@authowl/react 0.22.0 → 0.23.0

package/dist/index.cjs

@@ -737,6 +737,42 @@ var init_InvitationPrompt = __esm({
   }
 });
 
+// src/last-used-method.ts
+function useLastUsedSignInMethod() {
+  const { config } = usePublicConfig();
+  const projectId = config?.environmentId ?? null;
+  return React5.useMemo(
+    () => projectId ? (0, import_core2.readLastUsedSignInMethod)(projectId) : null,
+    [projectId]
+  );
+}
+function useSignInMethodRecorder() {
+  const { config } = usePublicConfig();
+  const projectId = config?.environmentId ?? null;
+  return React5.useCallback(
+    (method, pending) => {
+      if (!projectId) return;
+      (pending ? import_core2.rememberPendingSignInMethod : import_core2.recordLastUsedSignInMethod)(projectId, method);
+    },
+    [projectId]
+  );
+}
+function useConfirmPendingSignInMethod(loaded, signedIn, projectId) {
+  React5.useEffect(() => {
+    if (loaded && projectId) (0, import_core2.settlePendingSignInMethod)(projectId, signedIn);
+  }, [loaded, projectId, signedIn]);
+}
+var React5, import_core2;
+var init_last_used_method = __esm({
+  "src/last-used-method.ts"() {
+    "use strict";
+    "use client";
+    React5 = __toESM(require("react"), 1);
+    import_core2 = require("@authowl/core");
+    init_hooks();
+  }
+});
+
 // src/provider.tsx
 function warnPublicConfigFailed(resolved, error) {
   let origin = resolved.apiUrl;
@@ -752,6 +788,12 @@ function warnPublicConfigFailed(resolved, error) {
     `[AuthOwl] Could not load this project's public config from ${origin} (${reason}). Authentication UI is unavailable until the request succeeds. Likely causes: the API is unreachable, \`apiUrl\` is wrong, or the publishable key points at a missing/mismatched project. Check \`apiUrl\` and \`publishableKey\` on <AuthOwlProvider>. (This warning is dev-only.)`
   );
 }
+function LastUsedMethodSync() {
+  const { config } = usePublicConfig();
+  const { isLoaded, isSignedIn } = useUser();
+  useConfirmPendingSignInMethod(isLoaded, isSignedIn, config?.environmentId ?? null);
+  return null;
+}
 function detectLocale() {
   if (typeof document !== "undefined") {
     const root = document.documentElement;
@@ -763,9 +805,9 @@ function detectLocale() {
   return "en";
 }
 function resolveLocale(prop, autoDetected, configLocale) {
-  if (prop !== "auto" && (0, import_core2.isLocale)(prop)) return prop;
+  if (prop !== "auto" && (0, import_core3.isLocale)(prop)) return prop;
   if (prop === "auto") return autoDetected ?? "en";
-  return (0, import_core2.isLocale)(configLocale) ? configLocale : "en";
+  return (0, import_core3.isLocale)(configLocale) ? configLocale : "en";
 }
 function AuthOwlProvider({
   publishableKey,
@@ -776,21 +818,21 @@ function AuthOwlProvider({
   invitationPrompt = true,
   children
 }) {
-  const fetchRef = React5.useRef(fetch);
+  const fetchRef = React6.useRef(fetch);
   fetchRef.current = fetch;
-  const resolved = React5.useMemo(
-    () => (0, import_core2.resolveConfig)({ publishableKey, apiUrl, fetch: fetchRef.current }),
+  const resolved = React6.useMemo(
+    () => (0, import_core3.resolveConfig)({ publishableKey, apiUrl, fetch: fetchRef.current }),
     [publishableKey, apiUrl]
   );
-  const client = React5.useMemo(() => (0, import_core2.createAuthOwlClient)(resolved), [resolved]);
-  const [config, setConfig] = React5.useState(null);
-  const [configState, setConfigState] = React5.useState("loading");
-  const [configAttempt, setConfigAttempt] = React5.useState(0);
-  const retryPublicConfig = React5.useCallback(() => setConfigAttempt((attempt) => attempt + 1), []);
-  React5.useEffect(() => {
+  const client = React6.useMemo(() => (0, import_core3.createAuthOwlClient)(resolved), [resolved]);
+  const [config, setConfig] = React6.useState(null);
+  const [configState, setConfigState] = React6.useState("loading");
+  const [configAttempt, setConfigAttempt] = React6.useState(0);
+  const retryPublicConfig = React6.useCallback(() => setConfigAttempt((attempt) => attempt + 1), []);
+  React6.useEffect(() => {
     let active = true;
     setConfigState("loading");
-    (0, import_core2.getPublicConfig)(resolved).then((c) => {
+    (0, import_core3.getPublicConfig)(resolved).then((c) => {
       if (!active) return;
       setConfig(c);
       setConfigState("ready");
@@ -805,15 +847,18 @@ function AuthOwlProvider({
     };
   }, [resolved, configAttempt]);
   const merged = resolveAppearance(appearance, config);
-  const [autoLocale, setAutoLocale] = React5.useState(null);
-  React5.useEffect(() => {
+  const [autoLocale, setAutoLocale] = React6.useState(null);
+  React6.useEffect(() => {
     if (localeProp === "auto") setAutoLocale(detectLocale());
   }, [localeProp]);
   const locale = resolveLocale(localeProp, autoLocale, config?.locale);
-  React5.useEffect(() => {
-    (0, import_core2.captureInvitationClaim)();
+  React6.useEffect(() => {
+    return (0, import_core3.setActiveLocale)(resolved.decoded.projectId, locale);
+  }, [locale, resolved.decoded.projectId]);
+  React6.useEffect(() => {
+    (0, import_core3.captureInvitationClaim)();
   }, []);
-  const ctxValue = React5.useMemo(
+  const ctxValue = React6.useMemo(
     () => ({ client, appearance, config, configState, retryPublicConfig, locale }),
     [client, appearance, config, configState, retryPublicConfig, locale]
   );
@@ -823,43 +868,46 @@ function AuthOwlProvider({
       className: "authowl-root",
       "data-authowl-theme": merged.theme,
       "data-authowl-locale": locale,
-      dir: (0, import_core2.directionFor)(locale),
+      dir: (0, import_core3.directionFor)(locale),
       style: { display: "contents", ...merged.style },
       children: [
         children,
+        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(LastUsedMethodSync, {}),
         invitationPrompt ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(InvitationPrompt, {}) : null
       ]
     }
   ) });
 }
 function useAuthOwlContext() {
-  const v = React5.useContext(Context);
+  const v = React6.useContext(Context);
   if (!v) {
     throw new Error("AuthOwl hooks must be used inside <AuthOwlProvider>");
   }
   return v;
 }
-var React5, import_core2, import_jsx_runtime4, warnedConfigProjects, Context;
+var React6, import_core3, import_jsx_runtime4, warnedConfigProjects, Context;
 var init_provider = __esm({
   "src/provider.tsx"() {
     "use strict";
     "use client";
-    React5 = __toESM(require("react"), 1);
-    import_core2 = require("@authowl/core");
+    React6 = __toESM(require("react"), 1);
+    import_core3 = require("@authowl/core");
     init_appearance();
     init_InvitationPrompt();
+    init_last_used_method();
+    init_hooks();
     import_jsx_runtime4 = require("react/jsx-runtime");
     warnedConfigProjects = /* @__PURE__ */ new Set();
-    Context = React5.createContext(null);
+    Context = React6.createContext(null);
   }
 });
 
