@luxfi/ui 7.4.2 → 7.4.4

package/dist/white-label.cjs

@@ -24,10 +24,17 @@ var ORGS = {
     org: "zoo",
     name: "Zoo",
     domain: "zoo.ngo",
-    // Zoo's IdP is `id.zoo.network`, not a `zoo.id` apex — the one row in this
-    // table where the issuer is not `<org>.id`, and the one every hand-rolled
-    // per-app branding map got wrong.
-    iamDomain: "id.zoo.network",
+    // Zoo's issuer is `zoolabs.id` — the one row where it is not `<org>.id`,
+    // and the one every hand-rolled branding map gets wrong. `id.zoo.network`
+    // ANSWERS, which is why it keeps being copied around, but it is an alias:
+    // its own discovery document advertises
+    //   issuer                  https://zoolabs.id
+    //   authorization_endpoint  https://zoolabs.id/v1/iam/oauth/authorize
+    //   jwks_uri                https://zoolabs.id/v1/iam/.well-known/jwks
+    // so a client configured on the alias validates `iss` against a string the
+    // IdP never emits and rejects every token it is given — the exact shape of
+    // the lux.id outage. `zoo.id` is not an IdP at all (no discovery document).
+    iamDomain: "zoolabs.id",
     accent: LUX_BRAND.zoo,
     accentForeground: "#FFFFFF"
   },
@@ -61,15 +68,18 @@ var DOMAIN_ORG = [
   ["lux.cloud", "lux"],
   ["lux.id", "lux"],
   ["lux.finance", "lux"],
+  ["lux.market", "lux"],
+  ["lux.exchange", "lux"],
   ["zoo.ngo", "zoo"],
   ["zoo.network", "zoo"],
   ["zoo.cloud", "zoo"],
-  ["zoo.id", "zoo"],
+  ["zoolabs.id", "zoo"],
   ["hanzo.ai", "hanzo"],
   ["hanzo.cloud", "hanzo"],
   ["hanzo.id", "hanzo"],
-  ["pars.id", "pars"],
-  ["parsdao.org", "pars"],
+  ["pars.id", "pars", "app"],
+  ["pars.network", "pars", "app"],
+  ["parsdao.org", "pars", "app"],
   ["bootno.de", "bootnode", "platform"]
 ];
 var DEFAULT_ORG = "lux";
@@ -89,11 +99,11 @@ function matchDomain(host) {
   }
   return best;
 }
-function appSlug(host, domain, apexApp) {
+function appSlug(host, domain, pinned) {
+  if (pinned) return pinned;
   const sub = host === domain ? "" : host.slice(0, -(domain.length + 1));
   const leftmost = sub.split(".")[0] ?? "";
   if (leftmost && leftmost !== "www") return leftmost;
-  if (apexApp) return apexApp;
   const label = domain.split(".")[0] ?? "";
   const tld = domain.split(".").slice(1).join(".");
   return tld.split(".")[0] || label;

package/dist/white-label.d.cts

@@ -42,9 +42,9 @@ interface WhiteLabel extends OrgIdentity {
  * Pure and total: an unknown or missing host falls back to the Lux row rather
  * than throwing, so a preview URL or a health probe never blanks the UI.
  *
- *   resolveWhiteLabel('mpc.lux.cloud')  // org lux,  clientId lux-mpc,   issuer https://lux.id
- *   resolveWhiteLabel('zoo.network')    // org zoo,  clientId zoo-network, issuer https://zoo.id
- *   resolveWhiteLabel('id.pars.id')     // org pars, clientId pars-id,   issuer https://pars.id
+ *   resolveWhiteLabel('mpc.lux.network') // org lux,  clientId lux-mpc,   issuer https://lux.id
+ *   resolveWhiteLabel('zoo.cloud')       // org zoo,  clientId zoo-cloud, issuer https://zoolabs.id
+ *   resolveWhiteLabel('cloud.pars.network') // org pars, clientId pars-app, issuer https://pars.id
  */
 declare function resolveWhiteLabel(host?: string | null): WhiteLabel;
 /**

