@authowl/react 0.21.2 → 0.23.0

package/dist/index.cjs

@@ -737,6 +737,42 @@ var init_InvitationPrompt = __esm({
   }
 });
 
+// src/last-used-method.ts
+function useLastUsedSignInMethod() {
+  const { config } = usePublicConfig();
+  const projectId = config?.environmentId ?? null;
+  return React5.useMemo(
+    () => projectId ? (0, import_core2.readLastUsedSignInMethod)(projectId) : null,
+    [projectId]
+  );
+}
+function useSignInMethodRecorder() {
+  const { config } = usePublicConfig();
+  const projectId = config?.environmentId ?? null;
+  return React5.useCallback(
+    (method, pending) => {
+      if (!projectId) return;
+      (pending ? import_core2.rememberPendingSignInMethod : import_core2.recordLastUsedSignInMethod)(projectId, method);
+    },
+    [projectId]
+  );
+}
+function useConfirmPendingSignInMethod(loaded, signedIn, projectId) {
+  React5.useEffect(() => {
+    if (loaded && projectId) (0, import_core2.settlePendingSignInMethod)(projectId, signedIn);
+  }, [loaded, projectId, signedIn]);
+}
+var React5, import_core2;
+var init_last_used_method = __esm({
+  "src/last-used-method.ts"() {
+    "use strict";
+    "use client";
+    React5 = __toESM(require("react"), 1);
+    import_core2 = require("@authowl/core");
+    init_hooks();
+  }
+});
+
 // src/provider.tsx
 function warnPublicConfigFailed(resolved, error) {
   let origin = resolved.apiUrl;
@@ -752,6 +788,12 @@ function warnPublicConfigFailed(resolved, error) {
     `[AuthOwl] Could not load this project's public config from ${origin} (${reason}). Authentication UI is unavailable until the request succeeds. Likely causes: the API is unreachable, \`apiUrl\` is wrong, or the publishable key points at a missing/mismatched project. Check \`apiUrl\` and \`publishableKey\` on <AuthOwlProvider>. (This warning is dev-only.)`
   );
 }
+function LastUsedMethodSync() {
+  const { config } = usePublicConfig();
+  const { isLoaded, isSignedIn } = useUser();
+  useConfirmPendingSignInMethod(isLoaded, isSignedIn, config?.environmentId ?? null);
+  return null;
+}
 function detectLocale() {
   if (typeof document !== "undefined") {
     const root = document.documentElement;
@@ -763,9 +805,9 @@ function detectLocale() {
   return "en";
 }
 function resolveLocale(prop, autoDetected, configLocale) {
-  if (prop !== "auto" && (0, import_core2.isLocale)(prop)) return prop;
+  if (prop !== "auto" && (0, import_core3.isLocale)(prop)) return prop;
   if (prop === "auto") return autoDetected ?? "en";
-  return (0, import_core2.isLocale)(configLocale) ? configLocale : "en";
+  return (0, import_core3.isLocale)(configLocale) ? configLocale : "en";
 }
 function AuthOwlProvider({
   publishableKey,
@@ -776,21 +818,21 @@ function AuthOwlProvider({
   invitationPrompt = true,
   children
 }) {
-  const fetchRef = React5.useRef(fetch);
+  const fetchRef = React6.useRef(fetch);
   fetchRef.current = fetch;
-  const resolved = React5.useMemo(
-    () => (0, import_core2.resolveConfig)({ publishableKey, apiUrl, fetch: fetchRef.current }),
+  const resolved = React6.useMemo(
+    () => (0, import_core3.resolveConfig)({ publishableKey, apiUrl, fetch: fetchRef.current }),
     [publishableKey, apiUrl]
   );
-  const client = React5.useMemo(() => (0, import_core2.createAuthOwlClient)(resolved), [resolved]);
-  const [config, setConfig] = React5.useState(null);
-  const [configState, setConfigState] = React5.useState("loading");
-  const [configAttempt, setConfigAttempt] = React5.useState(0);
-  const retryPublicConfig = React5.useCallback(() => setConfigAttempt((attempt) => attempt + 1), []);
-  React5.useEffect(() => {
+  const client = React6.useMemo(() => (0, import_core3.createAuthOwlClient)(resolved), [resolved]);
+  const [config, setConfig] = React6.useState(null);
+  const [configState, setConfigState] = React6.useState("loading");
+  const [configAttempt, setConfigAttempt] = React6.useState(0);
+  const retryPublicConfig = React6.useCallback(() => setConfigAttempt((attempt) => attempt + 1), []);
+  React6.useEffect(() => {
     let active = true;
     setConfigState("loading");
-    (0, import_core2.getPublicConfig)(resolved).then((c) => {
+    (0, import_core3.getPublicConfig)(resolved).then((c) => {
       if (!active) return;
       setConfig(c);
       setConfigState("ready");
@@ -805,15 +847,18 @@ function AuthOwlProvider({
     };
   }, [resolved, configAttempt]);
   const merged = resolveAppearance(appearance, config);
-  const [autoLocale, setAutoLocale] = React5.useState(null);
-  React5.useEffect(() => {
+  const [autoLocale, setAutoLocale] = React6.useState(null);
+  React6.useEffect(() => {
     if (localeProp === "auto") setAutoLocale(detectLocale());
   }, [localeProp]);
   const locale = resolveLocale(localeProp, autoLocale, config?.locale);
-  React5.useEffect(() => {
-    (0, import_core2.captureInvitationClaim)();
+  React6.useEffect(() => {
+    return (0, import_core3.setActiveLocale)(resolved.decoded.projectId, locale);
+  }, [locale, resolved.decoded.projectId]);
+  React6.useEffect(() => {
+    (0, import_core3.captureInvitationClaim)();
   }, []);
-  const ctxValue = React5.useMemo(
+  const ctxValue = React6.useMemo(
     () => ({ client, appearance, config, configState, retryPublicConfig, locale }),
     [client, appearance, config, configState, retryPublicConfig, locale]
   );
@@ -823,43 +868,46 @@ function AuthOwlProvider({
       className: "authowl-root",
       "data-authowl-theme": merged.theme,
       "data-authowl-locale": locale,
-      dir: (0, import_core2.directionFor)(locale),
+      dir: (0, import_core3.directionFor)(locale),
       style: { display: "contents", ...merged.style },
       children: [
         children,
+        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(LastUsedMethodSync, {}),
         invitationPrompt ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(InvitationPrompt, {}) : null
       ]
     }
   ) });
 }
 function useAuthOwlContext() {
-  const v = React5.useContext(Context);
+  const v = React6.useContext(Context);
   if (!v) {
     throw new Error("AuthOwl hooks must be used inside <AuthOwlProvider>");
   }
   return v;
 }
-var React5, import_core2, import_jsx_runtime4, warnedConfigProjects, Context;
+var React6, import_core3, import_jsx_runtime4, warnedConfigProjects, Context;
 var init_provider = __esm({
   "src/provider.tsx"() {
     "use strict";
     "use client";
-    React5 = __toESM(require("react"), 1);
-    import_core2 = require("@authowl/core");
+    React6 = __toESM(require("react"), 1);
+    import_core3 = require("@authowl/core");
     init_appearance();
     init_InvitationPrompt();
+    init_last_used_method();
+    init_hooks();
     import_jsx_runtime4 = require("react/jsx-runtime");
     warnedConfigProjects = /* @__PURE__ */ new Set();
-    Context = React5.createContext(null);
+    Context = React6.createContext(null);
   }
 });
 
 // src/components/use-submit-action.ts
 function useSubmitAction() {
-  const [pending, setPending] = React6.useState(false);
-  const [error, setError] = React6.useState(null);
+  const [pending, setPending] = React7.useState(false);
+  const [error, setError] = React7.useState(null);
   const toMessage = useServerError();
-  const run = React6.useCallback(
+  const run = React7.useCallback(
     async (action, { failure, onSuccess, mapError, keepPendingOnSuccess }) => {
       setError(null);
       setPending(true);
@@ -881,12 +929,12 @@ function useSubmitAction() {
   );
   return { pending, error, setError, run };
 }
-var React6;
+var React7;
 var init_use_submit_action = __esm({
   "src/components/use-submit-action.ts"() {
     "use strict";
     "use client";
-    React6 = __toESM(require("react"), 1);
+    React7 = __toESM(require("react"), 1);
     init_i18n();
   }
 });
@@ -933,6 +981,159 @@ var init_FormError = __esm({
   }
 });
 