 // src/components/use-submit-action.ts
 function useSubmitAction() {
-  const [pending, setPending] = React6.useState(false);
-  const [error, setError] = React6.useState(null);
+  const [pending, setPending] = React7.useState(false);
+  const [error, setError] = React7.useState(null);
   const toMessage = useServerError();
-  const run = React6.useCallback(
+  const run = React7.useCallback(
     async (action, { failure, onSuccess, mapError, keepPendingOnSuccess }) => {
       setError(null);
       setPending(true);
@@ -881,12 +929,12 @@ function useSubmitAction() {
   );
   return { pending, error, setError, run };
 }
-var React6;
+var React7;
 var init_use_submit_action = __esm({
   "src/components/use-submit-action.ts"() {
     "use strict";
     "use client";
-    React6 = __toESM(require("react"), 1);
+    React7 = __toESM(require("react"), 1);
     init_i18n();
   }
 });
@@ -2806,11 +2854,11 @@ var init_model = __esm({
 // src/components/organization/use-organization-roles.ts
 function useOrganizationRoles(organizationId) {
   const api = useAuthClient().organization;
-  const apiRef = React49.useRef(api);
+  const apiRef = React50.useRef(api);
   apiRef.current = api;
-  const [dynamicRoles, setDynamicRoles] = React49.useState([]);
-  const requestRef = React49.useRef(0);
-  React49.useEffect(() => {
+  const [dynamicRoles, setDynamicRoles] = React50.useState([]);
+  const requestRef = React50.useRef(0);
+  React50.useEffect(() => {
     const token = ++requestRef.current;
     setDynamicRoles([]);
     if (!organizationId) return;
@@ -2826,7 +2874,7 @@ function useOrganizationRoles(organizationId) {
       requestRef.current += 1;
     };
   }, [organizationId]);
-  const roles = React49.useMemo(() => {
+  const roles = React50.useMemo(() => {
     const seen = /* @__PURE__ */ new Set();
     const out = [];
     for (const candidate of [...BUILTIN_ROLES, ...dynamicRoles.map((entry) => entry.role)]) {
@@ -2839,12 +2887,12 @@ function useOrganizationRoles(organizationId) {
   }, [dynamicRoles]);
   return { roles, dynamicRoles };
 }
-var React49, BUILTIN_ROLES;
+var React50, BUILTIN_ROLES;
 var init_use_organization_roles = __esm({
   "src/components/organization/use-organization-roles.ts"() {
     "use strict";
     "use client";
-    React49 = __toESM(require("react"), 1);
+    React50 = __toESM(require("react"), 1);
     init_hooks();
     BUILTIN_ROLES = ["owner", "admin", "member"];
   }
@@ -2859,12 +2907,12 @@ function useOrganizationListResource({
   inactiveData = null
 }) {
   const toServerError = useServerError();
-  const requestFn = React51.useRef(request);
+  const requestFn = React52.useRef(request);
   requestFn.current = request;
-  const [data, setData] = React51.useState(null);
-  const [error, setError] = React51.useState(null);
-  const requestToken = React51.useRef(0);
-  const refresh = React51.useCallback(async () => {
+  const [data, setData] = React52.useState(null);
+  const [error, setError] = React52.useState(null);
+  const requestToken = React52.useRef(0);
+  const refresh = React52.useCallback(async () => {
     const token = ++requestToken.current;
     if (!enabled || !resourceKey) {
       setData(inactiveData);
@@ -2884,7 +2932,7 @@ function useOrganizationListResource({
       if (token === requestToken.current) setError(fallback);
     }
   }, [enabled, fallback, inactiveData, resourceKey, toServerError]);
-  React51.useEffect(() => {
+  React52.useEffect(() => {
     setData(enabled && resourceKey ? null : inactiveData);
     setError(null);
     void refresh();
@@ -2894,12 +2942,12 @@ function useOrganizationListResource({
   }, [enabled, inactiveData, refresh, resourceKey]);
   return { data, isLoading: data === null && error === null, error, refresh };
 }
-var React51;
+var React52;
 var init_use_organization_list_resource = __esm({
   "src/components/organization/use-organization-list-resource.ts"() {
     "use strict";
     "use client";
-    React51 = __toESM(require("react"), 1);
+    React52 = __toESM(require("react"), 1);
     init_i18n();
   }
 });
@@ -2907,7 +2955,7 @@ var init_use_organization_list_resource = __esm({
 // src/components/organization/use-team-resources.ts
 function useTeamsResource(organizationId) {
   const api = useAuthClient().organization;
-  const apiRef = React52.useRef(api);
+  const apiRef = React53.useRef(api);
   apiRef.current = api;
   const t = useT();
   const resource = useOrganizationListResource({
@@ -2920,7 +2968,7 @@ function useTeamsResource(organizationId) {
 }
 function useTeamMembersResource(selectedTeamId) {
   const api = useAuthClient().organization;
-  const apiRef = React52.useRef(api);
+  const apiRef = React53.useRef(api);
   apiRef.current = api;
   const t = useT();
   const resource = useOrganizationListResource({
@@ -2931,12 +2979,12 @@ function useTeamMembersResource(selectedTeamId) {
   });
   return { members: resource.data, error: resource.error, reload: resource.refresh };
 }
-var React52;
+var React53;
 var init_use_team_resources = __esm({
   "src/components/organization/use-team-resources.ts"() {
     "use strict";
     "use client";
-    React52 = __toESM(require("react"), 1);
+    React53 = __toESM(require("react"), 1);
     init_hooks();
     init_i18n();
     init_use_organization_list_resource();
@@ -2953,7 +3001,7 @@ function TeamMembersPanel({
   const t = useT();
   const api = useAuthClient().organization;
   const { pending, error: actionError, run } = useSubmitAction();
-  const [userId, setUserId] = React53.useState("");
+  const [userId, setUserId] = React54.useState("");
   const { members, error, reload } = useTeamMembersResource(team.id);
   const assignedUserIds = new Set(members?.map((member) => member.userId));
   const availableMembers = organization.members.filter((member) => !assignedUserIds.has(member.userId));
@@ -3019,12 +3067,12 @@ function TeamMembersPanel({
     }) }) : error ? null : members === null ? /* @__PURE__ */ (0, import_jsx_runtime59.jsx)("div", { className: "ba-skeleton", "aria-label": t("common.loading") }) : members.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime59.jsx)("p", { className: "ba-muted", children: t("organization.profile.teams.membersEmpty") }) : null
   ] });
 }
-var React53, import_jsx_runtime59;
+var React54, import_jsx_runtime59;
 var init_TeamMembersPanel = __esm({
   "src/components/organization/TeamMembersPanel.tsx"() {
     "use strict";
     "use client";
-    React53 = __toESM(require("react"), 1);
+    React54 = __toESM(require("react"), 1);
     init_hooks();
     init_i18n();
     init_FormError();
@@ -3049,11 +3097,11 @@ function TeamsSection({
   const { teams, error: teamsError, reload } = useTeamsResource(organization.id);
   const { dynamicRoles } = useOrganizationRoles(organization.id);
   const capabilities = teamManagementCapabilities(membership, dynamicRoles);
-  const [name, setName] = React54.useState("");
-  const [selectedTeamId, setSelectedTeamId] = React54.useState(null);
-  const [editingTeamId, setEditingTeamId] = React54.useState(null);
-  const [editingName, setEditingName] = React54.useState("");
-  React54.useEffect(() => {
+  const [name, setName] = React55.useState("");
+  const [selectedTeamId, setSelectedTeamId] = React55.useState(null);
+  const [editingTeamId, setEditingTeamId] = React55.useState(null);
+  const [editingName, setEditingName] = React55.useState("");
+  React55.useEffect(() => {
     setSelectedTeamId(null);
     setEditingTeamId(null);
     setEditingName("");
@@ -3155,12 +3203,12 @@ function TeamsSection({
     )
   ] });
 }
-var React54, import_jsx_runtime60;
+var React55, import_jsx_runtime60;
 var init_TeamsSection = __esm({
   "src/components/organization/TeamsSection.tsx"() {
     "use strict";
     "use client";
-    React54 = __toESM(require("react"), 1);
+    React55 = __toESM(require("react"), 1);
     init_hooks();
     init_i18n();
     init_FormError();
@@ -3181,7 +3229,7 @@ __export(index_exports, {
   AuthLoading: () => AuthLoading,
   AuthOwlBadge: () => AuthOwlBadge,
   AuthOwlBranding: () => AuthOwlBranding,
-  AuthOwlError: () => import_core7.AuthOwlError,
+  AuthOwlError: () => import_core8.AuthOwlError,
   AuthOwlProvider: () => AuthOwlProvider,
   BackupCodesManager: () => BackupCodesManager,
   Bidi: () => Bidi,
@@ -3192,7 +3240,7 @@ __export(index_exports, {
   EmailOtpForm: () => EmailOtpForm,
   ForgotPassword: () => ForgotPassword,
   GoogleOneTap: () => GoogleOneTap,
-  InvalidKeyError: () => import_core7.InvalidKeyError,
+  InvalidKeyError: () => import_core8.InvalidKeyError,
   InvitationPrompt: () => InvitationPrompt,
   KNOWN_METHODS: () => KNOWN_METHODS,
   MFAChallenge: () => MFAChallenge,
@@ -3206,7 +3254,7 @@ __export(index_exports, {
   PasskeyManager: () => PasskeyManager,
   PhoneOTP: () => PhoneOTP,
   Protect: () => Protect,
-  RateLimitedError: () => import_core7.RateLimitedError,
+  RateLimitedError: () => import_core8.RateLimitedError,
   ResetPassword: () => ResetPassword,
   SignIn: () => SignIn,
   SignOutButton: () => SignOutButton,
@@ -3220,11 +3268,11 @@ __export(index_exports, {
   VerificationPending: () => VerificationPending,
   VerifyEmail: () => VerifyEmail,
   Waitlist: () => Waitlist,
-  createMembershipHas: () => import_core8.createMembershipHas,
+  createMembershipHas: () => import_core9.createMembershipHas,
   emailAutocomplete: () => emailAutocomplete,
-  membershipHas: () => import_core8.membershipHas,
-  membershipHasPermission: () => import_core8.membershipHasPermission,
-  membershipHasTeam: () => import_core8.membershipHasTeam,
+  membershipHas: () => import_core9.membershipHas,
+  membershipHasPermission: () => import_core9.membershipHasPermission,
+  membershipHasTeam: () => import_core9.membershipHasTeam,
   resolveSignInMethods: () => resolveSignInMethods,
   useAccount: () => useAccount,
   useAuth: () => useAuth,
@@ -3233,6 +3281,7 @@ __export(index_exports, {
   useConsent: () => useConsent,
   useEmailVerification: () => useEmailVerification,
   useInvitationRecipientHint: () => useInvitationRecipientHint,
+  useLastUsedSignInMethod: () => useLastUsedSignInMethod,
   useLocale: () => useLocale,
   useMFA: () => useMFA,
   useOrganization: () => useOrganization,
@@ -3254,7 +3303,7 @@ init_brand();
 init_hooks();
 
 // src/project-capabilities.ts
-var import_core3 = require("@authowl/core");
+var import_core4 = require("@authowl/core");
 
 // src/signin-methods.ts
 var KNOWN_METHODS = [
@@ -3286,7 +3335,7 @@ function resolveSignInMethods(config, pageHost) {
   const methods = config?.enabledMethods ?? ["password"];
   const social = config?.socialProviders ?? [];
   const has = (m) => methods.includes(m);
-  const capabilities = (0, import_core3.resolveProjectCapabilities)(config);
+  const capabilities = (0, import_core4.resolveProjectCapabilities)(config);
   const password = capabilities.passwordSignIn;
   const username = capabilities.usernameSignIn;
   const magicLink = capabilities.magicLinkSignIn;
@@ -3325,7 +3374,7 @@ function resolveSignInMethods(config, pageHost) {
 }
 
 // src/components/SignIn.tsx
-var React19 = __toESM(require("react"), 1);
+var React20 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
@@ -3391,15 +3440,15 @@ async function finishSignIn(opts) {
 init_use_submit_action();
 
 // src/components/passkey-autofill.ts
-var React7 = __toESM(require("react"), 1);
+var React8 = __toESM(require("react"), 1);
 init_hooks();
 function usePasskeyAutofill(opts) {
   const { signInPasskey } = useSignIn();
   const { sessionStore } = useAuthClient();
   const { enabled } = opts;
-  const ref = React7.useRef({ ...opts, signInPasskey, sessionStore });
+  const ref = React8.useRef({ ...opts, signInPasskey, sessionStore });
   ref.current = { ...opts, signInPasskey, sessionStore };
-  React7.useEffect(() => {
+  React8.useEffect(() => {
     if (!enabled || typeof window === "undefined") return;
     const pkc = window.PublicKeyCredential;
     if (!pkc?.isConditionalMediationAvailable) return;
@@ -3417,9 +3466,13 @@ function usePasskeyAutofill(opts) {
   }, [enabled]);
 }
 
