@djangocfg/api 2.1.619 → 2.1.622

package/dist/auth.cjs

@@ -216,17 +216,21 @@ __export(auth_exports, {
   AuthProvider: () => AuthProvider,
   OAUTH_PROVIDER_IDS: () => OAUTH_PROVIDER_IDS,
   authLogger: () => authLogger,
+  authTrace: () => authTrace,
   beginTwoFactorChallenge: () => beginTwoFactorChallenge,
+  clearAuthTrace: () => clearAuthTrace,
   clearOAuthAttempt: () => clearOAuthAttempt,
   clearProfileCache: () => clearProfileCache,
   consumeSavedRedirect: () => consumeSavedRedirect,
   decodeBase64: () => decodeBase64,
+  dumpAuthTrace: () => dumpAuthTrace,
   encodeBase64: () => encodeBase64,
   endTwoFactorChallenge: () => endTwoFactorChallenge,
   formatAuthError: () => formatAuthError,
   getCacheMetadata: () => getCacheMetadata,
   getCachedProfile: () => getCachedProfile,
   hasValidCache: () => hasValidCache,
+  installAuthTrace: () => installAuthTrace,
   isAllowedAuthPath: () => isAllowedAuthPath,
   isForbidden: () => isForbidden,
   isOAuthProviderId: () => isOAuthProviderId,
@@ -234,8 +238,11 @@ __export(auth_exports, {
   logger: () => logger,
   normalizePath: () => normalizePath,
   peekSavedRedirect: () => peekSavedRedirect,
+  readAuthTrace: () => readAuthTrace,
   readOAuthFailure: () => readOAuthFailure,
+  resetAuthTraceForTests: () => resetAuthTraceForTests,
   resolveAuthError: () => resolveAuthError,
+  resolveAuthStatus: () => resolveAuthStatus,
   resolveGuardIsAuthenticated: () => resolveGuardIsAuthenticated,
   resolveGuardIsLoading: () => resolveGuardIsLoading,
   setAnalyticsSink: () => setAnalyticsSink,
@@ -281,9 +288,201 @@ var AUTH_CONSTANTS = {
   RESEND_COOLDOWN_SECONDS: 30
 };
 
+// src/auth/trace.ts
+var KEY = "cfg.auth.trace";
+var MAX = 200;
+var MAX_STRING = 120;
+var SENSITIVE = /token|otp|code|email|password|secret|cookie|authorization|key|identifier/i;
+var TAB = (() => {
+  const g = globalThis;
+  return g.__cfgAuthTab ??= Math.random().toString(36).slice(2, 6);
+})();
+var hasWindow = typeof window !== "undefined";
+var memory = [];
+var loaded = false;
+function backend() {
+  if (!hasWindow) return null;
+  for (const name of ["localStorage", "sessionStorage"]) {
+    try {
+      const s = window[name];
+      s.setItem("__cfg_probe", "1");
+      s.removeItem("__cfg_probe");
+      return s;
+    } catch {
+    }
+  }
+  return null;
+}
+__name(backend, "backend");
+function load() {
+  if (loaded) return memory;
+  loaded = true;
+  try {
+    const raw = backend()?.getItem(KEY);
+    const parsed = raw ? JSON.parse(raw) : [];
+    if (Array.isArray(parsed)) memory = parsed.filter((e) => typeof e === "object" && e !== null);
+  } catch {
+    memory = [];
+  }
+  return memory;
+}
+__name(load, "load");
+function persist() {
+  try {
+    backend()?.setItem(KEY, JSON.stringify(memory));
+  } catch {
+  }
+}
+__name(persist, "persist");
+function clean(fields) {
+  if (!fields) return void 0;
+  const out = {};
+  for (const [k2, v] of Object.entries(fields)) {
+    if (SENSITIVE.test(k2)) continue;
+    if (typeof v === "string") out[k2] = v.length > MAX_STRING ? `${v.slice(0, MAX_STRING)}\u2026` : v;
+    else if (typeof v === "number" || typeof v === "boolean" || v === null) out[k2] = v;
+  }
+  return Object.keys(out).length ? out : void 0;
+}
+__name(clean, "clean");
+function refresh() {
+  try {
+    const raw = backend()?.getItem(KEY);
+    const parsed = raw ? JSON.parse(raw) : null;
+    if (Array.isArray(parsed)) memory = parsed.filter((e) => typeof e === "object" && e !== null);
+  } catch {
+  }
+}
+__name(refresh, "refresh");
+function record(at, ev, fields) {
+  load();
+  refresh();
+  const entries = memory;
+  const p = hasWindow && typeof performance !== "undefined" ? Math.round(performance.now()) : 0;
+  const f2 = clean(fields);
+  const last = entries[entries.length - 1];
+  if (last && last.tab === TAB && last.ev === ev && JSON.stringify(last.f) === JSON.stringify(f2)) {
+    last.n = (last.n ?? 1) + 1;
+    last.t = at;
+    last.p = p;
+    persist();
+    return;
+  }
+  entries.push({ t: at, p, tab: TAB, ev, f: f2 });
+  if (entries.length > MAX) entries.splice(0, entries.length - MAX);
+  persist();
+}
+__name(record, "record");
+function authTrace(ev, fields) {
+  if (!hasWindow) return;
+  try {
+    record(Date.now(), ev, fields);
+  } catch {
+  }
+}
+__name(authTrace, "authTrace");
+function resetAuthTraceForTests() {
+  memory = [];
+  loaded = true;
+}
+__name(resetAuthTraceForTests, "resetAuthTraceForTests");
+function readAuthTrace() {
+  return load().slice();
+}
+__name(readAuthTrace, "readAuthTrace");
+function clearAuthTrace() {
+  memory = [];
+  loaded = true;
+  try {
+    backend()?.removeItem(KEY);
+  } catch {
+  }
+}
+__name(clearAuthTrace, "clearAuthTrace");
+function context() {
+  if (!hasWindow) return [];
+  const copies = globalThis.__cfgAuthCopies ?? 1;
+  const lines = [`url: ${window.location.href.split("?")[0]}`, `copies: ${String(copies)}`, `online: ${navigator.onLine}`, `ua: ${navigator.userAgent}`];
+  try {
+    const auth2 = globalThis.__cfgAuthNow;
+    const now = auth2?.();
+    if (now) lines.push(`now: ${Object.entries(now).map(([k2, v]) => `${k2}=${String(v)}`).join(" ")}`);
+  } catch {
+  }
+  return lines;
+}
+__name(context, "context");
+function dumpAuthTrace() {
+  const entries = load();
+  const first = entries[0]?.t ?? Date.now();
+  const rows = entries.map((e) => {
+    const fields = e.f ? ` ${Object.entries(e.f).map(([k2, v]) => `${k2}=${String(v)}`).join(" ")}` : "";
+    const at = new Date(e.t).toISOString().slice(11, 23);
+    return `${at} +${String(e.t - first).padStart(6)}ms [${e.tab} p${e.p}] ${e.ev}${fields}${e.n && e.n > 1 ? ` x${e.n}` : ""}`;
+  });
+  return [`# cfg auth trace, ${entries.length} events`, ...context(), "", ...rows].join("\n");
+}
+__name(dumpAuthTrace, "dumpAuthTrace");
+function installAuthTrace() {