package/dist/white-label.d.ts

@@ -42,9 +42,9 @@ interface WhiteLabel extends OrgIdentity {
  * Pure and total: an unknown or missing host falls back to the Lux row rather
  * than throwing, so a preview URL or a health probe never blanks the UI.
  *
- *   resolveWhiteLabel('mpc.lux.cloud')  // org lux,  clientId lux-mpc,   issuer https://lux.id
- *   resolveWhiteLabel('zoo.network')    // org zoo,  clientId zoo-network, issuer https://zoo.id
- *   resolveWhiteLabel('id.pars.id')     // org pars, clientId pars-id,   issuer https://pars.id
+ *   resolveWhiteLabel('mpc.lux.network') // org lux,  clientId lux-mpc,   issuer https://lux.id
+ *   resolveWhiteLabel('zoo.cloud')       // org zoo,  clientId zoo-cloud, issuer https://zoolabs.id
+ *   resolveWhiteLabel('cloud.pars.network') // org pars, clientId pars-app, issuer https://pars.id
  */
 declare function resolveWhiteLabel(host?: string | null): WhiteLabel;
 /**

package/dist/white-label.js

@@ -22,10 +22,17 @@ var ORGS = {
     org: "zoo",
     name: "Zoo",
     domain: "zoo.ngo",
-    // Zoo's IdP is `id.zoo.network`, not a `zoo.id` apex — the one row in this
-    // table where the issuer is not `<org>.id`, and the one every hand-rolled
-    // per-app branding map got wrong.
-    iamDomain: "id.zoo.network",
+    // Zoo's issuer is `zoolabs.id` — the one row where it is not `<org>.id`,
+    // and the one every hand-rolled branding map gets wrong. `id.zoo.network`
+    // ANSWERS, which is why it keeps being copied around, but it is an alias:
+    // its own discovery document advertises
+    //   issuer                  https://zoolabs.id
+    //   authorization_endpoint  https://zoolabs.id/v1/iam/oauth/authorize
+    //   jwks_uri                https://zoolabs.id/v1/iam/.well-known/jwks
+    // so a client configured on the alias validates `iss` against a string the
+    // IdP never emits and rejects every token it is given — the exact shape of
+    // the lux.id outage. `zoo.id` is not an IdP at all (no discovery document).
+    iamDomain: "zoolabs.id",
     accent: LUX_BRAND.zoo,
     accentForeground: "#FFFFFF"
   },
@@ -59,15 +66,18 @@ var DOMAIN_ORG = [
   ["lux.cloud", "lux"],
   ["lux.id", "lux"],
   ["lux.finance", "lux"],
+  ["lux.market", "lux"],
+  ["lux.exchange", "lux"],
   ["zoo.ngo", "zoo"],
   ["zoo.network", "zoo"],
   ["zoo.cloud", "zoo"],
-  ["zoo.id", "zoo"],
+  ["zoolabs.id", "zoo"],
   ["hanzo.ai", "hanzo"],
   ["hanzo.cloud", "hanzo"],
   ["hanzo.id", "hanzo"],
-  ["pars.id", "pars"],
-  ["parsdao.org", "pars"],
+  ["pars.id", "pars", "app"],
+  ["pars.network", "pars", "app"],
+  ["parsdao.org", "pars", "app"],
   ["bootno.de", "bootnode", "platform"]
 ];
 var DEFAULT_ORG = "lux";
@@ -87,11 +97,11 @@ function matchDomain(host) {
   }
   return best;
 }
-function appSlug(host, domain, apexApp) {
+function appSlug(host, domain, pinned) {
+  if (pinned) return pinned;
   const sub = host === domain ? "" : host.slice(0, -(domain.length + 1));
   const leftmost = sub.split(".")[0] ?? "";
   if (leftmost && leftmost !== "www") return leftmost;
-  if (apexApp) return apexApp;
   const label = domain.split(".")[0] ?? "";
   const tld = domain.split(".").slice(1).join(".");
   return tld.split(".")[0] || label;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@luxfi/ui",
-  "version": "7.4.2",
+  "version": "7.4.4",
   "description": "Cross-platform DeFi UI components built on @hanzo/gui (Tamagui). Native mobile + web.",
   "type": "module",
   "license": "MIT",