+// src/components/SignIn.tsx
+init_last_used_method();
+
 // src/components/SocialButtons.tsx
-var React8 = __toESM(require("react"), 1);
+var React9 = __toESM(require("react"), 1);
 init_hooks();
+init_last_used_method();
 init_i18n();
 
 // src/components/social-icons.tsx
@@ -3498,9 +3551,10 @@ function SocialButtons({ providers, callbackURL }) {
   const t = useT();
   const toServerError = useServerError();
   const { signInSocial } = useSignIn();
-  const [pending, setPending] = React8.useState(null);
-  const [error, setError] = React8.useState(null);
-  React8.useEffect(() => {
+  const recordSignInMethod = useSignInMethodRecorder();
+  const [pending, setPending] = React9.useState(null);
+  const [error, setError] = React9.useState(null);
+  React9.useEffect(() => {
     if (typeof window === "undefined") return;
     const url = new URL(window.location.href);
     if (!url.searchParams.has("authowl_error")) return;
@@ -3530,6 +3584,8 @@ function SocialButtons({ providers, callbackURL }) {
             if (res?.error) {
               setError(toServerError(res.error, t("social.error.startFailed")));
               setPending(null);
+            } else {
+              recordSignInMethod(`social:${provider}`, true);
             }
           } catch {
             setError(t("social.error.startFailed"));
@@ -3583,14 +3639,14 @@ function PasskeyButton({ redirectTo, onSignedIn }) {
 }
 
 // src/components/ForgotPassword.tsx
-var React10 = __toESM(require("react"), 1);
+var React11 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
 init_Spinner();
 
 // src/components/AuthChallenge.tsx
-var React9 = __toESM(require("react"), 1);
+var React10 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_FormError();
@@ -3626,30 +3682,30 @@ function captchaTheme(root, fallback) {
 function useAuthChallenge() {
   const { config, isLoading, retry } = usePublicConfig();
   const t = useT();
-  const container = React9.useRef(null);
-  const active = React9.useRef(null);
-  const [status, setStatus] = React9.useState("idle");
+  const container = React10.useRef(null);
+  const active = React10.useRef(null);
+  const [status, setStatus] = React10.useState("idle");
   const captcha = config?.captcha ?? null;
   const providerSupported = captcha ? isSupportedCaptchaProvider(captcha.provider) : false;
   const unavailableProvider = captcha && !providerSupported ? captcha.provider : null;
-  const refetched = React9.useRef(null);
-  const refetchIfConfigMayBeStale = React9.useCallback(() => {
+  const refetched = React10.useRef(null);
+  const refetchIfConfigMayBeStale = React10.useCallback(() => {
     if (!config || refetched.current === config) return;
     refetched.current = config;
     retry();
   }, [config, retry]);
-  const removeActive = React9.useCallback((reason) => {
+  const removeActive = React10.useCallback((reason) => {
     const current = active.current;
     active.current = null;
     if (!current) return;
     current.adapter.teardown(current.api, current.id);
     if (reason) current.reject(reason);
   }, []);
-  React9.useEffect(
+  React10.useEffect(
     () => () => removeActive(new Error("Captcha challenge was cancelled")),
     [removeActive]
   );
-  const tokenFor = React9.useCallback(
+  const tokenFor = React10.useCallback(
     async (action) => {
       if (!captcha) return null;
       if (!providerSupported) throw new Error(`Unsupported captcha provider: ${captcha.provider}`);
@@ -3706,7 +3762,7 @@ function useAuthChallenge() {
     },
     [captcha, config?.branding?.theme, config?.locale, providerSupported, removeActive]
   );
-  const run = React9.useCallback(
+  const run = React10.useCallback(
     async (action, request) => {
       if (isLoading) {
         return {
@@ -3745,8 +3801,8 @@ function ForgotPassword({ resetPasswordUrl, onBack }) {
   const { requestPasswordReset } = usePasswordReset();
   const { pending, error, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React10.useState("");
-  const [sent, setSent] = React10.useState(false);
+  const [email, setEmail] = React11.useState("");
+  const [sent, setSent] = React11.useState(false);
   if (sent) {
     return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("div", { className: "ba-fields", "data-testid": "forgot-sent", children: [
       /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("p", { className: "ba-muted", children: richMessage(t("forgotPassword.sent"), { email: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Bidi, { children: email }) }) }),
@@ -3849,7 +3905,7 @@ function OtpCodeForm({
 }
 
 // src/components/MFAChallenge.tsx
-var React11 = __toESM(require("react"), 1);
+var React12 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -3860,9 +3916,9 @@ function MFAChallenge({ onVerified, allowTrustDevice = true }) {
   const t = useT();
   const { verifyTotp, verifyBackupCode, sendOtp, verifyOtp } = useMFA();
   const { pending, error, setError, run } = useSubmitAction();
-  const [mode, setMode] = React11.useState("totp");
-  const [code, setCode] = React11.useState("");
-  const [trustDevice, setTrustDevice] = React11.useState(false);
+  const [mode, setMode] = React12.useState("totp");
+  const [code, setCode] = React12.useState("");
+  const [trustDevice, setTrustDevice] = React12.useState(false);
   const switchMode = (next) => {
     setMode(next);
     setCode("");
@@ -3922,12 +3978,12 @@ function MFAChallenge({ onVerified, allowTrustDevice = true }) {
 }
 
 // src/components/mfa-enrollment-step.tsx
-var React14 = __toESM(require("react"), 1);
+var React15 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
 // src/components/MFAEnrollment.tsx
-var React13 = __toESM(require("react"), 1);
+var React14 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -3940,13 +3996,13 @@ function shouldDiscardSetup(args) {
 }
 
 // src/components/QrCode.tsx
-var React12 = __toESM(require("react"), 1);
+var React13 = __toESM(require("react"), 1);
 init_i18n();
 var import_jsx_runtime14 = require("react/jsx-runtime");
 function QrCode({ value, size = 200 }) {
   const t = useT();
-  const [path, setPath] = React12.useState(null);
-  React12.useEffect(() => {
+  const [path, setPath] = React13.useState(null);
+  React13.useEffect(() => {
     let active = true;
     setPath(null);
     void Promise.resolve().then(() => (init_qr(), qr_exports)).then(
@@ -3997,11 +4053,11 @@ function MFAEnrollment({ onEnrolled, title }) {
   const { enable, verifyTotp } = useMFA();
   const { user, isLoaded } = useUser();
   const { pending, error, run } = useSubmitAction();
-  const [password, setPassword] = React13.useState("");
-  const [setup, setSetup] = React13.useState(null);
-  const [code, setCode] = React13.useState("");
-  const [done, setDone] = React13.useState(false);
-  const setupOwnerId = React13.useRef(null);
+  const [password, setPassword] = React14.useState("");
+  const [setup, setSetup] = React14.useState(null);
+  const [code, setCode] = React14.useState("");
+  const [done, setDone] = React14.useState(false);
+  const setupOwnerId = React14.useRef(null);
   const userId = user?.id ?? null;
   const stale = shouldDiscardSetup({
     isLoaded,
@@ -4010,7 +4066,7 @@ function MFAEnrollment({ onEnrolled, title }) {
     currentUserId: userId
   });
   const activeSetup = stale ? null : setup;
-  React13.useEffect(() => {
+  React14.useEffect(() => {
     if (stale) {
       setSetup(null);
       setPassword("");
@@ -4134,8 +4190,8 @@ function useConfirmedMfaPending(onUnknown = "pending") {
   const client = useAuthClient();
   const { needsMfaEnrollment } = useUser();
   const { refetch } = useSession();
-  const [confirmed, setConfirmed] = React14.useState(null);
-  React14.useEffect(() => {
+  const [confirmed, setConfirmed] = React15.useState(null);
+  React15.useEffect(() => {
     if (!needsMfaEnrollment) {
       setConfirmed(null);
       return;
@@ -4206,8 +4262,8 @@ function AuthOwlBadge({ href = "https://authowl.dev", force } = {}) {
 init_Spinner();
 
 // src/components/PhoneOTP.tsx
-var React16 = __toESM(require("react"), 1);
-var import_core4 = require("@authowl/core");
+var React17 = __toESM(require("react"), 1);
+var import_core5 = require("@authowl/core");
 init_hooks();
 init_i18n();
 
