiKey, "defaultApiKey");
+var _localeOverride = null;
+var _apiKeyOverride = null;
+var _baseUrlOverride = null;
+var _withCredentials = true;
+var _onUnauthorized = null;
+var _refreshHandler = null;
+var _refreshInflight = null;
+var RETRY_MARKER = "X-Auth-Retry";
+function jwtExpMs(token) {
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) return null;
+    const json = JSON.parse(atob(payload.replace(/-/g, "+").replace(/_/g, "/")));
+    return typeof json.exp === "number" ? json.exp * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+__name(jwtExpMs, "jwtExpMs");
+function computeSnapshot() {
+  const access = _storage.get(ACCESS_KEY);
+  const refresh = _storage.get(REFRESH_KEY);
+  const now = Date.now();
+  const accessExp = access ? jwtExpMs(access) : null;
+  const accessAlive = access !== null && (accessExp === null || accessExp > now);
+  const refreshExp = refresh ? jwtExpMs(refresh) : null;
+  const refreshAlive = refresh !== null && (refreshExp === null || refreshExp > now);
   return {
-    push,
-    replace,
-    hardPush,
-    hardReplace,
-    prefetch,
-    back,
-    forward,
-    refresh
+    status: accessAlive || refreshAlive ? "authenticated" : "anonymous",
+    accessExpiresAt: accessExp
   };
 }
-__name(useCfgRouter, "useCfgRouter");
-
-// src/auth/hooks/useQueryParams.ts
-import { usePathname } from "next/navigation";
-import { useEffect, useRef, useState } from "react";
-function useQueryParams() {
-  const pathname = usePathname();
-  const [queryParams, setQueryParams] = useState(() => {
-    if (typeof window === "undefined") {
-      return new URLSearchParams();
+__name(computeSnapshot, "computeSnapshot");
+var SERVER_SNAPSHOT = { status: "anonymous", accessExpiresAt: null };
+var SESSION_SYNC_EVENT = `cfg-auth:changed:${ACCESS_KEY}`;
+var _snapshot = computeSnapshot();
+var _sessionListeners = /* @__PURE__ */ new Set();
+var _expiryTimer = null;
+var _storageListenerInstalled = false;
+function scheduleExpiryFlip() {
+  if (!isBrowser) return;
+  if (_expiryTimer !== null) {
+    clearTimeout(_expiryTimer);
+    _expiryTimer = null;
+  }
+  if (_sessionListeners.size === 0) return;
+  const now = Date.now();
+  const exps = [];
+  const access = _storage.get(ACCESS_KEY);
+  const refresh = _storage.get(REFRESH_KEY);
+  const accessExp = access ? jwtExpMs(access) : null;
+  const refreshExp = refresh ? jwtExpMs(refresh) : null;
+  if (accessExp !== null && accessExp > now) exps.push(accessExp);
+  if (refreshExp !== null && refreshExp > now) exps.push(refreshExp);
+  if (!exps.length) return;
+  const delay = Math.min(Math.min(...exps) - now + 250, 2147483647);
+  _expiryTimer = setTimeout(notifySessionChanged, delay);
+}
+__name(scheduleExpiryFlip, "scheduleExpiryFlip");
+function notifySessionChanged() {
+  const next = computeSnapshot();
+  const changed = next.status !== _snapshot.status || next.accessExpiresAt !== _snapshot.accessExpiresAt;
+  if (changed) _snapshot = next;
+  scheduleExpiryFlip();
+  if (!changed) return;
+  for (const listener of Array.from(_sessionListeners)) {
+    try {
+      listener();
+    } catch {
+    }
+  }
+  if (isBrowser) {
+    try {
+      window.dispatchEvent(new Event(SESSION_SYNC_EVENT));
+    } catch {
+    }
+  }
+}
+__name(notifySessionChanged, "notifySessionChanged");
+function ensureStorageSync() {
+  if (!isBrowser || _storageListenerInstalled) return;
+  _storageListenerInstalled = true;
+  window.addEventListener("storage", (e) => {
+    if (e.key === null || e.key === ACCESS_KEY || e.key === REFRESH_KEY) {
+      notifySessionChanged();
     }
-    return new URLSearchParams(window.location.search);
   });
-  const lastSearchRef = useRef("");
-  useEffect(() => {
-    if (typeof window === "undefined") return;
-    const updateQueryParams = /* @__PURE__ */ __name(() => {
-      const currentSearch = window.location.search;
-      if (currentSearch !== lastSearchRef.current) {
-        lastSearchRef.current = currentSearch;
-        setQueryParams(new URLSearchParams(currentSearch));
+  window.addEventListener(SESSION_SYNC_EVENT, () => notifySessionChanged());
+}
+__name(ensureStorageSync, "ensureStorageSync");
+var _sessionExpiredHandlers = /* @__PURE__ */ new Set();
+var _client = null;
+function pushClientConfig() {
+  if (!_client) return;
+  _client.setConfig({
+    baseUrl: auth.getBaseUrl(),
+    credentials: _withCredentials ? "include" : "same-origin"
+  });
+}
+__name(pushClientConfig, "pushClientConfig");
+var auth = {
+  // ── Storage mode ──────────────────────────────────────────────────
+  getStorageMode() {
+    return _storageMode;
+  },
+  setStorageMode(mode) {
+    _storageMode = mode;
+    _storage = mode === "cookie" ? cookieBackend : localStorageBackend;
+    notifySessionChanged();
+  },
+  // ── Bearer token ──────────────────────────────────────────────────
+  getToken() {
+    return _storage.get(ACCESS_KEY);
+  },
+  setToken(token) {
+    _storage.set(ACCESS_KEY, token);
+    notifySessionChanged();
+  },
+  getRefreshToken() {
+    return _storage.get(REFRESH_KEY);
+  },
+  setRefreshToken(token) {
+    _storage.set(REFRESH_KEY, token);
+    notifySessionChanged();
+  },
+  clearTokens() {
+    _storage.set(ACCESS_KEY, null);
+    _storage.set(REFRESH_KEY, null);
+    notifySessionChanged();
+  },
+  /** Session-aware: token PRESENT and not past its `exp` (or a live refresh
+   * token exists that can mint one). Prefer `getSnapshot().status` in React. */
+  isAuthenticated() {
+    return computeSnapshot().status === "authenticated";
+  },
+  // ── Session (the ONE write path for login/logout flows) ──────────
+  /**
+   * Persist a token pair atomically. Every login flow (OTP verify, 2FA,
+   * OAuth callback) and the refresh handler should end here — do NOT
+   * scatter `setToken`/`setRefreshToken` pairs through app code.
+   * `refresh: undefined` keeps the current refresh token (access-only
+   * rotation); `refresh: null` explicitly drops it.
+   */
+  setSession(tokens) {
+    _storage.set(ACCESS_KEY, tokens.access);
+    if (tokens.refresh !== void 0) _storage.set(REFRESH_KEY, tokens.refresh);
+    notifySessionChanged();
+  },
+  clearSession() {
+    auth.clearTokens();
+  },
+  // ── Reactive snapshot (for useSyncExternalStore) ──────────────────
+  /**
+   * @example React:
+   *   const session = useSyncExternalStore(
+   *     auth.subscribe, auth.getSnapshot, auth.getServerSnapshot,
+   *   );
+   *   const isAuthenticated = session.status === 'authenticated';
+   */
+  getSnapshot() {
+    return _snapshot;
+  },
+  getServerSnapshot() {
+    return SERVER_SNAPSHOT;
+  },
+  subscribe(listener) {
+    ensureStorageSync();
+    _sessionListeners.add(listener);
+    notifySessionChanged();
+    return () => {
+      _sessionListeners.delete(listener);
+      if (_sessionListeners.size === 0 && _expiryTimer !== null) {
+        clearTimeout(_expiryTimer);
+        _expiryTimer = null;
       }
-    }, "updateQueryParams");
-    updateQueryParams();
-    window.addEventListener("popstate", updateQueryParams);
-    const origPush = window.history.pushState;
-    const origReplace = window.history.replaceState;
-    window.history.pushState = function(...args) {
-      const result = origPush.apply(this, args);
-      updateQueryParams();
-      return result;
-    };
-    window.history.replaceState = function(...args) {
-      const result = origReplace.apply(this, args);
-      updateQueryParams();
-      return result;
     };
+  },
+  /**
+   * Fired on TERMINAL 401 — after the refresh+retry path is exhausted.
+   * The store has already cleared the session before calling back, so
+   * handlers only need to route to login (no clear-then-redirect
+   * ordering to get wrong). Returns an unsubscribe function; multiple
+   * handlers compose (unlike the legacy single-slot `onUnauthorized`).
+   */
+  onSessionExpired(cb) {
+    _sessionExpiredHandlers.add(cb);
     return () => {
-      window.removeEventListener("popstate", updateQueryParams);
-      window.history.pushState = origPush;
-      window.history.replaceState = origReplace;
+      _sessionExpiredHandlers.delete(cb);
     };
-  }, [pathname]);
-  return queryParams;
+  },
+  // ── API key ───────────────────────────────────────────────────────
+  getApiKey() {
+    return _apiKeyOverride ?? _storage.get(API_KEY_KEY) ?? defaultApiKey();
+  },
+  setApiKey(key) {
+    _apiKeyOverride = key;
+  },
+  setApiKeyPersist(key) {
+    _apiKeyOverride = key;
+    _storage.set(API_KEY_KEY, key);
+  },
+  clearApiKey() {
+    _apiKeyOverride = null;
+    _storage.set(API_KEY_KEY, null);
+  },
+  // ── Locale ────────────────────────────────────────────────────────
+  getLocale() {
+    return _localeOverride ?? detectLocale();
+  },
+  setLocale(locale) {
+    _localeOverride = locale;
+  },
+  // ── Base URL ──────────────────────────────────────────────────────
+  getBaseUrl() {
+    const url = _baseUrlOverride ?? defaultBaseUrl();
+    return url.replace(/\/$/, "");
+  },
+  setBaseUrl(url) {
+    _baseUrlOverride = url ? url.replace(/\/$/, "") : null;
+    pushClientConfig();
+  },
+  // ── Credentials toggle ────────────────────────────────────────────
+  getWithCredentials() {
+    return _withCredentials;
+  },
+  setWithCredentials(value) {
+    _withCredentials = value;
+    pushClientConfig();
+  },
+  // ── 401 handler ───────────────────────────────────────────────────
+  /**
+   * Fired when the server returns 401 AND no refresh path recovers it
+   * (no refresh token, no refresh handler, refresh failed, or retry
+   * still 401). The app should clear local state and redirect to login.
+   *
+   * NOT fired for 401 that gets transparently recovered by the refresh
+   * handler — those are invisible to callers.
+   */
+  onUnauthorized(cb) {
+    _onUnauthorized = cb;
+  },
+  /**
+   * Register the refresh strategy. The handler receives the current
+   * refresh token and must call your refresh endpoint, returning
+   * `{ access, refresh? }` on success or `null` on failure.
+   *
+   * @example
+   *   auth.setRefreshHandler(async (refresh) => {
+   *     const { data } = await Auth.tokenRefreshCreate({ body: { refresh } });
+   *     return data ? { access: data.access, refresh: data.refresh } : null;
+   *   });
+   */
+  setRefreshHandler(fn) {
+    _refreshHandler = fn;
+  },
+  /**
+   * Proactively run the registered refresh handler right now, reusing the
+   * SAME single-flight promise as the 401-recovery interceptor. Callers
+   * (e.g. an expiry timer / focus / reconnect) get token rotation,
+   * de-duplication and rotated-token persistence for free — they must NOT
+   * re-implement any of it. Returns the fresh access token, or null if
+   * there is no handler / no refresh token / the refresh failed.
+   */
+  refreshNow() {
+    return tryRefresh();
+  }
+};
+async function tryRefresh() {
+  if (_refreshInflight) return _refreshInflight;
+  if (!_refreshHandler) return null;
+  const runRefresh = /* @__PURE__ */ __name(async () => {
+    const refresh = auth.getRefreshToken();
+    if (!refresh) return null;
+    const result = await _refreshHandler(refresh);
+    if (!result?.access) return null;
+    auth.setToken(result.access);
+    if (result.refresh) auth.setRefreshToken(result.refresh);
+    return result.access;
+  }, "runRefresh");
+  _refreshInflight = (async () => {
+    try {
+      const locks = typeof navigator !== "undefined" ? navigator.locks : void 0;
+      if (locks?.request) {
+        return await locks.request(`${REFRESH_KEY}:refresh`, runRefresh);
+      }
+      return await runRefresh();
+    } catch {
+      return null;
+    } finally {
+      _refreshInflight = null;
+    }
+  })();
+  return _refreshInflight;
 }
-__name(useQueryParams, "useQueryParams");
-
-// src/auth/hooks/useAuthFormState.ts
-import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
-var formatCountdown = /* @__PURE__ */ __name((s) => {
-  if (s <= 0) return "";
-  const m = Math.floor(s / 60);
-  return m > 0 ? `${m}:${String(s % 60).padStart(2, "0")}` : `${s}s`;
-}, "formatCountdown");
-var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
-  const [identifier, setIdentifier] = useState2(initialIdentifier);
-  const [otp, setOtp] = useState2("");
-  const [isLoading, setIsLoading] = useState2(false);
-  const [acceptedTerms, setAcceptedTerms] = useState2(true);
-  const [step, setStep] = useState2("identifier");
-  const [error, setError] = useState2("");
-  const [webmail, setWebmail] = useState2(null);
-  const [twoFactorSessionId, setTwoFactorSessionId] = useState2(null);
-  const [shouldPrompt2FA, setShouldPrompt2FA] = useState2(false);
-  const [twoFactorCode, setTwoFactorCode] = useState2("");
-  const [useBackupCode, setUseBackupCode] = useState2(false);
-  const [rateLimitSeconds, setRateLimitSeconds] = useState2(0);
-  const rateLimitTimerRef = useRef2(null);
-  const startRateLimitCountdown = useCallback2((seconds) => {
-    if (rateLimitTimerRef.current) clearInterval(rateLimitTimerRef.current);
-    setRateLimitSeconds(seconds);
-    rateLimitTimerRef.current = setInterval(() => {
-      setRateLimitSeconds((prev) => {
-        if (prev <= 1) {
-          clearInterval(rateLimitTimerRef.current);
-          rateLimitTimerRef.current = null;
-          return 0;
-        }
-        return prev - 1;
-      });
-    }, 1e3);
-  }, []);
-  useEffect2(() => () => {
-    if (rateLimitTimerRef.current) clearInterval(rateLimitTimerRef.current);
-  }, []);
-  const clearError = useCallback2(() => setError(""), []);
-  return {
-    // State
-    identifier,
-    otp,
-    isLoading,
-    acceptedTerms,
-    step,
-    error,
-    twoFactorSessionId,
-    shouldPrompt2FA,
-    twoFactorCode,
-    useBackupCode,
-    rateLimitSeconds,
-    isRateLimited: rateLimitSeconds > 0,
-    rateLimitLabel: formatCountdown(rateLimitSeconds),
-    webmail,
-    // Handlers
-    setIdentifier,
-    setOtp,
-    setAcceptedTerms,
-    setError,
-    clearError,
-    setStep,
-    setIsLoading,
-    setTwoFactorSessionId,
-    setShouldPrompt2FA,
-    setTwoFactorCode,
-    setUseBackupCode,
-    startRateLimitCountdown,
-    setWebmail
-  };
-}, "useAuthFormState");
-
-// src/auth/hooks/useAuthValidation.ts
-import { useCallback as useCallback3 } from "react";
-var EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var useAuthValidation = /* @__PURE__ */ __name(() => {
-  const validateIdentifier2 = useCallback3((id) => {
-    return EMAIL_REGEX.test(id);
-  }, []);
-  return { validateIdentifier: validateIdentifier2 };
-}, "useAuthValidation");
-var validateIdentifier = /* @__PURE__ */ __name((id) => EMAIL_REGEX.test(id), "validateIdentifier");
-
-// src/auth/hooks/useAuthForm.ts
-import { useCallback as useCallback5, useEffect as useEffect4, useRef as useRef4 } from "react";
-
-// src/auth/utils/logger.ts
-import { createConsola } from "consola";
-
-// src/log-control.ts
-var verboseByDefault = isDev || isStaticBuild;
-var DEFAULT_LEVEL = verboseByDefault ? 4 : 1;
-var _level = DEFAULT_LEVEL;
-var _subscribers = /* @__PURE__ */ new Set();
-function getLogLevel() {
-  return _level;
-}
-__name(getLogLevel, "getLogLevel");
-function setLogLevel(level) {
-  _level = level;
-  for (const fn of _subscribers) {
+__name(tryRefresh, "tryRefresh");
+function expireSession(response) {
+  auth.clearTokens();
+  for (const cb of Array.from(_sessionExpiredHandlers)) {
     try {
-      fn(level);
+      cb(response);
+    } catch {
+    }
+  }
+  if (_onUnauthorized) {
+    try {
+      _onUnauthorized(response);
     } catch {
     }
   }
 }
-__name(setLogLevel, "setLogLevel");
-function onLogLevelChange(fn) {
-  _subscribers.add(fn);
+__name(expireSession, "expireSession");
+function dpopEnabled() {
   try {
-    fn(_level);
+    return typeof process !== "undefined" && process.env?.NEXT_PUBLIC_DPOP_ENABLED === "true";
   } catch {
+    return false;
   }
-  return () => _subscribers.delete(fn);
 }
-__name(onLogLevelChange, "onLogLevelChange");
-function applyRoleLogPolicy(opts) {
-  const devMode = opts.isDev ?? verboseByDefault;
-  if (opts.isAdmin || devMode) {
-    setLogLevel(4);
-  } else {
-    setLogLevel(1);
-  }
+__name(dpopEnabled, "dpopEnabled");
+var _DPOP_DB = "cfg-auth";
+var _DPOP_STORE = "keys";
+var _DPOP_KEY_ID = "dpop-ec-p256";
+function _idbOpen() {
+  return new Promise((resolve, reject) => {
+    const req = indexedDB.open(_DPOP_DB, 1);
+    req.onupgradeneeded = () => req.result.createObjectStore(_DPOP_STORE);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  });
 }
-__name(applyRoleLogPolicy, "applyRoleLogPolicy");
-
-// src/auth/utils/logger.ts
-var logger = createConsola({
-  level: getLogLevel()
-}).withTag("api");
-onLogLevelChange((level) => {
-  logger.level = level;
-});
-var authLogger = logger.withTag("auth");
-
-// src/auth/hooks/useAutoAuth.ts
-import { usePathname as usePathname2 } from "next/navigation";
-import { useEffect as useEffect3, useRef as useRef3 } from "react";
-
-// src/auth/utils/path.ts
-var normalizePath = /* @__PURE__ */ __name((path) => {
-  if (!path) return "";
-  const withoutLocale = path.replace(/^\/[a-z]{2}(?=\/|$)/, "");
-  const trimmed = withoutLocale.replace(/\/+$/, "");
-  return trimmed || "/";
-}, "normalizePath");
-var isAllowedAuthPath = /* @__PURE__ */ __name((pathname, allowedPaths) => {
-  const normalized = normalizePath(pathname);
-  return allowedPaths.some(
-    (p) => normalized === p || normalized.startsWith(p + "/")
-  );
-}, "isAllowedAuthPath");
-
-// src/auth/hooks/useAutoAuth.ts
-var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
-  const { onOTPDetected, cleanupUrl = true, allowedPaths = ["/auth"] } = options;
-  const queryParams = useQueryParams();
-  const pathname = usePathname2();
-  const router = useCfgRouter();
-  const isAllowedPath = isAllowedAuthPath(pathname, allowedPaths);
-  const queryOtp = queryParams.get("otp") || "";
-  const queryEmail = queryParams.get("email") || void 0;
-  const hasOTP = !!queryOtp;
-  const isReady = !!pathname && hasOTP && isAllowedPath;
-  const otpValid = queryOtp.length === AUTH_CONSTANTS.EMAIL_OTP_LENGTH;
-  const onOTPDetectedRef = useRef3(onOTPDetected);
-  onOTPDetectedRef.current = onOTPDetected;
-  useEffect3(() => {
-    if (!isReady || !otpValid) return;
-    authLogger.info("OTP detected in URL on auth page:", queryOtp);
-    onOTPDetectedRef.current?.(queryOtp, queryEmail);
-  }, [isReady, otpValid, queryOtp, queryEmail]);
-  useEffect3(() => {
-    if (!isReady || !cleanupUrl || !queryOtp) return;
-    const cleanQuery = Object.fromEntries(queryParams.entries());
-    delete cleanQuery.otp;
-    delete cleanQuery.email;
-    const queryString = new URLSearchParams(cleanQuery).toString();
-    const realPathname = typeof window !== "undefined" ? window.location.pathname : pathname;
-    router.replace(queryString ? `${realPathname}?${queryString}` : realPathname);
-  }, [isReady, cleanupUrl, queryOtp]);
-  return {
-    isReady,
-    hasOTP,
-    isAllowedPath
-  };
-}, "useAutoAuth");
-
-// src/auth/hooks/useTwoFactor.ts
-import { useCallback as useCallback4, useState as useState3 } from "react";
-
-// src/_api/generated/helpers/errors.ts
-var APIError = class extends Error {
-  constructor(statusCode, statusText, response, url, message) {
-    super(message || `HTTP ${statusCode}: ${statusText}`);
-    this.statusCode = statusCode;
-    this.statusText = statusText;
-    this.response = response;
-    this.url = url;
-    this.name = "APIError";
-  }
-  static {
-    __name(this, "APIError");
-  }
-  get details() {
-    if (typeof this.response === "object" && this.response !== null) {
-      return this.response;
-    }
+__name(_idbOpen, "_idbOpen");
+function _idbGet(key) {
+  return _idbOpen().then((db) => new Promise((resolve, reject) => {
+    const tx = db.transaction(_DPOP_STORE, "readonly");
+    const req = tx.objectStore(_DPOP_STORE).get(key);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  }));
+}
+__name(_idbGet, "_idbGet");
+function _idbPut(key, value) {
+  return _idbOpen().then((db) => new Promise((resolve, reject) => {
+    const tx = db.transaction(_DPOP_STORE, "readwrite");
+    tx.objectStore(_DPOP_STORE).put(value, key);
+    tx.oncomplete = () => resolve();
+    tx.onerror = () => reject(tx.error);
+  }));
+}
+__name(_idbPut, "_idbPut");
+var _dpopKeyPromise = null;
+function _getDpopKeyPair() {
+  if (_dpopKeyPromise) return _dpopKeyPromise;
+  _dpopKeyPromise = (async () => {
+    const existing = await _idbGet(_DPOP_KEY_ID).catch(() => void 0);
+    if (existing) return existing;
+    const pair = await crypto.subtle.generateKey(
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      // extractable:false — JS can sign but never export the private key
+      ["sign"]
+    );
+    await _idbPut(_DPOP_KEY_ID, pair).catch(() => {
+    });
+    return pair;
+  })();
+  return _dpopKeyPromise;
+}
+__name(_getDpopKeyPair, "_getDpopKeyPair");
+function _b64urlFromBytes(bytes) {
+  const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let s = "";
+  for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i]);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+__name(_b64urlFromBytes, "_b64urlFromBytes");
+function _b64urlFromString(str) {
+  return _b64urlFromBytes(new TextEncoder().encode(str));
+}
+__name(_b64urlFromString, "_b64urlFromString");
+async function _publicJwk(pub) {
+  const jwk = await crypto.subtle.exportKey("jwk", pub);
+  return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
+}
+__name(_publicJwk, "_publicJwk");
+async function _makeDpopProof(method, url) {
+  try {
+    const pair = await _getDpopKeyPair();
+    const jwk = await _publicJwk(pair.publicKey);
+    const header = { typ: "dpop+jwt", alg: "ES256", jwk };
+    const htu = url.split("#")[0].split("?")[0];
+    const jti = crypto.randomUUID && crypto.randomUUID() || _b64urlFromBytes(crypto.getRandomValues(new Uint8Array(16)));
+    const payload = { htm: method.toUpperCase(), htu, iat: Math.floor(Date.now() / 1e3), jti };
+    const signingInput = `${_b64urlFromString(JSON.stringify(header))}.${_b64urlFromString(JSON.stringify(payload))}`;
+    const sig = await crypto.subtle.sign(
+      { name: "ECDSA", hash: "SHA-256" },
+      pair.privateKey,
+      new TextEncoder().encode(signingInput)
+    );
+    return `${signingInput}.${_b64urlFromBytes(sig)}`;
+  } catch {
     return null;
   }
-  get fieldErrors() {
-    const details = this.details;
-    if (!details) return null;
-    const fieldErrors = {};
-    for (const [key, value] of Object.entries(details)) {
-      if (Array.isArray(value)) fieldErrors[key] = value;
+}
+__name(_makeDpopProof, "_makeDpopProof");
+function installAuthOnClient(client2) {
+  if (_client) return;
+  _client = client2;
+  client2.setConfig({
+    baseUrl: auth.getBaseUrl(),
+    credentials: _withCredentials ? "include" : "same-origin"
+  });
+  client2.interceptors.request.use(async (request) => {
+    const token = auth.getToken();
+    if (token) request.headers.set("Authorization", `Bearer ${token}`);
+    const locale = auth.getLocale();
+    if (locale) request.headers.set("Accept-Language", locale);
+    const apiKey = auth.getApiKey();
+    if (apiKey && !request.headers.has("X-API-Key")) request.headers.set("X-API-Key", apiKey);
+    try {
+      const tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
+      if (tz) request.headers.set("X-Timezone", tz);
+    } catch {
     }
-    return Object.keys(fieldErrors).length > 0 ? fieldErrors : null;
-  }
-  get errorMessage() {
-    const details = this.details;
-    if (!details) return this.message;
-    if (details.detail) {
-      return Array.isArray(details.detail) ? details.detail.join(", ") : String(details.detail);
+    request.headers.set("X-Client-Time", (/* @__PURE__ */ new Date()).toISOString());
+    if (dpopEnabled() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof(request.method, request.url);
+      if (proof) request.headers.set("DPoP", proof);
     }
-    if (details.error) return String(details.error);
