fix(auth): reject expired JWT on session read (silent-401 shell)

readFromStorage validated token shape but never checked exp, so an expired
token mounted the full authed shell and every API call 401d silently. Decode
the JWT and treat an expired token as no session. Pattern backported from
skyai-finance. Frontend audit 2026-06-20, rank 1.

Also clears the localStorage Session in onUnauthorized (root.tsx) so a 401
fully logs out instead of leaving a dead session behind getToken.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -7,9 +7,9 @@ This file is a quick map, not a duplication of upstream docs.
 
 ## What Arcadia Admin is
 
-- **Arcadia Admin** is the operator/admin UI for [arcadia-core](../reference/arcadia-core), a multi-tenant Phoenix backend. Surfaces tenant management, user/role admin, billing, audit logs, storage configs, scheduled tasks, feature flags, and platform monitoring on top of arcadia's `/api/v1` and `/admin/*` endpoints.
+- **Arcadia Admin** is the operator/admin UI for [arcadia-core](../reference/arcadia-app), a multi-tenant Phoenix backend. Surfaces tenant management, user/role admin, billing, audit logs, storage configs, scheduled tasks, feature flags, and platform monitoring on top of arcadia's `/api/v1` and `/admin/*` endpoints.
 - **Cloned from** [Vibespace](../vibespace) — the starter for webapps in this style. Vibespace and Skyrise are the upstream sources of truth for the shell and the theme; don't backport arcadia-admin-specific changes into Vibespace unless they're broadly applicable.
-- **Backend reference** lives at `../reference/arcadia-core/`. Treat it as read-only documentation — it's the Phoenix umbrella app that owns the OpenAPI spec, controllers, schemas, and seed data. Spec is regenerated from a running arcadia at `http://localhost:4000/api/openapi` via `node ../lib-arcadia-core-client/scripts/sync-spec.mjs` (run from this directory).
+- **Backend reference** lives at `../reference/arcadia-app/`. Treat it as read-only documentation — it's the Phoenix umbrella app that owns the OpenAPI spec, controllers, schemas, and seed data. Spec is regenerated from a running arcadia at `http://localhost:4000/api/openapi` via `node ../lib-arcadia-client/scripts/sync-spec.mjs` (run from this directory).
 - **Skyrise** (`lib-theme-skyrise`) is the canonical theme — premium AI-first glass, iridescent body, vivid text, Apple-spring motion. Theme tweaks belong upstream in Vibespace + Skyrise, not here.
 - The brand string lives in **one place**: `app/lib/identity.ts` (`useBrand()` / `getBrand()`). Don't hardcode "Arcadia Admin" in components, page titles, or copy.
 

README.md

@@ -1,6 +1,6 @@
 # Arcadia Admin
 
-Admin webapp for [arcadia-core](../reference/arcadia-core) — the multi-tenant Phoenix backend. Built on the [Crema design system](https://git.sky-ai.com/CremaUIStudio) with the **Skyrise** theme and started from the [Vibespace](../vibespace) starter.
+Admin webapp for [arcadia-core](../reference/arcadia-app) — the multi-tenant Phoenix backend. Built on the [Crema design system](https://git.sky-ai.com/CremaUIStudio) with the **Skyrise** theme and started from the [Vibespace](../vibespace) starter.
 
 Surfaces tenant management, user/role administration, billing, audit logs, storage configs, scheduled tasks, feature flags, and platform monitoring on top of arcadia's `/api/v1` and `/admin/*` endpoints.
 
@@ -15,7 +15,7 @@ Open [http://localhost:5173](http://localhost:5173). The app talks to arcadia at
 
 To use it for real:
 
-1. Have arcadia running locally (see `../reference/arcadia-core/DEV_SETUP.md`).
+1. Have arcadia running locally (see `../reference/arcadia-app/DEV_SETUP.md`).
 2. Visit `/login` and sign in with admin credentials. In dev seeds: `admin@example.com` / `AdminP@ssw0rd` (tenant `default`).
 
 ## Configuration
@@ -33,7 +33,7 @@ To use it for real:
 `app/components/layout/app-shell.tsx` — left rail + appbar + avatar dropdown. Brand identity in `app/lib/identity.ts` (`name: "Arcadia Admin"`, icon: `Shield`). The shell is **template code, not a lib** — fork it freely as admin features are added.
 
 ### Arcadia client + auth UI
-- [`@crema/arcadia-core-client`](../lib-arcadia-core-client) — typed HTTP client (generic + openapi-fetch-backed `client.typed`), Phoenix Channels realtime, error normalization. Mounted at the root via `<ArcadiaProvider>`.
+- [`@crema/arcadia-client`](../lib-arcadia-client) — typed HTTP client (generic + openapi-fetch-backed `client.typed`), Phoenix Channels realtime, error normalization. Mounted at the root via `<ArcadiaProvider>`.
 - [`@crema/arcadia-auth-ui`](../lib-arcadia-auth-ui) — login / signup / password reset / 2FA forms, themed via Skyrise tokens. The `/login` route renders `<LoginForm>`.
 