@@ -4257,7 +4313,7 @@ function LegalConsentCheckbox({
 }
 
 // src/components/Turnstile.tsx
-var React15 = __toESM(require("react"), 1);
+var React16 = __toESM(require("react"), 1);
 var import_jsx_runtime20 = require("react/jsx-runtime");
 var LOCAL_TURNSTILE_TEST_TOKEN = "XXXX.DUMMY.TOKEN.XXXX";
 async function loadTurnstile() {
@@ -4274,10 +4330,10 @@ function Turnstile({
   onToken,
   onUnavailable
 }) {
-  const container = React15.useRef(null);
-  const callbacks = React15.useRef({ onToken, onUnavailable });
+  const container = React16.useRef(null);
+  const callbacks = React16.useRef({ onToken, onUnavailable });
   callbacks.current = { onToken, onUnavailable };
-  React15.useEffect(() => {
+  React16.useEffect(() => {
     callbacks.current.onToken(null);
     if (!siteKey) {
       callbacks.current.onToken(LOCAL_TURNSTILE_TEST_TOKEN);
@@ -4327,20 +4383,20 @@ function PhoneOTP({
   const { config, isLoading } = usePublicConfig();
   const { preparePhoneOtp, startPhoneOtp, verifyPhoneOtp } = useSignIn();
   const { pending, error, setError, run } = useSubmitAction();
-  const [stage, setStage] = React16.useState("phone");
-  const [phoneNumber, setPhoneNumber] = React16.useState("");
-  const [code, setCode] = React16.useState("");
-  const [turnstileToken, setTurnstileToken] = React16.useState(null);
-  const [guardState, setGuardState] = React16.useState({ status: "loading" });
-  const [accepted, setAccepted] = React16.useState(false);
-  const attempt = React16.useRef(null);
-  const guardRequest = React16.useRef(0);
+  const [stage, setStage] = React17.useState("phone");
+  const [phoneNumber, setPhoneNumber] = React17.useState("");
+  const [code, setCode] = React17.useState("");
+  const [turnstileToken, setTurnstileToken] = React17.useState(null);
+  const [guardState, setGuardState] = React17.useState({ status: "loading" });
+  const [accepted, setAccepted] = React17.useState(false);
+  const attempt = React17.useRef(null);
+  const guardRequest = React17.useRef(0);
   const legal = config?.legal;
   const consentBlocked = Boolean(legal?.required && !accepted);
   const guard = guardState.status === "ready" ? guardState.data : null;
   const turnstileBlocked = guardState.status === "ready" && guardState.data.kind === "authowl_turnstile" && !turnstileToken;
   const humanCheckError = t("phoneOtp.error.humanCheck");
-  const loadGuard = React16.useCallback(async () => {
+  const loadGuard = React17.useCallback(async () => {
     const request = ++guardRequest.current;
     setGuardState({ status: "loading" });
     setError(null);
@@ -4359,7 +4415,7 @@ function PhoneOTP({
       setError(humanCheckError);
     }
   }, [humanCheckError, preparePhoneOtp, setError]);
-  React16.useEffect(() => {
+  React17.useEffect(() => {
     void loadGuard();
     return () => {
       guardRequest.current += 1;
@@ -4468,7 +4524,7 @@ function PhoneOTP({
           return;
         }
         if (!attempt.current || attempt.current.phoneNumber !== phoneNumber) {
-          attempt.current = { phoneNumber, idempotencyKey: (0, import_core4.createIdempotencyKey)() };
+          attempt.current = { phoneNumber, idempotencyKey: (0, import_core5.createIdempotencyKey)() };
         }
         const idempotencyKey = attempt.current.idempotencyKey;
         void run(
@@ -4481,7 +4537,7 @@ function PhoneOTP({
             const current = selected?.data ?? guard;
             if (selected?.data) setGuardState({ status: "ready", data: selected.data });
             if (current?.kind === "akedly_shield_v1_2") {
-              const akedlyShield = await (0, import_core4.solvePhoneOtpChallenge)(current);
+              const akedlyShield = await (0, import_core5.solvePhoneOtpChallenge)(current);
               return startPhoneOtp({ phoneNumber, akedlyShield, idempotencyKey });
             }
             if (current?.kind === "authowl_turnstile" && turnstileToken) {
@@ -4566,7 +4622,7 @@ function PhoneOTP({
 init_FormError();
 
 // src/components/AuthOwlBranding.tsx
-var React17 = __toESM(require("react"), 1);
+var React18 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 var import_jsx_runtime22 = require("react/jsx-runtime");
@@ -4577,8 +4633,8 @@ function AuthOwlBranding({ href, showEnvironment = true } = {}) {
   const appName = config?.branding?.appName?.trim() ?? "";
   const showAppName = config?.branding?.showAppName !== false && appName.length > 0;
   const alignment = config?.branding?.alignment ?? "left";
-  const [logoFailed, setLogoFailed] = React17.useState(false);
-  React17.useEffect(() => setLogoFailed(false), [logoUrl]);
+  const [logoFailed, setLogoFailed] = React18.useState(false);
+  React18.useEffect(() => setLogoFailed(false), [logoUrl]);
   if (!config) return null;
   if (!logoUrl && !showAppName && (!showEnvironment || !config.environmentType)) return null;
   const identity = /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)("div", { className: "ba-branding-identity", children: [
@@ -4618,15 +4674,15 @@ function AuthOwlBranding({ href, showEnvironment = true } = {}) {
 }
 
 // src/components/InvitationBanner.tsx
-var React18 = __toESM(require("react"), 1);
-var import_core5 = require("@authowl/core");
+var React19 = __toESM(require("react"), 1);
+var import_core6 = require("@authowl/core");
 init_i18n();
 var import_jsx_runtime23 = require("react/jsx-runtime");
 function InvitationBanner() {
   const t = useT();
-  const [pending, setPending] = React18.useState(false);
-  React18.useEffect(() => {
-    setPending((0, import_core5.readInvitationClaim)() !== null);
+  const [pending, setPending] = React19.useState(false);
+  React19.useEffect(() => {
+    setPending((0, import_core6.readInvitationClaim)() !== null);
   }, []);
   if (!pending) return null;
   return /* @__PURE__ */ (0, import_jsx_runtime23.jsx)("p", { className: "ba-muted", "data-testid": "authowl-invitation-banner", children: t("organization.invitationBanner") });
@@ -4673,18 +4729,27 @@ function SignIn({
   const { config, isLoading, isError } = usePublicConfig();
   const { pending, error, setError, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React19.useState("");
-  const [username, setUsername] = React19.useState("");
-  const [password, setPassword] = React19.useState("");
-  const [credentialMode, setCredentialMode] = React19.useState("email");
-  const [otp, setOtp] = React19.useState("");
-  const [view, setView] = React19.useState(
+  const [email, setEmail] = React20.useState("");
+  const [username, setUsername] = React20.useState("");
+  const [password, setPassword] = React20.useState("");
+  const [credentialMode, setCredentialMode] = React20.useState("email");
+  const [otp, setOtp] = React20.useState("");
+  const [view, setView] = React20.useState(
     "sign-in"
   );
-  const [inFlight, setInFlight] = React19.useState(null);
-  const [challenge, setChallenge] = React19.useState(false);
+  const [inFlight, setInFlight] = React20.useState(null);
+  const [challenge, setChallenge] = React20.useState(false);
   const mfaEnrolment = useConfirmedMfaPending("clear");
-  const emailRef = React19.useRef(null);
+  const emailRef = React20.useRef(null);
+  const recordSignInMethod = useSignInMethodRecorder();
+  const onPasskeySignedIn = React20.useCallback(() => {
+    recordSignInMethod("passkey");
+    onSignedIn?.();
+  }, [onSignedIn, recordSignInMethod]);
+  const onPhoneOtpSignedIn = React20.useCallback(() => {
+    recordSignInMethod("phone-otp");
+    onSignedIn?.();
+  }, [onSignedIn, recordSignInMethod]);
   const plan = resolveSignInMethods(
     config,
     typeof window === "undefined" ? void 0 : window.location.hostname
@@ -4692,7 +4757,7 @@ function SignIn({
   usePasskeyAutofill({
     enabled: credentialMode === "email" && plan.autofillHost !== null,
     redirectTo,
-    onSignedIn
+    onSignedIn: onPasskeySignedIn
   });
   const badge = /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(AuthOwlBadge, { force: showBadge });
   const branding = showBranding ? /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(AuthOwlBranding, {}) : null;
@@ -4744,7 +4809,10 @@ function SignIn({
           error,
           onSubmit: () => void run(() => signInEmailOtp({ email, otp }), {
             failure: t("emailOtp.error.invalidCode"),
-            onSuccess: () => finishSignIn({ sessionStore, redirectTo, onSignedIn })
+            onSuccess: () => {
+              recordSignInMethod("email-otp");
+              finishSignIn({ sessionStore, redirectTo, onSignedIn });
+            }
           }),
           onChangeEmail: () => {
             setOtp("");
@@ -4772,7 +4840,7 @@ function SignIn({
         PhoneOTP,
         {
           redirectTo,
-          onSignedIn,
+          onSignedIn: onPhoneOtpSignedIn,
           onBack: () => setView("sign-in"),
           onMfaPasswordRequired: () => {
             setView("sign-in");
@@ -4800,6 +4868,7 @@ function SignIn({
       failure: t("signIn.error.failed"),
       onSuccess: (res) => {
         const data = res.data;
+        recordSignInMethod(credentialMode === "username" ? "username" : "password");
         if (data && "twoFactorRedirect" in data && data.twoFactorRedirect) {
           setChallenge(true);
         } else {
@@ -4812,7 +4881,10 @@ function SignIn({
     "magic",
     () => void run(() => authChallenge.run(AUTH_CHALLENGE_ACTIONS.passwordless, (options) => signInMagicLink({ email, callbackURL: redirectTo }, options)), {
       failure: t("magicLink.error.sendFailed"),
-      onSuccess: () => setView("magic-sent")
+      onSuccess: () => {
+        recordSignInMethod("magic-link", true);
+        setView("magic-sent");
+      }
     })
   );
   const doRequestOtp = () => start(
@@ -4829,6 +4901,7 @@ function SignIn({
       {
         failure: t("sso.error.startFailed"),
         mapError: (error2) => error2.status === 404 ? t("sso.error.notFound") : null,
+        onSuccess: () => recordSignInMethod("sso", true),
         // SSO always redirects the browser to the IdP; keep the spinner up
         // through that navigation instead of flashing back to idle.
         keepPendingOnSuccess: true
@@ -4967,7 +5040,7 @@ function SignIn({
         ]
       }
     ),
-    plan.passkey && /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(PasskeyButton, { redirectTo, onSignedIn }),
+    plan.passkey && /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(PasskeyButton, { redirectTo, onSignedIn: onPasskeySignedIn }),
     plan.phoneOtp && /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(
       "button",
       {
@@ -4983,12 +5056,12 @@ function SignIn({
 }
 
 // src/components/SignUp.tsx
-var React23 = __toESM(require("react"), 1);
+var React24 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
 // src/components/VerificationPending.tsx
-var React20 = __toESM(require("react"), 1);
+var React21 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -5008,9 +5081,9 @@ function VerificationPending({
   } = useEmailVerification();
   const { pending, error, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [resent, setResent] = React20.useState(false);
-  const [code, setCode] = React20.useState("");
-  const [verified, setVerified] = React20.useState(false);
+  const [resent, setResent] = React21.useState(false);
+  const [code, setCode] = React21.useState("");
+  const [verified, setVerified] = React21.useState(false);
   if (verified) {
     return /* @__PURE__ */ (0, import_jsx_runtime26.jsx)("p", { className: "ba-success", role: "status", "data-testid": "verify-code-success", children: t("verifyEmail.success") });
   }
@@ -5113,7 +5186,7 @@ function VerificationPending({
 }
 