-    if (details.message) return String(details.message);
-    const fieldErrors = this.fieldErrors;
-    if (fieldErrors) {
-      const firstField = Object.keys(fieldErrors)[0];
-      if (firstField) return `${firstField}: ${fieldErrors[firstField]?.join(", ")}`;
+    return request;
+  });
+  client2.interceptors.error.use((err, res, req) => {
+    if (err instanceof APIError) return err;
+    const url = req?.url ?? "";
+    const status = res?.status ?? 0;
+    const statusText = res?.statusText ?? "";
+    return new APIError(status, statusText, err, url);
+  });
+  client2.interceptors.response.use(async (response, request) => {
+    if (response.status !== 401) return response;
+    if (request.headers.get(RETRY_MARKER)) {
+      expireSession(response);
+      return response;
     }
-    return this.message;
-  }
-  get isValidationError() {
-    return this.statusCode === 400;
-  }
-  get isAuthError() {
-    return this.statusCode === 401;
-  }
-  get isPermissionError() {
-    return this.statusCode === 403;
-  }
-  get isNotFoundError() {
-    return this.statusCode === 404;
-  }
-  get isServerError() {
-    return this.statusCode >= 500 && this.statusCode < 600;
-  }
-};
-
-// src/_api/generated/helpers/auth.ts
-var ACCESS_KEY = "cfg.access_token";
-var REFRESH_KEY = "cfg.refresh_token";
-var API_KEY_KEY = "cfg.api_key";
-var isBrowser2 = typeof window !== "undefined";
-var localStorageBackend = {
-  get(key) {
-    if (!isBrowser2) return null;
-    try {
-      return window.localStorage.getItem(key);
-    } catch {
-      return null;
+    const newToken = await tryRefresh();
+    if (!newToken) {
+      expireSession(response);
+      return response;
     }
-  },
-  set(key, value) {
-    if (!isBrowser2) return;
-    try {
-      if (value === null) window.localStorage.removeItem(key);
-      else window.localStorage.setItem(key, value);
-    } catch {
+    const retry = request.clone();
+    retry.headers.set("Authorization", `Bearer ${newToken}`);
+    retry.headers.set(RETRY_MARKER, "1");
+    if (dpopEnabled() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof(retry.method, retry.url);
+      if (proof) retry.headers.set("DPoP", proof);
     }
-  }
-};
-var COOKIE_MAX_AGE = 60 * 60 * 24 * 30;
-var cookieBackend = {
-  get(key) {
-    if (!isBrowser2) return null;
     try {
-      const re = new RegExp(`(?:^|;\\s*)${encodeURIComponent(key)}=([^;]*)`);
-      const m = document.cookie.match(re);
-      return m ? decodeURIComponent(m[1]) : null;
+      const retried = await fetch(retry);
+      if (retried.status === 401) expireSession(retried);
+      return retried;
     } catch {
-      return null;
+      return response;
     }
-  },
-  set(key, value) {
-    if (!isBrowser2) return;
-    try {
-      const k = encodeURIComponent(key);
-      const secure = window.location.protocol === "https:" ? "; Secure" : "";
-      if (value === null) {
-        document.cookie = `${k}=; Path=/; Max-Age=0; SameSite=Lax${secure}`;
-      } else {
-        const v = encodeURIComponent(value);
-        document.cookie = `${k}=${v}; Path=/; Max-Age=${COOKIE_MAX_AGE}; SameSite=Lax${secure}`;
-      }
-    } catch {
+  });
+}
+__name(installAuthOnClient, "installAuthOnClient");
+var REFRESH_ENDPOINT = "/cfg/accounts/token/refresh/";
+auth.setRefreshHandler(async (refresh) => {
+  try {
+    const url = `${auth.getBaseUrl()}${REFRESH_ENDPOINT}`;
+    const headers = { "Content-Type": "application/json" };
+    if (dpopEnabled() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof("POST", url);
+      if (proof) headers["DPoP"] = proof;
     }
+    const res = await fetch(url, {
+      method: "POST",
+      headers,
+      credentials: auth.getWithCredentials() ? "include" : "same-origin",
+      body: JSON.stringify({ refresh })
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data?.access ? { access: data.access, refresh: data.refresh ?? refresh } : null;
+  } catch {
+    return null;
   }
+});
+
+// src/_api/generated/helpers/logger.ts
+import { createConsola } from "consola";
+var DEFAULT_CONFIG = {
+  enabled: typeof process !== "undefined" && process.env.NODE_ENV !== "production",
+  logRequests: true,
+  logResponses: true,
+  logErrors: true,
+  logBodies: true,
+  logHeaders: false
 };
-var _storage = localStorageBackend;
-var _storageMode = "localStorage";
-function detectLocale() {
-  try {
-    if (typeof document !== "undefined") {
-      const m = document.cookie.match(/(?:^|;\s*)NEXT_LOCALE=([^;]*)/);
-      if (m) return decodeURIComponent(m[1]);
-    }
-    if (typeof navigator !== "undefined" && navigator.language) {
-      return navigator.language;
+var SENSITIVE_HEADERS = [
+  "authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "x-csrf-token"
+];
+var APILogger = class {
+  static {
+    __name(this, "APILogger");
+  }
+  config;
+  consola;
+  constructor(config = {}) {
+    this.config = { ...DEFAULT_CONFIG, ...config };
+    this.consola = config.consola || createConsola({
+      level: this.config.enabled ? 4 : 0
+    });
+  }
+  enable() {
+    this.config.enabled = true;
+  }
+  disable() {
+    this.config.enabled = false;
+  }
+  setConfig(config) {
+    this.config = { ...this.config, ...config };
+  }
+  filterHeaders(headers) {
+    if (!headers) return {};
+    const filtered = {};
+    Object.keys(headers).forEach((key) => {
+      filtered[key] = SENSITIVE_HEADERS.includes(key.toLowerCase()) ? "***" : headers[key] || "";
+    });
+    return filtered;
+  }
+  logRequest(request) {
+    if (!this.config.enabled || !this.config.logRequests) return;
+    const { method, url, headers, body } = request;
+    this.consola.start(`${method} ${url}`);
+    if (this.config.logHeaders && headers) this.consola.debug("Headers:", this.filterHeaders(headers));
+    if (this.config.logBodies && body) this.consola.debug("Body:", body);
+  }
+  logResponse(request, response) {
+    if (!this.config.enabled || !this.config.logResponses) return;
+    const { method, url } = request;
+    const { status, statusText, data, duration } = response;
+    this.consola.success(`${method} ${url} ${status} ${statusText} (${duration}ms)`);
+    if (this.config.logBodies && data) this.consola.debug("Response:", data);
+  }
+  logError(request, error) {
+    if (!this.config.enabled || !this.config.logErrors) return;
+    const { method, url } = request;
+    const { message, statusCode, fieldErrors, duration } = error;
+    this.consola.error(`${method} ${url} ${statusCode || "Network"} Error (${duration}ms)`);
+    this.consola.error("Message:", message);
+    if (fieldErrors && Object.keys(fieldErrors).length > 0) {
+      this.consola.error("Field Errors:");
+      Object.entries(fieldErrors).forEach(([field, errors]) => {
+        errors.forEach((err) => this.consola.error(`  \u2022 ${field}: ${err}`));
+      });
     }
-  } catch {
   }
-  return null;
+  info(message, ...args) {
+    if (this.config.enabled) this.consola.info(message, ...args);
+  }
+  warn(message, ...args) {
+    if (this.config.enabled) this.consola.warn(message, ...args);
+  }
+  error(message, ...args) {
+    if (this.config.enabled) this.consola.error(message, ...args);
+  }
+  debug(message, ...args) {
+    if (this.config.enabled) this.consola.debug(message, ...args);
+  }
+  success(message, ...args) {
+    if (this.config.enabled) this.consola.success(message, ...args);
+  }
+  withTag(tag) {
+    return this.consola.withTag(tag);
+  }
+};
+var defaultLogger = new APILogger();
+
+// src/auth/utils/env.ts
+var isDev = process.env.NODE_ENV === "development";
+var isBrowser2 = typeof window !== "undefined";
+var isStaticBuild = process.env.NEXT_PUBLIC_STATIC_BUILD === "true";
+var dpopEnabled2 = process.env.NEXT_PUBLIC_DPOP_ENABLED === "true";
+
+// src/log-control.ts
+var verboseByDefault = isDev || isStaticBuild;
+var DEFAULT_LEVEL = verboseByDefault ? 4 : 1;
+var _level = DEFAULT_LEVEL;
+var _subscribers = /* @__PURE__ */ new Set();
+function getLogLevel() {
+  return _level;
 }
-__name(detectLocale, "detectLocale");
-function defaultBaseUrl() {
-  if (typeof window !== "undefined") {
+__name(getLogLevel, "getLogLevel");
+function setLogLevel(level) {
+  _level = level;
+  for (const fn of _subscribers) {
     try {
-      if (typeof process !== "undefined" && process.env) {
-        if (process.env.NEXT_PUBLIC_STATIC_BUILD === "true") return "";
-        if (process.env.NEXT_PUBLIC_API_PROXY_URL !== void 0)
-          return process.env.NEXT_PUBLIC_API_PROXY_URL;
-        return process.env.NEXT_PUBLIC_API_URL || "";
-      }
+      fn(level);
     } catch {
     }
-    return "";
   }
+}
+__name(setLogLevel, "setLogLevel");
+function onLogLevelChange(fn) {
+  _subscribers.add(fn);
   try {
-    if (typeof process !== "undefined" && process.env) {
-      if (process.env.NEXT_PUBLIC_STATIC_BUILD === "true") return "";
-      return process.env.NEXT_PUBLIC_API_URL || "";
-    }
+    fn(_level);
   } catch {
   }
-  return "";
+  return () => _subscribers.delete(fn);
 }
-__name(defaultBaseUrl, "defaultBaseUrl");
-function defaultApiKey() {
-  try {
-    if (typeof process !== "undefined" && process.env?.NEXT_PUBLIC_API_KEY) {
-      return process.env.NEXT_PUBLIC_API_KEY;
-    }
-  } catch {
+__name(onLogLevelChange, "onLogLevelChange");
+function applyRoleLogPolicy(opts) {
+  const devMode = opts.isDev ?? verboseByDefault;
+  if (opts.isAdmin || devMode) {
+    setLogLevel(4);
+  } else {
+    setLogLevel(1);
   }
-  return null;
 }
-__name(defaultApiKey, "defaultApiKey");
-var _localeOverride = null;
-var _apiKeyOverride = null;
-var _baseUrlOverride = null;
-var _withCredentials = true;
-var _onUnauthorized = null;
-var _refreshHandler = null;
-var _refreshInflight = null;
-var RETRY_MARKER = "X-Auth-Retry";
-var _client = null;
-function pushClientConfig() {
-  if (!_client) return;
-  _client.setConfig({
-    baseUrl: auth.getBaseUrl(),
-    credentials: _withCredentials ? "include" : "same-origin"
-  });
+__name(applyRoleLogPolicy, "applyRoleLogPolicy");
+
+// src/auth/hooks/useSession.ts
+import { useSyncExternalStore } from "react";
+function useSession() {
+  return useSyncExternalStore(auth.subscribe, auth.getSnapshot, auth.getServerSnapshot);
 }
-__name(pushClientConfig, "pushClientConfig");
-var auth = {
-  // ── Storage mode ──────────────────────────────────────────────────
-  getStorageMode() {
-    return _storageMode;
-  },
-  setStorageMode(mode) {
-    _storageMode = mode;
-    _storage = mode === "cookie" ? cookieBackend : localStorageBackend;
-  },
-  // ── Bearer token ──────────────────────────────────────────────────
-  getToken() {
-    return _storage.get(ACCESS_KEY);
-  },
-  setToken(token) {
-    _storage.set(ACCESS_KEY, token);
-  },
-  getRefreshToken() {
-    return _storage.get(REFRESH_KEY);
-  },
-  setRefreshToken(token) {
-    _storage.set(REFRESH_KEY, token);
-  },
-  clearTokens() {
-    _storage.set(ACCESS_KEY, null);
-    _storage.set(REFRESH_KEY, null);
-  },
-  isAuthenticated() {
-    return _storage.get(ACCESS_KEY) !== null;
-  },
-  // ── API key ───────────────────────────────────────────────────────
-  getApiKey() {
-    return _apiKeyOverride ?? _storage.get(API_KEY_KEY) ?? defaultApiKey();
-  },
-  setApiKey(key) {
-    _apiKeyOverride = key;
-  },
-  setApiKeyPersist(key) {
-    _apiKeyOverride = key;
-    _storage.set(API_KEY_KEY, key);
-  },
-  clearApiKey() {
-    _apiKeyOverride = null;
-    _storage.set(API_KEY_KEY, null);
-  },
-  // ── Locale ────────────────────────────────────────────────────────
-  getLocale() {
-    return _localeOverride ?? detectLocale();
-  },
-  setLocale(locale) {
-    _localeOverride = locale;
-  },
-  // ── Base URL ──────────────────────────────────────────────────────
-  getBaseUrl() {
-    const url = _baseUrlOverride ?? defaultBaseUrl();
-    return url.replace(/\/$/, "");
-  },
-  setBaseUrl(url) {
-    _baseUrlOverride = url ? url.replace(/\/$/, "") : null;
-    pushClientConfig();
-  },
-  // ── Credentials toggle ────────────────────────────────────────────
-  getWithCredentials() {
-    return _withCredentials;
-  },
-  setWithCredentials(value) {
-    _withCredentials = value;
-    pushClientConfig();
-  },
-  // ── 401 handler ───────────────────────────────────────────────────
-  /**
-   * Fired when the server returns 401 AND no refresh path recovers it
-   * (no refresh token, no refresh handler, refresh failed, or retry
-   * still 401). The app should clear local state and redirect to login.
-   *
-   * NOT fired for 401 that gets transparently recovered by the refresh
-   * handler — those are invisible to callers.
-   */
-  onUnauthorized(cb) {
-    _onUnauthorized = cb;
-  },
-  /**
-   * Register the refresh strategy. The handler receives the current
-   * refresh token and must call your refresh endpoint, returning
-   * `{ access, refresh? }` on success or `null` on failure.
-   *
-   * @example
-   *   auth.setRefreshHandler(async (refresh) => {
-   *     const { data } = await Auth.tokenRefreshCreate({ body: { refresh } });
-   *     return data ? { access: data.access, refresh: data.refresh } : null;
-   *   });
-   */
-  setRefreshHandler(fn) {
-    _refreshHandler = fn;
-  },
-  /**
-   * Proactively run the registered refresh handler right now, reusing the
-   * SAME single-flight promise as the 401-recovery interceptor. Callers
-   * (e.g. an expiry timer / focus / reconnect) get token rotation,
-   * de-duplication and rotated-token persistence for free — they must NOT
-   * re-implement any of it. Returns the fresh access token, or null if
-   * there is no handler / no refresh token / the refresh failed.
-   */
-  refreshNow() {
-    return tryRefresh();
-  }
-};
-async function tryRefresh() {
-  if (_refreshInflight) return _refreshInflight;
-  if (!_refreshHandler) return null;
-  const refresh = auth.getRefreshToken();
-  if (!refresh) return null;
-  _refreshInflight = (async () => {
-    try {
-      const result = await _refreshHandler(refresh);
-      if (!result?.access) return null;
-      auth.setToken(result.access);
-      if (result.refresh) auth.setRefreshToken(result.refresh);
-      return result.access;
-    } catch {
-      return null;
-    } finally {
-      _refreshInflight = null;
-    }
-  })();
-  return _refreshInflight;
-}
-__name(tryRefresh, "tryRefresh");
-function dpopEnabled2() {
-  try {
-    return typeof process !== "undefined" && process.env?.NEXT_PUBLIC_DPOP_ENABLED === "true";
-  } catch {
-    return false;
+__name(useSession, "useSession");
+
+// src/auth/hooks/useCfgRouter.ts
+import { useRouter as useNextRouter } from "next/navigation";
+import { useCallback, useMemo } from "react";
+function getBasePath() {
+  if (typeof process === "undefined") {
+    return "";
   }
+  return process.env.NEXT_PUBLIC_BASE_PATH || "";
 }
-__name(dpopEnabled2, "dpopEnabled");
-var _DPOP_DB = "cfg-auth";
-var _DPOP_STORE = "keys";
-var _DPOP_KEY_ID = "dpop-ec-p256";
-function _idbOpen() {
-  return new Promise((resolve, reject) => {
-    const req = indexedDB.open(_DPOP_DB, 1);
-    req.onupgradeneeded = () => req.result.createObjectStore(_DPOP_STORE);
-    req.onsuccess = () => resolve(req.result);
-    req.onerror = () => reject(req.error);
-  });
-}
-__name(_idbOpen, "_idbOpen");
-function _idbGet(key) {
-  return _idbOpen().then((db) => new Promise((resolve, reject) => {
-    const tx = db.transaction(_DPOP_STORE, "readonly");
-    const req = tx.objectStore(_DPOP_STORE).get(key);
-    req.onsuccess = () => resolve(req.result);
-    req.onerror = () => reject(req.error);
-  }));
-}
-__name(_idbGet, "_idbGet");
-function _idbPut(key, value) {
-  return _idbOpen().then((db) => new Promise((resolve, reject) => {
-    const tx = db.transaction(_DPOP_STORE, "readwrite");
-    tx.objectStore(_DPOP_STORE).put(value, key);
-    tx.oncomplete = () => resolve();
-    tx.onerror = () => reject(tx.error);
-  }));
-}
-__name(_idbPut, "_idbPut");
-var _dpopKeyPromise = null;
-function _getDpopKeyPair() {
-  if (_dpopKeyPromise) return _dpopKeyPromise;
-  _dpopKeyPromise = (async () => {
-    const existing = await _idbGet(_DPOP_KEY_ID).catch(() => void 0);
-    if (existing) return existing;
-    const pair = await crypto.subtle.generateKey(
-      { name: "ECDSA", namedCurve: "P-256" },
-      false,
-      // extractable:false — JS can sign but never export the private key
-      ["sign"]
-    );
-    await _idbPut(_DPOP_KEY_ID, pair).catch(() => {
-    });
-    return pair;
-  })();
-  return _dpopKeyPromise;
-}
-__name(_getDpopKeyPair, "_getDpopKeyPair");
-function _b64urlFromBytes(bytes) {
-  const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
-  let s = "";
-  for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i]);
-  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-__name(_b64urlFromBytes, "_b64urlFromBytes");
-function _b64urlFromString(str) {
-  return _b64urlFromBytes(new TextEncoder().encode(str));
-}
-__name(_b64urlFromString, "_b64urlFromString");
-async function _publicJwk(pub) {
-  const jwk = await crypto.subtle.exportKey("jwk", pub);
-  return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
-}
-__name(_publicJwk, "_publicJwk");
-async function _makeDpopProof(method, url) {
-  try {
-    const pair = await _getDpopKeyPair();
-    const jwk = await _publicJwk(pair.publicKey);
-    const header = { typ: "dpop+jwt", alg: "ES256", jwk };
-    const htu = url.split("#")[0].split("?")[0];
-    const jti = crypto.randomUUID && crypto.randomUUID() || _b64urlFromBytes(crypto.getRandomValues(new Uint8Array(16)));
-    const payload = { htm: method.toUpperCase(), htu, iat: Math.floor(Date.now() / 1e3), jti };
-    const signingInput = `${_b64urlFromString(JSON.stringify(header))}.${_b64urlFromString(JSON.stringify(payload))}`;
-    const sig = await crypto.subtle.sign(
-      { name: "ECDSA", hash: "SHA-256" },
-      pair.privateKey,
-      new TextEncoder().encode(signingInput)
-    );
-    return `${signingInput}.${_b64urlFromBytes(sig)}`;
-  } catch {
-    return null;
+__name(getBasePath, "getBasePath");
+function withBasePath(path, basePath) {
+  if (!basePath) {
+    return path;
   }
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  const normalizedBasePath = basePath.replace(/\/$/, "");
+  return `${normalizedBasePath}${normalizedPath}`;
 }
-__name(_makeDpopProof, "_makeDpopProof");
-function installAuthOnClient(client2) {
-  if (_client) return;
-  _client = client2;
-  client2.setConfig({
-    baseUrl: auth.getBaseUrl(),
-    credentials: _withCredentials ? "include" : "same-origin"
-  });
-  client2.interceptors.request.use(async (request) => {
-    const token = auth.getToken();
-    if (token) request.headers.set("Authorization", `Bearer ${token}`);
-    const locale = auth.getLocale();
-    if (locale) request.headers.set("Accept-Language", locale);
-    const apiKey = auth.getApiKey();
-    if (apiKey && !request.headers.has("X-API-Key")) request.headers.set("X-API-Key", apiKey);
-    try {
-      const tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
-      if (tz) request.headers.set("X-Timezone", tz);
-    } catch {
+__name(withBasePath, "withBasePath");
+function useCfgRouter() {
+  const router = useNextRouter();
+  const basePath = useMemo(() => getBasePath(), []);
+  const isStaticBuild2 = useMemo(() => {
+    return typeof process !== "undefined" && process.env.NEXT_PUBLIC_STATIC_BUILD === "true";
+  }, []);
+  const push = useCallback((href, options) => {
+    if (basePath) {
+      window.location.href = withBasePath(href, basePath);
+    } else {
+      router.push(href, options);
     }
-    request.headers.set("X-Client-Time", (/* @__PURE__ */ new Date()).toISOString());
-    if (dpopEnabled2() && typeof window !== "undefined") {
-      const proof = await _makeDpopProof(request.method, request.url);
-      if (proof) request.headers.set("DPoP", proof);
+  }, [router, basePath]);
+  const replace = useCallback((href, options) => {
+    if (basePath) {
+      window.location.replace(withBasePath(href, basePath));
+    } else {
+      router.replace(href, options);
     }
-    return request;
-  });
-  client2.interceptors.error.use((err, res, req) => {
-    if (err instanceof APIError) return err;
-    const url = req?.url ?? "";
-    const status = res?.status ?? 0;
-    const statusText = res?.statusText ?? "";
-    return new APIError(status, statusText, err, url);
-  });
-  client2.interceptors.response.use(async (response, request) => {
-    if (response.status !== 401) return response;
-    if (request.headers.get(RETRY_MARKER)) {
-      if (_onUnauthorized) {
-        try {
-          _onUnauthorized(response);
-        } catch {
-        }
-      }
-      return response;
-    }
-    const newToken = await tryRefresh();
-    if (!newToken) {
-      if (_onUnauthorized) {
-        try {
-          _onUnauthorized(response);
-        } catch {
-        }
-      }
-      return response;
-    }
-    const retry = request.clone();
-    retry.headers.set("Authorization", `Bearer ${newToken}`);
-    retry.headers.set(RETRY_MARKER, "1");
-    if (dpopEnabled2() && typeof window !== "undefined") {
-      const proof = await _makeDpopProof(retry.method, retry.url);
-      if (proof) retry.headers.set("DPoP", proof);
-    }
-    try {
-      const retried = await fetch(retry);
-      if (retried.status === 401 && _onUnauthorized) {
-        try {
-          _onUnauthorized(retried);
-        } catch {
-        }
-      }
-      return retried;
-    } catch {
-      if (_onUnauthorized) {
-        try {
-          _onUnauthorized(response);
-        } catch {
-        }
-      }
-      return response;
+  }, [router, basePath]);
+  const hardPush = useCallback((href) => {
+    window.location.href = withBasePath(href, basePath);
+  }, [basePath]);
+  const hardReplace = useCallback((href) => {
+    window.location.replace(withBasePath(href, basePath));
+  }, [basePath]);
+  const prefetch = useCallback((href) => {
+    router.prefetch(href);
+  }, [router]);
+  const back = useCallback(() => {
+    router.back();
+  }, [router]);
+  const forward = useCallback(() => {
+    router.forward();
+  }, [router]);
+  const refresh = useCallback(() => {
+    router.refresh();
+  }, [router]);
+  return {
+    push,
+    replace,
+    hardPush,
+    hardReplace,
+    prefetch,
+    back,
+    forward,
+    refresh
+  };
+}
+__name(useCfgRouter, "useCfgRouter");
+
+// src/auth/hooks/useQueryParams.ts
+import { usePathname } from "next/navigation";
+import { useEffect, useRef, useState } from "react";
+function useQueryParams() {
+  const pathname = usePathname();
+  const [queryParams, setQueryParams] = useState(() => {
+    if (typeof window === "undefined") {
+      return new URLSearchParams();
     }
+    return new URLSearchParams(window.location.search);
   });
+  const lastSearchRef = useRef("");
+  useEffect(() => {
+    if (typeof window === "undefined") return;
+    const updateQueryParams = /* @__PURE__ */ __name(() => {
+      const currentSearch = window.location.search;
+      if (currentSearch !== lastSearchRef.current) {
+        lastSearchRef.current = currentSearch;
+        setQueryParams(new URLSearchParams(currentSearch));
+      }
+    }, "updateQueryParams");
+    updateQueryParams();
+    window.addEventListener("popstate", updateQueryParams);
+    const origPush = window.history.pushState;
+    const origReplace = window.history.replaceState;
+    window.history.pushState = function(...args) {
+      const result = origPush.apply(this, args);
+      updateQueryParams();
+      return result;
+    };
+    window.history.replaceState = function(...args) {
+      const result = origReplace.apply(this, args);
+      updateQueryParams();
+      return result;
+    };
+    return () => {
+      window.removeEventListener("popstate", updateQueryParams);
+      window.history.pushState = origPush;
+      window.history.replaceState = origReplace;
+    };
+  }, [pathname]);
+  return queryParams;
 }
-__name(installAuthOnClient, "installAuthOnClient");
+__name(useQueryParams, "useQueryParams");
 