+// src/components/captcha-loader.ts
+var captcha_loader_exports = {};
+__export(captcha_loader_exports, {
+  loadCaptcha: () => loadCaptcha
+});
+function providerGlobal(adapter) {
+  const api = window[adapter.globalName];
+  return typeof api?.render === "function" ? api : void 0;
+}
+function loadCaptcha(adapter) {
+  const available = providerGlobal(adapter);
+  if (available) return Promise.resolve(available);
+  const cached = loaders.get(adapter.scriptUrl);
+  if (cached) return cached;
+  const loading = new Promise((resolve, reject) => {
+    const existing = document.querySelector(
+      `script[src="${adapter.scriptUrl}"]`
+    );
+    const script = existing ?? document.createElement("script");
+    let poll;
+    const cleanup = () => {
+      clearTimeout(timeout);
+      if (poll !== void 0) clearInterval(poll);
+      script.removeEventListener("load", loaded);
+      script.removeEventListener("error", failed);
+    };
+    const resolveWhenPublished = () => {
+      const api = providerGlobal(adapter);
+      if (!api) return false;
+      cleanup();
+      resolve(api);
+      return true;
+    };
+    const loaded = () => {
+      if (!resolveWhenPublished() && poll === void 0) {
+        poll = setInterval(resolveWhenPublished, GLOBAL_POLL_INTERVAL_MS);
+      }
+    };
+    const failed = () => {
+      cleanup();
+      if (!existing) script.remove();
+      reject(new Error(`${adapter.label} failed to load`));
+    };
+    const timeout = setTimeout(failed, SCRIPT_LOAD_TIMEOUT_MS);
+    script.addEventListener("load", loaded, { once: true });
+    script.addEventListener("error", failed, { once: true });
+    if (existing) {
+      loaded();
+    } else {
+      script.src = adapter.scriptUrl;
+      script.async = true;
+      script.defer = true;
+      const nonce = document.querySelector("script[nonce]")?.nonce;
+      if (nonce) script.nonce = nonce;
+      document.head.appendChild(script);
+    }
+  });
+  const retryable = loading.catch((error) => {
+    loaders.delete(adapter.scriptUrl);
+    throw error;
+  });
+  loaders.set(adapter.scriptUrl, retryable);
+  return retryable;
+}
+var SCRIPT_LOAD_TIMEOUT_MS, GLOBAL_POLL_INTERVAL_MS, loaders;
+var init_captcha_loader = __esm({
+  "src/components/captcha-loader.ts"() {
+    "use strict";
+    "use client";
+    SCRIPT_LOAD_TIMEOUT_MS = 1e4;
+    GLOBAL_POLL_INTERVAL_MS = 25;
+    loaders = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/components/captcha-providers.ts
+var captcha_providers_exports = {};
+__export(captcha_providers_exports, {
+  CAPTCHA_ADAPTERS: () => CAPTCHA_ADAPTERS,
+  captchaAdapterFor: () => captchaAdapterFor
+});
+function preferredTheme() {
+  return typeof window !== "undefined" && window.matchMedia?.("(prefers-color-scheme: dark)").matches ? "dark" : "light";
+}
+function teardown(api, widgetId) {
+  if (api.remove) {
+    try {
+      api.remove(widgetId);
+      return;
+    } catch {
+    }
+  }
+  try {
+    api.reset?.(widgetId);
+  } catch {
+  }
+}
+function captchaAdapterFor(provider) {
+  return CAPTCHA_ADAPTERS[provider] ?? null;
+}
+var CAPTCHA_ADAPTERS;
+var init_captcha_providers = __esm({
+  "src/components/captcha-providers.ts"() {
+    "use strict";
+    "use client";
+    CAPTCHA_ADAPTERS = {
+      turnstile: {
+        scriptUrl: "https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit",
+        globalName: "turnstile",
+        label: "Cloudflare Turnstile",
+        invisibleRenderOptions: ({ siteKey, theme, action, language }) => ({
+          sitekey: siteKey,
+          theme,
+          action,
+          language,
+          execution: "execute",
+          appearance: "interaction-only",
+          size: "flexible"
+        }),
+        teardown
+      },
+      hcaptcha: {
+        scriptUrl: "https://js.hcaptcha.com/1/api.js?render=explicit",
+        globalName: "hcaptcha",
+        label: "hCaptcha",
+        invisibleRenderOptions: ({ siteKey, theme }) => ({
+          sitekey: siteKey,
+          // 'auto' is Turnstile vocabulary. hCaptcha and reCAPTCHA take light|dark
+          // only and silently fall back to light on anything else, which reads badly
+          // in a dark application.
+          theme: theme === "auto" ? preferredTheme() : theme,
+          size: "invisible"
+        }),
+        teardown
+      },
+      "recaptcha-v2": {
+        scriptUrl: "https://www.google.com/recaptcha/api.js?render=explicit",
+        globalName: "grecaptcha",
+        label: "reCAPTCHA",
+        invisibleRenderOptions: ({ siteKey, theme }) => ({
+          sitekey: siteKey,
+          // 'auto' is Turnstile vocabulary. hCaptcha and reCAPTCHA take light|dark
+          // only and silently fall back to light on anything else, which reads badly
+          // in a dark application.
+          theme: theme === "auto" ? preferredTheme() : theme,
+          size: "invisible"
+        }),
+        teardown
+      }
+    };
+  }
+});
+
 // ../../node_modules/.pnpm/qrcode-generator@2.0.4/node_modules/qrcode-generator/dist/qrcode.mjs
 var qrcode, QRMode, QRErrorCorrectionLevel, QRMaskPattern, QRUtil, QRMath, qrPolynomial, QRRSBlock, qrBitBuffer, qrNumber, qrAlphaNum, qr8BitByte, qrKanji, byteArrayOutputStream, base64EncodeOutputStream, base64DecodeInputStream, gifImage, createDataURL, qrcode_default, stringToBytes;
 var init_qrcode = __esm({
@@ -2653,11 +2854,11 @@ var init_model = __esm({
 // src/components/organization/use-organization-roles.ts
 function useOrganizationRoles(organizationId) {
   const api = useAuthClient().organization;
-  const apiRef = React49.useRef(api);
+  const apiRef = React50.useRef(api);
   apiRef.current = api;
-  const [dynamicRoles, setDynamicRoles] = React49.useState([]);
-  const requestRef = React49.useRef(0);
-  React49.useEffect(() => {
+  const [dynamicRoles, setDynamicRoles] = React50.useState([]);
+  const requestRef = React50.useRef(0);
+  React50.useEffect(() => {
     const token = ++requestRef.current;
     setDynamicRoles([]);
     if (!organizationId) return;
@@ -2673,7 +2874,7 @@ function useOrganizationRoles(organizationId) {
       requestRef.current += 1;
     };
   }, [organizationId]);
-  const roles = React49.useMemo(() => {
+  const roles = React50.useMemo(() => {
     const seen = /* @__PURE__ */ new Set();
     const out = [];
     for (const candidate of [...BUILTIN_ROLES, ...dynamicRoles.map((entry) => entry.role)]) {
@@ -2686,12 +2887,12 @@ function useOrganizationRoles(organizationId) {
   }, [dynamicRoles]);
   return { roles, dynamicRoles };
 }
-var React49, BUILTIN_ROLES;
+var React50, BUILTIN_ROLES;
 var init_use_organization_roles = __esm({
   "src/components/organization/use-organization-roles.ts"() {
     "use strict";
     "use client";
-    React49 = __toESM(require("react"), 1);
+    React50 = __toESM(require("react"), 1);
     init_hooks();
     BUILTIN_ROLES = ["owner", "admin", "member"];
   }
@@ -2706,12 +2907,12 @@ function useOrganizationListResource({
   inactiveData = null
 }) {
   const toServerError = useServerError();
-  const requestFn = React51.useRef(request);
+  const requestFn = React52.useRef(request);
   requestFn.current = request;
-  const [data, setData] = React51.useState(null);
-  const [error, setError] = React51.useState(null);
-  const requestToken = React51.useRef(0);
-  const refresh = React51.useCallback(async () => {
+  const [data, setData] = React52.useState(null);
+  const [error, setError] = React52.useState(null);
+  const requestToken = React52.useRef(0);
+  const refresh = React52.useCallback(async () => {
     const token = ++requestToken.current;
     if (!enabled || !resourceKey) {
       setData(inactiveData);
@@ -2731,7 +2932,7 @@ function useOrganizationListResource({
       if (token === requestToken.current) setError(fallback);
     }
   }, [enabled, fallback, inactiveData, resourceKey, toServerError]);
-  React51.useEffect(() => {
+  React52.useEffect(() => {
     setData(enabled && resourceKey ? null : inactiveData);
     setError(null);
     void refresh();
@@ -2741,12 +2942,12 @@ function useOrganizationListResource({
   }, [enabled, inactiveData, refresh, resourceKey]);
   return { data, isLoading: data === null && error === null, error, refresh };
 }
-var React51;
+var React52;
 var init_use_organization_list_resource = __esm({
   "src/components/organization/use-organization-list-resource.ts"() {
     "use strict";
     "use client";
-    React51 = __toESM(require("react"), 1);
+    React52 = __toESM(require("react"), 1);
     init_i18n();
   }
 });
@@ -2754,7 +2955,7 @@ var init_use_organization_list_resource = __esm({
 // src/components/organization/use-team-resources.ts
 function useTeamsResource(organizationId) {
   const api = useAuthClient().organization;
-  const apiRef = React52.useRef(api);
+  const apiRef = React53.useRef(api);
   apiRef.current = api;
   const t = useT();
   const resource = useOrganizationListResource({
@@ -2767,7 +2968,7 @@ function useTeamsResource(organizationId) {
 }
 function useTeamMembersResource(selectedTeamId) {
   const api = useAuthClient().organization;
-  const apiRef = React52.useRef(api);
+  const apiRef = React53.useRef(api);
   apiRef.current = api;
   const t = useT();
   const resource = useOrganizationListResource({
@@ -2778,12 +2979,12 @@ function useTeamMembersResource(selectedTeamId) {
   });
   return { members: resource.data, error: resource.error, reload: resource.refresh };
 }
-var React52;
+var React53;
 var init_use_team_resources = __esm({
   "src/components/organization/use-team-resources.ts"() {
     "use strict";
     "use client";
-    React52 = __toESM(require("react"), 1);
+    React53 = __toESM(require("react"), 1);
     init_hooks();
     init_i18n();
     init_use_organization_list_resource();
@@ -2800,7 +3001,7 @@ function TeamMembersPanel({
   const t = useT();
   const api = useAuthClient().organization;
   const { pending, error: actionError, run } = useSubmitAction();
-  const [userId, setUserId] = React53.useState("");
+  const [userId, setUserId] = React54.useState("");
   const { members, error, reload } = useTeamMembersResource(team.id);
   const assignedUserIds = new Set(members?.map((member) => member.userId));
   const availableMembers = organization.members.filter((member) => !assignedUserIds.has(member.userId));
@@ -2866,12 +3067,12 @@ function TeamMembersPanel({
     }) }) : error ? null : members === null ? /* @__PURE__ */ (0, import_jsx_runtime59.jsx)("div", { className: "ba-skeleton", "aria-label": t("common.loading") }) : members.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime59.jsx)("p", { className: "ba-muted", children: t("organization.profile.teams.membersEmpty") }) : null
   ] });
 }
-var React53, import_jsx_runtime59;
+var React54, import_jsx_runtime59;
 var init_TeamMembersPanel = __esm({
   "src/components/organization/TeamMembersPanel.tsx"() {
     "use strict";
     "use client";
-    React53 = __toESM(require("react"), 1);
+    React54 = __toESM(require("react"), 1);
     init_hooks();
     init_i18n();
     init_FormError();
@@ -2896,11 +3097,11 @@ function TeamsSection({
   const { teams, error: teamsError, reload } = useTeamsResource(organization.id);
   const { dynamicRoles } = useOrganizationRoles(organization.id);
   const capabilities = teamManagementCapabilities(membership, dynamicRoles);
-  const [name, setName] = React54.useState("");
-  const [selectedTeamId, setSelectedTeamId] = React54.useState(null);
-  const [editingTeamId, setEditingTeamId] = React54.useState(null);
-  const [editingName, setEditingName] = React54.useState("");
-  React54.useEffect(() => {
+  const [name, setName] = React55.useState("");
+  const [selectedTeamId, setSelectedTeamId] = React55.useState(null);
+  const [editingTeamId, setEditingTeamId] = React55.useState(null);
+  const [editingName, setEditingName] = React55.useState("");
+  React55.useEffect(() => {
     setSelectedTeamId(null);
     setEditingTeamId(null);
     setEditingName("");
@@ -3002,12 +3203,12 @@ function TeamsSection({
     )
   ] });
 }
-var React54, import_jsx_runtime60;
+var React55, import_jsx_runtime60;
 var init_TeamsSection = __esm({
   "src/components/organization/TeamsSection.tsx"() {
     "use strict";
     "use client";
-    React54 = __toESM(require("react"), 1);
+    React55 = __toESM(require("react"), 1);
     init_hooks();
     init_i18n();
     init_FormError();
@@ -3028,7 +3229,7 @@ __export(index_exports, {
   AuthLoading: () => AuthLoading,
   AuthOwlBadge: () => AuthOwlBadge,
   AuthOwlBranding: () => AuthOwlBranding,
-  AuthOwlError: () => import_core7.AuthOwlError,
+  AuthOwlError: () => import_core8.AuthOwlError,
   AuthOwlProvider: () => AuthOwlProvider,
   BackupCodesManager: () => BackupCodesManager,
   Bidi: () => Bidi,
@@ -3039,7 +3240,7 @@ __export(index_exports, {
   EmailOtpForm: () => EmailOtpForm,
   ForgotPassword: () => ForgotPassword,
   GoogleOneTap: () => GoogleOneTap,
-  InvalidKeyError: () => import_core7.InvalidKeyError,
+  InvalidKeyError: () => import_core8.InvalidKeyError,
   InvitationPrompt: () => InvitationPrompt,
   KNOWN_METHODS: () => KNOWN_METHODS,
   MFAChallenge: () => MFAChallenge,
@@ -3053,7 +3254,7 @@ __export(index_exports, {
   PasskeyManager: () => PasskeyManager,
   PhoneOTP: () => PhoneOTP,
   Protect: () => Protect,
-  RateLimitedError: () => import_core7.RateLimitedError,
+  RateLimitedError: () => import_core8.RateLimitedError,
   ResetPassword: () => ResetPassword,
   SignIn: () => SignIn,
   SignOutButton: () => SignOutButton,
@@ -3067,11 +3268,11 @@ __export(index_exports, {
   VerificationPending: () => VerificationPending,
   VerifyEmail: () => VerifyEmail,
   Waitlist: () => Waitlist,
-  createMembershipHas: () => import_core8.createMembershipHas,
+  createMembershipHas: () => import_core9.createMembershipHas,
   emailAutocomplete: () => emailAutocomplete,
-  membershipHas: () => import_core8.membershipHas,
-  membershipHasPermission: () => import_core8.membershipHasPermission,
-  membershipHasTeam: () => import_core8.membershipHasTeam,
+  membershipHas: () => import_core9.membershipHas,
+  membershipHasPermission: () => import_core9.membershipHasPermission,
+  membershipHasTeam: () => import_core9.membershipHasTeam,
   resolveSignInMethods: () => resolveSignInMethods,
   useAccount: () => useAccount,
   useAuth: () => useAuth,
@@ -3080,6 +3281,7 @@ __export(index_exports, {
   useConsent: () => useConsent,
   useEmailVerification: () => useEmailVerification,
   useInvitationRecipientHint: () => useInvitationRecipientHint,
+  useLastUsedSignInMethod: () => useLastUsedSignInMethod,
   useLocale: () => useLocale,
   useMFA: () => useMFA,
   useOrganization: () => useOrganization,
@@ -3101,7 +3303,7 @@ init_brand();
 init_hooks();
 
 // src/project-capabilities.ts
-var import_core3 = require("@authowl/core");
+var import_core4 = require("@authowl/core");
 
 // src/signin-methods.ts
 var KNOWN_METHODS = [
@@ -3133,7 +3335,7 @@ function resolveSignInMethods(config, pageHost) {
   const methods = config?.enabledMethods ?? ["password"];
   const social = config?.socialProviders ?? [];
   const has = (m) => methods.includes(m);
-  const capabilities = (0, import_core3.resolveProjectCapabilities)(config);
+  const capabilities = (0, import_core4.resolveProjectCapabilities)(config);
   const password = capabilities.passwordSignIn;
   const username = capabilities.usernameSignIn;
   const magicLink = capabilities.magicLinkSignIn;
@@ -3172,7 +3374,7 @@ function resolveSignInMethods(config, pageHost) {
 }
 
 // src/components/SignIn.tsx
-var React19 = __toESM(require("react"), 1);
+var React20 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
@@ -3238,15 +3440,15 @@ async function finishSignIn(opts) {
 init_use_submit_action();
 
 // src/components/passkey-autofill.ts
-var React7 = __toESM(require("react"), 1);
+var React8 = __toESM(require("react"), 1);
 init_hooks();
 function usePasskeyAutofill(opts) {
   const { signInPasskey } = useSignIn();
   const { sessionStore } = useAuthClient();
   const { enabled } = opts;
-  const ref = React7.useRef({ ...opts, signInPasskey, sessionStore });
+  const ref = React8.useRef({ ...opts, signInPasskey, sessionStore });
   ref.current = { ...opts, signInPasskey, sessionStore };
-  React7.useEffect(() => {
+  React8.useEffect(() => {
     if (!enabled || typeof window === "undefined") return;
     const pkc = window.PublicKeyCredential;
     if (!pkc?.isConditionalMediationAvailable) return;
@@ -3264,9 +3466,13 @@ function usePasskeyAutofill(opts) {
   }, [enabled]);
 }
 
+// src/components/SignIn.tsx
+init_last_used_method();
+
 // src/components/SocialButtons.tsx
-var React8 = __toESM(require("react"), 1);
+var React9 = __toESM(require("react"), 1);
 init_hooks();
+init_last_used_method();
 init_i18n();
 
 // src/components/social-icons.tsx
@@ -3345,9 +3551,10 @@ function SocialButtons({ providers, callbackURL }) {
   const t = useT();
   const toServerError = useServerError();
   const { signInSocial } = useSignIn();
-  const [pending, setPending] = React8.useState(null);
-  const [error, setError] = React8.useState(null);
-  React8.useEffect(() => {
+  const recordSignInMethod = useSignInMethodRecorder();
+  const [pending, setPending] = React9.useState(null);
+  const [error, setError] = React9.useState(null);
+  React9.useEffect(() => {
     if (typeof window === "undefined") return;
     const url = new URL(window.location.href);
     if (!url.searchParams.has("authowl_error")) return;
@@ -3377,6 +3584,8 @@ function SocialButtons({ providers, callbackURL }) {
             if (res?.error) {
               setError(toServerError(res.error, t("social.error.startFailed")));
               setPending(null);
+            } else {
+              recordSignInMethod(`social:${provider}`, true);
             }
           } catch {
             setError(t("social.error.startFailed"));
@@ -3440,100 +3649,16 @@ init_Spinner();
 var React10 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
+init_FormError();
 
