@luxfi/ui 7.4.2 → 7.4.4

package/dist/badge.cjs

@@ -270,8 +270,8 @@ var Tooltip = React3__namespace.forwardRef(
       }, nextOpen ? openDelay : closeDelay);
     }, [closeDelay, openDelay, onOpenChange]);
     const handleClickAway = React3__namespace.useCallback(() => {
-      handleOpenChangeManual(false);
-    }, [handleOpenChangeManual]);
+      if (open) handleOpenChangeManual(false);
+    }, [open, handleOpenChangeManual]);
     const triggerRef = usehooks.useClickAway(handleClickAway);
     const handleTriggerClick = React3__namespace.useCallback(() => {
       handleOpenChangeManual(!open);
@@ -311,7 +311,7 @@ var Tooltip = React3__namespace.forwardRef(
           /* @__PURE__ */ jsxRuntime.jsx(
             gui.Tooltip.Trigger,
             {
-              ref: open ? triggerRef : void 0,
+              ref: triggerRef,
               asChild: true,
               ...isMobile ? { onPress: handleTriggerClick } : {},
               ...triggerProps,

package/dist/badge.js

@@ -249,8 +249,8 @@ var Tooltip = React3.forwardRef(
       }, nextOpen ? openDelay : closeDelay);
     }, [closeDelay, openDelay, onOpenChange]);
     const handleClickAway = React3.useCallback(() => {
-      handleOpenChangeManual(false);
-    }, [handleOpenChangeManual]);
+      if (open) handleOpenChangeManual(false);
+    }, [open, handleOpenChangeManual]);
     const triggerRef = useClickAway(handleClickAway);
     const handleTriggerClick = React3.useCallback(() => {
       handleOpenChangeManual(!open);
@@ -290,7 +290,7 @@ var Tooltip = React3.forwardRef(
           /* @__PURE__ */ jsx(
             Tooltip$1.Trigger,
             {
-              ref: open ? triggerRef : void 0,
+              ref: triggerRef,
               asChild: true,
               ...isMobile ? { onPress: handleTriggerClick } : {},
               ...triggerProps,

package/dist/chrome.cjs

@@ -302,10 +302,17 @@ var ORGS = {
     org: "zoo",
     name: "Zoo",
     domain: "zoo.ngo",
-    // Zoo's IdP is `id.zoo.network`, not a `zoo.id` apex — the one row in this
-    // table where the issuer is not `<org>.id`, and the one every hand-rolled
-    // per-app branding map got wrong.
-    iamDomain: "id.zoo.network",
+    // Zoo's issuer is `zoolabs.id` — the one row where it is not `<org>.id`,
+    // and the one every hand-rolled branding map gets wrong. `id.zoo.network`
+    // ANSWERS, which is why it keeps being copied around, but it is an alias:
+    // its own discovery document advertises
+    //   issuer                  https://zoolabs.id
+    //   authorization_endpoint  https://zoolabs.id/v1/iam/oauth/authorize
+    //   jwks_uri                https://zoolabs.id/v1/iam/.well-known/jwks
+    // so a client configured on the alias validates `iss` against a string the
+    // IdP never emits and rejects every token it is given — the exact shape of
+    // the lux.id outage. `zoo.id` is not an IdP at all (no discovery document).
+    iamDomain: "zoolabs.id",
     accent: LUX_BRAND.zoo,
     accentForeground: "#FFFFFF"
   },
@@ -339,15 +346,18 @@ var DOMAIN_ORG = [
   ["lux.cloud", "lux"],
   ["lux.id", "lux"],
   ["lux.finance", "lux"],
+  ["lux.market", "lux"],
+  ["lux.exchange", "lux"],
   ["zoo.ngo", "zoo"],
   ["zoo.network", "zoo"],
   ["zoo.cloud", "zoo"],
-  ["zoo.id", "zoo"],
+  ["zoolabs.id", "zoo"],
   ["hanzo.ai", "hanzo"],
   ["hanzo.cloud", "hanzo"],
   ["hanzo.id", "hanzo"],
-  ["pars.id", "pars"],
-  ["parsdao.org", "pars"],
+  ["pars.id", "pars", "app"],
+  ["pars.network", "pars", "app"],
+  ["parsdao.org", "pars", "app"],
   ["bootno.de", "bootnode", "platform"]
 ];
 var DEFAULT_ORG = "lux";
@@ -367,11 +377,11 @@ function matchDomain(host) {
   }
   return best;
 }
-function appSlug(host, domain, apexApp) {
+function appSlug(host, domain, pinned) {
+  if (pinned) return pinned;
   const sub = host === domain ? "" : host.slice(0, -(domain.length + 1));
   const leftmost = sub.split(".")[0] ?? "";
   if (leftmost && leftmost !== "www") return leftmost;
-  if (apexApp) return apexApp;
   const label = domain.split(".")[0] ?? "";
   const tld = domain.split(".").slice(1).join(".");
   return tld.split(".")[0] || label;