 ### Skyrise theme
@@ -50,8 +50,8 @@ Surface tints (`body[data-surface="snow|stone|sage|slate"]`) and dark mode (`htm
 your-workspace/
   arcadia-admin/                ← this repo
   vibespace/                    ← starter that this was cloned from
-  reference/arcadia-core/        ← Phoenix backend (read-only reference)
+  reference/arcadia-app/        ← Phoenix backend (read-only reference)
-  lib-arcadia-core-client/
+  lib-arcadia-client/
   lib-arcadia-auth-ui/
   lib-action-bus/
   lib-aifirst-ui/
@@ -84,4 +84,4 @@ your-workspace/
 - [`docs/AI_FIRST.md`](docs/AI_FIRST.md) — command-bus / DSL system tour
 - [`app/components/layout/THEME_CONTRACT.md`](app/components/layout/THEME_CONTRACT.md) — token contract every theme must satisfy
 - `CLAUDE.md` — orientation for an LLM working in this repo
-- `../reference/arcadia-core/` — backend (DEV_SETUP, controllers, OpenAPI source-of-truth)
+- `../reference/arcadia-app/` — backend (DEV_SETUP, controllers, OpenAPI source-of-truth)

app/app.css

@@ -15,7 +15,7 @@
 @source "../../lib-aifirst-ui/src";
 @source "../../lib-llm-ui/src";
 @source "../../lib-action-bus/src";
-@source "../../lib-arcadia-core-client/src";
+@source "../../lib-arcadia-client/src";
 @source "../../lib-arcadia-auth-ui/src";
 @source "../../lib-table-ui/src";
 @source "../../lib-search-ui/src";

app/components/settings/llm-configurations-panel.tsx

@@ -9,7 +9,7 @@
 
 import { useCallback, useEffect, useMemo, useState } from "react"
 import { Pencil, Plus, Sparkles, Star, Trash2, Upload } from "lucide-react"
-import { useArcadiaClient } from "@crema/arcadia-core-client"
+import { useArcadiaClient } from "@crema/arcadia-client"
 import {
   loadSettings as loadActiveSettings,
   saveSettings as saveActiveSettings,

app/components/users/user-detail-sheet.tsx

@@ -15,7 +15,7 @@ import {
   X,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import { AlertBanner, ConfirmDialog } from "@crema/feedback-ui"
 
 import { Badge } from "~/components/ui/badge"

app/lib/admin-tools.ts

@@ -5,7 +5,7 @@
 // Each tool is a named function with documented args. The LLM never sees
 // raw HTTP — only the menu below.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 import {
   createToolRuntime,
   type ToolDef,
@@ -53,7 +53,7 @@ const docsClient = createRAGClient("/docs-index.json")
 //      tooling and wire it through `.env.local`.
 //   3. operator session JWT — works only when arcadia-search shares the
 //      JWT signing secret with the arcadia issuing the operator's session
-//      (i.e. local arcadia-core + local arcadia-search with matching keys).
+//      (i.e. local arcadia-app + local arcadia-search with matching keys).
 //   4. "dev" literal — only accepted by AUTH_MODE=dev backends.
 function readEnv(key: string): string | undefined {
   if (typeof import.meta === "undefined") return undefined
@@ -667,7 +667,7 @@ const TOOLS: ToolDef<ToolCtx>[] = [
   {
     name: "search_docs",
     description:
-      "Search the arcadia-core documentation (architecture, API surface, deploy/setup guides) for passages relevant to a question. Use this for conceptual or procedural questions where the live API tools won't help — e.g. 'how does multi-tenant isolation work', 'how do I deploy to production', 'what is the modular monolith pattern'. Returns up to `limit` ranked passages with title, sourcePath, and excerpt. Cite results by sourcePath in your reply.",
+      "Search the arcadia-app documentation (architecture, API surface, deploy/setup guides) for passages relevant to a question. Use this for conceptual or procedural questions where the live API tools won't help — e.g. 'how does multi-tenant isolation work', 'how do I deploy to production', 'what is the modular monolith pattern'. Returns up to `limit` ranked passages with title, sourcePath, and excerpt. Cite results by sourcePath in your reply.",
     parameters: {
       type: "object",
       properties: {
@@ -715,7 +715,7 @@ const TOOLS: ToolDef<ToolCtx>[] = [
   {
     name: "search_kb",
     description:
-      "Lexical (BM25) search over the arcadia-search Tantivy backend. Returns chunks with snippets + chunk_ids that can be passed to `read_chunk` to expand. Prefer this over `search_docs` (browser) when you need richer hits or when the content wouldn't be in the bundled docs.\n\nKnown corpora on the platform-admin tenant:\n- `docs` — arcadia-core architecture/ops docs (same as the browser RAG, server-hosted for parity).\n- `operator-tools` — arcadia-search + arcadia-admin documentation (admin sidecar, deploy script, search admin UI, MULTI_TENANT, RAG, AI_FIRST, LIBS, LLM_PROXY_CONTRACT).\n- `files` — markdown/text files uploaded by tenant users via arcadia-core.\n\nIf you're not sure what's available, call `list_search_corpora` first. Operators can add new corpora via the `/search` route.",
+      "Lexical (BM25) search over the arcadia-search Tantivy backend. Returns chunks with snippets + chunk_ids that can be passed to `read_chunk` to expand. Prefer this over `search_docs` (browser) when you need richer hits or when the content wouldn't be in the bundled docs.\n\nKnown corpora on the platform-admin tenant:\n- `docs` — arcadia-app architecture/ops docs (same as the browser RAG, server-hosted for parity).\n- `operator-tools` — arcadia-search + arcadia-admin documentation (admin sidecar, deploy script, search admin UI, MULTI_TENANT, RAG, AI_FIRST, LIBS, LLM_PROXY_CONTRACT).\n- `files` — markdown/text files uploaded by tenant users via arcadia-app.\n\nIf you're not sure what's available, call `list_search_corpora` first. Operators can add new corpora via the `/search` route.",
     parameters: {
       type: "object",
       properties: {

