@skylabs-digital/react-identity-access 2.18.0 → 2.20.0

package/dist/index.es.js

@@ -1,6 +1,6 @@
 import { jsx as s, Fragment as _, jsxs as d } from "react/jsx-runtime";
-import { createContext as pe, useMemo as K, useState as T, useCallback as se, useEffect as ee, useContext as ae, useRef as Qe } from "react";
-import { useLocation as ve, Navigate as we, useNavigate as ft, useSearchParams as gt } from "react-router-dom";
+import { createContext as fe, useMemo as J, useState as T, useCallback as se, useEffect as ee, useContext as ae, useRef as Qe } from "react";
+import { useLocation as Te, Navigate as be, useNavigate as ft, useSearchParams as gt } from "react-router-dom";
 class le {
   constructor(e, t = 1e4) {
     this.baseUrl = e.replace(/\/$/, ""), this.timeout = t;
@@ -109,9 +109,9 @@ class Oe {
     })).data;
   }
 }
-const Le = pe(null);
+const Le = fe(null);
 function mr({ config: n, children: e }) {
-  const t = K(
+  const t = J(
     () => {
       var p, x, R;
       return {
@@ -132,7 +132,7 @@ function mr({ config: n, children: e }) {
     } catch {
       return null;
     }
-  }), [o, a] = T(!r), [f, g] = T(null), w = K(() => {
+  }), [o, a] = T(!r), [f, g] = T(null), w = J(() => {
     const p = () => {
       c();
     };
@@ -153,14 +153,14 @@ function mr({ config: n, children: e }) {
           const x = new le(n.baseUrl), F = await new Oe(x, {}).getPublicAppInfo(n.appId);
           if (i(F), t.enabled)
             try {
-              const M = {
+              const E = {
                 data: F,
                 timestamp: Date.now(),
                 appId: n.appId
               };
-              localStorage.setItem(t.storageKey, JSON.stringify(M));
-            } catch (M) {
-              console.warn("Failed to cache app info:", M);
+              localStorage.setItem(t.storageKey, JSON.stringify(E));
+            } catch (E) {
+              console.warn("Failed to cache app info:", E);
             }
         } catch (x) {
           const R = x instanceof Error ? x : new Error("Failed to load app information");
@@ -194,7 +194,7 @@ function mr({ config: n, children: e }) {
     r ? I() : c();
   }, []), /* @__PURE__ */ s(Le.Provider, { value: w, children: e });
 }
-function be() {
+function Se() {
   const n = ae(Le);
   if (!n)
     throw new Error("useApp must be used within an AppProvider");
@@ -203,7 +203,7 @@ function be() {
 function Ze() {
   return ae(Le);
 }
-const yr = be;
+const yr = Se;
 class ie extends Error {
   constructor(e, t) {
     const r = {
@@ -226,7 +226,7 @@ class yt extends Error {
     ), this.name = "TokenRefreshError", this.attempts = e, this.lastError = t;
   }
 }
-class Ie {
+class pe {
   constructor(e = {}) {
     this.refreshPromise = null, this.refreshQueue = [], this.proactiveTimerId = null, this.backgroundRetryTimerId = null, this.isDestroyed = !1, e.tenantSlug !== void 0 ? this.storageKey = e.tenantSlug ? `auth_tokens_${e.tenantSlug}` : "auth_tokens" : this.storageKey = e.storageKey || "auth_tokens", this.autoRefresh = e.autoRefresh ?? !0, this.refreshThreshold = e.refreshThreshold || 3e5, this.onRefreshFailed = e.onRefreshFailed, this.onSessionExpired = e.onSessionExpired, this.baseUrl = e.baseUrl || "", this.proactiveRefreshMargin = e.proactiveRefreshMargin ?? 6e4, this.refreshQueueTimeout = e.refreshQueueTimeout ?? 1e4, this.maxRefreshRetries = e.maxRefreshRetries ?? 3, this.retryBackoffBase = e.retryBackoffBase ?? 1e3, this.tokenStorage = e.tokenStorage || this.createTokenStorage(this.storageKey), this.scheduleProactiveRefresh();
   }
@@ -256,22 +256,39 @@ class Ie {
     };
   }
   // --- Token CRUD ---
+  /**
+   * Extract the `exp` claim from a JWT and convert to milliseconds.
+   * Returns undefined if the token cannot be decoded or has no exp.
+   */
+  static extractJwtExpiry(e) {
+    try {
+      const t = e.split(".");
+      if (t.length !== 3) return;
+      const r = JSON.parse(atob(t[1].replace(/-/g, "+").replace(/_/g, "/")));
+      return typeof r.exp == "number" ? r.exp * 1e3 : void 0;
+    } catch {
+      return;
+    }
+  }
   setTokens(e) {
-    const t = {
+    const t = e.expiresAt || (e.expiresIn ? Date.now() + e.expiresIn * 1e3 : void 0) || pe.extractJwtExpiry(e.accessToken), r = {
       ...e,
-      expiresAt: e.expiresAt || (e.expiresIn ? Date.now() + e.expiresIn * 1e3 : void 0)
+      expiresAt: t
     };
-    this.tokenStorage.set(t), this.scheduleProactiveRefresh();
+    this.tokenStorage.set(r), this.scheduleProactiveRefresh();
   }
   getTokens() {
     const { accessToken: e, refreshToken: t, expiresAt: r, expiresIn: i, tokenType: o } = this.tokenStorage.get() || {};
-    return e ? {
+    if (!e)
+      return null;
+    const a = r || pe.extractJwtExpiry(e);
+    return {
       accessToken: e,
       refreshToken: t,
-      expiresAt: r,
+      expiresAt: a,
       expiresIn: i,
       tokenType: o
-    } : null;
+    };
   }
   clearTokens() {
     this.tokenStorage.clear();
@@ -295,7 +312,9 @@ class Ie {
     if (!(e != null && e.expiresAt) || !e.refreshToken) return;
     const r = e.expiresAt - this.proactiveRefreshMargin - Date.now();
     if (r <= 0) {
-      this.backgroundRefresh();
+      this.proactiveTimerId = setTimeout(() => {
+        this.backgroundRefresh();
+      }, 0);
       return;
     }
     this.proactiveTimerId = setTimeout(() => {
@@ -678,7 +697,7 @@ class bt {
     });
   }
 }
-class ye {
+class we {
   constructor(e, t, r) {
     this.httpService = e, this.appId = t, this.sessionManager = r;
   }
@@ -827,9 +846,9 @@ function Pt() {
     newUrl: n.toString()
   }), window.history.replaceState({}, "", n.toString());
 }
-const Fe = pe(null);
+const Fe = fe(null);
 function wr({ config: n, children: e }) {
-  const { baseUrl: t, appInfo: r, appId: i } = be(), o = se(() => typeof window > "u" ? null : Tt(
+  const { baseUrl: t, appInfo: r, appId: i } = Se(), o = se(() => typeof window > "u" ? null : Tt(
     {
       tenantMode: n.tenantMode || "selector",
       baseDomain: n.baseDomain,
@@ -841,7 +860,7 @@ function wr({ config: n, children: e }) {
       search: window.location.search
     },
     window.localStorage
-  ), [n.tenantMode, n.baseDomain, n.selectorParam, n.fixedTenantSlug]), [a, f] = T(() => o()), g = K(
+  ), [n.tenantMode, n.baseDomain, n.selectorParam, n.fixedTenantSlug]), [a, f] = T(() => o()), g = J(
     () => {
       var h, C, S;
       return {
@@ -863,18 +882,18 @@ function wr({ config: n, children: e }) {
     } catch {
       return null;
     }
-  }), [I, p] = T(!w && !n.initialTenant), [x, R] = T(null), [F, M] = T(null), [A, u] = T(!1), [k, m] = T(null);
+  }), [I, p] = T(!w && !n.initialTenant), [x, R] = T(null), [F, E] = T(null), [A, u] = T(!1), [k, m] = T(null);
   ee(() => {
     if (n.tenantMode === "fixed") return;
     const h = o();
     f(h);
   }, [o, n.tenantMode]);
-  const E = (r == null ? void 0 : r.settingsSchema) || null, L = se(
+  const M = (r == null ? void 0 : r.settingsSchema) || null, L = se(
     async (h, C = !1) => {
       if (!(!C && g.enabled && w && w.domain === h))
         try {
           p(!0), R(null);
-          const S = new le(t), y = await new ye(S, i).getPublicTenantInfo(h);
+          const S = new le(t), y = await new we(S, i).getPublicTenantInfo(h);
           if (c(y), g.enabled)
             try {
               const v = {
@@ -901,7 +920,7 @@ function wr({ config: n, children: e }) {
         if (!h) return;
         const C = JSON.parse(h);
         if (Date.now() - C.timestamp > g.ttl * 0.5) {