-// src/components/Turnstile.tsx
-var React9 = __toESM(require("react"), 1);
-var import_jsx_runtime10 = require("react/jsx-runtime");
-var SCRIPT_URL = "https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit";
-var SCRIPT_LOAD_TIMEOUT_MS = 1e4;
-var LOCAL_TURNSTILE_TEST_TOKEN = "XXXX.DUMMY.TOKEN.XXXX";
-var loader = null;
-function loadTurnstile() {
-  if (window.turnstile) return Promise.resolve(window.turnstile);
-  if (loader) return loader;
-  loader = new Promise((resolve, reject) => {
-    const existing = document.querySelector(`script[src="${SCRIPT_URL}"]`);
-    const script = existing ?? document.createElement("script");
-    const cleanup = () => {
-      clearTimeout(timeout);
-      script.removeEventListener("load", loaded);
-      script.removeEventListener("error", failed);
-    };
-    const loaded = () => {
-      cleanup();
-      if (window.turnstile) {
-        resolve(window.turnstile);
-      } else {
-        reject(new Error("Turnstile unavailable"));
-      }
-    };
-    const failed = () => {
-      cleanup();
-      if (!existing) script.remove();
-      reject(new Error("Turnstile failed to load"));
-    };
-    const timeout = setTimeout(failed, SCRIPT_LOAD_TIMEOUT_MS);
-    script.addEventListener("load", loaded, { once: true });
-    script.addEventListener("error", failed, { once: true });
-    if (!existing) {
-      script.src = SCRIPT_URL;
-      script.async = true;
-      script.defer = true;
-      const nonce = document.querySelector("script[nonce]")?.nonce;
-      if (nonce) script.nonce = nonce;
-      document.head.appendChild(script);
-    }
-  }).catch((error) => {
-    loader = null;
-    throw error;
-  });
-  return loader;
-}
-function Turnstile({
-  siteKey,
-  theme,
-  onToken,
-  onUnavailable
-}) {
-  const container = React9.useRef(null);
-  const callbacks = React9.useRef({ onToken, onUnavailable });
-  callbacks.current = { onToken, onUnavailable };
-  React9.useEffect(() => {
-    callbacks.current.onToken(null);
-    if (!siteKey) {
-      callbacks.current.onToken(LOCAL_TURNSTILE_TEST_TOKEN);
-      return;
-    }
-    let active = true;
-    let widget = null;
-    void loadTurnstile().then((api) => {
-      if (!active || !container.current) return;
-      const id = api.render(container.current, {
-        sitekey: siteKey,
-        theme: theme === "system" ? "auto" : theme,
-        size: "flexible",
-        callback: (token) => callbacks.current.onToken(token),
-        "expired-callback": () => callbacks.current.onToken(null),
-        "error-callback": () => {
-          callbacks.current.onToken(null);
-          callbacks.current.onUnavailable();
-        }
-      });
-      widget = { api, id };
-    }).catch(() => {
-      if (active) callbacks.current.onUnavailable();
-    });
-    return () => {
-      active = false;
-      if (widget) widget.api.remove(widget.id);
-    };
-  }, [siteKey, theme]);
-  if (!siteKey) return null;
-  return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "ba-turnstile", ref: container, "data-testid": "phoneotp-turnstile" });
+// src/components/captcha-provider-ids.ts
+var CAPTCHA_PROVIDER_IDS = ["turnstile", "hcaptcha", "recaptcha-v2"];
+function isSupportedCaptchaProvider(provider) {
+  return CAPTCHA_PROVIDER_IDS.includes(provider);
 }
 
 // src/components/AuthChallenge.tsx
-var import_jsx_runtime11 = require("react/jsx-runtime");
+var import_jsx_runtime10 = require("react/jsx-runtime");
 var AUTH_CHALLENGE_ACTIONS = {
   signUp: "auth_signup",
   signIn: "auth_signin",
@@ -3548,38 +3673,53 @@ var challengeError = {
   code: "BOT_CHALLENGE_FAILED",
   message: "Human verification failed."
 };
-function turnstileTheme(root, fallback) {
+function captchaTheme(root, fallback) {
   const rendered = root?.dataset.authowlTheme;
   if (rendered === "light" || rendered === "dark") return rendered;
   if (fallback === "light" || fallback === "dark") return fallback;
   return "auto";
 }
 function useAuthChallenge() {
-  const { config, isLoading } = usePublicConfig();
+  const { config, isLoading, retry } = usePublicConfig();
   const t = useT();
   const container = React10.useRef(null);
   const active = React10.useRef(null);
   const [status, setStatus] = React10.useState("idle");
-  const siteKey = config?.authTurnstileSiteKey ?? null;
+  const captcha = config?.captcha ?? null;
+  const providerSupported = captcha ? isSupportedCaptchaProvider(captcha.provider) : false;
+  const unavailableProvider = captcha && !providerSupported ? captcha.provider : null;
+  const refetched = React10.useRef(null);
+  const refetchIfConfigMayBeStale = React10.useCallback(() => {
+    if (!config || refetched.current === config) return;
+    refetched.current = config;
+    retry();
+  }, [config, retry]);
   const removeActive = React10.useCallback((reason) => {
     const current = active.current;
     active.current = null;
     if (!current) return;
-    current.api.remove(current.id);
+    current.adapter.teardown(current.api, current.id);
     if (reason) current.reject(reason);
   }, []);
   React10.useEffect(
-    () => () => removeActive(new Error("Turnstile challenge was cancelled")),
+    () => () => removeActive(new Error("Captcha challenge was cancelled")),
     [removeActive]
   );
   const tokenFor = React10.useCallback(
     async (action) => {
-      if (!siteKey) return null;
+      if (!captcha) return null;
+      if (!providerSupported) throw new Error(`Unsupported captcha provider: ${captcha.provider}`);
       setStatus("checking");
-      removeActive(new Error("Turnstile challenge was replaced"));
+      removeActive(new Error("Captcha challenge was replaced"));
       try {
-        const api = await loadTurnstile();
-        if (!container.current) throw new Error("Turnstile container unavailable");
+        const [{ loadCaptcha: loadCaptcha2 }, { captchaAdapterFor: captchaAdapterFor2 }] = await Promise.all([
+          Promise.resolve().then(() => (init_captcha_loader(), captcha_loader_exports)),
+          Promise.resolve().then(() => (init_captcha_providers(), captcha_providers_exports))
+        ]);
+        const adapter = captchaAdapterFor2(captcha.provider);
+        if (!adapter) throw new Error(`Unsupported captcha provider: ${captcha.provider}`);
+        const api = await loadCaptcha2(adapter);
+        if (!container.current) throw new Error("Captcha container unavailable");
         return await new Promise((resolve, reject) => {
           let settled = false;
           const finish = (outcome) => {
@@ -3587,27 +3727,29 @@ function useAuthChallenge() {
             settled = true;
             const current = active.current;
             active.current = null;
-            if (current) current.api.remove(current.id);
+            if (current) current.adapter.teardown(current.api, current.id);
             if ("token" in outcome) resolve(outcome.token);
             else reject(outcome.error);
           };
-          const fail = () => finish({ error: new Error("Turnstile challenge failed") });
+          const fail = () => finish({ error: new Error("Captcha challenge failed") });
           const root = container.current.closest(".authowl-root");
+          const optionalFailureCallbacks = captcha.provider === "turnstile" ? {
+            "timeout-callback": fail,
+            "unsupported-callback": fail
+          } : {};
           const id = api.render(container.current, {
-            sitekey: siteKey,
-            theme: turnstileTheme(root, config?.branding?.theme),
-            action,
-            execution: "execute",
-            appearance: "interaction-only",
-            size: "flexible",
-            language: root?.dataset.authowlLocale ?? config?.locale,
+            ...adapter.invisibleRenderOptions({
+              siteKey: captcha.siteKey,
+              theme: captchaTheme(root, config?.branding?.theme),
+              action,
+              language: root?.dataset.authowlLocale ?? config?.locale
+            }),
             callback: (token) => finish({ token }),
             "expired-callback": fail,
             "error-callback": fail,
-            "timeout-callback": fail,
-            "unsupported-callback": fail
+            ...optionalFailureCallbacks
           });
-          active.current = { api, id, reject };
+          active.current = { adapter, api, id, reject };
           try {
             api.execute(id);
           } catch {
@@ -3618,7 +3760,7 @@ function useAuthChallenge() {
         setStatus("idle");
       }
     },
-    [config?.branding?.theme, config?.locale, removeActive, siteKey]
+    [captcha, config?.branding?.theme, config?.locale, providerSupported, removeActive]
   );
   const run = React10.useCallback(
     async (action, request) => {
@@ -3630,27 +3772,30 @@ function useAuthChallenge() {
       }
       try {
         const token = await tokenFor(action);
-        return await request(token ? { authChallengeToken: token } : void 0);
+        const result = await request(token ? { authChallengeToken: token } : void 0);
+        if (result?.error?.code === challengeError.code) refetchIfConfigMayBeStale();
+        return result;
       } catch {
         setStatus("failed");
+        refetchIfConfigMayBeStale();
         return {
           data: null,
           error: challengeError
         };
       }
     },
-    [isLoading, tokenFor]
+    [isLoading, refetchIfConfigMayBeStale, tokenFor]
   );
-  const control = siteKey ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("div", { className: "ba-auth-challenge", "data-testid": "auth-challenge", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("div", { className: "ba-turnstile", ref: container }),
-    /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("p", { className: "ba-sr-only", role: "status", "aria-live": "polite", children: status === "checking" ? t("authChallenge.checking") : status === "failed" ? t("authChallenge.error.failed") : "" })
+  const control = captcha ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { className: "ba-auth-challenge", "data-testid": "auth-challenge", children: [
+    providerSupported ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "ba-turnstile", ref: container }) : null,
+    unavailableProvider ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(FormError, { "data-testid": "auth-challenge-unsupported", children: t("authChallenge.error.unsupportedProvider", { provider: unavailableProvider }) }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { className: "ba-sr-only", role: "status", "aria-live": "polite", children: status === "checking" ? t("authChallenge.checking") : status === "failed" ? t("authChallenge.error.failed") : "" })
   ] }) : null;
   return { run, control, configPending: isLoading };
 }
 
 // src/components/ForgotPassword.tsx
 init_FormError();
-var import_jsx_runtime12 = require("react/jsx-runtime");
+var import_jsx_runtime11 = require("react/jsx-runtime");
 function ForgotPassword({ resetPasswordUrl, onBack }) {
   const t = useT();
   const { requestPasswordReset } = usePasswordReset();
@@ -3659,12 +3804,12 @@ function ForgotPassword({ resetPasswordUrl, onBack }) {
   const [email, setEmail] = React11.useState("");
   const [sent, setSent] = React11.useState(false);
   if (sent) {
-    return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { className: "ba-fields", "data-testid": "forgot-sent", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { className: "ba-muted", children: richMessage(t("forgotPassword.sent"), { email: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Bidi, { children: email }) }) }),
-      onBack && /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("button", { type: "button", className: "ba-link-button", onClick: onBack, children: t("forgotPassword.backToSignIn") })
+    return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("div", { className: "ba-fields", "data-testid": "forgot-sent", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("p", { className: "ba-muted", children: richMessage(t("forgotPassword.sent"), { email: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Bidi, { children: email }) }) }),
+      onBack && /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("button", { type: "button", className: "ba-link-button", onClick: onBack, children: t("forgotPassword.backToSignIn") })
     ] });
   }
-  return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
+  return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(
     "form",
     {
       method: "post",
@@ -3678,9 +3823,9 @@ function ForgotPassword({ resetPasswordUrl, onBack }) {
         });
       },
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("label", { className: "ba-label", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("label", { className: "ba-label", children: [
           t("common.emailLabel"),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
             "input",
             {
               className: "ba-input",
@@ -3693,18 +3838,18 @@ function ForgotPassword({ resetPasswordUrl, onBack }) {
           )
         ] }),
         authChallenge.control,
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(FormError, { children: error }),
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(FormError, { children: error }),
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
           "button",
           {
             className: "ba-button",
             type: "submit",
             disabled: pending || authChallenge.configPending,
             "aria-busy": pending || void 0,
-            children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Busy, { busy: pending, label: t("common.sending"), children: t("forgotPassword.submit") })
+            children: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Busy, { busy: pending, label: t("common.sending"), children: t("forgotPassword.submit") })
           }
         ),
-        onBack && /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("button", { type: "button", className: "ba-link-button", onClick: onBack, children: t("forgotPassword.backToSignIn") })
+        onBack && /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("button", { type: "button", className: "ba-link-button", onClick: onBack, children: t("forgotPassword.backToSignIn") })
       ]
     }
   );
@@ -3714,7 +3859,7 @@ function ForgotPassword({ resetPasswordUrl, onBack }) {
 init_i18n();
 init_Spinner();
 init_FormError();
-var import_jsx_runtime13 = require("react/jsx-runtime");
+var import_jsx_runtime12 = require("react/jsx-runtime");
 function OtpCodeForm({
   email,
   code,
@@ -3725,7 +3870,7 @@ function OtpCodeForm({
   error
 }) {
   const t = useT();
-  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(
+  return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
     "form",
     {
       method: "post",
@@ -3736,9 +3881,9 @@ function OtpCodeForm({
         onSubmit();
       },
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("label", { className: "ba-label", children: [
-          richMessage(t("emailOtp.codeLabel"), { email: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Bidi, { children: email }) }),
-          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("label", { className: "ba-label", children: [
+          richMessage(t("emailOtp.codeLabel"), { email: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Bidi, { children: email }) }),
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
             "input",
             {
               className: "ba-input",
@@ -3751,9 +3896,9 @@ function OtpCodeForm({
             }
           )
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(FormError, { children: error }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("button", { className: "ba-button", type: "submit", disabled: pending, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Busy, { busy: pending, label: t("common.verifying"), children: t("emailOtp.verifySubmit") }) }),
-        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("button", { type: "button", className: "ba-link-button", onClick: onChangeEmail, children: t("emailOtp.changeEmail") })
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(FormError, { children: error }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("button", { className: "ba-button", type: "submit", disabled: pending, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Busy, { busy: pending, label: t("common.verifying"), children: t("emailOtp.verifySubmit") }) }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("button", { type: "button", className: "ba-link-button", onClick: onChangeEmail, children: t("emailOtp.changeEmail") })
       ]
     }
   );
@@ -3766,7 +3911,7 @@ init_i18n();
 init_use_submit_action();
 init_Spinner();
 init_FormError();
-var import_jsx_runtime14 = require("react/jsx-runtime");
+var import_jsx_runtime13 = require("react/jsx-runtime");
 function MFAChallenge({ onVerified, allowTrustDevice = true }) {
   const t = useT();
   const { verifyTotp, verifyBackupCode, sendOtp, verifyOtp } = useMFA();
@@ -3796,12 +3941,12 @@ function MFAChallenge({ onVerified, allowTrustDevice = true }) {
   };
   const hint = mode === "totp" ? t("mfa.challenge.totpHint") : mode === "backup" ? t("mfa.challenge.backupHint") : t("mfa.challenge.otpHint");
   const label2 = mode === "totp" ? t("mfa.challenge.totpLabel") : mode === "backup" ? t("mfa.challenge.backupLabel") : t("mfa.challenge.otpLabel");
-  return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("form", { method: "post", className: "ba-fields", "data-testid": "mfa-challenge", onSubmit: submit, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("h2", { className: "ba-title", children: t("mfa.challenge.title") }),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { className: "ba-muted", children: hint }),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("label", { className: "ba-label", children: [
+  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("form", { method: "post", className: "ba-fields", "data-testid": "mfa-challenge", onSubmit: submit, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("h2", { className: "ba-title", children: t("mfa.challenge.title") }),
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("p", { className: "ba-muted", children: hint }),
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("label", { className: "ba-label", children: [
       label2,
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
         "input",
         {
           className: "ba-input",
@@ -3817,18 +3962,18 @@ function MFAChallenge({ onVerified, allowTrustDevice = true }) {
         }
       )
     ] }),
-    mode !== "backup" && allowTrustDevice && /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("label", { className: "ba-consent ba-consent-centered", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("span", { className: "ba-checkbox-control", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("input", { className: "ba-checkbox", type: "checkbox", checked: trustDevice, onChange: (e) => setTrustDevice(e.target.checked) }),
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: "ba-checkbox-visual", "aria-hidden": "true", children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: "ba-checkbox-check" }) })
+    mode !== "backup" && allowTrustDevice && /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("label", { className: "ba-consent ba-consent-centered", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("span", { className: "ba-checkbox-control", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("input", { className: "ba-checkbox", type: "checkbox", checked: trustDevice, onChange: (e) => setTrustDevice(e.target.checked) }),
+        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: "ba-checkbox-visual", "aria-hidden": "true", children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: "ba-checkbox-check" }) })
       ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { children: t("mfa.challenge.trustDevice", { days: 30 }) })
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { children: t("mfa.challenge.trustDevice", { days: 30 }) })
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(FormError, { children: error }),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("button", { className: "ba-button", type: "submit", disabled: pending || !code, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Busy, { busy: pending, label: t("common.verifying"), children: t("mfa.challenge.submit") }) }),
-    mode !== "totp" && /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("button", { type: "button", className: "ba-link-button", onClick: () => switchMode("totp"), children: t("mfa.challenge.useTotp") }),
-    mode !== "backup" && /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("button", { type: "button", className: "ba-link-button", onClick: () => switchMode("backup"), children: t("mfa.challenge.useBackup") }),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("button", { type: "button", className: "ba-link-button", disabled: pending, onClick: requestOtp, children: t(mode === "otp" ? "mfa.challenge.resendOtp" : "mfa.challenge.useEmailOtp") })
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(FormError, { children: error }),
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("button", { className: "ba-button", type: "submit", disabled: pending || !code, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Busy, { busy: pending, label: t("common.verifying"), children: t("mfa.challenge.submit") }) }),
+    mode !== "totp" && /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("button", { type: "button", className: "ba-link-button", onClick: () => switchMode("totp"), children: t("mfa.challenge.useTotp") }),
+    mode !== "backup" && /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("button", { type: "button", className: "ba-link-button", onClick: () => switchMode("backup"), children: t("mfa.challenge.useBackup") }),
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("button", { type: "button", className: "ba-link-button", disabled: pending, onClick: requestOtp, children: t(mode === "otp" ? "mfa.challenge.resendOtp" : "mfa.challenge.useEmailOtp") })
   ] });
 }
 