app/lib/arcadia-knowledge.ts

@@ -1,5 +1,5 @@
 // Domain primer baked into the assistant's system prompt so it understands
-// what arcadia-core is, what platform admins do, and how the data model fits
+// what arcadia-app is, what platform admins do, and how the data model fits
 // together. Keep this tight — it costs context tokens on every turn.
 
 export const ARCADIA_KNOWLEDGE = `Arcadia (the backend you administer):
@@ -31,7 +31,7 @@ Things to keep in mind when assisting:
 - Writes are auditable. Suggest the user double-check tenant slug and impact before suspend/deactivate. Deactivate is harsher than suspend — only use when clearly intended.
 - The operator can impersonate tenant users for debugging (POST /api/v1/admin/impersonate/:user_id) — surface this when they ask "why can't user X log in".
 - Quotas / rate cards / billing config errors usually surface as 402/403 from /api/v1 endpoints — diagnose by checking the tenant's billing-config and api-metering quotas.
-- The reference Phoenix app lives at \`reference/arcadia-core/\` in the workspace; its OpenAPI spec is at /api/openapi (sync via \`node ../lib-arcadia-core-client/scripts/sync-spec.mjs\`).
+- The reference Phoenix app lives at \`reference/arcadia-app/\` in the workspace; its OpenAPI spec is at /api/openapi (sync via \`node ../lib-arcadia-client/scripts/sync-spec.mjs\`).
 - Search admin (arcadia-search) is a separate service. Manage tenants/corpora at \`/search\`. Use \`list_search_corpora\` if you don't know what's indexed; \`rebuild_search_corpus\` after uploads or when results look stale; \`search_kb\` / \`read_chunk\` to query.
 
 When the user asks something that maps to a tool, call it. When they ask about a concept, explain it from this primer in plain language. Write tools (suspend_tenant, activate_tenant) prompt the operator with an inline confirm card before they actually run — you do not need to ask in prose first; just call the tool and the user will see the confirmation UI. If the user denies a write, do not retry it; ask what they'd like to do differently.

app/lib/arcadia/announcements.ts

@@ -1,7 +1,7 @@
 // Platform announcements helpers.
 // Backend: /api/v1/admin/announcements (admin CRUD).
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type AnnouncementType =
   | "info"

app/lib/arcadia/api-keys.ts

@@ -4,7 +4,7 @@
 // once — list/show endpoints only return the prefix. Callers must surface
 // the value to the user immediately on create.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export interface ApiKey {
   id: string

app/lib/arcadia/audit-logs.ts

@@ -1,7 +1,7 @@
 // Audit log + observability helpers.
 // All endpoints are read-only; the backend writes audit events itself.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type AuditSeverity = "info" | "warning" | "error" | "critical" | string
 

app/lib/arcadia/buckets.ts

@@ -2,7 +2,7 @@
 // Backend: /api/v1/platform/buckets/*. All operations require a
 // storage_config_id pointing at a credential row in /api/v1/storage_configs.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export interface Bucket {
   name: string

