@djangocfg/api 2.1.580 → 2.1.581

package/dist/auth.mjs

@@ -10,7 +10,9 @@ var AUTH_CONSTANTS = {
   /** TOTP code length (RFC 6238 — authenticator apps). */
   TOTP_LENGTH: 6,
   /** Backup code max length. */
-  BACKUP_CODE_MAX_LENGTH: 12
+  BACKUP_CODE_MAX_LENGTH: 12,
+  /** Resend cooldown (s) when the server does not state one. Mirrors the backend per-email cooldown. */
+  RESEND_COOLDOWN_SECONDS: 30
 };
 
 // src/auth/context/AuthContext.tsx
@@ -978,6 +980,28 @@ var formatCountdown = /* @__PURE__ */ __name((s) => {
   const m = Math.floor(s / 60);
   return m > 0 ? `${m}:${String(s % 60).padStart(2, "0")}` : `${s}s`;
 }, "formatCountdown");
+var useCountdown = /* @__PURE__ */ __name(() => {
+  const [seconds, setSeconds] = useState2(0);
+  const timerRef = useRef2(null);
+  const start = useCallback2((from) => {
+    if (timerRef.current) clearInterval(timerRef.current);
+    setSeconds(from);
+    timerRef.current = setInterval(() => {
+      setSeconds((prev) => {
+        if (prev <= 1) {
+          clearInterval(timerRef.current);
+          timerRef.current = null;
+          return 0;
+        }
+        return prev - 1;
+      });
+    }, 1e3);
+  }, []);
+  useEffect2(() => () => {
+    if (timerRef.current) clearInterval(timerRef.current);
+  }, []);
+  return { seconds, start };
+}, "useCountdown");
 var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
   const [identifier, setIdentifier] = useState2(initialIdentifier);
   const [otp, setOtp] = useState2("");
@@ -985,33 +1009,12 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
   const [isLoading, setIsLoading] = useState2(false);
   const [acceptedTerms, setAcceptedTerms] = useState2(true);
   const [marketingConsent, setMarketingConsent] = useState2(null);
-  const [rememberMe, setRememberMe] = useState2(false);
+  const [rememberMe, setRememberMe] = useState2(true);
   const [step, setStep] = useState2("identifier");
   const [error, setError] = useState2("");
   const [webmail, setWebmail] = useState2(null);
-  const [twoFactorSessionId, setTwoFactorSessionId] = useState2(null);
-  const [shouldPrompt2FA, setShouldPrompt2FA] = useState2(false);
-  const [twoFactorCode, setTwoFactorCode] = useState2("");
-  const [useBackupCode, setUseBackupCode] = useState2(false);
-  const [rateLimitSeconds, setRateLimitSeconds] = useState2(0);
-  const rateLimitTimerRef = useRef2(null);
-  const startRateLimitCountdown = useCallback2((seconds) => {
-    if (rateLimitTimerRef.current) clearInterval(rateLimitTimerRef.current);
-    setRateLimitSeconds(seconds);
-    rateLimitTimerRef.current = setInterval(() => {
-      setRateLimitSeconds((prev) => {
-        if (prev <= 1) {
-          clearInterval(rateLimitTimerRef.current);
-          rateLimitTimerRef.current = null;
-          return 0;
-        }
-        return prev - 1;
-      });
-    }, 1e3);
-  }, []);
-  useEffect2(() => () => {
-    if (rateLimitTimerRef.current) clearInterval(rateLimitTimerRef.current);
-  }, []);
+  const rateLimit = useCountdown();
+  const resend = useCountdown();
   const clearError = useCallback2(() => setError(""), []);
   return {
     // State
@@ -1024,13 +1027,11 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     rememberMe,
     step,
     error,
-    twoFactorSessionId,
-    shouldPrompt2FA,
-    twoFactorCode,
-    useBackupCode,
-    rateLimitSeconds,
-    isRateLimited: rateLimitSeconds > 0,
-    rateLimitLabel: formatCountdown(rateLimitSeconds),
+    rateLimitSeconds: rateLimit.seconds,
+    isRateLimited: rateLimit.seconds > 0,
+    rateLimitLabel: formatCountdown(rateLimit.seconds),
+    resendSeconds: resend.seconds,
+    resendLabel: formatCountdown(resend.seconds),
     webmail,
     // Handlers
     setIdentifier,
@@ -1043,11 +1044,8 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     clearError,
     setStep,
     setIsLoading,
-    setTwoFactorSessionId,
-    setShouldPrompt2FA,
-    setTwoFactorCode,
-    setUseBackupCode,
-    startRateLimitCountdown,
+    startRateLimitCountdown: rateLimit.start,
+    startResendCountdown: resend.start,
     setWebmail
   };
 }, "useAuthFormState");
@@ -1064,7 +1062,7 @@ var useAuthValidation = /* @__PURE__ */ __name(() => {
 var validateIdentifier = /* @__PURE__ */ __name((id) => EMAIL_REGEX.test(id), "validateIdentifier");
 
 // src/auth/hooks/useAuthForm.ts
-import { useCallback as useCallback5, useEffect as useEffect4, useRef as useRef4 } from "react";
+import { useCallback as useCallback4, useEffect as useEffect4, useRef as useRef4 } from "react";
 
 // src/auth/utils/logger.ts
 import { createConsola as createConsola2 } from "consola";
@@ -1129,88 +1127,412 @@ var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
   };
 }, "useAutoAuth");
 
-// src/auth/hooks/useTwoFactorVerify.ts
-import { useCallback as useCallback4, useState as useState4 } from "react";
+// src/auth/hooks/useTwoFactorChallenge.ts
+import { useSyncExternalStore as useSyncExternalStore2 } from "react";
+var current = null;
+var listeners = /* @__PURE__ */ new Set();
+var set = /* @__PURE__ */ __name((next) => {
+  current = next;
+  for (const listener of [...listeners]) listener();
+}, "set");
+var subscribe = /* @__PURE__ */ __name((listener) => {
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
+}, "subscribe");
+var beginTwoFactorChallenge = /* @__PURE__ */ __name((challenge) => set(challenge), "beginTwoFactorChallenge");
+var endTwoFactorChallenge = /* @__PURE__ */ __name(() => set(null), "endTwoFactorChallenge");
+var useTwoFactorChallenge = /* @__PURE__ */ __name(() => useSyncExternalStore2(subscribe, () => current, () => null), "useTwoFactorChallenge");
 
-// src/_api/generated/core/bodySerializer.gen.ts
-var serializeFormDataPair = /* @__PURE__ */ __name((data, key, value) => {
-  if (typeof value === "string" || value instanceof Blob) {
-    data.append(key, value);
-  } else if (value instanceof Date) {
-    data.append(key, value.toISOString());
-  } else {
-    data.append(key, JSON.stringify(value));
-  }
-}, "serializeFormDataPair");