package/dist/chrome.js

@@ -279,10 +279,17 @@ var ORGS = {
     org: "zoo",
     name: "Zoo",
     domain: "zoo.ngo",
-    // Zoo's IdP is `id.zoo.network`, not a `zoo.id` apex — the one row in this
-    // table where the issuer is not `<org>.id`, and the one every hand-rolled
-    // per-app branding map got wrong.
-    iamDomain: "id.zoo.network",
+    // Zoo's issuer is `zoolabs.id` — the one row where it is not `<org>.id`,
+    // and the one every hand-rolled branding map gets wrong. `id.zoo.network`
+    // ANSWERS, which is why it keeps being copied around, but it is an alias:
+    // its own discovery document advertises
+    //   issuer                  https://zoolabs.id
+    //   authorization_endpoint  https://zoolabs.id/v1/iam/oauth/authorize
+    //   jwks_uri                https://zoolabs.id/v1/iam/.well-known/jwks
+    // so a client configured on the alias validates `iss` against a string the
+    // IdP never emits and rejects every token it is given — the exact shape of
+    // the lux.id outage. `zoo.id` is not an IdP at all (no discovery document).
+    iamDomain: "zoolabs.id",
     accent: LUX_BRAND.zoo,
     accentForeground: "#FFFFFF"
   },
@@ -316,15 +323,18 @@ var DOMAIN_ORG = [
   ["lux.cloud", "lux"],
   ["lux.id", "lux"],
   ["lux.finance", "lux"],
+  ["lux.market", "lux"],
+  ["lux.exchange", "lux"],
   ["zoo.ngo", "zoo"],
   ["zoo.network", "zoo"],
   ["zoo.cloud", "zoo"],
-  ["zoo.id", "zoo"],
+  ["zoolabs.id", "zoo"],
   ["hanzo.ai", "hanzo"],
   ["hanzo.cloud", "hanzo"],
   ["hanzo.id", "hanzo"],
-  ["pars.id", "pars"],
-  ["parsdao.org", "pars"],
+  ["pars.id", "pars", "app"],
+  ["pars.network", "pars", "app"],
+  ["parsdao.org", "pars", "app"],
   ["bootno.de", "bootnode", "platform"]
 ];
 var DEFAULT_ORG = "lux";
@@ -344,11 +354,11 @@ function matchDomain(host) {
   }
   return best;
 }
-function appSlug(host, domain, apexApp) {
+function appSlug(host, domain, pinned) {
+  if (pinned) return pinned;
   const sub = host === domain ? "" : host.slice(0, -(domain.length + 1));
   const leftmost = sub.split(".")[0] ?? "";
   if (leftmost && leftmost !== "www") return leftmost;
-  if (apexApp) return apexApp;
   const label = domain.split(".")[0] ?? "";
   const tld = domain.split(".").slice(1).join(".");
   return tld.split(".")[0] || label;