app/lib/arcadia/digital-objects.ts

@@ -2,7 +2,7 @@
 // used by the avatar uploader. The full digital-objects API is much
 // larger; add endpoints here as we wire more features.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export interface DigitalObject {
   id: string

app/lib/arcadia/health.ts

@@ -2,9 +2,9 @@
 //
 // Backed by /api/v1/health* (public — no auth). Each subsystem is probed
 // independently; the overall endpoint aggregates and returns 503 if any
-// subsystem is not "ok". See arcadia-core commit f427892.
+// subsystem is not "ok". See arcadia-app commit f427892.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type HealthSubsystem = "api" | "db" | "workers" | "storage"
 

app/lib/arcadia/integrations.ts

@@ -4,7 +4,7 @@
 // arcadia-console's tenant surface); this file just exposes operator-idiomatic
 // names so the page reads naturally.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 import {
   createIntegrationsApi,
   type CredentialInput,

app/lib/arcadia/invitations.ts

@@ -1,7 +1,7 @@
 // Arcadia invitations API helpers.
 // Backed by /api/v1/invitations.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export interface InvitationRole {
   id: string

app/lib/arcadia/llm-configs.ts

@@ -8,7 +8,7 @@
 // `tenant_id: null` configurations are platform-defaults visible to
 // every tenant. Names are unique within (tenant, name).
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type LlmProvider = "openai" | "anthropic" | "deepseek" | "qwen" | "lmstudio"
 
@@ -124,7 +124,7 @@ export async function getCatalog(arcadia: ArcadiaClient): Promise<CatalogEntry[]
 /**
  * Compute cost in cents for a given input/output token count using a
  * configuration's published rates. Mirrors `LlmConfiguration.compute_cost_cents/3`
- * in arcadia-core — keep in sync.
+ * in arcadia-app — keep in sync.
  */
 export function computeCostCents(
   config: Pick<LlmConfiguration, "input_cost_per_million" | "output_cost_per_million">,

app/lib/arcadia/llm-proxy.ts

@@ -1,13 +1,13 @@
 // Arcadia LLM proxy client.
 //
-// Implements the spec in docs/LLM_PROXY_CONTRACT.md against arcadia-core's
+// Implements the spec in docs/LLM_PROXY_CONTRACT.md against arcadia-app's
 // POST /api/v1/ai/llm/chat. The lib (@crema/llm-providers-ui buildAdapter)
 // owns the streaming chat path itself; this module exposes a lightweight
 // non-streaming probe so the Settings "Test connection" button can verify
 // the proxy round-trips end-to-end (auth → secret resolution → upstream
 // dispatch → response shape).
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type LLMProxyProvider =
   | "openai"

app/lib/arcadia/memberships.ts

@@ -1,7 +1,7 @@
 // Tenant memberships — the M:N glue between users and tenants.
 // Backend: /api/v1/admin/memberships (admin) + /api/v1/me/tenants (self).
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type MembershipStatus = "active" | "suspended" | "deactivated" | string
 

app/lib/arcadia/monitoring.ts

@@ -2,7 +2,7 @@
 // Wraps /api/v1/admin/monitoring/* + /api/v1/platform/* + a few observability
 // endpoints used by the monitoring dashboard.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 // --- Rate limits ---------------------------------------------------------
 

app/lib/arcadia/networking.ts

@@ -1,7 +1,7 @@
 // Networking helpers: firewalls, VPCs, domains + DNS records, floating IPs.
 // Backend: /api/v1/platform/{firewalls,vpcs,domains,floating_ips,...}.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 const BASE = "/api/v1/platform"
 

app/lib/arcadia/organizations.ts

@@ -5,7 +5,7 @@
 // `OrganizationContext` plug, so the same per-org routes used by end-users
 // are used here to mutate any org in the tenant.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type OrgStatus = "active" | "frozen" | "pending_deletion" | string
 export type OnOwnerRemoval =

app/lib/arcadia/profiles.ts

@@ -3,7 +3,7 @@
 // profile fields. The "profile" here is the per-tenant profile row, not
 // the auth account.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export interface Profile {
   id: string

app/lib/arcadia/roles.ts

@@ -1,7 +1,7 @@
 // Arcadia roles API helpers.
 // Backed by /api/v1/roles (resources route, except :new and :edit).
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export interface Role {
   id: string

app/lib/arcadia/scheduled-tasks.ts

@@ -1,7 +1,7 @@
 // Scheduled tasks (cron) helpers.
 // Backend: /api/v1/admin/scheduled-tasks (CRUD + runs/enable/disable/trigger).
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type ScheduledTaskAction = "webhook" | "event"
 

app/lib/arcadia/secrets.ts

@@ -5,7 +5,7 @@
 // exposed by these endpoints. Tenant-side resolution (returning the value)
 // goes through a separate runtime endpoint that's not used by the admin UI.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type SecretCategory =
   | "api_key"