-var formDataBodySerializer = {
-  bodySerializer: /* @__PURE__ */ __name((body) => {
-    const data = new FormData();
-    Object.entries(body).forEach(([key, value]) => {
-      if (value === void 0 || value === null) {
-        return;
+// src/auth/hooks/useAuthForm.ts
+var useAuthForm = /* @__PURE__ */ __name((options) => {
+  const {
+    onIdentifierSuccess,
+    onOTPSuccess,
+    onError,
+    sourceUrl,
+    redirectUrl,
+    requireTermsAcceptance = false,
+    marketingConsent: marketingConsentOption,
+    authPath = "/auth"
+  } = options;
+  const formState = useAuthFormState();
+  const validation = useAuthValidation();
+  const isAutoSubmitFromUrlRef = useRef4(false);
+  const processedOtpKeyRef = useRef4(null);
+  const {
+    requestOTP,
+    verifyOTP,
+    login,
+    getSavedEmail,
+    saveEmail
+  } = useAuth();
+  const {
+    identifier,
+    otp,
+    password,
+    acceptedTerms,
+    marketingConsent,
+    rememberMe,
+    setIdentifier,
+    setOtp,
+    setStep,
+    setError,
+    setIsLoading,
+    clearError,
+    startRateLimitCountdown,
+    startResendCountdown,
+    setWebmail
+  } = formState;
+  const { validateIdentifier: validateIdentifier2 } = validation;
+  const saveIdentifierToStorage = useCallback4((id) => {
+    saveEmail(id);
+  }, [saveEmail]);
+  useEffect4(() => {
+    const savedEmail = getSavedEmail();
+    if (savedEmail) {
+      setIdentifier(savedEmail);
+    }
+  }, []);
+  const handleIdentifierSubmit = useCallback4(async (e) => {
+    e.preventDefault();
+    if (!identifier) {
+      const msg = "Please enter your email address";
+      setError(msg);
+      onError?.(msg);
+      return;
+    }
+    if (!validateIdentifier2(identifier)) {
+      const msg = "Please enter a valid email address";
+      setError(msg);
+      onError?.(msg);
+      return;
+    }
+    if (requireTermsAcceptance && !acceptedTerms) {
+      const msg = "Please accept the Terms of Service and Privacy Policy";
+      setError(msg);
+      onError?.(msg);
+      return;
+    }
+    clearError();
+    setOtp("");
+    setWebmail(null);
+    setStep("otp");
+    const rollBack = /* @__PURE__ */ __name((msg) => {
+      setStep("identifier");
+      setError(msg);
+      onError?.(msg);
+    }, "rollBack");
+    try {
+      const consent = marketingConsentOption ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion } : void 0;
+      const result = await requestOTP(identifier, sourceUrl, consent);
+      if (result.success) {
+        saveIdentifierToStorage(identifier);
+        setWebmail(result.webmail ?? null);
+        startResendCountdown(result.resendIn ?? AUTH_CONSTANTS.RESEND_COOLDOWN_SECONDS);
+        onIdentifierSuccess?.(identifier);
+      } else if (result.retryAfter) {
+        setStep("identifier");
+        startRateLimitCountdown(result.retryAfter);
+      } else {
+        rollBack(result.message);
       }
-      if (Array.isArray(value)) {
-        value.forEach((v) => serializeFormDataPair(data, key, v));
+    } catch {
+      rollBack("An unexpected error occurred");
+    }
+  }, [
+    identifier,
+    acceptedTerms,
+    requireTermsAcceptance,
+    marketingConsent,
+    marketingConsentOption,
+    validateIdentifier2,
+    requestOTP,
+    saveIdentifierToStorage,
+    setError,
+    setOtp,
+    setStep,
+    clearError,
+    setWebmail,
+    startRateLimitCountdown,
+    startResendCountdown,
+    onIdentifierSuccess,
+    onError,
+    sourceUrl
+  ]);
+  const submitOTP = useCallback4(async (submitIdentifier, submitOtp) => {
+    if (!submitOtp || submitOtp.length < AUTH_CONSTANTS.EMAIL_OTP_LENGTH) {
+      const msg = `Please enter the ${AUTH_CONSTANTS.EMAIL_OTP_LENGTH}-digit verification code`;
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
+    setIsLoading(true);
+    clearError();
+    try {
+      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true, rememberMe);
+      if (result.requires_2fa && result.session_id) {
+        authLogger.info("2FA required after OTP verification");
+        beginTwoFactorChallenge({ sessionId: result.session_id });
+        saveIdentifierToStorage(submitIdentifier);
+        return true;
+      }
+      if (result.success) {
+        saveIdentifierToStorage(submitIdentifier);
+        authLogger.info("OTP verification successful, showing success screen");
+        setStep("success");
+        onOTPSuccess?.();
+        return true;
       } else {
-        serializeFormDataPair(data, key, value);
+        setError(result.message);
+        onError?.(result.message);
+        return false;
       }
-    });
-    return data;
-  }, "bodySerializer")
-};
-var jsonBodySerializer = {
-  bodySerializer: /* @__PURE__ */ __name((body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value), "bodySerializer")
-};
-
-// src/_api/generated/core/params.gen.ts
-var extraPrefixesMap = {
-  $body_: "body",
-  $headers_: "headers",
-  $path_: "path",
-  $query_: "query"
-};
-var extraPrefixes = Object.entries(extraPrefixesMap);
-
-// src/_api/generated/core/serverSentEvents.gen.ts
-function createSseClient({
-  onRequest,
-  onSseError,
-  onSseEvent,
-  responseTransformer,
-  responseValidator,
-  sseDefaultRetryDelay,
-  sseMaxRetryAttempts,
-  sseMaxRetryDelay,
-  sseSleepFn,
-  url,
-  ...options
-}) {
-  let lastEventId;
-  const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  const createStream = /* @__PURE__ */ __name(async function* () {
-    let retryDelay = sseDefaultRetryDelay ?? 3e3;
-    let attempt = 0;
-    const signal = options.signal ?? new AbortController().signal;
-    while (true) {
-      if (signal.aborted) break;
-      attempt++;
-      const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
-      if (lastEventId !== void 0) {
-        headers.set("Last-Event-ID", lastEventId);
+    } catch {
+      const msg = "An unexpected error occurred";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    } finally {
+      setIsLoading(false);
+    }
+  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, rememberMe, setStep]);
