@djangocfg/api 2.1.456 → 2.1.459

package/dist/auth.cjs

@@ -6,9 +6,6 @@ var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -31,1775 +28,552 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/_api/generated/helpers/errors.ts
-var APIError;
-var init_errors = __esm({
-  "src/_api/generated/helpers/errors.ts"() {
-    APIError = class extends Error {
-      constructor(statusCode, statusText, response, url, message) {
-        super(message || `HTTP ${statusCode}: ${statusText}`);
-        this.statusCode = statusCode;
-        this.statusText = statusText;
-        this.response = response;
-        this.url = url;
-        this.name = "APIError";
-      }
-      static {
-        __name(this, "APIError");
-      }
-      get details() {
-        if (typeof this.response === "object" && this.response !== null) {
-          return this.response;
-        }
-        return null;
-      }
-      get fieldErrors() {
-        const details = this.details;
-        if (!details) return null;
-        const fieldErrors = {};
-        for (const [key, value] of Object.entries(details)) {
-          if (Array.isArray(value)) fieldErrors[key] = value;
-        }
-        return Object.keys(fieldErrors).length > 0 ? fieldErrors : null;
-      }
-      get errorMessage() {
-        const details = this.details;
-        if (!details) return this.message;
-        if (details.detail) {
-          return Array.isArray(details.detail) ? details.detail.join(", ") : String(details.detail);
-        }
-        if (details.error) return String(details.error);
-        if (details.message) return String(details.message);
-        const fieldErrors = this.fieldErrors;
-        if (fieldErrors) {
-          const firstField = Object.keys(fieldErrors)[0];
-          if (firstField) return `${firstField}: ${fieldErrors[firstField]?.join(", ")}`;
-        }
-        return this.message;
-      }
-      get isValidationError() {
-        return this.statusCode === 400;
-      }
-      get isAuthError() {
-        return this.statusCode === 401;
-      }
-      get isPermissionError() {
-        return this.statusCode === 403;
-      }
-      get isNotFoundError() {
-        return this.statusCode === 404;
-      }
-      get isServerError() {
-        return this.statusCode >= 500 && this.statusCode < 600;
-      }
-    };
-  }
+// src/auth/index.ts
+var auth_exports = {};
+__export(auth_exports, {
+  AUTH_CONSTANTS: () => AUTH_CONSTANTS,
+  AccountsProvider: () => AccountsProvider,
+  Analytics: () => Analytics,
+  AnalyticsCategory: () => AnalyticsCategory,
+  AnalyticsEvent: () => AnalyticsEvent,
+  AuthContext: () => AuthContext_default,
+  AuthProvider: () => AuthProvider,
+  PatchedCfgUserUpdateRequestSchema: () => PatchedCfgUserUpdateRequestSchema,
+  authLogger: () => authLogger,
+  clearProfileCache: () => clearProfileCache,
+  consumeSavedRedirect: () => consumeSavedRedirect,
+  decodeBase64: () => decodeBase64,
+  encodeBase64: () => encodeBase64,
+  formatAuthError: () => formatAuthError,
+  getCacheMetadata: () => getCacheMetadata,
+  getCachedProfile: () => getCachedProfile,
+  hasValidCache: () => hasValidCache,
+  isAllowedAuthPath: () => isAllowedAuthPath,
+  logger: () => logger,
+  normalizePath: () => normalizePath,
+  peekSavedRedirect: () => peekSavedRedirect,
+  resolveGuardIsAuthenticated: () => resolveGuardIsAuthenticated,
+  resolveGuardIsLoading: () => resolveGuardIsLoading,
+  setCachedProfile: () => setCachedProfile,
+  shouldRedirectToAuth: () => shouldRedirectToAuth,
+  useAccountsContext: () => useAccountsContext,
+  useAuth: () => useAuth,
+  useAuthForm: () => useAuthForm,
+  useAuthFormState: () => useAuthFormState,
+  useAuthRedirectManager: () => useAuthRedirectManager,
+  useAuthValidation: () => useAuthValidation,
+  useAutoAuth: () => useAutoAuth,
+  useBase64: () => useBase64,
+  useCfgRouter: () => useCfgRouter,
+  useDeleteAccount: () => useDeleteAccount,
+  useGithubAuth: () => useGithubAuth,
+  useLocalStorage: () => useLocalStorage,
+  useQueryParams: () => useQueryParams,
+  useSession: () => useSession,
+  useSessionStorage: () => useSessionStorage,
+  useTwoFactor: () => useTwoFactor,
+  useTwoFactorSetup: () => useTwoFactorSetup,
+  useTwoFactorStatus: () => useTwoFactorStatus,
+  validateEmail: () => validateEmail,
+  validateIdentifier: () => validateIdentifier
 });
+module.exports = __toCommonJS(auth_exports);
 
-// src/_api/generated/core/bodySerializer.gen.ts
-var serializeFormDataPair, formDataBodySerializer, jsonBodySerializer;
-var init_bodySerializer_gen = __esm({
-  "src/_api/generated/core/bodySerializer.gen.ts"() {
-    serializeFormDataPair = /* @__PURE__ */ __name((data, key, value) => {
-      if (typeof value === "string" || value instanceof Blob) {
-        data.append(key, value);
-      } else if (value instanceof Date) {
-        data.append(key, value.toISOString());
-      } else {
-        data.append(key, JSON.stringify(value));
-      }
-    }, "serializeFormDataPair");
-    formDataBodySerializer = {
-      bodySerializer: /* @__PURE__ */ __name((body) => {
-        const data = new FormData();
-        Object.entries(body).forEach(([key, value]) => {
-          if (value === void 0 || value === null) {
-            return;
-          }
-          if (Array.isArray(value)) {
-            value.forEach((v) => serializeFormDataPair(data, key, v));
-          } else {
-            serializeFormDataPair(data, key, value);
-          }
-        });
-        return data;
-      }, "bodySerializer")
-    };
-    jsonBodySerializer = {
-      bodySerializer: /* @__PURE__ */ __name((body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value), "bodySerializer")
-    };
-  }
-});
+// src/auth/constants.ts
+var AUTH_CONSTANTS = {
+  /** Email OTP code length (numeric). */
+  EMAIL_OTP_LENGTH: 4,
+  /** TOTP code length (RFC 6238 — authenticator apps). */
+  TOTP_LENGTH: 6,
+  /** Backup code max length. */
+  BACKUP_CODE_MAX_LENGTH: 12
+};
 
-// src/_api/generated/core/params.gen.ts
-var extraPrefixesMap, extraPrefixes;
-var init_params_gen = __esm({
-  "src/_api/generated/core/params.gen.ts"() {
-    extraPrefixesMap = {
-      $body_: "body",
-      $headers_: "headers",
-      $path_: "path",
-      $query_: "query"
-    };
-    extraPrefixes = Object.entries(extraPrefixesMap);
-  }
-});
+// src/auth/context/AuthContext.tsx
+var import_navigation4 = require("next/navigation");
+var import_react16 = require("react");
 
-// src/_api/generated/core/queryKeySerializer.gen.ts
-var init_queryKeySerializer_gen = __esm({
-  "src/_api/generated/core/queryKeySerializer.gen.ts"() {
+// src/_api/generated/helpers/errors.ts
+var APIError = class extends Error {
+  constructor(statusCode, statusText, response, url, message) {
+    super(message || `HTTP ${statusCode}: ${statusText}`);
+    this.statusCode = statusCode;
+    this.statusText = statusText;
+    this.response = response;
+    this.url = url;
+    this.name = "APIError";
   }
-});
-
-// src/_api/generated/core/serverSentEvents.gen.ts
-function createSseClient({
-  onRequest,
-  onSseError,
-  onSseEvent,
-  responseTransformer,
-  responseValidator,
-  sseDefaultRetryDelay,
-  sseMaxRetryAttempts,
-  sseMaxRetryDelay,
-  sseSleepFn,
-  url,
-  ...options
-}) {
-  let lastEventId;
-  const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  const createStream = /* @__PURE__ */ __name(async function* () {
-    let retryDelay = sseDefaultRetryDelay ?? 3e3;
-    let attempt = 0;
-    const signal = options.signal ?? new AbortController().signal;
-    while (true) {
-      if (signal.aborted) break;
-      attempt++;
-      const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
-      if (lastEventId !== void 0) {
-        headers.set("Last-Event-ID", lastEventId);
-      }
-      try {
-        const requestInit = {
-          redirect: "follow",
-          ...options,
-          body: options.serializedBody,
-          headers,
-          signal
-        };
-        let request = new Request(url, requestInit);
-        if (onRequest) {
-          request = await onRequest(url, requestInit);
-        }
-        const _fetch = options.fetch ?? globalThis.fetch;
-        const response = await _fetch(request);
-        if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);
-        if (!response.body) throw new Error("No body in SSE response");
-        const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
-        let buffer = "";
-        const abortHandler = /* @__PURE__ */ __name(() => {
-          try {
-            reader.cancel();
-          } catch {
-          }
-        }, "abortHandler");
-        signal.addEventListener("abort", abortHandler);
-        try {
-          while (true) {
-            const { done, value } = await reader.read();
-            if (done) break;
-            buffer += value;
-            buffer = buffer.replace(/\r\n?/g, "\n");
-            const chunks = buffer.split("\n\n");
-            buffer = chunks.pop() ?? "";
-            for (const chunk of chunks) {
-              const lines = chunk.split("\n");
-              const dataLines = [];
-              let eventName;
-              for (const line of lines) {
-                if (line.startsWith("data:")) {
-                  dataLines.push(line.replace(/^data:\s*/, ""));
-                } else if (line.startsWith("event:")) {
-                  eventName = line.replace(/^event:\s*/, "");
-                } else if (line.startsWith("id:")) {
-                  lastEventId = line.replace(/^id:\s*/, "");
-                } else if (line.startsWith("retry:")) {
-                  const parsed = Number.parseInt(line.replace(/^retry:\s*/, ""), 10);
-                  if (!Number.isNaN(parsed)) {
-                    retryDelay = parsed;
-                  }
-                }
-              }
-              let data;
-              let parsedJson = false;
-              if (dataLines.length) {
-                const rawData = dataLines.join("\n");
-                try {
-                  data = JSON.parse(rawData);
-                  parsedJson = true;
-                } catch {
-                  data = rawData;
-                }
-              }
-              if (parsedJson) {
-                if (responseValidator) {
-                  await responseValidator(data);
-                }
-                if (responseTransformer) {
-                  data = await responseTransformer(data);
-                }
-              }
-              onSseEvent?.({
-                data,
-                event: eventName,
-                id: lastEventId,
-                retry: retryDelay
-              });
-              if (dataLines.length) {
-                yield data;
-              }
-            }
-          }
-        } finally {
-          signal.removeEventListener("abort", abortHandler);
-          reader.releaseLock();
-        }
-        break;
-      } catch (error) {
-        onSseError?.(error);
-        if (sseMaxRetryAttempts !== void 0 && attempt >= sseMaxRetryAttempts) {
-          break;
-        }
-        const backoff = Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 3e4);
-        await sleep(backoff);
-      }
+  static {
+    __name(this, "APIError");
+  }
+  get details() {
+    if (typeof this.response === "object" && this.response !== null) {
+      return this.response;
     }
-  }, "createStream");
-  const stream = createStream();
-  return { stream };
-}
-var init_serverSentEvents_gen = __esm({
-  "src/_api/generated/core/serverSentEvents.gen.ts"() {
-    __name(createSseClient, "createSseClient");
+    return null;
   }
-});
+  get fieldErrors() {
+    const details = this.details;
+    if (!details) return null;
+    const fieldErrors = {};
+    for (const [key, value] of Object.entries(details)) {
+      if (Array.isArray(value)) fieldErrors[key] = value;
+    }
+    return Object.keys(fieldErrors).length > 0 ? fieldErrors : null;
+  }
+  get errorMessage() {
+    const details = this.details;
+    if (!details) return this.message;
+    if (details.detail) {
+      return Array.isArray(details.detail) ? details.detail.join(", ") : String(details.detail);
+    }
+    if (details.error) return String(details.error);
+    if (details.message) return String(details.message);
+    const fieldErrors = this.fieldErrors;
+    if (fieldErrors) {
+      const firstField = Object.keys(fieldErrors)[0];
+      if (firstField) return `${firstField}: ${fieldErrors[firstField]?.join(", ")}`;
+    }
+    return this.message;
+  }
+  get isValidationError() {
+    return this.statusCode === 400;
+  }
+  get isAuthError() {
+    return this.statusCode === 401;
+  }
+  get isPermissionError() {
+    return this.statusCode === 403;
+  }
+  get isNotFoundError() {
+    return this.statusCode === 404;
+  }
+  get isServerError() {
+    return this.statusCode >= 500 && this.statusCode < 600;
+  }
+};
 