app/lib/arcadia/sso.ts

@@ -2,7 +2,7 @@
 // Backend: /api/v1/sso/identity-providers (tenant CRUD) + /sessions.
 // Note: certificates are large and write-only.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export interface IdentityProvider {
   id: string

app/lib/arcadia/status-page.ts

@@ -1,7 +1,7 @@
 // Status page helpers — components, incidents, subscribers.
 // Backend: /api/v1/admin/status-page/* (admin CRUD).
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type ComponentStatus =
   | "operational"

app/lib/arcadia/storage-configs.ts

@@ -8,7 +8,7 @@
 // generic `arcadia.GET<T>` / `arcadia.POST<T>` / etc. — same pattern as
 // `tenants.ts`. Switch to `arcadia.typed.*` when the spec gains coverage.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type StorageBackend = "s3" | "local" | "gcs"
 export type StorageStatus = "active" | "inactive" | "degraded" | "maintenance"

app/lib/arcadia/tenants.ts

@@ -6,7 +6,7 @@
 // gains coverage, switch to `arcadia.typed.GET("/api/v1/admin/tenants", ...)`
 // and drop these manual types.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type TenantStatus = "active" | "suspended" | "deactivated" | string
 

app/lib/arcadia/user-stats.ts

@@ -1,6 +1,6 @@
 // Per-user usage + quota helpers.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export interface UserUsage {
   storage_used_bytes: number

app/lib/arcadia/users.ts

@@ -4,7 +4,7 @@
 // describe these operations as typed paths, so we hand-roll types and use
 // the generic verb methods on the client. Same pattern as tenants.ts.
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type UserStatus = "active" | "inactive" | "suspended"
 

app/lib/arcadia/webhooks.ts

@@ -1,7 +1,7 @@
 // Outbound webhook helpers.
 // Backend: /api/v1/webhooks (CRUD + pause/resume/regenerate-secret/deliveries/stats/test).
 
-import type { ArcadiaClient } from "@crema/arcadia-core-client"
+import type { ArcadiaClient } from "@crema/arcadia-client"
 
 export type WebhookStatus = "active" | "paused" | "disabled"
 export type WebhookRetryStrategy = "linear" | "exponential"

app/lib/gateway.ts

@@ -1,13 +1,13 @@
 // Arcadia LLM-gateway client.
 //
-// The integration registry lives on arcadia-llm-gateway, not arcadia-core, so
+// The integration registry lives on arcadia-llm-gateway, not arcadia-app, so
 // it needs its own ArcadiaClient pointed at a different base URL. Everything
-// else is identical to the arcadia-core client: the same access token (the
+// else is identical to the arcadia-app client: the same access token (the
-// gateway validates arcadia-core JWTs via the shared Guardian secret) and the
+// gateway validates arcadia-app JWTs via the shared Guardian secret) and the
 // same 401 cleanup. The gateway's CORS already allows localhost + any
 // *.sky-ai.com origin, so the browser calls it directly.
 
-import { createArcadiaClient, type ArcadiaClient } from "@crema/arcadia-core-client"
+import { createArcadiaClient, type ArcadiaClient } from "@crema/arcadia-client"
 
 const GATEWAY_URL = import.meta.env.VITE_LLM_GATEWAY_URL ?? "http://localhost:4015"
 

app/lib/llm-config-bootstrap.tsx

@@ -11,7 +11,7 @@
 // panel remains the place to switch between configs.
 
 import { useEffect } from "react"
-import { useArcadiaClient } from "@crema/arcadia-core-client"
+import { useArcadiaClient } from "@crema/arcadia-client"
 import {
   loadSettings,
   saveSettings,

app/lib/profile-bootstrap.tsx

@@ -3,7 +3,7 @@
 // immediately, without waiting for the user to navigate to /profile.
 
 import { useEffect } from "react"
-import { useArcadiaClient } from "@crema/arcadia-core-client"
+import { useArcadiaClient } from "@crema/arcadia-client"
 
 import { fetchDigitalObjectAsBlobUrl } from "~/lib/arcadia/digital-objects"
 import { getProfile, pickAvatarUrl } from "~/lib/arcadia/profiles"

app/lib/session.ts

@@ -44,6 +44,10 @@ function readFromStorage(): Session | null {
       typeof parsed.token !== "string"
     )
       return null
+    // An expired JWT is not a session: without this the shell renders as
+    // "logged in" and every API call 401s silently. Treat it as null so the
+    // app bounces to /login. (Frontend audit 2026-06-20.)
+    if (isTokenExpired(parsed.token)) return null
     return {
       userId: parsed.userId,
       name:
@@ -76,6 +80,35 @@ export function loadSession(): Session | null {
   return readFromStorage()
 }
 