 // src/components/PasswordlessSignUp.tsx
-var React21 = __toESM(require("react"), 1);
+var React22 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -5125,9 +5198,9 @@ function PasswordlessSignUp({ onAuthenticated }) {
   const { sendEmailOtp, signInEmailOtp } = useSignIn();
   const { pending, error, setError, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React21.useState("");
-  const [code, setCode] = React21.useState("");
-  const [codeSent, setCodeSent] = React21.useState(false);
+  const [email, setEmail] = React22.useState("");
+  const [code, setCode] = React22.useState("");
+  const [codeSent, setCodeSent] = React22.useState(false);
   if (codeSent) {
     return /* @__PURE__ */ (0, import_jsx_runtime27.jsx)("div", { className: "ba-fields", "data-testid": "signup-emailotp-code", children: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(
       OtpCodeForm,
@@ -5232,7 +5305,7 @@ init_Spinner();
 init_FormError();
 
 // src/components/Waitlist.tsx
-var React22 = __toESM(require("react"), 1);
+var React23 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_FormError();
@@ -5244,8 +5317,8 @@ function Waitlist({ onJoined, showBadge, showBranding = true } = {}) {
   const { join } = useWaitlist();
   const { pending, error, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React22.useState("");
-  const [joined, setJoined] = React22.useState(false);
+  const [email, setEmail] = React23.useState("");
+  const [joined, setJoined] = React23.useState(false);
   if (joined) {
     return /* @__PURE__ */ (0, import_jsx_runtime29.jsxs)("div", { className: "ba-form", "data-testid": "waitlist-accepted", children: [
       showBranding ? /* @__PURE__ */ (0, import_jsx_runtime29.jsx)(AuthOwlBranding, {}) : null,
@@ -5329,24 +5402,24 @@ function SignUp({
   const { signUp } = useSignUp();
   const { config, isLoading, isError } = usePublicConfig();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React23.useState("");
-  const [password, setPassword] = React23.useState("");
-  const [name, setName] = React23.useState("");
-  const [firstName, setFirstName] = React23.useState("");
-  const [lastName, setLastName] = React23.useState("");
-  const [username, setUsername] = React23.useState("");
-  const [error, setError] = React23.useState(null);
-  const [submitting, setSubmitting] = React23.useState(false);
-  const [accepted, setAccepted] = React23.useState(false);
+  const [email, setEmail] = React24.useState("");
+  const [password, setPassword] = React24.useState("");
+  const [name, setName] = React24.useState("");
+  const [firstName, setFirstName] = React24.useState("");
+  const [lastName, setLastName] = React24.useState("");
+  const [username, setUsername] = React24.useState("");
+  const [error, setError] = React24.useState(null);
+  const [submitting, setSubmitting] = React24.useState(false);
+  const [accepted, setAccepted] = React24.useState(false);
   const legal = config?.legal;
   const consentRequired = Boolean(legal?.required);
   const consentBlocked = consentRequired && !accepted;
-  const capabilities = (0, import_core3.resolveProjectCapabilities)(config);
+  const capabilities = (0, import_core4.resolveProjectCapabilities)(config);
   const passwordMinLength = capabilities.passwordMinLength;
   const passwordMaxLength = capabilities.passwordMaxLength;
   const passkeysEnabled = capabilities.passkeyAdd;
-  const [pendingEmail, setPendingEmail] = React23.useState(null);
-  const [completeWithPasskey, setCompleteWithPasskey] = React23.useState(false);
+  const [pendingEmail, setPendingEmail] = React24.useState(null);
+  const [completeWithPasskey, setCompleteWithPasskey] = React24.useState(false);
   function finishSignUp() {
     onSignedUp?.();
     if (redirectTo) window.location.assign(redirectTo);
@@ -5633,7 +5706,7 @@ function MFARequiredGate({ children, title }) {
 }
 
 // src/components/BackupCodesManager.tsx
-var React24 = __toESM(require("react"), 1);
+var React25 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -5645,8 +5718,8 @@ function BackupCodesManager({ title }) {
   const { user } = useUser();
   const { regenerateBackupCodes } = useMFA();
   const { pending, error, run } = useSubmitAction();
-  const [password, setPassword] = React24.useState("");
-  const [codes, setCodes] = React24.useState(null);
+  const [password, setPassword] = React25.useState("");
+  const [codes, setCodes] = React25.useState(null);
   if (!user?.twoFactorEnabled) return null;
   const submit = (e) => {
     e.preventDefault();
@@ -5690,7 +5763,7 @@ function BackupCodesManager({ title }) {
 }
 
 // src/components/MagicLinkForm.tsx
-var React25 = __toESM(require("react"), 1);
+var React26 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -5702,8 +5775,8 @@ function MagicLinkForm({ callbackURL, webauthnAutofill }) {
   const { signInMagicLink } = useSignIn();
   const { pending, error, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React25.useState("");
-  const [sent, setSent] = React25.useState(false);
+  const [email, setEmail] = React26.useState("");
+  const [sent, setSent] = React26.useState(false);
   if (sent) {
     return /* @__PURE__ */ (0, import_jsx_runtime34.jsx)("p", { className: "ba-muted", "data-testid": "magiclink-sent", children: t("magicLink.sent") });
   }
@@ -5753,7 +5826,7 @@ function MagicLinkForm({ callbackURL, webauthnAutofill }) {
 }
 
 // src/components/EmailOtpForm.tsx
-var React26 = __toESM(require("react"), 1);
+var React27 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -5766,9 +5839,9 @@ function EmailOtpForm({ redirectTo, onSignedIn, webauthnAutofill }) {
   const { sendEmailOtp, signInEmailOtp } = useSignIn();
   const { pending, error, setError, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [email, setEmail] = React26.useState("");
-  const [otp, setOtp] = React26.useState("");
-  const [stage, setStage] = React26.useState("email");
+  const [email, setEmail] = React27.useState("");
+  const [otp, setOtp] = React27.useState("");
+  const [stage, setStage] = React27.useState("email");
   if (stage === "code") {
     return /* @__PURE__ */ (0, import_jsx_runtime35.jsx)(
       OtpCodeForm,
@@ -5842,7 +5915,7 @@ function EmailOtpForm({ redirectTo, onSignedIn, webauthnAutofill }) {
 }
 
 // src/components/ResetPassword.tsx
-var React27 = __toESM(require("react"), 1);
+var React28 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -5853,15 +5926,15 @@ function ResetPassword({ token: tokenProp, redirectTo, onReset }) {
   const t = useT();
   const { resetPassword } = usePasswordReset();
   const { config } = usePublicConfig();
-  const capabilities = (0, import_core3.resolveProjectCapabilities)(config);
+  const capabilities = (0, import_core4.resolveProjectCapabilities)(config);
   const { passwordMinLength, passwordMaxLength } = capabilities;
   const { pending, error, setError, run } = useSubmitAction();
-  const [token, setToken] = React27.useState(tokenProp ?? null);
-  const [ready, setReady] = React27.useState(tokenProp != null);
-  const [password, setPassword] = React27.useState("");
-  const [confirm, setConfirm] = React27.useState("");
-  const [done, setDone] = React27.useState(false);
-  React27.useEffect(() => {
+  const [token, setToken] = React28.useState(tokenProp ?? null);
+  const [ready, setReady] = React28.useState(tokenProp != null);
+  const [password, setPassword] = React28.useState("");
+  const [confirm, setConfirm] = React28.useState("");
+  const [done, setDone] = React28.useState(false);
+  React28.useEffect(() => {
     if (tokenProp != null) return;
     const params = new URLSearchParams(window.location.search);
     setToken(params.get("token"));
@@ -5948,7 +6021,7 @@ function ResetPassword({ token: tokenProp, redirectTo, onReset }) {
 }
 
 // src/components/VerifyEmail.tsx
-var React28 = __toESM(require("react"), 1);
+var React29 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -5960,11 +6033,11 @@ function VerifyEmail({ redirectTo, onVerified, callbackURL }) {
   const { sendVerificationEmail } = useEmailVerification();
   const { pending, error, run } = useSubmitAction();
   const authChallenge = useAuthChallenge();
-  const [ready, setReady] = React28.useState(false);
-  const [failed, setFailed] = React28.useState(false);
-  const [email, setEmail] = React28.useState("");
-  const [resent, setResent] = React28.useState(false);
-  React28.useEffect(() => {
+  const [ready, setReady] = React29.useState(false);
+  const [failed, setFailed] = React29.useState(false);
+  const [email, setEmail] = React29.useState("");
+  const [resent, setResent] = React29.useState(false);
+  React29.useEffect(() => {
     const didFail = new URLSearchParams(window.location.search).has("error");
     setFailed(didFail);
     setReady(true);
@@ -6029,7 +6102,7 @@ function VerifyEmail({ redirectTo, onVerified, callbackURL }) {
 }
 
 // src/components/PasskeyManager.tsx
-var React29 = __toESM(require("react"), 1);
+var React30 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6054,12 +6127,12 @@ function PasskeyManagerBody({
   const t = useT();
   const toServerError = useServerError();
   const api = usePasskeys();
-  const apiRef = React29.useRef(api);
+  const apiRef = React30.useRef(api);
   apiRef.current = api;
   const { pending, error, setError, run } = useSubmitAction();
-  const [passkeys, setPasskeys] = React29.useState(null);
-  const loadTokenRef = React29.useRef(0);
-  const load = React29.useCallback(async () => {
+  const [passkeys, setPasskeys] = React30.useState(null);
+  const loadTokenRef = React30.useRef(0);
+  const load = React30.useCallback(async () => {
     const token = ++loadTokenRef.current;
     try {
       const res = await apiRef.current.listPasskeys();
@@ -6075,7 +6148,7 @@ function PasskeyManagerBody({
       setError(t("passkeys.error.loadFailed"));
     }
   }, [setError, toServerError, t]);
-  React29.useEffect(() => {
+  React30.useEffect(() => {
     void load();
   }, [load]);
   function onRename(id, current) {
@@ -6146,7 +6219,7 @@ function PasskeyManagerBody({
 }
 