-// src/_api/generated/core/pathSerializer.gen.ts
-var separatorArrayExplode, separatorArrayNoExplode, separatorObjectExplode, serializeArrayParam, serializePrimitiveParam, serializeObjectParam;
-var init_pathSerializer_gen = __esm({
-  "src/_api/generated/core/pathSerializer.gen.ts"() {
-    separatorArrayExplode = /* @__PURE__ */ __name((style) => {
-      switch (style) {
-        case "label":
-          return ".";
-        case "matrix":
-          return ";";
-        case "simple":
-          return ",";
-        default:
-          return "&";
-      }
-    }, "separatorArrayExplode");
-    separatorArrayNoExplode = /* @__PURE__ */ __name((style) => {
-      switch (style) {
-        case "form":
-          return ",";
-        case "pipeDelimited":
-          return "|";
-        case "spaceDelimited":
-          return "%20";
-        default:
-          return ",";
+// src/_api/generated/helpers/auth.ts
+var ACCESS_KEY = "cfg.access_token";
+var REFRESH_KEY = "cfg.refresh_token";
+var API_KEY_KEY = "cfg.api_key";
+var isBrowser = typeof window !== "undefined";
+var localStorageBackend = {
+  get(key) {
+    if (!isBrowser) return null;
+    try {
+      return window.localStorage.getItem(key);
+    } catch {
+      return null;
+    }
+  },
+  set(key, value) {
+    if (!isBrowser) return;
+    try {
+      if (value === null) window.localStorage.removeItem(key);
+      else window.localStorage.setItem(key, value);
+    } catch {
+    }
+  }
+};
+var COOKIE_MAX_AGE = 60 * 60 * 24 * 30;
+var cookieBackend = {
+  get(key) {
+    if (!isBrowser) return null;
+    try {
+      const re = new RegExp(`(?:^|;\\s*)${encodeURIComponent(key)}=([^;]*)`);
+      const m = document.cookie.match(re);
+      return m ? decodeURIComponent(m[1]) : null;
+    } catch {
+      return null;
+    }
+  },
+  set(key, value) {
+    if (!isBrowser) return;
+    try {
+      const k = encodeURIComponent(key);
+      const secure = window.location.protocol === "https:" ? "; Secure" : "";
+      if (value === null) {
+        document.cookie = `${k}=; Path=/; Max-Age=0; SameSite=Lax${secure}`;
+      } else {
+        const v = encodeURIComponent(value);
+        document.cookie = `${k}=${v}; Path=/; Max-Age=${COOKIE_MAX_AGE}; SameSite=Lax${secure}`;
       }
-    }, "separatorArrayNoExplode");
-    separatorObjectExplode = /* @__PURE__ */ __name((style) => {
-      switch (style) {
-        case "label":
-          return ".";
-        case "matrix":
-          return ";";
-        case "simple":
-          return ",";
-        default:
-          return "&";
-      }
-    }, "separatorObjectExplode");
-    serializeArrayParam = /* @__PURE__ */ __name(({
-      allowReserved,
-      explode,
-      name,
-      style,
-      value
-    }) => {
-      if (!explode) {
-        const joinedValues2 = (allowReserved ? value : value.map((v) => encodeURIComponent(v))).join(separatorArrayNoExplode(style));
-        switch (style) {
-          case "label":
-            return `.${joinedValues2}`;
-          case "matrix":
-            return `;${name}=${joinedValues2}`;
-          case "simple":
-            return joinedValues2;
-          default:
-            return `${name}=${joinedValues2}`;
-        }
-      }
-      const separator = separatorArrayExplode(style);
-      const joinedValues = value.map((v) => {
-        if (style === "label" || style === "simple") {
-          return allowReserved ? v : encodeURIComponent(v);
-        }
-        return serializePrimitiveParam({
-          allowReserved,
-          name,
-          value: v
-        });
-      }).join(separator);
-      return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
-    }, "serializeArrayParam");
-    serializePrimitiveParam = /* @__PURE__ */ __name(({
-      allowReserved,
-      name,
-      value
-    }) => {
-      if (value === void 0 || value === null) {
-        return "";
-      }
-      if (typeof value === "object") {
-        throw new Error(
-          "Deeply-nested arrays/objects aren\u2019t supported. Provide your own `querySerializer()` to handle these."
-        );
-      }
-      return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
-    }, "serializePrimitiveParam");
-    serializeObjectParam = /* @__PURE__ */ __name(({
-      allowReserved,
-      explode,
-      name,
-      style,
-      value,
-      valueOnly
-    }) => {
-      if (value instanceof Date) {
-        return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
-      }
-      if (style !== "deepObject" && !explode) {
-        let values = [];
-        Object.entries(value).forEach(([key, v]) => {
-          values = [...values, key, allowReserved ? v : encodeURIComponent(v)];
-        });
-        const joinedValues2 = values.join(",");
-        switch (style) {
-          case "form":
-            return `${name}=${joinedValues2}`;
-          case "label":
-            return `.${joinedValues2}`;
-          case "matrix":
-            return `;${name}=${joinedValues2}`;
-          default:
-            return joinedValues2;
-        }
-      }
-      const separator = separatorObjectExplode(style);
-      const joinedValues = Object.entries(value).map(
-        ([key, v]) => serializePrimitiveParam({
-          allowReserved,
-          name: style === "deepObject" ? `${name}[${key}]` : key,
-          value: v
-        })
-      ).join(separator);
-      return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
-    }, "serializeObjectParam");
-  }
-});
-
-// src/_api/generated/core/utils.gen.ts
-function getValidRequestBody(options) {
-  const hasBody = options.body !== void 0;
-  const isSerializedBody = hasBody && options.bodySerializer;
-  if (isSerializedBody) {
-    if ("serializedBody" in options) {
-      const hasSerializedBody = options.serializedBody !== void 0 && options.serializedBody !== "";
-      return hasSerializedBody ? options.serializedBody : null;
+    } catch {
     }
-    return options.body !== "" ? options.body : null;
   }
-  if (hasBody) {
-    return options.body;
+};
+var _storage = localStorageBackend;
+var _storageMode = "localStorage";
+function detectLocale() {
+  try {
+    if (typeof document !== "undefined") {
+      const m = document.cookie.match(/(?:^|;\s*)NEXT_LOCALE=([^;]*)/);
+      if (m) return decodeURIComponent(m[1]);
+    }
+    if (typeof navigator !== "undefined" && navigator.language) {
+      return navigator.language;
+    }
+  } catch {
   }
-  return void 0;
+  return null;
 }
-var PATH_PARAM_RE, defaultPathSerializer, getUrl;
-var init_utils_gen = __esm({
-  "src/_api/generated/core/utils.gen.ts"() {
-    init_pathSerializer_gen();
-    PATH_PARAM_RE = /\{[^{}]+\}/g;
-    defaultPathSerializer = /* @__PURE__ */ __name(({ path, url: _url }) => {
-      let url = _url;
-      const matches = _url.match(PATH_PARAM_RE);
-      if (matches) {
-        for (const match of matches) {
-          let explode = false;
-          let name = match.substring(1, match.length - 1);
-          let style = "simple";
-          if (name.endsWith("*")) {
-            explode = true;
-            name = name.substring(0, name.length - 1);
-          }
-          if (name.startsWith(".")) {
-            name = name.substring(1);
-            style = "label";
-          } else if (name.startsWith(";")) {
-            name = name.substring(1);
-            style = "matrix";
-          }
-          const value = path[name];
-          if (value === void 0 || value === null) {
-            continue;
-          }
-          if (Array.isArray(value)) {
-            url = url.replace(match, serializeArrayParam({ explode, name, style, value }));
-            continue;
-          }
-          if (typeof value === "object") {
-            url = url.replace(
-              match,
-              serializeObjectParam({
-                explode,
-                name,
-                style,
-                value,
-                valueOnly: true
-              })
-            );
-            continue;
-          }
-          if (style === "matrix") {
-            url = url.replace(
-              match,
-              `;${serializePrimitiveParam({
-                name,
-                value
-              })}`
-            );
-            continue;
-          }
-          const replaceValue = encodeURIComponent(
-            style === "label" ? `.${value}` : value
-          );
-          url = url.replace(match, replaceValue);
-        }
-      }
-      return url;
-    }, "defaultPathSerializer");
-    getUrl = /* @__PURE__ */ __name(({
-      baseUrl,
-      path,
-      query,
-      querySerializer,
-      url: _url
-    }) => {
-      const pathUrl = _url.startsWith("/") ? _url : `/${_url}`;
-      let url = (baseUrl ?? "") + pathUrl;
-      if (path) {
-        url = defaultPathSerializer({ path, url });
-      }
-      let search = query ? querySerializer(query) : "";
-      if (search.startsWith("?")) {
-        search = search.substring(1);
-      }
-      if (search) {
-        url += `?${search}`;
+__name(detectLocale, "detectLocale");
+function defaultBaseUrl() {
+  if (typeof window !== "undefined") {
+    try {
+      if (typeof process !== "undefined" && process.env) {
+        if (process.env.NEXT_PUBLIC_STATIC_BUILD === "true") return "";
+        if (process.env.NEXT_PUBLIC_API_PROXY_URL !== void 0)
+          return process.env.NEXT_PUBLIC_API_PROXY_URL;
+        return process.env.NEXT_PUBLIC_API_URL || "";
       }
-      return url;
-    }, "getUrl");
-    __name(getValidRequestBody, "getValidRequestBody");
+    } catch {
+    }
+    return "";
   }
-});
-
-// src/_api/generated/core/auth.gen.ts
-var getAuthToken;
-var init_auth_gen = __esm({
-  "src/_api/generated/core/auth.gen.ts"() {
-    getAuthToken = /* @__PURE__ */ __name(async (auth2, callback) => {
-      const token = typeof callback === "function" ? await callback(auth2) : callback;
-      if (!token) {
-        return;
-      }
-      if (auth2.scheme === "bearer") {
-        return `Bearer ${token}`;
-      }
-      if (auth2.scheme === "basic") {
-        return `Basic ${btoa(token)}`;
-      }
-      return token;
-    }, "getAuthToken");
+  try {
+    if (typeof process !== "undefined" && process.env) {
+      if (process.env.NEXT_PUBLIC_STATIC_BUILD === "true") return "";
+      return process.env.NEXT_PUBLIC_API_URL || "";
+    }
+  } catch {
   }
-});
-
-// src/_api/generated/client/utils.gen.ts
-async function setAuthParams(options) {
-  for (const auth2 of options.security ?? []) {
-    if (checkForExistence(options, auth2.name)) {
-      continue;
+  return "";
+}
+__name(defaultBaseUrl, "defaultBaseUrl");
+function defaultApiKey() {
+  try {
+    if (typeof process !== "undefined" && process.env?.NEXT_PUBLIC_API_KEY) {
+      return process.env.NEXT_PUBLIC_API_KEY;
     }
-    const token = await getAuthToken(auth2, options.auth);
-    if (!token) {
-      continue;
+  } catch {
+  }
+  return null;
+}
+__name(defaultApiKey, "defaultApiKey");
+var _localeOverride = null;
+var _apiKeyOverride = null;
+var _baseUrlOverride = null;
+var _withCredentials = true;
+var _onUnauthorized = null;
+var _refreshHandler = null;
+var _refreshInflight = null;
+var RETRY_MARKER = "X-Auth-Retry";
+function jwtExpMs(token) {
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) return null;
+    const json = JSON.parse(atob(payload.replace(/-/g, "+").replace(/_/g, "/")));
+    return typeof json.exp === "number" ? json.exp * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+__name(jwtExpMs, "jwtExpMs");
+function computeSnapshot() {
+  const access = _storage.get(ACCESS_KEY);
+  const refresh = _storage.get(REFRESH_KEY);
+  const now = Date.now();
+  const accessExp = access ? jwtExpMs(access) : null;
+  const accessAlive = access !== null && (accessExp === null || accessExp > now);
+  const refreshExp = refresh ? jwtExpMs(refresh) : null;
+  const refreshAlive = refresh !== null && (refreshExp === null || refreshExp > now);
+  return {
+    status: accessAlive || refreshAlive ? "authenticated" : "anonymous",
+    accessExpiresAt: accessExp
+  };
+}
+__name(computeSnapshot, "computeSnapshot");
+var SERVER_SNAPSHOT = { status: "anonymous", accessExpiresAt: null };
+var SESSION_SYNC_EVENT = `cfg-auth:changed:${ACCESS_KEY}`;
+var _snapshot = computeSnapshot();
+var _sessionListeners = /* @__PURE__ */ new Set();
+var _expiryTimer = null;
+var _storageListenerInstalled = false;
+function scheduleExpiryFlip() {
+  if (!isBrowser) return;
+  if (_expiryTimer !== null) {
+    clearTimeout(_expiryTimer);
+    _expiryTimer = null;
+  }
+  if (_sessionListeners.size === 0) return;
+  const now = Date.now();
+  const exps = [];
+  const access = _storage.get(ACCESS_KEY);
+  const refresh = _storage.get(REFRESH_KEY);
+  const accessExp = access ? jwtExpMs(access) : null;
+  const refreshExp = refresh ? jwtExpMs(refresh) : null;
+  if (accessExp !== null && accessExp > now) exps.push(accessExp);
+  if (refreshExp !== null && refreshExp > now) exps.push(refreshExp);
+  if (!exps.length) return;
+  const delay = Math.min(Math.min(...exps) - now + 250, 2147483647);
+  _expiryTimer = setTimeout(notifySessionChanged, delay);
+}
+__name(scheduleExpiryFlip, "scheduleExpiryFlip");
+function notifySessionChanged() {
+  const next = computeSnapshot();
+  const changed = next.status !== _snapshot.status || next.accessExpiresAt !== _snapshot.accessExpiresAt;
+  if (changed) _snapshot = next;
+  scheduleExpiryFlip();
+  if (!changed) return;
+  for (const listener of Array.from(_sessionListeners)) {
+    try {
+      listener();
+    } catch {
     }
-    const name = auth2.name ?? "Authorization";
-    switch (auth2.in) {
-      case "query":
-        if (!options.query) {
-          options.query = {};
-        }
-        options.query[name] = token;
-        break;
-      case "cookie":
-        options.headers.append("Cookie", `${name}=${token}`);
-        break;
-      case "header":
-      default:
-        options.headers.set(name, token);
-        break;
+  }
+  if (isBrowser) {
+    try {
+      window.dispatchEvent(new Event(SESSION_SYNC_EVENT));
+    } catch {
     }
   }
 }
-var createQuerySerializer, getParseAs, checkForExistence, buildUrl, mergeConfigs, headersEntries, mergeHeaders, Interceptors, createInterceptors, defaultQuerySerializer, defaultHeaders, createConfig;
-var init_utils_gen2 = __esm({
-  "src/_api/generated/client/utils.gen.ts"() {
-    init_auth_gen();
-    init_bodySerializer_gen();
-    init_pathSerializer_gen();
-    init_utils_gen();
-    createQuerySerializer = /* @__PURE__ */ __name(({
-      parameters = {},
-      ...args
-    } = {}) => {
-      const querySerializer = /* @__PURE__ */ __name((queryParams) => {
-        const search = [];
-        if (queryParams && typeof queryParams === "object") {
-          for (const name in queryParams) {
-            const value = queryParams[name];
-            if (value === void 0 || value === null) {
-              continue;
-            }
-            const options = parameters[name] || args;
-            if (Array.isArray(value)) {
-              const serializedArray = serializeArrayParam({
-                allowReserved: options.allowReserved,
-                explode: true,
-                name,
-                style: "form",
-                value,
-                ...options.array
-              });
-              if (serializedArray) search.push(serializedArray);
-            } else if (typeof value === "object") {
-              const serializedObject = serializeObjectParam({
-                allowReserved: options.allowReserved,
-                explode: true,
-                name,
-                style: "deepObject",
-                value,
-                ...options.object
-              });
-              if (serializedObject) search.push(serializedObject);
-            } else {
-              const serializedPrimitive = serializePrimitiveParam({
-                allowReserved: options.allowReserved,
-                name,
-                value
-              });
-              if (serializedPrimitive) search.push(serializedPrimitive);
-            }
-          }
-        }
-        return search.join("&");
-      }, "querySerializer");
-      return querySerializer;
-    }, "createQuerySerializer");
-    getParseAs = /* @__PURE__ */ __name((contentType) => {
-      if (!contentType) {
-        return "stream";
-      }
-      const cleanContent = contentType.split(";")[0]?.trim();
-      if (!cleanContent) {
-        return;
-      }
-      if (cleanContent.startsWith("application/json") || cleanContent.endsWith("+json")) {
-        return "json";
-      }
-      if (cleanContent === "multipart/form-data") {
-        return "formData";
-      }
-      if (["application/", "audio/", "image/", "video/"].some((type) => cleanContent.startsWith(type))) {
-        return "blob";
-      }
-      if (cleanContent.startsWith("text/")) {
-        return "text";
-      }
-      return;
-    }, "getParseAs");
-    checkForExistence = /* @__PURE__ */ __name((options, name) => {
-      if (!name) {
-        return false;
-      }
-      if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) {
-        return true;
-      }
-      return false;
-    }, "checkForExistence");
-    __name(setAuthParams, "setAuthParams");
-    buildUrl = /* @__PURE__ */ __name((options) => getUrl({
-      baseUrl: options.baseUrl,
-      path: options.path,
-      query: options.query,
-      querySerializer: typeof options.querySerializer === "function" ? options.querySerializer : createQuerySerializer(options.querySerializer),
-      url: options.url
-    }), "buildUrl");
-    mergeConfigs = /* @__PURE__ */ __name((a, b) => {
-      const config = { ...a, ...b };
-      if (config.baseUrl?.endsWith("/")) {
-        config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);
-      }
-      config.headers = mergeHeaders(a.headers, b.headers);
-      return config;
-    }, "mergeConfigs");
-    headersEntries = /* @__PURE__ */ __name((headers) => {
-      const entries = [];
-      headers.forEach((value, key) => {
-        entries.push([key, value]);
-      });
-      return entries;
-    }, "headersEntries");
-    mergeHeaders = /* @__PURE__ */ __name((...headers) => {
-      const mergedHeaders = new Headers();
-      for (const header of headers) {
-        if (!header) {
-          continue;
-        }
-        const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
-        for (const [key, value] of iterator) {
-          if (value === null) {
-            mergedHeaders.delete(key);
-          } else if (Array.isArray(value)) {
-            for (const v of value) {
-              mergedHeaders.append(key, v);
-            }
-          } else if (value !== void 0) {
-            mergedHeaders.set(
-              key,
-              typeof value === "object" ? JSON.stringify(value) : value
-            );
-          }
-        }
-      }
-      return mergedHeaders;
-    }, "mergeHeaders");
-    Interceptors = class {
-      static {
-        __name(this, "Interceptors");
-      }
-      fns = [];
-      clear() {
-        this.fns = [];
-      }
-      eject(id) {
-        const index = this.getInterceptorIndex(id);
-        if (this.fns[index]) {
-          this.fns[index] = null;
-        }
-      }
-      exists(id) {
-        const index = this.getInterceptorIndex(id);
-        return Boolean(this.fns[index]);
-      }
-      getInterceptorIndex(id) {
-        if (typeof id === "number") {
-          return this.fns[id] ? id : -1;
-        }
-        return this.fns.indexOf(id);
-      }
-      update(id, fn) {
-        const index = this.getInterceptorIndex(id);
-        if (this.fns[index]) {
-          this.fns[index] = fn;
-          return id;
-        }
-        return false;
-      }
-      use(fn) {
-        this.fns.push(fn);
-        return this.fns.length - 1;
+__name(notifySessionChanged, "notifySessionChanged");
+function ensureStorageSync() {
+  if (!isBrowser || _storageListenerInstalled) return;
+  _storageListenerInstalled = true;
+  window.addEventListener("storage", (e) => {
+    if (e.key === null || e.key === ACCESS_KEY || e.key === REFRESH_KEY) {
+      notifySessionChanged();
+    }
+  });
+  window.addEventListener(SESSION_SYNC_EVENT, () => notifySessionChanged());
+}
+__name(ensureStorageSync, "ensureStorageSync");
+var _sessionExpiredHandlers = /* @__PURE__ */ new Set();
+var _client = null;
+function pushClientConfig() {
+  if (!_client) return;
+  _client.setConfig({
+    baseUrl: auth.getBaseUrl(),
+    credentials: _withCredentials ? "include" : "same-origin"
+  });
+}
+__name(pushClientConfig, "pushClientConfig");
+var auth = {
+  // ── Storage mode ──────────────────────────────────────────────────
+  getStorageMode() {
+    return _storageMode;
+  },
+  setStorageMode(mode) {
+    _storageMode = mode;
+    _storage = mode === "cookie" ? cookieBackend : localStorageBackend;
+    notifySessionChanged();
+  },
+  // ── Bearer token ──────────────────────────────────────────────────
+  getToken() {
+    return _storage.get(ACCESS_KEY);
+  },
+  setToken(token) {
+    _storage.set(ACCESS_KEY, token);
+    notifySessionChanged();
+  },
+  getRefreshToken() {
+    return _storage.get(REFRESH_KEY);
+  },
+  setRefreshToken(token) {
+    _storage.set(REFRESH_KEY, token);
+    notifySessionChanged();
+  },
+  clearTokens() {
+    _storage.set(ACCESS_KEY, null);
+    _storage.set(REFRESH_KEY, null);
+    notifySessionChanged();
+  },
+  /** Session-aware: token PRESENT and not past its `exp` (or a live refresh
+   * token exists that can mint one). Prefer `getSnapshot().status` in React. */
+  isAuthenticated() {
+    return computeSnapshot().status === "authenticated";
+  },
+  // ── Session (the ONE write path for login/logout flows) ──────────
+  /**
+   * Persist a token pair atomically. Every login flow (OTP verify, 2FA,
+   * OAuth callback) and the refresh handler should end here — do NOT
+   * scatter `setToken`/`setRefreshToken` pairs through app code.
+   * `refresh: undefined` keeps the current refresh token (access-only
+   * rotation); `refresh: null` explicitly drops it.
+   */
+  setSession(tokens) {
+    _storage.set(ACCESS_KEY, tokens.access);
+    if (tokens.refresh !== void 0) _storage.set(REFRESH_KEY, tokens.refresh);
+    notifySessionChanged();
+  },
+  clearSession() {
+    auth.clearTokens();
+  },
+  // ── Reactive snapshot (for useSyncExternalStore) ──────────────────
+  /**
+   * @example React:
+   *   const session = useSyncExternalStore(
+   *     auth.subscribe, auth.getSnapshot, auth.getServerSnapshot,
+   *   );
+   *   const isAuthenticated = session.status === 'authenticated';
+   */
+  getSnapshot() {
+    return _snapshot;
+  },
+  getServerSnapshot() {
+    return SERVER_SNAPSHOT;
+  },
+  subscribe(listener) {
+    ensureStorageSync();
+    _sessionListeners.add(listener);
+    notifySessionChanged();
+    return () => {
+      _sessionListeners.delete(listener);
+      if (_sessionListeners.size === 0 && _expiryTimer !== null) {
+        clearTimeout(_expiryTimer);
+        _expiryTimer = null;
       }
     };
-    createInterceptors = /* @__PURE__ */ __name(() => ({
-      error: new Interceptors(),
-      request: new Interceptors(),
-      response: new Interceptors()
-    }), "createInterceptors");
-    defaultQuerySerializer = createQuerySerializer({
-      allowReserved: false,
-      array: {
-        explode: true,
-        style: "form"
-      },
-      object: {
-        explode: true,
-        style: "deepObject"
-      }
-    });
-    defaultHeaders = {
-      "Content-Type": "application/json"
+  },
+  /**
+   * Fired on TERMINAL 401 — after the refresh+retry path is exhausted.
+   * The store has already cleared the session before calling back, so