@@ -3853,7 +3998,7 @@ function shouldDiscardSetup(args) {
 // src/components/QrCode.tsx
 var React13 = __toESM(require("react"), 1);
 init_i18n();
-var import_jsx_runtime15 = require("react/jsx-runtime");
+var import_jsx_runtime14 = require("react/jsx-runtime");
 function QrCode({ value, size = 200 }) {
   const t = useT();
   const [path, setPath] = React13.useState(null);
@@ -3875,7 +4020,7 @@ function QrCode({ value, size = 200 }) {
   if (!path) return null;
   const margin = 4;
   const dim = path.count + margin * 2;
-  return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(
+  return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(
     "svg",
     {
       width: size,
@@ -3886,8 +4031,8 @@ function QrCode({ value, size = 200 }) {
       shapeRendering: "crispEdges",
       className: "ba-qr",
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("rect", { width: dim, height: dim, fill: "#ffffff" }),
-        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("g", { transform: `translate(${margin} ${margin})`, children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("path", { d: path.d, fill: "#000000" }) })
+        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("rect", { width: dim, height: dim, fill: "#ffffff" }),
+        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("g", { transform: `translate(${margin} ${margin})`, children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("path", { d: path.d, fill: "#000000" }) })
       ]
     }
   );
@@ -3895,7 +4040,7 @@ function QrCode({ value, size = 200 }) {
 
 // src/components/MFAEnrollment.tsx
 init_FormError();
-var import_jsx_runtime16 = require("react/jsx-runtime");
+var import_jsx_runtime15 = require("react/jsx-runtime");
 function secretFromUri(uri) {
   try {
     return new URL(uri).searchParams.get("secret");
@@ -3929,22 +4074,22 @@ function MFAEnrollment({ onEnrolled, title }) {
     }
   }, [stale]);
   if (done) {
-    return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { className: "ba-fields", "data-testid": "mfa-enroll-done", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("h2", { className: "ba-title", children: t("mfa.enroll.doneTitle") }),
-      /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.doneBody") })
+    return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "ba-fields", "data-testid": "mfa-enroll-done", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("h2", { className: "ba-title", children: t("mfa.enroll.doneTitle") }),
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.doneBody") })
     ] });
   }
   if (!activeSetup) {
     if (!isLoaded) {
-      return /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("div", { className: "ba-fields", "data-testid": "mfa-enroll-loading", "aria-busy": "true", children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("div", { className: "ba-skeleton" }) });
+      return /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("div", { className: "ba-fields", "data-testid": "mfa-enroll-loading", "aria-busy": "true", children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("div", { className: "ba-skeleton" }) });
     }
     if (user?.twoFactorEnabled) {
-      return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { className: "ba-fields", "data-testid": "mfa-enroll-active", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("h2", { className: "ba-title", children: t("mfa.enroll.activeTitle") }),
-        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.activeBody") })
+      return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "ba-fields", "data-testid": "mfa-enroll-active", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("h2", { className: "ba-title", children: t("mfa.enroll.activeTitle") }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.activeBody") })
       ] });
     }
-    return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(
+    return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(
       "form",
       {
         method: "post",
@@ -3961,11 +4106,11 @@ function MFAEnrollment({ onEnrolled, title }) {
           });
         },
         children: [
-          title !== null && /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("h2", { className: "ba-title", children: title ?? t("mfa.enroll.title") }),
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.passwordHint") }),
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("label", { className: "ba-label", children: [
+          title !== null && /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("h2", { className: "ba-title", children: title ?? t("mfa.enroll.title") }),
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.passwordHint") }),
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("label", { className: "ba-label", children: [
             t("common.passwordLabel"),
-            /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
+            /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
               "input",
               {
                 className: "ba-input",
@@ -3977,29 +4122,29 @@ function MFAEnrollment({ onEnrolled, title }) {
               }
             )
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(FormError, { children: error }),
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("button", { className: "ba-button", type: "submit", disabled: pending || !password, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Busy, { busy: pending, label: t("mfa.enroll.startPending"), children: t("common.continue") }) })
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(FormError, { children: error }),
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("button", { className: "ba-button", type: "submit", disabled: pending || !password, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Busy, { busy: pending, label: t("mfa.enroll.startPending"), children: t("common.continue") }) })
         ]
       }
     );
   }
   const secret = secretFromUri(activeSetup.totpURI);
-  return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { className: "ba-fields", "data-testid": "mfa-enroll-verify", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("h2", { className: "ba-title", children: t("mfa.enroll.scanQrTitle") }),
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.scanQrHint") }),
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(QrCode, { value: activeSetup.totpURI }),
-    secret && /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { className: "ba-muted", children: richMessage(t("mfa.enroll.manualKey"), {
-      secret: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("code", { className: "ba-code", children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Bidi, { children: secret }) })
+  return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "ba-fields", "data-testid": "mfa-enroll-verify", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("h2", { className: "ba-title", children: t("mfa.enroll.scanQrTitle") }),
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { className: "ba-muted", children: t("mfa.enroll.scanQrHint") }),
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(QrCode, { value: activeSetup.totpURI }),
+    secret && /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { className: "ba-muted", children: richMessage(t("mfa.enroll.manualKey"), {
+      secret: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("code", { className: "ba-code", children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Bidi, { children: secret }) })
     }) }),
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("p", { className: "ba-muted", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("strong", { children: t("mfa.enroll.backupCodesWarningStrong") }),
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("p", { className: "ba-muted", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("strong", { children: t("mfa.enroll.backupCodesWarningStrong") }),
         " ",
         t("mfa.enroll.backupCodesWarningRest")
       ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("ul", { className: "ba-backup-codes", "data-testid": "mfa-backup-codes", children: activeSetup.backupCodes.map((c) => /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("li", { children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("code", { className: "ba-code", children: c }) }, c)) })
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("ul", { className: "ba-backup-codes", "data-testid": "mfa-backup-codes", children: activeSetup.backupCodes.map((c) => /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("li", { children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("code", { className: "ba-code", children: c }) }, c)) })
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(
       "form",
       {
         method: "post",
@@ -4017,9 +4162,9 @@ function MFAEnrollment({ onEnrolled, title }) {
           });
         },
         children: [
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("label", { className: "ba-label", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("label", { className: "ba-label", children: [
             t("mfa.enroll.codeLabel"),
-            /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
+            /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
               "input",
               {
                 className: "ba-input",
@@ -4031,8 +4176,8 @@ function MFAEnrollment({ onEnrolled, title }) {
               }
             )
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(FormError, { children: error }),
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("button", { className: "ba-button", type: "submit", disabled: pending || !code, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Busy, { busy: pending, label: t("common.verifying"), children: t("mfa.enroll.activateSubmit") }) })
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(FormError, { children: error }),
+          /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("button", { className: "ba-button", type: "submit", disabled: pending || !code, "aria-busy": pending || void 0, children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(Busy, { busy: pending, label: t("common.verifying"), children: t("mfa.enroll.activateSubmit") }) })
         ]
       }
     )
@@ -4040,7 +4185,7 @@ function MFAEnrollment({ onEnrolled, title }) {
 }
 
 // src/components/mfa-enrollment-step.tsx
-var import_jsx_runtime17 = require("react/jsx-runtime");
+var import_jsx_runtime16 = require("react/jsx-runtime");
 function useConfirmedMfaPending(onUnknown = "pending") {
   const client = useAuthClient();
   const { needsMfaEnrollment } = useUser();
@@ -4070,32 +4215,32 @@ function useConfirmedMfaPending(onUnknown = "pending") {
 function MfaEnrollmentStep({ title }) {
   const t = useT();
   const { refetch } = useSession();
-  return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_jsx_runtime17.Fragment, { children: [
-    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("h2", { className: "ba-title", children: title ?? t("mfaGate.title") }),
-    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("p", { className: "ba-muted", children: t("mfaGate.body") }),
-    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(MFAEnrollment, { onEnrolled: () => refetch({ query: { disableCookieCache: true } }) })
+  return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_jsx_runtime16.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("h2", { className: "ba-title", children: title ?? t("mfaGate.title") }),
+    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { className: "ba-muted", children: t("mfaGate.body") }),
+    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(MFAEnrollment, { onEnrolled: () => refetch({ query: { disableCookieCache: true } }) })
   ] });
 }
 
 // src/components/AuthOwlBadge.tsx
 init_hooks();
 init_i18n();
-var import_jsx_runtime18 = require("react/jsx-runtime");
+var import_jsx_runtime17 = require("react/jsx-runtime");
 function OwlMark() {
-  return /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)("svg", { className: "ba-badge-mark", viewBox: "0 0 24 24", "aria-hidden": "true", focusable: "false", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("circle", { cx: "12", cy: "12", r: "11", fill: "#F5B84C" }),
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("circle", { cx: "8.4", cy: "10", r: "3", fill: "#fff" }),
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("circle", { cx: "15.6", cy: "10", r: "3", fill: "#fff" }),
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("circle", { cx: "8.4", cy: "10", r: "1.4", fill: "#1f1300" }),
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("circle", { cx: "15.6", cy: "10", r: "1.4", fill: "#1f1300" }),
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("path", { d: "M12 13.1l1.5 2.1h-3z", fill: "#1f1300" })
+  return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("svg", { className: "ba-badge-mark", viewBox: "0 0 24 24", "aria-hidden": "true", focusable: "false", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("circle", { cx: "12", cy: "12", r: "11", fill: "#F5B84C" }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("circle", { cx: "8.4", cy: "10", r: "3", fill: "#fff" }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("circle", { cx: "15.6", cy: "10", r: "3", fill: "#fff" }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("circle", { cx: "8.4", cy: "10", r: "1.4", fill: "#1f1300" }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("circle", { cx: "15.6", cy: "10", r: "1.4", fill: "#1f1300" }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("path", { d: "M12 13.1l1.5 2.1h-3z", fill: "#1f1300" })
   ] });
 }
 function AuthOwlBadge({ href = "https://authowl.dev", force } = {}) {
   const t = useT();
   const { config } = usePublicConfig();
   if (!force && !config?.badge) return null;
-  return /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(
+  return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(
     "a",
     {
       className: "ba-badge",
@@ -4104,9 +4249,9 @@ function AuthOwlBadge({ href = "https://authowl.dev", force } = {}) {
       rel: "noopener noreferrer",
       "data-testid": "authowl-badge",
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(OwlMark, {}),
-        /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("span", { children: richMessage(t("badge.securedBy"), {
-          brand: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("span", { className: "ba-badge-brand", children: "AuthOwl" })
+        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(OwlMark, {}),
+        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("span", { children: richMessage(t("badge.securedBy"), {
+          brand: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("span", { className: "ba-badge-brand", children: "AuthOwl" })
         }) })
       ]
     }
@@ -4117,8 +4262,8 @@ function AuthOwlBadge({ href = "https://authowl.dev", force } = {}) {
 init_Spinner();
 