package/dist/iam.cjs

@@ -20,10 +20,17 @@ var ORGS = {
     org: "zoo",
     name: "Zoo",
     domain: "zoo.ngo",
-    // Zoo's IdP is `id.zoo.network`, not a `zoo.id` apex — the one row in this
-    // table where the issuer is not `<org>.id`, and the one every hand-rolled
-    // per-app branding map got wrong.
-    iamDomain: "id.zoo.network",
+    // Zoo's issuer is `zoolabs.id` — the one row where it is not `<org>.id`,
+    // and the one every hand-rolled branding map gets wrong. `id.zoo.network`
+    // ANSWERS, which is why it keeps being copied around, but it is an alias:
+    // its own discovery document advertises
+    //   issuer                  https://zoolabs.id
+    //   authorization_endpoint  https://zoolabs.id/v1/iam/oauth/authorize
+    //   jwks_uri                https://zoolabs.id/v1/iam/.well-known/jwks
+    // so a client configured on the alias validates `iss` against a string the
+    // IdP never emits and rejects every token it is given — the exact shape of
+    // the lux.id outage. `zoo.id` is not an IdP at all (no discovery document).
+    iamDomain: "zoolabs.id",
     accent: LUX_BRAND.zoo,
     accentForeground: "#FFFFFF"
   },
@@ -57,15 +64,18 @@ var DOMAIN_ORG = [
   ["lux.cloud", "lux"],
   ["lux.id", "lux"],
   ["lux.finance", "lux"],
+  ["lux.market", "lux"],
+  ["lux.exchange", "lux"],
   ["zoo.ngo", "zoo"],
   ["zoo.network", "zoo"],
   ["zoo.cloud", "zoo"],
-  ["zoo.id", "zoo"],
+  ["zoolabs.id", "zoo"],
   ["hanzo.ai", "hanzo"],
   ["hanzo.cloud", "hanzo"],
   ["hanzo.id", "hanzo"],
-  ["pars.id", "pars"],
-  ["parsdao.org", "pars"],
+  ["pars.id", "pars", "app"],
+  ["pars.network", "pars", "app"],
+  ["parsdao.org", "pars", "app"],
   ["bootno.de", "bootnode", "platform"]
 ];
 var DEFAULT_ORG = "lux";
@@ -85,11 +95,11 @@ function matchDomain(host) {
   }
   return best;
 }
-function appSlug(host, domain, apexApp) {
+function appSlug(host, domain, pinned) {
+  if (pinned) return pinned;
   const sub = host === domain ? "" : host.slice(0, -(domain.length + 1));
   const leftmost = sub.split(".")[0] ?? "";
   if (leftmost && leftmost !== "www") return leftmost;
-  if (apexApp) return apexApp;
   const label = domain.split(".")[0] ?? "";
   const tld = domain.split(".").slice(1).join(".");
   return tld.split(".")[0] || label;
@@ -124,7 +134,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/iam.js

