@djangocfg/api 2.1.580 → 2.1.581

package/dist/auth.cjs

@@ -71,7 +71,9 @@ var init_OTPRequestResponse = __esm({
     init_WebmailLink();
     OTPRequestResponseSchema = import_zod3.z.object({
       message: import_zod3.z.string(),
-      webmail: WebmailLinkSchema.nullable().optional()
+      webmail: WebmailLinkSchema.nullable().optional(),
+      resend_in: import_zod3.z.number().int().min(0).optional(),
+      expires_in: import_zod3.z.number().int().min(0).optional()
     });
   }
 });
@@ -168,10 +170,12 @@ __export(auth_exports, {
   AuthContext: () => AuthContext_default,
   AuthProvider: () => AuthProvider,
   authLogger: () => authLogger,
+  beginTwoFactorChallenge: () => beginTwoFactorChallenge,
   clearProfileCache: () => clearProfileCache,
   consumeSavedRedirect: () => consumeSavedRedirect,
   decodeBase64: () => decodeBase64,
   encodeBase64: () => encodeBase64,
+  endTwoFactorChallenge: () => endTwoFactorChallenge,
   formatAuthError: () => formatAuthError,
   getCacheMetadata: () => getCacheMetadata,
   getCachedProfile: () => getCachedProfile,
@@ -204,6 +208,7 @@ __export(auth_exports, {
   useSession: () => useSession,
   useSessionStorage: () => useSessionStorage,
   useTwoFactor: () => useTwoFactor,
+  useTwoFactorChallenge: () => useTwoFactorChallenge,
   useTwoFactorSetup: () => useTwoFactorSetup,
   useTwoFactorStatus: () => useTwoFactorStatus,
   useTwoFactorVerify: () => useTwoFactorVerify,
@@ -219,12 +224,14 @@ var AUTH_CONSTANTS = {
   /** TOTP code length (RFC 6238 — authenticator apps). */
   TOTP_LENGTH: 6,
   /** Backup code max length. */
-  BACKUP_CODE_MAX_LENGTH: 12
+  BACKUP_CODE_MAX_LENGTH: 12,
+  /** Resend cooldown (s) when the server does not state one. Mirrors the backend per-email cooldown. */
+  RESEND_COOLDOWN_SECONDS: 30
 };
 
 // src/auth/context/AuthContext.tsx
 var import_navigation4 = require("next/navigation");
-var import_react16 = require("react");
+var import_react17 = require("react");
 
 // src/_api/generated/helpers/errors.ts
 var APIError = class extends Error {
@@ -1178,6 +1185,28 @@ var formatCountdown = /* @__PURE__ */ __name((s) => {
   const m = Math.floor(s / 60);
   return m > 0 ? `${m}:${String(s % 60).padStart(2, "0")}` : `${s}s`;
 }, "formatCountdown");
+var useCountdown = /* @__PURE__ */ __name(() => {
+  const [seconds, setSeconds] = (0, import_react4.useState)(0);
+  const timerRef = (0, import_react4.useRef)(null);
+  const start = (0, import_react4.useCallback)((from) => {
+    if (timerRef.current) clearInterval(timerRef.current);
+    setSeconds(from);
+    timerRef.current = setInterval(() => {
+      setSeconds((prev) => {
+        if (prev <= 1) {
+          clearInterval(timerRef.current);
+          timerRef.current = null;
+          return 0;
+        }
+        return prev - 1;
+      });
+    }, 1e3);
+  }, []);
+  (0, import_react4.useEffect)(() => () => {
+    if (timerRef.current) clearInterval(timerRef.current);
+  }, []);
+  return { seconds, start };
+}, "useCountdown");
 var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
   const [identifier, setIdentifier] = (0, import_react4.useState)(initialIdentifier);
   const [otp, setOtp] = (0, import_react4.useState)("");
@@ -1185,33 +1214,12 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
   const [isLoading, setIsLoading] = (0, import_react4.useState)(false);
   const [acceptedTerms, setAcceptedTerms] = (0, import_react4.useState)(true);
   const [marketingConsent, setMarketingConsent] = (0, import_react4.useState)(null);
-  const [rememberMe, setRememberMe] = (0, import_react4.useState)(false);
+  const [rememberMe, setRememberMe] = (0, import_react4.useState)(true);
   const [step, setStep] = (0, import_react4.useState)("identifier");
   const [error, setError] = (0, import_react4.useState)("");
   const [webmail, setWebmail] = (0, import_react4.useState)(null);
-  const [twoFactorSessionId, setTwoFactorSessionId] = (0, import_react4.useState)(null);
-  const [shouldPrompt2FA, setShouldPrompt2FA] = (0, import_react4.useState)(false);
-  const [twoFactorCode, setTwoFactorCode] = (0, import_react4.useState)("");
-  const [useBackupCode, setUseBackupCode] = (0, import_react4.useState)(false);
-  const [rateLimitSeconds, setRateLimitSeconds] = (0, import_react4.useState)(0);
-  const rateLimitTimerRef = (0, import_react4.useRef)(null);
-  const startRateLimitCountdown = (0, import_react4.useCallback)((seconds) => {
-    if (rateLimitTimerRef.current) clearInterval(rateLimitTimerRef.current);
-    setRateLimitSeconds(seconds);
-    rateLimitTimerRef.current = setInterval(() => {
-      setRateLimitSeconds((prev) => {
-        if (prev <= 1) {
-          clearInterval(rateLimitTimerRef.current);
-          rateLimitTimerRef.current = null;
-          return 0;
-        }
-        return prev - 1;
-      });
-    }, 1e3);
-  }, []);
-  (0, import_react4.useEffect)(() => () => {
-    if (rateLimitTimerRef.current) clearInterval(rateLimitTimerRef.current);
-  }, []);
+  const rateLimit = useCountdown();
+  const resend = useCountdown();
   const clearError = (0, import_react4.useCallback)(() => setError(""), []);
   return {
     // State
@@ -1224,13 +1232,11 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     rememberMe,
     step,
     error,
-    twoFactorSessionId,
-    shouldPrompt2FA,
-    twoFactorCode,
-    useBackupCode,
-    rateLimitSeconds,
-    isRateLimited: rateLimitSeconds > 0,
-    rateLimitLabel: formatCountdown(rateLimitSeconds),
+    rateLimitSeconds: rateLimit.seconds,
+    isRateLimited: rateLimit.seconds > 0,
+    rateLimitLabel: formatCountdown(rateLimit.seconds),
+    resendSeconds: resend.seconds,
+    resendLabel: formatCountdown(resend.seconds),
     webmail,
     // Handlers
     setIdentifier,
@@ -1243,11 +1249,8 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     clearError,
     setStep,
     setIsLoading,
-    setTwoFactorSessionId,
-    setShouldPrompt2FA,
-    setTwoFactorCode,
-    setUseBackupCode,
-    startRateLimitCountdown,
+    startRateLimitCountdown: rateLimit.start,
+    startResendCountdown: resend.start,
     setWebmail
   };
 }, "useAuthFormState");
@@ -1264,7 +1267,7 @@ var useAuthValidation = /* @__PURE__ */ __name(() => {
 var validateIdentifier = /* @__PURE__ */ __name((id) => EMAIL_REGEX.test(id), "validateIdentifier");
 
 // src/auth/hooks/useAuthForm.ts
-var import_react9 = require("react");
+var import_react8 = require("react");
 
 // src/auth/utils/logger.ts
 var import_consola2 = require("consola");
@@ -1329,86 +1332,410 @@ var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
   };
 }, "useAutoAuth");
 
-// src/auth/hooks/useTwoFactorVerify.ts
-var import_react8 = require("react");
+// src/auth/hooks/useTwoFactorChallenge.ts
+var import_react7 = require("react");
+var current = null;
+var listeners = /* @__PURE__ */ new Set();
+var set = /* @__PURE__ */ __name((next) => {
+  current = next;
+  for (const listener of [...listeners]) listener();
+}, "set");
+var subscribe = /* @__PURE__ */ __name((listener) => {
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
+}, "subscribe");
+var beginTwoFactorChallenge = /* @__PURE__ */ __name((challenge) => set(challenge), "beginTwoFactorChallenge");
+var endTwoFactorChallenge = /* @__PURE__ */ __name(() => set(null), "endTwoFactorChallenge");
+var useTwoFactorChallenge = /* @__PURE__ */ __name(() => (0, import_react7.useSyncExternalStore)(subscribe, () => current, () => null), "useTwoFactorChallenge");
 