-// src/_api/generated/helpers/logger.ts
-import { createConsola as createConsola2 } from "consola";
-var DEFAULT_CONFIG = {
-  enabled: typeof process !== "undefined" && process.env.NODE_ENV !== "production",
-  logRequests: true,
-  logResponses: true,
-  logErrors: true,
-  logBodies: true,
-  logHeaders: false
-};
-var SENSITIVE_HEADERS = [
-  "authorization",
-  "cookie",
-  "set-cookie",
-  "x-api-key",
-  "x-csrf-token"
-];
-var APILogger = class {
-  static {
-    __name(this, "APILogger");
-  }
-  config;
-  consola;
-  constructor(config = {}) {
-    this.config = { ...DEFAULT_CONFIG, ...config };
-    this.consola = config.consola || createConsola2({
-      level: this.config.enabled ? 4 : 0
-    });
-  }
-  enable() {
-    this.config.enabled = true;
-  }
-  disable() {
-    this.config.enabled = false;
-  }
-  setConfig(config) {
-    this.config = { ...this.config, ...config };
-  }
-  filterHeaders(headers) {
-    if (!headers) return {};
-    const filtered = {};
-    Object.keys(headers).forEach((key) => {
-      filtered[key] = SENSITIVE_HEADERS.includes(key.toLowerCase()) ? "***" : headers[key] || "";
-    });
-    return filtered;
-  }
-  logRequest(request) {
-    if (!this.config.enabled || !this.config.logRequests) return;
-    const { method, url, headers, body } = request;
-    this.consola.start(`${method} ${url}`);
-    if (this.config.logHeaders && headers) this.consola.debug("Headers:", this.filterHeaders(headers));
-    if (this.config.logBodies && body) this.consola.debug("Body:", body);
-  }
-  logResponse(request, response) {
-    if (!this.config.enabled || !this.config.logResponses) return;
-    const { method, url } = request;
-    const { status, statusText, data, duration } = response;
-    this.consola.success(`${method} ${url} ${status} ${statusText} (${duration}ms)`);
-    if (this.config.logBodies && data) this.consola.debug("Response:", data);
-  }
-  logError(request, error) {
-    if (!this.config.enabled || !this.config.logErrors) return;
-    const { method, url } = request;
-    const { message, statusCode, fieldErrors, duration } = error;
-    this.consola.error(`${method} ${url} ${statusCode || "Network"} Error (${duration}ms)`);
-    this.consola.error("Message:", message);
-    if (fieldErrors && Object.keys(fieldErrors).length > 0) {
-      this.consola.error("Field Errors:");
-      Object.entries(fieldErrors).forEach(([field, errors]) => {
-        errors.forEach((err) => this.consola.error(`  \u2022 ${field}: ${err}`));
+// src/auth/hooks/useAuthFormState.ts
+import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
+var formatCountdown = /* @__PURE__ */ __name((s) => {
+  if (s <= 0) return "";
+  const m = Math.floor(s / 60);
+  return m > 0 ? `${m}:${String(s % 60).padStart(2, "0")}` : `${s}s`;
+}, "formatCountdown");
+var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
+  const [identifier, setIdentifier] = useState2(initialIdentifier);
+  const [otp, setOtp] = useState2("");
+  const [isLoading, setIsLoading] = useState2(false);
+  const [acceptedTerms, setAcceptedTerms] = useState2(true);
+  const [step, setStep] = useState2("identifier");
+  const [error, setError] = useState2("");
+  const [webmail, setWebmail] = useState2(null);
+  const [twoFactorSessionId, setTwoFactorSessionId] = useState2(null);
+  const [shouldPrompt2FA, setShouldPrompt2FA] = useState2(false);
+  const [twoFactorCode, setTwoFactorCode] = useState2("");
+  const [useBackupCode, setUseBackupCode] = useState2(false);
+  const [rateLimitSeconds, setRateLimitSeconds] = useState2(0);
+  const rateLimitTimerRef = useRef2(null);
+  const startRateLimitCountdown = useCallback2((seconds) => {
+    if (rateLimitTimerRef.current) clearInterval(rateLimitTimerRef.current);
+    setRateLimitSeconds(seconds);
+    rateLimitTimerRef.current = setInterval(() => {
+      setRateLimitSeconds((prev) => {
+        if (prev <= 1) {
+          clearInterval(rateLimitTimerRef.current);
+          rateLimitTimerRef.current = null;
+          return 0;
+        }
+        return prev - 1;
       });
-    }
-  }
-  info(message, ...args) {
-    if (this.config.enabled) this.consola.info(message, ...args);
-  }
-  warn(message, ...args) {
-    if (this.config.enabled) this.consola.warn(message, ...args);
-  }
-  error(message, ...args) {
-    if (this.config.enabled) this.consola.error(message, ...args);
-  }
-  debug(message, ...args) {
-    if (this.config.enabled) this.consola.debug(message, ...args);
-  }
-  success(message, ...args) {
-    if (this.config.enabled) this.consola.success(message, ...args);
-  }
-  withTag(tag) {
-    return this.consola.withTag(tag);
-  }
-};
-var defaultLogger = new APILogger();
+    }, 1e3);
+  }, []);
+  useEffect2(() => () => {
+    if (rateLimitTimerRef.current) clearInterval(rateLimitTimerRef.current);
+  }, []);
+  const clearError = useCallback2(() => setError(""), []);
+  return {
+    // State
+    identifier,
+    otp,
+    isLoading,
+    acceptedTerms,
+    step,
+    error,
+    twoFactorSessionId,
+    shouldPrompt2FA,
+    twoFactorCode,
+    useBackupCode,
+    rateLimitSeconds,
+    isRateLimited: rateLimitSeconds > 0,
+    rateLimitLabel: formatCountdown(rateLimitSeconds),
+    webmail,
+    // Handlers
+    setIdentifier,
+    setOtp,
+    setAcceptedTerms,
+    setError,
+    clearError,
+    setStep,
+    setIsLoading,
+    setTwoFactorSessionId,
+    setShouldPrompt2FA,
+    setTwoFactorCode,
+    setUseBackupCode,
+    startRateLimitCountdown,
+    setWebmail
+  };
+}, "useAuthFormState");
+
+// src/auth/hooks/useAuthValidation.ts
+import { useCallback as useCallback3 } from "react";
+var EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var useAuthValidation = /* @__PURE__ */ __name(() => {
+  const validateIdentifier2 = useCallback3((id) => {
+    return EMAIL_REGEX.test(id);
+  }, []);
+  return { validateIdentifier: validateIdentifier2 };
+}, "useAuthValidation");
+var validateIdentifier = /* @__PURE__ */ __name((id) => EMAIL_REGEX.test(id), "validateIdentifier");
+
+// src/auth/hooks/useAuthForm.ts
+import { useCallback as useCallback5, useEffect as useEffect4, useRef as useRef4 } from "react";
+
+// src/auth/utils/logger.ts
+import { createConsola as createConsola2 } from "consola";
+var logger = createConsola2({
+  level: getLogLevel()
+}).withTag("api");
+onLogLevelChange((level) => {
+  logger.level = level;
+});
+var authLogger = logger.withTag("auth");
+
+// src/auth/hooks/useAutoAuth.ts
+import { usePathname as usePathname2 } from "next/navigation";
+import { useEffect as useEffect3, useRef as useRef3 } from "react";
+
+// src/auth/utils/path.ts
+var normalizePath = /* @__PURE__ */ __name((path) => {
+  if (!path) return "";
+  const withoutLocale = path.replace(/^\/[a-z]{2}(?=\/|$)/, "");
+  const trimmed = withoutLocale.replace(/\/+$/, "");
+  return trimmed || "/";
+}, "normalizePath");
+var isAllowedAuthPath = /* @__PURE__ */ __name((pathname, allowedPaths) => {
+  const normalized = normalizePath(pathname);
+  return allowedPaths.some(
+    (p) => normalized === p || normalized.startsWith(p + "/")
+  );
+}, "isAllowedAuthPath");
+
+// src/auth/hooks/useAutoAuth.ts
+var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
+  const { onOTPDetected, cleanupUrl = true, allowedPaths = ["/auth"] } = options;
+  const queryParams = useQueryParams();
+  const pathname = usePathname2();
+  const router = useCfgRouter();
+  const isAllowedPath = isAllowedAuthPath(pathname, allowedPaths);
+  const queryOtp = queryParams.get("otp") || "";
+  const queryEmail = queryParams.get("email") || void 0;
+  const hasOTP = !!queryOtp;
+  const isReady = !!pathname && hasOTP && isAllowedPath;
+  const otpValid = queryOtp.length === AUTH_CONSTANTS.EMAIL_OTP_LENGTH;
+  const onOTPDetectedRef = useRef3(onOTPDetected);
+  onOTPDetectedRef.current = onOTPDetected;
+  useEffect3(() => {
+    if (!isReady || !otpValid) return;
+    authLogger.info("OTP detected in URL on auth page:", queryOtp);
+    onOTPDetectedRef.current?.(queryOtp, queryEmail);
+  }, [isReady, otpValid, queryOtp, queryEmail]);
+  useEffect3(() => {
+    if (!isReady || !cleanupUrl || !queryOtp) return;
+    const cleanQuery = Object.fromEntries(queryParams.entries());
+    delete cleanQuery.otp;
+    delete cleanQuery.email;
+    const queryString = new URLSearchParams(cleanQuery).toString();
+    const realPathname = typeof window !== "undefined" ? window.location.pathname : pathname;
+    router.replace(queryString ? `${realPathname}?${queryString}` : realPathname);
+  }, [isReady, cleanupUrl, queryOtp]);
+  return {
+    isReady,
+    hasOTP,
+    isAllowedPath
+  };
+}, "useAutoAuth");
+
+// src/auth/hooks/useTwoFactor.ts
+import { useCallback as useCallback4, useState as useState4 } from "react";
 
