@djangocfg/api 2.1.599 → 2.1.601

package/dist/auth.cjs

@@ -32,28 +32,70 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/_api/generated/_cfg_accounts/schemas/OAuthProviderEnum.ts
+var import_zod, OAuthProviderEnumSchema;
+var init_OAuthProviderEnum = __esm({
+  "src/_api/generated/_cfg_accounts/schemas/OAuthProviderEnum.ts"() {
+    "use strict";
+    import_zod = require("zod");
+    OAuthProviderEnumSchema = import_zod.z.enum(["github", "google"]);
+  }
+});
+
+// src/_api/generated/_cfg_accounts/schemas/OAuthProviderInfo.ts
+var import_zod2, OAuthProviderInfoSchema;
+var init_OAuthProviderInfo = __esm({
+  "src/_api/generated/_cfg_accounts/schemas/OAuthProviderInfo.ts"() {
+    "use strict";
+    import_zod2 = require("zod");
+    init_OAuthProviderEnum();
+    OAuthProviderInfoSchema = import_zod2.z.object({
+      id: OAuthProviderEnumSchema,
+      name: import_zod2.z.string(),
+      icon: import_zod2.z.string()
+    });
+  }
+});
+
+// src/_api/generated/_cfg_accounts/schemas/OAuthProvidersResponse.ts
+var OAuthProvidersResponse_exports = {};
+__export(OAuthProvidersResponse_exports, {
+  OAuthProvidersResponseSchema: () => OAuthProvidersResponseSchema
+});
+var import_zod3, OAuthProvidersResponseSchema;
+var init_OAuthProvidersResponse = __esm({
+  "src/_api/generated/_cfg_accounts/schemas/OAuthProvidersResponse.ts"() {
+    "use strict";
+    import_zod3 = require("zod");
+    init_OAuthProviderInfo();
+    OAuthProvidersResponseSchema = import_zod3.z.object({
+      providers: import_zod3.z.array(OAuthProviderInfoSchema)
+    });
+  }
+});
+
 // src/_api/generated/_cfg_accounts/schemas/WebmailLinkProviderEnum.ts
-var import_zod, WebmailLinkProviderEnumSchema;
+var import_zod4, WebmailLinkProviderEnumSchema;
 var init_WebmailLinkProviderEnum = __esm({
   "src/_api/generated/_cfg_accounts/schemas/WebmailLinkProviderEnum.ts"() {
     "use strict";
-    import_zod = require("zod");
-    WebmailLinkProviderEnumSchema = import_zod.z.enum(["gmail", "outlook", "yahoo", "icloud", "proton", "zoho", "aol", "fastmail", "gmx", "mailcom", "mail_ru", "yandex", "rambler", "qq", "netease", "sina", "aliyun", "naver", "daum", "web_de", "tonline", "seznam", "wp_pl", "o2_pl", "interia", "libero", "virgilio", "orange", "laposte", "free_fr", "sfr"]);
+    import_zod4 = require("zod");
+    WebmailLinkProviderEnumSchema = import_zod4.z.enum(["gmail", "outlook", "yahoo", "icloud", "proton", "zoho", "aol", "fastmail", "gmx", "mailcom", "mail_ru", "yandex", "rambler", "qq", "netease", "sina", "aliyun", "naver", "daum", "web_de", "tonline", "seznam", "wp_pl", "o2_pl", "interia", "libero", "virgilio", "orange", "laposte", "free_fr", "sfr"]);
   }
 });
 