+  if (!hasWindow) return;
+  const g = globalThis;
+  g.__cfgAuthTrace = authTrace;
+  g.__cfgAuth = {
+    trace: readAuthTrace,
+    dump: /* @__PURE__ */ __name(() => {
+      const text = dumpAuthTrace();
+      console.log(text);
+      return text;
+    }, "dump"),
+    clear: clearAuthTrace,
+    /** Put the dump on the clipboard (works when the console output is blocked or too long to select). */
+    copy: /* @__PURE__ */ __name(() => {
+      const text = dumpAuthTrace();
+      void navigator.clipboard?.writeText(text);
+      return `${text.split("\n").length} lines copied`;
+    }, "copy"),
+    /** Download the raw trace as a JSON file. */
+    download: /* @__PURE__ */ __name(() => {
+      const blob = new Blob([JSON.stringify(readAuthTrace(), null, 1)], { type: "application/json" });
+      const a = document.createElement("a");
+      a.href = URL.createObjectURL(blob);
+      a.download = `auth-trace-${Date.now()}.json`;
+      a.click();
+    }, "download")
+  };
+  const queued = g.__cfgAuthTraceQ;
+  if (Array.isArray(queued)) {
+    g.__cfgAuthTraceQ = [];
+    for (const item of queued) {
+      if (Array.isArray(item) && typeof item[1] === "string") {
+        try {
+          record(Number(item[0]) || Date.now(), item[1], item[2]);
+        } catch {
+        }
+      }
+    }
+  }
+}
+__name(installAuthTrace, "installAuthTrace");
+function registerCopy() {
+  if (!hasWindow) return;
+  const g = globalThis;
+  const n = (g.__cfgAuthCopies ?? 0) + 1;
+  g.__cfgAuthCopies = n;
+  if (n > 1) {
+    authTrace("dup.copy", { copies: n });
+    if (n === 2) {
+      console.warn("[@djangocfg/api] more than one copy of the auth package is loaded; see __cfgAuth.dump() (dup.copy). Align the peer set so pnpm installs one instance.");
+    }
+  }
+}
+__name(registerCopy, "registerCopy");
+registerCopy();
+installAuthTrace();
+
 // src/auth/context/AuthContext.tsx
 var import_navigation4 = require("next/navigation");
-var import_react20 = require("react");
+var import_react21 = require("react");
 
 // src/_api/generated/helpers/errors.ts
 var APIError = class extends Error {
@@ -388,10 +587,10 @@ function normalizeSegment(raw) {
   return raw.trim().toLowerCase().replace(/[^a-z0-9_]+/g, "_").replace(/^_+|_+$/g, "");
 }
 __name(normalizeSegment, "normalizeSegment");
-var hasWindow = /* @__PURE__ */ __name(() => typeof window !== "undefined", "hasWindow");
+var hasWindow2 = /* @__PURE__ */ __name(() => typeof window !== "undefined", "hasWindow");
 var domainByHost = /* @__PURE__ */ new Map();
 function detectCookieDomain() {
-  if (!hasWindow() || typeof document === "undefined") return null;
+  if (!hasWindow2() || typeof document === "undefined") return null;
   const host = window.location.hostname.toLowerCase();
   if (!host || !host.includes(".") || host.includes(":") || /^[0-9.]+$/.test(host)) return null;
   const cached = domainByHost.get(host);
@@ -415,7 +614,7 @@ function detectCookieDomain() {
 }
 __name(detectCookieDomain, "detectCookieDomain");
 function nativeStorage(store) {
-  if (!hasWindow()) return null;
+  if (!hasWindow2()) return null;
   try {
     return store === "session" ? window.sessionStorage : window.localStorage;
   } catch {
@@ -424,7 +623,7 @@ function nativeStorage(store) {
 }
 __name(nativeStorage, "nativeStorage");
 function cookieNames() {
-  if (!hasWindow()) return [];
+  if (!hasWindow2()) return [];
   try {
     return document.cookie.split("; ").map((part) => decodeURIComponent(part.split("=")[0] ?? "")).filter(Boolean);
   } catch {
@@ -449,7 +648,7 @@ function createStorage(owner, options = {}) {
   const families = Object.values(options.families ?? {});
   const specByKey = /* @__PURE__ */ new Map();
   for (const spec of specs) specByKey.set(spec.key, [...specByKey.get(spec.key) ?? [], spec]);
-  const memory = {
+  const memory2 = {
     local: /* @__PURE__ */ new Map(),
     session: /* @__PURE__ */ new Map(),
     cookie: /* @__PURE__ */ new Map()
@@ -463,7 +662,7 @@ function createStorage(owner, options = {}) {
     if (!key.startsWith(prefix)) throw new TypeError(`storage key "${key}" is not owned by "${owner}"`);
   }, "assertOwned");
   function rawGet(store, key) {
-    if (!hasWindow()) return null;
+    if (!hasWindow2()) return null;
     if (store === "cookie") {
       try {
         const escaped = encodeURIComponent(key).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -471,18 +670,18 @@ function createStorage(owner, options = {}) {
         if (match?.[1] !== void 0) return decodeURIComponent(match[1]);
       } catch {
       }
-      return memory.cookie.get(key) ?? null;
+      return memory2.cookie.get(key) ?? null;
     }
     try {
       const value = nativeStorage(store)?.getItem(key) ?? null;
       if (value !== null) return value;
     } catch {
     }
-    return memory[store].get(key) ?? null;
+    return memory2[store].get(key) ?? null;
   }
   __name(rawGet, "rawGet");
   function rawSet(store, key, value, maxAgeSeconds) {
-    if (!hasWindow()) return false;
+    if (!hasWindow2()) return false;
     try {
       if (store === "cookie") {
         const secure = window.location.protocol === "https:" ? "; Secure" : "";
@@ -490,24 +689,24 @@ function createStorage(owner, options = {}) {
         const domainPart = domain ? `; Domain=${domain}` : "";
         document.cookie = `${encodeURIComponent(key)}=${encodeURIComponent(value)}; Path=/; Max-Age=${Math.max(1, Math.floor(maxAgeSeconds ?? cookieMaxAge))}; SameSite=Lax${domainPart}${secure}`;
         if (domain) expireCookie(key, null);
-        if (rawGet("cookie", key) === value && !memory.cookie.has(key)) return true;
-        memory.cookie.set(key, value);
+        if (rawGet("cookie", key) === value && !memory2.cookie.has(key)) return true;
+        memory2.cookie.set(key, value);
         return false;