 // src/_api/generated/core/bodySerializer.gen.ts
 var serializeFormDataPair = /* @__PURE__ */ __name((data, key, value) => {
@@ -1733,103 +1905,6 @@ var client = createClient(createConfig({ baseUrl: "http://localhost:8000" }));
 installAuthOnClient(client);
 
 // src/_api/generated/sdk.gen.ts
-var CfgAccountsApiKey = class {
-  static {
-    __name(this, "CfgAccountsApiKey");
-  }
-  /**
-   * Get API key details
-   *
-   * Retrieve the current user's API key (masked) and metadata.
-   */
-  static cfgAccountsApiKeyRetrieve(options) {
-    return (options?.client ?? client).get({
-      security: [
-        { scheme: "bearer", type: "http" },
-        {
-          in: "cookie",
-          name: "sessionid",
-          type: "apiKey"
-        },
-        { name: "X-API-Key", type: "apiKey" }
-      ],
-      url: "/cfg/accounts/api-key/",
-      ...options
-    });
-  }
-  /**
-   * Regenerate API key
-   *
-   * Generate a new API key. The full key is returned only once.
-   */
-  static cfgAccountsApiKeyRegenerateCreate(options) {
-    return (options.client ?? client).post({
-      security: [
-        { scheme: "bearer", type: "http" },
-        {
-          in: "cookie",
-          name: "sessionid",
-          type: "apiKey"
-        },
-        { name: "X-API-Key", type: "apiKey" }
-      ],
-      url: "/cfg/accounts/api-key/regenerate/",
-      ...options,
-      headers: {
-        "Content-Type": "application/json",
-        ...options.headers
-      }
-    });
-  }
-  /**
-   * Reveal API key
-   *
-   * Return the current full API key WITHOUT rotating it. The same durable value every one of the user's agents uses — for the signed-in user to copy and paste into agent onboarding. Default GET stays masked; this is the explicit reveal action.
-   */
-  static cfgAccountsApiKeyRevealCreate(options) {
-    return (options.client ?? client).post({
-      security: [
-        { scheme: "bearer", type: "http" },
-        {
-          in: "cookie",
-          name: "sessionid",
-          type: "apiKey"
-        },
-        { name: "X-API-Key", type: "apiKey" }
-      ],
-      url: "/cfg/accounts/api-key/reveal/",
-      ...options,
-      headers: {
-        "Content-Type": "application/json",
-        ...options.headers
-      }
-    });
-  }
-  /**
-   * Test API key
-   *
-   * Test whether an API key is valid without consuming it.
-   */
-  static cfgAccountsApiKeyTestCreate(options) {
-    return (options.client ?? client).post({
-      security: [
-        { scheme: "bearer", type: "http" },
-        {
-          in: "cookie",
-          name: "sessionid",
-          type: "apiKey"
-        },
-        { name: "X-API-Key", type: "apiKey" }
-      ],
-      url: "/cfg/accounts/api-key/test/",
-      ...options,
-      headers: {
-        "Content-Type": "application/json",
-        ...options.headers
-      }
-    });
-  }
-};
 var CfgAccountsOauth = class {
   static {
     __name(this, "CfgAccountsOauth");
@@ -1841,7 +1916,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthConnectionsList(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/accounts/oauth/connections/",
       ...options
     });
@@ -1853,7 +1932,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthDisconnectCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/accounts/oauth/disconnect/",
       ...options,
       headers: {
@@ -1910,7 +1993,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpRequestCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/accounts/otp/request/",
       ...options,
       headers: {
@@ -1931,7 +2018,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpVerifyCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/accounts/otp/verify/",
       ...options,
       headers: {
@@ -1969,7 +2060,11 @@ var CfgAccountsProfile = class {
   static cfgAccountsProfileAvatarCreate(options) {
     return (options?.client ?? client).post({
       ...formDataBodySerializer,
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/accounts/profile/avatar/",
       ...options,
       headers: {
@@ -2090,17 +2185,15 @@ var CfgAccountsAuth = class {
     __name(this, "CfgAccountsAuth");
   }
   /**
-   * Refresh JWT token.
+   * Revoke a refresh token (logout).
    *
-   * DPoP-aware: when the incoming refresh token is key-bound (`cnf.jkt`), the
-   * rotated access/refresh in the response are re-stamped with the same `cnf`
-   * (stock SimpleJWT drops it from the derived access), and a matching DPoP
-   * proof is required on the refresh request — so a stolen refresh token can't
-   * be used to mint fresh tokens.
+   * Blacklists the posted refresh token so it can never mint another access
+   * token. Called best-effort by the client's logout — without it, "logout"
+   * is purely client-side and a stolen refresh token survives until expiry.
    */
-  static cfgAccountsTokenRefreshCreate(options) {
+  static cfgAccountsTokenBlacklistCreate(options) {
     return (options.client ?? client).post({
-      url: "/cfg/accounts/token/refresh/",
+      url: "/cfg/accounts/token/blacklist/",
       ...options,
       headers: {
         "Content-Type": "application/json",
@@ -2108,48 +2201,18 @@ var CfgAccountsAuth = class {
       }
     });
   }
-};
-var CfgCentrifugo = class {
-  static {
-    __name(this, "CfgCentrifugo");
-  }
-  /**
-   * Get Centrifugo connection token
-   *
-   * Generate JWT token for WebSocket connection to Centrifugo. Token includes user's allowed channels based on their permissions. Requires authentication.
-   */
-  static cfgCentrifugoAuthTokenRetrieve(options) {
-    return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
-      url: "/cfg/centrifugo/auth/token/",
-      ...options
-    });
-  }
-};
-var CfgTotpBackupCodes = class {
-  static {
-    __name(this, "CfgTotpBackupCodes");
-  }
-  /**
-   * Get backup codes status for user.
-   */
-  static cfgTotpBackupCodesRetrieve(options) {
-    return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
-      url: "/cfg/totp/backup-codes/",
-      ...options
-    });
-  }
   /**
-   * Regenerate backup codes.
+   * Refresh JWT token.
    *
-   * Requires TOTP code for verification.
-   * Invalidates all existing codes.
+   * DPoP-aware: when the incoming refresh token is key-bound (`cnf.jkt`), the
+   * rotated access/refresh in the response are re-stamped with the same `cnf`
+   * (stock SimpleJWT drops it from the derived access), and a matching DPoP
+   * proof is required on the refresh request — so a stolen refresh token can't
+   * be used to mint fresh tokens.
    */
-  static cfgTotpBackupCodesRegenerateCreate(options) {
+  static cfgAccountsTokenRefreshCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
-      url: "/cfg/totp/backup-codes/regenerate/",
+      url: "/cfg/accounts/token/refresh/",
       ...options,
       headers: {
         "Content-Type": "application/json",
@@ -2167,7 +2230,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/totp/devices/",
       ...options
     });
@@ -2179,7 +2246,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesDestroy(options) {
     return (options.client ?? client).delete({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/totp/devices/{id}/",
       ...options
     });
@@ -2191,7 +2262,11 @@ var CfgTotp = class {
    */
   static cfgTotpDisableCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/totp/disable/",
       ...options,
       headers: {
@@ -2212,298 +2287,86 @@ var CfgTotpSetup = class {
    */
   static cfgTotpSetupCreate(options) {
     return (options?.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
-      url: "/cfg/totp/setup/",
-      ...options,
-      headers: {
-        "Content-Type": "application/json",
-        ...options?.headers
-      }
-    });
-  }
-  /**
-   * Confirm 2FA setup with first valid code.
-   *
-   * Activates the device and generates backup codes.
-   */
-  static cfgTotpSetupConfirmCreate(options) {
-    return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
-      url: "/cfg/totp/setup/confirm/",
-      ...options,
-      headers: {
-        "Content-Type": "application/json",
-        ...options.headers
-      }
-    });
-  }
-};
-var CfgTotpVerify = class {
-  static {
-    __name(this, "CfgTotpVerify");
-  }
-  /**
-   * Verify TOTP code for 2FA session.
-   *
-   * Completes authentication and returns JWT tokens on success.
-   */
-  static cfgTotpVerifyCreate(options) {
-    return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
-      url: "/cfg/totp/verify/",
-      ...options,
-      headers: {
-        "Content-Type": "application/json",
-        ...options.headers
-      }
-    });
-  }
-  /**
-   * Verify backup recovery code for 2FA session.
-   *
-   * Alternative verification method when TOTP device unavailable.
-   */
-  static cfgTotpVerifyBackupCreate(options) {
-    return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
-      url: "/cfg/totp/verify/backup/",
-      ...options,
-      headers: {
-        "Content-Type": "application/json",
-        ...options.headers
-      }
-    });
-  }
-};
-
-// src/_api/generated/_cfg_accounts/api.ts
-var API = class {
-  static {
-    __name(this, "API");
-  }
-  logger;
-  cfgAccountsApiKey = CfgAccountsApiKey;
-  cfgAccountsOauth = CfgAccountsOauth;
-  cfgAccounts = CfgAccounts;
-  cfgAccountsProfile = CfgAccountsProfile;
-  cfgAccountsAuth = CfgAccountsAuth;
-  constructor(_baseUrl, opts = {}) {
-    this.logger = new APILogger(opts.logger);
-    if (_baseUrl) auth.setBaseUrl(_baseUrl);
-    if (opts.locale !== void 0) auth.setLocale(opts.locale);
-    if (opts.apiKey !== void 0) auth.setApiKey(opts.apiKey);
-    if (opts.withCredentials !== void 0) auth.setWithCredentials(opts.withCredentials);
-  }
-  // ── Base URL ────────────────────────────────────────────────────────────
-  getBaseUrl() {
-    return auth.getBaseUrl();
-  }
-  setBaseUrl(url) {
-    auth.setBaseUrl(url);
-  }
-  // ── Tokens ──────────────────────────────────────────────────────────────
-  getToken() {
-    return auth.getToken();
-  }
-  setToken(token) {
-    auth.setToken(token);
-  }
-  getRefreshToken() {
-    return auth.getRefreshToken();
-  }
-  setRefreshToken(token) {
-    auth.setRefreshToken(token);
-  }
-  clearToken() {
-    auth.clearTokens();
-  }
-  isAuthenticated() {
-    return auth.isAuthenticated();
-  }
-  // ── Locale / API key ────────────────────────────────────────────────────
-  getLocale() {
-    return auth.getLocale();
-  }
-  setLocale(locale) {
-    auth.setLocale(locale);
-  }
-  getApiKey() {
-    return auth.getApiKey();
-  }
-  setApiKey(key) {
-    auth.setApiKey(key);
-  }
-  // ── 401 handling ────────────────────────────────────────────────────────
-  /** Fired only on terminal 401 (after refresh+retry path is exhausted). */
-  onUnauthorized(cb) {
-    auth.onUnauthorized(cb);
-  }
-  /** Provide a refresh strategy. See `auth.setRefreshHandler` for the contract. */
-  setRefreshHandler(fn) {
-    auth.setRefreshHandler(fn);
-  }
-  /**
-   * Proactively refresh now via the registered handler, sharing the single
-   * 401-recovery flight (rotation + dedup + rotated-token persistence).
-   * See `auth.refreshNow`.
-   */
-  refreshNow() {
-    return auth.refreshNow();
-  }
-};
-
-// src/_api/generated/_cfg_centrifugo/api.ts
-var API2 = class {
-  static {
-    __name(this, "API");
-  }
-  logger;
-  cfgCentrifugo = CfgCentrifugo;
-  constructor(_baseUrl, opts = {}) {
-    this.logger = new APILogger(opts.logger);
-    if (_baseUrl) auth.setBaseUrl(_baseUrl);
-    if (opts.locale !== void 0) auth.setLocale(opts.locale);
-    if (opts.apiKey !== void 0) auth.setApiKey(opts.apiKey);
-    if (opts.withCredentials !== void 0) auth.setWithCredentials(opts.withCredentials);
-  }
-  // ── Base URL ────────────────────────────────────────────────────────────
-  getBaseUrl() {
-    return auth.getBaseUrl();
-  }
-  setBaseUrl(url) {
-    auth.setBaseUrl(url);
-  }
-  // ── Tokens ──────────────────────────────────────────────────────────────
-  getToken() {
-    return auth.getToken();
-  }
-  setToken(token) {
-    auth.setToken(token);
-  }
-  getRefreshToken() {
-    return auth.getRefreshToken();
-  }
-  setRefreshToken(token) {
-    auth.setRefreshToken(token);
-  }
-  clearToken() {
-    auth.clearTokens();
-  }
-  isAuthenticated() {
-    return auth.isAuthenticated();
-  }
-  // ── Locale / API key ────────────────────────────────────────────────────
-  getLocale() {
-    return auth.getLocale();
-  }
-  setLocale(locale) {
-    auth.setLocale(locale);
-  }
-  getApiKey() {
-    return auth.getApiKey();
-  }
-  setApiKey(key) {
-    auth.setApiKey(key);
-  }
-  // ── 401 handling ────────────────────────────────────────────────────────
-  /** Fired only on terminal 401 (after refresh+retry path is exhausted). */
-  onUnauthorized(cb) {
-    auth.onUnauthorized(cb);
-  }
-  /** Provide a refresh strategy. See `auth.setRefreshHandler` for the contract. */
-  setRefreshHandler(fn) {
-    auth.setRefreshHandler(fn);
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/totp/setup/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options?.headers
+      }
+    });
   }
   /**
-   * Proactively refresh now via the registered handler, sharing the single
-   * 401-recovery flight (rotation + dedup + rotated-token persistence).
-   * See `auth.refreshNow`.
+   * Confirm 2FA setup with first valid code.
+   *
+   * Activates the device and generates backup codes.
    */
-  refreshNow() {
-    return auth.refreshNow();
+  static cfgTotpSetupConfirmCreate(options) {
+    return (options.client ?? client).post({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/totp/setup/confirm/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
   }
 };
-
-// src/_api/generated/_cfg_totp/api.ts
-var API3 = class {
+var CfgTotpVerify = class {
   static {
-    __name(this, "API");
-  }
-  logger;
-  cfgTotpBackupCodes = CfgTotpBackupCodes;
-  cfgTotp = CfgTotp;
-  cfgTotpSetup = CfgTotpSetup;
-  cfgTotpVerify = CfgTotpVerify;
-  constructor(_baseUrl, opts = {}) {
-    this.logger = new APILogger(opts.logger);
-    if (_baseUrl) auth.setBaseUrl(_baseUrl);
-    if (opts.locale !== void 0) auth.setLocale(opts.locale);
-    if (opts.apiKey !== void 0) auth.setApiKey(opts.apiKey);
-    if (opts.withCredentials !== void 0) auth.setWithCredentials(opts.withCredentials);
-  }
-  // ── Base URL ────────────────────────────────────────────────────────────
-  getBaseUrl() {
-    return auth.getBaseUrl();
-  }
-  setBaseUrl(url) {
-    auth.setBaseUrl(url);
-  }
-  // ── Tokens ──────────────────────────────────────────────────────────────
-  getToken() {
-    return auth.getToken();
-  }
-  setToken(token) {
-    auth.setToken(token);
-  }
-  getRefreshToken() {
-    return auth.getRefreshToken();
-  }
-  setRefreshToken(token) {
-    auth.setRefreshToken(token);
-  }
-  clearToken() {
-    auth.clearTokens();
-  }
-  isAuthenticated() {
-    return auth.isAuthenticated();
-  }
-  // ── Locale / API key ────────────────────────────────────────────────────
-  getLocale() {
-    return auth.getLocale();
-  }
-  setLocale(locale) {
-    auth.setLocale(locale);
-  }
-  getApiKey() {
-    return auth.getApiKey();
-  }
-  setApiKey(key) {
-    auth.setApiKey(key);
-  }
-  // ── 401 handling ────────────────────────────────────────────────────────
-  /** Fired only on terminal 401 (after refresh+retry path is exhausted). */
-  onUnauthorized(cb) {
-    auth.onUnauthorized(cb);
+    __name(this, "CfgTotpVerify");
   }
-  /** Provide a refresh strategy. See `auth.setRefreshHandler` for the contract. */
-  setRefreshHandler(fn) {
-    auth.setRefreshHandler(fn);
+  /**
+   * Verify TOTP code for 2FA session.
+   *
+   * Completes authentication and returns JWT tokens on success.
+   */
+  static cfgTotpVerifyCreate(options) {
+    return (options.client ?? client).post({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/totp/verify/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
   }
   /**
-   * Proactively refresh now via the registered handler, sharing the single
-   * 401-recovery flight (rotation + dedup + rotated-token persistence).
-   * See `auth.refreshNow`.
+   * Verify backup recovery code for 2FA session.
+   *
+   * Alternative verification method when TOTP device unavailable.
    */
-  refreshNow() {
-    return auth.refreshNow();
+  static cfgTotpVerifyBackupCreate(options) {
+    return (options.client ?? client).post({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/totp/verify/backup/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
   }
 };
 