+  const handleOTPSubmit = useCallback4(async (e) => {
+    e.preventDefault();
+    await submitOTP(identifier, otp);
+  }, [identifier, otp, submitOTP]);
+  const submitPassword = useCallback4(async (submitIdentifier, submitPassword_) => {
+    if (!submitIdentifier || !validateIdentifier2(submitIdentifier)) {
+      const msg = "Please enter a valid email address";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
+    if (!submitPassword_) {
+      const msg = "Please enter your password";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
+    setIsLoading(true);
+    clearError();
+    try {
+      const result = await login(submitIdentifier, submitPassword_, {
+        redirectUrl,
+        skipRedirect: true,
+        rememberMe
+      });
+      if (result.requires_2fa && result.session_id) {
+        authLogger.info("2FA required after password login");
+        beginTwoFactorChallenge({ sessionId: result.session_id });
+        saveIdentifierToStorage(submitIdentifier);
+        return true;
       }
-      try {
-        const requestInit = {
-          redirect: "follow",
-          ...options,
-          body: options.serializedBody,
-          headers,
-          signal
-        };
-        let request = new Request(url, requestInit);
-        if (onRequest) {
-          request = await onRequest(url, requestInit);
-        }
-        const _fetch = options.fetch ?? globalThis.fetch;
+      if (result.success) {
+        saveIdentifierToStorage(submitIdentifier);
+        authLogger.info("Password login successful, showing success screen");
+        setStep("success");
+        onOTPSuccess?.();
+        return true;
+      }
+      if (result.retryAfter) {
+        startRateLimitCountdown(result.retryAfter);
+        clearError();
+      } else {
+        setError(result.message);
+        onError?.(result.message);
+      }
+      return false;
+    } catch {
+      const msg = "An unexpected error occurred";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    } finally {
+      setIsLoading(false);
+    }
+  }, [
+    login,
+    validateIdentifier2,
+    saveIdentifierToStorage,
+    setError,
+    setIsLoading,
+    clearError,
+    startRateLimitCountdown,
+    onOTPSuccess,
+    onError,
+    redirectUrl,
+    rememberMe,
+    setStep
+  ]);
+  const handlePasswordSubmit = useCallback4(async (e) => {
+    e.preventDefault();
+    await submitPassword(identifier, password);
+  }, [identifier, password, submitPassword]);
+  const handleResendOTP = useCallback4(async () => {
+    setIsLoading(true);
+    clearError();
+    try {
+      const consent = marketingConsentOption ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion } : void 0;
+      const result = await requestOTP(identifier, sourceUrl, consent);
+      if (result.success) {
+        saveIdentifierToStorage(identifier);
+        setWebmail(result.webmail ?? null);
+        startResendCountdown(result.resendIn ?? AUTH_CONSTANTS.RESEND_COOLDOWN_SECONDS);
+        setOtp("");
+      } else {
+        if (result.retryAfter) {
+          startRateLimitCountdown(result.retryAfter);
+          clearError();
+        } else {
+          setError(result.message);
+          onError?.(result.message);
+        }
+      }
+    } catch {
+      const msg = "Failed to resend verification code";
+      setError(msg);
+      onError?.(msg);
+    } finally {
+      setIsLoading(false);
+    }
+  }, [identifier, marketingConsent, marketingConsentOption, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, startRateLimitCountdown, startResendCountdown, setWebmail, onError, sourceUrl]);
+  const handleBackToIdentifier = useCallback4(() => {
+    setStep("identifier");
+    clearError();
+  }, [setStep, clearError]);
+  const forceOTPStep = useCallback4(() => {
+    setStep("otp");
+    clearError();
+  }, [setStep, clearError]);
+  const handleOTPFromUrl = useCallback4((detectedOtp, detectedEmail) => {
+    const autoIdentifier = detectedEmail || getSavedEmail() || "";
+    if (!autoIdentifier) {
+      authLogger.warn("No identifier found for auto-submit (no email in URL or storage)");
+      return;
+    }
+    const otpKey = `${autoIdentifier}:${detectedOtp}`;
+    if (processedOtpKeyRef.current === otpKey) return;
+    if (isAutoSubmitFromUrlRef.current) return;
+    processedOtpKeyRef.current = otpKey;
+    isAutoSubmitFromUrlRef.current = true;
+    authLogger.info("OTP detected from URL, auto-submitting");
+    setIdentifier(autoIdentifier);
+    setOtp(detectedOtp);
+    setStep("otp");
+    setTimeout(async () => {
+      try {
+        await submitOTP(autoIdentifier, detectedOtp);
+      } finally {
+        isAutoSubmitFromUrlRef.current = false;
+      }
+    }, 100);
+  }, [getSavedEmail, setIdentifier, setOtp, setStep, submitOTP]);
+  useAutoAuth({
+    allowedPaths: [authPath],
+    onOTPDetected: handleOTPFromUrl,
+    cleanupUrl: true
+  });
+  return {
+    // State
+    ...formState,
+    // Submit handlers
+    handleIdentifierSubmit,
+    handleOTPSubmit,
+    handlePasswordSubmit,
+    handleResendOTP,
+    handleBackToIdentifier,
+    forceOTPStep,
+    // Validation
+    ...validation,
+    // Auto-submit ref
+    isAutoSubmittingFromUrl: isAutoSubmitFromUrlRef
+  };
+}, "useAuthForm");
+
+// src/auth/hooks/useGithubAuth.ts
+import { useCallback as useCallback5, useState as useState3 } from "react";
+
+// src/_api/generated/core/bodySerializer.gen.ts
+var serializeFormDataPair = /* @__PURE__ */ __name((data, key, value) => {
+  if (typeof value === "string" || value instanceof Blob) {
+    data.append(key, value);
+  } else if (value instanceof Date) {
+    data.append(key, value.toISOString());
+  } else {
+    data.append(key, JSON.stringify(value));
+  }
+}, "serializeFormDataPair");
+var formDataBodySerializer = {
+  bodySerializer: /* @__PURE__ */ __name((body) => {
+    const data = new FormData();
+    Object.entries(body).forEach(([key, value]) => {
+      if (value === void 0 || value === null) {
+        return;
+      }
+      if (Array.isArray(value)) {
