@djangocfg/api 2.1.582 → 2.1.584

package/src/_api/generated/types.gen.ts

@@ -321,10 +321,6 @@ export type OAuthCallbackRequestRequest = {
      * Same redirect_uri used in authorize request. If not provided, uses config's site_url + callback_path
      */
     redirect_uri?: string;
-    /**
-     * Keep this browser signed in for 30 days
-     */
-    remember_me?: boolean;
 };
 
 /**
@@ -454,10 +450,6 @@ export type OAuthTokenResponse = {
      * True if user should be prompted to enable 2FA
      */
     should_prompt_2fa?: boolean;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session?: boolean;
 };
 
 /**
@@ -545,10 +537,6 @@ export type OtpVerifyRequest = {
      * Source URL for tracking login (e.g., https://my.djangocfg.com)
      */
     source_url?: string;
-    /**
-     * Keep this browser signed in for 30 days
-     */
-    remember_me?: boolean;
 };
 
 /**
@@ -589,10 +577,6 @@ export type OtpVerifyResponse = {
      * Whether user should be prompted to enable 2FA
      */
     should_prompt_2fa?: boolean;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session?: boolean;
 };
 
 /**
@@ -623,14 +607,12 @@ export type PasswordLoginError = {
  *
  * Subclasses SimpleJWT so the field/validation contract stays theirs, but
  * replaces ``validate()`` — the token pair itself is minted by the view via
- * ``mint_tokens_for_request`` so the DPoP binding and remembered-session
+ * ``mint_tokens_for_request`` so the DPoP binding and token
  * lifetime match OTP, OAuth and TOTP exactly.
  */
 export type PasswordLoginRequest = {
-    /**
-     * Keep this browser signed in for 30 days
-     */
-    remember_me?: boolean;
+    email: string;
+    password: string;
 };
 
 /**
@@ -664,10 +646,6 @@ export type PasswordLoginResponse = {
      * Whether user should be prompted to enable 2FA
      */
     should_prompt_2fa?: boolean;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session?: boolean;
 };
 
 /**
@@ -868,10 +846,6 @@ export type VerifyResponse = {
      * User profile data
      */
     user: TotpVerifyUser;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session: boolean;
     /**
      * Number of remaining backup codes (if backup code was used)
      */
@@ -1064,27 +1038,6 @@ export type OtpVerifyResponseWritable = {
      * Whether user should be prompted to enable 2FA
      */
     should_prompt_2fa?: boolean;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session?: boolean;
-};
-
-/**
- * Validate email+password against live accounts only.
- *
- * Subclasses SimpleJWT so the field/validation contract stays theirs, but
- * replaces ``validate()`` — the token pair itself is minted by the view via
- * ``mint_tokens_for_request`` so the DPoP binding and remembered-session
- * lifetime match OTP, OAuth and TOTP exactly.
- */
-export type PasswordLoginRequestWritable = {
-    /**
-     * Keep this browser signed in for 30 days
-     */
-    remember_me?: boolean;
-    email: string;
-    password: string;
 };
 
 /**
@@ -1118,10 +1071,6 @@ export type PasswordLoginResponseWritable = {
      * Whether user should be prompted to enable 2FA
      */
     should_prompt_2fa?: boolean;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session?: boolean;
 };
 
 export type TokenRefreshWritable = {
@@ -1171,10 +1120,6 @@ export type VerifyResponseWritable = {
      * User profile data
      */
     user: TotpVerifyUserWritable;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session: boolean;
     /**
      * Number of remaining backup codes (if backup code was used)
      */
@@ -1566,7 +1511,7 @@ export type CfgAccountsProfileUpdateUpdateResponses = {
 export type CfgAccountsProfileUpdateUpdateResponse = CfgAccountsProfileUpdateUpdateResponses[keyof CfgAccountsProfileUpdateUpdateResponses];
 