 // src/_api/generated/_cfg_accounts/schemas/WebmailLink.ts
-var import_zod2, WebmailLinkSchema;
+var import_zod5, WebmailLinkSchema;
 var init_WebmailLink = __esm({
   "src/_api/generated/_cfg_accounts/schemas/WebmailLink.ts"() {
     "use strict";
-    import_zod2 = require("zod");
+    import_zod5 = require("zod");
     init_WebmailLinkProviderEnum();
-    WebmailLinkSchema = import_zod2.z.object({
+    WebmailLinkSchema = import_zod5.z.object({
       provider: WebmailLinkProviderEnumSchema,
-      provider_name: import_zod2.z.string(),
-      url: import_zod2.z.url().or(import_zod2.z.literal("")),
-      is_search: import_zod2.z.boolean()
+      provider_name: import_zod5.z.string(),
+      url: import_zod5.z.url().or(import_zod5.z.literal("")),
+      is_search: import_zod5.z.boolean()
     });
   }
 });
@@ -63,17 +105,17 @@ var OTPRequestResponse_exports = {};
 __export(OTPRequestResponse_exports, {
   OTPRequestResponseSchema: () => OTPRequestResponseSchema
 });
-var import_zod3, OTPRequestResponseSchema;
+var import_zod6, OTPRequestResponseSchema;
 var init_OTPRequestResponse = __esm({
   "src/_api/generated/_cfg_accounts/schemas/OTPRequestResponse.ts"() {
     "use strict";
-    import_zod3 = require("zod");
+    import_zod6 = require("zod");
     init_WebmailLink();
-    OTPRequestResponseSchema = import_zod3.z.object({
-      message: import_zod3.z.string(),
+    OTPRequestResponseSchema = import_zod6.z.object({
+      message: import_zod6.z.string(),
       webmail: WebmailLinkSchema.nullable().optional(),
-      resend_in: import_zod3.z.number().int().min(0).optional(),
-      expires_in: import_zod3.z.number().int().min(0).optional()
+      resend_in: import_zod6.z.number().int().min(0).optional(),
+      expires_in: import_zod6.z.number().int().min(0).optional()
     });
   }
 });
@@ -83,31 +125,31 @@ var User_exports = {};
 __export(User_exports, {
   UserSchema: () => UserSchema
 });
-var import_zod4, UserSchema;
+var import_zod7, UserSchema;
 var init_User = __esm({
   "src/_api/generated/_cfg_accounts/schemas/User.ts"() {
     "use strict";
-    import_zod4 = require("zod");
-    UserSchema = import_zod4.z.object({
-      id: import_zod4.z.number().int(),
-      email: import_zod4.z.email().or(import_zod4.z.literal("")),
-      first_name: import_zod4.z.string().max(50).nullable().optional(),
-      last_name: import_zod4.z.string().max(50).nullable().optional(),
-      full_name: import_zod4.z.string(),
-      initials: import_zod4.z.string(),
-      display_username: import_zod4.z.string(),
-      company: import_zod4.z.string().max(100).nullable().optional(),
-      phone: import_zod4.z.string().max(20).nullable().optional(),
-      position: import_zod4.z.string().max(100).nullable().optional(),
-      language: import_zod4.z.string().max(10).nullable().optional(),
-      timezone: import_zod4.z.string().max(64).nullable().optional(),
-      avatar: import_zod4.z.url().or(import_zod4.z.literal("")).nullable(),
-      is_staff: import_zod4.z.boolean(),
-      is_superuser: import_zod4.z.boolean(),
-      date_joined: import_zod4.z.string().datetime({ offset: true }),
-      last_login: import_zod4.z.string().datetime({ offset: true }).nullable(),
-      unanswered_messages_count: import_zod4.z.number().int().default(0),
-      api_key: import_zod4.z.string().nullable()
+    import_zod7 = require("zod");
+    UserSchema = import_zod7.z.object({
+      id: import_zod7.z.number().int(),
+      email: import_zod7.z.email().or(import_zod7.z.literal("")),
+      first_name: import_zod7.z.string().max(50).nullable().optional(),
+      last_name: import_zod7.z.string().max(50).nullable().optional(),
+      full_name: import_zod7.z.string(),
+      initials: import_zod7.z.string(),
+      display_username: import_zod7.z.string(),
+      company: import_zod7.z.string().max(100).nullable().optional(),
+      phone: import_zod7.z.string().max(20).nullable().optional(),
+      position: import_zod7.z.string().max(100).nullable().optional(),
+      language: import_zod7.z.string().max(10).nullable().optional(),
+      timezone: import_zod7.z.string().max(64).nullable().optional(),
+      avatar: import_zod7.z.url().or(import_zod7.z.literal("")).nullable(),
+      is_staff: import_zod7.z.boolean(),
+      is_superuser: import_zod7.z.boolean(),
+      date_joined: import_zod7.z.string().datetime({ offset: true }),
+      last_login: import_zod7.z.string().datetime({ offset: true }).nullable(),
+      unanswered_messages_count: import_zod7.z.number().int().default(0),
+      api_key: import_zod7.z.string().nullable()
     });
   }
 });
@@ -117,19 +159,19 @@ var OTPVerifyResponse_exports = {};
 __export(OTPVerifyResponse_exports, {
   OTPVerifyResponseSchema: () => OTPVerifyResponseSchema
 });
-var import_zod5, OTPVerifyResponseSchema;
+var import_zod8, OTPVerifyResponseSchema;
 var init_OTPVerifyResponse = __esm({
   "src/_api/generated/_cfg_accounts/schemas/OTPVerifyResponse.ts"() {
     "use strict";
-    import_zod5 = require("zod");
+    import_zod8 = require("zod");
     init_User();
-    OTPVerifyResponseSchema = import_zod5.z.object({
-      requires_2fa: import_zod5.z.boolean().default(false).optional(),
-      session_id: import_zod5.z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).nullable().optional(),
-      refresh: import_zod5.z.string().nullable().optional(),
-      access: import_zod5.z.string().nullable().optional(),
+    OTPVerifyResponseSchema = import_zod8.z.object({
+      requires_2fa: import_zod8.z.boolean().default(false).optional(),
+      session_id: import_zod8.z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).nullable().optional(),
+      refresh: import_zod8.z.string().nullable().optional(),
+      access: import_zod8.z.string().nullable().optional(),
       user: UserSchema.nullable().optional(),
-      should_prompt_2fa: import_zod5.z.boolean().optional()
+      should_prompt_2fa: import_zod8.z.boolean().optional()
     });
   }
 });
@@ -139,19 +181,19 @@ var PasswordLoginResponse_exports = {};
 __export(PasswordLoginResponse_exports, {
   PasswordLoginResponseSchema: () => PasswordLoginResponseSchema
 });
-var import_zod6, PasswordLoginResponseSchema;
+var import_zod9, PasswordLoginResponseSchema;
 var init_PasswordLoginResponse = __esm({
   "src/_api/generated/_cfg_accounts/schemas/PasswordLoginResponse.ts"() {
     "use strict";
-    import_zod6 = require("zod");
+    import_zod9 = require("zod");
     init_User();
-    PasswordLoginResponseSchema = import_zod6.z.object({
-      requires_2fa: import_zod6.z.boolean().default(false).optional(),
-      session_id: import_zod6.z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).nullable().optional(),
-      refresh: import_zod6.z.string().nullable().optional(),
-      access: import_zod6.z.string().nullable().optional(),
+    PasswordLoginResponseSchema = import_zod9.z.object({
+      requires_2fa: import_zod9.z.boolean().default(false).optional(),
+      session_id: import_zod9.z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).nullable().optional(),
+      refresh: import_zod9.z.string().nullable().optional(),
+      access: import_zod9.z.string().nullable().optional(),
       user: UserSchema.nullable().optional(),
-      should_prompt_2fa: import_zod6.z.boolean().optional()
+      should_prompt_2fa: import_zod9.z.boolean().optional()
     });
   }
 });
@@ -167,8 +209,10 @@ __export(auth_exports, {
   AnalyticsEvent: () => AnalyticsEvent,
   AuthContext: () => AuthContext_default,
   AuthProvider: () => AuthProvider,
+  OAUTH_PROVIDER_IDS: () => OAUTH_PROVIDER_IDS,
   authLogger: () => authLogger,
   beginTwoFactorChallenge: () => beginTwoFactorChallenge,
+  clearOAuthAttempt: () => clearOAuthAttempt,
   clearProfileCache: () => clearProfileCache,
   consumeSavedRedirect: () => consumeSavedRedirect,
   decodeBase64: () => decodeBase64,
@@ -180,10 +224,12 @@ __export(auth_exports, {
   hasValidCache: () => hasValidCache,
   isAllowedAuthPath: () => isAllowedAuthPath,
   isForbidden: () => isForbidden,
+  isOAuthProviderId: () => isOAuthProviderId,
   logAuthFailure: () => logAuthFailure,
   logger: () => logger,
   normalizePath: () => normalizePath,
   peekSavedRedirect: () => peekSavedRedirect,
+  readOAuthFailure: () => readOAuthFailure,
   resolveAuthError: () => resolveAuthError,
   resolveGuardIsAuthenticated: () => resolveGuardIsAuthenticated,
   resolveGuardIsLoading: () => resolveGuardIsLoading,
@@ -202,6 +248,8 @@ __export(auth_exports, {
   useDeleteAccount: () => useDeleteAccount,
   useGithubAuth: () => useGithubAuth,
   useLocalStorage: () => useLocalStorage,
+  useOAuthLogin: () => useOAuthLogin,
+  useOAuthProviders: () => useOAuthProviders,
   useQueryParams: () => useQueryParams,
   useSession: () => useSession,
   useSessionStorage: () => useSessionStorage,
@@ -230,7 +278,7 @@ var AUTH_CONSTANTS = {
 
 // src/auth/context/AuthContext.tsx
 var import_navigation4 = require("next/navigation");
-var import_react18 = require("react");
+var import_react20 = require("react");
 
 // src/_api/generated/helpers/errors.ts
 var APIError = class extends Error {
@@ -309,6 +357,7 @@ var CFG_KEYS = {
   redirectUrlTs: k("cfg.auth.redirect_url_ts", "session", true),
   oauthState: k("cfg.auth.oauth_state", "session", true),
   oauthProvider: k("cfg.auth.oauth_provider", "session", true),
+  oauthProviders: k("cfg.auth.oauth_providers", "session", false),
   profileCache: k("cfg.profile.cache", "local", true),
   monitorSessionId: k("cfg.monitor.session_id", "local", false),
   monitorSessionCookie: k("cfg.monitor.session_id", "cookie", false),
@@ -1896,8 +1945,8 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
   };
 }, "useAuthForm");
 
-// src/auth/hooks/useGithubAuth.ts
-var import_react10 = require("react");
+// src/auth/hooks/useOAuthLogin.ts
+var import_react11 = require("react");
 
 // src/_api/generated/core/bodySerializer.gen.ts
 var serializeFormDataPair = /* @__PURE__ */ __name((data, key, value) => {
@@ -2763,7 +2812,7 @@ var CfgAccountsOauth = class {
   /**
    * Start GitHub OAuth
    *
-   * Generate GitHub OAuth authorization URL. Redirect user to this URL to start authentication.
+   * Generate the GitHub authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.
    */
   static cfgAccountsOauthGithubAuthorizeCreate(options) {
     return (options?.client ?? client).post({
@@ -2778,7 +2827,7 @@ var CfgAccountsOauth = class {
   /**
    * Complete GitHub OAuth
    *
-   * Exchange authorization code for JWT tokens. Call this after GitHub redirects back with code.
+   * Exchange the authorization code for JWT tokens. Call this after GitHub redirects back with a code. The state is single use.
    */
   static cfgAccountsOauthGithubCallbackCreate(options) {
     return (options.client ?? client).post({
@@ -2790,10 +2839,40 @@ var CfgAccountsOauth = class {
       }
     });
   }
+  /**
+   * Start Google OAuth
+   *
+   * Generate the Google authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.
+   */
+  static cfgAccountsOauthGoogleAuthorizeCreate(options) {
+    return (options?.client ?? client).post({
+      url: "/cfg/accounts/oauth/google/authorize/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options?.headers
+      }
+    });
+  }
+  /**
+   * Complete Google OAuth
+   *
+   * Exchange the authorization code for JWT tokens. Call this after Google redirects back with a code. The state is single use.
+   */
+  static cfgAccountsOauthGoogleCallbackCreate(options) {
+    return (options.client ?? client).post({
+      url: "/cfg/accounts/oauth/google/callback/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
   /**
    * List OAuth providers
    *
-   * Get list of available OAuth providers for authentication.
+   * Providers that are configured, in display order. The login screen shows exactly these buttons.
    */
   static cfgAccountsOauthProvidersRetrieve(options) {
     return (options?.client ?? client).get({ url: "/cfg/accounts/oauth/providers/", ...options });
@@ -3264,6 +3343,27 @@ var Analytics = {
   }
 };
 
