@djangocfg/api 2.1.618 → 2.1.621

package/dist/auth.mjs

@@ -15,6 +15,141 @@ var AUTH_CONSTANTS = {
   RESEND_COOLDOWN_SECONDS: 30
 };
 
+// src/auth/trace.ts
+var KEY = "cfg.auth.trace";
+var MAX = 200;
+var MAX_STRING = 120;
+var SENSITIVE = /token|otp|code|email|password|secret|cookie|authorization|key|identifier/i;
+var TAB = Math.random().toString(36).slice(2, 6);
+var hasWindow = typeof window !== "undefined";
+var memory = [];
+var loaded = false;
+function backend() {
+  if (!hasWindow) return null;
+  for (const name of ["localStorage", "sessionStorage"]) {
+    try {
+      const s = window[name];
+      s.setItem("__cfg_probe", "1");
+      s.removeItem("__cfg_probe");
+      return s;
+    } catch {
+    }
+  }
+  return null;
+}
+__name(backend, "backend");
+function load() {
+  if (loaded) return memory;
+  loaded = true;
+  try {
+    const raw = backend()?.getItem(KEY);
+    const parsed = raw ? JSON.parse(raw) : [];
+    if (Array.isArray(parsed)) memory = parsed.filter((e) => typeof e === "object" && e !== null);
+  } catch {
+    memory = [];
+  }
+  return memory;
+}
+__name(load, "load");
+function persist() {
+  try {
+    backend()?.setItem(KEY, JSON.stringify(memory));
+  } catch {
+  }
+}
+__name(persist, "persist");
+function clean(fields) {
+  if (!fields) return void 0;
+  const out = {};
+  for (const [k2, v] of Object.entries(fields)) {
+    if (SENSITIVE.test(k2)) continue;
+    if (typeof v === "string") out[k2] = v.length > MAX_STRING ? `${v.slice(0, MAX_STRING)}\u2026` : v;
+    else if (typeof v === "number" || typeof v === "boolean" || v === null) out[k2] = v;
+  }
+  return Object.keys(out).length ? out : void 0;
+}
+__name(clean, "clean");
+function record(at, ev, fields) {
+  const entries = load();
+  const p = hasWindow && typeof performance !== "undefined" ? Math.round(performance.now()) : 0;
+  entries.push({ t: at, p, tab: TAB, ev, f: clean(fields) });
+  if (entries.length > MAX) entries.splice(0, entries.length - MAX);
+  persist();
+}
+__name(record, "record");
+function authTrace(ev, fields) {
+  if (!hasWindow) return;
+  try {
+    record(Date.now(), ev, fields);
+  } catch {
+  }
+}
+__name(authTrace, "authTrace");
+function readAuthTrace() {
+  return load().slice();
+}
+__name(readAuthTrace, "readAuthTrace");
+function clearAuthTrace() {
+  memory = [];
+  loaded = true;
+  try {
+    backend()?.removeItem(KEY);
+  } catch {
+  }
+}
+__name(clearAuthTrace, "clearAuthTrace");
+function context() {
+  if (!hasWindow) return [];
+  const lines = [`url: ${window.location.href.split("?")[0]}`, `online: ${navigator.onLine}`, `ua: ${navigator.userAgent}`];
+  try {
+    const auth2 = globalThis.__cfgAuthNow;
+    const now = auth2?.();
+    if (now) lines.push(`now: ${Object.entries(now).map(([k2, v]) => `${k2}=${String(v)}`).join(" ")}`);
+  } catch {
+  }
+  return lines;
+}
+__name(context, "context");
+function dumpAuthTrace() {
+  const entries = load();
+  const first = entries[0]?.t ?? Date.now();
+  const rows = entries.map((e) => {
+    const fields = e.f ? ` ${Object.entries(e.f).map(([k2, v]) => `${k2}=${String(v)}`).join(" ")}` : "";
+    const at = new Date(e.t).toISOString().slice(11, 23);
+    return `${at} +${String(e.t - first).padStart(6)}ms [${e.tab} p${e.p}] ${e.ev}${fields}`;
+  });
+  return [`# cfg auth trace, ${entries.length} events`, ...context(), "", ...rows].join("\n");
+}
+__name(dumpAuthTrace, "dumpAuthTrace");
+function installAuthTrace() {
+  if (!hasWindow) return;
+  const g = globalThis;
+  g.__cfgAuthTrace = authTrace;
+  g.__cfgAuth = {
+    trace: readAuthTrace,
+    dump: /* @__PURE__ */ __name(() => {
+      const text = dumpAuthTrace();
+      console.log(text);
+      return text;
+    }, "dump"),
+    clear: clearAuthTrace
+  };
+  const queued = g.__cfgAuthTraceQ;
+  if (Array.isArray(queued)) {
+    g.__cfgAuthTraceQ = [];
+    for (const item of queued) {