 export type CfgAccountsTokenCreateData = {
-    body: PasswordLoginRequestWritable;
+    body: PasswordLoginRequest;
     path?: never;
     query?: never;
     url: '/cfg/accounts/token/';

package/src/auth/__tests__/authRedirect.test.ts

@@ -37,7 +37,7 @@ function installSessionStorage() {
   return map;
 }
 
-const KEY = 'auth_redirect_url';
+const KEY = 'cfg.auth.redirect_url';
 
 describe('useAuthRedirectManager (storage-backed paths)', () => {
   beforeEach(() => {

package/src/auth/__tests__/passwordLogin.test.tsx

@@ -136,21 +136,19 @@ describe('AuthContext.login (password grant)', () => {
     expect(tokens).toEqual({ access: 'access-1', refresh: 'refresh-1' });
   });
 
-  it('sends email, password and remember_me to the password endpoint', async () => {
+  it('sends email and password to the password endpoint', async () => {
     respondWith({ requires_2fa: false, access: 'access-1', refresh: 'refresh-1', user: USER });
     const { result } = await renderAuth();
 
     await act(async () => {
       await result.current.login('jane@example.com', 'correct horse', {
         skipRedirect: true,
-        rememberMe: true,
       });
     });
 
     expect(loginWithPassword).toHaveBeenCalledWith({
       email: 'jane@example.com',
       password: 'correct horse',
-      remember_me: true,
     });
   });
 

package/src/auth/__tests__/profileCache.test.ts

@@ -30,7 +30,7 @@ function installBrowserStorage() {
   return map;
 }
 
-const CACHE_KEY = 'user_profile_cache';
+const CACHE_KEY = 'cfg.profile.cache';
 const NOW = 1_800_000_000_000;
 
 // Minimal User-shaped object; the cache is generic over its shape.

package/src/auth/context/AccountsContext.tsx

@@ -57,7 +57,7 @@ import type {
     OtpVerifyRequest,
     OtpRequestResponse,
     OtpVerifyResponse,
-    PasswordLoginRequestWritable,
+    PasswordLoginRequest,
     PasswordLoginResponse,
 } from '../../_api/generated/_cfg_accounts/types.gen';
 
@@ -79,7 +79,7 @@ export interface AccountsContextValue {
 
   requestOTP: (data: OtpRequestRequest) => Promise<OtpRequestResponse>;
   verifyOTP: (data: OtpVerifyRequest) => Promise<OtpVerifyResponse>;
-  loginWithPassword: (data: PasswordLoginRequestWritable) => Promise<PasswordLoginResponse>;
+  loginWithPassword: (data: PasswordLoginRequest) => Promise<PasswordLoginResponse>;
   logout: () => void;
 }
 
@@ -207,11 +207,9 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
 
     if (result.access && result.refresh) {
       // The ONE write path — atomic pair, notifies every session subscriber.
-      // Storage is always localStorage: "remember me" is a TOKEN LIFETIME
-      // decision the server already made (`remember_me` → REMEMBER_ME_LIFETIME),
-      // not a storage decision. Switching the client to sessionStorage here used
-      // to strand the tokens — the module reinitializes to localStorage on the
-      // next page load and would never look at sessionStorage again.
+      // Storage is always localStorage: session length is the token lifetime
+      // the server chose. A sessionStorage switch would strand the tokens — the
+      // module reinitializes to localStorage on the next page load.
       auth.setSession({ access: result.access, refresh: result.refresh });
       try {
         await refreshProfile({ callerId, force: true });
@@ -228,7 +226,7 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
   }, [triggerOtpVerify, settleLoginEnvelope]);
 
   const loginWithPassword = useCallback(async (
-    data: PasswordLoginRequestWritable,
+    data: PasswordLoginRequest,
   ): Promise<PasswordLoginResponse> => {
     // Errors propagate: the SWR trigger throws APIError for 401/429 and the
     // caller maps them. Nothing is written to the session on a failure.