-// src/_api/generated/index.ts
-var CfgAccountsApi = new API();
-var CfgCentrifugoApi = new API2();
-var CfgTotpApi = new API3();
-
 // src/auth/utils/analytics.ts
 var AnalyticsEvent = /* @__PURE__ */ ((AnalyticsEvent2) => {
   AnalyticsEvent2["AUTH_OTP_REQUEST"] = "auth_otp_request";
@@ -2537,24 +2400,229 @@ var Analytics = {
     if (isDev) {
       console.log("[Analytics] Set user:", userId);
     }
-  }
-};
+  }
+};
+
+// src/auth/hooks/useSessionStorage.ts
+import { useState as useState3 } from "react";
+function useSessionStorage(key, initialValue) {
+  const [storedValue, setStoredValue] = useState3(() => {
+    if (typeof window === "undefined") {
+      return initialValue;
+    }
+    try {
+      const item = window.sessionStorage.getItem(key);
+      return item ? JSON.parse(item) : initialValue;
+    } catch (error) {
+      authLogger.error(`Error reading sessionStorage key "${key}":`, error);
+      return initialValue;
+    }
+  });
+  const checkDataSize = /* @__PURE__ */ __name((data) => {
+    try {
+      const jsonString = JSON.stringify(data);
+      const sizeInBytes = new Blob([jsonString]).size;
+      const sizeInKB = sizeInBytes / 1024;
+      if (sizeInKB > 1024) {
+        authLogger.warn(`Data size (${sizeInKB.toFixed(2)}KB) exceeds 1MB limit for key "${key}"`);
+        return false;
+      }
+      return true;
+    } catch (error) {
+      authLogger.error(`Error checking data size for key "${key}":`, error);
+      return false;
+    }
+  }, "checkDataSize");
+  const clearOldData = /* @__PURE__ */ __name(() => {
+    try {
+      const keys = Object.keys(sessionStorage).filter((key2) => key2 && typeof key2 === "string");
+      if (keys.length > 50) {
+        const itemsToRemove = Math.ceil(keys.length * 0.2);
+        for (let i = 0; i < itemsToRemove; i++) {
+          try {
+            const key2 = keys[i];
+            if (key2) {
+              sessionStorage.removeItem(key2);
+              sessionStorage.removeItem(`${key2}_timestamp`);
+            }
+          } catch {
+          }
+        }
+      }
+    } catch (error) {
+      authLogger.error("Error clearing old sessionStorage data:", error);
+    }
+  }, "clearOldData");
+  const forceClearAll = /* @__PURE__ */ __name(() => {
+    try {
+      const keys = Object.keys(sessionStorage);
+      for (const key2 of keys) {
+        try {
+          sessionStorage.removeItem(key2);
+        } catch {
+        }
+      }
+    } catch (error) {
+      authLogger.error("Error force clearing sessionStorage:", error);
+    }
+  }, "forceClearAll");
+  const setValue = /* @__PURE__ */ __name((value) => {
+    try {
+      const valueToStore = value instanceof Function ? value(storedValue) : value;
+      if (!checkDataSize(valueToStore)) {
+        authLogger.warn(`Data size too large for key "${key}", removing key`);
+        try {
+          window.sessionStorage.removeItem(key);
+          window.sessionStorage.removeItem(`${key}_timestamp`);
+        } catch {
+        }
+        setStoredValue(valueToStore);
+        return;
+      }
+      setStoredValue(valueToStore);
+      if (typeof window !== "undefined") {
+        try {
+          window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
+          window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
+        } catch (storageError) {
+          if (storageError.name === "QuotaExceededError" || storageError.code === 22 || storageError.message?.includes("quota")) {
+            authLogger.warn("sessionStorage quota exceeded, clearing old data...");
+            clearOldData();
+            try {
+              window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
+              window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
+            } catch (retryError) {
+              authLogger.error(`Failed to set sessionStorage key "${key}" after clearing old data:`, retryError);
+              try {
+                forceClearAll();
+                window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
+                window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
+              } catch (finalError) {
+                authLogger.error(`Failed to set sessionStorage key "${key}" after force clearing:`, finalError);
+                setStoredValue(valueToStore);
+              }
+            }
+          } else {
+            throw storageError;
+          }
+        }
+      }
+    } catch (error) {
+      authLogger.error(`Error setting sessionStorage key "${key}":`, error);
+      const valueToStore = value instanceof Function ? value(storedValue) : value;
+      setStoredValue(valueToStore);
+    }
+  }, "setValue");
+  const removeValue = /* @__PURE__ */ __name(() => {
+    try {
+      setStoredValue(initialValue);
+      if (typeof window !== "undefined") {
+        try {
+          window.sessionStorage.removeItem(key);
+          window.sessionStorage.removeItem(`${key}_timestamp`);
+        } catch (removeError) {
+          if (removeError.name === "QuotaExceededError" || removeError.code === 22 || removeError.message?.includes("quota")) {
+            authLogger.warn("sessionStorage quota exceeded during removal, clearing old data...");
+            clearOldData();
+            try {
+              window.sessionStorage.removeItem(key);
+              window.sessionStorage.removeItem(`${key}_timestamp`);
+            } catch (retryError) {
+              authLogger.error(`Failed to remove sessionStorage key "${key}" after clearing:`, retryError);
+              forceClearAll();
+            }
+          } else {
+            throw removeError;
+          }
+        }
+      }
+    } catch (error) {
+      authLogger.error(`Error removing sessionStorage key "${key}":`, error);
+    }
+  }, "removeValue");
+  return [storedValue, setValue, removeValue];
+}
+__name(useSessionStorage, "useSessionStorage");
+
+// src/auth/hooks/useAuthRedirect.ts
+var AUTH_REDIRECT_KEY = "auth_redirect_url";
+var getRedirectFromStorage = /* @__PURE__ */ __name(() => {
+  if (typeof window === "undefined") return "";
+  try {
+    const item = window.sessionStorage.getItem(AUTH_REDIRECT_KEY);
+    return item ? JSON.parse(item) : "";
+  } catch {
+    return "";
+  }
+}, "getRedirectFromStorage");
+var clearRedirectFromStorage = /* @__PURE__ */ __name(() => {
+  if (typeof window === "undefined") return;
+  try {
+    window.sessionStorage.removeItem(AUTH_REDIRECT_KEY);
+    window.sessionStorage.removeItem(`${AUTH_REDIRECT_KEY}_timestamp`);
+  } catch {
+  }
+}, "clearRedirectFromStorage");
+var peekSavedRedirect = /* @__PURE__ */ __name(() => getRedirectFromStorage() || null, "peekSavedRedirect");
+var consumeSavedRedirect = /* @__PURE__ */ __name(() => {
+  const stored = getRedirectFromStorage();
+  if (stored) clearRedirectFromStorage();
+  return stored || null;
+}, "consumeSavedRedirect");
+var useAuthRedirectManager = /* @__PURE__ */ __name((options = {}) => {
+  const { fallbackUrl = "/dashboard", clearOnUse = true } = options;
+  const [redirectUrl, setRedirectUrl, removeRedirectUrl] = useSessionStorage(AUTH_REDIRECT_KEY, "");
+  const setRedirect = /* @__PURE__ */ __name((url) => {
+    setRedirectUrl(url);
+  }, "setRedirect");
+  const getRedirect = /* @__PURE__ */ __name(() => {
+    return getRedirectFromStorage() || redirectUrl;
+  }, "getRedirect");
+  const clearRedirect = /* @__PURE__ */ __name(() => {
+    removeRedirectUrl();
+    clearRedirectFromStorage();
+  }, "clearRedirect");
+  const hasRedirect = /* @__PURE__ */ __name(() => {
+    const stored = getRedirectFromStorage();
+    return stored.length > 0 || redirectUrl.length > 0;
+  }, "hasRedirect");
+  const getFinalRedirectUrl = /* @__PURE__ */ __name(() => {
+    const stored = getRedirectFromStorage();
+    return stored || redirectUrl || fallbackUrl;
+  }, "getFinalRedirectUrl");
+  const useAndClearRedirect = /* @__PURE__ */ __name(() => {
+    const stored = getRedirectFromStorage();
+    const finalUrl = stored || redirectUrl || fallbackUrl;
+    if (clearOnUse) {
+      clearRedirect();
+    }
+    return finalUrl;
+  }, "useAndClearRedirect");
+  return {
+    redirectUrl,
+    setRedirect,
+    getRedirect,
+    clearRedirect,
+    hasRedirect,
+    getFinalRedirectUrl,
+    useAndClearRedirect
+  };
+}, "useAuthRedirectManager");
 
 // src/auth/hooks/useTwoFactor.ts
 var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
   const { onSuccess, onError, redirectUrl, skipRedirect = false } = options;
   const router = useCfgRouter();
-  const [isLoading, setIsLoading] = useState3(false);
-  const [error, setError] = useState3(null);
-  const [warning, setWarning] = useState3(null);
-  const [remainingBackupCodes, setRemainingBackupCodes] = useState3(null);
-  const [attemptsRemaining, setAttemptsRemaining] = useState3(null);
+  const [isLoading, setIsLoading] = useState4(false);
+  const [error, setError] = useState4(null);
+  const [warning, setWarning] = useState4(null);
+  const [remainingBackupCodes, setRemainingBackupCodes] = useState4(null);
+  const [attemptsRemaining, setAttemptsRemaining] = useState4(null);
   const clearError = useCallback4(() => {
     setError(null);
   }, []);
   const handleSuccess = useCallback4((response) => {
-    CfgAccountsApi.setToken(response.access_token);
-    CfgAccountsApi.setRefreshToken(response.refresh_token);
+    auth.setSession({ access: response.access_token, refresh: response.refresh_token });
     if (response.warning) {
       setWarning(response.warning);
     }
@@ -2570,7 +2638,7 @@ var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
     }
     onSuccess?.(response.user);
     if (!skipRedirect) {
-      const finalRedirectUrl = redirectUrl || "/dashboard";
+      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || "/";
       authLogger.info("2FA successful, redirecting to:", finalRedirectUrl);
       router.hardPush(finalRedirectUrl);
     }
@@ -2960,12 +3028,12 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
 }, "useAuthForm");
 
 // src/auth/hooks/useGithubAuth.ts
-import { useCallback as useCallback6, useState as useState4 } from "react";
+import { useCallback as useCallback6, useState as useState5 } from "react";
 var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
   const { sourceUrl, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
   const router = useCfgRouter();
-  const [isLoading, setIsLoading] = useState4(false);
-  const [error, setError] = useState4(null);
+  const [isLoading, setIsLoading] = useState5(false);
+  const [error, setError] = useState5(null);
   const startGithubAuth = useCallback6(async () => {
     setIsLoading(true);
     setError(null);
@@ -3035,8 +3103,7 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
         throw new Error("Invalid response from OAuth callback");
       }
       authLogger.info("GitHub OAuth successful, user:", response.user);
-      CfgAccountsApi.setToken(response.access);
-      CfgAccountsApi.setRefreshToken(response.refresh);
+      auth.setSession({ access: response.access, refresh: response.refresh });
       Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
         category: "auth" /* AUTH */,
         label: "github"
@@ -3071,15 +3138,15 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
 }, "useGithubAuth");
 
 // src/auth/hooks/useTwoFactorSetup.ts
-import { useCallback as useCallback7, useState as useState5 } from "react";
+import { useCallback as useCallback7, useState as useState6 } from "react";
 var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
   const { onComplete, onError } = options;
-  const [isLoading, setIsLoading] = useState5(false);
-  const [error, setError] = useState5(null);
-  const [setupData, setSetupData] = useState5(null);
-  const [backupCodes, setBackupCodes] = useState5(null);
-  const [backupCodesWarning, setBackupCodesWarning] = useState5(null);
-  const [setupStep, setSetupStep] = useState5("idle");
+  const [isLoading, setIsLoading] = useState6(false);
+  const [error, setError] = useState6(null);
+  const [setupData, setSetupData] = useState6(null);
+  const [backupCodes, setBackupCodes] = useState6(null);
+  const [backupCodesWarning, setBackupCodesWarning] = useState6(null);
+  const [setupStep, setSetupStep] = useState6("idle");
   const clearError = useCallback7(() => {
     setError(null);
   }, []);
@@ -3178,7 +3245,7 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
 }, "useTwoFactorSetup");
 