+      if (Array.isArray(item) && typeof item[1] === "string") {
+        try {
+          record(Number(item[0]) || Date.now(), item[1], item[2]);
+        } catch {
+        }
+      }
+    }
+  }
+}
+__name(installAuthTrace, "installAuthTrace");
+installAuthTrace();
+
 // src/auth/context/AuthContext.tsx
 import { usePathname as usePathname3 } from "next/navigation";
 import {
@@ -131,10 +266,10 @@ function normalizeSegment(raw) {
   return raw.trim().toLowerCase().replace(/[^a-z0-9_]+/g, "_").replace(/^_+|_+$/g, "");
 }
 __name(normalizeSegment, "normalizeSegment");
-var hasWindow = /* @__PURE__ */ __name(() => typeof window !== "undefined", "hasWindow");
+var hasWindow2 = /* @__PURE__ */ __name(() => typeof window !== "undefined", "hasWindow");
 var domainByHost = /* @__PURE__ */ new Map();
 function detectCookieDomain() {
-  if (!hasWindow() || typeof document === "undefined") return null;
+  if (!hasWindow2() || typeof document === "undefined") return null;
   const host = window.location.hostname.toLowerCase();
   if (!host || !host.includes(".") || host.includes(":") || /^[0-9.]+$/.test(host)) return null;
   const cached = domainByHost.get(host);
@@ -158,7 +293,7 @@ function detectCookieDomain() {
 }
 __name(detectCookieDomain, "detectCookieDomain");
 function nativeStorage(store) {
-  if (!hasWindow()) return null;
+  if (!hasWindow2()) return null;
   try {
     return store === "session" ? window.sessionStorage : window.localStorage;
   } catch {
@@ -167,7 +302,7 @@ function nativeStorage(store) {
 }
 __name(nativeStorage, "nativeStorage");
 function cookieNames() {
-  if (!hasWindow()) return [];
+  if (!hasWindow2()) return [];
   try {
     return document.cookie.split("; ").map((part) => decodeURIComponent(part.split("=")[0] ?? "")).filter(Boolean);
   } catch {
@@ -192,7 +327,7 @@ function createStorage(owner, options = {}) {
   const families = Object.values(options.families ?? {});
   const specByKey = /* @__PURE__ */ new Map();
   for (const spec of specs) specByKey.set(spec.key, [...specByKey.get(spec.key) ?? [], spec]);
-  const memory = {
+  const memory2 = {
     local: /* @__PURE__ */ new Map(),
     session: /* @__PURE__ */ new Map(),
     cookie: /* @__PURE__ */ new Map()
@@ -206,7 +341,7 @@ function createStorage(owner, options = {}) {
     if (!key.startsWith(prefix)) throw new TypeError(`storage key "${key}" is not owned by "${owner}"`);
   }, "assertOwned");
   function rawGet(store, key) {
-    if (!hasWindow()) return null;
+    if (!hasWindow2()) return null;
     if (store === "cookie") {
       try {
         const escaped = encodeURIComponent(key).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -214,18 +349,18 @@ function createStorage(owner, options = {}) {
         if (match?.[1] !== void 0) return decodeURIComponent(match[1]);
       } catch {
       }
-      return memory.cookie.get(key) ?? null;
+      return memory2.cookie.get(key) ?? null;
     }
     try {
       const value = nativeStorage(store)?.getItem(key) ?? null;
       if (value !== null) return value;
     } catch {
     }
-    return memory[store].get(key) ?? null;
+    return memory2[store].get(key) ?? null;
   }
   __name(rawGet, "rawGet");
   function rawSet(store, key, value, maxAgeSeconds) {
-    if (!hasWindow()) return false;
+    if (!hasWindow2()) return false;
     try {
       if (store === "cookie") {
         const secure = window.location.protocol === "https:" ? "; Secure" : "";
@@ -233,24 +368,24 @@ function createStorage(owner, options = {}) {
         const domainPart = domain ? `; Domain=${domain}` : "";
         document.cookie = `${encodeURIComponent(key)}=${encodeURIComponent(value)}; Path=/; Max-Age=${Math.max(1, Math.floor(maxAgeSeconds ?? cookieMaxAge))}; SameSite=Lax${domainPart}${secure}`;
         if (domain) expireCookie(key, null);
-        if (rawGet("cookie", key) === value && !memory.cookie.has(key)) return true;