package/src/auth/context/AuthContext.tsx

@@ -30,6 +30,7 @@ import React, {
 
 import { auth } from '../../_api/generated/helpers/auth';
 import { APIError } from '../../_api/generated/helpers';
+import { CFG_KEYS } from '../../_api/generated/helpers/keys';
 import { applyRoleLogPolicy } from '../../log-control';
 import { useCfgRouter, useLocalStorage, useQueryParams, useSession } from '../hooks';
 import { clearProfileCache } from '../hooks/useProfileCache';
@@ -68,7 +69,7 @@ export const resolveAuthRoutes = (
   defaultAuthCallback: routes?.defaultAuthCallback || routes?.auth || defaultRoutes.defaultAuthCallback,
 });
 
-const EMAIL_STORAGE_KEY = 'auth_email';
+const EMAIL_STORAGE_KEY = CFG_KEYS.email.key;
 
 const AuthContext = createContext<AuthContextType | undefined>(undefined);
 
@@ -287,7 +288,6 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
       sourceUrl?: string,
       redirectUrl?: string,
       skipRedirect?: boolean,
-      rememberMe = false,
     ): Promise<{
       success: boolean;
       message: string;
@@ -305,7 +305,6 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
           identifier,
           otp: otpCode,
           source_url: sourceUrl,
-          remember_me: rememberMe,
         });
 
         if (result.requires_2fa && result.session_id) {
@@ -378,7 +377,7 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
       password: string,
       options?: PasswordLoginOptions,
     ): Promise<PasswordLoginResult> => {
-      const { redirectUrl, skipRedirect, rememberMe = false } = options || {};
+      const { redirectUrl, skipRedirect } = options || {};
 
       try {
         // The caller opting out of redirect commits to handling ALL navigation
@@ -388,7 +387,6 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
         const result = await accountsRef.current.loginWithPassword({
           email,
           password,
-          remember_me: rememberMe,
         });
 
         if (result.requires_2fa && result.session_id) {

package/src/auth/context/types.ts

@@ -55,7 +55,7 @@ export interface AuthContextType {
 
   // OTP Methods - email only
   requestOTP: (identifier: string, sourceUrl?: string, consent?: OTPRequestConsent) => Promise<OTPRequestResult>;
-  verifyOTP: (identifier: string, otpCode: string, sourceUrl?: string, redirectUrl?: string, skipRedirect?: boolean, rememberMe?: boolean) => Promise<{
+  verifyOTP: (identifier: string, otpCode: string, sourceUrl?: string, redirectUrl?: string, skipRedirect?: boolean) => Promise<{
     success: boolean;
     message: string;
     user?: UserProfile;

package/src/auth/hooks/useAuthForm.ts

@@ -55,7 +55,6 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     password,
     acceptedTerms,
     marketingConsent,
-    rememberMe,
     setIdentifier,
     setOtp,
     setStep,
@@ -176,7 +175,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
 
     try {
       // Skip redirect - we'll show success screen first
-      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true, rememberMe);
+      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true);
 
       if (result.requires_2fa && result.session_id) {
         authLogger.info('2FA required after OTP verification');
@@ -205,7 +204,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     } finally {
       setIsLoading(false);
     }
-  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, rememberMe, setStep]);
+  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, setStep]);
 
   const handleOTPSubmit = useCallback(async (e: React.FormEvent) => {
     e.preventDefault();
@@ -244,7 +243,6 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
       const result = await login(submitIdentifier, submitPassword_, {
         redirectUrl,
         skipRedirect: true,
-        rememberMe,
       });
 
       if (result.requires_2fa && result.session_id) {
@@ -283,7 +281,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
   }, [
     login, validateIdentifier, saveIdentifierToStorage, setError, setIsLoading,
     clearError, startRateLimitCountdown, onOTPSuccess, onError, redirectUrl,
-    rememberMe, setStep,
+    setStep,
   ]);
 