-          const b = new le(t), v = await new ye(b, i).getPublicTenantInfo(a);
+          const b = new le(t), v = await new we(b, i).getPublicTenantInfo(a);
           c(v);
           const j = {
             data: v,
@@ -917,11 +936,11 @@ function wr({ config: n, children: e }) {
     if (w != null && w.id)
       try {
         u(!0), m(null);
-        const h = new le(t), S = await new ye(h, w.appId).getTenantSettings(w.id);
-        M(S);
+        const h = new le(t), S = await new we(h, w.appId).getTenantSettings(w.id);
+        E(S);
       } catch (h) {
         const C = h instanceof Error ? h : new Error("Failed to load tenant settings");
-        m(C), M(null);
+        m(C), E(null);
       } finally {
         u(!1);
       }
@@ -929,14 +948,14 @@ function wr({ config: n, children: e }) {
     P();
   }, [P]), l = se(
     (h) => {
-      if (!E)
+      if (!M)
         return { isValid: !0, errors: [] };
       const C = [];
       try {
-        return E.properties && Object.entries(E.properties).forEach(([S, b]) => {
+        return M.properties && Object.entries(M.properties).forEach(([S, b]) => {
           var v;
           const y = h[S];
-          if ((v = E.required) != null && v.includes(S) && y == null) {
+          if ((v = M.required) != null && v.includes(S) && y == null) {
             C.push(`Field '${S}' is required`);
             return;
           }
@@ -962,12 +981,12 @@ function wr({ config: n, children: e }) {
         };
       }
     },
-    [E]
+    [M]
   );
   ee(() => {
     !n.initialTenant && a ? w ? D() : L(a) : !n.initialTenant && !a && (c(null), R(null), p(!1));
   }, [n.initialTenant, a, w, L, D]), ee(() => {
-    w != null && w.id ? P() : (M(null), m(null), u(!1));
+    w != null && w.id ? P() : (E(null), m(null), u(!1));
   }, [w == null ? void 0 : w.id, P]);
   const N = se(
     (h, C) => {
@@ -1008,7 +1027,7 @@ function wr({ config: n, children: e }) {
       }
     },
     [n.tenantMode, n.selectorParam, n.baseDomain, L]
-  ), $ = K(() => ({
+  ), $ = J(() => ({
     // Tenant info
     tenant: w,
     tenantSlug: a,
@@ -1019,7 +1038,7 @@ function wr({ config: n, children: e }) {
     },
     // Settings
     settings: F,
-    settingsSchema: E,
+    settingsSchema: M,
     isSettingsLoading: A,
     settingsError: k,
     // Actions
@@ -1033,7 +1052,7 @@ function wr({ config: n, children: e }) {
     I,
     x,
     F,
-    E,
+    M,
     A,
     k,
     U,
@@ -1042,18 +1061,18 @@ function wr({ config: n, children: e }) {
   ]);
   return /* @__PURE__ */ s(Fe.Provider, { value: $, children: e });
 }
-function fe() {
+function ge() {
   const n = ae(Fe);
   if (!n)
     throw new Error("useTenant must be used within a TenantProvider");
   return n;
 }
-function Te() {
+function ke() {
   return ae(Fe);
 }
-const br = fe;
+const br = ge;
 function Sr() {
-  const { settings: n, settingsSchema: e, isSettingsLoading: t, settingsError: r, validateSettings: i } = fe();
+  const { settings: n, settingsSchema: e, isSettingsLoading: t, settingsError: r, validateSettings: i } = ge();
   return {
     settings: n,
     settingsSchema: e,
@@ -1062,8 +1081,8 @@ function Sr() {
     validateSettings: i
   };
 }
-function ge() {
-  const { tenant: n, tenantSlug: e, isTenantLoading: t, tenantError: r, retryTenant: i } = fe();
+function me() {
+  const { tenant: n, tenantSlug: e, isTenantLoading: t, tenantError: r, retryTenant: i } = ge();
   return {
     tenant: n,
     tenantSlug: e,
@@ -1072,30 +1091,30 @@ function ge() {
     retry: i
   };
 }
-const De = pe(null);
+const De = fe(null);
 function vr({ config: n = {}, children: e }) {
-  const { appId: t, baseUrl: r } = be(), { tenant: i, tenantSlug: o, switchTenant: a } = fe(), [f, g] = T(n.initialRoles || []), [w, c] = T(!n.initialRoles), [I, p] = T(null), [x, R] = T(!1), [F, M] = T(null), [A, u] = T(0), [k, m] = T(() => {
+  const { appId: t, baseUrl: r } = Se(), { tenant: i, tenantSlug: o, switchTenant: a } = ge(), [f, g] = T(n.initialRoles || []), [w, c] = T(!n.initialRoles), [I, p] = T(null), [x, R] = T(!1), [F, E] = T(null), [A, u] = T(0), [k, m] = T(() => {
     try {
       const G = localStorage.getItem("userTenants");
       return G ? JSON.parse(G) : [];
     } catch {
       return [];
     }
-  }), [E, L] = T(!1), D = Qe({ done: !1, urlTokens: null });
+  }), [M, L] = T(!1), D = Qe({ done: !1, urlTokens: null });
   D.current.done || (D.current.done = !0, D.current.urlTokens = At(), D.current.urlTokens && console.log(
     "[AuthProvider] SYNC: URL tokens found, will block isAuthReady until user loaded"
   ));
   const [P, U] = T(() => {
     const G = D.current.urlTokens !== null;
     return console.log("[AuthProvider] SYNC: isLoadingAfterUrlTokens initial:", G), G;
-  }), l = K(() => {
-    const G = new Ie({
+  }), l = J(() => {
+    const G = new pe({
       tenantSlug: o,
       baseUrl: r,
       refreshQueueTimeout: n.refreshQueueTimeout,
       proactiveRefreshMargin: n.proactiveRefreshMargin,
       onSessionExpired: (ue) => {
-        p(null), M(null), m([]), L(!1);
+        p(null), E(null), m([]), L(!1);
         try {
           localStorage.removeItem("userTenants");
         } catch {
@@ -1108,10 +1127,10 @@ function vr({ config: n = {}, children: e }) {
       refreshToken: D.current.urlTokens.refreshToken,
       expiresIn: D.current.urlTokens.expiresIn
     }), console.log("[AuthProvider] SYNC: Session valid:", G.hasValidSession())), G;
-  }, [o, r, n.refreshQueueTimeout, n.proactiveRefreshMargin]), [N, $] = T(() => D.current.urlTokens ? !1 : l.hasValidSession()), h = D.current.done && !P && !N, C = K(() => {
+  }, [o, r, n.refreshQueueTimeout, n.proactiveRefreshMargin]), [N, $] = T(() => D.current.urlTokens ? !1 : l.hasValidSession()), h = D.current.done && !P && !N, C = J(() => {
     const G = new le(r);
     return G.setSessionManager(l), G;
-  }, [r, l]), S = K(() => new wt(new le(r)), [r]), b = K(() => new bt(C, l), [C, l]), y = K(() => new ze(new le(r)), [r]), v = K(() => I || l.getUser(), [I, l]), j = K(() => v != null && v.roleId && f.find((G) => G.id === v.roleId) || null, [v, f]), Q = K(() => (j == null ? void 0 : j.permissions) || [], [j]), O = K(() => l.hasValidSession() && I !== null, [l, I]), q = 5 * 60 * 1e3, W = K(() => {
+  }, [r, l]), S = J(() => new wt(new le(r)), [r]), b = J(() => new bt(C, l), [C, l]), y = J(() => new ze(new le(r)), [r]), v = J(() => I || l.getUser(), [I, l]), j = J(() => v != null && v.roleId && f.find((G) => G.id === v.roleId) || null, [v, f]), Q = J(() => (j == null ? void 0 : j.permissions) || [], [j]), O = J(() => l.hasValidSession() && I !== null, [l, I]), q = 5 * 60 * 1e3, W = J(() => {
     const G = async (H = !1) => {
       try {
         if (!l.hasValidSession())
@@ -1124,29 +1143,29 @@ function vr({ config: n = {}, children: e }) {
           console.warn("[AuthProvider] No userId available in token or storage");
           return;
         }
-        R(!0), M(null);
-        const J = await b.getUserById(V);
-        p(J), l.setUser(J), u(Date.now());
+        R(!0), E(null);
+        const K = await b.getUserById(V);
+        p(K), l.setUser(K), u(Date.now());
       } catch (z) {
         const Y = z instanceof Error ? z : new Error("Failed to load user data");
-        M(Y), console.error("[AuthProvider] Failed to load user data:", Y);
+        E(Y), console.error("[AuthProvider] Failed to load user data:", Y);
       } finally {
         R(!1);
       }
     }, ue = async () => {
       await G();