 // src/components/PhoneOTP.tsx
-var React16 = __toESM(require("react"), 1);
-var import_core4 = require("@authowl/core");
+var React17 = __toESM(require("react"), 1);
+var import_core5 = require("@authowl/core");
 init_hooks();
 init_i18n();
 
@@ -4127,19 +4272,19 @@ init_i18n();
 
 // src/components/ConsentDocLinks.tsx
 init_i18n();
-var import_jsx_runtime19 = require("react/jsx-runtime");
+var import_jsx_runtime18 = require("react/jsx-runtime");
 function ConsentDocLinks({ termsUrl, privacyUrl }) {
   const t = useT();
   if (!termsUrl && !privacyUrl) return null;
-  return /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)(import_jsx_runtime19.Fragment, { children: [
-    termsUrl && /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("a", { href: termsUrl, target: "_blank", rel: "noopener noreferrer", children: t("consent.termsOfService") }),
+  return /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(import_jsx_runtime18.Fragment, { children: [
+    termsUrl && /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("a", { href: termsUrl, target: "_blank", rel: "noopener noreferrer", children: t("consent.termsOfService") }),
     termsUrl && privacyUrl && t("consent.docJoiner"),
-    privacyUrl && /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("a", { href: privacyUrl, target: "_blank", rel: "noopener noreferrer", children: t("consent.privacyPolicy") })
+    privacyUrl && /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("a", { href: privacyUrl, target: "_blank", rel: "noopener noreferrer", children: t("consent.privacyPolicy") })
   ] });
 }
 
 // src/components/LegalConsentCheckbox.tsx
-var import_jsx_runtime20 = require("react/jsx-runtime");
+var import_jsx_runtime19 = require("react/jsx-runtime");
 function LegalConsentCheckbox({
   legal,
   accepted,
@@ -4148,9 +4293,9 @@ function LegalConsentCheckbox({
 }) {
   const t = useT();
   if (!legal.required) return null;
-  return /* @__PURE__ */ (0, import_jsx_runtime20.jsxs)("label", { className: "ba-consent", "data-testid": testId, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime20.jsxs)("span", { className: "ba-checkbox-control", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime20.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)("label", { className: "ba-consent", "data-testid": testId, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)("span", { className: "ba-checkbox-control", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(
         "input",
         {
           className: "ba-checkbox",
@@ -4159,14 +4304,69 @@ function LegalConsentCheckbox({
           onChange: (event) => onAcceptedChange(event.target.checked)
         }
       ),
-      /* @__PURE__ */ (0, import_jsx_runtime20.jsx)("span", { className: "ba-checkbox-visual", "aria-hidden": "true", children: /* @__PURE__ */ (0, import_jsx_runtime20.jsx)("span", { className: "ba-checkbox-check" }) })
+      /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { className: "ba-checkbox-visual", "aria-hidden": "true", children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { className: "ba-checkbox-check" }) })
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime20.jsx)("span", { children: richMessage(t("signUp.consentLabel"), {
-      links: /* @__PURE__ */ (0, import_jsx_runtime20.jsx)(ConsentDocLinks, { termsUrl: legal.termsUrl, privacyUrl: legal.privacyUrl })
+    /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { children: richMessage(t("signUp.consentLabel"), {
+      links: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(ConsentDocLinks, { termsUrl: legal.termsUrl, privacyUrl: legal.privacyUrl })
     }) })
   ] });
 }
 
+// src/components/Turnstile.tsx
+var React16 = __toESM(require("react"), 1);
+var import_jsx_runtime20 = require("react/jsx-runtime");
+var LOCAL_TURNSTILE_TEST_TOKEN = "XXXX.DUMMY.TOKEN.XXXX";
+async function loadTurnstile() {
+  const [{ loadCaptcha: loadCaptcha2 }, { CAPTCHA_ADAPTERS: CAPTCHA_ADAPTERS2 }] = await Promise.all([
+    Promise.resolve().then(() => (init_captcha_loader(), captcha_loader_exports)),
+    Promise.resolve().then(() => (init_captcha_providers(), captcha_providers_exports))
+  ]);
+  const adapter = CAPTCHA_ADAPTERS2.turnstile;
+  return { api: await loadCaptcha2(adapter), adapter };
+}
+function Turnstile({
+  siteKey,
+  theme,
+  onToken,
+  onUnavailable
+}) {
+  const container = React16.useRef(null);
+  const callbacks = React16.useRef({ onToken, onUnavailable });
+  callbacks.current = { onToken, onUnavailable };
+  React16.useEffect(() => {
+    callbacks.current.onToken(null);
+    if (!siteKey) {
+      callbacks.current.onToken(LOCAL_TURNSTILE_TEST_TOKEN);
+      return;
+    }
+    let active = true;
+    let widget = null;
+    void loadTurnstile().then(({ api, adapter }) => {
+      if (!active || !container.current) return;
+      const id = api.render(container.current, {
+        sitekey: siteKey,
+        theme: theme === "system" ? "auto" : theme,
+        size: "flexible",
+        callback: (token) => callbacks.current.onToken(token),
+        "expired-callback": () => callbacks.current.onToken(null),
+        "error-callback": () => {
+          callbacks.current.onToken(null);
+          callbacks.current.onUnavailable();
+        }
+      });
+      widget = { api, adapter, id };
+    }).catch(() => {
+      if (active) callbacks.current.onUnavailable();
+    });
+    return () => {
+      active = false;
+      if (widget) widget.adapter.teardown(widget.api, widget.id);
+    };
+  }, [siteKey, theme]);
+  if (!siteKey) return null;
+  return /* @__PURE__ */ (0, import_jsx_runtime20.jsx)("div", { className: "ba-turnstile", ref: container, "data-testid": "phoneotp-turnstile" });
+}
+
 // src/components/PhoneOTP.tsx
 init_use_submit_action();
 init_Spinner();
@@ -4183,20 +4383,20 @@ function PhoneOTP({
   const { config, isLoading } = usePublicConfig();
   const { preparePhoneOtp, startPhoneOtp, verifyPhoneOtp } = useSignIn();
   const { pending, error, setError, run } = useSubmitAction();
-  const [stage, setStage] = React16.useState("phone");
-  const [phoneNumber, setPhoneNumber] = React16.useState("");
-  const [code, setCode] = React16.useState("");
-  const [turnstileToken, setTurnstileToken] = React16.useState(null);
-  const [guardState, setGuardState] = React16.useState({ status: "loading" });
-  const [accepted, setAccepted] = React16.useState(false);
-  const attempt = React16.useRef(null);
-  const guardRequest = React16.useRef(0);
+  const [stage, setStage] = React17.useState("phone");
+  const [phoneNumber, setPhoneNumber] = React17.useState("");
+  const [code, setCode] = React17.useState("");
+  const [turnstileToken, setTurnstileToken] = React17.useState(null);
+  const [guardState, setGuardState] = React17.useState({ status: "loading" });
+  const [accepted, setAccepted] = React17.useState(false);
+  const attempt = React17.useRef(null);
+  const guardRequest = React17.useRef(0);
   const legal = config?.legal;
   const consentBlocked = Boolean(legal?.required && !accepted);
   const guard = guardState.status === "ready" ? guardState.data : null;
   const turnstileBlocked = guardState.status === "ready" && guardState.data.kind === "authowl_turnstile" && !turnstileToken;
   const humanCheckError = t("phoneOtp.error.humanCheck");
-  const loadGuard = React16.useCallback(async () => {
+  const loadGuard = React17.useCallback(async () => {
     const request = ++guardRequest.current;
     setGuardState({ status: "loading" });
     setError(null);
@@ -4215,7 +4415,7 @@ function PhoneOTP({
       setError(humanCheckError);
     }
   }, [humanCheckError, preparePhoneOtp, setError]);
-  React16.useEffect(() => {
+  React17.useEffect(() => {
     void loadGuard();
     return () => {
       guardRequest.current += 1;
@@ -4324,7 +4524,7 @@ function PhoneOTP({
           return;
         }
         if (!attempt.current || attempt.current.phoneNumber !== phoneNumber) {
-          attempt.current = { phoneNumber, idempotencyKey: (0, import_core4.createIdempotencyKey)() };
+          attempt.current = { phoneNumber, idempotencyKey: (0, import_core5.createIdempotencyKey)() };
         }
         const idempotencyKey = attempt.current.idempotencyKey;
         void run(
@@ -4337,7 +4537,7 @@ function PhoneOTP({
             const current = selected?.data ?? guard;
             if (selected?.data) setGuardState({ status: "ready", data: selected.data });
             if (current?.kind === "akedly_shield_v1_2") {
-              const akedlyShield = await (0, import_core4.solvePhoneOtpChallenge)(current);
+              const akedlyShield = await (0, import_core5.solvePhoneOtpChallenge)(current);
               return startPhoneOtp({ phoneNumber, akedlyShield, idempotencyKey });
             }
             if (current?.kind === "authowl_turnstile" && turnstileToken) {
@@ -4422,7 +4622,7 @@ function PhoneOTP({
 init_FormError();
 
 // src/components/AuthOwlBranding.tsx
-var React17 = __toESM(require("react"), 1);
+var React18 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 var import_jsx_runtime22 = require("react/jsx-runtime");
@@ -4433,8 +4633,8 @@ function AuthOwlBranding({ href, showEnvironment = true } = {}) {
   const appName = config?.branding?.appName?.trim() ?? "";
   const showAppName = config?.branding?.showAppName !== false && appName.length > 0;
   const alignment = config?.branding?.alignment ?? "left";
-  const [logoFailed, setLogoFailed] = React17.useState(false);
-  React17.useEffect(() => setLogoFailed(false), [logoUrl]);
+  const [logoFailed, setLogoFailed] = React18.useState(false);
+  React18.useEffect(() => setLogoFailed(false), [logoUrl]);
   if (!config) return null;
   if (!logoUrl && !showAppName && (!showEnvironment || !config.environmentType)) return null;
   const identity = /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)("div", { className: "ba-branding-identity", children: [
@@ -4474,15 +4674,15 @@ function AuthOwlBranding({ href, showEnvironment = true } = {}) {
 }
 
 // src/components/InvitationBanner.tsx
-var React18 = __toESM(require("react"), 1);
-var import_core5 = require("@authowl/core");
+var React19 = __toESM(require("react"), 1);
+var import_core6 = require("@authowl/core");
 init_i18n();
 var import_jsx_runtime23 = require("react/jsx-runtime");
 function InvitationBanner() {
   const t = useT();
-  const [pending, setPending] = React18.useState(false);
-  React18.useEffect(() => {
-    setPending((0, import_core5.readInvitationClaim)() !== null);
+  const [pending, setPending] = React19.useState(false);
+  React19.useEffect(() => {
+    setPending((0, import_core6.readInvitationClaim)() !== null);
   }, []);
   if (!pending) return null;
   return /* @__PURE__ */ (0, import_jsx_runtime23.jsx)("p", { className: "ba-muted", "data-testid": "authowl-invitation-banner", children: t("organization.invitationBanner") });
@@ -4529,18 +4729,27 @@ function SignIn({
   const { config, isLoading, isError } = usePublicConfig();
   const { pending, error, setError, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React19.useState("");
-  const [username, setUsername] = React19.useState("");
-  const [password, setPassword] = React19.useState("");
-  const [credentialMode, setCredentialMode] = React19.useState("email");
-  const [otp, setOtp] = React19.useState("");
-  const [view, setView] = React19.useState(
+  const [email, setEmail] = React20.useState("");
+  const [username, setUsername] = React20.useState("");
+  const [password, setPassword] = React20.useState("");
+  const [credentialMode, setCredentialMode] = React20.useState("email");
+  const [otp, setOtp] = React20.useState("");
+  const [view, setView] = React20.useState(
     "sign-in"
   );
-  const [inFlight, setInFlight] = React19.useState(null);
-  const [challenge, setChallenge] = React19.useState(false);
+  const [inFlight, setInFlight] = React20.useState(null);
+  const [challenge, setChallenge] = React20.useState(false);
   const mfaEnrolment = useConfirmedMfaPending("clear");
-  const emailRef = React19.useRef(null);
+  const emailRef = React20.useRef(null);
+  const recordSignInMethod = useSignInMethodRecorder();
+  const onPasskeySignedIn = React20.useCallback(() => {
+    recordSignInMethod("passkey");
+    onSignedIn?.();
+  }, [onSignedIn, recordSignInMethod]);
+  const onPhoneOtpSignedIn = React20.useCallback(() => {
+    recordSignInMethod("phone-otp");
+    onSignedIn?.();
+  }, [onSignedIn, recordSignInMethod]);
   const plan = resolveSignInMethods(
     config,
     typeof window === "undefined" ? void 0 : window.location.hostname
@@ -4548,7 +4757,7 @@ function SignIn({
   usePasskeyAutofill({
     enabled: credentialMode === "email" && plan.autofillHost !== null,
     redirectTo,
-    onSignedIn
+    onSignedIn: onPasskeySignedIn
   });
   const badge = /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(AuthOwlBadge, { force: showBadge });
   const branding = showBranding ? /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(AuthOwlBranding, {}) : null;
@@ -4600,7 +4809,10 @@ function SignIn({
           error,
           onSubmit: () => void run(() => signInEmailOtp({ email, otp }), {
             failure: t("emailOtp.error.invalidCode"),
-            onSuccess: () => finishSignIn({ sessionStore, redirectTo, onSignedIn })
+            onSuccess: () => {
+              recordSignInMethod("email-otp");
+              finishSignIn({ sessionStore, redirectTo, onSignedIn });
+            }
           }),
           onChangeEmail: () => {
             setOtp("");
@@ -4628,7 +4840,7 @@ function SignIn({
         PhoneOTP,
         {
           redirectTo,
-          onSignedIn,
+          onSignedIn: onPhoneOtpSignedIn,
           onBack: () => setView("sign-in"),
           onMfaPasswordRequired: () => {
             setView("sign-in");
@@ -4656,6 +4868,7 @@ function SignIn({
       failure: t("signIn.error.failed"),
       onSuccess: (res) => {
         const data = res.data;
+        recordSignInMethod(credentialMode === "username" ? "username" : "password");
         if (data && "twoFactorRedirect" in data && data.twoFactorRedirect) {
           setChallenge(true);
         } else {
@@ -4668,7 +4881,10 @@ function SignIn({
     "magic",
     () => void run(() => authChallenge.run(AUTH_CHALLENGE_ACTIONS.passwordless, (options) => signInMagicLink({ email, callbackURL: redirectTo }, options)), {
       failure: t("magicLink.error.sendFailed"),
-      onSuccess: () => setView("magic-sent")
+      onSuccess: () => {
+        recordSignInMethod("magic-link", true);
+        setView("magic-sent");
+      }
     })
   );
   const doRequestOtp = () => start(
@@ -4685,6 +4901,7 @@ function SignIn({
       {
         failure: t("sso.error.startFailed"),
         mapError: (error2) => error2.status === 404 ? t("sso.error.notFound") : null,
+        onSuccess: () => recordSignInMethod("sso", true),
         // SSO always redirects the browser to the IdP; keep the spinner up
         // through that navigation instead of flashing back to idle.
         keepPendingOnSuccess: true
@@ -4823,7 +5040,7 @@ function SignIn({
         ]
       }
     ),
-    plan.passkey && /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(PasskeyButton, { redirectTo, onSignedIn }),
+    plan.passkey && /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(PasskeyButton, { redirectTo, onSignedIn: onPasskeySignedIn }),
     plan.phoneOtp && /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(
       "button",
       {
@@ -4839,12 +5056,12 @@ function SignIn({
 }
 