+   * handlers only need to route to login (no clear-then-redirect
+   * ordering to get wrong). Returns an unsubscribe function; multiple
+   * handlers compose (unlike the legacy single-slot `onUnauthorized`).
+   */
+  onSessionExpired(cb) {
+    _sessionExpiredHandlers.add(cb);
+    return () => {
+      _sessionExpiredHandlers.delete(cb);
     };
-    createConfig = /* @__PURE__ */ __name((override = {}) => ({
-      ...jsonBodySerializer,
-      headers: defaultHeaders,
-      parseAs: "auto",
-      querySerializer: defaultQuerySerializer,
-      ...override
-    }), "createConfig");
-  }
-});
-
-// src/_api/generated/client/client.gen.ts
-var createClient;
-var init_client_gen = __esm({
-  "src/_api/generated/client/client.gen.ts"() {
-    init_serverSentEvents_gen();
-    init_utils_gen();
-    init_utils_gen2();
-    createClient = /* @__PURE__ */ __name((config = {}) => {
-      let _config = mergeConfigs(createConfig(), config);
-      const getConfig = /* @__PURE__ */ __name(() => ({ ..._config }), "getConfig");
-      const setConfig = /* @__PURE__ */ __name((config2) => {
-        _config = mergeConfigs(_config, config2);
-        return getConfig();
-      }, "setConfig");
-      const interceptors = createInterceptors();
-      const beforeRequest = /* @__PURE__ */ __name(async (options) => {
-        const opts = {
-          ..._config,
-          ...options,
-          fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,
-          headers: mergeHeaders(_config.headers, options.headers),
-          serializedBody: void 0
-        };
-        if (opts.security) {
-          await setAuthParams(opts);
-        }
-        if (opts.requestValidator) {
-          await opts.requestValidator(opts);
-        }
-        if (opts.body !== void 0 && opts.bodySerializer) {
-          opts.serializedBody = opts.bodySerializer(opts.body);
-        }
-        if (opts.body === void 0 || opts.serializedBody === "") {
-          opts.headers.delete("Content-Type");
-        }
-        const resolvedOpts = opts;
-        const url = buildUrl(resolvedOpts);
-        return { opts: resolvedOpts, url };
-      }, "beforeRequest");
-      const request = /* @__PURE__ */ __name(async (options) => {
-        const throwOnError = options.throwOnError ?? _config.throwOnError;
-        const responseStyle = options.responseStyle ?? _config.responseStyle;
-        let request2;
-        let response;
-        try {
-          const { opts, url } = await beforeRequest(options);
-          const requestInit = {
-            redirect: "follow",
-            ...opts,
-            body: getValidRequestBody(opts)
-          };
-          request2 = new Request(url, requestInit);
-          for (const fn of interceptors.request.fns) {
-            if (fn) {
-              request2 = await fn(request2, opts);
-            }
-          }
-          const _fetch = opts.fetch;
-          response = await _fetch(request2);
-          for (const fn of interceptors.response.fns) {
-            if (fn) {
-              response = await fn(response, request2, opts);
-            }
-          }
-          const result = {
-            request: request2,
-            response
-          };
-          if (response.ok) {
-            const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
-            if (response.status === 204 || response.headers.get("Content-Length") === "0") {
-              let emptyData;
-              switch (parseAs) {
-                case "arrayBuffer":
-                case "blob":
-                case "text":
-                  emptyData = await response[parseAs]();
-                  break;
-                case "formData":
-                  emptyData = new FormData();
-                  break;
-                case "stream":
-                  emptyData = response.body;
-                  break;
-                case "json":
-                default:
-                  emptyData = {};
-                  break;
-              }
-              return opts.responseStyle === "data" ? emptyData : {
-                data: emptyData,
-                ...result
-              };
-            }
-            let data;
-            switch (parseAs) {
-              case "arrayBuffer":
-              case "blob":
-              case "formData":
-              case "text":
-                data = await response[parseAs]();
-                break;
-              case "json": {
-                const text = await response.text();
-                data = text ? JSON.parse(text) : {};
-                break;
-              }
-              case "stream":
-                return opts.responseStyle === "data" ? response.body : {
-                  data: response.body,
-                  ...result
-                };
-            }
-            if (parseAs === "json") {
-              if (opts.responseValidator) {
-                await opts.responseValidator(data);
-              }
-              if (opts.responseTransformer) {
-                data = await opts.responseTransformer(data);
-              }
-            }
-            return opts.responseStyle === "data" ? data : {
-              data,
-              ...result
-            };
-          }
-          const textError = await response.text();
-          let jsonError;
-          try {
-            jsonError = JSON.parse(textError);
-          } catch {
-          }
-          throw jsonError ?? textError;
-        } catch (error) {
-          let finalError = error;
-          for (const fn of interceptors.error.fns) {
-            if (fn) {
-              finalError = await fn(finalError, response, request2, options);
-            }
-          }
-          finalError = finalError || {};
-          if (throwOnError) {
-            throw finalError;
-          }
-          return responseStyle === "data" ? void 0 : {
-            error: finalError,
-            request: request2,
-            response
-          };
-        }
-      }, "request");
-      const makeMethodFn = /* @__PURE__ */ __name((method) => (options) => request({ ...options, method }), "makeMethodFn");
-      const makeSseFn = /* @__PURE__ */ __name((method) => async (options) => {
-        const { opts, url } = await beforeRequest(options);
-        return createSseClient({
-          ...opts,
-          body: opts.body,
-          method,
-          onRequest: /* @__PURE__ */ __name(async (url2, init) => {
-            let request2 = new Request(url2, init);
-            for (const fn of interceptors.request.fns) {
-              if (fn) {
-                request2 = await fn(request2, opts);
-              }
-            }
-            return request2;
-          }, "onRequest"),
-          serializedBody: getValidRequestBody(opts),
-          url
-        });
-      }, "makeSseFn");
-      const _buildUrl = /* @__PURE__ */ __name((options) => buildUrl({ ..._config, ...options }), "_buildUrl");
-      return {
-        buildUrl: _buildUrl,
-        connect: makeMethodFn("CONNECT"),
-        delete: makeMethodFn("DELETE"),
-        get: makeMethodFn("GET"),
-        getConfig,
-        head: makeMethodFn("HEAD"),
-        interceptors,
-        options: makeMethodFn("OPTIONS"),
-        patch: makeMethodFn("PATCH"),
-        post: makeMethodFn("POST"),
-        put: makeMethodFn("PUT"),
-        request,
-        setConfig,
-        sse: {
-          connect: makeSseFn("CONNECT"),
-          delete: makeSseFn("DELETE"),
-          get: makeSseFn("GET"),
-          head: makeSseFn("HEAD"),
-          options: makeSseFn("OPTIONS"),
-          patch: makeSseFn("PATCH"),
-          post: makeSseFn("POST"),
-          put: makeSseFn("PUT"),
-          trace: makeSseFn("TRACE")
-        },
-        trace: makeMethodFn("TRACE")
-      };
-    }, "createClient");
-  }
-});
-
-// src/_api/generated/client/index.ts
-var init_client = __esm({
-  "src/_api/generated/client/index.ts"() {
-    init_bodySerializer_gen();
-    init_params_gen();
-    init_queryKeySerializer_gen();
-    init_client_gen();
-    init_utils_gen2();
-  }
-});
-
-// src/_api/generated/client.gen.ts
-var client;
-var init_client_gen2 = __esm({
-  "src/_api/generated/client.gen.ts"() {
-    init_client();
-    init_auth();
-    client = createClient(createConfig({ baseUrl: "http://localhost:8000" }));
-    installAuthOnClient(client);
+  },
+  // ── API key ───────────────────────────────────────────────────────
+  getApiKey() {
+    return _apiKeyOverride ?? _storage.get(API_KEY_KEY) ?? defaultApiKey();
+  },
+  setApiKey(key) {
+    _apiKeyOverride = key;
+  },
+  setApiKeyPersist(key) {
+    _apiKeyOverride = key;
+    _storage.set(API_KEY_KEY, key);
+  },
+  clearApiKey() {
+    _apiKeyOverride = null;
+    _storage.set(API_KEY_KEY, null);
+  },
+  // ── Locale ────────────────────────────────────────────────────────
+  getLocale() {
+    return _localeOverride ?? detectLocale();
+  },
+  setLocale(locale) {
+    _localeOverride = locale;
+  },
+  // ── Base URL ──────────────────────────────────────────────────────
+  getBaseUrl() {
+    const url = _baseUrlOverride ?? defaultBaseUrl();
+    return url.replace(/\/$/, "");
+  },
+  setBaseUrl(url) {
+    _baseUrlOverride = url ? url.replace(/\/$/, "") : null;
+    pushClientConfig();
+  },
+  // ── Credentials toggle ────────────────────────────────────────────
+  getWithCredentials() {
+    return _withCredentials;
+  },
+  setWithCredentials(value) {
+    _withCredentials = value;
+    pushClientConfig();
+  },
+  // ── 401 handler ───────────────────────────────────────────────────
+  /**
+   * Fired when the server returns 401 AND no refresh path recovers it
+   * (no refresh token, no refresh handler, refresh failed, or retry
+   * still 401). The app should clear local state and redirect to login.
+   *
+   * NOT fired for 401 that gets transparently recovered by the refresh
+   * handler — those are invisible to callers.
+   */
+  onUnauthorized(cb) {
+    _onUnauthorized = cb;
+  },
+  /**
+   * Register the refresh strategy. The handler receives the current
+   * refresh token and must call your refresh endpoint, returning
+   * `{ access, refresh? }` on success or `null` on failure.
+   *
+   * @example
+   *   auth.setRefreshHandler(async (refresh) => {
+   *     const { data } = await Auth.tokenRefreshCreate({ body: { refresh } });
+   *     return data ? { access: data.access, refresh: data.refresh } : null;
+   *   });
+   */
+  setRefreshHandler(fn) {
+    _refreshHandler = fn;
+  },
+  /**
+   * Proactively run the registered refresh handler right now, reusing the
+   * SAME single-flight promise as the 401-recovery interceptor. Callers
+   * (e.g. an expiry timer / focus / reconnect) get token rotation,
+   * de-duplication and rotated-token persistence for free — they must NOT
+   * re-implement any of it. Returns the fresh access token, or null if
+   * there is no handler / no refresh token / the refresh failed.
+   */
+  refreshNow() {
+    return tryRefresh();
   }
-});
-
-// src/_api/generated/sdk.gen.ts
-var sdk_gen_exports = {};
-__export(sdk_gen_exports, {
-  CfgAccounts: () => CfgAccounts,
-  CfgAccountsApiKey: () => CfgAccountsApiKey,
-  CfgAccountsAuth: () => CfgAccountsAuth,
-  CfgAccountsOauth: () => CfgAccountsOauth,
-  CfgAccountsProfile: () => CfgAccountsProfile,
-  CfgCentrifugo: () => CfgCentrifugo,
-  CfgTotp: () => CfgTotp,
-  CfgTotpBackupCodes: () => CfgTotpBackupCodes,
-  CfgTotpSetup: () => CfgTotpSetup,
-  CfgTotpVerify: () => CfgTotpVerify
-});
-var CfgAccountsApiKey, CfgAccountsOauth, CfgAccounts, CfgAccountsProfile, CfgAccountsAuth, CfgCentrifugo, CfgTotpBackupCodes, CfgTotp, CfgTotpSetup, CfgTotpVerify;
-var init_sdk_gen = __esm({
-  "src/_api/generated/sdk.gen.ts"() {
-    init_client();
-    init_client_gen2();
-    CfgAccountsApiKey = class {
-      static {
-        __name(this, "CfgAccountsApiKey");
-      }
-      /**
-       * Get API key details
-       *
-       * Retrieve the current user's API key (masked) and metadata.
-       */
-      static cfgAccountsApiKeyRetrieve(options) {
-        return (options?.client ?? client).get({
-          security: [
-            { scheme: "bearer", type: "http" },
-            {
-              in: "cookie",
-              name: "sessionid",
-              type: "apiKey"
-            },
-            { name: "X-API-Key", type: "apiKey" }
-          ],
-          url: "/cfg/accounts/api-key/",
-          ...options
-        });
-      }
-      /**
-       * Regenerate API key
-       *
-       * Generate a new API key. The full key is returned only once.
-       */
-      static cfgAccountsApiKeyRegenerateCreate(options) {
-        return (options.client ?? client).post({
-          security: [
-            { scheme: "bearer", type: "http" },
-            {
-              in: "cookie",
-              name: "sessionid",
-              type: "apiKey"
-            },
-            { name: "X-API-Key", type: "apiKey" }
-          ],
-          url: "/cfg/accounts/api-key/regenerate/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
-      }
-      /**
-       * Reveal API key
-       *
-       * Return the current full API key WITHOUT rotating it. The same durable value every one of the user's agents uses — for the signed-in user to copy and paste into agent onboarding. Default GET stays masked; this is the explicit reveal action.
-       */
-      static cfgAccountsApiKeyRevealCreate(options) {
-        return (options.client ?? client).post({
-          security: [
-            { scheme: "bearer", type: "http" },
-            {
-              in: "cookie",
-              name: "sessionid",
-              type: "apiKey"
-            },
-            { name: "X-API-Key", type: "apiKey" }
-          ],
-          url: "/cfg/accounts/api-key/reveal/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
-      }
-      /**
-       * Test API key
-       *
-       * Test whether an API key is valid without consuming it.
-       */
-      static cfgAccountsApiKeyTestCreate(options) {
-        return (options.client ?? client).post({
-          security: [
-            { scheme: "bearer", type: "http" },
-            {
-              in: "cookie",
-              name: "sessionid",
-              type: "apiKey"
-            },
-            { name: "X-API-Key", type: "apiKey" }
-          ],
-          url: "/cfg/accounts/api-key/test/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
-      }
-    };
-    CfgAccountsOauth = class {
-      static {
-        __name(this, "CfgAccountsOauth");
-      }
-      /**
-       * List OAuth connections
-       *
-       * Get all OAuth connections for the current user.
-       */
-      static cfgAccountsOauthConnectionsList(options) {
-        return (options?.client ?? client).get({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/accounts/oauth/connections/",
-          ...options
-        });
-      }
-      /**
-       * Disconnect OAuth provider
-       *
-       * Remove OAuth connection for the specified provider.
-       */
-      static cfgAccountsOauthDisconnectCreate(options) {
-        return (options.client ?? client).post({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/accounts/oauth/disconnect/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
-      }
-      /**
-       * Start GitHub OAuth
-       *
-       * Generate GitHub OAuth authorization URL. Redirect user to this URL to start authentication.
-       */
-      static cfgAccountsOauthGithubAuthorizeCreate(options) {
-        return (options?.client ?? client).post({
-          url: "/cfg/accounts/oauth/github/authorize/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options?.headers
-          }
-        });
-      }
-      /**
-       * Complete GitHub OAuth
-       *
-       * Exchange authorization code for JWT tokens. Call this after GitHub redirects back with code.
-       */
-      static cfgAccountsOauthGithubCallbackCreate(options) {
-        return (options.client ?? client).post({
-          url: "/cfg/accounts/oauth/github/callback/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
-      }
-      /**
-       * List OAuth providers
-       *
-       * Get list of available OAuth providers for authentication.
-       */
-      static cfgAccountsOauthProvidersRetrieve(options) {
-        return (options?.client ?? client).get({ url: "/cfg/accounts/oauth/providers/", ...options });
-      }
-    };
-    CfgAccounts = class {
-      static {
-        __name(this, "CfgAccounts");
-      }
-      /**
-       * Request OTP code to email.
-       */
-      static cfgAccountsOtpRequestCreate(options) {
-        return (options.client ?? client).post({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/accounts/otp/request/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
-      }
-      /**
-       * Verify OTP code and return JWT tokens or 2FA session.
-       *
-       * If user has 2FA enabled:
-       * - Returns requires_2fa=True with session_id
-       * - Client must complete 2FA verification at /cfg/totp/verify/
-       *
-       * If user has no 2FA:
-       * - Returns JWT tokens and user data directly
-       */
-      static cfgAccountsOtpVerifyCreate(options) {
-        return (options.client ?? client).post({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/accounts/otp/verify/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
-      }
-    };
-    CfgAccountsProfile = class {
-      static {
-        __name(this, "CfgAccountsProfile");
-      }
-      /**
-       * Get current user profile
-       *
-       * Retrieve the current authenticated user's profile information.
-       */
-      static cfgAccountsProfileRetrieve(options) {
-        return (options?.client ?? client).get({
-          security: [{ scheme: "bearer", type: "http" }, {
-            in: "cookie",
-            name: "sessionid",
-            type: "apiKey"
-          }],
-          url: "/cfg/accounts/profile/",
-          ...options
-        });
-      }
-      /**
-       * Upload user avatar
-       *
-       * Upload avatar image for the current authenticated user. Accepts multipart/form-data with 'avatar' field.
-       */
-      static cfgAccountsProfileAvatarCreate(options) {
-        return (options?.client ?? client).post({
-          ...formDataBodySerializer,
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/accounts/profile/avatar/",
-          ...options,
-          headers: {
-            "Content-Type": null,
-            ...options?.headers
-          }
-        });
-      }
-      /**
-       * Delete user account
-       *
-       *
-       * Permanently delete the current user's account.
-       *
-       * This operation:
-       * - Deactivates the account (user cannot log in)
-       * - Anonymizes personal data (GDPR compliance)
-       * - Frees up the email address for re-registration
-       * - Preserves audit trail
-       *
-       * The account can be restored by an administrator if needed.
-       *
-       */
-      static cfgAccountsProfileDeleteCreate(options) {
-        return (options?.client ?? client).post({
-          security: [{ scheme: "bearer", type: "http" }, {
-            in: "cookie",
-            name: "sessionid",
-            type: "apiKey"
-          }],
-          url: "/cfg/accounts/profile/delete/",
-          ...options
-        });
-      }
-      /**
-       * Partial update user profile
-       *
-       * Partially update the current authenticated user's profile information. Supports avatar upload.
-       */
-      static cfgAccountsProfilePartialPartialUpdate(options) {
-        return (options?.client ?? client).patch({
-          security: [{ scheme: "bearer", type: "http" }, {
-            in: "cookie",
-            name: "sessionid",
-            type: "apiKey"
-          }],
-          url: "/cfg/accounts/profile/partial/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options?.headers
-          }
-        });
-      }
-      /**
-       * Partial update user profile
-       *
-       * Partially update the current authenticated user's profile information. Supports avatar upload.
-       */
-      static cfgAccountsProfilePartialUpdate(options) {
-        return (options?.client ?? client).put({
-          security: [{ scheme: "bearer", type: "http" }, {
-            in: "cookie",
-            name: "sessionid",
-            type: "apiKey"
-          }],
-          url: "/cfg/accounts/profile/partial/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options?.headers
-          }
-        });
-      }
-      /**
-       * Update user profile
-       *
-       * Update the current authenticated user's profile information.
-       */
-      static cfgAccountsProfileUpdatePartialUpdate(options) {
-        return (options?.client ?? client).patch({
-          security: [{ scheme: "bearer", type: "http" }, {
-            in: "cookie",
-            name: "sessionid",
-            type: "apiKey"
-          }],
-          url: "/cfg/accounts/profile/update/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options?.headers
-          }
-        });
-      }
-      /**
-       * Update user profile
-       *
-       * Update the current authenticated user's profile information.
-       */
-      static cfgAccountsProfileUpdateUpdate(options) {
-        return (options?.client ?? client).put({
-          security: [{ scheme: "bearer", type: "http" }, {
-            in: "cookie",
-            name: "sessionid",
-            type: "apiKey"
-          }],
-          url: "/cfg/accounts/profile/update/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options?.headers
-          }
-        });
-      }
-    };
-    CfgAccountsAuth = class {
-      static {
-        __name(this, "CfgAccountsAuth");
-      }
-      /**
-       * Revoke a refresh token (logout).
-       *
-       * Blacklists the posted refresh token so it can never mint another access
-       * token. Called best-effort by the client's logout — without it, "logout"
-       * is purely client-side and a stolen refresh token survives until expiry.
-       */
-      static cfgAccountsTokenBlacklistCreate(options) {
-        return (options.client ?? client).post({
-          url: "/cfg/accounts/token/blacklist/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
-      }
-      /**
-       * Refresh JWT token.
-       *
-       * DPoP-aware: when the incoming refresh token is key-bound (`cnf.jkt`), the
-       * rotated access/refresh in the response are re-stamped with the same `cnf`
-       * (stock SimpleJWT drops it from the derived access), and a matching DPoP
-       * proof is required on the refresh request — so a stolen refresh token can't
-       * be used to mint fresh tokens.
-       */
-      static cfgAccountsTokenRefreshCreate(options) {
-        return (options.client ?? client).post({
-          url: "/cfg/accounts/token/refresh/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
-      }
-    };
-    CfgCentrifugo = class {
-      static {
-        __name(this, "CfgCentrifugo");
-      }
-      /**
-       * Get Centrifugo connection token
-       *
-       * Generate JWT token for WebSocket connection to Centrifugo. Token includes user's allowed channels based on their permissions. Requires authentication.
-       */
-      static cfgCentrifugoAuthTokenRetrieve(options) {
-        return (options?.client ?? client).get({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/centrifugo/auth/token/",
-          ...options
-        });
-      }
-    };
-    CfgTotpBackupCodes = class {
-      static {
-        __name(this, "CfgTotpBackupCodes");
-      }
-      /**
-       * Get backup codes status for user.
-       */
-      static cfgTotpBackupCodesRetrieve(options) {