-    }, ke = async (H) => {
+    }, xe = async (H) => {
       var Be;
-      const { username: z, password: Y, tenantSlug: V, redirectPath: J } = H;
+      const { username: z, password: Y, tenantSlug: V, redirectPath: K } = H;
       let te = i == null ? void 0 : i.id, re = o, ne = l;
-      V && (te = (await new ye(C, t).getPublicTenantInfo(V)).id, re = V);
+      V && (te = (await new we(C, t).getPublicTenantInfo(V)).id, re = V);
       const Z = await S.login({
         username: z,
         password: Y,
         appId: t,
         tenantId: te
-      }), me = V && V !== o;
-      if (me && (ne = new Ie({
+      }), ye = V && V !== o;
+      if (ye && (ne = new pe({
         tenantSlug: re,
         baseUrl: r
       })), ne.setTokens({
@@ -1157,8 +1176,8 @@ function vr({ config: n = {}, children: e }) {
         ne.setUser(Z.user), p(Z.user);
         try {
           await G();
-        } catch (Se) {
-          console.warn("Failed to load complete user data after login:", Se);
+        } catch (ve) {
+          console.warn("Failed to load complete user data after login:", ve);
         }
       }
       if (Z.tenants && Z.tenants.length > 0) {
@@ -1168,52 +1187,52 @@ function vr({ config: n = {}, children: e }) {
         } catch {
         }
       }
-      const Pe = ((Be = Z.user) == null ? void 0 : Be.tenantId) !== null;
-      L(Pe);
-      const Re = {
+      const Re = ((Be = Z.user) == null ? void 0 : Be.tenantId) !== null;
+      L(Re);
+      const Ie = {
         accessToken: Z.accessToken,
         refreshToken: Z.refreshToken,
         expiresIn: Z.expiresIn
       };
-      if (me && re)
-        return a(re, { tokens: Re, redirectPath: J }), Z;
-      if (J && J !== window.location.pathname)
-        return a(re || o || "", { tokens: Re, redirectPath: J }), Z;
-      if (!Pe && Z.tenants && Z.tenants.length > 0) {
-        const Se = H.autoSwitch !== !1 && n.autoSwitchSingleTenant !== !1;
-        if (Z.tenants.length === 1 && Se) {
+      if (ye && re)
+        return a(re, { tokens: Ie, redirectPath: K }), Z;
+      if (K && K !== window.location.pathname)
+        return a(re || o || "", { tokens: Ie, redirectPath: K }), Z;
+      if (!Re && Z.tenants && Z.tenants.length > 0) {
+        const ve = H.autoSwitch !== !1 && n.autoSwitchSingleTenant !== !1;
+        if (Z.tenants.length === 1 && ve) {
           const qe = Z.tenants[0];
-          return a(qe.subdomain, { tokens: Re, redirectPath: J }), Z;
+          return a(qe.subdomain, { tokens: Ie, redirectPath: K }), Z;
         } else Z.tenants.length > 1 && n.onTenantSelectionRequired && n.onTenantSelectionRequired(Z.tenants);
       }
       return Z;
-    }, xe = async (H) => {
-      const { email: z, phoneNumber: Y, name: V, password: J, lastName: te, tenantId: re } = H;
+    }, Ae = async (H) => {
+      const { email: z, phoneNumber: Y, name: V, password: K, lastName: te, tenantId: re } = H;
       if (!z && !Y)
         throw new Error("Either email or phoneNumber is required");
-      if (!V || !J)
+      if (!V || !K)
         throw new Error("Name and password are required");
       const ne = re ?? (i == null ? void 0 : i.id);
       return await S.signup({
         email: z,
         phoneNumber: Y,
         name: V,
-        password: J,
+        password: K,
         tenantId: ne,
         lastName: te,
         appId: t
       });
     }, tt = async (H) => {
-      const { email: z, phoneNumber: Y, name: V, password: J, tenantName: te, lastName: re } = H;
+      const { email: z, phoneNumber: Y, name: V, password: K, tenantName: te, lastName: re } = H;
       if (!z && !Y)
         throw new Error("Either email or phoneNumber is required");
-      if (!V || !J || !te)
+      if (!V || !K || !te)
         throw new Error("Name, password, and tenantName are required");
       return await S.signupTenantAdmin({
         email: z,
         phoneNumber: Y,
         name: V,
-        password: J,
+        password: K,
         tenantName: te,
         appId: t,
         lastName: re
@@ -1230,7 +1249,7 @@ function vr({ config: n = {}, children: e }) {
       const { token: z, newPassword: Y } = H;
       await S.confirmPasswordReset({ token: z, newPassword: Y });
     }, it = async (H) => {
-      const { email: z, frontendUrl: Y, name: V, lastName: J, tenantId: te } = H, re = te ?? (i == null ? void 0 : i.id);
+      const { email: z, frontendUrl: Y, name: V, lastName: K, tenantId: te } = H, re = te ?? (i == null ? void 0 : i.id);
       if (!re)
         throw new Error("tenantId is required for magic link authentication");
       return await S.sendMagicLink({
@@ -1238,20 +1257,20 @@ function vr({ config: n = {}, children: e }) {
         tenantId: re,
         frontendUrl: Y,
         name: V,
-        lastName: J,
+        lastName: K,
         appId: t
       });
     }, ot = async (H) => {
       const { token: z, email: Y, tenantSlug: V } = H;
-      let J = i == null ? void 0 : i.id, te = o, re = l;
-      V && (J = (await new ye(C, t).getPublicTenantInfo(V)).id, te = V);
+      let K = i == null ? void 0 : i.id, te = o, re = l;
+      V && (K = (await new we(C, t).getPublicTenantInfo(V)).id, te = V);
       const ne = await S.verifyMagicLink({
         token: z,
         email: Y,
         appId: t,
-        tenantId: J
+        tenantId: K
       }), Z = V && V !== o;
-      if (Z && (re = new Ie({
+      if (Z && (re = new pe({
         tenantSlug: te,
         baseUrl: r
       })), re.setTokens({
@@ -1262,8 +1281,8 @@ function vr({ config: n = {}, children: e }) {
         re.setUser(ne.user), p(ne.user);
         try {
           await G();
-        } catch (me) {
-          console.warn("Failed to load complete user data after magic link login:", me);
+        } catch (ye) {
+          console.warn("Failed to load complete user data after magic link login:", ye);
         }
       }
       return Z && te && te !== o && a(te, {
@@ -1286,7 +1305,7 @@ function vr({ config: n = {}, children: e }) {
         expiresIn: z.expiresIn
       });
     }, lt = () => {
-      l.clearSession(), p(null), M(null), m([]), L(!1);
+      l.clearSession(), p(null), E(null), m([]), L(!1);
       try {
         localStorage.removeItem("userTenants");
       } catch {
@@ -1294,7 +1313,7 @@ function vr({ config: n = {}, children: e }) {
     }, ct = (H) => {
       l.setTokens(H);
     }, dt = () => l.hasValidSession(), ut = () => {
-      l.clearSession(), p(null), M(null);
+      l.clearSession(), p(null), E(null);
     }, ht = async () => {
       if (t)
         try {
@@ -1308,7 +1327,7 @@ function vr({ config: n = {}, children: e }) {
         }
     }, pt = async () => {
       await ht();
-    }, Ae = (H) => {
+    }, Pe = (H) => {
       if (!Q || Q.length === 0)
         return !1;
       if (typeof H == "string")
@@ -1321,8 +1340,8 @@ function vr({ config: n = {}, children: e }) {
       isAuthenticated: O,
       sessionManager: l,
       authenticatedHttpService: C,
-      login: ke,
-      signup: xe,
+      login: xe,
+      signup: Ae,
       signupTenantAdmin: tt,
       sendMagicLink: it,
       verifyMagicLink: ot,
@@ -1345,34 +1364,34 @@ function vr({ config: n = {}, children: e }) {
       userPermissions: Q,
       availableRoles: f,
       rolesLoading: w,
-      hasPermission: Ae,
-      hasAnyPermission: (H) => H.some((z) => Ae(z)),
-      hasAllPermissions: (H) => H.every((z) => Ae(z)),
+      hasPermission: Pe,
+      hasAnyPermission: (H) => H.some((z) => Pe(z)),