   const handlePasswordSubmit = useCallback(async (e: React.FormEvent) => {

package/src/auth/hooks/useAuthFormState.ts

@@ -53,8 +53,6 @@ export const useAuthFormState = (
   // null until the marketing-consent feature (if enabled) resolves its
   // jurisdiction-aware default — the layout owns that decision.
   const [marketingConsent, setMarketingConsent] = useState<boolean | null>(null);
-  // Signed in for 30 days unless an app opts into showing the choice.
-  const [rememberMe, setRememberMe] = useState(true);
   const [step, setStep] = useState<AuthStep>('identifier');
   const [error, setError] = useState('');
   const [webmail, setWebmail] = useState<WebmailLink | null>(null);
@@ -72,7 +70,6 @@ export const useAuthFormState = (
     isLoading,
     acceptedTerms,
     marketingConsent,
-    rememberMe,
     step,
     error,
     rateLimitSeconds: rateLimit.seconds,
@@ -87,7 +84,6 @@ export const useAuthFormState = (
     setPassword,
     setAcceptedTerms,
     setMarketingConsent,
-    setRememberMe,
     setError,
     clearError,
     setStep,

package/src/auth/hooks/useAuthRedirect.ts

@@ -1,6 +1,7 @@
+import { CFG_KEYS } from '../../_api/generated/helpers/keys';
 import { useSessionStorage } from './useSessionStorage';
 
-const AUTH_REDIRECT_KEY = 'auth_redirect_url';
+const AUTH_REDIRECT_KEY = CFG_KEYS.redirectUrl.key;
 
 export interface AuthRedirectOptions {
   fallbackUrl?: string;
@@ -28,7 +29,7 @@ const clearRedirectFromStorage = (): void => {
   if (typeof window === 'undefined') return;
   try {
     window.sessionStorage.removeItem(AUTH_REDIRECT_KEY);
-    window.sessionStorage.removeItem(`${AUTH_REDIRECT_KEY}_timestamp`);
+    window.sessionStorage.removeItem(`${AUTH_REDIRECT_KEY}_ts`);
   } catch {
     // Ignore errors
   }

package/src/auth/hooks/useGithubAuth.ts

@@ -3,6 +3,7 @@
 import { useCallback, useState } from 'react';
 
 import { auth } from '../../_api/generated/helpers/auth';
+import { CFG_KEYS } from '../../_api/generated/helpers/keys';
 import { CfgAccountsOauth } from '../../_api/generated/sdk.gen';
 import type { OAuthTokenResponse } from '../../_api/generated/types.gen';
 import { Analytics, AnalyticsCategory, AnalyticsEvent } from '../utils/analytics';
@@ -10,6 +11,9 @@ import { formatAuthError } from '../utils/errors';
 import { authLogger } from '../utils/logger';
 import { useCfgRouter } from './useCfgRouter';
 
+const OAUTH_STATE_KEY = CFG_KEYS.oauthState.key;
+const OAUTH_PROVIDER_KEY = CFG_KEYS.oauthProvider.key;
+
 /**
  * The user payload as the OAuth endpoint declares it.
  *
@@ -22,8 +26,6 @@ export type OAuthUser = NonNullable<OAuthTokenResponse['user']>;
 