       }
       const native = nativeStorage(store);
       if (!native) throw new Error("storage unavailable");
       native.setItem(key, value);
-      memory[store].delete(key);
+      memory2[store].delete(key);
       return true;
     } catch {
-      memory[store].set(key, value);
+      memory2[store].set(key, value);
       return false;
     }
   }
   __name(rawSet, "rawSet");
   function rawRemove(store, key) {
-    memory[store].delete(key);
-    if (!hasWindow()) return;
+    memory2[store].delete(key);
+    if (!hasWindow2()) return;
     try {
       if (store === "cookie") {
         expireCookie(key, null);
@@ -536,7 +735,7 @@ function createStorage(owner, options = {}) {
       }
     } catch {
     }
-    for (const name of memory[store].keys()) if (name.startsWith(startsWith) && !out.includes(name)) out.push(name);
+    for (const name of memory2[store].keys()) if (name.startsWith(startsWith) && !out.includes(name)) out.push(name);
     return out;
   }
   __name(listKeys, "listKeys");
@@ -608,7 +807,7 @@ function createStorage(owner, options = {}) {
     cookieDomain: resolveCookieDomain,
     onChange(key, listener, store = "local") {
       assertValid(key);
-      if (!hasWindow()) return () => {
+      if (!hasWindow2()) return () => {
       };
       const handler = /* @__PURE__ */ __name((event) => {
         if (event.storageArea !== nativeStorage(store)) return;
@@ -632,6 +831,29 @@ var REFRESH_KEY = "cfg.auth.refresh_token";
 var API_KEY_KEY = "cfg.auth.api_key";
 var storage = true ? cfgStorage : createStorage2("cfg");
 var isBrowser = typeof window !== "undefined";
+function trace(ev, fields) {
+  try {
+    const g = globalThis;
+    const sink2 = g.__cfgAuthTrace;
+    if (sink2) {
+      sink2(ev, fields);
+      return;
+    }
+    const queue = g.__cfgAuthTraceQ ?? [];
+    g.__cfgAuthTraceQ = queue;
+    if (queue.length < 100) queue.push([Date.now(), ev, fields]);
+  } catch {
+  }
+}
+__name(trace, "trace");
+function pathOf(url) {
+  try {
+    return new URL(url, "http://x").pathname;
+  } catch {
+    return "";
+  }
+}
+__name(pathOf, "pathOf");
 function secondsUntilExp(token) {
   const exp = jwtExpMs(token);
   return exp === null ? void 0 : Math.max(1, Math.floor((exp - Date.now()) / 1e3));
@@ -662,10 +884,10 @@ function adoptLegacySession() {
     if (_storage.get(ACCESS_KEY) !== null || _storage.get(REFRESH_KEY) !== null) return;
     const legacy = backendFor("localStorage");
     const access = legacy.get(ACCESS_KEY);
-    const refresh = legacy.get(REFRESH_KEY);
-    if (access === null && refresh === null) return;
+    const refresh2 = legacy.get(REFRESH_KEY);
+    if (access === null && refresh2 === null) return;
     if (access !== null) _storage.set(ACCESS_KEY, access);
-    if (refresh !== null) _storage.set(REFRESH_KEY, refresh);
+    if (refresh2 !== null) _storage.set(REFRESH_KEY, refresh2);
     legacy.set(ACCESS_KEY, null);
     legacy.set(REFRESH_KEY, null);
   } catch {
@@ -750,12 +972,12 @@ function jwtExpMs(token) {
 __name(jwtExpMs, "jwtExpMs");
 function computeSnapshot() {
   const access = _storage.get(ACCESS_KEY);
-  const refresh = _storage.get(REFRESH_KEY);
+  const refresh2 = _storage.get(REFRESH_KEY);
   const now = Date.now();
   const accessExp = access ? jwtExpMs(access) : null;
   const accessAlive = access !== null && (accessExp === null || accessExp > now);
-  const refreshExp = refresh ? jwtExpMs(refresh) : null;
-  const refreshAlive = refresh !== null && (refreshExp === null || refreshExp > now);
+  const refreshExp = refresh2 ? jwtExpMs(refresh2) : null;
+  const refreshAlive = refresh2 !== null && (refreshExp === null || refreshExp > now);
   return {
     status: accessAlive || refreshAlive ? "authenticated" : "anonymous",
     accessExpiresAt: accessExp
@@ -778,9 +1000,9 @@ function scheduleExpiryFlip() {
   const now = Date.now();
   const exps = [];
   const access = _storage.get(ACCESS_KEY);
-  const refresh = _storage.get(REFRESH_KEY);
+  const refresh2 = _storage.get(REFRESH_KEY);
   const accessExp = access ? jwtExpMs(access) : null;
-  const refreshExp = refresh ? jwtExpMs(refresh) : null;
+  const refreshExp = refresh2 ? jwtExpMs(refresh2) : null;
   if (accessExp !== null && accessExp > now) exps.push(accessExp);
   if (refreshExp !== null && refreshExp > now) exps.push(refreshExp);
   if (!exps.length) return;
@@ -791,7 +1013,10 @@ __name(scheduleExpiryFlip, "scheduleExpiryFlip");
 function notifySessionChanged() {
   const next = computeSnapshot();
   const changed = next.status !== _snapshot.status || next.accessExpiresAt !== _snapshot.accessExpiresAt;
-  if (changed) _snapshot = next;
+  if (changed) {
+    _snapshot = next;
+    trace("store.snapshot", { status: next.status });
+  }
   scheduleExpiryFlip();
   if (!changed) return;
   for (const listener of Array.from(_sessionListeners)) {
@@ -874,6 +1099,7 @@ var auth = {
     return _storage.get(ACCESS_KEY);
   },
   setToken(token) {
+    trace("store.setToken", { present: token !== null });
     _storage.set(ACCESS_KEY, token);
     notifySessionChanged();
   },
@@ -881,14 +1107,16 @@ var auth = {
     return _storage.get(REFRESH_KEY);
   },
   setRefreshToken(token) {
+    trace("store.setRefreshToken", { present: token !== null });
     _storage.set(REFRESH_KEY, token);
     notifySessionChanged();
   },
   clearTokens() {
+    trace("store.clearTokens");
     for (const mode of ["localStorage", "sessionStorage", "cookie"]) {
-      const backend = backendFor(mode);
-      backend.set(ACCESS_KEY, null);
-      backend.set(REFRESH_KEY, null);
+      const backend2 = backendFor(mode);
+      backend2.set(ACCESS_KEY, null);
+      backend2.set(REFRESH_KEY, null);
     }
     storage.clearAll();
     notifySessionChanged();
@@ -907,6 +1135,7 @@ var auth = {
    * rotation); `refresh: null` explicitly drops it.
