@progalaxyelabs/ngx-stonescriptphp-client 1.11.1 → 1.12.0

package/fesm2022/progalaxyelabs-ngx-stonescriptphp-client.mjs

@@ -1,228 +1,34 @@
 import * as i0 from '@angular/core';
-import { Injectable, Inject, NgModule, EventEmitter, Output, Input, Component, Optional } from '@angular/core';
+import { InjectionToken, makeEnvironmentProviders, Injectable, Inject, EventEmitter, Output, Input, Component, Optional } from '@angular/core';
 import { BehaviorSubject } from 'rxjs';
 import * as i3 from '@angular/common';
 import { CommonModule } from '@angular/common';
 import * as i4 from '@angular/forms';
 import { FormsModule } from '@angular/forms';
 
-class ApiResponse {
-    status;
-    data;
-    message;
-    get success() {
-        return this.status === 'ok';
-    }
-    get errors() {
-        return this.message ? [this.message] : [];
-    }
-    constructor(status, data = null, message = '') {
-        this.status = status;
-        this.data = data || null;
-        this.message = message;
-    }
-    onOk(callback) {
-        if (this.status === 'ok') {
-            callback(this.data);
-        }
-        return this;
-    }
-    onNotOk(callback) {
-        if (this.status === 'not ok') {
-            callback(this.message, this.data);
-        }
-        return this;
-    }
-    onError(callback) {
-        if (this.status === 'error') {
-            callback();
-        }
-        return this;
-    }
-    isSuccess() {
-        return this.status === 'ok';
-    }
-    isError() {
-        return this.status === 'error' || this.status === 'not ok';
-    }
-    getData() {
-        return this.data || null;
-    }
-    getError() {
-        return this.message || 'Unknown error';
-    }
-    getStatus() {
-        return this.status;
-    }
-    getMessage() {
-        return this.message;
-    }
-}
-
-class TokenService {
-    accessToken = '';
-    refreshToken = '';
-    lsAccessTokenKey = 'progalaxyapi_access_token';
-    lsRefreshTokenKey = 'progalaxyapi_refresh_token';
-    constructor() { }
-    setTokens(accessToken, refreshToken) {
-        this.accessToken = accessToken;
-        this.refreshToken = refreshToken;
-        localStorage.setItem(this.lsAccessTokenKey, accessToken);
-        localStorage.setItem(this.lsRefreshTokenKey, refreshToken);
-    }
-    setAccessToken(accessToken) {
-        this.accessToken = accessToken;
-        localStorage.setItem(this.lsAccessTokenKey, accessToken);
-    }
-    setRefreshToken(refreshToken) {
-        this.refreshToken = refreshToken;
-        localStorage.setItem(this.lsRefreshTokenKey, refreshToken);
-    }
-    getAccessToken() {
-        if (this.accessToken) {
-            return this.accessToken;
-        }
-        const storedAccessToken = localStorage.getItem(this.lsAccessTokenKey);
-        if (storedAccessToken) {
-            return storedAccessToken;
-        }
-        else {
-            return '';
-        }
-    }
-    getRefreshToken() {
-        if (this.refreshToken) {
-            return this.refreshToken;
-        }
-        const storedRefreshToken = localStorage.getItem(this.lsRefreshTokenKey);
-        if (storedRefreshToken) {
-            return storedRefreshToken;
-        }
-        else {
-            return '';
-        }
-    }
-    clear() {
-        this.accessToken = '';
-        this.refreshToken = '';
-        localStorage.removeItem(this.lsAccessTokenKey);
-        localStorage.removeItem(this.lsRefreshTokenKey);
-    }
-    /**
-     * Check if there is a non-empty access token.
-     * Token is treated as opaque — validity is determined by the auth server.
-     */
-    hasValidAccessToken() {
-        const token = this.getAccessToken();
-        return token !== null && token !== '';
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: TokenService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: TokenService, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: TokenService, decorators: [{
-            type: Injectable,
-            args: [{
-                    providedIn: 'root'
-                }]
-        }], ctorParameters: () => [] });
-
-/**
- * @deprecated Use boolean directly. Kept for backward compatibility.
- */
-var VerifyStatus;
-(function (VerifyStatus) {
-    VerifyStatus["initialized"] = "initialized";
-    VerifyStatus["yes"] = "yes";
-    VerifyStatus["no"] = "no";
-})(VerifyStatus || (VerifyStatus = {}));
-class SigninStatusService {
-    status;
-    constructor() {
-        this.status = new BehaviorSubject(false);
-    }
-    signedOut() {
-        this.status.next(false);
-    }
-    signedIn() {
-        this.status.next(true);
-    }
-    /**
-     * Set signin status
-     * @param isSignedIn - True if user is signed in, false otherwise
-     */
-    setSigninStatus(isSignedIn) {
-        this.status.next(isSignedIn);
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: SigninStatusService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: SigninStatusService, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: SigninStatusService, decorators: [{
-            type: Injectable,
-            args: [{
-                    providedIn: 'root'
-                }]
-        }], ctorParameters: () => [] });
-
 class MyEnvironmentModel {
     production = true;
     /**
-     * Platform code identifier (e.g., 'progalaxy', 'hr', 'admin')
-     * Used for multi-tenant authentication
+     * Platform code identifier (e.g., 'progalaxy', 'hr', 'admin').
+     * Used for multi-tenant authentication.
      */
     platformCode = '';
     /**
-     * Accounts platform URL for centralized authentication (single-server mode)
-     * @example 'https://accounts.progalaxyelabs.com'
-     * @deprecated Use authServers for multi-server support
-     */
-    accountsUrl = '';
-    /**
-     * Multiple authentication servers configuration
-     * Enables platforms to authenticate against different identity providers
-     * @example
-     * ```typescript
-     * authServers: {
-     *   customer: { url: 'https://auth.progalaxyelabs.com', default: true },
-     *   employee: { url: 'https://admin-auth.progalaxyelabs.com' }
-     * }
-     * ```
-     */
-    authServers;
-    firebase = {
-        projectId: '',
-        appId: '',
-        databaseURL: '',
-        storageBucket: '',
-        locationId: '',
-        apiKey: '',
-        authDomain: '',
-        messagingSenderId: '',
-        measurementId: ''
-    };
-    /**
-     * Platform's own API base URL (e.g., '//api.medstoreapp.in')
-     * Used to route registration through the platform API proxy instead of auth directly
+     * Platform's own API base URL.
+     * Used for routes that go through the platform API proxy (e.g. register-tenant).
+     * Falls back to apiServer.host if not set.
      * @example '//api.medstoreapp.in'
      */
     apiUrl;
     apiServer = { host: '' };
-    chatServer = { host: '' };
-    /**
-     * Accounts/Authentication service server configuration
-     * Use this when auth is on a different server than the API
-     * Replaces the deprecated accountsUrl string with structured config
-     * @example { host: 'https://accounts.progalaxyelabs.com' }
-     */
-    accountsServer;
     /**
-     * Files service server configuration
-     * Used by FilesService for file upload/download operations
+     * Files service server configuration.
+     * Used by FilesService for file upload/download operations.
      * @example { host: 'https://files.progalaxyelabs.com/api/' }
      */
     filesServer;
     /**
-     * Authentication configuration
+     * Authentication configuration.
      * @default { mode: 'cookie', refreshEndpoint: '/auth/refresh', useCsrf: true }
      */
     auth = {
@@ -234,667 +40,815 @@ class MyEnvironmentModel {
         csrfHeaderName: 'X-CSRF-Token'
     };
     /**
-     * Custom OAuth provider configurations.
-     * Register additional OAuth providers beyond the built-in ones
-     * (google, linkedin, apple, microsoft, github, zoho).
+     * Multiple authentication servers configuration (for StoneScriptPHPAuth multi-server mode).
      * @example
      * ```typescript
-     * customProviders: {
-     *   okta: { label: 'Sign in with Okta', cssClass: 'btn-okta', buttonStyle: { borderColor: '#007dc1' } },
-     *   keycloak: { label: 'Sign in with Keycloak', icon: '🔑' }
+     * authServers: {
+     *   customer: { url: 'https://auth.progalaxyelabs.com', default: true },
+     *   employee: { url: 'https://admin-auth.progalaxyelabs.com' }
      * }
      * ```
      */
-    customProviders;
+    authServers;
     /**
-     * Auth response field mapping.
-     * Defaults to StoneScriptPHP format: { status: 'ok', data: { access_token, user, ... } }
-     *
-     * For external auth servers that return flat responses like
-     * { access_token, identity, ... }, override with:
+     * Custom OAuth provider configurations.
+     * @example
      * ```typescript
-     * authResponseMap: {
-     *   accessTokenPath: 'access_token',
-     *   refreshTokenPath: 'refresh_token',
-     *   userPath: 'identity',
-     *   errorMessagePath: 'message'
+     * customProviders: {
+     *   okta: { label: 'Sign in with Okta', cssClass: 'btn-okta', buttonStyle: { borderColor: '#007dc1' } }
      * }
      * ```
      */
-    authResponseMap;
+    customProviders;
     /**
-     * Branding configuration for auth components
-     * Allows platforms to customize login/register pages without creating wrappers
+     * Branding configuration for auth UI components.
      */
     branding;
+    // ── Deprecated fields (kept for backward compatibility) ──────────────────
+    /**
+     * @deprecated Use auth.host instead.
+     * Auth server URL for centralized authentication.
+     */
+    accountsUrl = '';
+    /**
+     * @deprecated Use auth.host instead.
+     * Accounts/Authentication service server configuration.
+     */
+    accountsServer;
+    /**
+     * @deprecated Use auth.responseMap instead.
+     * Auth response field mapping for external auth compatibility.
+     */
+    authResponseMap;
 }
 
+const AUTH_PLUGIN = new InjectionToken('AUTH_PLUGIN');
+
+const ACTIVE_SERVER_KEY = 'progalaxyapi_active_auth_server';
+const DEFAULT_RESPONSE_MAP = {
+    successPath: 'status',
+    successValue: 'ok',
+    accessTokenPath: 'data.access_token',
+    refreshTokenPath: 'data.refresh_token',
+    userPath: 'data.user',
+    errorMessagePath: 'message'
+};
 /**
- * CSRF Token Service
+ * Built-in auth plugin for StoneScriptPHP backends.
  *
- * Manages CSRF tokens for cookie-based authentication.
- * Reads CSRF token from cookies and provides it for request headers.
+ * Handles StoneScriptPHP's auth format ({ status:'ok', data:{ access_token } })
+ * with optional authResponseMap overrides for external backends.
+ *
+ * Supports:
+ * - Cookie mode (httpOnly refresh token + CSRF)
+ * - Body mode (tokens in localStorage)
+ * - Multi-server auth (named authServers config)
+ * - OAuth popup login
+ * - Multi-tenant operations
  */
-class CsrfService {
-    /**
-     * Get CSRF token from cookie
-     */
-    getCsrfToken(cookieName = 'csrf_token') {
+class StoneScriptPHPAuth {
+    config;
+    activeServer = null;
+    constructor(config) {
+        this.config = config;
+        this.restoreActiveServer();
+    }
+    // ── Response mapping ────────────────────────────────────────────────────
+    get responseMap() {
+        const m = this.config.responseMap;
+        if (!m)
+            return DEFAULT_RESPONSE_MAP;
+        return { ...DEFAULT_RESPONSE_MAP, ...m };
+    }
+    resolvePath(obj, path) {
+        return path.split('.').reduce((o, key) => o?.[key], obj);
+    }
+    isAuthSuccess(data) {
+        const map = this.responseMap;
+        if (map.successPath) {
+            return this.resolvePath(data, map.successPath) === (map.successValue ?? 'ok');
+        }
+        return !!this.resolvePath(data, map.accessTokenPath);
+    }
+    resolveAccessToken(data) {
+        return this.resolvePath(data, this.responseMap.accessTokenPath);
+    }
+    resolveRefreshToken(data) {
+        return this.resolvePath(data, this.responseMap.refreshTokenPath);
+    }
+    resolveUser(data) {
+        const raw = this.resolvePath(data, this.responseMap.userPath);
+        return raw ? this.normalizeUser(raw) : undefined;
+    }
+    resolveErrorMessage(data, fallback) {
+        const path = this.responseMap.errorMessagePath ?? 'message';
+        return this.resolvePath(data, path) || fallback;
+    }
+    normalizeUser(raw) {
+        return {
+            user_id: raw.user_id ?? (raw.id ? this.hashUUID(raw.id) : 0),
+            id: raw.id ?? String(raw.user_id),
+            email: raw.email,
+            display_name: raw.display_name ?? raw.email?.split('@')[0] ?? '',
+            photo_url: raw.photo_url,
+            is_email_verified: raw.is_email_verified ?? false
+        };
+    }
+    hashUUID(uuid) {
+        let hash = 0;
+        for (let i = 0; i < uuid.length; i++) {
+            const char = uuid.charCodeAt(i);
+            hash = ((hash << 5) - hash) + char;
+            hash = hash & hash;
+        }
+        return Math.abs(hash);
+    }
+    // ── CSRF (inlined, no Angular DI needed) ────────────────────────────────
+    getCsrfToken() {
+        const cookieName = this.config.auth?.csrfTokenCookieName ?? 'csrf_token';
         const cookies = document.cookie.split(';');
         for (const cookie of cookies) {
             const [name, value] = cookie.trim().split('=');
-            if (name === cookieName) {
+            if (name === cookieName)
                 return decodeURIComponent(value);
-            }
         }
         return null;
     }
-    /**
-     * Check if CSRF token exists
-     */
-    hasCsrfToken(cookieName = 'csrf_token') {
-        return this.getCsrfToken(cookieName) !== null;
+    // ── Server resolution ────────────────────────────────────────────────────
+    getAccountsUrl(serverName) {
+        if (this.config.authServers && Object.keys(this.config.authServers).length > 0) {
+            const target = serverName || this.activeServer || this.getDefaultServer();
+            if (!target)
+                throw new Error('No auth server specified and no default server configured');
+            const serverConfig = this.config.authServers[target];
+            if (!serverConfig)
+                throw new Error(`Auth server '${target}' not found in configuration`);
+            return serverConfig.url;
+        }
+        return this.config.host;
     }
-    /**
-     * Clear CSRF token (for logout)
-     * Note: Client-side deletion is limited for httpOnly cookies
-     */
-    clearCsrfToken(cookieName = 'csrf_token') {
-        // Can only clear non-httpOnly cookies
-        document.cookie = `${cookieName}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;`;
+    getPlatformApiUrl() {
+        return this.config.apiUrl || this.config.host;
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: CsrfService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: CsrfService, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: CsrfService, decorators: [{
-            type: Injectable,
-            args: [{
-                    providedIn: 'root'
-                }]
-        }] });
-
-class ApiConnectionService {
-    tokens;
-    signinStatus;
-    environment;
-    csrf;
-    host = ''; // base URL without trailing slash
-    accessToken = '';
-    authConfig;
-    constructor(tokens, signinStatus, environment, csrf) {
-        this.tokens = tokens;
-        this.signinStatus = signinStatus;
-        this.environment = environment;
-        this.csrf = csrf;
-        this.host = environment.apiServer.host;
-        // Set default auth config based on mode
-        this.authConfig = {
-            mode: environment.auth?.mode || 'cookie',
-            refreshEndpoint: environment.auth?.refreshEndpoint,
-            useCsrf: environment.auth?.useCsrf,
-            refreshTokenCookieName: environment.auth?.refreshTokenCookieName || 'refresh_token',
-            csrfTokenCookieName: environment.auth?.csrfTokenCookieName || 'csrf_token',
-            csrfHeaderName: environment.auth?.csrfHeaderName || 'X-CSRF-Token'
-        };
-        // Set default refresh endpoint based on mode if not specified
-        if (!this.authConfig.refreshEndpoint) {
-            this.authConfig.refreshEndpoint = this.authConfig.mode === 'cookie'
-                ? '/auth/refresh'
-                : '/user/refresh_access';
-        }
-        // Set default CSRF setting based on mode if not specified
-        if (this.authConfig.useCsrf === undefined) {
-            this.authConfig.useCsrf = this.authConfig.mode === 'cookie';
+    getDefaultServer() {
+        if (!this.config.authServers)