+      hasAllPermissions: (H) => H.every((z) => Pe(z)),
       getUserPermissionStrings: () => Q || [],
       refreshRoles: pt,
       // RFC-004: Multi-tenant user membership
       userTenants: k,
-      hasTenantContext: E,
+      hasTenantContext: M,
       switchToTenant: async (H, z) => {
         const { redirectPath: Y } = z || {}, V = l.getTokens();
         if (!(V != null && V.refreshToken))
           throw new Error("No refresh token available for tenant switch");
-        const J = await S.switchTenant({
+        const K = await S.switchTenant({
           refreshToken: V.refreshToken,
           tenantId: H
         });
         l.setTokens({
-          accessToken: J.accessToken,
+          accessToken: K.accessToken,
           refreshToken: V.refreshToken,
           // Keep the same refresh token
-          expiresIn: J.expiresIn
-        }), p(J.user), l.setUser(J.user), L(!0);
+          expiresIn: K.expiresIn
+        }), p(K.user), l.setUser(K.user), L(!0);
         const te = k.find((re) => re.id === H);
         te && a(te.subdomain, {
           tokens: {
-            accessToken: J.accessToken,
+            accessToken: K.accessToken,
             refreshToken: V.refreshToken,
-            expiresIn: J.expiresIn
+            expiresIn: K.expiresIn
           },
           redirectPath: Y
         });
@@ -1403,19 +1422,21 @@ function vr({ config: n = {}, children: e }) {
     x,
     F,
     k,
-    E,
+    M,
     h,
     j,
     Q,
     A,
     q
   ]);
-  ee(() => {
+  ee(() => () => {
+    l.destroy();
+  }, [l]), ee(() => {
     !n.initialRoles && t && (async () => {
       try {
         c(!0);
-        const ue = new le(r), ke = new ze(ue), { roles: xe } = await ke.getRolesByApp(t);
-        g(xe);
+        const ue = new le(r), xe = new ze(ue), { roles: Ae } = await xe.getRolesByApp(t);
+        g(Ae);
       } catch (ue) {
         console.error("Failed to fetch roles:", ue);
       } finally {
@@ -1537,12 +1558,12 @@ class Rt {
     })).data;
   }
 }
-const Ce = pe(null);
+const Ce = fe(null);
 function Tr({ config: n = {}, children: e }) {
-  const t = Ze(), r = Te(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (t == null ? void 0 : t.appId) ?? "", a = (r == null ? void 0 : r.tenant) ?? null, [f, g] = T([]), [w, c] = T(!1), [I, p] = T(null), [x, R] = T(!1), F = K(() => {
+  const t = Ze(), r = ke(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (t == null ? void 0 : t.appId) ?? "", a = (r == null ? void 0 : r.tenant) ?? null, [f, g] = T([]), [w, c] = T(!1), [I, p] = T(null), [x, R] = T(!1), F = J(() => {
     const u = new le(i);
     return new Rt(u);
-  }, [i]), M = async () => {
+  }, [i]), E = async () => {
     if (!(a != null && a.id)) {
       g([]);
       return;
@@ -1560,19 +1581,19 @@ function Tr({ config: n = {}, children: e }) {
   };
   ee(() => {
     if (!i || !o) return;
-    M().finally(() => R(!0));
-    const u = n.refreshInterval || 5 * 60 * 1e3, k = setInterval(M, u);
+    E().finally(() => R(!0));
+    const u = n.refreshInterval || 5 * 60 * 1e3, k = setInterval(E, u);
     return () => clearInterval(k);
   }, [a == null ? void 0 : a.id, i, o, n.refreshInterval]);
-  const A = K(() => {
+  const A = J(() => {
     const u = (D) => {
       const P = f.find((U) => U.key === D);
       return (P == null ? void 0 : P.value) === !0;
     }, k = (D) => f.find((P) => P.key === D), m = (D) => {
       const P = f.find((U) => U.key === D);
       return P ? P.value ? "enabled" : "disabled" : "not_found";
-    }, E = async () => {
-      await M();
+    }, M = async () => {
+      await E();
     }, L = !!(i && o) && (x || !(a != null && a.id));
     return {
       featureFlags: f,
@@ -1582,7 +1603,7 @@ function Tr({ config: n = {}, children: e }) {
       isEnabled: u,
       getFlag: k,
       getFlagState: m,
-      refresh: E
+      refresh: M
     };
   }, [f, w, I, i, o, a == null ? void 0 : a.id, x]);
   return /* @__PURE__ */ s(Ce.Provider, { value: A, children: e });
@@ -1593,10 +1614,10 @@ function It() {
     throw new Error("useFeatureFlags must be used within a FeatureFlagProvider");
   return n;
 }
-function Ke() {
+function Je() {
   return ae(Ce);
 }
-class Mt {
+class Et {
   constructor(e, t) {
     this.httpService = e, this.sessionManager = t;
   }
@@ -1662,11 +1683,11 @@ class Mt {
     )).data;
   }
 }
-const Ue = pe(void 0);
+const Ue = fe(void 0);
 function kr({ config: n = {}, children: e }) {
-  const t = Ze(), r = Te(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (r == null ? void 0 : r.tenant) ?? null, [a, f] = T(null), [g, w] = T(!1), [c, I] = T(null), [p, x] = T(!1), R = K(() => {
+  const t = Ze(), r = ke(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (r == null ? void 0 : r.tenant) ?? null, [a, f] = T(null), [g, w] = T(!1), [c, I] = T(null), [p, x] = T(!1), R = J(() => {
     const A = new le(i);
-    return new Mt(A);
+    return new Et(A);
   }, [i]), F = async () => {
     if (!(o != null && o.id)) {
       f(null);
@@ -1688,14 +1709,14 @@ function kr({ config: n = {}, children: e }) {
     const A = n.refreshInterval || 10 * 60 * 1e3, u = setInterval(F, A);
     return () => clearInterval(u);
   }, [o == null ? void 0 : o.id, i, n.refreshInterval]);
-  const M = K(() => {
+  const E = J(() => {
     const A = (a == null ? void 0 : a.features) || [], u = (P) => {
       const U = A.find((l) => l.key === P);
       return U ? U.type === "BOOLEAN" || U.type === "boolean" ? U.value === !0 : !!U.value : !1;
     }, k = (P) => A.find((U) => U.key === P), m = (P, U) => {
       const l = A.find((N) => N.key === P);
       return l ? l.value : U;
-    }, E = (P) => !a || !a.isActive ? !1 : P.includes(a.planId), L = async () => {
+    }, M = (P) => !a || !a.isActive ? !1 : P.includes(a.planId), L = async () => {
       await F();
     }, D = !!i && (p || !(o != null && o.id));
     return {
@@ -1707,19 +1728,19 @@ function kr({ config: n = {}, children: e }) {
       isFeatureEnabled: u,
       getFeature: k,
       getFeatureValue: m,
-      hasAllowedPlan: E,
+      hasAllowedPlan: M,
       refresh: L
     };
   }, [a, g, c, i, o == null ? void 0 : o.id, p]);
-  return /* @__PURE__ */ s(Ue.Provider, { value: M, children: e });
+  return /* @__PURE__ */ s(Ue.Provider, { value: E, children: e });
 }
-function Et() {
+function Mt() {
   const n = ae(Ue);
   if (n === void 0)
     throw new Error("useSubscription must be used within a SubscriptionProvider");
   return n;
 }
-function Je() {
+function Ke() {
   return ae(Ue) ?? null;
 }
 var oe = /* @__PURE__ */ ((n) => (n.SUPERUSER = "SUPERUSER", n.TENANT_ADMIN = "TENANT_ADMIN", n.USER = "USER", n))(oe || {});
@@ -1748,9 +1769,9 @@ const $e = {
   admin: { tenant: "required", auth: "required", userType: oe.TENANT_ADMIN },
   // Fully open
   open: { tenant: "optional", auth: "optional" }
-}, He = pe(null);
+}, He = fe(null);
 function xr({ config: n = {}, children: e }) {
-  const t = K(() => {
+  const t = J(() => {
     const r = {
       ...$e,
       ...n.zoneRoots
@@ -1991,7 +2012,7 @@ function Rr({
   requireAllPermissions: i = !1,
   fallback: o
 }) {
-  const { hasValidSession: a, sessionManager: f, hasPermission: g, hasAnyPermission: w, hasAllPermissions: c } = de(), I = ve();
+  const { hasValidSession: a, sessionManager: f, hasPermission: g, hasAnyPermission: w, hasAllPermissions: c } = de(), I = Te();
   if (ee(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] ProtectedRoute is deprecated. Use AuthenticatedZone or AdminZone from ZoneRoute instead."