    */
   setSession(tokens) {
+    trace("store.setSession", { refresh: tokens.refresh === void 0 ? "kept" : tokens.refresh === null ? "dropped" : "set" });
     _storage.set(ACCESS_KEY, tokens.access);
     if (tokens.refresh !== void 0) _storage.set(REFRESH_KEY, tokens.refresh);
     notifySessionChanged();
@@ -1042,10 +1271,14 @@ async function tryRefresh() {
   if (_refreshInflight) return _refreshInflight;
   if (!_refreshHandler) return null;
   const runRefresh = /* @__PURE__ */ __name(async () => {
-    const refresh = auth.getRefreshToken();
-    if (!refresh) return null;
-    const result = await _refreshHandler(refresh);
-    if (!result?.access) return null;
+    const refresh2 = auth.getRefreshToken();
+    if (!refresh2) return null;
+    const result = await _refreshHandler(refresh2);
+    if (!result?.access) {
+      trace("refresh", { ok: false, why: "no-access" });
+      return null;
+    }
+    trace("refresh", { ok: true, rotated: Boolean(result.refresh) });
     auth.setToken(result.access);
     if (result.refresh) auth.setRefreshToken(result.refresh);
     return result.access;
@@ -1058,6 +1291,7 @@ async function tryRefresh() {
       }
       return await runRefresh();
     } catch {
+      trace("refresh", { ok: false, why: "threw" });
       return null;
     } finally {
       _refreshInflight = null;
@@ -1066,7 +1300,8 @@ async function tryRefresh() {
   return _refreshInflight;
 }
 __name(tryRefresh, "tryRefresh");
-function expireSession(response) {
+function expireSession(response, why) {
+  trace("store.expire", { why, status: response.status, path: pathOf(response.url), handlers: _sessionExpiredHandlers.size });
   auth.clearTokens();
   for (const cb of Array.from(_sessionExpiredHandlers)) {
     try {
@@ -1209,15 +1444,16 @@ function installAuthOnClient(client2) {
   client2.interceptors.response.use(async (response, request) => {
     if (response.status !== 401) return response;
     if (/\/accounts\/(otp|oauth|login|register|token)\b/.test(request.url)) {
+      trace("401.passthrough", { path: pathOf(request.url) });
       return response;
     }
     if (request.headers.get(RETRY_MARKER)) {
-      expireSession(response);
+      expireSession(response, "retry-marker");
       return response;
     }
     const newToken = await tryRefresh();
     if (!newToken) {
-      expireSession(response);
+      expireSession(response, "refresh-failed");
       return response;
     }
     const retry = request.clone();
@@ -1229,7 +1465,7 @@ function installAuthOnClient(client2) {
     }
     try {
       const retried = await fetch(retry);
-      if (retried.status === 401) expireSession(retried);
+      if (retried.status === 401) expireSession(retried, "retry-401");
       return retried;
     } catch {
       return response;
@@ -1238,7 +1474,7 @@ function installAuthOnClient(client2) {
 }
 __name(installAuthOnClient, "installAuthOnClient");
 var REFRESH_ENDPOINT = "/cfg/accounts/token/refresh/";
-auth.setRefreshHandler(async (refresh) => {
+auth.setRefreshHandler(async (refresh2) => {
   try {
     const url = `${auth.getBaseUrl()}${REFRESH_ENDPOINT}`;
     const headers = { "Content-Type": "application/json" };
@@ -1250,11 +1486,11 @@ auth.setRefreshHandler(async (refresh) => {
       method: "POST",
       headers,
       credentials: auth.getWithCredentials() ? "include" : "same-origin",
-      body: JSON.stringify({ refresh })
+      body: JSON.stringify({ refresh: refresh2 })
     });
     if (!res.ok) return null;
     const data = await res.json();
-    return data?.access ? { access: data.access, refresh: data.refresh ?? refresh } : null;
+    return data?.access ? { access: data.access, refresh: data.refresh ?? refresh2 } : null;
   } catch {
     return null;
   }
@@ -1453,6 +1689,16 @@ __name(useTimezone, "useTimezone");
 // src/auth/hooks/useCfgRouter.ts
 var import_navigation = require("next/navigation");
 var import_react3 = require("react");
+var hardNavigating = false;
+if (typeof window !== "undefined") {
+  window.addEventListener("pageshow", (e) => {
+    if (e.persisted) hardNavigating = false;
+  });
+}
+function fromPath() {
+  return typeof window === "undefined" ? "" : window.location.pathname;
+}
+__name(fromPath, "fromPath");
 function getBasePath() {
   if (typeof process === "undefined") {
     return "";
@@ -1473,6 +1719,7 @@ function useCfgRouter() {
   const router = (0, import_navigation.useRouter)();
   const basePath = (0, import_react3.useMemo)(() => getBasePath(), []);
   const push = (0, import_react3.useCallback)((href, options) => {
+    authTrace("nav.push", { from: fromPath(), to: href });
     if (basePath) {
       window.location.href = withBasePath(href, basePath);
     } else {
@@ -1480,6 +1727,7 @@ function useCfgRouter() {
     }
   }, [router, basePath]);
   const replace = (0, import_react3.useCallback)((href, options) => {
+    authTrace("nav.replace", { from: fromPath(), to: href });
     if (basePath) {
       window.location.replace(withBasePath(href, basePath));
     } else {
@@ -1487,9 +1735,21 @@ function useCfgRouter() {
     }
   }, [router, basePath]);
   const hardPush = (0, import_react3.useCallback)((href) => {
+    if (hardNavigating) {
+      authTrace("nav.hardPush.ignored", { from: fromPath(), to: href });
+      return;
+    }
+    hardNavigating = true;
+    authTrace("nav.hardPush", { from: fromPath(), to: href });
     window.location.href = withBasePath(href, basePath);
   }, [basePath]);
   const hardReplace = (0, import_react3.useCallback)((href) => {
+    if (hardNavigating) {
+      authTrace("nav.hardReplace.ignored", { from: fromPath(), to: href });
+      return;
+    }
+    hardNavigating = true;
+    authTrace("nav.hardReplace", { from: fromPath(), to: href });