 // src/components/control.tsx
-var import_core6 = require("@authowl/core");
+var import_core7 = require("@authowl/core");
 init_hooks();
 init_i18n();
 init_Spinner();
@@ -6171,7 +6244,7 @@ function Protect({
   const membership = useSession().data?.session?.membership ?? null;
   if (!isLoaded) return null;
   if (!isSignedIn || !user) return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(import_jsx_runtime39.Fragment, { children: fallback });
-  if ((role !== void 0 || permission !== void 0 || teamId !== void 0) && !(0, import_core6.membershipHas)(membership, { role, permission, teamId })) {
+  if ((role !== void 0 || permission !== void 0 || teamId !== void 0) && !(0, import_core7.membershipHas)(membership, { role, permission, teamId })) {
     return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(import_jsx_runtime39.Fragment, { children: fallback });
   }
   if (condition && !condition(user)) return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(import_jsx_runtime39.Fragment, { children: fallback });
@@ -6195,7 +6268,7 @@ function AuthLoaded({ children }) {
 init_Spinner();
 
 // src/components/SignOutButton.tsx
-var React30 = __toESM(require("react"), 1);
+var React31 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_Spinner();
@@ -6203,7 +6276,7 @@ var import_jsx_runtime40 = require("react/jsx-runtime");
 function SignOutButton({ children, redirectTo, onSignedOut, className }) {
   const t = useT();
   const { signOut } = useSignOut();
-  const [pending, setPending] = React30.useState(false);
+  const [pending, setPending] = React31.useState(false);
   const content = children ?? t("signOut.button");
   return /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(
     "button",
@@ -6229,17 +6302,17 @@ function SignOutButton({ children, redirectTo, onSignedOut, className }) {
 }
 
 // src/components/UserButton.tsx
-var React43 = __toESM(require("react"), 1);
+var React44 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
 // src/components/UserProfile.tsx
-var React42 = __toESM(require("react"), 1);
+var React43 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
 // src/components/user-profile/EmailSection.tsx
-var React31 = __toESM(require("react"), 1);
+var React32 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6251,9 +6324,9 @@ function EmailSection({ allowChange }) {
   const account = useAccount();
   const { user } = useUser();
   const { pending, error, run } = useSubmitAction();
-  const [newEmail, setNewEmail] = React31.useState("");
-  const [sent, setSent] = React31.useState(false);
-  const titleId = React31.useId();
+  const [newEmail, setNewEmail] = React32.useState("");
+  const [sent, setSent] = React32.useState(false);
+  const titleId = React32.useId();
   if (!user?.email) {
     return /* @__PURE__ */ (0, import_jsx_runtime41.jsxs)("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
       /* @__PURE__ */ (0, import_jsx_runtime41.jsx)("h2", { id: titleId, className: "ba-title", children: t("userProfile.email.title") }),
@@ -6318,7 +6391,7 @@ function EmailSection({ allowChange }) {
 }
 
 // src/components/user-profile/DeleteAccountSection.tsx
-var React32 = __toESM(require("react"), 1);
+var React33 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6331,8 +6404,8 @@ function DeleteAccountSection({ onDeleted }) {
   const session = useSession();
   const { user } = useUser();
   const { pending, error, run } = useSubmitAction();
-  const [confirmation, setConfirmation] = React32.useState("");
-  const titleId = React32.useId();
+  const [confirmation, setConfirmation] = React33.useState("");
+  const titleId = React33.useId();
   const identifier = user?.email ?? user?.phoneNumber ?? user?.id ?? "";
   const confirmed = identifier.length > 0 && confirmation.trim().toLowerCase() === identifier.toLowerCase();
   const submit = (event) => {
@@ -6390,7 +6463,7 @@ function DeleteAccountSection({ onDeleted }) {
 }
 
 // src/components/user-profile/MfaSection.tsx
-var React33 = __toESM(require("react"), 1);
+var React34 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6404,10 +6477,10 @@ function MfaSection() {
   const { config } = usePublicConfig();
   const { disable } = useMFA();
   const { pending, error, run } = useSubmitAction();
-  const [password, setPassword] = React33.useState("");
-  const [showDisable, setShowDisable] = React33.useState(false);
-  const titleId = React33.useId();
-  const required = (0, import_core3.resolveProjectCapabilities)(config).mfaRequired;
+  const [password, setPassword] = React34.useState("");
+  const [showDisable, setShowDisable] = React34.useState(false);
+  const titleId = React34.useId();
+  const required = (0, import_core4.resolveProjectCapabilities)(config).mfaRequired;
   if (!user?.twoFactorEnabled) {
     return /* @__PURE__ */ (0, import_jsx_runtime43.jsxs)("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
       /* @__PURE__ */ (0, import_jsx_runtime43.jsxs)("header", { className: "ba-profile-section-header", children: [
@@ -6501,7 +6574,7 @@ function MfaSection() {
 }
 
 // src/components/user-profile/PasswordSection.tsx
-var React34 = __toESM(require("react"), 1);
+var React35 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6512,13 +6585,13 @@ function PasswordSection() {
   const t = useT();
   const account = useAccount();
   const { config } = usePublicConfig();
-  const { passwordMinLength, passwordMaxLength } = (0, import_core3.resolveProjectCapabilities)(config);
+  const { passwordMinLength, passwordMaxLength } = (0, import_core4.resolveProjectCapabilities)(config);
   const { pending, error, setError, run } = useSubmitAction();
-  const [currentPassword, setCurrentPassword] = React34.useState("");
-  const [newPassword, setNewPassword] = React34.useState("");
-  const [confirmPassword, setConfirmPassword] = React34.useState("");
-  const [saved, setSaved] = React34.useState(false);
-  const titleId = React34.useId();
+  const [currentPassword, setCurrentPassword] = React35.useState("");
+  const [newPassword, setNewPassword] = React35.useState("");
+  const [confirmPassword, setConfirmPassword] = React35.useState("");
+  const [saved, setSaved] = React35.useState(false);
+  const titleId = React35.useId();
   const submit = (event) => {
     event.preventDefault();
     setSaved(false);
@@ -6587,12 +6660,12 @@ function PasswordSection() {
 }
 
 // src/components/user-profile/PasskeysSection.tsx
-var React35 = __toESM(require("react"), 1);
+var React36 = __toESM(require("react"), 1);
 init_i18n();
 var import_jsx_runtime45 = require("react/jsx-runtime");
 function PasskeysSection({ allowAdd }) {
   const t = useT();
-  const titleId = React35.useId();
+  const titleId = React36.useId();
   return /* @__PURE__ */ (0, import_jsx_runtime45.jsxs)("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
     /* @__PURE__ */ (0, import_jsx_runtime45.jsxs)("header", { className: "ba-profile-section-header", children: [
       /* @__PURE__ */ (0, import_jsx_runtime45.jsx)("h2", { id: titleId, className: "ba-title", children: t("userProfile.passkeys.title") }),
@@ -6603,7 +6676,7 @@ function PasskeysSection({ allowAdd }) {
 }
 
 // src/components/user-profile/ProfileSection.tsx
-var React36 = __toESM(require("react"), 1);
+var React37 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6620,15 +6693,15 @@ function ProfileSection({
   const { user } = useUser();
   const session = useSession();
   const { pending, error, run } = useSubmitAction();
-  const [name, setName] = React36.useState(user?.name ?? "");
-  const [firstName, setFirstName] = React36.useState(user?.firstName ?? "");
-  const [lastName, setLastName] = React36.useState(user?.lastName ?? "");
-  const [username, setUsername] = React36.useState(
+  const [name, setName] = React37.useState(user?.name ?? "");
+  const [firstName, setFirstName] = React37.useState(user?.firstName ?? "");
+  const [lastName, setLastName] = React37.useState(user?.lastName ?? "");
+  const [username, setUsername] = React37.useState(
     user?.displayUsername ?? user?.username ?? ""
   );
-  const [image, setImage] = React36.useState(user?.image ?? "");
-  const [saved, setSaved] = React36.useState(false);
-  const titleId = React36.useId();
+  const [image, setImage] = React37.useState(user?.image ?? "");
+  const [saved, setSaved] = React37.useState(false);
+  const titleId = React37.useId();
   const submit = (event) => {
     event.preventDefault();
     setSaved(false);
@@ -6738,14 +6811,14 @@ function ProfileSection({
 }
 
 // src/components/user-profile/RecoverySection.tsx
-var React37 = __toESM(require("react"), 1);
+var React38 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 var import_jsx_runtime47 = require("react/jsx-runtime");
 function RecoverySection() {
   const t = useT();
   const { user } = useUser();
-  const titleId = React37.useId();
+  const titleId = React38.useId();
   return /* @__PURE__ */ (0, import_jsx_runtime47.jsxs)("section", { className: "ba-profile-section", "aria-labelledby": titleId, children: [
     /* @__PURE__ */ (0, import_jsx_runtime47.jsxs)("header", { className: "ba-profile-section-header", children: [
       /* @__PURE__ */ (0, import_jsx_runtime47.jsx)("h2", { id: titleId, className: "ba-title", children: t("userProfile.recovery.title") }),
@@ -6763,7 +6836,7 @@ function RecoverySection() {
 }
 
 // src/components/user-profile/SessionsSection.tsx
-var React39 = __toESM(require("react"), 1);
+var React40 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6813,19 +6886,19 @@ function formatSessionTime(date, locale) {
 }
 