+        value.forEach((v) => serializeFormDataPair(data, key, v));
+      } else {
+        serializeFormDataPair(data, key, value);
+      }
+    });
+    return data;
+  }, "bodySerializer")
+};
+var jsonBodySerializer = {
+  bodySerializer: /* @__PURE__ */ __name((body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value), "bodySerializer")
+};
+
+// src/_api/generated/core/params.gen.ts
+var extraPrefixesMap = {
+  $body_: "body",
+  $headers_: "headers",
+  $path_: "path",
+  $query_: "query"
+};
+var extraPrefixes = Object.entries(extraPrefixesMap);
+
+// src/_api/generated/core/serverSentEvents.gen.ts
+function createSseClient({
+  onRequest,
+  onSseError,
+  onSseEvent,
+  responseTransformer,
+  responseValidator,
+  sseDefaultRetryDelay,
+  sseMaxRetryAttempts,
+  sseMaxRetryDelay,
+  sseSleepFn,
+  url,
+  ...options
+}) {
+  let lastEventId;
+  const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const createStream = /* @__PURE__ */ __name(async function* () {
+    let retryDelay = sseDefaultRetryDelay ?? 3e3;
+    let attempt = 0;
+    const signal = options.signal ?? new AbortController().signal;
+    while (true) {
+      if (signal.aborted) break;
+      attempt++;
+      const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
+      if (lastEventId !== void 0) {
+        headers.set("Last-Event-ID", lastEventId);
+      }
+      try {
+        const requestInit = {
+          redirect: "follow",
+          ...options,
+          body: options.serializedBody,
+          headers,
+          signal
+        };
+        let request = new Request(url, requestInit);
+        if (onRequest) {
+          request = await onRequest(url, requestInit);
+        }
+        const _fetch = options.fetch ?? globalThis.fetch;
         const response = await _fetch(request);
         if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);
         if (!response.body) throw new Error("No body in SSE response");
@@ -2558,63 +2880,183 @@ var logAuthFailure = /* @__PURE__ */ __name((log, message, error) => {
   log.error(message, error);
 }, "logAuthFailure");
 
-// src/auth/hooks/useSessionStorage.ts
-import { useState as useState3 } from "react";
-
-// src/auth/utils/storage.ts
-var MAX_ITEM_KB = 1024;
-function isQuotaExceededError(error) {
-  if (typeof error !== "object" || error === null) return false;
-  const { name, code, message } = error;
-  return name === "QuotaExceededError" || code === 22 || typeof message === "string" && message.includes("quota");
-}
-__name(isQuotaExceededError, "isQuotaExceededError");
-function isWithinSizeLimit(data, key) {
-  try {
-    const sizeInKB = new Blob([JSON.stringify(data)]).size / 1024;
-    if (sizeInKB > MAX_ITEM_KB) {
-      authLogger.warn(
-        `Data size (${sizeInKB.toFixed(2)}KB) exceeds 1MB limit for key "${key}"`
-      );
-      return false;
-    }
-    return true;
-  } catch (error) {
-    authLogger.error(`Error checking data size for key "${key}":`, error);
-    return false;
-  }
-}
-__name(isWithinSizeLimit, "isWithinSizeLimit");
-
-// src/auth/hooks/useSessionStorage.ts
-function useSessionStorage(key, initialValue) {
-  const [storedValue, setStoredValue] = useState3(() => {
-    if (typeof window === "undefined") {
-      return initialValue;
-    }
-    try {
-      const item = window.sessionStorage.getItem(key);
-      return item ? JSON.parse(item) : initialValue;
-    } catch (error) {
-      authLogger.error(`Error reading sessionStorage key "${key}":`, error);
-      return initialValue;
-    }
-  });
-  const clearOldData = /* @__PURE__ */ __name(() => {
+// src/auth/hooks/useGithubAuth.ts
+var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
+  const { sourceUrl, rememberMe = false, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
+  const router = useCfgRouter();
+  const [isLoading, setIsLoading] = useState3(false);
+  const [error, setError] = useState3(null);
+  const startGithubAuth = useCallback5(async () => {
+    setIsLoading(true);
+    setError(null);
+    auth.clearSession();
     try {
-      const keys = Object.keys(sessionStorage).filter((key2) => key2 && typeof key2 === "string");
-      if (keys.length > 50) {
-        const itemsToRemove = Math.ceil(keys.length * 0.2);
-        for (let i = 0; i < itemsToRemove; i++) {
-          try {
-            const key2 = keys[i];
-            if (key2) {
-              sessionStorage.removeItem(key2);
-              sessionStorage.removeItem(`${key2}_timestamp`);
-            }
-          } catch {
-          }
-        }
+      authLogger.info("Starting GitHub OAuth flow...");
+      Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
+        category: "auth" /* AUTH */,
+        label: "github"
+      });
+      const result = await CfgAccountsOauth.cfgAccountsOauthGithubAuthorizeCreate({
+        body: {
+          source_url: sourceUrl || (typeof window !== "undefined" ? window.location.href : "")
+        },
+        throwOnError: true
+      });
+      const response = result.data;
+      if (!response.authorization_url) {
+        throw new Error("Failed to get authorization URL");
+      }
+      authLogger.info("Redirecting to GitHub...", response.authorization_url);
+      if (typeof window !== "undefined") {
+        sessionStorage.setItem("oauth_state", response.state);
+        sessionStorage.setItem("oauth_provider", "github");
+        sessionStorage.setItem("cfg.oauth.remember_me", String(rememberMe));
+      }
+      window.location.href = response.authorization_url;
+    } catch (err) {
+      const errorMessage = formatAuthError(err, "Failed to start GitHub authentication");
+      authLogger.error("GitHub OAuth start error:", err);
+      setError(errorMessage);
+      onError?.(errorMessage);
+      Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
+        category: "auth" /* AUTH */,
+        label: "github"
+      });
+    } finally {
+      setIsLoading(false);
+    }
+  }, [sourceUrl, rememberMe, onError]);
+  const handleGithubCallback = useCallback5(async (code, state) => {