-        return (options?.client ?? client).get({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/totp/backup-codes/",
-          ...options
-        });
-      }
-      /**
-       * Regenerate backup codes.
-       *
-       * Requires TOTP code for verification.
-       * Invalidates all existing codes.
-       */
-      static cfgTotpBackupCodesRegenerateCreate(options) {
-        return (options.client ?? client).post({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/totp/backup-codes/regenerate/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
-      }
-    };
-    CfgTotp = class {
-      static {
-        __name(this, "CfgTotp");
-      }
-      /**
-       * List all TOTP devices for user.
-       */
-      static cfgTotpDevicesRetrieve(options) {
-        return (options?.client ?? client).get({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/totp/devices/",
-          ...options
-        });
-      }
-      /**
-       * Delete a TOTP device.
-       *
-       * Requires verification code if removing the last/primary device.
-       */
-      static cfgTotpDevicesDestroy(options) {
-        return (options.client ?? client).delete({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/totp/devices/{id}/",
-          ...options
-        });
-      }
-      /**
-       * Completely disable 2FA for account.
-       *
-       * Requires verification code.
-       */
-      static cfgTotpDisableCreate(options) {
-        return (options.client ?? client).post({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/totp/disable/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
-      }
-    };
-    CfgTotpSetup = class {
-      static {
-        __name(this, "CfgTotpSetup");
-      }
-      /**
-       * Start 2FA setup process.
-       *
-       * Creates a new TOTP device and returns QR code for scanning.
-       */
-      static cfgTotpSetupCreate(options) {
-        return (options?.client ?? client).post({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/totp/setup/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options?.headers
-          }
-        });
-      }
-      /**
-       * Confirm 2FA setup with first valid code.
-       *
-       * Activates the device and generates backup codes.
-       */
-      static cfgTotpSetupConfirmCreate(options) {
-        return (options.client ?? client).post({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/totp/setup/confirm/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
-      }
-    };
-    CfgTotpVerify = class {
-      static {
-        __name(this, "CfgTotpVerify");
-      }
-      /**
-       * Verify TOTP code for 2FA session.
-       *
-       * Completes authentication and returns JWT tokens on success.
-       */
-      static cfgTotpVerifyCreate(options) {
-        return (options.client ?? client).post({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/totp/verify/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
-      }
-      /**
-       * Verify backup recovery code for 2FA session.
-       *
-       * Alternative verification method when TOTP device unavailable.
-       */
-      static cfgTotpVerifyBackupCreate(options) {
-        return (options.client ?? client).post({
-          security: [
-            { name: "X-API-Key", type: "apiKey" },
-            { scheme: "bearer", type: "http" },
-            { name: "Authorization", type: "apiKey" }
-          ],
-          url: "/cfg/totp/verify/backup/",
-          ...options,
-          headers: {
-            "Content-Type": "application/json",
-            ...options.headers
-          }
-        });
+};
+async function tryRefresh() {
+  if (_refreshInflight) return _refreshInflight;
+  if (!_refreshHandler) return null;
+  const runRefresh = /* @__PURE__ */ __name(async () => {
+    const refresh = auth.getRefreshToken();
+    if (!refresh) return null;
+    const result = await _refreshHandler(refresh);
+    if (!result?.access) return null;
+    auth.setToken(result.access);
+    if (result.refresh) auth.setRefreshToken(result.refresh);
+    return result.access;
+  }, "runRefresh");
+  _refreshInflight = (async () => {
+    try {
+      const locks = typeof navigator !== "undefined" ? navigator.locks : void 0;
+      if (locks?.request) {
+        return await locks.request(`${REFRESH_KEY}:refresh`, runRefresh);
       }
-    };
-  }
-});
-
-// src/_api/generated/helpers/auth.ts
-function detectLocale() {
-  try {
-    if (typeof document !== "undefined") {
-      const m = document.cookie.match(/(?:^|;\s*)NEXT_LOCALE=([^;]*)/);
-      if (m) return decodeURIComponent(m[1]);
-    }
-    if (typeof navigator !== "undefined" && navigator.language) {
-      return navigator.language;
+      return await runRefresh();
+    } catch {
+      return null;
+    } finally {
+      _refreshInflight = null;
     }
-  } catch {
-  }
-  return null;
+  })();
+  return _refreshInflight;
 }
-function defaultBaseUrl() {
-  if (typeof window !== "undefined") {
+__name(tryRefresh, "tryRefresh");
+function expireSession(response) {
+  auth.clearTokens();
+  for (const cb of Array.from(_sessionExpiredHandlers)) {
     try {
-      if (typeof process !== "undefined" && process.env) {
-        if (process.env.NEXT_PUBLIC_STATIC_BUILD === "true") return "";
-        if (process.env.NEXT_PUBLIC_API_PROXY_URL !== void 0)
-          return process.env.NEXT_PUBLIC_API_PROXY_URL;
-        return process.env.NEXT_PUBLIC_API_URL || "";
-      }
+      cb(response);
     } catch {
     }
-    return "";
   }
-  try {
-    if (typeof process !== "undefined" && process.env) {
-      if (process.env.NEXT_PUBLIC_STATIC_BUILD === "true") return "";
-      return process.env.NEXT_PUBLIC_API_URL || "";
+  if (_onUnauthorized) {
+    try {
+      _onUnauthorized(response);
+    } catch {
     }
-  } catch {
   }
-  return "";
 }
-function defaultApiKey() {
-  try {
-    if (typeof process !== "undefined" && process.env?.NEXT_PUBLIC_API_KEY) {
-      return process.env.NEXT_PUBLIC_API_KEY;
-    }
-  } catch {
-  }
-  return null;
-}
-function jwtExpMs(token) {
-  try {
-    const payload = token.split(".")[1];
-    if (!payload) return null;
-    const json = JSON.parse(atob(payload.replace(/-/g, "+").replace(/_/g, "/")));
-    return typeof json.exp === "number" ? json.exp * 1e3 : null;
-  } catch {
-    return null;
-  }
-}
-function computeSnapshot() {
-  const access = _storage.get(ACCESS_KEY);
-  const refresh = _storage.get(REFRESH_KEY);
-  const now = Date.now();
-  const accessExp = access ? jwtExpMs(access) : null;
-  const accessAlive = access !== null && (accessExp === null || accessExp > now);
-  const refreshExp = refresh ? jwtExpMs(refresh) : null;
-  const refreshAlive = refresh !== null && (refreshExp === null || refreshExp > now);
-  return {
-    status: accessAlive || refreshAlive ? "authenticated" : "anonymous",
-    accessExpiresAt: accessExp
-  };
-}
-function scheduleExpiryFlip() {
-  if (!isBrowser) return;
-  if (_expiryTimer !== null) {
-    clearTimeout(_expiryTimer);
-    _expiryTimer = null;
-  }
-  if (_sessionListeners.size === 0) return;
-  const now = Date.now();
-  const exps = [];
-  const access = _storage.get(ACCESS_KEY);
-  const refresh = _storage.get(REFRESH_KEY);
-  const accessExp = access ? jwtExpMs(access) : null;
-  const refreshExp = refresh ? jwtExpMs(refresh) : null;
-  if (accessExp !== null && accessExp > now) exps.push(accessExp);
-  if (refreshExp !== null && refreshExp > now) exps.push(refreshExp);
-  if (!exps.length) return;
-  const delay = Math.min(Math.min(...exps) - now + 250, 2147483647);
-  _expiryTimer = setTimeout(notifySessionChanged, delay);
-}
-function notifySessionChanged() {
-  const next = computeSnapshot();
-  const changed = next.status !== _snapshot.status || next.accessExpiresAt !== _snapshot.accessExpiresAt;
-  if (changed) _snapshot = next;
-  scheduleExpiryFlip();
-  if (!changed) return;
-  for (const listener of Array.from(_sessionListeners)) {
-    try {
-      listener();
-    } catch {
-    }
-  }
-  if (isBrowser) {
-    try {
-      window.dispatchEvent(new Event(SESSION_SYNC_EVENT));
-    } catch {
-    }
-  }
-}
-function ensureStorageSync() {
-  if (!isBrowser || _storageListenerInstalled) return;
-  _storageListenerInstalled = true;
-  window.addEventListener("storage", (e) => {
-    if (e.key === null || e.key === ACCESS_KEY || e.key === REFRESH_KEY) {
-      notifySessionChanged();
-    }
-  });
-  window.addEventListener(SESSION_SYNC_EVENT, () => notifySessionChanged());
-}
-function pushClientConfig() {
-  if (!_client) return;
-  _client.setConfig({
-    baseUrl: auth.getBaseUrl(),
-    credentials: _withCredentials ? "include" : "same-origin"
-  });
-}
-async function tryRefresh() {
-  if (_refreshInflight) return _refreshInflight;
-  if (!_refreshHandler) return null;
-  const runRefresh = /* @__PURE__ */ __name(async () => {
-    const refresh = auth.getRefreshToken();
-    if (!refresh) return null;
-    const result = await _refreshHandler(refresh);
-    if (!result?.access) return null;
-    auth.setToken(result.access);
-    if (result.refresh) auth.setRefreshToken(result.refresh);
-    return result.access;
-  }, "runRefresh");
-  _refreshInflight = (async () => {
-    try {
-      const locks = typeof navigator !== "undefined" ? navigator.locks : void 0;
-      if (locks?.request) {
-        return await locks.request(`${REFRESH_KEY}:refresh`, runRefresh);
-      }
-      return await runRefresh();
-    } catch {
-      return null;
-    } finally {
-      _refreshInflight = null;
-    }
-  })();
-  return _refreshInflight;
-}
-function expireSession(response) {
-  auth.clearTokens();
-  for (const cb of Array.from(_sessionExpiredHandlers)) {
-    try {
-      cb(response);
-    } catch {
-    }
-  }
-  if (_onUnauthorized) {
-    try {
-      _onUnauthorized(response);
-    } catch {
-    }
-  }
-}
-function dpopEnabled() {
+__name(expireSession, "expireSession");
+function dpopEnabled() {
   try {
     return typeof process !== "undefined" && process.env?.NEXT_PUBLIC_DPOP_ENABLED === "true";
   } catch {
     return false;
   }
 }
+__name(dpopEnabled, "dpopEnabled");
+var _DPOP_DB = "cfg-auth";
+var _DPOP_STORE = "keys";
+var _DPOP_KEY_ID = "dpop-ec-p256";
 function _idbOpen() {
   return new Promise((resolve, reject) => {
     const req = indexedDB.open(_DPOP_DB, 1);
@@ -1808,6 +582,7 @@ function _idbOpen() {
     req.onerror = () => reject(req.error);
   });
 }
+__name(_idbOpen, "_idbOpen");
 function _idbGet(key) {
   return _idbOpen().then((db) => new Promise((resolve, reject) => {
     const tx = db.transaction(_DPOP_STORE, "readonly");
@@ -1816,6 +591,7 @@ function _idbGet(key) {
     req.onerror = () => reject(req.error);
   }));
 }
+__name(_idbGet, "_idbGet");
 function _idbPut(key, value) {
   return _idbOpen().then((db) => new Promise((resolve, reject) => {
     const tx = db.transaction(_DPOP_STORE, "readwrite");
@@ -1824,6 +600,8 @@ function _idbPut(key, value) {
     tx.onerror = () => reject(tx.error);
   }));
 }
+__name(_idbPut, "_idbPut");
+var _dpopKeyPromise = null;
 function _getDpopKeyPair() {
   if (_dpopKeyPromise) return _dpopKeyPromise;
   _dpopKeyPromise = (async () => {
@@ -1841,19 +619,23 @@ function _getDpopKeyPair() {
   })();
   return _dpopKeyPromise;
 }
+__name(_getDpopKeyPair, "_getDpopKeyPair");
 function _b64urlFromBytes(bytes) {
   const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
   let s = "";
   for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i]);
   return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
+__name(_b64urlFromBytes, "_b64urlFromBytes");
 function _b64urlFromString(str) {
   return _b64urlFromBytes(new TextEncoder().encode(str));
 }
+__name(_b64urlFromString, "_b64urlFromString");
 async function _publicJwk(pub) {
   const jwk = await crypto.subtle.exportKey("jwk", pub);
   return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
 }
+__name(_publicJwk, "_publicJwk");
 async function _makeDpopProof(method, url) {
   try {
     const pair = await _getDpopKeyPair();
@@ -1873,6 +655,7 @@ async function _makeDpopProof(method, url) {
     return null;
   }
 }
+__name(_makeDpopProof, "_makeDpopProof");
 function installAuthOnClient(client2) {
   if (_client) return;
   _client = client2;
@@ -1933,356 +716,30 @@ function installAuthOnClient(client2) {
     }
   });
 }
-var ACCESS_KEY, REFRESH_KEY, API_KEY_KEY, isBrowser, localStorageBackend, COOKIE_MAX_AGE, cookieBackend, _storage, _storageMode, _localeOverride, _apiKeyOverride, _baseUrlOverride, _withCredentials, _onUnauthorized, _refreshHandler, _refreshInflight, RETRY_MARKER, SERVER_SNAPSHOT, SESSION_SYNC_EVENT, _snapshot, _sessionListeners, _expiryTimer, _storageListenerInstalled, _sessionExpiredHandlers, _client, auth, _DPOP_DB, _DPOP_STORE, _DPOP_KEY_ID, _dpopKeyPromise;
-var init_auth = __esm({
-  "src/_api/generated/helpers/auth.ts"() {
-    init_errors();
-    ACCESS_KEY = "cfg.access_token";
-    REFRESH_KEY = "cfg.refresh_token";
-    API_KEY_KEY = "cfg.api_key";
-    isBrowser = typeof window !== "undefined";
-    localStorageBackend = {
-      get(key) {
-        if (!isBrowser) return null;
-        try {
-          return window.localStorage.getItem(key);
-        } catch {
-          return null;
-        }
-      },
-      set(key, value) {
-        if (!isBrowser) return;
-        try {
-          if (value === null) window.localStorage.removeItem(key);
-          else window.localStorage.setItem(key, value);
-        } catch {
-        }
-      }
-    };
-    COOKIE_MAX_AGE = 60 * 60 * 24 * 30;
-    cookieBackend = {
-      get(key) {
-        if (!isBrowser) return null;
-        try {
-          const re = new RegExp(`(?:^|;\\s*)${encodeURIComponent(key)}=([^;]*)`);
-          const m = document.cookie.match(re);
-          return m ? decodeURIComponent(m[1]) : null;
-        } catch {
-          return null;
-        }
-      },
-      set(key, value) {
-        if (!isBrowser) return;
-        try {
-          const k = encodeURIComponent(key);
-          const secure = window.location.protocol === "https:" ? "; Secure" : "";
-          if (value === null) {
-            document.cookie = `${k}=; Path=/; Max-Age=0; SameSite=Lax${secure}`;
-          } else {
-            const v = encodeURIComponent(value);
-            document.cookie = `${k}=${v}; Path=/; Max-Age=${COOKIE_MAX_AGE}; SameSite=Lax${secure}`;
-          }
-        } catch {
-        }
-      }
-    };
-    _storage = localStorageBackend;
-    _storageMode = "localStorage";
-    __name(detectLocale, "detectLocale");
-    __name(defaultBaseUrl, "defaultBaseUrl");
-    __name(defaultApiKey, "defaultApiKey");
-    _localeOverride = null;
-    _apiKeyOverride = null;
-    _baseUrlOverride = null;
-    _withCredentials = true;
-    _onUnauthorized = null;
-    _refreshHandler = null;
-    _refreshInflight = null;
-    RETRY_MARKER = "X-Auth-Retry";
-    __name(jwtExpMs, "jwtExpMs");
-    __name(computeSnapshot, "computeSnapshot");
-    SERVER_SNAPSHOT = { status: "anonymous", accessExpiresAt: null };
-    SESSION_SYNC_EVENT = `cfg-auth:changed:${ACCESS_KEY}`;
-    _snapshot = computeSnapshot();
-    _sessionListeners = /* @__PURE__ */ new Set();
-    _expiryTimer = null;
-    _storageListenerInstalled = false;
-    __name(scheduleExpiryFlip, "scheduleExpiryFlip");
-    __name(notifySessionChanged, "notifySessionChanged");
-    __name(ensureStorageSync, "ensureStorageSync");
-    _sessionExpiredHandlers = /* @__PURE__ */ new Set();
-    _client = null;
-    __name(pushClientConfig, "pushClientConfig");
-    auth = {
-      // ── Storage mode ──────────────────────────────────────────────────
-      getStorageMode() {
-        return _storageMode;
-      },
-      setStorageMode(mode) {
-        _storageMode = mode;
-        _storage = mode === "cookie" ? cookieBackend : localStorageBackend;
-        notifySessionChanged();
-      },
-      // ── Bearer token ──────────────────────────────────────────────────
-      getToken() {
-        return _storage.get(ACCESS_KEY);
-      },
-      setToken(token) {
-        _storage.set(ACCESS_KEY, token);
-        notifySessionChanged();
-      },
-      getRefreshToken() {
-        return _storage.get(REFRESH_KEY);
-      },
-      setRefreshToken(token) {
-        _storage.set(REFRESH_KEY, token);
-        notifySessionChanged();
-      },
-      clearTokens() {
-        _storage.set(ACCESS_KEY, null);
-        _storage.set(REFRESH_KEY, null);
-        notifySessionChanged();
-      },
-      /** Session-aware: token PRESENT and not past its `exp` (or a live refresh
-       * token exists that can mint one). Prefer `getSnapshot().status` in React. */
-      isAuthenticated() {
-        return computeSnapshot().status === "authenticated";
-      },
-      // ── Session (the ONE write path for login/logout flows) ──────────
-      /**
-       * Persist a token pair atomically. Every login flow (OTP verify, 2FA,
-       * OAuth callback) and the refresh handler should end here — do NOT
-       * scatter `setToken`/`setRefreshToken` pairs through app code.
-       * `refresh: undefined` keeps the current refresh token (access-only
-       * rotation); `refresh: null` explicitly drops it.
-       */
-      setSession(tokens) {
-        _storage.set(ACCESS_KEY, tokens.access);
-        if (tokens.refresh !== void 0) _storage.set(REFRESH_KEY, tokens.refresh);
-        notifySessionChanged();
-      },
-      clearSession() {
-        auth.clearTokens();
-      },
-      // ── Reactive snapshot (for useSyncExternalStore) ──────────────────
-      /**
-       * @example React:
-       *   const session = useSyncExternalStore(
-       *     auth.subscribe, auth.getSnapshot, auth.getServerSnapshot,
-       *   );
-       *   const isAuthenticated = session.status === 'authenticated';
-       */
-      getSnapshot() {
-        return _snapshot;
-      },
-      getServerSnapshot() {
-        return SERVER_SNAPSHOT;
-      },
-      subscribe(listener) {
-        ensureStorageSync();
-        _sessionListeners.add(listener);
-        notifySessionChanged();
-        return () => {
-          _sessionListeners.delete(listener);
-          if (_sessionListeners.size === 0 && _expiryTimer !== null) {
-            clearTimeout(_expiryTimer);
-            _expiryTimer = null;
-          }
-        };
-      },
-      /**
-       * Fired on TERMINAL 401 — after the refresh+retry path is exhausted.
-       * The store has already cleared the session before calling back, so
-       * handlers only need to route to login (no clear-then-redirect
-       * ordering to get wrong). Returns an unsubscribe function; multiple
-       * handlers compose (unlike the legacy single-slot `onUnauthorized`).
-       */
-      onSessionExpired(cb) {
-        _sessionExpiredHandlers.add(cb);
-        return () => {
-          _sessionExpiredHandlers.delete(cb);
-        };
-      },
-      // ── API key ───────────────────────────────────────────────────────
-      getApiKey() {
-        return _apiKeyOverride ?? _storage.get(API_KEY_KEY) ?? defaultApiKey();
-      },
-      setApiKey(key) {
-        _apiKeyOverride = key;
-      },
-      setApiKeyPersist(key) {
-        _apiKeyOverride = key;
-        _storage.set(API_KEY_KEY, key);
-      },
-      clearApiKey() {
-        _apiKeyOverride = null;
-        _storage.set(API_KEY_KEY, null);
-      },
-      // ── Locale ────────────────────────────────────────────────────────
-      getLocale() {
-        return _localeOverride ?? detectLocale();
-      },
-      setLocale(locale) {
-        _localeOverride = locale;
-      },
-      // ── Base URL ──────────────────────────────────────────────────────
-      getBaseUrl() {
-        const url = _baseUrlOverride ?? defaultBaseUrl();
-        return url.replace(/\/$/, "");
-      },
-      setBaseUrl(url) {
-        _baseUrlOverride = url ? url.replace(/\/$/, "") : null;
-        pushClientConfig();
-      },
-      // ── Credentials toggle ────────────────────────────────────────────
-      getWithCredentials() {
-        return _withCredentials;
-      },
-      setWithCredentials(value) {
-        _withCredentials = value;
-        pushClientConfig();
-      },
-      // ── 401 handler ───────────────────────────────────────────────────
-      /**
-       * Fired when the server returns 401 AND no refresh path recovers it
-       * (no refresh token, no refresh handler, refresh failed, or retry
-       * still 401). The app should clear local state and redirect to login.
-       *
-       * NOT fired for 401 that gets transparently recovered by the refresh
-       * handler — those are invisible to callers.
-       */
-      onUnauthorized(cb) {
-        _onUnauthorized = cb;
-      },
-      /**
-       * Register the refresh strategy. The handler receives the current
-       * refresh token and must call your refresh endpoint, returning
-       * `{ access, refresh? }` on success or `null` on failure.
-       *
-       * @example
-       *   auth.setRefreshHandler(async (refresh) => {
-       *     const { data } = await Auth.tokenRefreshCreate({ body: { refresh } });
-       *     return data ? { access: data.access, refresh: data.refresh } : null;
-       *   });
-       */
-      setRefreshHandler(fn) {
-        _refreshHandler = fn;
-      },
-      /**
-       * Proactively run the registered refresh handler right now, reusing the
-       * SAME single-flight promise as the 401-recovery interceptor. Callers
-       * (e.g. an expiry timer / focus / reconnect) get token rotation,
-       * de-duplication and rotated-token persistence for free — they must NOT
-       * re-implement any of it. Returns the fresh access token, or null if
-       * there is no handler / no refresh token / the refresh failed.
-       */
-      refreshNow() {
-        return tryRefresh();
-      }
-    };
-    __name(tryRefresh, "tryRefresh");
-    __name(expireSession, "expireSession");
-    __name(dpopEnabled, "dpopEnabled");
-    _DPOP_DB = "cfg-auth";
-    _DPOP_STORE = "keys";
-    _DPOP_KEY_ID = "dpop-ec-p256";
-    __name(_idbOpen, "_idbOpen");
-    __name(_idbGet, "_idbGet");
-    __name(_idbPut, "_idbPut");
-    _dpopKeyPromise = null;
-    __name(_getDpopKeyPair, "_getDpopKeyPair");
-    __name(_b64urlFromBytes, "_b64urlFromBytes");
-    __name(_b64urlFromString, "_b64urlFromString");
-    __name(_publicJwk, "_publicJwk");
-    __name(_makeDpopProof, "_makeDpopProof");
-    __name(installAuthOnClient, "installAuthOnClient");
-    auth.setRefreshHandler(async (refresh) => {
-      try {
-        const { CfgAccountsAuth: CfgAccountsAuth2 } = await Promise.resolve().then(() => (init_sdk_gen(), sdk_gen_exports));
-        const { data } = await CfgAccountsAuth2.cfgAccountsTokenRefreshCreate({
-          body: { refresh },
-          throwOnError: true
-        });
-        return data?.access ? { access: data.access, refresh: data.refresh ?? refresh } : null;
-      } catch {
-        return null;
-      }
+__name(installAuthOnClient, "installAuthOnClient");
+var REFRESH_ENDPOINT = "/cfg/accounts/token/refresh/";
+auth.setRefreshHandler(async (refresh) => {
+  try {
+    const url = `${auth.getBaseUrl()}${REFRESH_ENDPOINT}`;
+    const headers = { "Content-Type": "application/json" };
+    if (dpopEnabled() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof("POST", url);
+      if (proof) headers["DPoP"] = proof;
+    }
+    const res = await fetch(url, {
+      method: "POST",
+      headers,
+      credentials: auth.getWithCredentials() ? "include" : "same-origin",
+      body: JSON.stringify({ refresh })
     });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data?.access ? { access: data.access, refresh: data.refresh ?? refresh } : null;
+  } catch {
+    return null;
   }
 });
 