 // src/auth/hooks/useTwoFactorStatus.ts
-import { useCallback as useCallback8, useState as useState6 } from "react";
+import { useCallback as useCallback8, useState as useState7 } from "react";
 function extractErrorMessage(err, fallback) {
   if (err instanceof APIError) {
     const body = err.response;
@@ -3191,10 +3258,10 @@ function extractErrorMessage(err, fallback) {
 }
 __name(extractErrorMessage, "extractErrorMessage");
 var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
-  const [isLoading, setIsLoading] = useState6(false);
-  const [error, setError] = useState6(null);
-  const [has2FAEnabled, setHas2FAEnabled] = useState6(null);
-  const [devices, setDevices] = useState6([]);
+  const [isLoading, setIsLoading] = useState7(false);
+  const [error, setError] = useState7(null);
+  const [has2FAEnabled, setHas2FAEnabled] = useState7(null);
+  const [devices, setDevices] = useState7([]);
   const clearError = useCallback8(() => {
     setError(null);
   }, []);
@@ -3229,258 +3296,38 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
       return false;
     }
     setIsLoading(true);
-    setError(null);
-    try {
-      authLogger.info("Disabling 2FA...");
-      await CfgTotp.cfgTotpDisableCreate({ body: { code }, throwOnError: true });
-      setHas2FAEnabled(false);
-      setDevices([]);
-      authLogger.info("2FA disabled successfully");
-      return true;
-    } catch (err) {
-      const errorMessage = extractErrorMessage(err, "Invalid verification code");
-      authLogger.error("Failed to disable 2FA:", err);
-      setError(errorMessage);
-      return false;
-    } finally {
-      setIsLoading(false);
-    }
-  }, []);
-  return {
-    isLoading,
-    error,
-    has2FAEnabled,
-    devices,
-    fetchStatus,
-    disable2FA,
-    clearError
-  };
-}, "useTwoFactorStatus");
-
-// src/auth/hooks/useSessionStorage.ts
-import { useState as useState7 } from "react";
-function useSessionStorage(key, initialValue) {
-  const [storedValue, setStoredValue] = useState7(() => {
-    if (typeof window === "undefined") {
-      return initialValue;
-    }
-    try {
-      const item = window.sessionStorage.getItem(key);
-      return item ? JSON.parse(item) : initialValue;
-    } catch (error) {
-      authLogger.error(`Error reading sessionStorage key "${key}":`, error);
-      return initialValue;
-    }
-  });
-  const checkDataSize = /* @__PURE__ */ __name((data) => {
-    try {
-      const jsonString = JSON.stringify(data);
-      const sizeInBytes = new Blob([jsonString]).size;
-      const sizeInKB = sizeInBytes / 1024;
-      if (sizeInKB > 1024) {
-        authLogger.warn(`Data size (${sizeInKB.toFixed(2)}KB) exceeds 1MB limit for key "${key}"`);
-        return false;
-      }
-      return true;
-    } catch (error) {
-      authLogger.error(`Error checking data size for key "${key}":`, error);
-      return false;
-    }
-  }, "checkDataSize");
-  const clearOldData = /* @__PURE__ */ __name(() => {
-    try {
-      const keys = Object.keys(sessionStorage).filter((key2) => key2 && typeof key2 === "string");
-      if (keys.length > 50) {
-        const itemsToRemove = Math.ceil(keys.length * 0.2);
-        for (let i = 0; i < itemsToRemove; i++) {
-          try {
-            const key2 = keys[i];
-            if (key2) {
-              sessionStorage.removeItem(key2);
-              sessionStorage.removeItem(`${key2}_timestamp`);
-            }
-          } catch {
-          }
-        }
-      }
-    } catch (error) {
-      authLogger.error("Error clearing old sessionStorage data:", error);
-    }
-  }, "clearOldData");
-  const forceClearAll = /* @__PURE__ */ __name(() => {
-    try {
-      const keys = Object.keys(sessionStorage);
-      for (const key2 of keys) {
-        try {
-          sessionStorage.removeItem(key2);
-        } catch {
-        }
-      }
-    } catch (error) {
-      authLogger.error("Error force clearing sessionStorage:", error);
-    }
-  }, "forceClearAll");
-  const setValue = /* @__PURE__ */ __name((value) => {
-    try {
-      const valueToStore = value instanceof Function ? value(storedValue) : value;
-      if (!checkDataSize(valueToStore)) {
-        authLogger.warn(`Data size too large for key "${key}", removing key`);
-        try {
-          window.sessionStorage.removeItem(key);
-          window.sessionStorage.removeItem(`${key}_timestamp`);
-        } catch {
-        }
-        setStoredValue(valueToStore);
-        return;
-      }
-      setStoredValue(valueToStore);
-      if (typeof window !== "undefined") {
-        try {
-          window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
-          window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
-        } catch (storageError) {
-          if (storageError.name === "QuotaExceededError" || storageError.code === 22 || storageError.message?.includes("quota")) {
-            authLogger.warn("sessionStorage quota exceeded, clearing old data...");
-            clearOldData();
-            try {
-              window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
-              window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
-            } catch (retryError) {
-              authLogger.error(`Failed to set sessionStorage key "${key}" after clearing old data:`, retryError);
-              try {
-                forceClearAll();
-                window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
-                window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
-              } catch (finalError) {
-                authLogger.error(`Failed to set sessionStorage key "${key}" after force clearing:`, finalError);
-                setStoredValue(valueToStore);
-              }
-            }
-          } else {
-            throw storageError;
-          }
-        }
-      }
-    } catch (error) {
-      authLogger.error(`Error setting sessionStorage key "${key}":`, error);
-      const valueToStore = value instanceof Function ? value(storedValue) : value;
-      setStoredValue(valueToStore);
-    }
-  }, "setValue");
-  const removeValue = /* @__PURE__ */ __name(() => {
-    try {
-      setStoredValue(initialValue);
-      if (typeof window !== "undefined") {
-        try {
-          window.sessionStorage.removeItem(key);
-          window.sessionStorage.removeItem(`${key}_timestamp`);
-        } catch (removeError) {
-          if (removeError.name === "QuotaExceededError" || removeError.code === 22 || removeError.message?.includes("quota")) {
-            authLogger.warn("sessionStorage quota exceeded during removal, clearing old data...");
-            clearOldData();
-            try {
-              window.sessionStorage.removeItem(key);
-              window.sessionStorage.removeItem(`${key}_timestamp`);
-            } catch (retryError) {
-              authLogger.error(`Failed to remove sessionStorage key "${key}" after clearing:`, retryError);
-              forceClearAll();
-            }
-          } else {
-            throw removeError;
-          }
-        }
-      }
-    } catch (error) {
-      authLogger.error(`Error removing sessionStorage key "${key}":`, error);
-    }
-  }, "removeValue");
-  return [storedValue, setValue, removeValue];
-}
-__name(useSessionStorage, "useSessionStorage");
-
-// src/auth/hooks/useAuthRedirect.ts
-var AUTH_REDIRECT_KEY = "auth_redirect_url";
-var getRedirectFromStorage = /* @__PURE__ */ __name(() => {
-  if (typeof window === "undefined") return "";
-  try {
-    const item = window.sessionStorage.getItem(AUTH_REDIRECT_KEY);
-    return item ? JSON.parse(item) : "";
-  } catch {
-    return "";
-  }
-}, "getRedirectFromStorage");
-var clearRedirectFromStorage = /* @__PURE__ */ __name(() => {
-  if (typeof window === "undefined") return;
-  try {
-    window.sessionStorage.removeItem(AUTH_REDIRECT_KEY);
-    window.sessionStorage.removeItem(`${AUTH_REDIRECT_KEY}_timestamp`);
-  } catch {
-  }
-}, "clearRedirectFromStorage");
-var useAuthRedirectManager = /* @__PURE__ */ __name((options = {}) => {
-  const { fallbackUrl = "/dashboard", clearOnUse = true } = options;
-  const [redirectUrl, setRedirectUrl, removeRedirectUrl] = useSessionStorage(AUTH_REDIRECT_KEY, "");
-  const setRedirect = /* @__PURE__ */ __name((url) => {
-    setRedirectUrl(url);
-  }, "setRedirect");
-  const getRedirect = /* @__PURE__ */ __name(() => {
-    return getRedirectFromStorage() || redirectUrl;
-  }, "getRedirect");
-  const clearRedirect = /* @__PURE__ */ __name(() => {
-    removeRedirectUrl();
-    clearRedirectFromStorage();
-  }, "clearRedirect");
-  const hasRedirect = /* @__PURE__ */ __name(() => {
-    const stored = getRedirectFromStorage();
-    return stored.length > 0 || redirectUrl.length > 0;
-  }, "hasRedirect");
-  const getFinalRedirectUrl = /* @__PURE__ */ __name(() => {
-    const stored = getRedirectFromStorage();
-    return stored || redirectUrl || fallbackUrl;
-  }, "getFinalRedirectUrl");
-  const useAndClearRedirect = /* @__PURE__ */ __name(() => {
-    const stored = getRedirectFromStorage();
-    const finalUrl = stored || redirectUrl || fallbackUrl;
-    if (clearOnUse) {
-      clearRedirect();
+    setError(null);
+    try {
+      authLogger.info("Disabling 2FA...");
+      await CfgTotp.cfgTotpDisableCreate({ body: { code }, throwOnError: true });
+      setHas2FAEnabled(false);
+      setDevices([]);
+      authLogger.info("2FA disabled successfully");
+      return true;
+    } catch (err) {
+      const errorMessage = extractErrorMessage(err, "Invalid verification code");
+      authLogger.error("Failed to disable 2FA:", err);
+      setError(errorMessage);
+      return false;
+    } finally {
+      setIsLoading(false);
     }
-    return finalUrl;
-  }, "useAndClearRedirect");
+  }, []);
   return {
-    redirectUrl,
-    setRedirect,
-    getRedirect,
-    clearRedirect,
-    hasRedirect,
-    getFinalRedirectUrl,
-    useAndClearRedirect
+    isLoading,
+    error,
+    has2FAEnabled,
+    devices,
+    fetchStatus,
+    disable2FA,
+    clearError
   };
-}, "useAuthRedirectManager");
-
-// src/auth/hooks/useAuthGuard.ts
-import { useEffect as useEffect5, useState as useState8 } from "react";
-var useAuthGuard = /* @__PURE__ */ __name((options = {}) => {
-  const { redirectTo = "/auth", requireAuth = true, saveRedirectUrl: shouldSaveUrl = true } = options;
-  const { isAuthenticated, isLoading, saveRedirectUrl } = useAuth();
-  const router = useCfgRouter();
-  const [isRedirecting, setIsRedirecting] = useState8(false);
-  useEffect5(() => {
-    if (!isLoading && requireAuth && !isAuthenticated && !isRedirecting) {
-      if (shouldSaveUrl && typeof window !== "undefined") {
-        const currentUrl = window.location.pathname + window.location.search;
-        saveRedirectUrl(currentUrl);
-      }
-      setIsRedirecting(true);
-      router.push(redirectTo);
-    }
-  }, [isAuthenticated, isLoading, router, redirectTo, requireAuth, isRedirecting, shouldSaveUrl, saveRedirectUrl]);
-  return { isAuthenticated, isLoading, isRedirecting };
-}, "useAuthGuard");
+}, "useTwoFactorStatus");
 
 // src/auth/hooks/useLocalStorage.ts
-import { useState as useState9 } from "react";
+import { useState as useState8 } from "react";
 function useLocalStorage(key, initialValue) {
-  const [storedValue, setStoredValue] = useState9(() => {
+  const [storedValue, setStoredValue] = useState8(() => {
     if (typeof window === "undefined") {
       return initialValue;
     }
@@ -3775,150 +3622,16 @@ function getCacheMetadata() {
 }
 __name(getCacheMetadata, "getCacheMetadata");
 
-// src/auth/hooks/useTokenRefresh.ts
-import { useCallback as useCallback9, useEffect as useEffect7 } from "react";
-
-// src/auth/refreshHandler.ts
-var _registered = false;
-function ensureRefreshHandler() {
-  if (_registered) return;
-  _registered = true;
-  CfgAccountsApi.setRefreshHandler(async (refresh) => {
-    const result = await CfgAccountsAuth.cfgAccountsTokenRefreshCreate({
-      body: { refresh },
-      throwOnError: true
-    });
-    const access = result.data?.access;
-    if (!access) {
-      authLogger.error("Refresh response missing access token");
-      return null;
-    }
-    return { access, refresh: result.data?.refresh ?? refresh };
-  });
-  authLogger.debug("Canonical refresh handler registered");
-}
-__name(ensureRefreshHandler, "ensureRefreshHandler");
-function triggerRefresh() {
-  ensureRefreshHandler();
-  const maybe = CfgAccountsApi;
-  if (typeof maybe.refreshNow === "function") {
-    return maybe.refreshNow();
-  }
-  authLogger.warn("api.refreshNow() unavailable \u2014 run `make generate` to regenerate the client");
-  return Promise.resolve(null);
-}
-__name(triggerRefresh, "triggerRefresh");
-
-// src/auth/utils/jwt.ts
-function decodeSegment(segment) {
-  try {
-    const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
-    if (typeof atob !== "function") return null;
-    const json = atob(base64);
-    return JSON.parse(json);
-  } catch {
-    return null;
-  }
-}
-__name(decodeSegment, "decodeSegment");
-function getTokenExpiry(token) {
-  if (!token || typeof token !== "string") return null;
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
-  const payload = decodeSegment(parts[1]);
-  if (!payload || typeof payload !== "object") return null;
-  const exp = payload.exp;
-  if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
-  return exp * 1e3;
-}
-__name(getTokenExpiry, "getTokenExpiry");
-function isTokenExpired(token, skewMs = 0, now = Date.now()) {
-  const expiry = getTokenExpiry(token);
-  if (expiry === null) return true;
-  return expiry - skewMs <= now;
-}
-__name(isTokenExpired, "isTokenExpired");
-function isTokenExpiringSoon(token, thresholdMs, now = Date.now()) {
-  const expiry = getTokenExpiry(token);
-  if (expiry === null) return false;
-  return expiry - now < thresholdMs;
-}
-__name(isTokenExpiringSoon, "isTokenExpiringSoon");
-
-// src/auth/hooks/useTokenRefresh.ts
-var TOKEN_REFRESH_THRESHOLD_MS = 10 * 60 * 1e3;
-var CHECK_INTERVAL_MS = 5 * 60 * 1e3;
-function useTokenRefresh(options = {}) {
-  const { enabled = true, onRefresh, onRefreshError } = options;
-  const refreshToken = useCallback9(async () => {
-    if (!CfgAccountsApi.getRefreshToken()) {
-      authLogger.warn("No refresh token available");
-      return false;
-    }
-    authLogger.info("Refreshing token...");
-    try {
-      const newAccessToken = await triggerRefresh();
-      if (!newAccessToken) {
-        throw new Error("Token refresh failed");
-      }
-      authLogger.info("Token refreshed successfully");
-      onRefresh?.(newAccessToken);
-      return true;
-    } catch (error) {
-      authLogger.error("Token refresh error:", error);
-      onRefreshError?.(error instanceof Error ? error : new Error(String(error)));
-      return false;
-    }
-  }, [onRefresh, onRefreshError]);
-  const checkAndRefresh = useCallback9(async () => {
-    const token = CfgAccountsApi.getToken();
-    if (!token) return;
-    if (isTokenExpiringSoon(token, TOKEN_REFRESH_THRESHOLD_MS)) {
-      authLogger.info("Token expiring soon, refreshing proactively");
-      await refreshToken();
-    }
-  }, [refreshToken]);
-  useEffect7(() => {
-    if (!enabled) return;
-    checkAndRefresh();
-    const intervalId = setInterval(checkAndRefresh, CHECK_INTERVAL_MS);
-    return () => clearInterval(intervalId);
-  }, [enabled, checkAndRefresh]);
-  useEffect7(() => {
-    if (!enabled) return;
-    const handleFocus = /* @__PURE__ */ __name(() => {
-      authLogger.debug("Window focused, checking token...");
-      checkAndRefresh();
-    }, "handleFocus");
-    window.addEventListener("focus", handleFocus);
-    return () => window.removeEventListener("focus", handleFocus);
-  }, [enabled, checkAndRefresh]);
-  useEffect7(() => {
-    if (!enabled) return;
-    const handleOnline = /* @__PURE__ */ __name(() => {
-      authLogger.info("Network reconnected, checking token...");
-      checkAndRefresh();
-    }, "handleOnline");
-    window.addEventListener("online", handleOnline);
-    return () => window.removeEventListener("online", handleOnline);
-  }, [enabled, checkAndRefresh]);
-  return {
-    refreshToken,
-    checkAndRefresh
-  };
-}
-__name(useTokenRefresh, "useTokenRefresh");
-
 // src/auth/hooks/useDeleteAccount.ts
-import { useCallback as useCallback10, useState as useState10 } from "react";
+import { useCallback as useCallback9, useState as useState9 } from "react";
 var useDeleteAccount = /* @__PURE__ */ __name(() => {
-  const [isLoading, setIsLoading] = useState10(false);
-  const [error, setError] = useState10(null);
+  const [isLoading, setIsLoading] = useState9(false);
+  const [error, setError] = useState9(null);
   const { logout } = useAuth();
-  const clearError = useCallback10(() => {
+  const clearError = useCallback9(() => {
     setError(null);
   }, []);
-  const deleteAccount = useCallback10(async () => {
+  const deleteAccount = useCallback9(async () => {
     setIsLoading(true);
     setError(null);
     try {
@@ -3947,39 +3660,15 @@ var useDeleteAccount = /* @__PURE__ */ __name(() => {
   };
 }, "useDeleteAccount");
 