     window.location.replace(withBasePath(href, basePath));
   }, [basePath]);
   const prefetch = (0, import_react3.useCallback)((href) => {
@@ -1501,7 +1761,7 @@ function useCfgRouter() {
   const forward = (0, import_react3.useCallback)(() => {
     router.forward();
   }, [router]);
-  const refresh = (0, import_react3.useCallback)(() => {
+  const refresh2 = (0, import_react3.useCallback)(() => {
     router.refresh();
   }, [router]);
   return {
@@ -1512,7 +1772,7 @@ function useCfgRouter() {
     prefetch,
     back,
     forward,
-    refresh
+    refresh: refresh2
   };
 }
 __name(useCfgRouter, "useCfgRouter");
@@ -3455,7 +3715,7 @@ var OAuthErrorCodeEnum = /* @__PURE__ */ ((OAuthErrorCodeEnum2) => {
 
 // src/auth/utils/errors.ts
 var prop = /* @__PURE__ */ __name((value, key) => typeof value === "object" && value !== null ? value[key] : void 0, "prop");
-var TRANSPORT_FALLBACK = /^HTTP \d{3}:\s*/;
+var TRANSPORT_FALLBACK = /^HTTP \d{1,3}:\s*/;
 var AUTH_ERROR_KEYS = {
   invalidCredentials: "ui.errors.unauthorized",
   rateLimited: "api.errors.rateLimited",
@@ -3472,6 +3732,7 @@ var FALLBACK_COPY = {
 };
 var keyForStatus = /* @__PURE__ */ __name((status) => {
   if (status === void 0) return AUTH_ERROR_KEYS.generic;
+  if (status === 0) return AUTH_ERROR_KEYS.networkError;
   if (status === 401 || status === 403) return AUTH_ERROR_KEYS.invalidCredentials;
   if (status === 404) return AUTH_ERROR_KEYS.serverUnavailable;
   if (status === 429) return AUTH_ERROR_KEYS.rateLimited;
@@ -3516,9 +3777,9 @@ var logAuthFailure = /* @__PURE__ */ __name((log, message, error) => {
 
 // src/auth/utils/oauthErrors.ts
 var SERVER_CODES = new Set(Object.values(OAuthErrorCodeEnum));
-var record = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null ? value : null, "record");
+var record2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null ? value : null, "record");
 var readOAuthFailure = /* @__PURE__ */ __name((err, fallback) => {
-  const body = record(record(err)?.response);
+  const body = record2(record2(err)?.response);
   const code = body?.error;
   if (typeof code === "string" && SERVER_CODES.has(code)) {
     const description = body?.error_description;
@@ -3797,6 +4058,7 @@ var useOAuthLogin = /* @__PURE__ */ __name((options = {}) => {
     setLoadingProvider(provider);
     setError(null);
     setErrorCode(null);
+    authTrace("oauth.start");
     auth.clearSession();
     try {
       Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
@@ -3844,6 +4106,7 @@ var useOAuthLogin = /* @__PURE__ */ __name((options = {}) => {
       if (!response.access || !response.refresh) {
         throw new Error("Invalid response from OAuth callback");
       }
+      authTrace("oauth.session");
       auth.setSession({ access: response.access, refresh: response.refresh });
       Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
         category: "auth" /* AUTH */,
@@ -4024,6 +4287,7 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
     setError(null);
   }, []);
   const handleSuccess = (0, import_react14.useCallback)((response) => {
+    authTrace("2fa.session");
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
     if (response.warning) {
       setWarning(response.warning);
@@ -4675,8 +4939,19 @@ function purgeLegacyTokenStorage() {
 }
 __name(purgeLegacyTokenStorage, "purgeLegacyTokenStorage");
 
+// src/auth/utils/authState.ts
+function resolveAuthStatus(s) {
+  if (!s.clientReady) return "resolving";
+  if (s.snapshotAuthenticated) {
+    return s.profileSettled || s.timedOut ? "authenticated" : "resolving";
+  }
+  if (s.storeAuthenticated && !s.timedOut) return "resolving";
+  return "anonymous";
+}
+__name(resolveAuthStatus, "resolveAuthStatus");
+
 // src/auth/context/AccountsContext.tsx
-var import_react19 = require("react");
+var import_react20 = require("react");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRegenerateCreate.ts
 var import_mutation = __toESM(require("swr/mutation"), 1);
@@ -5023,6 +5298,15 @@ __name(useCfgAccountsTokenCreate, "useCfgAccountsTokenCreate");
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
 var import_mutation19 = __toESM(require("swr/mutation"), 1);
 
+// src/auth/context/sharedContext.ts
+var import_react19 = require("react");
+function sharedContext(key, initial) {
+  const g = globalThis;
+  const registry = g.__cfgAuthContexts ??= {};
+  return registry[key] ??= (0, import_react19.createContext)(initial);
+}
+__name(sharedContext, "sharedContext");
+
 // src/auth/context/AccountsContext.tsx
 var import_jsx_runtime = require("react/jsx-runtime");
 function hasApiOrigin() {
@@ -5036,9 +5320,9 @@ function hasApiOrigin() {
   }
 }
 __name(hasApiOrigin, "hasApiOrigin");
-var AccountsContext = (0, import_react19.createContext)(void 0);
+var AccountsContext = sharedContext("accounts", void 0);
 function AccountsProvider({ children }) {
-  const [profile, setProfile] = (0, import_react19.useState)(() => {
+  const [profile, setProfile] = (0, import_react20.useState)(() => {
     if (!auth.isAuthenticated()) {
       clearProfileCache();
       return void 0;
@@ -5046,15 +5330,15 @@ function AccountsProvider({ children }) {
     const cached = getCachedProfile();
     return cached || void 0;
   });
-  const [isLoadingProfile, setIsLoadingProfile] = (0, import_react19.useState)(false);
-  const [profileError, setProfileError] = (0, import_react19.useState)(null);
-  const profileRef = (0, import_react19.useRef)(profile);
-  const isLoadingRef = (0, import_react19.useRef)(false);
-  const fetchSeqRef = (0, import_react19.useRef)(0);
-  (0, import_react19.useEffect)(() => {
+  const [isLoadingProfile, setIsLoadingProfile] = (0, import_react20.useState)(false);
+  const [profileError, setProfileError] = (0, import_react20.useState)(null);