+// src/_api/generated/types.gen.ts
+var OAuthErrorCodeEnum = /* @__PURE__ */ ((OAuthErrorCodeEnum2) => {
+  OAuthErrorCodeEnum2["OAUTH_DISABLED"] = "oauth_disabled";
+  OAuthErrorCodeEnum2["GITHUB_OAUTH_DISABLED"] = "github_oauth_disabled";
+  OAuthErrorCodeEnum2["ORIGIN_NOT_ALLOWED"] = "origin_not_allowed";
+  OAuthErrorCodeEnum2["MISSING_REDIRECT_URI"] = "missing_redirect_uri";
+  OAuthErrorCodeEnum2["INVALID_STATE"] = "invalid_state";
+  OAuthErrorCodeEnum2["OAUTH_EXCHANGE_FAILED"] = "oauth_exchange_failed";
+  OAuthErrorCodeEnum2["INVALID_ID_TOKEN"] = "invalid_id_token";
+  OAuthErrorCodeEnum2["EMAIL_MISSING"] = "email_missing";
+  OAuthErrorCodeEnum2["EMAIL_NOT_VERIFIED"] = "email_not_verified";
+  OAuthErrorCodeEnum2["HOSTED_DOMAIN_NOT_ALLOWED"] = "hosted_domain_not_allowed";
+  OAuthErrorCodeEnum2["ACCOUNT_INACTIVE"] = "account_inactive";
+  OAuthErrorCodeEnum2["LINK_NOT_ALLOWED"] = "link_not_allowed";
+  OAuthErrorCodeEnum2["RATE_LIMITED"] = "rate_limited";
+  OAuthErrorCodeEnum2["PROVIDER_UNAVAILABLE"] = "provider_unavailable";
+  OAuthErrorCodeEnum2["SERVER_ERROR"] = "server_error";
+  OAuthErrorCodeEnum2["NOT_FOUND"] = "not_found";
+  return OAuthErrorCodeEnum2;
+})(OAuthErrorCodeEnum || {});
+
 // src/auth/utils/errors.ts
 var prop = /* @__PURE__ */ __name((value, key) => typeof value === "object" && value !== null ? value[key] : void 0, "prop");
 var TRANSPORT_FALLBACK = /^HTTP \d{3}:\s*/;
@@ -3325,126 +3425,24 @@ var logAuthFailure = /* @__PURE__ */ __name((log, message, error) => {
   log.error(message, error);
 }, "logAuthFailure");
 
-// src/auth/hooks/useGithubAuth.ts
-var OAUTH_STATE_KEY = CFG_KEYS.oauthState.key;
-var OAUTH_PROVIDER_KEY = CFG_KEYS.oauthProvider.key;
-var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
-  const { sourceUrl, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
-  const router = useCfgRouter();
-  const [isLoading, setIsLoading] = (0, import_react10.useState)(false);
-  const [error, setError] = (0, import_react10.useState)(null);
-  const startGithubAuth = (0, import_react10.useCallback)(async () => {
-    setIsLoading(true);
-    setError(null);
-    auth.clearSession();
-    try {
-      authLogger.info("Starting GitHub OAuth flow...");
-      Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-      const result = await CfgAccountsOauth.cfgAccountsOauthGithubAuthorizeCreate({
-        body: {
-          source_url: sourceUrl || (typeof window !== "undefined" ? window.location.href : "")
-        },
-        throwOnError: true
-      });
-      const response = result.data;
-      if (!response.authorization_url) {
-        throw new Error("Failed to get authorization URL");
-      }
-      authLogger.info("Redirecting to GitHub...", response.authorization_url);
-      if (typeof window !== "undefined") {
-        sessionStorage.setItem(OAUTH_STATE_KEY, response.state);
-        sessionStorage.setItem(OAUTH_PROVIDER_KEY, "github");
-      }
-      window.location.href = response.authorization_url;
-    } catch (err) {
-      const errorMessage = formatAuthError(err, "Failed to start GitHub authentication");
-      authLogger.error("GitHub OAuth start error:", err);
-      setError(errorMessage);
-      onError?.(errorMessage);
-      Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-    } finally {
-      setIsLoading(false);
-    }
-  }, [sourceUrl, onError]);
-  const handleGithubCallback = (0, import_react10.useCallback)(async (code, state) => {
-    setIsLoading(true);
-    setError(null);
-    try {
-      authLogger.info("Processing GitHub OAuth callback...");
-      if (typeof window !== "undefined") {
-        const storedState = sessionStorage.getItem(OAUTH_STATE_KEY);
-        if (storedState && storedState !== state) {
-          throw new Error("Invalid OAuth state - possible CSRF attack");
-        }
-        sessionStorage.removeItem(OAUTH_STATE_KEY);
-        sessionStorage.removeItem(OAUTH_PROVIDER_KEY);
-      }
-      const result = await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({
-        body: { code, state },
-        throwOnError: true
-      });
-      const response = result.data;
-      if (response.requires_2fa && response.session_id) {
-        authLogger.info("GitHub OAuth requires 2FA, session:", response.session_id);
-        Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
-          category: "auth" /* AUTH */,
-          label: "github-2fa-required"
-        });
-        onRequires2FA?.(response.session_id, response.should_prompt_2fa || false);
-        return;
-      }
-      if (!response.access || !response.refresh) {
-        throw new Error("Invalid response from OAuth callback");
-      }
-      authLogger.info("GitHub OAuth successful, user:", response.user);
-      auth.setSession({ access: response.access, refresh: response.refresh });
-      Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-      if (response.user?.id) {
-        Analytics.setUser(String(response.user.id));
-      }
-      if (response.user) {
-        onSuccess?.(response.user, response.is_new_user || false);
-      }
-      if (!skipRedirect) {
-        const finalRedirectUrl = redirectUrl || "/private";
-        router.hardPush(finalRedirectUrl);
-      }
-      return;
-    } catch (err) {
-      const errorMessage = formatAuthError(err, "GitHub authentication failed");
-      authLogger.error("GitHub OAuth callback error:", err);
-      setError(errorMessage);
-      onError?.(errorMessage);
-      Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-    } finally {
-      setIsLoading(false);
-    }
-  }, [onSuccess, onError, onRequires2FA, redirectUrl, router, skipRedirect]);
-  return {
-    isLoading,
-    error,
-    startGithubAuth,
-    handleGithubCallback
-  };
-}, "useGithubAuth");
-
-// src/auth/hooks/useTwoFactorVerify.ts
-var import_react12 = require("react");
+// src/auth/utils/oauthErrors.ts
+var SERVER_CODES = new Set(Object.values(OAuthErrorCodeEnum));
+var record = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null ? value : null, "record");
+var readOAuthFailure = /* @__PURE__ */ __name((err, fallback) => {
+  const body = record(record(err)?.response);
+  const code = body?.error;
+  if (typeof code === "string" && SERVER_CODES.has(code)) {
+    const description = body?.error_description;
+    return {
+      code,
+      message: typeof description === "string" && description ? description : fallback
+    };
+  }
+  return { message: formatAuthError(err, fallback) };
+}, "readOAuthFailure");
 
 // src/auth/hooks/useSessionStorage.ts
-var import_react11 = require("react");
+var import_react10 = require("react");
 
 // src/auth/utils/storage.ts
 var MAX_ITEM_KB = 1024;
@@ -3473,7 +3471,7 @@ __name(isWithinSizeLimit, "isWithinSizeLimit");
 
 // src/auth/hooks/useSessionStorage.ts
 function useSessionStorage(key, initialValue) {
-  const [storedValue, setStoredValue] = (0, import_react11.useState)(() => {
+  const [storedValue, setStoredValue] = (0, import_react10.useState)(() => {
     if (typeof window === "undefined") {
       return initialValue;
     }
@@ -3661,6 +3659,243 @@ var useAuthRedirectManager = /* @__PURE__ */ __name((options = {}) => {
   };
 }, "useAuthRedirectManager");
 