@@ -18,10 +18,17 @@ var ORGS = {
     org: "zoo",
     name: "Zoo",
     domain: "zoo.ngo",
-    // Zoo's IdP is `id.zoo.network`, not a `zoo.id` apex — the one row in this
-    // table where the issuer is not `<org>.id`, and the one every hand-rolled
-    // per-app branding map got wrong.
-    iamDomain: "id.zoo.network",
+    // Zoo's issuer is `zoolabs.id` — the one row where it is not `<org>.id`,
+    // and the one every hand-rolled branding map gets wrong. `id.zoo.network`
+    // ANSWERS, which is why it keeps being copied around, but it is an alias:
+    // its own discovery document advertises
+    //   issuer                  https://zoolabs.id
+    //   authorization_endpoint  https://zoolabs.id/v1/iam/oauth/authorize
+    //   jwks_uri                https://zoolabs.id/v1/iam/.well-known/jwks
+    // so a client configured on the alias validates `iss` against a string the
+    // IdP never emits and rejects every token it is given — the exact shape of
+    // the lux.id outage. `zoo.id` is not an IdP at all (no discovery document).
+    iamDomain: "zoolabs.id",
     accent: LUX_BRAND.zoo,
     accentForeground: "#FFFFFF"
   },
@@ -55,15 +62,18 @@ var DOMAIN_ORG = [
   ["lux.cloud", "lux"],
   ["lux.id", "lux"],
   ["lux.finance", "lux"],
+  ["lux.market", "lux"],
+  ["lux.exchange", "lux"],
   ["zoo.ngo", "zoo"],
   ["zoo.network", "zoo"],
   ["zoo.cloud", "zoo"],
-  ["zoo.id", "zoo"],
+  ["zoolabs.id", "zoo"],
   ["hanzo.ai", "hanzo"],
   ["hanzo.cloud", "hanzo"],
   ["hanzo.id", "hanzo"],
-  ["pars.id", "pars"],
-  ["parsdao.org", "pars"],
+  ["pars.id", "pars", "app"],
+  ["pars.network", "pars", "app"],
+  ["parsdao.org", "pars", "app"],
   ["bootno.de", "bootnode", "platform"]
 ];
 var DEFAULT_ORG = "lux";
@@ -83,11 +93,11 @@ function matchDomain(host) {
   }
   return best;
 }
-function appSlug(host, domain, apexApp) {
+function appSlug(host, domain, pinned) {
+  if (pinned) return pinned;
   const sub = host === domain ? "" : host.slice(0, -(domain.length + 1));
   const leftmost = sub.split(".")[0] ?? "";
   if (leftmost && leftmost !== "www") return leftmost;
-  if (apexApp) return apexApp;
   const label = domain.split(".")[0] ?? "";
   const tld = domain.split(".").slice(1).join(".");
   return tld.split(".")[0] || label;
@@ -122,7 +132,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/identity.cjs

@@ -46,10 +46,17 @@ var ORGS = {
     org: "zoo",
     name: "Zoo",
     domain: "zoo.ngo",
-    // Zoo's IdP is `id.zoo.network`, not a `zoo.id` apex — the one row in this
-    // table where the issuer is not `<org>.id`, and the one every hand-rolled
-    // per-app branding map got wrong.
-    iamDomain: "id.zoo.network",
+    // Zoo's issuer is `zoolabs.id` — the one row where it is not `<org>.id`,
+    // and the one every hand-rolled branding map gets wrong. `id.zoo.network`
+    // ANSWERS, which is why it keeps being copied around, but it is an alias:
+    // its own discovery document advertises
+    //   issuer                  https://zoolabs.id
+    //   authorization_endpoint  https://zoolabs.id/v1/iam/oauth/authorize
+    //   jwks_uri                https://zoolabs.id/v1/iam/.well-known/jwks
+    // so a client configured on the alias validates `iss` against a string the
+    // IdP never emits and rejects every token it is given — the exact shape of
+    // the lux.id outage. `zoo.id` is not an IdP at all (no discovery document).
+    iamDomain: "zoolabs.id",
     accent: LUX_BRAND.zoo,
     accentForeground: "#FFFFFF"
   },
@@ -83,15 +90,18 @@ var DOMAIN_ORG = [
   ["lux.cloud", "lux"],
   ["lux.id", "lux"],
   ["lux.finance", "lux"],
+  ["lux.market", "lux"],
+  ["lux.exchange", "lux"],
   ["zoo.ngo", "zoo"],
   ["zoo.network", "zoo"],
   ["zoo.cloud", "zoo"],
-  ["zoo.id", "zoo"],
+  ["zoolabs.id", "zoo"],
   ["hanzo.ai", "hanzo"],
   ["hanzo.cloud", "hanzo"],
   ["hanzo.id", "hanzo"],
-  ["pars.id", "pars"],
-  ["parsdao.org", "pars"],
+  ["pars.id", "pars", "app"],
+  ["pars.network", "pars", "app"],
+  ["parsdao.org", "pars", "app"],
   ["bootno.de", "bootnode", "platform"]
 ];
 var DEFAULT_ORG = "lux";
@@ -111,11 +121,11 @@ function matchDomain(host) {
   }
   return best;
 }
-function appSlug(host, domain, apexApp) {
+function appSlug(host, domain, pinned) {
+  if (pinned) return pinned;
   const sub = host === domain ? "" : host.slice(0, -(domain.length + 1));
   const leftmost = sub.split(".")[0] ?? "";
   if (leftmost && leftmost !== "www") return leftmost;
-  if (apexApp) return apexApp;
   const label = domain.split(".")[0] ?? "";
   const tld = domain.split(".").slice(1).join(".");
   return tld.split(".")[0] || label;
@@ -150,7 +160,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/identity.js