package/src/engine.ts

@@ -0,0 +1,130 @@
+// The gui engine, named once.
+//
+// @hanzo/gui is a facade over ~55 `@hanzogui/*` packages, and several of them
+// (`popper`, `popover`, `core`, `floating`) publish React contexts at MODULE
+// scope. Two physical copies of such a package are two different context
+// objects, so a provider from copy A is invisible to a consumer from copy B and
+// the consumer silently falls back to the context's default value.
+//
+// That is not a theoretical hazard, it is the shape of the loudest bug this
+// package has shipped: `PopperAnchor` reads `refs` off the Popper context and
+// calls `refs.setReference(node)` from a ref callback with no guard, so when the
+// context is the empty default the browser logs
+//
+//     Cannot read properties of undefined (reading 'setReference')
+//
+// once per tooltip trigger, uncaught (it runs inside `startTransition`, so no
+// error boundary sees it). A page with a tooltip per table row logs it hundreds
+// of times. The gui engine itself diagnoses the same root cause out loud when
+// the duplication reaches its config lookup: "Can't find Hanzo GUI
+// configuration … due to having mis-matched versions of Hanzo GUI dependencies,
+// or bundlers somehow duplicating them."
+//
+// So the engine list is a VALUE, declared once here, and both bundler wrappers
+// (`@luxfi/ui/vite`, `@luxfi/ui/next`) dedupe against it. A consumer that uses
+// the wrapper cannot end up with two copies, and does not have to hand-write a
+// per-app `pnpm.overrides` block pinning three dozen packages to stop it.
+
+/** Every package `@hanzo/gui` re-exports — the engine, in full. */
+export const GUI_PACKAGES: ReadonlyArray<string> = [
+  '@hanzo/gui',
+  '@hanzogui/accordion',
+  '@hanzogui/adapt',
+  '@hanzogui/alert-dialog',
+  '@hanzogui/animate',
+  '@hanzogui/animate-presence',
+  '@hanzogui/avatar',
+  '@hanzogui/button',
+  '@hanzogui/card',
+  '@hanzogui/checkbox',
+  '@hanzogui/collapsible',
+  '@hanzogui/component-helpers',
+  '@hanzogui/compose-refs',
+  '@hanzogui/config',
+  '@hanzogui/context-menu',
+  '@hanzogui/core',
+  '@hanzogui/create-context',
+  '@hanzogui/create-menu',
+  '@hanzogui/dialog',
+  '@hanzogui/dismissable',
+  '@hanzogui/element',
+  '@hanzogui/elements',
+  '@hanzogui/floating',
+  '@hanzogui/focus-scope',
+  '@hanzogui/font-size',
+  '@hanzogui/form',
+  '@hanzogui/get-token',
+  '@hanzogui/group',
+  '@hanzogui/helpers',
+  '@hanzogui/image',
+  '@hanzogui/input',
+  '@hanzogui/label',
+  '@hanzogui/list-item',
+  '@hanzogui/menu',
+  '@hanzogui/popover',
+  '@hanzogui/popper',
+  '@hanzogui/portal',
+  '@hanzogui/progress',
+  '@hanzogui/radio-group',
+  '@hanzogui/react-native-media-driver',
+  '@hanzogui/remove-scroll',
+  '@hanzogui/scroll-view',
+  '@hanzogui/select',
+  '@hanzogui/separator',
+  '@hanzogui/shapes',
+  '@hanzogui/sheet',
+  '@hanzogui/slider',
+  '@hanzogui/spacer',
+  '@hanzogui/spinner',
+  '@hanzogui/stacks',
+  '@hanzogui/switch',
+  '@hanzogui/tabs',
+  '@hanzogui/text',
+  '@hanzogui/theme',
+  '@hanzogui/toast',
+  '@hanzogui/toggle-group',
+  '@hanzogui/tooltip',
+  '@hanzogui/use-controllable-state',
+  '@hanzogui/use-debounce',
+  '@hanzogui/use-force-update',
+  '@hanzogui/use-presence',
+  '@hanzogui/use-window-dimensions',
+  '@hanzogui/visually-hidden',
+  '@hanzogui/web',
+  '@hanzogui/z-index-stack',
+  '@luxfi/ui',
+];
+
+/**
+ * The engine branches on these at module scope; without them a browser bundle
+ * takes the native path.
+ */
+export const GUI_DEFINES: Readonly<Record<string, string>> = {
+  'process.env.EXPO_OS': JSON.stringify('web'),
+  'process.env.IS_WEB': JSON.stringify('true'),
+};
+
+/**
+ * Exact-match aliases pinning every engine package to ONE entry file, for
+ * bundlers that have no `dedupe` of their own (webpack).
+ *
+ * Keys carry webpack's `$` exact-match suffix so only the bare specifier is
+ * redirected — a deep import keeps resolving normally. Packages that are not
+ * physically installed are skipped rather than throwing: the list is the
+ * engine's full surface and no single app pulls all of it.
+ */
+export function guiAliases(from: string): Record<string, string> {
+  // Deferred so this module stays importable from a browser bundle (the
+  // wrappers are build-time only, but `engine.ts` is plain values).
+  const { createRequire } = require('node:module') as typeof import('node:module');
+  const require_ = createRequire(`${ from.replace(/\/?$/, '/') }noop.js`);
+  const alias: Record<string, string> = {};
+  for (const pkg of GUI_PACKAGES) {
+    try {
+      alias[`${ pkg }$`] = require_.resolve(pkg);
+    } catch {
+      // Not installed in this app — nothing to dedupe.
+    }
+  }
+  return alias;
+}