+// src/auth/hooks/useOAuthLogin.ts
+var ADAPTERS = {
+  github: {
+    authorize: /* @__PURE__ */ __name(async (body) => (await CfgAccountsOauth.cfgAccountsOauthGithubAuthorizeCreate({ body, throwOnError: true })).data, "authorize"),
+    callback: /* @__PURE__ */ __name(async (body) => (await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({ body, throwOnError: true })).data, "callback")
+  },
+  google: {
+    authorize: /* @__PURE__ */ __name(async (body) => (await CfgAccountsOauth.cfgAccountsOauthGoogleAuthorizeCreate({ body, throwOnError: true })).data, "authorize"),
+    callback: /* @__PURE__ */ __name(async (body) => (await CfgAccountsOauth.cfgAccountsOauthGoogleCallbackCreate({ body, throwOnError: true })).data, "callback")
+  }
+};
+var OAUTH_PROVIDER_IDS = Object.keys(ADAPTERS);
+var isOAuthProviderId = /* @__PURE__ */ __name((value) => typeof value === "string" && Object.hasOwn(ADAPTERS, value), "isOAuthProviderId");
+var STATE_KEY = CFG_KEYS.oauthState.key;
+var PROVIDER_KEY = CFG_KEYS.oauthProvider.key;
+var clearOAuthAttempt = /* @__PURE__ */ __name(() => {
+  cfgStorage.remove(STATE_KEY);
+  cfgStorage.remove(PROVIDER_KEY);
+}, "clearOAuthAttempt");
+var useOAuthLogin = /* @__PURE__ */ __name((options = {}) => {
+  const router = useCfgRouter();
+  const optionsRef = (0, import_react11.useRef)(options);
+  optionsRef.current = options;
+  const routerRef = (0, import_react11.useRef)(router);
+  routerRef.current = router;
+  const [loadingProvider, setLoadingProvider] = (0, import_react11.useState)(null);
+  const [error, setError] = (0, import_react11.useState)(null);
+  const [errorCode, setErrorCode] = (0, import_react11.useState)(null);
+  (0, import_react11.useEffect)(() => {
+    const onShow = /* @__PURE__ */ __name((event) => {
+      if (event.persisted) setLoadingProvider(null);
+    }, "onShow");
+    window.addEventListener("pageshow", onShow);
+    return () => window.removeEventListener("pageshow", onShow);
+  }, []);
+  const fail = (0, import_react11.useCallback)((provider, message, code) => {
+    setError(message);
+    setErrorCode(code ?? null);
+    setLoadingProvider(null);
+    optionsRef.current.onError?.(message, code);
+    Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
+      category: "auth" /* AUTH */,
+      label: provider
+    });
+  }, []);
+  const start = (0, import_react11.useCallback)(async (provider) => {
+    setLoadingProvider(provider);
+    setError(null);
+    setErrorCode(null);
+    auth.clearSession();
+    try {
+      Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
+        category: "auth" /* AUTH */,
+        label: provider
+      });
+      const sourceUrl = optionsRef.current.sourceUrl || window.location.href;
+      const response = await ADAPTERS[provider].authorize({ source_url: sourceUrl });
+      if (!response.authorization_url || !response.state) {
+        throw new Error("Failed to get authorization URL");
+      }
+      cfgStorage.write(STATE_KEY, response.state);
+      cfgStorage.write(PROVIDER_KEY, provider);
+      authLogger.info(`Redirecting to ${provider}...`);
+      window.location.href = response.authorization_url;
+    } catch (err) {
+      authLogger.error(`${provider} OAuth start error:`, err);
+      const failure = readOAuthFailure(err, "Failed to start authentication");
+      fail(provider, failure.message, failure.code);
+    }
+  }, [fail]);
+  const complete = (0, import_react11.useCallback)(async (provider, code, state) => {
+    setLoadingProvider(provider);
+    setError(null);
+    setErrorCode(null);
+    const storedState = cfgStorage.read(STATE_KEY);
+    const storedProvider = cfgStorage.read(PROVIDER_KEY);
+    clearOAuthAttempt();
+    if (!storedState || storedState !== state || storedProvider && storedProvider !== provider) {
+      authLogger.warn(`${provider} OAuth callback rejected: state does not match this browser`);
+      fail(provider, "Invalid sign-in attempt. Please try again.", "invalid_state");
+      return;
+    }
+    try {
+      const response = await ADAPTERS[provider].callback({ code, state });
+      if (response.requires_2fa && response.session_id) {
+        Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
+          category: "auth" /* AUTH */,
+          label: `${provider}-2fa-required`
+        });
+        optionsRef.current.onRequires2FA?.(response.session_id, response.should_prompt_2fa || false);
+        setLoadingProvider(null);
+        return;
+      }
+      if (!response.access || !response.refresh) {
+        throw new Error("Invalid response from OAuth callback");
+      }
+      auth.setSession({ access: response.access, refresh: response.refresh });
+      Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
+        category: "auth" /* AUTH */,
+        label: provider
+      });
+      if (response.user?.id) {
+        Analytics.setUser(String(response.user.id));
+      }
+      if (response.user) {
+        optionsRef.current.onSuccess?.(response.user, response.is_new_user || false, provider);
+      }
+      setLoadingProvider(null);
+      if (!optionsRef.current.skipRedirect) {
+        routerRef.current.hardPush(consumeSavedRedirect() || optionsRef.current.redirectUrl || "/private");
+      }
+    } catch (err) {
+      authLogger.error(`${provider} OAuth callback error:`, err);
+      const failure = readOAuthFailure(err, "Authentication failed");
+      fail(provider, failure.message, failure.code);
+    }
+  }, [fail]);
+  return {
+    isLoading: loadingProvider !== null,
+    loadingProvider,
+    error,
+    errorCode,
+    start,
+    complete
+  };
+}, "useOAuthLogin");
+
+// src/auth/hooks/useOAuthProviders.ts
+var import_react12 = require("react");
+
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthProvidersRetrieve.ts
+var import_swr = __toESM(require("swr"), 1);
+function useCfgAccountsOauthProvidersRetrieve(args, config) {
+  const { enabled = true, ...swrConfig } = config ?? {};
+  const key = enabled ? ["cfg_accounts_oauth_providers_retrieve", args ?? {}] : null;
+  return (0, import_swr.default)(
+    key,
+    async () => {
+      const res = await CfgAccountsOauth.cfgAccountsOauthProvidersRetrieve({ ...args ?? {}, throwOnError: true });
+      const data = res.data;
+      void Promise.resolve().then(() => (init_OAuthProvidersResponse(), OAuthProvidersResponse_exports)).then(({ OAuthProvidersResponseSchema: OAuthProvidersResponseSchema2 }) => {
+        const parsed = OAuthProvidersResponseSchema2.safeParse(data);
+        if (parsed.success) return;
+        console.warn(
+          "[zod] response did not match schema",
+          {
+            operation: "cfg_accounts_oauth_providers_retrieve",
+            method: "GET",
+            path: "/cfg/accounts/oauth/providers/",
+            issues: parsed.error.issues,
+            data
+          }
+        );
+        if (typeof window !== "undefined") {
+          try {
+            window.dispatchEvent(
+              new CustomEvent("zod-validation-error", {
+                detail: {
+                  operation: "cfg_accounts_oauth_providers_retrieve",
+                  method: "GET",
+                  path: "/cfg/accounts/oauth/providers/",
+                  issues: parsed.error.issues,
+                  data,
+                  timestamp: /* @__PURE__ */ new Date()
+                },
+                bubbles: true,
+                cancelable: false
+              })
+            );
+          } catch {
+          }
+        }
+      }).catch(() => {
+      });
+      return data;
+    },
+    swrConfig
+  );
+}
+__name(useCfgAccountsOauthProvidersRetrieve, "useCfgAccountsOauthProvidersRetrieve");
+
+// src/auth/hooks/useOAuthProviders.ts
+var EMPTY = [];
+var CACHE_KEY = CFG_KEYS.oauthProviders.key;
+var isInfo = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && typeof value.id === "string", "isInfo");
+var lastRaw = null;
+var lastParsed;
+var readCached = /* @__PURE__ */ __name(() => {
+  const raw = cfgStorage.read(CACHE_KEY);
+  if (raw === lastRaw) return lastParsed;
+  lastRaw = raw;
+  try {
+    const parsed = raw === null ? null : JSON.parse(raw);
+    lastParsed = Array.isArray(parsed) && parsed.every(isInfo) ? parsed : void 0;
+  } catch {
+    lastParsed = void 0;
+  }
+  return lastParsed;
+}, "readCached");
+var subscribe3 = /* @__PURE__ */ __name(() => () => {
+}, "subscribe");
+var serverSnapshot = /* @__PURE__ */ __name(() => void 0, "serverSnapshot");
+var useOAuthProviders = /* @__PURE__ */ __name(() => {
+  const cached = (0, import_react12.useSyncExternalStore)(subscribe3, readCached, serverSnapshot);
+  const { data, error, isLoading } = useCfgAccountsOauthProvidersRetrieve(void 0, {
+    revalidateOnFocus: false,
+    revalidateOnReconnect: false,
+    revalidateOnMount: true,
+    shouldRetryOnError: false,
+    dedupingInterval: 60 * 60 * 1e3,
+    fallbackData: cached && { providers: cached },
+    onSuccess: /* @__PURE__ */ __name((response) => {
+      cfgStorage.writeJSON(CACHE_KEY, response.providers);
+    }, "onSuccess")
+  });
+  const providers = (0, import_react12.useMemo)(
+    () => data?.providers.filter((p) => OAUTH_PROVIDER_IDS.includes(p.id)) ?? EMPTY,
+    [data]
+  );
+  return { providers, isReady: !isLoading || Boolean(error) || cached !== void 0 };
+}, "useOAuthProviders");
+
+// src/auth/hooks/useGithubAuth.ts
+var import_react13 = require("react");
+var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
+  const { isLoading, error, start, complete } = useOAuthLogin(options);
+  const startGithubAuth = (0, import_react13.useCallback)(() => start("github"), [start]);
+  const handleGithubCallback = (0, import_react13.useCallback)(
+    (code, state) => complete("github", code, state),
+    [complete]
+  );
+  return { isLoading, error, startGithubAuth, handleGithubCallback };
+}, "useGithubAuth");
+
+// src/auth/hooks/useTwoFactorVerify.ts
+var import_react14 = require("react");
+
 // src/auth/hooks/twoFactor.shared.ts
 var TOTP_CODE_LENGTH = 6;
 function extractAttemptsRemaining(err) {
@@ -3680,15 +3915,15 @@ __name(isValidTotpCode, "isValidTotpCode");
 var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
   const { onSuccess, onError, redirectUrl, skipRedirect = false } = options;
   const router = useCfgRouter();
-  const [isLoading, setIsLoading] = (0, import_react12.useState)(false);
-  const [error, setError] = (0, import_react12.useState)(null);
-  const [warning, setWarning] = (0, import_react12.useState)(null);
-  const [remainingBackupCodes, setRemainingBackupCodes] = (0, import_react12.useState)(null);
-  const [attemptsRemaining, setAttemptsRemaining] = (0, import_react12.useState)(null);
-  const clearError = (0, import_react12.useCallback)(() => {
+  const [isLoading, setIsLoading] = (0, import_react14.useState)(false);
+  const [error, setError] = (0, import_react14.useState)(null);
+  const [warning, setWarning] = (0, import_react14.useState)(null);
+  const [remainingBackupCodes, setRemainingBackupCodes] = (0, import_react14.useState)(null);
+  const [attemptsRemaining, setAttemptsRemaining] = (0, import_react14.useState)(null);
+  const clearError = (0, import_react14.useCallback)(() => {
     setError(null);
   }, []);
-  const handleSuccess = (0, import_react12.useCallback)((response) => {
+  const handleSuccess = (0, import_react14.useCallback)((response) => {
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
     if (response.warning) {
       setWarning(response.warning);
@@ -3710,7 +3945,7 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
       router.hardPush(finalRedirectUrl);
     }
   }, [onSuccess, redirectUrl, router, skipRedirect]);
-  const verifyTOTP = (0, import_react12.useCallback)(async (sessionId, code) => {
+  const verifyTOTP = (0, import_react14.useCallback)(async (sessionId, code) => {
     if (!sessionId) {
       const msg = "Missing 2FA session ID";
       setError(msg);
@@ -3753,7 +3988,7 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
       setIsLoading(false);
     }
   }, [handleSuccess, onError]);
-  const verifyBackupCode = (0, import_react12.useCallback)(async (sessionId, backupCode) => {
+  const verifyBackupCode = (0, import_react14.useCallback)(async (sessionId, backupCode) => {
     if (!sessionId) {
       const msg = "Missing 2FA session ID";
       setError(msg);
@@ -3812,26 +4047,26 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
 }, "useTwoFactorVerify");
 