+    setIsLoading(true);
+    setError(null);
+    try {
+      authLogger.info("Processing GitHub OAuth callback...");
+      let rememberMeForSession = false;
+      if (typeof window !== "undefined") {
+        const storedState = sessionStorage.getItem("oauth_state");
+        if (storedState && storedState !== state) {
+          throw new Error("Invalid OAuth state - possible CSRF attack");
+        }
+        rememberMeForSession = sessionStorage.getItem("cfg.oauth.remember_me") === "true";
+        sessionStorage.removeItem("oauth_state");
+        sessionStorage.removeItem("oauth_provider");
+        sessionStorage.removeItem("cfg.oauth.remember_me");
+      }
+      const result = await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({
+        body: { code, state, remember_me: rememberMeForSession },
+        throwOnError: true
+      });
+      const response = result.data;
+      if (response.requires_2fa && response.session_id) {
+        authLogger.info("GitHub OAuth requires 2FA, session:", response.session_id);
+        Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
+          category: "auth" /* AUTH */,
+          label: "github-2fa-required"
+        });
+        onRequires2FA?.(response.session_id, response.should_prompt_2fa || false);
+        return;
+      }
+      if (!response.access || !response.refresh) {
+        throw new Error("Invalid response from OAuth callback");
+      }
+      authLogger.info("GitHub OAuth successful, user:", response.user);
+      auth.setSession({ access: response.access, refresh: response.refresh });
+      Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
+        category: "auth" /* AUTH */,
+        label: "github"
+      });
+      if (response.user?.id) {
+        Analytics.setUser(String(response.user.id));
+      }
+      if (response.user) {
+        onSuccess?.(response.user, response.is_new_user || false);
+      }
+      if (!skipRedirect) {
+        const finalRedirectUrl = redirectUrl || "/private";
+        router.hardPush(finalRedirectUrl);
+      }
+      return;
+    } catch (err) {
+      const errorMessage = formatAuthError(err, "GitHub authentication failed");
+      authLogger.error("GitHub OAuth callback error:", err);
+      setError(errorMessage);
+      onError?.(errorMessage);
+      Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
+        category: "auth" /* AUTH */,
+        label: "github"
+      });
+    } finally {
+      setIsLoading(false);
+    }
+  }, [onSuccess, onError, onRequires2FA, redirectUrl, router, skipRedirect]);
+  return {
+    isLoading,
+    error,
+    startGithubAuth,
+    handleGithubCallback
+  };
+}, "useGithubAuth");
+
+// src/auth/hooks/useTwoFactorVerify.ts
+import { useCallback as useCallback6, useState as useState5 } from "react";
+
+// src/auth/hooks/useSessionStorage.ts
+import { useState as useState4 } from "react";
+
+// src/auth/utils/storage.ts
+var MAX_ITEM_KB = 1024;
+function isQuotaExceededError(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const { name, code, message } = error;
+  return name === "QuotaExceededError" || code === 22 || typeof message === "string" && message.includes("quota");
+}
+__name(isQuotaExceededError, "isQuotaExceededError");
+function isWithinSizeLimit(data, key) {
+  try {
+    const sizeInKB = new Blob([JSON.stringify(data)]).size / 1024;
+    if (sizeInKB > MAX_ITEM_KB) {
+      authLogger.warn(
+        `Data size (${sizeInKB.toFixed(2)}KB) exceeds 1MB limit for key "${key}"`
+      );
+      return false;
+    }
+    return true;
+  } catch (error) {
+    authLogger.error(`Error checking data size for key "${key}":`, error);
+    return false;
+  }
+}
+__name(isWithinSizeLimit, "isWithinSizeLimit");
+
+// src/auth/hooks/useSessionStorage.ts
+function useSessionStorage(key, initialValue) {
+  const [storedValue, setStoredValue] = useState4(() => {
+    if (typeof window === "undefined") {
+      return initialValue;
+    }
+    try {
+      const item = window.sessionStorage.getItem(key);
+      return item ? JSON.parse(item) : initialValue;
+    } catch (error) {
+      authLogger.error(`Error reading sessionStorage key "${key}":`, error);
+      return initialValue;
+    }
+  });
+  const clearOldData = /* @__PURE__ */ __name(() => {
+    try {
+      const keys = Object.keys(sessionStorage).filter((key2) => key2 && typeof key2 === "string");
+      if (keys.length > 50) {
+        const itemsToRemove = Math.ceil(keys.length * 0.2);
+        for (let i = 0; i < itemsToRemove; i++) {
+          try {
+            const key2 = keys[i];
+            if (key2) {
+              sessionStorage.removeItem(key2);
+              sessionStorage.removeItem(`${key2}_timestamp`);
+            }
+          } catch {
+          }
+        }
       }
     } catch (error) {
       authLogger.error("Error clearing old sessionStorage data:", error);
@@ -2795,15 +3237,15 @@ __name(isValidTotpCode, "isValidTotpCode");
 var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
   const { onSuccess, onError, redirectUrl, skipRedirect = false } = options;
   const router = useCfgRouter();
-  const [isLoading, setIsLoading] = useState4(false);
-  const [error, setError] = useState4(null);
-  const [warning, setWarning] = useState4(null);
-  const [remainingBackupCodes, setRemainingBackupCodes] = useState4(null);
-  const [attemptsRemaining, setAttemptsRemaining] = useState4(null);
-  const clearError = useCallback4(() => {
+  const [isLoading, setIsLoading] = useState5(false);
+  const [error, setError] = useState5(null);
+  const [warning, setWarning] = useState5(null);
+  const [remainingBackupCodes, setRemainingBackupCodes] = useState5(null);
+  const [attemptsRemaining, setAttemptsRemaining] = useState5(null);
+  const clearError = useCallback6(() => {
     setError(null);
   }, []);
-  const handleSuccess = useCallback4((response) => {
+  const handleSuccess = useCallback6((response) => {
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
     if (response.warning) {