+// A token counts as expired only if it's a JWT carrying an `exp` in the past
+// (minus a small clock-skew grace). Non-JWT dev/mock tokens (no decodable
+// `exp`) are treated as non-expiring so offline/test flows keep working.
+const TOKEN_EXPIRY_SKEW_S = 30
+export function isTokenExpired(token: string | undefined | null): boolean {
+  if (!token) return true
+  const claims = decodeJwtPayload(token)
+  const exp =
+    claims && typeof claims.exp === "number" ? (claims.exp as number) : null
+  if (exp === null) return false
+  return Date.now() / 1000 >= exp - TOKEN_EXPIRY_SKEW_S
+}
+
+function decodeJwtPayload(token: string): Record<string, unknown> | null {
+  const parts = token.split(".")
+  if (parts.length !== 3) return null
+  try {
+    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/")
+    const pad = b64.length % 4 === 0 ? "" : "=".repeat(4 - (b64.length % 4))
+    const json =
+      typeof atob === "function"
+        ? atob(b64 + pad)
+        : Buffer.from(b64 + pad, "base64").toString("utf-8")
+    return JSON.parse(json) as Record<string, unknown>
+  } catch {
+    return null
+  }
+}
+
 export function signOut() {
   if (typeof window === "undefined") return
   localStorage.removeItem(STORAGE_KEY)

app/root.tsx

@@ -12,9 +12,10 @@ import "./app.css"
 
 import { ToastProvider, Toaster } from "@crema/notification-ui"
 import { CommandBusProvider } from "@crema/action-bus"
-import { ArcadiaProvider } from "@crema/arcadia-core-client"
+import { ArcadiaProvider } from "@crema/arcadia-client"
 import { LlmConfigBootstrap } from "~/lib/llm-config-bootstrap"
 import { ProfileBootstrap } from "~/lib/profile-bootstrap"
+import { signOut } from "~/lib/session"
 // CREMA:PROVIDERS-IMPORTS
 
 const ARCADIA_URL = import.meta.env.VITE_ARCADIA_URL ?? "http://localhost:4000"
@@ -59,6 +60,10 @@ export default function App() {
           if (typeof window !== "undefined") {
             sessionStorage.removeItem("arcadia_access_token")
             sessionStorage.removeItem("arcadia_refresh_token")
+            // Also clear the localStorage Session (crema.session); otherwise
+            // useSession() still reports "logged in" after a 401 and the shell
+            // keeps mounting with a dead token. (Frontend audit 2026-06-20.)
+            signOut()
           }
         }}
       >

app/routes/activity.tsx

@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useMemo, useState } from "react"
 import { Activity, Eye, RefreshCw } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import {
   ActionsCell,
   BadgeCell,

app/routes/ai.tsx

@@ -67,7 +67,7 @@ import {
 import { addLibraryItem } from "~/lib/library"
 import { Avatar, AvatarFallback } from "~/components/ui/avatar"
 import { pageTitle } from "~/lib/page-meta"
-import { useArcadiaClient } from "@crema/arcadia-core-client"
+import { useArcadiaClient } from "@crema/arcadia-client"
 import type { Message as LLMMessage, ToolCall } from "@crema/llm-ui"
 // Shape of a single hit returned by the `search_docs` tool. Defined here
 // rather than imported from the lib because the tool wrapper in

app/routes/announcements.tsx

@@ -7,7 +7,7 @@ import {
   Trash2,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import {
   ActionsCell,
   BadgeCell,

app/routes/assistant.tsx

@@ -98,7 +98,7 @@ import {
   runLLMToolCalls,
 } from "~/lib/admin-tools"
 import { ARCADIA_KNOWLEDGE } from "~/lib/arcadia-knowledge"
-import { useArcadiaClient } from "@crema/arcadia-core-client"
+import { useArcadiaClient } from "@crema/arcadia-client"
 import { ConfirmCard } from "~/components/assistant/confirm-card"
 import type { ToolCall } from "@crema/llm-ui"
 

app/routes/buckets.tsx

@@ -17,7 +17,7 @@ import {
   Trash2,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import {
   ActionsCell,
   DataTable,

app/routes/home.tsx

@@ -11,7 +11,7 @@ import {
   Users as UsersIcon,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import { AlertBanner } from "@crema/feedback-ui"
 
 import { AppShell } from "~/components/layout/app-shell"

app/routes/integrations.tsx

@@ -14,7 +14,7 @@ import {
   Plus,
   Trash2,
 } from "lucide-react"
-import { ArcadiaError } from "@crema/arcadia-core-client"
+import { ArcadiaError } from "@crema/arcadia-client"
 