-        memory.cookie.set(key, value);
+        if (rawGet("cookie", key) === value && !memory2.cookie.has(key)) return true;
+        memory2.cookie.set(key, value);
         return false;
       }
       const native = nativeStorage(store);
       if (!native) throw new Error("storage unavailable");
       native.setItem(key, value);
-      memory[store].delete(key);
+      memory2[store].delete(key);
       return true;
     } catch {
-      memory[store].set(key, value);
+      memory2[store].set(key, value);
       return false;
     }
   }
   __name(rawSet, "rawSet");
   function rawRemove(store, key) {
-    memory[store].delete(key);
-    if (!hasWindow()) return;
+    memory2[store].delete(key);
+    if (!hasWindow2()) return;
     try {
       if (store === "cookie") {
         expireCookie(key, null);
@@ -279,7 +414,7 @@ function createStorage(owner, options = {}) {
       }
     } catch {
     }
-    for (const name of memory[store].keys()) if (name.startsWith(startsWith) && !out.includes(name)) out.push(name);
+    for (const name of memory2[store].keys()) if (name.startsWith(startsWith) && !out.includes(name)) out.push(name);
     return out;
   }
   __name(listKeys, "listKeys");
@@ -351,7 +486,7 @@ function createStorage(owner, options = {}) {
     cookieDomain: resolveCookieDomain,
     onChange(key, listener, store = "local") {
       assertValid(key);
-      if (!hasWindow()) return () => {
+      if (!hasWindow2()) return () => {
       };
       const handler = /* @__PURE__ */ __name((event) => {
         if (event.storageArea !== nativeStorage(store)) return;
@@ -375,6 +510,29 @@ var REFRESH_KEY = "cfg.auth.refresh_token";
 var API_KEY_KEY = "cfg.auth.api_key";
 var storage = true ? cfgStorage : createStorage2("cfg");
 var isBrowser = typeof window !== "undefined";
+function trace(ev, fields) {
+  try {
+    const g = globalThis;
+    const sink2 = g.__cfgAuthTrace;
+    if (sink2) {
+      sink2(ev, fields);
+      return;
+    }
+    const queue = g.__cfgAuthTraceQ ?? [];
+    g.__cfgAuthTraceQ = queue;
+    if (queue.length < 100) queue.push([Date.now(), ev, fields]);
+  } catch {
+  }
+}
+__name(trace, "trace");
+function pathOf(url) {
+  try {
+    return new URL(url, "http://x").pathname;
+  } catch {
+    return "";
+  }
+}
+__name(pathOf, "pathOf");
 function secondsUntilExp(token) {
   const exp = jwtExpMs(token);
   return exp === null ? void 0 : Math.max(1, Math.floor((exp - Date.now()) / 1e3));
@@ -534,7 +692,10 @@ __name(scheduleExpiryFlip, "scheduleExpiryFlip");
 function notifySessionChanged() {
   const next = computeSnapshot();
   const changed = next.status !== _snapshot.status || next.accessExpiresAt !== _snapshot.accessExpiresAt;
-  if (changed) _snapshot = next;
+  if (changed) {
+    _snapshot = next;
+    trace("store.snapshot", { status: next.status });
+  }
   scheduleExpiryFlip();
   if (!changed) return;
   for (const listener of Array.from(_sessionListeners)) {
@@ -617,6 +778,7 @@ var auth = {
     return _storage.get(ACCESS_KEY);
   },
   setToken(token) {
+    trace("store.setToken", { present: token !== null });
     _storage.set(ACCESS_KEY, token);
     notifySessionChanged();
   },
@@ -624,14 +786,16 @@ var auth = {
     return _storage.get(REFRESH_KEY);
   },
   setRefreshToken(token) {
+    trace("store.setRefreshToken", { present: token !== null });
     _storage.set(REFRESH_KEY, token);
     notifySessionChanged();
   },
   clearTokens() {
+    trace("store.clearTokens");
     for (const mode of ["localStorage", "sessionStorage", "cookie"]) {
-      const backend = backendFor(mode);
-      backend.set(ACCESS_KEY, null);
-      backend.set(REFRESH_KEY, null);
+      const backend2 = backendFor(mode);
+      backend2.set(ACCESS_KEY, null);
+      backend2.set(REFRESH_KEY, null);
     }
     storage.clearAll();
     notifySessionChanged();
@@ -650,6 +814,7 @@ var auth = {
    * rotation); `refresh: null` explicitly drops it.