package/src/iam.ts

@@ -70,11 +70,25 @@ export class IamError extends Error {
   }
 }
 
-/** IAM answers 401, or 200 with a sign-in message. Both mean "no session". */
+/**
+ * "No session" — as opposed to "a session that may not do this".
+ *
+ * IAM says it two ways: 401, and (measured against lux.id) HTTP **200** with
+ * `{"status":"error","msg":"please sign in first"}`, which is what both a
+ * missing and a malformed bearer get. So the message has to be read, not just
+ * the status.
+ *
+ * 403 is deliberately NOT here. `get-organizations` answers 403 to an ordinary
+ * signed-in user — listing the tenant table is a super-admin read — and folding
+ * that into "signed out" logged the user out of the chrome: get-account had
+ * already succeeded, then the org read's 403 wiped the account and every
+ * switcher offered "Sign in" to somebody who was signed in. Forbidden means
+ * signed in and not allowed; the caller falls back to the org it can see.
+ */
 const SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 
 function isSignedOut(status: number, msg: string): boolean {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 
 /** The IAM API root for a host — `lux.cloud` → `https://lux.id/v1/iam`. */

package/src/identity.tsx

@@ -181,8 +181,12 @@ export const IdentityProvider = ({
           return;
         }
         setAccount(me);
-        // A member who cannot list the tenant table still has their OWN org:
-        // fall back to the one the account names rather than showing nothing.
+        // A member who cannot list the tenant table still has their OWN org.
+        // `get-organizations` is a super-admin read and answers 403 to everyone
+        // else (measured on lux.id with a real z@lux.network bearer), so this is
+        // the COMMON path, not an edge case: fall back to the org the account
+        // itself names rather than showing an empty switcher — or, worse,
+        // treating the refusal as "not signed in".
         const rows = await iam.organizations(call).catch((e: unknown) => {
           if (e instanceof IamError && !e.unauthenticated) return [ { owner: 'admin', name: me.owner } ];
           throw e;

package/src/next.ts

@@ -18,73 +18,7 @@
 // Node-only (a build-time module) and dependency-free: it takes and returns a
 // plain object, so it does not force `next` into anyone's type graph.
 