-// src/_api/generated/core/bodySerializer.gen.ts
-var serializeFormDataPair = /* @__PURE__ */ __name((data, key, value) => {
-  if (typeof value === "string" || value instanceof Blob) {
-    data.append(key, value);
-  } else if (value instanceof Date) {
-    data.append(key, value.toISOString());
-  } else {
-    data.append(key, JSON.stringify(value));
-  }
-}, "serializeFormDataPair");
-var formDataBodySerializer = {
-  bodySerializer: /* @__PURE__ */ __name((body) => {
-    const data = new FormData();
-    Object.entries(body).forEach(([key, value]) => {
-      if (value === void 0 || value === null) {
-        return;
+// src/auth/hooks/useAuthForm.ts
+var useAuthForm = /* @__PURE__ */ __name((options) => {
+  const {
+    onIdentifierSuccess,
+    onOTPSuccess,
+    onError,
+    sourceUrl,
+    redirectUrl,
+    requireTermsAcceptance = false,
+    marketingConsent: marketingConsentOption,
+    authPath = "/auth"
+  } = options;
+  const formState = useAuthFormState();
+  const validation = useAuthValidation();
+  const isAutoSubmitFromUrlRef = (0, import_react8.useRef)(false);
+  const processedOtpKeyRef = (0, import_react8.useRef)(null);
+  const {
+    requestOTP,
+    verifyOTP,
+    login,
+    getSavedEmail,
+    saveEmail
+  } = useAuth();
+  const {
+    identifier,
+    otp,
+    password,
+    acceptedTerms,
+    marketingConsent,
+    rememberMe,
+    setIdentifier,
+    setOtp,
+    setStep,
+    setError,
+    setIsLoading,
+    clearError,
+    startRateLimitCountdown,
+    startResendCountdown,
+    setWebmail
+  } = formState;
+  const { validateIdentifier: validateIdentifier2 } = validation;
+  const saveIdentifierToStorage = (0, import_react8.useCallback)((id) => {
+    saveEmail(id);
+  }, [saveEmail]);
+  (0, import_react8.useEffect)(() => {
+    const savedEmail = getSavedEmail();
+    if (savedEmail) {
+      setIdentifier(savedEmail);
+    }
+  }, []);
+  const handleIdentifierSubmit = (0, import_react8.useCallback)(async (e) => {
+    e.preventDefault();
+    if (!identifier) {
+      const msg = "Please enter your email address";
+      setError(msg);
+      onError?.(msg);
+      return;
+    }
+    if (!validateIdentifier2(identifier)) {
+      const msg = "Please enter a valid email address";
+      setError(msg);
+      onError?.(msg);
+      return;
+    }
+    if (requireTermsAcceptance && !acceptedTerms) {
+      const msg = "Please accept the Terms of Service and Privacy Policy";
+      setError(msg);
+      onError?.(msg);
+      return;
+    }
+    clearError();
+    setOtp("");
+    setWebmail(null);
+    setStep("otp");
+    const rollBack = /* @__PURE__ */ __name((msg) => {
+      setStep("identifier");
+      setError(msg);
+      onError?.(msg);
+    }, "rollBack");
+    try {
+      const consent = marketingConsentOption ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion } : void 0;
+      const result = await requestOTP(identifier, sourceUrl, consent);
+      if (result.success) {
+        saveIdentifierToStorage(identifier);
+        setWebmail(result.webmail ?? null);
+        startResendCountdown(result.resendIn ?? AUTH_CONSTANTS.RESEND_COOLDOWN_SECONDS);
+        onIdentifierSuccess?.(identifier);
+      } else if (result.retryAfter) {
+        setStep("identifier");
+        startRateLimitCountdown(result.retryAfter);
+      } else {
+        rollBack(result.message);
       }
-      if (Array.isArray(value)) {
-        value.forEach((v) => serializeFormDataPair(data, key, v));
+    } catch {
+      rollBack("An unexpected error occurred");
+    }
+  }, [
+    identifier,
+    acceptedTerms,
+    requireTermsAcceptance,
+    marketingConsent,
+    marketingConsentOption,
+    validateIdentifier2,
+    requestOTP,
+    saveIdentifierToStorage,
+    setError,
+    setOtp,
+    setStep,
+    clearError,
+    setWebmail,
+    startRateLimitCountdown,
+    startResendCountdown,
+    onIdentifierSuccess,
+    onError,
+    sourceUrl
+  ]);
+  const submitOTP = (0, import_react8.useCallback)(async (submitIdentifier, submitOtp) => {
+    if (!submitOtp || submitOtp.length < AUTH_CONSTANTS.EMAIL_OTP_LENGTH) {
+      const msg = `Please enter the ${AUTH_CONSTANTS.EMAIL_OTP_LENGTH}-digit verification code`;
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
+    setIsLoading(true);
+    clearError();
+    try {
+      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true, rememberMe);
+      if (result.requires_2fa && result.session_id) {
+        authLogger.info("2FA required after OTP verification");
+        beginTwoFactorChallenge({ sessionId: result.session_id });
+        saveIdentifierToStorage(submitIdentifier);
+        return true;
+      }
+      if (result.success) {
+        saveIdentifierToStorage(submitIdentifier);
+        authLogger.info("OTP verification successful, showing success screen");
+        setStep("success");
+        onOTPSuccess?.();
+        return true;
       } else {
-        serializeFormDataPair(data, key, value);
+        setError(result.message);
+        onError?.(result.message);
+        return false;
       }
-    });
-    return data;
-  }, "bodySerializer")
-};
-var jsonBodySerializer = {
-  bodySerializer: /* @__PURE__ */ __name((body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value), "bodySerializer")
-};
-
-// src/_api/generated/core/params.gen.ts
-var extraPrefixesMap = {
-  $body_: "body",
-  $headers_: "headers",
-  $path_: "path",
-  $query_: "query"
-};
-var extraPrefixes = Object.entries(extraPrefixesMap);
-
-// src/_api/generated/core/serverSentEvents.gen.ts
-function createSseClient({
-  onRequest,
-  onSseError,
-  onSseEvent,
-  responseTransformer,
-  responseValidator,
-  sseDefaultRetryDelay,
-  sseMaxRetryAttempts,
-  sseMaxRetryDelay,
-  sseSleepFn,
-  url,
-  ...options
-}) {
-  let lastEventId;
-  const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  const createStream = /* @__PURE__ */ __name(async function* () {
-    let retryDelay = sseDefaultRetryDelay ?? 3e3;
-    let attempt = 0;
-    const signal = options.signal ?? new AbortController().signal;
-    while (true) {
-      if (signal.aborted) break;
-      attempt++;
-      const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
-      if (lastEventId !== void 0) {
-        headers.set("Last-Event-ID", lastEventId);
+    } catch {
+      const msg = "An unexpected error occurred";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    } finally {
+      setIsLoading(false);
+    }
+  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, rememberMe, setStep]);
+  const handleOTPSubmit = (0, import_react8.useCallback)(async (e) => {
+    e.preventDefault();
+    await submitOTP(identifier, otp);
+  }, [identifier, otp, submitOTP]);
+  const submitPassword = (0, import_react8.useCallback)(async (submitIdentifier, submitPassword_) => {
+    if (!submitIdentifier || !validateIdentifier2(submitIdentifier)) {
+      const msg = "Please enter a valid email address";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
+    if (!submitPassword_) {
+      const msg = "Please enter your password";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
+    setIsLoading(true);
+    clearError();
+    try {
+      const result = await login(submitIdentifier, submitPassword_, {
+        redirectUrl,
+        skipRedirect: true,
+        rememberMe
+      });
+      if (result.requires_2fa && result.session_id) {
+        authLogger.info("2FA required after password login");
+        beginTwoFactorChallenge({ sessionId: result.session_id });
+        saveIdentifierToStorage(submitIdentifier);
+        return true;
       }
-      try {
-        const requestInit = {
-          redirect: "follow",
-          ...options,
-          body: options.serializedBody,
-          headers,
-          signal
-        };
-        let request = new Request(url, requestInit);
-        if (onRequest) {
-          request = await onRequest(url, requestInit);
+      if (result.success) {
+        saveIdentifierToStorage(submitIdentifier);
+        authLogger.info("Password login successful, showing success screen");
+        setStep("success");
+        onOTPSuccess?.();
+        return true;
+      }
+      if (result.retryAfter) {
+        startRateLimitCountdown(result.retryAfter);
+        clearError();
+      } else {
+        setError(result.message);
+        onError?.(result.message);
+      }
+      return false;
+    } catch {
+      const msg = "An unexpected error occurred";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    } finally {
+      setIsLoading(false);
+    }
+  }, [
+    login,
+    validateIdentifier2,
+    saveIdentifierToStorage,
+    setError,
+    setIsLoading,
+    clearError,
+    startRateLimitCountdown,
+    onOTPSuccess,
+    onError,
+    redirectUrl,
+    rememberMe,
+    setStep
+  ]);
+  const handlePasswordSubmit = (0, import_react8.useCallback)(async (e) => {
+    e.preventDefault();
+    await submitPassword(identifier, password);
+  }, [identifier, password, submitPassword]);
+  const handleResendOTP = (0, import_react8.useCallback)(async () => {
+    setIsLoading(true);
+    clearError();
+    try {
+      const consent = marketingConsentOption ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion } : void 0;
+      const result = await requestOTP(identifier, sourceUrl, consent);
+      if (result.success) {
+        saveIdentifierToStorage(identifier);
+        setWebmail(result.webmail ?? null);
+        startResendCountdown(result.resendIn ?? AUTH_CONSTANTS.RESEND_COOLDOWN_SECONDS);
+        setOtp("");
+      } else {
+        if (result.retryAfter) {
+          startRateLimitCountdown(result.retryAfter);
+          clearError();
+        } else {
+          setError(result.message);
+          onError?.(result.message);
+        }
+      }
+    } catch {
+      const msg = "Failed to resend verification code";
+      setError(msg);
+      onError?.(msg);
+    } finally {
+      setIsLoading(false);
+    }
+  }, [identifier, marketingConsent, marketingConsentOption, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, startRateLimitCountdown, startResendCountdown, setWebmail, onError, sourceUrl]);
+  const handleBackToIdentifier = (0, import_react8.useCallback)(() => {
+    setStep("identifier");
+    clearError();
+  }, [setStep, clearError]);
+  const forceOTPStep = (0, import_react8.useCallback)(() => {
+    setStep("otp");
+    clearError();
+  }, [setStep, clearError]);
+  const handleOTPFromUrl = (0, import_react8.useCallback)((detectedOtp, detectedEmail) => {
+    const autoIdentifier = detectedEmail || getSavedEmail() || "";
+    if (!autoIdentifier) {
+      authLogger.warn("No identifier found for auto-submit (no email in URL or storage)");
+      return;
+    }
+    const otpKey = `${autoIdentifier}:${detectedOtp}`;
+    if (processedOtpKeyRef.current === otpKey) return;
+    if (isAutoSubmitFromUrlRef.current) return;
+    processedOtpKeyRef.current = otpKey;
+    isAutoSubmitFromUrlRef.current = true;
+    authLogger.info("OTP detected from URL, auto-submitting");
+    setIdentifier(autoIdentifier);
+    setOtp(detectedOtp);
+    setStep("otp");
+    setTimeout(async () => {
+      try {
+        await submitOTP(autoIdentifier, detectedOtp);
+      } finally {
+        isAutoSubmitFromUrlRef.current = false;
+      }
+    }, 100);
+  }, [getSavedEmail, setIdentifier, setOtp, setStep, submitOTP]);
+  useAutoAuth({
+    allowedPaths: [authPath],
+    onOTPDetected: handleOTPFromUrl,
+    cleanupUrl: true
+  });
+  return {
+    // State
+    ...formState,
+    // Submit handlers
+    handleIdentifierSubmit,
+    handleOTPSubmit,
+    handlePasswordSubmit,
+    handleResendOTP,
+    handleBackToIdentifier,
+    forceOTPStep,
+    // Validation
+    ...validation,
+    // Auto-submit ref
+    isAutoSubmittingFromUrl: isAutoSubmitFromUrlRef
+  };
+}, "useAuthForm");
+
+// src/auth/hooks/useGithubAuth.ts
+var import_react9 = require("react");
+
+// src/_api/generated/core/bodySerializer.gen.ts
+var serializeFormDataPair = /* @__PURE__ */ __name((data, key, value) => {
+  if (typeof value === "string" || value instanceof Blob) {
+    data.append(key, value);
+  } else if (value instanceof Date) {
+    data.append(key, value.toISOString());
+  } else {
+    data.append(key, JSON.stringify(value));
+  }
+}, "serializeFormDataPair");
+var formDataBodySerializer = {
+  bodySerializer: /* @__PURE__ */ __name((body) => {
+    const data = new FormData();
+    Object.entries(body).forEach(([key, value]) => {
+      if (value === void 0 || value === null) {
+        return;
+      }
+      if (Array.isArray(value)) {
+        value.forEach((v) => serializeFormDataPair(data, key, v));
+      } else {
+        serializeFormDataPair(data, key, value);
+      }
+    });
+    return data;
+  }, "bodySerializer")
+};
+var jsonBodySerializer = {
+  bodySerializer: /* @__PURE__ */ __name((body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value), "bodySerializer")
+};
+
+// src/_api/generated/core/params.gen.ts
+var extraPrefixesMap = {
+  $body_: "body",
+  $headers_: "headers",
+  $path_: "path",
+  $query_: "query"
+};
+var extraPrefixes = Object.entries(extraPrefixesMap);
+
+// src/_api/generated/core/serverSentEvents.gen.ts
+function createSseClient({
+  onRequest,
+  onSseError,
+  onSseEvent,
+  responseTransformer,
+  responseValidator,
+  sseDefaultRetryDelay,
+  sseMaxRetryAttempts,
+  sseMaxRetryDelay,
+  sseSleepFn,
+  url,
+  ...options
+}) {
+  let lastEventId;
+  const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const createStream = /* @__PURE__ */ __name(async function* () {
+    let retryDelay = sseDefaultRetryDelay ?? 3e3;
+    let attempt = 0;
+    const signal = options.signal ?? new AbortController().signal;
+    while (true) {
+      if (signal.aborted) break;
+      attempt++;
+      const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
+      if (lastEventId !== void 0) {
+        headers.set("Last-Event-ID", lastEventId);
+      }
+      try {
+        const requestInit = {
+          redirect: "follow",
+          ...options,
+          body: options.serializedBody,
+          headers,
+          signal
+        };
+        let request = new Request(url, requestInit);
+        if (onRequest) {
+          request = await onRequest(url, requestInit);
         }
         const _fetch = options.fetch ?? globalThis.fetch;
         const response = await _fetch(request);
@@ -2758,63 +3085,183 @@ var logAuthFailure = /* @__PURE__ */ __name((log, message, error) => {
   log.error(message, error);
 }, "logAuthFailure");
 