    */
   setSession(tokens) {
+    trace("store.setSession", { refresh: tokens.refresh === void 0 ? "kept" : tokens.refresh === null ? "dropped" : "set" });
     _storage.set(ACCESS_KEY, tokens.access);
     if (tokens.refresh !== void 0) _storage.set(REFRESH_KEY, tokens.refresh);
     notifySessionChanged();
@@ -788,7 +953,11 @@ async function tryRefresh() {
     const refresh = auth.getRefreshToken();
     if (!refresh) return null;
     const result = await _refreshHandler(refresh);
-    if (!result?.access) return null;
+    if (!result?.access) {
+      trace("refresh", { ok: false, why: "no-access" });
+      return null;
+    }
+    trace("refresh", { ok: true, rotated: Boolean(result.refresh) });
     auth.setToken(result.access);
     if (result.refresh) auth.setRefreshToken(result.refresh);
     return result.access;
@@ -801,6 +970,7 @@ async function tryRefresh() {
       }
       return await runRefresh();
     } catch {
+      trace("refresh", { ok: false, why: "threw" });
       return null;
     } finally {
       _refreshInflight = null;
@@ -809,7 +979,8 @@ async function tryRefresh() {
   return _refreshInflight;
 }
 __name(tryRefresh, "tryRefresh");
-function expireSession(response) {
+function expireSession(response, why) {
+  trace("store.expire", { why, status: response.status, path: pathOf(response.url), handlers: _sessionExpiredHandlers.size });
   auth.clearTokens();
   for (const cb of Array.from(_sessionExpiredHandlers)) {
     try {
@@ -951,13 +1122,17 @@ function installAuthOnClient(client2) {
   });
   client2.interceptors.response.use(async (response, request) => {
     if (response.status !== 401) return response;
+    if (/\/accounts\/(otp|oauth|login|register|token)\b/.test(request.url)) {
+      trace("401.passthrough", { path: pathOf(request.url) });
+      return response;
+    }
     if (request.headers.get(RETRY_MARKER)) {
-      expireSession(response);
+      expireSession(response, "retry-marker");
       return response;
     }
     const newToken = await tryRefresh();
     if (!newToken) {
-      expireSession(response);
+      expireSession(response, "refresh-failed");
       return response;
     }
     const retry = request.clone();
@@ -969,7 +1144,7 @@ function installAuthOnClient(client2) {
     }
     try {
       const retried = await fetch(retry);
-      if (retried.status === 401) expireSession(retried);
+      if (retried.status === 401) expireSession(retried, "retry-401");
       return retried;
     } catch {
       return response;
@@ -1193,6 +1368,16 @@ __name(useTimezone, "useTimezone");
 // src/auth/hooks/useCfgRouter.ts
 import { useRouter as useNextRouter } from "next/navigation";
 import { useCallback as useCallback2, useMemo } from "react";
+var hardNavigating = false;
+if (typeof window !== "undefined") {
+  window.addEventListener("pageshow", (e) => {
+    if (e.persisted) hardNavigating = false;
+  });
+}
+function fromPath() {
+  return typeof window === "undefined" ? "" : window.location.pathname;
+}
+__name(fromPath, "fromPath");
 function getBasePath() {
   if (typeof process === "undefined") {
     return "";
@@ -1213,6 +1398,7 @@ function useCfgRouter() {
   const router = useNextRouter();
   const basePath = useMemo(() => getBasePath(), []);
   const push = useCallback2((href, options) => {
+    authTrace("nav.push", { from: fromPath(), to: href });
     if (basePath) {
       window.location.href = withBasePath(href, basePath);
     } else {
@@ -1220,6 +1406,7 @@ function useCfgRouter() {
     }
   }, [router, basePath]);
   const replace = useCallback2((href, options) => {
+    authTrace("nav.replace", { from: fromPath(), to: href });
     if (basePath) {
       window.location.replace(withBasePath(href, basePath));
     } else {
@@ -1227,9 +1414,21 @@ function useCfgRouter() {
     }
   }, [router, basePath]);
   const hardPush = useCallback2((href) => {
+    if (hardNavigating) {
+      authTrace("nav.hardPush.ignored", { from: fromPath(), to: href });