-// src/auth/index.ts
-var auth_exports = {};
-__export(auth_exports, {
-  AUTH_CONSTANTS: () => AUTH_CONSTANTS,
-  AccountsProvider: () => AccountsProvider,
-  Analytics: () => Analytics,
-  AnalyticsCategory: () => AnalyticsCategory,
-  AnalyticsEvent: () => AnalyticsEvent,
-  AuthContext: () => AuthContext_default,
-  AuthProvider: () => AuthProvider,
-  DEFAULT_AUTH_PATH: () => DEFAULT_AUTH_PATH,
-  DEFAULT_CALLBACK_PATH: () => DEFAULT_CALLBACK_PATH,
-  PatchedCfgUserUpdateRequestSchema: () => PatchedCfgUserUpdateRequestSchema,
-  authLogger: () => authLogger,
-  clearProfileCache: () => clearProfileCache,
-  decodeBase64: () => decodeBase64,
-  encodeBase64: () => encodeBase64,
-  formatAuthError: () => formatAuthError,
-  getCacheMetadata: () => getCacheMetadata,
-  getCachedProfile: () => getCachedProfile,
-  hasValidCache: () => hasValidCache,
-  isAllowedAuthPath: () => isAllowedAuthPath,
-  logger: () => logger,
-  normalizePath: () => normalizePath,
-  resolveGuardIsAuthenticated: () => resolveGuardIsAuthenticated,
-  resolveGuardIsLoading: () => resolveGuardIsLoading,
-  setCachedProfile: () => setCachedProfile,
-  shouldRedirectToAuth: () => shouldRedirectToAuth,
-  useAccountsContext: () => useAccountsContext,
-  useAuth: () => useAuth,
-  useAuthForm: () => useAuthForm,
-  useAuthFormState: () => useAuthFormState,
-  useAuthRedirectManager: () => useAuthRedirectManager,
-  useAuthValidation: () => useAuthValidation,
-  useAutoAuth: () => useAutoAuth,
-  useBase64: () => useBase64,
-  useCfgRouter: () => useCfgRouter,
-  useDeleteAccount: () => useDeleteAccount,
-  useGithubAuth: () => useGithubAuth,
-  useLocalStorage: () => useLocalStorage,
-  useQueryParams: () => useQueryParams,
-  useSession: () => useSession,
-  useSessionStorage: () => useSessionStorage,
-  useTwoFactor: () => useTwoFactor,
-  useTwoFactorSetup: () => useTwoFactorSetup,
-  useTwoFactorStatus: () => useTwoFactorStatus,
-  validateEmail: () => validateEmail,
-  validateIdentifier: () => validateIdentifier
-});
-module.exports = __toCommonJS(auth_exports);
-
-// src/auth/constants.ts
-var AUTH_CONSTANTS = {
-  /** Email OTP code length (numeric). */
-  EMAIL_OTP_LENGTH: 4,
-  /** TOTP code length (RFC 6238 — authenticator apps). */
-  TOTP_LENGTH: 6,
-  /** Backup code max length. */
-  BACKUP_CODE_MAX_LENGTH: 12
-};
-var DEFAULT_AUTH_PATH = "/auth";
-var DEFAULT_CALLBACK_PATH = "/dashboard";
-
-// src/auth/context/AuthContext.tsx
-var import_navigation4 = require("next/navigation");
-var import_react16 = require("react");
-init_auth();
-
-// src/_api/generated/helpers/index.ts
-init_auth();
-init_errors();
-
 // src/_api/generated/helpers/logger.ts
 var import_consola = require("consola");
 var DEFAULT_CONFIG = {
@@ -2423,7 +880,6 @@ __name(applyRoleLogPolicy, "applyRoleLogPolicy");
 