-// src/auth/hooks/useSessionStorage.ts
-var import_react7 = require("react");
-
-// src/auth/utils/storage.ts
-var MAX_ITEM_KB = 1024;
-function isQuotaExceededError(error) {
-  if (typeof error !== "object" || error === null) return false;
-  const { name, code, message } = error;
-  return name === "QuotaExceededError" || code === 22 || typeof message === "string" && message.includes("quota");
-}
-__name(isQuotaExceededError, "isQuotaExceededError");
-function isWithinSizeLimit(data, key) {
-  try {
-    const sizeInKB = new Blob([JSON.stringify(data)]).size / 1024;
-    if (sizeInKB > MAX_ITEM_KB) {
-      authLogger.warn(
-        `Data size (${sizeInKB.toFixed(2)}KB) exceeds 1MB limit for key "${key}"`
-      );
-      return false;
-    }
-    return true;
-  } catch (error) {
-    authLogger.error(`Error checking data size for key "${key}":`, error);
-    return false;
-  }
-}
-__name(isWithinSizeLimit, "isWithinSizeLimit");
-
-// src/auth/hooks/useSessionStorage.ts
-function useSessionStorage(key, initialValue) {
-  const [storedValue, setStoredValue] = (0, import_react7.useState)(() => {
-    if (typeof window === "undefined") {
-      return initialValue;
-    }
-    try {
-      const item = window.sessionStorage.getItem(key);
-      return item ? JSON.parse(item) : initialValue;
-    } catch (error) {
-      authLogger.error(`Error reading sessionStorage key "${key}":`, error);
-      return initialValue;
-    }
-  });
-  const clearOldData = /* @__PURE__ */ __name(() => {
+// src/auth/hooks/useGithubAuth.ts
+var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
+  const { sourceUrl, rememberMe = false, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
+  const router = useCfgRouter();
+  const [isLoading, setIsLoading] = (0, import_react9.useState)(false);
+  const [error, setError] = (0, import_react9.useState)(null);
+  const startGithubAuth = (0, import_react9.useCallback)(async () => {
+    setIsLoading(true);
+    setError(null);
+    auth.clearSession();
     try {
-      const keys = Object.keys(sessionStorage).filter((key2) => key2 && typeof key2 === "string");
-      if (keys.length > 50) {
-        const itemsToRemove = Math.ceil(keys.length * 0.2);
-        for (let i = 0; i < itemsToRemove; i++) {
-          try {
-            const key2 = keys[i];
-            if (key2) {
-              sessionStorage.removeItem(key2);
-              sessionStorage.removeItem(`${key2}_timestamp`);
-            }
-          } catch {
-          }
-        }
+      authLogger.info("Starting GitHub OAuth flow...");
+      Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
+        category: "auth" /* AUTH */,
+        label: "github"
+      });
+      const result = await CfgAccountsOauth.cfgAccountsOauthGithubAuthorizeCreate({
+        body: {
+          source_url: sourceUrl || (typeof window !== "undefined" ? window.location.href : "")
+        },
+        throwOnError: true
+      });
+      const response = result.data;
+      if (!response.authorization_url) {
+        throw new Error("Failed to get authorization URL");
+      }
+      authLogger.info("Redirecting to GitHub...", response.authorization_url);
+      if (typeof window !== "undefined") {
+        sessionStorage.setItem("oauth_state", response.state);
+        sessionStorage.setItem("oauth_provider", "github");
+        sessionStorage.setItem("cfg.oauth.remember_me", String(rememberMe));
+      }
+      window.location.href = response.authorization_url;
+    } catch (err) {
+      const errorMessage = formatAuthError(err, "Failed to start GitHub authentication");
+      authLogger.error("GitHub OAuth start error:", err);
+      setError(errorMessage);
+      onError?.(errorMessage);
+      Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
+        category: "auth" /* AUTH */,
+        label: "github"
+      });
+    } finally {
+      setIsLoading(false);
+    }
+  }, [sourceUrl, rememberMe, onError]);
+  const handleGithubCallback = (0, import_react9.useCallback)(async (code, state) => {
+    setIsLoading(true);
+    setError(null);
+    try {
+      authLogger.info("Processing GitHub OAuth callback...");
+      let rememberMeForSession = false;
+      if (typeof window !== "undefined") {
+        const storedState = sessionStorage.getItem("oauth_state");
+        if (storedState && storedState !== state) {
+          throw new Error("Invalid OAuth state - possible CSRF attack");
+        }
+        rememberMeForSession = sessionStorage.getItem("cfg.oauth.remember_me") === "true";
+        sessionStorage.removeItem("oauth_state");
+        sessionStorage.removeItem("oauth_provider");
+        sessionStorage.removeItem("cfg.oauth.remember_me");
+      }
+      const result = await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({
+        body: { code, state, remember_me: rememberMeForSession },
+        throwOnError: true
+      });
+      const response = result.data;
+      if (response.requires_2fa && response.session_id) {
+        authLogger.info("GitHub OAuth requires 2FA, session:", response.session_id);
+        Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
+          category: "auth" /* AUTH */,
+          label: "github-2fa-required"
+        });
+        onRequires2FA?.(response.session_id, response.should_prompt_2fa || false);
+        return;
+      }
+      if (!response.access || !response.refresh) {
+        throw new Error("Invalid response from OAuth callback");
+      }
+      authLogger.info("GitHub OAuth successful, user:", response.user);
+      auth.setSession({ access: response.access, refresh: response.refresh });
+      Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
+        category: "auth" /* AUTH */,
+        label: "github"
+      });
+      if (response.user?.id) {
+        Analytics.setUser(String(response.user.id));
+      }
+      if (response.user) {
+        onSuccess?.(response.user, response.is_new_user || false);
+      }
+      if (!skipRedirect) {
+        const finalRedirectUrl = redirectUrl || "/private";
+        router.hardPush(finalRedirectUrl);
+      }
+      return;
+    } catch (err) {
+      const errorMessage = formatAuthError(err, "GitHub authentication failed");
+      authLogger.error("GitHub OAuth callback error:", err);
+      setError(errorMessage);
+      onError?.(errorMessage);
+      Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
+        category: "auth" /* AUTH */,
+        label: "github"
+      });
+    } finally {
+      setIsLoading(false);
+    }
+  }, [onSuccess, onError, onRequires2FA, redirectUrl, router, skipRedirect]);
+  return {
+    isLoading,
+    error,
+    startGithubAuth,
+    handleGithubCallback
+  };
+}, "useGithubAuth");
+
+// src/auth/hooks/useTwoFactorVerify.ts
+var import_react11 = require("react");
+
+// src/auth/hooks/useSessionStorage.ts
+var import_react10 = require("react");
+
+// src/auth/utils/storage.ts
+var MAX_ITEM_KB = 1024;
+function isQuotaExceededError(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const { name, code, message } = error;
+  return name === "QuotaExceededError" || code === 22 || typeof message === "string" && message.includes("quota");
+}
+__name(isQuotaExceededError, "isQuotaExceededError");
+function isWithinSizeLimit(data, key) {
+  try {
+    const sizeInKB = new Blob([JSON.stringify(data)]).size / 1024;
+    if (sizeInKB > MAX_ITEM_KB) {
+      authLogger.warn(
+        `Data size (${sizeInKB.toFixed(2)}KB) exceeds 1MB limit for key "${key}"`
+      );
+      return false;
+    }
+    return true;
+  } catch (error) {
+    authLogger.error(`Error checking data size for key "${key}":`, error);
+    return false;
+  }
+}
+__name(isWithinSizeLimit, "isWithinSizeLimit");
+
+// src/auth/hooks/useSessionStorage.ts
+function useSessionStorage(key, initialValue) {
+  const [storedValue, setStoredValue] = (0, import_react10.useState)(() => {
+    if (typeof window === "undefined") {
+      return initialValue;
+    }
+    try {
+      const item = window.sessionStorage.getItem(key);
+      return item ? JSON.parse(item) : initialValue;
+    } catch (error) {
+      authLogger.error(`Error reading sessionStorage key "${key}":`, error);
+      return initialValue;
+    }
+  });
+  const clearOldData = /* @__PURE__ */ __name(() => {
+    try {
+      const keys = Object.keys(sessionStorage).filter((key2) => key2 && typeof key2 === "string");
+      if (keys.length > 50) {
+        const itemsToRemove = Math.ceil(keys.length * 0.2);
+        for (let i = 0; i < itemsToRemove; i++) {
+          try {
+            const key2 = keys[i];
+            if (key2) {
+              sessionStorage.removeItem(key2);
+              sessionStorage.removeItem(`${key2}_timestamp`);
+            }
+          } catch {
+          }
+        }
       }
     } catch (error) {
       authLogger.error("Error clearing old sessionStorage data:", error);
@@ -2991,642 +3438,162 @@ function isValidTotpCode(code) {
 }
 __name(isValidTotpCode, "isValidTotpCode");
 