-/** Every package `@hanzo/gui` re-exports — the engine, in full. */
-const GUI_PACKAGES = [
-  '@hanzo/gui',
-  '@hanzogui/accordion',
-  '@hanzogui/adapt',
-  '@hanzogui/alert-dialog',
-  '@hanzogui/animate',
-  '@hanzogui/animate-presence',
-  '@hanzogui/avatar',
-  '@hanzogui/button',
-  '@hanzogui/card',
-  '@hanzogui/checkbox',
-  '@hanzogui/collapsible',
-  '@hanzogui/component-helpers',
-  '@hanzogui/compose-refs',
-  '@hanzogui/config',
-  '@hanzogui/context-menu',
-  '@hanzogui/core',
-  '@hanzogui/create-context',
-  '@hanzogui/create-menu',
-  '@hanzogui/dialog',
-  '@hanzogui/element',
-  '@hanzogui/elements',
-  '@hanzogui/font-size',
-  '@hanzogui/form',
-  '@hanzogui/group',
-  '@hanzogui/image',
-  '@hanzogui/input',
-  '@hanzogui/label',
-  '@hanzogui/list-item',
-  '@hanzogui/menu',
-  '@hanzogui/popover',
-  '@hanzogui/popper',
-  '@hanzogui/portal',
-  '@hanzogui/progress',
-  '@hanzogui/radio-group',
-  '@hanzogui/react-native-media-driver',
-  '@hanzogui/scroll-view',
-  '@hanzogui/select',
-  '@hanzogui/separator',
-  '@hanzogui/shapes',
-  '@hanzogui/sheet',
-  '@hanzogui/slider',
-  '@hanzogui/spacer',
-  '@hanzogui/spinner',
-  '@hanzogui/stacks',
-  '@hanzogui/switch',
-  '@hanzogui/tabs',
-  '@hanzogui/text',
-  '@hanzogui/theme',
-  '@hanzogui/toast',
-  '@hanzogui/toggle-group',
-  '@hanzogui/tooltip',
-  '@hanzogui/use-controllable-state',
-  '@hanzogui/use-debounce',
-  '@hanzogui/use-force-update',
-  '@hanzogui/use-window-dimensions',
-  '@hanzogui/visually-hidden',
-  '@hanzogui/web',
-  '@luxfi/ui',
-];
-
-/** The engine branches on these at module scope. */
-const DEFINES: Record<string, string> = {
-  'process.env.EXPO_OS': JSON.stringify('web'),
-  'process.env.IS_WEB': JSON.stringify('true'),
-};
+import { guiAliases, GUI_DEFINES, GUI_PACKAGES } from './engine';
 
 interface WebpackConfig {
   resolve?: { alias?: Record<string, unknown> };
@@ -94,6 +28,8 @@ interface WebpackConfig {
 