       setWarning(response.warning);
@@ -2825,7 +3267,7 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
       router.hardPush(finalRedirectUrl);
     }
   }, [onSuccess, redirectUrl, router, skipRedirect]);
-  const verifyTOTP = useCallback4(async (sessionId, code) => {
+  const verifyTOTP = useCallback6(async (sessionId, code) => {
     if (!sessionId) {
       const msg = "Missing 2FA session ID";
       setError(msg);
@@ -2868,7 +3310,7 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
       setIsLoading(false);
     }
   }, [handleSuccess, onError]);
-  const verifyBackupCode = useCallback4(async (sessionId, backupCode) => {
+  const verifyBackupCode = useCallback6(async (sessionId, backupCode) => {
     if (!sessionId) {
       const msg = "Missing 2FA session ID";
       setError(msg);
@@ -2926,486 +3368,6 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
   };
 }, "useTwoFactorVerify");
 
-// src/auth/hooks/useAuthForm.ts
-var useAuthForm = /* @__PURE__ */ __name((options) => {
-  const {
-    onIdentifierSuccess,
-    onOTPSuccess,
-    onError,
-    sourceUrl,
-    redirectUrl,
-    requireTermsAcceptance = false,
-    marketingConsent: marketingConsentOption,
-    authPath = "/auth"
-  } = options;
-  const formState = useAuthFormState();
-  const validation = useAuthValidation();
-  const isAutoSubmitFromUrlRef = useRef4(false);
-  const processedOtpKeyRef = useRef4(null);
-  const {
-    requestOTP,
-    verifyOTP,
-    login,
-    getSavedEmail,
-    saveEmail
-  } = useAuth();
-  const {
-    identifier,
-    otp,
-    password,
-    acceptedTerms,
-    marketingConsent,
-    rememberMe,
-    twoFactorSessionId,
-    twoFactorCode,
-    useBackupCode,
-    setIdentifier,
-    setOtp,
-    setStep,
-    setError,
-    setIsLoading,
-    clearError,
-    setTwoFactorSessionId,
-    setShouldPrompt2FA,
-    setTwoFactorCode,
-    setUseBackupCode,
-    startRateLimitCountdown,
-    setWebmail
-  } = formState;
-  const twoFactor = useTwoFactorVerify({
-    onSuccess: /* @__PURE__ */ __name(() => {
-      authLogger.info("2FA verification successful, showing success screen");
-      setStep("success");
-      onOTPSuccess?.();
-    }, "onSuccess"),
-    onError: /* @__PURE__ */ __name((error) => {
-      setError(error);
-      onError?.(error);
-    }, "onError"),
-    redirectUrl,
-    skipRedirect: true
-    // We handle navigation via success step
-  });
-  const { validateIdentifier: validateIdentifier2 } = validation;
-  const saveIdentifierToStorage = useCallback5((id) => {
-    saveEmail(id);
-  }, [saveEmail]);
-  useEffect4(() => {
-    const savedEmail = getSavedEmail();
-    if (savedEmail) {
-      setIdentifier(savedEmail);
-    }
-  }, []);
-  const handleIdentifierSubmit = useCallback5(async (e) => {
-    e.preventDefault();
-    if (!identifier) {
-      const msg = "Please enter your email address";
-      setError(msg);
-      onError?.(msg);
-      return;
-    }
-    if (!validateIdentifier2(identifier)) {
-      const msg = "Please enter a valid email address";
-      setError(msg);
-      onError?.(msg);
-      return;
-    }
-    if (requireTermsAcceptance && !acceptedTerms) {
-      const msg = "Please accept the Terms of Service and Privacy Policy";
-      setError(msg);
-      onError?.(msg);
-      return;
-    }
-    setIsLoading(true);
-    clearError();
-    try {
-      const consent = marketingConsentOption ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion } : void 0;
-      const result = await requestOTP(identifier, sourceUrl, consent);
-      if (result.success) {
-        saveIdentifierToStorage(identifier);
-        setWebmail(result.webmail ?? null);
-        setStep("otp");
-        onIdentifierSuccess?.(identifier);
-      } else {
-        if (result.retryAfter) {
-          startRateLimitCountdown(result.retryAfter);
-          clearError();
-        } else {
-          setError(result.message);
-          onError?.(result.message);
-        }
-      }
-    } catch {
-      const msg = "An unexpected error occurred";
-      setError(msg);
-      onError?.(msg);
-    } finally {
-      setIsLoading(false);
-    }
-  }, [
-    identifier,
-    acceptedTerms,
-    requireTermsAcceptance,
-    marketingConsent,
-    marketingConsentOption,
-    validateIdentifier2,
-    requestOTP,
-    saveIdentifierToStorage,
-    setError,
-    setIsLoading,
-    setStep,
-    clearError,
-    setWebmail,
-    startRateLimitCountdown,
-    onIdentifierSuccess,
-    onError,
-    sourceUrl
-  ]);
-  const submitOTP = useCallback5(async (submitIdentifier, submitOtp) => {
-    if (!submitOtp || submitOtp.length < AUTH_CONSTANTS.EMAIL_OTP_LENGTH) {
-      const msg = `Please enter the ${AUTH_CONSTANTS.EMAIL_OTP_LENGTH}-digit verification code`;
-      setError(msg);
-      onError?.(msg);
-      return false;
-    }
-    setIsLoading(true);
-    clearError();
-    try {
-      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true, rememberMe);
-      if (result.requires_2fa && result.session_id) {
-        authLogger.info("2FA required after OTP verification");
-        setTwoFactorSessionId(result.session_id);
-        setShouldPrompt2FA(result.should_prompt_2fa || false);
-        setStep("2fa");
-        saveIdentifierToStorage(submitIdentifier);
-        return true;
-      }
-      if (result.success) {
-        saveIdentifierToStorage(submitIdentifier);
-        authLogger.info("OTP verification successful, showing success screen");
-        setStep("success");
-        onOTPSuccess?.();
-        return true;
-      } else {
-        setError(result.message);
-        onError?.(result.message);
-        return false;
-      }
-    } catch {
-      const msg = "An unexpected error occurred";
-      setError(msg);
-      onError?.(msg);
-      return false;
-    } finally {
-      setIsLoading(false);
-    }
-  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, rememberMe, setTwoFactorSessionId, setShouldPrompt2FA, setStep]);
-  const handleOTPSubmit = useCallback5(async (e) => {