@@ -25,10 +25,17 @@ var ORGS = {
     org: "zoo",
     name: "Zoo",
     domain: "zoo.ngo",
-    // Zoo's IdP is `id.zoo.network`, not a `zoo.id` apex — the one row in this
-    // table where the issuer is not `<org>.id`, and the one every hand-rolled
-    // per-app branding map got wrong.
-    iamDomain: "id.zoo.network",
+    // Zoo's issuer is `zoolabs.id` — the one row where it is not `<org>.id`,
+    // and the one every hand-rolled branding map gets wrong. `id.zoo.network`
+    // ANSWERS, which is why it keeps being copied around, but it is an alias:
+    // its own discovery document advertises
+    //   issuer                  https://zoolabs.id
+    //   authorization_endpoint  https://zoolabs.id/v1/iam/oauth/authorize
+    //   jwks_uri                https://zoolabs.id/v1/iam/.well-known/jwks
+    // so a client configured on the alias validates `iss` against a string the
+    // IdP never emits and rejects every token it is given — the exact shape of
+    // the lux.id outage. `zoo.id` is not an IdP at all (no discovery document).
+    iamDomain: "zoolabs.id",
     accent: LUX_BRAND.zoo,
     accentForeground: "#FFFFFF"
   },
@@ -62,15 +69,18 @@ var DOMAIN_ORG = [
   ["lux.cloud", "lux"],
   ["lux.id", "lux"],
   ["lux.finance", "lux"],
+  ["lux.market", "lux"],
+  ["lux.exchange", "lux"],
   ["zoo.ngo", "zoo"],
   ["zoo.network", "zoo"],
   ["zoo.cloud", "zoo"],
-  ["zoo.id", "zoo"],
+  ["zoolabs.id", "zoo"],
   ["hanzo.ai", "hanzo"],
   ["hanzo.cloud", "hanzo"],
   ["hanzo.id", "hanzo"],
-  ["pars.id", "pars"],
-  ["parsdao.org", "pars"],
+  ["pars.id", "pars", "app"],
+  ["pars.network", "pars", "app"],
+  ["parsdao.org", "pars", "app"],
   ["bootno.de", "bootnode", "platform"]
 ];
 var DEFAULT_ORG = "lux";
@@ -90,11 +100,11 @@ function matchDomain(host) {
   }
   return best;
 }
-function appSlug(host, domain, apexApp) {
+function appSlug(host, domain, pinned) {
+  if (pinned) return pinned;
   const sub = host === domain ? "" : host.slice(0, -(domain.length + 1));
   const leftmost = sub.split(".")[0] ?? "";
   if (leftmost && leftmost !== "www") return leftmost;
-  if (apexApp) return apexApp;
   const label = domain.split(".")[0] ?? "";
   const tld = domain.split(".").slice(1).join(".");
   return tld.split(".")[0] || label;
@@ -129,7 +139,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/index.cjs