@@ -1999,11 +2020,11 @@ function Rr({
   }, []), !a())
     return o ? /* @__PURE__ */ s(_, { children: o }) : /* @__PURE__ */ d(_, { children: [
       /* @__PURE__ */ s(Dt, { redirectPath: e }),
-      /* @__PURE__ */ s(we, { to: e, state: { from: I.pathname }, replace: !0 })
+      /* @__PURE__ */ s(be, { to: e, state: { from: I.pathname }, replace: !0 })
     ] });
   const p = f.getUser();
   if (!p)
-    return /* @__PURE__ */ s(we, { to: e, state: { from: I.pathname }, replace: !0 });
+    return /* @__PURE__ */ s(be, { to: e, state: { from: I.pathname }, replace: !0 });
   if (t && !Nt(p.userType, t))
     return /* @__PURE__ */ s(
       je,
@@ -2056,14 +2077,14 @@ const Ct = ({ redirectPath: n }) => /* @__PURE__ */ s(
   }
 );
 function Ir({ children: n, redirectTo: e = "/", fallback: t }) {
-  const { tenant: r, isLoading: i, error: o } = ge(), a = ve();
+  const { tenant: r, isLoading: i, error: o } = me(), a = Te();
   return ee(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] TenantRoute is deprecated. Use TenantZone from ZoneRoute instead."
     );
   }, []), i || o ? null : r ? /* @__PURE__ */ s(_, { children: n }) : t ? /* @__PURE__ */ s(_, { children: t }) : /* @__PURE__ */ d(_, { children: [
     /* @__PURE__ */ s(Ct, { redirectPath: e }),
-    /* @__PURE__ */ s(we, { to: e, state: { from: a.pathname }, replace: !0 })
+    /* @__PURE__ */ s(be, { to: e, state: { from: a.pathname }, replace: !0 })
   ] });
 }
 const Ut = ({ redirectPath: n }) => /* @__PURE__ */ s(
@@ -2103,15 +2124,15 @@ const Ut = ({ redirectPath: n }) => /* @__PURE__ */ s(
     )
   }
 );
-function Mr({ children: n, redirectTo: e = "/dashboard", fallback: t }) {
-  const { tenant: r, isLoading: i, error: o } = ge(), a = ve();
+function Er({ children: n, redirectTo: e = "/dashboard", fallback: t }) {
+  const { tenant: r, isLoading: i, error: o } = me(), a = Te();
   return ee(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] LandingRoute is deprecated. Use PublicZone from ZoneRoute instead."
     );
   }, []), i || o ? null : r ? t ? /* @__PURE__ */ s(_, { children: t }) : /* @__PURE__ */ d(_, { children: [
     /* @__PURE__ */ s(Ut, { redirectPath: e }),
-    /* @__PURE__ */ s(we, { to: e, state: { from: a.pathname }, replace: !0 })
+    /* @__PURE__ */ s(be, { to: e, state: { from: a.pathname }, replace: !0 })
   ] }) : /* @__PURE__ */ s(_, { children: n });
 }
 function $t(n, e) {
@@ -2151,10 +2172,10 @@ const ce = ({
   loadingFallback: c,
   accessDeniedFallback: I
 }) => {
-  const p = ve(), { isAuthenticated: x, isAuthInitializing: R, currentUser: F, userPermissions: M } = de(), { tenant: A, isTenantLoading: u } = fe(), k = Lt(), m = K(() => {
+  const p = Te(), { isAuthenticated: x, isAuthInitializing: R, currentUser: F, userPermissions: E } = de(), { tenant: A, isTenantLoading: u } = ge(), k = Lt(), m = J(() => {
     if (e)
       return k.presets[e];
-  }, [e, k.presets]), E = K(
+  }, [e, k.presets]), M = J(
     () => ({
       tenant: t ?? (m == null ? void 0 : m.tenant),
       auth: r ?? (m == null ? void 0 : m.auth),
@@ -2163,29 +2184,29 @@ const ce = ({
       requireAllPermissions: a
     }),
     [t, r, i, o, m, a]
-  ), L = K(
+  ), L = J(
     () => ({
       hasTenant: !!A,
       isAuthenticated: x,
       userType: F == null ? void 0 : F.userType,
-      permissions: M,
+      permissions: E,
       isLoading: R || u
     }),
     [
       A,
       x,
       F == null ? void 0 : F.userType,
-      M,
+      E,
       R,
       u
     ]
-  ), D = K(() => L.isLoading ? null : Ht(E, L), [E, L]), P = K(() => D ? w || Bt(L, k.zoneRoots) : null, [D, w, L, k.zoneRoots]), U = K(() => !D || !P ? null : {
+  ), D = J(() => L.isLoading ? null : Ht(M, L), [M, L]), P = J(() => D ? w || Bt(L, k.zoneRoots) : null, [D, w, L, k.zoneRoots]), U = J(() => !D || !P ? null : {
     type: D,
     required: {
-      tenant: E.tenant,
-      auth: E.auth,
-      userType: E.userType,
-      permissions: E.permissions
+      tenant: M.tenant,
+      auth: M.auth,
+      userType: M.userType,
+      permissions: M.permissions
     },
     current: {
       hasTenant: L.hasTenant,
@@ -2194,7 +2215,7 @@ const ce = ({
       permissions: L.permissions
     },
     redirectTo: P
-  }, [D, P, E, L]);
+  }, [D, P, M, L]);
   if (ee(() => {
     U && (g ? g(U) : k.onAccessDenied && k.onAccessDenied(U));
   }, [U, g, k]), ee(() => {
@@ -2218,10 +2239,10 @@ const ce = ({
       k.returnToParam,
       k.returnToStorage
     );
-    return /* @__PURE__ */ s(we, { to: N, replace: !0 });
+    return /* @__PURE__ */ s(be, { to: N, replace: !0 });
   }
   return /* @__PURE__ */ s(_, { children: n });
-}, Er = (n) => /* @__PURE__ */ s(ce, { tenant: "required", ...n }), Lr = (n) => /* @__PURE__ */ s(ce, { tenant: "forbidden", ...n }), Fr = (n) => /* @__PURE__ */ s(ce, { auth: "required", ...n }), Dr = (n) => /* @__PURE__ */ s(ce, { auth: "forbidden", ...n }), Nr = (n) => /* @__PURE__ */ s(ce, { auth: "required", userType: oe.TENANT_ADMIN, ...n }), Cr = (n) => /* @__PURE__ */ s(ce, { auth: "required", userType: oe.USER, ...n }), Ur = (n) => /* @__PURE__ */ s(ce, { tenant: "optional", auth: "optional", ...n }), $r = (n) => /* @__PURE__ */ s(ce, { tenant: "required", auth: "required", ...n }), Hr = (n) => /* @__PURE__ */ s(ce, { tenant: "required", auth: "optional", ...n }), Br = (n) => /* @__PURE__ */ s(ce, { tenant: "required", auth: "forbidden", ...n }), zt = () => /* @__PURE__ */ d(
+}, Mr = (n) => /* @__PURE__ */ s(ce, { tenant: "required", ...n }), Lr = (n) => /* @__PURE__ */ s(ce, { tenant: "forbidden", ...n }), Fr = (n) => /* @__PURE__ */ s(ce, { auth: "required", ...n }), Dr = (n) => /* @__PURE__ */ s(ce, { auth: "forbidden", ...n }), Nr = (n) => /* @__PURE__ */ s(ce, { auth: "required", userType: oe.TENANT_ADMIN, ...n }), Cr = (n) => /* @__PURE__ */ s(ce, { auth: "required", userType: oe.USER, ...n }), Ur = (n) => /* @__PURE__ */ s(ce, { tenant: "optional", auth: "optional", ...n }), $r = (n) => /* @__PURE__ */ s(ce, { tenant: "required", auth: "required", ...n }), Hr = (n) => /* @__PURE__ */ s(ce, { tenant: "required", auth: "optional", ...n }), Br = (n) => /* @__PURE__ */ s(ce, { tenant: "required", auth: "forbidden", ...n }), zt = () => /* @__PURE__ */ d(
   "div",
   {
     style: {
@@ -2244,7 +2265,7 @@ function qr({
   allowedPlans: t,
   requiredFeature: r
 }) {
-  const { subscription: i, hasAllowedPlan: o, isFeatureEnabled: a, loading: f } = Et();
+  const { subscription: i, hasAllowedPlan: o, isFeatureEnabled: a, loading: f } = Mt();
   return f ? /* @__PURE__ */ s(
     "div",
     {
@@ -2473,16 +2494,16 @@ function zr({
   showMagicLinkOption: c = !0,
   className: I
 }) {
-  const [p, x] = T(""), [R, F] = T(""), [M, A] = T(!1), [u, k] = T(!1), [m, E] = T(""), [L, D] = T({}), { login: P } = de(), { tenant: U } = ge(), l = { ...Gt, ...n }, N = { ...Qt, ...e }, $ = { ...jt, ...t }, h = () => {
+  const [p, x] = T(""), [R, F] = T(""), [E, A] = T(!1), [u, k] = T(!1), [m, M] = T(""), [L, D] = T({}), { login: P } = de(), { tenant: U } = me(), l = { ...Gt, ...n }, N = { ...Qt, ...e }, $ = { ...jt, ...t }, h = () => {
     const y = {};
     return p.trim() || (y.username = !0), R.trim() || (y.password = !0), D(y), Object.keys(y).length === 0;