 // src/auth/hooks/useTwoFactorSetup.ts
-var import_react13 = require("react");
+var import_react15 = require("react");
 var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
   const { onComplete, onError } = options;
-  const [isLoading, setIsLoading] = (0, import_react13.useState)(false);
-  const [error, setError] = (0, import_react13.useState)(null);
-  const [setupData, setSetupData] = (0, import_react13.useState)(null);
-  const [backupCodes, setBackupCodes] = (0, import_react13.useState)(null);
-  const [backupCodesWarning, setBackupCodesWarning] = (0, import_react13.useState)(null);
-  const [setupStep, setSetupStep] = (0, import_react13.useState)("idle");
-  const clearError = (0, import_react13.useCallback)(() => {
+  const [isLoading, setIsLoading] = (0, import_react15.useState)(false);
+  const [error, setError] = (0, import_react15.useState)(null);
+  const [setupData, setSetupData] = (0, import_react15.useState)(null);
+  const [backupCodes, setBackupCodes] = (0, import_react15.useState)(null);
+  const [backupCodesWarning, setBackupCodesWarning] = (0, import_react15.useState)(null);
+  const [setupStep, setSetupStep] = (0, import_react15.useState)("idle");
+  const clearError = (0, import_react15.useCallback)(() => {
     setError(null);
   }, []);
-  const resetSetup = (0, import_react13.useCallback)(() => {
+  const resetSetup = (0, import_react15.useCallback)(() => {
     setSetupData(null);
     setBackupCodes(null);
     setBackupCodesWarning(null);
     setSetupStep("idle");
     setError(null);
   }, []);
-  const startSetup = (0, import_react13.useCallback)(async (deviceName) => {
+  const startSetup = (0, import_react15.useCallback)(async (deviceName) => {
     setIsLoading(true);
     setError(null);
     setSetupStep("scanning");
@@ -3863,7 +4098,7 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
       setIsLoading(false);
     }
   }, [onError]);
-  const confirmSetup = (0, import_react13.useCallback)(async (code) => {
+  const confirmSetup = (0, import_react15.useCallback)(async (code) => {
     if (!setupData) {
       const msg = "Setup not started. Call startSetup() first.";
       setError(msg);
@@ -3919,16 +4154,16 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
 }, "useTwoFactorSetup");
 
 // src/auth/hooks/useTwoFactorStatus.ts
-var import_react14 = require("react");
+var import_react16 = require("react");
 var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
-  const [isLoading, setIsLoading] = (0, import_react14.useState)(false);
-  const [error, setError] = (0, import_react14.useState)(null);
-  const [has2FAEnabled, setHas2FAEnabled] = (0, import_react14.useState)(null);
-  const [devices, setDevices] = (0, import_react14.useState)([]);
-  const clearError = (0, import_react14.useCallback)(() => {
+  const [isLoading, setIsLoading] = (0, import_react16.useState)(false);
+  const [error, setError] = (0, import_react16.useState)(null);
+  const [has2FAEnabled, setHas2FAEnabled] = (0, import_react16.useState)(null);
+  const [devices, setDevices] = (0, import_react16.useState)([]);
+  const clearError = (0, import_react16.useCallback)(() => {
     setError(null);
   }, []);
-  const fetchStatus = (0, import_react14.useCallback)(async () => {
+  const fetchStatus = (0, import_react16.useCallback)(async () => {
     setIsLoading(true);
     setError(null);
     try {
@@ -3953,7 +4188,7 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
       setIsLoading(false);
     }
   }, []);
-  const disable2FA = (0, import_react14.useCallback)(async (code) => {
+  const disable2FA = (0, import_react16.useCallback)(async (code) => {
     if (!isValidTotpCode(code)) {
       setError("Please enter a 6-digit code");
       return false;
@@ -3996,9 +4231,9 @@ var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
 }, "useTwoFactor");
 