-// src/auth/hooks/useTwoFactorVerify.ts
-var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
-  const { onSuccess, onError, redirectUrl, skipRedirect = false } = options;
-  const router = useCfgRouter();
-  const [isLoading, setIsLoading] = (0, import_react8.useState)(false);
-  const [error, setError] = (0, import_react8.useState)(null);
-  const [warning, setWarning] = (0, import_react8.useState)(null);
-  const [remainingBackupCodes, setRemainingBackupCodes] = (0, import_react8.useState)(null);
-  const [attemptsRemaining, setAttemptsRemaining] = (0, import_react8.useState)(null);
-  const clearError = (0, import_react8.useCallback)(() => {
-    setError(null);
-  }, []);
-  const handleSuccess = (0, import_react8.useCallback)((response) => {
-    auth.setSession({ access: response.access_token, refresh: response.refresh_token });
-    if (response.warning) {
-      setWarning(response.warning);
-    }
-    if (response.remaining_backup_codes !== void 0) {
-      setRemainingBackupCodes(response.remaining_backup_codes);
-    }
-    Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
-      category: "auth" /* AUTH */,
-      label: "2fa"
-    });
-    if (response.user?.id) {
-      Analytics.setUser(String(response.user.id));
-    }
-    onSuccess?.(response.user);
-    if (!skipRedirect) {
-      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || "/private";
-      authLogger.info("2FA successful, redirecting to:", finalRedirectUrl);
-      router.hardPush(finalRedirectUrl);
-    }
-  }, [onSuccess, redirectUrl, router, skipRedirect]);
-  const verifyTOTP = (0, import_react8.useCallback)(async (sessionId, code) => {
-    if (!sessionId) {
-      const msg = "Missing 2FA session ID";
-      setError(msg);
-      onError?.(msg);
-      return false;
-    }
-    if (!isValidTotpCode(code)) {
-      const msg = "Please enter a 6-digit code";
-      setError(msg);
-      onError?.(msg);
-      return false;
-    }
-    setIsLoading(true);
-    setError(null);
-    try {
-      authLogger.info("Verifying TOTP code...");
-      const result = await CfgTotpVerify.cfgTotpVerifyCreate({
-        body: { session_id: sessionId, code },
-        throwOnError: true
-      });
-      const response = result.data;
-      if (!response.access_token || !response.refresh_token) {
-        throw new Error("Invalid response from 2FA verification");
-      }
-      handleSuccess(response);
-      return true;
-    } catch (err) {
-      logAuthFailure(authLogger, "2FA TOTP verification failed:", err);
-      const errorMessage = formatAuthError(err, "Invalid verification code");
-      const attempts = extractAttemptsRemaining(err);
-      if (attempts !== null) setAttemptsRemaining(attempts);
-      setError(errorMessage);
-      onError?.(errorMessage);
-      Analytics.event("auth_otp_verify_fail" /* AUTH_OTP_VERIFY_FAIL */, {
-        category: "auth" /* AUTH */,
-        label: "2fa-totp"
-      });
-      return false;
-    } finally {
-      setIsLoading(false);
-    }
-  }, [handleSuccess, onError]);
-  const verifyBackupCode = (0, import_react8.useCallback)(async (sessionId, backupCode) => {
-    if (!sessionId) {
-      const msg = "Missing 2FA session ID";
-      setError(msg);
-      onError?.(msg);
-      return false;
-    }
-    if (!backupCode || backupCode.length < 8) {
-      const msg = "Please enter your backup code";
-      setError(msg);
-      onError?.(msg);
-      return false;
-    }
-    setIsLoading(true);
-    setError(null);
-    try {
-      authLogger.info("Verifying backup code...");
-      const result = await CfgTotpVerify.cfgTotpVerifyBackupCreate({
-        body: {
-          session_id: sessionId,
-          backup_code: backupCode.replace(/\s+/g, "")
-        },
-        throwOnError: true
-      });
-      const response = result.data;
-      if (!response.access_token || !response.refresh_token) {
-        throw new Error("Invalid response from backup code verification");
-      }
-      handleSuccess(response);
-      return true;
-    } catch (err) {
-      logAuthFailure(authLogger, "2FA backup code verification failed:", err);
-      const errorMessage = formatAuthError(err, "Invalid backup code");
-      const attempts = extractAttemptsRemaining(err);
-      if (attempts !== null) setAttemptsRemaining(attempts);
-      setError(errorMessage);
-      onError?.(errorMessage);
-      Analytics.event("auth_otp_verify_fail" /* AUTH_OTP_VERIFY_FAIL */, {
-        category: "auth" /* AUTH */,
-        label: "2fa-backup"
-      });
-      return false;
-    } finally {
-      setIsLoading(false);
-    }
-  }, [handleSuccess, onError]);
-  return {
-    isLoading,
-    error,
-    warning,
-    remainingBackupCodes,
-    attemptsRemaining,
-    verifyTOTP,
-    verifyBackupCode,
-    clearError
-  };
-}, "useTwoFactorVerify");
-
-// src/auth/hooks/useAuthForm.ts
-var useAuthForm = /* @__PURE__ */ __name((options) => {
-  const {
-    onIdentifierSuccess,
-    onOTPSuccess,
-    onError,
-    sourceUrl,
-    redirectUrl,
-    requireTermsAcceptance = false,
-    marketingConsent: marketingConsentOption,
-    authPath = "/auth"
-  } = options;
-  const formState = useAuthFormState();
-  const validation = useAuthValidation();
-  const isAutoSubmitFromUrlRef = (0, import_react9.useRef)(false);
-  const processedOtpKeyRef = (0, import_react9.useRef)(null);
-  const {
-    requestOTP,
-    verifyOTP,
-    login,
-    getSavedEmail,
-    saveEmail
-  } = useAuth();
-  const {
-    identifier,
-    otp,
-    password,
-    acceptedTerms,
-    marketingConsent,
-    rememberMe,
-    twoFactorSessionId,
-    twoFactorCode,
-    useBackupCode,
-    setIdentifier,
-    setOtp,
-    setStep,
-    setError,
-    setIsLoading,
-    clearError,
-    setTwoFactorSessionId,
-    setShouldPrompt2FA,
-    setTwoFactorCode,
-    setUseBackupCode,
-    startRateLimitCountdown,
-    setWebmail
-  } = formState;
-  const twoFactor = useTwoFactorVerify({
-    onSuccess: /* @__PURE__ */ __name(() => {
-      authLogger.info("2FA verification successful, showing success screen");
-      setStep("success");
-      onOTPSuccess?.();
-    }, "onSuccess"),
-    onError: /* @__PURE__ */ __name((error) => {
-      setError(error);
-      onError?.(error);
-    }, "onError"),
-    redirectUrl,
-    skipRedirect: true
-    // We handle navigation via success step
-  });
-  const { validateIdentifier: validateIdentifier2 } = validation;
-  const saveIdentifierToStorage = (0, import_react9.useCallback)((id) => {
-    saveEmail(id);
-  }, [saveEmail]);
-  (0, import_react9.useEffect)(() => {
-    const savedEmail = getSavedEmail();
-    if (savedEmail) {
-      setIdentifier(savedEmail);
-    }
-  }, []);
-  const handleIdentifierSubmit = (0, import_react9.useCallback)(async (e) => {
-    e.preventDefault();
-    if (!identifier) {
-      const msg = "Please enter your email address";
-      setError(msg);
-      onError?.(msg);
-      return;
-    }
-    if (!validateIdentifier2(identifier)) {
-      const msg = "Please enter a valid email address";
-      setError(msg);
-      onError?.(msg);
-      return;
-    }
-    if (requireTermsAcceptance && !acceptedTerms) {
-      const msg = "Please accept the Terms of Service and Privacy Policy";
-      setError(msg);
-      onError?.(msg);
-      return;
-    }
-    setIsLoading(true);
-    clearError();
-    try {
-      const consent = marketingConsentOption ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion } : void 0;
-      const result = await requestOTP(identifier, sourceUrl, consent);
-      if (result.success) {
-        saveIdentifierToStorage(identifier);
-        setWebmail(result.webmail ?? null);
-        setStep("otp");
-        onIdentifierSuccess?.(identifier);
-      } else {
-        if (result.retryAfter) {
-          startRateLimitCountdown(result.retryAfter);
-          clearError();
-        } else {
-          setError(result.message);
-          onError?.(result.message);
-        }
-      }
-    } catch {
-      const msg = "An unexpected error occurred";
-      setError(msg);
-      onError?.(msg);
-    } finally {
-      setIsLoading(false);
-    }
-  }, [
-    identifier,
-    acceptedTerms,
-    requireTermsAcceptance,
-    marketingConsent,
-    marketingConsentOption,
-    validateIdentifier2,
-    requestOTP,
-    saveIdentifierToStorage,
-    setError,
-    setIsLoading,
-    setStep,
-    clearError,
-    setWebmail,
-    startRateLimitCountdown,
-    onIdentifierSuccess,
-    onError,
-    sourceUrl
-  ]);
-  const submitOTP = (0, import_react9.useCallback)(async (submitIdentifier, submitOtp) => {
-    if (!submitOtp || submitOtp.length < AUTH_CONSTANTS.EMAIL_OTP_LENGTH) {
-      const msg = `Please enter the ${AUTH_CONSTANTS.EMAIL_OTP_LENGTH}-digit verification code`;
-      setError(msg);
-      onError?.(msg);
-      return false;
-    }
-    setIsLoading(true);
-    clearError();
-    try {
-      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true, rememberMe);
-      if (result.requires_2fa && result.session_id) {
-        authLogger.info("2FA required after OTP verification");
-        setTwoFactorSessionId(result.session_id);
-        setShouldPrompt2FA(result.should_prompt_2fa || false);
-        setStep("2fa");
-        saveIdentifierToStorage(submitIdentifier);
-        return true;
-      }
-      if (result.success) {
-        saveIdentifierToStorage(submitIdentifier);
-        authLogger.info("OTP verification successful, showing success screen");
-        setStep("success");
-        onOTPSuccess?.();
-        return true;
-      } else {
-        setError(result.message);
-        onError?.(result.message);
-        return false;
-      }
-    } catch {
-      const msg = "An unexpected error occurred";
-      setError(msg);
-      onError?.(msg);
-      return false;
-    } finally {
-      setIsLoading(false);
-    }
-  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, rememberMe, setTwoFactorSessionId, setShouldPrompt2FA, setStep]);
-  const handleOTPSubmit = (0, import_react9.useCallback)(async (e) => {
-    e.preventDefault();
-    await submitOTP(identifier, otp);
-  }, [identifier, otp, submitOTP]);
-  const submitPassword = (0, import_react9.useCallback)(async (submitIdentifier, submitPassword_) => {
-    if (!submitIdentifier || !validateIdentifier2(submitIdentifier)) {
-      const msg = "Please enter a valid email address";
-      setError(msg);
-      onError?.(msg);
-      return false;
-    }
-    if (!submitPassword_) {
-      const msg = "Please enter your password";
-      setError(msg);
-      onError?.(msg);
-      return false;
-    }
-    setIsLoading(true);
-    clearError();
-    try {
-      const result = await login(submitIdentifier, submitPassword_, {
-        redirectUrl,
-        skipRedirect: true,
-        rememberMe
-      });
-      if (result.requires_2fa && result.session_id) {
-        authLogger.info("2FA required after password login");
-        setTwoFactorSessionId(result.session_id);
-        setShouldPrompt2FA(result.should_prompt_2fa || false);
-        setStep("2fa");
-        saveIdentifierToStorage(submitIdentifier);
-        return true;
-      }
-      if (result.success) {
-        saveIdentifierToStorage(submitIdentifier);
-        authLogger.info("Password login successful, showing success screen");
-        setStep("success");
-        onOTPSuccess?.();
-        return true;
-      }
-      if (result.retryAfter) {
-        startRateLimitCountdown(result.retryAfter);
-        clearError();
-      } else {
-        setError(result.message);
-        onError?.(result.message);
-      }
-      return false;
-    } catch {
-      const msg = "An unexpected error occurred";
-      setError(msg);
-      onError?.(msg);
-      return false;
-    } finally {
-      setIsLoading(false);
-    }
-  }, [
-    login,
-    validateIdentifier2,
-    saveIdentifierToStorage,
-    setError,
-    setIsLoading,
-    clearError,
-    startRateLimitCountdown,
-    onOTPSuccess,
-    onError,
-    redirectUrl,
-    rememberMe,
-    setTwoFactorSessionId,
-    setShouldPrompt2FA,
-    setStep
-  ]);
-  const handlePasswordSubmit = (0, import_react9.useCallback)(async (e) => {
-    e.preventDefault();
-    await submitPassword(identifier, password);
-  }, [identifier, password, submitPassword]);
-  const handleResendOTP = (0, import_react9.useCallback)(async () => {
-    setIsLoading(true);
-    clearError();
-    try {
-      const consent = marketingConsentOption ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion } : void 0;
-      const result = await requestOTP(identifier, sourceUrl, consent);
-      if (result.success) {
-        saveIdentifierToStorage(identifier);
-        setWebmail(result.webmail ?? null);
-        setOtp("");
-      } else {
-        if (result.retryAfter) {
-          startRateLimitCountdown(result.retryAfter);
-          clearError();
-        } else {
-          setError(result.message);
-          onError?.(result.message);
-        }
-      }
-    } catch {
-      const msg = "Failed to resend verification code";
+// src/auth/hooks/useTwoFactorVerify.ts
+var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
+  const { onSuccess, onError, redirectUrl, skipRedirect = false } = options;
+  const router = useCfgRouter();
+  const [isLoading, setIsLoading] = (0, import_react11.useState)(false);
+  const [error, setError] = (0, import_react11.useState)(null);
+  const [warning, setWarning] = (0, import_react11.useState)(null);
+  const [remainingBackupCodes, setRemainingBackupCodes] = (0, import_react11.useState)(null);
+  const [attemptsRemaining, setAttemptsRemaining] = (0, import_react11.useState)(null);
+  const clearError = (0, import_react11.useCallback)(() => {
+    setError(null);
+  }, []);
+  const handleSuccess = (0, import_react11.useCallback)((response) => {
+    auth.setSession({ access: response.access_token, refresh: response.refresh_token });
+    if (response.warning) {
+      setWarning(response.warning);
+    }
+    if (response.remaining_backup_codes !== void 0) {
+      setRemainingBackupCodes(response.remaining_backup_codes);
+    }
+    Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
+      category: "auth" /* AUTH */,
+      label: "2fa"
+    });
+    if (response.user?.id) {
+      Analytics.setUser(String(response.user.id));
+    }
+    onSuccess?.(response.user);
+    if (!skipRedirect) {
+      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || "/private";
+      authLogger.info("2FA successful, redirecting to:", finalRedirectUrl);
+      router.hardPush(finalRedirectUrl);
+    }
+  }, [onSuccess, redirectUrl, router, skipRedirect]);
+  const verifyTOTP = (0, import_react11.useCallback)(async (sessionId, code) => {
+    if (!sessionId) {
+      const msg = "Missing 2FA session ID";
       setError(msg);
       onError?.(msg);
-    } finally {
-      setIsLoading(false);
+      return false;
     }
-  }, [identifier, marketingConsent, marketingConsentOption, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, startRateLimitCountdown, setWebmail, onError, sourceUrl]);
-  const handleBackToIdentifier = (0, import_react9.useCallback)(() => {
-    setStep("identifier");
-    clearError();
-  }, [setStep, clearError]);
-  const forceOTPStep = (0, import_react9.useCallback)(() => {
-    setStep("otp");
-    clearError();
-  }, [setStep, clearError]);
-  const handle2FASubmit = (0, import_react9.useCallback)(async (e) => {
-    e.preventDefault();
-    if (!twoFactorSessionId) {
-      const msg = "Missing 2FA session";
+    if (!isValidTotpCode(code)) {
+      const msg = "Please enter a 6-digit code";
       setError(msg);
       onError?.(msg);
-      return;
-    }
-    if (useBackupCode) {
-      await twoFactor.verifyBackupCode(twoFactorSessionId, twoFactorCode);
-    } else {
-      await twoFactor.verifyTOTP(twoFactorSessionId, twoFactorCode);
-    }
-  }, [twoFactorSessionId, twoFactorCode, useBackupCode, twoFactor, setError, onError]);
-  const handleUseBackupCode = (0, import_react9.useCallback)(() => {
-    setUseBackupCode(true);
-    setTwoFactorCode("");
-    clearError();
-  }, [setUseBackupCode, setTwoFactorCode, clearError]);
-  const handleUseTOTP = (0, import_react9.useCallback)(() => {
-    setUseBackupCode(false);
-    setTwoFactorCode("");
-    clearError();
-  }, [setUseBackupCode, setTwoFactorCode, clearError]);
-  const handleOTPFromUrl = (0, import_react9.useCallback)((detectedOtp, detectedEmail) => {
-    const autoIdentifier = detectedEmail || getSavedEmail() || "";
-    if (!autoIdentifier) {
-      authLogger.warn("No identifier found for auto-submit (no email in URL or storage)");
-      return;
+      return false;
     }
-    const otpKey = `${autoIdentifier}:${detectedOtp}`;
-    if (processedOtpKeyRef.current === otpKey) return;
-    if (isAutoSubmitFromUrlRef.current) return;
-    processedOtpKeyRef.current = otpKey;
-    isAutoSubmitFromUrlRef.current = true;
-    authLogger.info("OTP detected from URL, auto-submitting");
-    setIdentifier(autoIdentifier);
-    setOtp(detectedOtp);
-    setStep("otp");
-    setTimeout(async () => {
-      try {
-        await submitOTP(autoIdentifier, detectedOtp);
-      } finally {
-        isAutoSubmitFromUrlRef.current = false;
-      }
-    }, 100);
-  }, [getSavedEmail, setIdentifier, setOtp, setStep, submitOTP]);
-  useAutoAuth({
-    allowedPaths: [authPath],
-    onOTPDetected: handleOTPFromUrl,
-    cleanupUrl: true
-  });
-  return {
-    // State
-    ...formState,
-    // Submit handlers
-    handleIdentifierSubmit,
-    handleOTPSubmit,
-    handlePasswordSubmit,
-    handleResendOTP,
-    handleBackToIdentifier,
-    forceOTPStep,
-    // 2FA handlers
-    handle2FASubmit,
-    handleUseBackupCode,
-    handleUseTOTP,
-    // Validation
-    ...validation,
-    // Auto-submit ref
-    isAutoSubmittingFromUrl: isAutoSubmitFromUrlRef,
-    // 2FA state from hook (for loading indicator)
-    is2FALoading: twoFactor.isLoading,
-    twoFactorWarning: twoFactor.warning,
-    twoFactorAttemptsRemaining: twoFactor.attemptsRemaining
-  };
-}, "useAuthForm");
-
-// src/auth/hooks/useGithubAuth.ts
-var import_react10 = require("react");
-var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
-  const { sourceUrl, rememberMe = false, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
-  const router = useCfgRouter();
-  const [isLoading, setIsLoading] = (0, import_react10.useState)(false);
-  const [error, setError] = (0, import_react10.useState)(null);
-  const startGithubAuth = (0, import_react10.useCallback)(async () => {
     setIsLoading(true);
     setError(null);
-    auth.clearSession();
     try {
-      authLogger.info("Starting GitHub OAuth flow...");
-      Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-      const result = await CfgAccountsOauth.cfgAccountsOauthGithubAuthorizeCreate({
-        body: {
-          source_url: sourceUrl || (typeof window !== "undefined" ? window.location.href : "")
-        },
+      authLogger.info("Verifying TOTP code...");
+      const result = await CfgTotpVerify.cfgTotpVerifyCreate({
+        body: { session_id: sessionId, code },
         throwOnError: true
       });
       const response = result.data;
-      if (!response.authorization_url) {
-        throw new Error("Failed to get authorization URL");
-      }
-      authLogger.info("Redirecting to GitHub...", response.authorization_url);
-      if (typeof window !== "undefined") {
-        sessionStorage.setItem("oauth_state", response.state);
-        sessionStorage.setItem("oauth_provider", "github");
-        sessionStorage.setItem("cfg.oauth.remember_me", String(rememberMe));
+      if (!response.access_token || !response.refresh_token) {
+        throw new Error("Invalid response from 2FA verification");
       }
-      window.location.href = response.authorization_url;
+      handleSuccess(response);
+      return true;
     } catch (err) {
-      const errorMessage = formatAuthError(err, "Failed to start GitHub authentication");
-      authLogger.error("GitHub OAuth start error:", err);
+      logAuthFailure(authLogger, "2FA TOTP verification failed:", err);
+      const errorMessage = formatAuthError(err, "Invalid verification code");
+      const attempts = extractAttemptsRemaining(err);
+      if (attempts !== null) setAttemptsRemaining(attempts);
       setError(errorMessage);
       onError?.(errorMessage);
-      Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
+      Analytics.event("auth_otp_verify_fail" /* AUTH_OTP_VERIFY_FAIL */, {
         category: "auth" /* AUTH */,
-        label: "github"
+        label: "2fa-totp"
       });
+      return false;
     } finally {
       setIsLoading(false);
     }
-  }, [sourceUrl, rememberMe, onError]);
-  const handleGithubCallback = (0, import_react10.useCallback)(async (code, state) => {
+  }, [handleSuccess, onError]);
+  const verifyBackupCode = (0, import_react11.useCallback)(async (sessionId, backupCode) => {
+    if (!sessionId) {
+      const msg = "Missing 2FA session ID";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
+    if (!backupCode || backupCode.length < 8) {
+      const msg = "Please enter your backup code";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
     setIsLoading(true);
     setError(null);
     try {
-      authLogger.info("Processing GitHub OAuth callback...");
-      let rememberMeForSession = false;
-      if (typeof window !== "undefined") {
-        const storedState = sessionStorage.getItem("oauth_state");
-        if (storedState && storedState !== state) {
-          throw new Error("Invalid OAuth state - possible CSRF attack");
-        }
-        rememberMeForSession = sessionStorage.getItem("cfg.oauth.remember_me") === "true";
-        sessionStorage.removeItem("oauth_state");
-        sessionStorage.removeItem("oauth_provider");
-        sessionStorage.removeItem("cfg.oauth.remember_me");
-      }
-      const result = await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({
-        body: { code, state, remember_me: rememberMeForSession },
+      authLogger.info("Verifying backup code...");
+      const result = await CfgTotpVerify.cfgTotpVerifyBackupCreate({
+        body: {
+          session_id: sessionId,
+          backup_code: backupCode.replace(/\s+/g, "")
+        },
         throwOnError: true
       });
       const response = result.data;
-      if (response.requires_2fa && response.session_id) {
-        authLogger.info("GitHub OAuth requires 2FA, session:", response.session_id);
-        Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
-          category: "auth" /* AUTH */,
-          label: "github-2fa-required"
-        });
-        onRequires2FA?.(response.session_id, response.should_prompt_2fa || false);
-        return;
-      }
-      if (!response.access || !response.refresh) {
-        throw new Error("Invalid response from OAuth callback");
-      }
-      authLogger.info("GitHub OAuth successful, user:", response.user);
-      auth.setSession({ access: response.access, refresh: response.refresh });
-      Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-      if (response.user?.id) {
-        Analytics.setUser(String(response.user.id));
-      }
-      if (response.user) {
-        onSuccess?.(response.user, response.is_new_user || false);
-      }
-      if (!skipRedirect) {
-        const finalRedirectUrl = redirectUrl || "/private";
-        router.hardPush(finalRedirectUrl);
+      if (!response.access_token || !response.refresh_token) {
+        throw new Error("Invalid response from backup code verification");
       }
-      return;
+      handleSuccess(response);
+      return true;
     } catch (err) {
-      const errorMessage = formatAuthError(err, "GitHub authentication failed");
-      authLogger.error("GitHub OAuth callback error:", err);
+      logAuthFailure(authLogger, "2FA backup code verification failed:", err);
+      const errorMessage = formatAuthError(err, "Invalid backup code");
+      const attempts = extractAttemptsRemaining(err);
+      if (attempts !== null) setAttemptsRemaining(attempts);
       setError(errorMessage);
       onError?.(errorMessage);
-      Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
+      Analytics.event("auth_otp_verify_fail" /* AUTH_OTP_VERIFY_FAIL */, {
         category: "auth" /* AUTH */,
-        label: "github"
+        label: "2fa-backup"
       });
+      return false;
     } finally {
       setIsLoading(false);
     }
-  }, [onSuccess, onError, onRequires2FA, redirectUrl, router, skipRedirect]);
+  }, [handleSuccess, onError]);
   return {
     isLoading,
     error,
-    startGithubAuth,
-    handleGithubCallback
+    warning,
+    remainingBackupCodes,
+    attemptsRemaining,
+    verifyTOTP,
+    verifyBackupCode,
+    clearError
   };
-}, "useGithubAuth");
+}, "useTwoFactorVerify");
 