 /** The structural slice of a Next config this wrapper touches. */
 export interface LuxUiNextConfig {
+  /** App root, for resolving the engine's single copy. Defaults to `cwd`. */
+  dir?: string;
   transpilePackages?: Array<string>;
   turbopack?: { resolveAlias?: Record<string, string>; [key: string]: unknown };
   env?: Record<string, string>;
@@ -109,8 +45,16 @@ export interface LuxUiNextConfig {
  */
 export function withLuxUi(config: LuxUiNextConfig = {}): LuxUiNextConfig {
   const userWebpack = config.webpack;
+  // ONE physical copy of every engine package. Webpack has no `resolve.dedupe`,
+  // so the equivalent is an exact-match alias per package, resolved from the app
+  // root — see ./engine for why two copies is a crash and not a size problem.
+  const engine = guiAliases(config.dir ?? process.cwd());
+  // `dir` is OURS, not Next's — leaving it on the returned object makes Next
+  // print `Unrecognized key(s) in object: 'dir'` on every boot of every surface
+  // that passes it. Consume it here.
+  const { dir: _dir, ...rest } = config;
   return {
-    ...config,
+    ...rest,
     transpilePackages: [ ...new Set([ ...(config.transpilePackages ?? []), ...GUI_PACKAGES ]) ],
     turbopack: {
       ...config.turbopack,
@@ -126,13 +70,15 @@ export function withLuxUi(config: LuxUiNextConfig = {}): LuxUiNextConfig {
       const next = userWebpack ? userWebpack(webpackConfig, context) : webpackConfig;
       next.resolve = {
         ...next.resolve,
-        alias: { ...next.resolve?.alias, 'react-native$': 'react-native-web' },
+        // The app's own aliases win — an app pinning a package on purpose is not
+        // something the umbrella should override.
+        alias: { 'react-native$': 'react-native-web', ...engine, ...next.resolve?.alias },
       };
       // `context` is Next's `{ webpack }` bag — use ITS webpack instance so the
       // DefinePlugin is the one running the build.
       const webpackModule = (context as { webpack?: { DefinePlugin?: new (d: Record<string, string>) => unknown } })?.webpack;
       if (webpackModule?.DefinePlugin) {
-        next.plugins = [ ...(next.plugins ?? []), new webpackModule.DefinePlugin(DEFINES) ];
+        next.plugins = [ ...(next.plugins ?? []), new webpackModule.DefinePlugin({ ...GUI_DEFINES }) ];
       }
       return next;
     },
@@ -140,3 +86,4 @@ export function withLuxUi(config: LuxUiNextConfig = {}): LuxUiNextConfig {
 }
 
 export { GUI_PACKAGES };
+

package/src/tooltip.tsx

@@ -82,9 +82,12 @@ export const Tooltip = React.forwardRef<HTMLDivElement, TooltipProps>(
       }, nextOpen ? openDelay : closeDelay);
     }, [ closeDelay, openDelay, onOpenChange ]);
 
+    // `useClickAway` keeps the LATEST callback in a ref and returns a ref whose
+    // identity never changes, so this may read `open` directly — and must, so a
+    // closed tooltip does not arm a close timer on every document click.
     const handleClickAway = React.useCallback(() => {
-      handleOpenChangeManual(false);
-    }, [ handleOpenChangeManual ]);
+      if (open) handleOpenChangeManual(false);
+    }, [ open, handleOpenChangeManual ]);
 
     const triggerRef = useClickAway<HTMLButtonElement>(handleClickAway);
 
@@ -132,7 +135,14 @@ export const Tooltip = React.forwardRef<HTMLDivElement, TooltipProps>(
           unstyled
         >
           <GuiTooltip.Trigger
-            ref={ open ? triggerRef : undefined }
+            // ONE ref, always the same one. Swapping between `triggerRef` and
+            // `undefined` on open/close changes the composed-ref identity, so
+            // React detaches and re-attaches the popper's reference element on
+            // every hover — two extra `refs.setReference()` calls per open, each
+            // of which throws uncaught when the Popper context is not the one
+            // this anchor is reading (see ./engine). The click-away handler
+            // already no-ops while closed, so the ref never needed to move.
+            ref={ triggerRef }
             asChild
             {...(isMobile ? { onPress: handleTriggerClick } : {})}
             { ...triggerProps as any }

package/src/vite.ts

@@ -14,6 +14,8 @@
 // Node-only (it is a build-time module) and dependency-free: it returns a plain
 // Vite plugin object, so it does not force `vite` into anyone's runtime graph.
 