 // src/auth/hooks/useLocalStorage.ts
-var import_react15 = require("react");
+var import_react17 = require("react");
 function useLocalStorage(key, initialValue) {
-  const [storedValue, setStoredValue] = (0, import_react15.useState)(() => {
+  const [storedValue, setStoredValue] = (0, import_react17.useState)(() => {
     if (typeof window === "undefined") {
       return initialValue;
     }
@@ -4190,13 +4425,13 @@ function useBase64() {
 __name(useBase64, "useBase64");
 
 // src/auth/hooks/useProfileCache.ts
-var CACHE_KEY = CFG_KEYS.profileCache.key;
+var CACHE_KEY2 = CFG_KEYS.profileCache.key;
 var CACHE_VERSION = 1;
 var DEFAULT_TTL = 144e5;
 function getCachedProfile() {
   try {
     if (typeof window === "undefined") return null;
-    const cached = localStorage.getItem(CACHE_KEY);
+    const cached = localStorage.getItem(CACHE_KEY2);
     if (!cached) {
       authLogger.debug("No cached profile found");
       return null;
@@ -4234,7 +4469,7 @@ function setCachedProfile(profile, options) {
       ttl: options?.ttl || DEFAULT_TTL
     };
     const encoded = encodeBase64(JSON.stringify(cachedData));
-    localStorage.setItem(CACHE_KEY, encoded);
+    localStorage.setItem(CACHE_KEY2, encoded);
     authLogger.debug("Profile cached, TTL:", cachedData.ttl / 1e3, "seconds");
   } catch (error) {
     authLogger.error("Error writing cache:", error);
@@ -4244,7 +4479,7 @@ __name(setCachedProfile, "setCachedProfile");
 function clearProfileCache() {
   try {
     if (typeof window === "undefined") return;
-    localStorage.removeItem(CACHE_KEY);
+    localStorage.removeItem(CACHE_KEY2);
     authLogger.debug("Cache cleared");
   } catch (error) {
     authLogger.error("Error clearing cache:", error);
@@ -4258,7 +4493,7 @@ __name(hasValidCache, "hasValidCache");
 function getCacheMetadata() {
   try {
     if (typeof window === "undefined") return null;
-    const cached = localStorage.getItem(CACHE_KEY);
+    const cached = localStorage.getItem(CACHE_KEY2);
     if (!cached) return { exists: false };
     const decoded = decodeBase64(cached);
     const cachedData = JSON.parse(decoded);
@@ -4279,15 +4514,15 @@ function getCacheMetadata() {
 __name(getCacheMetadata, "getCacheMetadata");
 
 // src/auth/hooks/useDeleteAccount.ts
-var import_react16 = require("react");
+var import_react18 = require("react");
 var useDeleteAccount = /* @__PURE__ */ __name(() => {
-  const [isLoading, setIsLoading] = (0, import_react16.useState)(false);
-  const [error, setError] = (0, import_react16.useState)(null);
+  const [isLoading, setIsLoading] = (0, import_react18.useState)(false);
+  const [error, setError] = (0, import_react18.useState)(null);
   const { logout } = useAuth();
-  const clearError = (0, import_react16.useCallback)(() => {
+  const clearError = (0, import_react18.useCallback)(() => {
     setError(null);
   }, []);
-  const deleteAccount = (0, import_react16.useCallback)(async () => {
+  const deleteAccount = (0, import_react18.useCallback)(async () => {
     setIsLoading(true);
     setError(null);
     try {
@@ -4317,13 +4552,13 @@ var useDeleteAccount = /* @__PURE__ */ __name(() => {
 }, "useDeleteAccount");
 
 // src/auth/context/AccountsContext.tsx
-var import_react17 = require("react");
+var import_react19 = require("react");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRegenerateCreate.ts
 var import_mutation = __toESM(require("swr/mutation"), 1);
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRetrieve.ts
-var import_swr = __toESM(require("swr"), 1);
+var import_swr2 = __toESM(require("swr"), 1);
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRevealCreate.ts
 var import_mutation2 = __toESM(require("swr/mutation"), 1);
@@ -4332,7 +4567,7 @@ var import_mutation2 = __toESM(require("swr/mutation"), 1);
 var import_mutation3 = __toESM(require("swr/mutation"), 1);
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthConnectionsList.ts
-var import_swr2 = __toESM(require("swr"), 1);
+var import_swr3 = __toESM(require("swr"), 1);
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthDisconnectCreate.ts
 var import_mutation4 = __toESM(require("swr/mutation"), 1);
@@ -4343,16 +4578,19 @@ var import_mutation5 = __toESM(require("swr/mutation"), 1);
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGithubCallbackCreate.ts
 var import_mutation6 = __toESM(require("swr/mutation"), 1);
 
-// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthProvidersRetrieve.ts
-var import_swr3 = __toESM(require("swr"), 1);
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGoogleAuthorizeCreate.ts
+var import_mutation7 = __toESM(require("swr/mutation"), 1);
+
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGoogleCallbackCreate.ts
+var import_mutation8 = __toESM(require("swr/mutation"), 1);
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpConsentPolicyRetrieve.ts
 var import_swr4 = __toESM(require("swr"), 1);
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpRequestCreate.ts
-var import_mutation7 = __toESM(require("swr/mutation"), 1);
+var import_mutation9 = __toESM(require("swr/mutation"), 1);
 function useCfgAccountsOtpRequestCreate(config) {
-  return (0, import_mutation7.default)(
+  return (0, import_mutation9.default)(
     ["cfg_accounts_otp_request_create"],
     async (_key, { arg }) => {
       const res = await CfgAccountsOtp.cfgAccountsOtpRequestCreate({ ...arg, throwOnError: true });
@@ -4399,9 +4637,9 @@ function useCfgAccountsOtpRequestCreate(config) {
 __name(useCfgAccountsOtpRequestCreate, "useCfgAccountsOtpRequestCreate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpVerifyCreate.ts
-var import_mutation8 = __toESM(require("swr/mutation"), 1);
+var import_mutation10 = __toESM(require("swr/mutation"), 1);
 function useCfgAccountsOtpVerifyCreate(config) {
-  return (0, import_mutation8.default)(
+  return (0, import_mutation10.default)(
     ["cfg_accounts_otp_verify_create"],
     async (_key, { arg }) => {
       const res = await CfgAccountsOtp.cfgAccountsOtpVerifyCreate({ ...arg, throwOnError: true });
@@ -4448,9 +4686,9 @@ function useCfgAccountsOtpVerifyCreate(config) {
 __name(useCfgAccountsOtpVerifyCreate, "useCfgAccountsOtpVerifyCreate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileAvatarCreate.ts
-var import_mutation9 = __toESM(require("swr/mutation"), 1);
+var import_mutation11 = __toESM(require("swr/mutation"), 1);
 function useCfgAccountsProfileAvatarCreate(config) {
-  return (0, import_mutation9.default)(
+  return (0, import_mutation11.default)(
     ["cfg_accounts_profile_avatar_create"],
     async (_key, { arg }) => {
       const res = await CfgAccountsProfile.cfgAccountsProfileAvatarCreate({ ...arg, throwOnError: true });
@@ -4497,15 +4735,15 @@ function useCfgAccountsProfileAvatarCreate(config) {
 __name(useCfgAccountsProfileAvatarCreate, "useCfgAccountsProfileAvatarCreate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileDeleteCreate.ts
-var import_mutation10 = __toESM(require("swr/mutation"), 1);
+var import_mutation12 = __toESM(require("swr/mutation"), 1);
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfilePartialPartialUpdate.ts
-var import_mutation11 = __toESM(require("swr/mutation"), 1);
+var import_mutation13 = __toESM(require("swr/mutation"), 1);
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfilePartialUpdate.ts
-var import_mutation12 = __toESM(require("swr/mutation"), 1);
+var import_mutation14 = __toESM(require("swr/mutation"), 1);
 function useCfgAccountsProfilePartialUpdate(config) {
-  return (0, import_mutation12.default)(
+  return (0, import_mutation14.default)(
     ["cfg_accounts_profile_partial_update"],
     async (_key, { arg }) => {
       const res = await CfgAccountsProfile.cfgAccountsProfilePartialUpdate({ ...arg, throwOnError: true });
@@ -4555,12 +4793,12 @@ __name(useCfgAccountsProfilePartialUpdate, "useCfgAccountsProfilePartialUpdate")
 var import_swr5 = __toESM(require("swr"), 1);
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileUpdatePartialUpdate.ts
-var import_mutation13 = __toESM(require("swr/mutation"), 1);
+var import_mutation15 = __toESM(require("swr/mutation"), 1);
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileUpdateUpdate.ts
-var import_mutation14 = __toESM(require("swr/mutation"), 1);
+var import_mutation16 = __toESM(require("swr/mutation"), 1);
 function useCfgAccountsProfileUpdateUpdate(config) {
-  return (0, import_mutation14.default)(
+  return (0, import_mutation16.default)(
     ["cfg_accounts_profile_update_update"],
     async (_key, { arg }) => {
       const res = await CfgAccountsProfile.cfgAccountsProfileUpdateUpdate({ ...arg, throwOnError: true });
@@ -4607,12 +4845,12 @@ function useCfgAccountsProfileUpdateUpdate(config) {
 __name(useCfgAccountsProfileUpdateUpdate, "useCfgAccountsProfileUpdateUpdate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenBlacklistCreate.ts
-var import_mutation15 = __toESM(require("swr/mutation"), 1);
+var import_mutation17 = __toESM(require("swr/mutation"), 1);
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenCreate.ts
-var import_mutation16 = __toESM(require("swr/mutation"), 1);
+var import_mutation18 = __toESM(require("swr/mutation"), 1);
 function useCfgAccountsTokenCreate(config) {
-  return (0, import_mutation16.default)(
+  return (0, import_mutation18.default)(
     ["cfg_accounts_token_create"],
     async (_key, { arg }) => {
       const res = await CfgAccountsAuth.cfgAccountsTokenCreate({ ...arg, throwOnError: true });
@@ -4659,7 +4897,7 @@ function useCfgAccountsTokenCreate(config) {
 __name(useCfgAccountsTokenCreate, "useCfgAccountsTokenCreate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
-var import_mutation17 = __toESM(require("swr/mutation"), 1);
+var import_mutation19 = __toESM(require("swr/mutation"), 1);
 