 // src/auth/hooks/useTwoFactorSetup.ts
-var import_react11 = require("react");
+var import_react12 = require("react");
 var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
   const { onComplete, onError } = options;
-  const [isLoading, setIsLoading] = (0, import_react11.useState)(false);
-  const [error, setError] = (0, import_react11.useState)(null);
-  const [setupData, setSetupData] = (0, import_react11.useState)(null);
-  const [backupCodes, setBackupCodes] = (0, import_react11.useState)(null);
-  const [backupCodesWarning, setBackupCodesWarning] = (0, import_react11.useState)(null);
-  const [setupStep, setSetupStep] = (0, import_react11.useState)("idle");
-  const clearError = (0, import_react11.useCallback)(() => {
+  const [isLoading, setIsLoading] = (0, import_react12.useState)(false);
+  const [error, setError] = (0, import_react12.useState)(null);
+  const [setupData, setSetupData] = (0, import_react12.useState)(null);
+  const [backupCodes, setBackupCodes] = (0, import_react12.useState)(null);
+  const [backupCodesWarning, setBackupCodesWarning] = (0, import_react12.useState)(null);
+  const [setupStep, setSetupStep] = (0, import_react12.useState)("idle");
+  const clearError = (0, import_react12.useCallback)(() => {
     setError(null);
   }, []);
-  const resetSetup = (0, import_react11.useCallback)(() => {
+  const resetSetup = (0, import_react12.useCallback)(() => {
     setSetupData(null);
     setBackupCodes(null);
     setBackupCodesWarning(null);
     setSetupStep("idle");
     setError(null);
   }, []);
-  const startSetup = (0, import_react11.useCallback)(async (deviceName) => {
+  const startSetup = (0, import_react12.useCallback)(async (deviceName) => {
     setIsLoading(true);
     setError(null);
     setSetupStep("scanning");
@@ -3658,7 +3625,7 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
       setIsLoading(false);
     }
   }, [onError]);
-  const confirmSetup = (0, import_react11.useCallback)(async (code) => {
+  const confirmSetup = (0, import_react12.useCallback)(async (code) => {
     if (!setupData) {
       const msg = "Setup not started. Call startSetup() first.";
       setError(msg);
@@ -3714,16 +3681,16 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
 }, "useTwoFactorSetup");
 