 export interface UseGithubAuthOptions {
   sourceUrl?: string;
-  /** Keep the completed browser session for 30 days. */
-  rememberMe?: boolean;
   /**
    * The OAuth endpoint's OpenAPI schema types `user` as a free-form object, so
    * this is what the server actually promises — not a `User`. Narrow it at the
@@ -65,7 +67,7 @@ export interface UseGithubAuthReturn {
  * ```
  */
 export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuthReturn => {
-  const { sourceUrl, rememberMe = false, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
+  const { sourceUrl, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
   const router = useCfgRouter();
 
   const [isLoading, setIsLoading] = useState(false);
@@ -107,9 +109,8 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
       authLogger.info('Redirecting to GitHub...', response.authorization_url);
 
       if (typeof window !== 'undefined') {
-        sessionStorage.setItem('oauth_state', response.state);
-        sessionStorage.setItem('oauth_provider', 'github');
-        sessionStorage.setItem('cfg.oauth.remember_me', String(rememberMe));
+        sessionStorage.setItem(OAUTH_STATE_KEY, response.state);
+        sessionStorage.setItem(OAUTH_PROVIDER_KEY, 'github');
       }
 
       window.location.href = response.authorization_url;
@@ -128,7 +129,7 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
     } finally {
       setIsLoading(false);
     }
-  }, [sourceUrl, rememberMe, onError]);
+  }, [sourceUrl, onError]);
 
   /**
    * Handle GitHub OAuth callback - exchanges code for JWT tokens.
@@ -144,22 +145,19 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
       authLogger.info('Processing GitHub OAuth callback...');
 
       // Verify state matches what we stored
-      let rememberMeForSession = false;
       if (typeof window !== 'undefined') {
-        const storedState = sessionStorage.getItem('oauth_state');
+        const storedState = sessionStorage.getItem(OAUTH_STATE_KEY);
         if (storedState && storedState !== state) {
           throw new Error('Invalid OAuth state - possible CSRF attack');
         }
-        rememberMeForSession = sessionStorage.getItem('cfg.oauth.remember_me') === 'true';
         // Clear stored state
-        sessionStorage.removeItem('oauth_state');
-        sessionStorage.removeItem('oauth_provider');
-        sessionStorage.removeItem('cfg.oauth.remember_me');
+        sessionStorage.removeItem(OAUTH_STATE_KEY);
+        sessionStorage.removeItem(OAUTH_PROVIDER_KEY);
 
       }
 
       const result = await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({
-        body: { code, state, remember_me: rememberMeForSession },
+        body: { code, state },
         throwOnError: true,
       });
       const response = result.data;
@@ -186,8 +184,8 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
       authLogger.info('GitHub OAuth successful, user:', response.user);
 
         // The ONE write path — atomic pair + session notification. Storage is
-        // always localStorage; session length is the server's call via
-        // `remember_me`. See AccountsContext.verifyOTP.
+        // always localStorage; session length is the server's call.
+        // See AccountsContext.verifyOTP.
       auth.setSession({ access: response.access, refresh: response.refresh });
 
         // Track successful OAuth

package/src/auth/hooks/useLocalStorage.ts

@@ -49,7 +49,7 @@ export function useLocalStorage<T>(key: string, initialValue: T) {
             const key = keys[i];
             if (key) {
               localStorage.removeItem(key);
-              localStorage.removeItem(`${key}_timestamp`);
+              localStorage.removeItem(`${key}_ts`);
             }
           } catch {
             // Ignore errors when removing items
@@ -88,7 +88,7 @@ export function useLocalStorage<T>(key: string, initialValue: T) {
         // Remove the key if data is too large
         try {
           window.localStorage.removeItem(key);
-          window.localStorage.removeItem(`${key}_timestamp`);
+          window.localStorage.removeItem(`${key}_ts`);
         } catch {
           // Ignore errors when removing
         }
@@ -109,7 +109,7 @@ export function useLocalStorage<T>(key: string, initialValue: T) {
             window.localStorage.setItem(key, JSON.stringify(valueToStore));
           }