-// src/auth/utils/guard.ts
-function resolveGuardIsLoading(s) {
-  if (!s.mounted) return true;
-  if (!s.requireAuth) return false;
-  return s.authLoading || s.isRedirecting || !s.isAuthenticated;
-}
-__name(resolveGuardIsLoading, "resolveGuardIsLoading");
-function shouldRedirectToAuth(s) {
-  return s.mounted && s.requireAuth && !s.authLoading && !s.isAuthenticated && !s.isRedirecting;
-}
-__name(shouldRedirectToAuth, "shouldRedirectToAuth");
-function resolveGuardIsAuthenticated(s) {
-  return !s.requireAuth || s.isAuthenticated;
-}
-__name(resolveGuardIsAuthenticated, "resolveGuardIsAuthenticated");
-function nextAuthEvaluationDelay(accessExp, refreshExp, now) {
-  const future = [accessExp, refreshExp].filter(
-    (d) => d !== null && d > now
-  );
-  if (future.length === 0) return null;
-  return Math.max(0, Math.min(...future) - now) + 1e3;
-}
-__name(nextAuthEvaluationDelay, "nextAuthEvaluationDelay");
-
 // src/auth/context/AccountsContext.tsx
 import {
   createContext,
-  useCallback as useCallback11,
+  useCallback as useCallback10,
   useContext,
-  useEffect as useEffect8,
+  useEffect as useEffect6,
   useMemo as useMemo2,
   useRef as useRef5,
-  useState as useState11
+  useState as useState10
 } from "react";
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRegenerateCreate.ts
@@ -4432,9 +4121,12 @@ function useCfgAccountsProfileUpdateUpdate(config) {
 }
 __name(useCfgAccountsProfileUpdateUpdate, "useCfgAccountsProfileUpdateUpdate");
 
-// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenBlacklistCreate.ts
 import useSWRMutation15 from "swr/mutation";
 
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
+import useSWRMutation16 from "swr/mutation";
+
 // src/_api/generated/_cfg_accounts/schemas/TokenRefresh.ts
 import { z as z19 } from "zod";
 var TokenRefreshSchema = z19.object({
@@ -4442,53 +4134,6 @@ var TokenRefreshSchema = z19.object({
   refresh: z19.string()
 });
 
-// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
-function useCfgAccountsTokenRefreshCreate(config) {
-  return useSWRMutation15(
-    ["cfg_accounts_token_refresh_create"],
-    async (_key, { arg }) => {
-      const res = await CfgAccountsAuth.cfgAccountsTokenRefreshCreate({ ...arg, throwOnError: true });
-      const data = res.data;
-      const parsed = TokenRefreshSchema.safeParse(data);
-      if (!parsed.success) {
-        console.warn(
-          "[zod] response did not match schema",
-          {
-            operation: "cfg_accounts_token_refresh_create",
-            method: "POST",
-            path: "/cfg/accounts/token/refresh/",
-            issues: parsed.error.issues,
-            data
-          }
-        );
-        if (typeof window !== "undefined") {
-          try {
-            window.dispatchEvent(
-              new CustomEvent("zod-validation-error", {
-                detail: {
-                  operation: "cfg_accounts_token_refresh_create",
-                  method: "POST",
-                  path: "/cfg/accounts/token/refresh/",
-                  issues: parsed.error.issues,
-                  data,
-                  timestamp: /* @__PURE__ */ new Date()
-                },
-                bubbles: true,
-                cancelable: false
-              })
-            );
-          } catch {
-          }
-        }
-        return data;
-      }
-      return parsed.data;
-    },
-    config
-  );
-}
-__name(useCfgAccountsTokenRefreshCreate, "useCfgAccountsTokenRefreshCreate");
-
 // src/_api/generated/_cfg_accounts/schemas/APIKeyRequest.ts
 import { z as z20 } from "zod";
 var APIKeyRequestSchema = z20.object({
@@ -4578,28 +4223,34 @@ var PatchedCfgUserUpdateRequestSchema = z30.object({
   timezone: z30.string().max(64).optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/TokenRefreshRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/TokenBlacklistRequest.ts
 import { z as z31 } from "zod";
-var TokenRefreshRequestSchema = z31.object({
+var TokenBlacklistRequestSchema = z31.object({
   refresh: z31.string().min(1)
 });
 