+      return;
+    }
+    hardNavigating = true;
+    authTrace("nav.hardPush", { from: fromPath(), to: href });
     window.location.href = withBasePath(href, basePath);
   }, [basePath]);
   const hardReplace = useCallback2((href) => {
+    if (hardNavigating) {
+      authTrace("nav.hardReplace.ignored", { from: fromPath(), to: href });
+      return;
+    }
+    hardNavigating = true;
+    authTrace("nav.hardReplace", { from: fromPath(), to: href });
     window.location.replace(withBasePath(href, basePath));
   }, [basePath]);
   const prefetch = useCallback2((href) => {
@@ -3195,7 +3394,7 @@ var OAuthErrorCodeEnum = /* @__PURE__ */ ((OAuthErrorCodeEnum2) => {
 
 // src/auth/utils/errors.ts
 var prop = /* @__PURE__ */ __name((value, key) => typeof value === "object" && value !== null ? value[key] : void 0, "prop");
-var TRANSPORT_FALLBACK = /^HTTP \d{3}:\s*/;
+var TRANSPORT_FALLBACK = /^HTTP \d{1,3}:\s*/;
 var AUTH_ERROR_KEYS = {
   invalidCredentials: "ui.errors.unauthorized",
   rateLimited: "api.errors.rateLimited",
@@ -3212,6 +3411,7 @@ var FALLBACK_COPY = {
 };
 var keyForStatus = /* @__PURE__ */ __name((status) => {
   if (status === void 0) return AUTH_ERROR_KEYS.generic;
+  if (status === 0) return AUTH_ERROR_KEYS.networkError;
   if (status === 401 || status === 403) return AUTH_ERROR_KEYS.invalidCredentials;
   if (status === 404) return AUTH_ERROR_KEYS.serverUnavailable;
   if (status === 429) return AUTH_ERROR_KEYS.rateLimited;
@@ -3256,9 +3456,9 @@ var logAuthFailure = /* @__PURE__ */ __name((log, message, error) => {
 
 // src/auth/utils/oauthErrors.ts
 var SERVER_CODES = new Set(Object.values(OAuthErrorCodeEnum));
-var record = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null ? value : null, "record");
+var record2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null ? value : null, "record");
 var readOAuthFailure = /* @__PURE__ */ __name((err, fallback) => {
-  const body = record(record(err)?.response);
+  const body = record2(record2(err)?.response);
   const code = body?.error;
   if (typeof code === "string" && SERVER_CODES.has(code)) {
     const description = body?.error_description;
@@ -3537,6 +3737,7 @@ var useOAuthLogin = /* @__PURE__ */ __name((options = {}) => {
     setLoadingProvider(provider);
     setError(null);
     setErrorCode(null);
+    authTrace("oauth.start");
     auth.clearSession();
     try {
       Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
@@ -3584,6 +3785,7 @@ var useOAuthLogin = /* @__PURE__ */ __name((options = {}) => {
       if (!response.access || !response.refresh) {
         throw new Error("Invalid response from OAuth callback");
       }
+      authTrace("oauth.session");
       auth.setSession({ access: response.access, refresh: response.refresh });
       Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
         category: "auth" /* AUTH */,
@@ -3764,6 +3966,7 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
     setError(null);
   }, []);
   const handleSuccess = useCallback8((response) => {
+    authTrace("2fa.session");
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
     if (response.warning) {
       setWarning(response.warning);
@@ -4415,6 +4618,17 @@ function purgeLegacyTokenStorage() {
 }
 __name(purgeLegacyTokenStorage, "purgeLegacyTokenStorage");
 
+// src/auth/utils/authState.ts
+function resolveAuthStatus(s) {
+  if (!s.clientReady) return "resolving";
+  if (s.snapshotAuthenticated) {
+    return s.profileSettled || s.timedOut ? "authenticated" : "resolving";
+  }
+  if (s.storeAuthenticated && !s.timedOut) return "resolving";
+  return "anonymous";
+}
+__name(resolveAuthStatus, "resolveAuthStatus");
+
 // src/auth/context/AccountsContext.tsx
 import {
   createContext,
@@ -4870,6 +5084,7 @@ function AccountsProvider({ children }) {
       return;
     }
     if (result.access && result.refresh) {
+      authTrace("accounts.otp.session");
       auth.setSession({ access: result.access, refresh: result.refresh });