 // src/auth/hooks/useSession.ts
 var import_react = require("react");
-init_auth();
 function useSession() {
   return (0, import_react.useSyncExternalStore)(auth.subscribe, auth.getSnapshot, auth.getServerSnapshot);
 }
@@ -2628,7 +1084,7 @@ var useAuthValidation = /* @__PURE__ */ __name(() => {
 var validateIdentifier = /* @__PURE__ */ __name((id) => EMAIL_REGEX.test(id), "validateIdentifier");
 
 // src/auth/hooks/useAuthForm.ts
-var import_react8 = require("react");
+var import_react9 = require("react");
 
 // src/auth/utils/logger.ts
 var import_consola2 = require("consola");
@@ -2694,9 +1150,1290 @@ var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
 }, "useAutoAuth");
 
 // src/auth/hooks/useTwoFactor.ts
-var import_react7 = require("react");
-init_auth();
-init_sdk_gen();
+var import_react8 = require("react");
+
+// src/_api/generated/core/bodySerializer.gen.ts
+var serializeFormDataPair = /* @__PURE__ */ __name((data, key, value) => {
+  if (typeof value === "string" || value instanceof Blob) {
+    data.append(key, value);
+  } else if (value instanceof Date) {
+    data.append(key, value.toISOString());
+  } else {
+    data.append(key, JSON.stringify(value));
+  }
+}, "serializeFormDataPair");
+var formDataBodySerializer = {
+  bodySerializer: /* @__PURE__ */ __name((body) => {
+    const data = new FormData();
+    Object.entries(body).forEach(([key, value]) => {
+      if (value === void 0 || value === null) {
+        return;
+      }
+      if (Array.isArray(value)) {
+        value.forEach((v) => serializeFormDataPair(data, key, v));
+      } else {
+        serializeFormDataPair(data, key, value);
+      }
+    });
+    return data;
+  }, "bodySerializer")
+};
+var jsonBodySerializer = {
+  bodySerializer: /* @__PURE__ */ __name((body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value), "bodySerializer")
+};
+
+// src/_api/generated/core/params.gen.ts
+var extraPrefixesMap = {
+  $body_: "body",
+  $headers_: "headers",
+  $path_: "path",
+  $query_: "query"
+};
+var extraPrefixes = Object.entries(extraPrefixesMap);
+
+// src/_api/generated/core/serverSentEvents.gen.ts
+function createSseClient({
+  onRequest,
+  onSseError,
+  onSseEvent,
+  responseTransformer,
+  responseValidator,
+  sseDefaultRetryDelay,
+  sseMaxRetryAttempts,
+  sseMaxRetryDelay,
+  sseSleepFn,
+  url,
+  ...options
+}) {
+  let lastEventId;
+  const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const createStream = /* @__PURE__ */ __name(async function* () {
+    let retryDelay = sseDefaultRetryDelay ?? 3e3;
+    let attempt = 0;
+    const signal = options.signal ?? new AbortController().signal;
+    while (true) {
+      if (signal.aborted) break;
+      attempt++;
+      const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
+      if (lastEventId !== void 0) {
+        headers.set("Last-Event-ID", lastEventId);
+      }
+      try {
+        const requestInit = {
+          redirect: "follow",
+          ...options,
+          body: options.serializedBody,
+          headers,
+          signal
+        };
+        let request = new Request(url, requestInit);
+        if (onRequest) {
+          request = await onRequest(url, requestInit);
+        }
+        const _fetch = options.fetch ?? globalThis.fetch;
+        const response = await _fetch(request);
+        if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);
+        if (!response.body) throw new Error("No body in SSE response");
+        const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
+        let buffer = "";
+        const abortHandler = /* @__PURE__ */ __name(() => {
+          try {
+            reader.cancel();
+          } catch {
+          }
+        }, "abortHandler");
+        signal.addEventListener("abort", abortHandler);
+        try {
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            buffer += value;
+            buffer = buffer.replace(/\r\n?/g, "\n");
+            const chunks = buffer.split("\n\n");
+            buffer = chunks.pop() ?? "";
+            for (const chunk of chunks) {
+              const lines = chunk.split("\n");
+              const dataLines = [];
+              let eventName;
+              for (const line of lines) {
+                if (line.startsWith("data:")) {
+                  dataLines.push(line.replace(/^data:\s*/, ""));
+                } else if (line.startsWith("event:")) {
+                  eventName = line.replace(/^event:\s*/, "");
+                } else if (line.startsWith("id:")) {
+                  lastEventId = line.replace(/^id:\s*/, "");
+                } else if (line.startsWith("retry:")) {
+                  const parsed = Number.parseInt(line.replace(/^retry:\s*/, ""), 10);
+                  if (!Number.isNaN(parsed)) {
+                    retryDelay = parsed;
+                  }
+                }
+              }
+              let data;
+              let parsedJson = false;
+              if (dataLines.length) {
+                const rawData = dataLines.join("\n");
+                try {
+                  data = JSON.parse(rawData);
+                  parsedJson = true;
+                } catch {
+                  data = rawData;
+                }
+              }
+              if (parsedJson) {
+                if (responseValidator) {
+                  await responseValidator(data);
+                }
+                if (responseTransformer) {
+                  data = await responseTransformer(data);
+                }
+              }
+              onSseEvent?.({
+                data,
+                event: eventName,
+                id: lastEventId,
+                retry: retryDelay
+              });
+              if (dataLines.length) {
+                yield data;
+              }
+            }
+          }
+        } finally {
+          signal.removeEventListener("abort", abortHandler);
+          reader.releaseLock();
+        }
+        break;
+      } catch (error) {
+        onSseError?.(error);
+        if (sseMaxRetryAttempts !== void 0 && attempt >= sseMaxRetryAttempts) {
+          break;
+        }
+        const backoff = Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 3e4);
+        await sleep(backoff);
+      }
+    }
+  }, "createStream");
+  const stream = createStream();
+  return { stream };
+}
+__name(createSseClient, "createSseClient");
+
+// src/_api/generated/core/pathSerializer.gen.ts
+var separatorArrayExplode = /* @__PURE__ */ __name((style) => {
+  switch (style) {
+    case "label":
+      return ".";
+    case "matrix":
+      return ";";
+    case "simple":
+      return ",";
+    default:
+      return "&";
+  }
+}, "separatorArrayExplode");
+var separatorArrayNoExplode = /* @__PURE__ */ __name((style) => {
+  switch (style) {
+    case "form":
+      return ",";
+    case "pipeDelimited":
+      return "|";
+    case "spaceDelimited":
+      return "%20";
+    default:
+      return ",";
+  }
+}, "separatorArrayNoExplode");
+var separatorObjectExplode = /* @__PURE__ */ __name((style) => {
+  switch (style) {
+    case "label":
+      return ".";
+    case "matrix":
+      return ";";
+    case "simple":
+      return ",";
+    default:
+      return "&";
+  }
+}, "separatorObjectExplode");
+var serializeArrayParam = /* @__PURE__ */ __name(({
+  allowReserved,
+  explode,
+  name,
+  style,
+  value
+}) => {
+  if (!explode) {
+    const joinedValues2 = (allowReserved ? value : value.map((v) => encodeURIComponent(v))).join(separatorArrayNoExplode(style));
+    switch (style) {
+      case "label":
+        return `.${joinedValues2}`;
+      case "matrix":
+        return `;${name}=${joinedValues2}`;
+      case "simple":
+        return joinedValues2;
+      default:
+        return `${name}=${joinedValues2}`;
+    }
+  }
+  const separator = separatorArrayExplode(style);
+  const joinedValues = value.map((v) => {
+    if (style === "label" || style === "simple") {
+      return allowReserved ? v : encodeURIComponent(v);
+    }
+    return serializePrimitiveParam({
+      allowReserved,
+      name,
+      value: v
+    });
+  }).join(separator);
+  return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+}, "serializeArrayParam");
+var serializePrimitiveParam = /* @__PURE__ */ __name(({
+  allowReserved,
+  name,
+  value
+}) => {
+  if (value === void 0 || value === null) {
+    return "";
+  }
+  if (typeof value === "object") {
+    throw new Error(
+      "Deeply-nested arrays/objects aren\u2019t supported. Provide your own `querySerializer()` to handle these."
+    );
+  }
+  return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
+}, "serializePrimitiveParam");
+var serializeObjectParam = /* @__PURE__ */ __name(({
+  allowReserved,
+  explode,
+  name,
+  style,
+  value,
+  valueOnly
+}) => {
+  if (value instanceof Date) {
+    return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
+  }
+  if (style !== "deepObject" && !explode) {
+    let values = [];
+    Object.entries(value).forEach(([key, v]) => {
+      values = [...values, key, allowReserved ? v : encodeURIComponent(v)];
+    });
+    const joinedValues2 = values.join(",");
+    switch (style) {
+      case "form":
+        return `${name}=${joinedValues2}`;
+      case "label":
+        return `.${joinedValues2}`;
+      case "matrix":
+        return `;${name}=${joinedValues2}`;
+      default:
+        return joinedValues2;
+    }
+  }
+  const separator = separatorObjectExplode(style);
+  const joinedValues = Object.entries(value).map(
+    ([key, v]) => serializePrimitiveParam({
+      allowReserved,
+      name: style === "deepObject" ? `${name}[${key}]` : key,
+      value: v
+    })
+  ).join(separator);
+  return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+}, "serializeObjectParam");
+
+// src/_api/generated/core/utils.gen.ts
+var PATH_PARAM_RE = /\{[^{}]+\}/g;
+var defaultPathSerializer = /* @__PURE__ */ __name(({ path, url: _url }) => {
+  let url = _url;
+  const matches = _url.match(PATH_PARAM_RE);
+  if (matches) {
+    for (const match of matches) {
+      let explode = false;
+      let name = match.substring(1, match.length - 1);
+      let style = "simple";
+      if (name.endsWith("*")) {
+        explode = true;
+        name = name.substring(0, name.length - 1);
+      }
+      if (name.startsWith(".")) {
+        name = name.substring(1);
+        style = "label";
+      } else if (name.startsWith(";")) {
+        name = name.substring(1);
+        style = "matrix";
+      }
+      const value = path[name];
+      if (value === void 0 || value === null) {
+        continue;
+      }
+      if (Array.isArray(value)) {
+        url = url.replace(match, serializeArrayParam({ explode, name, style, value }));
+        continue;
+      }
+      if (typeof value === "object") {
+        url = url.replace(
+          match,
+          serializeObjectParam({
+            explode,
+            name,
+            style,
+            value,
+            valueOnly: true
+          })
+        );
+        continue;
+      }
+      if (style === "matrix") {
+        url = url.replace(
+          match,
+          `;${serializePrimitiveParam({
+            name,
+            value
+          })}`
+        );
+        continue;
+      }
+      const replaceValue = encodeURIComponent(
+        style === "label" ? `.${value}` : value
+      );
+      url = url.replace(match, replaceValue);
+    }
+  }
+  return url;
+}, "defaultPathSerializer");
+var getUrl = /* @__PURE__ */ __name(({
+  baseUrl,
+  path,
+  query,
+  querySerializer,
+  url: _url
+}) => {
+  const pathUrl = _url.startsWith("/") ? _url : `/${_url}`;
+  let url = (baseUrl ?? "") + pathUrl;
+  if (path) {
+    url = defaultPathSerializer({ path, url });
+  }
+  let search = query ? querySerializer(query) : "";
+  if (search.startsWith("?")) {
+    search = search.substring(1);
+  }
+  if (search) {
+    url += `?${search}`;
+  }
+  return url;
+}, "getUrl");
+function getValidRequestBody(options) {
+  const hasBody = options.body !== void 0;
+  const isSerializedBody = hasBody && options.bodySerializer;
+  if (isSerializedBody) {
+    if ("serializedBody" in options) {
+      const hasSerializedBody = options.serializedBody !== void 0 && options.serializedBody !== "";
+      return hasSerializedBody ? options.serializedBody : null;
+    }
+    return options.body !== "" ? options.body : null;
+  }
+  if (hasBody) {
+    return options.body;
+  }
+  return void 0;
+}
+__name(getValidRequestBody, "getValidRequestBody");
+
+// src/_api/generated/core/auth.gen.ts
+var getAuthToken = /* @__PURE__ */ __name(async (auth2, callback) => {
+  const token = typeof callback === "function" ? await callback(auth2) : callback;
+  if (!token) {
+    return;
+  }
+  if (auth2.scheme === "bearer") {
+    return `Bearer ${token}`;
+  }
+  if (auth2.scheme === "basic") {
+    return `Basic ${btoa(token)}`;
+  }
+  return token;
+}, "getAuthToken");
+
+// src/_api/generated/client/utils.gen.ts
+var createQuerySerializer = /* @__PURE__ */ __name(({
+  parameters = {},
+  ...args
+} = {}) => {
+  const querySerializer = /* @__PURE__ */ __name((queryParams) => {
+    const search = [];
+    if (queryParams && typeof queryParams === "object") {
+      for (const name in queryParams) {
+        const value = queryParams[name];
+        if (value === void 0 || value === null) {
+          continue;
+        }
+        const options = parameters[name] || args;
+        if (Array.isArray(value)) {
+          const serializedArray = serializeArrayParam({
+            allowReserved: options.allowReserved,
+            explode: true,
+            name,
+            style: "form",
+            value,
+            ...options.array
+          });
+          if (serializedArray) search.push(serializedArray);
+        } else if (typeof value === "object") {
+          const serializedObject = serializeObjectParam({
+            allowReserved: options.allowReserved,
+            explode: true,
+            name,
+            style: "deepObject",
+            value,
+            ...options.object
+          });
+          if (serializedObject) search.push(serializedObject);
+        } else {
+          const serializedPrimitive = serializePrimitiveParam({
+            allowReserved: options.allowReserved,
+            name,
+            value
+          });
+          if (serializedPrimitive) search.push(serializedPrimitive);
+        }
+      }
+    }
+    return search.join("&");
+  }, "querySerializer");
+  return querySerializer;
+}, "createQuerySerializer");
+var getParseAs = /* @__PURE__ */ __name((contentType) => {
+  if (!contentType) {
+    return "stream";
+  }
+  const cleanContent = contentType.split(";")[0]?.trim();
+  if (!cleanContent) {
+    return;
+  }
+  if (cleanContent.startsWith("application/json") || cleanContent.endsWith("+json")) {
+    return "json";
+  }
+  if (cleanContent === "multipart/form-data") {
+    return "formData";
+  }
+  if (["application/", "audio/", "image/", "video/"].some((type) => cleanContent.startsWith(type))) {
+    return "blob";
+  }
+  if (cleanContent.startsWith("text/")) {
+    return "text";
+  }
+  return;
+}, "getParseAs");
+var checkForExistence = /* @__PURE__ */ __name((options, name) => {
+  if (!name) {
+    return false;
+  }
+  if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) {
+    return true;
+  }
+  return false;
+}, "checkForExistence");
+async function setAuthParams(options) {
+  for (const auth2 of options.security ?? []) {
+    if (checkForExistence(options, auth2.name)) {
+      continue;
+    }
+    const token = await getAuthToken(auth2, options.auth);
+    if (!token) {
+      continue;
+    }
+    const name = auth2.name ?? "Authorization";
+    switch (auth2.in) {
+      case "query":
+        if (!options.query) {
+          options.query = {};
+        }
+        options.query[name] = token;
+        break;
+      case "cookie":
+        options.headers.append("Cookie", `${name}=${token}`);
+        break;
+      case "header":
+      default:
+        options.headers.set(name, token);
+        break;
+    }
+  }
+}
+__name(setAuthParams, "setAuthParams");
+var buildUrl = /* @__PURE__ */ __name((options) => getUrl({
+  baseUrl: options.baseUrl,
+  path: options.path,
+  query: options.query,
+  querySerializer: typeof options.querySerializer === "function" ? options.querySerializer : createQuerySerializer(options.querySerializer),
+  url: options.url
+}), "buildUrl");
+var mergeConfigs = /* @__PURE__ */ __name((a, b) => {
+  const config = { ...a, ...b };
+  if (config.baseUrl?.endsWith("/")) {
+    config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);
+  }
+  config.headers = mergeHeaders(a.headers, b.headers);
+  return config;
+}, "mergeConfigs");
+var headersEntries = /* @__PURE__ */ __name((headers) => {
+  const entries = [];
+  headers.forEach((value, key) => {
+    entries.push([key, value]);
+  });
+  return entries;
+}, "headersEntries");
+var mergeHeaders = /* @__PURE__ */ __name((...headers) => {
+  const mergedHeaders = new Headers();
+  for (const header of headers) {
+    if (!header) {
+      continue;
+    }
+    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+    for (const [key, value] of iterator) {
+      if (value === null) {
+        mergedHeaders.delete(key);
+      } else if (Array.isArray(value)) {
+        for (const v of value) {
+          mergedHeaders.append(key, v);
+        }
+      } else if (value !== void 0) {
+        mergedHeaders.set(
+          key,
+          typeof value === "object" ? JSON.stringify(value) : value
+        );
+      }
+    }
+  }
+  return mergedHeaders;
+}, "mergeHeaders");
+var Interceptors = class {
+  static {
+    __name(this, "Interceptors");
+  }
+  fns = [];
+  clear() {
+    this.fns = [];
+  }
+  eject(id) {
+    const index = this.getInterceptorIndex(id);
+    if (this.fns[index]) {
+      this.fns[index] = null;
+    }
+  }
+  exists(id) {
+    const index = this.getInterceptorIndex(id);
+    return Boolean(this.fns[index]);
+  }
+  getInterceptorIndex(id) {
+    if (typeof id === "number") {
+      return this.fns[id] ? id : -1;
+    }
+    return this.fns.indexOf(id);
+  }
+  update(id, fn) {
+    const index = this.getInterceptorIndex(id);
+    if (this.fns[index]) {
+      this.fns[index] = fn;
+      return id;
+    }
+    return false;
+  }
+  use(fn) {
+    this.fns.push(fn);
+    return this.fns.length - 1;
+  }
+};
+var createInterceptors = /* @__PURE__ */ __name(() => ({
+  error: new Interceptors(),
+  request: new Interceptors(),
+  response: new Interceptors()
+}), "createInterceptors");
+var defaultQuerySerializer = createQuerySerializer({
+  allowReserved: false,
+  array: {
+    explode: true,
+    style: "form"
+  },
+  object: {
+    explode: true,
+    style: "deepObject"
+  }
+});
+var defaultHeaders = {
+  "Content-Type": "application/json"
+};
+var createConfig = /* @__PURE__ */ __name((override = {}) => ({
+  ...jsonBodySerializer,
+  headers: defaultHeaders,
+  parseAs: "auto",
+  querySerializer: defaultQuerySerializer,
+  ...override
+}), "createConfig");
+
+// src/_api/generated/client/client.gen.ts
+var createClient = /* @__PURE__ */ __name((config = {}) => {
+  let _config = mergeConfigs(createConfig(), config);
+  const getConfig = /* @__PURE__ */ __name(() => ({ ..._config }), "getConfig");
+  const setConfig = /* @__PURE__ */ __name((config2) => {
+    _config = mergeConfigs(_config, config2);
+    return getConfig();
+  }, "setConfig");
+  const interceptors = createInterceptors();
+  const beforeRequest = /* @__PURE__ */ __name(async (options) => {
+    const opts = {
+      ..._config,
+      ...options,
+      fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,
+      headers: mergeHeaders(_config.headers, options.headers),
+      serializedBody: void 0
+    };
+    if (opts.security) {
+      await setAuthParams(opts);
+    }
+    if (opts.requestValidator) {
+      await opts.requestValidator(opts);
+    }
+    if (opts.body !== void 0 && opts.bodySerializer) {
+      opts.serializedBody = opts.bodySerializer(opts.body);
+    }
+    if (opts.body === void 0 || opts.serializedBody === "") {
+      opts.headers.delete("Content-Type");
+    }
+    const resolvedOpts = opts;
+    const url = buildUrl(resolvedOpts);
+    return { opts: resolvedOpts, url };
+  }, "beforeRequest");
+  const request = /* @__PURE__ */ __name(async (options) => {
+    const throwOnError = options.throwOnError ?? _config.throwOnError;
+    const responseStyle = options.responseStyle ?? _config.responseStyle;
+    let request2;
+    let response;
+    try {
+      const { opts, url } = await beforeRequest(options);
+      const requestInit = {
+        redirect: "follow",
+        ...opts,
+        body: getValidRequestBody(opts)
+      };
+      request2 = new Request(url, requestInit);
+      for (const fn of interceptors.request.fns) {
+        if (fn) {
+          request2 = await fn(request2, opts);
+        }
+      }
+      const _fetch = opts.fetch;
+      response = await _fetch(request2);
+      for (const fn of interceptors.response.fns) {
+        if (fn) {
+          response = await fn(response, request2, opts);
+        }
+      }
+      const result = {
+        request: request2,
+        response
+      };
+      if (response.ok) {
+        const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
+        if (response.status === 204 || response.headers.get("Content-Length") === "0") {
+          let emptyData;
+          switch (parseAs) {
+            case "arrayBuffer":
+            case "blob":
+            case "text":
+              emptyData = await response[parseAs]();
+              break;
+            case "formData":
+              emptyData = new FormData();
+              break;
+            case "stream":
+              emptyData = response.body;
+              break;
+            case "json":
+            default:
+              emptyData = {};
+              break;
+          }
+          return opts.responseStyle === "data" ? emptyData : {
+            data: emptyData,
+            ...result
+          };
+        }
+        let data;
+        switch (parseAs) {
+          case "arrayBuffer":
+          case "blob":
+          case "formData":
+          case "text":
+            data = await response[parseAs]();
+            break;
+          case "json": {
+            const text = await response.text();
+            data = text ? JSON.parse(text) : {};
+            break;
+          }
+          case "stream":
+            return opts.responseStyle === "data" ? response.body : {
+              data: response.body,
+              ...result
+            };
+        }
+        if (parseAs === "json") {
+          if (opts.responseValidator) {
+            await opts.responseValidator(data);
+          }
+          if (opts.responseTransformer) {
+            data = await opts.responseTransformer(data);
+          }
+        }
+        return opts.responseStyle === "data" ? data : {
+          data,
+          ...result
+        };
+      }
+      const textError = await response.text();
+      let jsonError;
+      try {
+        jsonError = JSON.parse(textError);
+      } catch {
+      }
+      throw jsonError ?? textError;
+    } catch (error) {
+      let finalError = error;
+      for (const fn of interceptors.error.fns) {
+        if (fn) {
+          finalError = await fn(finalError, response, request2, options);
+        }
+      }
+      finalError = finalError || {};
+      if (throwOnError) {
+        throw finalError;
+      }
+      return responseStyle === "data" ? void 0 : {
+        error: finalError,
+        request: request2,
+        response
+      };
+    }
+  }, "request");
+  const makeMethodFn = /* @__PURE__ */ __name((method) => (options) => request({ ...options, method }), "makeMethodFn");
+  const makeSseFn = /* @__PURE__ */ __name((method) => async (options) => {
+    const { opts, url } = await beforeRequest(options);
+    return createSseClient({
+      ...opts,
+      body: opts.body,
+      method,
+      onRequest: /* @__PURE__ */ __name(async (url2, init) => {
+        let request2 = new Request(url2, init);
+        for (const fn of interceptors.request.fns) {
+          if (fn) {
+            request2 = await fn(request2, opts);
+          }
+        }
+        return request2;
+      }, "onRequest"),
+      serializedBody: getValidRequestBody(opts),
+      url
+    });
+  }, "makeSseFn");
+  const _buildUrl = /* @__PURE__ */ __name((options) => buildUrl({ ..._config, ...options }), "_buildUrl");
+  return {
+    buildUrl: _buildUrl,
+    connect: makeMethodFn("CONNECT"),
+    delete: makeMethodFn("DELETE"),
+    get: makeMethodFn("GET"),
+    getConfig,
+    head: makeMethodFn("HEAD"),
+    interceptors,
+    options: makeMethodFn("OPTIONS"),
+    patch: makeMethodFn("PATCH"),
+    post: makeMethodFn("POST"),
+    put: makeMethodFn("PUT"),
+    request,
+    setConfig,
+    sse: {
+      connect: makeSseFn("CONNECT"),
+      delete: makeSseFn("DELETE"),
+      get: makeSseFn("GET"),
+      head: makeSseFn("HEAD"),
+      options: makeSseFn("OPTIONS"),
+      patch: makeSseFn("PATCH"),
+      post: makeSseFn("POST"),
+      put: makeSseFn("PUT"),
+      trace: makeSseFn("TRACE")
+    },
+    trace: makeMethodFn("TRACE")
+  };
+}, "createClient");
+
+// src/_api/generated/client.gen.ts
+var client = createClient(createConfig({ baseUrl: "http://localhost:8000" }));
+installAuthOnClient(client);
+
+// src/_api/generated/sdk.gen.ts
+var CfgAccountsOauth = class {
+  static {
+    __name(this, "CfgAccountsOauth");
+  }
+  /**
+   * List OAuth connections
+   *
+   * Get all OAuth connections for the current user.
+   */
+  static cfgAccountsOauthConnectionsList(options) {
+    return (options?.client ?? client).get({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/accounts/oauth/connections/",
+      ...options
+    });
+  }
+  /**
+   * Disconnect OAuth provider
+   *
+   * Remove OAuth connection for the specified provider.
+   */
+  static cfgAccountsOauthDisconnectCreate(options) {
+    return (options.client ?? client).post({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/accounts/oauth/disconnect/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
+  /**
+   * Start GitHub OAuth
+   *
+   * Generate GitHub OAuth authorization URL. Redirect user to this URL to start authentication.
+   */
+  static cfgAccountsOauthGithubAuthorizeCreate(options) {
+    return (options?.client ?? client).post({
+      url: "/cfg/accounts/oauth/github/authorize/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options?.headers
+      }
+    });
+  }
+  /**
+   * Complete GitHub OAuth
+   *
+   * Exchange authorization code for JWT tokens. Call this after GitHub redirects back with code.
+   */
+  static cfgAccountsOauthGithubCallbackCreate(options) {
+    return (options.client ?? client).post({
+      url: "/cfg/accounts/oauth/github/callback/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
+  /**
+   * List OAuth providers
+   *
+   * Get list of available OAuth providers for authentication.
+   */
+  static cfgAccountsOauthProvidersRetrieve(options) {
+    return (options?.client ?? client).get({ url: "/cfg/accounts/oauth/providers/", ...options });
+  }
+};
+var CfgAccounts = class {
+  static {
+    __name(this, "CfgAccounts");
+  }
+  /**
+   * Request OTP code to email.
+   */
+  static cfgAccountsOtpRequestCreate(options) {
+    return (options.client ?? client).post({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/accounts/otp/request/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
+  /**
+   * Verify OTP code and return JWT tokens or 2FA session.
+   *
+   * If user has 2FA enabled:
+   * - Returns requires_2fa=True with session_id
+   * - Client must complete 2FA verification at /cfg/totp/verify/
+   *
+   * If user has no 2FA:
+   * - Returns JWT tokens and user data directly
+   */
+  static cfgAccountsOtpVerifyCreate(options) {
+    return (options.client ?? client).post({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/accounts/otp/verify/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
+};
+var CfgAccountsProfile = class {
+  static {
+    __name(this, "CfgAccountsProfile");
+  }
+  /**
+   * Get current user profile
+   *
+   * Retrieve the current authenticated user's profile information.
+   */
+  static cfgAccountsProfileRetrieve(options) {
+    return (options?.client ?? client).get({
+      security: [{ scheme: "bearer", type: "http" }, {
+        in: "cookie",
+        name: "sessionid",
+        type: "apiKey"
+      }],
+      url: "/cfg/accounts/profile/",
+      ...options
+    });
+  }
+  /**
+   * Upload user avatar
+   *
+   * Upload avatar image for the current authenticated user. Accepts multipart/form-data with 'avatar' field.
+   */
+  static cfgAccountsProfileAvatarCreate(options) {
+    return (options?.client ?? client).post({
+      ...formDataBodySerializer,
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/accounts/profile/avatar/",
+      ...options,
+      headers: {
+        "Content-Type": null,
+        ...options?.headers
+      }
+    });
+  }
+  /**
+   * Delete user account
+   *
+   *
+   * Permanently delete the current user's account.
+   *
+   * This operation:
+   * - Deactivates the account (user cannot log in)
+   * - Anonymizes personal data (GDPR compliance)
+   * - Frees up the email address for re-registration
+   * - Preserves audit trail
+   *
+   * The account can be restored by an administrator if needed.
+   *
+   */
+  static cfgAccountsProfileDeleteCreate(options) {
+    return (options?.client ?? client).post({
+      security: [{ scheme: "bearer", type: "http" }, {
+        in: "cookie",
+        name: "sessionid",
+        type: "apiKey"
+      }],
+      url: "/cfg/accounts/profile/delete/",
+      ...options
+    });
+  }
+  /**
+   * Partial update user profile
+   *
+   * Partially update the current authenticated user's profile information. Supports avatar upload.
+   */
+  static cfgAccountsProfilePartialPartialUpdate(options) {
+    return (options?.client ?? client).patch({
+      security: [{ scheme: "bearer", type: "http" }, {
+        in: "cookie",
+        name: "sessionid",
+        type: "apiKey"
+      }],
+      url: "/cfg/accounts/profile/partial/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options?.headers
+      }
+    });
+  }
+  /**
+   * Partial update user profile
+   *
+   * Partially update the current authenticated user's profile information. Supports avatar upload.
+   */
+  static cfgAccountsProfilePartialUpdate(options) {
+    return (options?.client ?? client).put({
+      security: [{ scheme: "bearer", type: "http" }, {
+        in: "cookie",
+        name: "sessionid",
+        type: "apiKey"
+      }],
+      url: "/cfg/accounts/profile/partial/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options?.headers
+      }
+    });
+  }
+  /**
+   * Update user profile
+   *
+   * Update the current authenticated user's profile information.
+   */
+  static cfgAccountsProfileUpdatePartialUpdate(options) {
+    return (options?.client ?? client).patch({
+      security: [{ scheme: "bearer", type: "http" }, {
+        in: "cookie",
+        name: "sessionid",
+        type: "apiKey"
+      }],
+      url: "/cfg/accounts/profile/update/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options?.headers
+      }
+    });
+  }
+  /**
+   * Update user profile
+   *
+   * Update the current authenticated user's profile information.
+   */
+  static cfgAccountsProfileUpdateUpdate(options) {
+    return (options?.client ?? client).put({
+      security: [{ scheme: "bearer", type: "http" }, {
+        in: "cookie",
+        name: "sessionid",
+        type: "apiKey"
+      }],
+      url: "/cfg/accounts/profile/update/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options?.headers
+      }
+    });
+  }
+};
+var CfgAccountsAuth = class {
+  static {
+    __name(this, "CfgAccountsAuth");
+  }
+  /**
+   * Revoke a refresh token (logout).
+   *
+   * Blacklists the posted refresh token so it can never mint another access
+   * token. Called best-effort by the client's logout — without it, "logout"
+   * is purely client-side and a stolen refresh token survives until expiry.
+   */
+  static cfgAccountsTokenBlacklistCreate(options) {
+    return (options.client ?? client).post({
+      url: "/cfg/accounts/token/blacklist/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
+  /**
+   * Refresh JWT token.
+   *
+   * DPoP-aware: when the incoming refresh token is key-bound (`cnf.jkt`), the
+   * rotated access/refresh in the response are re-stamped with the same `cnf`
+   * (stock SimpleJWT drops it from the derived access), and a matching DPoP
+   * proof is required on the refresh request — so a stolen refresh token can't
+   * be used to mint fresh tokens.
+   */
+  static cfgAccountsTokenRefreshCreate(options) {
+    return (options.client ?? client).post({
+      url: "/cfg/accounts/token/refresh/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
+};
+var CfgTotp = class {
+  static {
+    __name(this, "CfgTotp");
+  }
+  /**
+   * List all TOTP devices for user.
+   */
+  static cfgTotpDevicesRetrieve(options) {
+    return (options?.client ?? client).get({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/totp/devices/",
+      ...options
+    });
+  }
+  /**
+   * Delete a TOTP device.
+   *
+   * Requires verification code if removing the last/primary device.
+   */
+  static cfgTotpDevicesDestroy(options) {
+    return (options.client ?? client).delete({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/totp/devices/{id}/",
+      ...options
+    });
+  }
+  /**
+   * Completely disable 2FA for account.
+   *
+   * Requires verification code.
+   */
+  static cfgTotpDisableCreate(options) {
+    return (options.client ?? client).post({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/totp/disable/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
+};
+var CfgTotpSetup = class {
+  static {
+    __name(this, "CfgTotpSetup");
+  }
+  /**
+   * Start 2FA setup process.
+   *
+   * Creates a new TOTP device and returns QR code for scanning.
+   */
+  static cfgTotpSetupCreate(options) {
+    return (options?.client ?? client).post({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/totp/setup/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options?.headers
+      }
+    });
+  }
+  /**
+   * Confirm 2FA setup with first valid code.
+   *
+   * Activates the device and generates backup codes.
+   */
+  static cfgTotpSetupConfirmCreate(options) {
+    return (options.client ?? client).post({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/totp/setup/confirm/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
+};
+var CfgTotpVerify = class {
+  static {
+    __name(this, "CfgTotpVerify");
+  }
+  /**
+   * Verify TOTP code for 2FA session.
+   *
+   * Completes authentication and returns JWT tokens on success.
+   */
+  static cfgTotpVerifyCreate(options) {
+    return (options.client ?? client).post({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/totp/verify/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
+  /**
+   * Verify backup recovery code for 2FA session.
+   *
+   * Alternative verification method when TOTP device unavailable.
+   */
+  static cfgTotpVerifyBackupCreate(options) {
+    return (options.client ?? client).post({
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
+      url: "/cfg/totp/verify/backup/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
+};
 