   }, C = async (y) => {
     if (y.preventDefault(), !!h()) {
       if (!(U != null && U.id)) {
-        E("Tenant not found");
+        M("Tenant not found");
         return;
       }
-      k(!0), E("");
+      k(!0), M("");
       try {
         const v = await P({
           username: p,
@@ -2492,7 +2513,7 @@ function zr({
         r == null || r(v);
       } catch (v) {
         const j = v.message || l.errorMessage;
-        E(j), i == null || i(j);
+        M(j), i == null || i(j);
       } finally {
         k(!1);
       }
@@ -2534,7 +2555,7 @@ function zr({
             {
               id: "password",
               name: "password",
-              type: M ? "text" : "password",
+              type: E ? "text" : "password",
               value: R,
               onChange: (y) => {
                 F(y.target.value), L.password && D((v) => ({ ...v, password: !1 }));
@@ -2552,11 +2573,11 @@ function zr({
             "button",
             {
               type: "button",
-              onClick: () => A(!M),
+              onClick: () => A(!E),
               style: N.passwordToggle,
               disabled: u,
-              "aria-label": M ? "Hide password" : "Show password",
-              children: M ? $.hidePassword : $.showPassword
+              "aria-label": E ? "Hide password" : "Show password",
+              children: E ? $.hidePassword : $.showPassword
             }
           )
         ] })
@@ -2611,7 +2632,7 @@ const Zt = {
   passwordMismatchError: "Passwords do not match",
   isAdminLabel: "Create new organization",
   isAdminDescription: "Check this if you want to create a new organization"
-}, Kt = {
+}, Jt = {
   container: {
     maxWidth: "400px",
     width: "100%",
@@ -2722,9 +2743,9 @@ function _r({
   showMagicLinkOption: g = !0,
   className: w
 }) {
-  const [c, I] = T(""), [p, x] = T(""), [R, F] = T(""), [M, A] = T(""), [u, k] = T(""), [m, E] = T(""), [L, D] = T(""), [P, U] = T(!1), [l, N] = T(""), [$, h] = T({}), { signup: C, signupTenantAdmin: S } = de(), { tenant: b } = ge(), y = { ...Zt, ...n }, v = { ...Kt, ...e }, j = () => {
+  const [c, I] = T(""), [p, x] = T(""), [R, F] = T(""), [E, A] = T(""), [u, k] = T(""), [m, M] = T(""), [L, D] = T(""), [P, U] = T(!1), [l, N] = T(""), [$, h] = T({}), { signup: C, signupTenantAdmin: S } = de(), { tenant: b } = me(), y = { ...Zt, ...n }, v = { ...Jt, ...e }, j = () => {
     const B = {};
-    return c.trim() || (B.name = !0), !R.trim() && !M.trim() && (B.email = !0, B.phoneNumber = !0), u.trim() || (B.password = !0), m.trim() || (B.confirmPassword = !0), t === "tenant" && !L.trim() && (B.tenantName = !0), h(B), Object.keys(B).length === 0;
+    return c.trim() || (B.name = !0), !R.trim() && !E.trim() && (B.email = !0, B.phoneNumber = !0), u.trim() || (B.password = !0), m.trim() || (B.confirmPassword = !0), t === "tenant" && !L.trim() && (B.tenantName = !0), h(B), Object.keys(B).length === 0;
   }, Q = async (B) => {
     if (B.preventDefault(), !!j()) {
       if (u !== m) {
@@ -2740,14 +2761,14 @@ function _r({
         let X;
         t === "tenant" ? X = await S({
           email: R || void 0,
-          phoneNumber: M || void 0,
+          phoneNumber: E || void 0,
           name: c,
           password: u,
           tenantName: L,
           lastName: p || void 0
         }) : X = await C({
           email: R || void 0,
-          phoneNumber: M || void 0,
+          phoneNumber: E || void 0,
           name: c,
           password: u,
           tenantId: b.id,
@@ -2766,8 +2787,8 @@ function _r({
   }), q = () => ({
     ...v.button,
     ...P ? v.buttonLoading : {},
-    ...!c || !R && !M || !u || !m || P || t === "tenant" && !L ? v.buttonDisabled : {}
-  }), W = c && (R || M) && u && m && (t === "user" || L);
+    ...!c || !R && !E || !u || !m || P || t === "tenant" && !L ? v.buttonDisabled : {}
+  }), W = c && (R || E) && u && m && (t === "user" || L);
   return /* @__PURE__ */ d("div", { className: w, style: v.container, children: [
     /* @__PURE__ */ s("h2", { style: v.title, children: y.title }),
     /* @__PURE__ */ d("form", { onSubmit: Q, style: v.form, children: [
@@ -2831,7 +2852,7 @@ function _r({
             id: "phoneNumber",
             name: "phoneNumber",
             type: "tel",
-            value: M,
+            value: E,
             onChange: (B) => {
               A(B.target.value), $.phoneNumber && h((X) => ({ ...X, email: !1, phoneNumber: !1 }));
             },
@@ -2881,7 +2902,7 @@ function _r({
             type: "password",
             value: m,
             onChange: (B) => {
-              E(B.target.value), $.confirmPassword && h((X) => ({ ...X, confirmPassword: !1 })), l === y.passwordMismatchError && N("");
+              M(B.target.value), $.confirmPassword && h((X) => ({ ...X, confirmPassword: !1 })), l === y.passwordMismatchError && N("");
             },
             placeholder: y.confirmPasswordPlaceholder,
             style: O("confirmPassword"),
@@ -2929,7 +2950,7 @@ function _r({
     ] })
   ] });
 }
-const Jt = {
+const Kt = {
   title: "Sign In with Magic Link",
   emailLabel: "Email",
   emailPlaceholder: "Enter your email",
@@ -3062,16 +3083,16 @@ function Wr({
   verifyToken: g,
   frontendUrl: w
 }) {
-  const [c, I] = T(""), [p, x] = T(""), [R, F] = T(""), [M, A] = T(!1), [u, k] = T(!1), [m, E] = T(""), [L, D] = T(""), [P, U] = T({}), [l, N] = T(!1), { sendMagicLink: $, verifyMagicLink: h } = de(), { tenant: C } = ge(), S = { ...Jt, ...n }, b = { ...Yt, ...e };
+  const [c, I] = T(""), [p, x] = T(""), [R, F] = T(""), [E, A] = T(!1), [u, k] = T(!1), [m, M] = T(""), [L, D] = T(""), [P, U] = T({}), [l, N] = T(!1), { sendMagicLink: $, verifyMagicLink: h } = de(), { tenant: C } = me(), S = { ...Kt, ...n }, b = { ...Yt, ...e };
   ee(() => {
     g && y(g);
   }, [g]);
   const y = async (q) => {
     if (!C || !c) {
-      E("Missing tenant or email");
+      M("Missing tenant or email");
       return;
     }
-    k(!0), E("");
+    k(!0), M("");
     try {
       const W = await h({
         token: q,
@@ -3081,7 +3102,7 @@ function Wr({
       t == null || t(W);
     } catch (W) {
       const B = W.message || "Failed to verify magic link";
-      E(B), r == null || r(B);
+      M(B), r == null || r(B);
     } finally {
       k(!1);
     }
@@ -3091,10 +3112,10 @@ function Wr({
   }, j = async (q) => {
     if (q.preventDefault(), !!v()) {
       if (!(C != null && C.id)) {
-        E("Tenant not found");
+        M("Tenant not found");
         return;
       }
-      A(!0), E(""), D("");
+      A(!0), M(""), D("");
       try {
         const W = w || (typeof window < "u" ? window.location.origin : ""), B = await $({
           email: c,
@@ -3106,7 +3127,7 @@ function Wr({
         D(S.successMessage), t == null || t(B);
       } catch (W) {
         const B = W.message || S.errorMessage;
-        E(B), r == null || r(B);
+        M(B), r == null || r(B);
       } finally {
         A(!1);
       }
@@ -3116,8 +3137,8 @@ function Wr({
     ...P[q] ? b.inputError : {}
   }), O = () => ({
     ...b.button,
-    ...M || u ? b.buttonLoading : {},
-    ...!c || M || u ? b.buttonDisabled : {}