+// src/_api/generated/_cfg_accounts/schemas/TokenRefreshRequest.ts
+import { z as z32 } from "zod";
+var TokenRefreshRequestSchema = z32.object({
+  refresh: z32.string().min(1)
+});
+
 // src/auth/context/AccountsContext.tsx
 import { jsx } from "react/jsx-runtime";
 var AccountsContext = createContext(void 0);
 function AccountsProvider({ children }) {
-  const [profile, setProfile] = useState11(() => {
+  const [profile, setProfile] = useState10(() => {
     const cached = getCachedProfile();
     return cached || void 0;
   });
-  const [isLoadingProfile, setIsLoadingProfile] = useState11(false);
-  const [profileError, setProfileError] = useState11(null);
+  const [isLoadingProfile, setIsLoadingProfile] = useState10(false);
+  const [profileError, setProfileError] = useState10(null);
   const profileRef = useRef5(profile);
   const isLoadingRef = useRef5(false);
-  useEffect8(() => {
+  useEffect6(() => {
     profileRef.current = profile;
   }, [profile]);
-  useEffect8(() => {
+  useEffect6(() => {
     isLoadingRef.current = isLoadingProfile;
   }, [isLoadingProfile]);
   const { trigger: triggerProfileUpdate } = useCfgAccountsProfileUpdateUpdate();
@@ -4607,8 +4258,7 @@ function AccountsProvider({ children }) {
   const { trigger: triggerAvatar } = useCfgAccountsProfileAvatarCreate();
   const { trigger: triggerOtpRequest } = useCfgAccountsOtpRequestCreate();
   const { trigger: triggerOtpVerify } = useCfgAccountsOtpVerifyCreate();
-  const { trigger: triggerTokenRefresh } = useCfgAccountsTokenRefreshCreate();
-  const refreshProfile = useCallback11(async (options) => {
+  const refreshProfile = useCallback10(async (options) => {
     const { callerId, force } = options || {};
     if (isLoadingRef.current) {
       authLogger.debug(`Profile loading in progress, skipping (caller: ${callerId})`);
@@ -4660,8 +4310,7 @@ function AccountsProvider({ children }) {
       return result;
     }
     if (result.access && result.refresh) {
-      CfgAccountsApi.setToken(result.access);
-      CfgAccountsApi.setRefreshToken(result.refresh);
+      auth.setSession({ access: result.access, refresh: result.refresh });
       try {
         await refreshProfile({ callerId: "verifyOTP", force: true });
       } catch (profileError2) {
@@ -4670,17 +4319,14 @@ function AccountsProvider({ children }) {
     }
     return result;
   }, "verifyOTP");
-  const refreshToken = /* @__PURE__ */ __name(async (refresh) => {
-    const body = { refresh };
-    const result = await triggerTokenRefresh({ body });
-    if (result.access) {
-      CfgAccountsApi.setToken(result.access);
-      CfgAccountsApi.setRefreshToken(refresh);
+  const logout = useCallback10(() => {
+    const refresh = auth.getRefreshToken();
+    if (refresh) {
+      CfgAccountsAuth.cfgAccountsTokenBlacklistCreate({ body: { refresh } }).catch(() => {
+        authLogger.warn("Refresh-token blacklist failed (logged out locally anyway)");
+      });
     }
-    return result;
-  }, "refreshToken");
-  const logout = useCallback11(() => {
-    CfgAccountsApi.clearToken();
+    auth.clearSession();
     setProfile(void 0);
     setProfileError(null);
     clearProfileCache();
@@ -4695,7 +4341,6 @@ function AccountsProvider({ children }) {
     refreshProfile,
     requestOTP,
     verifyOTP,
-    refreshToken,
     logout
   }), [
     profile,
@@ -4707,7 +4352,6 @@ function AccountsProvider({ children }) {
     refreshProfile,
     requestOTP,
     verifyOTP,
-    refreshToken,
     logout
   ]);
   return /* @__PURE__ */ jsx(AccountsContext.Provider, { value, children });
@@ -4726,281 +4370,127 @@ __name(useAccountsContext, "useAccountsContext");
 import { Fragment, jsx as jsx2 } from "react/jsx-runtime";
 var defaultRoutes = {
   auth: "/auth",
-  defaultCallback: "/dashboard",
+  defaultCallback: "/",
   defaultAuthCallback: "/auth"
 };
-var AuthContext = createContext2(void 0);
+var resolveAuthRoutes = /* @__PURE__ */ __name((routes) => ({
+  auth: routes?.auth || defaultRoutes.auth,
+  defaultCallback: routes?.defaultCallback || defaultRoutes.defaultCallback,
+  defaultAuthCallback: routes?.defaultAuthCallback || routes?.auth || defaultRoutes.defaultAuthCallback
+}), "resolveAuthRoutes");
 var EMAIL_STORAGE_KEY = "auth_email";
-var hasValidTokens = /* @__PURE__ */ __name(() => {
-  if (typeof window === "undefined") return false;
-  return CfgAccountsApi.isAuthenticated();
-}, "hasValidTokens");
-var isSessionDeadOnBootstrap = /* @__PURE__ */ __name((accessToken, refreshToken, now = Date.now()) => {
-  const accessDead = isTokenExpired(accessToken, 0, now);
-  if (!accessDead) return false;
-  const refreshDead = isTokenExpired(refreshToken, 0, now);
-  return refreshDead;
-}, "isSessionDeadOnBootstrap");
-var isSessionAlive = /* @__PURE__ */ __name((now = Date.now()) => {
-  if (typeof window === "undefined") return false;
-  return !isSessionDeadOnBootstrap(
-    CfgAccountsApi.getToken(),
-    CfgAccountsApi.getRefreshToken(),
-    now
-  );
-}, "isSessionAlive");
+var AuthContext = createContext2(void 0);
+var apiErrorMessage = /* @__PURE__ */ __name((error) => {
+  const body = error.response;
+  return body?.error || body?.detail || body?.message || error.errorMessage;
+}, "apiErrorMessage");
 var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const accounts = useAccountsContext();
-  ensureRefreshHandler();
-  const redirectManager = useAuthRedirectManager({
-    fallbackUrl: config?.routes?.defaultCallback || defaultRoutes.defaultCallback,
-    clearOnUse: true
-  });
-  const [isLoading, setIsLoading] = useState12(() => {
-    if (typeof window !== "undefined") {
-      const hasTokens = hasValidTokens();
-      return !hasTokens;
-    }
-    return true;
-  });
-  const [initialized, setInitialized] = useState12(false);
-  const [authTick, setAuthTick] = useState12(0);
-  const bumpAuthTick = useCallback12(() => setAuthTick((t) => t + 1), []);
-  useEffect9(() => {
-    if (typeof window === "undefined") return;
-    const delay = nextAuthEvaluationDelay(
-      getTokenExpiry(CfgAccountsApi.getToken()),
-      getTokenExpiry(CfgAccountsApi.getRefreshToken()),
-      Date.now()
-    );
-    if (delay === null) return;
-    const timer = setTimeout(bumpAuthTick, Math.min(delay, 2e9));
-    return () => clearTimeout(timer);
-  }, [authTick, bumpAuthTick]);
-  const onUnauthorizedRef = useRef6(false);
+  const session = useSession();
+  const isAuthenticated = session.status === "authenticated";
   const router = useCfgRouter();
   const pathname = usePathname3();
   const queryParams = useQueryParams();
-  const [storedEmail, setStoredEmail, clearStoredEmail] = useLocalStorage(EMAIL_STORAGE_KEY, null);
-  const user = accounts.profile;
-  const userRef = useRef6(user);
+  const [storedEmail, setStoredEmail, clearStoredEmail] = useLocalStorage(
+    EMAIL_STORAGE_KEY,
+    null
+  );
+  const routes = useMemo3(() => resolveAuthRoutes(config?.routes), [config?.routes]);
+  const routesRef = useRef6(routes);
+  useEffect7(() => {
+    routesRef.current = routes;
+  }, [routes]);
+  const redirectManager = useAuthRedirectManager({
+    fallbackUrl: routes.defaultCallback,
+    clearOnUse: true
+  });
   const configRef = useRef6(config);
-  const isLoadingProfileRef = useRef6(false);
-  useEffect9(() => {
-    userRef.current = user;
-  }, [user]);
-  useEffect9(() => {
+  useEffect7(() => {
     configRef.current = config;
   }, [config]);
-  const clearAuthState = useCallback12((caller) => {
-    authLogger.info("clearAuthState >> caller", caller);
-    CfgAccountsApi.clearToken();
-    clearProfileCache();
-    setInitialized(true);
-    setIsLoading(false);
-    bumpAuthTick();
-  }, [bumpAuthTick]);
-  const handleProactiveRefreshError = useCallback12((error) => {
-    authLogger.warn("Proactive token refresh failed \u2014 session is dead, redirecting to login:", error.message);
-    if (onUnauthorizedRef.current) return;
-    onUnauthorizedRef.current = true;
-    clearAuthState("proactiveRefresh:failed");
-    const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
-    router.hardReplace(authCallbackUrl);
-  }, [clearAuthState, router]);
-  useTokenRefresh({
-    enabled: true,
-    onRefresh: /* @__PURE__ */ __name(() => {
-      authLogger.info("Token auto-refreshed successfully");
-    }, "onRefresh"),
-    onRefreshError: handleProactiveRefreshError
-  });
-  const handleGlobalAuthError = useCallback12((error, context = "API Request") => {
-    const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
-    if (isAuthError) {
-      authLogger.warn(`Authentication error in ${context}, clearing tokens`);
-      clearAuthState(`globalAuthError:${context}`);
-      return true;
+  const accountsRef = useRef6(accounts);
+  useEffect7(() => {
+    accountsRef.current = accounts;
+  }, [accounts]);
+  const pendingManualNavRef = useRef6(false);
+  const [profileSettled, setProfileSettled] = useState11(false);
+  const hasProfile = Boolean(accounts.profile);
+  const profileAttemptedRef = useRef6(false);
+  useEffect7(() => {
+    if (!isAuthenticated) {
+      profileAttemptedRef.current = false;
+      const hasTokens = Boolean(auth.getToken() || auth.getRefreshToken());
+      if (hasTokens && !auth.isAuthenticated()) {
+        authLogger.warn("Dead session in storage \u2014 clearing");
+        auth.clearSession();
+        clearProfileCache();
+      }
+      setProfileSettled(true);
+      return;
     }
-    if (error?.success === false) {
-      authLogger.warn(`Non-auth error in ${context} (not clearing session):`, error?.message || error);
+    if (hasProfile || profileAttemptedRef.current) {
+      setProfileSettled(true);
+      return;
     }
-    return false;
-  }, [clearAuthState]);
-  useEffect9(() => {
-    const handler = /* @__PURE__ */ __name(() => {
-      if (onUnauthorizedRef.current) return;
-      onUnauthorizedRef.current = true;
-      authLogger.warn("Unrecoverable 401 (refresh failed) \u2014 clearing session and redirecting to login");
-      clearAuthState("onUnauthorized:401");
-      const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
-      router.hardReplace(authCallbackUrl);
-    }, "handler");
-    CfgAccountsApi.onUnauthorized(handler);
+    profileAttemptedRef.current = true;
+    let cancelled = false;
+    accountsRef.current.refreshProfile({ callerId: "AuthProvider:bootstrap" }).catch((error) => {
+      authLogger.warn("Profile load failed (session kept):", error);
+    }).finally(() => {
+      if (!cancelled) setProfileSettled(true);
+    });
     return () => {
-      CfgAccountsApi.onUnauthorized(null);
+      cancelled = true;
     };
-  }, [clearAuthState, router]);
-  const isAutoLoggingOutRef = useRef6(false);
-  const swrOnError = useCallback12((error) => {
-    const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
-    if (isAuthError && !isAutoLoggingOutRef.current) {
-      isAutoLoggingOutRef.current = true;
-      authLogger.warn("SWR 401 error detected, auto-logout");
-      clearAuthState("swrOnError:401");
-      const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
-      router.hardReplace(authCallbackUrl);
-    }
-  }, [clearAuthState, router]);
-  const swrConfig = useMemo3(() => ({ onError: swrOnError }), [swrOnError]);
-  const loadCurrentProfile = useCallback12(async (callerId) => {
-    const finalCallerId = callerId || "AuthContext.loadCurrentProfile";
-    if (isLoadingProfileRef.current) {
-      authLogger.debug(`Profile loading already in progress, skipping duplicate call from: ${finalCallerId}`);
-      return;
-    }
-    authLogger.debug(`loadCurrentProfile called by: ${finalCallerId}`);
-    try {
-      isLoadingProfileRef.current = true;
-      const isAuth = CfgAccountsApi.isAuthenticated();
-      const token = CfgAccountsApi.getToken();
-      if (!isAuth) {
-        authLogger.warn("No valid authentication token, throwing error");
-        throw new Error("No valid authentication token");
-      }
-      if (accounts.profile && !accounts.isLoadingProfile) {
-        authLogger.debug("Profile already loaded in AccountsContext, skipping API call");
-        setInitialized(true);
-        return;
-      }
-      const refreshedProfile = await accounts.refreshProfile({ callerId: finalCallerId });
-      if (refreshedProfile) {
-        authLogger.info("Profile loaded successfully:", refreshedProfile.id);
-      } else {
-        authLogger.warn("Profile refresh returned undefined - but keeping tokens");
-      }
-      setInitialized(true);
-    } catch (error) {
-      authLogger.error("Failed to load profile:", error);
-      const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
-      if (isAuthError) {
-        authLogger.warn("Authentication error, clearing session");
-        clearAuthState("loadCurrentProfile:authError");
-      } else {
-        authLogger.warn("Profile load failed but keeping session (non-auth error)");
-        setInitialized(true);
-      }
-    } finally {
-      isLoadingProfileRef.current = false;
+  }, [isAuthenticated, hasProfile]);
+  const isLoading = !profileSettled;
+  const expiredHandledRef = useRef6(false);
+  useEffect7(() => {
+    const unsubscribe = auth.onSessionExpired(() => {
+      if (expiredHandledRef.current) return;
+      expiredHandledRef.current = true;
+      authLogger.warn("Session expired (terminal 401) \u2014 redirecting to login");
+      clearProfileCache();
+      Analytics.event("auth_session_expired" /* AUTH_SESSION_EXPIRED */, {
+        category: "auth" /* AUTH */
+      });
+      router.hardReplace(routesRef.current.defaultAuthCallback);
+    });
+    return unsubscribe;
+  }, [router]);
+  useEffect7(() => {
+    if (!isAuthenticated || pendingManualNavRef.current) return;
+    if (pathname === routes.auth && !queryParams.get("flow")) {
+      const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;
+      if (saved) redirectManager.clearRedirect();
+      router.push(saved || routes.defaultCallback);
     }
-  }, [clearAuthState, handleGlobalAuthError, accounts]);
-  useEffect9(() => {
-    if (initialized) return;
-    const initializeAuth = /* @__PURE__ */ __name(async () => {
-      authLogger.info("Initializing auth...");
-      const isInIframe = typeof window !== "undefined" && window.self !== window.top;
-      authLogger.info("Is in iframe:", isInIframe);
-      const token = CfgAccountsApi.getToken();
-      const refreshToken2 = CfgAccountsApi.getRefreshToken();
-      authLogger.info("Token from API:", token ? `${token.substring(0, 20)}...` : "null");
-      authLogger.info("Refresh token from API:", refreshToken2 ? `${refreshToken2.substring(0, 20)}...` : "null");
-      authLogger.info("localStorage keys:", Object.keys(localStorage).filter((k) => k.includes("token") || k.includes("auth")));
-      if (!isInIframe && isSessionDeadOnBootstrap(token, refreshToken2)) {
-        authLogger.warn("Bootstrap: dead session in storage (access + refresh both unusable) \u2014 clearing and showing login");
-        clearAuthState("initializeAuth:deadSession");
-        return;
-      }
-      const hasTokens = hasValidTokens();
-      authLogger.info("Has tokens:", hasTokens);
-      if (userRef.current) {
-        authLogger.info("Profile already loaded from AccountsContext cache, skipping API request");
-        setInitialized(true);
-        setIsLoading(false);
-        return;
-      }
-      const cachedProfile = getCachedProfile();
-      if (cachedProfile) {
-        authLogger.info("Profile found in localStorage cache, skipping API request");
-        setInitialized(true);
-        setIsLoading(false);
-        return;
-      }
-      if (isInIframe && !hasTokens) {
-        authLogger.info("Running in iframe without tokens - waiting for parent to send via postMessage");
-        authLogger.info("AdminLayout will handle auth initialization, skipping AuthContext init");
-        setInitialized(true);
-        setIsLoading(false);
-        return;
-      }
-      if (hasTokens) {
-        setIsLoading(true);
-        try {
-          authLogger.info("No cached profile found, loading from API...");
-          await loadCurrentProfile("AuthContext.initializeAuth");
-        } catch (error) {
-          authLogger.error("Failed to load profile during initialization:", error);
-          const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
-          if (isAuthError) {
-            clearAuthState("initializeAuth:authError");
-          } else {
-            authLogger.warn("Init profile load failed but keeping session");
-            setInitialized(true);
-          }
-        }
-        setIsLoading(false);
-      } else {
-        setInitialized(true);
-        setIsLoading(false);
-      }
-    }, "initializeAuth");
-    initializeAuth();
-  }, [initialized]);
-  useEffect9(() => {
-    if (!initialized) return;
-    const isAuthenticated = CfgAccountsApi.isAuthenticated();
-    const authRoute = config?.routes?.auth || defaultRoutes.auth;
-    const isAuthPage = pathname === authRoute;
-    const flowParam = queryParams.get("flow");
-    if (isAuthenticated && isAuthPage && !flowParam) {
-      const callbackUrl = config?.routes?.defaultCallback || defaultRoutes.defaultCallback;
-      router.push(callbackUrl);
+  }, [isAuthenticated, pathname, queryParams, routes, router, redirectManager]);
+  const loadCurrentProfile = useCallback11(async (callerId) => {
+    if (!auth.isAuthenticated()) {
+      throw new Error("No valid authentication token");
     }
-  }, [initialized, pathname, queryParams, config?.routes]);
-  const pushToDefaultCallbackUrl = useCallback12(() => {
-    const callbackUrl = config?.routes?.defaultCallback || defaultRoutes.defaultCallback;
-    router.push(callbackUrl);
-  }, [config?.routes, router]);
-  const pushToDefaultAuthCallbackUrl = useCallback12(() => {
-    const authCallbackUrl = config?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
-    router.push(authCallbackUrl);
-  }, [config?.routes, router]);
-  const checkAuthAndRedirect = useCallback12(async () => {
-    try {
-      setIsLoading(true);
-      const isAuthenticated = CfgAccountsApi.isAuthenticated();
-      if (isAuthenticated) {
-        await loadCurrentProfile();
-        if (userRef.current) {
-          pushToDefaultCallbackUrl();
-        }
-      } else {
-        pushToDefaultAuthCallbackUrl();
-      }
-    } catch (error) {
-      authLogger.error("Failed to check authentication:", error);
-      if (!handleGlobalAuthError(error, "checkAuthAndRedirect")) {
-        clearAuthState("checkAuthAndRedirect");
+    await accountsRef.current.refreshProfile({
+      callerId: callerId || "AuthContext.loadCurrentProfile"
+    });
+  }, []);
+  const checkAuthAndRedirect = useCallback11(async () => {
+    if (auth.isAuthenticated()) {
+      try {
+        await loadCurrentProfile("checkAuthAndRedirect");
+      } catch (error) {
+        authLogger.warn("checkAuthAndRedirect: profile load failed", error);
       }
-      pushToDefaultAuthCallbackUrl();
-    } finally {
-      setIsLoading(false);
+      router.push(routesRef.current.defaultCallback);
+    } else {
+      router.push(routesRef.current.defaultAuthCallback);
     }
-  }, [loadCurrentProfile, clearAuthState, pushToDefaultCallbackUrl, pushToDefaultAuthCallbackUrl, handleGlobalAuthError]);
-  const requestOTP = useCallback12(
+  }, [loadCurrentProfile, router]);
+  const requestOTP = useCallback11(
     async (identifier, sourceUrl) => {
-      CfgAccountsApi.clearToken();
+      auth.clearSession();
       try {
-        const result = await accounts.requestOTP({
+        const result = await accountsRef.current.requestOTP({
           identifier,
           source_url: sourceUrl
         });
@@ -5010,33 +4500,31 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
         });
         return {
           success: true,
-          message: result.message || `OTP code sent to your email address`,
+          message: result.message || "OTP code sent to your email address",
           webmail: result.webmail ?? null
         };
       } catch (error) {
         authLogger.error("Request OTP error:", error);
         if (error instanceof APIError) {
-          const retryAfter = error.response?.retry_after ?? error.response?.retryAfter;
-          const message = error.response?.error || error.response?.detail || error.response?.message || error.errorMessage;
+          const body = error.response;
+          const retryAfter = body?.retry_after ?? body?.retryAfter;
           return {
             success: false,
             statusCode: error.statusCode,
-            message,
+            message: apiErrorMessage(error),
             retryAfter: typeof retryAfter === "number" ? retryAfter : void 0
           };
         }
-        return {
-          success: false,
-          message: "Failed to send OTP"
-        };
+        return { success: false, message: "Failed to send OTP" };
       }
     },
-    [accounts]
+    []
   );
-  const verifyOTP = useCallback12(
+  const verifyOTP = useCallback11(
     async (identifier, otpCode, sourceUrl, redirectUrl, skipRedirect) => {
       try {
-        const result = await accounts.verifyOTP({
+        pendingManualNavRef.current = Boolean(skipRedirect);
+        const result = await accountsRef.current.verifyOTP({
           identifier,
           otp: otpCode,
           source_url: sourceUrl
@@ -5053,15 +4541,11 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
         }
         if (!result.access || !result.refresh) {
           authLogger.error("Verify OTP returned invalid response:", result);
-          return {
-            success: false,
-            message: "Invalid OTP verification response"
-          };
+          return { success: false, message: "Invalid OTP verification response" };
         }
         if (identifier.includes("@")) {
           setStoredEmail(identifier);
         }
-        await new Promise((resolve) => setTimeout(resolve, 200));
         Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
           category: "auth" /* AUTH */,
           label: "email"
@@ -5070,8 +4554,9 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
           Analytics.setUser(String(result.user.id));
         }
         if (!skipRedirect) {
-          const savedRedirect = redirectManager.useAndClearRedirect();
-          const finalRedirectUrl = redirectUrl || savedRedirect || config?.routes?.defaultCallback || defaultRoutes.defaultCallback;
+          const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;
+          if (saved) redirectManager.clearRedirect();
+          const finalRedirectUrl = saved || redirectUrl || routesRef.current.defaultCallback;
           authLogger.info("Redirecting after auth to:", finalRedirectUrl);
           router.hardPush(finalRedirectUrl);
         }
@@ -5088,96 +4573,62 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
           label: "email"
         });
         if (error instanceof APIError) {
-          const message = error.response?.error || error.response?.detail || error.response?.message || error.errorMessage;
-          return { success: false, message };
+          return { success: false, message: apiErrorMessage(error) };
         }
-        return {
-          success: false,
-          message: "Failed to verify OTP"
-        };
+        return { success: false, message: "Failed to verify OTP" };
       }
     },
-    [setStoredEmail, config?.routes?.defaultCallback, accounts, router]
+    [setStoredEmail, redirectManager, router]
   );
-  const refreshToken = useCallback12(async () => {
-    try {
-      const refreshTokenValue = CfgAccountsApi.getRefreshToken();
-      if (!refreshTokenValue) {
-        clearAuthState("refreshToken:noToken");
-        Analytics.event("auth_session_expired" /* AUTH_SESSION_EXPIRED */, {
-          category: "auth" /* AUTH */
-        });
-        return {
-          success: false,
-          message: "No refresh token available"
-        };
-      }
-      await accounts.refreshToken(refreshTokenValue);
+  const refreshToken = useCallback11(async () => {
+    const access = await auth.refreshNow();
+    if (access) {
       Analytics.event("auth_token_refresh" /* AUTH_TOKEN_REFRESH */, {
         category: "auth" /* AUTH */
       });
-      return {
-        success: true,
-        message: "Token refreshed"
-      };
-    } catch (error) {
-      authLogger.error("Refresh token error:", error);
-      clearAuthState("refreshToken:error");
-      Analytics.event("auth_token_refresh_fail" /* AUTH_TOKEN_REFRESH_FAIL */, {
-        category: "auth" /* AUTH */
-      });
-      return {
-        success: false,
-        message: "Error refreshing token"
-      };
+      return { success: true, message: "Token refreshed" };
     }
-  }, [clearAuthState, accounts]);
-  const logout = useCallback12(() => {
+    Analytics.event("auth_token_refresh_fail" /* AUTH_TOKEN_REFRESH_FAIL */, {
+      category: "auth" /* AUTH */
+    });
+    return { success: false, message: "Error refreshing token" };
+  }, []);
+  const logout = useCallback11(() => {
     Analytics.event("auth_logout" /* AUTH_LOGOUT */, {
       category: "auth" /* AUTH */
     });
-    accounts.logout();
-    setInitialized(true);
-    setIsLoading(false);
-    const authCallbackUrl = config?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
-    router.hardReplace(authCallbackUrl);
-  }, [accounts, config?.routes?.defaultAuthCallback, router]);
-  const isAdminUser = useMemo3(() => {
-    return Boolean(user?.is_staff || user?.is_superuser);
-  }, [user]);
-  useEffect9(() => {
+    accountsRef.current.logout();
+    router.hardReplace(routesRef.current.defaultAuthCallback);
+  }, [router]);
+  const user = accounts.profile ?? null;
+  const isAdminUser = Boolean(user?.is_staff || user?.is_superuser);
+  useEffect7(() => {
     applyRoleLogPolicy({ isAdmin: isAdminUser });
   }, [isAdminUser]);
-  const updateProfile = useCallback12(
+  const updateProfile = useCallback11(
     async (data) => {
-      const result = await accounts.partialUpdateProfile(data);
-      return result;
-    },
-    [accounts]
-  );
-  const uploadAvatar = useCallback12(
-    async (avatar) => {
-      const result = await accounts.uploadAvatar(avatar);
+      const result = await accountsRef.current.partialUpdateProfile(data);
       return result;
     },
-    [accounts]
+    []
   );
+  const uploadAvatar = useCallback11(async (avatar) => {
+    const result = await accountsRef.current.uploadAvatar(avatar);
+    return result;
+  }, []);
   const value = useMemo3(
     () => ({
       user,
       isLoading,
-      // Authenticated iff the session is locally alive (access valid OR a usable
-      // refresh token) — validated by `exp`, NOT by mere token presence. This is
-      // what makes the guard self-sufficient: an expired session reads as
-      // unauthenticated WITHOUT waiting for a server 401 (which CSP / a hung
-      // request / offline can swallow). `authTick` (in deps) forces recompute
-      // after tokens are cleared/set, since token state lives in storage.
-      isAuthenticated: isSessionAlive(),
+      // Reactive: flips via the store snapshot (token writes, refreshes,
+      // expiry timer, cross-tab/cross-store sync) — no ticks, no polling.
+      isAuthenticated,
       isAdminUser,
+      routes,
       loadCurrentProfile,
       checkAuthAndRedirect,
-      getToken: /* @__PURE__ */ __name(() => CfgAccountsApi.getToken(), "getToken"),
-      getRefreshToken: /* @__PURE__ */ __name(() => CfgAccountsApi.getRefreshToken(), "getRefreshToken"),
+      getToken: /* @__PURE__ */ __name(() => auth.getToken(), "getToken"),
+      getRefreshToken: /* @__PURE__ */ __name(() => auth.getRefreshToken(), "getRefreshToken"),
       getSavedEmail: /* @__PURE__ */ __name(() => storedEmail, "getSavedEmail"),
       saveEmail: setStoredEmail,
       clearSavedEmail: clearStoredEmail,
@@ -5185,21 +4636,19 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       verifyOTP,
       refreshToken,
       logout,
-      // Redirect URL methods
       saveRedirectUrl: redirectManager.setRedirect,
       getRedirectUrl: redirectManager.getFinalRedirectUrl,
       clearRedirectUrl: redirectManager.clearRedirect,
       hasRedirectUrl: redirectManager.hasRedirect,
-      // Profile management
       updateProfile,
       uploadAvatar
     }),
     [
       user,
       isLoading,
-      authTick,
-      // recompute isAuthenticated when tokens are cleared/set
+      isAuthenticated,
       isAdminUser,
+      routes,
       loadCurrentProfile,
       checkAuthAndRedirect,
       storedEmail,
@@ -5214,7 +4663,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       uploadAvatar
     ]
   );
-  return /* @__PURE__ */ jsx2(AuthContext.Provider, { value, children: /* @__PURE__ */ jsx2(SWRConfig, { value: swrConfig, children }) });
+  return /* @__PURE__ */ jsx2(AuthContext.Provider, { value, children });
 }, "AuthProviderInternal");
 function AuthProviderRaw({ children, config, enabled = true }) {
   if (!enabled) return /* @__PURE__ */ jsx2(Fragment, { children });
@@ -5227,6 +4676,7 @@ var defaultAuthState = {
   isLoading: false,
   isAuthenticated: false,
   isAdminUser: false,
+  routes: resolveAuthRoutes(),
   loadCurrentProfile: /* @__PURE__ */ __name(async () => {
     authLogger.warn("useAuth: loadCurrentProfile called outside AuthProvider");
   }, "loadCurrentProfile"),
@@ -5253,12 +4703,12 @@ var defaultAuthState = {
     authLogger.warn("useAuth: refreshToken called outside AuthProvider");
     return { success: false, message: "AuthProvider not available" };
   }, "refreshToken"),
-  logout: /* @__PURE__ */ __name(async (_options) => {
+  logout: /* @__PURE__ */ __name(() => {
     authLogger.warn("useAuth: logout called outside AuthProvider");
   }, "logout"),
   saveRedirectUrl: /* @__PURE__ */ __name(() => {
   }, "saveRedirectUrl"),
-  getRedirectUrl: /* @__PURE__ */ __name(() => null, "getRedirectUrl"),
+  getRedirectUrl: /* @__PURE__ */ __name(() => "", "getRedirectUrl"),
   clearRedirectUrl: /* @__PURE__ */ __name(() => {
   }, "clearRedirectUrl"),
   hasRedirectUrl: /* @__PURE__ */ __name(() => false, "hasRedirectUrl"),
@@ -5274,7 +4724,7 @@ var defaultAuthState = {
 var useAuth = /* @__PURE__ */ __name(() => {
   const context = useContext2(AuthContext);
   if (context === void 0) {
-    if (isBrowser && isDev) {
+    if (isBrowser2 && isDev) {
       authLogger.debug("useAuth called outside AuthProvider, returning default state");
     }
     return defaultAuthState;
@@ -5305,6 +4755,22 @@ var formatAuthError = /* @__PURE__ */ __name((error) => {
   }
   return "An unexpected error occurred";
 }, "formatAuthError");
+
+// src/auth/utils/guard.ts
+function resolveGuardIsLoading(s) {
+  if (!s.mounted) return true;
+  if (!s.requireAuth) return false;
+  return s.authLoading || s.isRedirecting || !s.isAuthenticated;
+}
+__name(resolveGuardIsLoading, "resolveGuardIsLoading");
+function shouldRedirectToAuth(s) {
+  return s.mounted && s.requireAuth && !s.authLoading && !s.isAuthenticated && !s.isRedirecting;
+}
+__name(shouldRedirectToAuth, "shouldRedirectToAuth");
+function resolveGuardIsAuthenticated(s) {
+  return !s.requireAuth || s.isAuthenticated;
+}
+__name(resolveGuardIsAuthenticated, "resolveGuardIsAuthenticated");
 export {
   AUTH_CONSTANTS,
   AccountsProvider,
@@ -5316,19 +4782,17 @@ export {
   PatchedCfgUserUpdateRequestSchema,
   authLogger,
   clearProfileCache,
+  consumeSavedRedirect,
   decodeBase64,
   encodeBase64,
   formatAuthError,
   getCacheMetadata,
   getCachedProfile,
-  getTokenExpiry,
   hasValidCache,
   isAllowedAuthPath,
-  isTokenExpired,
-  isTokenExpiringSoon,
   logger,
-  nextAuthEvaluationDelay,
   normalizePath,
+  peekSavedRedirect,
   resolveGuardIsAuthenticated,
   resolveGuardIsLoading,
   setCachedProfile,
@@ -5337,7 +4801,6 @@ export {
   useAuth,
   useAuthForm,
   useAuthFormState,
-  useAuthGuard,
   useAuthRedirectManager,
   useAuthValidation,
   useAutoAuth,
@@ -5347,8 +4810,8 @@ export {
   useGithubAuth,
   useLocalStorage,
   useQueryParams,
+  useSession,
   useSessionStorage,
-  useTokenRefresh,
   useTwoFactor,
   useTwoFactorSetup,
   useTwoFactorStatus,