 import { AppShell } from "~/components/layout/app-shell"
 import { Badge } from "~/components/ui/badge"

app/routes/memberships.tsx

@@ -9,7 +9,7 @@ import {
   Trash2,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import {
   ActionsCell,
   BadgeCell,

app/routes/monitoring.tsx

@@ -14,7 +14,7 @@ import {
   Zap,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import { AlertBanner } from "@crema/feedback-ui"
 import {
   BarChart,

app/routes/networking.tsx

@@ -10,7 +10,7 @@ import {
   Wifi,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import { AlertBanner, ConfirmDialog, EmptyState, LoadingOverlay } from "@crema/feedback-ui"
 
 import { AppShell } from "~/components/layout/app-shell"

app/routes/organizations.tsx

@@ -11,7 +11,7 @@ import {
   Users as UsersIcon,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import {
   ActionsCell,
   BadgeCell,

app/routes/profile.tsx

@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useState } from "react"
 import { Check, RefreshCw, Trash2 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import { AlertBanner } from "@crema/feedback-ui"
 
 import { AppShell } from "~/components/layout/app-shell"

app/routes/scheduled-tasks.tsx

@@ -12,7 +12,7 @@ import {
   Zap,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import {
   ActionsCell,
   BadgeCell,

app/routes/secrets.tsx

@@ -12,7 +12,7 @@ import {
   Trash2,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import {
   ActionsCell,
   BadgeCell,

app/routes/settings.tsx

@@ -16,7 +16,7 @@ import {
   useSettings as useProviderSettings,
   type LLMProvidersSettings,
 } from "@crema/llm-providers-ui"
-import { useArcadiaClient } from "@crema/arcadia-core-client"
+import { useArcadiaClient } from "@crema/arcadia-client"
 
 import { probeProxy, type LLMProxyProvider } from "~/lib/arcadia/llm-proxy"
 import { LlmConfigurationsPanel } from "~/components/settings/llm-configurations-panel"

app/routes/sso.tsx

@@ -9,7 +9,7 @@ import {
   X,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import {
   ActionsCell,
   BadgeCell,
@@ -580,7 +580,7 @@ function IdpEditorDialog({
               id="idp-callback"
               value={callbackUrl}
               onChange={(e) => setCallbackUrl(e.target.value)}
-              placeholder="https://your-arcadia-core/api/v1/auth/saml/callback"
+              placeholder="https://your-arcadia-app/api/v1/auth/saml/callback"
               className="font-mono text-xs"
               data-action="idp-form-callback"
             />

app/routes/status-page.tsx

@@ -8,7 +8,7 @@ import {
   Trash2,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import { AlertBanner, ConfirmDialog, EmptyState, LoadingOverlay } from "@crema/feedback-ui"
 import {
   IncidentTimeline,

app/routes/storage.tsx

@@ -12,7 +12,7 @@ import {
   Wrench,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import {
   ActionsCell,
   BadgeCell,

app/routes/tenants.tsx

@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useMemo, useState, type FormEvent } from "react"
 import { Pause, Play, Plus, RefreshCw } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import {
   ActionsCell,
   BadgeCell,

app/routes/users.tsx

@@ -14,7 +14,7 @@ import {
   X,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import {
   ActionsCell,
   BadgeCell,

app/routes/webhooks.tsx

@@ -15,7 +15,7 @@ import {
   Webhook as WebhookIcon,
 } from "lucide-react"
 
-import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-core-client"
+import { ArcadiaError, useArcadiaClient } from "@crema/arcadia-client"
 import {
   ActionsCell,
   BadgeCell,

docs/LLM_PROXY_CONTRACT.md

@@ -1,6 +1,6 @@
 # LLM Proxy Contract
 
-> **Status: implemented.** Backend lives in `arcadia-core` at `apps/arcadia_core/lib/arcadia/ai/llm_proxy*` (see commit `75669f1`). This document remains the contract that `lib-llm-providers-ui` and `app/lib/arcadia/llm-proxy.ts` expect from arcadia — keep it in sync if either side changes.
+> **Status: implemented.** Backend lives in `arcadia-app` at `apps/arcadia_core/lib/arcadia/ai/llm_proxy*` (see commit `75669f1`). This document remains the contract that `lib-llm-providers-ui` and `app/lib/arcadia/llm-proxy.ts` expect from arcadia — keep it in sync if either side changes.
 