 // src/auth/utils/analytics.ts
 var AnalyticsEvent = /* @__PURE__ */ ((AnalyticsEvent2) => {
@@ -2731,22 +2468,228 @@ var Analytics = {
     if (isDev) {
       console.log("[Analytics] Set user:", userId);
     }
-  }
-};
+  }
+};
+
+// src/auth/hooks/useSessionStorage.ts
+var import_react7 = require("react");
+function useSessionStorage(key, initialValue) {
+  const [storedValue, setStoredValue] = (0, import_react7.useState)(() => {
+    if (typeof window === "undefined") {
+      return initialValue;
+    }
+    try {
+      const item = window.sessionStorage.getItem(key);
+      return item ? JSON.parse(item) : initialValue;
+    } catch (error) {
+      authLogger.error(`Error reading sessionStorage key "${key}":`, error);
+      return initialValue;
+    }
+  });
+  const checkDataSize = /* @__PURE__ */ __name((data) => {
+    try {
+      const jsonString = JSON.stringify(data);
+      const sizeInBytes = new Blob([jsonString]).size;
+      const sizeInKB = sizeInBytes / 1024;
+      if (sizeInKB > 1024) {
+        authLogger.warn(`Data size (${sizeInKB.toFixed(2)}KB) exceeds 1MB limit for key "${key}"`);
+        return false;
+      }
+      return true;
+    } catch (error) {
+      authLogger.error(`Error checking data size for key "${key}":`, error);
+      return false;
+    }
+  }, "checkDataSize");
+  const clearOldData = /* @__PURE__ */ __name(() => {
+    try {
+      const keys = Object.keys(sessionStorage).filter((key2) => key2 && typeof key2 === "string");
+      if (keys.length > 50) {
+        const itemsToRemove = Math.ceil(keys.length * 0.2);
+        for (let i = 0; i < itemsToRemove; i++) {
+          try {
+            const key2 = keys[i];
+            if (key2) {
+              sessionStorage.removeItem(key2);
+              sessionStorage.removeItem(`${key2}_timestamp`);
+            }
+          } catch {
+          }
+        }
+      }
+    } catch (error) {
+      authLogger.error("Error clearing old sessionStorage data:", error);
+    }
+  }, "clearOldData");
+  const forceClearAll = /* @__PURE__ */ __name(() => {
+    try {
+      const keys = Object.keys(sessionStorage);
+      for (const key2 of keys) {
+        try {
+          sessionStorage.removeItem(key2);
+        } catch {
+        }
+      }
+    } catch (error) {
+      authLogger.error("Error force clearing sessionStorage:", error);
+    }
+  }, "forceClearAll");
+  const setValue = /* @__PURE__ */ __name((value) => {
+    try {
+      const valueToStore = value instanceof Function ? value(storedValue) : value;
+      if (!checkDataSize(valueToStore)) {
+        authLogger.warn(`Data size too large for key "${key}", removing key`);
+        try {
+          window.sessionStorage.removeItem(key);
+          window.sessionStorage.removeItem(`${key}_timestamp`);
+        } catch {
+        }
+        setStoredValue(valueToStore);
+        return;
+      }
+      setStoredValue(valueToStore);
+      if (typeof window !== "undefined") {
+        try {
+          window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
+          window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
+        } catch (storageError) {
+          if (storageError.name === "QuotaExceededError" || storageError.code === 22 || storageError.message?.includes("quota")) {
+            authLogger.warn("sessionStorage quota exceeded, clearing old data...");
+            clearOldData();
+            try {
+              window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
+              window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
+            } catch (retryError) {
+              authLogger.error(`Failed to set sessionStorage key "${key}" after clearing old data:`, retryError);
+              try {
+                forceClearAll();
+                window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
+                window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
+              } catch (finalError) {
+                authLogger.error(`Failed to set sessionStorage key "${key}" after force clearing:`, finalError);
+                setStoredValue(valueToStore);
+              }
+            }
+          } else {
+            throw storageError;
+          }
+        }
+      }
+    } catch (error) {
+      authLogger.error(`Error setting sessionStorage key "${key}":`, error);
+      const valueToStore = value instanceof Function ? value(storedValue) : value;
+      setStoredValue(valueToStore);
+    }
+  }, "setValue");
+  const removeValue = /* @__PURE__ */ __name(() => {
+    try {
+      setStoredValue(initialValue);
+      if (typeof window !== "undefined") {
+        try {
+          window.sessionStorage.removeItem(key);
+          window.sessionStorage.removeItem(`${key}_timestamp`);
+        } catch (removeError) {
+          if (removeError.name === "QuotaExceededError" || removeError.code === 22 || removeError.message?.includes("quota")) {
+            authLogger.warn("sessionStorage quota exceeded during removal, clearing old data...");
+            clearOldData();
+            try {
+              window.sessionStorage.removeItem(key);
+              window.sessionStorage.removeItem(`${key}_timestamp`);
+            } catch (retryError) {
+              authLogger.error(`Failed to remove sessionStorage key "${key}" after clearing:`, retryError);
+              forceClearAll();
+            }
+          } else {
+            throw removeError;
+          }
+        }
+      }
+    } catch (error) {
+      authLogger.error(`Error removing sessionStorage key "${key}":`, error);
+    }
+  }, "removeValue");
+  return [storedValue, setValue, removeValue];
+}
+__name(useSessionStorage, "useSessionStorage");
+
+// src/auth/hooks/useAuthRedirect.ts
+var AUTH_REDIRECT_KEY = "auth_redirect_url";
+var getRedirectFromStorage = /* @__PURE__ */ __name(() => {
+  if (typeof window === "undefined") return "";
+  try {
+    const item = window.sessionStorage.getItem(AUTH_REDIRECT_KEY);
+    return item ? JSON.parse(item) : "";
+  } catch {
+    return "";
+  }
+}, "getRedirectFromStorage");
+var clearRedirectFromStorage = /* @__PURE__ */ __name(() => {
+  if (typeof window === "undefined") return;
+  try {
+    window.sessionStorage.removeItem(AUTH_REDIRECT_KEY);
+    window.sessionStorage.removeItem(`${AUTH_REDIRECT_KEY}_timestamp`);
+  } catch {
+  }
+}, "clearRedirectFromStorage");
+var peekSavedRedirect = /* @__PURE__ */ __name(() => getRedirectFromStorage() || null, "peekSavedRedirect");
+var consumeSavedRedirect = /* @__PURE__ */ __name(() => {
+  const stored = getRedirectFromStorage();
+  if (stored) clearRedirectFromStorage();
+  return stored || null;
+}, "consumeSavedRedirect");
+var useAuthRedirectManager = /* @__PURE__ */ __name((options = {}) => {
+  const { fallbackUrl = "/dashboard", clearOnUse = true } = options;
+  const [redirectUrl, setRedirectUrl, removeRedirectUrl] = useSessionStorage(AUTH_REDIRECT_KEY, "");
+  const setRedirect = /* @__PURE__ */ __name((url) => {
+    setRedirectUrl(url);
+  }, "setRedirect");
+  const getRedirect = /* @__PURE__ */ __name(() => {
+    return getRedirectFromStorage() || redirectUrl;
+  }, "getRedirect");
+  const clearRedirect = /* @__PURE__ */ __name(() => {
+    removeRedirectUrl();
+    clearRedirectFromStorage();
+  }, "clearRedirect");
+  const hasRedirect = /* @__PURE__ */ __name(() => {
+    const stored = getRedirectFromStorage();
+    return stored.length > 0 || redirectUrl.length > 0;
+  }, "hasRedirect");
+  const getFinalRedirectUrl = /* @__PURE__ */ __name(() => {
+    const stored = getRedirectFromStorage();
+    return stored || redirectUrl || fallbackUrl;
+  }, "getFinalRedirectUrl");
+  const useAndClearRedirect = /* @__PURE__ */ __name(() => {
+    const stored = getRedirectFromStorage();
+    const finalUrl = stored || redirectUrl || fallbackUrl;
+    if (clearOnUse) {
+      clearRedirect();
+    }
+    return finalUrl;
+  }, "useAndClearRedirect");
+  return {
+    redirectUrl,
+    setRedirect,
+    getRedirect,
+    clearRedirect,
+    hasRedirect,
+    getFinalRedirectUrl,
+    useAndClearRedirect
+  };
+}, "useAuthRedirectManager");
 
 // src/auth/hooks/useTwoFactor.ts
 var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
   const { onSuccess, onError, redirectUrl, skipRedirect = false } = options;
   const router = useCfgRouter();
-  const [isLoading, setIsLoading] = (0, import_react7.useState)(false);
-  const [error, setError] = (0, import_react7.useState)(null);
-  const [warning, setWarning] = (0, import_react7.useState)(null);
-  const [remainingBackupCodes, setRemainingBackupCodes] = (0, import_react7.useState)(null);
-  const [attemptsRemaining, setAttemptsRemaining] = (0, import_react7.useState)(null);
-  const clearError = (0, import_react7.useCallback)(() => {
+  const [isLoading, setIsLoading] = (0, import_react8.useState)(false);
+  const [error, setError] = (0, import_react8.useState)(null);
+  const [warning, setWarning] = (0, import_react8.useState)(null);
+  const [remainingBackupCodes, setRemainingBackupCodes] = (0, import_react8.useState)(null);
+  const [attemptsRemaining, setAttemptsRemaining] = (0, import_react8.useState)(null);
+  const clearError = (0, import_react8.useCallback)(() => {
     setError(null);
   }, []);
-  const handleSuccess = (0, import_react7.useCallback)((response) => {
+  const handleSuccess = (0, import_react8.useCallback)((response) => {
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
     if (response.warning) {
       setWarning(response.warning);
@@ -2763,12 +2706,12 @@ var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
     }
     onSuccess?.(response.user);
     if (!skipRedirect) {
-      const finalRedirectUrl = redirectUrl || "/dashboard";
+      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || "/";
       authLogger.info("2FA successful, redirecting to:", finalRedirectUrl);
       router.hardPush(finalRedirectUrl);
     }
   }, [onSuccess, redirectUrl, router, skipRedirect]);
-  const verifyTOTP = (0, import_react7.useCallback)(async (sessionId, code) => {
+  const verifyTOTP = (0, import_react8.useCallback)(async (sessionId, code) => {
     if (!sessionId) {
       const msg = "Missing 2FA session ID";
       setError(msg);
@@ -2812,7 +2755,7 @@ var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
       setIsLoading(false);
     }
   }, [handleSuccess, onError]);
-  const verifyBackupCode = (0, import_react7.useCallback)(async (sessionId, backupCode) => {
+  const verifyBackupCode = (0, import_react8.useCallback)(async (sessionId, backupCode) => {
     if (!sessionId) {
       const msg = "Missing 2FA session ID";
       setError(msg);
@@ -2884,8 +2827,8 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
   } = options;
   const formState = useAuthFormState();
   const validation = useAuthValidation();
-  const isAutoSubmitFromUrlRef = (0, import_react8.useRef)(false);
-  const processedOtpKeyRef = (0, import_react8.useRef)(null);
+  const isAutoSubmitFromUrlRef = (0, import_react9.useRef)(false);
+  const processedOtpKeyRef = (0, import_react9.useRef)(null);
   const {
     requestOTP,
     verifyOTP,
@@ -2928,16 +2871,16 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     // We handle navigation via success step
   });
   const { validateIdentifier: validateIdentifier2 } = validation;
-  const saveIdentifierToStorage = (0, import_react8.useCallback)((id) => {
+  const saveIdentifierToStorage = (0, import_react9.useCallback)((id) => {
     saveEmail(id);
   }, [saveEmail]);
-  (0, import_react8.useEffect)(() => {
+  (0, import_react9.useEffect)(() => {
     const savedEmail = getSavedEmail();
     if (savedEmail) {
       setIdentifier(savedEmail);
     }
   }, []);
-  const handleIdentifierSubmit = (0, import_react8.useCallback)(async (e) => {
+  const handleIdentifierSubmit = (0, import_react9.useCallback)(async (e) => {
     e.preventDefault();
     if (!identifier) {
       const msg = "Please enter your email address";
@@ -2999,7 +2942,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     onError,
     sourceUrl
   ]);
-  const submitOTP = (0, import_react8.useCallback)(async (submitIdentifier, submitOtp) => {
+  const submitOTP = (0, import_react9.useCallback)(async (submitIdentifier, submitOtp) => {
     if (!submitOtp || submitOtp.length < AUTH_CONSTANTS.EMAIL_OTP_LENGTH) {
       const msg = `Please enter the ${AUTH_CONSTANTS.EMAIL_OTP_LENGTH}-digit verification code`;
       setError(msg);
@@ -3038,11 +2981,11 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
       setIsLoading(false);
     }
   }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, setTwoFactorSessionId, setShouldPrompt2FA, setStep]);
-  const handleOTPSubmit = (0, import_react8.useCallback)(async (e) => {
+  const handleOTPSubmit = (0, import_react9.useCallback)(async (e) => {
     e.preventDefault();
     await submitOTP(identifier, otp);
   }, [identifier, otp, submitOTP]);
-  const handleResendOTP = (0, import_react8.useCallback)(async () => {
+  const handleResendOTP = (0, import_react9.useCallback)(async () => {
     setIsLoading(true);
     clearError();
     try {
@@ -3068,15 +3011,15 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
       setIsLoading(false);
     }
   }, [identifier, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, startRateLimitCountdown, setWebmail, onError, sourceUrl]);
-  const handleBackToIdentifier = (0, import_react8.useCallback)(() => {
+  const handleBackToIdentifier = (0, import_react9.useCallback)(() => {
     setStep("identifier");
     clearError();
   }, [setStep, clearError]);
-  const forceOTPStep = (0, import_react8.useCallback)(() => {
+  const forceOTPStep = (0, import_react9.useCallback)(() => {
     setStep("otp");
     clearError();
   }, [setStep, clearError]);
-  const handle2FASubmit = (0, import_react8.useCallback)(async (e) => {
+  const handle2FASubmit = (0, import_react9.useCallback)(async (e) => {
     e.preventDefault();
     if (!twoFactorSessionId) {
       const msg = "Missing 2FA session";
@@ -3090,17 +3033,17 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
       await twoFactor.verifyTOTP(twoFactorSessionId, twoFactorCode);
     }
   }, [twoFactorSessionId, twoFactorCode, useBackupCode, twoFactor, setError, onError]);
-  const handleUseBackupCode = (0, import_react8.useCallback)(() => {
+  const handleUseBackupCode = (0, import_react9.useCallback)(() => {
     setUseBackupCode(true);
     setTwoFactorCode("");
     clearError();
   }, [setUseBackupCode, setTwoFactorCode, clearError]);
-  const handleUseTOTP = (0, import_react8.useCallback)(() => {
+  const handleUseTOTP = (0, import_react9.useCallback)(() => {
     setUseBackupCode(false);
     setTwoFactorCode("");
     clearError();
   }, [setUseBackupCode, setTwoFactorCode, clearError]);
-  const handleOTPFromUrl = (0, import_react8.useCallback)((detectedOtp, detectedEmail) => {
+  const handleOTPFromUrl = (0, import_react9.useCallback)((detectedOtp, detectedEmail) => {
     const autoIdentifier = detectedEmail || getSavedEmail() || "";
     if (!autoIdentifier) {
       authLogger.warn("No identifier found for auto-submit (no email in URL or storage)");
@@ -3153,15 +3096,13 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
 }, "useAuthForm");
 
 // src/auth/hooks/useGithubAuth.ts
-var import_react9 = require("react");
-init_auth();
-init_sdk_gen();
+var import_react10 = require("react");
 var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
   const { sourceUrl, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
   const router = useCfgRouter();
-  const [isLoading, setIsLoading] = (0, import_react9.useState)(false);
-  const [error, setError] = (0, import_react9.useState)(null);
-  const startGithubAuth = (0, import_react9.useCallback)(async () => {
+  const [isLoading, setIsLoading] = (0, import_react10.useState)(false);
+  const [error, setError] = (0, import_react10.useState)(null);
+  const startGithubAuth = (0, import_react10.useCallback)(async () => {
     setIsLoading(true);
     setError(null);
     try {
@@ -3199,7 +3140,7 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
       setIsLoading(false);
     }
   }, [sourceUrl, onError]);
-  const handleGithubCallback = (0, import_react9.useCallback)(async (code, state) => {
+  const handleGithubCallback = (0, import_react10.useCallback)(async (code, state) => {
     setIsLoading(true);
     setError(null);
     try {
@@ -3265,27 +3206,26 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
 }, "useGithubAuth");
 
 // src/auth/hooks/useTwoFactorSetup.ts
-var import_react10 = require("react");
-init_sdk_gen();
+var import_react11 = require("react");
 var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
   const { onComplete, onError } = options;
-  const [isLoading, setIsLoading] = (0, import_react10.useState)(false);
-  const [error, setError] = (0, import_react10.useState)(null);
-  const [setupData, setSetupData] = (0, import_react10.useState)(null);
-  const [backupCodes, setBackupCodes] = (0, import_react10.useState)(null);
-  const [backupCodesWarning, setBackupCodesWarning] = (0, import_react10.useState)(null);
-  const [setupStep, setSetupStep] = (0, import_react10.useState)("idle");
-  const clearError = (0, import_react10.useCallback)(() => {
+  const [isLoading, setIsLoading] = (0, import_react11.useState)(false);
+  const [error, setError] = (0, import_react11.useState)(null);
+  const [setupData, setSetupData] = (0, import_react11.useState)(null);
+  const [backupCodes, setBackupCodes] = (0, import_react11.useState)(null);
+  const [backupCodesWarning, setBackupCodesWarning] = (0, import_react11.useState)(null);
+  const [setupStep, setSetupStep] = (0, import_react11.useState)("idle");
+  const clearError = (0, import_react11.useCallback)(() => {
     setError(null);
   }, []);
-  const resetSetup = (0, import_react10.useCallback)(() => {
+  const resetSetup = (0, import_react11.useCallback)(() => {
     setSetupData(null);
     setBackupCodes(null);
     setBackupCodesWarning(null);
     setSetupStep("idle");
     setError(null);
   }, []);
-  const startSetup = (0, import_react10.useCallback)(async (deviceName) => {
+  const startSetup = (0, import_react11.useCallback)(async (deviceName) => {
     setIsLoading(true);
     setError(null);
     setSetupStep("scanning");
@@ -3317,7 +3257,7 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
       setIsLoading(false);
     }
   }, [onError]);
-  const confirmSetup = (0, import_react10.useCallback)(async (code) => {
+  const confirmSetup = (0, import_react11.useCallback)(async (code) => {
     if (!setupData) {
       const msg = "Setup not started. Call startSetup() first.";
       setError(msg);
@@ -3373,8 +3313,7 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
 }, "useTwoFactorSetup");
 
 // src/auth/hooks/useTwoFactorStatus.ts
-var import_react11 = require("react");
-init_sdk_gen();
+var import_react12 = require("react");
 function extractErrorMessage(err, fallback) {
   if (err instanceof APIError) {
     const body = err.response;
@@ -3387,14 +3326,14 @@ function extractErrorMessage(err, fallback) {
 }
 __name(extractErrorMessage, "extractErrorMessage");
 var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
-  const [isLoading, setIsLoading] = (0, import_react11.useState)(false);
-  const [error, setError] = (0, import_react11.useState)(null);
-  const [has2FAEnabled, setHas2FAEnabled] = (0, import_react11.useState)(null);
-  const [devices, setDevices] = (0, import_react11.useState)([]);
-  const clearError = (0, import_react11.useCallback)(() => {
+  const [isLoading, setIsLoading] = (0, import_react12.useState)(false);
+  const [error, setError] = (0, import_react12.useState)(null);
+  const [has2FAEnabled, setHas2FAEnabled] = (0, import_react12.useState)(null);
+  const [devices, setDevices] = (0, import_react12.useState)([]);
+  const clearError = (0, import_react12.useCallback)(() => {
     setError(null);
   }, []);
-  const fetchStatus = (0, import_react11.useCallback)(async () => {
+  const fetchStatus = (0, import_react12.useCallback)(async () => {
     setIsLoading(true);
     setError(null);
     try {
@@ -3419,7 +3358,7 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
       setIsLoading(false);
     }
   }, []);
-  const disable2FA = (0, import_react11.useCallback)(async (code) => {
+  const disable2FA = (0, import_react12.useCallback)(async (code) => {
     if (!code || code.length !== 6) {
       setError("Please enter a 6-digit code");
       return false;
@@ -3453,206 +3392,6 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
   };
 }, "useTwoFactorStatus");
 