 // src/auth/context/AccountsContext.tsx
 var import_jsx_runtime = require("react/jsx-runtime");
@@ -4674,21 +4912,21 @@ function hasApiOrigin() {
   }
 }
 __name(hasApiOrigin, "hasApiOrigin");
-var AccountsContext = (0, import_react17.createContext)(void 0);
+var AccountsContext = (0, import_react19.createContext)(void 0);
 function AccountsProvider({ children }) {
-  const [profile, setProfile] = (0, import_react17.useState)(() => {
+  const [profile, setProfile] = (0, import_react19.useState)(() => {
     const cached = getCachedProfile();
     return cached || void 0;
   });
-  const [isLoadingProfile, setIsLoadingProfile] = (0, import_react17.useState)(false);
-  const [profileError, setProfileError] = (0, import_react17.useState)(null);
-  const profileRef = (0, import_react17.useRef)(profile);
-  const isLoadingRef = (0, import_react17.useRef)(false);
-  const fetchSeqRef = (0, import_react17.useRef)(0);
-  (0, import_react17.useEffect)(() => {
+  const [isLoadingProfile, setIsLoadingProfile] = (0, import_react19.useState)(false);
+  const [profileError, setProfileError] = (0, import_react19.useState)(null);
+  const profileRef = (0, import_react19.useRef)(profile);
+  const isLoadingRef = (0, import_react19.useRef)(false);
+  const fetchSeqRef = (0, import_react19.useRef)(0);
+  (0, import_react19.useEffect)(() => {
     profileRef.current = profile;
   }, [profile]);
-  (0, import_react17.useEffect)(() => {
+  (0, import_react19.useEffect)(() => {
     isLoadingRef.current = isLoadingProfile;
   }, [isLoadingProfile]);
   const { trigger: triggerProfileUpdate } = useCfgAccountsProfileUpdateUpdate();
@@ -4697,7 +4935,7 @@ function AccountsProvider({ children }) {
   const { trigger: triggerOtpRequest } = useCfgAccountsOtpRequestCreate();
   const { trigger: triggerOtpVerify } = useCfgAccountsOtpVerifyCreate();
   const { trigger: triggerPasswordLogin } = useCfgAccountsTokenCreate();
-  const refreshProfile = (0, import_react17.useCallback)(async (options) => {
+  const refreshProfile = (0, import_react19.useCallback)(async (options) => {
     const { callerId, force } = options || {};
     if (!hasApiOrigin()) {
       authLogger.debug(`No API origin configured, skipping profile fetch (caller: ${callerId})`);
@@ -4731,26 +4969,26 @@ function AccountsProvider({ children }) {
       }
     }
   }, []);
-  const updateProfile = (0, import_react17.useCallback)(async (data) => {
+  const updateProfile = (0, import_react19.useCallback)(async (data) => {
     await triggerProfileUpdate({ body: data });
     const user = await refreshProfile({ callerId: "updateProfile", force: true });
     return user;
   }, [triggerProfileUpdate, refreshProfile]);
-  const partialUpdateProfile = (0, import_react17.useCallback)(async (data) => {
+  const partialUpdateProfile = (0, import_react19.useCallback)(async (data) => {
     await triggerProfilePartialUpdate({ body: data });
     const user = await refreshProfile({ callerId: "partialUpdateProfile", force: true });
     return user;
   }, [triggerProfilePartialUpdate, refreshProfile]);
-  const uploadAvatar = (0, import_react17.useCallback)(async (avatar) => {
+  const uploadAvatar = (0, import_react19.useCallback)(async (avatar) => {
     await triggerAvatar({ body: { avatar } });
     const user = await refreshProfile({ callerId: "uploadAvatar", force: true });
     return user;
   }, [triggerAvatar, refreshProfile]);
-  const requestOTP = (0, import_react17.useCallback)(async (data) => {
+  const requestOTP = (0, import_react19.useCallback)(async (data) => {
     const result = await triggerOtpRequest({ body: data });
     return result;
   }, [triggerOtpRequest]);
-  const settleLoginEnvelope = (0, import_react17.useCallback)(async (result, callerId) => {
+  const settleLoginEnvelope = (0, import_react19.useCallback)(async (result, callerId) => {
     if (result.requires_2fa && result.session_id) {
       authLogger.info("2FA required, session:", result.session_id);
       return;
@@ -4764,17 +5002,17 @@ function AccountsProvider({ children }) {
       }
     }
   }, [refreshProfile]);
-  const verifyOTP = (0, import_react17.useCallback)(async (data) => {
+  const verifyOTP = (0, import_react19.useCallback)(async (data) => {
     const result = await triggerOtpVerify({ body: data });
     await settleLoginEnvelope(result, "verifyOTP");
     return result;
   }, [triggerOtpVerify, settleLoginEnvelope]);
-  const loginWithPassword = (0, import_react17.useCallback)(async (data) => {
+  const loginWithPassword = (0, import_react19.useCallback)(async (data) => {
     const result = await triggerPasswordLogin({ body: data });
     await settleLoginEnvelope(result, "loginWithPassword");
     return result;
   }, [triggerPasswordLogin, settleLoginEnvelope]);
-  const logout = (0, import_react17.useCallback)(() => {
+  const logout = (0, import_react19.useCallback)(() => {
     const refresh = auth.getRefreshToken();
     if (refresh) {
       CfgAccountsAuth.cfgAccountsTokenBlacklistCreate({ body: { refresh } }).catch(() => {
@@ -4786,7 +5024,7 @@ function AccountsProvider({ children }) {
     setProfileError(null);
     clearProfileCache();
   }, []);
-  const value = (0, import_react17.useMemo)(() => ({
+  const value = (0, import_react19.useMemo)(() => ({
     profile,
     isLoadingProfile,
     profileError,
@@ -4815,7 +5053,7 @@ function AccountsProvider({ children }) {
 }
 __name(AccountsProvider, "AccountsProvider");
 function useAccountsContext() {
-  const context = (0, import_react17.useContext)(AccountsContext);
+  const context = (0, import_react19.useContext)(AccountsContext);
   if (!context) {
     throw new Error("useAccountsContext must be used within AccountsProvider");
   }
@@ -4836,7 +5074,7 @@ var resolveAuthRoutes = /* @__PURE__ */ __name((routes) => ({
   defaultAuthCallback: routes?.defaultAuthCallback || routes?.auth || defaultRoutes.defaultAuthCallback
 }), "resolveAuthRoutes");
 var EMAIL_STORAGE_KEY = CFG_KEYS.email.key;
-var AuthContext = (0, import_react18.createContext)(void 0);
+var AuthContext = (0, import_react20.createContext)(void 0);
 var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const accounts = useAccountsContext();
   const session = useSession();
@@ -4848,28 +5086,28 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     EMAIL_STORAGE_KEY,
     null
   );
-  const routes = (0, import_react18.useMemo)(() => resolveAuthRoutes(config?.routes), [config?.routes]);
-  const routesRef = (0, import_react18.useRef)(routes);
-  (0, import_react18.useEffect)(() => {
+  const routes = (0, import_react20.useMemo)(() => resolveAuthRoutes(config?.routes), [config?.routes]);
+  const routesRef = (0, import_react20.useRef)(routes);
+  (0, import_react20.useEffect)(() => {
     routesRef.current = routes;
   }, [routes]);
   const redirectManager = useAuthRedirectManager({