+  const profileRef = (0, import_react20.useRef)(profile);
+  const isLoadingRef = (0, import_react20.useRef)(false);
+  const fetchSeqRef = (0, import_react20.useRef)(0);
+  (0, import_react20.useEffect)(() => {
     profileRef.current = profile;
   }, [profile]);
-  (0, import_react19.useEffect)(() => {
+  (0, import_react20.useEffect)(() => {
     isLoadingRef.current = isLoadingProfile;
   }, [isLoadingProfile]);
   const { trigger: triggerProfileUpdate } = useCfgAccountsProfileUpdateUpdate();
@@ -5063,7 +5347,7 @@ function AccountsProvider({ children }) {
   const { trigger: triggerOtpRequest } = useCfgAccountsOtpRequestCreate();
   const { trigger: triggerOtpVerify } = useCfgAccountsOtpVerifyCreate();
   const { trigger: triggerPasswordLogin } = useCfgAccountsTokenCreate();
-  const refreshProfile = (0, import_react19.useCallback)(async (options) => {
+  const refreshProfile = (0, import_react20.useCallback)(async (options) => {
     const { callerId, force } = options || {};
     if (!hasApiOrigin()) {
       authLogger.debug(`No API origin configured, skipping profile fetch (caller: ${callerId})`);
@@ -5097,31 +5381,32 @@ function AccountsProvider({ children }) {
       }
     }
   }, []);
-  const updateProfile = (0, import_react19.useCallback)(async (data) => {
+  const updateProfile = (0, import_react20.useCallback)(async (data) => {
     await triggerProfileUpdate({ body: data });
     const user = await refreshProfile({ callerId: "updateProfile", force: true });
     return user;
   }, [triggerProfileUpdate, refreshProfile]);
-  const partialUpdateProfile = (0, import_react19.useCallback)(async (data) => {
+  const partialUpdateProfile = (0, import_react20.useCallback)(async (data) => {
     await triggerProfilePartialUpdate({ body: data });
     const user = await refreshProfile({ callerId: "partialUpdateProfile", force: true });
     return user;
   }, [triggerProfilePartialUpdate, refreshProfile]);
-  const uploadAvatar = (0, import_react19.useCallback)(async (avatar) => {
+  const uploadAvatar = (0, import_react20.useCallback)(async (avatar) => {
     await triggerAvatar({ body: { avatar } });
     const user = await refreshProfile({ callerId: "uploadAvatar", force: true });
     return user;
   }, [triggerAvatar, refreshProfile]);
-  const requestOTP = (0, import_react19.useCallback)(async (data) => {
+  const requestOTP = (0, import_react20.useCallback)(async (data) => {
     const result = await triggerOtpRequest({ body: data });
     return result;
   }, [triggerOtpRequest]);
-  const settleLoginEnvelope = (0, import_react19.useCallback)(async (result, callerId) => {
+  const settleLoginEnvelope = (0, import_react20.useCallback)(async (result, callerId) => {
     if (result.requires_2fa && result.session_id) {
       authLogger.info("2FA required, session:", result.session_id);
       return;
     }
     if (result.access && result.refresh) {
+      authTrace("accounts.otp.session");
       auth.setSession({ access: result.access, refresh: result.refresh });
       try {
         await refreshProfile({ callerId, force: true });
@@ -5130,29 +5415,30 @@ function AccountsProvider({ children }) {
       }
     }
   }, [refreshProfile]);
-  const verifyOTP = (0, import_react19.useCallback)(async (data) => {
+  const verifyOTP = (0, import_react20.useCallback)(async (data) => {
     const result = await triggerOtpVerify({ body: data });
     await settleLoginEnvelope(result, "verifyOTP");
     return result;
   }, [triggerOtpVerify, settleLoginEnvelope]);
-  const loginWithPassword = (0, import_react19.useCallback)(async (data) => {
+  const loginWithPassword = (0, import_react20.useCallback)(async (data) => {
     const result = await triggerPasswordLogin({ body: data });
     await settleLoginEnvelope(result, "loginWithPassword");
     return result;
   }, [triggerPasswordLogin, settleLoginEnvelope]);
-  const logout = (0, import_react19.useCallback)(() => {
-    const refresh = auth.getRefreshToken();
-    if (refresh) {
-      CfgAccountsAuth.cfgAccountsTokenBlacklistCreate({ body: { refresh } }).catch(() => {
+  const logout = (0, import_react20.useCallback)(() => {
+    const refresh2 = auth.getRefreshToken();
+    if (refresh2) {
+      CfgAccountsAuth.cfgAccountsTokenBlacklistCreate({ body: { refresh: refresh2 } }).catch(() => {
         authLogger.warn("Refresh-token blacklist failed (logged out locally anyway)");
       });
     }
+    authTrace("accounts.logout");
     auth.clearSession();
     setProfile(void 0);
     setProfileError(null);
     clearProfileCache();
   }, []);
-  const value = (0, import_react19.useMemo)(() => ({
+  const value = (0, import_react20.useMemo)(() => ({
     profile,
     isLoadingProfile,
     profileError,
@@ -5181,11 +5467,11 @@ function AccountsProvider({ children }) {
 }
 __name(AccountsProvider, "AccountsProvider");
 function useAccountsContext() {
-  const context = (0, import_react19.useContext)(AccountsContext);
-  if (!context) {
+  const context2 = (0, import_react20.useContext)(AccountsContext);
+  if (!context2) {
     throw new Error("useAccountsContext must be used within AccountsProvider");
   }
-  return context;
+  return context2;
 }
 __name(useAccountsContext, "useAccountsContext");
 
@@ -5202,7 +5488,7 @@ var resolveAuthRoutes = /* @__PURE__ */ __name((routes) => ({
   defaultAuthCallback: routes?.defaultAuthCallback || routes?.auth || defaultRoutes.defaultAuthCallback
 }), "resolveAuthRoutes");
 var EMAIL_STORAGE_KEY = CFG_KEYS.email.key;
-var AuthContext = (0, import_react20.createContext)(void 0);
+var AuthContext = sharedContext("auth", void 0);
 var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const accounts = useAccountsContext();
   const session = useSession();