           // Add timestamp for cleanup
-          window.localStorage.setItem(`${key}_timestamp`, Date.now().toString());
+          window.localStorage.setItem(`${key}_ts`, Date.now().toString());
         } catch (storageError: unknown) {
           // If quota exceeded, clear old data and try again
           if (isQuotaExceededError(storageError)) {
@@ -124,7 +124,7 @@ export function useLocalStorage<T>(key: string, initialValue: T) {
               } else {
                 window.localStorage.setItem(key, JSON.stringify(valueToStore));
               }
-              window.localStorage.setItem(`${key}_timestamp`, Date.now().toString());
+              window.localStorage.setItem(`${key}_ts`, Date.now().toString());
             } catch (retryError) {
               authLogger.error(`Failed to set localStorage key "${key}" after clearing old data:`, retryError);
               // If still fails, force clear all and try one more time
@@ -136,7 +136,7 @@ export function useLocalStorage<T>(key: string, initialValue: T) {
                 } else {
                   window.localStorage.setItem(key, JSON.stringify(valueToStore));
                 }
-                window.localStorage.setItem(`${key}_timestamp`, Date.now().toString());
+                window.localStorage.setItem(`${key}_ts`, Date.now().toString());
               } catch (finalError) {
                 authLogger.error(`Failed to set localStorage key "${key}" after force clearing:`, finalError);
                 // If still fails, just update the state without localStorage
@@ -163,7 +163,7 @@ export function useLocalStorage<T>(key: string, initialValue: T) {
       if (typeof window !== 'undefined') {
         try {
           window.localStorage.removeItem(key);
-          window.localStorage.removeItem(`${key}_timestamp`);
+          window.localStorage.removeItem(`${key}_ts`);
         } catch (removeError: unknown) {
           // If removal fails due to quota, try to clear some data first
           if (isQuotaExceededError(removeError)) {
@@ -172,7 +172,7 @@ export function useLocalStorage<T>(key: string, initialValue: T) {
             
             try {
               window.localStorage.removeItem(key);
-              window.localStorage.removeItem(`${key}_timestamp`);
+              window.localStorage.removeItem(`${key}_ts`);
             } catch (retryError) {
               authLogger.error(`Failed to remove localStorage key "${key}" after clearing:`, retryError);
               // If still fails, force clear all

package/src/auth/hooks/useProfileCache.ts

@@ -11,10 +11,11 @@
 
 import type { User } from '../../';
 import { authLogger as profileLogger } from '../utils/logger';
+import { CFG_KEYS } from '../../_api/generated/helpers/keys';
 import { decodeBase64, encodeBase64 } from './useBase64';
 
 // Cache configuration
-const CACHE_KEY = 'user_profile_cache';
+const CACHE_KEY = CFG_KEYS.profileCache.key;
 const CACHE_VERSION = 1;
 const DEFAULT_TTL = 14400000; // 4 hours in milliseconds (reduced API calls, more resilient)
 

package/src/auth/hooks/useSessionStorage.ts

@@ -39,7 +39,7 @@ export function useSessionStorage<T>(key: string, initialValue: T) {
             const key = keys[i];
             if (key) {
               sessionStorage.removeItem(key);
-              sessionStorage.removeItem(`${key}_timestamp`);
+              sessionStorage.removeItem(`${key}_ts`);
             }
           } catch {
             // Ignore errors when removing items
@@ -78,7 +78,7 @@ export function useSessionStorage<T>(key: string, initialValue: T) {
         // Remove the key if data is too large
         try {
           window.sessionStorage.removeItem(key);
-          window.sessionStorage.removeItem(`${key}_timestamp`);
+          window.sessionStorage.removeItem(`${key}_ts`);
         } catch {
           // Ignore errors when removing
         }
@@ -94,7 +94,7 @@ export function useSessionStorage<T>(key: string, initialValue: T) {
         try {
           window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
           // Add timestamp for cleanup
-          window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
+          window.sessionStorage.setItem(`${key}_ts`, Date.now().toString());
         } catch (storageError: unknown) {
           // If quota exceeded, clear old data and try again
           if (isQuotaExceededError(storageError)) {