 // src/components/user-profile/use-account-resource.ts
-var React38 = __toESM(require("react"), 1);
+var React39 = __toESM(require("react"), 1);
 init_i18n();
 function useAccountResource(loader, failure) {
-  const loaderRef = React38.useRef(loader);
+  const loaderRef = React39.useRef(loader);
   loaderRef.current = loader;
-  const failureRef = React38.useRef(failure);
+  const failureRef = React39.useRef(failure);
   failureRef.current = failure;
   const toServerError = useServerError();
-  const [data, setData] = React38.useState(null);
-  const [error, setError] = React38.useState(null);
-  const [loading, setLoading] = React38.useState(true);
-  const requestRef = React38.useRef(0);
-  const load = React38.useCallback(async () => {
+  const [data, setData] = React39.useState(null);
+  const [error, setError] = React39.useState(null);
+  const [loading, setLoading] = React39.useState(true);
+  const requestRef = React39.useRef(0);
+  const load = React39.useCallback(async () => {
     const request = ++requestRef.current;
     setLoading(true);
     try {
@@ -6844,7 +6917,7 @@ function useAccountResource(loader, failure) {
       if (request === requestRef.current) setLoading(false);
     }
   }, [toServerError]);
-  React38.useEffect(() => {
+  React39.useEffect(() => {
     void load();
     return () => {
       requestRef.current += 1;
@@ -6862,7 +6935,7 @@ function SessionsSection() {
   const account = useAccount();
   const sessionState = useSession();
   const mutation = useSubmitAction();
-  const titleId = React39.useId();
+  const titleId = React40.useId();
   const resource = useAccountResource(
     () => account.listSessions(),
     t("userProfile.sessions.loadError")
@@ -6933,7 +7006,7 @@ function SessionsSection() {
 }
 
 // src/components/user-profile/SocialSection.tsx
-var React40 = __toESM(require("react"), 1);
+var React41 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -6947,7 +7020,7 @@ function SocialSection() {
   const account = useAccount();
   const { config } = usePublicConfig();
   const mutation = useSubmitAction();
-  const titleId = React40.useId();
+  const titleId = React41.useId();
   const resource = useAccountResource(
     () => account.listSocialAccounts(),
     t("userProfile.social.loadError")
@@ -7019,7 +7092,7 @@ function SocialSection() {
 }
 
 // src/components/user-profile/UserProfileModal.tsx
-var React41 = __toESM(require("react"), 1);
+var React42 = __toESM(require("react"), 1);
 init_i18n();
 init_ModalSurface();
 var import_jsx_runtime50 = require("react/jsx-runtime");
@@ -7029,7 +7102,7 @@ function UserProfileModal({
   branding
 }) {
   const t = useT();
-  const titleId = React41.useId();
+  const titleId = React42.useId();
   return /* @__PURE__ */ (0, import_jsx_runtime50.jsxs)(
     ModalSurface,
     {
@@ -7102,16 +7175,16 @@ function UserProfile(props = {}) {
   const t = useT();
   const { user, isLoaded, isSignedIn } = useUser();
   const { config } = usePublicConfig();
-  const [internalSection, setInternalSection] = React42.useState(() => initialSection(defaultSection));
+  const [internalSection, setInternalSection] = React43.useState(() => initialSection(defaultSection));
   const active = section ?? internalSection;
-  const capabilities = (0, import_core3.resolveProjectCapabilities)(config);
+  const capabilities = (0, import_core4.resolveProjectCapabilities)(config);
   const passwordEnabled = config !== null && capabilities.passwordSignIn;
   const passkeysEnabled = capabilities.passkeySignIn || capabilities.passkeyAdd;
   const mfaEnabled = capabilities.totp;
   const recoveryEnabled = capabilities.backupCodes && user?.twoFactorEnabled === true;
   const deletionEnabled = capabilities.accountDeletion;
   const socialEnabled = (config?.socialProviders?.length ?? 0) > 0;
-  const sections = React42.useMemo(
+  const sections = React43.useMemo(
     () => userProfileSectionsFor({
       password: passwordEnabled,
       passkeys: passkeysEnabled,
@@ -7122,7 +7195,7 @@ function UserProfile(props = {}) {
     }),
     [deletionEnabled, mfaEnabled, passkeysEnabled, passwordEnabled, recoveryEnabled, socialEnabled]
   );
-  React42.useEffect(() => {
+  React43.useEffect(() => {
     if (section || mode !== "page") return;
     const onHashChange = () => {
       const next = userProfileSectionFromHash(window.location.hash);
@@ -7221,10 +7294,10 @@ function UserButton() {
   const t = useT();
   const { user, isLoaded } = useUser();
   const { signOut } = useSignOut();
-  const [open, setOpen] = React43.useState(false);
-  const [profileOpen, setProfileOpen] = React43.useState(false);
-  const [failedImage, setFailedImage] = React43.useState(null);
-  const triggerRef = React43.useRef(null);
+  const [open, setOpen] = React44.useState(false);
+  const [profileOpen, setProfileOpen] = React44.useState(false);
+  const [failedImage, setFailedImage] = React44.useState(null);
+  const triggerRef = React44.useRef(null);
   if (!isLoaded || !user) return null;
   const identity = user.email ?? user.phoneNumber ?? user.name ?? "?";
   const image = user.image ?? null;
@@ -7280,12 +7353,12 @@ function UserButton() {
 }
 
 // src/components/OrganizationSwitcher.tsx
-var React56 = __toESM(require("react"), 1);
+var React57 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
 // src/components/CreateOrganization.tsx
-var React44 = __toESM(require("react"), 1);
+var React45 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_model();
@@ -7299,10 +7372,10 @@ function CreateOrganization({ onCreated, title } = {}) {
   const { isLoaded, isSignedIn } = useUser();
   const api = useAuthClient().organization;
   const { pending, error, run } = useSubmitAction();
-  const [name, setName] = React44.useState("");
-  const [slug, setSlug] = React44.useState("");
-  const [logo, setLogo] = React44.useState("");
-  const [slugTouched, setSlugTouched] = React44.useState(false);
+  const [name, setName] = React45.useState("");
+  const [slug, setSlug] = React45.useState("");
+  const [logo, setLogo] = React45.useState("");
+  const [slugTouched, setSlugTouched] = React45.useState(false);
   if (configLoading || !isLoaded) {
     return /* @__PURE__ */ (0, import_jsx_runtime53.jsx)("div", { className: "ba-skeleton", "aria-label": t("organization.loading") });
   }
@@ -7402,7 +7475,7 @@ function CreateOrganization({ onCreated, title } = {}) {
 }
 
 // src/components/organization/OrganizationModal.tsx
-var React45 = __toESM(require("react"), 1);
+var React46 = __toESM(require("react"), 1);
 init_i18n();
 init_ModalSurface();
 var import_jsx_runtime54 = require("react/jsx-runtime");
@@ -7413,7 +7486,7 @@ function OrganizationModal({
   children
 }) {
   const t = useT();
-  const titleId = React45.useId();
+  const titleId = React46.useId();
   return /* @__PURE__ */ (0, import_jsx_runtime54.jsxs)(
     ModalSurface,
     {
@@ -7444,21 +7517,21 @@ function OrganizationModal({
 }
 
 // src/components/organization/use-organizations-resource.ts
-var React46 = __toESM(require("react"), 1);
+var React47 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 function useOrganizationsResource(enabled = true) {
   const api = useAuthClient().organization;
-  const apiRef = React46.useRef(api);
+  const apiRef = React47.useRef(api);
   apiRef.current = api;
   const { user, isLoaded, isSignedIn } = useUser();
   const t = useT();
   const toServerError = useServerError();
-  const [organizations, setOrganizations] = React46.useState(null);
-  const [error, setError] = React46.useState(null);
-  const requestRef = React46.useRef(0);
+  const [organizations, setOrganizations] = React47.useState(null);
+  const [error, setError] = React47.useState(null);
+  const requestRef = React47.useRef(0);
   const identity = user?.id ?? null;
-  const refresh = React46.useCallback(async () => {
+  const refresh = React47.useCallback(async () => {
     const token = ++requestRef.current;
     if (!enabled || !identity || !isSignedIn) {
       setOrganizations([]);
@@ -7478,7 +7551,7 @@ function useOrganizationsResource(enabled = true) {
       if (token === requestRef.current) setError(t("organization.error.load"));
     }
   }, [enabled, identity, isSignedIn, t, toServerError]);
-  React46.useEffect(() => {
+  React47.useEffect(() => {
     setOrganizations(null);
     setError(null);
     if (!isLoaded) return;
@@ -7487,7 +7560,7 @@ function useOrganizationsResource(enabled = true) {
       requestRef.current += 1;
     };
   }, [identity, isLoaded, refresh]);
-  React46.useEffect(
+  React47.useEffect(
     () => api.subscribe(() => void refresh()),
     [api, refresh]
   );
@@ -7500,12 +7573,12 @@ function useOrganizationsResource(enabled = true) {
 }
 
 // src/components/OrganizationProfile.tsx
-var React55 = __toESM(require("react"), 1);
+var React56 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
 // src/components/organization/DangerSection.tsx
-var React47 = __toESM(require("react"), 1);
+var React48 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -7523,7 +7596,7 @@ function DangerSection({
   const api = useAuthClient().organization;
   const session = useSession();
   const { pending, error, run } = useSubmitAction();
-  const [confirmation, setConfirmation] = React47.useState("");
+  const [confirmation, setConfirmation] = React48.useState("");
   const isOwner = hasOrganizationRole(membership, "owner");
   const confirmed = confirmation.trim().toLowerCase() === organization.slug.toLowerCase();
   const leave = () => {
@@ -7588,7 +7661,7 @@ function DangerSection({
 }
 
 // src/components/organization/GeneralSection.tsx
-var React48 = __toESM(require("react"), 1);
+var React49 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -7604,10 +7677,10 @@ function GeneralSection({
   const t = useT();
   const api = useAuthClient().organization;
   const { pending, error, run } = useSubmitAction();
-  const [name, setName] = React48.useState(organization.name);
-  const [slug, setSlug] = React48.useState(organization.slug);
-  const [logo, setLogo] = React48.useState(organization.logo ?? "");
-  React48.useEffect(() => {
+  const [name, setName] = React49.useState(organization.name);
+  const [slug, setSlug] = React49.useState(organization.slug);
+  const [logo, setLogo] = React49.useState(organization.logo ?? "");
+  React49.useEffect(() => {
     setName(organization.name);
     setSlug(organization.slug);
     setLogo(organization.logo ?? "");
@@ -7684,7 +7757,7 @@ function GeneralSection({
 }
 