-    e.preventDefault();
-    await submitOTP(identifier, otp);
-  }, [identifier, otp, submitOTP]);
-  const submitPassword = useCallback5(async (submitIdentifier, submitPassword_) => {
-    if (!submitIdentifier || !validateIdentifier2(submitIdentifier)) {
-      const msg = "Please enter a valid email address";
-      setError(msg);
-      onError?.(msg);
-      return false;
-    }
-    if (!submitPassword_) {
-      const msg = "Please enter your password";
-      setError(msg);
-      onError?.(msg);
-      return false;
-    }
-    setIsLoading(true);
-    clearError();
-    try {
-      const result = await login(submitIdentifier, submitPassword_, {
-        redirectUrl,
-        skipRedirect: true,
-        rememberMe
-      });
-      if (result.requires_2fa && result.session_id) {
-        authLogger.info("2FA required after password login");
-        setTwoFactorSessionId(result.session_id);
-        setShouldPrompt2FA(result.should_prompt_2fa || false);
-        setStep("2fa");
-        saveIdentifierToStorage(submitIdentifier);
-        return true;
-      }
-      if (result.success) {
-        saveIdentifierToStorage(submitIdentifier);
-        authLogger.info("Password login successful, showing success screen");
-        setStep("success");
-        onOTPSuccess?.();
-        return true;
-      }
-      if (result.retryAfter) {
-        startRateLimitCountdown(result.retryAfter);
-        clearError();
-      } else {
-        setError(result.message);
-        onError?.(result.message);
-      }
-      return false;
-    } catch {
-      const msg = "An unexpected error occurred";
-      setError(msg);
-      onError?.(msg);
-      return false;
-    } finally {
-      setIsLoading(false);
-    }
-  }, [
-    login,
-    validateIdentifier2,
-    saveIdentifierToStorage,
-    setError,
-    setIsLoading,
-    clearError,
-    startRateLimitCountdown,
-    onOTPSuccess,
-    onError,
-    redirectUrl,
-    rememberMe,
-    setTwoFactorSessionId,
-    setShouldPrompt2FA,
-    setStep
-  ]);
-  const handlePasswordSubmit = useCallback5(async (e) => {
-    e.preventDefault();
-    await submitPassword(identifier, password);
-  }, [identifier, password, submitPassword]);
-  const handleResendOTP = useCallback5(async () => {
-    setIsLoading(true);
-    clearError();
-    try {
-      const consent = marketingConsentOption ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion } : void 0;
-      const result = await requestOTP(identifier, sourceUrl, consent);
-      if (result.success) {
-        saveIdentifierToStorage(identifier);
-        setWebmail(result.webmail ?? null);
-        setOtp("");
-      } else {
-        if (result.retryAfter) {
-          startRateLimitCountdown(result.retryAfter);
-          clearError();
-        } else {
-          setError(result.message);
-          onError?.(result.message);
-        }
-      }
-    } catch {
-      const msg = "Failed to resend verification code";
-      setError(msg);
-      onError?.(msg);
-    } finally {
-      setIsLoading(false);
-    }
-  }, [identifier, marketingConsent, marketingConsentOption, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, startRateLimitCountdown, setWebmail, onError, sourceUrl]);
-  const handleBackToIdentifier = useCallback5(() => {
-    setStep("identifier");
-    clearError();
-  }, [setStep, clearError]);
-  const forceOTPStep = useCallback5(() => {
-    setStep("otp");
-    clearError();
-  }, [setStep, clearError]);
-  const handle2FASubmit = useCallback5(async (e) => {
-    e.preventDefault();
-    if (!twoFactorSessionId) {
-      const msg = "Missing 2FA session";
-      setError(msg);
-      onError?.(msg);
-      return;
-    }
-    if (useBackupCode) {
-      await twoFactor.verifyBackupCode(twoFactorSessionId, twoFactorCode);
-    } else {
-      await twoFactor.verifyTOTP(twoFactorSessionId, twoFactorCode);
-    }
-  }, [twoFactorSessionId, twoFactorCode, useBackupCode, twoFactor, setError, onError]);
-  const handleUseBackupCode = useCallback5(() => {
-    setUseBackupCode(true);
-    setTwoFactorCode("");
-    clearError();
-  }, [setUseBackupCode, setTwoFactorCode, clearError]);
-  const handleUseTOTP = useCallback5(() => {
-    setUseBackupCode(false);
-    setTwoFactorCode("");
-    clearError();
-  }, [setUseBackupCode, setTwoFactorCode, clearError]);
-  const handleOTPFromUrl = useCallback5((detectedOtp, detectedEmail) => {
-    const autoIdentifier = detectedEmail || getSavedEmail() || "";
-    if (!autoIdentifier) {
-      authLogger.warn("No identifier found for auto-submit (no email in URL or storage)");
-      return;
-    }
-    const otpKey = `${autoIdentifier}:${detectedOtp}`;
-    if (processedOtpKeyRef.current === otpKey) return;
-    if (isAutoSubmitFromUrlRef.current) return;
-    processedOtpKeyRef.current = otpKey;
-    isAutoSubmitFromUrlRef.current = true;
-    authLogger.info("OTP detected from URL, auto-submitting");
-    setIdentifier(autoIdentifier);
-    setOtp(detectedOtp);
-    setStep("otp");
-    setTimeout(async () => {
-      try {
-        await submitOTP(autoIdentifier, detectedOtp);
-      } finally {
-        isAutoSubmitFromUrlRef.current = false;
-      }
-    }, 100);
-  }, [getSavedEmail, setIdentifier, setOtp, setStep, submitOTP]);
-  useAutoAuth({
-    allowedPaths: [authPath],
-    onOTPDetected: handleOTPFromUrl,
-    cleanupUrl: true
-  });
-  return {
-    // State
-    ...formState,
-    // Submit handlers
-    handleIdentifierSubmit,
-    handleOTPSubmit,
-    handlePasswordSubmit,
-    handleResendOTP,
-    handleBackToIdentifier,
-    forceOTPStep,
-    // 2FA handlers
-    handle2FASubmit,
-    handleUseBackupCode,
-    handleUseTOTP,
-    // Validation
-    ...validation,
-    // Auto-submit ref
-    isAutoSubmittingFromUrl: isAutoSubmitFromUrlRef,
-    // 2FA state from hook (for loading indicator)
-    is2FALoading: twoFactor.isLoading,
-    twoFactorWarning: twoFactor.warning,
-    twoFactorAttemptsRemaining: twoFactor.attemptsRemaining
-  };
-}, "useAuthForm");
-