+            return null;
+        for (const [name, cfg] of Object.entries(this.config.authServers)) {
+            if (cfg.default)
+                return name;
         }
+        return Object.keys(this.config.authServers)[0] || null;
     }
-    async request(url, options, data) {
+    restoreActiveServer() {
         try {
-            if (data !== null) {
-                const body = JSON.stringify(data);
-                if (body) {
-                    options.body = body;
-                }
-                else {
-                    options.body = {};
-                }
-            }
-            const accessTokenIncluded = this.includeAccessToken(options);
-            let response = await fetch(url, options);
-            if ((response.status === 401) && accessTokenIncluded) {
-                response = await this.refreshAccessTokenAndRetry(url, options, response);
-            }
-            if (response.ok) {
-                const json = await (response.json());
-                return (new ApiResponse(json.status, json.data, json.message));
-            }
-            if (response.status === 401) {
-                this.signinStatus.signedOut();
-            }
-            return this.handleError(response);
+            const saved = localStorage.getItem(ACTIVE_SERVER_KEY);
+            this.activeServer = (saved && this.config.authServers?.[saved])
+                ? saved
+                : this.getDefaultServer();
         }
-        catch (error) {
-            return this.handleError(error);
+        catch {
+            this.activeServer = this.getDefaultServer();
         }
     }
-    handleError(error) {
-        console.error(`Backend returned code ${error.status}, ` +
-            `full error: `, error);
-        return new ApiResponse('error');
-    }
-    async get(endpoint, queryParamsObj) {
-        const url = this.host + endpoint + this.buildQueryString(queryParamsObj);
-        const fetchOptions = {
-            mode: 'cors',
-            redirect: 'error'
-        };
-        return this.request(url, fetchOptions, null);
-    }
-    async post(pathWithQueryParams, data) {
-        const url = this.host + pathWithQueryParams;
-        const fetchOptions = {
-            method: 'POST',
-            mode: 'cors',
-            redirect: 'error',
-            headers: {
-                'Content-Type': 'application/json'
-            },
-            body: JSON.stringify(data)
-        };
-        return this.request(url, fetchOptions, data);
+    // ── Multi-server public API ──────────────────────────────────────────────
+    switchServer(serverName) {
+        if (!this.config.authServers?.[serverName]) {
+            throw new Error(`Auth server '${serverName}' not found in configuration`);
+        }
+        try {
+            localStorage.setItem(ACTIVE_SERVER_KEY, serverName);
+        }
+        catch { /* ignore */ }
+        this.activeServer = serverName;
     }
-    async put(pathWithQueryParams, data) {
-        const url = this.host + pathWithQueryParams;
-        const fetchOptions = {
-            method: 'PUT',
-            mode: 'cors',
-            redirect: 'error',
-            headers: {
-                'Content-Type': 'application/json'
-            },
-            body: JSON.stringify(data)
-        };
-        return this.request(url, fetchOptions, data);
+    getAvailableServers() {
+        return Object.keys(this.config.authServers ?? {});
     }
-    async patch(pathWithQueryParams, data) {
-        const url = this.host + pathWithQueryParams;
-        const fetchOptions = {
-            method: 'PATCH',
-            mode: 'cors',
-            redirect: 'error',
-            headers: {
-                'Content-Type': 'application/json'
-            },
-            body: JSON.stringify(data)
-        };
-        return this.request(url, fetchOptions, data);
+    getActiveServer() {
+        return this.activeServer;
     }
-    async delete(endpoint, queryParamsObj) {
-        const url = this.host + endpoint + this.buildQueryString(queryParamsObj);
-        const fetchOptions = {
-            method: 'DELETE',
-            mode: 'cors',
-            redirect: 'error'
-        };
-        return this.request(url, fetchOptions, null);
+    getServerConfig(serverName) {
+        if (!this.config.authServers)
+            return null;
+        const target = serverName || this.activeServer || this.getDefaultServer();
+        return target ? (this.config.authServers[target] ?? null) : null;
     }
-    // async postFormWithFiles(pathWithQueryParams: string, formData: FormData): Promise<ApiResponse | null> {
-    //     const url = this.host + pathWithQueryParams.replace(/^\/+/, '')
-    //     try {
-    //         const fetchOptions: RequestInit = {
-    //             method: 'POST',
-    //             mode: 'cors',
-    //             redirect: 'error',
-    //             body: formData
-    //         }
-    //         const accessTokenIncluded = this.includeAccessToken(fetchOptions)
-    //         let response: Response = await fetch(url, fetchOptions)
-    //         if ((response.status === 401) && accessTokenIncluded) {
-    //             response = await this.refreshAccessTokenAndRetry(url, fetchOptions, response)
-    //         }
-    //         if (response.ok) {
-    //             return ((await (response.json()) as ApiResponse))
-    //         }
-    //         return this.handleError(response)
-    //     } catch (error) {
-    //         return this.handleError(error)
-    //     }
-    // }
-    includeAccessToken(options) {
-        this.accessToken = this.tokens.getAccessToken();
-        if (!this.accessToken) {
-            return false;
+    // ── Core auth operations ─────────────────────────────────────────────────
+    async login(email, password) {
+        try {
+            const accountsUrl = this.getAccountsUrl();
+            const response = await fetch(`${accountsUrl}/api/auth/login`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                credentials: 'include',
+                body: JSON.stringify({ email, password, platform: this.config.platformCode })
+            });
+            const data = await response.json();
+            if (this.isAuthSuccess(data)) {
+                return {
+                    success: true,
+                    accessToken: this.resolveAccessToken(data),
+                    refreshToken: this.resolveRefreshToken(data),
+                    user: this.resolveUser(data)
+                };
+            }
+            return { success: false, message: this.resolveErrorMessage(data, 'Invalid credentials') };
         }
-        if (!options.headers) {
-            options.headers = {};
+        catch {
+            return { success: false, message: 'Network error. Please try again.' };
         }
-        options.headers['Authorization'] = 'Bearer ' + this.accessToken;
-        return true;
     }
-    async refreshAccessTokenAndRetry(url, fetchOptions, response) {
-        const refreshStatusOk = await this.refreshAccessToken();
-        if (!refreshStatusOk) {
-            return response;
+    async register(email, password, displayName) {
+        try {
+            const accountsUrl = this.getAccountsUrl();
+            const response = await fetch(`${accountsUrl}/api/auth/register`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                credentials: 'include',
+                body: JSON.stringify({
+                    email,
+                    password,
+                    display_name: displayName,
+                    platform: this.config.platformCode
+                })
+            });
+            const data = await response.json();
+            if (this.isAuthSuccess(data)) {
+                return {
+                    success: true,
+                    accessToken: this.resolveAccessToken(data),
+                    refreshToken: this.resolveRefreshToken(data),
+                    user: this.resolveUser(data),
+                    needsVerification: !!data.needs_verification,
+                    message: data.needs_verification ? 'Please verify your email' : undefined
+                };
+            }
+            return { success: false, message: this.resolveErrorMessage(data, 'Registration failed') };
+        }
+        catch {
+            return { success: false, message: 'Network error. Please try again.' };
         }
-        fetchOptions.headers['Authorization'] = 'Bearer ' + this.accessToken;
-        response = await fetch(url, fetchOptions);
-        return response;
     }
-    async refreshAccessToken() {
-        if (this.authConfig.mode === 'none') {
-            return false;
+    async logout(refreshToken) {
+        try {
+            const accountsUrl = this.getAccountsUrl();
+            await fetch(`${accountsUrl}/api/auth/logout`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                credentials: 'include',
+                body: JSON.stringify({ refresh_token: refreshToken })
+            });
         }
-        if (this.authConfig.mode === 'cookie') {
-            return await this.refreshAccessTokenCookieMode();
+        catch (error) {
+            console.error('Logout API call failed:', error);
         }
-        else {
-            return await this.refreshAccessTokenBodyMode();
+    }
+    async checkSession() {
+        try {
+            const accountsUrl = this.getAccountsUrl();
+            const response = await fetch(`${accountsUrl}/api/auth/refresh`, {
+                method: 'POST',
+                credentials: 'include'
+            });
+            if (!response.ok)
+                return { success: false };
+            const data = await response.json();
+            const accessToken = this.resolveAccessToken(data);
+            if (accessToken) {
+                return { success: true, accessToken, user: this.resolveUser(data) };
+            }
+            return { success: false };
+        }
+        catch {
+            return { success: false };
         }
     }
-    /**
-     * Refresh access token using cookie-based auth (StoneScriptPHP v2.1.x default)
-     */
-    async refreshAccessTokenCookieMode() {
+    async refresh(accessToken, refreshToken) {
+        const mode = this.config.auth?.mode ?? 'cookie';
+        if (mode === 'none')
+            return null;
+        return mode === 'cookie'
+            ? this.refreshCookieMode()
+            : this.refreshBodyMode(accessToken, refreshToken);
+    }
+    async refreshCookieMode() {
         try {
-            // Determine auth server: accountsServer.host > accountsUrl > apiServer.host
-            const authHost = this.environment.accountsServer?.host
-                || this.environment.accountsUrl
-                || this.host;
-            const refreshTokenUrl = authHost + this.authConfig.refreshEndpoint;
-            const headers = {
-                'Content-Type': 'application/json'
-            };
-            // Add CSRF token if enabled
-            if (this.authConfig.useCsrf) {
-                const csrfToken = this.csrf.getCsrfToken(this.authConfig.csrfTokenCookieName);
+            const authHost = this.getAccountsUrl();
+            const endpoint = this.config.auth?.refreshEndpoint ?? '/auth/refresh';
+            const headers = { 'Content-Type': 'application/json' };
+            if (this.config.auth?.useCsrf !== false) {
+                const csrfToken = this.getCsrfToken();
                 if (!csrfToken) {
                     console.error('CSRF token not found in cookie');
-                    return false;
+                    return null;
                 }
-                headers[this.authConfig.csrfHeaderName] = csrfToken;
+                headers[this.config.auth?.csrfHeaderName ?? 'X-CSRF-Token'] = csrfToken;
             }
-            let refreshTokenResponse = await fetch(refreshTokenUrl, {
+            const response = await fetch(`${authHost}${endpoint}`, {
                 method: 'POST',
                 mode: 'cors',
-                credentials: 'include', // Important: send cookies
+                credentials: 'include',
                 redirect: 'error',
-                headers: headers
+                headers
             });
-            if (!refreshTokenResponse.ok) {
-                this.accessToken = '';
-                this.tokens.clear();
-                return false;
-            }
-            let refreshAccessData = await refreshTokenResponse.json();
-            if (!refreshAccessData || refreshAccessData.status !== 'ok') {
-                return false;
-            }
-            // Extract access token from response
-            const newAccessToken = refreshAccessData.data?.access_token || refreshAccessData.access_token;
-            if (!newAccessToken) {
-                console.error('No access token in refresh response');
-                return false;
-            }
-            // Store new access token (refresh token is in httpOnly cookie)
-            this.tokens.setAccessToken(newAccessToken);
-            this.accessToken = newAccessToken;
-            return true;
+            if (!response.ok)
+                return null;
+            const data = await response.json();
+            if (!this.isAuthSuccess(data))
+                return null;
+            return this.resolveAccessToken(data) ?? null;
         }
         catch (error) {
             console.error('Token refresh failed (cookie mode):', error);
-            this.accessToken = '';
-            this.tokens.clear();
-            return false;
+            return null;
         }
     }
-    /**
-     * Refresh access token using body-based auth (legacy mode)
-     */
-    async refreshAccessTokenBodyMode() {
+    async refreshBodyMode(accessToken, refreshToken) {
+        if (!refreshToken)
+            return null;
         try {
-            const refreshToken = this.tokens.getRefreshToken();
-            if (!refreshToken) {
-                return false;
-            }
-            // Determine auth server: accountsServer.host > accountsUrl > apiServer.host
-            const authHost = this.environment.accountsServer?.host
-                || this.environment.accountsUrl
-                || this.host;
-            const refreshTokenUrl = authHost + this.authConfig.refreshEndpoint;
-            let refreshTokenResponse = await fetch(refreshTokenUrl, {
+            const authHost = this.getAccountsUrl();
+            const endpoint = this.config.auth?.refreshEndpoint ?? '/user/refresh_access';
+            const response = await fetch(`${authHost}${endpoint}`, {
                 method: 'POST',
                 mode: 'cors',
                 redirect: 'error',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify({
-                    access_token: this.accessToken,
-                    refresh_token: refreshToken
-                })
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ access_token: accessToken, refresh_token: refreshToken })
             });
-            if (!refreshTokenResponse.ok) {
-                this.accessToken = '';
-                this.tokens.clear();
-                return false;
-            }
-            let refreshAccessData = await refreshTokenResponse.json();
-            if (!refreshAccessData) {
-                return false;
-            }
-            const newAccessToken = refreshAccessData.data?.access_token || refreshAccessData.access_token;
-            if (!newAccessToken) {
-                console.error('No access token in refresh response');
-                return false;
-            }
-            this.tokens.setTokens(newAccessToken, refreshToken);
-            this.accessToken = newAccessToken;
-            return true;
+            if (!response.ok)
+                return null;
+            const data = await response.json();
+            return this.resolveAccessToken(data) ?? null;
         }
         catch (error) {
             console.error('Token refresh failed (body mode):', error);
-            this.accessToken = '';
-            this.tokens.clear();
-            return false;
+            return null;
         }
     }
-    buildQueryString(options) {
-        if (options === undefined) {
-            return '';
-        }
-        const array = [];
-        for (let key in options) {
-            if (options.hasOwnProperty(key) && (options[key] !== null) && (options[key] !== undefined)) {
-                array.push(encodeURIComponent(key) + "=" + encodeURIComponent(options[key]));
+    // ── OAuth ────────────────────────────────────────────────────────────────
+    async loginWithProvider(provider) {
+        return new Promise((resolve) => {
+            const width = 500, height = 600;
+            const left = (window.screen.width - width) / 2;