+    ...E || u ? b.buttonLoading : {},
+    ...!c || E || u ? b.buttonDisabled : {}
   });
   return u ? /* @__PURE__ */ d("div", { className: f, style: b.container, children: [
     /* @__PURE__ */ s("h2", { style: b.title, children: S.verifyingText }),
@@ -3140,7 +3161,7 @@ function Wr({
             },
             placeholder: S.emailPlaceholder,
             style: Q("email"),
-            disabled: M || u
+            disabled: E || u
           }
         )
       ] }),
@@ -3175,7 +3196,7 @@ function Wr({
               },
               placeholder: S.namePlaceholder,
               style: Q("name"),
-              disabled: M || u
+              disabled: E || u
             }
           )
         ] }),
@@ -3191,7 +3212,7 @@ function Wr({
               onChange: (q) => F(q.target.value),
               placeholder: S.lastNamePlaceholder,
               style: b.input,
-              disabled: M || u
+              disabled: E || u
             }
           )
         ] }),
@@ -3214,7 +3235,7 @@ function Wr({
           }
         ) })
       ] }),
-      /* @__PURE__ */ s("button", { type: "submit", disabled: !c || M || u, style: O(), children: M ? S.loadingText : S.submitButton }),
+      /* @__PURE__ */ s("button", { type: "submit", disabled: !c || E || u, style: O(), children: E ? S.loadingText : S.submitButton }),
       m && /* @__PURE__ */ s("div", { style: b.errorText, children: m }),
       L && /* @__PURE__ */ s("div", { style: b.successText, children: L })
     ] }),
@@ -3387,7 +3408,7 @@ function Vr({
   tenantSlug: I,
   autoRedirectDelay: p = 3e3
 }) {
-  const [x, R] = T("verifying"), [F, M] = T(""), { verifyMagicLink: A } = de(), u = { ...Xt, ...n }, k = { ...Xe, ...e }, m = { ...nr, ...t }, E = () => {
+  const [x, R] = T("verifying"), [F, E] = T(""), { verifyMagicLink: A } = de(), u = { ...Xt, ...n }, k = { ...Xe, ...e }, m = { ...nr, ...t }, M = () => {
     if (typeof window > "u") return {};
     const l = new URLSearchParams(window.location.search);
     return {
@@ -3397,9 +3418,9 @@ function Vr({
       tenantSlug: I || l.get("tenantSlug") || void 0
     };
   }, L = async () => {
-    R("verifying"), M("");
+    R("verifying"), E("");
     try {
-      const l = E();
+      const l = M();
       if (!l.token || !l.email)
         throw new Error("Missing required parameters: token or email");
       const N = await A({
@@ -3412,7 +3433,7 @@ function Vr({
       }, p);
     } catch (l) {
       const N = l.message || u.errorMessage;
-      M(N), R("error"), i == null || i(N);
+      E(N), R("error"), i == null || i(N);
     }
   }, D = () => {
     o == null || o(), L();
@@ -3614,7 +3635,7 @@ function jr({
   onModeChange: f,
   className: g
 }) {
-  const [w, c] = T(""), [I, p] = T(r), [x, R] = T(""), [F, M] = T(""), [A, u] = T(!1), [k, m] = T(""), [E, L] = T(""), [D, P] = T({}), { requestPasswordReset: U, confirmPasswordReset: l } = de(), { tenant: N } = ge(), $ = { ...sr, ...n }, h = { ...ir, ...e }, C = () => {
+  const [w, c] = T(""), [I, p] = T(r), [x, R] = T(""), [F, E] = T(""), [A, u] = T(!1), [k, m] = T(""), [M, L] = T(""), [D, P] = T({}), { requestPasswordReset: U, confirmPasswordReset: l } = de(), { tenant: N } = me(), $ = { ...sr, ...n }, h = { ...ir, ...e }, C = () => {
     const O = {};
     return w.trim() || (O.email = !0), P(O), Object.keys(O).length === 0;
   }, S = () => {
@@ -3705,7 +3726,7 @@ function jr({
               type: "password",
               value: F,
               onChange: (q) => {
-                M(q.target.value), D.confirmPassword && P((W) => ({ ...W, confirmPassword: !1 })), k === $.passwordMismatchError && m("");
+                E(q.target.value), D.confirmPassword && P((W) => ({ ...W, confirmPassword: !1 })), k === $.passwordMismatchError && m("");
               },
               placeholder: $.confirmPasswordPlaceholder,
               style: v("confirmPassword"),
@@ -3726,7 +3747,7 @@ function jr({
           }
         ),
         k && /* @__PURE__ */ s("div", { style: h.errorText, children: k }),
-        E && /* @__PURE__ */ s("div", { style: h.successText, children: E })
+        M && /* @__PURE__ */ s("div", { style: h.successText, children: M })
       ] }),
       /* @__PURE__ */ d("div", { style: h.linkContainer, children: [
         /* @__PURE__ */ s("a", { onClick: a, style: h.link, children: $.backToLoginLink }),
@@ -3771,7 +3792,7 @@ function jr({
         }
       ),
       k && /* @__PURE__ */ s("div", { style: h.errorText, children: k }),
-      E && /* @__PURE__ */ s("div", { style: h.successText, children: E })
+      M && /* @__PURE__ */ s("div", { style: h.successText, children: M })
     ] }),
     /* @__PURE__ */ d("div", { style: h.linkContainer, children: [
       /* @__PURE__ */ s("a", { onClick: a, style: h.link, children: $.backToLoginLink }),
@@ -3834,8 +3855,8 @@ function Gr({
   errorFallback: t,
   requireTenant: r = !0
 }) {
-  const { isAppLoading: i, appError: o, retryApp: a } = be(), f = Te(), g = Ne(), w = Ke(), c = Je(), I = (f == null ? void 0 : f.isTenantLoading) ?? !1, p = (f == null ? void 0 : f.tenantError) ?? null, x = (f == null ? void 0 : f.tenantSlug) ?? null, R = (f == null ? void 0 : f.retryTenant) ?? (() => {
-  }), F = (g == null ? void 0 : g.isAuthReady) ?? !0, M = (w == null ? void 0 : w.isReady) ?? !0, A = (c == null ? void 0 : c.isReady) ?? !0, u = r && f && x, L = i || u && I || g && !F || w && !M || c && !A, D = o || (u ? p : null), P = () => {
+  const { isAppLoading: i, appError: o, retryApp: a } = Se(), f = ke(), g = Ne(), w = Je(), c = Ke(), I = (f == null ? void 0 : f.isTenantLoading) ?? !1, p = (f == null ? void 0 : f.tenantError) ?? null, x = (f == null ? void 0 : f.tenantSlug) ?? null, R = (f == null ? void 0 : f.retryTenant) ?? (() => {
+  }), F = (g == null ? void 0 : g.isAuthReady) ?? !0, E = (w == null ? void 0 : w.isReady) ?? !0, A = (c == null ? void 0 : c.isReady) ?? !0, u = r && f && x, L = i || u && I || g && !F || w && !E || c && !A, D = o || (u ? p : null), P = () => {
     o && a(), p && f && R();
   };
   if (L)
@@ -3847,12 +3868,12 @@ function Gr({
   return /* @__PURE__ */ s(_, { children: n });
 }
 function Qr(n = !0) {
-  const { isAppLoading: e, appError: t, retryApp: r, appInfo: i } = be(), o = Te(), a = Ne(), f = Ke(), g = Je(), w = (o == null ? void 0 : o.isTenantLoading) ?? !1, c = (o == null ? void 0 : o.tenantError) ?? null, I = (o == null ? void 0 : o.tenant) ?? null, p = (o == null ? void 0 : o.tenantSlug) ?? null, x = (o == null ? void 0 : o.retryTenant) ?? (() => {
-  }), R = (a == null ? void 0 : a.isAuthReady) ?? !0, F = (f == null ? void 0 : f.isReady) ?? !0, M = (g == null ? void 0 : g.isReady) ?? !0, A = n && o && p, E = e || A && w || a && !R || f && !F || g && !M, L = t || (A ? c : null);
+  const { isAppLoading: e, appError: t, retryApp: r, appInfo: i } = Se(), o = ke(), a = Ne(), f = Je(), g = Ke(), w = (o == null ? void 0 : o.isTenantLoading) ?? !1, c = (o == null ? void 0 : o.tenantError) ?? null, I = (o == null ? void 0 : o.tenant) ?? null, p = (o == null ? void 0 : o.tenantSlug) ?? null, x = (o == null ? void 0 : o.retryTenant) ?? (() => {