-// src/auth/hooks/useSessionStorage.ts
-var import_react12 = require("react");
-function useSessionStorage(key, initialValue) {
-  const [storedValue, setStoredValue] = (0, import_react12.useState)(() => {
-    if (typeof window === "undefined") {
-      return initialValue;
-    }
-    try {
-      const item = window.sessionStorage.getItem(key);
-      return item ? JSON.parse(item) : initialValue;
-    } catch (error) {
-      authLogger.error(`Error reading sessionStorage key "${key}":`, error);
-      return initialValue;
-    }
-  });
-  const checkDataSize = /* @__PURE__ */ __name((data) => {
-    try {
-      const jsonString = JSON.stringify(data);
-      const sizeInBytes = new Blob([jsonString]).size;
-      const sizeInKB = sizeInBytes / 1024;
-      if (sizeInKB > 1024) {
-        authLogger.warn(`Data size (${sizeInKB.toFixed(2)}KB) exceeds 1MB limit for key "${key}"`);
-        return false;
-      }
-      return true;
-    } catch (error) {
-      authLogger.error(`Error checking data size for key "${key}":`, error);
-      return false;
-    }
-  }, "checkDataSize");
-  const clearOldData = /* @__PURE__ */ __name(() => {
-    try {
-      const keys = Object.keys(sessionStorage).filter((key2) => key2 && typeof key2 === "string");
-      if (keys.length > 50) {
-        const itemsToRemove = Math.ceil(keys.length * 0.2);
-        for (let i = 0; i < itemsToRemove; i++) {
-          try {
-            const key2 = keys[i];
-            if (key2) {
-              sessionStorage.removeItem(key2);
-              sessionStorage.removeItem(`${key2}_timestamp`);
-            }
-          } catch {
-          }
-        }
-      }
-    } catch (error) {
-      authLogger.error("Error clearing old sessionStorage data:", error);
-    }
-  }, "clearOldData");
-  const forceClearAll = /* @__PURE__ */ __name(() => {
-    try {
-      const keys = Object.keys(sessionStorage);
-      for (const key2 of keys) {
-        try {
-          sessionStorage.removeItem(key2);
-        } catch {
-        }
-      }
-    } catch (error) {
-      authLogger.error("Error force clearing sessionStorage:", error);
-    }
-  }, "forceClearAll");
-  const setValue = /* @__PURE__ */ __name((value) => {
-    try {
-      const valueToStore = value instanceof Function ? value(storedValue) : value;
-      if (!checkDataSize(valueToStore)) {
-        authLogger.warn(`Data size too large for key "${key}", removing key`);
-        try {
-          window.sessionStorage.removeItem(key);
-          window.sessionStorage.removeItem(`${key}_timestamp`);
-        } catch {
-        }
-        setStoredValue(valueToStore);
-        return;
-      }
-      setStoredValue(valueToStore);
-      if (typeof window !== "undefined") {
-        try {
-          window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
-          window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
-        } catch (storageError) {
-          if (storageError.name === "QuotaExceededError" || storageError.code === 22 || storageError.message?.includes("quota")) {
-            authLogger.warn("sessionStorage quota exceeded, clearing old data...");
-            clearOldData();
-            try {
-              window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
-              window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
-            } catch (retryError) {
-              authLogger.error(`Failed to set sessionStorage key "${key}" after clearing old data:`, retryError);
-              try {
-                forceClearAll();
-                window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
-                window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
-              } catch (finalError) {
-                authLogger.error(`Failed to set sessionStorage key "${key}" after force clearing:`, finalError);
-                setStoredValue(valueToStore);
-              }
-            }
-          } else {
-            throw storageError;
-          }
-        }
-      }
-    } catch (error) {
-      authLogger.error(`Error setting sessionStorage key "${key}":`, error);
-      const valueToStore = value instanceof Function ? value(storedValue) : value;
-      setStoredValue(valueToStore);
-    }
-  }, "setValue");
-  const removeValue = /* @__PURE__ */ __name(() => {
-    try {
-      setStoredValue(initialValue);
-      if (typeof window !== "undefined") {
-        try {
-          window.sessionStorage.removeItem(key);
-          window.sessionStorage.removeItem(`${key}_timestamp`);
-        } catch (removeError) {
-          if (removeError.name === "QuotaExceededError" || removeError.code === 22 || removeError.message?.includes("quota")) {
-            authLogger.warn("sessionStorage quota exceeded during removal, clearing old data...");
-            clearOldData();
-            try {
-              window.sessionStorage.removeItem(key);
-              window.sessionStorage.removeItem(`${key}_timestamp`);
-            } catch (retryError) {
-              authLogger.error(`Failed to remove sessionStorage key "${key}" after clearing:`, retryError);
-              forceClearAll();
-            }
-          } else {
-            throw removeError;
-          }
-        }
-      }
-    } catch (error) {
-      authLogger.error(`Error removing sessionStorage key "${key}":`, error);
-    }
-  }, "removeValue");
-  return [storedValue, setValue, removeValue];
-}
-__name(useSessionStorage, "useSessionStorage");
-
-// src/auth/hooks/useAuthRedirect.ts
-var AUTH_REDIRECT_KEY = "auth_redirect_url";
-var getRedirectFromStorage = /* @__PURE__ */ __name(() => {
-  if (typeof window === "undefined") return "";
-  try {
-    const item = window.sessionStorage.getItem(AUTH_REDIRECT_KEY);
-    return item ? JSON.parse(item) : "";
-  } catch {
-    return "";
-  }
-}, "getRedirectFromStorage");
-var clearRedirectFromStorage = /* @__PURE__ */ __name(() => {
-  if (typeof window === "undefined") return;
-  try {
-    window.sessionStorage.removeItem(AUTH_REDIRECT_KEY);
-    window.sessionStorage.removeItem(`${AUTH_REDIRECT_KEY}_timestamp`);
-  } catch {
-  }
-}, "clearRedirectFromStorage");
-var useAuthRedirectManager = /* @__PURE__ */ __name((options = {}) => {
-  const { fallbackUrl = "/dashboard", clearOnUse = true } = options;
-  const [redirectUrl, setRedirectUrl, removeRedirectUrl] = useSessionStorage(AUTH_REDIRECT_KEY, "");
-  const setRedirect = /* @__PURE__ */ __name((url) => {
-    setRedirectUrl(url);
-  }, "setRedirect");
-  const getRedirect = /* @__PURE__ */ __name(() => {
-    return getRedirectFromStorage() || redirectUrl;
-  }, "getRedirect");
-  const clearRedirect = /* @__PURE__ */ __name(() => {
-    removeRedirectUrl();
-    clearRedirectFromStorage();
-  }, "clearRedirect");
-  const hasRedirect = /* @__PURE__ */ __name(() => {
-    const stored = getRedirectFromStorage();
-    return stored.length > 0 || redirectUrl.length > 0;
-  }, "hasRedirect");
-  const getFinalRedirectUrl = /* @__PURE__ */ __name(() => {
-    const stored = getRedirectFromStorage();
-    return stored || redirectUrl || fallbackUrl;
-  }, "getFinalRedirectUrl");
-  const useAndClearRedirect = /* @__PURE__ */ __name(() => {
-    const stored = getRedirectFromStorage();
-    const finalUrl = stored || redirectUrl || fallbackUrl;
-    if (clearOnUse) {
-      clearRedirect();
-    }
-    return finalUrl;
-  }, "useAndClearRedirect");
-  return {
-    redirectUrl,
-    setRedirect,
-    getRedirect,
-    clearRedirect,
-    hasRedirect,
-    getFinalRedirectUrl,
-    useAndClearRedirect
-  };
-}, "useAuthRedirectManager");
-
 // src/auth/hooks/useLocalStorage.ts
 var import_react13 = require("react");
 function useLocalStorage(key, initialValue) {
@@ -3953,7 +3692,6 @@ __name(getCacheMetadata, "getCacheMetadata");
 
 // src/auth/hooks/useDeleteAccount.ts
 var import_react14 = require("react");
-init_sdk_gen();
 var useDeleteAccount = /* @__PURE__ */ __name(() => {
   const [isLoading, setIsLoading] = (0, import_react14.useState)(false);
   const [error, setError] = (0, import_react14.useState)(null);
@@ -3992,14 +3730,9 @@ var useDeleteAccount = /* @__PURE__ */ __name(() => {
 
 // src/auth/context/AccountsContext.tsx
 var import_react15 = require("react");
-init_auth();
-
-// src/_api/generated/_cfg_accounts/sdk.gen.ts
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRegenerateCreate.ts
 var import_mutation = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/schemas/APIKeyRegenerate.ts
 var import_zod = require("zod");
@@ -4010,7 +3743,6 @@ var APIKeyRegenerateSchema = import_zod.z.object({
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRetrieve.ts
 var import_swr = __toESM(require("swr"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/schemas/APIKey.ts
 var import_zod2 = require("zod");
@@ -4022,7 +3754,6 @@ var APIKeySchema = import_zod2.z.object({
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRevealCreate.ts
 var import_mutation2 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/schemas/APIKeyReveal.ts
 var import_zod3 = require("zod");
@@ -4034,7 +3765,6 @@ var APIKeyRevealSchema = import_zod3.z.object({
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyTestCreate.ts
 var import_mutation3 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/schemas/APIKeyTestResult.ts
 var import_zod4 = require("zod");
@@ -4045,7 +3775,6 @@ var APIKeyTestResultSchema = import_zod4.z.object({
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthConnectionsList.ts
 var import_swr2 = __toESM(require("swr"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/schemas/cfg_accounts_oauth_connections_response_200_AutoRef.ts
 var import_zod7 = require("zod");
@@ -4074,7 +3803,6 @@ var cfg_accounts_oauth_connections_response_200_AutoRefSchema = import_zod7.z.ar
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthDisconnectCreate.ts
 var import_mutation4 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/schemas/cfg_accounts_oauth_disconnect_response_200_AutoRef.ts
 var import_zod8 = require("zod");
@@ -4084,7 +3812,6 @@ var cfg_accounts_oauth_disconnect_response_200_AutoRefSchema = import_zod8.z.obj
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGithubAuthorizeCreate.ts
 var import_mutation5 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthAuthorizeResponse.ts
 var import_zod9 = require("zod");
@@ -4095,7 +3822,6 @@ var OAuthAuthorizeResponseSchema = import_zod9.z.object({
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGithubCallbackCreate.ts
 var import_mutation6 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthTokenResponse.ts
 var import_zod10 = require("zod");
@@ -4112,7 +3838,6 @@ var OAuthTokenResponseSchema = import_zod10.z.object({
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthProvidersRetrieve.ts
 var import_swr3 = __toESM(require("swr"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthProvidersResponse.ts
 var import_zod11 = require("zod");
@@ -4122,7 +3847,6 @@ var OAuthProvidersResponseSchema = import_zod11.z.object({
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpRequestCreate.ts
 var import_mutation7 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/schemas/OTPRequestResponse.ts
 var import_zod14 = require("zod");
@@ -4197,7 +3921,6 @@ __name(useCfgAccountsOtpRequestCreate, "useCfgAccountsOtpRequestCreate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpVerifyCreate.ts
 var import_mutation8 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/schemas/OTPVerifyResponse.ts
 var import_zod17 = require("zod");
@@ -4297,7 +4020,6 @@ __name(useCfgAccountsOtpVerifyCreate, "useCfgAccountsOtpVerifyCreate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileAvatarCreate.ts
 var import_mutation9 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 function useCfgAccountsProfileAvatarCreate(config) {
   return (0, import_mutation9.default)(
     ["cfg_accounts_profile_avatar_create"],
@@ -4346,7 +4068,6 @@ __name(useCfgAccountsProfileAvatarCreate, "useCfgAccountsProfileAvatarCreate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileDeleteCreate.ts
 var import_mutation10 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/schemas/AccountDeleteResponse.ts
 var import_zod18 = require("zod");
@@ -4357,11 +4078,9 @@ var AccountDeleteResponseSchema = import_zod18.z.object({
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfilePartialPartialUpdate.ts
 var import_mutation11 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfilePartialUpdate.ts
 var import_mutation12 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 function useCfgAccountsProfilePartialUpdate(config) {
   return (0, import_mutation12.default)(
     ["cfg_accounts_profile_partial_update"],
@@ -4410,15 +4129,12 @@ __name(useCfgAccountsProfilePartialUpdate, "useCfgAccountsProfilePartialUpdate")
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileRetrieve.ts
 var import_swr4 = __toESM(require("swr"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileUpdatePartialUpdate.ts
 var import_mutation13 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileUpdateUpdate.ts
 var import_mutation14 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 function useCfgAccountsProfileUpdateUpdate(config) {
   return (0, import_mutation14.default)(
     ["cfg_accounts_profile_update_update"],
@@ -4467,11 +4183,9 @@ __name(useCfgAccountsProfileUpdateUpdate, "useCfgAccountsProfileUpdateUpdate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenBlacklistCreate.ts
 var import_mutation15 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
 var import_mutation16 = __toESM(require("swr/mutation"), 1);
-init_sdk_gen();
 
 // src/_api/generated/_cfg_accounts/schemas/TokenRefresh.ts
 var import_zod19 = require("zod");
@@ -4715,10 +4429,15 @@ __name(useAccountsContext, "useAccountsContext");
 // src/auth/context/AuthContext.tsx
 var import_jsx_runtime2 = require("react/jsx-runtime");
 var defaultRoutes = {
-  auth: DEFAULT_AUTH_PATH,
-  defaultCallback: DEFAULT_CALLBACK_PATH,
-  defaultAuthCallback: DEFAULT_AUTH_PATH
+  auth: "/auth",
+  defaultCallback: "/",
+  defaultAuthCallback: "/auth"
 };
+var resolveAuthRoutes = /* @__PURE__ */ __name((routes) => ({
+  auth: routes?.auth || defaultRoutes.auth,
+  defaultCallback: routes?.defaultCallback || defaultRoutes.defaultCallback,
+  defaultAuthCallback: routes?.defaultAuthCallback || routes?.auth || defaultRoutes.defaultAuthCallback
+}), "resolveAuthRoutes");
 var EMAIL_STORAGE_KEY = "auth_email";
 var AuthContext = (0, import_react16.createContext)(void 0);
 var apiErrorMessage = /* @__PURE__ */ __name((error) => {
@@ -4736,8 +4455,13 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     EMAIL_STORAGE_KEY,
     null
   );
+  const routes = (0, import_react16.useMemo)(() => resolveAuthRoutes(config?.routes), [config?.routes]);
+  const routesRef = (0, import_react16.useRef)(routes);
+  (0, import_react16.useEffect)(() => {
+    routesRef.current = routes;
+  }, [routes]);
   const redirectManager = useAuthRedirectManager({
-    fallbackUrl: config?.routes?.defaultCallback || defaultRoutes.defaultCallback,
+    fallbackUrl: routes.defaultCallback,
     clearOnUse: true
   });
   const configRef = (0, import_react16.useRef)(config);
@@ -4748,13 +4472,15 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   (0, import_react16.useEffect)(() => {
     accountsRef.current = accounts;
   }, [accounts]);
+  const pendingManualNavRef = (0, import_react16.useRef)(false);
   const [profileSettled, setProfileSettled] = (0, import_react16.useState)(false);
   const hasProfile = Boolean(accounts.profile);
   const profileAttemptedRef = (0, import_react16.useRef)(false);
   (0, import_react16.useEffect)(() => {
     if (!isAuthenticated) {
       profileAttemptedRef.current = false;
-      if (auth.getToken() || auth.getRefreshToken()) {
+      const hasTokens = Boolean(auth.getToken() || auth.getRefreshToken());
+      if (hasTokens && !auth.isAuthenticated()) {
         authLogger.warn("Dead session in storage \u2014 clearing");
         auth.clearSession();
         clearProfileCache();
@@ -4788,18 +4514,18 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       Analytics.event("auth_session_expired" /* AUTH_SESSION_EXPIRED */, {
         category: "auth" /* AUTH */
       });
-      const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
-      router.hardReplace(authCallbackUrl);
+      router.hardReplace(routesRef.current.defaultAuthCallback);
     });
     return unsubscribe;
   }, [router]);
   (0, import_react16.useEffect)(() => {
-    if (!isAuthenticated) return;
-    const authRoute = config?.routes?.auth || defaultRoutes.auth;
-    if (pathname === authRoute && !queryParams.get("flow")) {
-      router.push(config?.routes?.defaultCallback || defaultRoutes.defaultCallback);
+    if (!isAuthenticated || pendingManualNavRef.current) return;
+    if (pathname === routes.auth && !queryParams.get("flow")) {
+      const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;
+      if (saved) redirectManager.clearRedirect();
+      router.push(saved || routes.defaultCallback);
     }
-  }, [isAuthenticated, pathname, queryParams, config?.routes, router]);
+  }, [isAuthenticated, pathname, queryParams, routes, router, redirectManager]);
   const loadCurrentProfile = (0, import_react16.useCallback)(async (callerId) => {
     if (!auth.isAuthenticated()) {
       throw new Error("No valid authentication token");
@@ -4809,16 +4535,15 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     });
   }, []);
   const checkAuthAndRedirect = (0, import_react16.useCallback)(async () => {
-    const routes = configRef.current?.routes;
     if (auth.isAuthenticated()) {
       try {
         await loadCurrentProfile("checkAuthAndRedirect");
       } catch (error) {
         authLogger.warn("checkAuthAndRedirect: profile load failed", error);
       }
-      router.push(routes?.defaultCallback || defaultRoutes.defaultCallback);
+      router.push(routesRef.current.defaultCallback);
     } else {
-      router.push(routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback);
+      router.push(routesRef.current.defaultAuthCallback);
     }
   }, [loadCurrentProfile, router]);
   const requestOTP = (0, import_react16.useCallback)(
@@ -4858,6 +4583,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const verifyOTP = (0, import_react16.useCallback)(
     async (identifier, otpCode, sourceUrl, redirectUrl, skipRedirect) => {
       try {
+        pendingManualNavRef.current = Boolean(skipRedirect);
         const result = await accountsRef.current.verifyOTP({
           identifier,
           otp: otpCode,
@@ -4888,8 +4614,9 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
           Analytics.setUser(String(result.user.id));
         }
         if (!skipRedirect) {
-          const savedRedirect = redirectManager.useAndClearRedirect();
-          const finalRedirectUrl = redirectUrl || savedRedirect || configRef.current?.routes?.defaultCallback || defaultRoutes.defaultCallback;
+          const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;
+          if (saved) redirectManager.clearRedirect();
+          const finalRedirectUrl = saved || redirectUrl || routesRef.current.defaultCallback;
           authLogger.info("Redirecting after auth to:", finalRedirectUrl);
           router.hardPush(finalRedirectUrl);
         }
@@ -4931,8 +4658,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       category: "auth" /* AUTH */
     });
     accountsRef.current.logout();
-    const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
-    router.hardReplace(authCallbackUrl);
+    router.hardReplace(routesRef.current.defaultAuthCallback);
   }, [router]);
   const user = accounts.profile ?? null;
   const isAdminUser = Boolean(user?.is_staff || user?.is_superuser);
@@ -4958,6 +4684,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       // expiry timer, cross-tab/cross-store sync) — no ticks, no polling.
       isAuthenticated,
       isAdminUser,
+      routes,
       loadCurrentProfile,
       checkAuthAndRedirect,
       getToken: /* @__PURE__ */ __name(() => auth.getToken(), "getToken"),
@@ -4981,6 +4708,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       isLoading,
       isAuthenticated,
       isAdminUser,
+      routes,
       loadCurrentProfile,
       checkAuthAndRedirect,
       storedEmail,
@@ -5008,6 +4736,7 @@ var defaultAuthState = {
   isLoading: false,
   isAuthenticated: false,
   isAdminUser: false,
+  routes: resolveAuthRoutes(),
   loadCurrentProfile: /* @__PURE__ */ __name(async () => {
     authLogger.warn("useAuth: loadCurrentProfile called outside AuthProvider");
   }, "loadCurrentProfile"),