+            const top = (window.screen.height - height) / 2;
+            const accountsUrl = this.getAccountsUrl();
+            const oauthUrl = `${accountsUrl}/oauth/${provider}?platform=${this.config.platformCode}&mode=popup`;
+            const popup = window.open(oauthUrl, `${provider}_login`, `width=${width},height=${height},left=${left},top=${top}`);
+            if (!popup) {
+                resolve({ success: false, message: 'Popup blocked. Please allow popups for this site.' });
+                return;
             }
-        }
-        const str = array.join('&');
-        if (str !== '') {
-            return '?' + str;
-        }
-        return '';
-    }
-    /**
-     * Upload a drawing (uses upload server if configured, otherwise API server)
-     * @deprecated Platform-specific method - consider moving to platform service
-     */
-    async uploadDrawing(formData) {
-        const uploadHost = this.environment.uploadServer?.host || this.host;
-        const url = uploadHost + '/upload/drawing';
-        const fetchOptions = {
-            method: 'POST',
-            mode: 'cors',
-            redirect: 'error',
-            body: formData
-        };
-        return this.request(url, fetchOptions, null);
-    }
-    /**
-     * Upload an image (uses upload server if configured, otherwise API server)
-     * @deprecated Platform-specific method - consider moving to platform service
-     */
-    async uploadImage(formData) {
-        const uploadHost = this.environment.uploadServer?.host || this.host;
-        const url = uploadHost + '/upload/image';
-        const fetchOptions = {
-            method: 'POST',
-            mode: 'cors',
-            redirect: 'error',
-            body: formData
-        };
-        return this.request(url, fetchOptions, null);
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: ApiConnectionService, deps: [{ token: TokenService }, { token: SigninStatusService }, { token: MyEnvironmentModel }, { token: CsrfService }], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: ApiConnectionService, providedIn: 'root' });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: ApiConnectionService, decorators: [{
-            type: Injectable,
-            args: [{
-                    providedIn: 'root'
-                }]
-        }], ctorParameters: () => [{ type: TokenService }, { type: SigninStatusService }, { type: MyEnvironmentModel }, { type: CsrfService }] });
-
-class AuthService {
-    tokens;
-    signinStatus;
-    environment;
-    USER_STORAGE_KEY = 'progalaxyapi_user';
-    ACTIVE_AUTH_SERVER_KEY = 'progalaxyapi_active_auth_server';
-    // Observable user state
-    userSubject = new BehaviorSubject(null);
-    user$ = this.userSubject.asObservable();
-    // Current active auth server name (for multi-server mode)
-    activeAuthServer = null;
-    constructor(tokens, signinStatus, environment) {
-        this.tokens = tokens;
-        this.signinStatus = signinStatus;
-        this.environment = environment;
-        // Restore user from localStorage on initialization
-        this.restoreUser();
-        // Restore active auth server
-        this.restoreActiveAuthServer();
+            const messageHandler = (event) => {
+                if (event.origin !== new URL(accountsUrl).origin)
+                    return;
+                if (event.data.type === 'oauth_success') {
+                    window.removeEventListener('message', messageHandler);
+                    popup.close();
+                    const rawUser = event.data.user || this.resolveUser(event.data);
+                    resolve({
+                        success: true,
+                        accessToken: event.data.access_token,
+                        user: rawUser ? this.normalizeUser(rawUser) : undefined
+                    });
+                }
+                else if (event.data.type === 'oauth_error') {
+                    window.removeEventListener('message', messageHandler);
+                    popup.close();
+                    resolve({ success: false, message: event.data.message || 'OAuth login failed' });
+                }
+            };
+            window.addEventListener('message', messageHandler);
+            const checkClosed = setInterval(() => {
+                if (popup.closed) {
+                    clearInterval(checkClosed);
+                    window.removeEventListener('message', messageHandler);
+                    resolve({ success: false, message: 'Login cancelled' });
+                }
+            }, 500);
+        });
     }
-    // ===== Multi-Server Support Methods =====
-    /**
-     * Get the current accounts URL based on configuration
-     * Supports both single-server (accountsUrl) and multi-server (authServers) modes
-     * @param serverName - Optional server name for multi-server mode
-     */
-    getAccountsUrl(serverName) {
-        // Multi-server mode
-        if (this.environment.authServers && Object.keys(this.environment.authServers).length > 0) {
-            const targetServer = serverName || this.activeAuthServer || this.getDefaultAuthServer();
-            if (!targetServer) {
-                throw new Error('No auth server specified and no default server configured');
-            }
-            const serverConfig = this.environment.authServers[targetServer];
-            if (!serverConfig) {
-                throw new Error(`Auth server '${targetServer}' not found in configuration`);
+    // ── Multi-tenant ─────────────────────────────────────────────────────────
+    async selectTenant(tenantId, accessToken) {
+        try {
+            const accountsUrl = this.getAccountsUrl();
+            const response = await fetch(`${accountsUrl}/api/auth/select-tenant`, {
+                method: 'POST',
+                headers: {
+                    'Authorization': `Bearer ${accessToken}`,
+                    'Content-Type': 'application/json'
+                },
+                credentials: 'include',
+                body: JSON.stringify({ tenant_id: tenantId })
+            });
+            const data = await response.json();
+            if (this.isAuthSuccess(data)) {
+                return { success: true, accessToken: this.resolveAccessToken(data) };
             }
-            return serverConfig.url;
+            return { success: false, message: this.resolveErrorMessage(data, 'Failed to select tenant') };
         }
-        // Single-server mode (backward compatibility)
-        if (this.environment.accountsUrl) {
-            return this.environment.accountsUrl;
+        catch {
+            return { success: false, message: 'Network error. Please try again.' };
         }
-        throw new Error('No authentication server configured. Set either accountsUrl or authServers in environment config.');
     }
-    /**
-     * Get the default auth server name
-     */
-    getDefaultAuthServer() {
-        if (!this.environment.authServers) {
-            return null;
+    async getTenantMemberships(accessToken) {
+        try {
+            const accountsUrl = this.getAccountsUrl();
+            const response = await fetch(`${accountsUrl}/api/auth/memberships`, {
+                method: 'GET',
+                headers: {
+                    'Authorization': `Bearer ${accessToken}`,
+                    'Content-Type': 'application/json'
+                },
+                credentials: 'include'
+            });
+            const data = await response.json();
+            return data.memberships || [];
         }
-        // Find server marked as default
-        for (const [name, config] of Object.entries(this.environment.authServers)) {
-            if (config.default) {
-                return name;
-            }
+        catch {
+            return [];
         }
-        // If no default is marked, use the first server
-        const firstServer = Object.keys(this.environment.authServers)[0];
-        return firstServer || null;
     }
-    /**
-     * Restore active auth server from localStorage
-     */
-    restoreActiveAuthServer() {
+    async registerTenant(data, accessToken) {
+        if (data.provider !== 'emailPassword') {
+            return this.registerTenantWithOAuth(data.tenantName, data.provider);
+        }
         try {
-            const savedServer = localStorage.getItem(this.ACTIVE_AUTH_SERVER_KEY);
-            if (savedServer && this.environment.authServers?.[savedServer]) {
-                this.activeAuthServer = savedServer;
-            }
-            else {
-                // Set to default if saved server is invalid
-                this.activeAuthServer = this.getDefaultAuthServer();
-            }
+            const apiUrl = this.getPlatformApiUrl();
+            const body = {
+                tenant_name: data.tenantName,
+                email: data.email ?? '',
+                password: data.password ?? '',
+                provider: 'emailPassword'
+            };
+            if (data.displayName)
+                body['display_name'] = data.displayName;
+            if (data.countryCode)
+                body['country_code'] = data.countryCode;
+            if (data.role)
+                body['role'] = data.role;
+            const response = await fetch(`${apiUrl}/auth/register-tenant`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(accessToken ? { 'Authorization': `Bearer ${accessToken}` } : {})
+                },
+                credentials: 'include',
+                body: JSON.stringify(body)
+            });
+            return response.json();
         }
-        catch (error) {
-            console.error('Failed to restore active auth server:', error);
-            this.activeAuthServer = this.getDefaultAuthServer();
+        catch {
+            return { success: false, message: 'Network error. Please try again.' };
         }
     }
-    /**
-     * Save active auth server to localStorage
-     */
-    saveActiveAuthServer(serverName) {
+    async registerTenantWithOAuth(tenantName, provider) {
+        return new Promise((resolve) => {
+            const width = 500, height = 600;
+            const left = (window.screen.width - width) / 2;
+            const top = (window.screen.height - height) / 2;
+            const accountsUrl = this.getAccountsUrl();
+            const oauthUrl = `${accountsUrl}/oauth/${provider}?` +
+                `platform=${this.config.platformCode}&mode=popup&action=register_tenant&` +
+                `tenant_name=${encodeURIComponent(tenantName)}`;
+            const popup = window.open(oauthUrl, `${provider}_register_tenant`, `width=${width},height=${height},left=${left},top=${top}`);
+            if (!popup) {
+                resolve({ success: false, message: 'Popup blocked. Please allow popups for this site.' });
+                return;
+            }
+            const messageHandler = (event) => {
+                if (event.origin !== new URL(accountsUrl).origin)
+                    return;
+                if (event.data.type === 'tenant_register_success') {
+                    window.removeEventListener('message', messageHandler);
+                    popup.close();
+                    resolve({ success: true, tenant: event.data.tenant, user: event.data.user,
+                        access_token: event.data.access_token });
+                }
+                else if (event.data.type === 'tenant_register_error') {
+                    window.removeEventListener('message', messageHandler);
+                    popup.close();
+                    resolve({ success: false, message: event.data.message || 'Tenant registration failed' });
+                }
+            };
+            window.addEventListener('message', messageHandler);
+            const checkClosed = setInterval(() => {
+                if (popup.closed) {
+                    clearInterval(checkClosed);
+                    window.removeEventListener('message', messageHandler);
+                    resolve({ success: false, message: 'Registration cancelled' });
+                }
+            }, 500);
+        });
+    }
+    async checkTenantSlugAvailable(slug) {
         try {
-            localStorage.setItem(this.ACTIVE_AUTH_SERVER_KEY, serverName);
-            this.activeAuthServer = serverName;
-        }
-        catch (error) {
-            console.error('Failed to save active auth server:', error);
+            const accountsUrl = this.getAccountsUrl();
+            const response = await fetch(`${accountsUrl}/api/auth/check-tenant-slug/${slug}`, {
+                method: 'GET',
+                headers: { 'Content-Type': 'application/json' }
+            });
+            const data = await response.json();
+            return { available: data.available || false, suggestion: data.suggestion };
         }
-    }
-    /**
-     * Get available auth servers
-     * @returns Array of server names or empty array if using single-server mode
-     */
-    getAvailableAuthServers() {
-        if (!this.environment.authServers) {
-            return [];
+        catch {
+            return { available: true };
         }
-        return Object.keys(this.environment.authServers);
     }
-    /**
-     * Get current active auth server name
-     * @returns Server name or null if using single-server mode
-     */
-    getActiveAuthServer() {
-        return this.activeAuthServer;
+    async checkOnboardingStatus(identityId, platformCode) {
+        const accountsUrl = this.getAccountsUrl();
+        const platform = platformCode ?? this.config.platformCode ?? '';
+        const response = await fetch(`${accountsUrl}/api/auth/onboarding/status?platform_code=${platform}&identity_id=${identityId}`, { method: 'GET', headers: { 'Content-Type': 'application/json' }, credentials: 'include' });
+        if (!response.ok)
+            throw new Error('Failed to check onboarding status');
+        return response.json();
     }
-    /**
-     * Switch to a different auth server
-     * @param serverName - Name of the server to switch to
-     * @throws Error if server not found in configuration
-     */
-    switchAuthServer(serverName) {
-        if (!this.environment.authServers) {
-            throw new Error('Multi-server mode not configured. Use authServers in environment config.');
-        }
-        if (!this.environment.authServers[serverName]) {
-            throw new Error(`Auth server '${serverName}' not found in configuration`);
+    async completeTenantOnboarding(countryCode, tenantName, accessToken) {
+        const apiUrl = this.getPlatformApiUrl();
+        const response = await fetch(`${apiUrl}/auth/register-tenant`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Authorization': `Bearer ${accessToken}`
+            },
+            credentials: 'include',
+            body: JSON.stringify({
+                platform: this.config.platformCode,
+                tenant_name: tenantName,
+                country_code: countryCode,
+                provider: 'google',
+                oauth_token: accessToken
+            })
+        });
+        if (!response.ok) {
+            const errorData = await response.json();
+            throw new Error(errorData.message || 'Failed to create tenant');
         }
-        this.saveActiveAuthServer(serverName);
+        return response.json();
     }
-    /**
-     * Get auth server configuration
-     * @param serverName - Optional server name (uses active server if not specified)
-     */
-    getAuthServerConfig(serverName) {
-        if (!this.environment.authServers) {
-            return null;
+    async checkEmail(email) {
+        try {
+            const accountsUrl = this.getAccountsUrl();
+            const response = await fetch(`${accountsUrl}/api/auth/check-email`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ email })
+            });
+            const data = await response.json();
+            return { exists: data.exists, user: data.user };
         }
-        const targetServer = serverName || this.activeAuthServer || this.getDefaultAuthServer();
-        if (!targetServer) {
-            return null;
+        catch {
+            return { exists: false };
         }
-        return this.environment.authServers[targetServer] || null;
     }
-    /**
-     * Check if multi-server mode is enabled
-     */
-    isMultiServerMode() {
-        return !!(this.environment.authServers && Object.keys(this.environment.authServers).length > 0);
+}
+
+/**
+ * Configure the ngx-stonescriptphp-client library.
+ *
+ * @param environment - Library configuration (API server, auth settings, etc.)
+ * @param plugin - Optional auth plugin override. Defaults to StoneScriptPHPAuth.
+ *   Provide your own plugin to use Firebase, progalaxyelabs-auth, Okta, or any other auth backend.