@@ -104,14 +104,14 @@ export function useSessionStorage<T>(key: string, initialValue: T) {
             // Try again after clearing
             try {
               window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
-              window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
+              window.sessionStorage.setItem(`${key}_ts`, Date.now().toString());
             } catch (retryError) {
               authLogger.error(`Failed to set sessionStorage key "${key}" after clearing old data:`, retryError);
               // If still fails, force clear all and try one more time
               try {
                 forceClearAll();
                 window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
-                window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
+                window.sessionStorage.setItem(`${key}_ts`, Date.now().toString());
               } catch (finalError) {
                 authLogger.error(`Failed to set sessionStorage key "${key}" after force clearing:`, finalError);
                 // If still fails, just update the state without sessionStorage
@@ -138,7 +138,7 @@ export function useSessionStorage<T>(key: string, initialValue: T) {
       if (typeof window !== 'undefined') {
         try {
           window.sessionStorage.removeItem(key);
-          window.sessionStorage.removeItem(`${key}_timestamp`);
+          window.sessionStorage.removeItem(`${key}_ts`);
         } catch (removeError: unknown) {
           // If removal fails due to quota, try to clear some data first
           if (isQuotaExceededError(removeError)) {
@@ -147,7 +147,7 @@ export function useSessionStorage<T>(key: string, initialValue: T) {
             
             try {
               window.sessionStorage.removeItem(key);
-              window.sessionStorage.removeItem(`${key}_timestamp`);
+              window.sessionStorage.removeItem(`${key}_ts`);
             } catch (retryError) {
               authLogger.error(`Failed to remove sessionStorage key "${key}" after clearing:`, retryError);
               // If still fails, force clear all

package/src/auth/hooks/useTwoFactorVerify.ts

@@ -69,8 +69,8 @@ export const useTwoFactorVerify = (
   // copy it replaces cannot drift from the server contract any more.
   const handleSuccess = useCallback((response: VerifyResponse) => {
     // Save tokens — the ONE write path (atomic pair + session notification).
-    // Storage is always localStorage; session length is the server's call via
-    // `remember_me`. See AccountsContext.verifyOTP.
+    // Storage is always localStorage; session length is the server's call.
+    // See AccountsContext.verifyOTP.
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
 
     if (response.warning) {

package/src/auth/types/form.ts

@@ -52,8 +52,6 @@ export interface PasswordLoginOptions {
   redirectUrl?: string;
   /** Caller owns ALL navigation for this login, including the 2FA continuation. */
   skipRedirect?: boolean;
-  /** Ask the server for a 30-day session instead of the default lifetime. */
-  rememberMe?: boolean;
 }
 
 /**
@@ -99,8 +97,6 @@ export interface AuthFormState {
    * jurisdiction-aware default on mount.
    */
   marketingConsent: boolean | null;
-  /** Keep this browser signed in for 30 days after successful verification. */
-  rememberMe: boolean;
   /** Current form step */
   step: AuthStep;
   /** Error message */
@@ -129,7 +125,6 @@ export interface AuthFormStateHandlers {
   setPassword: (password: string) => void;
   setAcceptedTerms: (accepted: boolean) => void;
   setMarketingConsent: (consent: boolean | null) => void;
-  setRememberMe: (rememberMe: boolean) => void;
   setError: (error: string) => void;
   clearError: () => void;
   setStep: (step: AuthStep) => void;

package/src/storage.ts

@@ -0,0 +1,21 @@
+/**
+ * `@djangocfg/api/storage` — the browser-storage key registry on its own.
+ *
+ * Zero dependencies and no client: packages that only need a key, a guarded
+ * read/write or `createStorage('<owner>')` import this, not the generated SDK.
+ * The source is the generated `helpers/keys.ts`.
+ */
+export {
+  CFG_FAMILIES,
+  CFG_KEYS,
+  cfgStorage,
+  createStorage,
+  normalizeSegment,
+} from './_api/generated/helpers/keys';
+export type {
+  FamilySpec,
+  GuardedStorage,
+  KeySpec,
+  KeyStore,
+  StorageOptions,
+} from './_api/generated/helpers/keys';