 // src/auth/hooks/useTwoFactorStatus.ts
-var import_react12 = require("react");
+var import_react13 = require("react");
 var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
-  const [isLoading, setIsLoading] = (0, import_react12.useState)(false);
-  const [error, setError] = (0, import_react12.useState)(null);
-  const [has2FAEnabled, setHas2FAEnabled] = (0, import_react12.useState)(null);
-  const [devices, setDevices] = (0, import_react12.useState)([]);
-  const clearError = (0, import_react12.useCallback)(() => {
+  const [isLoading, setIsLoading] = (0, import_react13.useState)(false);
+  const [error, setError] = (0, import_react13.useState)(null);
+  const [has2FAEnabled, setHas2FAEnabled] = (0, import_react13.useState)(null);
+  const [devices, setDevices] = (0, import_react13.useState)([]);
+  const clearError = (0, import_react13.useCallback)(() => {
     setError(null);
   }, []);
-  const fetchStatus = (0, import_react12.useCallback)(async () => {
+  const fetchStatus = (0, import_react13.useCallback)(async () => {
     setIsLoading(true);
     setError(null);
     try {
@@ -3748,7 +3715,7 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
       setIsLoading(false);
     }
   }, []);
-  const disable2FA = (0, import_react12.useCallback)(async (code) => {
+  const disable2FA = (0, import_react13.useCallback)(async (code) => {
     if (!isValidTotpCode(code)) {
       setError("Please enter a 6-digit code");
       return false;
@@ -3791,9 +3758,9 @@ var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
 }, "useTwoFactor");
 