+ *
+ * @example Default (StoneScriptPHP backend)
+ * ```typescript
+ * // app.config.ts
+ * export const appConfig: ApplicationConfig = {
+ *   providers: [
+ *     provideNgxStoneScriptPhpClient(environment)
+ *   ]
+ * };
+ * ```
+ *
+ * @example External auth plugin
+ * ```typescript
+ * import { ProgalaxyElabsAuth } from './progalaxyelabs-auth.auth-plugin';
+ *
+ * providers: [
+ *   provideNgxStoneScriptPhpClient(environment, new ProgalaxyElabsAuth({ host: '...' }))
+ * ]
+ * ```
+ *
+ * @example Firebase
+ * ```typescript
+ * import { FirebaseAuthPlugin } from './firebase-auth.auth-plugin';
+ *
+ * providers: [
+ *   provideNgxStoneScriptPhpClient(environment, new FirebaseAuthPlugin(firebaseConfig))
+ * ]
+ * ```
+ */
+function provideNgxStoneScriptPhpClient(environment, plugin) {
+    const resolvedPlugin = plugin ?? new StoneScriptPHPAuth({
+        // Resolve auth host: auth.host → accountsServer.host (compat) → accountsUrl (compat) → apiServer.host
+        host: environment.auth?.host
+            || environment.accountsServer?.host
+            || environment.accountsUrl
+            || environment.apiServer.host,
+        platformCode: environment.platformCode,
+        authServers: environment.authServers,
+        responseMap: environment.auth?.responseMap ?? environment.authResponseMap,
+        auth: environment.auth,
+        apiUrl: environment.apiUrl
+    });
+    return makeEnvironmentProviders([
+        { provide: MyEnvironmentModel, useValue: environment },
+        { provide: AUTH_PLUGIN, useValue: resolvedPlugin }
+    ]);
+}
+
+class ApiResponse {
+    status;
+    data;
+    message;
+    get success() {
+        return this.status === 'ok';
     }
-    /**
-     * Get the platform's own API base URL
-     * Used for routes that go through the platform API proxy (e.g. register-tenant)
-     * @throws Error if no API URL is configured
-     */
-    getPlatformApiUrl() {
-        if (this.environment.apiUrl) {
-            return this.environment.apiUrl;
+    get errors() {
+        return this.message ? [this.message] : [];
+    }
+    constructor(status, data = null, message = '') {
+        this.status = status;
+        this.data = data || null;
+        this.message = message;
+    }
+    onOk(callback) {
+        if (this.status === 'ok') {
+            callback(this.data);
         }
-        if (this.environment.apiServer?.host) {
-            return this.environment.apiServer.host;
+        return this;
+    }
+    onNotOk(callback) {
+        if (this.status === 'not ok') {
+            callback(this.message, this.data);
         }
-        throw new Error('No platform API URL configured. Set apiUrl in environment config.');
+        return this;
     }
-    // ===== Auth Response Mapping Helpers =====
-    /** Default response map: StoneScriptPHP format */
-    get responseMap() {
-        return this.environment.authResponseMap ?? {
-            successPath: 'status',
-            successValue: 'ok',
-            accessTokenPath: 'data.access_token',
-            refreshTokenPath: 'data.refresh_token',
-            userPath: 'data.user',
-            errorMessagePath: 'message'
-        };
+    onError(callback) {
+        if (this.status === 'error') {
+            callback();
+        }
+        return this;
     }
-    /** Resolve a dot-notation path on an object (e.g., 'data.access_token') */
-    resolvePath(obj, path) {
-        return path.split('.').reduce((o, key) => o?.[key], obj);
+    isSuccess() {
+        return this.status === 'ok';
     }
-    /** Check if an auth response indicates success */
-    isAuthSuccess(data) {
-        const map = this.responseMap;
-        if (map.successPath) {
-            return this.resolvePath(data, map.successPath) === (map.successValue ?? 'ok');
+    isError() {
+        return this.status === 'error' || this.status === 'not ok';
+    }
+    getData() {
+        return this.data || null;
+    }
+    getError() {
+        return this.message || 'Unknown error';
+    }
+    getStatus() {
+        return this.status;
+    }
+    getMessage() {
+        return this.message;
+    }
+}
+
+class TokenService {
+    accessToken = '';
+    refreshToken = '';
+    lsAccessTokenKey = 'progalaxyapi_access_token';
+    lsRefreshTokenKey = 'progalaxyapi_refresh_token';
+    constructor() { }
+    setTokens(accessToken, refreshToken) {
+        this.accessToken = accessToken;
+        this.refreshToken = refreshToken;
+        localStorage.setItem(this.lsAccessTokenKey, accessToken);
+        localStorage.setItem(this.lsRefreshTokenKey, refreshToken);
+    }
+    setAccessToken(accessToken) {
+        this.accessToken = accessToken;
+        localStorage.setItem(this.lsAccessTokenKey, accessToken);
+    }
+    setRefreshToken(refreshToken) {
+        this.refreshToken = refreshToken;
+        localStorage.setItem(this.lsRefreshTokenKey, refreshToken);
+    }
+    getAccessToken() {
+        if (this.accessToken) {
+            return this.accessToken;
+        }
+        const storedAccessToken = localStorage.getItem(this.lsAccessTokenKey);
+        if (storedAccessToken) {
+            return storedAccessToken;
+        }
+        else {
+            return '';
         }
-        // No successPath configured — success = access token present
-        return !!this.resolvePath(data, map.accessTokenPath);
     }
-    /** Extract access token from auth response */
-    getAccessToken(data) {
-        return this.resolvePath(data, this.responseMap.accessTokenPath);
+    getRefreshToken() {
+        if (this.refreshToken) {
+            return this.refreshToken;
+        }
+        const storedRefreshToken = localStorage.getItem(this.lsRefreshTokenKey);
+        if (storedRefreshToken) {
+            return storedRefreshToken;
+        }
+        else {
+            return '';
+        }
     }
-    /** Extract refresh token from auth response */
-    getRefreshToken(data) {
-        return this.resolvePath(data, this.responseMap.refreshTokenPath);
+    clear() {
+        this.accessToken = '';
+        this.refreshToken = '';
+        localStorage.removeItem(this.lsAccessTokenKey);
+        localStorage.removeItem(this.lsRefreshTokenKey);
     }
-    /** Extract user/identity object from auth response */
-    getUserFromResponse(data) {
-        return this.resolvePath(data, this.responseMap.userPath);
+    /**
+     * Check if there is a non-empty access token.
+     * Token is treated as opaque — validity is determined by the auth server.
+     */
+    hasValidAccessToken() {
+        const token = this.getAccessToken();
+        return token !== null && token !== '';
     }
-    /** Extract error message from auth response */
-    getErrorMessage(data, fallback) {
-        const path = this.responseMap.errorMessagePath ?? 'message';
-        return this.resolvePath(data, path) || fallback;
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TokenService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TokenService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TokenService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: () => [] });
+
+/**
+ * @deprecated Use boolean directly. Kept for backward compatibility.
+ */
+var VerifyStatus;
+(function (VerifyStatus) {
+    VerifyStatus["initialized"] = "initialized";
+    VerifyStatus["yes"] = "yes";
+    VerifyStatus["no"] = "no";
+})(VerifyStatus || (VerifyStatus = {}));
+class SigninStatusService {
+    status;
+    constructor() {
+        this.status = new BehaviorSubject(false);
     }
-    /** Normalize a user/identity object into the standard User shape */
-    normalizeUser(raw) {
-        return {
-            user_id: raw.user_id ?? (raw.id ? this.hashUUID(raw.id) : 0),
-            id: raw.id ?? String(raw.user_id),
-            email: raw.email,
-            display_name: raw.display_name ?? raw.email?.split('@')[0] ?? '',
-            photo_url: raw.photo_url,
-            is_email_verified: raw.is_email_verified ?? false
-        };
+    signedOut() {
+        this.status.next(false);
+    }
+    signedIn() {
+        this.status.next(true);
     }
     /**
-     * Hash UUID to numeric ID for backward compatibility
-     * Converts UUID string to a consistent numeric ID for legacy code
+     * Set signin status
+     * @param isSignedIn - True if user is signed in, false otherwise
      */
-    hashUUID(uuid) {
-        let hash = 0;
-        for (let i = 0; i < uuid.length; i++) {
-            const char = uuid.charCodeAt(i);
-            hash = ((hash << 5) - hash) + char;
-            hash = hash & hash; // Convert to 32bit integer
-        }
-        return Math.abs(hash);
+    setSigninStatus(isSignedIn) {
+        this.status.next(isSignedIn);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: SigninStatusService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: SigninStatusService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: SigninStatusService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: () => [] });
+
+/**
+ * AuthService — manages auth state and delegates all auth operations to the AuthPlugin.
+ *
+ * This service holds user state (via BehaviorSubject) and tokens (via TokenService).
+ * It does not make any HTTP calls directly — all auth logic lives in the plugin.
+ *
+ * Provide a plugin via provideNgxStoneScriptPhpClient():
+ * - Default: StoneScriptPHPAuth (built-in, matches StoneScriptPHP backend)
+ * - External: any class implementing AuthPlugin (Firebase, progalaxyelabs-auth, Okta, etc.)
+ */
+class AuthService {
+    plugin;
+    tokens;
+    signinStatus;
+    USER_STORAGE_KEY = 'progalaxyapi_user';
+    userSubject = new BehaviorSubject(null);
+    user$ = this.userSubject.asObservable();
+    constructor(plugin, tokens, signinStatus) {
+        this.plugin = plugin;
+        this.tokens = tokens;
+        this.signinStatus = signinStatus;
+        this.restoreUser();
     }
-    /**
-     * Restore user from localStorage
-     */
+    // ── State management ──────────────────────────────────────────────────────
     restoreUser() {
         try {
             const userJson = localStorage.getItem(this.USER_STORAGE_KEY);
-            if (userJson) {
-                const user = JSON.parse(userJson);
-                this.updateUser(user);
-            }
+            if (userJson)
+                this.updateUser(JSON.parse(userJson));
         }
         catch (error) {
             console.error('Failed to restore user from localStorage:', error);
         }
     }
-    /**
-     * Save user to localStorage
-     */
     saveUser(user) {
         try {
             if (user) {
@@ -908,699 +862,431 @@ class AuthService {
             console.error('Failed to save user to localStorage:', error);
         }
     }
-    /**
-     * Update user subject and persist to localStorage
-     */
     updateUser(user) {
         this.userSubject.next(user);
         this.saveUser(user);
     }
-    /**
-     * Login with email and password
-     * @param email - User email
-     * @param password - User password
-     * @param serverName - Optional: Specify which auth server to use (for multi-server mode)
-     */
-    async loginWithEmail(email, password, serverName) {
-        try {
-            const accountsUrl = this.getAccountsUrl(serverName);
-            const response = await fetch(`${accountsUrl}/api/auth/login`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                credentials: 'include',
-                body: JSON.stringify({
-                    email,
-                    password,
-                    platform: this.environment.platformCode
-                })
-            });
-            const data = await response.json();
-            if (this.isAuthSuccess(data)) {
-                const accessToken = this.getAccessToken(data);
-                this.tokens.setAccessToken(accessToken);
-                this.signinStatus.setSigninStatus(true);
-                const rawUser = this.getUserFromResponse(data);
-                if (rawUser) {
-                    const normalizedUser = this.normalizeUser(rawUser);
-                    this.updateUser(normalizedUser);
-                    return { success: true, user: normalizedUser };
-                }
-                return { success: true };
-            }
-            return {
-                success: false,
-                message: this.getErrorMessage(data, 'Invalid credentials')
-            };
-        }
-        catch (error) {
-            return {
-                success: false,
-                message: 'Network error. Please try again.'
-            };
-        }
+    storeAuthResult(result) {
+        if (result.accessToken)
+            this.tokens.setAccessToken(result.accessToken);
+        if (result.refreshToken)
+            this.tokens.setRefreshToken(result.refreshToken);
+        if (result.user)
+            this.updateUser(result.user);
+        this.signinStatus.setSigninStatus(true);
+    }
+    // ── Core auth operations ──────────────────────────────────────────────────
+    async loginWithEmail(email, password) {
+        const result = await this.plugin.login(email, password);
+        if (result.success)
+            this.storeAuthResult(result);
+        return result;
     }
-    /**
-     * Login with Google OAuth (popup window)
-     * @param serverName - Optional: Specify which auth server to use (for multi-server mode)
-     */
     async loginWithGoogle(serverName) {
-        return this.loginWithOAuth('google', serverName);
+        return this.loginWithProvider('google');
     }
-    /**
-     * Login with GitHub OAuth (popup window)
-     * @param serverName - Optional: Specify which auth server to use (for multi-server mode)
-     */
     async loginWithGitHub(serverName) {
-        return this.loginWithOAuth('github', serverName);
+        return this.loginWithProvider('github');
     }
-    /**
-     * Login with LinkedIn OAuth (popup window)
-     * @param serverName - Optional: Specify which auth server to use (for multi-server mode)
-     */
     async loginWithLinkedIn(serverName) {
-        return this.loginWithOAuth('linkedin', serverName);
+        return this.loginWithProvider('linkedin');
     }
-    /**
-     * Login with Apple OAuth (popup window)
-     * @param serverName - Optional: Specify which auth server to use (for multi-server mode)
-     */
     async loginWithApple(serverName) {
-        return this.loginWithOAuth('apple', serverName);
+        return this.loginWithProvider('apple');
     }
-    /**
-     * Login with Microsoft OAuth (popup window)
-     * @param serverName - Optional: Specify which auth server to use (for multi-server mode)
-     */
     async loginWithMicrosoft(serverName) {
-        return this.loginWithOAuth('microsoft', serverName);
+        return this.loginWithProvider('microsoft');
     }
-    /**
-     * Login with Zoho OAuth (popup window)
-     * @param serverName - Optional: Specify which auth server to use (for multi-server mode)
-     */
     async loginWithZoho(serverName) {
-        return this.loginWithOAuth('zoho', serverName);
+        return this.loginWithProvider('zoho');
     }
-    /**
-     * Generic provider-based login (supports all OAuth providers)
-     * @param provider - The provider identifier
-     * @param serverName - Optional: Specify which auth server to use (for multi-server mode)
-     */
     async loginWithProvider(provider, serverName) {
         if (provider === 'emailPassword') {
             throw new Error('Use loginWithEmail() for email/password authentication');
         }
-        return this.loginWithOAuth(provider, serverName);
-    }
-    /**
-     * Generic OAuth login handler
-     * Opens popup window and listens for postMessage
-     * @param provider - OAuth provider name
-     * @param serverName - Optional: Specify which auth server to use (for multi-server mode)
-     */
-    async loginWithOAuth(provider, serverName) {
-        return new Promise((resolve) => {
-            const width = 500;
-            const height = 600;
-            const left = (window.screen.width - width) / 2;
-            const top = (window.screen.height - height) / 2;
-            const accountsUrl = this.getAccountsUrl(serverName);
-            const oauthUrl = `${accountsUrl}/oauth/${provider}?` +
-                `platform=${this.environment.platformCode}&` +
-                `mode=popup`;
-            const popup = window.open(oauthUrl, `${provider}_login`, `width=${width},height=${height},left=${left},top=${top}`);
-            if (!popup) {
-                resolve({
-                    success: false,
-                    message: 'Popup blocked. Please allow popups for this site.'
-                });
-                return;
-            }
-            // Listen for message from popup
-            const messageHandler = (event) => {
-                // Verify origin
-                if (event.origin !== new URL(accountsUrl).origin) {
-                    return;
-                }
-                if (event.data.type === 'oauth_success') {
-                    this.tokens.setAccessToken(event.data.access_token);
-                    this.signinStatus.setSigninStatus(true);
-                    const rawUser = event.data.user || this.getUserFromResponse(event.data);
-                    const normalizedUser = rawUser ? this.normalizeUser(rawUser) : undefined;
-                    if (normalizedUser) {
-                        this.updateUser(normalizedUser);
-                    }
-                    window.removeEventListener('message', messageHandler);
-                    popup.close();
-                    resolve({
-                        success: true,
-                        user: normalizedUser
-                    });
-                }
-                else if (event.data.type === 'oauth_error') {
-                    window.removeEventListener('message', messageHandler);
-                    popup.close();
-                    resolve({
-                        success: false,
-                        message: event.data.message || 'OAuth login failed'
-                    });
-                }
-            };
-            window.addEventListener('message', messageHandler);
-            // Check if popup was closed manually
-            const checkClosed = setInterval(() => {
-                if (popup.closed) {
-                    clearInterval(checkClosed);
-                    window.removeEventListener('message', messageHandler);
-                    resolve({
-                        success: false,
-                        message: 'Login cancelled'
-                    });
-                }
-            }, 500);
-        });
+        if (!this.plugin.loginWithProvider) {
+            return { success: false, message: 'OAuth not supported by the configured auth plugin' };
+        }
+        const result = await this.plugin.loginWithProvider(provider);
+        if (result.success)
+            this.storeAuthResult(result);
+        return result;
     }
-    /**
-     * Register new user
-     * @param email - User email
-     * @param password - User password
-     * @param displayName - Display name
-     * @param serverName - Optional: Specify which auth server to use (for multi-server mode)
-     */
     async register(email, password, displayName, serverName) {
-        try {
-            const accountsUrl = this.getAccountsUrl(serverName);
-            const response = await fetch(`${accountsUrl}/api/auth/register`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                credentials: 'include',
-                body: JSON.stringify({
-                    email,
-                    password,
-                    display_name: displayName,
-                    platform: this.environment.platformCode
-                })
-            });
-            const data = await response.json();
-            if (this.isAuthSuccess(data)) {
-                const accessToken = this.getAccessToken(data);
-                this.tokens.setAccessToken(accessToken);
-                this.signinStatus.setSigninStatus(true);
-                const rawUser = this.getUserFromResponse(data);
-                if (rawUser) {
-                    const normalizedUser = this.normalizeUser(rawUser);
-                    this.updateUser(normalizedUser);
-                    return {
-                        success: true,
-                        user: normalizedUser,
-                        message: data.needs_verification ? 'Please verify your email' : undefined
-                    };
-                }
-                return { success: true };
-            }
-            return {
-                success: false,
-                message: this.getErrorMessage(data, 'Registration failed')
-            };
-        }
-        catch (error) {
-            return {
-                success: false,
-                message: 'Network error. Please try again.'