+  }), R = (a == null ? void 0 : a.isAuthReady) ?? !0, F = (f == null ? void 0 : f.isReady) ?? !0, E = (g == null ? void 0 : g.isReady) ?? !0, A = n && o && p, M = e || A && w || a && !R || f && !F || g && !E, L = t || (A ? c : null);
   return {
-    isLoading: E,
+    isLoading: M,
     error: L,
-    isReady: !E && !L && i !== null && (!A || I !== null),
+    isReady: !M && !L && i !== null && (!A || I !== null),
     retry: () => {
       t && r(), c && o && x();
     },
@@ -3861,7 +3882,7 @@ function Qr(n = !0) {
     tenant: o ? { isLoading: w, error: c, data: I } : null,
     auth: a ? { isReady: R } : null,
     featureFlags: f ? { isReady: F } : null,
-    subscription: g ? { isReady: M } : null
+    subscription: g ? { isReady: E } : null
   };
 }
 function Zr({
@@ -3877,12 +3898,12 @@ function Zr({
   showCurrentTenant: w = !0
 }) {
   var k;
-  const c = Ne(), [I, p] = T(!1), x = Qe(null), R = n ?? (c == null ? void 0 : c.userTenants) ?? [], F = e ?? ((k = c == null ? void 0 : c.currentUser) == null ? void 0 : k.tenantId) ?? null, M = async (m) => {
+  const c = Ne(), [I, p] = T(!1), x = Qe(null), R = n ?? (c == null ? void 0 : c.userTenants) ?? [], F = e ?? ((k = c == null ? void 0 : c.currentUser) == null ? void 0 : k.tenantId) ?? null, E = async (m) => {
     p(!1), t ? t(m) : c != null && c.switchToTenant && await c.switchToTenant(m);
   };
   ee(() => {
-    const m = (E) => {
-      x.current && !x.current.contains(E.target) && p(!1);
+    const m = (M) => {
+      x.current && !x.current.contains(M.target) && p(!1);
     };
     return document.addEventListener("mousedown", m), () => document.removeEventListener("mousedown", m);
   }, []);
@@ -3891,7 +3912,7 @@ function Zr({
     return null;
   if (R.length === 1 && w)
     return /* @__PURE__ */ s("div", { className: r, children: /* @__PURE__ */ s("span", { children: R[0].name }) });
-  const u = (m, E) => /* @__PURE__ */ d("span", { style: { fontWeight: E ? "bold" : "normal" }, children: [
+  const u = (m, M) => /* @__PURE__ */ d("span", { style: { fontWeight: M ? "bold" : "normal" }, children: [
     m.name,
     m.role && /* @__PURE__ */ d("span", { style: { opacity: 0.7, marginLeft: 8 }, children: [
       "(",
@@ -3934,24 +3955,24 @@ function Zr({
           overflowY: "auto"
         },
         children: R.map((m) => {
-          const E = m.id === F;
+          const M = m.id === F;
           return /* @__PURE__ */ s(
             "div",
             {
               className: o,
-              onClick: () => M(m.id),
+              onClick: () => E(m.id),
               style: {
                 padding: "8px 12px",
                 cursor: "pointer",
-                backgroundColor: E ? "#f0f0f0" : "transparent"
+                backgroundColor: M ? "#f0f0f0" : "transparent"
               },
               onMouseEnter: (L) => {
-                E || (L.target.style.backgroundColor = "#f5f5f5");
+                M || (L.target.style.backgroundColor = "#f5f5f5");
               },
               onMouseLeave: (L) => {
-                E || (L.target.style.backgroundColor = "transparent");
+                M || (L.target.style.backgroundColor = "transparent");
               },
-              children: a ? a(m, E) : u(m, E)
+              children: a ? a(m, M) : u(m, M)
             },
             m.id
           );
@@ -3960,7 +3981,7 @@ function Zr({
     )
   ] });
 }
-class Kr {
+class Jr {
   constructor(e, t) {
     this.httpService = e, this.sessionManager = t;
   }
@@ -4028,7 +4049,7 @@ class Kr {
     };
   }
 }
-class Jr {
+class Kr {
   constructor(e, t) {
     this.httpService = e, this.sessionManager = t;
   }
@@ -4210,20 +4231,20 @@ class Xr {
     }), t;
   }
 }
-const et = "returnTo", Me = "zone_return_to", Ee = "zone_return_to";
+const et = "returnTo", Ee = "zone_return_to", Me = "zone_return_to";
 function en(n = {}) {
   const {
     zoneRoots: e = {},
     returnToParam: t = et,
     returnToStorage: r = "url"
-  } = n, i = ft(), [o, a] = gt(), { isAuthenticated: f, currentUser: g } = de(), { tenant: w } = fe(), c = K(() => ({ ...$e, ...e }), [e]), I = !!w, p = g == null ? void 0 : g.userType, x = K(() => {
+  } = n, i = ft(), [o, a] = gt(), { isAuthenticated: f, currentUser: g } = de(), { tenant: w } = ge(), c = J(() => ({ ...$e, ...e }), [e]), I = !!w, p = g == null ? void 0 : g.userType, x = J(() => {
     switch (r) {
       case "url":
         return o.get(t);
       case "session":
-        return sessionStorage.getItem(Me);
+        return sessionStorage.getItem(Ee);
       case "local":
-        return localStorage.getItem(Ee);
+        return localStorage.getItem(Me);
       default:
         return null;
     }
@@ -4235,10 +4256,10 @@ function en(n = {}) {
         break;
       }
       case "session":
-        sessionStorage.removeItem(Me);
+        sessionStorage.removeItem(Ee);
         break;
       case "local":
-        localStorage.removeItem(Ee);
+        localStorage.removeItem(Me);
         break;
     }
   }, [r, o, t, a]), F = se(
@@ -4250,15 +4271,15 @@ function en(n = {}) {
           break;
         }
         case "session":
-          sessionStorage.setItem(Me, u);
+          sessionStorage.setItem(Ee, u);
           break;
         case "local":
-          localStorage.setItem(Ee, u);
+          localStorage.setItem(Me, u);
           break;
       }
     },
     [r, o, t, a]
-  ), M = se(
+  ), E = se(
     (u) => {
       const k = c[u] || c.default;
       i(k);
@@ -4269,7 +4290,7 @@ function en(n = {}) {
     returnToUrl: x,
     clearReturnTo: R,
     setReturnTo: F,
-    navigateToZone: M,
+    navigateToZone: E,
     getSmartRedirect: A
   };
 }
@@ -4296,33 +4317,33 @@ export {
   Dr as GuestZone,
   Yr as HealthApiService,
   le as HttpService,
-  Mr as LandingRoute,
+  Er as LandingRoute,
   zr as LoginForm,
   Wr as MagicLinkForm,
   Vr as MagicLinkVerify,
   Ur as OpenZone,
   jr as PasswordRecoveryForm,
-  Kr as PermissionApiService,
+  Jr as PermissionApiService,
   Pr as Protected,
   Rr as ProtectedRoute,
   Lr as PublicZone,
   ze as RoleApiService,
   xr as RoutingProvider,
   ie as SessionExpiredError,
-  Ie as SessionManager,
+  pe as SessionManager,
   _r as SignupForm,
-  Mt as SubscriptionApiService,
+  Et as SubscriptionApiService,
   qr as SubscriptionGuard,
-  Jr as SubscriptionPlanApiService,
+  Kr as SubscriptionPlanApiService,
   kr as SubscriptionProvider,
-  ye as TenantApiService,
+  we as TenantApiService,
   $r as TenantAuthenticatedZone,
   Br as TenantGuestZone,
   Hr as TenantOpenZone,
   wr as TenantProvider,
   Ir as TenantRoute,
   Zr as TenantSelector,
-  Er as TenantZone,
+  Mr as TenantZone,
   yt as TokenRefreshError,
   mt as TokenRefreshTimeoutError,
   bt as UserApiService,
@@ -4331,17 +4352,17 @@ export {
   ce as ZoneRoute,
   tn as buildRedirectUrl,
   yr as useApi,
-  be as useApp,
+  Se as useApp,
   Qr as useAppLoaderState,
   de as useAuth,
   It as useFeatureFlags,
   Ar as useRouting,
   Lt as useRoutingOptional,
   Sr as useSettings,
-  Et as useSubscription,
-  fe as useTenant,
-  ge as useTenantInfo,
-  Te as useTenantOptional,
+  Mt as useSubscription,
+  ge as useTenant,
+  me as useTenantInfo,
+  ke as useTenantOptional,
   br as useTenantSettings,
   en as useZoneNavigation
 };