-// src/auth/hooks/useGithubAuth.ts
-import { useCallback as useCallback6, useState as useState5 } from "react";
-var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
-  const { sourceUrl, rememberMe = false, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
-  const router = useCfgRouter();
-  const [isLoading, setIsLoading] = useState5(false);
-  const [error, setError] = useState5(null);
-  const startGithubAuth = useCallback6(async () => {
-    setIsLoading(true);
-    setError(null);
-    auth.clearSession();
-    try {
-      authLogger.info("Starting GitHub OAuth flow...");
-      Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-      const result = await CfgAccountsOauth.cfgAccountsOauthGithubAuthorizeCreate({
-        body: {
-          source_url: sourceUrl || (typeof window !== "undefined" ? window.location.href : "")
-        },
-        throwOnError: true
-      });
-      const response = result.data;
-      if (!response.authorization_url) {
-        throw new Error("Failed to get authorization URL");
-      }
-      authLogger.info("Redirecting to GitHub...", response.authorization_url);
-      if (typeof window !== "undefined") {
-        sessionStorage.setItem("oauth_state", response.state);
-        sessionStorage.setItem("oauth_provider", "github");
-        sessionStorage.setItem("cfg.oauth.remember_me", String(rememberMe));
-      }
-      window.location.href = response.authorization_url;
-    } catch (err) {
-      const errorMessage = formatAuthError(err, "Failed to start GitHub authentication");
-      authLogger.error("GitHub OAuth start error:", err);
-      setError(errorMessage);
-      onError?.(errorMessage);
-      Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-    } finally {
-      setIsLoading(false);
-    }
-  }, [sourceUrl, rememberMe, onError]);
-  const handleGithubCallback = useCallback6(async (code, state) => {
-    setIsLoading(true);
-    setError(null);
-    try {
-      authLogger.info("Processing GitHub OAuth callback...");
-      let rememberMeForSession = false;
-      if (typeof window !== "undefined") {
-        const storedState = sessionStorage.getItem("oauth_state");
-        if (storedState && storedState !== state) {
-          throw new Error("Invalid OAuth state - possible CSRF attack");
-        }
-        rememberMeForSession = sessionStorage.getItem("cfg.oauth.remember_me") === "true";
-        sessionStorage.removeItem("oauth_state");
-        sessionStorage.removeItem("oauth_provider");
-        sessionStorage.removeItem("cfg.oauth.remember_me");
-      }
-      const result = await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({
-        body: { code, state, remember_me: rememberMeForSession },
-        throwOnError: true
-      });
-      const response = result.data;
-      if (response.requires_2fa && response.session_id) {
-        authLogger.info("GitHub OAuth requires 2FA, session:", response.session_id);
-        Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
-          category: "auth" /* AUTH */,
-          label: "github-2fa-required"
-        });
-        onRequires2FA?.(response.session_id, response.should_prompt_2fa || false);
-        return;
-      }
-      if (!response.access || !response.refresh) {
-        throw new Error("Invalid response from OAuth callback");
-      }
-      authLogger.info("GitHub OAuth successful, user:", response.user);
-      auth.setSession({ access: response.access, refresh: response.refresh });
-      Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-      if (response.user?.id) {
-        Analytics.setUser(String(response.user.id));
-      }
-      if (response.user) {
-        onSuccess?.(response.user, response.is_new_user || false);
-      }
-      if (!skipRedirect) {
-        const finalRedirectUrl = redirectUrl || "/private";
-        router.hardPush(finalRedirectUrl);
-      }
-      return;
-    } catch (err) {
-      const errorMessage = formatAuthError(err, "GitHub authentication failed");
-      authLogger.error("GitHub OAuth callback error:", err);
-      setError(errorMessage);
-      onError?.(errorMessage);
-      Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-    } finally {
-      setIsLoading(false);
-    }
-  }, [onSuccess, onError, onRequires2FA, redirectUrl, router, skipRedirect]);
-  return {
-    isLoading,
-    error,
-    startGithubAuth,
-    handleGithubCallback
-  };
-}, "useGithubAuth");
-
 // src/auth/hooks/useTwoFactorSetup.ts
 import { useCallback as useCallback7, useState as useState6 } from "react";
 var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
@@ -3960,7 +3922,7 @@ function useCfgAccountsOtpRequestCreate(config) {
     async (_key, { arg }) => {
       const res = await CfgAccountsOtp.cfgAccountsOtpRequestCreate({ ...arg, throwOnError: true });
       const data = res.data;
-      void import("./OTPRequestResponse-ZU5KRNSW.mjs").then(({ OTPRequestResponseSchema }) => {
+      void import("./OTPRequestResponse-TZSEVCID.mjs").then(({ OTPRequestResponseSchema }) => {
         const parsed = OTPRequestResponseSchema.safeParse(data);
         if (parsed.success) return;
         console.warn(
@@ -4564,7 +4526,8 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
         return {
           success: true,
           message: result.message || "OTP code sent to your email address",
-          webmail: result.webmail ?? null
+          webmail: result.webmail ?? null,
+          resendIn: result.resend_in
         };
       } catch (error) {
         logAuthFailure(authLogger, "Request OTP failed:", error);
@@ -4907,10 +4870,12 @@ export {
   AuthContext_default as AuthContext,
   AuthProvider,
   authLogger,
+  beginTwoFactorChallenge,
   clearProfileCache,
   consumeSavedRedirect,
   decodeBase64,
   encodeBase64,
+  endTwoFactorChallenge,
   formatAuthError,
   getCacheMetadata,
   getCachedProfile,
@@ -4943,6 +4908,7 @@ export {
   useSession,
   useSessionStorage,
   useTwoFactor,
+  useTwoFactorChallenge,
   useTwoFactorSetup,
   useTwoFactorStatus,
   useTwoFactorVerify,