-            };
-        }
+        const result = await this.plugin.register(email, password, displayName);
+        if (result.success)
+            this.storeAuthResult(result);
+        return result;
     }
-    /**
-     * Sign out user
-     * @param serverName - Optional: Specify which auth server to logout from (for multi-server mode)
-     */
     async signout(serverName) {
-        try {
-            const refreshToken = this.tokens.getRefreshToken();
-            if (refreshToken) {
-                const accountsUrl = this.getAccountsUrl(serverName);
-                await fetch(`${accountsUrl}/api/auth/logout`, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json'
-                    },
-                    credentials: 'include',
-                    body: JSON.stringify({
-                        refresh_token: refreshToken
-                    })
-                });
-            }
-        }
-        catch (error) {
-            console.error('Logout API call failed:', error);
-        }
-        finally {
-            this.tokens.clear();
-            this.signinStatus.setSigninStatus(false);
-            this.updateUser(null);
-        }
+        const refreshToken = this.tokens.getRefreshToken() || undefined;
+        await this.plugin.logout(refreshToken);
+        this.tokens.clear();
+        this.signinStatus.setSigninStatus(false);
+        this.updateUser(null);
     }
-    /**
-     * Check for active session (call on app init)
-     * @param serverName - Optional: Specify which auth server to check (for multi-server mode)
-     */
     async checkSession(serverName) {
         if (this.tokens.hasValidAccessToken()) {
             this.signinStatus.setSigninStatus(true);
             return true;
         }
-        // Try to refresh using httpOnly cookie
-        try {
-            const accountsUrl = this.getAccountsUrl(serverName);
-            const response = await fetch(`${accountsUrl}/api/auth/refresh`, {
-                method: 'POST',
-                credentials: 'include'
-            });
-            if (!response.ok) {
-                // Refresh failed (expired, revoked, wrong keypair) — clear stale tokens
-                // so the user gets a clean login page, not a broken retry loop
-                this.tokens.clear();
-                this.updateUser(null);
-                this.signinStatus.setSigninStatus(false);
-                return false;
-            }
-            const data = await response.json();
-            const accessToken = this.getAccessToken(data) ?? data.access_token;
-            if (accessToken) {
-                this.tokens.setAccessToken(accessToken);
-                const rawUser = this.getUserFromResponse(data) ?? data.user;
-                if (rawUser) {
-                    this.updateUser(this.normalizeUser(rawUser));
-                }
-                this.signinStatus.setSigninStatus(true);
-                return true;
-            }
-            // Response OK but no token — clear stale state
-            this.tokens.clear();
-            this.updateUser(null);
-            return false;
-        }
-        catch (error) {
-            // Network error — clear stale state to avoid retry loops
-            this.tokens.clear();
-            this.updateUser(null);
-            this.signinStatus.setSigninStatus(false);
-            return false;
+        const result = await this.plugin.checkSession();
+        if (result.success && result.accessToken) {
+            this.tokens.setAccessToken(result.accessToken);
+            if (result.user)
+                this.updateUser(result.user);
+            this.signinStatus.setSigninStatus(true);
+            return true;
         }
+        this.tokens.clear();
+        this.updateUser(null);
+        this.signinStatus.setSigninStatus(false);
+        return false;
     }
     /**
-     * Check if user is authenticated
-     */
-    isAuthenticated() {
-        return this.tokens.hasValidAccessToken();
-    }
-    /**
-     * Get current user (synchronous)
-     */
-    getCurrentUser() {
-        return this.userSubject.value;
-    }
-    // ===== Multi-Tenant Methods =====
-    /**
-     * Register a new user AND create a new tenant (organization)
-     * This is used when a user wants to create their own organization
+     * Refresh the access token. Called by ApiConnectionService on 401.
+     * @returns true if token was refreshed, false if refresh failed (user is signed out)
      */
-    async registerTenant(data) {
-        try {
-            // If using OAuth, initiate OAuth flow first
-            if (data.provider !== 'emailPassword') {
-                return await this.registerTenantWithOAuth(data.tenantName, data.tenantSlug, data.provider);
-            }
-            // Email/password registration — route through platform API proxy
-            const apiUrl = this.getPlatformApiUrl();
-            const response = await fetch(`${apiUrl}/auth/register-tenant`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                credentials: 'include',
-                body: JSON.stringify({
-                    platform: this.environment.platformCode,
-                    tenant_name: data.tenantName,
-                    tenant_slug: data.tenantSlug,
-                    display_name: data.displayName,
-                    email: data.email,
-                    password: data.password,
-                    provider: 'emailPassword'
-                })
-            });
-            const result = await response.json();
-            if (this.isAuthSuccess(result)) {
-                const accessToken = this.getAccessToken(result);
-                if (accessToken) {
-                    this.tokens.setAccessToken(accessToken);
-                    this.signinStatus.setSigninStatus(true);
-                }
-                const rawUser = this.getUserFromResponse(result);
-                if (rawUser) {
-                    this.updateUser(this.normalizeUser(rawUser));
-                }
-            }
-            return result;
-        }
-        catch (error) {
-            return {
-                success: false,
-                message: 'Network error. Please try again.'
-            };
+    async refresh() {
+        const newToken = await this.plugin.refresh(this.tokens.getAccessToken(), this.tokens.getRefreshToken() || undefined);
+        if (newToken) {
+            this.tokens.setAccessToken(newToken);
+            return true;
         }
+        this.tokens.clear();
+        this.updateUser(null);
+        this.signinStatus.signedOut();
+        return false;
     }
-    /**
-     * Register tenant with OAuth provider
-     * Opens popup window for OAuth flow
-     */
-    async registerTenantWithOAuth(tenantName, tenantSlug, provider) {
-        return new Promise((resolve) => {
-            const width = 500;
-            const height = 600;
-            const left = (window.screen.width - width) / 2;
-            const top = (window.screen.height - height) / 2;
-            // Build OAuth URL with tenant registration params
-            const accountsUrl = this.getAccountsUrl();
-            const oauthUrl = `${accountsUrl}/oauth/${provider}?` +
-                `platform=${this.environment.platformCode}&` +
-                `mode=popup&` +
-                `action=register_tenant&` +
-                `tenant_name=${encodeURIComponent(tenantName)}&` +
-                `tenant_slug=${encodeURIComponent(tenantSlug)}`;
-            const popup = window.open(oauthUrl, `${provider}_register_tenant`, `width=${width},height=${height},left=${left},top=${top}`);
-            if (!popup) {
-                resolve({
-                    success: false,
-                    message: 'Popup blocked. Please allow popups for this site.'
-                });
-                return;
-            }
-            // Listen for message from popup
-            const messageHandler = (event) => {
-                // Verify origin
-                if (event.origin !== new URL(accountsUrl).origin) {
-                    return;
-                }
-                if (event.data.type === 'tenant_register_success') {
-                    if (event.data.access_token) {
-                        this.tokens.setAccessToken(event.data.access_token);
-                        this.signinStatus.setSigninStatus(true);
-                    }
-                    const rawUser = event.data.user || this.getUserFromResponse(event.data);
-                    if (rawUser) {
-                        this.updateUser(this.normalizeUser(rawUser));
-                    }
-                    window.removeEventListener('message', messageHandler);
-                    popup.close();
-                    resolve({
-                        success: true,
-                        tenant: event.data.tenant,
-                        user: event.data.user
-                    });
-                }
-                else if (event.data.type === 'tenant_register_error') {
-                    window.removeEventListener('message', messageHandler);
-                    popup.close();
-                    resolve({
-                        success: false,
-                        message: event.data.message || 'Tenant registration failed'
-                    });
-                }
-            };
-            window.addEventListener('message', messageHandler);
-            // Check if popup was closed manually
-            const checkClosed = setInterval(() => {
-                if (popup.closed) {
-                    clearInterval(checkClosed);
-                    window.removeEventListener('message', messageHandler);
-                    resolve({
-                        success: false,
-                        message: 'Registration cancelled'
-                    });
-                }
-            }, 500);
-        });
-    }
-    /**
-     * Get all tenant memberships for the authenticated user
-     * @param serverName - Optional: Specify which auth server to query (for multi-server mode)
-     */
-    async getTenantMemberships(serverName) {
-        try {
-            const accountsUrl = this.getAccountsUrl(serverName);
-            const response = await fetch(`${accountsUrl}/api/auth/memberships`, {
-                method: 'GET',
-                headers: {
-                    'Authorization': `Bearer ${this.tokens.getAccessToken()}`,
-                    'Content-Type': 'application/json'
-                },
-                credentials: 'include'
-            });
-            const data = await response.json();
-            return {
-                memberships: data.memberships || []
-            };
-        }
-        catch (error) {
-            return { memberships: [] };
-        }
+    isAuthenticated() {
+        return this.tokens.hasValidAccessToken();
     }
-    /**
-     * Select a tenant for the current session
-     * Updates the JWT token with tenant context
-     * @param tenantId - Tenant ID to select
-     * @param serverName - Optional: Specify which auth server to use (for multi-server mode)
-     */
-    async selectTenant(tenantId, serverName) {
-        try {
-            const accountsUrl = this.getAccountsUrl(serverName);
-            const response = await fetch(`${accountsUrl}/api/auth/select-tenant`, {
-                method: 'POST',
-                headers: {
-                    'Authorization': `Bearer ${this.tokens.getAccessToken()}`,
-                    'Content-Type': 'application/json'
-                },
-                credentials: 'include',
-                body: JSON.stringify({ tenant_id: tenantId })
-            });
-            const data = await response.json();
-            if (this.isAuthSuccess(data)) {
-                const accessToken = this.getAccessToken(data);
-                this.tokens.setAccessToken(accessToken);
-                return {
-                    success: true,
-                    access_token: accessToken
-                };
-            }
-            return {
-                success: false,
-                message: this.getErrorMessage(data, 'Failed to select tenant')
-            };
+    getCurrentUser() {
+        return this.userSubject.value;
+    }
+    // ── Multi-tenant operations ───────────────────────────────────────────────
+    async registerTenant(data) {
+        if (!this.plugin.registerTenant) {
+            return { success: false, message: 'registerTenant not supported by the configured auth plugin' };
         }
-        catch (error) {
-            return {
-                success: false,
-                message: 'Network error. Please try again.'
-            };
+        const accessToken = this.tokens.getAccessToken() || undefined;
+        const result = await this.plugin.registerTenant(data, accessToken);
+        if (result?.access_token) {
+            this.tokens.setAccessToken(result.access_token);
+            this.signinStatus.setSigninStatus(true);
+        }
+        if (result?.refresh_token) {
+            this.tokens.setRefreshToken(result.refresh_token);
         }
+        return result;
     }
-    /**
-     * Check if a tenant slug is available
-     * @param slug - Tenant slug to check
-     * @param serverName - Optional: Specify which auth server to query (for multi-server mode)
-     */
-    async checkTenantSlugAvailable(slug, serverName) {
-        try {
-            const accountsUrl = this.getAccountsUrl(serverName);
-            const response = await fetch(`${accountsUrl}/api/auth/check-tenant-slug/${slug}`, {
-                method: 'GET',
-                headers: { 'Content-Type': 'application/json' }
-            });
-            const data = await response.json();
-            return {
-                available: data.available || false,
-                suggestion: data.suggestion
-            };
+    async getTenantMemberships(serverName) {
+        if (!this.plugin.getTenantMemberships)
+            return { memberships: [] };
+        const memberships = await this.plugin.getTenantMemberships(this.tokens.getAccessToken());
+        return { memberships };
+    }
+    async selectTenant(tenantId, serverName) {
+        if (!this.plugin.selectTenant) {
+            return { success: false, message: 'selectTenant not supported by the configured auth plugin' };
         }
-        catch (error) {
-            // On error, assume available (don't block registration)
+        const result = await this.plugin.selectTenant(tenantId, this.tokens.getAccessToken());
+        if (result.success && result.accessToken) {
+            this.tokens.setAccessToken(result.accessToken);
+        }
+        return { success: result.success, message: result.message, access_token: result.accessToken };
+    }
+    async checkTenantSlugAvailable(slug, serverName) {
+        if (!this.plugin.checkTenantSlugAvailable)
             return { available: true };
+        return this.plugin.checkTenantSlugAvailable(slug);
+    }
+    async checkOnboardingStatus(identityId, serverName) {
+        if (!this.plugin.checkOnboardingStatus)
+            throw new Error('checkOnboardingStatus not supported');
+        return this.plugin.checkOnboardingStatus(identityId);
+    }
+    async completeTenantOnboarding(countryCode, tenantName, serverName) {
+        if (!this.plugin.completeTenantOnboarding)
+            throw new Error('completeTenantOnboarding not supported');
+        const result = await this.plugin.completeTenantOnboarding(countryCode, tenantName, this.tokens.getAccessToken());
+        if (result?.access_token) {
+            this.tokens.setAccessToken(result.access_token);
+            this.signinStatus.setSigninStatus(true);
         }
+        return result;
     }
-    // ===== Backward Compatibility Methods =====
-    // These methods are deprecated and maintained for backward compatibility
-    // with existing platform code. New code should use the methods above.