 // src/auth/hooks/useLocalStorage.ts
-var import_react13 = require("react");
+var import_react14 = require("react");
 function useLocalStorage(key, initialValue) {
-  const [storedValue, setStoredValue] = (0, import_react13.useState)(() => {
+  const [storedValue, setStoredValue] = (0, import_react14.useState)(() => {
     if (typeof window === "undefined") {
       return initialValue;
     }
@@ -4074,15 +4041,15 @@ function getCacheMetadata() {
 __name(getCacheMetadata, "getCacheMetadata");
 
 // src/auth/hooks/useDeleteAccount.ts
-var import_react14 = require("react");
+var import_react15 = require("react");
 var useDeleteAccount = /* @__PURE__ */ __name(() => {
-  const [isLoading, setIsLoading] = (0, import_react14.useState)(false);
-  const [error, setError] = (0, import_react14.useState)(null);
+  const [isLoading, setIsLoading] = (0, import_react15.useState)(false);
+  const [error, setError] = (0, import_react15.useState)(null);
   const { logout } = useAuth();
-  const clearError = (0, import_react14.useCallback)(() => {
+  const clearError = (0, import_react15.useCallback)(() => {
     setError(null);
   }, []);
-  const deleteAccount = (0, import_react14.useCallback)(async () => {
+  const deleteAccount = (0, import_react15.useCallback)(async () => {
     setIsLoading(true);
     setError(null);
     try {
@@ -4112,7 +4079,7 @@ var useDeleteAccount = /* @__PURE__ */ __name(() => {
 }, "useDeleteAccount");
 