 // src/components/organization/InvitationsSection.tsx
-var React50 = __toESM(require("react"), 1);
+var React51 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -7715,8 +7788,8 @@ function InvitationsSection({
   const api = useAuthClient().organization;
   const { pending, error, run } = useSubmitAction();
   const { roles } = useOrganizationRoles(organization.id);
-  const [email, setEmail] = React50.useState("");
-  const [role, setRole] = React50.useState("member");
+  const [email, setEmail] = React51.useState("");
+  const [role, setRole] = React51.useState("member");
   const invitations = organization.invitations.filter((invitation) => invitation.status === "pending");
   const invite = (event) => {
     event.preventDefault();
@@ -7857,7 +7930,7 @@ var SECTION_KEYS2 = {
   invitations: "organization.profile.nav.invitations",
   danger: "organization.profile.nav.danger"
 };
-var TeamsSection2 = React55.lazy(() => Promise.resolve().then(() => (init_TeamsSection(), TeamsSection_exports)));
+var TeamsSection2 = React56.lazy(() => Promise.resolve().then(() => (init_TeamsSection(), TeamsSection_exports)));
 function OrganizationProfile({ organizationId, defaultSection = "general", onDeleted, onLeft } = {}) {
   const t = useT();
   const toServerError = useServerError();
@@ -7865,17 +7938,17 @@ function OrganizationProfile({ organizationId, defaultSection = "general", onDel
   const { user, isLoaded, isSignedIn } = useUser();
   const session = useSession();
   const api = useAuthClient().organization;
-  const apiRef = React55.useRef(api);
+  const apiRef = React56.useRef(api);
   apiRef.current = api;
   const activeOrganizationId = session.data?.session.activeOrganizationId ?? null;
   const requestedId = organizationId ?? activeOrganizationId;
   const enabled = config?.organizations === true && isSignedIn;
-  const [organization, setOrganization] = React55.useState(null);
-  const [error, setError] = React55.useState(null);
-  const [wasRemoved, setWasRemoved] = React55.useState(false);
-  const [section, setSection] = React55.useState(defaultSection);
-  const requestRef = React55.useRef(0);
-  const load = React55.useCallback(async () => {
+  const [organization, setOrganization] = React56.useState(null);
+  const [error, setError] = React56.useState(null);
+  const [wasRemoved, setWasRemoved] = React56.useState(false);
+  const [section, setSection] = React56.useState(defaultSection);
+  const requestRef = React56.useRef(0);
+  const load = React56.useCallback(async () => {
     const token = ++requestRef.current;
     if (!enabled || !requestedId) {
       setOrganization(null);
@@ -7895,7 +7968,7 @@ function OrganizationProfile({ organizationId, defaultSection = "general", onDel
       if (token === requestRef.current) setError(t("organization.profile.loadError"));
     }
   }, [enabled, requestedId, t, toServerError]);
-  React55.useEffect(() => {
+  React56.useEffect(() => {
     setOrganization(null);
     setError(null);
     setWasRemoved(false);
@@ -7949,7 +8022,7 @@ function OrganizationProfile({ organizationId, defaultSection = "general", onDel
       /* @__PURE__ */ (0, import_jsx_runtime61.jsxs)("div", { className: "ba-organization-profile-content", children: [
         activeSection === "general" && /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(GeneralSection, { organization, canManage, onChanged: load }),
         activeSection === "members" && /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(MembersSection, { organization, userId: user.id, canManage, onChanged: load }),
-        activeSection === "teams" && /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(React55.Suspense, { fallback: null, children: /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(TeamsSection2, { organization, membership }) }),
+        activeSection === "teams" && /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(React56.Suspense, { fallback: null, children: /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(TeamsSection2, { organization, membership }) }),
         activeSection === "invitations" && /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(InvitationsSection, { organization, onChanged: load }),
         activeSection === "danger" && /* @__PURE__ */ (0, import_jsx_runtime61.jsx)(
           DangerSection,
@@ -7978,15 +8051,15 @@ function OrganizationSwitcher({ showPersonalWorkspace = true, onOrganizationChan
   const enabled = config?.organizations === true && isSignedIn;
   const { organizations, isLoading, error: loadError, refresh } = useOrganizationsResource(enabled);
   const { pending, error, run } = useSubmitAction();
-  const [open, setOpen] = React56.useState(false);
-  const [dialog, setDialog] = React56.useState(null);
-  const rootRef = React56.useRef(null);
-  const triggerRef = React56.useRef(null);
-  const menuRef = React56.useRef(null);
-  const menuId = React56.useId();
+  const [open, setOpen] = React57.useState(false);
+  const [dialog, setDialog] = React57.useState(null);
+  const rootRef = React57.useRef(null);
+  const triggerRef = React57.useRef(null);
+  const menuRef = React57.useRef(null);
+  const menuId = React57.useId();
   const activeId = session.data?.session.activeOrganizationId ?? null;
   const active = organizations?.find((organization) => organization.id === activeId) ?? null;
-  React56.useEffect(() => {
+  React57.useEffect(() => {
     if (!open) return;
     const onPointerDown = (event) => {
       if (!rootRef.current?.contains(event.target)) setOpen(false);
@@ -8123,7 +8196,7 @@ function OrganizationSwitcher({ showPersonalWorkspace = true, onOrganizationChan
 init_InvitationPrompt();
 
 // src/components/OrganizationList.tsx
-var React57 = __toESM(require("react"), 1);
+var React58 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 init_use_submit_action();
@@ -8136,19 +8209,19 @@ function OrganizationList({ onOrganizationChange } = {}) {
   const { user, isLoaded, isSignedIn } = useUser();
   const session = useSession();
   const api = useAuthClient().organization;
-  const apiRef = React57.useRef(api);
+  const apiRef = React58.useRef(api);
   apiRef.current = api;
   const enabled = config?.organizations === true && isSignedIn;
   const { organizations, isLoading, error: organizationError, refresh } = useOrganizationsResource(enabled);
   const { pending, error, run } = useSubmitAction();
-  const [invitations, setInvitations] = React57.useState(null);
-  const [invitationError, setInvitationError] = React57.useState(null);
-  const [dialog, setDialog] = React57.useState(null);
-  const [profileId, setProfileId] = React57.useState(null);
-  const dialogReturnFocusRef = React57.useRef(null);
-  const invitationRequestRef = React57.useRef(0);
+  const [invitations, setInvitations] = React58.useState(null);
+  const [invitationError, setInvitationError] = React58.useState(null);
+  const [dialog, setDialog] = React58.useState(null);
+  const [profileId, setProfileId] = React58.useState(null);
+  const dialogReturnFocusRef = React58.useRef(null);
+  const invitationRequestRef = React58.useRef(0);
   const activeId = session.data?.session.activeOrganizationId ?? null;
-  const loadInvitations = React57.useCallback(async () => {
+  const loadInvitations = React58.useCallback(async () => {
     const token = ++invitationRequestRef.current;
     if (!enabled) {
       setInvitations([]);
@@ -8168,7 +8241,7 @@ function OrganizationList({ onOrganizationChange } = {}) {
       if (token === invitationRequestRef.current) setInvitationError(t("organization.list.invitationsError"));
     }
   }, [enabled, t, toServerError]);
-  React57.useEffect(() => {
+  React58.useEffect(() => {
     setInvitations(null);
     setInvitationError(null);
     if (!isLoaded) return;
@@ -8284,7 +8357,7 @@ function OrganizationList({ onOrganizationChange } = {}) {
 }
 
 // src/components/GoogleOneTap.tsx
-var React58 = __toESM(require("react"), 1);
+var React59 = __toESM(require("react"), 1);
 init_hooks();
 
 // src/components/google-one-tap.ts
@@ -8434,6 +8507,14 @@ function normalizeDismissReason(reason) {
   }
   return "unknown";
 }
+var warnedMissingNonce = /* @__PURE__ */ new Set();
+function warnOneTapWithoutNonce(clientId) {
+  if (warnedMissingNonce.has(clientId)) return;
+  warnedMissingNonce.add(clientId);
+  console.warn(
+    "[AuthOwl] <GoogleOneTap/> is running without a `nonce`. Google\u2019s ID token is then not bound to a value chosen for this prompt. Generate a fresh random value per prompt and pass it as `nonce`; AuthOwl forwards it to Google and verifies the match. The direct browser exchange does not keep separate one-time server state, so do not treat this prop by itself as replay protection. (This warning is dev-only.)"
+  );
+}
 function GoogleOneTap({
   disabled = false,
   nonce,
@@ -8453,11 +8534,16 @@ function GoogleOneTap({
   const { config, isLoading: configLoading, isError: configError } = usePublicConfig();
   const { user, isLoaded: sessionLoaded } = useUser();
   const { signInSocial } = useSignIn();
-  const callbacks = React58.useRef({ onSignedIn, onSkipped, onDismissed, onError });
+  const callbacks = React59.useRef({ onSignedIn, onSkipped, onDismissed, onError });
   callbacks.current = { onSignedIn, onSkipped, onDismissed, onError };
   const googleEnabled = config?.socialProviders.includes("google") === true;
   const clientId = config?.socialProviderClientIds?.google;
-  React58.useEffect(() => {
+  React59.useEffect(() => {
+    if (process.env.NODE_ENV === "production") return;
+    if (disabled || !googleEnabled || !clientId || nonce) return;
+    warnOneTapWithoutNonce(clientId);
+  }, [clientId, disabled, googleEnabled, nonce]);
+  React59.useEffect(() => {
     if (configLoading || !sessionLoaded) return;
     if (disabled) {
       callbacks.current.onSkipped?.("disabled");
@@ -8573,8 +8659,9 @@ function GoogleOneTap({
 }
 
 // src/index.ts
-var import_core7 = require("@authowl/core");
 var import_core8 = require("@authowl/core");
+var import_core9 = require("@authowl/core");
+init_last_used_method();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthLoaded,
@@ -8633,6 +8720,7 @@ var import_core8 = require("@authowl/core");
   useConsent,
   useEmailVerification,
   useInvitationRecipientHint,
+  useLastUsedSignInMethod,
   useLocale,
   useMFA,
   useOrganization,