 ## Why a proxy?
 

docs/RAG.md

@@ -14,7 +14,7 @@ shape.
 |---|---|---|
 | Lib / service | `@crema/lexical-rag-ui` | `arcadia-search` (Rust) |
 | Engine | MiniSearch (BM25, JS) | Tantivy (BM25, Rust) |
-| Where it runs | In the user's browser | Sibling of arcadia-core |
+| Where it runs | In the user's browser | Sibling of arcadia-app |
 | Index storage | Static JSON, fetched once | mmap'd disk, ~30–80MB resident |
 | Practical corpus size | ~5–10MB / ~50–100k chunks | GB-scale, no hard cap |
 | Update cadence | Static — rebuilt at app build time | Live — cron, webhook, or admin trigger |
@@ -58,7 +58,7 @@ The index is a single JSON file built offline by
 **How it's wired here.**
 
 - Build script: `arcadia-admin/scripts/build-docs-index.mjs` reads
-  markdown from `../reference/arcadia-core/`, chunks at H1–H3,
+  markdown from `../reference/arcadia-app/`, chunks at H1–H3,
   produces `public/docs-index.json`. Runs on `npm run build:docs`
   (and as the `prebuild` step before `npm run build`).
 - Tool wrapper: `app/lib/admin-tools.ts` constructs a singleton
@@ -130,7 +130,7 @@ text extraction, webhook signature, service tokens) see
 
 The default deploy runs **both**:
 
-- `search_docs` indexes the same arcadia-core docs the parity corpus
+- `search_docs` indexes the same arcadia-app docs the parity corpus
   on `arcadia-search` indexes. Same content, two engines.
 - This is intentional — it means the assistant always has *something*
   to search, even if `arcadia-search` is down or unreachable. The

scripts/build-docs-index.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // Build the /docs-index.json bundle consumed by @crema/lexical-rag-ui at
 // runtime. Thin wrapper — all engine logic lives in the lib's builder.ts;
-// this file owns the per-app config (which arcadia-core docs to index and
+// this file owns the per-app config (which arcadia-app docs to index and
 // how to tag them).
 //
 // Run: npm run build:docs
@@ -18,11 +18,11 @@ import MiniSearch from "minisearch"
 import { buildIndex } from "../../lib-lexical-rag-ui/src/builder.mjs"
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..")
-const ARCADIA = resolve(ROOT, "../reference/arcadia-core")
+const ARCADIA = resolve(ROOT, "../reference/arcadia-app")
 const OUT = resolve(ROOT, "public/docs-index.json")
 
 const SOURCES = [
-  // Arcadia platform docs (resolved against ARCADIA = ../reference/arcadia-core).
+  // Arcadia platform docs (resolved against ARCADIA = ../reference/arcadia-app).
   { path: "README.md", tags: ["core"] },
   { path: "docs/ARCADIA.md", tags: ["core"] },
   { path: "docs/MODULAR_MONOLITH.md", tags: ["core"] },

tsconfig.json

@@ -26,8 +26,8 @@
       "@crema/llm-ui/*": ["../lib-llm-ui/src/*"],
       "@crema/action-bus": ["../lib-action-bus/src/index.tsx"],
       "@crema/action-bus/*": ["../lib-action-bus/src/*"],
-      "@crema/arcadia-core-client": ["../lib-arcadia-core-client/src/index.tsx"],
+      "@crema/arcadia-client": ["../lib-arcadia-client/src/index.tsx"],
-      "@crema/arcadia-core-client/*": ["../lib-arcadia-core-client/src/*"],
+      "@crema/arcadia-client/*": ["../lib-arcadia-client/src/*"],
       "@crema/integration-registry-client": ["../lib-integration-registry-client/src/index.tsx"],
       "@crema/integration-registry-client/*": ["../lib-integration-registry-client/src/*"],
       "@crema/arcadia-auth-ui": ["../lib-arcadia-auth-ui/src/index.tsx"],

vite.config.ts

@@ -60,7 +60,7 @@ const searchUiSrc = fileURLToPath(
   new URL("../lib-search-ui/src", import.meta.url),
 )
 const arcadiaClientSrc = fileURLToPath(
-  new URL("../lib-arcadia-core-client/src", import.meta.url),
+  new URL("../lib-arcadia-client/src", import.meta.url),
 )
 const integrationRegistryClientSrc = fileURLToPath(
   new URL("../lib-integration-registry-client/src", import.meta.url),
@@ -175,7 +175,7 @@ export default defineConfig({
       { find: "@crema/auth-ui", replacement: `${authUiSrc}/index.tsx` },
       { find: "@crema/table-ui", replacement: `${tableUiSrc}/index.tsx` },
       { find: "@crema/search-ui", replacement: `${searchUiSrc}/index.tsx` },
-      { find: "@crema/arcadia-core-client", replacement: `${arcadiaClientSrc}/index.tsx` },
+      { find: "@crema/arcadia-client", replacement: `${arcadiaClientSrc}/index.tsx` },
       {
         find: "@crema/integration-registry-client",
         replacement: `${integrationRegistryClientSrc}/index.tsx`,