 // src/auth/context/AccountsContext.tsx
-var import_react15 = require("react");
+var import_react16 = require("react");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRegenerateCreate.ts
 var import_mutation = __toESM(require("swr/mutation"), 1);
@@ -4469,21 +4436,21 @@ function hasApiOrigin() {
   }
 }
 __name(hasApiOrigin, "hasApiOrigin");
-var AccountsContext = (0, import_react15.createContext)(void 0);
+var AccountsContext = (0, import_react16.createContext)(void 0);
 function AccountsProvider({ children }) {
-  const [profile, setProfile] = (0, import_react15.useState)(() => {
+  const [profile, setProfile] = (0, import_react16.useState)(() => {
     const cached = getCachedProfile();
     return cached || void 0;
   });
-  const [isLoadingProfile, setIsLoadingProfile] = (0, import_react15.useState)(false);
-  const [profileError, setProfileError] = (0, import_react15.useState)(null);
-  const profileRef = (0, import_react15.useRef)(profile);
-  const isLoadingRef = (0, import_react15.useRef)(false);
-  const fetchSeqRef = (0, import_react15.useRef)(0);
-  (0, import_react15.useEffect)(() => {
+  const [isLoadingProfile, setIsLoadingProfile] = (0, import_react16.useState)(false);
+  const [profileError, setProfileError] = (0, import_react16.useState)(null);
+  const profileRef = (0, import_react16.useRef)(profile);
+  const isLoadingRef = (0, import_react16.useRef)(false);
+  const fetchSeqRef = (0, import_react16.useRef)(0);
+  (0, import_react16.useEffect)(() => {
     profileRef.current = profile;
   }, [profile]);
-  (0, import_react15.useEffect)(() => {
+  (0, import_react16.useEffect)(() => {
     isLoadingRef.current = isLoadingProfile;
   }, [isLoadingProfile]);
   const { trigger: triggerProfileUpdate } = useCfgAccountsProfileUpdateUpdate();
@@ -4492,7 +4459,7 @@ function AccountsProvider({ children }) {
   const { trigger: triggerOtpRequest } = useCfgAccountsOtpRequestCreate();
   const { trigger: triggerOtpVerify } = useCfgAccountsOtpVerifyCreate();
   const { trigger: triggerPasswordLogin } = useCfgAccountsTokenCreate();
-  const refreshProfile = (0, import_react15.useCallback)(async (options) => {
+  const refreshProfile = (0, import_react16.useCallback)(async (options) => {
     const { callerId, force } = options || {};
     if (!hasApiOrigin()) {
       authLogger.debug(`No API origin configured, skipping profile fetch (caller: ${callerId})`);
@@ -4526,26 +4493,26 @@ function AccountsProvider({ children }) {
       }
     }
   }, []);
-  const updateProfile = (0, import_react15.useCallback)(async (data) => {
+  const updateProfile = (0, import_react16.useCallback)(async (data) => {
     await triggerProfileUpdate({ body: data });
     const user = await refreshProfile({ callerId: "updateProfile", force: true });
     return user;
   }, [triggerProfileUpdate, refreshProfile]);
-  const partialUpdateProfile = (0, import_react15.useCallback)(async (data) => {
+  const partialUpdateProfile = (0, import_react16.useCallback)(async (data) => {
     await triggerProfilePartialUpdate({ body: data });
     const user = await refreshProfile({ callerId: "partialUpdateProfile", force: true });
     return user;
   }, [triggerProfilePartialUpdate, refreshProfile]);
-  const uploadAvatar = (0, import_react15.useCallback)(async (avatar) => {
+  const uploadAvatar = (0, import_react16.useCallback)(async (avatar) => {
     await triggerAvatar({ body: { avatar } });
     const user = await refreshProfile({ callerId: "uploadAvatar", force: true });
     return user;
   }, [triggerAvatar, refreshProfile]);
-  const requestOTP = (0, import_react15.useCallback)(async (data) => {
+  const requestOTP = (0, import_react16.useCallback)(async (data) => {
     const result = await triggerOtpRequest({ body: data });
     return result;
   }, [triggerOtpRequest]);
-  const settleLoginEnvelope = (0, import_react15.useCallback)(async (result, callerId) => {
+  const settleLoginEnvelope = (0, import_react16.useCallback)(async (result, callerId) => {
     if (result.requires_2fa && result.session_id) {
       authLogger.info("2FA required, session:", result.session_id);
       return;
@@ -4559,17 +4526,17 @@ function AccountsProvider({ children }) {
       }
     }
   }, [refreshProfile]);
-  const verifyOTP = (0, import_react15.useCallback)(async (data) => {
+  const verifyOTP = (0, import_react16.useCallback)(async (data) => {
     const result = await triggerOtpVerify({ body: data });
     await settleLoginEnvelope(result, "verifyOTP");
     return result;
   }, [triggerOtpVerify, settleLoginEnvelope]);
-  const loginWithPassword = (0, import_react15.useCallback)(async (data) => {
+  const loginWithPassword = (0, import_react16.useCallback)(async (data) => {
     const result = await triggerPasswordLogin({ body: data });
     await settleLoginEnvelope(result, "loginWithPassword");
     return result;
   }, [triggerPasswordLogin, settleLoginEnvelope]);
-  const logout = (0, import_react15.useCallback)(() => {
+  const logout = (0, import_react16.useCallback)(() => {
     const refresh = auth.getRefreshToken();
     if (refresh) {
       CfgAccountsAuth.cfgAccountsTokenBlacklistCreate({ body: { refresh } }).catch(() => {
@@ -4581,7 +4548,7 @@ function AccountsProvider({ children }) {
     setProfileError(null);
     clearProfileCache();
   }, []);
-  const value = (0, import_react15.useMemo)(() => ({
+  const value = (0, import_react16.useMemo)(() => ({
     profile,
     isLoadingProfile,
     profileError,
@@ -4610,7 +4577,7 @@ function AccountsProvider({ children }) {
 }
 __name(AccountsProvider, "AccountsProvider");
 function useAccountsContext() {
-  const context = (0, import_react15.useContext)(AccountsContext);
+  const context = (0, import_react16.useContext)(AccountsContext);
   if (!context) {
     throw new Error("useAccountsContext must be used within AccountsProvider");
   }
@@ -4631,7 +4598,7 @@ var resolveAuthRoutes = /* @__PURE__ */ __name((routes) => ({
   defaultAuthCallback: routes?.defaultAuthCallback || routes?.auth || defaultRoutes.defaultAuthCallback
 }), "resolveAuthRoutes");
 var EMAIL_STORAGE_KEY = "auth_email";
-var AuthContext = (0, import_react16.createContext)(void 0);
+var AuthContext = (0, import_react17.createContext)(void 0);
 var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const accounts = useAccountsContext();
   const session = useSession();
@@ -4643,28 +4610,28 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     EMAIL_STORAGE_KEY,
     null
   );
-  const routes = (0, import_react16.useMemo)(() => resolveAuthRoutes(config?.routes), [config?.routes]);
-  const routesRef = (0, import_react16.useRef)(routes);
-  (0, import_react16.useEffect)(() => {
+  const routes = (0, import_react17.useMemo)(() => resolveAuthRoutes(config?.routes), [config?.routes]);
+  const routesRef = (0, import_react17.useRef)(routes);
+  (0, import_react17.useEffect)(() => {
     routesRef.current = routes;
   }, [routes]);
   const redirectManager = useAuthRedirectManager({
     fallbackUrl: routes.defaultCallback,
     clearOnUse: true
   });
-  const configRef = (0, import_react16.useRef)(config);
-  (0, import_react16.useEffect)(() => {
+  const configRef = (0, import_react17.useRef)(config);
+  (0, import_react17.useEffect)(() => {
     configRef.current = config;
   }, [config]);
-  const accountsRef = (0, import_react16.useRef)(accounts);
-  (0, import_react16.useEffect)(() => {
+  const accountsRef = (0, import_react17.useRef)(accounts);
+  (0, import_react17.useEffect)(() => {
     accountsRef.current = accounts;
   }, [accounts]);
-  const pendingManualNavRef = (0, import_react16.useRef)(false);
-  const [profileSettled, setProfileSettled] = (0, import_react16.useState)(false);
+  const pendingManualNavRef = (0, import_react17.useRef)(false);
+  const [profileSettled, setProfileSettled] = (0, import_react17.useState)(false);
   const hasProfile = Boolean(accounts.profile);
-  const profileAttemptedRef = (0, import_react16.useRef)(false);
-  (0, import_react16.useEffect)(() => {
+  const profileAttemptedRef = (0, import_react17.useRef)(false);
+  (0, import_react17.useEffect)(() => {
     if (!isAuthenticated) {
       profileAttemptedRef.current = false;
       const hasTokens = Boolean(auth.getToken() || auth.getRefreshToken());
@@ -4692,8 +4659,8 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     };
   }, [isAuthenticated, hasProfile]);
   const isLoading = !profileSettled;
-  const expiredHandledRef = (0, import_react16.useRef)(false);
-  (0, import_react16.useEffect)(() => {
+  const expiredHandledRef = (0, import_react17.useRef)(false);
+  (0, import_react17.useEffect)(() => {
     const unsubscribe = auth.onSessionExpired(() => {
       if (expiredHandledRef.current) return;
       expiredHandledRef.current = true;
@@ -4706,7 +4673,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     });
     return unsubscribe;
   }, [router]);
-  (0, import_react16.useEffect)(() => {
+  (0, import_react17.useEffect)(() => {
     if (!isAuthenticated || pendingManualNavRef.current) return;
     if (pathname === routes.auth && !queryParams.get("flow")) {
       const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;
@@ -4714,7 +4681,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       router.push(saved || routes.defaultCallback);
     }
   }, [isAuthenticated, pathname, queryParams, routes, router, redirectManager]);
-  const loadCurrentProfile = (0, import_react16.useCallback)(async (callerId) => {
+  const loadCurrentProfile = (0, import_react17.useCallback)(async (callerId) => {
     if (!auth.isAuthenticated()) {
       throw new Error("No valid authentication token");
     }
@@ -4722,7 +4689,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       callerId: callerId || "AuthContext.loadCurrentProfile"
     });
   }, []);
-  const checkAuthAndRedirect = (0, import_react16.useCallback)(async () => {
+  const checkAuthAndRedirect = (0, import_react17.useCallback)(async () => {
     if (auth.isAuthenticated()) {
       try {
         await loadCurrentProfile("checkAuthAndRedirect");
@@ -4734,7 +4701,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       router.push(routesRef.current.defaultAuthCallback);
     }
   }, [loadCurrentProfile, router]);
-  const requestOTP = (0, import_react16.useCallback)(
+  const requestOTP = (0, import_react17.useCallback)(
     async (identifier, sourceUrl, consent) => {
       auth.clearSession();
       try {
@@ -4756,7 +4723,8 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
         return {
           success: true,
           message: result.message || "OTP code sent to your email address",
-          webmail: result.webmail ?? null
+          webmail: result.webmail ?? null,
+          resendIn: result.resend_in
         };
       } catch (error) {
         logAuthFailure(authLogger, "Request OTP failed:", error);
@@ -4775,7 +4743,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     []
   );
-  const verifyOTP = (0, import_react16.useCallback)(
+  const verifyOTP = (0, import_react17.useCallback)(
     async (identifier, otpCode, sourceUrl, redirectUrl, skipRedirect, rememberMe = false) => {
       try {
         pendingManualNavRef.current = Boolean(skipRedirect);
@@ -4836,7 +4804,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     [setStoredEmail, redirectManager, router]
   );
-  const login = (0, import_react16.useCallback)(
+  const login = (0, import_react17.useCallback)(
     async (email, password, options) => {
       const { redirectUrl, skipRedirect, rememberMe = false } = options || {};
       try {
@@ -4902,7 +4870,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     [setStoredEmail, redirectManager, router]
   );
-  const refreshToken = (0, import_react16.useCallback)(async () => {
+  const refreshToken = (0, import_react17.useCallback)(async () => {
     const access = await auth.refreshNow();
     if (access) {
       Analytics.event("auth_token_refresh" /* AUTH_TOKEN_REFRESH */, {
@@ -4915,7 +4883,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     });
     return { success: false, message: "Error refreshing token" };
   }, []);
-  const logout = (0, import_react16.useCallback)(() => {
+  const logout = (0, import_react17.useCallback)(() => {
     Analytics.event("auth_logout" /* AUTH_LOGOUT */, {
       category: "auth" /* AUTH */
     });
@@ -4924,21 +4892,21 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   }, [router]);
   const user = accounts.profile ?? null;
   const isAdminUser = Boolean(user?.is_staff || user?.is_superuser);
-  (0, import_react16.useEffect)(() => {
+  (0, import_react17.useEffect)(() => {
     applyRoleLogPolicy({ isAdmin: isAdminUser });
   }, [isAdminUser]);
-  const updateProfile = (0, import_react16.useCallback)(
+  const updateProfile = (0, import_react17.useCallback)(
     async (data) => {
       const result = await accountsRef.current.partialUpdateProfile(data);
       return result;
     },
     []
   );
-  const uploadAvatar = (0, import_react16.useCallback)(async (avatar) => {
+  const uploadAvatar = (0, import_react17.useCallback)(async (avatar) => {
     const result = await accountsRef.current.uploadAvatar(avatar);
     return result;
   }, []);
-  const value = (0, import_react16.useMemo)(
+  const value = (0, import_react17.useMemo)(
     () => ({
       user,
       isLoading,
@@ -4994,7 +4962,7 @@ function AuthProviderRaw({ children, config, enabled = true }) {
   return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(AccountsProvider, { children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(AuthProviderInternal, { config, children }) });
 }
 __name(AuthProviderRaw, "AuthProviderRaw");
-var AuthProvider = (0, import_react16.memo)(AuthProviderRaw);
+var AuthProvider = (0, import_react17.memo)(AuthProviderRaw);
 var defaultAuthState = {
   user: null,
   isLoading: false,
@@ -5050,7 +5018,7 @@ var defaultAuthState = {
   }, "uploadAvatar")
 };
 var useAuth = /* @__PURE__ */ __name(() => {
-  const context = (0, import_react16.useContext)(AuthContext);
+  const context = (0, import_react17.useContext)(AuthContext);
   if (context === void 0) {
     if (isBrowser2 && isDev) {
       authLogger.debug("useAuth called outside AuthProvider, returning default state");