+import { GUI_DEFINES, GUI_PACKAGES } from './engine';
+
 interface LuxUiViteOptions {
   /**
    * Extra packages to keep to a single physical copy. React, the gui engine and
@@ -37,13 +39,16 @@ interface LuxUiVitePlugin {
   };
 }
 
+// The WHOLE engine, not a hand-picked three. `@hanzogui/popper` and
+// `@hanzogui/popover` publish the contexts a Tooltip trigger reads, and they
+// were the two missing from the old list — so a consumer using this plugin
+// could still get two poppers and the `setReference` crash it causes. One list,
+// shared with the Next wrapper. See ./engine.
 const DEDUPE = [
   'react',
   'react-dom',
   '@tanstack/react-query',
-  '@hanzo/gui',
-  '@hanzogui/core',
-  '@hanzogui/web',
+  ...GUI_PACKAGES,
 ];
 
 const INCLUDE = [
@@ -59,11 +64,8 @@ export function luxUi(options: LuxUiViteOptions = {}): LuxUiVitePlugin {
     name: '@luxfi/ui',
     config: () => ({
       // The engine branches on these at module scope; without them it takes the
-      // native path in a browser bundle.
-      define: {
-        'process.env.EXPO_OS': JSON.stringify('web'),
-        'process.env.IS_WEB': JSON.stringify('true'),
-      },
+      // native path in a browser bundle. (./engine)
+      define: { ...GUI_DEFINES },
       resolve: {
         alias: { 'react-native': 'react-native-web' },
         dedupe: [ ...new Set([ ...DEDUPE, ...(options.dedupe ?? []) ]) ],

package/src/white-label.ts

@@ -68,10 +68,17 @@ const ORGS: Readonly<Record<Org, OrgIdentity>> = {
     org: 'zoo',
     name: 'Zoo',
     domain: 'zoo.ngo',
-    // Zoo's IdP is `id.zoo.network`, not a `zoo.id` apex — the one row in this
-    // table where the issuer is not `<org>.id`, and the one every hand-rolled
-    // per-app branding map got wrong.
-    iamDomain: 'id.zoo.network',
+    // Zoo's issuer is `zoolabs.id` — the one row where it is not `<org>.id`,
+    // and the one every hand-rolled branding map gets wrong. `id.zoo.network`
+    // ANSWERS, which is why it keeps being copied around, but it is an alias:
+    // its own discovery document advertises
+    //   issuer                  https://zoolabs.id
+    //   authorization_endpoint  https://zoolabs.id/v1/iam/oauth/authorize
+    //   jwks_uri                https://zoolabs.id/v1/iam/.well-known/jwks
+    // so a client configured on the alias validates `iss` against a string the
+    // IdP never emits and rejects every token it is given — the exact shape of
+    // the lux.id outage. `zoo.id` is not an IdP at all (no discovery document).
+    iamDomain: 'zoolabs.id',
     accent: LUX_BRAND.zoo,
     accentForeground: '#FFFFFF',
   },
@@ -105,24 +112,31 @@ const ORGS: Readonly<Record<Org, OrgIdentity>> = {
 // SUFFIX on a label boundary, so `mpc.lux.cloud` and `lux.cloud` both hit `lux`
 // while `notlux.cloud` does not.
 //
-// The third slot names the app at the domain's APEX. It is usually derivable
-// (`lux.cloud` → `cloud` → client `lux-cloud`), so it is only written where the
-// registered client says otherwise — `bootno.de` is `bootnode-platform`, not
-// `bootnode-de`. A client id is a registration, not a guess.
+// The third slot PINS the registered app slug for every host under the domain.
+// Most brands register one client per app and the slug is derivable from the
+// hostname — `lux.cloud` → `cloud` → `lux-cloud`, `mpc.lux.network` → `lux-mpc`,
+// both verified 302 against the live authorize endpoint. Some register ONE
+// client for the whole brand, and then the derivation is a guess that 400s:
+// `bootno.de` is `bootnode-platform`, and Pars is `pars-app` on every host
+// (`pars-cloud` answers 400 where `pars-app` answers 302). A client id is a
+// registration, not a guess — so where it is not derivable it is written down.
 const DOMAIN_ORG: ReadonlyArray<readonly [string, Org, string?]> = [
   [ 'lux.network', 'lux' ],
   [ 'lux.cloud', 'lux' ],
   [ 'lux.id', 'lux' ],
   [ 'lux.finance', 'lux' ],
+  [ 'lux.market', 'lux' ],
+  [ 'lux.exchange', 'lux' ],
   [ 'zoo.ngo', 'zoo' ],
   [ 'zoo.network', 'zoo' ],
   [ 'zoo.cloud', 'zoo' ],
-  [ 'zoo.id', 'zoo' ],
+  [ 'zoolabs.id', 'zoo' ],
   [ 'hanzo.ai', 'hanzo' ],
   [ 'hanzo.cloud', 'hanzo' ],
   [ 'hanzo.id', 'hanzo' ],
-  [ 'pars.id', 'pars' ],
-  [ 'parsdao.org', 'pars' ],
+  [ 'pars.id', 'pars', 'app' ],
+  [ 'pars.network', 'pars', 'app' ],
+  [ 'parsdao.org', 'pars', 'app' ],
   [ 'bootno.de', 'bootnode', 'platform' ],
 ];
 