@@ -74,10 +74,17 @@ var ORGS = {
     org: "zoo",
     name: "Zoo",
     domain: "zoo.ngo",
-    // Zoo's IdP is `id.zoo.network`, not a `zoo.id` apex — the one row in this
-    // table where the issuer is not `<org>.id`, and the one every hand-rolled
-    // per-app branding map got wrong.
-    iamDomain: "id.zoo.network",
+    // Zoo's issuer is `zoolabs.id` — the one row where it is not `<org>.id`,
+    // and the one every hand-rolled branding map gets wrong. `id.zoo.network`
+    // ANSWERS, which is why it keeps being copied around, but it is an alias:
+    // its own discovery document advertises
+    //   issuer                  https://zoolabs.id
+    //   authorization_endpoint  https://zoolabs.id/v1/iam/oauth/authorize
+    //   jwks_uri                https://zoolabs.id/v1/iam/.well-known/jwks
+    // so a client configured on the alias validates `iss` against a string the
+    // IdP never emits and rejects every token it is given — the exact shape of
+    // the lux.id outage. `zoo.id` is not an IdP at all (no discovery document).
+    iamDomain: "zoolabs.id",
     accent: LUX_BRAND.zoo,
     accentForeground: "#FFFFFF"
   },
@@ -111,15 +118,18 @@ var DOMAIN_ORG = [
   ["lux.cloud", "lux"],
   ["lux.id", "lux"],
   ["lux.finance", "lux"],
+  ["lux.market", "lux"],
+  ["lux.exchange", "lux"],
   ["zoo.ngo", "zoo"],
   ["zoo.network", "zoo"],
   ["zoo.cloud", "zoo"],
-  ["zoo.id", "zoo"],
+  ["zoolabs.id", "zoo"],
   ["hanzo.ai", "hanzo"],
   ["hanzo.cloud", "hanzo"],
   ["hanzo.id", "hanzo"],
-  ["pars.id", "pars"],
-  ["parsdao.org", "pars"],
+  ["pars.id", "pars", "app"],
+  ["pars.network", "pars", "app"],
+  ["parsdao.org", "pars", "app"],
   ["bootno.de", "bootnode", "platform"]
 ];
 var DEFAULT_ORG = "lux";
@@ -139,11 +149,11 @@ function matchDomain(host) {
   }
   return best;
 }
-function appSlug(host, domain, apexApp) {
+function appSlug(host, domain, pinned) {
+  if (pinned) return pinned;
   const sub = host === domain ? "" : host.slice(0, -(domain.length + 1));
   const leftmost = sub.split(".")[0] ?? "";
   if (leftmost && leftmost !== "www") return leftmost;
-  if (apexApp) return apexApp;
   const label = domain.split(".")[0] ?? "";
   const tld = domain.split(".").slice(1).join(".");
   return tld.split(".")[0] || label;
@@ -278,7 +288,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);
@@ -1925,8 +1935,8 @@ var Tooltip = React33__namespace.forwardRef(
       }, nextOpen ? openDelay : closeDelay);
     }, [closeDelay, openDelay, onOpenChange]);
     const handleClickAway = React33__namespace.useCallback(() => {
-      handleOpenChangeManual(false);
-    }, [handleOpenChangeManual]);
+      if (open) handleOpenChangeManual(false);
+    }, [open, handleOpenChangeManual]);
     const triggerRef = usehooks.useClickAway(handleClickAway);
     const handleTriggerClick = React33__namespace.useCallback(() => {
       handleOpenChangeManual(!open);
@@ -1966,7 +1976,7 @@ var Tooltip = React33__namespace.forwardRef(
           /* @__PURE__ */ jsxRuntime.jsx(
             gui.Tooltip.Trigger,
             {
-              ref: open ? triggerRef : void 0,
+              ref: triggerRef,
               asChild: true,
               ...isMobile ? { onPress: handleTriggerClick } : {},
               ...triggerProps,