     fallbackUrl: routes.defaultCallback,
     clearOnUse: true
   });
-  const configRef = (0, import_react18.useRef)(config);
-  (0, import_react18.useEffect)(() => {
+  const configRef = (0, import_react20.useRef)(config);
+  (0, import_react20.useEffect)(() => {
     configRef.current = config;
   }, [config]);
-  const accountsRef = (0, import_react18.useRef)(accounts);
-  (0, import_react18.useEffect)(() => {
+  const accountsRef = (0, import_react20.useRef)(accounts);
+  (0, import_react20.useEffect)(() => {
     accountsRef.current = accounts;
   }, [accounts]);
-  const pendingManualNavRef = (0, import_react18.useRef)(false);
-  const [profileSettled, setProfileSettled] = (0, import_react18.useState)(false);
+  const pendingManualNavRef = (0, import_react20.useRef)(false);
+  const [profileSettled, setProfileSettled] = (0, import_react20.useState)(false);
   const hasProfile = Boolean(accounts.profile);
-  const profileAttemptedRef = (0, import_react18.useRef)(false);
-  (0, import_react18.useEffect)(() => {
+  const profileAttemptedRef = (0, import_react20.useRef)(false);
+  (0, import_react20.useEffect)(() => {
     if (!isAuthenticated) {
       profileAttemptedRef.current = false;
       const hasTokens = Boolean(auth.getToken() || auth.getRefreshToken());
@@ -4897,8 +5135,8 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     };
   }, [isAuthenticated, hasProfile]);
   const isLoading = !profileSettled;
-  const expiredHandledRef = (0, import_react18.useRef)(false);
-  (0, import_react18.useEffect)(() => {
+  const expiredHandledRef = (0, import_react20.useRef)(false);
+  (0, import_react20.useEffect)(() => {
     const unsubscribe = auth.onSessionExpired(() => {
       if (expiredHandledRef.current) return;
       expiredHandledRef.current = true;
@@ -4911,7 +5149,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     });
     return unsubscribe;
   }, [router]);
-  (0, import_react18.useEffect)(() => {
+  (0, import_react20.useEffect)(() => {
     if (!isAuthenticated || pendingManualNavRef.current) return;
     if (pathname === routes.auth && !queryParams.get("flow")) {
       const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;
@@ -4919,7 +5157,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       router.push(saved || routes.defaultCallback);
     }
   }, [isAuthenticated, pathname, queryParams, routes, router, redirectManager]);
-  const loadCurrentProfile = (0, import_react18.useCallback)(async (callerId) => {
+  const loadCurrentProfile = (0, import_react20.useCallback)(async (callerId) => {
     if (!auth.isAuthenticated()) {
       throw new Error("No valid authentication token");
     }
@@ -4927,7 +5165,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       callerId: callerId || "AuthContext.loadCurrentProfile"
     });
   }, []);
-  const checkAuthAndRedirect = (0, import_react18.useCallback)(async () => {
+  const checkAuthAndRedirect = (0, import_react20.useCallback)(async () => {
     if (auth.isAuthenticated()) {
       try {
         await loadCurrentProfile("checkAuthAndRedirect");
@@ -4939,7 +5177,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       router.push(routesRef.current.defaultAuthCallback);
     }
   }, [loadCurrentProfile, router]);
-  const requestOTP = (0, import_react18.useCallback)(
+  const requestOTP = (0, import_react20.useCallback)(
     async (identifier, sourceUrl, consent) => {
       auth.clearSession();
       try {
@@ -4981,7 +5219,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     []
   );
-  const verifyOTP = (0, import_react18.useCallback)(
+  const verifyOTP = (0, import_react20.useCallback)(
     async (identifier, otpCode, sourceUrl, redirectUrl, skipRedirect) => {
       try {
         pendingManualNavRef.current = Boolean(skipRedirect);
@@ -5041,7 +5279,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     [setStoredEmail, redirectManager, router]
   );
-  const login = (0, import_react18.useCallback)(
+  const login = (0, import_react20.useCallback)(
     async (email, password, options) => {
       const { redirectUrl, skipRedirect } = options || {};
       try {
@@ -5106,7 +5344,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     [setStoredEmail, redirectManager, router]
   );
-  const refreshToken = (0, import_react18.useCallback)(async () => {
+  const refreshToken = (0, import_react20.useCallback)(async () => {
     const access = await auth.refreshNow();
     if (access) {
       Analytics.event("auth_token_refresh" /* AUTH_TOKEN_REFRESH */, {
@@ -5119,7 +5357,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     });
     return { success: false, message: "Error refreshing token" };
   }, []);
-  const logout = (0, import_react18.useCallback)(() => {
+  const logout = (0, import_react20.useCallback)(() => {
     Analytics.event("auth_logout" /* AUTH_LOGOUT */, {
       category: "auth" /* AUTH */
     });
@@ -5128,21 +5366,21 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   }, [router]);
   const user = accounts.profile ?? null;
   const isAdminUser = Boolean(user?.is_staff || user?.is_superuser);
-  (0, import_react18.useEffect)(() => {
+  (0, import_react20.useEffect)(() => {
     applyRoleLogPolicy({ isAdmin: isAdminUser });
   }, [isAdminUser]);
-  const updateProfile = (0, import_react18.useCallback)(
+  const updateProfile = (0, import_react20.useCallback)(
     async (data) => {
       const result = await accountsRef.current.partialUpdateProfile(data);
       return result;
     },
     []
   );
-  const uploadAvatar = (0, import_react18.useCallback)(async (avatar) => {
+  const uploadAvatar = (0, import_react20.useCallback)(async (avatar) => {
     const result = await accountsRef.current.uploadAvatar(avatar);
     return result;
   }, []);
-  const value = (0, import_react18.useMemo)(
+  const value = (0, import_react20.useMemo)(
     () => ({
       user,
       isLoading,
@@ -5198,7 +5436,7 @@ function AuthProviderRaw({ children, config, enabled = true }) {
   return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(AccountsProvider, { children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(AuthProviderInternal, { config, children }) });
 }
 __name(AuthProviderRaw, "AuthProviderRaw");
-var AuthProvider = (0, import_react18.memo)(AuthProviderRaw);
+var AuthProvider = (0, import_react20.memo)(AuthProviderRaw);
 var defaultAuthState = {
   user: null,
   isLoading: false,
@@ -5254,7 +5492,7 @@ var defaultAuthState = {
   }, "uploadAvatar")
 };
 var useAuth = /* @__PURE__ */ __name(() => {
-  const context = (0, import_react18.useContext)(AuthContext);
+  const context = (0, import_react20.useContext)(AuthContext);
   if (context === void 0) {
     if (isBrowser2 && isDev) {
       authLogger.debug("useAuth called outside AuthProvider, returning default state");