 // src/components/SignUp.tsx
-var React23 = __toESM(require("react"), 1);
+var React24 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
 // src/components/VerificationPending.tsx
-var React20 = __toESM(require("react"), 1);
+var React21 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -4864,9 +5081,9 @@ function VerificationPending({
   } = useEmailVerification();
   const { pending, error, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [resent, setResent] = React20.useState(false);
-  const [code, setCode] = React20.useState("");
-  const [verified, setVerified] = React20.useState(false);
+  const [resent, setResent] = React21.useState(false);
+  const [code, setCode] = React21.useState("");
+  const [verified, setVerified] = React21.useState(false);
   if (verified) {
     return /* @__PURE__ */ (0, import_jsx_runtime26.jsx)("p", { className: "ba-success", role: "status", "data-testid": "verify-code-success", children: t("verifyEmail.success") });
   }
@@ -4969,7 +5186,7 @@ function VerificationPending({
 }
 
 // src/components/PasswordlessSignUp.tsx
-var React21 = __toESM(require("react"), 1);
+var React22 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -4981,9 +5198,9 @@ function PasswordlessSignUp({ onAuthenticated }) {
   const { sendEmailOtp, signInEmailOtp } = useSignIn();
   const { pending, error, setError, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React21.useState("");
-  const [code, setCode] = React21.useState("");
-  const [codeSent, setCodeSent] = React21.useState(false);
+  const [email, setEmail] = React22.useState("");
+  const [code, setCode] = React22.useState("");
+  const [codeSent, setCodeSent] = React22.useState(false);
   if (codeSent) {
     return /* @__PURE__ */ (0, import_jsx_runtime27.jsx)("div", { className: "ba-fields", "data-testid": "signup-emailotp-code", children: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(
       OtpCodeForm,
@@ -5088,7 +5305,7 @@ init_Spinner();
 init_FormError();
 
 // src/components/Waitlist.tsx
-var React22 = __toESM(require("react"), 1);
+var React23 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_FormError();
@@ -5100,8 +5317,8 @@ function Waitlist({ onJoined, showBadge, showBranding = true } = {}) {
   const { join } = useWaitlist();
   const { pending, error, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React22.useState("");
-  const [joined, setJoined] = React22.useState(false);
+  const [email, setEmail] = React23.useState("");
+  const [joined, setJoined] = React23.useState(false);
   if (joined) {
     return /* @__PURE__ */ (0, import_jsx_runtime29.jsxs)("div", { className: "ba-form", "data-testid": "waitlist-accepted", children: [
       showBranding ? /* @__PURE__ */ (0, import_jsx_runtime29.jsx)(AuthOwlBranding, {}) : null,
@@ -5185,24 +5402,24 @@ function SignUp({
   const { signUp } = useSignUp();
   const { config, isLoading, isError } = usePublicConfig();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React23.useState("");
-  const [password, setPassword] = React23.useState("");
-  const [name, setName] = React23.useState("");
-  const [firstName, setFirstName] = React23.useState("");
-  const [lastName, setLastName] = React23.useState("");
-  const [username, setUsername] = React23.useState("");
-  const [error, setError] = React23.useState(null);
-  const [submitting, setSubmitting] = React23.useState(false);
-  const [accepted, setAccepted] = React23.useState(false);
+  const [email, setEmail] = React24.useState("");
+  const [password, setPassword] = React24.useState("");
+  const [name, setName] = React24.useState("");
+  const [firstName, setFirstName] = React24.useState("");
+  const [lastName, setLastName] = React24.useState("");
+  const [username, setUsername] = React24.useState("");
+  const [error, setError] = React24.useState(null);
+  const [submitting, setSubmitting] = React24.useState(false);
+  const [accepted, setAccepted] = React24.useState(false);
   const legal = config?.legal;
   const consentRequired = Boolean(legal?.required);
   const consentBlocked = consentRequired && !accepted;
-  const capabilities = (0, import_core3.resolveProjectCapabilities)(config);
+  const capabilities = (0, import_core4.resolveProjectCapabilities)(config);
   const passwordMinLength = capabilities.passwordMinLength;
   const passwordMaxLength = capabilities.passwordMaxLength;
   const passkeysEnabled = capabilities.passkeyAdd;
-  const [pendingEmail, setPendingEmail] = React23.useState(null);
-  const [completeWithPasskey, setCompleteWithPasskey] = React23.useState(false);
+  const [pendingEmail, setPendingEmail] = React24.useState(null);
+  const [completeWithPasskey, setCompleteWithPasskey] = React24.useState(false);
   function finishSignUp() {
     onSignedUp?.();
     if (redirectTo) window.location.assign(redirectTo);
@@ -5489,7 +5706,7 @@ function MFARequiredGate({ children, title }) {
 }
 
 // src/components/BackupCodesManager.tsx
-var React24 = __toESM(require("react"), 1);
+var React25 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -5501,8 +5718,8 @@ function BackupCodesManager({ title }) {
   const { user } = useUser();
   const { regenerateBackupCodes } = useMFA();
   const { pending, error, run } = useSubmitAction();
-  const [password, setPassword] = React24.useState("");
-  const [codes, setCodes] = React24.useState(null);
+  const [password, setPassword] = React25.useState("");
+  const [codes, setCodes] = React25.useState(null);
   if (!user?.twoFactorEnabled) return null;
   const submit = (e) => {
     e.preventDefault();
@@ -5546,7 +5763,7 @@ function BackupCodesManager({ title }) {
 }
 
 // src/components/MagicLinkForm.tsx
-var React25 = __toESM(require("react"), 1);
+var React26 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -5558,8 +5775,8 @@ function MagicLinkForm({ callbackURL, webauthnAutofill }) {
   const { signInMagicLink } = useSignIn();
   const { pending, error, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React25.useState("");
-  const [sent, setSent] = React25.useState(false);
+  const [email, setEmail] = React26.useState("");
+  const [sent, setSent] = React26.useState(false);
   if (sent) {
     return /* @__PURE__ */ (0, import_jsx_runtime34.jsx)("p", { className: "ba-muted", "data-testid": "magiclink-sent", children: t("magicLink.sent") });
   }
@@ -5609,7 +5826,7 @@ function MagicLinkForm({ callbackURL, webauthnAutofill }) {
 }
 
 // src/components/EmailOtpForm.tsx
-var React26 = __toESM(require("react"), 1);
+var React27 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -5622,9 +5839,9 @@ function EmailOtpForm({ redirectTo, onSignedIn, webauthnAutofill }) {
   const { sendEmailOtp, signInEmailOtp } = useSignIn();
   const { pending, error, setError, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React26.useState("");
-  const [otp, setOtp] = React26.useState("");
-  const [stage, setStage] = React26.useState("email");
+  const [email, setEmail] = React27.useState("");
+  const [otp, setOtp] = React27.useState("");
+  const [stage, setStage] = React27.useState("email");
   if (stage === "code") {
     return /* @__PURE__ */ (0, import_jsx_runtime35.jsx)(
       OtpCodeForm,
@@ -5698,7 +5915,7 @@ function EmailOtpForm({ redirectTo, onSignedIn, webauthnAutofill }) {
 }
 
 // src/components/ResetPassword.tsx
-var React27 = __toESM(require("react"), 1);
+var React28 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -5709,15 +5926,15 @@ function ResetPassword({ token: tokenProp, redirectTo, onReset }) {
   const t = useT();
   const { resetPassword } = usePasswordReset();
   const { config } = usePublicConfig();
-  const capabilities = (0, import_core3.resolveProjectCapabilities)(config);
+  const capabilities = (0, import_core4.resolveProjectCapabilities)(config);
   const { passwordMinLength, passwordMaxLength } = capabilities;
   const { pending, error, setError, run } = useSubmitAction();
-  const [token, setToken] = React27.useState(tokenProp ?? null);
-  const [ready, setReady] = React27.useState(tokenProp != null);
-  const [password, setPassword] = React27.useState("");
-  const [confirm, setConfirm] = React27.useState("");
-  const [done, setDone] = React27.useState(false);
-  React27.useEffect(() => {
+  const [token, setToken] = React28.useState(tokenProp ?? null);
+  const [ready, setReady] = React28.useState(tokenProp != null);
+  const [password, setPassword] = React28.useState("");
+  const [confirm, setConfirm] = React28.useState("");
+  const [done, setDone] = React28.useState(false);
+  React28.useEffect(() => {
     if (tokenProp != null) return;
     const params = new URLSearchParams(window.location.search);
     setToken(params.get("token"));
@@ -5804,7 +6021,7 @@ function ResetPassword({ token: tokenProp, redirectTo, onReset }) {
 }
 
 // src/components/VerifyEmail.tsx
-var React28 = __toESM(require("react"), 1);
+var React29 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -5816,11 +6033,11 @@ function VerifyEmail({ redirectTo, onVerified, callbackURL }) {
   const { sendVerificationEmail } = useEmailVerification();
   const { pending, error, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [ready, setReady] = React28.useState(false);
-  const [failed, setFailed] = React28.useState(false);
-  const [email, setEmail] = React28.useState("");
-  const [resent, setResent] = React28.useState(false);
-  React28.useEffect(() => {
+  const [ready, setReady] = React29.useState(false);
+  const [failed, setFailed] = React29.useState(false);
+  const [email, setEmail] = React29.useState("");
+  const [resent, setResent] = React29.useState(false);
+  React29.useEffect(() => {
     const didFail = new URLSearchParams(window.location.search).has("error");
     setFailed(didFail);
     setReady(true);
@@ -5885,7 +6102,7 @@ function VerifyEmail({ redirectTo, onVerified, callbackURL }) {
 }
 
 // src/components/PasskeyManager.tsx
-var React29 = __toESM(require("react"), 1);
+var React30 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -5910,12 +6127,12 @@ function PasskeyManagerBody({
   const t = useT();
   const toServerError = useServerError();
   const api = usePasskeys();
-  const apiRef = React29.useRef(api);
+  const apiRef = React30.useRef(api);
   apiRef.current = api;
   const { pending, error, setError, run } = useSubmitAction();
-  const [passkeys, setPasskeys] = React29.useState(null);
-  const loadTokenRef = React29.useRef(0);
-  const load = React29.useCallback(async () => {
+  const [passkeys, setPasskeys] = React30.useState(null);
+  const loadTokenRef = React30.useRef(0);
+  const load = React30.useCallback(async () => {
     const token = ++loadTokenRef.current;
     try {
       const res = await apiRef.current.listPasskeys();
@@ -5931,7 +6148,7 @@ function PasskeyManagerBody({
       setError(t("passkeys.error.loadFailed"));
     }
   }, [setError, toServerError, t]);
-  React29.useEffect(() => {
+  React30.useEffect(() => {
     void load();
   }, [load]);
   function onRename(id, current) {
@@ -6002,7 +6219,7 @@ function PasskeyManagerBody({
 }
 
 // src/components/control.tsx
-var import_core6 = require("@authowl/core");
+var import_core7 = require("@authowl/core");
 init_hooks();
 init_i18n();
 init_Spinner();
@@ -6027,7 +6244,7 @@ function Protect({
   const membership = useSession().data?.session?.membership ?? null;
   if (!isLoaded) return null;
   if (!isSignedIn || !user) return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(import_jsx_runtime39.Fragment, { children: fallback });
-  if ((role !== void 0 || permission !== void 0 || teamId !== void 0) && !(0, import_core6.membershipHas)(membership, { role, permission, teamId })) {
+  if ((role !== void 0 || permission !== void 0 || teamId !== void 0) && !(0, import_core7.membershipHas)(membership, { role, permission, teamId })) {
     return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(import_jsx_runtime39.Fragment, { children: fallback });
   }
   if (condition && !condition(user)) return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(import_jsx_runtime39.Fragment, { children: fallback });
@@ -6051,7 +6268,7 @@ function AuthLoaded({ children }) {
 init_Spinner();
 
 // src/components/SignOutButton.tsx
-var React30 = __toESM(require("react"), 1);
+var React31 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_Spinner();
@@ -6059,7 +6276,7 @@ var import_jsx_runtime40 = require("react/jsx-runtime");
 function SignOutButton({ children, redirectTo, onSignedOut, className }) {
   const t = useT();
   const { signOut } = useSignOut();
-  const [pending, setPending] = React30.useState(false);
+  const [pending, setPending] = React31.useState(false);
   const content = children ?? t("signOut.button");
   return /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(
     "button",
@@ -6085,17 +6302,17 @@ function SignOutButton({ children, redirectTo, onSignedOut, className }) {
 }
 