-    /**
-     * @deprecated Use getCurrentUser()?.user_id instead
-     */
-    getUserId() {
-        return this.userSubject.value?.user_id || 0;
+    // ── Multi-server (delegated to plugin) ────────────────────────────────────
+    getAvailableAuthServers() {
+        return this.plugin.getAvailableServers?.() ?? [];
     }
-    /**
-     * @deprecated Use getCurrentUser()?.display_name instead
-     */
-    getUserName() {
-        return this.userSubject.value?.display_name || '';
+    getActiveAuthServer() {
+        return this.plugin.getActiveServer?.() ?? null;
     }
-    /**
-     * @deprecated Use getCurrentUser()?.photo_url instead
-     */
-    getPhotoUrl() {
-        return this.userSubject.value?.photo_url || '';
+    switchAuthServer(serverName) {
+        if (!this.plugin.switchServer) {
+            throw new Error('Multi-server mode not supported by the configured auth plugin');
+        }
+        this.plugin.switchServer(serverName);
     }
-    /**
-     * @deprecated Use getCurrentUser()?.display_name instead
-     */
-    getDisplayName() {
-        return this.userSubject.value?.display_name || '';
+    getAuthServerConfig(serverName) {
+        return this.plugin.getServerConfig?.(serverName) ?? null;
     }
-    /**
-     * @deprecated Use `/profile/${getCurrentUser()?.user_id}` instead
-     */
+    isMultiServerMode() {
+        return (this.plugin.getAvailableServers?.() ?? []).length > 0;
+    }
+    // ── Backward compatibility ────────────────────────────────────────────────
+    /** @deprecated Use getCurrentUser()?.user_id instead */
+    getUserId() { return this.userSubject.value?.user_id || 0; }
+    /** @deprecated Use getCurrentUser()?.display_name instead */
+    getUserName() { return this.userSubject.value?.display_name || ''; }
+    /** @deprecated Use getCurrentUser()?.photo_url instead */
+    getPhotoUrl() { return this.userSubject.value?.photo_url || ''; }
+    /** @deprecated Use getCurrentUser()?.display_name instead */
+    getDisplayName() { return this.userSubject.value?.display_name || ''; }
+    /** @deprecated Use `/profile/${getCurrentUser()?.user_id}` instead */
     getProfileUrl() {
         const userId = this.userSubject.value?.user_id;
         return userId ? `/profile/${userId}` : '';
     }
-    /**
-     * @deprecated Use isAuthenticated() instead
-     */
-    async signin() {
-        return this.isAuthenticated();
-    }
-    /**
-     * @deprecated Use loginWithEmail() instead
-     */
+    /** @deprecated Use isAuthenticated() instead */
+    async signin() { return this.isAuthenticated(); }
+    /** @deprecated Use loginWithEmail() instead */
     async verifyCredentials(email, password) {
         const result = await this.loginWithEmail(email, password);
         return result.success;
     }
-    /**
-     * @deprecated Check user.is_email_verified from getCurrentUser() instead
-     */
-    isSigninEmailValid() {
-        return this.userSubject.value?.is_email_verified || false;
-    }
-    /**
-     * @deprecated No longer needed - dialog is managed by platform
-     */
-    onDialogClose() {
-        // No-op for backward compatibility
+    /** @deprecated Check user.is_email_verified from getCurrentUser() instead */
+    isSigninEmailValid() { return this.userSubject.value?.is_email_verified || false; }
+    /** @deprecated No longer needed */
+    onDialogClose() { }
+    /** @deprecated No longer needed */
+    closeSocialAuthDialog() { }
+    /** @deprecated Use checkEmail() from the plugin directly */
+    async getUserProfile(email, serverName) {
+        if (!this.plugin.checkEmail)
+            return null;
+        const result = await this.plugin.checkEmail(email);
+        return result.exists ? result.user : null;
     }
-    /**
-     * @deprecated No longer needed - dialog is managed by platform
-     */
-    closeSocialAuthDialog() {
-        // No-op for backward compatibility
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: AuthService, deps: [{ token: AUTH_PLUGIN }, { token: TokenService }, { token: SigninStatusService }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: AuthService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: AuthService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: () => [{ type: undefined, decorators: [{
+                    type: Inject,
+                    args: [AUTH_PLUGIN]
+                }] }, { type: TokenService }, { type: SigninStatusService }] });
+
+class ApiConnectionService {
+    tokens;
+    signinStatus;
+    environment;
+    authService;
+    host = ''; // base URL without trailing slash
+    constructor(tokens, signinStatus, environment, authService) {
+        this.tokens = tokens;
+        this.signinStatus = signinStatus;
+        this.environment = environment;
+        this.authService = authService;
+        this.host = environment.apiServer.host;
     }
-    /**
-     * @deprecated Check if user exists by calling /api/auth/check-email endpoint
-     */
-    async getUserProfile(email, serverName) {
+    async request(url, options, data) {
         try {
-            const accountsUrl = this.getAccountsUrl(serverName);
-            const response = await fetch(`${accountsUrl}/api/auth/check-email`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ email })
-            });
-            const data = await response.json();
-            return data.exists ? data.user : null;
+            if (data !== null) {
+                const body = JSON.stringify(data);
+                options.body = body || {};
+            }
+            const accessTokenIncluded = this.includeAccessToken(options);
+            let response = await fetch(url, options);
+            if (response.status === 401 && accessTokenIncluded) {
+                response = await this.refreshAndRetry(url, options, response);
+            }
+            if (response.ok) {
+                const json = await response.json();
+                return new ApiResponse(json.status, json.data, json.message);
+            }
+            if (response.status === 401) {
+                this.signinStatus.signedOut();
+            }
+            return this.handleError(response);
         }
         catch (error) {
-            return null;
+            return this.handleError(error);
         }
     }
+    handleError(error) {
+        console.error(`Backend returned code ${error.status}, full error: `, error);
+        return new ApiResponse('error');
+    }
+    async get(endpoint, queryParamsObj) {
+        const url = this.host + endpoint + this.buildQueryString(queryParamsObj);
+        const fetchOptions = { mode: 'cors', redirect: 'error' };
+        return this.request(url, fetchOptions, null);
+    }
+    async post(pathWithQueryParams, data) {
+        const url = this.host + pathWithQueryParams;
+        const fetchOptions = {
+            method: 'POST',
+            mode: 'cors',
+            redirect: 'error',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(data)
+        };
+        return this.request(url, fetchOptions, data);
+    }
+    async put(pathWithQueryParams, data) {
+        const url = this.host + pathWithQueryParams;
+        const fetchOptions = {
+            method: 'PUT',
+            mode: 'cors',
+            redirect: 'error',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(data)
+        };
+        return this.request(url, fetchOptions, data);
+    }
+    async patch(pathWithQueryParams, data) {
+        const url = this.host + pathWithQueryParams;
+        const fetchOptions = {
+            method: 'PATCH',
+            mode: 'cors',
+            redirect: 'error',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(data)
+        };
+        return this.request(url, fetchOptions, data);
+    }
+    async delete(endpoint, queryParamsObj) {
+        const url = this.host + endpoint + this.buildQueryString(queryParamsObj);
+        const fetchOptions = { method: 'DELETE', mode: 'cors', redirect: 'error' };
+        return this.request(url, fetchOptions, null);
+    }
+    includeAccessToken(options) {
+        const accessToken = this.tokens.getAccessToken();
+        if (!accessToken)
+            return false;
+        if (!options.headers)
+            options.headers = {};
+        options.headers['Authorization'] = 'Bearer ' + accessToken;
+        return true;
+    }
+    async refreshAndRetry(url, fetchOptions, response) {
+        const refreshed = await this.authService.refresh();
+        if (!refreshed)
+            return response;
+        fetchOptions.headers['Authorization'] = 'Bearer ' + this.tokens.getAccessToken();
+        return fetch(url, fetchOptions);
+    }
     /**
-     * Check if user has completed onboarding (has a tenant)
-     * @param identityId - User identity ID
-     * @param serverName - Optional: Specify which auth server to query (for multi-server mode)
+     * Refresh the access token (delegates to AuthService → AuthPlugin).
+     * Kept public for backward compatibility.
      */
-    async checkOnboardingStatus(identityId, serverName) {
-        try {
-            const accountsUrl = this.getAccountsUrl(serverName);
-            const response = await fetch(`${accountsUrl}/api/auth/onboarding/status?platform_code=${this.environment.platformCode}&identity_id=${identityId}`, {
-                method: 'GET',
-                headers: { 'Content-Type': 'application/json' },
-                credentials: 'include'
-            });
-            if (!response.ok) {
-                throw new Error('Failed to check onboarding status');
+    async refreshAccessToken() {
+        return this.authService.refresh();
+    }
+    buildQueryString(options) {
+        if (options === undefined)
+            return '';
+        const array = [];
+        for (const key in options) {
+            if (options.hasOwnProperty(key) && options[key] !== null && options[key] !== undefined) {
+                array.push(encodeURIComponent(key) + '=' + encodeURIComponent(options[key]));
             }
-            return await response.json();
-        }
-        catch (error) {
-            throw error;
         }
+        const str = array.join('&');
+        return str ? '?' + str : '';
     }
     /**
-     * Complete tenant onboarding (create tenant with country + org name)
-     * @param countryCode - Country code
-     * @param tenantName - Tenant organization name
-     * @param serverName - Optional: Specify which auth server to use (for multi-server mode)
+     * Upload a drawing (uses upload server if configured, otherwise API server)
+     * @deprecated Platform-specific method - consider moving to platform service
      */
-    async completeTenantOnboarding(countryCode, tenantName, serverName) {
-        try {
-            const accessToken = this.tokens.getAccessToken();
-            if (!accessToken) {
-                throw new Error('Not authenticated');
-            }
-            // Route through platform API proxy — PHP API adds platform_secret header
-            const apiUrl = this.getPlatformApiUrl();
-            const response = await fetch(`${apiUrl}/auth/register-tenant`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'Authorization': `Bearer ${accessToken}`
-                },
-                credentials: 'include',
-                body: JSON.stringify({
-                    platform: this.environment.platformCode,
-                    tenant_name: tenantName,
-                    country_code: countryCode,
-                    provider: 'google', // Assuming OAuth
-                    oauth_token: accessToken
-                })
-            });
-            if (!response.ok) {
-                const errorData = await response.json();
-                throw new Error(errorData.message || 'Failed to create tenant');
-            }
-            const data = await response.json();
-            // Update tokens with new tenant-scoped tokens
-            if (data.access_token) {
-                this.tokens.setAccessToken(data.access_token);
-                this.signinStatus.setSigninStatus(true);
-            }
-            return data;
-        }
-        catch (error) {
-            throw error;
-        }
+    async uploadDrawing(formData) {
+        const uploadHost = this.environment.uploadServer?.host || this.host;
+        const url = uploadHost + '/upload/drawing';
+        const fetchOptions = { method: 'POST', mode: 'cors', redirect: 'error', body: formData };
+        return this.request(url, fetchOptions, null);
+    }
+    /**
+     * Upload an image (uses upload server if configured, otherwise API server)
+     * @deprecated Platform-specific method - consider moving to platform service
+     */
+    async uploadImage(formData) {
+        const uploadHost = this.environment.uploadServer?.host || this.host;
+        const url = uploadHost + '/upload/image';
+        const fetchOptions = { method: 'POST', mode: 'cors', redirect: 'error', body: formData };
+        return this.request(url, fetchOptions, null);
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: AuthService, deps: [{ token: TokenService }, { token: SigninStatusService }, { token: MyEnvironmentModel }], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: AuthService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: ApiConnectionService, deps: [{ token: TokenService }, { token: SigninStatusService }, { token: MyEnvironmentModel }, { token: AuthService }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: ApiConnectionService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: AuthService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: ApiConnectionService, decorators: [{
             type: Injectable,
             args: [{
                     providedIn: 'root'
                 }]
-        }], ctorParameters: () => [{ type: TokenService }, { type: SigninStatusService }, { type: MyEnvironmentModel, decorators: [{
-                    type: Inject,
-                    args: [MyEnvironmentModel]
-                }] }] });
+        }], ctorParameters: () => [{ type: TokenService }, { type: SigninStatusService }, { type: MyEnvironmentModel }, { type: AuthService }] });
 
 class DbService {
     constructor() { }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: DbService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: DbService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: DbService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: DbService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: DbService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: DbService, decorators: [{
             type: Injectable,
             args: [{
                     providedIn: 'root'
                 }]
         }], ctorParameters: () => [] });
 
+/**
+ * CSRF Token Service
+ *
+ * Manages CSRF tokens for cookie-based authentication.
+ * Reads CSRF token from cookies and provides it for request headers.
+ */
+class CsrfService {
+    /**
+     * Get CSRF token from cookie
+     */
+    getCsrfToken(cookieName = 'csrf_token') {
+        const cookies = document.cookie.split(';');
+        for (const cookie of cookies) {
+            const [name, value] = cookie.trim().split('=');
+            if (name === cookieName) {
+                return decodeURIComponent(value);
+            }
+        }
+        return null;
+    }
+    /**
+     * Check if CSRF token exists
+     */
+    hasCsrfToken(cookieName = 'csrf_token') {
+        return this.getCsrfToken(cookieName) !== null;
+    }
+    /**
+     * Clear CSRF token (for logout)
+     * Note: Client-side deletion is limited for httpOnly cookies
+     */
+    clearCsrfToken(cookieName = 'csrf_token') {
+        // Can only clear non-httpOnly cookies
+        document.cookie = `${cookieName}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;`;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: CsrfService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: CsrfService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: CsrfService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }] });
+
 /**
  * Service for interacting with the stonescriptphp-files server.