package/dist/index.js

@@ -46,10 +46,17 @@ var ORGS = {
     org: "zoo",
     name: "Zoo",
     domain: "zoo.ngo",
-    // Zoo's IdP is `id.zoo.network`, not a `zoo.id` apex — the one row in this
-    // table where the issuer is not `<org>.id`, and the one every hand-rolled
-    // per-app branding map got wrong.
-    iamDomain: "id.zoo.network",
+    // Zoo's issuer is `zoolabs.id` — the one row where it is not `<org>.id`,
+    // and the one every hand-rolled branding map gets wrong. `id.zoo.network`
+    // ANSWERS, which is why it keeps being copied around, but it is an alias:
+    // its own discovery document advertises
+    //   issuer                  https://zoolabs.id
+    //   authorization_endpoint  https://zoolabs.id/v1/iam/oauth/authorize
+    //   jwks_uri                https://zoolabs.id/v1/iam/.well-known/jwks
+    // so a client configured on the alias validates `iss` against a string the
+    // IdP never emits and rejects every token it is given — the exact shape of
+    // the lux.id outage. `zoo.id` is not an IdP at all (no discovery document).
+    iamDomain: "zoolabs.id",
     accent: LUX_BRAND.zoo,
     accentForeground: "#FFFFFF"
   },
@@ -83,15 +90,18 @@ var DOMAIN_ORG = [
   ["lux.cloud", "lux"],
   ["lux.id", "lux"],
   ["lux.finance", "lux"],
+  ["lux.market", "lux"],
+  ["lux.exchange", "lux"],
   ["zoo.ngo", "zoo"],
   ["zoo.network", "zoo"],
   ["zoo.cloud", "zoo"],
-  ["zoo.id", "zoo"],
+  ["zoolabs.id", "zoo"],
   ["hanzo.ai", "hanzo"],
   ["hanzo.cloud", "hanzo"],
   ["hanzo.id", "hanzo"],
-  ["pars.id", "pars"],
-  ["parsdao.org", "pars"],
+  ["pars.id", "pars", "app"],
+  ["pars.network", "pars", "app"],
+  ["parsdao.org", "pars", "app"],
   ["bootno.de", "bootnode", "platform"]
 ];
 var DEFAULT_ORG = "lux";
@@ -111,11 +121,11 @@ function matchDomain(host) {
   }
   return best;
 }
-function appSlug(host, domain, apexApp) {
+function appSlug(host, domain, pinned) {
+  if (pinned) return pinned;
   const sub = host === domain ? "" : host.slice(0, -(domain.length + 1));
   const leftmost = sub.split(".")[0] ?? "";
   if (leftmost && leftmost !== "www") return leftmost;
-  if (apexApp) return apexApp;
   const label = domain.split(".")[0] ?? "";
   const tld = domain.split(".").slice(1).join(".");
   return tld.split(".")[0] || label;
@@ -250,7 +260,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);
@@ -1897,8 +1907,8 @@ var Tooltip = React33.forwardRef(
       }, nextOpen ? openDelay : closeDelay);
     }, [closeDelay, openDelay, onOpenChange]);
     const handleClickAway = React33.useCallback(() => {
-      handleOpenChangeManual(false);
-    }, [handleOpenChangeManual]);
+      if (open) handleOpenChangeManual(false);
+    }, [open, handleOpenChangeManual]);
     const triggerRef = useClickAway(handleClickAway);
     const handleTriggerClick = React33.useCallback(() => {
       handleOpenChangeManual(!open);
@@ -1938,7 +1948,7 @@ var Tooltip = React33.forwardRef(
           /* @__PURE__ */ jsx(
             Tooltip$1.Trigger,
             {
-              ref: open ? triggerRef : void 0,
+              ref: triggerRef,
               asChild: true,
               ...isMobile ? { onPress: handleTriggerClick } : {},
               ...triggerProps,