@@ -170,15 +184,15 @@ function matchDomain(host: string): readonly [string, Org, string?] | undefined
  * `mpc.lux.cloud`  → `mpc`      (leftmost label)
  * `lux.cloud`      → `cloud`    (apex: the service name, not the org)
  * `www.lux.network`→ `network`  (www is chrome, not an app)
+ * `bootno.de`      → `platform` (pinned: a registration, not a guess)
  * `localhost`      → `local`
  */
-function appSlug(host: string, domain: string, apexApp?: string): string {
+function appSlug(host: string, domain: string, pinned?: string): string {
+  if (pinned) return pinned;
   const sub = host === domain ? '' : host.slice(0, -(domain.length + 1));
   const leftmost = sub.split('.')[0] ?? '';
   if (leftmost && leftmost !== 'www') return leftmost;
-  // Apex (or www) — the registered name when the table gives one, else the
-  // domain's own service label.
-  if (apexApp) return apexApp;
+  // Apex (or www) — the domain's own service label.
   const label = domain.split('.')[0] ?? '';
   const tld = domain.split('.').slice(1).join('.');
   // `lux.network` → `network`, `lux.cloud` → `cloud`, `pars.id` → `id`.
@@ -203,9 +217,9 @@ function isLocal(host: string): boolean {
  * Pure and total: an unknown or missing host falls back to the Lux row rather
  * than throwing, so a preview URL or a health probe never blanks the UI.
  *
- *   resolveWhiteLabel('mpc.lux.cloud')  // org lux,  clientId lux-mpc,   issuer https://lux.id
- *   resolveWhiteLabel('zoo.network')    // org zoo,  clientId zoo-network, issuer https://zoo.id
- *   resolveWhiteLabel('id.pars.id')     // org pars, clientId pars-id,   issuer https://pars.id
+ *   resolveWhiteLabel('mpc.lux.network') // org lux,  clientId lux-mpc,   issuer https://lux.id
+ *   resolveWhiteLabel('zoo.cloud')       // org zoo,  clientId zoo-cloud, issuer https://zoolabs.id
+ *   resolveWhiteLabel('cloud.pars.network') // org pars, clientId pars-app, issuer https://pars.id
  */
 export function resolveWhiteLabel(host?: string | null): WhiteLabel {
   const h = normalizeHost(host ?? '');