  * Handles file upload, download, list, and delete operations
@@ -1855,10 +1541,10 @@ class FilesService {
             return false;
         }
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: FilesService, deps: [{ token: TokenService }, { token: SigninStatusService }, { token: MyEnvironmentModel }, { token: CsrfService }], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: FilesService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: FilesService, deps: [{ token: TokenService }, { token: SigninStatusService }, { token: MyEnvironmentModel }, { token: CsrfService }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: FilesService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: FilesService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: FilesService, decorators: [{
             type: Injectable,
             args: [{
                     providedIn: 'root'
@@ -2034,10 +1720,10 @@ class ProviderRegistryService {
         }
         return Object.keys(styles).length > 0 ? styles : null;
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: ProviderRegistryService, deps: [{ token: MyEnvironmentModel }], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: ProviderRegistryService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: ProviderRegistryService, deps: [{ token: MyEnvironmentModel }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: ProviderRegistryService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: ProviderRegistryService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: ProviderRegistryService, decorators: [{
             type: Injectable,
             args: [{
                     providedIn: 'root'
@@ -2047,29 +1733,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImpo
                     args: [MyEnvironmentModel]
                 }] }] });
 
-class NgxStoneScriptPhpClientModule {
-    static forRoot(environment) {
-        return {
-            ngModule: NgxStoneScriptPhpClientModule,
-            providers: [
-                { provide: MyEnvironmentModel, useValue: environment }
-            ]
-        };
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: NgxStoneScriptPhpClientModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule });
-    static ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "20.3.15", ngImport: i0, type: NgxStoneScriptPhpClientModule, imports: [CommonModule] });
-    static ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: NgxStoneScriptPhpClientModule, imports: [CommonModule] });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: NgxStoneScriptPhpClientModule, decorators: [{
-            type: NgModule,
-            args: [{
-                    declarations: [],
-                    imports: [
-                        CommonModule
-                    ]
-                }]
-        }] });
-
 class TenantLoginComponent {
     auth;
     providerRegistry;
@@ -2297,8 +1960,8 @@ class TenantLoginComponent {
         event.preventDefault();
         this.createTenant.emit();
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: TenantLoginComponent, deps: [{ token: AuthService }, { token: ProviderRegistryService }], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "20.3.15", type: TenantLoginComponent, isStandalone: true, selector: "lib-tenant-login", inputs: { title: "title", providers: "providers", showTenantSelector: "showTenantSelector", autoSelectSingleTenant: "autoSelectSingleTenant", prefillEmail: "prefillEmail", allowTenantCreation: "allowTenantCreation", tenantSelectorTitle: "tenantSelectorTitle", tenantSelectorDescription: "tenantSelectorDescription", continueButtonText: "continueButtonText", registerLinkText: "registerLinkText", registerLinkAction: "registerLinkAction", createTenantLinkText: "createTenantLinkText", createTenantLinkAction: "createTenantLinkAction" }, outputs: { tenantSelected: "tenantSelected", createTenant: "createTenant" }, ngImport: i0, template: `
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TenantLoginComponent, deps: [{ token: AuthService }, { token: ProviderRegistryService }], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "20.3.17", type: TenantLoginComponent, isStandalone: true, selector: "lib-tenant-login", inputs: { title: "title", providers: "providers", showTenantSelector: "showTenantSelector", autoSelectSingleTenant: "autoSelectSingleTenant", prefillEmail: "prefillEmail", allowTenantCreation: "allowTenantCreation", tenantSelectorTitle: "tenantSelectorTitle", tenantSelectorDescription: "tenantSelectorDescription", continueButtonText: "continueButtonText", registerLinkText: "registerLinkText", registerLinkAction: "registerLinkAction", createTenantLinkText: "createTenantLinkText", createTenantLinkAction: "createTenantLinkAction" }, outputs: { tenantSelected: "tenantSelected", createTenant: "createTenant" }, ngImport: i0, template: `
         <div class="tenant-login-dialog">
             @if (!showingTenantSelector) {
                 <!-- Step 1: Authentication -->
@@ -2466,7 +2129,7 @@ class TenantLoginComponent {
         </div>
     `, isInline: true, styles: [".tenant-login-dialog{padding:24px;max-width:450px;position:relative}.login-title{margin:0 0 24px;font-size:24px;font-weight:500;text-align:center}.welcome-message{margin-bottom:16px;padding:12px;background:#e8f5e9;border-radius:4px;text-align:center;font-size:14px;color:#2e7d32}.selector-description{margin-bottom:20px;font-size:14px;color:#666;text-align:center}.email-form,.form-group{margin-bottom:16px}.password-group{position:relative}.form-control{width:100%;padding:12px;border:1px solid #ddd;border-radius:4px;font-size:14px;box-sizing:border-box}.password-input{padding-right:45px}.password-toggle{position:absolute;right:8px;top:50%;transform:translateY(-50%);background:none;border:none;cursor:pointer;font-size:18px;padding:8px;line-height:1;opacity:.6;transition:opacity .2s}.password-toggle:hover{opacity:1}.password-toggle:focus{outline:2px solid #4285f4;outline-offset:2px;border-radius:4px}.form-control:focus{outline:none;border-color:#4285f4}.btn{padding:12px 24px;border:none;border-radius:4px;font-size:14px;font-weight:500;cursor:pointer;transition:background-color .2s}.btn:disabled{opacity:.6;cursor:not-allowed}.btn-block{width:100%}.btn-primary{background-color:#4285f4;color:#fff}.btn-primary:hover:not(:disabled){background-color:#357ae8}.divider{margin:16px 0;text-align:center;position:relative}.divider:before{content:\"\";position:absolute;top:50%;left:0;right:0;height:1px;background:#ddd}.divider span{background:#fff;padding:0 12px;position:relative;color:#666;font-size:12px}.oauth-buttons{display:flex;flex-direction:column;gap:12px}.btn-oauth{width:100%;background:#fff;color:#333;border:1px solid #ddd;display:flex;align-items:center;justify-content:center;gap:8px}.btn-oauth:hover:not(:disabled){background:#f8f8f8}.btn-google{border-color:#4285f4}.btn-linkedin{border-color:#0077b5}.btn-apple{border-color:#000}.btn-microsoft{border-color:#00a4ef}.btn-github{border-color:#333}.btn-zoho{background-color:#f0483e;color:#fff;border:1px solid #d63b32}.btn-zoho:hover{background-color:#d63b32}.oauth-icon{font-size:18px}.switch-method{margin-top:12px;text-align:center;font-size:14px}.switch-method a{color:#4285f4;text-decoration:none}.switch-method a:hover{text-decoration:underline}.tenant-list{margin-bottom:20px;display:flex;flex-direction:column;gap:12px}.tenant-item{display:flex;align-items:flex-start;gap:12px;padding:16px;border:2px solid #e0e0e0;border-radius:6px;cursor:pointer;transition:all .2s}.tenant-item:hover{border-color:#4285f4;background:#f8f9ff}.tenant-item.selected{border-color:#4285f4;background:#e8f0fe}.tenant-radio{flex-shrink:0;padding-top:2px}.tenant-radio input[type=radio]{width:18px;height:18px;cursor:pointer}.tenant-info{flex:1}.tenant-name{font-size:16px;font-weight:500;color:#333;margin-bottom:4px}.tenant-meta{font-size:13px;color:#666}.tenant-role{font-weight:500;color:#4285f4}.tenant-separator{margin:0 6px}.error-message{margin-top:16px;padding:12px;background:#fee;color:#c33;border-radius:4px;font-size:14px}.loading-overlay{position:absolute;inset:0;background:#fffc;display:flex;align-items:center;justify-content:center}.spinner{width:40px;height:40px;border:4px solid #f3f3f3;border-top:4px solid #4285f4;border-radius:50%;animation:spin 1s linear infinite}@keyframes spin{0%{transform:rotate(0)}to{transform:rotate(360deg)}}.register-link{margin-top:16px;text-align:center;font-size:14px;color:#666}.register-link a{color:#4285f4;text-decoration:none}.register-link a:hover{text-decoration:underline}.create-tenant-link{margin-top:16px;padding-top:16px;border-top:1px solid #e0e0e0;text-align:center;font-size:14px;color:#666}.create-tenant-link a{color:#4285f4;text-decoration:none;font-weight:500}.create-tenant-link a:hover{text-decoration:underline}\n"], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "directive", type: i3.NgStyle, selector: "[ngStyle]", inputs: ["ngStyle"] }, { kind: "ngmodule", type: FormsModule }, { kind: "directive", type: i4.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i4.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i4.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i4.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i4.RequiredValidator, selector: ":not([type=checkbox])[required][formControlName],:not([type=checkbox])[required][formControl],:not([type=checkbox])[required][ngModel]", inputs: ["required"] }, { kind: "directive", type: i4.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "directive", type: i4.NgForm, selector: "form:not([ngNoForm]):not([formGroup]),ng-form,[ngForm]", inputs: ["ngFormOptions"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: TenantLoginComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TenantLoginComponent, decorators: [{
             type: Component,
             args: [{ selector: 'lib-tenant-login', standalone: true, imports: [CommonModule, FormsModule], template: `
         <div class="tenant-login-dialog">
@@ -2771,8 +2434,8 @@ class RegisterComponent {
         this.confirmPassword = '';
         this.displayName = '';
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: RegisterComponent, deps: [{ token: AuthService }, { token: MyEnvironmentModel }], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "20.3.15", type: RegisterComponent, isStandalone: true, selector: "lib-register", outputs: { navigateToLogin: "navigateToLogin" }, ngImport: i0, template: `
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: RegisterComponent, deps: [{ token: AuthService }, { token: MyEnvironmentModel }], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "20.3.17", type: RegisterComponent, isStandalone: true, selector: "lib-register", outputs: { navigateToLogin: "navigateToLogin" }, ngImport: i0, template: `
         <div class="register-dialog">
             <h2 class="register-title">Create Account</h2>
 
@@ -2901,7 +2564,7 @@ class RegisterComponent {
         </div>
     `, isInline: true, styles: [".register-dialog{padding:24px;max-width:400px;position:relative}.register-title{margin:0 0 24px;font-size:24px;font-weight:500;text-align:center}.register-form,.form-group{margin-bottom:16px}.password-group{position:relative}.form-group label{display:block;margin-bottom:6px;font-size:14px;font-weight:500;color:#333}.form-control{width:100%;padding:12px;border:1px solid #ddd;border-radius:4px;font-size:14px;box-sizing:border-box}.password-input{padding-right:45px}.password-toggle{position:absolute;right:8px;top:38px;background:none;border:none;cursor:pointer;font-size:18px;padding:8px;line-height:1;opacity:.6;transition:opacity .2s}.password-toggle:hover{opacity:1}.password-toggle:focus{outline:2px solid #4285f4;outline-offset:2px;border-radius:4px}.form-control:focus{outline:none;border-color:#4285f4}.form-hint{display:block;margin-top:4px;font-size:12px;color:#666}.btn{padding:12px 24px;border:none;border-radius:4px;font-size:14px;font-weight:500;cursor:pointer;transition:background-color .2s}.btn:disabled{opacity:.6;cursor:not-allowed}.btn-block{width:100%}.btn-primary{background-color:#4285f4;color:#fff}.btn-primary:hover:not(:disabled){background-color:#357ae8}.error-message{margin-top:16px;padding:12px;background:#fee;color:#c33;border-radius:4px;font-size:14px}.success-message{margin-top:16px;padding:12px;background:#efe;color:#3a3;border-radius:4px;font-size:14px}.loading-overlay{position:absolute;inset:0;background:#fffc;display:flex;align-items:center;justify-content:center}.spinner{width:40px;height:40px;border:4px solid #f3f3f3;border-top:4px solid #4285f4;border-radius:50%;animation:spin 1s linear infinite}@keyframes spin{0%{transform:rotate(0)}to{transform:rotate(360deg)}}.login-link{margin-top:16px;text-align:center;font-size:14px;color:#666}.login-link a{color:#4285f4;text-decoration:none}.login-link a:hover{text-decoration:underline}.account-link-prompt{background:#f8f9fa;border:2px solid #4285f4;border-radius:8px;padding:24px;margin-bottom:16px;text-align:center}.prompt-icon{font-size:48px;margin-bottom:12px}.account-link-prompt h3{margin:0 0 12px;color:#333;font-size:20px;font-weight:500}.account-link-prompt p{margin:8px 0;color:#555;font-size:14px;line-height:1.6}.prompt-actions{margin-top:20px;display:flex;flex-direction:column;gap:10px}.btn-secondary{background:#fff;color:#333;border:1px solid #ddd}.btn-secondary:hover:not(:disabled){background:#f8f9fa;border-color:#ccc}\n"], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "directive", type: i3.NgIf, selector: "[ngIf]", inputs: ["ngIf", "ngIfThen", "ngIfElse"] }, { kind: "ngmodule", type: FormsModule }, { kind: "directive", type: i4.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i4.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i4.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i4.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i4.RequiredValidator, selector: ":not([type=checkbox])[required][formControlName],:not([type=checkbox])[required][formControl],:not([type=checkbox])[required][ngModel]", inputs: ["required"] }, { kind: "directive", type: i4.MinLengthValidator, selector: "[minlength][formControlName],[minlength][formControl],[minlength][ngModel]", inputs: ["minlength"] }, { kind: "directive", type: i4.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "directive", type: i4.NgForm, selector: "form:not([ngNoForm]):not([formGroup]),ng-form,[ngForm]", inputs: ["ngFormOptions"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: RegisterComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: RegisterComponent, decorators: [{
             type: Component,
             args: [{ selector: 'lib-register', standalone: true, imports: [CommonModule, FormsModule], template: `
         <div class="register-dialog">
@@ -3087,8 +2750,8 @@ class AuthPageComponent {
             (B < 255 ? B < 1 ? 0 : B : 255))
             .toString(16).slice(1);
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: AuthPageComponent, deps: [{ token: MyEnvironmentModel }], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "20.3.15", type: AuthPageComponent, isStandalone: true, selector: "lib-auth-page", inputs: { providers: "providers" }, outputs: { authenticated: "authenticated" }, ngImport: i0, template: `
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: AuthPageComponent, deps: [{ token: MyEnvironmentModel }], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "20.3.17", type: AuthPageComponent, isStandalone: true, selector: "lib-auth-page", inputs: { providers: "providers" }, outputs: { authenticated: "authenticated" }, ngImport: i0, template: `
         <div class="auth-container" [style.background]="gradientStyle">
             <div class="auth-card">
                 @if (logo) {
@@ -3115,7 +2778,7 @@ class AuthPageComponent {
         </div>
     `, isInline: true, styles: [".auth-container{min-height:100vh;display:flex;align-items:center;justify-content:center;padding:20px;background:linear-gradient(135deg,#667eea,#764ba2)}.auth-card{background:#fff;border-radius:12px;box-shadow:0 10px 40px #0000001a;padding:40px;width:100%;max-width:480px}.logo{display:block;max-width:200px;max-height:80px;margin:0 auto 24px}.app-name{margin:0 0 12px;font-size:28px;font-weight:600;text-align:center;color:#1a202c}.subtitle{margin:0 0 32px;font-size:16px;text-align:center;color:#718096}:host ::ng-deep .tenant-login-dialog,:host ::ng-deep .register-dialog{padding:0;max-width:none}:host ::ng-deep .login-title,:host ::ng-deep .register-title{display:none}\n"], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "component", type: TenantLoginComponent, selector: "lib-tenant-login", inputs: ["title", "providers", "showTenantSelector", "autoSelectSingleTenant", "prefillEmail", "allowTenantCreation", "tenantSelectorTitle", "tenantSelectorDescription", "continueButtonText", "registerLinkText", "registerLinkAction", "createTenantLinkText", "createTenantLinkAction"], outputs: ["tenantSelected", "createTenant"] }, { kind: "component", type: RegisterComponent, selector: "lib-register", outputs: ["navigateToLogin"] }] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: AuthPageComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: AuthPageComponent, decorators: [{
             type: Component,
             args: [{ selector: 'lib-auth-page', standalone: true, imports: [CommonModule, TenantLoginComponent, RegisterComponent], template: `
         <div class="auth-container" [style.background]="gradientStyle">
@@ -3238,8 +2901,8 @@ class LoginDialogComponent {
         // For now, just emit a console message