       try {
         await refreshProfile({ callerId, force: true });
@@ -4895,6 +5110,7 @@ function AccountsProvider({ children }) {
         authLogger.warn("Refresh-token blacklist failed (logged out locally anyway)");
       });
     }
+    authTrace("accounts.logout");
     auth.clearSession();
     setProfile(void 0);
     setProfileError(null);
@@ -4929,11 +5145,11 @@ function AccountsProvider({ children }) {
 }
 __name(AccountsProvider, "AccountsProvider");
 function useAccountsContext() {
-  const context = useContext(AccountsContext);
-  if (!context) {
+  const context2 = useContext(AccountsContext);
+  if (!context2) {
     throw new Error("useAccountsContext must be used within AccountsProvider");
   }
-  return context;
+  return context2;
 }
 __name(useAccountsContext, "useAccountsContext");
 
@@ -4989,9 +5205,11 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       const hasTokens = Boolean(auth.getToken() || auth.getRefreshToken());
       if (hasTokens && !auth.isAuthenticated()) {
         authLogger.warn("Dead session in storage \u2014 clearing");
+        authTrace("bootstrap.purge", { why: "dead-tokens" });
         auth.clearSession();
         clearProfileCache();
       } else if (!hasTokens && !auth.isAuthenticated()) {
+        authTrace("bootstrap.purge", { why: "no-session" });
         clearProfileCache();
         purgeLegacyTokenStorage();
         if (accountsRef.current.profile) accountsRef.current.logout();
@@ -5004,9 +5222,13 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       return;
     }
     profileAttemptedRef.current = true;
+    authTrace("bootstrap.profile.start");
     let cancelled = false;
     accountsRef.current.refreshProfile({ callerId: "AuthProvider:bootstrap" }).catch((error) => {
       authLogger.warn("Profile load failed (session kept):", error);
+      authTrace("bootstrap.profile.failed", {
+        status: error instanceof APIError ? error.statusCode : 0
+      });
     }).finally(() => {
       if (!cancelled) setProfileSettled(true);
     });
@@ -5015,11 +5237,47 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     };
   }, [isAuthenticated, hasProfile]);
   const isLoading = !profileSettled;
-  const expiredHandledRef = useRef7(false);
+  const [clientReady, setClientReady] = useState12(false);
+  const [timedOut, setTimedOut] = useState12(false);
+  useEffect7(() => {
+    setClientReady(true);
+    const timer = setTimeout(() => setTimedOut(true), 8e3);
+    return () => clearTimeout(timer);
+  }, []);
+  const status = resolveAuthStatus({
+    clientReady,
+    snapshotAuthenticated: isAuthenticated,
+    storeAuthenticated: isBrowser2 ? auth.isAuthenticated() : false,
+    profileSettled,
+    timedOut
+  });
+  const lastStatusRef = useRef7("");
+  useEffect7(() => {
+    if (lastStatusRef.current === status) return;
+    lastStatusRef.current = status;
+    authTrace("status", {
+      status,
+      snapshot: isAuthenticated,
+      store: auth.isAuthenticated(),
+      profileSettled,
+      timedOut,
+      path: pathname ?? ""
+    });
+  }, [status, isAuthenticated, profileSettled, timedOut, pathname]);
+  useEffect7(() => {
+    globalThis.__cfgAuthNow = () => ({
+      status,
+      snapshot: isAuthenticated,
+      store: auth.isAuthenticated(),
+      hasToken: Boolean(auth.getToken()),
+      hasRefresh: Boolean(auth.getRefreshToken()),
+      profileSettled,
+      timedOut
+    });
+  }, [status, isAuthenticated, profileSettled, timedOut]);
   useEffect7(() => {
     const unsubscribe = auth.onSessionExpired(() => {
-      if (expiredHandledRef.current) return;
-      expiredHandledRef.current = true;
+      authTrace("expired.handler", { path: pathname ?? "" });
       authLogger.warn("Session expired (terminal 401) \u2014 redirecting to login");
       clearProfileCache();
       Analytics.event("auth_session_expired" /* AUTH_SESSION_EXPIRED */, {
@@ -5028,12 +5286,13 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       router.hardReplace(routesRef.current.defaultAuthCallback);