 // src/components/UserButton.tsx
-var React43 = __toESM(require("react"), 1);
+var React44 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
 // src/components/UserProfile.tsx
-var React42 = __toESM(require("react"), 1);
+var React43 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
 // src/components/user-profile/EmailSection.tsx
-var React31 = __toESM(require("react"), 1);
+var React32 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6107,9 +6324,9 @@ function EmailSection({ allowChange }) {
   const account = useAccount();
   const { user } = useUser();
   const { pending, error, run } = useSubmitAction();
-  const [newEmail, setNewEmail] = React31.useState("");
-  const [sent, setSent] = React31.useState(false);
-  const titleId = React31.useId();
+  const [newEmail, setNewEmail] = React32.useState("");
+  const [sent, setSent] = React32.useState(false);
+  const titleId = React32.useId();
   if (!user?.email) {
     return /* @__PURE__ */ (0, import_jsx_runtime41.jsxs)("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
       /* @__PURE__ */ (0, import_jsx_runtime41.jsx)("h2", { id: titleId, className: "ba-title", children: t("userProfile.email.title") }),
@@ -6174,7 +6391,7 @@ function EmailSection({ allowChange }) {
 }
 
 // src/components/user-profile/DeleteAccountSection.tsx
-var React32 = __toESM(require("react"), 1);
+var React33 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6187,8 +6404,8 @@ function DeleteAccountSection({ onDeleted }) {
   const session = useSession();
   const { user } = useUser();
   const { pending, error, run } = useSubmitAction();
-  const [confirmation, setConfirmation] = React32.useState("");
-  const titleId = React32.useId();
+  const [confirmation, setConfirmation] = React33.useState("");
+  const titleId = React33.useId();
   const identifier = user?.email ?? user?.phoneNumber ?? user?.id ?? "";
   const confirmed = identifier.length > 0 && confirmation.trim().toLowerCase() === identifier.toLowerCase();
   const submit = (event) => {
@@ -6246,7 +6463,7 @@ function DeleteAccountSection({ onDeleted }) {
 }
 
 // src/components/user-profile/MfaSection.tsx
-var React33 = __toESM(require("react"), 1);
+var React34 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6260,10 +6477,10 @@ function MfaSection() {
   const { config } = usePublicConfig();
   const { disable } = useMFA();
   const { pending, error, run } = useSubmitAction();
-  const [password, setPassword] = React33.useState("");
-  const [showDisable, setShowDisable] = React33.useState(false);
-  const titleId = React33.useId();
-  const required = (0, import_core3.resolveProjectCapabilities)(config).mfaRequired;
+  const [password, setPassword] = React34.useState("");
+  const [showDisable, setShowDisable] = React34.useState(false);
+  const titleId = React34.useId();
+  const required = (0, import_core4.resolveProjectCapabilities)(config).mfaRequired;
   if (!user?.twoFactorEnabled) {
     return /* @__PURE__ */ (0, import_jsx_runtime43.jsxs)("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
       /* @__PURE__ */ (0, import_jsx_runtime43.jsxs)("header", { className: "ba-profile-section-header", children: [
@@ -6357,7 +6574,7 @@ function MfaSection() {
 }
 
 // src/components/user-profile/PasswordSection.tsx
-var React34 = __toESM(require("react"), 1);
+var React35 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6368,13 +6585,13 @@ function PasswordSection() {
   const t = useT();
   const account = useAccount();
   const { config } = usePublicConfig();
-  const { passwordMinLength, passwordMaxLength } = (0, import_core3.resolveProjectCapabilities)(config);
+  const { passwordMinLength, passwordMaxLength } = (0, import_core4.resolveProjectCapabilities)(config);
   const { pending, error, setError, run } = useSubmitAction();
-  const [currentPassword, setCurrentPassword] = React34.useState("");
-  const [newPassword, setNewPassword] = React34.useState("");
-  const [confirmPassword, setConfirmPassword] = React34.useState("");
-  const [saved, setSaved] = React34.useState(false);
-  const titleId = React34.useId();
+  const [currentPassword, setCurrentPassword] = React35.useState("");
+  const [newPassword, setNewPassword] = React35.useState("");
+  const [confirmPassword, setConfirmPassword] = React35.useState("");
+  const [saved, setSaved] = React35.useState(false);
+  const titleId = React35.useId();
   const submit = (event) => {
     event.preventDefault();
     setSaved(false);
@@ -6443,12 +6660,12 @@ function PasswordSection() {
 }
 
 // src/components/user-profile/PasskeysSection.tsx
-var React35 = __toESM(require("react"), 1);
+var React36 = __toESM(require("react"), 1);
 init_i18n();
 var import_jsx_runtime45 = require("react/jsx-runtime");
 function PasskeysSection({ allowAdd }) {
   const t = useT();
-  const titleId = React35.useId();
+  const titleId = React36.useId();
   return /* @__PURE__ */ (0, import_jsx_runtime45.jsxs)("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
     /* @__PURE__ */ (0, import_jsx_runtime45.jsxs)("header", { className: "ba-profile-section-header", children: [
       /* @__PURE__ */ (0, import_jsx_runtime45.jsx)("h2", { id: titleId, className: "ba-title", children: t("userProfile.passkeys.title") }),
@@ -6459,7 +6676,7 @@ function PasskeysSection({ allowAdd }) {
 }
 
 // src/components/user-profile/ProfileSection.tsx
-var React36 = __toESM(require("react"), 1);
+var React37 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6476,15 +6693,15 @@ function ProfileSection({
   const { user } = useUser();
   const session = useSession();
   const { pending, error, run } = useSubmitAction();
-  const [name, setName] = React36.useState(user?.name ?? "");
-  const [firstName, setFirstName] = React36.useState(user?.firstName ?? "");
-  const [lastName, setLastName] = React36.useState(user?.lastName ?? "");
-  const [username, setUsername] = React36.useState(
+  const [name, setName] = React37.useState(user?.name ?? "");
+  const [firstName, setFirstName] = React37.useState(user?.firstName ?? "");
+  const [lastName, setLastName] = React37.useState(user?.lastName ?? "");
+  const [username, setUsername] = React37.useState(
     user?.displayUsername ?? user?.username ?? ""
   );
-  const [image, setImage] = React36.useState(user?.image ?? "");
-  const [saved, setSaved] = React36.useState(false);
-  const titleId = React36.useId();
+  const [image, setImage] = React37.useState(user?.image ?? "");
+  const [saved, setSaved] = React37.useState(false);
+  const titleId = React37.useId();
   const submit = (event) => {
     event.preventDefault();
     setSaved(false);
@@ -6594,14 +6811,14 @@ function ProfileSection({
 }
 
 // src/components/user-profile/RecoverySection.tsx
-var React37 = __toESM(require("react"), 1);
+var React38 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 var import_jsx_runtime47 = require("react/jsx-runtime");
 function RecoverySection() {
   const t = useT();
   const { user } = useUser();
-  const titleId = React37.useId();
+  const titleId = React38.useId();
   return /* @__PURE__ */ (0, import_jsx_runtime47.jsxs)("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
     /* @__PURE__ */ (0, import_jsx_runtime47.jsxs)("header", { className: "ba-profile-section-header", children: [
       /* @__PURE__ */ (0, import_jsx_runtime47.jsx)("h2", { id: titleId, className: "ba-title", children: t("userProfile.recovery.title") }),
@@ -6619,7 +6836,7 @@ function RecoverySection() {
 }
 
 // src/components/user-profile/SessionsSection.tsx
-var React39 = __toESM(require("react"), 1);
+var React40 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6669,19 +6886,19 @@ function formatSessionTime(date, locale) {
 }
 
 // src/components/user-profile/use-account-resource.ts
-var React38 = __toESM(require("react"), 1);
+var React39 = __toESM(require("react"), 1);
 init_i18n();
-function useAccountResource(loader2, failure) {
-  const loaderRef = React38.useRef(loader2);
-  loaderRef.current = loader2;
-  const failureRef = React38.useRef(failure);
+function useAccountResource(loader, failure) {
+  const loaderRef = React39.useRef(loader);
+  loaderRef.current = loader;
+  const failureRef = React39.useRef(failure);
   failureRef.current = failure;
   const toServerError = useServerError();
-  const [data, setData] = React38.useState(null);
-  const [error, setError] = React38.useState(null);
-  const [loading, setLoading] = React38.useState(true);
-  const requestRef = React38.useRef(0);
-  const load = React38.useCallback(async () => {
+  const [data, setData] = React39.useState(null);
+  const [error, setError] = React39.useState(null);
+  const [loading, setLoading] = React39.useState(true);
+  const requestRef = React39.useRef(0);
+  const load = React39.useCallback(async () => {
     const request = ++requestRef.current;
     setLoading(true);
     try {
@@ -6700,7 +6917,7 @@ function useAccountResource(loader2, failure) {
       if (request === requestRef.current) setLoading(false);
     }
   }, [toServerError]);
-  React38.useEffect(() => {
+  React39.useEffect(() => {
     void load();
     return () => {
       requestRef.current += 1;
@@ -6718,7 +6935,7 @@ function SessionsSection() {
   const account = useAccount();
   const sessionState = useSession();
   const mutation = useSubmitAction();
-  const titleId = React39.useId();
+  const titleId = React40.useId();
   const resource = useAccountResource(
     () => account.listSessions(),
     t("userProfile.sessions.loadError")
@@ -6789,7 +7006,7 @@ function SessionsSection() {
 }
 
 // src/components/user-profile/SocialSection.tsx
-var React40 = __toESM(require("react"), 1);
+var React41 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6803,7 +7020,7 @@ function SocialSection() {
   const account = useAccount();
   const { config } = usePublicConfig();
   const mutation = useSubmitAction();
-  const titleId = React40.useId();
+  const titleId = React41.useId();
   const resource = useAccountResource(
     () => account.listSocialAccounts(),
     t("userProfile.social.loadError")
@@ -6875,7 +7092,7 @@ function SocialSection() {
 }
 
 // src/components/user-profile/UserProfileModal.tsx
-var React41 = __toESM(require("react"), 1);
+var React42 = __toESM(require("react"), 1);
 init_i18n();
 init_ModalSurface();
 var import_jsx_runtime50 = require("react/jsx-runtime");
@@ -6885,7 +7102,7 @@ function UserProfileModal({
   branding
 }) {
   const t = useT();
-  const titleId = React41.useId();
+  const titleId = React42.useId();
   return /* @__PURE__ */ (0, import_jsx_runtime50.jsxs)(
     ModalSurface,
     {
@@ -6958,16 +7175,16 @@ function UserProfile(props = {}) {
   const t = useT();
   const { user, isLoaded, isSignedIn } = useUser();
   const { config } = usePublicConfig();
-  const [internalSection, setInternalSection] = React42.useState(() => initialSection(defaultSection));
+  const [internalSection, setInternalSection] = React43.useState(() => initialSection(defaultSection));
   const active = section ?? internalSection;
-  const capabilities = (0, import_core3.resolveProjectCapabilities)(config);
+  const capabilities = (0, import_core4.resolveProjectCapabilities)(config);
   const passwordEnabled = config !== null && capabilities.passwordSignIn;
   const passkeysEnabled = capabilities.passkeySignIn || capabilities.passkeyAdd;
   const mfaEnabled = capabilities.totp;
   const recoveryEnabled = capabilities.backupCodes && user?.twoFactorEnabled === true;
   const deletionEnabled = capabilities.accountDeletion;
   const socialEnabled = (config?.socialProviders?.length ?? 0) > 0;
-  const sections = React42.useMemo(
+  const sections = React43.useMemo(
     () => userProfileSectionsFor({
       password: passwordEnabled,
       passkeys: passkeysEnabled,
@@ -6978,7 +7195,7 @@ function UserProfile(props = {}) {
     }),
     [deletionEnabled, mfaEnabled, passkeysEnabled, passwordEnabled, recoveryEnabled, socialEnabled]
   );
-  React42.useEffect(() => {
+  React43.useEffect(() => {
     if (section || mode !== "page") return;
     const onHashChange = () => {
       const next = userProfileSectionFromHash(window.location.hash);
@@ -7077,10 +7294,10 @@ function UserButton() {
   const t = useT();
   const { user, isLoaded } = useUser();
   const { signOut } = useSignOut();
-  const [open, setOpen] = React43.useState(false);
-  const [profileOpen, setProfileOpen] = React43.useState(false);
-  const [failedImage, setFailedImage] = React43.useState(null);
-  const triggerRef = React43.useRef(null);
+  const [open, setOpen] = React44.useState(false);
+  const [profileOpen, setProfileOpen] = React44.useState(false);
+  const [failedImage, setFailedImage] = React44.useState(null);
+  const triggerRef = React44.useRef(null);
   if (!isLoaded || !user) return null;
   const identity = user.email ?? user.phoneNumber ?? user.name ?? "?";
   const image = user.image ?? null;
@@ -7136,12 +7353,12 @@ function UserButton() {
 }
 
 // src/components/OrganizationSwitcher.tsx
-var React56 = __toESM(require("react"), 1);
+var React57 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
 // src/components/CreateOrganization.tsx
-var React44 = __toESM(require("react"), 1);
+var React45 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_model();
@@ -7155,10 +7372,10 @@ function CreateOrganization({ onCreated, title } = {}) {
   const { isLoaded, isSignedIn } = useUser();
   const api = useAuthClient().organization;
   const { pending, error, run } = useSubmitAction();
-  const [name, setName] = React44.useState("");
-  const [slug, setSlug] = React44.useState("");
-  const [logo, setLogo] = React44.useState("");
-  const [slugTouched, setSlugTouched] = React44.useState(false);
+  const [name, setName] = React45.useState("");
+  const [slug, setSlug] = React45.useState("");
+  const [logo, setLogo] = React45.useState("");
+  const [slugTouched, setSlugTouched] = React45.useState(false);
   if (configLoading || !isLoaded) {
     return /* @__PURE__ */ (0, import_jsx_runtime53.jsx)("div", { className: "ba-skeleton", "aria-label": t("organization.loading") });
   }
@@ -7258,7 +7475,7 @@ function CreateOrganization({ onCreated, title } = {}) {
 }
 