         console.log('Register clicked - platform should handle navigation');
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: LoginDialogComponent, deps: [{ token: AuthService }, { token: ProviderRegistryService }], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "20.3.15", type: LoginDialogComponent, isStandalone: true, selector: "lib-login-dialog", inputs: { providers: "providers" }, ngImport: i0, template: `
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: LoginDialogComponent, deps: [{ token: AuthService }, { token: ProviderRegistryService }], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "20.3.17", type: LoginDialogComponent, isStandalone: true, selector: "lib-login-dialog", inputs: { providers: "providers" }, ngImport: i0, template: `
         <div class="login-dialog">
             <h2 class="login-title">Sign In</h2>
 
@@ -3329,7 +2992,7 @@ class LoginDialogComponent {
         </div>
     `, isInline: true, styles: [".login-dialog{padding:24px;max-width:400px;position:relative}.login-title{margin:0 0 24px;font-size:24px;font-weight:500;text-align:center}.email-form,.form-group{margin-bottom:16px}.password-group{position:relative}.form-control{width:100%;padding:12px;border:1px solid #ddd;border-radius:4px;font-size:14px;box-sizing:border-box}.password-input{padding-right:45px}.password-toggle{position:absolute;right:8px;top:50%;transform:translateY(-50%);background:none;border:none;cursor:pointer;font-size:18px;padding:8px;line-height:1;opacity:.6;transition:opacity .2s}.password-toggle:hover{opacity:1}.password-toggle:focus{outline:2px solid #4285f4;outline-offset:2px;border-radius:4px}.form-control:focus{outline:none;border-color:#4285f4}.btn{padding:12px 24px;border:none;border-radius:4px;font-size:14px;font-weight:500;cursor:pointer;transition:background-color .2s}.btn:disabled{opacity:.6;cursor:not-allowed}.btn-block{width:100%}.btn-primary{background-color:#4285f4;color:#fff}.btn-primary:hover:not(:disabled){background-color:#357ae8}.divider{margin:16px 0;text-align:center;position:relative}.divider:before{content:\"\";position:absolute;top:50%;left:0;right:0;height:1px;background:#ddd}.divider span{background:#fff;padding:0 12px;position:relative;color:#666;font-size:12px}.oauth-buttons{display:flex;flex-direction:column;gap:12px}.btn-oauth{width:100%;background:#fff;color:#333;border:1px solid #ddd;display:flex;align-items:center;justify-content:center;gap:8px}.btn-oauth:hover:not(:disabled){background:#f8f8f8}.btn-google{border-color:#4285f4}.btn-linkedin{border-color:#0077b5}.btn-apple{border-color:#000}.btn-microsoft{border-color:#00a4ef}.btn-github{border-color:#333}.oauth-icon{font-size:18px}.error-message{margin-top:16px;padding:12px;background:#fee;color:#c33;border-radius:4px;font-size:14px}.loading-overlay{position:absolute;inset:0;background:#fffc;display:flex;align-items:center;justify-content:center}.spinner{width:40px;height:40px;border:4px solid #f3f3f3;border-top:4px solid #4285f4;border-radius:50%;animation:spin 1s linear infinite}@keyframes spin{0%{transform:rotate(0)}to{transform:rotate(360deg)}}.register-link{margin-top:16px;text-align:center;font-size:14px;color:#666}.register-link a{color:#4285f4;text-decoration:none}.register-link a:hover{text-decoration:underline}\n"], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "directive", type: i3.NgStyle, selector: "[ngStyle]", inputs: ["ngStyle"] }, { kind: "ngmodule", type: FormsModule }, { kind: "directive", type: i4.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i4.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i4.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i4.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i4.RequiredValidator, selector: ":not([type=checkbox])[required][formControlName],:not([type=checkbox])[required][formControl],:not([type=checkbox])[required][ngModel]", inputs: ["required"] }, { kind: "directive", type: i4.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "directive", type: i4.NgForm, selector: "form:not([ngNoForm]):not([formGroup]),ng-form,[ngForm]", inputs: ["ngFormOptions"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: LoginDialogComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: LoginDialogComponent, decorators: [{
             type: Component,
             args: [{ selector: 'lib-login-dialog', standalone: true, imports: [CommonModule, FormsModule], template: `
         <div class="login-dialog">
@@ -3584,7 +3247,6 @@ class TenantRegisterComponent {
         try {
             const result = await this.auth.registerTenant({
                 tenantName: this.tenantName,
-                tenantSlug: this.tenantSlug,
                 provider: provider
             });
             if (result.success && result.tenant && result.user) {
@@ -3617,7 +3279,6 @@ class TenantRegisterComponent {
         try {
             const result = await this.auth.registerTenant({
                 tenantName: this.tenantName,
-                tenantSlug: this.tenantSlug,
                 displayName: this.displayName,
                 email: this.email,
                 password: this.password,
@@ -3645,8 +3306,8 @@ class TenantRegisterComponent {
         event.preventDefault();
         this.navigateToLogin.emit();
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: TenantRegisterComponent, deps: [{ token: AuthService }, { token: ProviderRegistryService }], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "20.3.15", type: TenantRegisterComponent, isStandalone: true, selector: "lib-tenant-register", inputs: { title: "title", providers: "providers", requireTenantName: "requireTenantName", tenantSectionTitle: "tenantSectionTitle", tenantNameLabel: "tenantNameLabel", tenantNamePlaceholder: "tenantNamePlaceholder", tenantSlugLabel: "tenantSlugLabel", tenantSlugPlaceholder: "tenantSlugPlaceholder", urlPreviewEnabled: "urlPreviewEnabled", urlPreviewPrefix: "urlPreviewPrefix", userSectionTitle: "userSectionTitle", oauthDescription: "oauthDescription", ownershipTitle: "ownershipTitle", ownershipMessage: "ownershipMessage", submitButtonText: "submitButtonText", loginLinkText: "loginLinkText", loginLinkAction: "loginLinkAction" }, outputs: { tenantCreated: "tenantCreated", navigateToLogin: "navigateToLogin" }, ngImport: i0, template: `
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TenantRegisterComponent, deps: [{ token: AuthService }, { token: ProviderRegistryService }], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "20.3.17", type: TenantRegisterComponent, isStandalone: true, selector: "lib-tenant-register", inputs: { title: "title", providers: "providers", requireTenantName: "requireTenantName", tenantSectionTitle: "tenantSectionTitle", tenantNameLabel: "tenantNameLabel", tenantNamePlaceholder: "tenantNamePlaceholder", tenantSlugLabel: "tenantSlugLabel", tenantSlugPlaceholder: "tenantSlugPlaceholder", urlPreviewEnabled: "urlPreviewEnabled", urlPreviewPrefix: "urlPreviewPrefix", userSectionTitle: "userSectionTitle", oauthDescription: "oauthDescription", ownershipTitle: "ownershipTitle", ownershipMessage: "ownershipMessage", submitButtonText: "submitButtonText", loginLinkText: "loginLinkText", loginLinkAction: "loginLinkAction" }, outputs: { tenantCreated: "tenantCreated", navigateToLogin: "navigateToLogin" }, ngImport: i0, template: `
         <div class="tenant-register-dialog">
             <h2 class="register-title">{{ title }}</h2>
 
@@ -3856,7 +3517,7 @@ class TenantRegisterComponent {
         </div>
     `, isInline: true, styles: [".tenant-register-dialog{padding:24px;max-width:500px;position:relative}.register-title{margin:0 0 20px;font-size:24px;font-weight:500;text-align:center}.warning-box{display:flex;gap:12px;padding:16px;background:#fff3cd;border:1px solid #ffc107;border-radius:6px;margin-bottom:24px}.warning-icon{font-size:24px;line-height:1}.warning-content{flex:1}.warning-content strong{display:block;margin-bottom:4px;color:#856404;font-size:14px}.warning-content p{margin:0;color:#856404;font-size:13px;line-height:1.5}.section-header{font-size:16px;font-weight:600;margin:20px 0 12px;padding-bottom:8px;border-bottom:2px solid #e0e0e0;color:#333}.register-form,.form-group{margin-bottom:16px}.password-group{position:relative}.form-group label{display:block;margin-bottom:6px;font-size:14px;font-weight:500;color:#333}.form-control{width:100%;padding:12px;border:1px solid #ddd;border-radius:4px;font-size:14px;box-sizing:border-box;transition:border-color .2s}.password-input{padding-right:45px}.password-toggle{position:absolute;right:8px;top:38px;background:none;border:none;cursor:pointer;font-size:18px;padding:8px;line-height:1;opacity:.6;transition:opacity .2s}.password-toggle:hover{opacity:1}.password-toggle:focus{outline:2px solid #4285f4;outline-offset:2px;border-radius:4px}.form-control:focus{outline:none;border-color:#4285f4}.form-control.input-error{border-color:#dc3545}.form-control.input-success{border-color:#28a745}.form-hint{display:block;margin-top:4px;font-size:12px;color:#666}.form-hint .checking{color:#666}.form-hint .available{color:#28a745;font-weight:500}.form-hint .error-text{color:#dc3545}.oauth-section{margin:16px 0}.oauth-description{margin-bottom:12px;font-size:14px;color:#666;text-align:center}.oauth-buttons{display:flex;flex-direction:column;gap:12px}.btn{padding:12px 24px;border:none;border-radius:4px;font-size:14px;font-weight:500;cursor:pointer;transition:background-color .2s,opacity .2s}.btn:disabled{opacity:.6;cursor:not-allowed}.btn-block{width:100%}.btn-primary{background-color:#4285f4;color:#fff}.btn-primary:hover:not(:disabled){background-color:#357ae8}.btn-oauth{width:100%;background:#fff;color:#333;border:1px solid #ddd;display:flex;align-items:center;justify-content:center;gap:8px}.btn-oauth:hover:not(:disabled){background:#f8f8f8}.btn-google{border-color:#4285f4}.btn-linkedin{border-color:#0077b5}.btn-apple{border-color:#000}.btn-microsoft{border-color:#00a4ef}.btn-github{border-color:#333}.oauth-icon{font-size:18px}.switch-method{margin-top:12px;text-align:center;font-size:14px}.switch-method a{color:#4285f4;text-decoration:none}.switch-method a:hover{text-decoration:underline}.error-message{margin-top:16px;padding:12px;background:#fee;color:#c33;border-radius:4px;font-size:14px}.success-message{margin-top:16px;padding:12px;background:#efe;color:#3a3;border-radius:4px;font-size:14px}.loading-overlay{position:absolute;inset:0;background:#fffffff2;display:flex;flex-direction:column;align-items:center;justify-content:center;gap:16px}.spinner{width:40px;height:40px;border:4px solid #f3f3f3;border-top:4px solid #4285f4;border-radius:50%;animation:spin 1s linear infinite}@keyframes spin{0%{transform:rotate(0)}to{transform:rotate(360deg)}}.loading-text{margin:0;font-size:14px;color:#666}.login-link{margin-top:16px;text-align:center;font-size:14px;color:#666}.login-link a{color:#4285f4;text-decoration:none}.login-link a:hover{text-decoration:underline}\n"], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "directive", type: i3.NgStyle, selector: "[ngStyle]", inputs: ["ngStyle"] }, { kind: "ngmodule", type: FormsModule }, { kind: "directive", type: i4.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i4.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i4.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i4.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i4.RequiredValidator, selector: ":not([type=checkbox])[required][formControlName],:not([type=checkbox])[required][formControl],:not([type=checkbox])[required][ngModel]", inputs: ["required"] }, { kind: "directive", type: i4.MinLengthValidator, selector: "[minlength][formControlName],[minlength][formControl],[minlength][ngModel]", inputs: ["minlength"] }, { kind: "directive", type: i4.PatternValidator, selector: "[pattern][formControlName],[pattern][formControl],[pattern][ngModel]", inputs: ["pattern"] }, { kind: "directive", type: i4.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "directive", type: i4.NgForm, selector: "form:not([ngNoForm]):not([formGroup]),ng-form,[ngForm]", inputs: ["ngFormOptions"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: TenantRegisterComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TenantRegisterComponent, decorators: [{
             type: Component,
             args: [{ selector: 'lib-tenant-register', standalone: true, imports: [CommonModule, FormsModule], template: `
         <div class="tenant-register-dialog">
@@ -4156,8 +3817,8 @@ class TenantLoginDialogComponent {
             this.dialogRef.close({ action: 'create_tenant' });
         }
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: TenantLoginDialogComponent, deps: [{ token: 'DIALOG_DATA', optional: true }, { token: 'DIALOG_REF', optional: true }], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "20.3.15", type: TenantLoginDialogComponent, isStandalone: true, selector: "lib-tenant-login-dialog", ngImport: i0, template: `
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TenantLoginDialogComponent, deps: [{ token: 'DIALOG_DATA', optional: true }, { token: 'DIALOG_REF', optional: true }], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "20.3.17", type: TenantLoginDialogComponent, isStandalone: true, selector: "lib-tenant-login-dialog", ngImport: i0, template: `
         <div class="dialog-wrapper">
             <lib-tenant-login
                 [title]="data?.title || 'Sign In'"
@@ -4178,7 +3839,7 @@ class TenantLoginDialogComponent {
         </div>
     `, isInline: true, styles: [".dialog-wrapper{padding:0}\n"], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "component", type: TenantLoginComponent, selector: "lib-tenant-login", inputs: ["title", "providers", "showTenantSelector", "autoSelectSingleTenant", "prefillEmail", "allowTenantCreation", "tenantSelectorTitle", "tenantSelectorDescription", "continueButtonText", "registerLinkText", "registerLinkAction", "createTenantLinkText", "createTenantLinkAction"], outputs: ["tenantSelected", "createTenant"] }] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: TenantLoginDialogComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TenantLoginDialogComponent, decorators: [{
             type: Component,
             args: [{ selector: 'lib-tenant-login-dialog', standalone: true, imports: [CommonModule, TenantLoginComponent], template: `
         <div class="dialog-wrapper">
@@ -4259,8 +3920,8 @@ class TenantRegisterDialogComponent {
             this.dialogRef.close({ action: 'navigate_to_login' });
         }
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: TenantRegisterDialogComponent, deps: [{ token: 'DIALOG_DATA', optional: true }, { token: 'DIALOG_REF', optional: true }], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "20.3.15", type: TenantRegisterDialogComponent, isStandalone: true, selector: "lib-tenant-register-dialog", ngImport: i0, template: `
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TenantRegisterDialogComponent, deps: [{ token: 'DIALOG_DATA', optional: true }, { token: 'DIALOG_REF', optional: true }], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "20.3.17", type: TenantRegisterDialogComponent, isStandalone: true, selector: "lib-tenant-register-dialog", ngImport: i0, template: `
         <div class="dialog-wrapper">
             <lib-tenant-register
                 [title]="data?.title || 'Create New Organization'"
@@ -4286,7 +3947,7 @@ class TenantRegisterDialogComponent {
         </div>
     `, isInline: true, styles: [".dialog-wrapper{padding:0}\n"], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "component", type: TenantRegisterComponent, selector: "lib-tenant-register", inputs: ["title", "providers", "requireTenantName", "tenantSectionTitle", "tenantNameLabel", "tenantNamePlaceholder", "tenantSlugLabel", "tenantSlugPlaceholder", "urlPreviewEnabled", "urlPreviewPrefix", "userSectionTitle", "oauthDescription", "ownershipTitle", "ownershipMessage", "submitButtonText", "loginLinkText", "loginLinkAction"], outputs: ["tenantCreated", "navigateToLogin"] }] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImport: i0, type: TenantRegisterDialogComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TenantRegisterDialogComponent, decorators: [{
             type: Component,
             args: [{ selector: 'lib-tenant-register-dialog', standalone: true, imports: [CommonModule, TenantRegisterComponent], template: `
         <div class="dialog-wrapper">
@@ -4328,10 +3989,11 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.15", ngImpo
 /*
  * Public API Surface of ngx-stonescriptphp-client
  */
+// ── Core setup ────────────────────────────────────────────────────────────────
 
 /**
  * Generated bundle index. Do not edit.
  */
 
-export { ApiConnectionService, ApiResponse, AuthPageComponent, AuthService, CsrfService, DbService, FilesService, LoginDialogComponent, MyEnvironmentModel, NgxStoneScriptPhpClientModule, ProviderRegistryService, RegisterComponent, SigninStatusService, TenantLoginComponent, TenantLoginDialogComponent, TenantRegisterComponent, TenantRegisterDialogComponent, TokenService, VerifyStatus };
+export { AUTH_PLUGIN, ApiConnectionService, ApiResponse, AuthPageComponent, AuthService, CsrfService, DbService, FilesService, LoginDialogComponent, MyEnvironmentModel, ProviderRegistryService, RegisterComponent, SigninStatusService, StoneScriptPHPAuth, TenantLoginComponent, TenantLoginDialogComponent, TenantRegisterComponent, TenantRegisterDialogComponent, TokenService, VerifyStatus, provideNgxStoneScriptPhpClient };
 //# sourceMappingURL=progalaxyelabs-ngx-stonescriptphp-client.mjs.map