@@ -5214,41 +5500,42 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     EMAIL_STORAGE_KEY,
     null
   );
-  const routes = (0, import_react20.useMemo)(() => resolveAuthRoutes(config?.routes), [config?.routes]);
-  const routesRef = (0, import_react20.useRef)(routes);
-  (0, import_react20.useEffect)(() => {
+  const routes = (0, import_react21.useMemo)(() => resolveAuthRoutes(config?.routes), [config?.routes]);
+  const routesRef = (0, import_react21.useRef)(routes);
+  (0, import_react21.useEffect)(() => {
     routesRef.current = routes;
   }, [routes]);
   const redirectManager = useAuthRedirectManager({
     fallbackUrl: routes.defaultCallback,
     clearOnUse: true
   });
-  const configRef = (0, import_react20.useRef)(config);
-  (0, import_react20.useEffect)(() => {
+  const configRef = (0, import_react21.useRef)(config);
+  (0, import_react21.useEffect)(() => {
     configRef.current = config;
   }, [config]);
-  const accountsRef = (0, import_react20.useRef)(accounts);
-  (0, import_react20.useEffect)(() => {
+  const accountsRef = (0, import_react21.useRef)(accounts);
+  (0, import_react21.useEffect)(() => {
     accountsRef.current = accounts;
   }, [accounts]);
-  const pendingManualNavRef = (0, import_react20.useRef)(false);
-  const [profileSettled, setProfileSettled] = (0, import_react20.useState)(false);
+  const pendingManualNavRef = (0, import_react21.useRef)(false);
+  const [profileSettled, setProfileSettled] = (0, import_react21.useState)(false);
   const hasProfile = Boolean(accounts.profile);
-  const profileAttemptedRef = (0, import_react20.useRef)(false);
-  (0, import_react20.useEffect)(() => {
+  const profileAttemptedRef = (0, import_react21.useRef)(false);
+  (0, import_react21.useEffect)(() => {
     if (!isAuthenticated) {
       profileAttemptedRef.current = false;
       const hasTokens = Boolean(auth.getToken() || auth.getRefreshToken());
       if (hasTokens && !auth.isAuthenticated()) {
         authLogger.warn("Dead session in storage \u2014 clearing");
+        authTrace("bootstrap.purge", { why: "dead-tokens" });
         auth.clearSession();
         clearProfileCache();
       } else if (!hasTokens && !auth.isAuthenticated()) {
+        authTrace("bootstrap.purge", { why: "no-session" });
         clearProfileCache();
         purgeLegacyTokenStorage();
         if (accountsRef.current.profile) accountsRef.current.logout();
       }
-      if (auth.isAuthenticated()) return;
       setProfileSettled(true);
       return;
     }
@@ -5257,9 +5544,13 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       return;
     }
     profileAttemptedRef.current = true;
+    authTrace("bootstrap.profile.start");
     let cancelled = false;
     accountsRef.current.refreshProfile({ callerId: "AuthProvider:bootstrap" }).catch((error) => {
       authLogger.warn("Profile load failed (session kept):", error);
+      authTrace("bootstrap.profile.failed", {
+        status: error instanceof APIError ? error.statusCode : 0
+      });
     }).finally(() => {
       if (!cancelled) setProfileSettled(true);
     });
@@ -5268,11 +5559,47 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     };
   }, [isAuthenticated, hasProfile]);
   const isLoading = !profileSettled;
-  const expiredHandledRef = (0, import_react20.useRef)(false);
-  (0, import_react20.useEffect)(() => {
+  const [clientReady, setClientReady] = (0, import_react21.useState)(false);
+  const [timedOut, setTimedOut] = (0, import_react21.useState)(false);
+  (0, import_react21.useEffect)(() => {
+    setClientReady(true);
+    const timer = setTimeout(() => setTimedOut(true), 8e3);
+    return () => clearTimeout(timer);
+  }, []);
+  const status = resolveAuthStatus({
+    clientReady,
+    snapshotAuthenticated: isAuthenticated,
+    storeAuthenticated: isBrowser2 ? auth.isAuthenticated() : false,
+    profileSettled,
+    timedOut
+  });
+  const lastStatusRef = (0, import_react21.useRef)("");
+  (0, import_react21.useEffect)(() => {
+    if (lastStatusRef.current === status) return;
+    lastStatusRef.current = status;
+    authTrace("status", {
+      status,
+      snapshot: isAuthenticated,
+      store: auth.isAuthenticated(),
+      profileSettled,
+      timedOut,
+      path: pathname ?? ""
+    });
+  }, [status, isAuthenticated, profileSettled, timedOut, pathname]);
+  (0, import_react21.useEffect)(() => {
+    globalThis.__cfgAuthNow = () => ({
+      status,
+      snapshot: isAuthenticated,
+      store: auth.isAuthenticated(),
+      hasToken: Boolean(auth.getToken()),
+      hasRefresh: Boolean(auth.getRefreshToken()),
+      profileSettled,
+      timedOut
+    });
+  }, [status, isAuthenticated, profileSettled, timedOut]);
+  (0, import_react21.useEffect)(() => {
     const unsubscribe = auth.onSessionExpired(() => {
-      if (expiredHandledRef.current) return;
-      expiredHandledRef.current = true;
+      authTrace("expired.handler", { path: pathname ?? "" });
       authLogger.warn("Session expired (terminal 401) \u2014 redirecting to login");
       clearProfileCache();
       Analytics.event("auth_session_expired" /* AUTH_SESSION_EXPIRED */, {
@@ -5281,16 +5608,17 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       router.hardReplace(routesRef.current.defaultAuthCallback);
     });
     return unsubscribe;
-  }, [router]);
-  (0, import_react20.useEffect)(() => {
+  }, [router, pathname]);
+  (0, import_react21.useEffect)(() => {
     if (!isAuthenticated || pendingManualNavRef.current) return;
     if (pathname === routes.auth && !queryParams.get("flow")) {
       const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;
       if (saved) redirectManager.clearRedirect();
+      authTrace("leave-auth", { to: saved || routes.defaultCallback, saved: Boolean(saved) });