 // src/components/organization/OrganizationModal.tsx
-var React45 = __toESM(require("react"), 1);
+var React46 = __toESM(require("react"), 1);
 init_i18n();
 init_ModalSurface();
 var import_jsx_runtime54 = require("react/jsx-runtime");
@@ -7269,7 +7486,7 @@ function OrganizationModal({
   children
 }) {
   const t = useT();
-  const titleId = React45.useId();
+  const titleId = React46.useId();
   return /* @__PURE__ */ (0, import_jsx_runtime54.jsxs)(
     ModalSurface,
     {
@@ -7300,21 +7517,21 @@ function OrganizationModal({
 }
 
 // src/components/organization/use-organizations-resource.ts
-var React46 = __toESM(require("react"), 1);
+var React47 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 function useOrganizationsResource(enabled = true) {
   const api = useAuthClient().organization;
-  const apiRef = React46.useRef(api);
+  const apiRef = React47.useRef(api);
   apiRef.current = api;
   const { user, isLoaded, isSignedIn } = useUser();
   const t = useT();
   const toServerError = useServerError();
-  const [organizations, setOrganizations] = React46.useState(null);
-  const [error, setError] = React46.useState(null);
-  const requestRef = React46.useRef(0);
+  const [organizations, setOrganizations] = React47.useState(null);
+  const [error, setError] = React47.useState(null);
+  const requestRef = React47.useRef(0);
   const identity = user?.id ?? null;
-  const refresh = React46.useCallback(async () => {
+  const refresh = React47.useCallback(async () => {
     const token = ++requestRef.current;
     if (!enabled || !identity || !isSignedIn) {
       setOrganizations([]);
@@ -7334,7 +7551,7 @@ function useOrganizationsResource(enabled = true) {
       if (token === requestRef.current) setError(t("organization.error.load"));
     }
   }, [enabled, identity, isSignedIn, t, toServerError]);
-  React46.useEffect(() => {
+  React47.useEffect(() => {
     setOrganizations(null);
     setError(null);
     if (!isLoaded) return;
@@ -7343,7 +7560,7 @@ function useOrganizationsResource(enabled = true) {
       requestRef.current += 1;
     };
   }, [identity, isLoaded, refresh]);
-  React46.useEffect(
+  React47.useEffect(
     () => api.subscribe(() => void refresh()),
     [api, refresh]
   );
@@ -7356,12 +7573,12 @@ function useOrganizationsResource(enabled = true) {
 }
 
 // src/components/OrganizationProfile.tsx
-var React55 = __toESM(require("react"), 1);
+var React56 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
 // src/components/organization/DangerSection.tsx
-var React47 = __toESM(require("react"), 1);
+var React48 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -7379,7 +7596,7 @@ function DangerSection({
   const api = useAuthClient().organization;
   const session = useSession();
   const { pending, error, run } = useSubmitAction();
-  const [confirmation, setConfirmation] = React47.useState("");
+  const [confirmation, setConfirmation] = React48.useState("");
   const isOwner = hasOrganizationRole(membership, "owner");
   const confirmed = confirmation.trim().toLowerCase() === organization.slug.toLowerCase();
   const leave = () => {
@@ -7444,7 +7661,7 @@ function DangerSection({
 }
 
 // src/components/organization/GeneralSection.tsx
-var React48 = __toESM(require("react"), 1);
+var React49 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -7460,10 +7677,10 @@ function GeneralSection({
   const t = useT();
   const api = useAuthClient().organization;
   const { pending, error, run } = useSubmitAction();
-  const [name, setName] = React48.useState(organization.name);
-  const [slug, setSlug] = React48.useState(organization.slug);
-  const [logo, setLogo] = React48.useState(organization.logo ?? "");
-  React48.useEffect(() => {
+  const [name, setName] = React49.useState(organization.name);
+  const [slug, setSlug] = React49.useState(organization.slug);
+  const [logo, setLogo] = React49.useState(organization.logo ?? "");
+  React49.useEffect(() => {
     setName(organization.name);
     setSlug(organization.slug);
     setLogo(organization.logo ?? "");
@@ -7540,7 +7757,7 @@ function GeneralSection({
 }
 
 // src/components/organization/InvitationsSection.tsx
-var React50 = __toESM(require("react"), 1);
+var React51 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -7571,8 +7788,8 @@ function InvitationsSection({
   const api = useAuthClient().organization;
   const { pending, error, run } = useSubmitAction();
   const { roles } = useOrganizationRoles(organization.id);
-  const [email, setEmail] = React50.useState("");
-  const [role, setRole] = React50.useState("member");
+  const [email, setEmail] = React51.useState("");
+  const [role, setRole] = React51.useState("member");
   const invitations = organization.invitations.filter((invitation) => invitation.status === "pending");
   const invite = (event) => {
     event.preventDefault();
@@ -7713,7 +7930,7 @@ var SECTION_KEYS2 = {
   invitations: "organization.profile.nav.invitations",
   danger: "organization.profile.nav.danger"
 };
-var TeamsSection2 = React55.lazy(() => Promise.resolve().then(() => (init_TeamsSection(), TeamsSection_exports)));
+var TeamsSection2 = React56.lazy(() => Promise.resolve().then(() => (init_TeamsSection(), TeamsSection_exports)));
 function OrganizationProfile({ organizationId, defaultSection = "general", onDeleted, onLeft } = {}) {
   const t = useT();
   const toServerError = useServerError();
@@ -7721,17 +7938,17 @@ function OrganizationProfile({ organizationId, defaultSection = "general", onDel
   const { user, isLoaded, isSignedIn } = useUser();
   const session = useSession();
   const api = useAuthClient().organization;
-  const apiRef = React55.useRef(api);
+  const apiRef = React56.useRef(api);
   apiRef.current = api;
   const activeOrganizationId = session.data?.session.activeOrganizationId ?? null;
   const requestedId = organizationId ?? activeOrganizationId;
   const enabled = config?.organizations === true && isSignedIn;
-  const [organization, setOrganization] = React55.useState(null);
-  const [error, setError] = React55.useState(null);
-  const [wasRemoved, setWasRemoved] = React55.useState(false);
-  const [section, setSection] = React55.useState(defaultSection);
-  const requestRef = React55.useRef(0);
-  const load = React55.useCallback(async () => {
+  const [organization, setOrganization] = React56.useState(null);
+  const [error, setError] = React56.useState(null);
+  const [wasRemoved, setWasRemoved] = React56.useState(false);
+  const [section, setSection] = React56.useState(defaultSection);
+  const requestRef = React56.useRef(0);
+  const load = React56.useCallback(async () => {
     const token = ++requestRef.current;
     if (!enabled || !requestedId) {
       setOrganization(null);
@@ -7751,7 +7968,7 @@ function OrganizationProfile({ organizationId, defaultSection = "general", onDel
       if (token === requestRef.current) setError(t("organization.profile.loadError"));
     }
   }, [enabled, requestedId, t, toServerError]);
-  React55.useEffect(() => {
+  React56.useEffect(() => {
     setOrganization(null);
     setError(null);
     setWasRemoved(false);
@@ -7805,7 +8022,7 @@ function OrganizationProfile({ organizationId, defaultSection = "general", onDel
       /* @__PURE__ */ (0, import_jsx_runtime61.jsxs)("div", { className: "ba-organization-profile-content", children: [
         activeSection === "general" && /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(GeneralSection, { organization, canManage, onChanged: load }),
         activeSection === "members" && /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(MembersSection, { organization, userId: user.id, canManage, onChanged: load }),
-        activeSection === "teams" && /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(React55.Suspense, { fallback: null, children: /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(TeamsSection2, { organization, membership }) }),
+        activeSection === "teams" && /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(React56.Suspense, { fallback: null, children: /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(TeamsSection2, { organization, membership }) }),
         activeSection === "invitations" && /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(InvitationsSection, { organization, onChanged: load }),
         activeSection === "danger" && /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(
           DangerSection,
@@ -7834,15 +8051,15 @@ function OrganizationSwitcher({ showPersonalWorkspace = true, onOrganizationChan
   const enabled = config?.organizations === true && isSignedIn;
   const { organizations, isLoading, error: loadError, refresh } = useOrganizationsResource(enabled);
   const { pending, error, run } = useSubmitAction();
-  const [open, setOpen] = React56.useState(false);
-  const [dialog, setDialog] = React56.useState(null);
-  const rootRef = React56.useRef(null);
-  const triggerRef = React56.useRef(null);
-  const menuRef = React56.useRef(null);
-  const menuId = React56.useId();
+  const [open, setOpen] = React57.useState(false);
+  const [dialog, setDialog] = React57.useState(null);
+  const rootRef = React57.useRef(null);
+  const triggerRef = React57.useRef(null);
+  const menuRef = React57.useRef(null);
+  const menuId = React57.useId();
   const activeId = session.data?.session.activeOrganizationId ?? null;
   const active = organizations?.find((organization) => organization.id === activeId) ?? null;
-  React56.useEffect(() => {
+  React57.useEffect(() => {
     if (!open) return;
     const onPointerDown = (event) => {
       if (!rootRef.current?.contains(event.target)) setOpen(false);
@@ -7979,7 +8196,7 @@ function OrganizationSwitcher({ showPersonalWorkspace = true, onOrganizationChan
 init_InvitationPrompt();
 
 // src/components/OrganizationList.tsx
-var React57 = __toESM(require("react"), 1);
+var React58 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -7992,19 +8209,19 @@ function OrganizationList({ onOrganizationChange } = {}) {
   const { user, isLoaded, isSignedIn } = useUser();
   const session = useSession();
   const api = useAuthClient().organization;
-  const apiRef = React57.useRef(api);
+  const apiRef = React58.useRef(api);
   apiRef.current = api;
   const enabled = config?.organizations === true && isSignedIn;
   const { organizations, isLoading, error: organizationError, refresh } = useOrganizationsResource(enabled);
   const { pending, error, run } = useSubmitAction();
-  const [invitations, setInvitations] = React57.useState(null);
-  const [invitationError, setInvitationError] = React57.useState(null);
-  const [dialog, setDialog] = React57.useState(null);
-  const [profileId, setProfileId] = React57.useState(null);
-  const dialogReturnFocusRef = React57.useRef(null);
-  const invitationRequestRef = React57.useRef(0);
+  const [invitations, setInvitations] = React58.useState(null);
+  const [invitationError, setInvitationError] = React58.useState(null);
+  const [dialog, setDialog] = React58.useState(null);
+  const [profileId, setProfileId] = React58.useState(null);
+  const dialogReturnFocusRef = React58.useRef(null);
+  const invitationRequestRef = React58.useRef(0);
   const activeId = session.data?.session.activeOrganizationId ?? null;
-  const loadInvitations = React57.useCallback(async () => {
+  const loadInvitations = React58.useCallback(async () => {
     const token = ++invitationRequestRef.current;
     if (!enabled) {
       setInvitations([]);
@@ -8024,7 +8241,7 @@ function OrganizationList({ onOrganizationChange } = {}) {
       if (token === invitationRequestRef.current) setInvitationError(t("organization.list.invitationsError"));
     }
   }, [enabled, t, toServerError]);
-  React57.useEffect(() => {
+  React58.useEffect(() => {
     setInvitations(null);
     setInvitationError(null);
     if (!isLoaded) return;
@@ -8140,7 +8357,7 @@ function OrganizationList({ onOrganizationChange } = {}) {
 }
 
 // src/components/GoogleOneTap.tsx
-var React58 = __toESM(require("react"), 1);
+var React59 = __toESM(require("react"), 1);
 init_hooks();
 
 // src/components/google-one-tap.ts
@@ -8290,6 +8507,14 @@ function normalizeDismissReason(reason) {
   }
   return "unknown";
 }
+var warnedMissingNonce = /* @__PURE__ */ new Set();
+function warnOneTapWithoutNonce(clientId) {
+  if (warnedMissingNonce.has(clientId)) return;
+  warnedMissingNonce.add(clientId);
+  console.warn(
+    "[AuthOwl] <GoogleOneTap/> is running without a `nonce`. Google\u2019s ID token is then not bound to a value chosen for this prompt. Generate a fresh random value per prompt and pass it as `nonce`; AuthOwl forwards it to Google and verifies the match. The direct browser exchange does not keep separate one-time server state, so do not treat this prop by itself as replay protection. (This warning is dev-only.)"
+  );
+}
 function GoogleOneTap({
   disabled = false,
   nonce,
@@ -8309,11 +8534,16 @@ function GoogleOneTap({
   const { config, isLoading: configLoading, isError: configError } = usePublicConfig();
   const { user, isLoaded: sessionLoaded } = useUser();
   const { signInSocial } = useSignIn();
-  const callbacks = React58.useRef({ onSignedIn, onSkipped, onDismissed, onError });
+  const callbacks = React59.useRef({ onSignedIn, onSkipped, onDismissed, onError });
   callbacks.current = { onSignedIn, onSkipped, onDismissed, onError };
   const googleEnabled = config?.socialProviders.includes("google") === true;
   const clientId = config?.socialProviderClientIds?.google;
-  React58.useEffect(() => {
+  React59.useEffect(() => {
+    if (process.env.NODE_ENV === "production") return;
+    if (disabled || !googleEnabled || !clientId || nonce) return;
+    warnOneTapWithoutNonce(clientId);
+  }, [clientId, disabled, googleEnabled, nonce]);
+  React59.useEffect(() => {
     if (configLoading || !sessionLoaded) return;
     if (disabled) {
       callbacks.current.onSkipped?.("disabled");
@@ -8429,8 +8659,9 @@ function GoogleOneTap({
 }
 
 // src/index.ts
-var import_core7 = require("@authowl/core");
 var import_core8 = require("@authowl/core");
+var import_core9 = require("@authowl/core");
+init_last_used_method();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthLoaded,
@@ -8489,6 +8720,7 @@ var import_core8 = require("@authowl/core");
   useConsent,
   useEmailVerification,
   useInvitationRecipientHint,
+  useLastUsedSignInMethod,
   useLocale,
   useMFA,
   useOrganization,