     });
     return unsubscribe;
-  }, [router]);
+  }, [router, pathname]);
   useEffect7(() => {
     if (!isAuthenticated || pendingManualNavRef.current) return;
     if (pathname === routes.auth && !queryParams.get("flow")) {
       const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;
       if (saved) redirectManager.clearRedirect();
+      authTrace("leave-auth", { to: saved || routes.defaultCallback, saved: Boolean(saved) });
       router.push(saved || routes.defaultCallback);
     }
   }, [isAuthenticated, pathname, queryParams, routes, router, redirectManager]);
@@ -5059,6 +5318,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   }, [loadCurrentProfile, router]);
   const requestOTP = useCallback13(
     async (identifier, sourceUrl, consent) => {
+      authTrace("otp.request");
       auth.clearSession();
       try {
         const body = {
@@ -5103,6 +5363,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     async (identifier, otpCode, sourceUrl, redirectUrl, skipRedirect) => {
       try {
         pendingManualNavRef.current = Boolean(skipRedirect);
+        authTrace("otp.verify", { skipRedirect: Boolean(skipRedirect) });
         const result = await accountsRef.current.verifyOTP({
           identifier,
           otp: otpCode,
@@ -5164,6 +5425,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       const { redirectUrl, skipRedirect } = options || {};
       try {
         pendingManualNavRef.current = Boolean(skipRedirect);
+        authTrace("password.login", { skipRedirect: Boolean(skipRedirect) });
         const result = await accountsRef.current.loginWithPassword({
           email,
           password
@@ -5238,6 +5500,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     return { success: false, message: "Error refreshing token" };
   }, []);
   const logout = useCallback13(() => {
+    authTrace("logout");
     Analytics.event("auth_logout" /* AUTH_LOGOUT */, {
       category: "auth" /* AUTH */
     });
@@ -5264,6 +5527,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     () => ({
       user,
       isLoading,
+      status,
       // Reactive: flips via the store snapshot (token writes, refreshes,
       // expiry timer, cross-tab/cross-store sync) — no ticks, no polling.
       isAuthenticated,
@@ -5291,6 +5555,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     [
       user,
       isLoading,
+      status,
       isAuthenticated,
       isAdminUser,
       routes,
@@ -5320,6 +5585,7 @@ var AuthProvider = memo(AuthProviderRaw);
 var defaultAuthState = {
   user: null,
   isLoading: false,
+  status: "anonymous",
   isAuthenticated: false,
   isAdminUser: false,
   routes: resolveAuthRoutes(),
@@ -5372,14 +5638,14 @@ var defaultAuthState = {
   }, "uploadAvatar")
 };
 var useAuth = /* @__PURE__ */ __name(() => {
-  const context = useContext2(AuthContext);
-  if (context === void 0) {
+  const context2 = useContext2(AuthContext);
+  if (context2 === void 0) {
     if (isBrowser2 && isDev) {
       authLogger.debug("useAuth called outside AuthProvider, returning default state");
     }
     return defaultAuthState;
   }
-  return context;
+  return context2;
 }, "useAuth");
 var AuthContext_default = AuthContext;
 
@@ -5422,17 +5688,21 @@ export {
   AuthProvider,
   OAUTH_PROVIDER_IDS,
   authLogger,
+  authTrace,
   beginTwoFactorChallenge,
+  clearAuthTrace,
   clearOAuthAttempt,
   clearProfileCache,
   consumeSavedRedirect,
   decodeBase64,
+  dumpAuthTrace,
   encodeBase64,
   endTwoFactorChallenge,
   formatAuthError,
   getCacheMetadata,
   getCachedProfile,
   hasValidCache,
+  installAuthTrace,
   isAllowedAuthPath,
   isForbidden,
   isOAuthProviderId,
@@ -5440,8 +5710,10 @@ export {
   logger,
   normalizePath,
   peekSavedRedirect,
+  readAuthTrace,
   readOAuthFailure,
   resolveAuthError,
+  resolveAuthStatus,
   resolveGuardIsAuthenticated,
   resolveGuardIsLoading,
   setAnalyticsSink,