       router.push(saved || routes.defaultCallback);
     }
   }, [isAuthenticated, pathname, queryParams, routes, router, redirectManager]);
-  const loadCurrentProfile = (0, import_react20.useCallback)(async (callerId) => {
+  const loadCurrentProfile = (0, import_react21.useCallback)(async (callerId) => {
     if (!auth.isAuthenticated()) {
       throw new Error("No valid authentication token");
     }
@@ -5298,7 +5626,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       callerId: callerId || "AuthContext.loadCurrentProfile"
     });
   }, []);
-  const checkAuthAndRedirect = (0, import_react20.useCallback)(async () => {
+  const checkAuthAndRedirect = (0, import_react21.useCallback)(async () => {
     if (auth.isAuthenticated()) {
       try {
         await loadCurrentProfile("checkAuthAndRedirect");
@@ -5310,8 +5638,9 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       router.push(routesRef.current.defaultAuthCallback);
     }
   }, [loadCurrentProfile, router]);
-  const requestOTP = (0, import_react20.useCallback)(
+  const requestOTP = (0, import_react21.useCallback)(
     async (identifier, sourceUrl, consent) => {
+      authTrace("otp.request");
       auth.clearSession();
       try {
         const body = {
@@ -5352,10 +5681,11 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     []
   );
-  const verifyOTP = (0, import_react20.useCallback)(
+  const verifyOTP = (0, import_react21.useCallback)(
     async (identifier, otpCode, sourceUrl, redirectUrl, skipRedirect) => {
       try {
         pendingManualNavRef.current = Boolean(skipRedirect);
+        authTrace("otp.verify", { skipRedirect: Boolean(skipRedirect) });
         const result = await accountsRef.current.verifyOTP({
           identifier,
           otp: otpCode,
@@ -5412,11 +5742,12 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     [setStoredEmail, redirectManager, router]
   );
-  const login = (0, import_react20.useCallback)(
+  const login = (0, import_react21.useCallback)(
     async (email, password, options) => {
       const { redirectUrl, skipRedirect } = options || {};
       try {
         pendingManualNavRef.current = Boolean(skipRedirect);
+        authTrace("password.login", { skipRedirect: Boolean(skipRedirect) });
         const result = await accountsRef.current.loginWithPassword({
           email,
           password
@@ -5477,7 +5808,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     [setStoredEmail, redirectManager, router]
   );
-  const refreshToken = (0, import_react20.useCallback)(async () => {
+  const refreshToken = (0, import_react21.useCallback)(async () => {
     const access = await auth.refreshNow();
     if (access) {
       Analytics.event("auth_token_refresh" /* AUTH_TOKEN_REFRESH */, {
@@ -5490,7 +5821,8 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     });
     return { success: false, message: "Error refreshing token" };
   }, []);
-  const logout = (0, import_react20.useCallback)(() => {
+  const logout = (0, import_react21.useCallback)(() => {
+    authTrace("logout");
     Analytics.event("auth_logout" /* AUTH_LOGOUT */, {
       category: "auth" /* AUTH */
     });
@@ -5499,24 +5831,25 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   }, [router]);
   const user = accounts.profile ?? null;
   const isAdminUser = Boolean(user?.is_staff || user?.is_superuser);
-  (0, import_react20.useEffect)(() => {
+  (0, import_react21.useEffect)(() => {
     applyRoleLogPolicy({ isAdmin: isAdminUser });
   }, [isAdminUser]);
-  const updateProfile = (0, import_react20.useCallback)(
+  const updateProfile = (0, import_react21.useCallback)(
     async (data) => {
       const result = await accountsRef.current.partialUpdateProfile(data);
       return result;
     },
     []
   );
-  const uploadAvatar = (0, import_react20.useCallback)(async (avatar) => {
+  const uploadAvatar = (0, import_react21.useCallback)(async (avatar) => {
     const result = await accountsRef.current.uploadAvatar(avatar);
     return result;
   }, []);
-  const value = (0, import_react20.useMemo)(
+  const value = (0, import_react21.useMemo)(
     () => ({
       user,
       isLoading,
+      status,
       // Reactive: flips via the store snapshot (token writes, refreshes,
       // expiry timer, cross-tab/cross-store sync) — no ticks, no polling.
       isAuthenticated,
@@ -5544,6 +5877,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     [
       user,
       isLoading,
+      status,
       isAuthenticated,
       isAdminUser,
       routes,
@@ -5569,10 +5903,11 @@ function AuthProviderRaw({ children, config, enabled = true }) {
   return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(AccountsProvider, { children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(AuthProviderInternal, { config, children }) });
 }
 __name(AuthProviderRaw, "AuthProviderRaw");
-var AuthProvider = (0, import_react20.memo)(AuthProviderRaw);
+var AuthProvider = (0, import_react21.memo)(AuthProviderRaw);
 var defaultAuthState = {
   user: null,
   isLoading: false,
+  status: "anonymous",
   isAuthenticated: false,
   isAdminUser: false,
   routes: resolveAuthRoutes(),
@@ -5625,14 +5960,14 @@ var defaultAuthState = {
   }, "uploadAvatar")
 };
 var useAuth = /* @__PURE__ */ __name(() => {
-  const context = (0, import_react20.useContext)(AuthContext);
-  if (context === void 0) {
+  const context2 = (0, import_react21.useContext)(AuthContext);
+  if (context2 === void 0) {
     if (isBrowser2 && isDev) {
       authLogger.debug("useAuth called outside AuthProvider, returning default state");
     }
     return defaultAuthState;
   }
-  return context;
+  return context2;
 }, "useAuth");
 var AuthContext_default = AuthContext;